summaryrefslogtreecommitdiff
path: root/src/lib/libssl
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libssl')
-rw-r--r--src/lib/libssl/LICENSE127
-rw-r--r--src/lib/libssl/bio_ssl.c555
-rw-r--r--src/lib/libssl/doc/openssl.cnf214
-rw-r--r--src/lib/libssl/doc/openssl.txt1174
-rw-r--r--src/lib/libssl/s23_clnt.c465
-rw-r--r--src/lib/libssl/s23_lib.c213
-rw-r--r--src/lib/libssl/s23_pkt.c117
-rw-r--r--src/lib/libssl/s23_srvr.c503
-rw-r--r--src/lib/libssl/s3_both.c468
-rw-r--r--src/lib/libssl/s3_clnt.c1729
-rw-r--r--src/lib/libssl/s3_lib.c1107
-rw-r--r--src/lib/libssl/s3_pkt.c1041
-rw-r--r--src/lib/libssl/s3_srvr.c1683
-rw-r--r--src/lib/libssl/shlib_version2
-rw-r--r--src/lib/libssl/ssl.h1484
-rw-r--r--src/lib/libssl/ssl2.h265
-rw-r--r--src/lib/libssl/ssl23.h83
-rw-r--r--src/lib/libssl/ssl3.h459
-rw-r--r--src/lib/libssl/ssl_algs.c103
-rw-r--r--src/lib/libssl/ssl_asn1.c327
-rw-r--r--src/lib/libssl/ssl_cert.c716
-rw-r--r--src/lib/libssl/ssl_ciph.c835
-rw-r--r--src/lib/libssl/ssl_err.c416
-rw-r--r--src/lib/libssl/ssl_err2.c70
-rw-r--r--src/lib/libssl/ssl_lib.c1947
-rw-r--r--src/lib/libssl/ssl_locl.h499
-rw-r--r--src/lib/libssl/ssl_rsa.c815
-rw-r--r--src/lib/libssl/ssl_sess.c637
-rw-r--r--src/lib/libssl/ssl_stat.c454
-rw-r--r--src/lib/libssl/ssl_txt.c171
-rw-r--r--src/lib/libssl/t1_clnt.c90
-rw-r--r--src/lib/libssl/t1_enc.c633
-rw-r--r--src/lib/libssl/t1_lib.c145
-rw-r--r--src/lib/libssl/t1_meth.c88
-rw-r--r--src/lib/libssl/t1_srvr.c91
-rw-r--r--src/lib/libssl/test/CAss.cnf25
-rw-r--r--src/lib/libssl/test/CAssdh.cnf24
-rw-r--r--src/lib/libssl/test/CAssdsa.cnf23
-rw-r--r--src/lib/libssl/test/CAssrsa.cnf24
-rw-r--r--src/lib/libssl/test/Sssdsa.cnf27
-rw-r--r--src/lib/libssl/test/Sssrsa.cnf26
-rw-r--r--src/lib/libssl/test/Uss.cnf28
-rw-r--r--src/lib/libssl/test/VMSca-response.11
-rw-r--r--src/lib/libssl/test/VMSca-response.22
-rw-r--r--src/lib/libssl/test/methtest.c105
-rw-r--r--src/lib/libssl/test/pkcs7-1.pem15
-rw-r--r--src/lib/libssl/test/pkcs7.pem54
-rw-r--r--src/lib/libssl/test/r160test.c57
-rw-r--r--src/lib/libssl/test/tcrl81
-rw-r--r--src/lib/libssl/test/test.cnf88
-rw-r--r--src/lib/libssl/test/testca44
-rw-r--r--src/lib/libssl/test/testcrl.pem16
-rw-r--r--src/lib/libssl/test/testenc54
-rw-r--r--src/lib/libssl/test/testgen30
-rw-r--r--src/lib/libssl/test/testp7.pem46
-rw-r--r--src/lib/libssl/test/testreq2.pem7
-rw-r--r--src/lib/libssl/test/testrsa.pem9
-rw-r--r--src/lib/libssl/test/testsid.pem12
-rw-r--r--src/lib/libssl/test/testss90
-rw-r--r--src/lib/libssl/test/testssl75
-rw-r--r--src/lib/libssl/test/testx509.pem10
-rw-r--r--src/lib/libssl/test/times113
-rw-r--r--src/lib/libssl/test/tpkcs751
-rw-r--r--src/lib/libssl/test/tpkcs7d44
-rw-r--r--src/lib/libssl/test/treq81
-rw-r--r--src/lib/libssl/test/trsa81
-rw-r--r--src/lib/libssl/test/tsid81
-rw-r--r--src/lib/libssl/test/tx50981
-rw-r--r--src/lib/libssl/test/v3-cert1.pem16
-rw-r--r--src/lib/libssl/test/v3-cert2.pem16
-rw-r--r--src/lib/libssl/tls1.h153
71 files changed, 0 insertions, 21416 deletions
diff --git a/src/lib/libssl/LICENSE b/src/lib/libssl/LICENSE
deleted file mode 100644
index b9e18d5e7b..0000000000
--- a/src/lib/libssl/LICENSE
+++ /dev/null
@@ -1,127 +0,0 @@
1
2 LICENSE ISSUES
3 ==============
4
5 The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
6 the OpenSSL License and the original SSLeay license apply to the toolkit.
7 See below for the actual license texts. Actually both licenses are BSD-style
8 Open Source licenses. In case of any license issues related to OpenSSL
9 please contact openssl-core@openssl.org.
10
11 OpenSSL License
12 ---------------
13
14/* ====================================================================
15 * Copyright (c) 1998-1999 The OpenSSL Project. All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 *
21 * 1. Redistributions of source code must retain the above copyright
22 * notice, this list of conditions and the following disclaimer.
23 *
24 * 2. Redistributions in binary form must reproduce the above copyright
25 * notice, this list of conditions and the following disclaimer in
26 * the documentation and/or other materials provided with the
27 * distribution.
28 *
29 * 3. All advertising materials mentioning features or use of this
30 * software must display the following acknowledgment:
31 * "This product includes software developed by the OpenSSL Project
32 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
33 *
34 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
35 * endorse or promote products derived from this software without
36 * prior written permission. For written permission, please contact
37 * openssl-core@openssl.org.
38 *
39 * 5. Products derived from this software may not be called "OpenSSL"
40 * nor may "OpenSSL" appear in their names without prior written
41 * permission of the OpenSSL Project.
42 *
43 * 6. Redistributions of any form whatsoever must retain the following
44 * acknowledgment:
45 * "This product includes software developed by the OpenSSL Project
46 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
49 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
51 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
52 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
53 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
54 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
55 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
57 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
59 * OF THE POSSIBILITY OF SUCH DAMAGE.
60 * ====================================================================
61 *
62 * This product includes cryptographic software written by Eric Young
63 * (eay@cryptsoft.com). This product includes software written by Tim
64 * Hudson (tjh@cryptsoft.com).
65 *
66 */
67
68 Original SSLeay License
69 -----------------------
70
71/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
72 * All rights reserved.
73 *
74 * This package is an SSL implementation written
75 * by Eric Young (eay@cryptsoft.com).
76 * The implementation was written so as to conform with Netscapes SSL.
77 *
78 * This library is free for commercial and non-commercial use as long as
79 * the following conditions are aheared to. The following conditions
80 * apply to all code found in this distribution, be it the RC4, RSA,
81 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
82 * included with this distribution is covered by the same copyright terms
83 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
84 *
85 * Copyright remains Eric Young's, and as such any Copyright notices in
86 * the code are not to be removed.
87 * If this package is used in a product, Eric Young should be given attribution
88 * as the author of the parts of the library used.
89 * This can be in the form of a textual message at program startup or
90 * in documentation (online or textual) provided with the package.
91 *
92 * Redistribution and use in source and binary forms, with or without
93 * modification, are permitted provided that the following conditions
94 * are met:
95 * 1. Redistributions of source code must retain the copyright
96 * notice, this list of conditions and the following disclaimer.
97 * 2. Redistributions in binary form must reproduce the above copyright
98 * notice, this list of conditions and the following disclaimer in the
99 * documentation and/or other materials provided with the distribution.
100 * 3. All advertising materials mentioning features or use of this software
101 * must display the following acknowledgement:
102 * "This product includes cryptographic software written by
103 * Eric Young (eay@cryptsoft.com)"
104 * The word 'cryptographic' can be left out if the rouines from the library
105 * being used are not cryptographic related :-).
106 * 4. If you include any Windows specific code (or a derivative thereof) from
107 * the apps directory (application code) you must include an acknowledgement:
108 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
109 *
110 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
111 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
112 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
113 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
114 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
115 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
116 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
117 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
118 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
119 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
120 * SUCH DAMAGE.
121 *
122 * The licence and distribution terms for any publically available version or
123 * derivative of this code cannot be changed. i.e. this code cannot simply be
124 * copied and put under another distribution licence
125 * [including the GNU Public Licence.]
126 */
127
diff --git a/src/lib/libssl/bio_ssl.c b/src/lib/libssl/bio_ssl.c
deleted file mode 100644
index f62cde4e5d..0000000000
--- a/src/lib/libssl/bio_ssl.c
+++ /dev/null
@@ -1,555 +0,0 @@
1/* ssl/bio_ssl.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <stdlib.h>
61#include <string.h>
62#include <errno.h>
63#include <openssl/crypto.h>
64#include <openssl/bio.h>
65#include <openssl/err.h>
66#include <openssl/ssl.h>
67
68static int ssl_write(BIO *h,char *buf,int num);
69static int ssl_read(BIO *h,char *buf,int size);
70static int ssl_puts(BIO *h,char *str);
71static long ssl_ctrl(BIO *h,int cmd,long arg1,char *arg2);
72static int ssl_new(BIO *h);
73static int ssl_free(BIO *data);
74typedef struct bio_ssl_st
75 {
76 SSL *ssl; /* The ssl handle :-) */
77 /* re-negotiate every time the total number of bytes is this size */
78 int num_renegotiates;
79 unsigned long renegotiate_count;
80 unsigned long byte_count;
81 unsigned long renegotiate_timeout;
82 unsigned long last_time;
83 } BIO_SSL;
84
85static BIO_METHOD methods_sslp=
86 {
87 BIO_TYPE_SSL,"ssl",
88 ssl_write,
89 ssl_read,
90 ssl_puts,
91 NULL, /* ssl_gets, */
92 ssl_ctrl,
93 ssl_new,
94 ssl_free,
95 };
96
97BIO_METHOD *BIO_f_ssl(void)
98 {
99 return(&methods_sslp);
100 }
101
102static int ssl_new(BIO *bi)
103 {
104 BIO_SSL *bs;
105
106 bs=(BIO_SSL *)Malloc(sizeof(BIO_SSL));
107 if (bs == NULL)
108 {
109 BIOerr(BIO_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
110 return(0);
111 }
112 memset(bs,0,sizeof(BIO_SSL));
113 bi->init=0;
114 bi->ptr=(char *)bs;
115 bi->flags=0;
116 return(1);
117 }
118
119static int ssl_free(BIO *a)
120 {
121 BIO_SSL *bs;
122
123 if (a == NULL) return(0);
124 bs=(BIO_SSL *)a->ptr;
125 if (bs->ssl != NULL) SSL_shutdown(bs->ssl);
126 if (a->shutdown)
127 {
128 if (a->init && (bs->ssl != NULL))
129 SSL_free(bs->ssl);
130 a->init=0;
131 a->flags=0;
132 }
133 if (a->ptr != NULL)
134 Free(a->ptr);
135 return(1);
136 }
137
138static int ssl_read(BIO *b, char *out, int outl)
139 {
140 int ret=1;
141 BIO_SSL *sb;
142 SSL *ssl;
143 int retry_reason=0;
144 int r=0;
145
146 if (out == NULL) return(0);
147 sb=(BIO_SSL *)b->ptr;
148 ssl=sb->ssl;
149
150 BIO_clear_retry_flags(b);
151
152#if 0
153 if (!SSL_is_init_finished(ssl))
154 {
155/* ret=SSL_do_handshake(ssl); */
156 if (ret > 0)
157 {
158
159 outflags=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY);
160 ret= -1;
161 goto end;
162 }
163 }
164#endif
165/* if (ret > 0) */
166 ret=SSL_read(ssl,out,outl);
167
168 switch (SSL_get_error(ssl,ret))
169 {
170 case SSL_ERROR_NONE:
171 if (ret <= 0) break;
172 if (sb->renegotiate_count > 0)
173 {
174 sb->byte_count+=ret;
175 if (sb->byte_count > sb->renegotiate_count)
176 {
177 sb->byte_count=0;
178 sb->num_renegotiates++;
179 SSL_renegotiate(ssl);
180 r=1;
181 }
182 }
183 if ((sb->renegotiate_timeout > 0) && (!r))
184 {
185 unsigned long tm;
186
187 tm=(unsigned long)time(NULL);
188 if (tm > sb->last_time+sb->renegotiate_timeout)
189 {
190 sb->last_time=tm;
191 sb->num_renegotiates++;
192 SSL_renegotiate(ssl);
193 }
194 }
195
196 break;
197 case SSL_ERROR_WANT_READ:
198 BIO_set_retry_read(b);
199 break;
200 case SSL_ERROR_WANT_WRITE:
201 BIO_set_retry_write(b);
202 break;
203 case SSL_ERROR_WANT_X509_LOOKUP:
204 BIO_set_retry_special(b);
205 retry_reason=BIO_RR_SSL_X509_LOOKUP;
206 break;
207 case SSL_ERROR_WANT_CONNECT:
208 BIO_set_retry_special(b);
209 retry_reason=BIO_RR_CONNECT;
210 break;
211 case SSL_ERROR_SYSCALL:
212 case SSL_ERROR_SSL:
213 case SSL_ERROR_ZERO_RETURN:
214 default:
215 break;
216 }
217
218 b->retry_reason=retry_reason;
219 return(ret);
220 }
221
222static int ssl_write(BIO *b, char *out, int outl)
223 {
224 int ret,r=0;
225 int retry_reason=0;
226 SSL *ssl;
227 BIO_SSL *bs;
228
229 if (out == NULL) return(0);
230 bs=(BIO_SSL *)b->ptr;
231 ssl=bs->ssl;
232
233 BIO_clear_retry_flags(b);
234
235/* ret=SSL_do_handshake(ssl);
236 if (ret > 0) */
237 ret=SSL_write(ssl,out,outl);
238
239 switch (SSL_get_error(ssl,ret))
240 {
241 case SSL_ERROR_NONE:
242 if (ret <= 0) break;
243 if (bs->renegotiate_count > 0)
244 {
245 bs->byte_count+=ret;
246 if (bs->byte_count > bs->renegotiate_count)
247 {
248 bs->byte_count=0;
249 bs->num_renegotiates++;
250 SSL_renegotiate(ssl);
251 r=1;
252 }
253 }
254 if ((bs->renegotiate_timeout > 0) && (!r))
255 {
256 unsigned long tm;
257
258 tm=(unsigned long)time(NULL);
259 if (tm > bs->last_time+bs->renegotiate_timeout)
260 {
261 bs->last_time=tm;
262 bs->num_renegotiates++;
263 SSL_renegotiate(ssl);
264 }
265 }
266 break;
267 case SSL_ERROR_WANT_WRITE:
268 BIO_set_retry_write(b);
269 break;
270 case SSL_ERROR_WANT_READ:
271 BIO_set_retry_read(b);
272 break;
273 case SSL_ERROR_WANT_X509_LOOKUP:
274 BIO_set_retry_special(b);
275 retry_reason=BIO_RR_SSL_X509_LOOKUP;
276 break;
277 case SSL_ERROR_WANT_CONNECT:
278 BIO_set_retry_special(b);
279 retry_reason=BIO_RR_CONNECT;
280 case SSL_ERROR_SYSCALL:
281 case SSL_ERROR_SSL:
282 default:
283 break;
284 }
285
286 b->retry_reason=retry_reason;
287 return(ret);
288 }
289
290static long ssl_ctrl(BIO *b, int cmd, long num, char *ptr)
291 {
292 SSL **sslp,*ssl;
293 BIO_SSL *bs;
294 BIO *dbio,*bio;
295 long ret=1;
296
297 bs=(BIO_SSL *)b->ptr;
298 ssl=bs->ssl;
299 if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))
300 return(0);
301 switch (cmd)
302 {
303 case BIO_CTRL_RESET:
304 SSL_shutdown(ssl);
305
306 if (ssl->handshake_func == ssl->method->ssl_connect)
307 SSL_set_connect_state(ssl);
308 else if (ssl->handshake_func == ssl->method->ssl_accept)
309 SSL_set_accept_state(ssl);
310
311 SSL_clear(ssl);
312
313 if (b->next_bio != NULL)
314 ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
315 else if (ssl->rbio != NULL)
316 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr);
317 else
318 ret=1;
319 break;
320 case BIO_CTRL_INFO:
321 ret=0;
322 break;
323 case BIO_C_SSL_MODE:
324 if (num) /* client mode */
325 SSL_set_connect_state(ssl);
326 else
327 SSL_set_accept_state(ssl);
328 break;
329 case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
330 ret=bs->renegotiate_timeout;
331 if (num < 60) num=5;
332 bs->renegotiate_timeout=(unsigned long)num;
333 bs->last_time=(unsigned long)time(NULL);
334 break;
335 case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
336 ret=bs->renegotiate_count;
337 if ((long)num >=512)
338 bs->renegotiate_count=(unsigned long)num;
339 break;
340 case BIO_C_GET_SSL_NUM_RENEGOTIATES:
341 ret=bs->num_renegotiates;
342 break;
343 case BIO_C_SET_SSL:
344 if (ssl != NULL)
345 ssl_free(b);
346 b->shutdown=(int)num;
347 ssl=(SSL *)ptr;
348 ((BIO_SSL *)b->ptr)->ssl=ssl;
349 bio=SSL_get_rbio(ssl);
350 if (bio != NULL)
351 {
352 if (b->next_bio != NULL)
353 BIO_push(bio,b->next_bio);
354 b->next_bio=bio;
355 CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO);
356 }
357 b->init=1;
358 break;
359 case BIO_C_GET_SSL:
360 if (ptr != NULL)
361 {
362 sslp=(SSL **)ptr;
363 *sslp=ssl;
364 }
365 else
366 ret=0;
367 break;
368 case BIO_CTRL_GET_CLOSE:
369 ret=b->shutdown;
370 break;
371 case BIO_CTRL_SET_CLOSE:
372 b->shutdown=(int)num;
373 break;
374 case BIO_CTRL_WPENDING:
375 ret=BIO_ctrl(ssl->wbio,cmd,num,ptr);
376 break;
377 case BIO_CTRL_PENDING:
378 ret=SSL_pending(ssl);
379 if (ret == 0)
380 ret=BIO_pending(ssl->rbio);
381 break;
382 case BIO_CTRL_FLUSH:
383 BIO_clear_retry_flags(b);
384 ret=BIO_ctrl(ssl->wbio,cmd,num,ptr);
385 BIO_copy_next_retry(b);
386 break;
387 case BIO_CTRL_PUSH:
388 if ((b->next_bio != NULL) && (b->next_bio != ssl->rbio))
389 {
390 SSL_set_bio(ssl,b->next_bio,b->next_bio);
391 CRYPTO_add(&b->next_bio->references,1,CRYPTO_LOCK_BIO);
392 }
393 break;
394 case BIO_CTRL_POP:
395 /* ugly bit of a hack */
396 if (ssl->rbio != ssl->wbio) /* we are in trouble :-( */
397 {
398 BIO_free_all(ssl->wbio);
399 }
400 ssl->wbio=NULL;
401 ssl->rbio=NULL;
402 break;
403 case BIO_C_DO_STATE_MACHINE:
404 BIO_clear_retry_flags(b);
405
406 b->retry_reason=0;
407 ret=(int)SSL_do_handshake(ssl);
408
409 switch (SSL_get_error(ssl,(int)ret))
410 {
411 case SSL_ERROR_WANT_READ:
412 BIO_set_flags(b,
413 BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY);
414 break;
415 case SSL_ERROR_WANT_WRITE:
416 BIO_set_flags(b,
417 BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY);
418 break;
419 case SSL_ERROR_WANT_CONNECT:
420 BIO_set_flags(b,
421 BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY);
422 b->retry_reason=b->next_bio->retry_reason;
423 break;
424 default:
425 break;
426 }
427 break;
428 case BIO_CTRL_DUP:
429 dbio=(BIO *)ptr;
430 if (((BIO_SSL *)dbio->ptr)->ssl != NULL)
431 SSL_free(((BIO_SSL *)dbio->ptr)->ssl);
432 ((BIO_SSL *)dbio->ptr)->ssl=SSL_dup(ssl);
433 ((BIO_SSL *)dbio->ptr)->renegotiate_count=
434 ((BIO_SSL *)b->ptr)->renegotiate_count;
435 ((BIO_SSL *)dbio->ptr)->byte_count=
436 ((BIO_SSL *)b->ptr)->byte_count;
437 ((BIO_SSL *)dbio->ptr)->renegotiate_timeout=
438 ((BIO_SSL *)b->ptr)->renegotiate_timeout;
439 ((BIO_SSL *)dbio->ptr)->last_time=
440 ((BIO_SSL *)b->ptr)->last_time;
441 ret=(((BIO_SSL *)dbio->ptr)->ssl != NULL);
442 break;
443 case BIO_C_GET_FD:
444 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr);
445 break;
446 case BIO_CTRL_SET_CALLBACK:
447 SSL_set_info_callback(ssl,(void (*)())ptr);
448 break;
449 case BIO_CTRL_GET_CALLBACK:
450 {
451 void (**fptr)();
452
453 fptr=(void (**)())ptr;
454 *fptr=SSL_get_info_callback(ssl);
455 }
456 break;
457 default:
458 ret=BIO_ctrl(ssl->rbio,cmd,num,ptr);
459 break;
460 }
461 return(ret);
462 }
463
464static int ssl_puts(BIO *bp, char *str)
465 {
466 int n,ret;
467
468 n=strlen(str);
469 ret=BIO_write(bp,str,n);
470 return(ret);
471 }
472
473BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx)
474 {
475 BIO *ret=NULL,*buf=NULL,*ssl=NULL;
476
477 if ((buf=BIO_new(BIO_f_buffer())) == NULL)
478 return(NULL);
479 if ((ssl=BIO_new_ssl_connect(ctx)) == NULL)
480 goto err;
481 if ((ret=BIO_push(buf,ssl)) == NULL)
482 goto err;
483 return(ret);
484err:
485 if (buf != NULL) BIO_free(buf);
486 if (ssl != NULL) BIO_free(ssl);
487 return(NULL);
488 }
489
490BIO *BIO_new_ssl_connect(SSL_CTX *ctx)
491 {
492 BIO *ret=NULL,*con=NULL,*ssl=NULL;
493
494 if ((con=BIO_new(BIO_s_connect())) == NULL)
495 return(NULL);
496 if ((ssl=BIO_new_ssl(ctx,1)) == NULL)
497 goto err;
498 if ((ret=BIO_push(ssl,con)) == NULL)
499 goto err;
500 return(ret);
501err:
502 if (con != NULL) BIO_free(con);
503 if (ret != NULL) BIO_free(ret);
504 return(NULL);
505 }
506
507BIO *BIO_new_ssl(SSL_CTX *ctx, int client)
508 {
509 BIO *ret;
510 SSL *ssl;
511
512 if ((ret=BIO_new(BIO_f_ssl())) == NULL)
513 return(NULL);
514 if ((ssl=SSL_new(ctx)) == NULL)
515 {
516 BIO_free(ret);
517 return(NULL);
518 }
519 if (client)
520 SSL_set_connect_state(ssl);
521 else
522 SSL_set_accept_state(ssl);
523
524 BIO_set_ssl(ret,ssl,BIO_CLOSE);
525 return(ret);
526 }
527
528int BIO_ssl_copy_session_id(BIO *t, BIO *f)
529 {
530 t=BIO_find_type(t,BIO_TYPE_SSL);
531 f=BIO_find_type(f,BIO_TYPE_SSL);
532 if ((t == NULL) || (f == NULL))
533 return(0);
534 if ( (((BIO_SSL *)t->ptr)->ssl == NULL) ||
535 (((BIO_SSL *)f->ptr)->ssl == NULL))
536 return(0);
537 SSL_copy_session_id(((BIO_SSL *)t->ptr)->ssl,((BIO_SSL *)f->ptr)->ssl);
538 return(1);
539 }
540
541void BIO_ssl_shutdown(BIO *b)
542 {
543 SSL *s;
544
545 while (b != NULL)
546 {
547 if (b->method->type == BIO_TYPE_SSL)
548 {
549 s=((BIO_SSL *)b->ptr)->ssl;
550 SSL_shutdown(s);
551 break;
552 }
553 b=b->next_bio;
554 }
555 }
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
deleted file mode 100644
index d70dd25622..0000000000
--- a/src/lib/libssl/doc/openssl.cnf
+++ /dev/null
@@ -1,214 +0,0 @@
1#
2# OpenSSL example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5
6RANDFILE = $ENV::HOME/.rnd
7oid_file = $ENV::HOME/.oid
8oid_section = new_oids
9
10# To use this configuration file with the "-extfile" option of the
11# "openssl x509" utility, name here the section containing the
12# X.509v3 extensions to use:
13# extensions =
14# (Alternatively, use a configuration file that has only
15# X.509v3 extensions in its main [= default] section.)
16
17[ new_oids ]
18
19# We can add new OIDs in here for use by 'ca' and 'req'.
20# Add a simple OID like this:
21# testoid1=1.2.3.4
22# Or use config file substitution like this:
23# testoid2=${testoid1}.5.6
24
25####################################################################
26[ ca ]
27default_ca = CA_default # The default ca section
28
29####################################################################
30[ CA_default ]
31
32dir = ./demoCA # Where everything is kept
33certs = $dir/certs # Where the issued certs are kept
34crl_dir = $dir/crl # Where the issued crl are kept
35database = $dir/index.txt # database index file.
36new_certs_dir = $dir/newcerts # default place for new certs.
37
38certificate = $dir/cacert.pem # The CA certificate
39serial = $dir/serial # The current serial number
40crl = $dir/crl.pem # The current CRL
41private_key = $dir/private/cakey.pem# The private key
42RANDFILE = $dir/private/.rand # private random number file
43
44x509_extensions = usr_cert # The extentions to add to the cert
45
46# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
47# so this is commented out by default to leave a V1 CRL.
48# crl_extensions = crl_ext
49
50default_days = 365 # how long to certify for
51default_crl_days= 30 # how long before next CRL
52default_md = md5 # which md to use.
53preserve = no # keep passed DN ordering
54
55# A few difference way of specifying how similar the request should look
56# For type CA, the listed attributes must be the same, and the optional
57# and supplied fields are just that :-)
58policy = policy_match
59
60# For the CA policy
61[ policy_match ]
62countryName = match
63stateOrProvinceName = match
64organizationName = match
65organizationalUnitName = optional
66commonName = supplied
67emailAddress = optional
68
69# For the 'anything' policy
70# At this point in time, you must list all acceptable 'object'
71# types.
72[ policy_anything ]
73countryName = optional
74stateOrProvinceName = optional
75localityName = optional
76organizationName = optional
77organizationalUnitName = optional
78commonName = supplied
79emailAddress = optional
80
81####################################################################
82[ req ]
83default_bits = 1024
84default_keyfile = privkey.pem
85distinguished_name = req_distinguished_name
86attributes = req_attributes
87x509_extensions = v3_ca # The extentions to add to the self signed cert
88
89[ req_distinguished_name ]
90countryName = Country Name (2 letter code)
91countryName_default = AU
92countryName_min = 2
93countryName_max = 2
94
95stateOrProvinceName = State or Province Name (full name)
96stateOrProvinceName_default = Some-State
97
98localityName = Locality Name (eg, city)
99
1000.organizationName = Organization Name (eg, company)
1010.organizationName_default = Internet Widgits Pty Ltd
102
103# we can do this but it is not needed normally :-)
104#1.organizationName = Second Organization Name (eg, company)
105#1.organizationName_default = World Wide Web Pty Ltd
106
107organizationalUnitName = Organizational Unit Name (eg, section)
108#organizationalUnitName_default =
109
110commonName = Common Name (eg, YOUR name)
111commonName_max = 64
112
113emailAddress = Email Address
114emailAddress_max = 40
115
116# SET-ex3 = SET extension number 3
117
118[ req_attributes ]
119challengePassword = A challenge password
120challengePassword_min = 4
121challengePassword_max = 20
122
123unstructuredName = An optional company name
124
125[ usr_cert ]
126
127# These extensions are added when 'ca' signs a request.
128
129# This goes against PKIX guidelines but some CAs do it and some software
130# requires this to avoid interpreting an end user certificate as a CA.
131
132basicConstraints=CA:FALSE
133
134# Here are some examples of the usage of nsCertType. If it is omitted
135# the certificate can be used for anything *except* object signing.
136
137# This is OK for an SSL server.
138# nsCertType = server
139
140# For an object signing certificate this would be used.
141# nsCertType = objsign
142
143# For normal client use this is typical
144# nsCertType = client, email
145
146# and for everything including object signing:
147# nsCertType = client, email, objsign
148
149# This is typical in keyUsage for a client certificate.
150# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
151
152# This will be displayed in Netscape's comment listbox.
153nsComment = "OpenSSL Generated Certificate"
154
155# PKIX recommendations harmless if included in all certificates.
156subjectKeyIdentifier=hash
157authorityKeyIdentifier=keyid,issuer:always
158
159# This stuff is for subjectAltName and issuerAltname.
160# Import the email address.
161# subjectAltName=email:copy
162
163# Copy subject details
164# issuerAltName=issuer:copy
165
166#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
167#nsBaseUrl
168#nsRevocationUrl
169#nsRenewalUrl
170#nsCaPolicyUrl
171#nsSslServerName
172
173[ v3_ca ]
174
175# Extensions for a typical CA
176
177
178# PKIX recommendation.
179
180subjectKeyIdentifier=hash
181
182authorityKeyIdentifier=keyid:always,issuer:always
183
184# This is what PKIX recommends but some broken software chokes on critical
185# extensions.
186#basicConstraints = critical,CA:true
187# So we do this instead.
188basicConstraints = CA:true
189
190# Key usage: this is typical for a CA certificate. However since it will
191# prevent it being used as an test self-signed certificate it is best
192# left out by default.
193# keyUsage = cRLSign, keyCertSign
194
195# Some might want this also
196# nsCertType = sslCA, emailCA
197
198# Include email address in subject alt name: another PKIX recommendation
199# subjectAltName=email:copy
200# Copy issuer details
201# issuerAltName=issuer:copy
202
203# RAW DER hex encoding of an extension: beware experts only!
204# 1.2.3.5=RAW:02:03
205# You can even override a supported extension:
206# basicConstraints= critical, RAW:30:03:01:01:FF
207
208[ crl_ext ]
209
210# CRL extensions.
211# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
212
213# issuerAltName=issuer:copy
214authorityKeyIdentifier=keyid:always,issuer:always
diff --git a/src/lib/libssl/doc/openssl.txt b/src/lib/libssl/doc/openssl.txt
deleted file mode 100644
index 91b85e5f14..0000000000
--- a/src/lib/libssl/doc/openssl.txt
+++ /dev/null
@@ -1,1174 +0,0 @@
1
2This is some preliminary documentation for OpenSSL.
3
4==============================================================================
5 BUFFER Library
6==============================================================================
7
8The buffer library handles simple character arrays. Buffers are used for
9various purposes in the library, most notably memory BIOs.
10
11The library uses the BUF_MEM structure defined in buffer.h:
12
13typedef struct buf_mem_st
14{
15 int length; /* current number of bytes */
16 char *data;
17 int max; /* size of buffer */
18} BUF_MEM;
19
20'length' is the current size of the buffer in bytes, 'max' is the amount of
21memory allocated to the buffer. There are three functions which handle these
22and one "miscellaneous" function.
23
24BUF_MEM *BUF_MEM_new()
25
26This allocates a new buffer of zero size. Returns the buffer or NULL on error.
27
28void BUF_MEM_free(BUF_MEM *a)
29
30This frees up an already existing buffer. The data is zeroed before freeing
31up in case the buffer contains sensitive data.
32
33int BUF_MEM_grow(BUF_MEM *str, int len)
34
35This changes the size of an already existing buffer. It returns zero on error
36or the new size (i.e. 'len'). Any data already in the buffer is preserved if
37it increases in size.
38
39char * BUF_strdup(char *str)
40
41This is the previously mentioned strdup function: like the standard library
42strdup() it copies a null terminated string into a block of allocated memory
43and returns a pointer to the allocated block.
44
45Unlike the standard C library strdup() this function uses Malloc() and so
46should be used in preference to the standard library strdup() because it can
47be used for memory leak checking or replacing the malloc() function.
48
49The memory allocated from BUF_strdup() should be freed up using the Free()
50function.
51
52==============================================================================
53 OpenSSL X509V3 extension configuration
54==============================================================================
55
56OpenSSL X509V3 extension configuration: preliminary documentation.
57
58INTRODUCTION.
59
60For OpenSSL 0.9.2 the extension code has be considerably enhanced. It is now
61possible to add and print out common X509 V3 certificate and CRL extensions.
62
63BEGINNERS NOTE
64
65For most simple applications you don't need to know too much about extensions:
66the default openssl.cnf values will usually do sensible things.
67
68If you want to know more you can initially quickly look through the sections
69describing how the standard OpenSSL utilities display and add extensions and
70then the list of supported extensions.
71
72For more technical information about the meaning of extensions see:
73
74http://www.imc.org/ietf-pkix/
75http://home.netscape.com/eng/security/certs.html
76
77PRINTING EXTENSIONS.
78
79Extension values are automatically printed out for supported extensions.
80
81openssl x509 -in cert.pem -text
82openssl crl -in crl.pem -text
83
84will give information in the extension printout, for example:
85
86 X509v3 extensions:
87 X509v3 Basic Constraints:
88 CA:TRUE
89 X509v3 Subject Key Identifier:
90 73:FE:F7:59:A7:E1:26:84:44:D6:44:36:EE:79:1A:95:7C:B1:4B:15
91 X509v3 Authority Key Identifier:
92 keyid:73:FE:F7:59:A7:E1:26:84:44:D6:44:36:EE:79:1A:95:7C:B1:4B:15, DirName:/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/Email=email@1.address/Email=email@2.address, serial:00
93 X509v3 Key Usage:
94 Certificate Sign, CRL Sign
95 X509v3 Subject Alternative Name:
96 email:email@1.address, email:email@2.address
97
98CONFIGURATION FILES.
99
100The OpenSSL utilities 'ca' and 'req' can now have extension sections listing
101which certificate extensions to include. In each case a line:
102
103x509_extensions = extension_section
104
105indicates which section contains the extensions. In the case of 'req' the
106extension section is used when the -x509 option is present to create a
107self signed root certificate.
108
109The 'x509' utility also supports extensions when it signs a certificate.
110The -extfile option is used to set the configuration file containing the
111extensions. In this case a line with:
112
113extensions = extension_section
114
115in the nameless (default) section is used. If no such line is included then
116it uses the default section.
117
118You can also add extensions to CRLs: a line
119
120crl_extensions = crl_extension_section
121
122will include extensions when the -gencrl option is used with the 'ca' utility.
123You can add any extension to a CRL but of the supported extensions only
124issuerAltName and authorityKeyIdentifier make any real sense. Note: these are
125CRL extensions NOT CRL *entry* extensions which cannot currently be generated.
126CRL entry extensions can be displayed.
127
128NB. At this time Netscape Communicator rejects V2 CRLs: to get an old V1 CRL
129you should not include a crl_extensions line in the configuration file.
130
131As with all configuration files you can use the inbuilt environment expansion
132to allow the values to be passed in the environment. Therefore if you have
133several extension sections used for different purposes you can have a line:
134
135x509_extensions = $ENV::ENV_EXT
136
137and set the ENV_EXT environment variable before calling the relevant utility.
138
139EXTENSION SYNTAX.
140
141Extensions have the basic form:
142
143extension_name=[critical,] extension_options
144
145the use of the critical option makes the extension critical. Extreme caution
146should be made when using the critical flag. If an extension is marked
147as critical then any client that does not understand the extension should
148reject it as invalid. Some broken software will reject certificates which
149have *any* critical extensions (these violates PKIX but we have to live
150with it).
151
152There are three main types of extension: string extensions, multi-valued
153extensions, and raw extensions.
154
155String extensions simply have a string which contains either the value itself
156or how it is obtained.
157
158For example:
159
160nsComment="This is a Comment"
161
162Multi-valued extensions have a short form and a long form. The short form
163is a list of names and values:
164
165basicConstraints=critical,CA:true,pathlen:1
166
167The long form allows the values to be placed in a separate section:
168
169basicConstraints=critical,@bs_section
170
171[bs_section]
172
173CA=true
174pathlen=1
175
176Both forms are equivalent. However it should be noted that in some cases the
177same name can appear multiple times, for example,
178
179subjectAltName=email:steve@here,email:steve@there
180
181in this case an equivalent long form is:
182
183subjectAltName=@alt_section
184
185[alt_section]
186
187email.1=steve@here
188email.2=steve@there
189
190This is because the configuration file code cannot handle the same name
191occurring twice in the same extension.
192
193The syntax of raw extensions is governed by the extension code: it can
194for example contain data in multiple sections. The correct syntax to
195use is defined by the extension code itself: check out the certificate
196policies extension for an example.
197
198In addition it is also possible to use the word DER to include arbitrary
199data in any extension.
200
2011.2.3.4=critical,DER:01:02:03:04
2021.2.3.4=DER:01020304
203
204The value following DER is a hex dump of the DER encoding of the extension
205Any extension can be placed in this form to override the default behaviour.
206For example:
207
208basicConstraints=critical,DER:00:01:02:03
209
210WARNING: DER should be used with caution. It is possible to create totally
211invalid extensions unless care is taken.
212
213CURRENTLY SUPPORTED EXTENSIONS.
214
215If you aren't sure about extensions then they can be largely ignored: its only
216when you want to do things like restrict certificate usage when you need to
217worry about them.
218
219The only extension that a beginner might want to look at is Basic Constraints.
220If in addition you want to try Netscape object signing the you should also
221look at Netscape Certificate Type.
222
223Literal String extensions.
224
225In each case the 'value' of the extension is placed directly in the
226extension. Currently supported extensions in this category are: nsBaseUrl,
227nsRevocationUrl, nsCaRevocationUrl, nsRenewalUrl, nsCaPolicyUrl,
228nsSslServerName and nsComment.
229
230For example:
231
232nsComment="This is a test comment"
233
234Bit Strings.
235
236Bit string extensions just consist of a list of supported bits, currently
237two extensions are in this category: PKIX keyUsage and the Netscape specific
238nsCertType.
239
240nsCertType (netscape certificate type) takes the flags: client, server, email,
241objsign, reserved, sslCA, emailCA, objCA.
242
243keyUsage (PKIX key usage) takes the flags: digitalSignature, nonRepudiation,
244keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign,
245encipherOnly, decipherOnly.
246
247For example:
248
249nsCertType=server
250
251keyUsage=digitalSignature, nonRepudiation
252
253Hints on Netscape Certificate Type.
254
255Other than Basic Constraints this is the only extension a beginner might
256want to use, if you want to try Netscape object signing, otherwise it can
257be ignored.
258
259If you want a certificate that can be used just for object signing then:
260
261nsCertType=objsign
262
263will do the job. If you want to use it as a normal end user and server
264certificate as well then
265
266nsCertType=objsign,email,server
267
268is more appropriate. You cannot use a self signed certificate for object
269signing (well Netscape signtool can but it cheats!) so you need to create
270a CA certificate and sign an end user certificate with it.
271
272Side note: If you want to conform to the Netscape specifications then you
273should really also set:
274
275nsCertType=objCA
276
277in the *CA* certificate for just an object signing CA and
278
279nsCertType=objCA,emailCA,sslCA
280
281for everything. Current Netscape software doesn't enforce this so it can
282be omitted.
283
284Basic Constraints.
285
286This is generally the only extension you need to worry about for simple
287applications. If you want your certificate to be usable as a CA certificate
288(in addition to an end user certificate) then you set this to:
289
290basicConstraints=CA:TRUE
291
292if you want to be certain the certificate cannot be used as a CA then do:
293
294basicConstraints=CA:FALSE
295
296The rest of this section describes more advanced usage.
297
298Basic constraints is a multi-valued extension that supports a CA and an
299optional pathlen option. The CA option takes the values true and false and
300pathlen takes an integer. Note if the CA option is false the pathlen option
301should be omitted.
302
303The pathlen parameter indicates the maximum number of CAs that can appear
304below this one in a chain. So if you have a CA with a pathlen of zero it can
305only be used to sign end user certificates and not further CAs. This all
306assumes that the software correctly interprets this extension of course.
307
308Examples:
309
310basicConstraints=CA:TRUE
311basicConstraints=critical,CA:TRUE, pathlen:0
312
313NOTE: for a CA to be considered valid it must have the CA option set to
314TRUE. An end user certificate MUST NOT have the CA value set to true.
315According to PKIX recommendations it should exclude the extension entirely,
316however some software may require CA set to FALSE for end entity certificates.
317
318Subject Key Identifier.
319
320This is really a string extension and can take two possible values. Either
321a hex string giving details of the extension value to include or the word
322'hash' which then automatically follow PKIX guidelines in selecting and
323appropriate key identifier. The use of the hex string is strongly discouraged.
324
325Example: subjectKeyIdentifier=hash
326
327Authority Key Identifier.
328
329The authority key identifier extension permits two options. keyid and issuer:
330both can take the optional value "always".
331
332If the keyid option is present an attempt is made to copy the subject key
333identifier from the parent certificate. If the value "always" is present
334then an error is returned if the option fails.
335
336The issuer option copies the issuer and serial number from the issuer
337certificate. Normally this will only be done if the keyid option fails or
338is not included: the "always" flag will always include the value.
339
340Subject Alternative Name.
341
342The subject alternative name extension allows various literal values to be
343included in the configuration file. These include "email" (an email address)
344"URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a
345registered ID: OBJECT IDENTIFIER) and IP (and IP address).
346
347Also the email option include a special 'copy' value. This will automatically
348include and email addresses contained in the certificate subject name in
349the extension.
350
351Examples:
352
353subjectAltName=email:copy,email:my@other.address,URL:http://my.url.here/
354subjectAltName=email:my@other.address,RID:1.2.3.4
355
356Issuer Alternative Name.
357
358The issuer alternative name option supports all the literal options of
359subject alternative name. It does *not* support the email:copy option because
360that would not make sense. It does support an additional issuer:copy option
361that will copy all the subject alternative name values from the issuer
362certificate (if possible).
363
364CRL distribution points.
365
366This is a multi-valued extension that supports all the literal options of
367subject alternative name. Of the few software packages that currently interpret
368this extension most only interpret the URI option.
369
370Currently each option will set a new DistributionPoint with the fullName
371field set to the given value.
372
373Other fields like cRLissuer and reasons cannot currently be set or displayed:
374at this time no examples were available that used these fields.
375
376If you see this extension with <UNSUPPORTED> when you attempt to print it out
377or it doesn't appear to display correctly then let me know, including the
378certificate (mail me at steve@openssl.org) .
379
380Examples:
381
382crlDistributionPoints=URI:http://www.myhost.com/myca.crl
383crlDistributionPoints=URI:http://www.my.com/my.crl,URI:http://www.oth.com/my.crl
384
385Certificate Policies.
386
387This is a RAW extension. It attempts to display the contents of this extension:
388unfortunately this extension is often improperly encoded.
389
390The certificate policies extension will rarely be used in practice: few
391software packages interpret it correctly or at all. IE5 does partially
392support this extension: but it needs the 'ia5org' option because it will
393only correctly support a broken encoding. Of the options below only the
394policy OID, explicitText and CPS options are displayed with IE5.
395
396All the fields of this extension can be set by using the appropriate syntax.
397
398If you follow the PKIX recommendations of not including any qualifiers and just
399using only one OID then you just include the value of that OID. Multiple OIDs
400can be set separated by commas, for example:
401
402certificatePolicies= 1.2.4.5, 1.1.3.4
403
404If you wish to include qualifiers then the policy OID and qualifiers need to
405be specified in a separate section: this is done by using the @section syntax
406instead of a literal OID value.
407
408The section referred to must include the policy OID using the name
409policyIdentifier, cPSuri qualifiers can be included using the syntax:
410
411CPS.nnn=value
412
413userNotice qualifiers can be set using the syntax:
414
415userNotice.nnn=@notice
416
417The value of the userNotice qualifier is specified in the relevant section.
418This section can include explicitText, organization and noticeNumbers
419options. explicitText and organization are text strings, noticeNumbers is a
420comma separated list of numbers. The organization and noticeNumbers options
421(if included) must BOTH be present. If you use the userNotice option with IE5
422then you need the 'ia5org' option at the top level to modify the encoding:
423otherwise it will not be interpreted properly.
424
425Example:
426
427certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect
428
429[polsect]
430
431policyIdentifier = 1.3.5.8
432CPS.1="http://my.host.name/"
433CPS.2="http://my.your.name/"
434userNotice.1=@notice
435
436[notice]
437
438explicitText="Explicit Text Here"
439organization="Organisation Name"
440noticeNumbers=1,2,3,4
441
442TECHNICAL NOTE: the ia5org option changes the type of the 'organization' field,
443according to PKIX it should be of type DisplayText but Verisign uses an
444IA5STRING and IE5 needs this too.
445
446Display only extensions.
447
448Some extensions are only partially supported and currently are only displayed
449but cannot be set. These include private key usage period, CRL number, and
450CRL reason.
451
452==============================================================================
453 X509V3 Extension code: programmers guide
454==============================================================================
455
456The purpose of the extension code is twofold. It allows an extension to be
457created from a string or structure describing its contents and it prints out an
458extension in a human or machine readable form.
459
4601. Initialisation and cleanup.
461
462X509V3_add_standard_extensions();
463
464This function should be called before any other extension code. It adds support
465for some common PKIX and Netscape extensions. Additional custom extensions can
466be added as well (see later).
467
468void X509V3_EXT_cleanup(void);
469
470This function should be called last to cleanup the extension code. After this
471call no other extension calls should be made.
472
4732. Printing and parsing extensions.
474
475The simplest way to print out extensions is via the standard X509 printing
476routines: if you use the standard X509_print() function, the supported
477extensions will be printed out automatically.
478
479The following functions allow finer control over extension display:
480
481int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent);
482int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
483
484These two functions print out an individual extension to a BIO or FILE pointer.
485Currently the flag argument is unused and should be set to 0. The 'indent'
486argument is the number of spaces to indent each line.
487
488void *X509V3_EXT_d2i(X509_EXTENSION *ext);
489
490This function parses an extension and returns its internal structure. The
491precise structure you get back depends on the extension being parsed. If the
492extension if basicConstraints you will get back a pointer to a
493BASIC_CONSTRAINTS structure. Check out the source in crypto/x509v3 for more
494details about the structures returned. The returned structure should be freed
495after use using the relevant free function, BASIC_CONSTRAINTS_free() for
496example.
497
4983. Generating extensions.
499
500An extension will typically be generated from a configuration file, or some
501other kind of configuration database.
502
503int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
504 X509 *cert);
505int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section,
506 X509_CRL *crl);
507
508These functions add all the extensions in the given section to the given
509certificate or CRL. They will normally be called just before the certificate
510or CRL is due to be signed. Both return 0 on error on non zero for success.
511
512In each case 'conf' is the LHASH pointer of the configuration file to use
513and 'section' is the section containing the extension details.
514
515See the 'context functions' section for a description of the ctx paramater.
516
517
518X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name,
519 char *value);
520
521This function returns an extension based on a name and value pair, if the
522pair will not need to access other sections in a config file (or there is no
523config file) then the 'conf' parameter can be set to NULL.
524
525X509_EXTENSION *X509V3_EXT_conf_nid(char *conf, X509V3_CTX *ctx, int nid,
526 char *value);
527
528This function creates an extension in the same way as X509V3_EXT_conf() but
529takes the NID of the extension rather than its name.
530
531For example to produce basicConstraints with the CA flag and a path length of
53210:
533
534x = X509V3_EXT_conf_nid(NULL, NULL, NID_basicConstraints, "CA:TRUE,pathlen:10");
535
536
537X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc);
538
539This function sets up an extension from its internal structure. The ext_nid
540parameter is the NID of the extension and 'crit' is the critical flag.
541
5424. Context functions.
543
544The following functions set and manipulate an extension context structure.
545The purpose of the extension context is to allow the extension code to
546access various structures relating to the "environment" of the certificate:
547for example the issuers certificate or the certificate request.
548
549void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject,
550 X509_REQ *req, X509_CRL *crl, int flags);
551
552This function sets up an X509V3_CTX structure with details of the certificate
553environment: specifically the issuers certificate, the subject certificate,
554the certificate request and the CRL: if these are not relevant or not
555available then they can be set to NULL. The 'flags' parameter should be set
556to zero.
557
558X509V3_set_ctx_test(ctx)
559
560This macro is used to set the 'ctx' structure to a 'test' value: this is to
561allow the syntax of an extension (or configuration file) to be tested.
562
563X509V3_set_ctx_nodb(ctx)
564
565This macro is used when no configuration database is present.
566
567void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH *lhash);
568
569This function is used to set the configuration database when it is an LHASH
570structure: typically a configuration file.
571
572The following functions are used to access a configuration database: they
573should only be used in RAW extensions.
574
575char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section);
576
577This function returns the value of the parameter "name" in "section", or NULL
578if there has been an error.
579
580void X509V3_string_free(X509V3_CTX *ctx, char *str);
581
582This function frees up the string returned by the above function.
583
584STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section);
585
586This function returns a whole section as a STACK_OF(CONF_VALUE) .
587
588void X509V3_section_free( X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section);
589
590This function frees up the STACK returned by the above function.
591
592Note: it is possible to use the extension code with a custom configuration
593database. To do this the "db_meth" element of the X509V3_CTX structure should
594be set to an X509V3_CTX_METHOD structure. This structure contains the following
595function pointers:
596
597char * (*get_string)(void *db, char *section, char *value);
598STACK_OF(CONF_VALUE) * (*get_section)(void *db, char *section);
599void (*free_string)(void *db, char * string);
600void (*free_section)(void *db, STACK_OF(CONF_VALUE) *section);
601
602these will be called and passed the 'db' element in the X509V3_CTX structure
603to access the database. If a given function is not implemented or not required
604it can be set to NULL.
605
6065. String helper functions.
607
608There are several "i2s" and "s2i" functions that convert structures to and
609from ASCII strings. In all the "i2s" cases the returned string should be
610freed using Free() after use. Since some of these are part of other extension
611code they may take a 'method' parameter. Unless otherwise stated it can be
612safely set to NULL.
613
614char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *oct);
615
616This returns a hex string from an ASN1_OCTET_STRING.
617
618char * i2s_ASN1_INTEGER(X509V3_EXT_METHOD *meth, ASN1_INTEGER *aint);
619char * i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint);
620
621These return a string decimal representations of an ASN1_INTEGER and an
622ASN1_ENUMERATED type, respectively.
623
624ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method,
625 X509V3_CTX *ctx, char *str);
626
627This converts an ASCII hex string to an ASN1_OCTET_STRING.
628
629ASN1_INTEGER * s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, char *value);
630
631This converts a decimal ASCII string into an ASN1_INTEGER.
632
6336. Multi valued extension helper functions.
634
635The following functions can be used to manipulate STACKs of CONF_VALUE
636structures, as used by multi valued extensions.
637
638int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool);
639
640This function expects a boolean value in 'value' and sets 'asn1_bool' to
641it. That is it sets it to 0 for FALSE or 0xff for TRUE. The following
642strings are acceptable: "TRUE", "true", "Y", "y", "YES", "yes", "FALSE"
643"false", "N", "n", "NO" or "no".
644
645int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint);
646
647This accepts a decimal integer of arbitrary length and sets an ASN1_INTEGER.
648
649int X509V3_add_value(const char *name, const char *value,
650 STACK_OF(CONF_VALUE) **extlist);
651
652This simply adds a string name and value pair.
653
654int X509V3_add_value_uchar(const char *name, const unsigned char *value,
655 STACK_OF(CONF_VALUE) **extlist);
656
657The same as above but for an unsigned character value.
658
659int X509V3_add_value_bool(const char *name, int asn1_bool,
660 STACK_OF(CONF_VALUE) **extlist);
661
662This adds either "TRUE" or "FALSE" depending on the value of 'ans1_bool'
663
664int X509V3_add_value_bool_nf(char *name, int asn1_bool,
665 STACK_OF(CONF_VALUE) **extlist);
666
667This is the same as above except it adds nothing if asn1_bool is FALSE.
668
669int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint,
670 STACK_OF(CONF_VALUE) **extlist);
671
672This function adds the value of the ASN1_INTEGER in decimal form.
673
6747. Other helper functions.
675
676<to be added>
677
678ADDING CUSTOM EXTENSIONS.
679
680Currently there are three types of supported extensions.
681
682String extensions are simple strings where the value is placed directly in the
683extensions, and the string returned is printed out.
684
685Multi value extensions are passed a STACK_OF(CONF_VALUE) name and value pairs
686or return a STACK_OF(CONF_VALUE).
687
688Raw extensions are just passed a BIO or a value and it is the extensions
689responsiblity to handle all the necessary printing.
690
691There are two ways to add an extension. One is simply as an alias to an already
692existing extension. An alias is an extension that is identical in ASN1 structure
693to an existing extension but has a different OBJECT IDENTIFIER. This can be
694done by calling:
695
696int X509V3_EXT_add_alias(int nid_to, int nid_from);
697
698'nid_to' is the new extension NID and 'nid_from' is the already existing
699extension NID.
700
701Alternatively an extension can be written from scratch. This involves writing
702the ASN1 code to encode and decode the extension and functions to print out and
703generate the extension from strings. The relevant functions are then placed in
704a X509V3_EXT_METHOD structure and int X509V3_EXT_add(X509V3_EXT_METHOD *ext);
705called.
706
707The X509V3_EXT_METHOD structure is described below.
708
709strut {
710int ext_nid;
711int ext_flags;
712X509V3_EXT_NEW ext_new;
713X509V3_EXT_FREE ext_free;
714X509V3_EXT_D2I d2i;
715X509V3_EXT_I2D i2d;
716X509V3_EXT_I2S i2s;
717X509V3_EXT_S2I s2i;
718X509V3_EXT_I2V i2v;
719X509V3_EXT_V2I v2i;
720X509V3_EXT_R2I r2i;
721X509V3_EXT_I2R i2r;
722
723void *usr_data;
724};
725
726The elements have the following meanings.
727
728ext_nid is the NID of the object identifier of the extension.
729
730ext_flags is set of flags. Currently the only external flag is
731 X509V3_EXT_MULTILINE which means a multi valued extensions
732 should be printed on separate lines.
733
734usr_data is an extension specific pointer to any relevant data. This
735 allows extensions to share identical code but have different
736 uses. An example of this is the bit string extension which uses
737 usr_data to contain a list of the bit names.
738
739All the remaining elements are function pointers.
740
741ext_new is a pointer to a function that allocates memory for the
742 extension ASN1 structure: for example ASN1_OBJECT_new().
743
744ext_free is a pointer to a function that free up memory of the extension
745 ASN1 structure: for example ASN1_OBJECT_free().
746
747d2i is the standard ASN1 function that converts a DER buffer into
748 the internal ASN1 structure: for example d2i_ASN1_IA5STRING().
749
750i2d is the standard ASN1 function that converts the internal
751 structure into the DER representation: for example
752 i2d_ASN1_IA5STRING().
753
754The remaining functions are depend on the type of extension. One i2X and
755one X2i should be set and the rest set to NULL. The types set do not need
756to match up, for example the extension could be set using the multi valued
757v2i function and printed out using the raw i2r.
758
759All functions have the X509V3_EXT_METHOD passed to them in the 'method'
760parameter and an X509V3_CTX structure. Extension code can then access the
761parent structure via the 'method' parameter to for example make use of the value
762of usr_data. If the code needs to use detail relating to the request it can
763use the 'ctx' parameter.
764
765A note should be given here about the 'flags' member of the 'ctx' parameter.
766If it has the value CTX_TEST then the configuration syntax is being checked
767and no actual certificate or CRL exists. Therefore any attempt in the config
768file to access such information should silently succeed. If the syntax is OK
769then it should simply return a (possibly bogus) extension, otherwise it
770should return NULL.
771
772char *i2s(struct v3_ext_method *method, void *ext);
773
774This function takes the internal structure in the ext parameter and returns
775a Malloc'ed string representing its value.
776
777void * s2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str);
778
779This function takes the string representation in the ext parameter and returns
780an allocated internal structure: ext_free() will be used on this internal
781structure after use.
782
783i2v and v2i handle a STACK_OF(CONF_VALUE):
784
785typedef struct
786{
787 char *section;
788 char *name;
789 char *value;
790} CONF_VALUE;
791
792Only the name and value members are currently used.
793
794STACK_OF(CONF_VALUE) * i2v(struct v3_ext_method *method, void *ext);
795
796This function is passed the internal structure in the ext parameter and
797returns a STACK of CONF_VALUE structures. The values of name, value,
798section and the structure itself will be freed up with Free after use.
799Several helper functions are available to add values to this STACK.
800
801void * v2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx,
802 STACK_OF(CONF_VALUE) *values);
803
804This function takes a STACK_OF(CONF_VALUE) structures and should set the
805values of the external structure. This typically uses the name element to
806determine which structure element to set and the value element to determine
807what to set it to. Several helper functions are available for this
808purpose (see above).
809
810int i2r(struct v3_ext_method *method, void *ext, BIO *out, int indent);
811
812This function is passed the internal extension structure in the ext parameter
813and sends out a human readable version of the extension to out. The 'indent'
814paremeter should be noted to determine the necessary amount of indentation
815needed on the output.
816
817void * r2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str);
818
819This is just passed the string representation of the extension. It is intended
820to be used for more elaborate extensions where the standard single and multi
821valued options are insufficient. They can use the 'ctx' parameter to parse the
822configuration database themselves. See the context functions section for details
823of how to do this.
824
825Note: although this type takes the same parameters as the "r2s" function there
826is a subtle difference. Whereas an "r2i" function can access a configuration
827database an "s2i" function MUST NOT. This is so the internal code can safely
828assume that an "s2i" function will work without a configuration database.
829
830==============================================================================
831 PKCS#12 Library
832==============================================================================
833
834This section describes the internal PKCS#12 support. There are very few
835differences between the old external library and the new internal code at
836present. This may well change because the external library will not be updated
837much in future.
838
839This version now includes a couple of high level PKCS#12 functions which
840generally "do the right thing" and should make it much easier to handle PKCS#12
841structures.
842
843HIGH LEVEL FUNCTIONS.
844
845For most applications you only need concern yourself with the high level
846functions. They can parse and generate simple PKCS#12 files as produced by
847Netscape and MSIE or indeed any compliant PKCS#12 file containing a single
848private key and certificate pair.
849
8501. Initialisation and cleanup.
851
852No special initialisation is needed for the internal PKCS#12 library: the
853standard SSLeay_add_all_algorithms() is sufficient. If you do not wish to
854add all algorithms (you should at least add SHA1 though) then you can manually
855initialise the PKCS#12 library with:
856
857PKCS12_PBE_add();
858
859The memory allocated by the PKCS#12 library is freed up when EVP_cleanup() is
860called or it can be directly freed with:
861
862EVP_PBE_cleanup();
863
864after this call (or EVP_cleanup() ) no more PKCS#12 library functions should
865be called.
866
8672. I/O functions.
868
869i2d_PKCS12_bio(bp, p12)
870
871This writes out a PKCS12 structure to a BIO.
872
873i2d_PKCS12_fp(fp, p12)
874
875This is the same but for a FILE pointer.
876
877d2i_PKCS12_bio(bp, p12)
878
879This reads in a PKCS12 structure from a BIO.
880
881d2i_PKCS12_fp(fp, p12)
882
883This is the same but for a FILE pointer.
884
8853. Parsing and creation functions.
886
8873.1 Parsing with PKCS12_parse().
888
889int PKCS12_parse(PKCS12 *p12, char *pass, EVP_PKEY **pkey, X509 **cert,
890 STACK **ca);
891
892This function takes a PKCS12 structure and a password (ASCII, null terminated)
893and returns the private key, the corresponding certificate and any CA
894certificates. If any of these is not required it can be passed as a NULL.
895The 'ca' parameter should be either NULL, a pointer to NULL or a valid STACK
896structure. Typically to read in a PKCS#12 file you might do:
897
898p12 = d2i_PKCS12_fp(fp, NULL);
899PKCS12_parse(p12, password, &pkey, &cert, NULL); /* CAs not wanted */
900PKCS12_free(p12);
901
9023.2 PKCS#12 creation with PKCS12_create().
903
904PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
905 STACK *ca, int nid_key, int nid_cert, int iter,
906 int mac_iter, int keytype);
907
908This function will create a PKCS12 structure from a given password, name,
909private key, certificate and optional STACK of CA certificates. The remaining
9105 parameters can be set to 0 and sensible defaults will be used.
911
912The parameters nid_key and nid_cert are the key and certificate encryption
913algorithms, iter is the encryption iteration count, mac_iter is the MAC
914iteration count and keytype is the type of private key. If you really want
915to know what these last 5 parameters do then read the low level section.
916
917Typically to create a PKCS#12 file the following could be used:
918
919p12 = PKCS12_create(pass, "My Certificate", pkey, cert, NULL, 0,0,0,0,0);
920i2d_PKCS12_fp(fp, p12);
921PKCS12_free(p12);
922
923LOW LEVEL FUNCTIONS.
924
925In some cases the high level functions do not provide the necessary
926functionality. For example if you want to generate or parse more complex
927PKCS#12 files. The sample pkcs12 application uses the low level functions
928to display details about the internal structure of a PKCS#12 file.
929
930Introduction.
931
932This is a brief description of how a PKCS#12 file is represented internally:
933some knowledge of PKCS#12 is assumed.
934
935A PKCS#12 object contains several levels.
936
937At the lowest level is a PKCS12_SAFEBAG. This can contain a certificate, a
938CRL, a private key, encrypted or unencrypted, a set of safebags (so the
939structure can be nested) or other secrets (not documented at present).
940A safebag can optionally have attributes, currently these are: a unicode
941friendlyName (a Unicode string) or a localKeyID (a string of bytes).
942
943At the next level is an authSafe which is a set of safebags collected into
944a PKCS#7 ContentInfo. This can be just plain data, or encrypted itself.
945
946At the top level is the PKCS12 structure itself which contains a set of
947authSafes in an embedded PKCS#7 Contentinfo of type data. In addition it
948contains a MAC which is a kind of password protected digest to preserve
949integrity (so any unencrypted stuff below can't be tampered with).
950
951The reason for these levels is so various objects can be encrypted in various
952ways. For example you might want to encrypt a set of private keys with
953triple-DES and then include the related certificates either unencrypted or
954with lower encryption. Yes it's the dreaded crypto laws at work again which
955allow strong encryption on private keys and only weak encryption on other
956stuff.
957
958To build one of these things you turn all certificates and keys into safebags
959(with optional attributes). You collect the safebags into (one or more) STACKS
960and convert these into authsafes (encrypted or unencrypted). The authsafes
961are collected into a STACK and added to a PKCS12 structure. Finally a MAC
962inserted.
963
964Pulling one apart is basically the reverse process. The MAC is verified against
965the given password. The authsafes are extracted and each authsafe split into
966a set of safebags (possibly involving decryption). Finally the safebags are
967decomposed into the original keys and certificates and the attributes used to
968match up private key and certificate pairs.
969
970Anyway here are the functions that do the dirty work.
971
9721. Construction functions.
973
9741.1 Safebag functions.
975
976M_PKCS12_x5092certbag(x509)
977
978This macro takes an X509 structure and returns a certificate bag. The
979X509 structure can be freed up after calling this function.
980
981M_PKCS12_x509crl2certbag(crl)
982
983As above but for a CRL.
984
985PKCS8_PRIV_KEY_INFO *PKEY2PKCS8(EVP_PKEY *pkey)
986
987Take a private key and convert it into a PKCS#8 PrivateKeyInfo structure.
988Works for both RSA and DSA private keys. NB since the PKCS#8 PrivateKeyInfo
989structure contains a private key data in plain text form it should be free'd
990up as soon as it has been encrypted for security reasons (freeing up the
991structure zeros out the sensitive data). This can be done with
992PKCS8_PRIV_KEY_INFO_free().
993
994PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage)
995
996This sets the key type when a key is imported into MSIE or Outlook 98. Two
997values are currently supported: KEY_EX and KEY_SIG. KEY_EX is an exchange type
998key that can also be used for signing but its size is limited in the export
999versions of MS software to 512 bits, it is also the default. KEY_SIG is a
1000signing only key but the keysize is unlimited (well 16K is supposed to work).
1001If you are using the domestic version of MSIE then you can ignore this because
1002KEY_EX is not limited and can be used for both.
1003
1004PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8)
1005
1006Convert a PKCS8 private key structure into a keybag. This routine embeds the
1007p8 structure in the keybag so p8 should not be freed up or used after it is
1008called. The p8 structure will be freed up when the safebag is freed.
1009
1010PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8)
1011
1012Convert a PKCS#8 structure into a shrouded key bag (encrypted). p8 is not
1013embedded and can be freed up after use.
1014
1015int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen)
1016int PKCS12_add_friendlyname(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen)
1017
1018Add a local key id or a friendlyname to a safebag.
1019
10201.2 Authsafe functions.
1021
1022PKCS7 *PKCS12_pack_p7data(STACK *sk)
1023Take a stack of safebags and convert them into an unencrypted authsafe. The
1024stack of safebags can be freed up after calling this function.
1025
1026PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, STACK *bags);
1027
1028As above but encrypted.
1029
10301.3 PKCS12 functions.
1031
1032PKCS12 *PKCS12_init(int mode)
1033
1034Initialise a PKCS12 structure (currently mode should be NID_pkcs7_data).
1035
1036M_PKCS12_pack_authsafes(p12, safes)
1037
1038This macro takes a STACK of authsafes and adds them to a PKCS#12 structure.
1039
1040int PKCS12_set_mac(PKCS12 *p12, unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, EVP_MD *md_type);
1041
1042Add a MAC to a PKCS12 structure. If EVP_MD is NULL use SHA-1, the spec suggests
1043that SHA-1 should be used.
1044
10452. Extraction Functions.
1046
10472.1 Safebags.
1048
1049M_PKCS12_bag_type(bag)
1050
1051Return the type of "bag". Returns one of the following
1052
1053NID_keyBag
1054NID_pkcs8ShroudedKeyBag 7
1055NID_certBag 8
1056NID_crlBag 9
1057NID_secretBag 10
1058NID_safeContentsBag 11
1059
1060M_PKCS12_cert_bag_type(bag)
1061
1062Returns type of certificate bag, following are understood.
1063
1064NID_x509Certificate 14
1065NID_sdsiCertificate 15
1066
1067M_PKCS12_crl_bag_type(bag)
1068
1069Returns crl bag type, currently only NID_crlBag is recognised.
1070
1071M_PKCS12_certbag2x509(bag)
1072
1073This macro extracts an X509 certificate from a certificate bag.
1074
1075M_PKCS12_certbag2x509crl(bag)
1076
1077As above but for a CRL.
1078
1079EVP_PKEY * PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8)
1080
1081Extract a private key from a PKCS8 private key info structure.
1082
1083M_PKCS12_decrypt_skey(bag, pass, passlen)
1084
1085Decrypt a shrouded key bag and return a PKCS8 private key info structure.
1086Works with both RSA and DSA keys
1087
1088char *PKCS12_get_friendlyname(bag)
1089
1090Returns the friendlyName of a bag if present or NULL if none. The returned
1091string is a null terminated ASCII string allocated with Malloc(). It should
1092thus be freed up with Free() after use.
1093
10942.2 AuthSafe functions.
1095
1096M_PKCS12_unpack_p7data(p7)
1097
1098Extract a STACK of safe bags from a PKCS#7 data ContentInfo.
1099
1100#define M_PKCS12_unpack_p7encdata(p7, pass, passlen)
1101
1102As above but for an encrypted content info.
1103
11042.3 PKCS12 functions.
1105
1106M_PKCS12_unpack_authsafes(p12)
1107
1108Extract a STACK of authsafes from a PKCS12 structure.
1109
1110M_PKCS12_mac_present(p12)
1111
1112Check to see if a MAC is present.
1113
1114int PKCS12_verify_mac(PKCS12 *p12, unsigned char *pass, int passlen)
1115
1116Verify a MAC on a PKCS12 structure. Returns an error if MAC not present.
1117
1118
1119Notes.
1120
11211. All the function return 0 or NULL on error.
11222. Encryption based functions take a common set of parameters. These are
1123described below.
1124
1125pass, passlen
1126ASCII password and length. The password on the MAC is called the "integrity
1127password" the encryption password is called the "privacy password" in the
1128PKCS#12 documentation. The passwords do not have to be the same. If -1 is
1129passed for the length it is worked out by the function itself (currently
1130this is sometimes done whatever is passed as the length but that may change).
1131
1132salt, saltlen
1133A 'salt' if salt is NULL a random salt is used. If saltlen is also zero a
1134default length is used.
1135
1136iter
1137Iteration count. This is a measure of how many times an internal function is
1138called to encrypt the data. The larger this value is the longer it takes, it
1139makes dictionary attacks on passwords harder. NOTE: Some implementations do
1140not support an iteration count on the MAC. If the password for the MAC and
1141encryption is the same then there is no point in having a high iteration
1142count for encryption if the MAC has no count. The MAC could be attacked
1143and the password used for the main decryption.
1144
1145pbe_nid
1146This is the NID of the password based encryption method used. The following are
1147supported.
1148NID_pbe_WithSHA1And128BitRC4
1149NID_pbe_WithSHA1And40BitRC4
1150NID_pbe_WithSHA1And3_Key_TripleDES_CBC
1151NID_pbe_WithSHA1And2_Key_TripleDES_CBC
1152NID_pbe_WithSHA1And128BitRC2_CBC
1153NID_pbe_WithSHA1And40BitRC2_CBC
1154
1155Which you use depends on the implementation you are exporting to. "Export
1156grade" (i.e. cryptographically challenged) products cannot support all
1157algorithms. Typically you may be able to use any encryption on shrouded key
1158bags but they must then be placed in an unencrypted authsafe. Other authsafes
1159may only support 40bit encryption. Of course if you are using SSLeay
1160throughout you can strongly encrypt everything and have high iteration counts
1161on everything.
1162
11633. For decryption routines only the password and length are needed.
1164
11654. Unlike the external version the nid's of objects are the values of the
1166constants: that is NID_certBag is the real nid, therefore there is no
1167PKCS12_obj_offset() function. Note the object constants are not the same as
1168those of the external version. If you use these constants then you will need
1169to recompile your code.
1170
11715. With the exception of PKCS12_MAKE_KEYBAG(), after calling any function or
1172macro of the form PKCS12_MAKE_SOMETHING(other) the "other" structure can be
1173reused or freed up safely.
1174
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c
deleted file mode 100644
index 299d2ae5d2..0000000000
--- a/src/lib/libssl/s23_clnt.c
+++ /dev/null
@@ -1,465 +0,0 @@
1/* ssl/s23_clnt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include <openssl/rand.h>
62#include <openssl/objects.h>
63#include <openssl/evp.h>
64#include "ssl_locl.h"
65
66static SSL_METHOD *ssl23_get_client_method(int ver);
67static int ssl23_client_hello(SSL *s);
68static int ssl23_get_server_hello(SSL *s);
69static SSL_METHOD *ssl23_get_client_method(int ver)
70 {
71 if (ver == SSL2_VERSION)
72 return(SSLv2_client_method());
73 if (ver == SSL3_VERSION)
74 return(SSLv3_client_method());
75 else if (ver == TLS1_VERSION)
76 return(TLSv1_client_method());
77 else
78 return(NULL);
79 }
80
81SSL_METHOD *SSLv23_client_method(void)
82 {
83 static int init=1;
84 static SSL_METHOD SSLv23_client_data;
85
86 if (init)
87 {
88 memcpy((char *)&SSLv23_client_data,
89 (char *)sslv23_base_method(),sizeof(SSL_METHOD));
90 SSLv23_client_data.ssl_connect=ssl23_connect;
91 SSLv23_client_data.get_ssl_method=ssl23_get_client_method;
92 init=0;
93 }
94 return(&SSLv23_client_data);
95 }
96
97int ssl23_connect(SSL *s)
98 {
99 BUF_MEM *buf;
100 unsigned long Time=time(NULL);
101 void (*cb)()=NULL;
102 int ret= -1;
103 int new_state,state;
104
105 RAND_seed(&Time,sizeof(Time));
106 ERR_clear_error();
107 clear_sys_error();
108
109 if (s->info_callback != NULL)
110 cb=s->info_callback;
111 else if (s->ctx->info_callback != NULL)
112 cb=s->ctx->info_callback;
113
114 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
115 s->in_handshake++;
116
117 for (;;)
118 {
119 state=s->state;
120
121 switch(s->state)
122 {
123 case SSL_ST_BEFORE:
124 case SSL_ST_CONNECT:
125 case SSL_ST_BEFORE|SSL_ST_CONNECT:
126 case SSL_ST_OK|SSL_ST_CONNECT:
127
128 if (s->session != NULL)
129 {
130 SSLerr(SSL_F_SSL23_CONNECT,SSL_R_SSL23_DOING_SESSION_ID_REUSE);
131 ret= -1;
132 goto end;
133 }
134 s->server=0;
135 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
136
137 /* s->version=TLS1_VERSION; */
138 s->type=SSL_ST_CONNECT;
139
140 if (s->init_buf == NULL)
141 {
142 if ((buf=BUF_MEM_new()) == NULL)
143 {
144 ret= -1;
145 goto end;
146 }
147 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
148 {
149 ret= -1;
150 goto end;
151 }
152 s->init_buf=buf;
153 }
154
155 if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
156
157 ssl3_init_finished_mac(s);
158
159 s->state=SSL23_ST_CW_CLNT_HELLO_A;
160 s->ctx->stats.sess_connect++;
161 s->init_num=0;
162 break;
163
164 case SSL23_ST_CW_CLNT_HELLO_A:
165 case SSL23_ST_CW_CLNT_HELLO_B:
166
167 s->shutdown=0;
168 ret=ssl23_client_hello(s);
169 if (ret <= 0) goto end;
170 s->state=SSL23_ST_CR_SRVR_HELLO_A;
171 s->init_num=0;
172
173 break;
174
175 case SSL23_ST_CR_SRVR_HELLO_A:
176 case SSL23_ST_CR_SRVR_HELLO_B:
177 ret=ssl23_get_server_hello(s);
178 if (ret >= 0) cb=NULL;
179 goto end;
180 /* break; */
181
182 default:
183 SSLerr(SSL_F_SSL23_CONNECT,SSL_R_UNKNOWN_STATE);
184 ret= -1;
185 goto end;
186 /* break; */
187 }
188
189 if (s->debug) { (void)BIO_flush(s->wbio); }
190
191 if ((cb != NULL) && (s->state != state))
192 {
193 new_state=s->state;
194 s->state=state;
195 cb(s,SSL_CB_CONNECT_LOOP,1);
196 s->state=new_state;
197 }
198 }
199end:
200 s->in_handshake--;
201 if (cb != NULL)
202 cb(s,SSL_CB_CONNECT_EXIT,ret);
203 return(ret);
204 }
205
206
207static int ssl23_client_hello(SSL *s)
208 {
209 unsigned char *buf;
210 unsigned char *p,*d;
211 int i,ch_len;
212
213 buf=(unsigned char *)s->init_buf->data;
214 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
215 {
216#if 0
217 /* don't reuse session-id's */
218 if (!ssl_get_new_session(s,0))
219 {
220 return(-1);
221 }
222#endif
223
224 p=s->s3->client_random;
225 RAND_bytes(p,SSL3_RANDOM_SIZE);
226
227 /* Do the message type and length last */
228 d= &(buf[2]);
229 p=d+9;
230
231 *(d++)=SSL2_MT_CLIENT_HELLO;
232 if (!(s->options & SSL_OP_NO_TLSv1))
233 {
234 *(d++)=TLS1_VERSION_MAJOR;
235 *(d++)=TLS1_VERSION_MINOR;
236 s->client_version=TLS1_VERSION;
237 }
238 else if (!(s->options & SSL_OP_NO_SSLv3))
239 {
240 *(d++)=SSL3_VERSION_MAJOR;
241 *(d++)=SSL3_VERSION_MINOR;
242 s->client_version=SSL3_VERSION;
243 }
244 else if (!(s->options & SSL_OP_NO_SSLv2))
245 {
246 *(d++)=SSL2_VERSION_MAJOR;
247 *(d++)=SSL2_VERSION_MINOR;
248 s->client_version=SSL2_VERSION;
249 }
250 else
251 {
252 SSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_PROTOCOLS_AVAILABLE);
253 return(-1);
254 }
255
256 /* Ciphers supported */
257 i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),p);
258 if (i == 0)
259 {
260 /* no ciphers */
261 SSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);
262 return(-1);
263 }
264 s2n(i,d);
265 p+=i;
266
267 /* put in the session-id, zero since there is no
268 * reuse. */
269#if 0
270 s->session->session_id_length=0;
271#endif
272 s2n(0,d);
273
274 if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)
275 ch_len=SSL2_CHALLENGE_LENGTH;
276 else
277 ch_len=SSL2_MAX_CHALLENGE_LENGTH;
278
279 /* write out sslv2 challenge */
280 if (SSL3_RANDOM_SIZE < ch_len)
281 i=SSL3_RANDOM_SIZE;
282 else
283 i=ch_len;
284 s2n(i,d);
285 memset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE);
286 RAND_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
287 memcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
288 p+=i;
289
290 i= p- &(buf[2]);
291 buf[0]=((i>>8)&0xff)|0x80;
292 buf[1]=(i&0xff);
293
294 s->state=SSL23_ST_CW_CLNT_HELLO_B;
295 /* number of bytes to write */
296 s->init_num=i+2;
297 s->init_off=0;
298
299 ssl3_finish_mac(s,&(buf[2]),i);
300 }
301
302 /* SSL3_ST_CW_CLNT_HELLO_B */
303 return(ssl23_write_bytes(s));
304 }
305
306static int ssl23_get_server_hello(SSL *s)
307 {
308 char buf[8];
309 unsigned char *p;
310 int i,ch_len;
311 int n;
312
313 n=ssl23_read_bytes(s,7);
314
315 if (n != 7) return(n);
316 p=s->packet;
317
318 memcpy(buf,p,n);
319
320 if ((p[0] & 0x80) && (p[2] == SSL2_MT_SERVER_HELLO) &&
321 (p[5] == 0x00) && (p[6] == 0x02))
322 {
323 /* we are talking sslv2 */
324 /* we need to clean up the SSLv3 setup and put in the
325 * sslv2 stuff. */
326
327 if (s->options & SSL_OP_NO_SSLv2)
328 {
329 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
330 goto err;
331 }
332 if (s->s2 == NULL)
333 {
334 if (!ssl2_new(s))
335 goto err;
336 }
337 else
338 ssl2_clear(s);
339
340 if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)
341 ch_len=SSL2_CHALLENGE_LENGTH;
342 else
343 ch_len=SSL2_MAX_CHALLENGE_LENGTH;
344
345 /* write out sslv2 challenge */
346 i=(SSL3_RANDOM_SIZE < ch_len)
347 ?SSL3_RANDOM_SIZE:ch_len;
348 s->s2->challenge_length=i;
349 memcpy(s->s2->challenge,
350 &(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);
351
352 if (s->s3 != NULL) ssl3_free(s);
353
354 if (!BUF_MEM_grow(s->init_buf,
355 SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))
356 {
357 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,ERR_R_BUF_LIB);
358 goto err;
359 }
360
361 s->state=SSL2_ST_GET_SERVER_HELLO_A;
362 s->s2->ssl2_rollback=1;
363
364 /* setup the 5 bytes we have read so we get them from
365 * the sslv2 buffer */
366 s->rstate=SSL_ST_READ_HEADER;
367 s->packet_length=n;
368 s->packet= &(s->s2->rbuf[0]);
369 memcpy(s->packet,buf,n);
370 s->s2->rbuf_left=n;
371 s->s2->rbuf_offs=0;
372
373 /* we have already written one */
374 s->s2->write_sequence=1;
375
376 s->method=SSLv2_client_method();
377 s->handshake_func=s->method->ssl_connect;
378 }
379 else if ((p[0] == SSL3_RT_HANDSHAKE) &&
380 (p[1] == SSL3_VERSION_MAJOR) &&
381 ((p[2] == SSL3_VERSION_MINOR) ||
382 (p[2] == TLS1_VERSION_MINOR)) &&
383 (p[5] == SSL3_MT_SERVER_HELLO))
384 {
385 /* we have sslv3 or tls1 */
386
387 if (!ssl_init_wbio_buffer(s,1)) goto err;
388
389 /* we are in this state */
390 s->state=SSL3_ST_CR_SRVR_HELLO_A;
391
392 /* put the 5 bytes we have read into the input buffer
393 * for SSLv3 */
394 s->rstate=SSL_ST_READ_HEADER;
395 s->packet_length=n;
396 s->packet= &(s->s3->rbuf.buf[0]);
397 memcpy(s->packet,buf,n);
398 s->s3->rbuf.left=n;
399 s->s3->rbuf.offset=0;
400
401 if ((p[2] == SSL3_VERSION_MINOR) &&
402 !(s->options & SSL_OP_NO_SSLv3))
403 {
404 s->version=SSL3_VERSION;
405 s->method=SSLv3_client_method();
406 }
407 else if ((p[2] == TLS1_VERSION_MINOR) &&
408 !(s->options & SSL_OP_NO_TLSv1))
409 {
410 s->version=TLS1_VERSION;
411 s->method=TLSv1_client_method();
412 }
413 else
414 {
415 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
416 goto err;
417 }
418
419 s->handshake_func=s->method->ssl_connect;
420 }
421 else if ((p[0] == SSL3_RT_ALERT) &&
422 (p[1] == SSL3_VERSION_MAJOR) &&
423 ((p[2] == SSL3_VERSION_MINOR) ||
424 (p[2] == TLS1_VERSION_MINOR)) &&
425 (p[3] == 0) &&
426 (p[4] == 2))
427 {
428 void (*cb)()=NULL;
429 int j;
430
431 /* An alert */
432 if (s->info_callback != NULL)
433 cb=s->info_callback;
434 else if (s->ctx->info_callback != NULL)
435 cb=s->ctx->info_callback;
436
437 i=p[5];
438 if (cb != NULL)
439 {
440 j=(i<<8)|p[6];
441 cb(s,SSL_CB_READ_ALERT,j);
442 }
443
444 s->rwstate=SSL_NOTHING;
445 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_AD_REASON_OFFSET+p[6]);
446 goto err;
447 }
448 else
449 {
450 SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNKNOWN_PROTOCOL);
451 goto err;
452 }
453 s->init_num=0;
454
455 /* Since, if we are sending a ssl23 client hello, we are not
456 * reusing a session-id */
457 if (!ssl_get_new_session(s,0))
458 goto err;
459
460 s->first_packet=1;
461 return(SSL_connect(s));
462err:
463 return(-1);
464 }
465
diff --git a/src/lib/libssl/s23_lib.c b/src/lib/libssl/s23_lib.c
deleted file mode 100644
index 822a395837..0000000000
--- a/src/lib/libssl/s23_lib.c
+++ /dev/null
@@ -1,213 +0,0 @@
1/* ssl/s23_lib.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/objects.h>
61#include "ssl_locl.h"
62
63static int ssl23_num_ciphers(void );
64static SSL_CIPHER *ssl23_get_cipher(unsigned int u);
65static int ssl23_read(SSL *s, void *buf, int len);
66static int ssl23_write(SSL *s, const void *buf, int len);
67static long ssl23_default_timeout(void );
68static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
69static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
70char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
71
72static SSL_METHOD SSLv23_data= {
73 TLS1_VERSION,
74 tls1_new,
75 tls1_clear,
76 tls1_free,
77 ssl_undefined_function,
78 ssl_undefined_function,
79 ssl23_read,
80 (int (*)(struct ssl_st *, char *, int))ssl_undefined_function,
81 ssl23_write,
82 ssl_undefined_function,
83 ssl_undefined_function,
84 ssl_ok,
85 ssl3_ctrl,
86 ssl3_ctx_ctrl,
87 ssl23_get_cipher_by_char,
88 ssl23_put_cipher_by_char,
89 ssl_undefined_function,
90 ssl23_num_ciphers,
91 ssl23_get_cipher,
92 ssl_bad_method,
93 ssl23_default_timeout,
94 &ssl3_undef_enc_method,
95 };
96
97static long ssl23_default_timeout(void)
98 {
99 return(300);
100 }
101
102SSL_METHOD *sslv23_base_method(void)
103 {
104 return(&SSLv23_data);
105 }
106
107static int ssl23_num_ciphers(void)
108 {
109 return(ssl3_num_ciphers()+ssl2_num_ciphers());
110 }
111
112static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
113 {
114 unsigned int uu=ssl3_num_ciphers();
115
116 if (u < uu)
117 return(ssl3_get_cipher(u));
118 else
119 return(ssl2_get_cipher(u-uu));
120 }
121
122/* This function needs to check if the ciphers required are actually
123 * available */
124static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
125 {
126 SSL_CIPHER c,*cp;
127 unsigned long id;
128 int n;
129
130 n=ssl3_num_ciphers();
131 id=0x03000000|((unsigned long)p[0]<<16L)|
132 ((unsigned long)p[1]<<8L)|(unsigned long)p[2];
133 c.id=id;
134 cp=ssl3_get_cipher_by_char(p);
135 if (cp == NULL)
136 cp=ssl2_get_cipher_by_char(p);
137 return(cp);
138 }
139
140static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
141 {
142 long l;
143
144 /* We can write SSLv2 and SSLv3 ciphers */
145 if (p != NULL)
146 {
147 l=c->id;
148 p[0]=((unsigned char)(l>>16L))&0xFF;
149 p[1]=((unsigned char)(l>> 8L))&0xFF;
150 p[2]=((unsigned char)(l ))&0xFF;
151 }
152 return(3);
153 }
154
155static int ssl23_read(SSL *s, void *buf, int len)
156 {
157 int n;
158
159#if 0
160 if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
161 {
162 s->rwstate=SSL_NOTHING;
163 return(0);
164 }
165#endif
166 clear_sys_error();
167 if (SSL_in_init(s) && (!s->in_handshake))
168 {
169 n=s->handshake_func(s);
170 if (n < 0) return(n);
171 if (n == 0)
172 {
173 SSLerr(SSL_F_SSL23_READ,SSL_R_SSL_HANDSHAKE_FAILURE);
174 return(-1);
175 }
176 return(SSL_read(s,buf,len));
177 }
178 else
179 {
180 ssl_undefined_function(s);
181 return(-1);
182 }
183 }
184
185static int ssl23_write(SSL *s, const void *buf, int len)
186 {
187 int n;
188
189#if 0
190 if (s->shutdown & SSL_SENT_SHUTDOWN)
191 {
192 s->rwstate=SSL_NOTHING;
193 return(0);
194 }
195#endif
196 clear_sys_error();
197 if (SSL_in_init(s) && (!s->in_handshake))
198 {
199 n=s->handshake_func(s);
200 if (n < 0) return(n);
201 if (n == 0)
202 {
203 SSLerr(SSL_F_SSL23_WRITE,SSL_R_SSL_HANDSHAKE_FAILURE);
204 return(-1);
205 }
206 return(SSL_write(s,buf,len));
207 }
208 else
209 {
210 ssl_undefined_function(s);
211 return(-1);
212 }
213 }
diff --git a/src/lib/libssl/s23_pkt.c b/src/lib/libssl/s23_pkt.c
deleted file mode 100644
index 8370ea508c..0000000000
--- a/src/lib/libssl/s23_pkt.c
+++ /dev/null
@@ -1,117 +0,0 @@
1/* ssl/s23_pkt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <errno.h>
61#define USE_SOCKETS
62#include <openssl/evp.h>
63#include <openssl/buffer.h>
64#include "ssl_locl.h"
65
66int ssl23_write_bytes(SSL *s)
67 {
68 int i,num,tot;
69 char *buf;
70
71 buf=s->init_buf->data;
72 tot=s->init_off;
73 num=s->init_num;
74 for (;;)
75 {
76 s->rwstate=SSL_WRITING;
77 i=BIO_write(s->wbio,&(buf[tot]),num);
78 if (i <= 0)
79 {
80 s->init_off=tot;
81 s->init_num=num;
82 return(i);
83 }
84 s->rwstate=SSL_NOTHING;
85 if (i == num) return(tot+i);
86
87 num-=i;
88 tot+=i;
89 }
90 }
91
92/* only return when we have read 'n' bytes */
93int ssl23_read_bytes(SSL *s, int n)
94 {
95 unsigned char *p;
96 int j;
97
98 if (s->packet_length < (unsigned int)n)
99 {
100 p=s->packet;
101
102 for (;;)
103 {
104 s->rwstate=SSL_READING;
105 j=BIO_read(s->rbio,(char *)&(p[s->packet_length]),
106 n-s->packet_length);
107 if (j <= 0)
108 return(j);
109 s->rwstate=SSL_NOTHING;
110 s->packet_length+=j;
111 if (s->packet_length >= (unsigned int)n)
112 return(s->packet_length);
113 }
114 }
115 return(n);
116 }
117
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
deleted file mode 100644
index e4122f2d78..0000000000
--- a/src/lib/libssl/s23_srvr.c
+++ /dev/null
@@ -1,503 +0,0 @@
1/* ssl/s23_srvr.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include <openssl/rand.h>
62#include <openssl/objects.h>
63#include <openssl/evp.h>
64#include "ssl_locl.h"
65
66static SSL_METHOD *ssl23_get_server_method(int ver);
67int ssl23_get_client_hello(SSL *s);
68static SSL_METHOD *ssl23_get_server_method(int ver)
69 {
70 if (ver == SSL2_VERSION)
71 return(SSLv2_server_method());
72 if (ver == SSL3_VERSION)
73 return(SSLv3_server_method());
74 else if (ver == TLS1_VERSION)
75 return(TLSv1_server_method());
76 else
77 return(NULL);
78 }
79
80SSL_METHOD *SSLv23_server_method(void)
81 {
82 static int init=1;
83 static SSL_METHOD SSLv23_server_data;
84
85 if (init)
86 {
87 memcpy((char *)&SSLv23_server_data,
88 (char *)sslv23_base_method(),sizeof(SSL_METHOD));
89 SSLv23_server_data.ssl_accept=ssl23_accept;
90 SSLv23_server_data.get_ssl_method=ssl23_get_server_method;
91 init=0;
92 }
93 return(&SSLv23_server_data);
94 }
95
96int ssl23_accept(SSL *s)
97 {
98 BUF_MEM *buf;
99 unsigned long Time=time(NULL);
100 void (*cb)()=NULL;
101 int ret= -1;
102 int new_state,state;
103
104 RAND_seed(&Time,sizeof(Time));
105 ERR_clear_error();
106 clear_sys_error();
107
108 if (s->info_callback != NULL)
109 cb=s->info_callback;
110 else if (s->ctx->info_callback != NULL)
111 cb=s->ctx->info_callback;
112
113 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
114 s->in_handshake++;
115
116 for (;;)
117 {
118 state=s->state;
119
120 switch(s->state)
121 {
122 case SSL_ST_BEFORE:
123 case SSL_ST_ACCEPT:
124 case SSL_ST_BEFORE|SSL_ST_ACCEPT:
125 case SSL_ST_OK|SSL_ST_ACCEPT:
126
127 s->server=1;
128 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
129
130 /* s->version=SSL3_VERSION; */
131 s->type=SSL_ST_ACCEPT;
132
133 if (s->init_buf == NULL)
134 {
135 if ((buf=BUF_MEM_new()) == NULL)
136 {
137 ret= -1;
138 goto end;
139 }
140 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
141 {
142 ret= -1;
143 goto end;
144 }
145 s->init_buf=buf;
146 }
147
148 ssl3_init_finished_mac(s);
149
150 s->state=SSL23_ST_SR_CLNT_HELLO_A;
151 s->ctx->stats.sess_accept++;
152 s->init_num=0;
153 break;
154
155 case SSL23_ST_SR_CLNT_HELLO_A:
156 case SSL23_ST_SR_CLNT_HELLO_B:
157
158 s->shutdown=0;
159 ret=ssl23_get_client_hello(s);
160 if (ret >= 0) cb=NULL;
161 goto end;
162 /* break; */
163
164 default:
165 SSLerr(SSL_F_SSL23_ACCEPT,SSL_R_UNKNOWN_STATE);
166 ret= -1;
167 goto end;
168 /* break; */
169 }
170
171 if ((cb != NULL) && (s->state != state))
172 {
173 new_state=s->state;
174 s->state=state;
175 cb(s,SSL_CB_ACCEPT_LOOP,1);
176 s->state=new_state;
177 }
178 }
179end:
180 if (cb != NULL)
181 cb(s,SSL_CB_ACCEPT_EXIT,ret);
182 s->in_handshake--;
183 return(ret);
184 }
185
186
187int ssl23_get_client_hello(SSL *s)
188 {
189 char buf_space[8];
190 char *buf= &(buf_space[0]);
191 unsigned char *p,*d,*dd;
192 unsigned int i;
193 unsigned int csl,sil,cl;
194 int n=0,j,tls1=0;
195 int type=0,use_sslv2_strong=0;
196 int v[2];
197
198 /* read the initial header */
199 v[0]=v[1]=0;
200 if (s->state == SSL23_ST_SR_CLNT_HELLO_A)
201 {
202 if (!ssl3_setup_buffers(s)) goto err;
203
204 n=ssl23_read_bytes(s,7);
205 if (n != 7) return(n); /* n == -1 || n == 0 */
206
207 p=s->packet;
208
209 memcpy(buf,p,n);
210
211 if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO))
212 {
213 /* SSLv2 header */
214 if ((p[3] == 0x00) && (p[4] == 0x02))
215 {
216 v[0]=p[3]; v[1]=p[4];
217 /* SSLv2 */
218 if (!(s->options & SSL_OP_NO_SSLv2))
219 type=1;
220 }
221 else if (p[3] == SSL3_VERSION_MAJOR)
222 {
223 v[0]=p[3]; v[1]=p[4];
224 /* SSLv3/TLSv1 */
225 if (p[4] >= TLS1_VERSION_MINOR)
226 {
227 if (!(s->options & SSL_OP_NO_TLSv1))
228 {
229 tls1=1;
230 s->state=SSL23_ST_SR_CLNT_HELLO_B;
231 }
232 else if (!(s->options & SSL_OP_NO_SSLv3))
233 {
234 s->state=SSL23_ST_SR_CLNT_HELLO_B;
235 }
236 else if (!(s->options & SSL_OP_NO_SSLv2))
237 {
238 type=1;
239 }
240 }
241 else if (!(s->options & SSL_OP_NO_SSLv3))
242 s->state=SSL23_ST_SR_CLNT_HELLO_B;
243 else if (!(s->options & SSL_OP_NO_SSLv2))
244 type=1;
245
246 if (s->options & SSL_OP_NON_EXPORT_FIRST)
247 {
248 STACK_OF(SSL_CIPHER) *sk;
249 SSL_CIPHER *c;
250 int ne2,ne3;
251
252 j=((p[0]&0x7f)<<8)|p[1];
253 if (j > (1024*4))
254 {
255 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE);
256 goto err;
257 }
258
259 n=ssl23_read_bytes(s,j+2);
260 if (n <= 0) return(n);
261 p=s->packet;
262
263 if ((buf=Malloc(n)) == NULL)
264 {
265 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,ERR_R_MALLOC_FAILURE);
266 goto err;
267 }
268 memcpy(buf,p,n);
269
270 p+=5;
271 n2s(p,csl);
272 p+=4;
273
274 sk=ssl_bytes_to_cipher_list(
275 s,p,csl,NULL);
276 if (sk != NULL)
277 {
278 ne2=ne3=0;
279 for (j=0; j<sk_SSL_CIPHER_num(sk); j++)
280 {
281 c=sk_SSL_CIPHER_value(sk,j);
282 if (!SSL_C_IS_EXPORT(c))
283 {
284 if ((c->id>>24L) == 2L)
285 ne2=1;
286 else
287 ne3=1;
288 }
289 }
290 if (ne2 && !ne3)
291 {
292 type=1;
293 use_sslv2_strong=1;
294 goto next_bit;
295 }
296 }
297 }
298 }
299 }
300 else if ((p[0] == SSL3_RT_HANDSHAKE) &&
301 (p[1] == SSL3_VERSION_MAJOR) &&
302 (p[5] == SSL3_MT_CLIENT_HELLO))
303 {
304 v[0]=p[1]; v[1]=p[2];
305 /* true SSLv3 or tls1 */
306 if (p[2] >= TLS1_VERSION_MINOR)
307 {
308 if (!(s->options & SSL_OP_NO_TLSv1))
309 {
310 type=3;
311 tls1=1;
312 }
313 else if (!(s->options & SSL_OP_NO_SSLv3))
314 type=3;
315 }
316 else if (!(s->options & SSL_OP_NO_SSLv3))
317 type=3;
318 }
319 else if ((strncmp("GET ", (char *)p,4) == 0) ||
320 (strncmp("POST ",(char *)p,5) == 0) ||
321 (strncmp("HEAD ",(char *)p,5) == 0) ||
322 (strncmp("PUT ", (char *)p,4) == 0))
323 {
324 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_HTTP_REQUEST);
325 goto err;
326 }
327 else if (strncmp("CONNECT",(char *)p,7) == 0)
328 {
329 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_HTTPS_PROXY_REQUEST);
330 goto err;
331 }
332 }
333
334next_bit:
335 if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
336 {
337 /* we have a SSLv3/TLSv1 in a SSLv2 header */
338 type=2;
339 p=s->packet;
340 n=((p[0]&0x7f)<<8)|p[1];
341 if (n > (1024*4))
342 {
343 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE);
344 goto err;
345 }
346
347 j=ssl23_read_bytes(s,n+2);
348 if (j <= 0) return(j);
349
350 ssl3_finish_mac(s,&(s->packet[2]),s->packet_length-2);
351
352 p=s->packet;
353 p+=5;
354 n2s(p,csl);
355 n2s(p,sil);
356 n2s(p,cl);
357 d=(unsigned char *)s->init_buf->data;
358 if ((csl+sil+cl+11) != s->packet_length)
359 {
360 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_LENGTH_MISMATCH);
361 goto err;
362 }
363
364 *(d++)=SSL3_VERSION_MAJOR;
365 if (tls1)
366 *(d++)=TLS1_VERSION_MINOR;
367 else
368 *(d++)=SSL3_VERSION_MINOR;
369
370 /* lets populate the random area */
371 /* get the chalenge_length */
372 i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;
373 memset(d,0,SSL3_RANDOM_SIZE);
374 memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);
375 d+=SSL3_RANDOM_SIZE;
376
377 /* no session-id reuse */
378 *(d++)=0;
379
380 /* ciphers */
381 j=0;
382 dd=d;
383 d+=2;
384 for (i=0; i<csl; i+=3)
385 {
386 if (p[i] != 0) continue;
387 *(d++)=p[i+1];
388 *(d++)=p[i+2];
389 j+=2;
390 }
391 s2n(j,dd);
392
393 /* COMPRESSION */
394 *(d++)=1;
395 *(d++)=0;
396
397 i=(d-(unsigned char *)s->init_buf->data);
398
399 /* get the data reused from the init_buf */
400 s->s3->tmp.reuse_message=1;
401 s->s3->tmp.message_type=SSL3_MT_CLIENT_HELLO;
402 s->s3->tmp.message_size=i;
403 }
404
405 if (type == 1)
406 {
407 /* we are talking sslv2 */
408 /* we need to clean up the SSLv3/TLSv1 setup and put in the
409 * sslv2 stuff. */
410
411 if (s->s2 == NULL)
412 {
413 if (!ssl2_new(s))
414 goto err;
415 }
416 else
417 ssl2_clear(s);
418
419 if (s->s3 != NULL) ssl3_free(s);
420
421 if (!BUF_MEM_grow(s->init_buf,
422 SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))
423 {
424 goto err;
425 }
426
427 s->state=SSL2_ST_GET_CLIENT_HELLO_A;
428 if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) ||
429 use_sslv2_strong)
430 s->s2->ssl2_rollback=0;
431 else
432 s->s2->ssl2_rollback=1;
433
434 /* setup the 5 bytes we have read so we get them from
435 * the sslv2 buffer */
436 s->rstate=SSL_ST_READ_HEADER;
437 s->packet_length=n;
438 s->packet= &(s->s2->rbuf[0]);
439 memcpy(s->packet,buf,n);
440 s->s2->rbuf_left=n;
441 s->s2->rbuf_offs=0;
442
443 s->method=SSLv2_server_method();
444 s->handshake_func=s->method->ssl_accept;
445 }
446
447 if ((type == 2) || (type == 3))
448 {
449 /* we have SSLv3/TLSv1 */
450
451 if (!ssl_init_wbio_buffer(s,1)) goto err;
452
453 /* we are in this state */
454 s->state=SSL3_ST_SR_CLNT_HELLO_A;
455
456 if (type == 3)
457 {
458 /* put the 'n' bytes we have read into the input buffer
459 * for SSLv3 */
460 s->rstate=SSL_ST_READ_HEADER;
461 s->packet_length=n;
462 s->packet= &(s->s3->rbuf.buf[0]);
463 memcpy(s->packet,buf,n);
464 s->s3->rbuf.left=n;
465 s->s3->rbuf.offset=0;
466 }
467 else
468 {
469 s->packet_length=0;
470 s->s3->rbuf.left=0;
471 s->s3->rbuf.offset=0;
472 }
473
474 if (tls1)
475 {
476 s->version=TLS1_VERSION;
477 s->method=TLSv1_server_method();
478 }
479 else
480 {
481 s->version=SSL3_VERSION;
482 s->method=SSLv3_server_method();
483 }
484 s->client_version=(v[0]<<8)|v[1];
485 s->handshake_func=s->method->ssl_accept;
486 }
487
488 if ((type < 1) || (type > 3))
489 {
490 /* bad, very bad */
491 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNKNOWN_PROTOCOL);
492 goto err;
493 }
494 s->init_num=0;
495
496 if (buf != buf_space) Free(buf);
497 s->first_packet=1;
498 return(SSL_accept(s));
499err:
500 if (buf != buf_space) Free(buf);
501 return(-1);
502 }
503
diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c
deleted file mode 100644
index f3f27715d5..0000000000
--- a/src/lib/libssl/s3_both.c
+++ /dev/null
@@ -1,468 +0,0 @@
1/* ssl/s3_both.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include <openssl/rand.h>
62#include <openssl/objects.h>
63#include <openssl/evp.h>
64#include <openssl/x509.h>
65#include "ssl_locl.h"
66
67int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,
68 int slen)
69 {
70 unsigned char *p,*d;
71 int i;
72 unsigned long l;
73
74 if (s->state == a)
75 {
76 d=(unsigned char *)s->init_buf->data;
77 p= &(d[4]);
78
79 i=s->method->ssl3_enc->final_finish_mac(s,
80 &(s->s3->finish_dgst1),
81 &(s->s3->finish_dgst2),
82 sender,slen,p);
83 p+=i;
84 l=i;
85
86#ifdef WIN16
87 /* MSVC 1.5 does not clear the top bytes of the word unless
88 * I do this.
89 */
90 l&=0xffff;
91#endif
92
93 *(d++)=SSL3_MT_FINISHED;
94 l2n3(l,d);
95 s->init_num=(int)l+4;
96 s->init_off=0;
97
98 s->state=b;
99 }
100
101 /* SSL3_ST_SEND_xxxxxx_HELLO_B */
102 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
103 }
104
105int ssl3_get_finished(SSL *s, int a, int b)
106 {
107 int al,i,ok;
108 long n;
109 unsigned char *p;
110
111 /* the mac has already been generated when we received the
112 * change cipher spec message and is in s->s3->tmp.in_dgst[12]
113 */
114
115 n=ssl3_get_message(s,
116 a,
117 b,
118 SSL3_MT_FINISHED,
119 64, /* should actually be 36+4 :-) */
120 &ok);
121
122 if (!ok) return((int)n);
123
124 /* If this occurs if we has missed a message */
125 if (!s->s3->change_cipher_spec)
126 {
127 al=SSL_AD_UNEXPECTED_MESSAGE;
128 SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_GOT_A_FIN_BEFORE_A_CCS);
129 goto f_err;
130 }
131 s->s3->change_cipher_spec=0;
132
133 p=(unsigned char *)s->init_buf->data;
134
135 i=s->method->ssl3_enc->finish_mac_length;
136
137 if (i != n)
138 {
139 al=SSL_AD_DECODE_ERROR;
140 SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_BAD_DIGEST_LENGTH);
141 goto f_err;
142 }
143
144 if (memcmp( p, (char *)&(s->s3->tmp.finish_md[0]),i) != 0)
145 {
146 al=SSL_AD_DECRYPT_ERROR;
147 SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
148 goto f_err;
149 }
150
151 return(1);
152f_err:
153 ssl3_send_alert(s,SSL3_AL_FATAL,al);
154 return(0);
155 }
156
157/* for these 2 messages, we need to
158 * ssl->enc_read_ctx re-init
159 * ssl->s3->read_sequence zero
160 * ssl->s3->read_mac_secret re-init
161 * ssl->session->read_sym_enc assign
162 * ssl->session->read_compression assign
163 * ssl->session->read_hash assign
164 */
165int ssl3_send_change_cipher_spec(SSL *s, int a, int b)
166 {
167 unsigned char *p;
168
169 if (s->state == a)
170 {
171 p=(unsigned char *)s->init_buf->data;
172 *p=SSL3_MT_CCS;
173 s->init_num=1;
174 s->init_off=0;
175
176 s->state=b;
177 }
178
179 /* SSL3_ST_CW_CHANGE_B */
180 return(ssl3_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
181 }
182
183unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
184 {
185 unsigned char *p;
186 int n,i;
187 unsigned long l=7;
188 BUF_MEM *buf;
189 X509_STORE_CTX xs_ctx;
190 X509_OBJECT obj;
191
192 /* TLSv1 sends a chain with nothing in it, instead of an alert */
193 buf=s->init_buf;
194 if (!BUF_MEM_grow(buf,(int)(10)))
195 {
196 SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
197 return(0);
198 }
199 if (x != NULL)
200 {
201 X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL);
202
203 for (;;)
204 {
205 n=i2d_X509(x,NULL);
206 if (!BUF_MEM_grow(buf,(int)(n+l+3)))
207 {
208 SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
209 return(0);
210 }
211 p=(unsigned char *)&(buf->data[l]);
212 l2n3(n,p);
213 i2d_X509(x,&p);
214 l+=n+3;
215 if (X509_NAME_cmp(X509_get_subject_name(x),
216 X509_get_issuer_name(x)) == 0) break;
217
218 i=X509_STORE_get_by_subject(&xs_ctx,X509_LU_X509,
219 X509_get_issuer_name(x),&obj);
220 if (i <= 0) break;
221 x=obj.data.x509;
222 /* Count is one too high since the X509_STORE_get uped the
223 * ref count */
224 X509_free(x);
225 }
226
227 X509_STORE_CTX_cleanup(&xs_ctx);
228 }
229
230 /* Thawte special :-) */
231 if (s->ctx->extra_certs != NULL)
232 for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
233 {
234 x=sk_X509_value(s->ctx->extra_certs,i);
235 n=i2d_X509(x,NULL);
236 if (!BUF_MEM_grow(buf,(int)(n+l+3)))
237 {
238 SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
239 return(0);
240 }
241 p=(unsigned char *)&(buf->data[l]);
242 l2n3(n,p);
243 i2d_X509(x,&p);
244 l+=n+3;
245 }
246
247 l-=7;
248 p=(unsigned char *)&(buf->data[4]);
249 l2n3(l,p);
250 l+=3;
251 p=(unsigned char *)&(buf->data[0]);
252 *(p++)=SSL3_MT_CERTIFICATE;
253 l2n3(l,p);
254 l+=4;
255 return(l);
256 }
257
258long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
259 {
260 unsigned char *p;
261 unsigned long l;
262 long n;
263 int i,al;
264
265 if (s->s3->tmp.reuse_message)
266 {
267 s->s3->tmp.reuse_message=0;
268 if ((mt >= 0) && (s->s3->tmp.message_type != mt))
269 {
270 al=SSL_AD_UNEXPECTED_MESSAGE;
271 SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
272 goto f_err;
273 }
274 *ok=1;
275 return((int)s->s3->tmp.message_size);
276 }
277
278 p=(unsigned char *)s->init_buf->data;
279
280 if (s->state == st1)
281 {
282 i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
283 4-s->init_num);
284 if (i < (4-s->init_num))
285 {
286 *ok=0;
287 return(ssl3_part_read(s,i));
288 }
289
290 if ((mt >= 0) && (*p != mt))
291 {
292 al=SSL_AD_UNEXPECTED_MESSAGE;
293 SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
294 goto f_err;
295 }
296 s->s3->tmp.message_type= *(p++);
297
298 n2l3(p,l);
299 if (l > (unsigned long)max)
300 {
301 al=SSL_AD_ILLEGAL_PARAMETER;
302 SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
303 goto f_err;
304 }
305 if (l && !BUF_MEM_grow(s->init_buf,(int)l))
306 {
307 SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);
308 goto err;
309 }
310 s->s3->tmp.message_size=l;
311 s->state=stn;
312
313 s->init_num=0;
314 }
315
316 /* next state (stn) */
317 p=(unsigned char *)s->init_buf->data;
318 n=s->s3->tmp.message_size;
319 if (n > 0)
320 {
321 i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n);
322 if (i != (int)n)
323 {
324 *ok=0;
325 return(ssl3_part_read(s,i));
326 }
327 }
328 *ok=1;
329 return(n);
330f_err:
331 ssl3_send_alert(s,SSL3_AL_FATAL,al);
332err:
333 *ok=0;
334 return(-1);
335 }
336
337int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
338 {
339 EVP_PKEY *pk;
340 int ret= -1,i,j;
341
342 if (pkey == NULL)
343 pk=X509_get_pubkey(x);
344 else
345 pk=pkey;
346 if (pk == NULL) goto err;
347
348 i=pk->type;
349 if (i == EVP_PKEY_RSA)
350 {
351 ret=SSL_PKEY_RSA_ENC;
352 if (x != NULL)
353 {
354 j=X509_get_ext_count(x);
355 /* check to see if this is a signing only certificate */
356 /* EAY EAY EAY EAY */
357 }
358 }
359 else if (i == EVP_PKEY_DSA)
360 {
361 ret=SSL_PKEY_DSA_SIGN;
362 }
363 else if (i == EVP_PKEY_DH)
364 {
365 /* if we just have a key, we needs to be guess */
366
367 if (x == NULL)
368 ret=SSL_PKEY_DH_DSA;
369 else
370 {
371 j=X509_get_signature_type(x);
372 if (j == EVP_PKEY_RSA)
373 ret=SSL_PKEY_DH_RSA;
374 else if (j== EVP_PKEY_DSA)
375 ret=SSL_PKEY_DH_DSA;
376 else ret= -1;
377 }
378 }
379 else
380 ret= -1;
381
382err:
383 if(!pkey) EVP_PKEY_free(pk);
384 return(ret);
385 }
386
387int ssl_verify_alarm_type(long type)
388 {
389 int al;
390
391 switch(type)
392 {
393 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
394 case X509_V_ERR_UNABLE_TO_GET_CRL:
395 al=SSL_AD_UNKNOWN_CA;
396 break;
397 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
398 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
399 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
400 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
401 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
402 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
403 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
404 case X509_V_ERR_CERT_NOT_YET_VALID:
405 case X509_V_ERR_CRL_NOT_YET_VALID:
406 al=SSL_AD_BAD_CERTIFICATE;
407 break;
408 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
409 case X509_V_ERR_CRL_SIGNATURE_FAILURE:
410 al=SSL_AD_DECRYPT_ERROR;
411 break;
412 case X509_V_ERR_CERT_HAS_EXPIRED:
413 case X509_V_ERR_CRL_HAS_EXPIRED:
414 al=SSL_AD_CERTIFICATE_EXPIRED;
415 break;
416 case X509_V_ERR_CERT_REVOKED:
417 al=SSL_AD_CERTIFICATE_REVOKED;
418 break;
419 case X509_V_ERR_OUT_OF_MEM:
420 al=SSL_AD_INTERNAL_ERROR;
421 break;
422 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
423 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
424 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
425 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
426 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
427 al=SSL_AD_UNKNOWN_CA;
428 break;
429 case X509_V_ERR_APPLICATION_VERIFICATION:
430 al=SSL_AD_HANDSHAKE_FAILURE;
431 break;
432 default:
433 al=SSL_AD_CERTIFICATE_UNKNOWN;
434 break;
435 }
436 return(al);
437 }
438
439int ssl3_setup_buffers(SSL *s)
440 {
441 unsigned char *p;
442 unsigned int extra;
443
444 if (s->s3->rbuf.buf == NULL)
445 {
446 if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
447 extra=SSL3_RT_MAX_EXTRA;
448 else
449 extra=0;
450 if ((p=(unsigned char *)Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
451 == NULL)
452 goto err;
453 s->s3->rbuf.buf=p;
454 }
455
456 if (s->s3->wbuf.buf == NULL)
457 {
458 if ((p=(unsigned char *)Malloc(SSL3_RT_MAX_PACKET_SIZE))
459 == NULL)
460 goto err;
461 s->s3->wbuf.buf=p;
462 }
463 s->packet= &(s->s3->rbuf.buf[0]);
464 return(1);
465err:
466 SSLerr(SSL_F_SSL3_SETUP_BUFFERS,ERR_R_MALLOC_FAILURE);
467 return(0);
468 }
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
deleted file mode 100644
index d3e6b4d1e5..0000000000
--- a/src/lib/libssl/s3_clnt.c
+++ /dev/null
@@ -1,1729 +0,0 @@
1/* ssl/s3_clnt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include <openssl/rand.h>
62#include <openssl/objects.h>
63#include <openssl/md5.h>
64#include <openssl/sha.h>
65#include <openssl/evp.h>
66#include "ssl_locl.h"
67
68static SSL_METHOD *ssl3_get_client_method(int ver);
69static int ssl3_client_hello(SSL *s);
70static int ssl3_get_server_hello(SSL *s);
71static int ssl3_get_certificate_request(SSL *s);
72static int ca_dn_cmp(X509_NAME **a,X509_NAME **b);
73static int ssl3_get_server_done(SSL *s);
74static int ssl3_send_client_verify(SSL *s);
75static int ssl3_send_client_certificate(SSL *s);
76static int ssl3_send_client_key_exchange(SSL *s);
77static int ssl3_get_key_exchange(SSL *s);
78static int ssl3_get_server_certificate(SSL *s);
79static int ssl3_check_cert_and_algorithm(SSL *s);
80static SSL_METHOD *ssl3_get_client_method(int ver)
81 {
82 if (ver == SSL3_VERSION)
83 return(SSLv3_client_method());
84 else
85 return(NULL);
86 }
87
88SSL_METHOD *SSLv3_client_method(void)
89 {
90 static int init=1;
91 static SSL_METHOD SSLv3_client_data;
92
93 if (init)
94 {
95 init=0;
96 memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(),
97 sizeof(SSL_METHOD));
98 SSLv3_client_data.ssl_connect=ssl3_connect;
99 SSLv3_client_data.get_ssl_method=ssl3_get_client_method;
100 }
101 return(&SSLv3_client_data);
102 }
103
104int ssl3_connect(SSL *s)
105 {
106 BUF_MEM *buf;
107 unsigned long Time=time(NULL),l;
108 long num1;
109 void (*cb)()=NULL;
110 int ret= -1;
111 int new_state,state,skip=0;;
112
113 RAND_seed(&Time,sizeof(Time));
114 ERR_clear_error();
115 clear_sys_error();
116
117 if (s->info_callback != NULL)
118 cb=s->info_callback;
119 else if (s->ctx->info_callback != NULL)
120 cb=s->ctx->info_callback;
121
122 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
123 s->in_handshake++;
124
125 for (;;)
126 {
127 state=s->state;
128
129 switch(s->state)
130 {
131 case SSL_ST_RENEGOTIATE:
132 s->new_session=1;
133 s->state=SSL_ST_CONNECT;
134 s->ctx->stats.sess_connect_renegotiate++;
135 /* break */
136 case SSL_ST_BEFORE:
137 case SSL_ST_CONNECT:
138 case SSL_ST_BEFORE|SSL_ST_CONNECT:
139 case SSL_ST_OK|SSL_ST_CONNECT:
140
141 s->server=0;
142 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
143
144 if ((s->version & 0xff00 ) != 0x0300)
145 abort();
146 /* s->version=SSL3_VERSION; */
147 s->type=SSL_ST_CONNECT;
148
149 if (s->init_buf == NULL)
150 {
151 if ((buf=BUF_MEM_new()) == NULL)
152 {
153 ret= -1;
154 goto end;
155 }
156 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
157 {
158 ret= -1;
159 goto end;
160 }
161 s->init_buf=buf;
162 }
163
164 if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
165
166 /* setup buffing BIO */
167 if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
168
169 /* don't push the buffering BIO quite yet */
170
171 ssl3_init_finished_mac(s);
172
173 s->state=SSL3_ST_CW_CLNT_HELLO_A;
174 s->ctx->stats.sess_connect++;
175 s->init_num=0;
176 break;
177
178 case SSL3_ST_CW_CLNT_HELLO_A:
179 case SSL3_ST_CW_CLNT_HELLO_B:
180
181 s->shutdown=0;
182 ret=ssl3_client_hello(s);
183 if (ret <= 0) goto end;
184 s->state=SSL3_ST_CR_SRVR_HELLO_A;
185 s->init_num=0;
186
187 /* turn on buffering for the next lot of output */
188 if (s->bbio != s->wbio)
189 s->wbio=BIO_push(s->bbio,s->wbio);
190
191 break;
192
193 case SSL3_ST_CR_SRVR_HELLO_A:
194 case SSL3_ST_CR_SRVR_HELLO_B:
195 ret=ssl3_get_server_hello(s);
196 if (ret <= 0) goto end;
197 if (s->hit)
198 s->state=SSL3_ST_CR_FINISHED_A;
199 else
200 s->state=SSL3_ST_CR_CERT_A;
201 s->init_num=0;
202 break;
203
204 case SSL3_ST_CR_CERT_A:
205 case SSL3_ST_CR_CERT_B:
206 /* Check if it is anon DH */
207 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
208 {
209 ret=ssl3_get_server_certificate(s);
210 if (ret <= 0) goto end;
211 }
212 else
213 skip=1;
214 s->state=SSL3_ST_CR_KEY_EXCH_A;
215 s->init_num=0;
216 break;
217
218 case SSL3_ST_CR_KEY_EXCH_A:
219 case SSL3_ST_CR_KEY_EXCH_B:
220 ret=ssl3_get_key_exchange(s);
221 if (ret <= 0) goto end;
222 s->state=SSL3_ST_CR_CERT_REQ_A;
223 s->init_num=0;
224
225 /* at this point we check that we have the
226 * required stuff from the server */
227 if (!ssl3_check_cert_and_algorithm(s))
228 {
229 ret= -1;
230 goto end;
231 }
232 break;
233
234 case SSL3_ST_CR_CERT_REQ_A:
235 case SSL3_ST_CR_CERT_REQ_B:
236 ret=ssl3_get_certificate_request(s);
237 if (ret <= 0) goto end;
238 s->state=SSL3_ST_CR_SRVR_DONE_A;
239 s->init_num=0;
240 break;
241
242 case SSL3_ST_CR_SRVR_DONE_A:
243 case SSL3_ST_CR_SRVR_DONE_B:
244 ret=ssl3_get_server_done(s);
245 if (ret <= 0) goto end;
246 if (s->s3->tmp.cert_req)
247 s->state=SSL3_ST_CW_CERT_A;
248 else
249 s->state=SSL3_ST_CW_KEY_EXCH_A;
250 s->init_num=0;
251
252 break;
253
254 case SSL3_ST_CW_CERT_A:
255 case SSL3_ST_CW_CERT_B:
256 case SSL3_ST_CW_CERT_C:
257 case SSL3_ST_CW_CERT_D:
258 ret=ssl3_send_client_certificate(s);
259 if (ret <= 0) goto end;
260 s->state=SSL3_ST_CW_KEY_EXCH_A;
261 s->init_num=0;
262 break;
263
264 case SSL3_ST_CW_KEY_EXCH_A:
265 case SSL3_ST_CW_KEY_EXCH_B:
266 ret=ssl3_send_client_key_exchange(s);
267 if (ret <= 0) goto end;
268 l=s->s3->tmp.new_cipher->algorithms;
269 /* EAY EAY EAY need to check for DH fix cert
270 * sent back */
271 /* For TLS, cert_req is set to 2, so a cert chain
272 * of nothing is sent, but no verify packet is sent */
273 if (s->s3->tmp.cert_req == 1)
274 {
275 s->state=SSL3_ST_CW_CERT_VRFY_A;
276 }
277 else
278 {
279 s->state=SSL3_ST_CW_CHANGE_A;
280 s->s3->change_cipher_spec=0;
281 }
282
283 s->init_num=0;
284 break;
285
286 case SSL3_ST_CW_CERT_VRFY_A:
287 case SSL3_ST_CW_CERT_VRFY_B:
288 ret=ssl3_send_client_verify(s);
289 if (ret <= 0) goto end;
290 s->state=SSL3_ST_CW_CHANGE_A;
291 s->init_num=0;
292 s->s3->change_cipher_spec=0;
293 break;
294
295 case SSL3_ST_CW_CHANGE_A:
296 case SSL3_ST_CW_CHANGE_B:
297 ret=ssl3_send_change_cipher_spec(s,
298 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
299 if (ret <= 0) goto end;
300 s->state=SSL3_ST_CW_FINISHED_A;
301 s->init_num=0;
302
303 s->session->cipher=s->s3->tmp.new_cipher;
304 if (s->s3->tmp.new_compression == NULL)
305 s->session->compress_meth=0;
306 else
307 s->session->compress_meth=
308 s->s3->tmp.new_compression->id;
309 if (!s->method->ssl3_enc->setup_key_block(s))
310 {
311 ret= -1;
312 goto end;
313 }
314
315 if (!s->method->ssl3_enc->change_cipher_state(s,
316 SSL3_CHANGE_CIPHER_CLIENT_WRITE))
317 {
318 ret= -1;
319 goto end;
320 }
321
322 break;
323
324 case SSL3_ST_CW_FINISHED_A:
325 case SSL3_ST_CW_FINISHED_B:
326 ret=ssl3_send_finished(s,
327 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
328 s->method->ssl3_enc->client_finished,
329 s->method->ssl3_enc->client_finished_len);
330 if (ret <= 0) goto end;
331 s->state=SSL3_ST_CW_FLUSH;
332
333 /* clear flags */
334 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
335 if (s->hit)
336 {
337 s->s3->tmp.next_state=SSL_ST_OK;
338 if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED)
339 {
340 s->state=SSL_ST_OK;
341 s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
342 s->s3->delay_buf_pop_ret=0;
343 }
344 }
345 else
346 {
347 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
348 }
349 s->init_num=0;
350 break;
351
352 case SSL3_ST_CR_FINISHED_A:
353 case SSL3_ST_CR_FINISHED_B:
354
355 ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
356 SSL3_ST_CR_FINISHED_B);
357 if (ret <= 0) goto end;
358
359 if (s->hit)
360 s->state=SSL3_ST_CW_CHANGE_A;
361 else
362 s->state=SSL_ST_OK;
363 s->init_num=0;
364 break;
365
366 case SSL3_ST_CW_FLUSH:
367 /* number of bytes to be flushed */
368 num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
369 if (num1 > 0)
370 {
371 s->rwstate=SSL_WRITING;
372 num1=BIO_flush(s->wbio);
373 if (num1 <= 0) { ret= -1; goto end; }
374 s->rwstate=SSL_NOTHING;
375 }
376
377 s->state=s->s3->tmp.next_state;
378 break;
379
380 case SSL_ST_OK:
381 /* clean a few things up */
382 ssl3_cleanup_key_block(s);
383
384 if (s->init_buf != NULL)
385 {
386 BUF_MEM_free(s->init_buf);
387 s->init_buf=NULL;
388 }
389
390 /* If we are not 'joining' the last two packets,
391 * remove the buffering now */
392 if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
393 ssl_free_wbio_buffer(s);
394 /* else do it later in ssl3_write */
395
396 s->init_num=0;
397 s->new_session=0;
398
399 ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
400 if (s->hit) s->ctx->stats.sess_hit++;
401
402 ret=1;
403 /* s->server=0; */
404 s->handshake_func=ssl3_connect;
405 s->ctx->stats.sess_connect_good++;
406
407 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
408
409 goto end;
410 /* break; */
411
412 default:
413 SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE);
414 ret= -1;
415 goto end;
416 /* break; */
417 }
418
419 /* did we do anything */
420 if (!s->s3->tmp.reuse_message && !skip)
421 {
422 if (s->debug)
423 {
424 if ((ret=BIO_flush(s->wbio)) <= 0)
425 goto end;
426 }
427
428 if ((cb != NULL) && (s->state != state))
429 {
430 new_state=s->state;
431 s->state=state;
432 cb(s,SSL_CB_CONNECT_LOOP,1);
433 s->state=new_state;
434 }
435 }
436 skip=0;
437 }
438end:
439 if (cb != NULL)
440 cb(s,SSL_CB_CONNECT_EXIT,ret);
441 s->in_handshake--;
442 return(ret);
443 }
444
445
446static int ssl3_client_hello(SSL *s)
447 {
448 unsigned char *buf;
449 unsigned char *p,*d;
450 int i,j;
451 unsigned long Time,l;
452 SSL_COMP *comp;
453
454 buf=(unsigned char *)s->init_buf->data;
455 if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
456 {
457 if ((s->session == NULL) ||
458 (s->session->ssl_version != s->version) ||
459 (s->session->not_resumable))
460 {
461 if (!ssl_get_new_session(s,0))
462 goto err;
463 }
464 /* else use the pre-loaded session */
465
466 p=s->s3->client_random;
467 Time=time(NULL); /* Time */
468 l2n(Time,p);
469 RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
470
471 /* Do the message type and length last */
472 d=p= &(buf[4]);
473
474 *(p++)=s->version>>8;
475 *(p++)=s->version&0xff;
476 s->client_version=s->version;
477
478 /* Random stuff */
479 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
480 p+=SSL3_RANDOM_SIZE;
481
482 /* Session ID */
483 if (s->new_session)
484 i=0;
485 else
486 i=s->session->session_id_length;
487 *(p++)=i;
488 if (i != 0)
489 {
490 memcpy(p,s->session->session_id,i);
491 p+=i;
492 }
493
494 /* Ciphers supported */
495 i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]));
496 if (i == 0)
497 {
498 SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);
499 goto err;
500 }
501 s2n(i,p);
502 p+=i;
503
504 /* COMPRESSION */
505 if (s->ctx->comp_methods == NULL)
506 j=0;
507 else
508 j=sk_SSL_COMP_num(s->ctx->comp_methods);
509 *(p++)=1+j;
510 for (i=0; i<j; i++)
511 {
512 comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
513 *(p++)=comp->id;
514 }
515 *(p++)=0; /* Add the NULL method */
516
517 l=(p-d);
518 d=buf;
519 *(d++)=SSL3_MT_CLIENT_HELLO;
520 l2n3(l,d);
521
522 s->state=SSL3_ST_CW_CLNT_HELLO_B;
523 /* number of bytes to write */
524 s->init_num=p-buf;
525 s->init_off=0;
526 }
527
528 /* SSL3_ST_CW_CLNT_HELLO_B */
529 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
530err:
531 return(-1);
532 }
533
534static int ssl3_get_server_hello(SSL *s)
535 {
536 STACK_OF(SSL_CIPHER) *sk;
537 SSL_CIPHER *c;
538 unsigned char *p,*d;
539 int i,al,ok;
540 unsigned int j;
541 long n;
542 SSL_COMP *comp;
543
544 n=ssl3_get_message(s,
545 SSL3_ST_CR_SRVR_HELLO_A,
546 SSL3_ST_CR_SRVR_HELLO_B,
547 SSL3_MT_SERVER_HELLO,
548 300, /* ?? */
549 &ok);
550
551 if (!ok) return((int)n);
552 d=p=(unsigned char *)s->init_buf->data;
553
554 if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
555 {
556 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION);
557 s->version=(s->version&0xff00)|p[1];
558 al=SSL_AD_PROTOCOL_VERSION;
559 goto f_err;
560 }
561 p+=2;
562
563 /* load the server hello data */
564 /* load the server random */
565 memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE);
566 p+=SSL3_RANDOM_SIZE;
567
568 /* get the session-id */
569 j= *(p++);
570
571 if ((j != 0) && (j != SSL3_SESSION_ID_SIZE))
572 {
573 /* SSLref returns 16 :-( */
574 if (j < SSL2_SSL_SESSION_ID_LENGTH)
575 {
576 al=SSL_AD_ILLEGAL_PARAMETER;
577 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_SHORT);
578 goto f_err;
579 }
580 }
581 if (j != 0 && j == s->session->session_id_length
582 && memcmp(p,s->session->session_id,j) == 0)
583 {
584 if(s->sid_ctx_length != s->session->sid_ctx_length
585 || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
586 {
587 al=SSL_AD_ILLEGAL_PARAMETER;
588 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
589 goto f_err;
590 }
591 s->hit=1;
592 }
593 else /* a miss or crap from the other end */
594 {
595 /* If we were trying for session-id reuse, make a new
596 * SSL_SESSION so we don't stuff up other people */
597 s->hit=0;
598 if (s->session->session_id_length > 0)
599 {
600 if (!ssl_get_new_session(s,0))
601 {
602 al=SSL_AD_INTERNAL_ERROR;
603 goto f_err;
604 }
605 }
606 s->session->session_id_length=j;
607 memcpy(s->session->session_id,p,j); /* j could be 0 */
608 }
609 p+=j;
610 c=ssl_get_cipher_by_char(s,p);
611 if (c == NULL)
612 {
613 /* unknown cipher */
614 al=SSL_AD_ILLEGAL_PARAMETER;
615 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED);
616 goto f_err;
617 }
618 p+=ssl_put_cipher_by_char(s,NULL,NULL);
619
620 sk=ssl_get_ciphers_by_id(s);
621 i=sk_SSL_CIPHER_find(sk,c);
622 if (i < 0)
623 {
624 /* we did not say we would use this cipher */
625 al=SSL_AD_ILLEGAL_PARAMETER;
626 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED);
627 goto f_err;
628 }
629
630 if (s->hit && (s->session->cipher != c))
631 {
632 if (!(s->options &
633 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
634 {
635 al=SSL_AD_ILLEGAL_PARAMETER;
636 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
637 goto f_err;
638 }
639 }
640 s->s3->tmp.new_cipher=c;
641
642 /* lets get the compression algorithm */
643 /* COMPRESSION */
644 j= *(p++);
645 if (j == 0)
646 comp=NULL;
647 else
648 comp=ssl3_comp_find(s->ctx->comp_methods,j);
649
650 if ((j != 0) && (comp == NULL))
651 {
652 al=SSL_AD_ILLEGAL_PARAMETER;
653 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
654 goto f_err;
655 }
656 else
657 {
658 s->s3->tmp.new_compression=comp;
659 }
660
661 if (p != (d+n))
662 {
663 /* wrong packet length */
664 al=SSL_AD_DECODE_ERROR;
665 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH);
666 goto err;
667 }
668
669 return(1);
670f_err:
671 ssl3_send_alert(s,SSL3_AL_FATAL,al);
672err:
673 return(-1);
674 }
675
676static int ssl3_get_server_certificate(SSL *s)
677 {
678 int al,i,ok,ret= -1;
679 unsigned long n,nc,llen,l;
680 X509 *x=NULL;
681 unsigned char *p,*d,*q;
682 STACK_OF(X509) *sk=NULL;
683 SESS_CERT *sc;
684 EVP_PKEY *pkey=NULL;
685
686 n=ssl3_get_message(s,
687 SSL3_ST_CR_CERT_A,
688 SSL3_ST_CR_CERT_B,
689 -1,
690#if defined(MSDOS) && !defined(WIN32)
691 1024*30, /* 30k max cert list :-) */
692#else
693 1024*100, /* 100k max cert list :-) */
694#endif
695 &ok);
696
697 if (!ok) return((int)n);
698
699 if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
700 {
701 s->s3->tmp.reuse_message=1;
702 return(1);
703 }
704
705 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
706 {
707 al=SSL_AD_UNEXPECTED_MESSAGE;
708 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
709 goto f_err;
710 }
711 d=p=(unsigned char *)s->init_buf->data;
712
713 if ((sk=sk_X509_new_null()) == NULL)
714 {
715 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
716 goto err;
717 }
718
719 n2l3(p,llen);
720 if (llen+3 != n)
721 {
722 al=SSL_AD_DECODE_ERROR;
723 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
724 goto f_err;
725 }
726 for (nc=0; nc<llen; )
727 {
728 n2l3(p,l);
729 if ((l+nc+3) > llen)
730 {
731 al=SSL_AD_DECODE_ERROR;
732 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
733 goto f_err;
734 }
735
736 q=p;
737 x=d2i_X509(NULL,&q,l);
738 if (x == NULL)
739 {
740 al=SSL_AD_BAD_CERTIFICATE;
741 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);
742 goto f_err;
743 }
744 if (q != (p+l))
745 {
746 al=SSL_AD_DECODE_ERROR;
747 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
748 goto f_err;
749 }
750 if (!sk_X509_push(sk,x))
751 {
752 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
753 goto err;
754 }
755 x=NULL;
756 nc+=l+3;
757 p=q;
758 }
759
760 i=ssl_verify_cert_chain(s,sk);
761 if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
762 {
763 al=ssl_verify_alarm_type(s->verify_result);
764 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
765 goto f_err;
766 }
767
768 sc=ssl_sess_cert_new();
769 if (sc == NULL) goto err;
770
771 if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
772 s->session->sess_cert=sc;
773
774 sc->cert_chain=sk;
775 x=sk_X509_value(sk,0);
776 sk=NULL;
777
778 pkey=X509_get_pubkey(x);
779
780 if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey))
781 {
782 x=NULL;
783 al=SSL3_AL_FATAL;
784 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
785 goto f_err;
786 }
787
788 i=ssl_cert_type(x,pkey);
789 if (i < 0)
790 {
791 x=NULL;
792 al=SSL3_AL_FATAL;
793 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
794 goto f_err;
795 }
796
797 sc->peer_cert_type=i;
798 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
799 if (sc->peer_pkeys[i].x509 != NULL) /* Why would this ever happen?
800 * We just created sc a couple of
801 * lines ago. */
802 X509_free(sc->peer_pkeys[i].x509);
803 sc->peer_pkeys[i].x509=x;
804 sc->peer_key= &(sc->peer_pkeys[i]);
805
806 if (s->session->peer != NULL)
807 X509_free(s->session->peer);
808 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
809 s->session->peer=x;
810
811 x=NULL;
812 ret=1;
813
814 if (0)
815 {
816f_err:
817 ssl3_send_alert(s,SSL3_AL_FATAL,al);
818 }
819err:
820 EVP_PKEY_free(pkey);
821 X509_free(x);
822 sk_X509_pop_free(sk,X509_free);
823 return(ret);
824 }
825
826static int ssl3_get_key_exchange(SSL *s)
827 {
828#ifndef NO_RSA
829 unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
830#endif
831 EVP_MD_CTX md_ctx;
832 unsigned char *param,*p;
833 int al,i,j,param_len,ok;
834 long n,alg;
835 EVP_PKEY *pkey=NULL;
836#ifndef NO_RSA
837 RSA *rsa=NULL;
838#endif
839#ifndef NO_DH
840 DH *dh=NULL;
841#endif
842
843 n=ssl3_get_message(s,
844 SSL3_ST_CR_KEY_EXCH_A,
845 SSL3_ST_CR_KEY_EXCH_B,
846 -1,
847 1024*8, /* ?? */
848 &ok);
849
850 if (!ok) return((int)n);
851
852 if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
853 {
854 s->s3->tmp.reuse_message=1;
855 return(1);
856 }
857
858 param=p=(unsigned char *)s->init_buf->data;
859
860 if (s->session->sess_cert != NULL)
861 {
862#ifndef NO_RSA
863 if (s->session->sess_cert->peer_rsa_tmp != NULL)
864 {
865 RSA_free(s->session->sess_cert->peer_rsa_tmp);
866 s->session->sess_cert->peer_rsa_tmp=NULL;
867 }
868#endif
869#ifndef NO_DH
870 if (s->session->sess_cert->peer_dh_tmp)
871 {
872 DH_free(s->session->sess_cert->peer_dh_tmp);
873 s->session->sess_cert->peer_dh_tmp=NULL;
874 }
875#endif
876 }
877 else
878 {
879 s->session->sess_cert=ssl_sess_cert_new();
880 }
881
882 param_len=0;
883 alg=s->s3->tmp.new_cipher->algorithms;
884
885#ifndef NO_RSA
886 if (alg & SSL_kRSA)
887 {
888 if ((rsa=RSA_new()) == NULL)
889 {
890 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
891 goto err;
892 }
893 n2s(p,i);
894 param_len=i+2;
895 if (param_len > n)
896 {
897 al=SSL_AD_DECODE_ERROR;
898 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH);
899 goto f_err;
900 }
901 if (!(rsa->n=BN_bin2bn(p,i,rsa->n)))
902 {
903 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
904 goto err;
905 }
906 p+=i;
907
908 n2s(p,i);
909 param_len+=i+2;
910 if (param_len > n)
911 {
912 al=SSL_AD_DECODE_ERROR;
913 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH);
914 goto f_err;
915 }
916 if (!(rsa->e=BN_bin2bn(p,i,rsa->e)))
917 {
918 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
919 goto err;
920 }
921 p+=i;
922 n-=param_len;
923
924 /* this should be because we are using an export cipher */
925 if (alg & SSL_aRSA)
926 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
927 else
928 {
929 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR);
930 goto err;
931 }
932 s->session->sess_cert->peer_rsa_tmp=rsa;
933 rsa=NULL;
934 }
935 else
936#endif
937#ifndef NO_DH
938 if (alg & SSL_kEDH)
939 {
940 if ((dh=DH_new()) == NULL)
941 {
942 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB);
943 goto err;
944 }
945 n2s(p,i);
946 param_len=i+2;
947 if (param_len > n)
948 {
949 al=SSL_AD_DECODE_ERROR;
950 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH);
951 goto f_err;
952 }
953 if (!(dh->p=BN_bin2bn(p,i,NULL)))
954 {
955 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
956 goto err;
957 }
958 p+=i;
959
960 n2s(p,i);
961 param_len+=i+2;
962 if (param_len > n)
963 {
964 al=SSL_AD_DECODE_ERROR;
965 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH);
966 goto f_err;
967 }
968 if (!(dh->g=BN_bin2bn(p,i,NULL)))
969 {
970 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
971 goto err;
972 }
973 p+=i;
974
975 n2s(p,i);
976 param_len+=i+2;
977 if (param_len > n)
978 {
979 al=SSL_AD_DECODE_ERROR;
980 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH);
981 goto f_err;
982 }
983 if (!(dh->pub_key=BN_bin2bn(p,i,NULL)))
984 {
985 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
986 goto err;
987 }
988 p+=i;
989 n-=param_len;
990
991#ifndef NO_RSA
992 if (alg & SSL_aRSA)
993 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
994 else
995#endif
996#ifndef NO_DSA
997 if (alg & SSL_aDSS)
998 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509);
999#endif
1000 /* else anonymous DH, so no certificate or pkey. */
1001
1002 s->session->sess_cert->peer_dh_tmp=dh;
1003 dh=NULL;
1004 }
1005 else if ((alg & SSL_kDHr) || (alg & SSL_kDHd))
1006 {
1007 al=SSL_AD_ILLEGAL_PARAMETER;
1008 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1009 goto f_err;
1010 }
1011#endif
1012 if (alg & SSL_aFZA)
1013 {
1014 al=SSL_AD_HANDSHAKE_FAILURE;
1015 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1016 goto f_err;
1017 }
1018
1019
1020 /* p points to the next byte, there are 'n' bytes left */
1021
1022
1023 /* if it was signed, check the signature */
1024 if (pkey != NULL)
1025 {
1026 n2s(p,i);
1027 n-=2;
1028 j=EVP_PKEY_size(pkey);
1029
1030 if ((i != n) || (n > j) || (n <= 0))
1031 {
1032 /* wrong packet length */
1033 al=SSL_AD_DECODE_ERROR;
1034 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH);
1035 goto f_err;
1036 }
1037
1038#ifndef NO_RSA
1039 if (pkey->type == EVP_PKEY_RSA)
1040 {
1041 int num;
1042
1043 j=0;
1044 q=md_buf;
1045 for (num=2; num > 0; num--)
1046 {
1047 EVP_DigestInit(&md_ctx,(num == 2)
1048 ?s->ctx->md5:s->ctx->sha1);
1049 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1050 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1051 EVP_DigestUpdate(&md_ctx,param,param_len);
1052 EVP_DigestFinal(&md_ctx,q,(unsigned int *)&i);
1053 q+=i;
1054 j+=i;
1055 }
1056 i=RSA_public_decrypt((int)n,p,p,pkey->pkey.rsa,
1057 RSA_PKCS1_PADDING);
1058 if (i <= 0)
1059 {
1060 al=SSL_AD_DECRYPT_ERROR;
1061 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
1062 goto f_err;
1063 }
1064 if ((j != i) || (memcmp(p,md_buf,i) != 0))
1065 {
1066 /* bad signature */
1067 al=SSL_AD_DECRYPT_ERROR;
1068 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1069 goto f_err;
1070 }
1071 }
1072 else
1073#endif
1074#ifndef NO_DSA
1075 if (pkey->type == EVP_PKEY_DSA)
1076 {
1077 /* lets do DSS */
1078 EVP_VerifyInit(&md_ctx,EVP_dss1());
1079 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1080 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1081 EVP_VerifyUpdate(&md_ctx,param,param_len);
1082 if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
1083 {
1084 /* bad signature */
1085 al=SSL_AD_DECRYPT_ERROR;
1086 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1087 goto f_err;
1088 }
1089 }
1090 else
1091#endif
1092 {
1093 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR);
1094 goto err;
1095 }
1096 }
1097 else
1098 {
1099 /* still data left over */
1100 if (!(alg & SSL_aNULL))
1101 {
1102 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR);
1103 goto err;
1104 }
1105 if (n != 0)
1106 {
1107 al=SSL_AD_DECODE_ERROR;
1108 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE);
1109 goto f_err;
1110 }
1111 }
1112 EVP_PKEY_free(pkey);
1113 return(1);
1114f_err:
1115 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1116err:
1117 EVP_PKEY_free(pkey);
1118#ifndef NO_RSA
1119 if (rsa != NULL)
1120 RSA_free(rsa);
1121#endif
1122#ifndef NO_DH
1123 if (dh != NULL)
1124 DH_free(dh);
1125#endif
1126 return(-1);
1127 }
1128
1129static int ssl3_get_certificate_request(SSL *s)
1130 {
1131 int ok,ret=0;
1132 unsigned long n,nc,l;
1133 unsigned int llen,ctype_num,i;
1134 X509_NAME *xn=NULL;
1135 unsigned char *p,*d,*q;
1136 STACK_OF(X509_NAME) *ca_sk=NULL;
1137
1138 n=ssl3_get_message(s,
1139 SSL3_ST_CR_CERT_REQ_A,
1140 SSL3_ST_CR_CERT_REQ_B,
1141 -1,
1142#if defined(MSDOS) && !defined(WIN32)
1143 1024*30, /* 30k max cert list :-) */
1144#else
1145 1024*100, /* 100k max cert list :-) */
1146#endif
1147 &ok);
1148
1149 if (!ok) return((int)n);
1150
1151 s->s3->tmp.cert_req=0;
1152
1153 if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)
1154 {
1155 s->s3->tmp.reuse_message=1;
1156 return(1);
1157 }
1158
1159 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST)
1160 {
1161 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1162 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE);
1163 goto err;
1164 }
1165
1166 /* TLS does not like anon-DH with client cert */
1167 if (s->version > SSL3_VERSION)
1168 {
1169 l=s->s3->tmp.new_cipher->algorithms;
1170 if (l & SSL_aNULL)
1171 {
1172 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1173 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER);
1174 goto err;
1175 }
1176 }
1177
1178 d=p=(unsigned char *)s->init_buf->data;
1179
1180 if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
1181 {
1182 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
1183 goto err;
1184 }
1185
1186 /* get the certificate types */
1187 ctype_num= *(p++);
1188 if (ctype_num > SSL3_CT_NUMBER)
1189 ctype_num=SSL3_CT_NUMBER;
1190 for (i=0; i<ctype_num; i++)
1191 s->s3->tmp.ctype[i]= p[i];
1192 p+=ctype_num;
1193
1194 /* get the CA RDNs */
1195 n2s(p,llen);
1196#if 0
1197{
1198FILE *out;
1199out=fopen("/tmp/vsign.der","w");
1200fwrite(p,1,llen,out);
1201fclose(out);
1202}
1203#endif
1204
1205 if ((llen+ctype_num+2+1) != n)
1206 {
1207 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1208 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH);
1209 goto err;
1210 }
1211
1212 for (nc=0; nc<llen; )
1213 {
1214 n2s(p,l);
1215 if ((l+nc+2) > llen)
1216 {
1217 if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1218 goto cont; /* netscape bugs */
1219 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1220 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG);
1221 goto err;
1222 }
1223
1224 q=p;
1225
1226 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL)
1227 {
1228 /* If netscape tollerance is on, ignore errors */
1229 if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG)
1230 goto cont;
1231 else
1232 {
1233 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1234 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB);
1235 goto err;
1236 }
1237 }
1238
1239 if (q != (p+l))
1240 {
1241 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1242 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH);
1243 goto err;
1244 }
1245 if (!sk_X509_NAME_push(ca_sk,xn))
1246 {
1247 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
1248 goto err;
1249 }
1250
1251 p+=l;
1252 nc+=l+2;
1253 }
1254
1255 if (0)
1256 {
1257cont:
1258 ERR_clear_error();
1259 }
1260
1261 /* we should setup a certficate to return.... */
1262 s->s3->tmp.cert_req=1;
1263 s->s3->tmp.ctype_num=ctype_num;
1264 if (s->s3->tmp.ca_names != NULL)
1265 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
1266 s->s3->tmp.ca_names=ca_sk;
1267 ca_sk=NULL;
1268
1269 ret=1;
1270err:
1271 if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free);
1272 return(ret);
1273 }
1274
1275static int ca_dn_cmp(X509_NAME **a, X509_NAME **b)
1276 {
1277 return(X509_NAME_cmp(*a,*b));
1278 }
1279
1280static int ssl3_get_server_done(SSL *s)
1281 {
1282 int ok,ret=0;
1283 long n;
1284
1285 n=ssl3_get_message(s,
1286 SSL3_ST_CR_SRVR_DONE_A,
1287 SSL3_ST_CR_SRVR_DONE_B,
1288 SSL3_MT_SERVER_DONE,
1289 30, /* should be very small, like 0 :-) */
1290 &ok);
1291
1292 if (!ok) return((int)n);
1293 if (n > 0)
1294 {
1295 /* should contain no data */
1296 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1297 SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH);
1298 }
1299 ret=1;
1300 return(ret);
1301 }
1302
1303static int ssl3_send_client_key_exchange(SSL *s)
1304 {
1305 unsigned char *p,*d;
1306 int n;
1307 unsigned long l;
1308#ifndef NO_RSA
1309 unsigned char *q;
1310 EVP_PKEY *pkey=NULL;
1311#endif
1312
1313 if (s->state == SSL3_ST_CW_KEY_EXCH_A)
1314 {
1315 d=(unsigned char *)s->init_buf->data;
1316 p= &(d[4]);
1317
1318 l=s->s3->tmp.new_cipher->algorithms;
1319
1320#ifndef NO_RSA
1321 if (l & SSL_kRSA)
1322 {
1323 RSA *rsa;
1324 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1325
1326 if (s->session->sess_cert->peer_rsa_tmp != NULL)
1327 rsa=s->session->sess_cert->peer_rsa_tmp;
1328 else
1329 {
1330 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1331 if ((pkey == NULL) ||
1332 (pkey->type != EVP_PKEY_RSA) ||
1333 (pkey->pkey.rsa == NULL))
1334 {
1335 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR);
1336 goto err;
1337 }
1338 rsa=pkey->pkey.rsa;
1339 EVP_PKEY_free(pkey);
1340 }
1341
1342 tmp_buf[0]=s->client_version>>8;
1343 tmp_buf[1]=s->client_version&0xff;
1344 RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
1345
1346 s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
1347
1348 q=p;
1349 /* Fix buf for TLS and beyond */
1350 if (s->version > SSL3_VERSION)
1351 p+=2;
1352 n=RSA_public_encrypt(SSL_MAX_MASTER_KEY_LENGTH,
1353 tmp_buf,p,rsa,RSA_PKCS1_PADDING);
1354#ifdef PKCS1_CHECK
1355 if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
1356 if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70;
1357#endif
1358 if (n <= 0)
1359 {
1360 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT);
1361 goto err;
1362 }
1363
1364 /* Fix buf for TLS and beyond */
1365 if (s->version > SSL3_VERSION)
1366 {
1367 s2n(n,q);
1368 n+=2;
1369 }
1370
1371 s->session->master_key_length=
1372 s->method->ssl3_enc->generate_master_secret(s,
1373 s->session->master_key,
1374 tmp_buf,SSL_MAX_MASTER_KEY_LENGTH);
1375 memset(tmp_buf,0,SSL_MAX_MASTER_KEY_LENGTH);
1376 }
1377 else
1378#endif
1379#ifndef NO_DH
1380 if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1381 {
1382 DH *dh_srvr,*dh_clnt;
1383
1384 if (s->session->sess_cert->peer_dh_tmp != NULL)
1385 dh_srvr=s->session->sess_cert->peer_dh_tmp;
1386 else
1387 {
1388 /* we get them from the cert */
1389 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
1390 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
1391 goto err;
1392 }
1393
1394 /* generate a new random key */
1395 if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL)
1396 {
1397 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1398 goto err;
1399 }
1400 if (!DH_generate_key(dh_clnt))
1401 {
1402 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1403 goto err;
1404 }
1405
1406 /* use the 'p' output buffer for the DH key, but
1407 * make sure to clear it out afterwards */
1408
1409 n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt);
1410
1411 if (n <= 0)
1412 {
1413 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1414 goto err;
1415 }
1416
1417 /* generate master key from the result */
1418 s->session->master_key_length=
1419 s->method->ssl3_enc->generate_master_secret(s,
1420 s->session->master_key,p,n);
1421 /* clean up */
1422 memset(p,0,n);
1423
1424 /* send off the data */
1425 n=BN_num_bytes(dh_clnt->pub_key);
1426 s2n(n,p);
1427 BN_bn2bin(dh_clnt->pub_key,p);
1428 n+=2;
1429
1430 DH_free(dh_clnt);
1431
1432 /* perhaps clean things up a bit EAY EAY EAY EAY*/
1433 }
1434 else
1435#endif
1436 {
1437 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
1438 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR);
1439 goto err;
1440 }
1441
1442 *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE;
1443 l2n3(n,d);
1444
1445 s->state=SSL3_ST_CW_KEY_EXCH_B;
1446 /* number of bytes to write */
1447 s->init_num=n+4;
1448 s->init_off=0;
1449 }
1450
1451 /* SSL3_ST_CW_KEY_EXCH_B */
1452 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1453err:
1454 return(-1);
1455 }
1456
1457static int ssl3_send_client_verify(SSL *s)
1458 {
1459 unsigned char *p,*d;
1460 unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
1461 EVP_PKEY *pkey;
1462#ifndef NO_RSA
1463 int i=0;
1464#endif
1465 unsigned long n;
1466#ifndef NO_DSA
1467 int j;
1468#endif
1469
1470 if (s->state == SSL3_ST_CW_CERT_VRFY_A)
1471 {
1472 d=(unsigned char *)s->init_buf->data;
1473 p= &(d[4]);
1474 pkey=s->cert->key->privatekey;
1475
1476 s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2),
1477 &(data[MD5_DIGEST_LENGTH]));
1478
1479#ifndef NO_RSA
1480 if (pkey->type == EVP_PKEY_RSA)
1481 {
1482 s->method->ssl3_enc->cert_verify_mac(s,
1483 &(s->s3->finish_dgst1),&(data[0]));
1484 i=RSA_private_encrypt(
1485 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
1486 data,&(p[2]),pkey->pkey.rsa,
1487 RSA_PKCS1_PADDING);
1488 if (i <= 0)
1489 {
1490 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
1491 goto err;
1492 }
1493 s2n(i,p);
1494 n=i+2;
1495 }
1496 else
1497#endif
1498#ifndef NO_DSA
1499 if (pkey->type == EVP_PKEY_DSA)
1500 {
1501 if (!DSA_sign(pkey->save_type,
1502 &(data[MD5_DIGEST_LENGTH]),
1503 SHA_DIGEST_LENGTH,&(p[2]),
1504 (unsigned int *)&j,pkey->pkey.dsa))
1505 {
1506 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB);
1507 goto err;
1508 }
1509 s2n(j,p);
1510 n=j+2;
1511 }
1512 else
1513#endif
1514 {
1515 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,SSL_R_INTERNAL_ERROR);
1516 goto err;
1517 }
1518 *(d++)=SSL3_MT_CERTIFICATE_VERIFY;
1519 l2n3(n,d);
1520
1521 s->init_num=(int)n+4;
1522 s->init_off=0;
1523 }
1524 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1525err:
1526 return(-1);
1527 }
1528
1529static int ssl3_send_client_certificate(SSL *s)
1530 {
1531 X509 *x509=NULL;
1532 EVP_PKEY *pkey=NULL;
1533 int i;
1534 unsigned long l;
1535
1536 if (s->state == SSL3_ST_CW_CERT_A)
1537 {
1538 if ((s->cert == NULL) ||
1539 (s->cert->key->x509 == NULL) ||
1540 (s->cert->key->privatekey == NULL))
1541 s->state=SSL3_ST_CW_CERT_B;
1542 else
1543 s->state=SSL3_ST_CW_CERT_C;
1544 }
1545
1546 /* We need to get a client cert */
1547 if (s->state == SSL3_ST_CW_CERT_B)
1548 {
1549 /* If we get an error, we need to
1550 * ssl->rwstate=SSL_X509_LOOKUP; return(-1);
1551 * We then get retied later */
1552 i=0;
1553 if (s->ctx->client_cert_cb != NULL)
1554 i=s->ctx->client_cert_cb(s,&(x509),&(pkey));
1555 if (i < 0)
1556 {
1557 s->rwstate=SSL_X509_LOOKUP;
1558 return(-1);
1559 }
1560 s->rwstate=SSL_NOTHING;
1561 if ((i == 1) && (pkey != NULL) && (x509 != NULL))
1562 {
1563 s->state=SSL3_ST_CW_CERT_B;
1564 if ( !SSL_use_certificate(s,x509) ||
1565 !SSL_use_PrivateKey(s,pkey))
1566 i=0;
1567 }
1568 else if (i == 1)
1569 {
1570 i=0;
1571 SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
1572 }
1573
1574 if (x509 != NULL) X509_free(x509);
1575 if (pkey != NULL) EVP_PKEY_free(pkey);
1576 if (i == 0)
1577 {
1578 if (s->version == SSL3_VERSION)
1579 {
1580 s->s3->tmp.cert_req=0;
1581 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE);
1582 return(1);
1583 }
1584 else
1585 {
1586 s->s3->tmp.cert_req=2;
1587 }
1588 }
1589
1590 /* Ok, we have a cert */
1591 s->state=SSL3_ST_CW_CERT_C;
1592 }
1593
1594 if (s->state == SSL3_ST_CW_CERT_C)
1595 {
1596 s->state=SSL3_ST_CW_CERT_D;
1597 l=ssl3_output_cert_chain(s,
1598 (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509);
1599 s->init_num=(int)l;
1600 s->init_off=0;
1601 }
1602 /* SSL3_ST_CW_CERT_D */
1603 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1604 }
1605
1606#define has_bits(i,m) (((i)&(m)) == (m))
1607
1608static int ssl3_check_cert_and_algorithm(SSL *s)
1609 {
1610 int i,idx;
1611 long algs;
1612 EVP_PKEY *pkey=NULL;
1613 SESS_CERT *sc;
1614#ifndef NO_RSA
1615 RSA *rsa;
1616#endif
1617#ifndef NO_DH
1618 DH *dh;
1619#endif
1620
1621 sc=s->session->sess_cert;
1622
1623 if (sc == NULL)
1624 {
1625 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR);
1626 goto err;
1627 }
1628
1629 algs=s->s3->tmp.new_cipher->algorithms;
1630
1631 /* we don't have a certificate */
1632 if (algs & (SSL_aDH|SSL_aNULL))
1633 return(1);
1634
1635#ifndef NO_RSA
1636 rsa=s->session->sess_cert->peer_rsa_tmp;
1637#endif
1638#ifndef NO_DH
1639 dh=s->session->sess_cert->peer_dh_tmp;
1640#endif
1641
1642 /* This is the passed certificate */
1643
1644 idx=sc->peer_cert_type;
1645 pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
1646 i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
1647 EVP_PKEY_free(pkey);
1648
1649
1650 /* Check that we have a certificate if we require one */
1651 if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
1652 {
1653 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
1654 goto f_err;
1655 }
1656#ifndef NO_DSA
1657 else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
1658 {
1659 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
1660 goto f_err;
1661 }
1662#endif
1663#ifndef NO_RSA
1664 if ((algs & SSL_kRSA) &&
1665 !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
1666 {
1667 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
1668 goto f_err;
1669 }
1670#endif
1671#ifndef NO_DH
1672 if ((algs & SSL_kEDH) &&
1673 !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
1674 {
1675 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
1676 goto f_err;
1677 }
1678 else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
1679 {
1680 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
1681 goto f_err;
1682 }
1683#ifndef NO_DSA
1684 else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
1685 {
1686 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
1687 goto f_err;
1688 }
1689#endif
1690#endif
1691
1692 if (SSL_IS_EXPORT(algs) && !has_bits(i,EVP_PKT_EXP))
1693 {
1694#ifndef NO_RSA
1695 if (algs & SSL_kRSA)
1696 {
1697 if (rsa == NULL
1698 || RSA_size(rsa) > SSL_EXPORT_PKEYLENGTH(algs))
1699 {
1700 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
1701 goto f_err;
1702 }
1703 }
1704 else
1705#endif
1706#ifndef NO_DH
1707 if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1708 {
1709 if (dh == NULL
1710 || DH_size(dh) > SSL_EXPORT_PKEYLENGTH(algs))
1711 {
1712 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
1713 goto f_err;
1714 }
1715 }
1716 else
1717#endif
1718 {
1719 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
1720 goto f_err;
1721 }
1722 }
1723 return(1);
1724f_err:
1725 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
1726err:
1727 return(0);
1728 }
1729
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
deleted file mode 100644
index aeff6b5c5b..0000000000
--- a/src/lib/libssl/s3_lib.c
+++ /dev/null
@@ -1,1107 +0,0 @@
1/* ssl/s3_lib.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/md5.h>
61#include <openssl/sha.h>
62#include <openssl/objects.h>
63#include "ssl_locl.h"
64
65const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT;
66
67#define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
68
69static long ssl3_default_timeout(void );
70
71OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
72/* The RSA ciphers */
73/* Cipher 01 */
74 {
75 1,
76 SSL3_TXT_RSA_NULL_MD5,
77 SSL3_CK_RSA_NULL_MD5,
78 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3,
79 0,
80 SSL_ALL_CIPHERS,
81 },
82/* Cipher 02 */
83 {
84 1,
85 SSL3_TXT_RSA_NULL_SHA,
86 SSL3_CK_RSA_NULL_SHA,
87 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
88 0,
89 SSL_ALL_CIPHERS,
90 },
91
92/* anon DH */
93/* Cipher 17 */
94 {
95 1,
96 SSL3_TXT_ADH_RC4_40_MD5,
97 SSL3_CK_ADH_RC4_40_MD5,
98 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
99 0,
100 SSL_ALL_CIPHERS,
101 },
102/* Cipher 18 */
103 {
104 1,
105 SSL3_TXT_ADH_RC4_128_MD5,
106 SSL3_CK_ADH_RC4_128_MD5,
107 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3,
108 0,
109 SSL_ALL_CIPHERS,
110 },
111/* Cipher 19 */
112 {
113 1,
114 SSL3_TXT_ADH_DES_40_CBC_SHA,
115 SSL3_CK_ADH_DES_40_CBC_SHA,
116 SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
117 0,
118 SSL_ALL_CIPHERS,
119 },
120/* Cipher 1A */
121 {
122 1,
123 SSL3_TXT_ADH_DES_64_CBC_SHA,
124 SSL3_CK_ADH_DES_64_CBC_SHA,
125 SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
126 0,
127 SSL_ALL_CIPHERS,
128 },
129/* Cipher 1B */
130 {
131 1,
132 SSL3_TXT_ADH_DES_192_CBC_SHA,
133 SSL3_CK_ADH_DES_192_CBC_SHA,
134 SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
135 0,
136 SSL_ALL_CIPHERS,
137 },
138
139/* RSA again */
140/* Cipher 03 */
141 {
142 1,
143 SSL3_TXT_RSA_RC4_40_MD5,
144 SSL3_CK_RSA_RC4_40_MD5,
145 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
146 0,
147 SSL_ALL_CIPHERS,
148 },
149/* Cipher 04 */
150 {
151 1,
152 SSL3_TXT_RSA_RC4_128_MD5,
153 SSL3_CK_RSA_RC4_128_MD5,
154 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
155 0,
156 SSL_ALL_CIPHERS,
157 },
158/* Cipher 05 */
159 {
160 1,
161 SSL3_TXT_RSA_RC4_128_SHA,
162 SSL3_CK_RSA_RC4_128_SHA,
163 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
164 0,
165 SSL_ALL_CIPHERS,
166 },
167/* Cipher 06 */
168 {
169 1,
170 SSL3_TXT_RSA_RC2_40_MD5,
171 SSL3_CK_RSA_RC2_40_MD5,
172 SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_EXP40|SSL_SSLV3,
173 0,
174 SSL_ALL_CIPHERS,
175 },
176/* Cipher 07 */
177 {
178 1,
179 SSL3_TXT_RSA_IDEA_128_SHA,
180 SSL3_CK_RSA_IDEA_128_SHA,
181 SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_MEDIUM,
182 0,
183 SSL_ALL_CIPHERS,
184 },
185/* Cipher 08 */
186 {
187 1,
188 SSL3_TXT_RSA_DES_40_CBC_SHA,
189 SSL3_CK_RSA_DES_40_CBC_SHA,
190 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
191 0,
192 SSL_ALL_CIPHERS,
193 },
194/* Cipher 09 */
195 {
196 1,
197 SSL3_TXT_RSA_DES_64_CBC_SHA,
198 SSL3_CK_RSA_DES_64_CBC_SHA,
199 SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
200 0,
201 SSL_ALL_CIPHERS,
202 },
203/* Cipher 0A */
204 {
205 1,
206 SSL3_TXT_RSA_DES_192_CBC3_SHA,
207 SSL3_CK_RSA_DES_192_CBC3_SHA,
208 SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
209 0,
210 SSL_ALL_CIPHERS,
211 },
212
213/* The DH ciphers */
214/* Cipher 0B */
215 {
216 0,
217 SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
218 SSL3_CK_DH_DSS_DES_40_CBC_SHA,
219 SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
220 0,
221 SSL_ALL_CIPHERS,
222 },
223/* Cipher 0C */
224 {
225 0,
226 SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
227 SSL3_CK_DH_DSS_DES_64_CBC_SHA,
228 SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
229 0,
230 SSL_ALL_CIPHERS,
231 },
232/* Cipher 0D */
233 {
234 0,
235 SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
236 SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
237 SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
238 0,
239 SSL_ALL_CIPHERS,
240 },
241/* Cipher 0E */
242 {
243 0,
244 SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
245 SSL3_CK_DH_RSA_DES_40_CBC_SHA,
246 SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
247 0,
248 SSL_ALL_CIPHERS,
249 },
250/* Cipher 0F */
251 {
252 0,
253 SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
254 SSL3_CK_DH_RSA_DES_64_CBC_SHA,
255 SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
256 0,
257 SSL_ALL_CIPHERS,
258 },
259/* Cipher 10 */
260 {
261 0,
262 SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
263 SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
264 SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
265 0,
266 SSL_ALL_CIPHERS,
267 },
268
269/* The Ephemeral DH ciphers */
270/* Cipher 11 */
271 {
272 1,
273 SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
274 SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
275 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
276 0,
277 SSL_ALL_CIPHERS,
278 },
279/* Cipher 12 */
280 {
281 1,
282 SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
283 SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
284 SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
285 0,
286 SSL_ALL_CIPHERS,
287 },
288/* Cipher 13 */
289 {
290 1,
291 SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
292 SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
293 SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
294 0,
295 SSL_ALL_CIPHERS,
296 },
297/* Cipher 14 */
298 {
299 1,
300 SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
301 SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
302 SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_EXP40|SSL_SSLV3,
303 0,
304 SSL_ALL_CIPHERS,
305 },
306/* Cipher 15 */
307 {
308 1,
309 SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
310 SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
311 SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_LOW,
312 0,
313 SSL_ALL_CIPHERS,
314 },
315/* Cipher 16 */
316 {
317 1,
318 SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
319 SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
320 SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3|SSL_HIGH,
321 0,
322 SSL_ALL_CIPHERS,
323 },
324
325/* Fortezza */
326/* Cipher 1C */
327 {
328 0,
329 SSL3_TXT_FZA_DMS_NULL_SHA,
330 SSL3_CK_FZA_DMS_NULL_SHA,
331 SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
332 0,
333 SSL_ALL_CIPHERS,
334 },
335
336/* Cipher 1D */
337 {
338 0,
339 SSL3_TXT_FZA_DMS_FZA_SHA,
340 SSL3_CK_FZA_DMS_FZA_SHA,
341 SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
342 0,
343 SSL_ALL_CIPHERS,
344 },
345
346/* Cipher 1E */
347 {
348 0,
349 SSL3_TXT_FZA_DMS_RC4_SHA,
350 SSL3_CK_FZA_DMS_RC4_SHA,
351 SSL_kFZA|SSL_aFZA |SSL_RC4 |SSL_SHA1|SSL_NOT_EXP|SSL_SSLV3,
352 0,
353 SSL_ALL_CIPHERS,
354 },
355
356#if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
357 /* New TLS Export CipherSuites */
358 /* Cipher 60 */
359 {
360 1,
361 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
362 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
363 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_EXP56|SSL_TLSV1,
364 0,
365 SSL_ALL_CIPHERS
366 },
367 /* Cipher 61 */
368 {
369 1,
370 TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
371 TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
372 SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_EXP56|SSL_TLSV1,
373 0,
374 SSL_ALL_CIPHERS
375 },
376 /* Cipher 62 */
377 {
378 1,
379 TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
380 TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
381 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_EXP56|SSL_TLSV1,
382 0,
383 SSL_ALL_CIPHERS
384 },
385 /* Cipher 63 */
386 {
387 1,
388 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
389 TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
390 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_EXP56|SSL_TLSV1,
391 0,
392 SSL_ALL_CIPHERS
393 },
394 /* Cipher 64 */
395 {
396 1,
397 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
398 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
399 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_EXP56|SSL_TLSV1,
400 0,
401 SSL_ALL_CIPHERS
402 },
403 /* Cipher 65 */
404 {
405 1,
406 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
407 TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
408 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_EXP56|SSL_TLSV1,
409 0,
410 SSL_ALL_CIPHERS
411 },
412 /* Cipher 66 */
413 {
414 1,
415 TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
416 TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
417 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
418 0,
419 SSL_ALL_CIPHERS
420 },
421#endif
422
423/* end of list */
424 };
425
426static SSL3_ENC_METHOD SSLv3_enc_data={
427 ssl3_enc,
428 ssl3_mac,
429 ssl3_setup_key_block,
430 ssl3_generate_master_secret,
431 ssl3_change_cipher_state,
432 ssl3_final_finish_mac,
433 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
434 ssl3_cert_verify_mac,
435 SSL3_MD_CLIENT_FINISHED_CONST,4,
436 SSL3_MD_SERVER_FINISHED_CONST,4,
437 ssl3_alert_code,
438 };
439
440static SSL_METHOD SSLv3_data= {
441 SSL3_VERSION,
442 ssl3_new,
443 ssl3_clear,
444 ssl3_free,
445 ssl_undefined_function,
446 ssl_undefined_function,
447 ssl3_read,
448 ssl3_peek,
449 ssl3_write,
450 ssl3_shutdown,
451 ssl3_renegotiate,
452 ssl3_renegotiate_check,
453 ssl3_ctrl,
454 ssl3_ctx_ctrl,
455 ssl3_get_cipher_by_char,
456 ssl3_put_cipher_by_char,
457 ssl3_pending,
458 ssl3_num_ciphers,
459 ssl3_get_cipher,
460 ssl_bad_method,
461 ssl3_default_timeout,
462 &SSLv3_enc_data,
463 };
464
465static long ssl3_default_timeout(void)
466 {
467 /* 2 hours, the 24 hours mentioned in the SSLv3 spec
468 * is way too long for http, the cache would over fill */
469 return(60*60*2);
470 }
471
472SSL_METHOD *sslv3_base_method(void)
473 {
474 return(&SSLv3_data);
475 }
476
477int ssl3_num_ciphers(void)
478 {
479 return(SSL3_NUM_CIPHERS);
480 }
481
482SSL_CIPHER *ssl3_get_cipher(unsigned int u)
483 {
484 if (u < SSL3_NUM_CIPHERS)
485 return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
486 else
487 return(NULL);
488 }
489
490/* The problem is that it may not be the correct record type */
491int ssl3_pending(SSL *s)
492 {
493 return(s->s3->rrec.length);
494 }
495
496int ssl3_new(SSL *s)
497 {
498 SSL3_CTX *s3;
499
500 if ((s3=(SSL3_CTX *)Malloc(sizeof(SSL3_CTX))) == NULL) goto err;
501 memset(s3,0,sizeof(SSL3_CTX));
502
503 s->s3=s3;
504 /*
505 s->s3->tmp.ca_names=NULL;
506 s->s3->tmp.key_block=NULL;
507 s->s3->tmp.key_block_length=0;
508 s->s3->rbuf.buf=NULL;
509 s->s3->wbuf.buf=NULL;
510 */
511
512 s->method->ssl_clear(s);
513 return(1);
514err:
515 return(0);
516 }
517
518void ssl3_free(SSL *s)
519 {
520 if(s == NULL)
521 return;
522
523 ssl3_cleanup_key_block(s);
524 if (s->s3->rbuf.buf != NULL)
525 Free(s->s3->rbuf.buf);
526 if (s->s3->wbuf.buf != NULL)
527 Free(s->s3->wbuf.buf);
528 if (s->s3->rrec.comp != NULL)
529 Free(s->s3->rrec.comp);
530#ifndef NO_DH
531 if (s->s3->tmp.dh != NULL)
532 DH_free(s->s3->tmp.dh);
533#endif
534 if (s->s3->tmp.ca_names != NULL)
535 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
536 memset(s->s3,0,sizeof(SSL3_CTX));
537 Free(s->s3);
538 s->s3=NULL;
539 }
540
541void ssl3_clear(SSL *s)
542 {
543 unsigned char *rp,*wp;
544
545 ssl3_cleanup_key_block(s);
546 if (s->s3->tmp.ca_names != NULL)
547 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
548
549 if (s->s3->rrec.comp != NULL)
550 {
551 Free(s->s3->rrec.comp);
552 s->s3->rrec.comp=NULL;
553 }
554
555 rp=s->s3->rbuf.buf;
556 wp=s->s3->wbuf.buf;
557
558 memset(s->s3,0,sizeof(SSL3_CTX));
559 if (rp != NULL) s->s3->rbuf.buf=rp;
560 if (wp != NULL) s->s3->wbuf.buf=wp;
561
562 ssl_free_wbio_buffer(s);
563
564 s->packet_length=0;
565 s->s3->renegotiate=0;
566 s->s3->total_renegotiations=0;
567 s->s3->num_renegotiations=0;
568 s->s3->in_read_app_data=0;
569 s->version=SSL3_VERSION;
570 }
571
572long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
573 {
574 int ret=0;
575
576#if !defined(NO_DSA) || !defined(NO_RSA)
577 if (
578#ifndef NO_RSA
579 cmd == SSL_CTRL_SET_TMP_RSA ||
580 cmd == SSL_CTRL_SET_TMP_RSA_CB ||
581#endif
582#ifndef NO_DSA
583 cmd == SSL_CTRL_SET_TMP_DH ||
584 cmd == SSL_CTRL_SET_TMP_DH_CB ||
585#endif
586 0)
587 {
588 if (!ssl_cert_inst(&s->cert))
589 {
590 SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
591 return(0);
592 }
593 }
594#endif
595
596 switch (cmd)
597 {
598 case SSL_CTRL_GET_SESSION_REUSED:
599 ret=s->hit;
600 break;
601 case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
602 break;
603 case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
604 ret=s->s3->num_renegotiations;
605 break;
606 case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
607 ret=s->s3->num_renegotiations;
608 s->s3->num_renegotiations=0;
609 break;
610 case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
611 ret=s->s3->total_renegotiations;
612 break;
613 case SSL_CTRL_GET_FLAGS:
614 ret=(int)(s->s3->flags);
615 break;
616#ifndef NO_RSA
617 case SSL_CTRL_NEED_TMP_RSA:
618 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) &&
619 ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
620 (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))))
621 ret = 1;
622 break;
623 case SSL_CTRL_SET_TMP_RSA:
624 {
625 RSA *rsa = (RSA *)parg;
626 if (rsa == NULL) {
627 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
628 return(ret);
629 }
630 if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) {
631 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB);
632 return(ret);
633 }
634 if (s->cert->rsa_tmp != NULL)
635 RSA_free(s->cert->rsa_tmp);
636 s->cert->rsa_tmp = rsa;
637 ret = 1;
638 }
639 break;
640 case SSL_CTRL_SET_TMP_RSA_CB:
641 s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))parg;
642 break;
643#endif
644#ifndef NO_DH
645 case SSL_CTRL_SET_TMP_DH:
646 {
647 DH *dh = (DH *)parg;
648 if (dh == NULL) {
649 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
650 return(ret);
651 }
652 if ((dh = DHparams_dup(dh)) == NULL) {
653 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
654 return(ret);
655 }
656 if (!DH_generate_key(dh)) {
657 DH_free(dh);
658 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
659 return(ret);
660 }
661 if (s->cert->dh_tmp != NULL)
662 DH_free(s->cert->dh_tmp);
663 s->cert->dh_tmp = dh;
664 ret = 1;
665 }
666 break;
667 case SSL_CTRL_SET_TMP_DH_CB:
668 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))parg;
669 break;
670#endif
671 default:
672 break;
673 }
674 return(ret);
675 }
676
677long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
678 {
679 CERT *cert;
680
681 cert=ctx->cert;
682
683 switch (cmd)
684 {
685#ifndef NO_RSA
686 case SSL_CTRL_NEED_TMP_RSA:
687 if ( (cert->rsa_tmp == NULL) &&
688 ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
689 (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))
690 )
691 return(1);
692 else
693 return(0);
694 /* break; */
695 case SSL_CTRL_SET_TMP_RSA:
696 {
697 RSA *rsa;
698 int i;
699
700 rsa=(RSA *)parg;
701 i=1;
702 if (rsa == NULL)
703 i=0;
704 else
705 {
706 if ((rsa=RSAPrivateKey_dup(rsa)) == NULL)
707 i=0;
708 }
709 if (!i)
710 {
711 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB);
712 return(0);
713 }
714 else
715 {
716 if (cert->rsa_tmp != NULL)
717 RSA_free(cert->rsa_tmp);
718 cert->rsa_tmp=rsa;
719 return(1);
720 }
721 }
722 /* break; */
723 case SSL_CTRL_SET_TMP_RSA_CB:
724 cert->rsa_tmp_cb=(RSA *(*)(SSL *, int, int))parg;
725 break;
726#endif
727#ifndef NO_DH
728 case SSL_CTRL_SET_TMP_DH:
729 {
730 DH *new=NULL,*dh;
731 int rret=0;
732
733 dh=(DH *)parg;
734 if ( ((new=DHparams_dup(dh)) == NULL) ||
735 (!DH_generate_key(new)))
736 {
737 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
738 if (new != NULL) DH_free(new);
739 }
740 else
741 {
742 if (cert->dh_tmp != NULL)
743 DH_free(cert->dh_tmp);
744 cert->dh_tmp=new;
745 rret=1;
746 }
747 return(rret);
748 }
749 /*break; */
750 case SSL_CTRL_SET_TMP_DH_CB:
751 cert->dh_tmp_cb=(DH *(*)(SSL *, int, int))parg;
752 break;
753#endif
754 /* A Thawte special :-) */
755 case SSL_CTRL_EXTRA_CHAIN_CERT:
756 if (ctx->extra_certs == NULL)
757 {
758 if ((ctx->extra_certs=sk_X509_new_null()) == NULL)
759 return(0);
760 }
761 sk_X509_push(ctx->extra_certs,(X509 *)parg);
762 break;
763
764 default:
765 return(0);
766 }
767 return(1);
768 }
769
770/* This function needs to check if the ciphers required are actually
771 * available */
772SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
773 {
774 static int init=1;
775 static SSL_CIPHER *sorted[SSL3_NUM_CIPHERS];
776 SSL_CIPHER c,*cp= &c,**cpp;
777 unsigned long id;
778 int i;
779
780 if (init)
781 {
782 CRYPTO_w_lock(CRYPTO_LOCK_SSL);
783
784 for (i=0; i<SSL3_NUM_CIPHERS; i++)
785 sorted[i]= &(ssl3_ciphers[i]);
786
787 qsort( (char *)sorted,
788 SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *),
789 FP_ICC ssl_cipher_ptr_id_cmp);
790
791 CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
792
793 init=0;
794 }
795
796 id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
797 c.id=id;
798 cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp,
799 (char *)sorted,
800 SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *),
801 (int (*)())ssl_cipher_ptr_id_cmp);
802 if ((cpp == NULL) || !(*cpp)->valid)
803 return(NULL);
804 else
805 return(*cpp);
806 }
807
808int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
809 {
810 long l;
811
812 if (p != NULL)
813 {
814 l=c->id;
815 if ((l & 0xff000000) != 0x03000000) return(0);
816 p[0]=((unsigned char)(l>> 8L))&0xFF;
817 p[1]=((unsigned char)(l ))&0xFF;
818 }
819 return(2);
820 }
821
822int ssl3_part_read(SSL *s, int i)
823 {
824 s->rwstate=SSL_READING;
825
826 if (i < 0)
827 {
828 return(i);
829 }
830 else
831 {
832 s->init_num+=i;
833 return(0);
834 }
835 }
836
837SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have,
838 STACK_OF(SSL_CIPHER) *pref)
839 {
840 SSL_CIPHER *c,*ret=NULL;
841 int i,j,ok;
842 CERT *cert;
843 unsigned long alg,mask,emask;
844
845 /* Let's see which ciphers we can support */
846 cert=s->cert;
847
848 sk_SSL_CIPHER_set_cmp_func(pref,ssl_cipher_ptr_id_cmp);
849
850#ifdef CIPHER_DEBUG
851 printf("Have:\n");
852 for(i=0 ; i < sk_num(pref) ; ++i)
853 {
854 c=(SSL_CIPHER *)sk_value(pref,i);
855 printf("%p:%s\n",c,c->name);
856 }
857#endif
858
859 for (i=0; i<sk_SSL_CIPHER_num(have); i++)
860 {
861 c=sk_SSL_CIPHER_value(have,i);
862
863 ssl_set_cert_masks(cert,c);
864 mask=cert->mask;
865 emask=cert->export_mask;
866
867 alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK);
868 if (SSL_IS_EXPORT(c->algorithms))
869 {
870 ok=((alg & emask) == alg)?1:0;
871#ifdef CIPHER_DEBUG
872 printf("%d:[%08lX:%08lX]%p:%s (export)\n",ok,alg,emask,
873 c,c->name);
874#endif
875 }
876 else
877 {
878 ok=((alg & mask) == alg)?1:0;
879#ifdef CIPHER_DEBUG
880 printf("%d:[%08lX:%08lX]%p:%s\n",ok,alg,mask,c,
881 c->name);
882#endif
883 }
884
885 if (!ok) continue;
886
887 j=sk_SSL_CIPHER_find(pref,c);
888 if (j >= 0)
889 {
890 ret=sk_SSL_CIPHER_value(pref,j);
891 break;
892 }
893 }
894 return(ret);
895 }
896
897int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
898 {
899 int ret=0;
900 unsigned long alg;
901
902 alg=s->s3->tmp.new_cipher->algorithms;
903
904#ifndef NO_DH
905 if (alg & (SSL_kDHr|SSL_kEDH))
906 {
907# ifndef NO_RSA
908 p[ret++]=SSL3_CT_RSA_FIXED_DH;
909# endif
910# ifndef NO_DSA
911 p[ret++]=SSL3_CT_DSS_FIXED_DH;
912# endif
913 }
914 if ((s->version == SSL3_VERSION) &&
915 (alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr)))
916 {
917# ifndef NO_RSA
918 p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
919# endif
920# ifndef NO_DSA
921 p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
922# endif
923 }
924#endif /* !NO_DH */
925#ifndef NO_RSA
926 p[ret++]=SSL3_CT_RSA_SIGN;
927#endif
928#ifndef NO_DSA
929 p[ret++]=SSL3_CT_DSS_SIGN;
930#endif
931 return(ret);
932 }
933
934int ssl3_shutdown(SSL *s)
935 {
936
937 /* Don't do anything much if we have not done the handshake or
938 * we don't want to send messages :-) */
939 if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE))
940 {
941 s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
942 return(1);
943 }
944
945 if (!(s->shutdown & SSL_SENT_SHUTDOWN))
946 {
947 s->shutdown|=SSL_SENT_SHUTDOWN;
948#if 1
949 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY);
950#endif
951 /* our shutdown alert has been sent now, and if it still needs
952 * to be written, s->s3->alert_dispatch will be true */
953 }
954 else if (s->s3->alert_dispatch)
955 {
956 /* resend it if not sent */
957#if 1
958 ssl3_dispatch_alert(s);
959#endif
960 }
961 else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
962 {
963 /* If we are waiting for a close from our peer, we are closed */
964 ssl3_read_bytes(s,0,NULL,0);
965 }
966
967 if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
968 !s->s3->alert_dispatch)
969 return(1);
970 else
971 return(0);
972 }
973
974int ssl3_write(SSL *s, const void *buf, int len)
975 {
976 int ret,n;
977
978#if 0
979 if (s->shutdown & SSL_SEND_SHUTDOWN)
980 {
981 s->rwstate=SSL_NOTHING;
982 return(0);
983 }
984#endif
985 clear_sys_error();
986 if (s->s3->renegotiate) ssl3_renegotiate_check(s);
987
988 /* This is an experimental flag that sends the
989 * last handshake message in the same packet as the first
990 * use data - used to see if it helps the TCP protocol during
991 * session-id reuse */
992 /* The second test is because the buffer may have been removed */
993 if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio))
994 {
995 /* First time through, we write into the buffer */
996 if (s->s3->delay_buf_pop_ret == 0)
997 {
998 ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
999 buf,len);
1000 if (ret <= 0) return(ret);
1001
1002 s->s3->delay_buf_pop_ret=ret;
1003 }
1004
1005 s->rwstate=SSL_WRITING;
1006 n=BIO_flush(s->wbio);
1007 if (n <= 0) return(n);
1008 s->rwstate=SSL_NOTHING;
1009
1010 /* We have flushed the buffer, so remove it */
1011 ssl_free_wbio_buffer(s);
1012 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
1013
1014 ret=s->s3->delay_buf_pop_ret;
1015 s->s3->delay_buf_pop_ret=0;
1016 }
1017 else
1018 {
1019 ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
1020 buf,len);
1021 if (ret <= 0) return(ret);
1022 }
1023
1024 return(ret);
1025 }
1026
1027int ssl3_read(SSL *s, void *buf, int len)
1028 {
1029 int ret;
1030
1031 clear_sys_error();
1032 if (s->s3->renegotiate) ssl3_renegotiate_check(s);
1033 s->s3->in_read_app_data=1;
1034 ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len);
1035 if ((ret == -1) && (s->s3->in_read_app_data == 0))
1036 {
1037 ERR_get_error(); /* clear the error */
1038 s->s3->in_read_app_data=0;
1039 s->in_handshake++;
1040 ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len);
1041 s->in_handshake--;
1042 }
1043 else
1044 s->s3->in_read_app_data=0;
1045
1046 return(ret);
1047 }
1048
1049int ssl3_peek(SSL *s, char *buf, int len)
1050 {
1051 SSL3_RECORD *rr;
1052 int n;
1053
1054 rr= &(s->s3->rrec);
1055 if ((rr->length == 0) || (rr->type != SSL3_RT_APPLICATION_DATA))
1056 {
1057 n=ssl3_read(s,buf,1);
1058 if (n <= 0) return(n);
1059 rr->length++;
1060 rr->off--;
1061 }
1062
1063 if ((unsigned int)len > rr->length)
1064 n=rr->length;
1065 else
1066 n=len;
1067 memcpy(buf,&(rr->data[rr->off]),(unsigned int)n);
1068 return(n);
1069 }
1070
1071int ssl3_renegotiate(SSL *s)
1072 {
1073 if (s->handshake_func == NULL)
1074 return(1);
1075
1076 if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
1077 return(0);
1078
1079 s->s3->renegotiate=1;
1080 return(1);
1081 }
1082
1083int ssl3_renegotiate_check(SSL *s)
1084 {
1085 int ret=0;
1086
1087 if (s->s3->renegotiate)
1088 {
1089 if ( (s->s3->rbuf.left == 0) &&
1090 (s->s3->wbuf.left == 0) &&
1091 !SSL_in_init(s))
1092 {
1093/*
1094if we are the server, and we have sent a 'RENEGOTIATE' message, we
1095need to go to SSL_ST_ACCEPT.
1096*/
1097 /* SSL_ST_ACCEPT */
1098 s->state=SSL_ST_RENEGOTIATE;
1099 s->s3->renegotiate=0;
1100 s->s3->num_renegotiations++;
1101 s->s3->total_renegotiations++;
1102 ret=1;
1103 }
1104 }
1105 return(ret);
1106 }
1107
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
deleted file mode 100644
index 7893d03123..0000000000
--- a/src/lib/libssl/s3_pkt.c
+++ /dev/null
@@ -1,1041 +0,0 @@
1/* ssl/s3_pkt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <errno.h>
61#define USE_SOCKETS
62#include <openssl/evp.h>
63#include <openssl/buffer.h>
64#include "ssl_locl.h"
65
66static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
67 unsigned int len);
68static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
69 unsigned int len);
70static int ssl3_get_record(SSL *s);
71static int do_compress(SSL *ssl);
72static int do_uncompress(SSL *ssl);
73static int do_change_cipher_spec(SSL *ssl);
74static int ssl3_read_n(SSL *s, int n, int max, int extend)
75 {
76 int i,off,newb;
77
78 /* if there is stuff still in the buffer from a previous read,
79 * and there is more than we want, take some. */
80 if (s->s3->rbuf.left >= (int)n)
81 {
82 if (extend)
83 s->packet_length+=n;
84 else
85 {
86 s->packet= &(s->s3->rbuf.buf[s->s3->rbuf.offset]);
87 s->packet_length=n;
88 }
89 s->s3->rbuf.left-=n;
90 s->s3->rbuf.offset+=n;
91 return(n);
92 }
93
94 /* else we need to read more data */
95 if (!s->read_ahead) max=n;
96 if (max > SSL3_RT_MAX_PACKET_SIZE)
97 max=SSL3_RT_MAX_PACKET_SIZE;
98
99 /* First check if there is some left or we want to extend */
100 off=0;
101 if ( (s->s3->rbuf.left != 0) ||
102 ((s->packet_length != 0) && extend))
103 {
104 newb=s->s3->rbuf.left;
105 if (extend)
106 {
107 /* Copy bytes back to the front of the buffer
108 * Take the bytes already pointed to by 'packet'
109 * and take the extra ones on the end. */
110 off=s->packet_length;
111 if (s->packet != s->s3->rbuf.buf)
112 memcpy(s->s3->rbuf.buf,s->packet,newb+off);
113 }
114 else if (s->s3->rbuf.offset != 0)
115 { /* so the data is not at the start of the buffer */
116 memcpy(s->s3->rbuf.buf,
117 &(s->s3->rbuf.buf[s->s3->rbuf.offset]),newb);
118 s->s3->rbuf.offset=0;
119 }
120
121 s->s3->rbuf.left=0;
122 }
123 else
124 newb=0;
125
126 /* So we now have 'newb' bytes at the front of
127 * s->s3->rbuf.buf and need to read some more in on the end
128 * We start reading into the buffer at 's->s3->rbuf.offset'
129 */
130 s->packet=s->s3->rbuf.buf;
131
132 while (newb < n)
133 {
134 clear_sys_error();
135 if (s->rbio != NULL)
136 {
137 s->rwstate=SSL_READING;
138 i=BIO_read(s->rbio,
139 (char *)&(s->s3->rbuf.buf[off+newb]),
140 max-newb);
141 }
142 else
143 {
144 SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);
145 i= -1;
146 }
147
148 if (i <= 0)
149 {
150 s->s3->rbuf.left+=newb;
151 return(i);
152 }
153 newb+=i;
154 }
155
156 /* record used data read */
157 if (newb > n)
158 {
159 s->s3->rbuf.offset=n+off;
160 s->s3->rbuf.left=newb-n;
161 }
162 else
163 {
164 s->s3->rbuf.offset=0;
165 s->s3->rbuf.left=0;
166 }
167
168 if (extend)
169 s->packet_length+=n;
170 else
171 s->packet_length+=n;
172 return(n);
173 }
174
175/* Call this to get a new input record.
176 * It will return <= 0 if more data is needed, normally due to an error
177 * or non-blocking IO.
178 * When it finishes, one packet has been decoded and can be found in
179 * ssl->s3->rrec.type - is the type of record
180 * ssl->s3->rrec.data, - data
181 * ssl->s3->rrec.length, - number of bytes
182 */
183static int ssl3_get_record(SSL *s)
184 {
185 int ssl_major,ssl_minor,al;
186 int n,i,ret= -1;
187 SSL3_BUFFER *rb;
188 SSL3_RECORD *rr;
189 SSL_SESSION *sess;
190 unsigned char *p;
191 unsigned char md[EVP_MAX_MD_SIZE];
192 short version;
193 unsigned int mac_size;
194 int clear=0,extra;
195
196 rr= &(s->s3->rrec);
197 rb= &(s->s3->rbuf);
198 sess=s->session;
199
200 if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
201 extra=SSL3_RT_MAX_EXTRA;
202 else
203 extra=0;
204
205again:
206 /* check if we have the header */
207 if ( (s->rstate != SSL_ST_READ_BODY) ||
208 (s->packet_length < SSL3_RT_HEADER_LENGTH))
209 {
210 n=ssl3_read_n(s,SSL3_RT_HEADER_LENGTH,
211 SSL3_RT_MAX_PACKET_SIZE,0);
212 if (n <= 0) return(n); /* error or non-blocking */
213 s->rstate=SSL_ST_READ_BODY;
214
215 p=s->packet;
216
217 /* Pull apart the header into the SSL3_RECORD */
218 rr->type= *(p++);
219 ssl_major= *(p++);
220 ssl_minor= *(p++);
221 version=(ssl_major<<8)|ssl_minor;
222 n2s(p,rr->length);
223
224 /* Lets check version */
225 if (s->first_packet)
226 {
227 s->first_packet=0;
228 }
229 else
230 {
231 if (version != s->version)
232 {
233 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
234 /* Send back error using their
235 * version number :-) */
236 s->version=version;
237 al=SSL_AD_PROTOCOL_VERSION;
238 goto f_err;
239 }
240 }
241
242 if ((version>>8) != SSL3_VERSION_MAJOR)
243 {
244 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
245 goto err;
246 }
247
248 if (rr->length >
249 (unsigned int)SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)
250 {
251 al=SSL_AD_RECORD_OVERFLOW;
252 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG);
253 goto f_err;
254 }
255
256 s->rstate=SSL_ST_READ_BODY;
257 }
258
259 /* get and decode the data */
260 if (s->rstate == SSL_ST_READ_BODY)
261 {
262 if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
263 {
264 i=rr->length;
265 /*-(s->packet_length-SSL3_RT_HEADER_LENGTH); */
266 n=ssl3_read_n(s,i,i,1);
267 if (n <= 0) return(n); /* error or non-blocking io */
268 }
269 s->rstate=SSL_ST_READ_HEADER;
270 }
271
272 /* At this point, we have the data in s->packet and there should be
273 * s->packet_length bytes, we must not 'overrun' this buffer :-)
274 * One of the following functions will copy the data from the
275 * s->packet buffer */
276
277 rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
278
279 /* ok, we can now read from 's->packet' data into 'rr'
280 * rr->input points at rr->length bytes, which
281 * need to be copied into rr->data by either
282 * the decryption or by the decompression
283 * When the data is 'copied' into the rr->data buffer,
284 * rr->input will be pointed at the new buffer */
285
286 /* Set the state for the following operations */
287 s->rstate=SSL_ST_READ_HEADER;
288
289 /* We now have - encrypted [ MAC [ compressed [ plain ] ] ]
290 * rr->length bytes of encrypted compressed stuff. */
291
292 /* check is not needed I belive */
293 if (rr->length > (unsigned int)SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)
294 {
295 al=SSL_AD_RECORD_OVERFLOW;
296 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
297 goto f_err;
298 }
299
300 /* decrypt in place in 'rr->input' */
301 rr->data=rr->input;
302
303 if (!s->method->ssl3_enc->enc(s,0))
304 {
305 al=SSL_AD_DECRYPT_ERROR;
306 goto f_err;
307 }
308#ifdef TLS_DEBUG
309printf("dec %d\n",rr->length);
310{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
311printf("\n");
312#endif
313 /* r->length is now the compressed data plus mac */
314 if ( (sess == NULL) ||
315 (s->enc_read_ctx == NULL) ||
316 (s->read_hash == NULL))
317 clear=1;
318
319 if (!clear)
320 {
321 mac_size=EVP_MD_size(s->read_hash);
322
323 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
324 {
325 al=SSL_AD_RECORD_OVERFLOW;
326 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
327 goto f_err;
328 }
329 /* check MAC for rr->input' */
330 if (rr->length < mac_size)
331 {
332 al=SSL_AD_DECODE_ERROR;
333 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
334 goto f_err;
335 }
336 rr->length-=mac_size;
337 i=s->method->ssl3_enc->mac(s,md,0);
338 if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
339 {
340 al=SSL_AD_BAD_RECORD_MAC;
341 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_MAC_DECODE);
342 ret= -1;
343 goto f_err;
344 }
345 }
346
347 /* r->length is now just compressed */
348 if (s->expand != NULL)
349 {
350 if (rr->length >
351 (unsigned int)SSL3_RT_MAX_COMPRESSED_LENGTH+extra)
352 {
353 al=SSL_AD_RECORD_OVERFLOW;
354 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
355 goto f_err;
356 }
357 if (!do_uncompress(s))
358 {
359 al=SSL_AD_DECOMPRESSION_FAILURE;
360 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);
361 goto f_err;
362 }
363 }
364
365 if (rr->length > (unsigned int)SSL3_RT_MAX_PLAIN_LENGTH+extra)
366 {
367 al=SSL_AD_RECORD_OVERFLOW;
368 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);
369 goto f_err;
370 }
371
372 rr->off=0;
373 /* So at this point the following is true
374 * ssl->s3->rrec.type is the type of record
375 * ssl->s3->rrec.length == number of bytes in record
376 * ssl->s3->rrec.off == offset to first valid byte
377 * ssl->s3->rrec.data == where to take bytes from, increment
378 * after use :-).
379 */
380
381 /* we have pulled in a full packet so zero things */
382 s->packet_length=0;
383
384 /* just read a 0 length packet */
385 if (rr->length == 0) goto again;
386
387 return(1);
388f_err:
389 ssl3_send_alert(s,SSL3_AL_FATAL,al);
390err:
391 return(ret);
392 }
393
394static int do_uncompress(SSL *ssl)
395 {
396 int i;
397 SSL3_RECORD *rr;
398
399 rr= &(ssl->s3->rrec);
400 i=COMP_expand_block(ssl->expand,rr->comp,
401 SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length);
402 if (i < 0)
403 return(0);
404 else
405 rr->length=i;
406 rr->data=rr->comp;
407
408 return(1);
409 }
410
411static int do_compress(SSL *ssl)
412 {
413 int i;
414 SSL3_RECORD *wr;
415
416 wr= &(ssl->s3->wrec);
417 i=COMP_compress_block(ssl->compress,wr->data,
418 SSL3_RT_MAX_COMPRESSED_LENGTH,
419 wr->input,(int)wr->length);
420 if (i < 0)
421 return(0);
422 else
423 wr->length=i;
424
425 wr->input=wr->data;
426 return(1);
427 }
428
429/* Call this to write data
430 * It will return <= 0 if not all data has been sent or non-blocking IO.
431 */
432int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
433 {
434 const unsigned char *buf=_buf;
435 unsigned int tot,n,nw;
436 int i;
437
438 s->rwstate=SSL_NOTHING;
439 tot=s->s3->wnum;
440 s->s3->wnum=0;
441
442 if (SSL_in_init(s) && !s->in_handshake)
443 {
444 i=s->handshake_func(s);
445 if (i < 0) return(i);
446 if (i == 0)
447 {
448 SSLerr(SSL_F_SSL3_WRITE_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
449 return(-1);
450 }
451 }
452
453 n=(len-tot);
454 for (;;)
455 {
456 if (n > SSL3_RT_MAX_PLAIN_LENGTH)
457 nw=SSL3_RT_MAX_PLAIN_LENGTH;
458 else
459 nw=n;
460
461 i=do_ssl3_write(s,type,&(buf[tot]),nw);
462 if (i <= 0)
463 {
464 s->s3->wnum=tot;
465 return(i);
466 }
467
468 if (type == SSL3_RT_HANDSHAKE)
469 ssl3_finish_mac(s,&(buf[tot]),i);
470
471 if ((i == (int)n) ||
472 (type == SSL3_RT_APPLICATION_DATA &&
473 (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))
474 {
475 return(tot+i);
476 }
477
478 n-=i;
479 tot+=i;
480 }
481 }
482
483static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
484 unsigned int len)
485 {
486 unsigned char *p,*plen;
487 int i,mac_size,clear=0;
488 SSL3_RECORD *wr;
489 SSL3_BUFFER *wb;
490 SSL_SESSION *sess;
491
492 /* first check is there is a SSL3_RECORD still being written
493 * out. This will happen with non blocking IO */
494 if (s->s3->wbuf.left != 0)
495 return(ssl3_write_pending(s,type,buf,len));
496
497 /* If we have an alert to send, lets send it */
498 if (s->s3->alert_dispatch)
499 {
500 i=ssl3_dispatch_alert(s);
501 if (i <= 0)
502 return(i);
503 /* if it went, fall through and send more stuff */
504 }
505
506 if (len <= 0) return(len);
507
508 wr= &(s->s3->wrec);
509 wb= &(s->s3->wbuf);
510 sess=s->session;
511
512 if ( (sess == NULL) ||
513 (s->enc_write_ctx == NULL) ||
514 (s->write_hash == NULL))
515 clear=1;
516
517 if (clear)
518 mac_size=0;
519 else
520 mac_size=EVP_MD_size(s->write_hash);
521
522 p=wb->buf;
523
524 /* write the header */
525 *(p++)=type&0xff;
526 wr->type=type;
527
528 *(p++)=(s->version>>8);
529 *(p++)=s->version&0xff;
530
531 /* record where we are to write out packet length */
532 plen=p;
533 p+=2;
534
535 /* lets setup the record stuff. */
536 wr->data=p;
537 wr->length=(int)len;
538 wr->input=(unsigned char *)buf;
539
540 /* we now 'read' from wr->input, wr->length bytes into
541 * wr->data */
542
543 /* first we compress */
544 if (s->compress != NULL)
545 {
546 if (!do_compress(s))
547 {
548 SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE);
549 goto err;
550 }
551 }
552 else
553 {
554 memcpy(wr->data,wr->input,wr->length);
555 wr->input=wr->data;
556 }
557
558 /* we should still have the output to wr->data and the input
559 * from wr->input. Length should be wr->length.
560 * wr->data still points in the wb->buf */
561
562 if (mac_size != 0)
563 {
564 s->method->ssl3_enc->mac(s,&(p[wr->length]),1);
565 wr->length+=mac_size;
566 wr->input=p;
567 wr->data=p;
568 }
569
570 /* ssl3_enc can only have an error on read */
571 s->method->ssl3_enc->enc(s,1);
572
573 /* record length after mac and block padding */
574 s2n(wr->length,plen);
575
576 /* we should now have
577 * wr->data pointing to the encrypted data, which is
578 * wr->length long */
579 wr->type=type; /* not needed but helps for debugging */
580 wr->length+=SSL3_RT_HEADER_LENGTH;
581
582 /* Now lets setup wb */
583 wb->left=wr->length;
584 wb->offset=0;
585
586 s->s3->wpend_tot=len;
587 s->s3->wpend_buf=buf;
588 s->s3->wpend_type=type;
589 s->s3->wpend_ret=len;
590
591 /* we now just need to write the buffer */
592 return(ssl3_write_pending(s,type,buf,len));
593err:
594 return(-1);
595 }
596
597/* if s->s3->wbuf.left != 0, we need to call this */
598static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
599 unsigned int len)
600 {
601 int i;
602
603/* XXXX */
604 if ((s->s3->wpend_tot > (int)len)
605 || ((s->s3->wpend_buf != buf) &&
606 !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER))
607 || (s->s3->wpend_type != type))
608 {
609 SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BAD_WRITE_RETRY);
610 return(-1);
611 }
612
613 for (;;)
614 {
615 clear_sys_error();
616 if (s->wbio != NULL)
617 {
618 s->rwstate=SSL_WRITING;
619 i=BIO_write(s->wbio,
620 (char *)&(s->s3->wbuf.buf[s->s3->wbuf.offset]),
621 (unsigned int)s->s3->wbuf.left);
622 }
623 else
624 {
625 SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BIO_NOT_SET);
626 i= -1;
627 }
628 if (i == s->s3->wbuf.left)
629 {
630 s->s3->wbuf.left=0;
631 s->rwstate=SSL_NOTHING;
632 return(s->s3->wpend_ret);
633 }
634 else if (i <= 0)
635 return(i);
636 s->s3->wbuf.offset+=i;
637 s->s3->wbuf.left-=i;
638 }
639 }
640
641int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len)
642 {
643 int al,i,j,n,ret;
644 SSL3_RECORD *rr;
645 void (*cb)()=NULL;
646 BIO *bio;
647
648 if (s->s3->rbuf.buf == NULL) /* Not initialize yet */
649 if (!ssl3_setup_buffers(s))
650 return(-1);
651
652 if (!s->in_handshake && SSL_in_init(s))
653 {
654 i=s->handshake_func(s);
655 if (i < 0) return(i);
656 if (i == 0)
657 {
658 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
659 return(-1);
660 }
661 }
662start:
663 s->rwstate=SSL_NOTHING;
664
665 /* s->s3->rrec.type - is the type of record
666 * s->s3->rrec.data, - data
667 * s->s3->rrec.off, - ofset into 'data' for next read
668 * s->s3->rrec.length, - number of bytes. */
669 rr= &(s->s3->rrec);
670
671 /* get new packet */
672 if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))
673 {
674 ret=ssl3_get_record(s);
675 if (ret <= 0) return(ret);
676 }
677
678 /* we now have a packet which can be read and processed */
679
680 if (s->s3->change_cipher_spec && (rr->type != SSL3_RT_HANDSHAKE))
681 {
682 al=SSL_AD_UNEXPECTED_MESSAGE;
683 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
684 goto err;
685 }
686
687 /* If the other end has shutdown, throw anything we read away */
688 if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
689 {
690 rr->length=0;
691 s->rwstate=SSL_NOTHING;
692 return(0);
693 }
694
695 /* Check for an incoming 'Client Request' message */
696 if ((rr->type == SSL3_RT_HANDSHAKE) && (rr->length == 4) &&
697 (rr->data[0] == SSL3_MT_CLIENT_REQUEST) &&
698 (s->session != NULL) && (s->session->cipher != NULL))
699 {
700 if ((rr->data[1] != 0) || (rr->data[2] != 0) ||
701 (rr->data[3] != 0))
702 {
703 al=SSL_AD_DECODE_ERROR;
704 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CLIENT_REQUEST);
705 goto err;
706 }
707
708 if (SSL_is_init_finished(s) &&
709 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
710 !s->s3->renegotiate)
711 {
712 ssl3_renegotiate(s);
713 if (ssl3_renegotiate_check(s))
714 {
715 n=s->handshake_func(s);
716 if (n < 0) return(n);
717 if (n == 0)
718 {
719 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
720 return(-1);
721 }
722 }
723 }
724 rr->length=0;
725/* ZZZ */ goto start;
726 }
727
728 /* if it is not the type we want, or we have shutdown and want
729 * the peer shutdown */
730 if ((rr->type != type) || (s->shutdown & SSL_SENT_SHUTDOWN))
731 {
732 if (rr->type == SSL3_RT_ALERT)
733 {
734 if ((rr->length != 2) || (rr->off != 0))
735 {
736 al=SSL_AD_DECODE_ERROR;
737 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_ALERT_RECORD);
738 goto f_err;
739 }
740
741 i=rr->data[0];
742 n=rr->data[1];
743
744 /* clear from buffer */
745 rr->length=0;
746
747 if (s->info_callback != NULL)
748 cb=s->info_callback;
749 else if (s->ctx->info_callback != NULL)
750 cb=s->ctx->info_callback;
751
752 if (cb != NULL)
753 {
754 j=(i<<8)|n;
755 cb(s,SSL_CB_READ_ALERT,j);
756 }
757
758 if (i == 1)
759 {
760 s->s3->warn_alert=n;
761 if (n == SSL_AD_CLOSE_NOTIFY)
762 {
763 s->shutdown|=SSL_RECEIVED_SHUTDOWN;
764 return(0);
765 }
766 }
767 else if (i == 2)
768 {
769 char tmp[16];
770
771 s->rwstate=SSL_NOTHING;
772 s->s3->fatal_alert=n;
773 SSLerr(SSL_F_SSL3_READ_BYTES,
774 SSL_AD_REASON_OFFSET+n);
775 sprintf(tmp,"%d",n);
776 ERR_add_error_data(2,"SSL alert number ",tmp);
777 s->shutdown|=SSL_RECEIVED_SHUTDOWN;
778 SSL_CTX_remove_session(s->ctx,s->session);
779 return(0);
780 }
781 else
782 {
783 al=SSL_AD_ILLEGAL_PARAMETER;
784 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
785 goto f_err;
786 }
787
788 rr->length=0;
789 goto start;
790 }
791
792 if (s->shutdown & SSL_SENT_SHUTDOWN)
793 {
794 s->rwstate=SSL_NOTHING;
795 rr->length=0;
796 return(0);
797 }
798
799 if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
800 {
801 if ( (rr->length != 1) || (rr->off != 0) ||
802 (rr->data[0] != SSL3_MT_CCS))
803 {
804 i=SSL_AD_ILLEGAL_PARAMETER;
805 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
806 goto err;
807 }
808
809 rr->length=0;
810 s->s3->change_cipher_spec=1;
811 if (!do_change_cipher_spec(s))
812 goto err;
813 else
814 goto start;
815 }
816
817 /* else we have a handshake */
818 if ((rr->type == SSL3_RT_HANDSHAKE) &&
819 !s->in_handshake)
820 {
821 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
822 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
823 {
824 s->state=SSL_ST_BEFORE|(s->server)
825 ?SSL_ST_ACCEPT
826 :SSL_ST_CONNECT;
827 s->new_session=1;
828 }
829 n=s->handshake_func(s);
830 if (n < 0) return(n);
831 if (n == 0)
832 {
833 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
834 return(-1);
835 }
836
837 /* In the case where we try to read application data
838 * the first time, but we trigger an SSL handshake, we
839 * return -1 with the retry option set. I do this
840 * otherwise renegotiation can cause nasty problems
841 * in the non-blocking world */
842
843 s->rwstate=SSL_READING;
844 bio=SSL_get_rbio(s);
845 BIO_clear_retry_flags(bio);
846 BIO_set_retry_read(bio);
847 return(-1);
848 }
849
850 switch (rr->type)
851 {
852 default:
853#ifndef NO_TLS
854 /* TLS just ignores unknown message types */
855 if (s->version == TLS1_VERSION)
856 {
857 goto start;
858 }
859#endif
860 case SSL3_RT_CHANGE_CIPHER_SPEC:
861 case SSL3_RT_ALERT:
862 case SSL3_RT_HANDSHAKE:
863 al=SSL_AD_UNEXPECTED_MESSAGE;
864 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
865 goto f_err;
866 case SSL3_RT_APPLICATION_DATA:
867 /* At this point, we were expecting something else,
868 * but have application data. What we do is set the
869 * error, and return -1. On the way out, if the
870 * library was running inside ssl3_read() and it makes
871 * sense to read application data at this point, we
872 * will indulge it. This will mostly happen during
873 * session renegotiation.
874 */
875 if (s->s3->in_read_app_data &&
876 (s->s3->total_renegotiations != 0) &&
877 ((
878 (s->state & SSL_ST_CONNECT) &&
879 (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
880 (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
881 ) || (
882 (s->state & SSL_ST_ACCEPT) &&
883 (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
884 (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
885 )
886 ))
887 {
888 s->s3->in_read_app_data=0;
889 return(-1);
890 }
891 else
892 {
893 al=SSL_AD_UNEXPECTED_MESSAGE;
894 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
895 goto f_err;
896 }
897 }
898 }
899
900 /* make sure that we are not getting application data when we
901 * are doing a handshake for the first time */
902 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
903 (s->enc_read_ctx == NULL))
904 {
905 al=SSL_AD_UNEXPECTED_MESSAGE;
906 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
907 goto f_err;
908 }
909
910 if (len <= 0) return(len);
911
912 if ((unsigned int)len > rr->length)
913 n=rr->length;
914 else
915 n=len;
916
917 memcpy(buf,&(rr->data[rr->off]),(unsigned int)n);
918 rr->length-=n;
919 rr->off+=n;
920 if (rr->length <= 0)
921 {
922 s->rstate=SSL_ST_READ_HEADER;
923 rr->off=0;
924 }
925
926 if (type == SSL3_RT_HANDSHAKE)
927 ssl3_finish_mac(s,buf,n);
928 return(n);
929f_err:
930 ssl3_send_alert(s,SSL3_AL_FATAL,al);
931err:
932 return(-1);
933 }
934
935static int do_change_cipher_spec(SSL *s)
936 {
937 int i;
938 unsigned char *sender;
939 int slen;
940
941 if (s->state & SSL_ST_ACCEPT)
942 i=SSL3_CHANGE_CIPHER_SERVER_READ;
943 else
944 i=SSL3_CHANGE_CIPHER_CLIENT_READ;
945
946 if (s->s3->tmp.key_block == NULL)
947 {
948 s->session->cipher=s->s3->tmp.new_cipher;
949 if (!s->method->ssl3_enc->setup_key_block(s)) return(0);
950 }
951
952 if (!s->method->ssl3_enc->change_cipher_state(s,i))
953 return(0);
954
955 /* we have to record the message digest at
956 * this point so we can get it before we read
957 * the finished message */
958 if (s->state & SSL_ST_CONNECT)
959 {
960 sender=s->method->ssl3_enc->server_finished;
961 slen=s->method->ssl3_enc->server_finished_len;
962 }
963 else
964 {
965 sender=s->method->ssl3_enc->client_finished;
966 slen=s->method->ssl3_enc->client_finished_len;
967 }
968
969 s->method->ssl3_enc->final_finish_mac(s,
970 &(s->s3->finish_dgst1),
971 &(s->s3->finish_dgst2),
972 sender,slen,&(s->s3->tmp.finish_md[0]));
973
974 return(1);
975 }
976
977int ssl3_do_write(SSL *s, int type)
978 {
979 int ret;
980
981 ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
982 s->init_num);
983 if (ret == s->init_num)
984 return(1);
985 if (ret < 0) return(-1);
986 s->init_off+=ret;
987 s->init_num-=ret;
988 return(0);
989 }
990
991void ssl3_send_alert(SSL *s, int level, int desc)
992 {
993 /* Map tls/ssl alert value to correct one */
994 desc=s->method->ssl3_enc->alert_value(desc);
995 if (desc < 0) return;
996 /* If a fatal one, remove from cache */
997 if ((level == 2) && (s->session != NULL))
998 SSL_CTX_remove_session(s->ctx,s->session);
999
1000 s->s3->alert_dispatch=1;
1001 s->s3->send_alert[0]=level;
1002 s->s3->send_alert[1]=desc;
1003 if (s->s3->wbuf.left == 0) /* data still being written out */
1004 ssl3_dispatch_alert(s);
1005 /* else data is still being written out, we will get written
1006 * some time in the future */
1007 }
1008
1009int ssl3_dispatch_alert(SSL *s)
1010 {
1011 int i,j;
1012 void (*cb)()=NULL;
1013
1014 s->s3->alert_dispatch=0;
1015 i=do_ssl3_write(s,SSL3_RT_ALERT,&s->s3->send_alert[0],2);
1016 if (i <= 0)
1017 {
1018 s->s3->alert_dispatch=1;
1019 }
1020 else
1021 {
1022 /* If it is important, send it now. If the message
1023 * does not get sent due to non-blocking IO, we will
1024 * not worry too much. */
1025 if (s->s3->send_alert[0] == SSL3_AL_FATAL)
1026 (void)BIO_flush(s->wbio);
1027
1028 if (s->info_callback != NULL)
1029 cb=s->info_callback;
1030 else if (s->ctx->info_callback != NULL)
1031 cb=s->ctx->info_callback;
1032
1033 if (cb != NULL)
1034 {
1035 j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
1036 cb(s,SSL_CB_WRITE_ALERT,j);
1037 }
1038 }
1039 return(i);
1040 }
1041
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
deleted file mode 100644
index e003d88357..0000000000
--- a/src/lib/libssl/s3_srvr.c
+++ /dev/null
@@ -1,1683 +0,0 @@
1/* ssl/s3_srvr.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#define REUSE_CIPHER_BUG
60
61#include <stdio.h>
62#include <openssl/buffer.h>
63#include <openssl/rand.h>
64#include <openssl/objects.h>
65#include <openssl/md5.h>
66#include <openssl/sha.h>
67#include <openssl/evp.h>
68#include <openssl/x509.h>
69#include "ssl_locl.h"
70
71static SSL_METHOD *ssl3_get_server_method(int ver);
72static int ssl3_get_client_hello(SSL *s);
73static int ssl3_send_server_hello(SSL *s);
74static int ssl3_send_server_key_exchange(SSL *s);
75static int ssl3_send_certificate_request(SSL *s);
76static int ssl3_send_server_done(SSL *s);
77static int ssl3_get_cert_verify(SSL *s);
78static int ssl3_get_client_key_exchange(SSL *s);
79static int ssl3_get_client_certificate(SSL *s);
80static int ssl3_send_hello_request(SSL *s);
81
82static SSL_METHOD *ssl3_get_server_method(int ver)
83 {
84 if (ver == SSL3_VERSION)
85 return(SSLv3_server_method());
86 else
87 return(NULL);
88 }
89
90SSL_METHOD *SSLv3_server_method(void)
91 {
92 static int init=1;
93 static SSL_METHOD SSLv3_server_data;
94
95 if (init)
96 {
97 memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(),
98 sizeof(SSL_METHOD));
99 SSLv3_server_data.ssl_accept=ssl3_accept;
100 SSLv3_server_data.get_ssl_method=ssl3_get_server_method;
101 init=0;
102 }
103 return(&SSLv3_server_data);
104 }
105
106int ssl3_accept(SSL *s)
107 {
108 BUF_MEM *buf;
109 unsigned long l,Time=time(NULL);
110 void (*cb)()=NULL;
111 long num1;
112 int ret= -1;
113 int new_state,state,skip=0;
114
115 RAND_seed(&Time,sizeof(Time));
116 ERR_clear_error();
117 clear_sys_error();
118
119 if (s->info_callback != NULL)
120 cb=s->info_callback;
121 else if (s->ctx->info_callback != NULL)
122 cb=s->ctx->info_callback;
123
124 /* init things to blank */
125 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
126 s->in_handshake++;
127
128 if (s->cert == NULL)
129 {
130 SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_NO_CERTIFICATE_SET);
131 return(-1);
132 }
133
134 for (;;)
135 {
136 state=s->state;
137
138 switch (s->state)
139 {
140 case SSL_ST_RENEGOTIATE:
141 s->new_session=1;
142 /* s->state=SSL_ST_ACCEPT; */
143
144 case SSL_ST_BEFORE:
145 case SSL_ST_ACCEPT:
146 case SSL_ST_BEFORE|SSL_ST_ACCEPT:
147 case SSL_ST_OK|SSL_ST_ACCEPT:
148
149 s->server=1;
150 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
151
152 if ((s->version>>8) != 3)
153 abort();
154 /* s->version=SSL3_VERSION; */
155 s->type=SSL_ST_ACCEPT;
156
157 if (s->init_buf == NULL)
158 {
159 if ((buf=BUF_MEM_new()) == NULL)
160 {
161 ret= -1;
162 goto end;
163 }
164 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
165 {
166 ret= -1;
167 goto end;
168 }
169 s->init_buf=buf;
170 }
171
172 if (!ssl3_setup_buffers(s))
173 {
174 ret= -1;
175 goto end;
176 }
177
178 /* Ok, we now need to push on a buffering BIO so that
179 * the output is sent in a way that TCP likes :-)
180 */
181 if (!ssl_init_wbio_buffer(s,1)) { ret= -1; goto end; }
182
183 s->init_num=0;
184
185 if (s->state != SSL_ST_RENEGOTIATE)
186 {
187 s->state=SSL3_ST_SR_CLNT_HELLO_A;
188 ssl3_init_finished_mac(s);
189 s->ctx->stats.sess_accept++;
190 }
191 else
192 {
193 s->ctx->stats.sess_accept_renegotiate++;
194 s->state=SSL3_ST_SW_HELLO_REQ_A;
195 }
196 break;
197
198 case SSL3_ST_SW_HELLO_REQ_A:
199 case SSL3_ST_SW_HELLO_REQ_B:
200
201 s->shutdown=0;
202 ret=ssl3_send_hello_request(s);
203 if (ret <= 0) goto end;
204 s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C;
205 s->state=SSL3_ST_SW_FLUSH;
206 s->init_num=0;
207
208 ssl3_init_finished_mac(s);
209 break;
210
211 case SSL3_ST_SW_HELLO_REQ_C:
212 s->state=SSL_ST_OK;
213 ret=1;
214 goto end;
215 /* break; */
216
217 case SSL3_ST_SR_CLNT_HELLO_A:
218 case SSL3_ST_SR_CLNT_HELLO_B:
219 case SSL3_ST_SR_CLNT_HELLO_C:
220
221 s->shutdown=0;
222 ret=ssl3_get_client_hello(s);
223 if (ret <= 0) goto end;
224 s->state=SSL3_ST_SW_SRVR_HELLO_A;
225 s->init_num=0;
226 break;
227
228 case SSL3_ST_SW_SRVR_HELLO_A:
229 case SSL3_ST_SW_SRVR_HELLO_B:
230 ret=ssl3_send_server_hello(s);
231 if (ret <= 0) goto end;
232
233 if (s->hit)
234 s->state=SSL3_ST_SW_CHANGE_A;
235 else
236 s->state=SSL3_ST_SW_CERT_A;
237 s->init_num=0;
238 break;
239
240 case SSL3_ST_SW_CERT_A:
241 case SSL3_ST_SW_CERT_B:
242 /* Check if it is anon DH */
243 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
244 {
245 ret=ssl3_send_server_certificate(s);
246 if (ret <= 0) goto end;
247 }
248 else
249 skip=1;
250 s->state=SSL3_ST_SW_KEY_EXCH_A;
251 s->init_num=0;
252 break;
253
254 case SSL3_ST_SW_KEY_EXCH_A:
255 case SSL3_ST_SW_KEY_EXCH_B:
256 l=s->s3->tmp.new_cipher->algorithms;
257
258 /* clear this, it may get reset by
259 * send_server_key_exchange */
260 if (s->options & SSL_OP_EPHEMERAL_RSA)
261 s->s3->tmp.use_rsa_tmp=1;
262 else
263 s->s3->tmp.use_rsa_tmp=0;
264
265 /* only send if a DH key exchange, fortezza or
266 * RSA but we have a sign only certificate */
267 if (s->s3->tmp.use_rsa_tmp
268 || (l & (SSL_DH|SSL_kFZA))
269 || ((l & SSL_kRSA)
270 && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
271 || (SSL_IS_EXPORT(l)
272 && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_EXPORT_PKEYLENGTH(l)
273 )
274 )
275 )
276 )
277 {
278 ret=ssl3_send_server_key_exchange(s);
279 if (ret <= 0) goto end;
280 }
281 else
282 skip=1;
283
284 s->state=SSL3_ST_SW_CERT_REQ_A;
285 s->init_num=0;
286 break;
287
288 case SSL3_ST_SW_CERT_REQ_A:
289 case SSL3_ST_SW_CERT_REQ_B:
290 if (!(s->verify_mode & SSL_VERIFY_PEER) ||
291 ((s->session->peer != NULL) &&
292 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)))
293 {
294 /* no cert request */
295 skip=1;
296 s->s3->tmp.cert_request=0;
297 s->state=SSL3_ST_SW_SRVR_DONE_A;
298 }
299 else
300 {
301 s->s3->tmp.cert_request=1;
302 ret=ssl3_send_certificate_request(s);
303 if (ret <= 0) goto end;
304 s->state=SSL3_ST_SW_SRVR_DONE_A;
305 s->init_num=0;
306 }
307 break;
308
309 case SSL3_ST_SW_SRVR_DONE_A:
310 case SSL3_ST_SW_SRVR_DONE_B:
311 ret=ssl3_send_server_done(s);
312 if (ret <= 0) goto end;
313 s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
314 s->state=SSL3_ST_SW_FLUSH;
315 s->init_num=0;
316 break;
317
318 case SSL3_ST_SW_FLUSH:
319 /* number of bytes to be flushed */
320 num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
321 if (num1 > 0)
322 {
323 s->rwstate=SSL_WRITING;
324 num1=BIO_flush(s->wbio);
325 if (num1 <= 0) { ret= -1; goto end; }
326 s->rwstate=SSL_NOTHING;
327 }
328
329 s->state=s->s3->tmp.next_state;
330 break;
331
332 case SSL3_ST_SR_CERT_A:
333 case SSL3_ST_SR_CERT_B:
334 /* could be sent for a DH cert, even if we
335 * have not asked for it :-) */
336 ret=ssl3_get_client_certificate(s);
337 if (ret <= 0) goto end;
338 s->init_num=0;
339 s->state=SSL3_ST_SR_KEY_EXCH_A;
340 break;
341
342 case SSL3_ST_SR_KEY_EXCH_A:
343 case SSL3_ST_SR_KEY_EXCH_B:
344 ret=ssl3_get_client_key_exchange(s);
345 if (ret <= 0) goto end;
346 s->state=SSL3_ST_SR_CERT_VRFY_A;
347 s->init_num=0;
348
349 /* We need to get hashes here so if there is
350 * a client cert, it can be verified */
351 s->method->ssl3_enc->cert_verify_mac(s,
352 &(s->s3->finish_dgst1),
353 &(s->s3->tmp.finish_md[0]));
354 s->method->ssl3_enc->cert_verify_mac(s,
355 &(s->s3->finish_dgst2),
356 &(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]));
357
358 break;
359
360 case SSL3_ST_SR_CERT_VRFY_A:
361 case SSL3_ST_SR_CERT_VRFY_B:
362
363 /* we should decide if we expected this one */
364 ret=ssl3_get_cert_verify(s);
365 if (ret <= 0) goto end;
366
367 s->state=SSL3_ST_SR_FINISHED_A;
368 s->init_num=0;
369 break;
370
371 case SSL3_ST_SR_FINISHED_A:
372 case SSL3_ST_SR_FINISHED_B:
373 ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
374 SSL3_ST_SR_FINISHED_B);
375 if (ret <= 0) goto end;
376 if (s->hit)
377 s->state=SSL_ST_OK;
378 else
379 s->state=SSL3_ST_SW_CHANGE_A;
380 s->init_num=0;
381 break;
382
383 case SSL3_ST_SW_CHANGE_A:
384 case SSL3_ST_SW_CHANGE_B:
385
386 s->session->cipher=s->s3->tmp.new_cipher;
387 if (!s->method->ssl3_enc->setup_key_block(s))
388 { ret= -1; goto end; }
389
390 ret=ssl3_send_change_cipher_spec(s,
391 SSL3_ST_SW_CHANGE_A,SSL3_ST_SW_CHANGE_B);
392
393 if (ret <= 0) goto end;
394 s->state=SSL3_ST_SW_FINISHED_A;
395 s->init_num=0;
396
397 if (!s->method->ssl3_enc->change_cipher_state(s,
398 SSL3_CHANGE_CIPHER_SERVER_WRITE))
399 {
400 ret= -1;
401 goto end;
402 }
403
404 break;
405
406 case SSL3_ST_SW_FINISHED_A:
407 case SSL3_ST_SW_FINISHED_B:
408 ret=ssl3_send_finished(s,
409 SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B,
410 s->method->ssl3_enc->server_finished,
411 s->method->ssl3_enc->server_finished_len);
412 if (ret <= 0) goto end;
413 s->state=SSL3_ST_SW_FLUSH;
414 if (s->hit)
415 s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
416 else
417 s->s3->tmp.next_state=SSL_ST_OK;
418 s->init_num=0;
419 break;
420
421 case SSL_ST_OK:
422 /* clean a few things up */
423 ssl3_cleanup_key_block(s);
424
425 BUF_MEM_free(s->init_buf);
426 s->init_buf=NULL;
427
428 /* remove buffering on output */
429 ssl_free_wbio_buffer(s);
430
431 s->new_session=0;
432 s->init_num=0;
433
434 ssl_update_cache(s,SSL_SESS_CACHE_SERVER);
435
436 s->ctx->stats.sess_accept_good++;
437 /* s->server=1; */
438 s->handshake_func=ssl3_accept;
439 ret=1;
440
441 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
442
443 goto end;
444 /* break; */
445
446 default:
447 SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_UNKNOWN_STATE);
448 ret= -1;
449 goto end;
450 /* break; */
451 }
452
453 if (!s->s3->tmp.reuse_message && !skip)
454 {
455 if (s->debug)
456 {
457 if ((ret=BIO_flush(s->wbio)) <= 0)
458 goto end;
459 }
460
461
462 if ((cb != NULL) && (s->state != state))
463 {
464 new_state=s->state;
465 s->state=state;
466 cb(s,SSL_CB_ACCEPT_LOOP,1);
467 s->state=new_state;
468 }
469 }
470 skip=0;
471 }
472end:
473 /* BIO_flush(s->wbio); */
474
475 if (cb != NULL)
476 cb(s,SSL_CB_ACCEPT_EXIT,ret);
477 s->in_handshake--;
478 return(ret);
479 }
480
481static int ssl3_send_hello_request(SSL *s)
482 {
483 unsigned char *p;
484
485 if (s->state == SSL3_ST_SW_HELLO_REQ_A)
486 {
487 p=(unsigned char *)s->init_buf->data;
488 *(p++)=SSL3_MT_CLIENT_REQUEST;
489 *(p++)=0;
490 *(p++)=0;
491 *(p++)=0;
492
493 s->state=SSL3_ST_SW_HELLO_REQ_B;
494 /* number of bytes to write */
495 s->init_num=4;
496 s->init_off=0;
497 }
498
499 /* SSL3_ST_SW_HELLO_REQ_B */
500 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
501 }
502
503static int ssl3_get_client_hello(SSL *s)
504 {
505 int i,j,ok,al,ret= -1;
506 long n;
507 unsigned long id;
508 unsigned char *p,*d,*q;
509 SSL_CIPHER *c;
510 SSL_COMP *comp=NULL;
511 STACK_OF(SSL_CIPHER) *ciphers=NULL;
512
513 /* We do this so that we will respond with our native type.
514 * If we are TLSv1 and we get SSLv3, we will respond with TLSv1,
515 * This down switching should be handled by a different method.
516 * If we are SSLv3, we will respond with SSLv3, even if prompted with
517 * TLSv1.
518 */
519 if (s->state == SSL3_ST_SR_CLNT_HELLO_A)
520 {
521 s->first_packet=1;
522 s->state=SSL3_ST_SR_CLNT_HELLO_B;
523 }
524 n=ssl3_get_message(s,
525 SSL3_ST_SR_CLNT_HELLO_B,
526 SSL3_ST_SR_CLNT_HELLO_C,
527 SSL3_MT_CLIENT_HELLO,
528 SSL3_RT_MAX_PLAIN_LENGTH,
529 &ok);
530
531 if (!ok) return((int)n);
532 d=p=(unsigned char *)s->init_buf->data;
533
534 /* The version number has already been checked in ssl3_get_message.
535 * I a native TLSv1/SSLv3 method, the match must be correct except
536 * perhaps for the first message */
537/* s->client_version=(((int)p[0])<<8)|(int)p[1]; */
538 p+=2;
539
540 /* load the client random */
541 memcpy(s->s3->client_random,p,SSL3_RANDOM_SIZE);
542 p+=SSL3_RANDOM_SIZE;
543
544 /* get the session-id */
545 j= *(p++);
546
547 s->hit=0;
548 if (j == 0)
549 {
550 if (!ssl_get_new_session(s,1))
551 goto err;
552 }
553 else
554 {
555 i=ssl_get_prev_session(s,p,j);
556 if (i == 1)
557 { /* previous session */
558 s->hit=1;
559 }
560 else if (i == -1)
561 goto err;
562 else /* i == 0 */
563 {
564 if (!ssl_get_new_session(s,1))
565 goto err;
566 }
567 }
568
569 p+=j;
570 n2s(p,i);
571 if ((i == 0) && (j != 0))
572 {
573 /* we need a cipher if we are not resuming a session */
574 al=SSL_AD_ILLEGAL_PARAMETER;
575 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_SPECIFIED);
576 goto f_err;
577 }
578 if ((i+p) > (d+n))
579 {
580 /* not enough data */
581 al=SSL_AD_DECODE_ERROR;
582 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH);
583 goto f_err;
584 }
585 if ((i > 0) && (ssl_bytes_to_cipher_list(s,p,i,&(ciphers))
586 == NULL))
587 {
588 goto err;
589 }
590 p+=i;
591
592 /* If it is a hit, check that the cipher is in the list */
593 if ((s->hit) && (i > 0))
594 {
595 j=0;
596 id=s->session->cipher->id;
597
598#ifdef CIPHER_DEBUG
599 printf("client sent %d ciphers\n",sk_num(ciphers));
600#endif
601 for (i=0; i<sk_SSL_CIPHER_num(ciphers); i++)
602 {
603 c=sk_SSL_CIPHER_value(ciphers,i);
604#ifdef CIPHER_DEBUG
605 printf("client [%2d of %2d]:%s\n",
606 i,sk_num(ciphers),SSL_CIPHER_get_name(c));
607#endif
608 if (c->id == id)
609 {
610 j=1;
611 break;
612 }
613 }
614 if (j == 0)
615 {
616 if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
617 {
618 /* Very bad for multi-threading.... */
619 s->session->cipher=sk_SSL_CIPHER_value(ciphers,
620 0);
621 }
622 else
623 {
624 /* we need to have the cipher in the cipher
625 * list if we are asked to reuse it */
626 al=SSL_AD_ILLEGAL_PARAMETER;
627 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
628 goto f_err;
629 }
630 }
631 }
632
633 /* compression */
634 i= *(p++);
635 q=p;
636 for (j=0; j<i; j++)
637 {
638 if (p[j] == 0) break;
639 }
640
641 p+=i;
642 if (j >= i)
643 {
644 /* no compress */
645 al=SSL_AD_DECODE_ERROR;
646 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_COMPRESSION_SPECIFIED);
647 goto f_err;
648 }
649
650 /* Worst case, we will use the NULL compression, but if we have other
651 * options, we will now look for them. We have i-1 compression
652 * algorithms from the client, starting at q. */
653 s->s3->tmp.new_compression=NULL;
654 if (s->ctx->comp_methods != NULL)
655 { /* See if we have a match */
656 int m,nn,o,v,done=0;
657
658 nn=sk_SSL_COMP_num(s->ctx->comp_methods);
659 for (m=0; m<nn; m++)
660 {
661 comp=sk_SSL_COMP_value(s->ctx->comp_methods,m);
662 v=comp->id;
663 for (o=0; o<i; o++)
664 {
665 if (v == q[o])
666 {
667 done=1;
668 break;
669 }
670 }
671 if (done) break;
672 }
673 if (done)
674 s->s3->tmp.new_compression=comp;
675 else
676 comp=NULL;
677 }
678
679 /* TLS does not mind if there is extra stuff */
680 if (s->version == SSL3_VERSION)
681 {
682 if (p > (d+n))
683 {
684 /* wrong number of bytes,
685 * there could be more to follow */
686 al=SSL_AD_DECODE_ERROR;
687 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH);
688 goto f_err;
689 }
690 }
691
692 /* Given s->session->ciphers and ssl_get_ciphers_by_id(s), we must
693 * pick a cipher */
694
695 if (!s->hit)
696 {
697 s->session->compress_meth=(comp == NULL)?0:comp->id;
698 if (s->session->ciphers != NULL)
699 sk_SSL_CIPHER_free(s->session->ciphers);
700 s->session->ciphers=ciphers;
701 if (ciphers == NULL)
702 {
703 al=SSL_AD_ILLEGAL_PARAMETER;
704 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_PASSED);
705 goto f_err;
706 }
707 ciphers=NULL;
708 c=ssl3_choose_cipher(s,s->session->ciphers,
709 ssl_get_ciphers_by_id(s));
710
711 if (c == NULL)
712 {
713 al=SSL_AD_HANDSHAKE_FAILURE;
714 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER);
715 goto f_err;
716 }
717 s->s3->tmp.new_cipher=c;
718 }
719 else
720 {
721 /* Session-id reuse */
722#ifdef REUSE_CIPHER_BUG
723 STACK_OF(SSL_CIPHER) *sk;
724 SSL_CIPHER *nc=NULL;
725 SSL_CIPHER *ec=NULL;
726
727 if (s->options & SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG)
728 {
729 sk=s->session->ciphers;
730 for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
731 {
732 c=sk_SSL_CIPHER_value(sk,i);
733 if (c->algorithms & SSL_eNULL)
734 nc=c;
735 if (SSL_C_IS_EXPORT(c))
736 ec=c;
737 }
738 if (nc != NULL)
739 s->s3->tmp.new_cipher=nc;
740 else if (ec != NULL)
741 s->s3->tmp.new_cipher=ec;
742 else
743 s->s3->tmp.new_cipher=s->session->cipher;
744 }
745 else
746#endif
747 s->s3->tmp.new_cipher=s->session->cipher;
748 }
749
750 /* we now have the following setup.
751 * client_random
752 * cipher_list - our prefered list of ciphers
753 * ciphers - the clients prefered list of ciphers
754 * compression - basically ignored right now
755 * ssl version is set - sslv3
756 * s->session - The ssl session has been setup.
757 * s->hit - sesson reuse flag
758 * s->tmp.new_cipher - the new cipher to use.
759 */
760
761 ret=1;
762 if (0)
763 {
764f_err:
765 ssl3_send_alert(s,SSL3_AL_FATAL,al);
766 }
767err:
768 if (ciphers != NULL) sk_SSL_CIPHER_free(ciphers);
769 return(ret);
770 }
771
772static int ssl3_send_server_hello(SSL *s)
773 {
774 unsigned char *buf;
775 unsigned char *p,*d;
776 int i,sl;
777 unsigned long l,Time;
778
779 if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
780 {
781 buf=(unsigned char *)s->init_buf->data;
782 p=s->s3->server_random;
783 Time=time(NULL); /* Time */
784 l2n(Time,p);
785 RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
786 /* Do the message type and length last */
787 d=p= &(buf[4]);
788
789 *(p++)=s->version>>8;
790 *(p++)=s->version&0xff;
791
792 /* Random stuff */
793 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
794 p+=SSL3_RANDOM_SIZE;
795
796 /* now in theory we have 3 options to sending back the
797 * session id. If it is a re-use, we send back the
798 * old session-id, if it is a new session, we send
799 * back the new session-id or we send back a 0 length
800 * session-id if we want it to be single use.
801 * Currently I will not implement the '0' length session-id
802 * 12-Jan-98 - I'll now support the '0' length stuff.
803 */
804 if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
805 s->session->session_id_length=0;
806
807 sl=s->session->session_id_length;
808 *(p++)=sl;
809 memcpy(p,s->session->session_id,sl);
810 p+=sl;
811
812 /* put the cipher */
813 i=ssl3_put_cipher_by_char(s->s3->tmp.new_cipher,p);
814 p+=i;
815
816 /* put the compression method */
817 if (s->s3->tmp.new_compression == NULL)
818 *(p++)=0;
819 else
820 *(p++)=s->s3->tmp.new_compression->id;
821
822 /* do the header */
823 l=(p-d);
824 d=buf;
825 *(d++)=SSL3_MT_SERVER_HELLO;
826 l2n3(l,d);
827
828 s->state=SSL3_ST_CW_CLNT_HELLO_B;
829 /* number of bytes to write */
830 s->init_num=p-buf;
831 s->init_off=0;
832 }
833
834 /* SSL3_ST_CW_CLNT_HELLO_B */
835 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
836 }
837
838static int ssl3_send_server_done(SSL *s)
839 {
840 unsigned char *p;
841
842 if (s->state == SSL3_ST_SW_SRVR_DONE_A)
843 {
844 p=(unsigned char *)s->init_buf->data;
845
846 /* do the header */
847 *(p++)=SSL3_MT_SERVER_DONE;
848 *(p++)=0;
849 *(p++)=0;
850 *(p++)=0;
851
852 s->state=SSL3_ST_SW_SRVR_DONE_B;
853 /* number of bytes to write */
854 s->init_num=4;
855 s->init_off=0;
856 }
857
858 /* SSL3_ST_CW_CLNT_HELLO_B */
859 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
860 }
861
862static int ssl3_send_server_key_exchange(SSL *s)
863 {
864#ifndef NO_RSA
865 unsigned char *q;
866 int j,num;
867 RSA *rsa;
868 unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
869#endif
870#ifndef NO_DH
871 DH *dh,*dhp;
872#endif
873 EVP_PKEY *pkey;
874 unsigned char *p,*d;
875 int al,i;
876 unsigned long type;
877 int n;
878 CERT *cert;
879 BIGNUM *r[4];
880 int nr[4],kn;
881 BUF_MEM *buf;
882 EVP_MD_CTX md_ctx;
883
884 if (s->state == SSL3_ST_SW_KEY_EXCH_A)
885 {
886 type=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK;
887 cert=s->cert;
888
889 buf=s->init_buf;
890
891 r[0]=r[1]=r[2]=r[3]=NULL;
892 n=0;
893#ifndef NO_RSA
894 if (type & SSL_kRSA)
895 {
896 rsa=cert->rsa_tmp;
897 if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL))
898 {
899 rsa=s->cert->rsa_tmp_cb(s,
900 SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
901 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
902 CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
903 cert->rsa_tmp=rsa;
904 }
905 if (rsa == NULL)
906 {
907 al=SSL_AD_HANDSHAKE_FAILURE;
908 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY);
909 goto f_err;
910 }
911 r[0]=rsa->n;
912 r[1]=rsa->e;
913 s->s3->tmp.use_rsa_tmp=1;
914 }
915 else
916#endif
917#ifndef NO_DH
918 if (type & SSL_kEDH)
919 {
920 dhp=cert->dh_tmp;
921 if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
922 dhp=s->cert->dh_tmp_cb(s,
923 !SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
924 SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
925 if (dhp == NULL)
926 {
927 al=SSL_AD_HANDSHAKE_FAILURE;
928 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
929 goto f_err;
930 }
931 if ((dh=DHparams_dup(dhp)) == NULL)
932 {
933 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
934 goto err;
935 }
936
937 s->s3->tmp.dh=dh;
938 if ((dhp->pub_key == NULL ||
939 dhp->priv_key == NULL ||
940 (s->options & SSL_OP_SINGLE_DH_USE)))
941 {
942 if(!DH_generate_key(dh))
943 {
944 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
945 ERR_R_DH_LIB);
946 goto err;
947 }
948 }
949 else
950 {
951 dh->pub_key=BN_dup(dhp->pub_key);
952 dh->priv_key=BN_dup(dhp->priv_key);
953 if ((dh->pub_key == NULL) ||
954 (dh->priv_key == NULL))
955 {
956 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
957 goto err;
958 }
959 }
960 r[0]=dh->p;
961 r[1]=dh->g;
962 r[2]=dh->pub_key;
963 }
964 else
965#endif
966 {
967 al=SSL_AD_HANDSHAKE_FAILURE;
968 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
969 goto f_err;
970 }
971 for (i=0; r[i] != NULL; i++)
972 {
973 nr[i]=BN_num_bytes(r[i]);
974 n+=2+nr[i];
975 }
976
977 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
978 {
979 if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))
980 == NULL)
981 {
982 al=SSL_AD_DECODE_ERROR;
983 goto f_err;
984 }
985 kn=EVP_PKEY_size(pkey);
986 }
987 else
988 {
989 pkey=NULL;
990 kn=0;
991 }
992
993 if (!BUF_MEM_grow(buf,n+4+kn))
994 {
995 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF);
996 goto err;
997 }
998 d=(unsigned char *)s->init_buf->data;
999 p= &(d[4]);
1000
1001 for (i=0; r[i] != NULL; i++)
1002 {
1003 s2n(nr[i],p);
1004 BN_bn2bin(r[i],p);
1005 p+=nr[i];
1006 }
1007
1008 /* not anonymous */
1009 if (pkey != NULL)
1010 {
1011 /* n is the length of the params, they start at &(d[4])
1012 * and p points to the space at the end. */
1013#ifndef NO_RSA
1014 if (pkey->type == EVP_PKEY_RSA)
1015 {
1016 q=md_buf;
1017 j=0;
1018 for (num=2; num > 0; num--)
1019 {
1020 EVP_DigestInit(&md_ctx,(num == 2)
1021 ?s->ctx->md5:s->ctx->sha1);
1022 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1023 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1024 EVP_DigestUpdate(&md_ctx,&(d[4]),n);
1025 EVP_DigestFinal(&md_ctx,q,
1026 (unsigned int *)&i);
1027 q+=i;
1028 j+=i;
1029 }
1030 i=RSA_private_encrypt(j,md_buf,&(p[2]),
1031 pkey->pkey.rsa,RSA_PKCS1_PADDING);
1032 if (i <= 0)
1033 {
1034 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
1035 goto err;
1036 }
1037 s2n(i,p);
1038 n+=i+2;
1039 }
1040 else
1041#endif
1042#if !defined(NO_DSA)
1043 if (pkey->type == EVP_PKEY_DSA)
1044 {
1045 /* lets do DSS */
1046 EVP_SignInit(&md_ctx,EVP_dss1());
1047 EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1048 EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1049 EVP_SignUpdate(&md_ctx,&(d[4]),n);
1050 if (!EVP_SignFinal(&md_ctx,&(p[2]),
1051 (unsigned int *)&i,pkey))
1052 {
1053 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA);
1054 goto err;
1055 }
1056 s2n(i,p);
1057 n+=i+2;
1058 }
1059 else
1060#endif
1061 {
1062 /* Is this error check actually needed? */
1063 al=SSL_AD_HANDSHAKE_FAILURE;
1064 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE);
1065 goto f_err;
1066 }
1067 }
1068
1069 *(d++)=SSL3_MT_SERVER_KEY_EXCHANGE;
1070 l2n3(n,d);
1071
1072 /* we should now have things packed up, so lets send
1073 * it off */
1074 s->init_num=n+4;
1075 s->init_off=0;
1076 }
1077
1078 /* SSL3_ST_SW_KEY_EXCH_B */
1079 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1080f_err:
1081 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1082err:
1083 return(-1);
1084 }
1085
1086static int ssl3_send_certificate_request(SSL *s)
1087 {
1088 unsigned char *p,*d;
1089 int i,j,nl,off,n;
1090 STACK_OF(X509_NAME) *sk=NULL;
1091 X509_NAME *name;
1092 BUF_MEM *buf;
1093
1094 if (s->state == SSL3_ST_SW_CERT_REQ_A)
1095 {
1096 buf=s->init_buf;
1097
1098 d=p=(unsigned char *)&(buf->data[4]);
1099
1100 /* get the list of acceptable cert types */
1101 p++;
1102 n=ssl3_get_req_cert_type(s,p);
1103 d[0]=n;
1104 p+=n;
1105 n++;
1106
1107 off=n;
1108 p+=2;
1109 n+=2;
1110
1111 sk=SSL_get_client_CA_list(s);
1112 nl=0;
1113 if (sk != NULL)
1114 {
1115 for (i=0; i<sk_X509_NAME_num(sk); i++)
1116 {
1117 name=sk_X509_NAME_value(sk,i);
1118 j=i2d_X509_NAME(name,NULL);
1119 if (!BUF_MEM_grow(buf,4+n+j+2))
1120 {
1121 SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
1122 goto err;
1123 }
1124 p=(unsigned char *)&(buf->data[4+n]);
1125 if (!(s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1126 {
1127 s2n(j,p);
1128 i2d_X509_NAME(name,&p);
1129 n+=2+j;
1130 nl+=2+j;
1131 }
1132 else
1133 {
1134 d=p;
1135 i2d_X509_NAME(name,&p);
1136 j-=2; s2n(j,d); j+=2;
1137 n+=j;
1138 nl+=j;
1139 }
1140 }
1141 }
1142 /* else no CA names */
1143 p=(unsigned char *)&(buf->data[4+off]);
1144 s2n(nl,p);
1145
1146 d=(unsigned char *)buf->data;
1147 *(d++)=SSL3_MT_CERTIFICATE_REQUEST;
1148 l2n3(n,d);
1149
1150 /* we should now have things packed up, so lets send
1151 * it off */
1152
1153 s->init_num=n+4;
1154 s->init_off=0;
1155 }
1156
1157 /* SSL3_ST_SW_CERT_REQ_B */
1158 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1159err:
1160 return(-1);
1161 }
1162
1163static int ssl3_get_client_key_exchange(SSL *s)
1164 {
1165 int i,al,ok;
1166 long n;
1167 unsigned long l;
1168 unsigned char *p;
1169#ifndef NO_RSA
1170 RSA *rsa=NULL;
1171 EVP_PKEY *pkey=NULL;
1172#endif
1173#ifndef NO_DH
1174 BIGNUM *pub=NULL;
1175 DH *dh_srvr;
1176#endif
1177
1178 n=ssl3_get_message(s,
1179 SSL3_ST_SR_KEY_EXCH_A,
1180 SSL3_ST_SR_KEY_EXCH_B,
1181 SSL3_MT_CLIENT_KEY_EXCHANGE,
1182 400, /* ???? */
1183 &ok);
1184
1185 if (!ok) return((int)n);
1186 p=(unsigned char *)s->init_buf->data;
1187
1188 l=s->s3->tmp.new_cipher->algorithms;
1189
1190#ifndef NO_RSA
1191 if (l & SSL_kRSA)
1192 {
1193 /* FIX THIS UP EAY EAY EAY EAY */
1194 if (s->s3->tmp.use_rsa_tmp)
1195 {
1196 if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL))
1197 rsa=s->cert->rsa_tmp;
1198 /* Don't do a callback because rsa_tmp should
1199 * be sent already */
1200 if (rsa == NULL)
1201 {
1202 al=SSL_AD_HANDSHAKE_FAILURE;
1203 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_PKEY);
1204 goto f_err;
1205
1206 }
1207 }
1208 else
1209 {
1210 pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1211 if ( (pkey == NULL) ||
1212 (pkey->type != EVP_PKEY_RSA) ||
1213 (pkey->pkey.rsa == NULL))
1214 {
1215 al=SSL_AD_HANDSHAKE_FAILURE;
1216 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_RSA_CERTIFICATE);
1217 goto f_err;
1218 }
1219 rsa=pkey->pkey.rsa;
1220 }
1221
1222 /* TLS */
1223 if (s->version > SSL3_VERSION)
1224 {
1225 n2s(p,i);
1226 if (n != i+2)
1227 {
1228 if (!(s->options & SSL_OP_TLS_D5_BUG))
1229 {
1230 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
1231 goto err;
1232 }
1233 else
1234 p-=2;
1235 }
1236 else
1237 n=i;
1238 }
1239
1240 i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
1241
1242#if 1
1243 /* If a bad decrypt, use a random master key */
1244 if ((i != SSL_MAX_MASTER_KEY_LENGTH) ||
1245 ((p[0] != (s->client_version>>8)) ||
1246 (p[1] != (s->client_version & 0xff))))
1247 {
1248 int bad=1;
1249
1250 if ((i == SSL_MAX_MASTER_KEY_LENGTH) &&
1251 (p[0] == (s->version>>8)) &&
1252 (p[1] == 0))
1253 {
1254 if (s->options & SSL_OP_TLS_ROLLBACK_BUG)
1255 bad=0;
1256 }
1257 if (bad)
1258 {
1259 p[0]=(s->version>>8);
1260 p[1]=(s->version & 0xff);
1261 RAND_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
1262 i=SSL_MAX_MASTER_KEY_LENGTH;
1263 }
1264 /* else, an SSLeay bug, ssl only server, tls client */
1265 }
1266#else
1267 if (i != SSL_MAX_MASTER_KEY_LENGTH)
1268 {
1269 al=SSL_AD_DECODE_ERROR;
1270 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
1271 goto f_err;
1272 }
1273
1274 if ((p[0] != (s->version>>8)) || (p[1] != (s->version & 0xff)))
1275 {
1276 al=SSL_AD_DECODE_ERROR;
1277 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
1278 goto f_err;
1279 }
1280#endif
1281
1282 s->session->master_key_length=
1283 s->method->ssl3_enc->generate_master_secret(s,
1284 s->session->master_key,
1285 p,i);
1286 memset(p,0,i);
1287 }
1288 else
1289#endif
1290#ifndef NO_DH
1291 if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1292 {
1293 n2s(p,i);
1294 if (n != i+2)
1295 {
1296 if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))
1297 {
1298 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
1299 goto err;
1300 }
1301 else
1302 {
1303 p-=2;
1304 i=(int)n;
1305 }
1306 }
1307
1308 if (n == 0L) /* the parameters are in the cert */
1309 {
1310 al=SSL_AD_HANDSHAKE_FAILURE;
1311 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_DECODE_DH_CERTS);
1312 goto f_err;
1313 }
1314 else
1315 {
1316 if (s->s3->tmp.dh == NULL)
1317 {
1318 al=SSL_AD_HANDSHAKE_FAILURE;
1319 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
1320 goto f_err;
1321 }
1322 else
1323 dh_srvr=s->s3->tmp.dh;
1324 }
1325
1326 pub=BN_bin2bn(p,i,NULL);
1327 if (pub == NULL)
1328 {
1329 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);
1330 goto err;
1331 }
1332
1333 i=DH_compute_key(p,pub,dh_srvr);
1334
1335 if (i <= 0)
1336 {
1337 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1338 goto err;
1339 }
1340
1341 DH_free(s->s3->tmp.dh);
1342 s->s3->tmp.dh=NULL;
1343
1344 BN_clear_free(pub);
1345 pub=NULL;
1346 s->session->master_key_length=
1347 s->method->ssl3_enc->generate_master_secret(s,
1348 s->session->master_key,p,i);
1349 }
1350 else
1351#endif
1352 {
1353 al=SSL_AD_HANDSHAKE_FAILURE;
1354 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNKNOWN_CIPHER_TYPE);
1355 goto f_err;
1356 }
1357
1358 return(1);
1359f_err:
1360 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1361#if !defined(NO_DH) || !defined(NO_RSA)
1362err:
1363#endif
1364 return(-1);
1365 }
1366
1367static int ssl3_get_cert_verify(SSL *s)
1368 {
1369 EVP_PKEY *pkey=NULL;
1370 unsigned char *p;
1371 int al,ok,ret=0;
1372 long n;
1373 int type=0,i,j;
1374 X509 *peer;
1375
1376 n=ssl3_get_message(s,
1377 SSL3_ST_SR_CERT_VRFY_A,
1378 SSL3_ST_SR_CERT_VRFY_B,
1379 -1,
1380 512, /* 512? */
1381 &ok);
1382
1383 if (!ok) return((int)n);
1384
1385 if (s->session->peer != NULL)
1386 {
1387 peer=s->session->peer;
1388 pkey=X509_get_pubkey(peer);
1389 type=X509_certificate_type(peer,pkey);
1390 }
1391 else
1392 {
1393 peer=NULL;
1394 pkey=NULL;
1395 }
1396
1397 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1398 {
1399 s->s3->tmp.reuse_message=1;
1400 if ((peer != NULL) && (type | EVP_PKT_SIGN))
1401 {
1402 al=SSL_AD_UNEXPECTED_MESSAGE;
1403 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
1404 goto f_err;
1405 }
1406 ret=1;
1407 goto end;
1408 }
1409
1410 if (peer == NULL)
1411 {
1412 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
1413 al=SSL_AD_UNEXPECTED_MESSAGE;
1414 goto f_err;
1415 }
1416
1417 if (!(type & EVP_PKT_SIGN))
1418 {
1419 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
1420 al=SSL_AD_ILLEGAL_PARAMETER;
1421 goto f_err;
1422 }
1423
1424 if (s->s3->change_cipher_spec)
1425 {
1426 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
1427 al=SSL_AD_UNEXPECTED_MESSAGE;
1428 goto f_err;
1429 }
1430
1431 /* we now have a signature that we need to verify */
1432 p=(unsigned char *)s->init_buf->data;
1433 n2s(p,i);
1434 n-=2;
1435 if (i > n)
1436 {
1437 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1438 al=SSL_AD_DECODE_ERROR;
1439 goto f_err;
1440 }
1441
1442 j=EVP_PKEY_size(pkey);
1443 if ((i > j) || (n > j) || (n <= 0))
1444 {
1445 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
1446 al=SSL_AD_DECODE_ERROR;
1447 goto f_err;
1448 }
1449
1450#ifndef NO_RSA
1451 if (pkey->type == EVP_PKEY_RSA)
1452 {
1453 i=RSA_public_decrypt(i,p,p,pkey->pkey.rsa,RSA_PKCS1_PADDING);
1454 if (i < 0)
1455 {
1456 al=SSL_AD_DECRYPT_ERROR;
1457 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
1458 goto f_err;
1459 }
1460 if ((i != (MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH)) ||
1461 memcmp(&(s->s3->tmp.finish_md[0]),p,
1462 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH))
1463 {
1464 al=SSL_AD_DECRYPT_ERROR;
1465 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
1466 goto f_err;
1467 }
1468 }
1469 else
1470#endif
1471#ifndef NO_DSA
1472 if (pkey->type == EVP_PKEY_DSA)
1473 {
1474 j=DSA_verify(pkey->save_type,
1475 &(s->s3->tmp.finish_md[MD5_DIGEST_LENGTH]),
1476 SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
1477 if (j <= 0)
1478 {
1479 /* bad signature */
1480 al=SSL_AD_DECRYPT_ERROR;
1481 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
1482 goto f_err;
1483 }
1484 }
1485 else
1486#endif
1487 {
1488 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);
1489 al=SSL_AD_UNSUPPORTED_CERTIFICATE;
1490 goto f_err;
1491 }
1492
1493
1494 ret=1;
1495 if (0)
1496 {
1497f_err:
1498 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1499 }
1500end:
1501 EVP_PKEY_free(pkey);
1502 return(ret);
1503 }
1504
1505static int ssl3_get_client_certificate(SSL *s)
1506 {
1507 int i,ok,al,ret= -1;
1508 X509 *x=NULL;
1509 unsigned long l,nc,llen,n;
1510 unsigned char *p,*d,*q;
1511 STACK_OF(X509) *sk=NULL;
1512
1513 n=ssl3_get_message(s,
1514 SSL3_ST_SR_CERT_A,
1515 SSL3_ST_SR_CERT_B,
1516 -1,
1517#if defined(MSDOS) && !defined(WIN32)
1518 1024*30, /* 30k max cert list :-) */
1519#else
1520 1024*100, /* 100k max cert list :-) */
1521#endif
1522 &ok);
1523
1524 if (!ok) return((int)n);
1525
1526 if (s->s3->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE)
1527 {
1528 if ( (s->verify_mode & SSL_VERIFY_PEER) &&
1529 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
1530 {
1531 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
1532 al=SSL_AD_HANDSHAKE_FAILURE;
1533 goto f_err;
1534 }
1535 /* If tls asked for a client cert we must return a 0 list */
1536 if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request)
1537 {
1538 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST);
1539 al=SSL_AD_UNEXPECTED_MESSAGE;
1540 goto f_err;
1541 }
1542 s->s3->tmp.reuse_message=1;
1543 return(1);
1544 }
1545
1546 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
1547 {
1548 al=SSL_AD_UNEXPECTED_MESSAGE;
1549 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_WRONG_MESSAGE_TYPE);
1550 goto f_err;
1551 }
1552 d=p=(unsigned char *)s->init_buf->data;
1553
1554 if ((sk=sk_X509_new_null()) == NULL)
1555 {
1556 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE);
1557 goto err;
1558 }
1559
1560 n2l3(p,llen);
1561 if (llen+3 != n)
1562 {
1563 al=SSL_AD_DECODE_ERROR;
1564 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
1565 goto f_err;
1566 }
1567 for (nc=0; nc<llen; )
1568 {
1569 n2l3(p,l);
1570 if ((l+nc+3) > llen)
1571 {
1572 al=SSL_AD_DECODE_ERROR;
1573 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
1574 goto f_err;
1575 }
1576
1577 q=p;
1578 x=d2i_X509(NULL,&p,l);
1579 if (x == NULL)
1580 {
1581 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_ASN1_LIB);
1582 goto err;
1583 }
1584 if (p != (q+l))
1585 {
1586 al=SSL_AD_DECODE_ERROR;
1587 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
1588 goto f_err;
1589 }
1590 if (!sk_X509_push(sk,x))
1591 {
1592 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE);
1593 goto err;
1594 }
1595 x=NULL;
1596 nc+=l+3;
1597 }
1598
1599 if (sk_X509_num(sk) <= 0)
1600 {
1601 /* TLS does not mind 0 certs returned */
1602 if (s->version == SSL3_VERSION)
1603 {
1604 al=SSL_AD_HANDSHAKE_FAILURE;
1605 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATES_RETURNED);
1606 goto f_err;
1607 }
1608 /* Fail for TLS only if we required a certificate */
1609 else if ((s->verify_mode & SSL_VERIFY_PEER) &&
1610 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
1611 {
1612 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
1613 al=SSL_AD_HANDSHAKE_FAILURE;
1614 goto f_err;
1615 }
1616 }
1617 else
1618 {
1619 i=ssl_verify_cert_chain(s,sk);
1620 if (!i)
1621 {
1622 al=ssl_verify_alarm_type(s->verify_result);
1623 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
1624 goto f_err;
1625 }
1626 }
1627
1628 if (s->session->peer != NULL) /* This should not be needed */
1629 X509_free(s->session->peer);
1630 s->session->peer=sk_X509_shift(sk);
1631
1632 /* With the current implementation, sess_cert will always be NULL
1633 * when we arrive here. */
1634 if (s->session->sess_cert == NULL)
1635 {
1636 s->session->sess_cert = ssl_sess_cert_new();
1637 if (s->session->sess_cert == NULL)
1638 {
1639 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
1640 goto err;
1641 }
1642 }
1643 if (s->session->sess_cert->cert_chain != NULL)
1644 sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
1645 s->session->sess_cert->cert_chain=sk;
1646
1647 sk=NULL;
1648
1649 ret=1;
1650 if (0)
1651 {
1652f_err:
1653 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1654 }
1655err:
1656 if (x != NULL) X509_free(x);
1657 if (sk != NULL) sk_X509_pop_free(sk,X509_free);
1658 return(ret);
1659 }
1660
1661int ssl3_send_server_certificate(SSL *s)
1662 {
1663 unsigned long l;
1664 X509 *x;
1665
1666 if (s->state == SSL3_ST_SW_CERT_A)
1667 {
1668 x=ssl_get_server_send_cert(s);
1669 if (x == NULL)
1670 {
1671 SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,SSL_R_INTERNAL_ERROR);
1672 return(0);
1673 }
1674
1675 l=ssl3_output_cert_chain(s,x);
1676 s->state=SSL3_ST_SW_CERT_B;
1677 s->init_num=(int)l;
1678 s->init_off=0;
1679 }
1680
1681 /* SSL3_ST_SW_CERT_B */
1682 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1683 }
diff --git a/src/lib/libssl/shlib_version b/src/lib/libssl/shlib_version
deleted file mode 100644
index b52599a164..0000000000
--- a/src/lib/libssl/shlib_version
+++ /dev/null
@@ -1,2 +0,0 @@
1major=2
2minor=0
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
deleted file mode 100644
index fbe4f667fa..0000000000
--- a/src/lib/libssl/ssl.h
+++ /dev/null
@@ -1,1484 +0,0 @@
1/* ssl/ssl.h */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_SSL_H
60#define HEADER_SSL_H
61
62#ifdef __cplusplus
63extern "C" {
64#endif
65
66#include <openssl/safestack.h>
67
68/* SSLeay version number for ASN.1 encoding of the session information */
69/* Version 0 - initial version
70 * Version 1 - added the optional peer certificate
71 */
72#define SSL_SESSION_ASN1_VERSION 0x0001
73
74/* text strings for the ciphers */
75#define SSL_TXT_NULL_WITH_MD5 SSL2_TXT_NULL_WITH_MD5
76#define SSL_TXT_RC4_128_WITH_MD5 SSL2_TXT_RC4_128_WITH_MD5
77#define SSL_TXT_RC4_128_EXPORT40_WITH_MD5 SSL2_TXT_RC4_128_EXPORT40_WITH_MD5
78#define SSL_TXT_RC2_128_CBC_WITH_MD5 SSL2_TXT_RC2_128_CBC_WITH_MD5
79#define SSL_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5
80#define SSL_TXT_IDEA_128_CBC_WITH_MD5 SSL2_TXT_IDEA_128_CBC_WITH_MD5
81#define SSL_TXT_DES_64_CBC_WITH_MD5 SSL2_TXT_DES_64_CBC_WITH_MD5
82#define SSL_TXT_DES_64_CBC_WITH_SHA SSL2_TXT_DES_64_CBC_WITH_SHA
83#define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5
84#define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA
85
86#define SSL_MAX_SSL_SESSION_ID_LENGTH 32
87#define SSL_MAX_SID_CTX_LENGTH 32
88
89#define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8)
90#define SSL_MAX_KEY_ARG_LENGTH 8
91#define SSL_MAX_MASTER_KEY_LENGTH 48
92
93/* These are used to specify which ciphers to use and not to use */
94#define SSL_TXT_LOW "LOW"
95#define SSL_TXT_MEDIUM "MEDIUM"
96#define SSL_TXT_HIGH "HIGH"
97#define SSL_TXT_kFZA "kFZA"
98#define SSL_TXT_aFZA "aFZA"
99#define SSL_TXT_eFZA "eFZA"
100#define SSL_TXT_FZA "FZA"
101
102#define SSL_TXT_aNULL "aNULL"
103#define SSL_TXT_eNULL "eNULL"
104#define SSL_TXT_NULL "NULL"
105
106#define SSL_TXT_kRSA "kRSA"
107#define SSL_TXT_kDHr "kDHr"
108#define SSL_TXT_kDHd "kDHd"
109#define SSL_TXT_kEDH "kEDH"
110#define SSL_TXT_aRSA "aRSA"
111#define SSL_TXT_aDSS "aDSS"
112#define SSL_TXT_aDH "aDH"
113#define SSL_TXT_DSS "DSS"
114#define SSL_TXT_DH "DH"
115#define SSL_TXT_EDH "EDH"
116#define SSL_TXT_ADH "ADH"
117#define SSL_TXT_RSA "RSA"
118#define SSL_TXT_DES "DES"
119#define SSL_TXT_3DES "3DES"
120#define SSL_TXT_RC4 "RC4"
121#define SSL_TXT_RC2 "RC2"
122#define SSL_TXT_IDEA "IDEA"
123#define SSL_TXT_MD5 "MD5"
124#define SSL_TXT_SHA1 "SHA1"
125#define SSL_TXT_SHA "SHA"
126#define SSL_TXT_EXP40 "EXP"
127#define SSL_TXT_EXPORT "EXPORT"
128#define SSL_TXT_EXP56 "EXPORT56"
129#define SSL_TXT_SSLV2 "SSLv2"
130#define SSL_TXT_SSLV3 "SSLv3"
131#define SSL_TXT_TLSV1 "TLSv1"
132#define SSL_TXT_ALL "ALL"
133
134/* 'DEFAULT' at the start of the cipher list insert the following string
135 * in addition to this being the default cipher string */
136#ifndef NO_RSA
137#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
138#else
139#define SSL_ALLOW_ADH
140#define SSL_DEFAULT_CIPHER_LIST "HIGH:MEDIUM:LOW:ADH+3DES:ADH+RC4:ADH+DES:+EXP"
141#endif
142
143/* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
144#define SSL_SENT_SHUTDOWN 1
145#define SSL_RECEIVED_SHUTDOWN 2
146
147#include <openssl/crypto.h>
148#include <openssl/lhash.h>
149#include <openssl/buffer.h>
150#include <openssl/bio.h>
151#include <openssl/pem.h>
152#include <openssl/x509.h>
153
154#define SSL_FILETYPE_ASN1 X509_FILETYPE_ASN1
155#define SSL_FILETYPE_PEM X509_FILETYPE_PEM
156
157/* This is needed to stop compilers complaining about the
158 * 'struct ssl_st *' function parameters used to prototype callbacks
159 * in SSL_CTX. */
160typedef struct ssl_st *ssl_crock_st;
161
162/* used to hold info on the particular ciphers used */
163typedef struct ssl_cipher_st
164 {
165 int valid;
166 const char *name; /* text name */
167 unsigned long id; /* id, 4 bytes, first is version */
168 unsigned long algorithms; /* what ciphers are used */
169 unsigned long algorithm2; /* Extra flags */
170 unsigned long mask; /* used for matching */
171 } SSL_CIPHER;
172
173DECLARE_STACK_OF(SSL_CIPHER)
174
175typedef struct ssl_st SSL;
176typedef struct ssl_ctx_st SSL_CTX;
177
178/* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
179typedef struct ssl_method_st
180 {
181 int version;
182 int (*ssl_new)(SSL *s);
183 void (*ssl_clear)(SSL *s);
184 void (*ssl_free)(SSL *s);
185 int (*ssl_accept)(SSL *s);
186 int (*ssl_connect)(SSL *s);
187 int (*ssl_read)(SSL *s,void *buf,int len);
188 int (*ssl_peek)(SSL *s,char *buf,int len);
189 int (*ssl_write)(SSL *s,const void *buf,int len);
190 int (*ssl_shutdown)(SSL *s);
191 int (*ssl_renegotiate)(SSL *s);
192 int (*ssl_renegotiate_check)(SSL *s);
193 long (*ssl_ctrl)(SSL *s,int cmd,long larg,char *parg);
194 long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,char *parg);
195 SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);
196 int (*put_cipher_by_char)(const SSL_CIPHER *cipher,unsigned char *ptr);
197 int (*ssl_pending)(SSL *s);
198 int (*num_ciphers)(void);
199 SSL_CIPHER *(*get_cipher)(unsigned ncipher);
200 struct ssl_method_st *(*get_ssl_method)(int version);
201 long (*get_timeout)(void);
202 struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
203 int (*ssl_version)();
204 } SSL_METHOD;
205
206/* Lets make this into an ASN.1 type structure as follows
207 * SSL_SESSION_ID ::= SEQUENCE {
208 * version INTEGER, -- structure version number
209 * SSLversion INTEGER, -- SSL version number
210 * Cipher OCTET_STRING, -- the 3 byte cipher ID
211 * Session_ID OCTET_STRING, -- the Session ID
212 * Master_key OCTET_STRING, -- the master key
213 * Key_Arg [ 0 ] IMPLICIT OCTET_STRING, -- the optional Key argument
214 * Time [ 1 ] EXPLICIT INTEGER, -- optional Start Time
215 * Timeout [ 2 ] EXPLICIT INTEGER, -- optional Timeout ins seconds
216 * Peer [ 3 ] EXPLICIT X509, -- optional Peer Certificate
217 * Session_ID_context [ 4 ] EXPLICIT OCTET_STRING, -- the Session ID context
218 * Compression [5] IMPLICIT ASN1_OBJECT -- compression OID XXXXX
219 * }
220 * Look in ssl/ssl_asn1.c for more details
221 * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-).
222 */
223typedef struct ssl_session_st
224 {
225 int ssl_version; /* what ssl version session info is
226 * being kept in here? */
227
228 /* only really used in SSLv2 */
229 unsigned int key_arg_length;
230 unsigned char key_arg[SSL_MAX_KEY_ARG_LENGTH];
231 int master_key_length;
232 unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
233 /* session_id - valid? */
234 unsigned int session_id_length;
235 unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
236 /* this is used to determine whether the session is being reused in
237 * the appropriate context. It is up to the application to set this,
238 * via SSL_new */
239 unsigned int sid_ctx_length;
240 unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
241
242 int not_resumable;
243
244 /* The cert is the certificate used to establish this connection */
245 struct sess_cert_st /* SESS_CERT */ *sess_cert;
246
247 /* This is the cert for the other end.
248 * On clients, it will be the same as sess_cert->peer_key->x509
249 * (the latter is not enough as sess_cert is not retained
250 * in the external representation of sessions, see ssl_asn1.c). */
251 X509 *peer;
252
253 int references;
254 long timeout;
255 long time;
256
257 int compress_meth; /* Need to lookup the method */
258
259 SSL_CIPHER *cipher;
260 unsigned long cipher_id; /* when ASN.1 loaded, this
261 * needs to be used to load
262 * the 'cipher' structure */
263
264 STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */
265
266 CRYPTO_EX_DATA ex_data; /* application specific data */
267
268 /* These are used to make removal of session-ids more
269 * efficient and to implement a maximum cache size. */
270 struct ssl_session_st *prev,*next;
271 } SSL_SESSION;
272
273#define SSL_OP_MICROSOFT_SESS_ID_BUG 0x00000001L
274#define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x00000002L
275#define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x00000008L
276#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x00000010L
277#define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L
278#define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x00000040L
279#define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x00000080L
280#define SSL_OP_TLS_D5_BUG 0x00000100L
281#define SSL_OP_TLS_BLOCK_PADDING_BUG 0x00000200L
282#define SSL_OP_TLS_ROLLBACK_BUG 0x00000400L
283
284/* If set, always create a new key when using tmp_dh parameters */
285#define SSL_OP_SINGLE_DH_USE 0x00100000L
286/* Set to also use the tmp_rsa key when doing RSA operations. */
287#define SSL_OP_EPHEMERAL_RSA 0x00200000L
288
289/* The next flag deliberately changes the ciphertest, this is a check
290 * for the PKCS#1 attack */
291#define SSL_OP_PKCS1_CHECK_1 0x08000000L
292#define SSL_OP_PKCS1_CHECK_2 0x10000000L
293#define SSL_OP_NETSCAPE_CA_DN_BUG 0x20000000L
294#define SSL_OP_NON_EXPORT_FIRST 0x40000000L
295#define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG 0x80000000L
296#define SSL_OP_ALL 0x000FFFFFL
297
298#define SSL_OP_NO_SSLv2 0x01000000L
299#define SSL_OP_NO_SSLv3 0x02000000L
300#define SSL_OP_NO_TLSv1 0x04000000L
301
302/* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success
303 * when just a single record has been written): */
304#define SSL_MODE_ENABLE_PARTIAL_WRITE 0x00000001L
305/* Make it possible to retry SSL_write() with changed buffer location
306 * (buffer contents must stay the same!); this is not the default to avoid
307 * the misconception that non-blocking SSL_write() behaves like
308 * non-blocking write(): */
309#define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L
310
311/* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
312 * they cannot be used to clear bits. */
313
314#define SSL_CTX_set_options(ctx,op) \
315 SSL_CTX_ctrl(ctx,SSL_CTRL_OPTIONS,op,NULL)
316#define SSL_CTX_get_options(ctx) \
317 SSL_CTX_ctrl(ctx,SSL_CTRL_OPTIONS,0,NULL)
318#define SSL_set_options(ssl,op) \
319 SSL_ctrl(ssl,SSL_CTRL_OPTIONS,op,NULL)
320#define SSL_get_options(ssl) \
321 SSL_ctrl(ssl,SSL_CTRL_OPTIONS,0,NULL)
322
323#define SSL_CTX_set_mode(ctx,op) \
324 SSL_CTX_ctrl(ctx,SSL_CTRL_MODE,op,NULL)
325#define SSL_CTX_get_mode(ctx) \
326 SSL_CTX_ctrl(ctx,SSL_CTRL_MODE,0,NULL)
327#define SSL_set_mode(ssl,op) \
328 SSL_ctrl(ssl,SSL_CTRL_MODE,op,NULL)
329#define SSL_get_mode(ssl) \
330 SSL_ctrl(ssl,SSL_CTRL_MODE,0,NULL)
331
332#define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT (1024*20)
333
334typedef struct ssl_comp_st
335{
336 int id;
337 char *name;
338#ifdef HEADER_COMP_H
339 COMP_METHOD *method;
340#else
341 char *method;
342#endif
343} SSL_COMP;
344
345DECLARE_STACK_OF(SSL_COMP)
346
347struct ssl_ctx_st
348 {
349 SSL_METHOD *method;
350 unsigned long options;
351 unsigned long mode;
352
353 STACK_OF(SSL_CIPHER) *cipher_list;
354 /* same as above but sorted for lookup */
355 STACK_OF(SSL_CIPHER) *cipher_list_by_id;
356
357 struct x509_store_st /* X509_STORE */ *cert_store;
358 struct lhash_st /* LHASH */ *sessions; /* a set of SSL_SESSION's */
359 /* Most session-ids that will be cached, default is
360 * SSL_SESSION_CACHE_SIZE_DEFAULT. 0 is unlimited. */
361 unsigned long session_cache_size;
362 struct ssl_session_st *session_cache_head;
363 struct ssl_session_st *session_cache_tail;
364
365 /* This can have one of 2 values, ored together,
366 * SSL_SESS_CACHE_CLIENT,
367 * SSL_SESS_CACHE_SERVER,
368 * Default is SSL_SESSION_CACHE_SERVER, which means only
369 * SSL_accept which cache SSL_SESSIONS. */
370 int session_cache_mode;
371
372 /* If timeout is not 0, it is the default timeout value set
373 * when SSL_new() is called. This has been put in to make
374 * life easier to set things up */
375 long session_timeout;
376
377 /* If this callback is not null, it will be called each
378 * time a session id is added to the cache. If this function
379 * returns 1, it means that the callback will do a
380 * SSL_SESSION_free() when it has finished using it. Otherwise,
381 * on 0, it means the callback has finished with it.
382 * If remove_session_cb is not null, it will be called when
383 * a session-id is removed from the cache. Again, a return
384 * of 0 mens that SSLeay should not SSL_SESSION_free() since
385 * the application is doing something with it. */
386 int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess);
387 void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess);
388 SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl,
389 unsigned char *data,int len,int *copy);
390 struct
391 {
392 int sess_connect; /* SSL new conn - started */
393 int sess_connect_renegotiate;/* SSL reneg - requested */
394 int sess_connect_good; /* SSL new conne/reneg - finished */
395 int sess_accept; /* SSL new accept - started */
396 int sess_accept_renegotiate;/* SSL reneg - requested */
397 int sess_accept_good; /* SSL accept/reneg - finished */
398 int sess_miss; /* session lookup misses */
399 int sess_timeout; /* reuse attempt on timeouted session */
400 int sess_cache_full; /* session removed due to full cache */
401 int sess_hit; /* session reuse actually done */
402 int sess_cb_hit; /* session-id that was not
403 * in the cache was
404 * passed back via the callback. This
405 * indicates that the application is
406 * supplying session-id's from other
407 * processes - spooky :-) */
408 } stats;
409
410 int references;
411
412/**/ void (*info_callback)();
413
414 /* if defined, these override the X509_verify_cert() calls */
415/**/ int (*app_verify_callback)();
416/**/ char *app_verify_arg; /* never used; should be void * */
417
418 /* default values to use in SSL structures */
419/**/ struct cert_st /* CERT */ *cert;
420/**/ int read_ahead;
421/**/ int verify_mode;
422/**/ int verify_depth;
423/**/ unsigned int sid_ctx_length;
424/**/ unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
425/**/ int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx);
426
427 /* Default password callback. */
428/**/ pem_password_cb *default_passwd_callback;
429
430 /* Default password callback user data. */
431/**/ void *default_passwd_callback_userdata;
432
433 /* get client cert callback */
434/**/ int (*client_cert_cb)(/* SSL *ssl, X509 **x509, EVP_PKEY **pkey */);
435
436 /* what we put in client requests */
437 STACK_OF(X509_NAME) *client_CA;
438
439/**/ int quiet_shutdown;
440
441 CRYPTO_EX_DATA ex_data;
442
443 const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */
444 const EVP_MD *md5; /* For SSLv3/TLSv1 'ssl3-md5' */
445 const EVP_MD *sha1; /* For SSLv3/TLSv1 'ssl3->sha1' */
446
447 STACK_OF(X509) *extra_certs;
448 STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */
449 };
450
451#define SSL_SESS_CACHE_OFF 0x0000
452#define SSL_SESS_CACHE_CLIENT 0x0001
453#define SSL_SESS_CACHE_SERVER 0x0002
454#define SSL_SESS_CACHE_BOTH (SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER)
455#define SSL_SESS_CACHE_NO_AUTO_CLEAR 0x0080
456/* This one, when set, makes the server session-id lookup not look
457 * in the cache. If there is an application get_session callback
458 * defined, this will still get called. */
459#define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP 0x0100
460
461#define SSL_CTX_sess_number(ctx) \
462 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL)
463#define SSL_CTX_sess_connect(ctx) \
464 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL)
465#define SSL_CTX_sess_connect_good(ctx) \
466 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL)
467#define SSL_CTX_sess_connect_renegotiate(ctx) \
468 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL)
469#define SSL_CTX_sess_accept(ctx) \
470 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL)
471#define SSL_CTX_sess_accept_renegotiate(ctx) \
472 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL)
473#define SSL_CTX_sess_accept_good(ctx) \
474 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL)
475#define SSL_CTX_sess_hits(ctx) \
476 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL)
477#define SSL_CTX_sess_cb_hits(ctx) \
478 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL)
479#define SSL_CTX_sess_misses(ctx) \
480 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL)
481#define SSL_CTX_sess_timeouts(ctx) \
482 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL)
483#define SSL_CTX_sess_cache_full(ctx) \
484 SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL)
485
486#define SSL_CTX_sess_set_new_cb(ctx,cb) ((ctx)->new_session_cb=(cb))
487#define SSL_CTX_sess_get_new_cb(ctx) ((ctx)->new_session_cb)
488#define SSL_CTX_sess_set_remove_cb(ctx,cb) ((ctx)->remove_session_cb=(cb))
489#define SSL_CTX_sess_get_remove_cb(ctx) ((ctx)->remove_session_cb)
490#define SSL_CTX_sess_set_get_cb(ctx,cb) ((ctx)->get_session_cb=(cb))
491#define SSL_CTX_sess_get_get_cb(ctx) ((ctx)->get_session_cb)
492#define SSL_CTX_set_info_callback(ctx,cb) ((ctx)->info_callback=(cb))
493#define SSL_CTX_get_info_callback(ctx) ((ctx)->info_callback)
494#define SSL_CTX_set_client_cert_cb(ctx,cb) ((ctx)->client_cert_cb=(cb))
495#define SSL_CTX_get_client_cert_cb(ctx) ((ctx)->client_cert_cb)
496
497#define SSL_NOTHING 1
498#define SSL_WRITING 2
499#define SSL_READING 3
500#define SSL_X509_LOOKUP 4
501
502/* These will only be used when doing non-blocking IO */
503#define SSL_want_nothing(s) (SSL_want(s) == SSL_NOTHING)
504#define SSL_want_read(s) (SSL_want(s) == SSL_READING)
505#define SSL_want_write(s) (SSL_want(s) == SSL_WRITING)
506#define SSL_want_x509_lookup(s) (SSL_want(s) == SSL_X509_LOOKUP)
507
508struct ssl_st
509 {
510 /* protocol version
511 * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION)
512 */
513 int version;
514 int type; /* SSL_ST_CONNECT or SSL_ST_ACCEPT */
515
516 SSL_METHOD *method; /* SSLv3 */
517
518 /* There are 2 BIO's even though they are normally both the
519 * same. This is so data can be read and written to different
520 * handlers */
521
522#ifdef HEADER_BIO_H
523 BIO *rbio; /* used by SSL_read */
524 BIO *wbio; /* used by SSL_write */
525 BIO *bbio; /* used during session-id reuse to concatinate
526 * messages */
527#else
528 char *rbio; /* used by SSL_read */
529 char *wbio; /* used by SSL_write */
530 char *bbio;
531#endif
532 /* This holds a variable that indicates what we were doing
533 * when a 0 or -1 is returned. This is needed for
534 * non-blocking IO so we know what request needs re-doing when
535 * in SSL_accept or SSL_connect */
536 int rwstate;
537
538 /* true when we are actually in SSL_accept() or SSL_connect() */
539 int in_handshake;
540 int (*handshake_func)();
541
542 /* Imagine that here's a boolean member "init" that is
543 * switched as soon as SSL_set_{accept/connect}_state
544 * is called for the first time, so that "state" and
545 * "handshake_func" are properly initialized. But as
546 * handshake_func is == 0 until then, we use this
547 * test instead of an "init" member.
548 */
549
550 int server; /* are we the server side? - mostly used by SSL_clear*/
551
552 int new_session;/* 1 if we are to use a new session */
553 int quiet_shutdown;/* don't send shutdown packets */
554 int shutdown; /* we have shut things down, 0x01 sent, 0x02
555 * for received */
556 int state; /* where we are */
557 int rstate; /* where we are when reading */
558
559 BUF_MEM *init_buf; /* buffer used during init */
560 int init_num; /* amount read/written */
561 int init_off; /* amount read/written */
562
563 /* used internally to point at a raw packet */
564 unsigned char *packet;
565 unsigned int packet_length;
566
567 struct ssl2_ctx_st *s2; /* SSLv2 variables */
568 struct ssl3_ctx_st *s3; /* SSLv3 variables */
569
570 int read_ahead; /* Read as many input bytes as possible */
571 int hit; /* reusing a previous session */
572
573 /* crypto */
574 STACK_OF(SSL_CIPHER) *cipher_list;
575 STACK_OF(SSL_CIPHER) *cipher_list_by_id;
576
577 /* These are the ones being used, the ones is SSL_SESSION are
578 * the ones to be 'copied' into these ones */
579
580 EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */
581 const EVP_MD *read_hash; /* used for mac generation */
582#ifdef HEADER_COMP_H
583 COMP_CTX *expand; /* uncompress */
584#else
585 char *expand;
586#endif
587
588 EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
589 const EVP_MD *write_hash; /* used for mac generation */
590#ifdef HEADER_COMP_H
591 COMP_CTX *compress; /* compression */
592#else
593 char *compress;
594#endif
595
596 /* session info */
597
598 /* client cert? */
599 /* This is used to hold the server certificate used */
600 struct cert_st /* CERT */ *cert;
601
602 /* the session_id_context is used to ensure sessions are only reused
603 * in the appropriate context */
604 unsigned int sid_ctx_length;
605 unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
606
607 /* This can also be in the session once a session is established */
608 SSL_SESSION *session;
609
610 /* Used in SSL2 and SSL3 */
611 int verify_mode; /* 0 don't care about verify failure.
612 * 1 fail if verify fails */
613 int verify_depth;
614 int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */
615 void (*info_callback)(); /* optional informational callback */
616
617 int error; /* error bytes to be written */
618 int error_code; /* actual code */
619
620 SSL_CTX *ctx;
621 /* set this flag to 1 and a sleep(1) is put into all SSL_read()
622 * and SSL_write() calls, good for nbio debuging :-) */
623 int debug;
624
625 /* extra application data */
626 long verify_result;
627 CRYPTO_EX_DATA ex_data;
628
629 /* for server side, keep the list of CA_dn we can use */
630 STACK_OF(X509_NAME) *client_CA;
631
632 int references;
633 unsigned long options; /* protocol behaviour */
634 unsigned long mode; /* API behaviour */
635 int first_packet;
636 int client_version; /* what was passed, used for
637 * SSLv3/TLS rolback check */
638 };
639
640#include <openssl/ssl2.h>
641#include <openssl/ssl3.h>
642#include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */
643#include <openssl/ssl23.h>
644
645/* compatablity */
646#define SSL_set_app_data(s,arg) (SSL_set_ex_data(s,0,(char *)arg))
647#define SSL_get_app_data(s) (SSL_get_ex_data(s,0))
648#define SSL_SESSION_set_app_data(s,a) (SSL_SESSION_set_ex_data(s,0,(char *)a))
649#define SSL_SESSION_get_app_data(s) (SSL_SESSION_get_ex_data(s,0))
650#define SSL_CTX_get_app_data(ctx) (SSL_CTX_get_ex_data(ctx,0))
651#define SSL_CTX_set_app_data(ctx,arg) (SSL_CTX_set_ex_data(ctx,0,(char *)arg))
652
653/* The following are the possible values for ssl->state are are
654 * used to indicate where we are upto in the SSL connection establishment.
655 * The macros that follow are about the only things you should need to use
656 * and even then, only when using non-blocking IO.
657 * It can also be useful to work out where you were when the connection
658 * failed */
659
660#define SSL_ST_CONNECT 0x1000
661#define SSL_ST_ACCEPT 0x2000
662#define SSL_ST_MASK 0x0FFF
663#define SSL_ST_INIT (SSL_ST_CONNECT|SSL_ST_ACCEPT)
664#define SSL_ST_BEFORE 0x4000
665#define SSL_ST_OK 0x03
666#define SSL_ST_RENEGOTIATE (0x04|SSL_ST_INIT)
667
668#define SSL_CB_LOOP 0x01
669#define SSL_CB_EXIT 0x02
670#define SSL_CB_READ 0x04
671#define SSL_CB_WRITE 0x08
672#define SSL_CB_ALERT 0x4000 /* used in callback */
673#define SSL_CB_READ_ALERT (SSL_CB_ALERT|SSL_CB_READ)
674#define SSL_CB_WRITE_ALERT (SSL_CB_ALERT|SSL_CB_WRITE)
675#define SSL_CB_ACCEPT_LOOP (SSL_ST_ACCEPT|SSL_CB_LOOP)
676#define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT|SSL_CB_EXIT)
677#define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT|SSL_CB_LOOP)
678#define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT|SSL_CB_EXIT)
679#define SSL_CB_HANDSHAKE_START 0x10
680#define SSL_CB_HANDSHAKE_DONE 0x20
681
682/* Is the SSL_connection established? */
683#define SSL_get_state(a) SSL_state(a)
684#define SSL_is_init_finished(a) (SSL_state(a) == SSL_ST_OK)
685#define SSL_in_init(a) (SSL_state(a)&SSL_ST_INIT)
686#define SSL_in_before(a) (SSL_state(a)&SSL_ST_BEFORE)
687#define SSL_in_connect_init(a) (SSL_state(a)&SSL_ST_CONNECT)
688#define SSL_in_accept_init(a) (SSL_state(a)&SSL_ST_ACCEPT)
689
690/* The following 2 states are kept in ssl->rstate when reads fail,
691 * you should not need these */
692#define SSL_ST_READ_HEADER 0xF0
693#define SSL_ST_READ_BODY 0xF1
694#define SSL_ST_READ_DONE 0xF2
695
696/* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options
697 * are 'ored' with SSL_VERIFY_PEER if they are desired */
698#define SSL_VERIFY_NONE 0x00
699#define SSL_VERIFY_PEER 0x01
700#define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02
701#define SSL_VERIFY_CLIENT_ONCE 0x04
702
703#define SSLeay_add_ssl_algorithms() SSL_library_init()
704
705/* this is for backward compatablility */
706#if 0 /* NEW_SSLEAY */
707#define SSL_CTX_set_default_verify(a,b,c) SSL_CTX_set_verify(a,b,c)
708#define SSL_set_pref_cipher(c,n) SSL_set_cipher_list(c,n)
709#define SSL_add_session(a,b) SSL_CTX_add_session((a),(b))
710#define SSL_remove_session(a,b) SSL_CTX_remove_session((a),(b))
711#define SSL_flush_sessions(a,b) SSL_CTX_flush_sessions((a),(b))
712#endif
713/* More backward compatablity */
714#define SSL_get_cipher(s) \
715 SSL_CIPHER_get_name(SSL_get_current_cipher(s))
716#define SSL_get_cipher_bits(s,np) \
717 SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np)
718#define SSL_get_cipher_version(s) \
719 SSL_CIPHER_get_version(SSL_get_current_cipher(s))
720#define SSL_get_cipher_name(s) \
721 SSL_CIPHER_get_name(SSL_get_current_cipher(s))
722#define SSL_get_time(a) SSL_SESSION_get_time(a)
723#define SSL_set_time(a,b) SSL_SESSION_set_time((a),(b))
724#define SSL_get_timeout(a) SSL_SESSION_get_timeout(a)
725#define SSL_set_timeout(a,b) SSL_SESSION_set_timeout((a),(b))
726
727#if 1 /*SSLEAY_MACROS*/
728#define d2i_SSL_SESSION_bio(bp,s_id) (SSL_SESSION *)ASN1_d2i_bio( \
729 (char *(*)())SSL_SESSION_new,(char *(*)())d2i_SSL_SESSION, \
730 (bp),(unsigned char **)(s_id))
731#define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio(i2d_SSL_SESSION, \
732 bp,(unsigned char *)s_id)
733#define PEM_read_SSL_SESSION(fp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read( \
734 (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,fp,(char **)x,cb,u)
735#define PEM_read_bio_SSL_SESSION(bp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read_bio( \
736 (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,(char **)x,cb,u)
737#define PEM_write_SSL_SESSION(fp,x) \
738 PEM_ASN1_write((int (*)())i2d_SSL_SESSION, \
739 PEM_STRING_SSL_SESSION,fp, (char *)x, NULL,NULL,0,NULL,NULL)
740#define PEM_write_bio_SSL_SESSION(bp,x) \
741 PEM_ASN1_write_bio((int (*)())i2d_SSL_SESSION, \
742 PEM_STRING_SSL_SESSION,bp, (char *)x, NULL,NULL,0,NULL,NULL)
743#endif
744
745#define SSL_AD_REASON_OFFSET 1000
746/* These alert types are for SSLv3 and TLSv1 */
747#define SSL_AD_CLOSE_NOTIFY SSL3_AD_CLOSE_NOTIFY
748#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE /* fatal */
749#define SSL_AD_BAD_RECORD_MAC SSL3_AD_BAD_RECORD_MAC /* fatal */
750#define SSL_AD_DECRYPTION_FAILED TLS1_AD_DECRYPTION_FAILED
751#define SSL_AD_RECORD_OVERFLOW TLS1_AD_RECORD_OVERFLOW
752#define SSL_AD_DECOMPRESSION_FAILURE SSL3_AD_DECOMPRESSION_FAILURE/* fatal */
753#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE/* fatal */
754#define SSL_AD_NO_CERTIFICATE SSL3_AD_NO_CERTIFICATE /* Not for TLS */
755#define SSL_AD_BAD_CERTIFICATE SSL3_AD_BAD_CERTIFICATE
756#define SSL_AD_UNSUPPORTED_CERTIFICATE SSL3_AD_UNSUPPORTED_CERTIFICATE
757#define SSL_AD_CERTIFICATE_REVOKED SSL3_AD_CERTIFICATE_REVOKED
758#define SSL_AD_CERTIFICATE_EXPIRED SSL3_AD_CERTIFICATE_EXPIRED
759#define SSL_AD_CERTIFICATE_UNKNOWN SSL3_AD_CERTIFICATE_UNKNOWN
760#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER /* fatal */
761#define SSL_AD_UNKNOWN_CA TLS1_AD_UNKNOWN_CA /* fatal */
762#define SSL_AD_ACCESS_DENIED TLS1_AD_ACCESS_DENIED /* fatal */
763#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR /* fatal */
764#define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR
765#define SSL_AD_EXPORT_RESTRICION TLS1_AD_EXPORT_RESTRICION/* fatal */
766#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION /* fatal */
767#define SSL_AD_INSUFFICIENT_SECURITY TLS1_AD_INSUFFICIENT_SECURITY/* fatal */
768#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR /* fatal */
769#define SSL_AD_USER_CANCLED TLS1_AD_USER_CANCLED
770#define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION
771
772#define SSL_ERROR_NONE 0
773#define SSL_ERROR_SSL 1
774#define SSL_ERROR_WANT_READ 2
775#define SSL_ERROR_WANT_WRITE 3
776#define SSL_ERROR_WANT_X509_LOOKUP 4
777#define SSL_ERROR_SYSCALL 5 /* look at error stack/return value/errno */
778#define SSL_ERROR_ZERO_RETURN 6
779#define SSL_ERROR_WANT_CONNECT 7
780
781#define SSL_CTRL_NEED_TMP_RSA 1
782#define SSL_CTRL_SET_TMP_RSA 2
783#define SSL_CTRL_SET_TMP_DH 3
784#define SSL_CTRL_SET_TMP_RSA_CB 4
785#define SSL_CTRL_SET_TMP_DH_CB 5
786/* Add these ones */
787#define SSL_CTRL_GET_SESSION_REUSED 6
788#define SSL_CTRL_GET_CLIENT_CERT_REQUEST 7
789#define SSL_CTRL_GET_NUM_RENEGOTIATIONS 8
790#define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS 9
791#define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS 10
792#define SSL_CTRL_GET_FLAGS 11
793#define SSL_CTRL_EXTRA_CHAIN_CERT 12
794
795/* Stats */
796#define SSL_CTRL_SESS_NUMBER 20
797#define SSL_CTRL_SESS_CONNECT 21
798#define SSL_CTRL_SESS_CONNECT_GOOD 22
799#define SSL_CTRL_SESS_CONNECT_RENEGOTIATE 23
800#define SSL_CTRL_SESS_ACCEPT 24
801#define SSL_CTRL_SESS_ACCEPT_GOOD 25
802#define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE 26
803#define SSL_CTRL_SESS_HIT 27
804#define SSL_CTRL_SESS_CB_HIT 28
805#define SSL_CTRL_SESS_MISSES 29
806#define SSL_CTRL_SESS_TIMEOUTS 30
807#define SSL_CTRL_SESS_CACHE_FULL 31
808#define SSL_CTRL_OPTIONS 32
809#define SSL_CTRL_MODE 33
810
811#define SSL_CTRL_GET_READ_AHEAD 40
812#define SSL_CTRL_SET_READ_AHEAD 41
813#define SSL_CTRL_SET_SESS_CACHE_SIZE 42
814#define SSL_CTRL_GET_SESS_CACHE_SIZE 43
815#define SSL_CTRL_SET_SESS_CACHE_MODE 44
816#define SSL_CTRL_GET_SESS_CACHE_MODE 45
817
818#define SSL_session_reused(ssl) \
819 SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL)
820#define SSL_num_renegotiations(ssl) \
821 SSL_ctrl((ssl),SSL_CTRL_GET_NUM_RENEGOTIATIONS,0,NULL)
822#define SSL_clear_num_renegotiations(ssl) \
823 SSL_ctrl((ssl),SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS,0,NULL)
824#define SSL_total_renegotiations(ssl) \
825 SSL_ctrl((ssl),SSL_CTRL_GET_TOTAL_RENEGOTIATIONS,0,NULL)
826
827#define SSL_CTX_need_tmp_RSA(ctx) \
828 SSL_CTX_ctrl(ctx,SSL_CTRL_NEED_TMP_RSA,0,NULL)
829#define SSL_CTX_set_tmp_rsa(ctx,rsa) \
830 SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa)
831#define SSL_CTX_set_tmp_dh(ctx,dh) \
832 SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
833
834#define SSL_need_tmp_RSA(ssl) \
835 SSL_ctrl(ssl,SSL_CTRL_NEED_TMP_RSA,0,NULL)
836#define SSL_set_tmp_rsa(ssl,rsa) \
837 SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa)
838#define SSL_set_tmp_dh(ssl,dh) \
839 SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
840
841#define SSL_CTX_add_extra_chain_cert(ctx,x509) \
842 SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509)
843
844/* VMS uses only 31 characters for symbols. */
845#ifdef VMS
846#undef SSL_CTX_set_cert_verify_callback
847#define SSL_CTX_set_cert_verify_callback SSL_CTX_set_cert_verify_cb
848#undef SSL_CTX_use_certificate_chain_file
849#define SSL_CTX_use_certificate_chain_file SSL_CTX_use_cert_chain_file
850#undef SSL_CTX_set_default_verify_paths
851#define SSL_CTX_set_default_verify_paths SSL_CTX_set_def_verify_paths
852#undef SSL_get_ex_data_X509_STORE_CTX_idx
853#define SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_ex_data_X509_STOR_CTX_i
854#undef SSL_add_file_cert_subjects_to_stack
855#define SSL_add_file_cert_subjects_to_stack SSL_add_file_cert_sub_to_stack
856#undef SSL_add_dir_cert_subjects_to_stack
857#define SSL_add_dir_cert_subjects_to_stack SSL_add_dir_cert_sub_to_stack
858#endif
859
860#ifdef HEADER_BIO_H
861BIO_METHOD *BIO_f_ssl(void);
862BIO *BIO_new_ssl(SSL_CTX *ctx,int client);
863BIO *BIO_new_ssl_connect(SSL_CTX *ctx);
864BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx);
865int BIO_ssl_copy_session_id(BIO *to,BIO *from);
866void BIO_ssl_shutdown(BIO *ssl_bio);
867
868#endif
869
870int SSL_CTX_set_cipher_list(SSL_CTX *,char *str);
871SSL_CTX *SSL_CTX_new(SSL_METHOD *meth);
872void SSL_CTX_free(SSL_CTX *);
873long SSL_CTX_set_timeout(SSL_CTX *ctx,long t);
874long SSL_CTX_get_timeout(SSL_CTX *ctx);
875X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *);
876void SSL_CTX_set_cert_store(SSL_CTX *,X509_STORE *);
877int SSL_want(SSL *s);
878int SSL_clear(SSL *s);
879
880void SSL_CTX_flush_sessions(SSL_CTX *ctx,long tm);
881
882SSL_CIPHER *SSL_get_current_cipher(SSL *s);
883int SSL_CIPHER_get_bits(SSL_CIPHER *c,int *alg_bits);
884char * SSL_CIPHER_get_version(SSL_CIPHER *c);
885const char * SSL_CIPHER_get_name(SSL_CIPHER *c);
886
887int SSL_get_fd(SSL *s);
888const char * SSL_get_cipher_list(SSL *s,int n);
889char * SSL_get_shared_ciphers(SSL *s, char *buf, int len);
890int SSL_get_read_ahead(SSL * s);
891int SSL_pending(SSL *s);
892#ifndef NO_SOCK
893int SSL_set_fd(SSL *s, int fd);
894int SSL_set_rfd(SSL *s, int fd);
895int SSL_set_wfd(SSL *s, int fd);
896#endif
897#ifdef HEADER_BIO_H
898void SSL_set_bio(SSL *s, BIO *rbio,BIO *wbio);
899BIO * SSL_get_rbio(SSL *s);
900BIO * SSL_get_wbio(SSL *s);
901#endif
902int SSL_set_cipher_list(SSL *s, char *str);
903void SSL_set_read_ahead(SSL *s, int yes);
904int SSL_get_verify_mode(SSL *s);
905int SSL_get_verify_depth(SSL *s);
906int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *);
907void SSL_set_verify(SSL *s, int mode,
908 int (*callback)(int ok,X509_STORE_CTX *ctx));
909void SSL_set_verify_depth(SSL *s, int depth);
910#ifndef NO_RSA
911int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);
912#endif
913int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len);
914int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);
915int SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, unsigned char *d, long len);
916int SSL_use_certificate(SSL *ssl, X509 *x);
917int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len);
918
919#ifndef NO_STDIO
920int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type);
921int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type);
922int SSL_use_certificate_file(SSL *ssl, const char *file, int type);
923int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type);
924int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type);
925int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type);
926int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); /* PEM type */
927STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file);
928int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs,
929 const char *file);
930int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs,
931 const char *dir);
932#endif
933
934void ERR_load_SSL_strings(void );
935void SSL_load_error_strings(void );
936char * SSL_state_string(SSL *s);
937char * SSL_rstate_string(SSL *s);
938char * SSL_state_string_long(SSL *s);
939char * SSL_rstate_string_long(SSL *s);
940long SSL_SESSION_get_time(SSL_SESSION *s);
941long SSL_SESSION_set_time(SSL_SESSION *s, long t);
942long SSL_SESSION_get_timeout(SSL_SESSION *s);
943long SSL_SESSION_set_timeout(SSL_SESSION *s, long t);
944void SSL_copy_session_id(SSL *to,SSL *from);
945
946SSL_SESSION *SSL_SESSION_new(void);
947unsigned long SSL_SESSION_hash(SSL_SESSION *a);
948int SSL_SESSION_cmp(SSL_SESSION *a,SSL_SESSION *b);
949#ifndef NO_FP_API
950int SSL_SESSION_print_fp(FILE *fp,SSL_SESSION *ses);
951#endif
952#ifdef HEADER_BIO_H
953int SSL_SESSION_print(BIO *fp,SSL_SESSION *ses);
954#endif
955void SSL_SESSION_free(SSL_SESSION *ses);
956int i2d_SSL_SESSION(SSL_SESSION *in,unsigned char **pp);
957int SSL_set_session(SSL *to, SSL_SESSION *session);
958int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c);
959int SSL_CTX_remove_session(SSL_CTX *,SSL_SESSION *c);
960SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a,unsigned char **pp,long length);
961
962#ifdef HEADER_X509_H
963X509 * SSL_get_peer_certificate(SSL *s);
964#endif
965
966STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s);
967
968#ifdef VMS
969#define SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_def_passwd_cb_ud
970#endif
971
972int SSL_CTX_get_verify_mode(SSL_CTX *ctx);
973int SSL_CTX_get_verify_depth(SSL_CTX *ctx);
974int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *);
975void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,
976 int (*callback)(int, X509_STORE_CTX *));
977void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth);
978void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(),char *arg);
979#ifndef NO_RSA
980int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);
981#endif
982int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len);
983int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey);
984int SSL_CTX_use_PrivateKey_ASN1(int pk,SSL_CTX *ctx,
985 unsigned char *d, long len);
986int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);
987int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d);
988
989void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb);
990void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u);
991
992int SSL_CTX_check_private_key(SSL_CTX *ctx);
993int SSL_check_private_key(SSL *ctx);
994
995int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
996 unsigned int sid_ctx_len);
997
998SSL * SSL_new(SSL_CTX *ctx);
999int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
1000 unsigned int sid_ctx_len);
1001void SSL_free(SSL *ssl);
1002int SSL_accept(SSL *ssl);
1003int SSL_connect(SSL *ssl);
1004int SSL_read(SSL *ssl,char *buf,int num);
1005int SSL_peek(SSL *ssl,char *buf,int num);
1006int SSL_write(SSL *ssl,const char *buf,int num);
1007long SSL_ctrl(SSL *ssl,int cmd, long larg, char *parg);
1008long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd, long larg, char *parg);
1009
1010int SSL_get_error(SSL *s,int ret_code);
1011char * SSL_get_version(SSL *s);
1012
1013/* This sets the 'default' SSL version that SSL_new() will create */
1014int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth);
1015
1016SSL_METHOD *SSLv2_method(void); /* SSLv2 */
1017SSL_METHOD *SSLv2_server_method(void); /* SSLv2 */
1018SSL_METHOD *SSLv2_client_method(void); /* SSLv2 */
1019
1020SSL_METHOD *SSLv3_method(void); /* SSLv3 */
1021SSL_METHOD *SSLv3_server_method(void); /* SSLv3 */
1022SSL_METHOD *SSLv3_client_method(void); /* SSLv3 */
1023
1024SSL_METHOD *SSLv23_method(void); /* SSLv3 but can rollback to v2 */
1025SSL_METHOD *SSLv23_server_method(void); /* SSLv3 but can rollback to v2 */
1026SSL_METHOD *SSLv23_client_method(void); /* SSLv3 but can rollback to v2 */
1027
1028SSL_METHOD *TLSv1_method(void); /* TLSv1.0 */
1029SSL_METHOD *TLSv1_server_method(void); /* TLSv1.0 */
1030SSL_METHOD *TLSv1_client_method(void); /* TLSv1.0 */
1031
1032STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s);
1033
1034int SSL_do_handshake(SSL *s);
1035int SSL_renegotiate(SSL *s);
1036int SSL_shutdown(SSL *s);
1037
1038SSL_METHOD *SSL_get_ssl_method(SSL *s);
1039int SSL_set_ssl_method(SSL *s,SSL_METHOD *method);
1040char *SSL_alert_type_string_long(int value);
1041char *SSL_alert_type_string(int value);
1042char *SSL_alert_desc_string_long(int value);
1043char *SSL_alert_desc_string(int value);
1044
1045void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list);
1046void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list);
1047STACK_OF(X509_NAME) *SSL_get_client_CA_list(SSL *s);
1048STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(SSL_CTX *s);
1049int SSL_add_client_CA(SSL *ssl,X509 *x);
1050int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x);
1051
1052void SSL_set_connect_state(SSL *s);
1053void SSL_set_accept_state(SSL *s);
1054
1055long SSL_get_default_timeout(SSL *s);
1056
1057int SSL_library_init(void );
1058
1059char *SSL_CIPHER_description(SSL_CIPHER *,char *buf,int size);
1060STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk);
1061
1062SSL *SSL_dup(SSL *ssl);
1063
1064X509 *SSL_get_certificate(SSL *ssl);
1065/* EVP_PKEY */ struct evp_pkey_st *SSL_get_privatekey(SSL *ssl);
1066
1067void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode);
1068int SSL_CTX_get_quiet_shutdown(SSL_CTX *ctx);
1069void SSL_set_quiet_shutdown(SSL *ssl,int mode);
1070int SSL_get_quiet_shutdown(SSL *ssl);
1071void SSL_set_shutdown(SSL *ssl,int mode);
1072int SSL_get_shutdown(SSL *ssl);
1073int SSL_version(SSL *ssl);
1074int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx);
1075int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
1076 const char *CApath);
1077SSL_SESSION *SSL_get_session(SSL *ssl);
1078SSL_CTX *SSL_get_SSL_CTX(SSL *ssl);
1079void SSL_set_info_callback(SSL *ssl,void (*cb)());
1080void (*SSL_get_info_callback(SSL *ssl))();
1081int SSL_state(SSL *ssl);
1082
1083void SSL_set_verify_result(SSL *ssl,long v);
1084long SSL_get_verify_result(SSL *ssl);
1085
1086int SSL_set_ex_data(SSL *ssl,int idx,void *data);
1087void *SSL_get_ex_data(SSL *ssl,int idx);
1088int SSL_get_ex_new_index(long argl, char *argp, int (*new_func)(),
1089 int (*dup_func)(), void (*free_func)());
1090
1091int SSL_SESSION_set_ex_data(SSL_SESSION *ss,int idx,void *data);
1092void *SSL_SESSION_get_ex_data(SSL_SESSION *ss,int idx);
1093int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
1094 int (*dup_func)(), void (*free_func)());
1095
1096int SSL_CTX_set_ex_data(SSL_CTX *ssl,int idx,void *data);
1097void *SSL_CTX_get_ex_data(SSL_CTX *ssl,int idx);
1098int SSL_CTX_get_ex_new_index(long argl, char *argp, int (*new_func)(),
1099 int (*dup_func)(), void (*free_func)());
1100
1101int SSL_get_ex_data_X509_STORE_CTX_idx(void );
1102
1103#define SSL_CTX_sess_set_cache_size(ctx,t) \
1104 SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_SIZE,t,NULL)
1105#define SSL_CTX_sess_get_cache_size(ctx) \
1106 SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_SIZE,0,NULL)
1107#define SSL_CTX_set_session_cache_mode(ctx,m) \
1108 SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL)
1109#define SSL_CTX_get_session_cache_mode(ctx) \
1110 SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL)
1111
1112#define SSL_CTX_get_default_read_ahead(ctx) SSL_CTX_get_read_ahead(ctx)
1113#define SSL_CTX_set_default_read_ahead(ctx,m) SSL_CTX_set_read_ahead(ctx,m)
1114#define SSL_CTX_get_read_ahead(ctx) \
1115 SSL_CTX_ctrl(ctx,SSL_CTRL_GET_READ_AHEAD,0,NULL)
1116#define SSL_CTX_set_read_ahead(ctx,m) \
1117 SSL_CTX_ctrl(ctx,SSL_CTRL_SET_READ_AHEAD,0,NULL)
1118
1119 /* NB: the keylength is only applicable when is_export is true */
1120#ifndef NO_RSA
1121void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,
1122 RSA *(*cb)(SSL *ssl,int is_export,
1123 int keylength));
1124
1125void SSL_set_tmp_rsa_callback(SSL *ssl,
1126 RSA *(*cb)(SSL *ssl,int is_export,
1127 int keylength));
1128#endif
1129#ifndef NO_DH
1130void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,
1131 DH *(*dh)(SSL *ssl,int is_export,
1132 int keylength));
1133void SSL_set_tmp_dh_callback(SSL *ssl,
1134 DH *(*dh)(SSL *ssl,int is_export,
1135 int keylength));
1136#endif
1137
1138#ifdef HEADER_COMP_H
1139int SSL_COMP_add_compression_method(int id,COMP_METHOD *cm);
1140#else
1141int SSL_COMP_add_compression_method(int id,char *cm);
1142#endif
1143
1144/* BEGIN ERROR CODES */
1145/* The following lines are auto generated by the script mkerr.pl. Any changes
1146 * made after this point may be overwritten when the script is next run.
1147 */
1148
1149/* Error codes for the SSL functions. */
1150
1151/* Function codes. */
1152#define SSL_F_CLIENT_CERTIFICATE 100
1153#define SSL_F_CLIENT_HELLO 101
1154#define SSL_F_CLIENT_MASTER_KEY 102
1155#define SSL_F_D2I_SSL_SESSION 103
1156#define SSL_F_DO_SSL3_WRITE 104
1157#define SSL_F_GET_CLIENT_FINISHED 105
1158#define SSL_F_GET_CLIENT_HELLO 106
1159#define SSL_F_GET_CLIENT_MASTER_KEY 107
1160#define SSL_F_GET_SERVER_FINISHED 108
1161#define SSL_F_GET_SERVER_HELLO 109
1162#define SSL_F_GET_SERVER_VERIFY 110
1163#define SSL_F_I2D_SSL_SESSION 111
1164#define SSL_F_READ_N 112
1165#define SSL_F_REQUEST_CERTIFICATE 113
1166#define SSL_F_SERVER_HELLO 114
1167#define SSL_F_SSL23_ACCEPT 115
1168#define SSL_F_SSL23_CLIENT_HELLO 116
1169#define SSL_F_SSL23_CONNECT 117
1170#define SSL_F_SSL23_GET_CLIENT_HELLO 118
1171#define SSL_F_SSL23_GET_SERVER_HELLO 119
1172#define SSL_F_SSL23_READ 120
1173#define SSL_F_SSL23_WRITE 121
1174#define SSL_F_SSL2_ACCEPT 122
1175#define SSL_F_SSL2_CONNECT 123
1176#define SSL_F_SSL2_ENC_INIT 124
1177#define SSL_F_SSL2_READ 125
1178#define SSL_F_SSL2_SET_CERTIFICATE 126
1179#define SSL_F_SSL2_WRITE 127
1180#define SSL_F_SSL3_ACCEPT 128
1181#define SSL_F_SSL3_CHANGE_CIPHER_STATE 129
1182#define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130
1183#define SSL_F_SSL3_CLIENT_HELLO 131
1184#define SSL_F_SSL3_CONNECT 132
1185#define SSL_F_SSL3_CTRL 213
1186#define SSL_F_SSL3_CTX_CTRL 133
1187#define SSL_F_SSL3_ENC 134
1188#define SSL_F_SSL3_GET_CERTIFICATE_REQUEST 135
1189#define SSL_F_SSL3_GET_CERT_VERIFY 136
1190#define SSL_F_SSL3_GET_CLIENT_CERTIFICATE 137
1191#define SSL_F_SSL3_GET_CLIENT_HELLO 138
1192#define SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE 139
1193#define SSL_F_SSL3_GET_FINISHED 140
1194#define SSL_F_SSL3_GET_KEY_EXCHANGE 141
1195#define SSL_F_SSL3_GET_MESSAGE 142
1196#define SSL_F_SSL3_GET_RECORD 143
1197#define SSL_F_SSL3_GET_SERVER_CERTIFICATE 144
1198#define SSL_F_SSL3_GET_SERVER_DONE 145
1199#define SSL_F_SSL3_GET_SERVER_HELLO 146
1200#define SSL_F_SSL3_OUTPUT_CERT_CHAIN 147
1201#define SSL_F_SSL3_READ_BYTES 148
1202#define SSL_F_SSL3_READ_N 149
1203#define SSL_F_SSL3_SEND_CERTIFICATE_REQUEST 150
1204#define SSL_F_SSL3_SEND_CLIENT_CERTIFICATE 151
1205#define SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE 152
1206#define SSL_F_SSL3_SEND_CLIENT_VERIFY 153
1207#define SSL_F_SSL3_SEND_SERVER_CERTIFICATE 154
1208#define SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE 155
1209#define SSL_F_SSL3_SETUP_BUFFERS 156
1210#define SSL_F_SSL3_SETUP_KEY_BLOCK 157
1211#define SSL_F_SSL3_WRITE_BYTES 158
1212#define SSL_F_SSL3_WRITE_PENDING 159
1213#define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK 215
1214#define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK 216
1215#define SSL_F_SSL_BAD_METHOD 160
1216#define SSL_F_SSL_BYTES_TO_CIPHER_LIST 161
1217#define SSL_F_SSL_CERT_DUP 221
1218#define SSL_F_SSL_CERT_INST 222
1219#define SSL_F_SSL_CERT_INSTANTIATE 214
1220#define SSL_F_SSL_CERT_NEW 162
1221#define SSL_F_SSL_CHECK_PRIVATE_KEY 163
1222#define SSL_F_SSL_CLEAR 164
1223#define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD 165
1224#define SSL_F_SSL_CREATE_CIPHER_LIST 166
1225#define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY 168
1226#define SSL_F_SSL_CTX_NEW 169
1227#define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT 219
1228#define SSL_F_SSL_CTX_SET_SSL_VERSION 170
1229#define SSL_F_SSL_CTX_USE_CERTIFICATE 171
1230#define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1 172
1231#define SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE 220
1232#define SSL_F_SSL_CTX_USE_CERTIFICATE_FILE 173
1233#define SSL_F_SSL_CTX_USE_PRIVATEKEY 174
1234#define SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1 175
1235#define SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE 176
1236#define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY 177
1237#define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1 178
1238#define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE 179
1239#define SSL_F_SSL_DO_HANDSHAKE 180
1240#define SSL_F_SSL_GET_NEW_SESSION 181
1241#define SSL_F_SSL_GET_PREV_SESSION 217
1242#define SSL_F_SSL_GET_SERVER_SEND_CERT 182
1243#define SSL_F_SSL_GET_SIGN_PKEY 183
1244#define SSL_F_SSL_INIT_WBIO_BUFFER 184
1245#define SSL_F_SSL_LOAD_CLIENT_CA_FILE 185
1246#define SSL_F_SSL_NEW 186
1247#define SSL_F_SSL_READ 223
1248#define SSL_F_SSL_RSA_PRIVATE_DECRYPT 187
1249#define SSL_F_SSL_RSA_PUBLIC_ENCRYPT 188
1250#define SSL_F_SSL_SESSION_NEW 189
1251#define SSL_F_SSL_SESSION_PRINT_FP 190
1252#define SSL_F_SSL_SESS_CERT_NEW 225
1253#define SSL_F_SSL_SET_CERT 191
1254#define SSL_F_SSL_SET_FD 192
1255#define SSL_F_SSL_SET_PKEY 193
1256#define SSL_F_SSL_SET_RFD 194
1257#define SSL_F_SSL_SET_SESSION 195
1258#define SSL_F_SSL_SET_SESSION_ID_CONTEXT 218
1259#define SSL_F_SSL_SET_WFD 196
1260#define SSL_F_SSL_SHUTDOWN 224
1261#define SSL_F_SSL_UNDEFINED_FUNCTION 197
1262#define SSL_F_SSL_USE_CERTIFICATE 198
1263#define SSL_F_SSL_USE_CERTIFICATE_ASN1 199
1264#define SSL_F_SSL_USE_CERTIFICATE_FILE 200
1265#define SSL_F_SSL_USE_PRIVATEKEY 201
1266#define SSL_F_SSL_USE_PRIVATEKEY_ASN1 202
1267#define SSL_F_SSL_USE_PRIVATEKEY_FILE 203
1268#define SSL_F_SSL_USE_RSAPRIVATEKEY 204
1269#define SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1 205
1270#define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 206
1271#define SSL_F_SSL_VERIFY_CERT_CHAIN 207
1272#define SSL_F_SSL_WRITE 208
1273#define SSL_F_TLS1_CHANGE_CIPHER_STATE 209
1274#define SSL_F_TLS1_ENC 210
1275#define SSL_F_TLS1_SETUP_KEY_BLOCK 211
1276#define SSL_F_WRITE_PENDING 212
1277
1278/* Reason codes. */
1279#define SSL_R_APP_DATA_IN_HANDSHAKE 100
1280#define SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT 272
1281#define SSL_R_BAD_ALERT_RECORD 101
1282#define SSL_R_BAD_AUTHENTICATION_TYPE 102
1283#define SSL_R_BAD_CHANGE_CIPHER_SPEC 103
1284#define SSL_R_BAD_CHECKSUM 104
1285#define SSL_R_BAD_CLIENT_REQUEST 105
1286#define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK 106
1287#define SSL_R_BAD_DECOMPRESSION 107
1288#define SSL_R_BAD_DH_G_LENGTH 108
1289#define SSL_R_BAD_DH_PUB_KEY_LENGTH 109
1290#define SSL_R_BAD_DH_P_LENGTH 110
1291#define SSL_R_BAD_DIGEST_LENGTH 111
1292#define SSL_R_BAD_DSA_SIGNATURE 112
1293#define SSL_R_BAD_LENGTH 271
1294#define SSL_R_BAD_MAC_DECODE 113
1295#define SSL_R_BAD_MESSAGE_TYPE 114
1296#define SSL_R_BAD_PACKET_LENGTH 115
1297#define SSL_R_BAD_PROTOCOL_VERSION_NUMBER 116
1298#define SSL_R_BAD_RESPONSE_ARGUMENT 117
1299#define SSL_R_BAD_RSA_DECRYPT 118
1300#define SSL_R_BAD_RSA_ENCRYPT 119
1301#define SSL_R_BAD_RSA_E_LENGTH 120
1302#define SSL_R_BAD_RSA_MODULUS_LENGTH 121
1303#define SSL_R_BAD_RSA_SIGNATURE 122
1304#define SSL_R_BAD_SIGNATURE 123
1305#define SSL_R_BAD_SSL_FILETYPE 124
1306#define SSL_R_BAD_SSL_SESSION_ID_LENGTH 125
1307#define SSL_R_BAD_STATE 126
1308#define SSL_R_BAD_WRITE_RETRY 127
1309#define SSL_R_BIO_NOT_SET 128
1310#define SSL_R_BLOCK_CIPHER_PAD_IS_WRONG 129
1311#define SSL_R_BN_LIB 130
1312#define SSL_R_CA_DN_LENGTH_MISMATCH 131
1313#define SSL_R_CA_DN_TOO_LONG 132
1314#define SSL_R_CCS_RECEIVED_EARLY 133
1315#define SSL_R_CERTIFICATE_VERIFY_FAILED 134
1316#define SSL_R_CERT_LENGTH_MISMATCH 135
1317#define SSL_R_CHALLENGE_IS_DIFFERENT 136
1318#define SSL_R_CIPHER_CODE_WRONG_LENGTH 137
1319#define SSL_R_CIPHER_OR_HASH_UNAVAILABLE 138
1320#define SSL_R_CIPHER_TABLE_SRC_ERROR 139
1321#define SSL_R_COMPRESSED_LENGTH_TOO_LONG 140
1322#define SSL_R_COMPRESSION_FAILURE 141
1323#define SSL_R_COMPRESSION_LIBRARY_ERROR 142
1324#define SSL_R_CONNECTION_ID_IS_DIFFERENT 143
1325#define SSL_R_CONNECTION_TYPE_NOT_SET 144
1326#define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED 145
1327#define SSL_R_DATA_LENGTH_TOO_LONG 146
1328#define SSL_R_DECRYPTION_FAILED 147
1329#define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG 148
1330#define SSL_R_DIGEST_CHECK_FAILED 149
1331#define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 150
1332#define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 151
1333#define SSL_R_EXCESSIVE_MESSAGE_SIZE 152
1334#define SSL_R_EXTRA_DATA_IN_MESSAGE 153
1335#define SSL_R_GOT_A_FIN_BEFORE_A_CCS 154
1336#define SSL_R_HTTPS_PROXY_REQUEST 155
1337#define SSL_R_HTTP_REQUEST 156
1338#define SSL_R_INTERNAL_ERROR 157
1339#define SSL_R_INVALID_CHALLENGE_LENGTH 158
1340#define SSL_R_LENGTH_MISMATCH 159
1341#define SSL_R_LENGTH_TOO_SHORT 160
1342#define SSL_R_LIBRARY_BUG 274
1343#define SSL_R_LIBRARY_HAS_NO_CIPHERS 161
1344#define SSL_R_MISSING_DH_DSA_CERT 162
1345#define SSL_R_MISSING_DH_KEY 163
1346#define SSL_R_MISSING_DH_RSA_CERT 164
1347#define SSL_R_MISSING_DSA_SIGNING_CERT 165
1348#define SSL_R_MISSING_EXPORT_TMP_DH_KEY 166
1349#define SSL_R_MISSING_EXPORT_TMP_RSA_KEY 167
1350#define SSL_R_MISSING_RSA_CERTIFICATE 168
1351#define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169
1352#define SSL_R_MISSING_RSA_SIGNING_CERT 170
1353#define SSL_R_MISSING_TMP_DH_KEY 171
1354#define SSL_R_MISSING_TMP_RSA_KEY 172
1355#define SSL_R_MISSING_TMP_RSA_PKEY 173
1356#define SSL_R_MISSING_VERIFY_MESSAGE 174
1357#define SSL_R_NON_SSLV2_INITIAL_PACKET 175
1358#define SSL_R_NO_CERTIFICATES_RETURNED 176
1359#define SSL_R_NO_CERTIFICATE_ASSIGNED 177
1360#define SSL_R_NO_CERTIFICATE_RETURNED 178
1361#define SSL_R_NO_CERTIFICATE_SET 179
1362#define SSL_R_NO_CERTIFICATE_SPECIFIED 180
1363#define SSL_R_NO_CIPHERS_AVAILABLE 181
1364#define SSL_R_NO_CIPHERS_PASSED 182
1365#define SSL_R_NO_CIPHERS_SPECIFIED 183
1366#define SSL_R_NO_CIPHER_LIST 184
1367#define SSL_R_NO_CIPHER_MATCH 185
1368#define SSL_R_NO_CLIENT_CERT_RECEIVED 186
1369#define SSL_R_NO_COMPRESSION_SPECIFIED 187
1370#define SSL_R_NO_METHOD_SPECIFIED 188
1371#define SSL_R_NO_PRIVATEKEY 189
1372#define SSL_R_NO_PRIVATE_KEY_ASSIGNED 190
1373#define SSL_R_NO_PROTOCOLS_AVAILABLE 191
1374#define SSL_R_NO_PUBLICKEY 192
1375#define SSL_R_NO_SHARED_CIPHER 193
1376#define SSL_R_NO_VERIFY_CALLBACK 194
1377#define SSL_R_NULL_SSL_CTX 195
1378#define SSL_R_NULL_SSL_METHOD_PASSED 196
1379#define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED 197
1380#define SSL_R_PACKET_LENGTH_TOO_LONG 198
1381#define SSL_R_PATH_TOO_LONG 270
1382#define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE 199
1383#define SSL_R_PEER_ERROR 200
1384#define SSL_R_PEER_ERROR_CERTIFICATE 201
1385#define SSL_R_PEER_ERROR_NO_CERTIFICATE 202
1386#define SSL_R_PEER_ERROR_NO_CIPHER 203
1387#define SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE 204
1388#define SSL_R_PRE_MAC_LENGTH_TOO_LONG 205
1389#define SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS 206
1390#define SSL_R_PROTOCOL_IS_SHUTDOWN 207
1391#define SSL_R_PUBLIC_KEY_ENCRYPT_ERROR 208
1392#define SSL_R_PUBLIC_KEY_IS_NOT_RSA 209
1393#define SSL_R_PUBLIC_KEY_NOT_RSA 210
1394#define SSL_R_READ_BIO_NOT_SET 211
1395#define SSL_R_READ_WRONG_PACKET_TYPE 212
1396#define SSL_R_RECORD_LENGTH_MISMATCH 213
1397#define SSL_R_RECORD_TOO_LARGE 214
1398#define SSL_R_REQUIRED_CIPHER_MISSING 215
1399#define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO 216
1400#define SSL_R_REUSE_CERT_TYPE_NOT_ZERO 217
1401#define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO 218
1402#define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277
1403#define SSL_R_SHORT_READ 219
1404#define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220
1405#define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221
1406#define SSL_R_SSL3_SESSION_ID_TOO_SHORT 222
1407#define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 1042
1408#define SSL_R_SSLV3_ALERT_BAD_RECORD_MAC 1020
1409#define SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED 1045
1410#define SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED 1044
1411#define SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN 1046
1412#define SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE 1030
1413#define SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE 1040
1414#define SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER 1047
1415#define SSL_R_SSLV3_ALERT_NO_CERTIFICATE 1041
1416#define SSL_R_SSLV3_ALERT_PEER_ERROR_CERTIFICATE 223
1417#define SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CERTIFICATE 224
1418#define SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CIPHER 225
1419#define SSL_R_SSLV3_ALERT_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE 226
1420#define SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010
1421#define SSL_R_SSLV3_ALERT_UNKNOWN_REMOTE_ERROR_TYPE 227
1422#define SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE 1043
1423#define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228
1424#define SSL_R_SSL_HANDSHAKE_FAILURE 229
1425#define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS 230
1426#define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG 273
1427#define SSL_R_SSL_SESSION_ID_IS_DIFFERENT 231
1428#define SSL_R_TLSV1_ALERT_ACCESS_DENIED 1049
1429#define SSL_R_TLSV1_ALERT_DECODE_ERROR 1050
1430#define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021
1431#define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051
1432#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICION 1060
1433#define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071
1434#define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080
1435#define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100
1436#define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION 1070
1437#define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW 1022
1438#define SSL_R_TLSV1_ALERT_UNKNOWN_CA 1048
1439#define SSL_R_TLSV1_ALERT_USER_CANCLED 1090
1440#define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER 232
1441#define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
1442#define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG 234
1443#define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER 235
1444#define SSL_R_UNABLE_TO_DECODE_DH_CERTS 236
1445#define SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY 237
1446#define SSL_R_UNABLE_TO_FIND_DH_PARAMETERS 238
1447#define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS 239
1448#define SSL_R_UNABLE_TO_FIND_SSL_METHOD 240
1449#define SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES 241
1450#define SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES 242
1451#define SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES 243
1452#define SSL_R_UNEXPECTED_MESSAGE 244
1453#define SSL_R_UNEXPECTED_RECORD 245
1454#define SSL_R_UNINITIALIZED 276
1455#define SSL_R_UNKNOWN_ALERT_TYPE 246
1456#define SSL_R_UNKNOWN_CERTIFICATE_TYPE 247
1457#define SSL_R_UNKNOWN_CIPHER_RETURNED 248
1458#define SSL_R_UNKNOWN_CIPHER_TYPE 249
1459#define SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE 250
1460#define SSL_R_UNKNOWN_PKEY_TYPE 251
1461#define SSL_R_UNKNOWN_PROTOCOL 252
1462#define SSL_R_UNKNOWN_REMOTE_ERROR_TYPE 253
1463#define SSL_R_UNKNOWN_SSL_VERSION 254
1464#define SSL_R_UNKNOWN_STATE 255
1465#define SSL_R_UNSUPPORTED_CIPHER 256
1466#define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM 257
1467#define SSL_R_UNSUPPORTED_PROTOCOL 258
1468#define SSL_R_UNSUPPORTED_SSL_VERSION 259
1469#define SSL_R_WRITE_BIO_NOT_SET 260
1470#define SSL_R_WRONG_CIPHER_RETURNED 261
1471#define SSL_R_WRONG_MESSAGE_TYPE 262
1472#define SSL_R_WRONG_NUMBER_OF_KEY_BITS 263
1473#define SSL_R_WRONG_SIGNATURE_LENGTH 264
1474#define SSL_R_WRONG_SIGNATURE_SIZE 265
1475#define SSL_R_WRONG_SSL_VERSION 266
1476#define SSL_R_WRONG_VERSION_NUMBER 267
1477#define SSL_R_X509_LIB 268
1478#define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS 269
1479
1480#ifdef __cplusplus
1481}
1482#endif
1483#endif
1484
diff --git a/src/lib/libssl/ssl2.h b/src/lib/libssl/ssl2.h
deleted file mode 100644
index d7f24ac1b4..0000000000
--- a/src/lib/libssl/ssl2.h
+++ /dev/null
@@ -1,265 +0,0 @@
1/* ssl/ssl2.h */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_SSL2_H
60#define HEADER_SSL2_H
61
62#ifdef __cplusplus
63extern "C" {
64#endif
65
66/* Protocol Version Codes */
67#define SSL2_VERSION 0x0002
68#define SSL2_VERSION_MAJOR 0x00
69#define SSL2_VERSION_MINOR 0x02
70/* #define SSL2_CLIENT_VERSION 0x0002 */
71/* #define SSL2_SERVER_VERSION 0x0002 */
72
73/* Protocol Message Codes */
74#define SSL2_MT_ERROR 0
75#define SSL2_MT_CLIENT_HELLO 1
76#define SSL2_MT_CLIENT_MASTER_KEY 2
77#define SSL2_MT_CLIENT_FINISHED 3
78#define SSL2_MT_SERVER_HELLO 4
79#define SSL2_MT_SERVER_VERIFY 5
80#define SSL2_MT_SERVER_FINISHED 6
81#define SSL2_MT_REQUEST_CERTIFICATE 7
82#define SSL2_MT_CLIENT_CERTIFICATE 8
83
84/* Error Message Codes */
85#define SSL2_PE_UNDEFINED_ERROR 0x0000
86#define SSL2_PE_NO_CIPHER 0x0001
87#define SSL2_PE_NO_CERTIFICATE 0x0002
88#define SSL2_PE_BAD_CERTIFICATE 0x0004
89#define SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE 0x0006
90
91/* Cipher Kind Values */
92#define SSL2_CK_NULL_WITH_MD5 0x02000000 /* v3 */
93#define SSL2_CK_RC4_128_WITH_MD5 0x02010080
94#define SSL2_CK_RC4_128_EXPORT40_WITH_MD5 0x02020080
95#define SSL2_CK_RC2_128_CBC_WITH_MD5 0x02030080
96#define SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5 0x02040080
97#define SSL2_CK_IDEA_128_CBC_WITH_MD5 0x02050080
98#define SSL2_CK_DES_64_CBC_WITH_MD5 0x02060040
99#define SSL2_CK_DES_64_CBC_WITH_SHA 0x02060140 /* v3 */
100#define SSL2_CK_DES_192_EDE3_CBC_WITH_MD5 0x020700c0
101#define SSL2_CK_DES_192_EDE3_CBC_WITH_SHA 0x020701c0 /* v3 */
102#define SSL2_CK_RC4_64_WITH_MD5 0x02080080 /* MS hack */
103
104#define SSL2_CK_DES_64_CFB64_WITH_MD5_1 0x02ff0800 /* SSLeay */
105#define SSL2_CK_NULL 0x02ff0810 /* SSLeay */
106
107#define SSL2_TXT_DES_64_CFB64_WITH_MD5_1 "DES-CFB-M1"
108#define SSL2_TXT_NULL_WITH_MD5 "NULL-MD5"
109#define SSL2_TXT_RC4_128_WITH_MD5 "RC4-MD5"
110#define SSL2_TXT_RC4_128_EXPORT40_WITH_MD5 "EXP-RC4-MD5"
111#define SSL2_TXT_RC2_128_CBC_WITH_MD5 "RC2-CBC-MD5"
112#define SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 "EXP-RC2-CBC-MD5"
113#define SSL2_TXT_IDEA_128_CBC_WITH_MD5 "IDEA-CBC-MD5"
114#define SSL2_TXT_DES_64_CBC_WITH_MD5 "DES-CBC-MD5"
115#define SSL2_TXT_DES_64_CBC_WITH_SHA "DES-CBC-SHA"
116#define SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5 "DES-CBC3-MD5"
117#define SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA "DES-CBC3-SHA"
118#define SSL2_TXT_RC4_64_WITH_MD5 "RC4-64-MD5"
119
120#define SSL2_TXT_NULL "NULL"
121
122/* Flags for the SSL_CIPHER.algorithm2 field */
123#define SSL2_CF_5_BYTE_ENC 0x01
124#define SSL2_CF_8_BYTE_ENC 0x02
125
126/* Certificate Type Codes */
127#define SSL2_CT_X509_CERTIFICATE 0x01
128
129/* Authentication Type Code */
130#define SSL2_AT_MD5_WITH_RSA_ENCRYPTION 0x01
131
132#define SSL2_MAX_SSL_SESSION_ID_LENGTH 32
133
134/* Upper/Lower Bounds */
135#define SSL2_MAX_MASTER_KEY_LENGTH_IN_BITS 256
136#define SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER (unsigned int)32767
137#define SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER 16383 /**/
138
139#define SSL2_CHALLENGE_LENGTH 16
140/*#define SSL2_CHALLENGE_LENGTH 32 */
141#define SSL2_MIN_CHALLENGE_LENGTH 16
142#define SSL2_MAX_CHALLENGE_LENGTH 32
143#define SSL2_CONNECTION_ID_LENGTH 16
144#define SSL2_MAX_CONNECTION_ID_LENGTH 16
145#define SSL2_SSL_SESSION_ID_LENGTH 16
146#define SSL2_MAX_CERT_CHALLENGE_LENGTH 32
147#define SSL2_MIN_CERT_CHALLENGE_LENGTH 16
148#define SSL2_MAX_KEY_MATERIAL_LENGTH 24
149
150#ifndef HEADER_SSL_LOCL_H
151#define CERT char
152#endif
153
154typedef struct ssl2_ctx_st
155 {
156 int three_byte_header;
157 int clear_text; /* clear text */
158 int escape; /* not used in SSLv2 */
159 int ssl2_rollback; /* used if SSLv23 rolled back to SSLv2 */
160
161 /* non-blocking io info, used to make sure the same
162 * args were passwd */
163 unsigned int wnum; /* number of bytes sent so far */
164 int wpend_tot;
165 const unsigned char *wpend_buf;
166
167 int wpend_off; /* offset to data to write */
168 int wpend_len; /* number of bytes passwd to write */
169 int wpend_ret; /* number of bytes to return to caller */
170
171 /* buffer raw data */
172 int rbuf_left;
173 int rbuf_offs;
174 unsigned char *rbuf;
175 unsigned char *wbuf;
176
177 unsigned char *write_ptr;/* used to point to the start due to
178 * 2/3 byte header. */
179
180 unsigned int padding;
181 unsigned int rlength; /* passed to ssl2_enc */
182 int ract_data_length; /* Set when things are encrypted. */
183 unsigned int wlength; /* passed to ssl2_enc */
184 int wact_data_length; /* Set when things are decrypted. */
185 unsigned char *ract_data;
186 unsigned char *wact_data;
187 unsigned char *mac_data;
188 unsigned char *pad_data;
189
190 unsigned char *read_key;
191 unsigned char *write_key;
192
193 /* Stuff specifically to do with this SSL session */
194 unsigned int challenge_length;
195 unsigned char challenge[SSL2_MAX_CHALLENGE_LENGTH];
196 unsigned int conn_id_length;
197 unsigned char conn_id[SSL2_MAX_CONNECTION_ID_LENGTH];
198 unsigned int key_material_length;
199 unsigned char key_material[SSL2_MAX_KEY_MATERIAL_LENGTH*2];
200
201 unsigned long read_sequence;
202 unsigned long write_sequence;
203
204 struct {
205 unsigned int conn_id_length;
206 unsigned int cert_type;
207 unsigned int cert_length;
208 int csl;
209 int clear;
210 unsigned int enc;
211 unsigned char ccl[SSL2_MAX_CERT_CHALLENGE_LENGTH];
212 int cipher_spec_length;
213 unsigned int session_id_length;
214 unsigned int clen;
215 unsigned int rlen;
216 } tmp;
217 } SSL2_CTX;
218
219/* SSLv2 */
220/* client */
221#define SSL2_ST_SEND_CLIENT_HELLO_A (0x10|SSL_ST_CONNECT)
222#define SSL2_ST_SEND_CLIENT_HELLO_B (0x11|SSL_ST_CONNECT)
223#define SSL2_ST_GET_SERVER_HELLO_A (0x20|SSL_ST_CONNECT)
224#define SSL2_ST_GET_SERVER_HELLO_B (0x21|SSL_ST_CONNECT)
225#define SSL2_ST_SEND_CLIENT_MASTER_KEY_A (0x30|SSL_ST_CONNECT)
226#define SSL2_ST_SEND_CLIENT_MASTER_KEY_B (0x31|SSL_ST_CONNECT)
227#define SSL2_ST_SEND_CLIENT_FINISHED_A (0x40|SSL_ST_CONNECT)
228#define SSL2_ST_SEND_CLIENT_FINISHED_B (0x41|SSL_ST_CONNECT)
229#define SSL2_ST_SEND_CLIENT_CERTIFICATE_A (0x50|SSL_ST_CONNECT)
230#define SSL2_ST_SEND_CLIENT_CERTIFICATE_B (0x51|SSL_ST_CONNECT)
231#define SSL2_ST_SEND_CLIENT_CERTIFICATE_C (0x52|SSL_ST_CONNECT)
232#define SSL2_ST_SEND_CLIENT_CERTIFICATE_D (0x53|SSL_ST_CONNECT)
233#define SSL2_ST_GET_SERVER_VERIFY_A (0x60|SSL_ST_CONNECT)
234#define SSL2_ST_GET_SERVER_VERIFY_B (0x61|SSL_ST_CONNECT)
235#define SSL2_ST_GET_SERVER_FINISHED_A (0x70|SSL_ST_CONNECT)
236#define SSL2_ST_GET_SERVER_FINISHED_B (0x71|SSL_ST_CONNECT)
237#define SSL2_ST_CLIENT_START_ENCRYPTION (0x80|SSL_ST_CONNECT)
238#define SSL2_ST_X509_GET_CLIENT_CERTIFICATE (0x90|SSL_ST_CONNECT)
239/* server */
240#define SSL2_ST_GET_CLIENT_HELLO_A (0x10|SSL_ST_ACCEPT)
241#define SSL2_ST_GET_CLIENT_HELLO_B (0x11|SSL_ST_ACCEPT)
242#define SSL2_ST_GET_CLIENT_HELLO_C (0x12|SSL_ST_ACCEPT)
243#define SSL2_ST_SEND_SERVER_HELLO_A (0x20|SSL_ST_ACCEPT)
244#define SSL2_ST_SEND_SERVER_HELLO_B (0x21|SSL_ST_ACCEPT)
245#define SSL2_ST_GET_CLIENT_MASTER_KEY_A (0x30|SSL_ST_ACCEPT)
246#define SSL2_ST_GET_CLIENT_MASTER_KEY_B (0x31|SSL_ST_ACCEPT)
247#define SSL2_ST_SEND_SERVER_VERIFY_A (0x40|SSL_ST_ACCEPT)
248#define SSL2_ST_SEND_SERVER_VERIFY_B (0x41|SSL_ST_ACCEPT)
249#define SSL2_ST_SEND_SERVER_VERIFY_C (0x42|SSL_ST_ACCEPT)
250#define SSL2_ST_GET_CLIENT_FINISHED_A (0x50|SSL_ST_ACCEPT)
251#define SSL2_ST_GET_CLIENT_FINISHED_B (0x51|SSL_ST_ACCEPT)
252#define SSL2_ST_SEND_SERVER_FINISHED_A (0x60|SSL_ST_ACCEPT)
253#define SSL2_ST_SEND_SERVER_FINISHED_B (0x61|SSL_ST_ACCEPT)
254#define SSL2_ST_SEND_REQUEST_CERTIFICATE_A (0x70|SSL_ST_ACCEPT)
255#define SSL2_ST_SEND_REQUEST_CERTIFICATE_B (0x71|SSL_ST_ACCEPT)
256#define SSL2_ST_SEND_REQUEST_CERTIFICATE_C (0x72|SSL_ST_ACCEPT)
257#define SSL2_ST_SEND_REQUEST_CERTIFICATE_D (0x73|SSL_ST_ACCEPT)
258#define SSL2_ST_SERVER_START_ENCRYPTION (0x80|SSL_ST_ACCEPT)
259#define SSL2_ST_X509_GET_SERVER_CERTIFICATE (0x90|SSL_ST_ACCEPT)
260
261#ifdef __cplusplus
262}
263#endif
264#endif
265
diff --git a/src/lib/libssl/ssl23.h b/src/lib/libssl/ssl23.h
deleted file mode 100644
index d3228983c7..0000000000
--- a/src/lib/libssl/ssl23.h
+++ /dev/null
@@ -1,83 +0,0 @@
1/* ssl/ssl23.h */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_SSL23_H
60#define HEADER_SSL23_H
61
62#ifdef __cplusplus
63extern "C" {
64#endif
65
66/*client */
67/* write to server */
68#define SSL23_ST_CW_CLNT_HELLO_A (0x210|SSL_ST_CONNECT)
69#define SSL23_ST_CW_CLNT_HELLO_B (0x211|SSL_ST_CONNECT)
70/* read from server */
71#define SSL23_ST_CR_SRVR_HELLO_A (0x220|SSL_ST_CONNECT)
72#define SSL23_ST_CR_SRVR_HELLO_B (0x221|SSL_ST_CONNECT)
73
74/* server */
75/* read from client */
76#define SSL23_ST_SR_CLNT_HELLO_A (0x210|SSL_ST_ACCEPT)
77#define SSL23_ST_SR_CLNT_HELLO_B (0x211|SSL_ST_ACCEPT)
78
79#ifdef __cplusplus
80}
81#endif
82#endif
83
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
deleted file mode 100644
index 2a9714fc19..0000000000
--- a/src/lib/libssl/ssl3.h
+++ /dev/null
@@ -1,459 +0,0 @@
1/* ssl/ssl3.h */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_SSL3_H
60#define HEADER_SSL3_H
61
62#include <openssl/buffer.h>
63#include <openssl/evp.h>
64#include <openssl/ssl.h>
65
66#ifdef __cplusplus
67extern "C" {
68#endif
69
70#define SSL3_CK_RSA_NULL_MD5 0x03000001
71#define SSL3_CK_RSA_NULL_SHA 0x03000002
72#define SSL3_CK_RSA_RC4_40_MD5 0x03000003
73#define SSL3_CK_RSA_RC4_128_MD5 0x03000004
74#define SSL3_CK_RSA_RC4_128_SHA 0x03000005
75#define SSL3_CK_RSA_RC2_40_MD5 0x03000006
76#define SSL3_CK_RSA_IDEA_128_SHA 0x03000007
77#define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008
78#define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009
79#define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A
80
81#define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B
82#define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C
83#define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D
84#define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E
85#define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F
86#define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010
87
88#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011
89#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012
90#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013
91#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014
92#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015
93#define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016
94
95#define SSL3_CK_ADH_RC4_40_MD5 0x03000017
96#define SSL3_CK_ADH_RC4_128_MD5 0x03000018
97#define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019
98#define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A
99#define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B
100
101#define SSL3_CK_FZA_DMS_NULL_SHA 0x0300001C
102#define SSL3_CK_FZA_DMS_FZA_SHA 0x0300001D
103#define SSL3_CK_FZA_DMS_RC4_SHA 0x0300001E
104
105#define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5"
106#define SSL3_TXT_RSA_NULL_SHA "NULL-SHA"
107#define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5"
108#define SSL3_TXT_RSA_RC4_128_MD5 "RC4-MD5"
109#define SSL3_TXT_RSA_RC4_128_SHA "RC4-SHA"
110#define SSL3_TXT_RSA_RC2_40_MD5 "EXP-RC2-CBC-MD5"
111#define SSL3_TXT_RSA_IDEA_128_SHA "IDEA-CBC-SHA"
112#define SSL3_TXT_RSA_DES_40_CBC_SHA "EXP-DES-CBC-SHA"
113#define SSL3_TXT_RSA_DES_64_CBC_SHA "DES-CBC-SHA"
114#define SSL3_TXT_RSA_DES_192_CBC3_SHA "DES-CBC3-SHA"
115
116#define SSL3_TXT_DH_DSS_DES_40_CBC_SHA "EXP-DH-DSS-DES-CBC-SHA"
117#define SSL3_TXT_DH_DSS_DES_64_CBC_SHA "DH-DSS-DES-CBC-SHA"
118#define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA"
119#define SSL3_TXT_DH_RSA_DES_40_CBC_SHA "EXP-DH-RSA-DES-CBC-SHA"
120#define SSL3_TXT_DH_RSA_DES_64_CBC_SHA "DH-RSA-DES-CBC-SHA"
121#define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA"
122
123#define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA "EXP-EDH-DSS-DES-CBC-SHA"
124#define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA "EDH-DSS-DES-CBC-SHA"
125#define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA"
126#define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA "EXP-EDH-RSA-DES-CBC-SHA"
127#define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA "EDH-RSA-DES-CBC-SHA"
128#define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA"
129
130#define SSL3_TXT_ADH_RC4_40_MD5 "EXP-ADH-RC4-MD5"
131#define SSL3_TXT_ADH_RC4_128_MD5 "ADH-RC4-MD5"
132#define SSL3_TXT_ADH_DES_40_CBC_SHA "EXP-ADH-DES-CBC-SHA"
133#define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA"
134#define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA"
135
136#define SSL3_TXT_FZA_DMS_NULL_SHA "FZA-NULL-SHA"
137#define SSL3_TXT_FZA_DMS_FZA_SHA "FZA-FZA-CBC-SHA"
138#define SSL3_TXT_FZA_DMS_RC4_SHA "FZA-RC4-SHA"
139
140#define SSL3_SSL_SESSION_ID_LENGTH 32
141#define SSL3_MAX_SSL_SESSION_ID_LENGTH 32
142
143#define SSL3_MASTER_SECRET_SIZE 48
144#define SSL3_RANDOM_SIZE 32
145#define SSL3_SESSION_ID_SIZE 32
146#define SSL3_RT_HEADER_LENGTH 5
147
148/* Due to MS stuffing up, this can change.... */
149#if defined(WIN16) || (defined(MSDOS) && !defined(WIN32))
150#define SSL3_RT_MAX_EXTRA (14000)
151#else
152#define SSL3_RT_MAX_EXTRA (16384)
153#endif
154
155#define SSL3_RT_MAX_PLAIN_LENGTH 16384
156#define SSL3_RT_MAX_COMPRESSED_LENGTH (1024+SSL3_RT_MAX_PLAIN_LENGTH)
157#define SSL3_RT_MAX_ENCRYPTED_LENGTH (1024+SSL3_RT_MAX_COMPRESSED_LENGTH)
158#define SSL3_RT_MAX_PACKET_SIZE (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
159#define SSL3_RT_MAX_DATA_SIZE (1024*1024)
160
161/* the states that a SSL3_RECORD can be in
162 * For SSL_read it goes
163 * rbuf->ENCODED -> read
164 * ENCODED -> we need to decode everything - call decode_record
165 */
166
167#define SSL3_RS_BLANK 1
168#define SSL3_RS_DATA
169
170#define SSL3_RS_ENCODED 2
171#define SSL3_RS_READ_MORE 3
172#define SSL3_RS_WRITE_MORE
173#define SSL3_RS_PLAIN 3
174#define SSL3_RS_PART_READ 4
175#define SSL3_RS_PART_WRITE 5
176
177#define SSL3_MD_CLIENT_FINISHED_CONST {0x43,0x4C,0x4E,0x54}
178#define SSL3_MD_SERVER_FINISHED_CONST {0x53,0x52,0x56,0x52}
179
180#define SSL3_VERSION 0x0300
181#define SSL3_VERSION_MAJOR 0x03
182#define SSL3_VERSION_MINOR 0x00
183
184#define SSL3_RT_CHANGE_CIPHER_SPEC 20
185#define SSL3_RT_ALERT 21
186#define SSL3_RT_HANDSHAKE 22
187#define SSL3_RT_APPLICATION_DATA 23
188
189#define SSL3_AL_WARNING 1
190#define SSL3_AL_FATAL 2
191
192#define SSL3_AD_CLOSE_NOTIFY 0
193#define SSL3_AD_UNEXPECTED_MESSAGE 10 /* fatal */
194#define SSL3_AD_BAD_RECORD_MAC 20 /* fatal */
195#define SSL3_AD_DECOMPRESSION_FAILURE 30 /* fatal */
196#define SSL3_AD_HANDSHAKE_FAILURE 40 /* fatal */
197#define SSL3_AD_NO_CERTIFICATE 41
198#define SSL3_AD_BAD_CERTIFICATE 42
199#define SSL3_AD_UNSUPPORTED_CERTIFICATE 43
200#define SSL3_AD_CERTIFICATE_REVOKED 44
201#define SSL3_AD_CERTIFICATE_EXPIRED 45
202#define SSL3_AD_CERTIFICATE_UNKNOWN 46
203#define SSL3_AD_ILLEGAL_PARAMETER 47 /* fatal */
204
205typedef struct ssl3_record_st
206 {
207/*r */ int type; /* type of record */
208/* */ /*int state;*/ /* any data in it? */
209/*rw*/ unsigned int length; /* How many bytes available */
210/*r */ unsigned int off; /* read/write offset into 'buf' */
211/*rw*/ unsigned char *data; /* pointer to the record data */
212/*rw*/ unsigned char *input; /* where the decode bytes are */
213/*r */ unsigned char *comp; /* only used with decompression - malloc()ed */
214 } SSL3_RECORD;
215
216typedef struct ssl3_buffer_st
217 {
218/*r */ int total; /* used in non-blocking writes */
219/*r */ int wanted; /* how many more bytes we need */
220/*rw*/ int left; /* how many bytes left */
221/*rw*/ int offset; /* where to 'copy from' */
222/*rw*/ unsigned char *buf; /* SSL3_RT_MAX_PACKET_SIZE bytes */
223 } SSL3_BUFFER;
224
225#define SSL3_CT_RSA_SIGN 1
226#define SSL3_CT_DSS_SIGN 2
227#define SSL3_CT_RSA_FIXED_DH 3
228#define SSL3_CT_DSS_FIXED_DH 4
229#define SSL3_CT_RSA_EPHEMERAL_DH 5
230#define SSL3_CT_DSS_EPHEMERAL_DH 6
231#define SSL3_CT_FORTEZZA_DMS 20
232#define SSL3_CT_NUMBER 7
233
234#define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS 0x0001
235#define SSL3_FLAGS_DELAY_CLIENT_FINISHED 0x0002
236#define SSL3_FLAGS_POP_BUFFER 0x0004
237#define TLS1_FLAGS_TLS_PADDING_BUG 0x0008
238
239#if 0
240#define AD_CLOSE_NOTIFY 0
241#define AD_UNEXPECTED_MESSAGE 1
242#define AD_BAD_RECORD_MAC 2
243#define AD_DECRYPTION_FAILED 3
244#define AD_RECORD_OVERFLOW 4
245#define AD_DECOMPRESSION_FAILURE 5 /* fatal */
246#define AD_HANDSHAKE_FAILURE 6 /* fatal */
247#define AD_NO_CERTIFICATE 7 /* Not under TLS */
248#define AD_BAD_CERTIFICATE 8
249#define AD_UNSUPPORTED_CERTIFICATE 9
250#define AD_CERTIFICATE_REVOKED 10
251#define AD_CERTIFICATE_EXPIRED 11
252#define AD_CERTIFICATE_UNKNOWN 12
253#define AD_ILLEGAL_PARAMETER 13 /* fatal */
254#define AD_UNKNOWN_CA 14 /* fatal */
255#define AD_ACCESS_DENIED 15 /* fatal */
256#define AD_DECODE_ERROR 16 /* fatal */
257#define AD_DECRYPT_ERROR 17
258#define AD_EXPORT_RESTRICION 18 /* fatal */
259#define AD_PROTOCOL_VERSION 19 /* fatal */
260#define AD_INSUFFICIENT_SECURITY 20 /* fatal */
261#define AD_INTERNAL_ERROR 21 /* fatal */
262#define AD_USER_CANCLED 22
263#define AD_NO_RENEGOTIATION 23
264#endif
265
266typedef struct ssl3_ctx_st
267 {
268 long flags;
269 int delay_buf_pop_ret;
270
271 unsigned char read_sequence[8];
272 unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
273 unsigned char write_sequence[8];
274 unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
275
276 unsigned char server_random[SSL3_RANDOM_SIZE];
277 unsigned char client_random[SSL3_RANDOM_SIZE];
278
279 SSL3_BUFFER rbuf; /* read IO goes into here */
280 SSL3_BUFFER wbuf; /* write IO goes into here */
281 SSL3_RECORD rrec; /* each decoded record goes in here */
282 SSL3_RECORD wrec; /* goes out from here */
283 /* Used by ssl3_read_n to point
284 * to input data packet */
285
286 /* partial write - check the numbers match */
287 unsigned int wnum; /* number of bytes sent so far */
288 int wpend_tot; /* number bytes written */
289 int wpend_type;
290 int wpend_ret; /* number of bytes submitted */
291 const unsigned char *wpend_buf;
292
293 /* used during startup, digest all incoming/outgoing packets */
294 EVP_MD_CTX finish_dgst1;
295 EVP_MD_CTX finish_dgst2;
296
297 /* this is set whenerver we see a change_cipher_spec message
298 * come in when we are not looking for one */
299 int change_cipher_spec;
300
301 int warn_alert;
302 int fatal_alert;
303 /* we alow one fatal and one warning alert to be outstanding,
304 * send close alert via the warning alert */
305 int alert_dispatch;
306 unsigned char send_alert[2];
307
308 /* This flag is set when we should renegotiate ASAP, basically when
309 * there is no more data in the read or write buffers */
310 int renegotiate;
311 int total_renegotiations;
312 int num_renegotiations;
313
314 int in_read_app_data;
315
316 struct {
317 /* Actually only needs to be 16+20 for SSLv3 and 12 for TLS */
318 unsigned char finish_md[EVP_MAX_MD_SIZE*2];
319
320 unsigned long message_size;
321 int message_type;
322
323 /* used to hold the new cipher we are going to use */
324 SSL_CIPHER *new_cipher;
325#ifndef NO_DH
326 DH *dh;
327#endif
328 /* used when SSL_ST_FLUSH_DATA is entered */
329 int next_state;
330
331 int reuse_message;
332
333 /* used for certificate requests */
334 int cert_req;
335 int ctype_num;
336 char ctype[SSL3_CT_NUMBER];
337 STACK_OF(X509_NAME) *ca_names;
338
339 int use_rsa_tmp;
340
341 int key_block_length;
342 unsigned char *key_block;
343
344 const EVP_CIPHER *new_sym_enc;
345 const EVP_MD *new_hash;
346#ifdef HEADER_COMP_H
347 const SSL_COMP *new_compression;
348#else
349 char *new_compression;
350#endif
351 int cert_request;
352 } tmp;
353
354 } SSL3_CTX;
355
356/* SSLv3 */
357/*client */
358/* extra state */
359#define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT)
360/* write to server */
361#define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT)
362#define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT)
363/* read from server */
364#define SSL3_ST_CR_SRVR_HELLO_A (0x120|SSL_ST_CONNECT)
365#define SSL3_ST_CR_SRVR_HELLO_B (0x121|SSL_ST_CONNECT)
366#define SSL3_ST_CR_CERT_A (0x130|SSL_ST_CONNECT)
367#define SSL3_ST_CR_CERT_B (0x131|SSL_ST_CONNECT)
368#define SSL3_ST_CR_KEY_EXCH_A (0x140|SSL_ST_CONNECT)
369#define SSL3_ST_CR_KEY_EXCH_B (0x141|SSL_ST_CONNECT)
370#define SSL3_ST_CR_CERT_REQ_A (0x150|SSL_ST_CONNECT)
371#define SSL3_ST_CR_CERT_REQ_B (0x151|SSL_ST_CONNECT)
372#define SSL3_ST_CR_SRVR_DONE_A (0x160|SSL_ST_CONNECT)
373#define SSL3_ST_CR_SRVR_DONE_B (0x161|SSL_ST_CONNECT)
374/* write to server */
375#define SSL3_ST_CW_CERT_A (0x170|SSL_ST_CONNECT)
376#define SSL3_ST_CW_CERT_B (0x171|SSL_ST_CONNECT)
377#define SSL3_ST_CW_CERT_C (0x172|SSL_ST_CONNECT)
378#define SSL3_ST_CW_CERT_D (0x173|SSL_ST_CONNECT)
379#define SSL3_ST_CW_KEY_EXCH_A (0x180|SSL_ST_CONNECT)
380#define SSL3_ST_CW_KEY_EXCH_B (0x181|SSL_ST_CONNECT)
381#define SSL3_ST_CW_CERT_VRFY_A (0x190|SSL_ST_CONNECT)
382#define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT)
383#define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT)
384#define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT)
385#define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT)
386#define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT)
387/* read from server */
388#define SSL3_ST_CR_CHANGE_A (0x1C0|SSL_ST_CONNECT)
389#define SSL3_ST_CR_CHANGE_B (0x1C1|SSL_ST_CONNECT)
390#define SSL3_ST_CR_FINISHED_A (0x1D0|SSL_ST_CONNECT)
391#define SSL3_ST_CR_FINISHED_B (0x1D1|SSL_ST_CONNECT)
392
393/* server */
394/* extra state */
395#define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT)
396/* read from client */
397/* Do not change the number values, they do matter */
398#define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT)
399#define SSL3_ST_SR_CLNT_HELLO_B (0x111|SSL_ST_ACCEPT)
400#define SSL3_ST_SR_CLNT_HELLO_C (0x112|SSL_ST_ACCEPT)
401/* write to client */
402#define SSL3_ST_SW_HELLO_REQ_A (0x120|SSL_ST_ACCEPT)
403#define SSL3_ST_SW_HELLO_REQ_B (0x121|SSL_ST_ACCEPT)
404#define SSL3_ST_SW_HELLO_REQ_C (0x122|SSL_ST_ACCEPT)
405#define SSL3_ST_SW_SRVR_HELLO_A (0x130|SSL_ST_ACCEPT)
406#define SSL3_ST_SW_SRVR_HELLO_B (0x131|SSL_ST_ACCEPT)
407#define SSL3_ST_SW_CERT_A (0x140|SSL_ST_ACCEPT)
408#define SSL3_ST_SW_CERT_B (0x141|SSL_ST_ACCEPT)
409#define SSL3_ST_SW_KEY_EXCH_A (0x150|SSL_ST_ACCEPT)
410#define SSL3_ST_SW_KEY_EXCH_B (0x151|SSL_ST_ACCEPT)
411#define SSL3_ST_SW_CERT_REQ_A (0x160|SSL_ST_ACCEPT)
412#define SSL3_ST_SW_CERT_REQ_B (0x161|SSL_ST_ACCEPT)
413#define SSL3_ST_SW_SRVR_DONE_A (0x170|SSL_ST_ACCEPT)
414#define SSL3_ST_SW_SRVR_DONE_B (0x171|SSL_ST_ACCEPT)
415/* read from client */
416#define SSL3_ST_SR_CERT_A (0x180|SSL_ST_ACCEPT)
417#define SSL3_ST_SR_CERT_B (0x181|SSL_ST_ACCEPT)
418#define SSL3_ST_SR_KEY_EXCH_A (0x190|SSL_ST_ACCEPT)
419#define SSL3_ST_SR_KEY_EXCH_B (0x191|SSL_ST_ACCEPT)
420#define SSL3_ST_SR_CERT_VRFY_A (0x1A0|SSL_ST_ACCEPT)
421#define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT)
422#define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT)
423#define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT)
424#define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT)
425#define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT)
426/* write to client */
427#define SSL3_ST_SW_CHANGE_A (0x1D0|SSL_ST_ACCEPT)
428#define SSL3_ST_SW_CHANGE_B (0x1D1|SSL_ST_ACCEPT)
429#define SSL3_ST_SW_FINISHED_A (0x1E0|SSL_ST_ACCEPT)
430#define SSL3_ST_SW_FINISHED_B (0x1E1|SSL_ST_ACCEPT)
431
432#define SSL3_MT_CLIENT_REQUEST 0
433#define SSL3_MT_CLIENT_HELLO 1
434#define SSL3_MT_SERVER_HELLO 2
435#define SSL3_MT_CERTIFICATE 11
436#define SSL3_MT_SERVER_KEY_EXCHANGE 12
437#define SSL3_MT_CERTIFICATE_REQUEST 13
438#define SSL3_MT_SERVER_DONE 14
439#define SSL3_MT_CERTIFICATE_VERIFY 15
440#define SSL3_MT_CLIENT_KEY_EXCHANGE 16
441#define SSL3_MT_FINISHED 20
442
443#define SSL3_MT_CCS 1
444
445/* These are used when changing over to a new cipher */
446#define SSL3_CC_READ 0x01
447#define SSL3_CC_WRITE 0x02
448#define SSL3_CC_CLIENT 0x10
449#define SSL3_CC_SERVER 0x20
450#define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE)
451#define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER|SSL3_CC_READ)
452#define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT|SSL3_CC_READ)
453#define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE)
454
455#ifdef __cplusplus
456}
457#endif
458#endif
459
diff --git a/src/lib/libssl/ssl_algs.c b/src/lib/libssl/ssl_algs.c
deleted file mode 100644
index a91ee6d22e..0000000000
--- a/src/lib/libssl/ssl_algs.c
+++ /dev/null
@@ -1,103 +0,0 @@
1/* ssl/ssl_algs.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/objects.h>
61#include <openssl/lhash.h>
62#include "ssl_locl.h"
63
64int SSL_library_init(void)
65 {
66#ifndef NO_DES
67 EVP_add_cipher(EVP_des_cbc());
68 EVP_add_cipher(EVP_des_ede3_cbc());
69#endif
70#ifndef NO_IDEA
71 EVP_add_cipher(EVP_idea_cbc());
72#endif
73#ifndef NO_RC4
74 EVP_add_cipher(EVP_rc4());
75#endif
76#ifndef NO_RC2
77 EVP_add_cipher(EVP_rc2_cbc());
78#endif
79
80#ifndef NO_MD2
81 EVP_add_digest(EVP_md2());
82#endif
83#ifndef NO_MD5
84 EVP_add_digest(EVP_md5());
85 EVP_add_digest_alias(SN_md5,"ssl2-md5");
86 EVP_add_digest_alias(SN_md5,"ssl3-md5");
87#endif
88#ifndef NO_SHA
89 EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
90 EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
91#endif
92#if !defined(NO_SHA) && !defined(NO_DSA)
93 EVP_add_digest(EVP_dss1()); /* DSA with sha1 */
94#endif
95
96 /* If you want support for phased out ciphers, add the following */
97#if 0
98 EVP_add_digest(EVP_sha());
99 EVP_add_digest(EVP_dss());
100#endif
101 return(1);
102 }
103
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
deleted file mode 100644
index 0f6a0884e4..0000000000
--- a/src/lib/libssl/ssl_asn1.c
+++ /dev/null
@@ -1,327 +0,0 @@
1/* ssl/ssl_asn1.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <stdlib.h>
61#include <openssl/asn1_mac.h>
62#include <openssl/objects.h>
63#include "ssl_locl.h"
64
65typedef struct ssl_session_asn1_st
66 {
67 ASN1_INTEGER version;
68 ASN1_INTEGER ssl_version;
69 ASN1_OCTET_STRING cipher;
70 ASN1_OCTET_STRING master_key;
71 ASN1_OCTET_STRING session_id;
72 ASN1_OCTET_STRING session_id_context;
73 ASN1_OCTET_STRING key_arg;
74 ASN1_INTEGER time;
75 ASN1_INTEGER timeout;
76 } SSL_SESSION_ASN1;
77
78int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
79 {
80#define LSIZE2 (sizeof(long)*2)
81 int v1=0,v2=0,v3=0,v4=0;
82 unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2];
83 unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2];
84 long l;
85 SSL_SESSION_ASN1 a;
86 M_ASN1_I2D_vars(in);
87
88 if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
89 return(0);
90
91 /* Note that I cheat in the following 2 assignments. I know
92 * that if the ASN1_INTERGER passed to ASN1_INTEGER_set
93 * is > sizeof(long)+1, the buffer will not be re-Malloc()ed.
94 * This is a bit evil but makes things simple, no dynamic allocation
95 * to clean up :-) */
96 a.version.length=LSIZE2;
97 a.version.type=V_ASN1_INTEGER;
98 a.version.data=ibuf1;
99 ASN1_INTEGER_set(&(a.version),SSL_SESSION_ASN1_VERSION);
100
101 a.ssl_version.length=LSIZE2;
102 a.ssl_version.type=V_ASN1_INTEGER;
103 a.ssl_version.data=ibuf2;
104 ASN1_INTEGER_set(&(a.ssl_version),in->ssl_version);
105
106 a.cipher.type=V_ASN1_OCTET_STRING;
107 a.cipher.data=buf;
108
109 if (in->cipher == NULL)
110 l=in->cipher_id;
111 else
112 l=in->cipher->id;
113 if (in->ssl_version == SSL2_VERSION)
114 {
115 a.cipher.length=3;
116 buf[0]=((unsigned char)(l>>16L))&0xff;
117 buf[1]=((unsigned char)(l>> 8L))&0xff;
118 buf[2]=((unsigned char)(l ))&0xff;
119 }
120 else
121 {
122 a.cipher.length=2;
123 buf[0]=((unsigned char)(l>>8L))&0xff;
124 buf[1]=((unsigned char)(l ))&0xff;
125 }
126
127 a.master_key.length=in->master_key_length;
128 a.master_key.type=V_ASN1_OCTET_STRING;
129 a.master_key.data=in->master_key;
130
131 a.session_id.length=in->session_id_length;
132 a.session_id.type=V_ASN1_OCTET_STRING;
133 a.session_id.data=in->session_id;
134
135 a.session_id_context.length=in->sid_ctx_length;
136 a.session_id_context.type=V_ASN1_OCTET_STRING;
137 a.session_id_context.data=in->sid_ctx;
138
139 a.key_arg.length=in->key_arg_length;
140 a.key_arg.type=V_ASN1_OCTET_STRING;
141 a.key_arg.data=in->key_arg;
142
143 if (in->time != 0L)
144 {
145 a.time.length=LSIZE2;
146 a.time.type=V_ASN1_INTEGER;
147 a.time.data=ibuf3;
148 ASN1_INTEGER_set(&(a.time),in->time);
149 }
150
151 if (in->timeout != 0L)
152 {
153 a.timeout.length=LSIZE2;
154 a.timeout.type=V_ASN1_INTEGER;
155 a.timeout.data=ibuf4;
156 ASN1_INTEGER_set(&(a.timeout),in->timeout);
157 }
158
159 M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER);
160 M_ASN1_I2D_len(&(a.ssl_version), i2d_ASN1_INTEGER);
161 M_ASN1_I2D_len(&(a.cipher), i2d_ASN1_OCTET_STRING);
162 M_ASN1_I2D_len(&(a.session_id), i2d_ASN1_OCTET_STRING);
163 M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING);
164 if (in->key_arg_length > 0)
165 M_ASN1_I2D_len_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING);
166 if (in->time != 0L)
167 M_ASN1_I2D_len_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1);
168 if (in->timeout != 0L)
169 M_ASN1_I2D_len_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2);
170 if (in->peer != NULL)
171 M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3);
172 M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4);
173
174 M_ASN1_I2D_seq_total();
175
176 M_ASN1_I2D_put(&(a.version), i2d_ASN1_INTEGER);
177 M_ASN1_I2D_put(&(a.ssl_version), i2d_ASN1_INTEGER);
178 M_ASN1_I2D_put(&(a.cipher), i2d_ASN1_OCTET_STRING);
179 M_ASN1_I2D_put(&(a.session_id), i2d_ASN1_OCTET_STRING);
180 M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING);
181 if (in->key_arg_length > 0)
182 M_ASN1_I2D_put_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING,0);
183 if (in->time != 0L)
184 M_ASN1_I2D_put_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1);
185 if (in->timeout != 0L)
186 M_ASN1_I2D_put_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2);
187 if (in->peer != NULL)
188 M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3);
189 M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,
190 v4);
191
192 M_ASN1_I2D_finish();
193 }
194
195SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp,
196 long length)
197 {
198 int version,ssl_version=0,i;
199 long id;
200 ASN1_INTEGER ai,*aip;
201 ASN1_OCTET_STRING os,*osp;
202 M_ASN1_D2I_vars(a,SSL_SESSION *,SSL_SESSION_new);
203
204 aip= &ai;
205 osp= &os;
206
207 M_ASN1_D2I_Init();
208 M_ASN1_D2I_start_sequence();
209
210 ai.data=NULL; ai.length=0;
211 M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
212 version=(int)ASN1_INTEGER_get(aip);
213 if (ai.data != NULL) { Free(ai.data); ai.data=NULL; ai.length=0; }
214
215 /* we don't care about the version right now :-) */
216 M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
217 ssl_version=(int)ASN1_INTEGER_get(aip);
218 ret->ssl_version=ssl_version;
219 if (ai.data != NULL) { Free(ai.data); ai.data=NULL; ai.length=0; }
220
221 os.data=NULL; os.length=0;
222 M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
223 if (ssl_version == SSL2_VERSION)
224 {
225 if (os.length != 3)
226 {
227 c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH;
228 goto err;
229 }
230 id=0x02000000L|
231 ((unsigned long)os.data[0]<<16L)|
232 ((unsigned long)os.data[1]<< 8L)|
233 (unsigned long)os.data[2];
234 }
235 else if ((ssl_version>>8) == 3)
236 {
237 if (os.length != 2)
238 {
239 c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH;
240 goto err;
241 }
242 id=0x03000000L|
243 ((unsigned long)os.data[0]<<8L)|
244 (unsigned long)os.data[1];
245 }
246 else
247 {
248 SSLerr(SSL_F_D2I_SSL_SESSION,SSL_R_UNKNOWN_SSL_VERSION);
249 return(NULL);
250 }
251
252 ret->cipher=NULL;
253 ret->cipher_id=id;
254
255 M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
256 if ((ssl_version>>8) == SSL3_VERSION)
257 i=SSL3_MAX_SSL_SESSION_ID_LENGTH;
258 else /* if (ssl_version == SSL2_VERSION) */
259 i=SSL2_MAX_SSL_SESSION_ID_LENGTH;
260
261 if (os.length > i)
262 os.length=i;
263
264 ret->session_id_length=os.length;
265 memcpy(ret->session_id,os.data,os.length);
266
267 M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
268 if (ret->master_key_length > SSL_MAX_MASTER_KEY_LENGTH)
269 ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
270 else
271 ret->master_key_length=os.length;
272 memcpy(ret->master_key,os.data,ret->master_key_length);
273
274 os.length=0;
275 M_ASN1_D2I_get_IMP_opt(osp,d2i_ASN1_OCTET_STRING,0,V_ASN1_OCTET_STRING);
276 if (os.length > SSL_MAX_KEY_ARG_LENGTH)
277 ret->key_arg_length=SSL_MAX_KEY_ARG_LENGTH;
278 else
279 ret->key_arg_length=os.length;
280 memcpy(ret->key_arg,os.data,ret->key_arg_length);
281 if (os.data != NULL) Free(os.data);
282
283 ai.length=0;
284 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,1);
285 if (ai.data != NULL)
286 {
287 ret->time=ASN1_INTEGER_get(aip);
288 Free(ai.data); ai.data=NULL; ai.length=0;
289 }
290 else
291 ret->time=time(NULL);
292
293 ai.length=0;
294 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,2);
295 if (ai.data != NULL)
296 {
297 ret->timeout=ASN1_INTEGER_get(aip);
298 Free(ai.data); ai.data=NULL; ai.length=0;
299 }
300 else
301 ret->timeout=3;
302
303 if (ret->peer != NULL)
304 {
305 X509_free(ret->peer);
306 ret->peer=NULL;
307 }
308 M_ASN1_D2I_get_EXP_opt(ret->peer,d2i_X509,3);
309
310 os.length=0;
311 os.data=NULL;
312 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,4);
313
314 if(os.data != NULL)
315 {
316 if (os.length > SSL_MAX_SID_CTX_LENGTH)
317 SSLerr(SSL_F_D2I_SSL_SESSION,SSL_R_BAD_LENGTH);
318 ret->sid_ctx_length=os.length;
319 memcpy(ret->sid_ctx,os.data,os.length);
320 Free(os.data); os.data=NULL; os.length=0;
321 }
322 else
323 ret->sid_ctx_length=0;
324
325 M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION);
326 }
327
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
deleted file mode 100644
index 6d2511f76c..0000000000
--- a/src/lib/libssl/ssl_cert.c
+++ /dev/null
@@ -1,716 +0,0 @@
1/*! \file ssl/ssl_cert.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58/* ====================================================================
59 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@OpenSSL.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 */
106
107#include <stdio.h>
108#include <sys/types.h>
109#if !defined(WIN32) && !defined(VSM) && !defined(NeXT)
110#include <dirent.h>
111#endif
112#ifdef NeXT
113#include <sys/dir.h>
114#define dirent direct
115#endif
116#include <openssl/objects.h>
117#include <openssl/bio.h>
118#include <openssl/pem.h>
119#include "ssl_locl.h"
120
121int SSL_get_ex_data_X509_STORE_CTX_idx(void)
122 {
123 static int ssl_x509_store_ctx_idx= -1;
124
125 if (ssl_x509_store_ctx_idx < 0)
126 {
127 ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index(
128 0,"SSL for verify callback",NULL,NULL,NULL);
129 }
130 return(ssl_x509_store_ctx_idx);
131 }
132
133CERT *ssl_cert_new(void)
134 {
135 CERT *ret;
136
137 ret=(CERT *)Malloc(sizeof(CERT));
138 if (ret == NULL)
139 {
140 SSLerr(SSL_F_SSL_CERT_NEW,ERR_R_MALLOC_FAILURE);
141 return(NULL);
142 }
143 memset(ret,0,sizeof(CERT));
144
145 ret->key= &(ret->pkeys[SSL_PKEY_RSA_ENC]);
146 ret->references=1;
147
148 return(ret);
149 }
150
151CERT *ssl_cert_dup(CERT *cert)
152 {
153 CERT *ret;
154 int i;
155
156 ret = (CERT *)Malloc(sizeof(CERT));
157 if (ret == NULL)
158 {
159 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
160 return(NULL);
161 }
162
163 memset(ret, 0, sizeof(CERT));
164
165 ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];
166 /* or ret->key = ret->pkeys + (cert->key - cert->pkeys),
167 * if you find that more readable */
168
169 ret->valid = cert->valid;
170 ret->mask = cert->mask;
171 ret->export_mask = cert->export_mask;
172
173#ifndef NO_RSA
174 if (cert->rsa_tmp != NULL)
175 {
176 ret->rsa_tmp = cert->rsa_tmp;
177 CRYPTO_add(&ret->rsa_tmp->references, 1, CRYPTO_LOCK_RSA);
178 }
179 ret->rsa_tmp_cb = cert->rsa_tmp_cb;
180#endif
181
182#ifndef NO_DH
183 if (cert->dh_tmp != NULL)
184 {
185 /* DH parameters don't have a reference count (and cannot
186 * reasonably be shared anyway, as the secret exponent may
187 * be created just when it is needed -- earlier library
188 * versions did not pay attention to this) */
189 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
190 if (ret->dh_tmp == NULL)
191 {
192 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_DH_LIB);
193 goto err;
194 }
195 }
196 ret->dh_tmp_cb = cert->dh_tmp_cb;
197#endif
198
199 for (i = 0; i < SSL_PKEY_NUM; i++)
200 {
201 if (cert->pkeys[i].x509 != NULL)
202 {
203 ret->pkeys[i].x509 = cert->pkeys[i].x509;
204 CRYPTO_add(&ret->pkeys[i].x509->references, 1,
205 CRYPTO_LOCK_X509);
206 }
207
208 if (cert->pkeys[i].privatekey != NULL)
209 {
210 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey;
211 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1,
212 CRYPTO_LOCK_EVP_PKEY);
213
214 switch(i)
215 {
216 /* If there was anything special to do for
217 * certain types of keys, we'd do it here.
218 * (Nothing at the moment, I think.) */
219
220 case SSL_PKEY_RSA_ENC:
221 case SSL_PKEY_RSA_SIGN:
222 /* We have an RSA key. */
223 break;
224
225 case SSL_PKEY_DSA_SIGN:
226 /* We have a DSA key. */
227 break;
228
229 case SSL_PKEY_DH_RSA:
230 case SSL_PKEY_DH_DSA:
231 /* We have a DH key. */
232 break;
233
234 default:
235 /* Can't happen. */
236 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG);
237 }
238 }
239 }
240
241 /* ret->extra_certs *should* exist, but currently the own certificate
242 * chain is held inside SSL_CTX */
243
244 ret->references=1;
245
246 return(ret);
247
248err:
249#ifndef NO_RSA
250 if (ret->rsa_tmp != NULL)
251 RSA_free(ret->rsa_tmp);
252#endif
253#ifndef NO_DH
254 if (ret->dh_tmp != NULL)
255 DH_free(ret->dh_tmp);
256#endif
257
258 for (i = 0; i < SSL_PKEY_NUM; i++)
259 {
260 if (ret->pkeys[i].x509 != NULL)
261 X509_free(ret->pkeys[i].x509);
262 if (ret->pkeys[i].privatekey != NULL)
263 EVP_PKEY_free(ret->pkeys[i].privatekey);
264 }
265
266 return NULL;
267 }
268
269
270void ssl_cert_free(CERT *c)
271 {
272 int i;
273
274 if(c == NULL)
275 return;
276
277 i=CRYPTO_add(&c->references,-1,CRYPTO_LOCK_SSL_CERT);
278#ifdef REF_PRINT
279 REF_PRINT("CERT",c);
280#endif
281 if (i > 0) return;
282#ifdef REF_CHECK
283 if (i < 0)
284 {
285 fprintf(stderr,"ssl_cert_free, bad reference count\n");
286 abort(); /* ok */
287 }
288#endif
289
290#ifndef NO_RSA
291 if (c->rsa_tmp) RSA_free(c->rsa_tmp);
292#endif
293#ifndef NO_DH
294 if (c->dh_tmp) DH_free(c->dh_tmp);
295#endif
296
297 for (i=0; i<SSL_PKEY_NUM; i++)
298 {
299 if (c->pkeys[i].x509 != NULL)
300 X509_free(c->pkeys[i].x509);
301 if (c->pkeys[i].privatekey != NULL)
302 EVP_PKEY_free(c->pkeys[i].privatekey);
303#if 0
304 if (c->pkeys[i].publickey != NULL)
305 EVP_PKEY_free(c->pkeys[i].publickey);
306#endif
307 }
308 Free(c);
309 }
310
311int ssl_cert_inst(CERT **o)
312 {
313 /* Create a CERT if there isn't already one
314 * (which cannot really happen, as it is initially created in
315 * SSL_CTX_new; but the earlier code usually allows for that one
316 * being non-existant, so we follow that behaviour, as it might
317 * turn out that there actually is a reason for it -- but I'm
318 * not sure that *all* of the existing code could cope with
319 * s->cert being NULL, otherwise we could do without the
320 * initialization in SSL_CTX_new).
321 */
322
323 if (o == NULL)
324 {
325 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER);
326 return(0);
327 }
328 if (*o == NULL)
329 {
330 if ((*o = ssl_cert_new()) == NULL)
331 {
332 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE);
333 return(0);
334 }
335 }
336 return(1);
337 }
338
339
340SESS_CERT *ssl_sess_cert_new(void)
341 {
342 SESS_CERT *ret;
343
344 ret = Malloc(sizeof *ret);
345 if (ret == NULL)
346 {
347 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
348 return NULL;
349 }
350
351 memset(ret, 0 ,sizeof *ret);
352 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
353 ret->references = 1;
354
355 return ret;
356 }
357
358void ssl_sess_cert_free(SESS_CERT *sc)
359 {
360 int i;
361
362 if (sc == NULL)
363 return;
364
365 i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT);
366#ifdef REF_PRINT
367 REF_PRINT("SESS_CERT", sc);
368#endif
369 if (i > 0)
370 return;
371#ifdef REF_CHECK
372 if (i < 0)
373 {
374 fprintf(stderr,"ssl_sess_cert_free, bad reference count\n");
375 abort(); /* ok */
376 }
377#endif
378
379 /* i == 0 */
380 if (sc->cert_chain != NULL)
381 sk_X509_pop_free(sc->cert_chain, X509_free);
382 for (i = 0; i < SSL_PKEY_NUM; i++)
383 {
384 if (sc->peer_pkeys[i].x509 != NULL)
385 X509_free(sc->peer_pkeys[i].x509);
386#if 0 /* We don't have the peer's private key. These lines are just
387 * here as a reminder that we're still using a not-quite-appropriate
388 * data structure. */
389 if (sc->peer_pkeys[i].privatekey != NULL)
390 EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
391#endif
392 }
393
394#ifndef NO_RSA
395 if (sc->peer_rsa_tmp != NULL)
396 RSA_free(sc->peer_rsa_tmp);
397#endif
398#ifndef NO_DH
399 if (sc->peer_dh_tmp != NULL)
400 DH_free(sc->peer_dh_tmp);
401#endif
402
403 Free(sc);
404 }
405
406int ssl_set_peer_cert_type(SESS_CERT *sc,int type)
407 {
408 sc->peer_cert_type = type;
409 return(1);
410 }
411
412int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
413 {
414 X509 *x;
415 int i;
416 X509_STORE_CTX ctx;
417
418 if ((sk == NULL) || (sk_X509_num(sk) == 0))
419 return(0);
420
421 x=sk_X509_value(sk,0);
422 X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk);
423 if (SSL_get_verify_depth(s) >= 0)
424 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
425 X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),
426 (char *)s);
427
428 if (s->ctx->app_verify_callback != NULL)
429 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
430 else
431 {
432#ifndef NO_X509_VERIFY
433 i=X509_verify_cert(&ctx);
434#else
435 i=0;
436 ctx.error=X509_V_ERR_APPLICATION_VERIFICATION;
437 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,SSL_R_NO_VERIFY_CALLBACK);
438#endif
439 }
440
441 s->verify_result=ctx.error;
442 X509_STORE_CTX_cleanup(&ctx);
443
444 return(i);
445 }
446
447static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *list)
448 {
449 if (*ca_list != NULL)
450 sk_X509_NAME_pop_free(*ca_list,X509_NAME_free);
451
452 *ca_list=list;
453 }
454
455STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
456 {
457 int i;
458 STACK_OF(X509_NAME) *ret;
459 X509_NAME *name;
460
461 ret=sk_X509_NAME_new_null();
462 for (i=0; i<sk_X509_NAME_num(sk); i++)
463 {
464 name=X509_NAME_dup(sk_X509_NAME_value(sk,i));
465 if ((name == NULL) || !sk_X509_NAME_push(ret,name))
466 {
467 sk_X509_NAME_pop_free(ret,X509_NAME_free);
468 return(NULL);
469 }
470 }
471 return(ret);
472 }
473
474void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *list)
475 {
476 set_client_CA_list(&(s->client_CA),list);
477 }
478
479void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *list)
480 {
481 set_client_CA_list(&(ctx->client_CA),list);
482 }
483
484STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(SSL_CTX *ctx)
485 {
486 return(ctx->client_CA);
487 }
488
489STACK_OF(X509_NAME) *SSL_get_client_CA_list(SSL *s)
490 {
491 if (s->type == SSL_ST_CONNECT)
492 { /* we are in the client */
493 if (((s->version>>8) == SSL3_VERSION_MAJOR) &&
494 (s->s3 != NULL))
495 return(s->s3->tmp.ca_names);
496 else
497 return(NULL);
498 }
499 else
500 {
501 if (s->client_CA != NULL)
502 return(s->client_CA);
503 else
504 return(s->ctx->client_CA);
505 }
506 }
507
508static int add_client_CA(STACK_OF(X509_NAME) **sk,X509 *x)
509 {
510 X509_NAME *name;
511
512 if (x == NULL) return(0);
513 if ((*sk == NULL) && ((*sk=sk_X509_NAME_new_null()) == NULL))
514 return(0);
515
516 if ((name=X509_NAME_dup(X509_get_subject_name(x))) == NULL)
517 return(0);
518
519 if (!sk_X509_NAME_push(*sk,name))
520 {
521 X509_NAME_free(name);
522 return(0);
523 }
524 return(1);
525 }
526
527int SSL_add_client_CA(SSL *ssl,X509 *x)
528 {
529 return(add_client_CA(&(ssl->client_CA),x));
530 }
531
532int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x)
533 {
534 return(add_client_CA(&(ctx->client_CA),x));
535 }
536
537static int name_cmp(X509_NAME **a,X509_NAME **b)
538 {
539 return(X509_NAME_cmp(*a,*b));
540 }
541
542#ifndef NO_STDIO
543/*!
544 * Load CA certs from a file into a ::STACK. Note that it is somewhat misnamed;
545 * it doesn't really have anything to do with clients (except that a common use
546 * for a stack of CAs is to send it to the client). Actually, it doesn't have
547 * much to do with CAs, either, since it will load any old cert.
548 * \param file the file containing one or more certs.
549 * \return a ::STACK containing the certs.
550 */
551STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
552 {
553 BIO *in;
554 X509 *x=NULL;
555 X509_NAME *xn=NULL;
556 STACK_OF(X509_NAME) *ret,*sk;
557
558 ret=sk_X509_NAME_new(NULL);
559 sk=sk_X509_NAME_new(name_cmp);
560
561 in=BIO_new(BIO_s_file_internal());
562
563 if ((ret == NULL) || (sk == NULL) || (in == NULL))
564 {
565 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
566 goto err;
567 }
568
569 if (!BIO_read_filename(in,file))
570 goto err;
571
572 for (;;)
573 {
574 if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
575 break;
576 if ((xn=X509_get_subject_name(x)) == NULL) goto err;
577 /* check for duplicates */
578 xn=X509_NAME_dup(xn);
579 if (xn == NULL) goto err;
580 if (sk_X509_NAME_find(sk,xn) >= 0)
581 X509_NAME_free(xn);
582 else
583 {
584 sk_X509_NAME_push(sk,xn);
585 sk_X509_NAME_push(ret,xn);
586 }
587 }
588
589 if (0)
590 {
591err:
592 if (ret != NULL) sk_X509_NAME_pop_free(ret,X509_NAME_free);
593 ret=NULL;
594 }
595 if (sk != NULL) sk_X509_NAME_free(sk);
596 if (in != NULL) BIO_free(in);
597 if (x != NULL) X509_free(x);
598 return(ret);
599 }
600#endif
601
602/*!
603 * Add a file of certs to a stack.
604 * \param stack the stack to add to.
605 * \param file the file to add from. All certs in this file that are not
606 * already in the stack will be added.
607 * \return 1 for success, 0 for failure. Note that in the case of failure some
608 * certs may have been added to \c stack.
609 */
610
611int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
612 const char *file)
613 {
614 BIO *in;
615 X509 *x=NULL;
616 X509_NAME *xn=NULL;
617 int ret=1;
618 int (*oldcmp)(X509_NAME **a, X509_NAME **b);
619
620 oldcmp=sk_X509_NAME_set_cmp_func(stack,name_cmp);
621
622 in=BIO_new(BIO_s_file_internal());
623
624 if (in == NULL)
625 {
626 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE);
627 goto err;
628 }
629
630 if (!BIO_read_filename(in,file))
631 goto err;
632
633 for (;;)
634 {
635 if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
636 break;
637 if ((xn=X509_get_subject_name(x)) == NULL) goto err;
638 xn=X509_NAME_dup(xn);
639 if (xn == NULL) goto err;
640 if (sk_X509_NAME_find(stack,xn) >= 0)
641 X509_NAME_free(xn);
642 else
643 sk_X509_NAME_push(stack,xn);
644 }
645
646 if (0)
647 {
648err:
649 ret=0;
650 }
651 if(in != NULL)
652 BIO_free(in);
653 if(x != NULL)
654 X509_free(x);
655
656 sk_X509_NAME_set_cmp_func(stack,oldcmp);
657
658 return ret;
659 }
660
661/*!
662 * Add a directory of certs to a stack.
663 * \param stack the stack to append to.
664 * \param dir the directory to append from. All files in this directory will be
665 * examined as potential certs. Any that are acceptable to
666 * SSL_add_dir_cert_subjects_to_stack() that are not already in the stack will be
667 * included.
668 * \return 1 for success, 0 for failure. Note that in the case of failure some
669 * certs may have been added to \c stack.
670 */
671
672#ifndef WIN32
673#ifndef VMS /* XXXX This may be fixed in the future */
674
675int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
676 const char *dir)
677 {
678 DIR *d;
679 struct dirent *dstruct;
680 int ret = 0;
681
682 CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
683 d = opendir(dir);
684
685 /* Note that a side effect is that the CAs will be sorted by name */
686 if(!d)
687 {
688 SYSerr(SYS_F_OPENDIR, get_last_sys_error());
689 ERR_add_error_data(3, "opendir('", dir, "')");
690 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
691 goto err;
692 }
693
694 while((dstruct=readdir(d)))
695 {
696 char buf[1024];
697
698 if(strlen(dir)+strlen(dstruct->d_name)+2 > sizeof buf)
699 {
700 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
701 goto err;
702 }
703
704 sprintf(buf,"%s/%s",dir,dstruct->d_name);
705 if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
706 goto err;
707 }
708 ret = 1;
709
710err:
711 CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
712 return ret;
713 }
714
715#endif
716#endif
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
deleted file mode 100644
index 4c2989c47a..0000000000
--- a/src/lib/libssl/ssl_ciph.c
+++ /dev/null
@@ -1,835 +0,0 @@
1/* ssl/ssl_ciph.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/objects.h>
61#include <openssl/comp.h>
62#include "ssl_locl.h"
63
64#define SSL_ENC_DES_IDX 0
65#define SSL_ENC_3DES_IDX 1
66#define SSL_ENC_RC4_IDX 2
67#define SSL_ENC_RC2_IDX 3
68#define SSL_ENC_IDEA_IDX 4
69#define SSL_ENC_eFZA_IDX 5
70#define SSL_ENC_NULL_IDX 6
71#define SSL_ENC_NUM_IDX 7
72
73static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
74 NULL,NULL,NULL,NULL,NULL,NULL,
75 };
76
77static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
78
79#define SSL_MD_MD5_IDX 0
80#define SSL_MD_SHA1_IDX 1
81#define SSL_MD_NUM_IDX 2
82static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={
83 NULL,NULL,
84 };
85
86typedef struct cipher_sort_st
87 {
88 SSL_CIPHER *cipher;
89 int pref;
90 } CIPHER_SORT;
91
92#define CIPHER_ADD 1
93#define CIPHER_KILL 2
94#define CIPHER_DEL 3
95#define CIPHER_ORD 4
96
97typedef struct cipher_choice_st
98 {
99 int type;
100 unsigned long algorithms;
101 unsigned long mask;
102 long top;
103 } CIPHER_CHOICE;
104
105typedef struct cipher_order_st
106 {
107 SSL_CIPHER *cipher;
108 int active;
109 int dead;
110 struct cipher_order_st *next,*prev;
111 } CIPHER_ORDER;
112
113static SSL_CIPHER cipher_aliases[]={
114 /* Don't include eNULL unless specifically enabled */
115 {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, 0,SSL_ALL}, /* must be first */
116 {0,SSL_TXT_kRSA,0,SSL_kRSA, 0,SSL_MKEY_MASK},
117 {0,SSL_TXT_kDHr,0,SSL_kDHr, 0,SSL_MKEY_MASK},
118 {0,SSL_TXT_kDHd,0,SSL_kDHd, 0,SSL_MKEY_MASK},
119 {0,SSL_TXT_kEDH,0,SSL_kEDH, 0,SSL_MKEY_MASK},
120 {0,SSL_TXT_kFZA,0,SSL_kFZA, 0,SSL_MKEY_MASK},
121 {0,SSL_TXT_DH, 0,SSL_DH, 0,SSL_MKEY_MASK},
122 {0,SSL_TXT_EDH, 0,SSL_EDH, 0,SSL_MKEY_MASK|SSL_AUTH_MASK},
123
124 {0,SSL_TXT_aRSA,0,SSL_aRSA, 0,SSL_AUTH_MASK},
125 {0,SSL_TXT_aDSS,0,SSL_aDSS, 0,SSL_AUTH_MASK},
126 {0,SSL_TXT_aFZA,0,SSL_aFZA, 0,SSL_AUTH_MASK},
127 {0,SSL_TXT_aNULL,0,SSL_aNULL,0,SSL_AUTH_MASK},
128 {0,SSL_TXT_aDH, 0,SSL_aDH, 0,SSL_AUTH_MASK},
129 {0,SSL_TXT_DSS, 0,SSL_DSS, 0,SSL_AUTH_MASK},
130
131 {0,SSL_TXT_DES, 0,SSL_DES, 0,SSL_ENC_MASK},
132 {0,SSL_TXT_3DES,0,SSL_3DES, 0,SSL_ENC_MASK},
133 {0,SSL_TXT_RC4, 0,SSL_RC4, 0,SSL_ENC_MASK},
134 {0,SSL_TXT_RC2, 0,SSL_RC2, 0,SSL_ENC_MASK},
135 {0,SSL_TXT_IDEA,0,SSL_IDEA, 0,SSL_ENC_MASK},
136 {0,SSL_TXT_eNULL,0,SSL_eNULL,0,SSL_ENC_MASK},
137 {0,SSL_TXT_eFZA,0,SSL_eFZA, 0,SSL_ENC_MASK},
138
139 {0,SSL_TXT_MD5, 0,SSL_MD5, 0,SSL_MAC_MASK},
140 {0,SSL_TXT_SHA1,0,SSL_SHA1, 0,SSL_MAC_MASK},
141 {0,SSL_TXT_SHA, 0,SSL_SHA, 0,SSL_MAC_MASK},
142
143 {0,SSL_TXT_NULL,0,SSL_NULL, 0,SSL_ENC_MASK},
144 {0,SSL_TXT_RSA, 0,SSL_RSA, 0,SSL_AUTH_MASK|SSL_MKEY_MASK},
145 {0,SSL_TXT_ADH, 0,SSL_ADH, 0,SSL_AUTH_MASK|SSL_MKEY_MASK},
146 {0,SSL_TXT_FZA, 0,SSL_FZA, 0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK},
147
148 {0,SSL_TXT_EXP40, 0,SSL_EXP40, 0,SSL_EXP_MASK},
149 {0,SSL_TXT_EXPORT,0,SSL_EXP40, 0,SSL_EXP_MASK},
150 {0,SSL_TXT_EXP56, 0,SSL_EXP56, 0,SSL_EXP_MASK},
151 {0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,SSL_SSL_MASK},
152 {0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,SSL_SSL_MASK},
153 {0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,SSL_SSL_MASK},
154 {0,SSL_TXT_LOW, 0,SSL_LOW, 0,SSL_STRONG_MASK},
155 {0,SSL_TXT_MEDIUM,0,SSL_MEDIUM,0,SSL_STRONG_MASK},
156 {0,SSL_TXT_HIGH, 0,SSL_HIGH, 0,SSL_STRONG_MASK},
157 };
158
159static int init_ciphers=1;
160static void load_ciphers();
161
162static int cmp_by_name(SSL_CIPHER **a, SSL_CIPHER **b)
163 {
164 return(strcmp((*a)->name,(*b)->name));
165 }
166
167static void load_ciphers(void)
168 {
169 init_ciphers=0;
170 ssl_cipher_methods[SSL_ENC_DES_IDX]=
171 EVP_get_cipherbyname(SN_des_cbc);
172 ssl_cipher_methods[SSL_ENC_3DES_IDX]=
173 EVP_get_cipherbyname(SN_des_ede3_cbc);
174 ssl_cipher_methods[SSL_ENC_RC4_IDX]=
175 EVP_get_cipherbyname(SN_rc4);
176 ssl_cipher_methods[SSL_ENC_RC2_IDX]=
177 EVP_get_cipherbyname(SN_rc2_cbc);
178 ssl_cipher_methods[SSL_ENC_IDEA_IDX]=
179 EVP_get_cipherbyname(SN_idea_cbc);
180
181 ssl_digest_methods[SSL_MD_MD5_IDX]=
182 EVP_get_digestbyname(SN_md5);
183 ssl_digest_methods[SSL_MD_SHA1_IDX]=
184 EVP_get_digestbyname(SN_sha1);
185 }
186
187int ssl_cipher_get_evp(SSL_SESSION *s, const EVP_CIPHER **enc,
188 const EVP_MD **md, SSL_COMP **comp)
189 {
190 int i;
191 SSL_CIPHER *c;
192
193 c=s->cipher;
194 if (c == NULL) return(0);
195 if (comp != NULL)
196 {
197 SSL_COMP ctmp;
198
199 if (s->compress_meth == 0)
200 *comp=NULL;
201 else if (ssl_comp_methods == NULL)
202 {
203 /* bad */
204 *comp=NULL;
205 }
206 else
207 {
208
209 ctmp.id=s->compress_meth;
210 i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
211 if (i >= 0)
212 *comp=sk_SSL_COMP_value(ssl_comp_methods,i);
213 else
214 *comp=NULL;
215 }
216 }
217
218 if ((enc == NULL) || (md == NULL)) return(0);
219
220 switch (c->algorithms & SSL_ENC_MASK)
221 {
222 case SSL_DES:
223 i=SSL_ENC_DES_IDX;
224 break;
225 case SSL_3DES:
226 i=SSL_ENC_3DES_IDX;
227 break;
228 case SSL_RC4:
229 i=SSL_ENC_RC4_IDX;
230 break;
231 case SSL_RC2:
232 i=SSL_ENC_RC2_IDX;
233 break;
234 case SSL_IDEA:
235 i=SSL_ENC_IDEA_IDX;
236 break;
237 case SSL_eNULL:
238 i=SSL_ENC_NULL_IDX;
239 break;
240 default:
241 i= -1;
242 break;
243 }
244
245 if ((i < 0) || (i > SSL_ENC_NUM_IDX))
246 *enc=NULL;
247 else
248 {
249 if (i == SSL_ENC_NULL_IDX)
250 *enc=EVP_enc_null();
251 else
252 *enc=ssl_cipher_methods[i];
253 }
254
255 switch (c->algorithms & SSL_MAC_MASK)
256 {
257 case SSL_MD5:
258 i=SSL_MD_MD5_IDX;
259 break;
260 case SSL_SHA1:
261 i=SSL_MD_SHA1_IDX;
262 break;
263 default:
264 i= -1;
265 break;
266 }
267 if ((i < 0) || (i > SSL_MD_NUM_IDX))
268 *md=NULL;
269 else
270 *md=ssl_digest_methods[i];
271
272 if ((*enc != NULL) && (*md != NULL))
273 return(1);
274 else
275 return(0);
276 }
277
278#define ITEM_SEP(a) \
279 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))
280
281static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
282 CIPHER_ORDER **tail)
283 {
284 if (curr == *tail) return;
285 if (curr == *head)
286 *head=curr->next;
287 if (curr->prev != NULL)
288 curr->prev->next=curr->next;
289 if (curr->next != NULL) /* should always be true */
290 curr->next->prev=curr->prev;
291 (*tail)->next=curr;
292 curr->prev= *tail;
293 curr->next=NULL;
294 *tail=curr;
295 }
296
297STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *ssl_method,
298 STACK_OF(SSL_CIPHER) **cipher_list,
299 STACK_OF(SSL_CIPHER) **cipher_list_by_id,
300 char *str)
301 {
302 SSL_CIPHER *c;
303 char *l;
304 STACK_OF(SSL_CIPHER) *ret=NULL,*ok=NULL;
305#define CL_BUF 40
306 char buf[CL_BUF];
307 char *tmp_str=NULL;
308 unsigned long mask,algorithms,ma;
309 char *start;
310 int i,j,k,num=0,ch,multi;
311 unsigned long al;
312 STACK *ca_list=NULL;
313 int current_x,num_x;
314 CIPHER_CHOICE *ops=NULL;
315 CIPHER_ORDER *list=NULL,*head=NULL,*tail=NULL,*curr,*tail2,*curr2;
316 int list_num;
317 int type;
318 SSL_CIPHER c_tmp,*cp;
319
320 if (str == NULL) return(NULL);
321
322 if (strncmp(str,"DEFAULT",7) == 0)
323 {
324 i=strlen(str)+2+strlen(SSL_DEFAULT_CIPHER_LIST);
325 if ((tmp_str=Malloc(i)) == NULL)
326 {
327 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
328 goto err;
329 }
330 strcpy(tmp_str,SSL_DEFAULT_CIPHER_LIST);
331 strcat(tmp_str,":");
332 strcat(tmp_str,&(str[7]));
333 str=tmp_str;
334 }
335 if (init_ciphers) load_ciphers();
336
337 num=ssl_method->num_ciphers();
338
339 if ((ret=sk_SSL_CIPHER_new(NULL)) == NULL) goto err;
340 if ((ca_list=(STACK *)sk_new(cmp_by_name)) == NULL) goto err;
341
342 mask =SSL_kFZA;
343#ifdef NO_RSA
344 mask|=SSL_aRSA|SSL_kRSA;
345#endif
346#ifdef NO_DSA
347 mask|=SSL_aDSS;
348#endif
349#ifdef NO_DH
350 mask|=SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
351#endif
352
353#ifdef SSL_FORBID_ENULL
354 mask|=SSL_eNULL;
355#endif
356
357 mask|=(ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL)?SSL_DES :0;
358 mask|=(ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL)?SSL_3DES:0;
359 mask|=(ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL)?SSL_RC4 :0;
360 mask|=(ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL)?SSL_RC2 :0;
361 mask|=(ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL)?SSL_IDEA:0;
362 mask|=(ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL)?SSL_eFZA:0;
363
364 mask|=(ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL)?SSL_MD5 :0;
365 mask|=(ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL)?SSL_SHA1:0;
366
367 if ((list=(CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER)*num)) == NULL)
368 goto err;
369
370 /* Get the initial list of ciphers */
371 list_num=0;
372 for (i=0; i<num; i++)
373 {
374 c=ssl_method->get_cipher((unsigned int)i);
375 /* drop those that use any of that is not available */
376 if ((c != NULL) && c->valid && !(c->algorithms & mask))
377 {
378 list[list_num].cipher=c;
379 list[list_num].next=NULL;
380 list[list_num].prev=NULL;
381 list[list_num].active=0;
382 list_num++;
383 if (!sk_push(ca_list,(char *)c)) goto err;
384 }
385 }
386
387 for (i=1; i<list_num-1; i++)
388 {
389 list[i].prev= &(list[i-1]);
390 list[i].next= &(list[i+1]);
391 }
392 if (list_num > 0)
393 {
394 head= &(list[0]);
395 head->prev=NULL;
396 head->next= &(list[1]);
397 tail= &(list[list_num-1]);
398 tail->prev= &(list[list_num-2]);
399 tail->next=NULL;
400 }
401
402 /* special case */
403 cipher_aliases[0].algorithms &= ~mask;
404
405 /* get the aliases */
406 k=sizeof(cipher_aliases)/sizeof(SSL_CIPHER);
407 for (j=0; j<k; j++)
408 {
409 al=cipher_aliases[j].algorithms;
410 /* Drop those that are not relevent */
411 if ((al & mask) == al) continue;
412 if (!sk_push(ca_list,(char *)&(cipher_aliases[j]))) goto err;
413 }
414
415 /* ca_list now holds a 'stack' of SSL_CIPHERS, some real, some
416 * 'aliases' */
417
418 /* how many parameters are there? */
419 num=1;
420 for (l=str; *l; l++)
421 if (ITEM_SEP(*l))
422 num++;
423 ops=(CIPHER_CHOICE *)Malloc(sizeof(CIPHER_CHOICE)*num);
424 if (ops == NULL) goto err;
425 memset(ops,0,sizeof(CIPHER_CHOICE)*num);
426
427 /* we now parse the input string and create our operations */
428 l=str;
429 i=0;
430 current_x=0;
431
432 for (;;)
433 {
434 ch= *l;
435
436 if (ch == '\0') break;
437
438 if (ch == '-')
439 { j=CIPHER_DEL; l++; }
440 else if (ch == '+')
441 { j=CIPHER_ORD; l++; }
442 else if (ch == '!')
443 { j=CIPHER_KILL; l++; }
444 else
445 { j=CIPHER_ADD; }
446
447 if (ITEM_SEP(ch))
448 {
449 l++;
450 continue;
451 }
452 ops[current_x].type=j;
453 ops[current_x].algorithms=0;
454 ops[current_x].mask=0;
455
456 start=l;
457 for (;;)
458 {
459 ch= *l;
460 i=0;
461#ifndef CHARSET_EBCDIC
462 while ( ((ch >= 'A') && (ch <= 'Z')) ||
463 ((ch >= '0') && (ch <= '9')) ||
464 ((ch >= 'a') && (ch <= 'z')) ||
465 (ch == '-'))
466#else
467 while ( isalnum(ch) || (ch == '-'))
468#endif
469 {
470 buf[i]=ch;
471 ch= *(++l);
472 i++;
473 if (i >= (CL_BUF-2)) break;
474 }
475 buf[i]='\0';
476
477 /* check for multi-part specification */
478 if (ch == '+')
479 {
480 multi=1;
481 l++;
482 }
483 else
484 multi=0;
485
486 c_tmp.name=buf;
487 j=sk_find(ca_list,(char *)&c_tmp);
488 if (j < 0)
489 goto end_loop;
490
491 cp=(SSL_CIPHER *)sk_value(ca_list,j);
492 ops[current_x].algorithms|=cp->algorithms;
493 /* We add the SSL_SSL_MASK so we can match the
494 * SSLv2 and SSLv3 versions of RC4-MD5 */
495 ops[current_x].mask|=cp->mask;
496 if (!multi) break;
497 }
498 current_x++;
499 if (ch == '\0') break;
500end_loop:
501 /* Make sure we scan until the next valid start point */
502 while ((*l != '\0') && ITEM_SEP(*l))
503 l++;
504 }
505
506 num_x=current_x;
507 current_x=0;
508
509 /* We will now process the list of ciphers, once for each category, to
510 * decide what we should do with it. */
511 for (j=0; j<num_x; j++)
512 {
513 algorithms=ops[j].algorithms;
514 type=ops[j].type;
515 mask=ops[j].mask;
516
517 curr=head;
518 curr2=head;
519 tail2=tail;
520 for (;;)
521 {
522 if ((curr == NULL) || (curr == tail2)) break;
523 curr=curr2;
524 curr2=curr->next;
525
526 cp=curr->cipher;
527 ma=mask & cp->algorithms;
528 if ((ma == 0) || ((ma & algorithms) != ma))
529 {
530 /* does not apply */
531 continue;
532 }
533
534 /* add the cipher if it has not been added yet. */
535 if (type == CIPHER_ADD)
536 {
537 if (!curr->active)
538 {
539 ll_append_tail(&head,curr,&tail);
540 curr->active=1;
541 }
542 }
543 /* Move the added cipher to this location */
544 else if (type == CIPHER_ORD)
545 {
546 if (curr->active)
547 {
548 ll_append_tail(&head,curr,&tail);
549 }
550 }
551 else if (type == CIPHER_DEL)
552 curr->active=0;
553 if (type == CIPHER_KILL)
554 {
555 if (head == curr)
556 head=curr->next;
557 else
558 curr->prev->next=curr->next;
559 if (tail == curr)
560 tail=curr->prev;
561 curr->active=0;
562 if (curr->next != NULL)
563 curr->next->prev=curr->prev;
564 if (curr->prev != NULL)
565 curr->prev->next=curr->next;
566 curr->next=NULL;
567 curr->prev=NULL;
568 }
569 }
570 }
571
572 for (curr=head; curr != NULL; curr=curr->next)
573 {
574 if (curr->active)
575 {
576 sk_SSL_CIPHER_push(ret,curr->cipher);
577#ifdef CIPHER_DEBUG
578 printf("<%s>\n",curr->cipher->name);
579#endif
580 }
581 }
582
583 if (cipher_list != NULL)
584 {
585 if (*cipher_list != NULL)
586 sk_SSL_CIPHER_free(*cipher_list);
587 *cipher_list=ret;
588 }
589
590 if (cipher_list_by_id != NULL)
591 {
592 if (*cipher_list_by_id != NULL)
593 sk_SSL_CIPHER_free(*cipher_list_by_id);
594 *cipher_list_by_id=sk_SSL_CIPHER_dup(ret);
595 }
596
597 if ( (cipher_list_by_id == NULL) ||
598 (*cipher_list_by_id == NULL) ||
599 (cipher_list == NULL) ||
600 (*cipher_list == NULL))
601 goto err;
602 sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
603
604 ok=ret;
605 ret=NULL;
606err:
607 if (tmp_str) Free(tmp_str);
608 if (ops != NULL) Free(ops);
609 if (ret != NULL) sk_SSL_CIPHER_free(ret);
610 if (ca_list != NULL) sk_free(ca_list);
611 if (list != NULL) Free(list);
612 return(ok);
613 }
614
615char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
616 {
617 int is_export,pkl,kl;
618 char *ver,*exp;
619 char *kx,*au,*enc,*mac;
620 unsigned long alg,alg2;
621 static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
622
623 alg=cipher->algorithms;
624 alg2=cipher->algorithm2;
625
626 is_export=SSL_IS_EXPORT(alg);
627 pkl=SSL_EXPORT_PKEYLENGTH(alg);
628 kl=SSL_EXPORT_KEYLENGTH(alg);
629 exp=is_export?" export":"";
630
631 if (alg & SSL_SSLV2)
632 ver="SSLv2";
633 else if (alg & SSL_SSLV3)
634 ver="SSLv3";
635 else
636 ver="unknown";
637
638 switch (alg&SSL_MKEY_MASK)
639 {
640 case SSL_kRSA:
641 kx=is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA";
642 break;
643 case SSL_kDHr:
644 kx="DH/RSA";
645 break;
646 case SSL_kDHd:
647 kx="DH/DSS";
648 break;
649 case SSL_kFZA:
650 kx="Fortezza";
651 break;
652 case SSL_kEDH:
653 kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH";
654 break;
655 default:
656 kx="unknown";
657 }
658
659 switch (alg&SSL_AUTH_MASK)
660 {
661 case SSL_aRSA:
662 au="RSA";
663 break;
664 case SSL_aDSS:
665 au="DSS";
666 break;
667 case SSL_aDH:
668 au="DH";
669 break;
670 case SSL_aFZA:
671 case SSL_aNULL:
672 au="None";
673 break;
674 default:
675 au="unknown";
676 break;
677 }
678
679 switch (alg&SSL_ENC_MASK)
680 {
681 case SSL_DES:
682 enc=(is_export && kl == 5)?"DES(40)":"DES(56)";
683 break;
684 case SSL_3DES:
685 enc="3DES(168)";
686 break;
687 case SSL_RC4:
688 enc=is_export?(kl == 5 ? "RC4(40)" : "RC4(56)")
689 :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)");
690 break;
691 case SSL_RC2:
692 enc=is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)";
693 break;
694 case SSL_IDEA:
695 enc="IDEA(128)";
696 break;
697 case SSL_eFZA:
698 enc="Fortezza";
699 break;
700 case SSL_eNULL:
701 enc="None";
702 break;
703 default:
704 enc="unknown";
705 break;
706 }
707
708 switch (alg&SSL_MAC_MASK)
709 {
710 case SSL_MD5:
711 mac="MD5";
712 break;
713 case SSL_SHA1:
714 mac="SHA1";
715 break;
716 default:
717 mac="unknown";
718 break;
719 }
720
721 if (buf == NULL)
722 {
723 buf=Malloc(128);
724 if (buf == NULL) return("Malloc Error");
725 }
726 else if (len < 128)
727 return("Buffer too small");
728
729 sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp);
730 return(buf);
731 }
732
733char *SSL_CIPHER_get_version(SSL_CIPHER *c)
734 {
735 int i;
736
737 if (c == NULL) return("(NONE)");
738 i=(int)(c->id>>24L);
739 if (i == 3)
740 return("TLSv1/SSLv3");
741 else if (i == 2)
742 return("SSLv2");
743 else
744 return("unknown");
745 }
746
747/* return the actual cipher being used */
748const char *SSL_CIPHER_get_name(SSL_CIPHER *c)
749 {
750 if (c != NULL)
751 return(c->name);
752 return("(NONE)");
753 }
754
755/* number of bits for symetric cipher */
756int SSL_CIPHER_get_bits(SSL_CIPHER *c, int *alg_bits)
757 {
758 int ret=0,a=0;
759 const EVP_CIPHER *enc;
760 const EVP_MD *md;
761 SSL_SESSION ss;
762
763 if (c != NULL)
764 {
765 ss.cipher=c;
766 if (!ssl_cipher_get_evp(&ss,&enc,&md,NULL))
767 return(0);
768
769 a=EVP_CIPHER_key_length(enc)*8;
770
771 if (SSL_C_IS_EXPORT(c))
772 {
773 ret=SSL_C_EXPORT_KEYLENGTH(c)*8;
774 }
775 else
776 {
777 if (c->algorithm2 & SSL2_CF_8_BYTE_ENC)
778 ret=64;
779 else
780 ret=a;
781 }
782 }
783
784 if (alg_bits != NULL) *alg_bits=a;
785
786 return(ret);
787 }
788
789SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
790 {
791 SSL_COMP *ctmp;
792 int i,nn;
793
794 if ((n == 0) || (sk == NULL)) return(NULL);
795 nn=sk_SSL_COMP_num(sk);
796 for (i=0; i<nn; i++)
797 {
798 ctmp=sk_SSL_COMP_value(sk,i);
799 if (ctmp->id == n)
800 return(ctmp);
801 }
802 return(NULL);
803 }
804
805static int sk_comp_cmp(SSL_COMP **a,SSL_COMP **b)
806 {
807 return((*a)->id-(*b)->id);
808 }
809
810STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void)
811 {
812 return(ssl_comp_methods);
813 }
814
815int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
816 {
817 SSL_COMP *comp;
818 STACK_OF(SSL_COMP) *sk;
819
820 comp=(SSL_COMP *)Malloc(sizeof(SSL_COMP));
821 comp->id=id;
822 comp->method=cm;
823 if (ssl_comp_methods == NULL)
824 sk=ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
825 else
826 sk=ssl_comp_methods;
827 if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
828 {
829 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
830 return(0);
831 }
832 else
833 return(1);
834 }
835
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
deleted file mode 100644
index 3ddc805b53..0000000000
--- a/src/lib/libssl/ssl_err.c
+++ /dev/null
@@ -1,416 +0,0 @@
1/* ssl/ssl_err.c */
2/* ====================================================================
3 * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * 3. All advertising materials mentioning features or use of this
18 * software must display the following acknowledgment:
19 * "This product includes software developed by the OpenSSL Project
20 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21 *
22 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23 * endorse or promote products derived from this software without
24 * prior written permission. For written permission, please contact
25 * openssl-core@OpenSSL.org.
26 *
27 * 5. Products derived from this software may not be called "OpenSSL"
28 * nor may "OpenSSL" appear in their names without prior written
29 * permission of the OpenSSL Project.
30 *
31 * 6. Redistributions of any form whatsoever must retain the following
32 * acknowledgment:
33 * "This product includes software developed by the OpenSSL Project
34 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35 *
36 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
40 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47 * OF THE POSSIBILITY OF SUCH DAMAGE.
48 * ====================================================================
49 *
50 * This product includes cryptographic software written by Eric Young
51 * (eay@cryptsoft.com). This product includes software written by Tim
52 * Hudson (tjh@cryptsoft.com).
53 *
54 */
55
56/* NOTE: this file was auto generated by the mkerr.pl script: any changes
57 * made to it will be overwritten when the script next updates this file.
58 */
59
60#include <stdio.h>
61#include <openssl/err.h>
62#include <openssl/ssl.h>
63
64/* BEGIN ERROR CODES */
65#ifndef NO_ERR
66static ERR_STRING_DATA SSL_str_functs[]=
67 {
68{ERR_PACK(0,SSL_F_CLIENT_CERTIFICATE,0), "CLIENT_CERTIFICATE"},
69{ERR_PACK(0,SSL_F_CLIENT_HELLO,0), "CLIENT_HELLO"},
70{ERR_PACK(0,SSL_F_CLIENT_MASTER_KEY,0), "CLIENT_MASTER_KEY"},
71{ERR_PACK(0,SSL_F_D2I_SSL_SESSION,0), "d2i_SSL_SESSION"},
72{ERR_PACK(0,SSL_F_DO_SSL3_WRITE,0), "DO_SSL3_WRITE"},
73{ERR_PACK(0,SSL_F_GET_CLIENT_FINISHED,0), "GET_CLIENT_FINISHED"},
74{ERR_PACK(0,SSL_F_GET_CLIENT_HELLO,0), "GET_CLIENT_HELLO"},
75{ERR_PACK(0,SSL_F_GET_CLIENT_MASTER_KEY,0), "GET_CLIENT_MASTER_KEY"},
76{ERR_PACK(0,SSL_F_GET_SERVER_FINISHED,0), "GET_SERVER_FINISHED"},
77{ERR_PACK(0,SSL_F_GET_SERVER_HELLO,0), "GET_SERVER_HELLO"},
78{ERR_PACK(0,SSL_F_GET_SERVER_VERIFY,0), "GET_SERVER_VERIFY"},
79{ERR_PACK(0,SSL_F_I2D_SSL_SESSION,0), "i2d_SSL_SESSION"},
80{ERR_PACK(0,SSL_F_READ_N,0), "READ_N"},
81{ERR_PACK(0,SSL_F_REQUEST_CERTIFICATE,0), "REQUEST_CERTIFICATE"},
82{ERR_PACK(0,SSL_F_SERVER_HELLO,0), "SERVER_HELLO"},
83{ERR_PACK(0,SSL_F_SSL23_ACCEPT,0), "SSL23_ACCEPT"},
84{ERR_PACK(0,SSL_F_SSL23_CLIENT_HELLO,0), "SSL23_CLIENT_HELLO"},
85{ERR_PACK(0,SSL_F_SSL23_CONNECT,0), "SSL23_CONNECT"},
86{ERR_PACK(0,SSL_F_SSL23_GET_CLIENT_HELLO,0), "SSL23_GET_CLIENT_HELLO"},
87{ERR_PACK(0,SSL_F_SSL23_GET_SERVER_HELLO,0), "SSL23_GET_SERVER_HELLO"},
88{ERR_PACK(0,SSL_F_SSL23_READ,0), "SSL23_READ"},
89{ERR_PACK(0,SSL_F_SSL23_WRITE,0), "SSL23_WRITE"},
90{ERR_PACK(0,SSL_F_SSL2_ACCEPT,0), "SSL2_ACCEPT"},
91{ERR_PACK(0,SSL_F_SSL2_CONNECT,0), "SSL2_CONNECT"},
92{ERR_PACK(0,SSL_F_SSL2_ENC_INIT,0), "SSL2_ENC_INIT"},
93{ERR_PACK(0,SSL_F_SSL2_READ,0), "SSL2_READ"},
94{ERR_PACK(0,SSL_F_SSL2_SET_CERTIFICATE,0), "SSL2_SET_CERTIFICATE"},
95{ERR_PACK(0,SSL_F_SSL2_WRITE,0), "SSL2_WRITE"},
96{ERR_PACK(0,SSL_F_SSL3_ACCEPT,0), "SSL3_ACCEPT"},
97{ERR_PACK(0,SSL_F_SSL3_CHANGE_CIPHER_STATE,0), "SSL3_CHANGE_CIPHER_STATE"},
98{ERR_PACK(0,SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,0), "SSL3_CHECK_CERT_AND_ALGORITHM"},
99{ERR_PACK(0,SSL_F_SSL3_CLIENT_HELLO,0), "SSL3_CLIENT_HELLO"},
100{ERR_PACK(0,SSL_F_SSL3_CONNECT,0), "SSL3_CONNECT"},
101{ERR_PACK(0,SSL_F_SSL3_CTRL,0), "SSL3_CTRL"},
102{ERR_PACK(0,SSL_F_SSL3_CTX_CTRL,0), "SSL3_CTX_CTRL"},
103{ERR_PACK(0,SSL_F_SSL3_ENC,0), "SSL3_ENC"},
104{ERR_PACK(0,SSL_F_SSL3_GET_CERTIFICATE_REQUEST,0), "SSL3_GET_CERTIFICATE_REQUEST"},
105{ERR_PACK(0,SSL_F_SSL3_GET_CERT_VERIFY,0), "SSL3_GET_CERT_VERIFY"},
106{ERR_PACK(0,SSL_F_SSL3_GET_CLIENT_CERTIFICATE,0), "SSL3_GET_CLIENT_CERTIFICATE"},
107{ERR_PACK(0,SSL_F_SSL3_GET_CLIENT_HELLO,0), "SSL3_GET_CLIENT_HELLO"},
108{ERR_PACK(0,SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,0), "SSL3_GET_CLIENT_KEY_EXCHANGE"},
109{ERR_PACK(0,SSL_F_SSL3_GET_FINISHED,0), "SSL3_GET_FINISHED"},
110{ERR_PACK(0,SSL_F_SSL3_GET_KEY_EXCHANGE,0), "SSL3_GET_KEY_EXCHANGE"},
111{ERR_PACK(0,SSL_F_SSL3_GET_MESSAGE,0), "SSL3_GET_MESSAGE"},
112{ERR_PACK(0,SSL_F_SSL3_GET_RECORD,0), "SSL3_GET_RECORD"},
113{ERR_PACK(0,SSL_F_SSL3_GET_SERVER_CERTIFICATE,0), "SSL3_GET_SERVER_CERTIFICATE"},
114{ERR_PACK(0,SSL_F_SSL3_GET_SERVER_DONE,0), "SSL3_GET_SERVER_DONE"},
115{ERR_PACK(0,SSL_F_SSL3_GET_SERVER_HELLO,0), "SSL3_GET_SERVER_HELLO"},
116{ERR_PACK(0,SSL_F_SSL3_OUTPUT_CERT_CHAIN,0), "SSL3_OUTPUT_CERT_CHAIN"},
117{ERR_PACK(0,SSL_F_SSL3_READ_BYTES,0), "SSL3_READ_BYTES"},
118{ERR_PACK(0,SSL_F_SSL3_READ_N,0), "SSL3_READ_N"},
119{ERR_PACK(0,SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,0), "SSL3_SEND_CERTIFICATE_REQUEST"},
120{ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,0), "SSL3_SEND_CLIENT_CERTIFICATE"},
121{ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,0), "SSL3_SEND_CLIENT_KEY_EXCHANGE"},
122{ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_VERIFY,0), "SSL3_SEND_CLIENT_VERIFY"},
123{ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_CERTIFICATE,0), "SSL3_SEND_SERVER_CERTIFICATE"},
124{ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,0), "SSL3_SEND_SERVER_KEY_EXCHANGE"},
125{ERR_PACK(0,SSL_F_SSL3_SETUP_BUFFERS,0), "SSL3_SETUP_BUFFERS"},
126{ERR_PACK(0,SSL_F_SSL3_SETUP_KEY_BLOCK,0), "SSL3_SETUP_KEY_BLOCK"},
127{ERR_PACK(0,SSL_F_SSL3_WRITE_BYTES,0), "SSL3_WRITE_BYTES"},
128{ERR_PACK(0,SSL_F_SSL3_WRITE_PENDING,0), "SSL3_WRITE_PENDING"},
129{ERR_PACK(0,SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,0), "SSL_add_dir_cert_subjects_to_stack"},
130{ERR_PACK(0,SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,0), "SSL_add_file_cert_subjects_to_stack"},
131{ERR_PACK(0,SSL_F_SSL_BAD_METHOD,0), "SSL_BAD_METHOD"},
132{ERR_PACK(0,SSL_F_SSL_BYTES_TO_CIPHER_LIST,0), "SSL_BYTES_TO_CIPHER_LIST"},
133{ERR_PACK(0,SSL_F_SSL_CERT_DUP,0), "SSL_CERT_DUP"},
134{ERR_PACK(0,SSL_F_SSL_CERT_INST,0), "SSL_CERT_INST"},
135{ERR_PACK(0,SSL_F_SSL_CERT_INSTANTIATE,0), "SSL_CERT_INSTANTIATE"},
136{ERR_PACK(0,SSL_F_SSL_CERT_NEW,0), "SSL_CERT_NEW"},
137{ERR_PACK(0,SSL_F_SSL_CHECK_PRIVATE_KEY,0), "SSL_check_private_key"},
138{ERR_PACK(0,SSL_F_SSL_CLEAR,0), "SSL_clear"},
139{ERR_PACK(0,SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,0), "SSL_COMP_add_compression_method"},
140{ERR_PACK(0,SSL_F_SSL_CREATE_CIPHER_LIST,0), "SSL_CREATE_CIPHER_LIST"},
141{ERR_PACK(0,SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,0), "SSL_CTX_check_private_key"},
142{ERR_PACK(0,SSL_F_SSL_CTX_NEW,0), "SSL_CTX_new"},
143{ERR_PACK(0,SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,0), "SSL_CTX_set_session_id_context"},
144{ERR_PACK(0,SSL_F_SSL_CTX_SET_SSL_VERSION,0), "SSL_CTX_set_ssl_version"},
145{ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE,0), "SSL_CTX_use_certificate"},
146{ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,0), "SSL_CTX_use_certificate_ASN1"},
147{ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,0), "SSL_CTX_use_certificate_chain_file"},
148{ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,0), "SSL_CTX_use_certificate_file"},
149{ERR_PACK(0,SSL_F_SSL_CTX_USE_PRIVATEKEY,0), "SSL_CTX_use_PrivateKey"},
150{ERR_PACK(0,SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,0), "SSL_CTX_use_PrivateKey_ASN1"},
151{ERR_PACK(0,SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,0), "SSL_CTX_use_PrivateKey_file"},
152{ERR_PACK(0,SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,0), "SSL_CTX_use_RSAPrivateKey"},
153{ERR_PACK(0,SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,0), "SSL_CTX_use_RSAPrivateKey_ASN1"},
154{ERR_PACK(0,SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,0), "SSL_CTX_use_RSAPrivateKey_file"},
155{ERR_PACK(0,SSL_F_SSL_DO_HANDSHAKE,0), "SSL_do_handshake"},
156{ERR_PACK(0,SSL_F_SSL_GET_NEW_SESSION,0), "SSL_GET_NEW_SESSION"},
157{ERR_PACK(0,SSL_F_SSL_GET_PREV_SESSION,0), "SSL_GET_PREV_SESSION"},
158{ERR_PACK(0,SSL_F_SSL_GET_SERVER_SEND_CERT,0), "SSL_GET_SERVER_SEND_CERT"},
159{ERR_PACK(0,SSL_F_SSL_GET_SIGN_PKEY,0), "SSL_GET_SIGN_PKEY"},
160{ERR_PACK(0,SSL_F_SSL_INIT_WBIO_BUFFER,0), "SSL_INIT_WBIO_BUFFER"},
161{ERR_PACK(0,SSL_F_SSL_LOAD_CLIENT_CA_FILE,0), "SSL_load_client_CA_file"},
162{ERR_PACK(0,SSL_F_SSL_NEW,0), "SSL_new"},
163{ERR_PACK(0,SSL_F_SSL_READ,0), "SSL_read"},
164{ERR_PACK(0,SSL_F_SSL_RSA_PRIVATE_DECRYPT,0), "SSL_RSA_PRIVATE_DECRYPT"},
165{ERR_PACK(0,SSL_F_SSL_RSA_PUBLIC_ENCRYPT,0), "SSL_RSA_PUBLIC_ENCRYPT"},
166{ERR_PACK(0,SSL_F_SSL_SESSION_NEW,0), "SSL_SESSION_new"},
167{ERR_PACK(0,SSL_F_SSL_SESSION_PRINT_FP,0), "SSL_SESSION_print_fp"},
168{ERR_PACK(0,SSL_F_SSL_SESS_CERT_NEW,0), "SSL_SESS_CERT_NEW"},
169{ERR_PACK(0,SSL_F_SSL_SET_CERT,0), "SSL_SET_CERT"},
170{ERR_PACK(0,SSL_F_SSL_SET_FD,0), "SSL_set_fd"},
171{ERR_PACK(0,SSL_F_SSL_SET_PKEY,0), "SSL_SET_PKEY"},
172{ERR_PACK(0,SSL_F_SSL_SET_RFD,0), "SSL_set_rfd"},
173{ERR_PACK(0,SSL_F_SSL_SET_SESSION,0), "SSL_set_session"},
174{ERR_PACK(0,SSL_F_SSL_SET_SESSION_ID_CONTEXT,0), "SSL_set_session_id_context"},
175{ERR_PACK(0,SSL_F_SSL_SET_WFD,0), "SSL_set_wfd"},
176{ERR_PACK(0,SSL_F_SSL_SHUTDOWN,0), "SSL_shutdown"},
177{ERR_PACK(0,SSL_F_SSL_UNDEFINED_FUNCTION,0), "SSL_UNDEFINED_FUNCTION"},
178{ERR_PACK(0,SSL_F_SSL_USE_CERTIFICATE,0), "SSL_use_certificate"},
179{ERR_PACK(0,SSL_F_SSL_USE_CERTIFICATE_ASN1,0), "SSL_use_certificate_ASN1"},
180{ERR_PACK(0,SSL_F_SSL_USE_CERTIFICATE_FILE,0), "SSL_use_certificate_file"},
181{ERR_PACK(0,SSL_F_SSL_USE_PRIVATEKEY,0), "SSL_use_PrivateKey"},
182{ERR_PACK(0,SSL_F_SSL_USE_PRIVATEKEY_ASN1,0), "SSL_use_PrivateKey_ASN1"},
183{ERR_PACK(0,SSL_F_SSL_USE_PRIVATEKEY_FILE,0), "SSL_use_PrivateKey_file"},
184{ERR_PACK(0,SSL_F_SSL_USE_RSAPRIVATEKEY,0), "SSL_use_RSAPrivateKey"},
185{ERR_PACK(0,SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,0), "SSL_use_RSAPrivateKey_ASN1"},
186{ERR_PACK(0,SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,0), "SSL_use_RSAPrivateKey_file"},
187{ERR_PACK(0,SSL_F_SSL_VERIFY_CERT_CHAIN,0), "SSL_VERIFY_CERT_CHAIN"},
188{ERR_PACK(0,SSL_F_SSL_WRITE,0), "SSL_write"},
189{ERR_PACK(0,SSL_F_TLS1_CHANGE_CIPHER_STATE,0), "TLS1_CHANGE_CIPHER_STATE"},
190{ERR_PACK(0,SSL_F_TLS1_ENC,0), "TLS1_ENC"},
191{ERR_PACK(0,SSL_F_TLS1_SETUP_KEY_BLOCK,0), "TLS1_SETUP_KEY_BLOCK"},
192{ERR_PACK(0,SSL_F_WRITE_PENDING,0), "WRITE_PENDING"},
193{0,NULL}
194 };
195
196static ERR_STRING_DATA SSL_str_reasons[]=
197 {
198{SSL_R_APP_DATA_IN_HANDSHAKE ,"app data in handshake"},
199{SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT,"attempt to reuse session in different context"},
200{SSL_R_BAD_ALERT_RECORD ,"bad alert record"},
201{SSL_R_BAD_AUTHENTICATION_TYPE ,"bad authentication type"},
202{SSL_R_BAD_CHANGE_CIPHER_SPEC ,"bad change cipher spec"},
203{SSL_R_BAD_CHECKSUM ,"bad checksum"},
204{SSL_R_BAD_CLIENT_REQUEST ,"bad client request"},
205{SSL_R_BAD_DATA_RETURNED_BY_CALLBACK ,"bad data returned by callback"},
206{SSL_R_BAD_DECOMPRESSION ,"bad decompression"},
207{SSL_R_BAD_DH_G_LENGTH ,"bad dh g length"},
208{SSL_R_BAD_DH_PUB_KEY_LENGTH ,"bad dh pub key length"},
209{SSL_R_BAD_DH_P_LENGTH ,"bad dh p length"},
210{SSL_R_BAD_DIGEST_LENGTH ,"bad digest length"},
211{SSL_R_BAD_DSA_SIGNATURE ,"bad dsa signature"},
212{SSL_R_BAD_LENGTH ,"bad length"},
213{SSL_R_BAD_MAC_DECODE ,"bad mac decode"},
214{SSL_R_BAD_MESSAGE_TYPE ,"bad message type"},
215{SSL_R_BAD_PACKET_LENGTH ,"bad packet length"},
216{SSL_R_BAD_PROTOCOL_VERSION_NUMBER ,"bad protocol version number"},
217{SSL_R_BAD_RESPONSE_ARGUMENT ,"bad response argument"},
218{SSL_R_BAD_RSA_DECRYPT ,"bad rsa decrypt"},
219{SSL_R_BAD_RSA_ENCRYPT ,"bad rsa encrypt"},
220{SSL_R_BAD_RSA_E_LENGTH ,"bad rsa e length"},
221{SSL_R_BAD_RSA_MODULUS_LENGTH ,"bad rsa modulus length"},
222{SSL_R_BAD_RSA_SIGNATURE ,"bad rsa signature"},
223{SSL_R_BAD_SIGNATURE ,"bad signature"},
224{SSL_R_BAD_SSL_FILETYPE ,"bad ssl filetype"},
225{SSL_R_BAD_SSL_SESSION_ID_LENGTH ,"bad ssl session id length"},
226{SSL_R_BAD_STATE ,"bad state"},
227{SSL_R_BAD_WRITE_RETRY ,"bad write retry"},
228{SSL_R_BIO_NOT_SET ,"bio not set"},
229{SSL_R_BLOCK_CIPHER_PAD_IS_WRONG ,"block cipher pad is wrong"},
230{SSL_R_BN_LIB ,"bn lib"},
231{SSL_R_CA_DN_LENGTH_MISMATCH ,"ca dn length mismatch"},
232{SSL_R_CA_DN_TOO_LONG ,"ca dn too long"},
233{SSL_R_CCS_RECEIVED_EARLY ,"ccs received early"},
234{SSL_R_CERTIFICATE_VERIFY_FAILED ,"certificate verify failed"},
235{SSL_R_CERT_LENGTH_MISMATCH ,"cert length mismatch"},
236{SSL_R_CHALLENGE_IS_DIFFERENT ,"challenge is different"},
237{SSL_R_CIPHER_CODE_WRONG_LENGTH ,"cipher code wrong length"},
238{SSL_R_CIPHER_OR_HASH_UNAVAILABLE ,"cipher or hash unavailable"},
239{SSL_R_CIPHER_TABLE_SRC_ERROR ,"cipher table src error"},
240{SSL_R_COMPRESSED_LENGTH_TOO_LONG ,"compressed length too long"},
241{SSL_R_COMPRESSION_FAILURE ,"compression failure"},
242{SSL_R_COMPRESSION_LIBRARY_ERROR ,"compression library error"},
243{SSL_R_CONNECTION_ID_IS_DIFFERENT ,"connection id is different"},
244{SSL_R_CONNECTION_TYPE_NOT_SET ,"connection type not set"},
245{SSL_R_DATA_BETWEEN_CCS_AND_FINISHED ,"data between ccs and finished"},
246{SSL_R_DATA_LENGTH_TOO_LONG ,"data length too long"},
247{SSL_R_DECRYPTION_FAILED ,"decryption failed"},
248{SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG ,"dh public value length is wrong"},
249{SSL_R_DIGEST_CHECK_FAILED ,"digest check failed"},
250{SSL_R_ENCRYPTED_LENGTH_TOO_LONG ,"encrypted length too long"},
251{SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST ,"error in received cipher list"},
252{SSL_R_EXCESSIVE_MESSAGE_SIZE ,"excessive message size"},
253{SSL_R_EXTRA_DATA_IN_MESSAGE ,"extra data in message"},
254{SSL_R_GOT_A_FIN_BEFORE_A_CCS ,"got a fin before a ccs"},
255{SSL_R_HTTPS_PROXY_REQUEST ,"https proxy request"},
256{SSL_R_HTTP_REQUEST ,"http request"},
257{SSL_R_INTERNAL_ERROR ,"internal error"},
258{SSL_R_INVALID_CHALLENGE_LENGTH ,"invalid challenge length"},
259{SSL_R_LENGTH_MISMATCH ,"length mismatch"},
260{SSL_R_LENGTH_TOO_SHORT ,"length too short"},
261{SSL_R_LIBRARY_BUG ,"library bug"},
262{SSL_R_LIBRARY_HAS_NO_CIPHERS ,"library has no ciphers"},
263{SSL_R_MISSING_DH_DSA_CERT ,"missing dh dsa cert"},
264{SSL_R_MISSING_DH_KEY ,"missing dh key"},
265{SSL_R_MISSING_DH_RSA_CERT ,"missing dh rsa cert"},
266{SSL_R_MISSING_DSA_SIGNING_CERT ,"missing dsa signing cert"},
267{SSL_R_MISSING_EXPORT_TMP_DH_KEY ,"missing export tmp dh key"},
268{SSL_R_MISSING_EXPORT_TMP_RSA_KEY ,"missing export tmp rsa key"},
269{SSL_R_MISSING_RSA_CERTIFICATE ,"missing rsa certificate"},
270{SSL_R_MISSING_RSA_ENCRYPTING_CERT ,"missing rsa encrypting cert"},
271{SSL_R_MISSING_RSA_SIGNING_CERT ,"missing rsa signing cert"},
272{SSL_R_MISSING_TMP_DH_KEY ,"missing tmp dh key"},
273{SSL_R_MISSING_TMP_RSA_KEY ,"missing tmp rsa key"},
274{SSL_R_MISSING_TMP_RSA_PKEY ,"missing tmp rsa pkey"},
275{SSL_R_MISSING_VERIFY_MESSAGE ,"missing verify message"},
276{SSL_R_NON_SSLV2_INITIAL_PACKET ,"non sslv2 initial packet"},
277{SSL_R_NO_CERTIFICATES_RETURNED ,"no certificates returned"},
278{SSL_R_NO_CERTIFICATE_ASSIGNED ,"no certificate assigned"},
279{SSL_R_NO_CERTIFICATE_RETURNED ,"no certificate returned"},
280{SSL_R_NO_CERTIFICATE_SET ,"no certificate set"},
281{SSL_R_NO_CERTIFICATE_SPECIFIED ,"no certificate specified"},
282{SSL_R_NO_CIPHERS_AVAILABLE ,"no ciphers available"},
283{SSL_R_NO_CIPHERS_PASSED ,"no ciphers passed"},
284{SSL_R_NO_CIPHERS_SPECIFIED ,"no ciphers specified"},
285{SSL_R_NO_CIPHER_LIST ,"no cipher list"},
286{SSL_R_NO_CIPHER_MATCH ,"no cipher match"},
287{SSL_R_NO_CLIENT_CERT_RECEIVED ,"no client cert received"},
288{SSL_R_NO_COMPRESSION_SPECIFIED ,"no compression specified"},
289{SSL_R_NO_METHOD_SPECIFIED ,"no method specified"},
290{SSL_R_NO_PRIVATEKEY ,"no privatekey"},
291{SSL_R_NO_PRIVATE_KEY_ASSIGNED ,"no private key assigned"},
292{SSL_R_NO_PROTOCOLS_AVAILABLE ,"no protocols available"},
293{SSL_R_NO_PUBLICKEY ,"no publickey"},
294{SSL_R_NO_SHARED_CIPHER ,"no shared cipher"},
295{SSL_R_NO_VERIFY_CALLBACK ,"no verify callback"},
296{SSL_R_NULL_SSL_CTX ,"null ssl ctx"},
297{SSL_R_NULL_SSL_METHOD_PASSED ,"null ssl method passed"},
298{SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED ,"old session cipher not returned"},
299{SSL_R_PACKET_LENGTH_TOO_LONG ,"packet length too long"},
300{SSL_R_PATH_TOO_LONG ,"path too long"},
301{SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE ,"peer did not return a certificate"},
302{SSL_R_PEER_ERROR ,"peer error"},
303{SSL_R_PEER_ERROR_CERTIFICATE ,"peer error certificate"},
304{SSL_R_PEER_ERROR_NO_CERTIFICATE ,"peer error no certificate"},
305{SSL_R_PEER_ERROR_NO_CIPHER ,"peer error no cipher"},
306{SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE,"peer error unsupported certificate type"},
307{SSL_R_PRE_MAC_LENGTH_TOO_LONG ,"pre mac length too long"},
308{SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS ,"problems mapping cipher functions"},
309{SSL_R_PROTOCOL_IS_SHUTDOWN ,"protocol is shutdown"},
310{SSL_R_PUBLIC_KEY_ENCRYPT_ERROR ,"public key encrypt error"},
311{SSL_R_PUBLIC_KEY_IS_NOT_RSA ,"public key is not rsa"},
312{SSL_R_PUBLIC_KEY_NOT_RSA ,"public key not rsa"},
313{SSL_R_READ_BIO_NOT_SET ,"read bio not set"},
314{SSL_R_READ_WRONG_PACKET_TYPE ,"read wrong packet type"},
315{SSL_R_RECORD_LENGTH_MISMATCH ,"record length mismatch"},
316{SSL_R_RECORD_TOO_LARGE ,"record too large"},
317{SSL_R_REQUIRED_CIPHER_MISSING ,"required cipher missing"},
318{SSL_R_REUSE_CERT_LENGTH_NOT_ZERO ,"reuse cert length not zero"},
319{SSL_R_REUSE_CERT_TYPE_NOT_ZERO ,"reuse cert type not zero"},
320{SSL_R_REUSE_CIPHER_LIST_NOT_ZERO ,"reuse cipher list not zero"},
321{SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED ,"session id context uninitialized"},
322{SSL_R_SHORT_READ ,"short read"},
323{SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE,"signature for non signing certificate"},
324{SSL_R_SSL23_DOING_SESSION_ID_REUSE ,"ssl23 doing session id reuse"},
325{SSL_R_SSL3_SESSION_ID_TOO_SHORT ,"ssl3 session id too short"},
326{SSL_R_SSLV3_ALERT_BAD_CERTIFICATE ,"sslv3 alert bad certificate"},
327{SSL_R_SSLV3_ALERT_BAD_RECORD_MAC ,"sslv3 alert bad record mac"},
328{SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED ,"sslv3 alert certificate expired"},
329{SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED ,"sslv3 alert certificate revoked"},
330{SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN ,"sslv3 alert certificate unknown"},
331{SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE ,"sslv3 alert decompression failure"},
332{SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE ,"sslv3 alert handshake failure"},
333{SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER ,"sslv3 alert illegal parameter"},
334{SSL_R_SSLV3_ALERT_NO_CERTIFICATE ,"sslv3 alert no certificate"},
335{SSL_R_SSLV3_ALERT_PEER_ERROR_CERTIFICATE,"sslv3 alert peer error certificate"},
336{SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CERTIFICATE,"sslv3 alert peer error no certificate"},
337{SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CIPHER ,"sslv3 alert peer error no cipher"},
338{SSL_R_SSLV3_ALERT_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE,"sslv3 alert peer error unsupported certificate type"},
339{SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE ,"sslv3 alert unexpected message"},
340{SSL_R_SSLV3_ALERT_UNKNOWN_REMOTE_ERROR_TYPE,"sslv3 alert unknown remote error type"},
341{SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE,"sslv3 alert unsupported certificate"},
342{SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION,"ssl ctx has no default ssl version"},
343{SSL_R_SSL_HANDSHAKE_FAILURE ,"ssl handshake failure"},
344{SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS ,"ssl library has no ciphers"},
345{SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG ,"ssl session id context too long"},
346{SSL_R_SSL_SESSION_ID_IS_DIFFERENT ,"ssl session id is different"},
347{SSL_R_TLSV1_ALERT_ACCESS_DENIED ,"tlsv1 alert access denied"},
348{SSL_R_TLSV1_ALERT_DECODE_ERROR ,"tlsv1 alert decode error"},
349{SSL_R_TLSV1_ALERT_DECRYPTION_FAILED ,"tlsv1 alert decryption failed"},
350{SSL_R_TLSV1_ALERT_DECRYPT_ERROR ,"tlsv1 alert decrypt error"},
351{SSL_R_TLSV1_ALERT_EXPORT_RESTRICION ,"tlsv1 alert export restricion"},
352{SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY ,"tlsv1 alert insufficient security"},
353{SSL_R_TLSV1_ALERT_INTERNAL_ERROR ,"tlsv1 alert internal error"},
354{SSL_R_TLSV1_ALERT_NO_RENEGOTIATION ,"tlsv1 alert no renegotiation"},
355{SSL_R_TLSV1_ALERT_PROTOCOL_VERSION ,"tlsv1 alert protocol version"},
356{SSL_R_TLSV1_ALERT_RECORD_OVERFLOW ,"tlsv1 alert record overflow"},
357{SSL_R_TLSV1_ALERT_UNKNOWN_CA ,"tlsv1 alert unknown ca"},
358{SSL_R_TLSV1_ALERT_USER_CANCLED ,"tlsv1 alert user cancled"},
359{SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER,"tls client cert req with anon cipher"},
360{SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST,"tls peer did not respond with certificate list"},
361{SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG,"tls rsa encrypted value length is wrong"},
362{SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER ,"tried to use unsupported cipher"},
363{SSL_R_UNABLE_TO_DECODE_DH_CERTS ,"unable to decode dh certs"},
364{SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY ,"unable to extract public key"},
365{SSL_R_UNABLE_TO_FIND_DH_PARAMETERS ,"unable to find dh parameters"},
366{SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS,"unable to find public key parameters"},
367{SSL_R_UNABLE_TO_FIND_SSL_METHOD ,"unable to find ssl method"},
368{SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES ,"unable to load ssl2 md5 routines"},
369{SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES ,"unable to load ssl3 md5 routines"},
370{SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES ,"unable to load ssl3 sha1 routines"},
371{SSL_R_UNEXPECTED_MESSAGE ,"unexpected message"},
372{SSL_R_UNEXPECTED_RECORD ,"unexpected record"},
373{SSL_R_UNINITIALIZED ,"uninitialized"},
374{SSL_R_UNKNOWN_ALERT_TYPE ,"unknown alert type"},
375{SSL_R_UNKNOWN_CERTIFICATE_TYPE ,"unknown certificate type"},
376{SSL_R_UNKNOWN_CIPHER_RETURNED ,"unknown cipher returned"},
377{SSL_R_UNKNOWN_CIPHER_TYPE ,"unknown cipher type"},
378{SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE ,"unknown key exchange type"},
379{SSL_R_UNKNOWN_PKEY_TYPE ,"unknown pkey type"},
380{SSL_R_UNKNOWN_PROTOCOL ,"unknown protocol"},
381{SSL_R_UNKNOWN_REMOTE_ERROR_TYPE ,"unknown remote error type"},
382{SSL_R_UNKNOWN_SSL_VERSION ,"unknown ssl version"},
383{SSL_R_UNKNOWN_STATE ,"unknown state"},
384{SSL_R_UNSUPPORTED_CIPHER ,"unsupported cipher"},
385{SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM ,"unsupported compression algorithm"},
386{SSL_R_UNSUPPORTED_PROTOCOL ,"unsupported protocol"},
387{SSL_R_UNSUPPORTED_SSL_VERSION ,"unsupported ssl version"},
388{SSL_R_WRITE_BIO_NOT_SET ,"write bio not set"},
389{SSL_R_WRONG_CIPHER_RETURNED ,"wrong cipher returned"},
390{SSL_R_WRONG_MESSAGE_TYPE ,"wrong message type"},
391{SSL_R_WRONG_NUMBER_OF_KEY_BITS ,"wrong number of key bits"},
392{SSL_R_WRONG_SIGNATURE_LENGTH ,"wrong signature length"},
393{SSL_R_WRONG_SIGNATURE_SIZE ,"wrong signature size"},
394{SSL_R_WRONG_SSL_VERSION ,"wrong ssl version"},
395{SSL_R_WRONG_VERSION_NUMBER ,"wrong version number"},
396{SSL_R_X509_LIB ,"x509 lib"},
397{SSL_R_X509_VERIFICATION_SETUP_PROBLEMS ,"x509 verification setup problems"},
398{0,NULL}
399 };
400
401#endif
402
403void ERR_load_SSL_strings(void)
404 {
405 static int init=1;
406
407 if (init)
408 {
409 init=0;
410#ifndef NO_ERR
411 ERR_load_strings(ERR_LIB_SSL,SSL_str_functs);
412 ERR_load_strings(ERR_LIB_SSL,SSL_str_reasons);
413#endif
414
415 }
416 }
diff --git a/src/lib/libssl/ssl_err2.c b/src/lib/libssl/ssl_err2.c
deleted file mode 100644
index cc089a612b..0000000000
--- a/src/lib/libssl/ssl_err2.c
+++ /dev/null
@@ -1,70 +0,0 @@
1/* ssl/ssl_err2.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/err.h>
61#include <openssl/ssl.h>
62
63void SSL_load_error_strings(void)
64 {
65#ifndef NO_ERR
66 ERR_load_crypto_strings();
67 ERR_load_SSL_strings();
68#endif
69 }
70
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
deleted file mode 100644
index e192fc4cac..0000000000
--- a/src/lib/libssl/ssl_lib.c
+++ /dev/null
@@ -1,1947 +0,0 @@
1/*! \file ssl/ssl_lib.c
2 * \brief Version independent SSL functions.
3 */
4/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * All rights reserved.
6 *
7 * This package is an SSL implementation written
8 * by Eric Young (eay@cryptsoft.com).
9 * The implementation was written so as to conform with Netscapes SSL.
10 *
11 * This library is free for commercial and non-commercial use as long as
12 * the following conditions are aheared to. The following conditions
13 * apply to all code found in this distribution, be it the RC4, RSA,
14 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
15 * included with this distribution is covered by the same copyright terms
16 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
17 *
18 * Copyright remains Eric Young's, and as such any Copyright notices in
19 * the code are not to be removed.
20 * If this package is used in a product, Eric Young should be given attribution
21 * as the author of the parts of the library used.
22 * This can be in the form of a textual message at program startup or
23 * in documentation (online or textual) provided with the package.
24 *
25 * Redistribution and use in source and binary forms, with or without
26 * modification, are permitted provided that the following conditions
27 * are met:
28 * 1. Redistributions of source code must retain the copyright
29 * notice, this list of conditions and the following disclaimer.
30 * 2. Redistributions in binary form must reproduce the above copyright
31 * notice, this list of conditions and the following disclaimer in the
32 * documentation and/or other materials provided with the distribution.
33 * 3. All advertising materials mentioning features or use of this software
34 * must display the following acknowledgement:
35 * "This product includes cryptographic software written by
36 * Eric Young (eay@cryptsoft.com)"
37 * The word 'cryptographic' can be left out if the rouines from the library
38 * being used are not cryptographic related :-).
39 * 4. If you include any Windows specific code (or a derivative thereof) from
40 * the apps directory (application code) you must include an acknowledgement:
41 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
42 *
43 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
46 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * SUCH DAMAGE.
54 *
55 * The licence and distribution terms for any publically available version or
56 * derivative of this code cannot be changed. i.e. this code cannot simply be
57 * copied and put under another distribution licence
58 * [including the GNU Public Licence.]
59 */
60
61#include <stdio.h>
62#include <openssl/objects.h>
63#include <openssl/lhash.h>
64#include "ssl_locl.h"
65
66char *SSL_version_str=OPENSSL_VERSION_TEXT;
67
68static STACK *ssl_meth=NULL;
69static STACK *ssl_ctx_meth=NULL;
70static int ssl_meth_num=0;
71static int ssl_ctx_meth_num=0;
72
73OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
74 ssl_undefined_function,
75 ssl_undefined_function,
76 ssl_undefined_function,
77 ssl_undefined_function,
78 ssl_undefined_function,
79 ssl_undefined_function,
80 };
81
82int SSL_clear(SSL *s)
83 {
84 int state;
85
86 if (s->method == NULL)
87 {
88 SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED);
89 return(0);
90 }
91
92 s->error=0;
93 s->hit=0;
94 s->shutdown=0;
95
96#if 0
97 /* This is set if we are doing dynamic renegotiation so keep
98 * the old cipher. It is sort of a SSL_clear_lite :-) */
99 if (s->new_session) return(1);
100#endif
101
102 state=s->state; /* Keep to check if we throw away the session-id */
103 s->type=0;
104
105 s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);
106
107 s->version=s->method->version;
108 s->client_version=s->version;
109 s->rwstate=SSL_NOTHING;
110 s->rstate=SSL_ST_READ_HEADER;
111 s->read_ahead=s->ctx->read_ahead;
112
113 if (s->init_buf != NULL)
114 {
115 BUF_MEM_free(s->init_buf);
116 s->init_buf=NULL;
117 }
118
119 ssl_clear_cipher_ctx(s);
120
121 if (ssl_clear_bad_session(s))
122 {
123 SSL_SESSION_free(s->session);
124 s->session=NULL;
125 }
126
127 s->first_packet=0;
128
129#if 1
130 /* Check to see if we were changed into a different method, if
131 * so, revert back if we are not doing session-id reuse. */
132 if ((s->session == NULL) && (s->method != s->ctx->method))
133 {
134 s->method->ssl_free(s);
135 s->method=s->ctx->method;
136 if (!s->method->ssl_new(s))
137 return(0);
138 }
139 else
140#endif
141 s->method->ssl_clear(s);
142 return(1);
143 }
144
145/** Used to change an SSL_CTXs default SSL method type */
146int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth)
147 {
148 STACK_OF(SSL_CIPHER) *sk;
149
150 ctx->method=meth;
151
152 sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),
153 &(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST);
154 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))
155 {
156 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
157 return(0);
158 }
159 return(1);
160 }
161
162SSL *SSL_new(SSL_CTX *ctx)
163 {
164 SSL *s;
165
166 if (ctx == NULL)
167 {
168 SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);
169 return(NULL);
170 }
171 if (ctx->method == NULL)
172 {
173 SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
174 return(NULL);
175 }
176
177 s=(SSL *)Malloc(sizeof(SSL));
178 if (s == NULL) goto err;
179 memset(s,0,sizeof(SSL));
180
181 if (ctx->cert != NULL)
182 {
183 /* Earlier library versions used to copy the pointer to
184 * the CERT, not its contents; only when setting new
185 * parameters for the per-SSL copy, ssl_cert_new would be
186 * called (and the direct reference to the per-SSL_CTX
187 * settings would be lost, but those still were indirectly
188 * accessed for various purposes, and for that reason they
189 * used to be known as s->ctx->default_cert).
190 * Now we don't look at the SSL_CTX's CERT after having
191 * duplicated it once. */
192
193 s->cert = ssl_cert_dup(ctx->cert);
194 if (s->cert == NULL)
195 goto err;
196 }
197 else
198 s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */
199 s->sid_ctx_length=ctx->sid_ctx_length;
200 memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
201 s->verify_mode=ctx->verify_mode;
202 s->verify_depth=ctx->verify_depth;
203 s->verify_callback=ctx->default_verify_callback;
204 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
205 s->ctx=ctx;
206
207 s->verify_result=X509_V_OK;
208
209 s->method=ctx->method;
210
211 if (!s->method->ssl_new(s))
212 goto err;
213
214 s->quiet_shutdown=ctx->quiet_shutdown;
215 s->references=1;
216 s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
217 s->options=ctx->options;
218 s->mode=ctx->mode;
219 SSL_clear(s);
220
221 CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);
222
223 return(s);
224err:
225 if (s != NULL)
226 {
227 if (s->cert != NULL)
228 ssl_cert_free(s->cert);
229 if (s->ctx != NULL)
230 SSL_CTX_free(s->ctx); /* decrement reference count */
231 Free(s);
232 }
233 SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
234 return(NULL);
235 }
236
237int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
238 unsigned int sid_ctx_len)
239 {
240 if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
241 {
242 SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
243 return 0;
244 }
245 ctx->sid_ctx_length=sid_ctx_len;
246 memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len);
247
248 return 1;
249 }
250
251int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
252 unsigned int sid_ctx_len)
253 {
254 if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
255 {
256 SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
257 return 0;
258 }
259 ssl->sid_ctx_length=sid_ctx_len;
260 memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len);
261
262 return 1;
263 }
264
265void SSL_free(SSL *s)
266 {
267 int i;
268
269 if(s == NULL)
270 return;
271
272 i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);
273#ifdef REF_PRINT
274 REF_PRINT("SSL",s);
275#endif
276 if (i > 0) return;
277#ifdef REF_CHECK
278 if (i < 0)
279 {
280 fprintf(stderr,"SSL_free, bad reference count\n");
281 abort(); /* ok */
282 }
283#endif
284
285 CRYPTO_free_ex_data(ssl_meth,(char *)s,&s->ex_data);
286
287 if (s->bbio != NULL)
288 {
289 /* If the buffering BIO is in place, pop it off */
290 if (s->bbio == s->wbio)
291 {
292 s->wbio=BIO_pop(s->wbio);
293 }
294 BIO_free(s->bbio);
295 s->bbio=NULL;
296 }
297 if (s->rbio != NULL)
298 BIO_free_all(s->rbio);
299 if ((s->wbio != NULL) && (s->wbio != s->rbio))
300 BIO_free_all(s->wbio);
301
302 if (s->init_buf != NULL) BUF_MEM_free(s->init_buf);
303
304 /* add extra stuff */
305 if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);
306 if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);
307
308 /* Make the next call work :-) */
309 if (s->session != NULL)
310 {
311 ssl_clear_bad_session(s);
312 SSL_SESSION_free(s->session);
313 }
314
315 ssl_clear_cipher_ctx(s);
316
317 if (s->cert != NULL) ssl_cert_free(s->cert);
318 /* Free up if allocated */
319
320 if (s->ctx) SSL_CTX_free(s->ctx);
321
322 if (s->client_CA != NULL)
323 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);
324
325 if (s->method != NULL) s->method->ssl_free(s);
326
327 Free((char *)s);
328 }
329
330void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio)
331 {
332 /* If the output buffering BIO is still in place, remove it
333 */
334 if (s->bbio != NULL)
335 {
336 if (s->wbio == s->bbio)
337 {
338 s->wbio=s->wbio->next_bio;
339 s->bbio->next_bio=NULL;
340 }
341 }
342 if ((s->rbio != NULL) && (s->rbio != rbio))
343 BIO_free_all(s->rbio);
344 if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio))
345 BIO_free_all(s->wbio);
346 s->rbio=rbio;
347 s->wbio=wbio;
348 }
349
350BIO *SSL_get_rbio(SSL *s)
351 { return(s->rbio); }
352
353BIO *SSL_get_wbio(SSL *s)
354 { return(s->wbio); }
355
356int SSL_get_fd(SSL *s)
357 {
358 int ret= -1;
359 BIO *b,*r;
360
361 b=SSL_get_rbio(s);
362 r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR);
363 if (r != NULL)
364 BIO_get_fd(r,&ret);
365 return(ret);
366 }
367
368#ifndef NO_SOCK
369int SSL_set_fd(SSL *s,int fd)
370 {
371 int ret=0;
372 BIO *bio=NULL;
373
374 bio=BIO_new(BIO_s_socket());
375
376 if (bio == NULL)
377 {
378 SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
379 goto err;
380 }
381 BIO_set_fd(bio,fd,BIO_NOCLOSE);
382 SSL_set_bio(s,bio,bio);
383 ret=1;
384err:
385 return(ret);
386 }
387
388int SSL_set_wfd(SSL *s,int fd)
389 {
390 int ret=0;
391 BIO *bio=NULL;
392
393 if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET)
394 || ((int)BIO_get_fd(s->rbio,NULL) != fd))
395 {
396 bio=BIO_new(BIO_s_socket());
397
398 if (bio == NULL)
399 { SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; }
400 BIO_set_fd(bio,fd,BIO_NOCLOSE);
401 SSL_set_bio(s,SSL_get_rbio(s),bio);
402 }
403 else
404 SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s));
405 ret=1;
406err:
407 return(ret);
408 }
409
410int SSL_set_rfd(SSL *s,int fd)
411 {
412 int ret=0;
413 BIO *bio=NULL;
414
415 if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET)
416 || ((int)BIO_get_fd(s->wbio,NULL) != fd))
417 {
418 bio=BIO_new(BIO_s_socket());
419
420 if (bio == NULL)
421 {
422 SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB);
423 goto err;
424 }
425 BIO_set_fd(bio,fd,BIO_NOCLOSE);
426 SSL_set_bio(s,bio,SSL_get_wbio(s));
427 }
428 else
429 SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s));
430 ret=1;
431err:
432 return(ret);
433 }
434#endif
435
436int SSL_get_verify_mode(SSL *s)
437 {
438 return(s->verify_mode);
439 }
440
441int SSL_get_verify_depth(SSL *s)
442 {
443 return(s->verify_depth);
444 }
445
446int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *)
447 {
448 return(s->verify_callback);
449 }
450
451int SSL_CTX_get_verify_mode(SSL_CTX *ctx)
452 {
453 return(ctx->verify_mode);
454 }
455
456int SSL_CTX_get_verify_depth(SSL_CTX *ctx)
457 {
458 return(ctx->verify_depth);
459 }
460
461int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *)
462 {
463 return(ctx->default_verify_callback);
464 }
465
466void SSL_set_verify(SSL *s,int mode,
467 int (*callback)(int ok,X509_STORE_CTX *ctx))
468 {
469 s->verify_mode=mode;
470 if (callback != NULL)
471 s->verify_callback=callback;
472 }
473
474void SSL_set_verify_depth(SSL *s,int depth)
475 {
476 s->verify_depth=depth;
477 }
478
479void SSL_set_read_ahead(SSL *s,int yes)
480 {
481 s->read_ahead=yes;
482 }
483
484int SSL_get_read_ahead(SSL *s)
485 {
486 return(s->read_ahead);
487 }
488
489int SSL_pending(SSL *s)
490 {
491 return(s->method->ssl_pending(s));
492 }
493
494X509 *SSL_get_peer_certificate(SSL *s)
495 {
496 X509 *r;
497
498 if ((s == NULL) || (s->session == NULL))
499 r=NULL;
500 else
501 r=s->session->peer;
502
503 if (r == NULL) return(r);
504
505 CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509);
506
507 return(r);
508 }
509
510STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s)
511 {
512 STACK_OF(X509) *r;
513
514 if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL))
515 r=NULL;
516 else
517 r=s->session->sess_cert->cert_chain;
518
519 return(r);
520 }
521
522/* Now in theory, since the calling process own 't' it should be safe to
523 * modify. We need to be able to read f without being hassled */
524void SSL_copy_session_id(SSL *t,SSL *f)
525 {
526 CERT *tmp;
527
528 /* Do we need to to SSL locking? */
529 SSL_set_session(t,SSL_get_session(f));
530
531 /* what if we are setup as SSLv2 but want to talk SSLv3 or
532 * vice-versa */
533 if (t->method != f->method)
534 {
535 t->method->ssl_free(t); /* cleanup current */
536 t->method=f->method; /* change method */
537 t->method->ssl_new(t); /* setup new */
538 }
539
540 tmp=t->cert;
541 if (f->cert != NULL)
542 {
543 CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT);
544 t->cert=f->cert;
545 }
546 else
547 t->cert=NULL;
548 if (tmp != NULL) ssl_cert_free(tmp);
549 SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length);
550 }
551
552/* Fix this so it checks all the valid key/cert options */
553int SSL_CTX_check_private_key(SSL_CTX *ctx)
554 {
555 if ( (ctx == NULL) ||
556 (ctx->cert == NULL) ||
557 (ctx->cert->key->x509 == NULL))
558 {
559 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
560 return(0);
561 }
562 if (ctx->cert->key->privatekey == NULL)
563 {
564 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
565 return(0);
566 }
567 return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
568 }
569
570/* Fix this function so that it takes an optional type parameter */
571int SSL_check_private_key(SSL *ssl)
572 {
573 if (ssl == NULL)
574 {
575 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER);
576 return(0);
577 }
578 if (ssl->cert == NULL)
579 {
580 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
581 return 0;
582 }
583 if (ssl->cert->key->x509 == NULL)
584 {
585 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
586 return(0);
587 }
588 if (ssl->cert->key->privatekey == NULL)
589 {
590 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
591 return(0);
592 }
593 return(X509_check_private_key(ssl->cert->key->x509,
594 ssl->cert->key->privatekey));
595 }
596
597int SSL_accept(SSL *s)
598 {
599 if (s->handshake_func == 0)
600 /* Not properly initialized yet */
601 SSL_set_accept_state(s);
602
603 return(s->method->ssl_accept(s));
604 }
605
606int SSL_connect(SSL *s)
607 {
608 if (s->handshake_func == 0)
609 /* Not properly initialized yet */
610 SSL_set_connect_state(s);
611
612 return(s->method->ssl_connect(s));
613 }
614
615long SSL_get_default_timeout(SSL *s)
616 {
617 return(s->method->get_timeout());
618 }
619
620int SSL_read(SSL *s,char *buf,int num)
621 {
622 if (s->handshake_func == 0)
623 {
624 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
625 return -1;
626 }
627
628 if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
629 {
630 s->rwstate=SSL_NOTHING;
631 return(0);
632 }
633 return(s->method->ssl_read(s,buf,num));
634 }
635
636int SSL_peek(SSL *s,char *buf,int num)
637 {
638 if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
639 {
640 return(0);
641 }
642 return(s->method->ssl_peek(s,buf,num));
643 }
644
645int SSL_write(SSL *s,const char *buf,int num)
646 {
647 if (s->handshake_func == 0)
648 {
649 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED);
650 return -1;
651 }
652
653 if (s->shutdown & SSL_SENT_SHUTDOWN)
654 {
655 s->rwstate=SSL_NOTHING;
656 SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN);
657 return(-1);
658 }
659 return(s->method->ssl_write(s,buf,num));
660 }
661
662int SSL_shutdown(SSL *s)
663 {
664 /* Note that this function behaves differently from what one might
665 * expect. Return values are 0 for no success (yet),
666 * 1 for success; but calling it once is usually not enough,
667 * even if blocking I/O is used (see ssl3_shutdown).
668 */
669
670 if (s->handshake_func == 0)
671 {
672 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
673 return -1;
674 }
675
676 if ((s != NULL) && !SSL_in_init(s))
677 return(s->method->ssl_shutdown(s));
678 else
679 return(1);
680 }
681
682int SSL_renegotiate(SSL *s)
683 {
684 s->new_session=1;
685 return(s->method->ssl_renegotiate(s));
686 }
687
688long SSL_ctrl(SSL *s,int cmd,long larg,char *parg)
689 {
690 long l;
691
692 switch (cmd)
693 {
694 case SSL_CTRL_GET_READ_AHEAD:
695 return(s->read_ahead);
696 case SSL_CTRL_SET_READ_AHEAD:
697 l=s->read_ahead;
698 s->read_ahead=larg;
699 return(l);
700 case SSL_CTRL_OPTIONS:
701 return(s->options|=larg);
702 case SSL_CTRL_MODE:
703 return(s->mode|=larg);
704 default:
705 return(s->method->ssl_ctrl(s,cmd,larg,parg));
706 }
707 }
708
709long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
710 {
711 long l;
712
713 switch (cmd)
714 {
715 case SSL_CTRL_GET_READ_AHEAD:
716 return(ctx->read_ahead);
717 case SSL_CTRL_SET_READ_AHEAD:
718 l=ctx->read_ahead;
719 ctx->read_ahead=larg;
720 return(l);
721
722 case SSL_CTRL_SET_SESS_CACHE_SIZE:
723 l=ctx->session_cache_size;
724 ctx->session_cache_size=larg;
725 return(l);
726 case SSL_CTRL_GET_SESS_CACHE_SIZE:
727 return(ctx->session_cache_size);
728 case SSL_CTRL_SET_SESS_CACHE_MODE:
729 l=ctx->session_cache_mode;
730 ctx->session_cache_mode=larg;
731 return(l);
732 case SSL_CTRL_GET_SESS_CACHE_MODE:
733 return(ctx->session_cache_mode);
734
735 case SSL_CTRL_SESS_NUMBER:
736 return(ctx->sessions->num_items);
737 case SSL_CTRL_SESS_CONNECT:
738 return(ctx->stats.sess_connect);
739 case SSL_CTRL_SESS_CONNECT_GOOD:
740 return(ctx->stats.sess_connect_good);
741 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
742 return(ctx->stats.sess_connect_renegotiate);
743 case SSL_CTRL_SESS_ACCEPT:
744 return(ctx->stats.sess_accept);
745 case SSL_CTRL_SESS_ACCEPT_GOOD:
746 return(ctx->stats.sess_accept_good);
747 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
748 return(ctx->stats.sess_accept_renegotiate);
749 case SSL_CTRL_SESS_HIT:
750 return(ctx->stats.sess_hit);
751 case SSL_CTRL_SESS_CB_HIT:
752 return(ctx->stats.sess_cb_hit);
753 case SSL_CTRL_SESS_MISSES:
754 return(ctx->stats.sess_miss);
755 case SSL_CTRL_SESS_TIMEOUTS:
756 return(ctx->stats.sess_timeout);
757 case SSL_CTRL_SESS_CACHE_FULL:
758 return(ctx->stats.sess_cache_full);
759 case SSL_CTRL_OPTIONS:
760 return(ctx->options|=larg);
761 case SSL_CTRL_MODE:
762 return(ctx->mode|=larg);
763 default:
764 return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
765 }
766 }
767
768int ssl_cipher_id_cmp(SSL_CIPHER *a,SSL_CIPHER *b)
769 {
770 long l;
771
772 l=a->id-b->id;
773 if (l == 0L)
774 return(0);
775 else
776 return((l > 0)?1:-1);
777 }
778
779int ssl_cipher_ptr_id_cmp(SSL_CIPHER **ap,SSL_CIPHER **bp)
780 {
781 long l;
782
783 l=(*ap)->id-(*bp)->id;
784 if (l == 0L)
785 return(0);
786 else
787 return((l > 0)?1:-1);
788 }
789
790/** return a STACK of the ciphers available for the SSL and in order of
791 * preference */
792STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
793 {
794 if ((s != NULL) && (s->cipher_list != NULL))
795 {
796 return(s->cipher_list);
797 }
798 else if ((s->ctx != NULL) &&
799 (s->ctx->cipher_list != NULL))
800 {
801 return(s->ctx->cipher_list);
802 }
803 return(NULL);
804 }
805
806/** return a STACK of the ciphers available for the SSL and in order of
807 * algorithm id */
808STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
809 {
810 if ((s != NULL) && (s->cipher_list_by_id != NULL))
811 {
812 return(s->cipher_list_by_id);
813 }
814 else if ((s != NULL) && (s->ctx != NULL) &&
815 (s->ctx->cipher_list_by_id != NULL))
816 {
817 return(s->ctx->cipher_list_by_id);
818 }
819 return(NULL);
820 }
821
822/** The old interface to get the same thing as SSL_get_ciphers() */
823const char *SSL_get_cipher_list(SSL *s,int n)
824 {
825 SSL_CIPHER *c;
826 STACK_OF(SSL_CIPHER) *sk;
827
828 if (s == NULL) return(NULL);
829 sk=SSL_get_ciphers(s);
830 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
831 return(NULL);
832 c=sk_SSL_CIPHER_value(sk,n);
833 if (c == NULL) return(NULL);
834 return(c->name);
835 }
836
837/** specify the ciphers to be used by defaut by the SSL_CTX */
838int SSL_CTX_set_cipher_list(SSL_CTX *ctx,char *str)
839 {
840 STACK_OF(SSL_CIPHER) *sk;
841
842 sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list,
843 &ctx->cipher_list_by_id,str);
844/* XXXX */
845 return((sk == NULL)?0:1);
846 }
847
848/** specify the ciphers to be used by the SSL */
849int SSL_set_cipher_list(SSL *s,char *str)
850 {
851 STACK_OF(SSL_CIPHER) *sk;
852
853 sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list,
854 &s->cipher_list_by_id,str);
855/* XXXX */
856 return((sk == NULL)?0:1);
857 }
858
859/* works well for SSLv2, not so good for SSLv3 */
860char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
861 {
862 char *p;
863 const char *cp;
864 STACK_OF(SSL_CIPHER) *sk;
865 SSL_CIPHER *c;
866 int i;
867
868 if ((s->session == NULL) || (s->session->ciphers == NULL) ||
869 (len < 2))
870 return(NULL);
871
872 p=buf;
873 sk=s->session->ciphers;
874 for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
875 {
876 /* Decrement for either the ':' or a '\0' */
877 len--;
878 c=sk_SSL_CIPHER_value(sk,i);
879 for (cp=c->name; *cp; )
880 {
881 if (len-- == 0)
882 {
883 *p='\0';
884 return(buf);
885 }
886 else
887 *(p++)= *(cp++);
888 }
889 *(p++)=':';
890 }
891 p[-1]='\0';
892 return(buf);
893 }
894
895int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p)
896 {
897 int i,j=0;
898 SSL_CIPHER *c;
899 unsigned char *q;
900
901 if (sk == NULL) return(0);
902 q=p;
903
904 for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
905 {
906 c=sk_SSL_CIPHER_value(sk,i);
907 j=ssl_put_cipher_by_char(s,c,p);
908 p+=j;
909 }
910 return(p-q);
911 }
912
913STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
914 STACK_OF(SSL_CIPHER) **skp)
915 {
916 SSL_CIPHER *c;
917 STACK_OF(SSL_CIPHER) *sk;
918 int i,n;
919
920 n=ssl_put_cipher_by_char(s,NULL,NULL);
921 if ((num%n) != 0)
922 {
923 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
924 return(NULL);
925 }
926 if ((skp == NULL) || (*skp == NULL))
927 sk=sk_SSL_CIPHER_new(NULL); /* change perhaps later */
928 else
929 {
930 sk= *skp;
931 sk_SSL_CIPHER_zero(sk);
932 }
933
934 for (i=0; i<num; i+=n)
935 {
936 c=ssl_get_cipher_by_char(s,p);
937 p+=n;
938 if (c != NULL)
939 {
940 if (!sk_SSL_CIPHER_push(sk,c))
941 {
942 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
943 goto err;
944 }
945 }
946 }
947
948 if (skp != NULL)
949 *skp=sk;
950 return(sk);
951err:
952 if ((skp == NULL) || (*skp == NULL))
953 sk_SSL_CIPHER_free(sk);
954 return(NULL);
955 }
956
957unsigned long SSL_SESSION_hash(SSL_SESSION *a)
958 {
959 unsigned long l;
960
961 l=(unsigned long)
962 ((unsigned int) a->session_id[0] )|
963 ((unsigned int) a->session_id[1]<< 8L)|
964 ((unsigned long)a->session_id[2]<<16L)|
965 ((unsigned long)a->session_id[3]<<24L);
966 return(l);
967 }
968
969int SSL_SESSION_cmp(SSL_SESSION *a,SSL_SESSION *b)
970 {
971 if (a->ssl_version != b->ssl_version)
972 return(1);
973 if (a->session_id_length != b->session_id_length)
974 return(1);
975 return(memcmp(a->session_id,b->session_id,a->session_id_length));
976 }
977
978SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
979 {
980 SSL_CTX *ret=NULL;
981
982 if (meth == NULL)
983 {
984 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED);
985 return(NULL);
986 }
987
988 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)
989 {
990 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
991 goto err;
992 }
993 ret=(SSL_CTX *)Malloc(sizeof(SSL_CTX));
994 if (ret == NULL)
995 goto err;
996
997 memset(ret,0,sizeof(SSL_CTX));
998
999 ret->method=meth;
1000
1001 ret->cert_store=NULL;
1002 ret->session_cache_mode=SSL_SESS_CACHE_SERVER;
1003 ret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
1004 ret->session_cache_head=NULL;
1005 ret->session_cache_tail=NULL;
1006
1007 /* We take the system default */
1008 ret->session_timeout=meth->get_timeout();
1009
1010 ret->new_session_cb=NULL;
1011 ret->remove_session_cb=NULL;
1012 ret->get_session_cb=NULL;
1013
1014 memset((char *)&ret->stats,0,sizeof(ret->stats));
1015
1016 ret->references=1;
1017 ret->quiet_shutdown=0;
1018
1019/* ret->cipher=NULL;*/
1020/* ret->s2->challenge=NULL;
1021 ret->master_key=NULL;
1022 ret->key_arg=NULL;
1023 ret->s2->conn_id=NULL; */
1024
1025 ret->info_callback=NULL;
1026
1027 ret->app_verify_callback=NULL;
1028 ret->app_verify_arg=NULL;
1029
1030 ret->read_ahead=0;
1031 ret->verify_mode=SSL_VERIFY_NONE;
1032 ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
1033 ret->default_verify_callback=NULL;
1034 if ((ret->cert=ssl_cert_new()) == NULL)
1035 goto err;
1036
1037 ret->default_passwd_callback=NULL;
1038 ret->default_passwd_callback_userdata=NULL;
1039 ret->client_cert_cb=NULL;
1040
1041 ret->sessions=lh_new(SSL_SESSION_hash,SSL_SESSION_cmp);
1042 if (ret->sessions == NULL) goto err;
1043 ret->cert_store=X509_STORE_new();
1044 if (ret->cert_store == NULL) goto err;
1045
1046 ssl_create_cipher_list(ret->method,
1047 &ret->cipher_list,&ret->cipher_list_by_id,
1048 SSL_DEFAULT_CIPHER_LIST);
1049 if (ret->cipher_list == NULL
1050 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0)
1051 {
1052 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);
1053 goto err2;
1054 }
1055
1056 if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)
1057 {
1058 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
1059 goto err2;
1060 }
1061 if ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL)
1062 {
1063 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1064 goto err2;
1065 }
1066 if ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL)
1067 {
1068 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1069 goto err2;
1070 }
1071
1072 if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL)
1073 goto err;
1074
1075 CRYPTO_new_ex_data(ssl_ctx_meth,(char *)ret,&ret->ex_data);
1076
1077 ret->extra_certs=NULL;
1078 ret->comp_methods=SSL_COMP_get_compression_methods();
1079
1080 return(ret);
1081err:
1082 SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
1083err2:
1084 if (ret != NULL) SSL_CTX_free(ret);
1085 return(NULL);
1086 }
1087
1088static void SSL_COMP_free(SSL_COMP *comp)
1089 { Free(comp); }
1090
1091void SSL_CTX_free(SSL_CTX *a)
1092 {
1093 int i;
1094
1095 if (a == NULL) return;
1096
1097 i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX);
1098#ifdef REF_PRINT
1099 REF_PRINT("SSL_CTX",a);
1100#endif
1101 if (i > 0) return;
1102#ifdef REF_CHECK
1103 if (i < 0)
1104 {
1105 fprintf(stderr,"SSL_CTX_free, bad reference count\n");
1106 abort(); /* ok */
1107 }
1108#endif
1109 CRYPTO_free_ex_data(ssl_ctx_meth,(char *)a,&a->ex_data);
1110
1111 if (a->sessions != NULL)
1112 {
1113 SSL_CTX_flush_sessions(a,0);
1114 lh_free(a->sessions);
1115 }
1116 if (a->cert_store != NULL)
1117 X509_STORE_free(a->cert_store);
1118 if (a->cipher_list != NULL)
1119 sk_SSL_CIPHER_free(a->cipher_list);
1120 if (a->cipher_list_by_id != NULL)
1121 sk_SSL_CIPHER_free(a->cipher_list_by_id);
1122 if (a->cert != NULL)
1123 ssl_cert_free(a->cert);
1124 if (a->client_CA != NULL)
1125 sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free);
1126 if (a->extra_certs != NULL)
1127 sk_X509_pop_free(a->extra_certs,X509_free);
1128 if (a->comp_methods != NULL)
1129 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);
1130 Free((char *)a);
1131 }
1132
1133void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
1134 {
1135 ctx->default_passwd_callback=cb;
1136 }
1137
1138void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u)
1139 {
1140 ctx->default_passwd_callback_userdata=u;
1141 }
1142
1143void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,int (*cb)(),char *arg)
1144 {
1145 /* now
1146 * int (*cb)(X509_STORE_CTX *),
1147 * but should be
1148 * int (*cb)(X509_STORE_CTX *, void *arg)
1149 */
1150 ctx->app_verify_callback=cb;
1151 ctx->app_verify_arg=arg; /* never used */
1152 }
1153
1154void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *))
1155 {
1156 ctx->verify_mode=mode;
1157 ctx->default_verify_callback=cb;
1158 /* This needs cleaning up EAY EAY EAY */
1159 X509_STORE_set_verify_cb_func(ctx->cert_store,cb);
1160 }
1161
1162void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth)
1163 {
1164 ctx->verify_depth=depth;
1165 }
1166
1167void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
1168 {
1169 CERT_PKEY *cpk;
1170 int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign;
1171 int rsa_enc_export,dh_rsa_export,dh_dsa_export;
1172 int rsa_tmp_export,dh_tmp_export,kl;
1173 unsigned long mask,emask;
1174
1175 if (c == NULL) return;
1176
1177 kl=SSL_C_EXPORT_PKEYLENGTH(cipher);
1178
1179#ifndef NO_RSA
1180 rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL);
1181 rsa_tmp_export=(c->rsa_tmp_cb != NULL ||
1182 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl));
1183#else
1184 rsa_tmp=rsa_tmp_export=0;
1185#endif
1186#ifndef NO_DH
1187 dh_tmp=(c->dh_tmp != NULL || c->dh_tmp_cb != NULL);
1188 dh_tmp_export=(c->dh_tmp_cb != NULL ||
1189 (dh_tmp && DH_size(c->dh_tmp)*8 <= kl));
1190#else
1191 dh_tmp=dh_tmp_export=0;
1192#endif
1193
1194 cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]);
1195 rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL);
1196 rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
1197 cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]);
1198 rsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL);
1199 cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]);
1200 dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL);
1201 cpk= &(c->pkeys[SSL_PKEY_DH_RSA]);
1202 dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL);
1203 dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
1204 cpk= &(c->pkeys[SSL_PKEY_DH_DSA]);
1205/* FIX THIS EAY EAY EAY */
1206 dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL);
1207 dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
1208
1209 mask=0;
1210 emask=0;
1211
1212#ifdef CIPHER_DEBUG
1213 printf("rt=%d rte=%d dht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
1214 rsa_tmp,rsa_tmp_export,dh_tmp,
1215 rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa);
1216#endif
1217
1218 if (rsa_enc || (rsa_tmp && rsa_sign))
1219 mask|=SSL_kRSA;
1220 if (rsa_enc_export || (rsa_tmp_export && (rsa_sign || rsa_enc)))
1221 emask|=SSL_kRSA;
1222
1223#if 0
1224 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */
1225 if ( (dh_tmp || dh_rsa || dh_dsa) &&
1226 (rsa_enc || rsa_sign || dsa_sign))
1227 mask|=SSL_kEDH;
1228 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) &&
1229 (rsa_enc || rsa_sign || dsa_sign))
1230 emask|=SSL_kEDH;
1231#endif
1232
1233 if (dh_tmp_export)
1234 emask|=SSL_kEDH;
1235
1236 if (dh_tmp)
1237 mask|=SSL_kEDH;
1238
1239 if (dh_rsa) mask|=SSL_kDHr;
1240 if (dh_rsa_export) emask|=SSL_kDHr;
1241
1242 if (dh_dsa) mask|=SSL_kDHd;
1243 if (dh_dsa_export) emask|=SSL_kDHd;
1244
1245 if (rsa_enc || rsa_sign)
1246 {
1247 mask|=SSL_aRSA;
1248 emask|=SSL_aRSA;
1249 }
1250
1251 if (dsa_sign)
1252 {
1253 mask|=SSL_aDSS;
1254 emask|=SSL_aDSS;
1255 }
1256
1257#ifdef SSL_ALLOW_ADH
1258 mask|=SSL_aNULL;
1259 emask|=SSL_aNULL;
1260#endif
1261
1262 c->mask=mask;
1263 c->export_mask=emask;
1264 c->valid=1;
1265 }
1266
1267/* THIS NEEDS CLEANING UP */
1268X509 *ssl_get_server_send_cert(SSL *s)
1269 {
1270 unsigned long alg,mask,kalg;
1271 CERT *c;
1272 int i,is_export;
1273
1274 c=s->cert;
1275 ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
1276 alg=s->s3->tmp.new_cipher->algorithms;
1277 is_export=SSL_IS_EXPORT(alg);
1278 mask=is_export?c->export_mask:c->mask;
1279 kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
1280
1281 if (kalg & SSL_kDHr)
1282 i=SSL_PKEY_DH_RSA;
1283 else if (kalg & SSL_kDHd)
1284 i=SSL_PKEY_DH_DSA;
1285 else if (kalg & SSL_aDSS)
1286 i=SSL_PKEY_DSA_SIGN;
1287 else if (kalg & SSL_aRSA)
1288 {
1289 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL)
1290 i=SSL_PKEY_RSA_SIGN;
1291 else
1292 i=SSL_PKEY_RSA_ENC;
1293 }
1294 else /* if (kalg & SSL_aNULL) */
1295 {
1296 SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,SSL_R_INTERNAL_ERROR);
1297 return(NULL);
1298 }
1299 if (c->pkeys[i].x509 == NULL) return(NULL);
1300 return(c->pkeys[i].x509);
1301 }
1302
1303EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher)
1304 {
1305 unsigned long alg;
1306 CERT *c;
1307
1308 alg=cipher->algorithms;
1309 c=s->cert;
1310
1311 if ((alg & SSL_aDSS) &&
1312 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL))
1313 return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey);
1314 else if (alg & SSL_aRSA)
1315 {
1316 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL)
1317 return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey);
1318 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL)
1319 return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey);
1320 else
1321 return(NULL);
1322 }
1323 else /* if (alg & SSL_aNULL) */
1324 {
1325 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,SSL_R_INTERNAL_ERROR);
1326 return(NULL);
1327 }
1328 }
1329
1330void ssl_update_cache(SSL *s,int mode)
1331 {
1332 int i;
1333
1334 /* If the session_id_length is 0, we are not supposed to cache it,
1335 * and it would be rather hard to do anyway :-) */
1336 if (s->session->session_id_length == 0) return;
1337
1338 if ((s->ctx->session_cache_mode & mode)
1339 && (!s->hit)
1340 && SSL_CTX_add_session(s->ctx,s->session)
1341 && (s->ctx->new_session_cb != NULL))
1342 {
1343 CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION);
1344 if (!s->ctx->new_session_cb(s,s->session))
1345 SSL_SESSION_free(s->session);
1346 }
1347
1348 /* auto flush every 255 connections */
1349 i=s->ctx->session_cache_mode;
1350 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) &&
1351 ((i & mode) == mode))
1352 {
1353 if ( (((mode & SSL_SESS_CACHE_CLIENT)
1354 ?s->ctx->stats.sess_connect_good
1355 :s->ctx->stats.sess_accept_good) & 0xff) == 0xff)
1356 {
1357 SSL_CTX_flush_sessions(s->ctx,time(NULL));
1358 }
1359 }
1360 }
1361
1362SSL_METHOD *SSL_get_ssl_method(SSL *s)
1363 {
1364 return(s->method);
1365 }
1366
1367int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth)
1368 {
1369 int conn= -1;
1370 int ret=1;
1371
1372 if (s->method != meth)
1373 {
1374 if (s->handshake_func != NULL)
1375 conn=(s->handshake_func == s->method->ssl_connect);
1376
1377 if (s->method->version == meth->version)
1378 s->method=meth;
1379 else
1380 {
1381 s->method->ssl_free(s);
1382 s->method=meth;
1383 ret=s->method->ssl_new(s);
1384 }
1385
1386 if (conn == 1)
1387 s->handshake_func=meth->ssl_connect;
1388 else if (conn == 0)
1389 s->handshake_func=meth->ssl_accept;
1390 }
1391 return(ret);
1392 }
1393
1394int SSL_get_error(SSL *s,int i)
1395 {
1396 int reason;
1397 unsigned long l;
1398 BIO *bio;
1399
1400 if (i > 0) return(SSL_ERROR_NONE);
1401
1402 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake
1403 * etc, where we do encode the error */
1404 if ((l=ERR_peek_error()) != 0)
1405 {
1406 if (ERR_GET_LIB(l) == ERR_LIB_SYS)
1407 return(SSL_ERROR_SYSCALL);
1408 else
1409 return(SSL_ERROR_SSL);
1410 }
1411
1412 if ((i < 0) && SSL_want_read(s))
1413 {
1414 bio=SSL_get_rbio(s);
1415 if (BIO_should_read(bio))
1416 return(SSL_ERROR_WANT_READ);
1417 else if (BIO_should_write(bio))
1418 /* This one doesn't make too much sense ... We never try
1419 * to write to the rbio, and an application program where
1420 * rbio and wbio are separate couldn't even know what it
1421 * should wait for.
1422 * However if we ever set s->rwstate incorrectly
1423 * (so that we have SSL_want_read(s) instead of
1424 * SSL_want_write(s)) and rbio and wbio *are* the same,
1425 * this test works around that bug; so it might be safer
1426 * to keep it. */
1427 return(SSL_ERROR_WANT_WRITE);
1428 else if (BIO_should_io_special(bio))
1429 {
1430 reason=BIO_get_retry_reason(bio);
1431 if (reason == BIO_RR_CONNECT)
1432 return(SSL_ERROR_WANT_CONNECT);
1433 else
1434 return(SSL_ERROR_SYSCALL); /* unknown */
1435 }
1436 }
1437
1438 if ((i < 0) && SSL_want_write(s))
1439 {
1440 bio=SSL_get_wbio(s);
1441 if (BIO_should_write(bio))
1442 return(SSL_ERROR_WANT_WRITE);
1443 else if (BIO_should_read(bio))
1444 /* See above (SSL_want_read(s) with BIO_should_write(bio)) */
1445 return(SSL_ERROR_WANT_READ);
1446 else if (BIO_should_io_special(bio))
1447 {
1448 reason=BIO_get_retry_reason(bio);
1449 if (reason == BIO_RR_CONNECT)
1450 return(SSL_ERROR_WANT_CONNECT);
1451 else
1452 return(SSL_ERROR_SYSCALL);
1453 }
1454 }
1455 if ((i < 0) && SSL_want_x509_lookup(s))
1456 {
1457 return(SSL_ERROR_WANT_X509_LOOKUP);
1458 }
1459
1460 if (i == 0)
1461 {
1462 if (s->version == SSL2_VERSION)
1463 {
1464 /* assume it is the socket being closed */
1465 return(SSL_ERROR_ZERO_RETURN);
1466 }
1467 else
1468 {
1469 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
1470 (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
1471 return(SSL_ERROR_ZERO_RETURN);
1472 }
1473 }
1474 return(SSL_ERROR_SYSCALL);
1475 }
1476
1477int SSL_do_handshake(SSL *s)
1478 {
1479 int ret=1;
1480
1481 if (s->handshake_func == NULL)
1482 {
1483 SSLerr(SSL_F_SSL_DO_HANDSHAKE,SSL_R_CONNECTION_TYPE_NOT_SET);
1484 return(-1);
1485 }
1486
1487 s->method->ssl_renegotiate_check(s);
1488
1489 if (SSL_in_init(s) || SSL_in_before(s))
1490 {
1491 ret=s->handshake_func(s);
1492 }
1493 return(ret);
1494 }
1495
1496/* For the next 2 functions, SSL_clear() sets shutdown and so
1497 * one of these calls will reset it */
1498void SSL_set_accept_state(SSL *s)
1499 {
1500 s->server=1;
1501 s->shutdown=0;
1502 s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE;
1503 s->handshake_func=s->method->ssl_accept;
1504 /* clear the current cipher */
1505 ssl_clear_cipher_ctx(s);
1506 }
1507
1508void SSL_set_connect_state(SSL *s)
1509 {
1510 s->server=0;
1511 s->shutdown=0;
1512 s->state=SSL_ST_CONNECT|SSL_ST_BEFORE;
1513 s->handshake_func=s->method->ssl_connect;
1514 /* clear the current cipher */
1515 ssl_clear_cipher_ctx(s);
1516 }
1517
1518int ssl_undefined_function(SSL *s)
1519 {
1520 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1521 return(0);
1522 }
1523
1524SSL_METHOD *ssl_bad_method(int ver)
1525 {
1526 SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1527 return(NULL);
1528 }
1529
1530char *SSL_get_version(SSL *s)
1531 {
1532 if (s->version == TLS1_VERSION)
1533 return("TLSv1");
1534 else if (s->version == SSL3_VERSION)
1535 return("SSLv3");
1536 else if (s->version == SSL2_VERSION)
1537 return("SSLv2");
1538 else
1539 return("unknown");
1540 }
1541
1542SSL *SSL_dup(SSL *s)
1543 {
1544 STACK_OF(X509_NAME) *sk;
1545 X509_NAME *xn;
1546 SSL *ret;
1547 int i;
1548
1549 if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL)
1550 return(NULL);
1551
1552 if (s->session != NULL)
1553 {
1554 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */
1555 SSL_copy_session_id(ret,s);
1556 }
1557 else
1558 {
1559 /* No session has been established yet, so we have to expect
1560 * that s->cert or ret->cert will be changed later --
1561 * they should not both point to the same object,
1562 * and thus we can't use SSL_copy_session_id. */
1563
1564 ret->method = s->method;
1565 ret->method->ssl_new(ret);
1566
1567 if (s->cert != NULL)
1568 {
1569 ret->cert = ssl_cert_dup(s->cert);
1570 if (ret->cert == NULL)
1571 goto err;
1572 }
1573
1574 SSL_set_session_id_context(ret,
1575 s->sid_ctx, s->sid_ctx_length);
1576 }
1577
1578 SSL_set_read_ahead(ret,SSL_get_read_ahead(s));
1579 SSL_set_verify(ret,SSL_get_verify_mode(s),
1580 SSL_get_verify_callback(s));
1581 SSL_set_verify_depth(ret,SSL_get_verify_depth(s));
1582
1583 SSL_set_info_callback(ret,SSL_get_info_callback(s));
1584
1585 ret->debug=s->debug;
1586 ret->options=s->options;
1587
1588 /* copy app data, a little dangerous perhaps */
1589 if (!CRYPTO_dup_ex_data(ssl_meth,&ret->ex_data,&s->ex_data))
1590 goto err;
1591
1592 /* setup rbio, and wbio */
1593 if (s->rbio != NULL)
1594 {
1595 if (!BIO_dup_state(s->rbio,(char *)&ret->rbio))
1596 goto err;
1597 }
1598 if (s->wbio != NULL)
1599 {
1600 if (s->wbio != s->rbio)
1601 {
1602 if (!BIO_dup_state(s->wbio,(char *)&ret->wbio))
1603 goto err;
1604 }
1605 else
1606 ret->wbio=ret->rbio;
1607 }
1608
1609 /* dup the cipher_list and cipher_list_by_id stacks */
1610 if (s->cipher_list != NULL)
1611 {
1612 if ((ret->cipher_list=sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
1613 goto err;
1614 }
1615 if (s->cipher_list_by_id != NULL)
1616 if ((ret->cipher_list_by_id=sk_SSL_CIPHER_dup(s->cipher_list_by_id))
1617 == NULL)
1618 goto err;
1619
1620 /* Dup the client_CA list */
1621 if (s->client_CA != NULL)
1622 {
1623 if ((sk=sk_X509_NAME_dup(s->client_CA)) == NULL) goto err;
1624 ret->client_CA=sk;
1625 for (i=0; i<sk_X509_NAME_num(sk); i++)
1626 {
1627 xn=sk_X509_NAME_value(sk,i);
1628 if (sk_X509_NAME_set(sk,i,X509_NAME_dup(xn)) == NULL)
1629 {
1630 X509_NAME_free(xn);
1631 goto err;
1632 }
1633 }
1634 }
1635
1636 ret->shutdown=s->shutdown;
1637 ret->state=s->state;
1638 ret->handshake_func=s->handshake_func;
1639 ret->server=s->server;
1640
1641 if (0)
1642 {
1643err:
1644 if (ret != NULL) SSL_free(ret);
1645 ret=NULL;
1646 }
1647 return(ret);
1648 }
1649
1650void ssl_clear_cipher_ctx(SSL *s)
1651 {
1652 if (s->enc_read_ctx != NULL)
1653 {
1654 EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
1655 Free(s->enc_read_ctx);
1656 s->enc_read_ctx=NULL;
1657 }
1658 if (s->enc_write_ctx != NULL)
1659 {
1660 EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
1661 Free(s->enc_write_ctx);
1662 s->enc_write_ctx=NULL;
1663 }
1664 if (s->expand != NULL)
1665 {
1666 COMP_CTX_free(s->expand);
1667 s->expand=NULL;
1668 }
1669 if (s->compress != NULL)
1670 {
1671 COMP_CTX_free(s->compress);
1672 s->compress=NULL;
1673 }
1674 }
1675
1676/* Fix this function so that it takes an optional type parameter */
1677X509 *SSL_get_certificate(SSL *s)
1678 {
1679 if (s->cert != NULL)
1680 return(s->cert->key->x509);
1681 else
1682 return(NULL);
1683 }
1684
1685/* Fix this function so that it takes an optional type parameter */
1686EVP_PKEY *SSL_get_privatekey(SSL *s)
1687 {
1688 if (s->cert != NULL)
1689 return(s->cert->key->privatekey);
1690 else
1691 return(NULL);
1692 }
1693
1694SSL_CIPHER *SSL_get_current_cipher(SSL *s)
1695 {
1696 if ((s->session != NULL) && (s->session->cipher != NULL))
1697 return(s->session->cipher);
1698 return(NULL);
1699 }
1700
1701int ssl_init_wbio_buffer(SSL *s,int push)
1702 {
1703 BIO *bbio;
1704
1705 if (s->bbio == NULL)
1706 {
1707 bbio=BIO_new(BIO_f_buffer());
1708 if (bbio == NULL) return(0);
1709 s->bbio=bbio;
1710 }
1711 else
1712 {
1713 bbio=s->bbio;
1714 if (s->bbio == s->wbio)
1715 s->wbio=BIO_pop(s->wbio);
1716 }
1717 (void)BIO_reset(bbio);
1718/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */
1719 if (!BIO_set_read_buffer_size(bbio,1))
1720 {
1721 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER,ERR_R_BUF_LIB);
1722 return(0);
1723 }
1724 if (push)
1725 {
1726 if (s->wbio != bbio)
1727 s->wbio=BIO_push(bbio,s->wbio);
1728 }
1729 else
1730 {
1731 if (s->wbio == bbio)
1732 s->wbio=BIO_pop(bbio);
1733 }
1734 return(1);
1735 }
1736
1737void ssl_free_wbio_buffer(SSL *s)
1738 {
1739 BIO *under;
1740
1741 if (s->bbio == NULL) return;
1742
1743 if (s->bbio == s->wbio)
1744 {
1745 /* remove buffering */
1746 under=BIO_pop(s->wbio);
1747 if (under != NULL)
1748 s->wbio=under;
1749 else
1750 abort(); /* ok */
1751 }
1752 BIO_free(s->bbio);
1753 s->bbio=NULL;
1754 }
1755
1756void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode)
1757 {
1758 ctx->quiet_shutdown=mode;
1759 }
1760
1761int SSL_CTX_get_quiet_shutdown(SSL_CTX *ctx)
1762 {
1763 return(ctx->quiet_shutdown);
1764 }
1765
1766void SSL_set_quiet_shutdown(SSL *s,int mode)
1767 {
1768 s->quiet_shutdown=mode;
1769 }
1770
1771int SSL_get_quiet_shutdown(SSL *s)
1772 {
1773 return(s->quiet_shutdown);
1774 }
1775
1776void SSL_set_shutdown(SSL *s,int mode)
1777 {
1778 s->shutdown=mode;
1779 }
1780
1781int SSL_get_shutdown(SSL *s)
1782 {
1783 return(s->shutdown);
1784 }
1785
1786int SSL_version(SSL *s)
1787 {
1788 return(s->version);
1789 }
1790
1791SSL_CTX *SSL_get_SSL_CTX(SSL *ssl)
1792 {
1793 return(ssl->ctx);
1794 }
1795
1796#ifndef NO_STDIO
1797int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
1798 {
1799 return(X509_STORE_set_default_paths(ctx->cert_store));
1800 }
1801
1802int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
1803 const char *CApath)
1804 {
1805 return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath));
1806 }
1807#endif
1808
1809void SSL_set_info_callback(SSL *ssl,void (*cb)())
1810 {
1811 ssl->info_callback=cb;
1812 }
1813
1814void (*SSL_get_info_callback(SSL *ssl))(void)
1815 {
1816 return((void (*)())ssl->info_callback);
1817 }
1818
1819int SSL_state(SSL *ssl)
1820 {
1821 return(ssl->state);
1822 }
1823
1824void SSL_set_verify_result(SSL *ssl,long arg)
1825 {
1826 ssl->verify_result=arg;
1827 }
1828
1829long SSL_get_verify_result(SSL *ssl)
1830 {
1831 return(ssl->verify_result);
1832 }
1833
1834int SSL_get_ex_new_index(long argl,char *argp,int (*new_func)(),
1835 int (*dup_func)(),void (*free_func)())
1836 {
1837 ssl_meth_num++;
1838 return(CRYPTO_get_ex_new_index(ssl_meth_num-1,
1839 &ssl_meth,argl,argp,new_func,dup_func,free_func));
1840 }
1841
1842int SSL_set_ex_data(SSL *s,int idx,void *arg)
1843 {
1844 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
1845 }
1846
1847void *SSL_get_ex_data(SSL *s,int idx)
1848 {
1849 return(CRYPTO_get_ex_data(&s->ex_data,idx));
1850 }
1851
1852int SSL_CTX_get_ex_new_index(long argl,char *argp,int (*new_func)(),
1853 int (*dup_func)(),void (*free_func)())
1854 {
1855 ssl_ctx_meth_num++;
1856 return(CRYPTO_get_ex_new_index(ssl_ctx_meth_num-1,
1857 &ssl_ctx_meth,argl,argp,new_func,dup_func,free_func));
1858 }
1859
1860int SSL_CTX_set_ex_data(SSL_CTX *s,int idx,void *arg)
1861 {
1862 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
1863 }
1864
1865void *SSL_CTX_get_ex_data(SSL_CTX *s,int idx)
1866 {
1867 return(CRYPTO_get_ex_data(&s->ex_data,idx));
1868 }
1869
1870int ssl_ok(SSL *s)
1871 {
1872 return(1);
1873 }
1874
1875X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *ctx)
1876 {
1877 return(ctx->cert_store);
1878 }
1879
1880void SSL_CTX_set_cert_store(SSL_CTX *ctx,X509_STORE *store)
1881 {
1882 if (ctx->cert_store != NULL)
1883 X509_STORE_free(ctx->cert_store);
1884 ctx->cert_store=store;
1885 }
1886
1887int SSL_want(SSL *s)
1888 {
1889 return(s->rwstate);
1890 }
1891
1892/*!
1893 * \brief Set the callback for generating temporary RSA keys.
1894 * \param ctx the SSL context.
1895 * \param cb the callback
1896 */
1897
1898#ifndef NO_RSA
1899void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
1900 int is_export,
1901 int keylength))
1902 { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
1903#endif
1904
1905#ifndef NO_RSA
1906void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,int is_export,
1907 int keylength))
1908 { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
1909#endif
1910
1911#ifdef DOXYGEN
1912/*!
1913 * \brief The RSA temporary key callback function.
1914 * \param ssl the SSL session.
1915 * \param is_export \c TRUE if the temp RSA key is for an export ciphersuite.
1916 * \param keylength if \c is_export is \c TRUE, then \c keylength is the size
1917 * of the required key in bits.
1918 * \return the temporary RSA key.
1919 * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback
1920 */
1921
1922RSA *cb(SSL *ssl,int is_export,int keylength)
1923 {}
1924#endif
1925
1926/*!
1927 * \brief Set the callback for generating temporary DH keys.
1928 * \param ctx the SSL context.
1929 * \param dh the callback
1930 */
1931
1932#ifndef NO_DH
1933void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
1934 int keylength))
1935 { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
1936
1937void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
1938 int keylength))
1939 { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
1940#endif
1941
1942#if defined(_WINDLL) && defined(WIN16)
1943#include "../crypto/bio/bss_file.c"
1944#endif
1945
1946IMPLEMENT_STACK_OF(SSL_CIPHER)
1947IMPLEMENT_STACK_OF(SSL_COMP)
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
deleted file mode 100644
index 0bfd57db32..0000000000
--- a/src/lib/libssl/ssl_locl.h
+++ /dev/null
@@ -1,499 +0,0 @@
1/* ssl/ssl_locl.h */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_SSL_LOCL_H
60#define HEADER_SSL_LOCL_H
61#include <stdlib.h>
62#include <time.h>
63#include <string.h>
64#include <errno.h>
65
66#include "openssl/e_os.h"
67
68#include <openssl/buffer.h>
69#include <openssl/comp.h>
70#include <openssl/bio.h>
71#include <openssl/crypto.h>
72#include <openssl/evp.h>
73#include <openssl/stack.h>
74#include <openssl/x509.h>
75#include <openssl/err.h>
76#include <openssl/ssl.h>
77
78#define PKCS1_CHECK
79
80#define c2l(c,l) (l = ((unsigned long)(*((c)++))) , \
81 l|=(((unsigned long)(*((c)++)))<< 8), \
82 l|=(((unsigned long)(*((c)++)))<<16), \
83 l|=(((unsigned long)(*((c)++)))<<24))
84
85/* NOTE - c is not incremented as per c2l */
86#define c2ln(c,l1,l2,n) { \
87 c+=n; \
88 l1=l2=0; \
89 switch (n) { \
90 case 8: l2 =((unsigned long)(*(--(c))))<<24; \
91 case 7: l2|=((unsigned long)(*(--(c))))<<16; \
92 case 6: l2|=((unsigned long)(*(--(c))))<< 8; \
93 case 5: l2|=((unsigned long)(*(--(c)))); \
94 case 4: l1 =((unsigned long)(*(--(c))))<<24; \
95 case 3: l1|=((unsigned long)(*(--(c))))<<16; \
96 case 2: l1|=((unsigned long)(*(--(c))))<< 8; \
97 case 1: l1|=((unsigned long)(*(--(c)))); \
98 } \
99 }
100
101#define l2c(l,c) (*((c)++)=(unsigned char)(((l) )&0xff), \
102 *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
103 *((c)++)=(unsigned char)(((l)>>16)&0xff), \
104 *((c)++)=(unsigned char)(((l)>>24)&0xff))
105
106#define n2l(c,l) (l =((unsigned long)(*((c)++)))<<24, \
107 l|=((unsigned long)(*((c)++)))<<16, \
108 l|=((unsigned long)(*((c)++)))<< 8, \
109 l|=((unsigned long)(*((c)++))))
110
111#define l2n(l,c) (*((c)++)=(unsigned char)(((l)>>24)&0xff), \
112 *((c)++)=(unsigned char)(((l)>>16)&0xff), \
113 *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
114 *((c)++)=(unsigned char)(((l) )&0xff))
115
116/* NOTE - c is not incremented as per l2c */
117#define l2cn(l1,l2,c,n) { \
118 c+=n; \
119 switch (n) { \
120 case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
121 case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
122 case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
123 case 5: *(--(c))=(unsigned char)(((l2) )&0xff); \
124 case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
125 case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
126 case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
127 case 1: *(--(c))=(unsigned char)(((l1) )&0xff); \
128 } \
129 }
130
131#define n2s(c,s) ((s=(((unsigned int)(c[0]))<< 8)| \
132 (((unsigned int)(c[1])) )),c+=2)
133#define s2n(s,c) ((c[0]=(unsigned char)(((s)>> 8)&0xff), \
134 c[1]=(unsigned char)(((s) )&0xff)),c+=2)
135
136#define n2l3(c,l) ((l =(((unsigned long)(c[0]))<<16)| \
137 (((unsigned long)(c[1]))<< 8)| \
138 (((unsigned long)(c[2])) )),c+=3)
139
140#define l2n3(l,c) ((c[0]=(unsigned char)(((l)>>16)&0xff), \
141 c[1]=(unsigned char)(((l)>> 8)&0xff), \
142 c[2]=(unsigned char)(((l) )&0xff)),c+=3)
143
144/* LOCAL STUFF */
145
146#define SSL_DECRYPT 0
147#define SSL_ENCRYPT 1
148
149#define TWO_BYTE_BIT 0x80
150#define SEC_ESC_BIT 0x40
151#define TWO_BYTE_MASK 0x7fff
152#define THREE_BYTE_MASK 0x3fff
153
154#define INC32(a) ((a)=((a)+1)&0xffffffffL)
155#define DEC32(a) ((a)=((a)-1)&0xffffffffL)
156#define MAX_MAC_SIZE 20 /* up from 16 for SSLv3 */
157
158#define SSL_MKEY_MASK 0x0000001FL
159#define SSL_kRSA 0x00000001L /* RSA key exchange */
160#define SSL_kDHr 0x00000002L /* DH cert RSA CA cert */
161#define SSL_kDHd 0x00000004L /* DH cert DSA CA cert */
162#define SSL_kFZA 0x00000008L
163#define SSL_kEDH 0x00000010L /* tmp DH key no DH cert */
164#define SSL_EDH (SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL))
165
166#define SSL_AUTH_MASK 0x000003e0L
167#define SSL_aRSA 0x00000020L /* Authenticate with RSA */
168#define SSL_aDSS 0x00000040L /* Authenticate with DSS */
169#define SSL_DSS SSL_aDSS
170#define SSL_aFZA 0x00000080L
171#define SSL_aNULL 0x00000100L /* no Authenticate, ADH */
172#define SSL_aDH 0x00000200L /* no Authenticate, ADH */
173
174#define SSL_NULL (SSL_eNULL)
175#define SSL_ADH (SSL_kEDH|SSL_aNULL)
176#define SSL_RSA (SSL_kRSA|SSL_aRSA)
177#define SSL_DH (SSL_kDHr|SSL_kDHd|SSL_kEDH)
178#define SSL_FZA (SSL_aFZA|SSL_kFZA|SSL_eFZA)
179
180#define SSL_ENC_MASK 0x0001Fc00L
181#define SSL_DES 0x00000400L
182#define SSL_3DES 0x00000800L
183#define SSL_RC4 0x00001000L
184#define SSL_RC2 0x00002000L
185#define SSL_IDEA 0x00004000L
186#define SSL_eFZA 0x00008000L
187#define SSL_eNULL 0x00010000L
188
189#define SSL_MAC_MASK 0x00060000L
190#define SSL_MD5 0x00020000L
191#define SSL_SHA1 0x00040000L
192#define SSL_SHA (SSL_SHA1)
193
194#define SSL_EXP_MASK 0x00300000L
195#define SSL_EXP40 0x00100000L
196#define SSL_NOT_EXP 0x00200000L
197#define SSL_EXP56 0x00300000L
198#define SSL_IS_EXPORT(a) ((a)&SSL_EXP40)
199#define SSL_IS_EXPORT56(a) (((a)&SSL_EXP_MASK) == SSL_EXP56)
200#define SSL_IS_EXPORT40(a) (((a)&SSL_EXP_MASK) == SSL_EXP40)
201#define SSL_C_IS_EXPORT(c) SSL_IS_EXPORT((c)->algorithms)
202#define SSL_C_IS_EXPORT56(c) SSL_IS_EXPORT56((c)->algorithms)
203#define SSL_C_IS_EXPORT40(c) SSL_IS_EXPORT40((c)->algorithms)
204#define SSL_EXPORT_KEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 5 : \
205 ((a)&SSL_ENC_MASK) == SSL_DES ? 8 : 7)
206#define SSL_EXPORT_PKEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 512 : 1024)
207#define SSL_C_EXPORT_KEYLENGTH(c) SSL_EXPORT_KEYLENGTH((c)->algorithms)
208#define SSL_C_EXPORT_PKEYLENGTH(c) SSL_EXPORT_PKEYLENGTH((c)->algorithms)
209
210#define SSL_SSL_MASK 0x00c00000L
211#define SSL_SSLV2 0x00400000L
212#define SSL_SSLV3 0x00800000L
213#define SSL_TLSV1 SSL_SSLV3 /* for now */
214
215#define SSL_STRONG_MASK 0x07000000L
216#define SSL_LOW 0x01000000L
217#define SSL_MEDIUM 0x02000000L
218#define SSL_HIGH 0x04000000L
219
220/* we have used 0fffffff - 4 bits left to go */
221#define SSL_ALL 0xffffffffL
222#define SSL_ALL_CIPHERS (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|\
223 SSL_MAC_MASK|SSL_EXP_MASK)
224
225/* Mostly for SSLv3 */
226#define SSL_PKEY_RSA_ENC 0
227#define SSL_PKEY_RSA_SIGN 1
228#define SSL_PKEY_DSA_SIGN 2
229#define SSL_PKEY_DH_RSA 3
230#define SSL_PKEY_DH_DSA 4
231#define SSL_PKEY_NUM 5
232
233/* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) |
234 * <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN)
235 * SSL_kDH <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN)
236 * SSL_kEDH <- RSA_ENC | RSA_SIGN | DSA_SIGN
237 * SSL_aRSA <- RSA_ENC | RSA_SIGN
238 * SSL_aDSS <- DSA_SIGN
239 */
240
241/*
242#define CERT_INVALID 0
243#define CERT_PUBLIC_KEY 1
244#define CERT_PRIVATE_KEY 2
245*/
246
247typedef struct cert_pkey_st
248 {
249 X509 *x509;
250 EVP_PKEY *privatekey;
251 } CERT_PKEY;
252
253typedef struct cert_st
254 {
255 /* Current active set */
256 CERT_PKEY *key; /* ALWAYS points to an element of the pkeys array
257 * Probably it would make more sense to store
258 * an index, not a pointer. */
259
260 /* The following masks are for the key and auth
261 * algorithms that are supported by the certs below */
262 int valid;
263 unsigned long mask;
264 unsigned long export_mask;
265#ifndef NO_RSA
266 RSA *rsa_tmp;
267 RSA *(*rsa_tmp_cb)(SSL *ssl,int is_export,int keysize);
268#endif
269#ifndef NO_DH
270 DH *dh_tmp;
271 DH *(*dh_tmp_cb)(SSL *ssl,int is_export,int keysize);
272#endif
273
274 CERT_PKEY pkeys[SSL_PKEY_NUM];
275
276 int references; /* >1 only if SSL_copy_session_id is used */
277 } CERT;
278
279
280typedef struct sess_cert_st
281 {
282 STACK_OF(X509) *cert_chain; /* as received from peer (not for SSL2) */
283
284 /* The 'peer_...' members are used only by clients. */
285 int peer_cert_type;
286
287 CERT_PKEY *peer_key; /* points to an element of peer_pkeys (never NULL!) */
288 CERT_PKEY peer_pkeys[SSL_PKEY_NUM];
289 /* Obviously we don't have the private keys of these,
290 * so maybe we shouldn't even use the CERT_PKEY type here. */
291
292#ifndef NO_RSA
293 RSA *peer_rsa_tmp; /* not used for SSL 2 */
294#endif
295#ifndef NO_DH
296 DH *peer_dh_tmp; /* not used for SSL 2 */
297#endif
298
299 int references; /* actually always 1 at the moment */
300 } SESS_CERT;
301
302
303/*#define MAC_DEBUG */
304
305/*#define ERR_DEBUG */
306/*#define ABORT_DEBUG */
307/*#define PKT_DEBUG 1 */
308/*#define DES_DEBUG */
309/*#define DES_OFB_DEBUG */
310/*#define SSL_DEBUG */
311/*#define RSA_DEBUG */
312/*#define IDEA_DEBUG */
313
314#define FP_ICC (int (*)(const void *,const void *))
315#define ssl_put_cipher_by_char(ssl,ciph,ptr) \
316 ((ssl)->method->put_cipher_by_char((ciph),(ptr)))
317#define ssl_get_cipher_by_char(ssl,ptr) \
318 ((ssl)->method->get_cipher_by_char(ptr))
319
320/* This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff
321 * It is a bit of a mess of functions, but hell, think of it as
322 * an opaque strucute :-) */
323typedef struct ssl3_enc_method
324 {
325 int (*enc)();
326 int (*mac)();
327 int (*setup_key_block)();
328 int (*generate_master_secret)();
329 int (*change_cipher_state)();
330 int (*final_finish_mac)();
331 int finish_mac_length;
332 int (*cert_verify_mac)();
333 unsigned char client_finished[20];
334 int client_finished_len;
335 unsigned char server_finished[20];
336 int server_finished_len;
337 int (*alert_value)();
338 } SSL3_ENC_METHOD;
339
340/* Used for holding the relevant compression methods loaded into SSL_CTX */
341typedef struct ssl3_comp_st
342 {
343 int comp_id; /* The identifer byte for this compression type */
344 char *name; /* Text name used for the compression type */
345 COMP_METHOD *method; /* The method :-) */
346 } SSL3_COMP;
347
348OPENSSL_EXTERN SSL3_ENC_METHOD ssl3_undef_enc_method;
349OPENSSL_EXTERN SSL_CIPHER ssl2_ciphers[];
350OPENSSL_EXTERN SSL_CIPHER ssl3_ciphers[];
351
352#ifdef VMS
353#undef SSL_COMP_get_compression_methods
354#define SSL_COMP_get_compression_methods SSL_COMP_get_compress_methods
355#endif
356
357
358SSL_METHOD *ssl_bad_method(int ver);
359SSL_METHOD *sslv2_base_method(void);
360SSL_METHOD *sslv23_base_method(void);
361SSL_METHOD *sslv3_base_method(void);
362
363void ssl_clear_cipher_ctx(SSL *s);
364int ssl_clear_bad_session(SSL *s);
365CERT *ssl_cert_new(void);
366CERT *ssl_cert_dup(CERT *cert);
367int ssl_cert_inst(CERT **o);
368void ssl_cert_free(CERT *c);
369SESS_CERT *ssl_sess_cert_new(void);
370void ssl_sess_cert_free(SESS_CERT *sc);
371int ssl_set_peer_cert_type(SESS_CERT *c, int type);
372int ssl_get_new_session(SSL *s, int session);
373int ssl_get_prev_session(SSL *s, unsigned char *session,int len);
374int ssl_cipher_id_cmp(SSL_CIPHER *a,SSL_CIPHER *b);
375int ssl_cipher_ptr_id_cmp(SSL_CIPHER **ap,SSL_CIPHER **bp);
376STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
377 STACK_OF(SSL_CIPHER) **skp);
378int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p);
379STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *meth,
380 STACK_OF(SSL_CIPHER) **pref,
381 STACK_OF(SSL_CIPHER) **sorted,
382 char *str);
383void ssl_update_cache(SSL *s, int mode);
384int ssl_cipher_get_evp(SSL_SESSION *s,const EVP_CIPHER **enc,const EVP_MD **md,
385 SSL_COMP **comp);
386int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
387int ssl_undefined_function(SSL *s);
388X509 *ssl_get_server_send_cert(SSL *);
389EVP_PKEY *ssl_get_sign_pkey(SSL *,SSL_CIPHER *);
390int ssl_cert_type(X509 *x,EVP_PKEY *pkey);
391void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher);
392STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
393int ssl_verify_alarm_type(long type);
394
395int ssl2_enc_init(SSL *s, int client);
396void ssl2_generate_key_material(SSL *s);
397void ssl2_enc(SSL *s,int send_data);
398void ssl2_mac(SSL *s,unsigned char *mac,int send_data);
399SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p);
400int ssl2_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p);
401int ssl2_part_read(SSL *s, unsigned long f, int i);
402int ssl2_do_write(SSL *s);
403int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data);
404void ssl2_return_error(SSL *s,int reason);
405void ssl2_write_error(SSL *s);
406int ssl2_num_ciphers(void);
407SSL_CIPHER *ssl2_get_cipher(unsigned int u);
408int ssl2_new(SSL *s);
409void ssl2_free(SSL *s);
410int ssl2_accept(SSL *s);
411int ssl2_connect(SSL *s);
412int ssl2_read(SSL *s, void *buf, int len);
413int ssl2_peek(SSL *s, char *buf, int len);
414int ssl2_write(SSL *s, const void *buf, int len);
415int ssl2_shutdown(SSL *s);
416void ssl2_clear(SSL *s);
417long ssl2_ctrl(SSL *s,int cmd, long larg, char *parg);
418long ssl2_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg);
419int ssl2_pending(SSL *s);
420
421SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
422int ssl3_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p);
423void ssl3_init_finished_mac(SSL *s);
424int ssl3_send_server_certificate(SSL *s);
425int ssl3_get_finished(SSL *s,int state_a,int state_b);
426int ssl3_setup_key_block(SSL *s);
427int ssl3_send_change_cipher_spec(SSL *s,int state_a,int state_b);
428int ssl3_change_cipher_state(SSL *s,int which);
429void ssl3_cleanup_key_block(SSL *s);
430int ssl3_do_write(SSL *s,int type);
431void ssl3_send_alert(SSL *s,int level, int desc);
432int ssl3_generate_master_secret(SSL *s, unsigned char *out,
433 unsigned char *p, int len);
434int ssl3_get_req_cert_type(SSL *s,unsigned char *p);
435long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
436int ssl3_send_finished(SSL *s, int a, int b, unsigned char *sender,int slen);
437int ssl3_num_ciphers(void);
438SSL_CIPHER *ssl3_get_cipher(unsigned int u);
439int ssl3_renegotiate(SSL *ssl);
440int ssl3_renegotiate_check(SSL *ssl);
441int ssl3_dispatch_alert(SSL *s);
442int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len);
443int ssl3_part_read(SSL *s, int i);
444int ssl3_write_bytes(SSL *s, int type, const void *buf, int len);
445int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1,EVP_MD_CTX *ctx2,
446 unsigned char *sender, int slen,unsigned char *p);
447int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
448void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len);
449int ssl3_enc(SSL *s, int send_data);
450int ssl3_mac(SSL *ssl, unsigned char *md, int send_data);
451unsigned long ssl3_output_cert_chain(SSL *s, X509 *x);
452SSL_CIPHER *ssl3_choose_cipher(SSL *ssl,STACK_OF(SSL_CIPHER) *have,
453 STACK_OF(SSL_CIPHER) *pref);
454int ssl3_setup_buffers(SSL *s);
455int ssl3_new(SSL *s);
456void ssl3_free(SSL *s);
457int ssl3_accept(SSL *s);
458int ssl3_connect(SSL *s);
459int ssl3_read(SSL *s, void *buf, int len);
460int ssl3_peek(SSL *s,char *buf, int len);
461int ssl3_write(SSL *s, const void *buf, int len);
462int ssl3_shutdown(SSL *s);
463void ssl3_clear(SSL *s);
464long ssl3_ctrl(SSL *s,int cmd, long larg, char *parg);
465long ssl3_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg);
466int ssl3_pending(SSL *s);
467
468int ssl23_accept(SSL *s);
469int ssl23_connect(SSL *s);
470int ssl23_read_bytes(SSL *s, int n);
471int ssl23_write_bytes(SSL *s);
472
473int tls1_new(SSL *s);
474void tls1_free(SSL *s);
475void tls1_clear(SSL *s);
476long tls1_ctrl(SSL *s,int cmd, long larg, char *parg);
477SSL_METHOD *tlsv1_base_method(void );
478
479int ssl_init_wbio_buffer(SSL *s, int push);
480void ssl_free_wbio_buffer(SSL *s);
481
482int tls1_change_cipher_state(SSL *s, int which);
483int tls1_setup_key_block(SSL *s);
484int tls1_enc(SSL *s, int snd);
485int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
486 unsigned char *str, int slen, unsigned char *p);
487int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
488int tls1_mac(SSL *ssl, unsigned char *md, int snd);
489int tls1_generate_master_secret(SSL *s, unsigned char *out,
490 unsigned char *p, int len);
491int tls1_alert_code(int code);
492int ssl3_alert_code(int code);
493int ssl_ok(SSL *s);
494
495SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
496STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
497
498
499#endif
diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
deleted file mode 100644
index 6ec7a5cdb1..0000000000
--- a/src/lib/libssl/ssl_rsa.c
+++ /dev/null
@@ -1,815 +0,0 @@
1/* ssl/ssl_rsa.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/bio.h>
61#include <openssl/objects.h>
62#include <openssl/evp.h>
63#include <openssl/x509.h>
64#include <openssl/pem.h>
65#include "ssl_locl.h"
66
67static int ssl_set_cert(CERT *c, X509 *x509);
68static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
69int SSL_use_certificate(SSL *ssl, X509 *x)
70 {
71 if (x == NULL)
72 {
73 SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER);
74 return(0);
75 }
76 if (!ssl_cert_inst(&ssl->cert))
77 {
78 SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE);
79 return(0);
80 }
81 return(ssl_set_cert(ssl->cert,x));
82 }
83
84#ifndef NO_STDIO
85int SSL_use_certificate_file(SSL *ssl, const char *file, int type)
86 {
87 int j;
88 BIO *in;
89 int ret=0;
90 X509 *x=NULL;
91
92 in=BIO_new(BIO_s_file_internal());
93 if (in == NULL)
94 {
95 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
96 goto end;
97 }
98
99 if (BIO_read_filename(in,file) <= 0)
100 {
101 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
102 goto end;
103 }
104 if (type == SSL_FILETYPE_ASN1)
105 {
106 j=ERR_R_ASN1_LIB;
107 x=d2i_X509_bio(in,NULL);
108 }
109 else if (type == SSL_FILETYPE_PEM)
110 {
111 j=ERR_R_PEM_LIB;
112 x=PEM_read_bio_X509(in,NULL,ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
113 }
114 else
115 {
116 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
117 goto end;
118 }
119
120 if (x == NULL)
121 {
122 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,j);
123 goto end;
124 }
125
126 ret=SSL_use_certificate(ssl,x);
127end:
128 if (x != NULL) X509_free(x);
129 if (in != NULL) BIO_free(in);
130 return(ret);
131 }
132#endif
133
134int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len)
135 {
136 X509 *x;
137 int ret;
138
139 x=d2i_X509(NULL,&d,(long)len);
140 if (x == NULL)
141 {
142 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB);
143 return(0);
144 }
145
146 ret=SSL_use_certificate(ssl,x);
147 X509_free(x);
148 return(ret);
149 }
150
151#ifndef NO_RSA
152int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
153 {
154 EVP_PKEY *pkey;
155 int ret;
156
157 if (rsa == NULL)
158 {
159 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
160 return(0);
161 }
162 if (!ssl_cert_inst(&ssl->cert))
163 {
164 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE);
165 return(0);
166 }
167 if ((pkey=EVP_PKEY_new()) == NULL)
168 {
169 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
170 return(0);
171 }
172
173 CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
174 EVP_PKEY_assign_RSA(pkey,rsa);
175
176 ret=ssl_set_pkey(ssl->cert,pkey);
177 EVP_PKEY_free(pkey);
178 return(ret);
179 }
180#endif
181
182static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
183 {
184 int i,ok=0,bad=0;
185
186 i=ssl_cert_type(NULL,pkey);
187 if (i < 0)
188 {
189 SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
190 return(0);
191 }
192
193 if (c->pkeys[i].x509 != NULL)
194 {
195 EVP_PKEY *pktmp;
196 pktmp = X509_get_pubkey(c->pkeys[i].x509);
197 EVP_PKEY_copy_parameters(pktmp,pkey);
198 EVP_PKEY_free(pktmp);
199 ERR_clear_error();
200
201#ifndef NO_RSA
202 /* Don't check the public/private key, this is mostly
203 * for smart cards. */
204 if ((pkey->type == EVP_PKEY_RSA) &&
205 (RSA_flags(pkey->pkey.rsa) &
206 RSA_METHOD_FLAG_NO_CHECK))
207 ok=1;
208 else
209#endif
210 if (!X509_check_private_key(c->pkeys[i].x509,pkey))
211 {
212 if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
213 {
214 i=(i == SSL_PKEY_DH_RSA)?
215 SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
216
217 if (c->pkeys[i].x509 == NULL)
218 ok=1;
219 else
220 {
221 if (!X509_check_private_key(
222 c->pkeys[i].x509,pkey))
223 bad=1;
224 else
225 ok=1;
226 }
227 }
228 else
229 bad=1;
230 }
231 else
232 ok=1;
233 }
234 else
235 ok=1;
236
237 if (bad)
238 {
239 X509_free(c->pkeys[i].x509);
240 c->pkeys[i].x509=NULL;
241 return(0);
242 }
243
244 if (c->pkeys[i].privatekey != NULL)
245 EVP_PKEY_free(c->pkeys[i].privatekey);
246 CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
247 c->pkeys[i].privatekey=pkey;
248 c->key= &(c->pkeys[i]);
249
250 c->valid=0;
251 return(1);
252 }
253
254#ifndef NO_RSA
255#ifndef NO_STDIO
256int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
257 {
258 int j,ret=0;
259 BIO *in;
260 RSA *rsa=NULL;
261
262 in=BIO_new(BIO_s_file_internal());
263 if (in == NULL)
264 {
265 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
266 goto end;
267 }
268
269 if (BIO_read_filename(in,file) <= 0)
270 {
271 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
272 goto end;
273 }
274 if (type == SSL_FILETYPE_ASN1)
275 {
276 j=ERR_R_ASN1_LIB;
277 rsa=d2i_RSAPrivateKey_bio(in,NULL);
278 }
279 else if (type == SSL_FILETYPE_PEM)
280 {
281 j=ERR_R_PEM_LIB;
282 rsa=PEM_read_bio_RSAPrivateKey(in,NULL,
283 ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
284 }
285 else
286 {
287 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
288 goto end;
289 }
290 if (rsa == NULL)
291 {
292 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,j);
293 goto end;
294 }
295 ret=SSL_use_RSAPrivateKey(ssl,rsa);
296 RSA_free(rsa);
297end:
298 if (in != NULL) BIO_free(in);
299 return(ret);
300 }
301#endif
302
303int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len)
304 {
305 int ret;
306 unsigned char *p;
307 RSA *rsa;
308
309 p=d;
310 if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL)
311 {
312 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
313 return(0);
314 }
315
316 ret=SSL_use_RSAPrivateKey(ssl,rsa);
317 RSA_free(rsa);
318 return(ret);
319 }
320#endif /* !NO_RSA */
321
322int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
323 {
324 int ret;
325
326 if (pkey == NULL)
327 {
328 SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
329 return(0);
330 }
331 if (!ssl_cert_inst(&ssl->cert))
332 {
333 SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
334 return(0);
335 }
336 ret=ssl_set_pkey(ssl->cert,pkey);
337 return(ret);
338 }
339
340#ifndef NO_STDIO
341int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
342 {
343 int j,ret=0;
344 BIO *in;
345 EVP_PKEY *pkey=NULL;
346
347 in=BIO_new(BIO_s_file_internal());
348 if (in == NULL)
349 {
350 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
351 goto end;
352 }
353
354 if (BIO_read_filename(in,file) <= 0)
355 {
356 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
357 goto end;
358 }
359 if (type == SSL_FILETYPE_PEM)
360 {
361 j=ERR_R_PEM_LIB;
362 pkey=PEM_read_bio_PrivateKey(in,NULL,
363 ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
364 }
365 else
366 {
367 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
368 goto end;
369 }
370 if (pkey == NULL)
371 {
372 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,j);
373 goto end;
374 }
375 ret=SSL_use_PrivateKey(ssl,pkey);
376 EVP_PKEY_free(pkey);
377end:
378 if (in != NULL) BIO_free(in);
379 return(ret);
380 }
381#endif
382
383int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, unsigned char *d, long len)
384 {
385 int ret;
386 unsigned char *p;
387 EVP_PKEY *pkey;
388
389 p=d;
390 if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL)
391 {
392 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
393 return(0);
394 }
395
396 ret=SSL_use_PrivateKey(ssl,pkey);
397 EVP_PKEY_free(pkey);
398 return(ret);
399 }
400
401int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
402 {
403 if (x == NULL)
404 {
405 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER);
406 return(0);
407 }
408 if (!ssl_cert_inst(&ctx->cert))
409 {
410 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE);
411 return(0);
412 }
413 return(ssl_set_cert(ctx->cert, x));
414 }
415
416static int ssl_set_cert(CERT *c, X509 *x)
417 {
418 EVP_PKEY *pkey;
419 int i,ok=0,bad=0;
420
421 pkey=X509_get_pubkey(x);
422 if (pkey == NULL)
423 {
424 SSLerr(SSL_F_SSL_SET_CERT,SSL_R_X509_LIB);
425 return(0);
426 }
427
428 i=ssl_cert_type(x,pkey);
429 if (i < 0)
430 {
431 SSLerr(SSL_F_SSL_SET_CERT,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
432 EVP_PKEY_free(pkey);
433 return(0);
434 }
435
436 if (c->pkeys[i].privatekey != NULL)
437 {
438 EVP_PKEY_copy_parameters(pkey,c->pkeys[i].privatekey);
439 ERR_clear_error();
440
441#ifndef NO_RSA
442 /* Don't check the public/private key, this is mostly
443 * for smart cards. */
444 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
445 (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
446 RSA_METHOD_FLAG_NO_CHECK))
447 ok=1;
448 else
449#endif
450 {
451 if (!X509_check_private_key(x,c->pkeys[i].privatekey))
452 {
453 if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
454 {
455 i=(i == SSL_PKEY_DH_RSA)?
456 SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
457
458 if (c->pkeys[i].privatekey == NULL)
459 ok=1;
460 else
461 {
462 if (!X509_check_private_key(x,
463 c->pkeys[i].privatekey))
464 bad=1;
465 else
466 ok=1;
467 }
468 }
469 else
470 bad=1;
471 }
472 else
473 ok=1;
474 } /* NO_RSA */
475 }
476 else
477 ok=1;
478
479 EVP_PKEY_free(pkey);
480 if (bad)
481 {
482 EVP_PKEY_free(c->pkeys[i].privatekey);
483 c->pkeys[i].privatekey=NULL;
484 }
485
486 if (c->pkeys[i].x509 != NULL)
487 X509_free(c->pkeys[i].x509);
488 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
489 c->pkeys[i].x509=x;
490 c->key= &(c->pkeys[i]);
491
492 c->valid=0;
493 return(1);
494 }
495
496#ifndef NO_STDIO
497int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
498 {
499 int j;
500 BIO *in;
501 int ret=0;
502 X509 *x=NULL;
503
504 in=BIO_new(BIO_s_file_internal());
505 if (in == NULL)
506 {
507 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
508 goto end;
509 }
510
511 if (BIO_read_filename(in,file) <= 0)
512 {
513 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
514 goto end;
515 }
516 if (type == SSL_FILETYPE_ASN1)
517 {
518 j=ERR_R_ASN1_LIB;
519 x=d2i_X509_bio(in,NULL);
520 }
521 else if (type == SSL_FILETYPE_PEM)
522 {
523 j=ERR_R_PEM_LIB;
524 x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
525 }
526 else
527 {
528 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
529 goto end;
530 }
531
532 if (x == NULL)
533 {
534 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,j);
535 goto end;
536 }
537
538 ret=SSL_CTX_use_certificate(ctx,x);
539end:
540 if (x != NULL) X509_free(x);
541 if (in != NULL) BIO_free(in);
542 return(ret);
543 }
544#endif
545
546int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d)
547 {
548 X509 *x;
549 int ret;
550
551 x=d2i_X509(NULL,&d,(long)len);
552 if (x == NULL)
553 {
554 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB);
555 return(0);
556 }
557
558 ret=SSL_CTX_use_certificate(ctx,x);
559 X509_free(x);
560 return(ret);
561 }
562
563#ifndef NO_RSA
564int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
565 {
566 int ret;
567 EVP_PKEY *pkey;
568
569 if (rsa == NULL)
570 {
571 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
572 return(0);
573 }
574 if (!ssl_cert_inst(&ctx->cert))
575 {
576 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE);
577 return(0);
578 }
579 if ((pkey=EVP_PKEY_new()) == NULL)
580 {
581 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
582 return(0);
583 }
584
585 CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
586 EVP_PKEY_assign_RSA(pkey,rsa);
587
588 ret=ssl_set_pkey(ctx->cert, pkey);
589 EVP_PKEY_free(pkey);
590 return(ret);
591 }
592
593#ifndef NO_STDIO
594int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
595 {
596 int j,ret=0;
597 BIO *in;
598 RSA *rsa=NULL;
599
600 in=BIO_new(BIO_s_file_internal());
601 if (in == NULL)
602 {
603 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
604 goto end;
605 }
606
607 if (BIO_read_filename(in,file) <= 0)
608 {
609 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
610 goto end;
611 }
612 if (type == SSL_FILETYPE_ASN1)
613 {
614 j=ERR_R_ASN1_LIB;
615 rsa=d2i_RSAPrivateKey_bio(in,NULL);
616 }
617 else if (type == SSL_FILETYPE_PEM)
618 {
619 j=ERR_R_PEM_LIB;
620 rsa=PEM_read_bio_RSAPrivateKey(in,NULL,
621 ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
622 }
623 else
624 {
625 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
626 goto end;
627 }
628 if (rsa == NULL)
629 {
630 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,j);
631 goto end;
632 }
633 ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa);
634 RSA_free(rsa);
635end:
636 if (in != NULL) BIO_free(in);
637 return(ret);
638 }
639#endif
640
641int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len)
642 {
643 int ret;
644 unsigned char *p;
645 RSA *rsa;
646
647 p=d;
648 if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL)
649 {
650 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
651 return(0);
652 }
653
654 ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa);
655 RSA_free(rsa);
656 return(ret);
657 }
658#endif /* !NO_RSA */
659
660int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
661 {
662 if (pkey == NULL)
663 {
664 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER);
665 return(0);
666 }
667 if (!ssl_cert_inst(&ctx->cert))
668 {
669 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
670 return(0);
671 }
672 return(ssl_set_pkey(ctx->cert,pkey));
673 }
674
675#ifndef NO_STDIO
676int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
677 {
678 int j,ret=0;
679 BIO *in;
680 EVP_PKEY *pkey=NULL;
681
682 in=BIO_new(BIO_s_file_internal());
683 if (in == NULL)
684 {
685 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
686 goto end;
687 }
688
689 if (BIO_read_filename(in,file) <= 0)
690 {
691 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
692 goto end;
693 }
694 if (type == SSL_FILETYPE_PEM)
695 {
696 j=ERR_R_PEM_LIB;
697 pkey=PEM_read_bio_PrivateKey(in,NULL,
698 ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
699 }
700 else
701 {
702 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
703 goto end;
704 }
705 if (pkey == NULL)
706 {
707 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,j);
708 goto end;
709 }
710 ret=SSL_CTX_use_PrivateKey(ctx,pkey);
711 EVP_PKEY_free(pkey);
712end:
713 if (in != NULL) BIO_free(in);
714 return(ret);
715 }
716#endif
717
718int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, unsigned char *d,
719 long len)
720 {
721 int ret;
722 unsigned char *p;
723 EVP_PKEY *pkey;
724
725 p=d;
726 if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL)
727 {
728 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
729 return(0);
730 }
731
732 ret=SSL_CTX_use_PrivateKey(ctx,pkey);
733 EVP_PKEY_free(pkey);
734 return(ret);
735 }
736
737
738#ifndef NO_STDIO
739/* Read a file that contains our certificate in "PEM" format,
740 * possibly followed by a sequence of CA certificates that should be
741 * sent to the peer in the Certificate message.
742 */
743int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
744 {
745 BIO *in;
746 int ret=0;
747 X509 *x=NULL;
748
749 in=BIO_new(BIO_s_file_internal());
750 if (in == NULL)
751 {
752 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB);
753 goto end;
754 }
755
756 if (BIO_read_filename(in,file) <= 0)
757 {
758 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_SYS_LIB);
759 goto end;
760 }
761
762 x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
763 if (x == NULL)
764 {
765 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB);
766 goto end;
767 }
768
769 ret=SSL_CTX_use_certificate(ctx,x);
770 if (ERR_peek_error() != 0)
771 ret = 0; /* Key/certificate mismatch doesn't imply ret==0 ... */
772 if (ret)
773 {
774 /* If we could set up our certificate, now proceed to
775 * the CA certificates.
776 */
777 X509 *ca;
778 int r;
779 unsigned long err;
780
781 if (ctx->extra_certs != NULL)
782 {
783 sk_X509_pop_free(ctx->extra_certs, X509_free);
784 ctx->extra_certs = NULL;
785 }
786
787 while ((ca = PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata))
788 != NULL)
789 {
790 r = SSL_CTX_add_extra_chain_cert(ctx, ca);
791 if (!r)
792 {
793 X509_free(ca);
794 ret = 0;
795 goto end;
796 }
797 /* Note that we must not free r if it was successfully
798 * added to the chain (while we must free the main
799 * certificate, since its reference count is increased
800 * by SSL_CTX_use_certificate). */
801 }
802 /* When the while loop ends, it's usually just EOF. */
803 err = ERR_peek_error();
804 if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)
805 (void) ERR_get_error();
806 else
807 ret = 0; /* some real error */
808 }
809
810end:
811 if (x != NULL) X509_free(x);
812 if (in != NULL) BIO_free(in);
813 return(ret);
814 }
815#endif
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
deleted file mode 100644
index 681499f08a..0000000000
--- a/src/lib/libssl/ssl_sess.c
+++ /dev/null
@@ -1,637 +0,0 @@
1/* ssl/ssl_sess.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/lhash.h>
61#include <openssl/rand.h>
62#include "ssl_locl.h"
63
64static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
65static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s);
66static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
67static int ssl_session_num=0;
68static STACK *ssl_session_meth=NULL;
69
70SSL_SESSION *SSL_get_session(SSL *ssl)
71 {
72 return(ssl->session);
73 }
74
75int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
76 int (*dup_func)(), void (*free_func)())
77 {
78 ssl_session_num++;
79 return(CRYPTO_get_ex_new_index(ssl_session_num-1,
80 &ssl_session_meth,
81 argl,argp,new_func,dup_func,free_func));
82 }
83
84int SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg)
85 {
86 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
87 }
88
89void *SSL_SESSION_get_ex_data(SSL_SESSION *s, int idx)
90 {
91 return(CRYPTO_get_ex_data(&s->ex_data,idx));
92 }
93
94SSL_SESSION *SSL_SESSION_new(void)
95 {
96 SSL_SESSION *ss;
97
98 ss=(SSL_SESSION *)Malloc(sizeof(SSL_SESSION));
99 if (ss == NULL)
100 {
101 SSLerr(SSL_F_SSL_SESSION_NEW,ERR_R_MALLOC_FAILURE);
102 return(0);
103 }
104 memset(ss,0,sizeof(SSL_SESSION));
105
106 ss->references=1;
107 ss->timeout=60*5+4; /* 5 minute timeout by default */
108 ss->time=time(NULL);
109 ss->prev=NULL;
110 ss->next=NULL;
111 ss->compress_meth=0;
112 CRYPTO_new_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
113 return(ss);
114 }
115
116int ssl_get_new_session(SSL *s, int session)
117 {
118 /* This gets used by clients and servers. */
119
120 SSL_SESSION *ss=NULL;
121
122 if ((ss=SSL_SESSION_new()) == NULL) return(0);
123
124 /* If the context has a default timeout, use it */
125 if (s->ctx->session_timeout == 0)
126 ss->timeout=SSL_get_default_timeout(s);
127 else
128 ss->timeout=s->ctx->session_timeout;
129
130 if (s->session != NULL)
131 {
132 SSL_SESSION_free(s->session);
133 s->session=NULL;
134 }
135
136 if (session)
137 {
138 if (s->version == SSL2_VERSION)
139 {
140 ss->ssl_version=SSL2_VERSION;
141 ss->session_id_length=SSL2_SSL_SESSION_ID_LENGTH;
142 }
143 else if (s->version == SSL3_VERSION)
144 {
145 ss->ssl_version=SSL3_VERSION;
146 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
147 }
148 else if (s->version == TLS1_VERSION)
149 {
150 ss->ssl_version=TLS1_VERSION;
151 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
152 }
153 else
154 {
155 SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
156 SSL_SESSION_free(ss);
157 return(0);
158 }
159
160 for (;;)
161 {
162 SSL_SESSION *r;
163
164 RAND_bytes(ss->session_id,ss->session_id_length);
165 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
166 r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,
167 (char *)ss);
168 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
169 if (r == NULL) break;
170 /* else - woops a session_id match */
171 /* XXX should also check external cache!
172 * (But the probability of a collision is negligible, anyway...) */
173 }
174 }
175 else
176 {
177 ss->session_id_length=0;
178 }
179
180 memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length);
181 ss->sid_ctx_length=s->sid_ctx_length;
182 s->session=ss;
183 ss->ssl_version=s->version;
184
185 return(1);
186 }
187
188int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
189 {
190 /* This is used only by servers. */
191
192 SSL_SESSION *ret=NULL,data;
193 int fatal = 0;
194
195 /* conn_init();*/
196 data.ssl_version=s->version;
197 data.session_id_length=len;
198 if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
199 goto err;
200 memcpy(data.session_id,session_id,len);
201
202 if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
203 {
204 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
205 ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,(char *)&data);
206 if (ret != NULL)
207 /* don't allow other threads to steal it: */
208 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);
209 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
210 }
211
212 if (ret == NULL)
213 {
214 int copy=1;
215
216 s->ctx->stats.sess_miss++;
217 ret=NULL;
218 if (s->ctx->get_session_cb != NULL
219 && (ret=s->ctx->get_session_cb(s,session_id,len,&copy))
220 != NULL)
221 {
222 s->ctx->stats.sess_cb_hit++;
223
224 /* Increment reference count now if the session callback
225 * asks us to do so (note that if the session structures
226 * returned by the callback are shared between threads,
227 * it must handle the reference count itself [i.e. copy == 0],
228 * or things won't be thread-safe). */
229 if (copy)
230 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);
231
232 /* The following should not return 1, otherwise,
233 * things are very strange */
234 SSL_CTX_add_session(s->ctx,ret);
235 }
236 if (ret == NULL)
237 goto err;
238 }
239
240 /* Now ret is non-NULL, and we own one of its reference counts. */
241
242 if((s->verify_mode&SSL_VERIFY_PEER)
243 && (!s->sid_ctx_length || ret->sid_ctx_length != s->sid_ctx_length
244 || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)))
245 {
246 /* We've found the session named by the client, but we don't
247 * want to use it in this context. */
248
249 if (s->sid_ctx_length == 0)
250 {
251 /* application should have used SSL[_CTX]_set_session_id_context
252 * -- we could tolerate this and just pretend we never heard
253 * of this session, but then applications could effectively
254 * disable the session cache by accident without anyone noticing */
255
256 SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
257 fatal = 1;
258 goto err;
259 }
260 else
261 {
262#if 0 /* The client cannot always know when a session is not appropriate,
263 * so we shouldn't generate an error message. */
264
265 SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
266#endif
267 goto err; /* treat like cache miss */
268 }
269 }
270
271 if (ret->cipher == NULL)
272 {
273 unsigned char buf[5],*p;
274 unsigned long l;
275
276 p=buf;
277 l=ret->cipher_id;
278 l2n(l,p);
279 if ((ret->ssl_version>>8) == SSL3_VERSION_MAJOR)
280 ret->cipher=ssl_get_cipher_by_char(s,&(buf[2]));
281 else
282 ret->cipher=ssl_get_cipher_by_char(s,&(buf[1]));
283 if (ret->cipher == NULL)
284 goto err;
285 }
286
287
288#if 0 /* This is way too late. */
289
290 /* If a thread got the session, then 'swaped', and another got
291 * it and then due to a time-out decided to 'Free' it we could
292 * be in trouble. So I'll increment it now, then double decrement
293 * later - am I speaking rubbish?. */
294 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);
295#endif
296
297 if ((long)(ret->time+ret->timeout) < (long)time(NULL)) /* timeout */
298 {
299 s->ctx->stats.sess_timeout++;
300 /* remove it from the cache */
301 SSL_CTX_remove_session(s->ctx,ret);
302 goto err;
303 }
304
305 s->ctx->stats.sess_hit++;
306
307 /* ret->time=time(NULL); */ /* rezero timeout? */
308 /* again, just leave the session
309 * if it is the same session, we have just incremented and
310 * then decremented the reference count :-) */
311 if (s->session != NULL)
312 SSL_SESSION_free(s->session);
313 s->session=ret;
314 return(1);
315
316 err:
317 if (ret != NULL)
318 SSL_SESSION_free(ret);
319 if (fatal)
320 return -1;
321 else
322 return 0;
323 }
324
325int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
326 {
327 int ret=0;
328 SSL_SESSION *s;
329
330 /* conn_init(); */
331 CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION);
332
333 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
334 s=(SSL_SESSION *)lh_insert(ctx->sessions,(char *)c);
335
336 /* Put on the end of the queue unless it is already in the cache */
337 if (s == NULL)
338 SSL_SESSION_list_add(ctx,c);
339
340 /* If the same session if is being 're-added', Free the old
341 * one when the last person stops using it.
342 * This will also work if it is alread in the cache.
343 * The references will go up and then down :-) */
344 if (s != NULL)
345 {
346 SSL_SESSION_free(s);
347 ret=0;
348 }
349 else
350 {
351 ret=1;
352
353 if (SSL_CTX_sess_get_cache_size(ctx) > 0)
354 {
355 while (SSL_CTX_sess_number(ctx) >
356 SSL_CTX_sess_get_cache_size(ctx))
357 {
358 if (!remove_session_lock(ctx,
359 ctx->session_cache_tail, 0))
360 break;
361 else
362 ctx->stats.sess_cache_full++;
363 }
364 }
365 }
366 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
367 return(ret);
368 }
369
370int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
371{
372 return remove_session_lock(ctx, c, 1);
373}
374
375static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
376 {
377 SSL_SESSION *r;
378 int ret=0;
379
380 if ((c != NULL) && (c->session_id_length != 0))
381 {
382 if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
383 r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
384 if (r != NULL)
385 {
386 ret=1;
387 SSL_SESSION_list_remove(ctx,c);
388 }
389
390 if(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
391
392 if (ret)
393 {
394 r->not_resumable=1;
395 if (ctx->remove_session_cb != NULL)
396 ctx->remove_session_cb(ctx,r);
397 SSL_SESSION_free(r);
398 }
399 }
400 else
401 ret=0;
402 return(ret);
403 }
404
405void SSL_SESSION_free(SSL_SESSION *ss)
406 {
407 int i;
408
409 if(ss == NULL)
410 return;
411
412 i=CRYPTO_add(&ss->references,-1,CRYPTO_LOCK_SSL_SESSION);
413#ifdef REF_PRINT
414 REF_PRINT("SSL_SESSION",ss);
415#endif
416 if (i > 0) return;
417#ifdef REF_CHECK
418 if (i < 0)
419 {
420 fprintf(stderr,"SSL_SESSION_free, bad reference count\n");
421 abort(); /* ok */
422 }
423#endif
424
425 CRYPTO_free_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
426
427 memset(ss->key_arg,0,SSL_MAX_KEY_ARG_LENGTH);
428 memset(ss->master_key,0,SSL_MAX_MASTER_KEY_LENGTH);
429 memset(ss->session_id,0,SSL_MAX_SSL_SESSION_ID_LENGTH);
430 if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert);
431 if (ss->peer != NULL) X509_free(ss->peer);
432 if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers);
433 memset(ss,0,sizeof(*ss));
434 Free(ss);
435 }
436
437int SSL_set_session(SSL *s, SSL_SESSION *session)
438 {
439 int ret=0;
440 SSL_METHOD *meth;
441
442 if (session != NULL)
443 {
444 meth=s->ctx->method->get_ssl_method(session->ssl_version);
445 if (meth == NULL)
446 meth=s->method->get_ssl_method(session->ssl_version);
447 if (meth == NULL)
448 {
449 SSLerr(SSL_F_SSL_SET_SESSION,SSL_R_UNABLE_TO_FIND_SSL_METHOD);
450 return(0);
451 }
452
453 if (meth != s->method)
454 {
455 if (!SSL_set_ssl_method(s,meth))
456 return(0);
457 if (s->ctx->session_timeout == 0)
458 session->timeout=SSL_get_default_timeout(s);
459 else
460 session->timeout=s->ctx->session_timeout;
461 }
462
463 /* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/
464 CRYPTO_add(&session->references,1,CRYPTO_LOCK_SSL_SESSION);
465 if (s->session != NULL)
466 SSL_SESSION_free(s->session);
467 s->session=session;
468 /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/
469 ret=1;
470 }
471 else
472 {
473 if (s->session != NULL)
474 {
475 SSL_SESSION_free(s->session);
476 s->session=NULL;
477 }
478
479 meth=s->ctx->method;
480 if (meth != s->method)
481 {
482 if (!SSL_set_ssl_method(s,meth))
483 return(0);
484 }
485 ret=1;
486 }
487 return(ret);
488 }
489
490long SSL_SESSION_set_timeout(SSL_SESSION *s, long t)
491 {
492 if (s == NULL) return(0);
493 s->timeout=t;
494 return(1);
495 }
496
497long SSL_SESSION_get_timeout(SSL_SESSION *s)
498 {
499 if (s == NULL) return(0);
500 return(s->timeout);
501 }
502
503long SSL_SESSION_get_time(SSL_SESSION *s)
504 {
505 if (s == NULL) return(0);
506 return(s->time);
507 }
508
509long SSL_SESSION_set_time(SSL_SESSION *s, long t)
510 {
511 if (s == NULL) return(0);
512 s->time=t;
513 return(t);
514 }
515
516long SSL_CTX_set_timeout(SSL_CTX *s, long t)
517 {
518 long l;
519 if (s == NULL) return(0);
520 l=s->session_timeout;
521 s->session_timeout=t;
522 return(l);
523 }
524
525long SSL_CTX_get_timeout(SSL_CTX *s)
526 {
527 if (s == NULL) return(0);
528 return(s->session_timeout);
529 }
530
531typedef struct timeout_param_st
532 {
533 SSL_CTX *ctx;
534 long time;
535 LHASH *cache;
536 } TIMEOUT_PARAM;
537
538static void timeout(SSL_SESSION *s, TIMEOUT_PARAM *p)
539 {
540 if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */
541 {
542 /* The reason we don't call SSL_CTX_remove_session() is to
543 * save on locking overhead */
544 lh_delete(p->cache,(char *)s);
545 SSL_SESSION_list_remove(p->ctx,s);
546 s->not_resumable=1;
547 if (p->ctx->remove_session_cb != NULL)
548 p->ctx->remove_session_cb(p->ctx,s);
549 SSL_SESSION_free(s);
550 }
551 }
552
553void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
554 {
555 unsigned long i;
556 TIMEOUT_PARAM tp;
557
558 tp.ctx=s;
559 tp.cache=s->sessions;
560 if (tp.cache == NULL) return;
561 tp.time=t;
562 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
563 i=tp.cache->down_load;
564 tp.cache->down_load=0;
565 lh_doall_arg(tp.cache,(void (*)())timeout,(char *)&tp);
566 tp.cache->down_load=i;
567 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
568 }
569
570int ssl_clear_bad_session(SSL *s)
571 {
572 if ( (s->session != NULL) &&
573 !(s->shutdown & SSL_SENT_SHUTDOWN) &&
574 !(SSL_in_init(s) || SSL_in_before(s)))
575 {
576 SSL_CTX_remove_session(s->ctx,s->session);
577 return(1);
578 }
579 else
580 return(0);
581 }
582
583/* locked by SSL_CTX in the calling function */
584static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s)
585 {
586 if ((s->next == NULL) || (s->prev == NULL)) return;
587
588 if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail))
589 { /* last element in list */
590 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
591 { /* only one element in list */
592 ctx->session_cache_head=NULL;
593 ctx->session_cache_tail=NULL;
594 }
595 else
596 {
597 ctx->session_cache_tail=s->prev;
598 s->prev->next=(SSL_SESSION *)&(ctx->session_cache_tail);
599 }
600 }
601 else
602 {
603 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
604 { /* first element in list */
605 ctx->session_cache_head=s->next;
606 s->next->prev=(SSL_SESSION *)&(ctx->session_cache_head);
607 }
608 else
609 { /* middle of list */
610 s->next->prev=s->prev;
611 s->prev->next=s->next;
612 }
613 }
614 s->prev=s->next=NULL;
615 }
616
617static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
618 {
619 if ((s->next != NULL) && (s->prev != NULL))
620 SSL_SESSION_list_remove(ctx,s);
621
622 if (ctx->session_cache_head == NULL)
623 {
624 ctx->session_cache_head=s;
625 ctx->session_cache_tail=s;
626 s->prev=(SSL_SESSION *)&(ctx->session_cache_head);
627 s->next=(SSL_SESSION *)&(ctx->session_cache_tail);
628 }
629 else
630 {
631 s->next=ctx->session_cache_head;
632 s->next->prev=s;
633 s->prev=(SSL_SESSION *)&(ctx->session_cache_head);
634 ctx->session_cache_head=s;
635 }
636 }
637
diff --git a/src/lib/libssl/ssl_stat.c b/src/lib/libssl/ssl_stat.c
deleted file mode 100644
index 3eca4ee601..0000000000
--- a/src/lib/libssl/ssl_stat.c
+++ /dev/null
@@ -1,454 +0,0 @@
1/* ssl/ssl_stat.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include "ssl_locl.h"
61
62char *SSL_state_string_long(SSL *s)
63 {
64 char *str;
65
66 switch (s->state)
67 {
68case SSL_ST_BEFORE: str="before SSL initialization"; break;
69case SSL_ST_ACCEPT: str="before accept initialization"; break;
70case SSL_ST_CONNECT: str="before connect initialization"; break;
71case SSL_ST_OK: str="SSL negotiation finished successfully"; break;
72case SSL_ST_RENEGOTIATE: str="SSL renegotiate ciphers"; break;
73case SSL_ST_BEFORE|SSL_ST_CONNECT: str="before/connect initialization"; break;
74case SSL_ST_OK|SSL_ST_CONNECT: str="ok/connect SSL initialization"; break;
75case SSL_ST_BEFORE|SSL_ST_ACCEPT: str="before/accept initialization"; break;
76case SSL_ST_OK|SSL_ST_ACCEPT: str="ok/accept SSL initialization"; break;
77#ifndef NO_SSL2
78case SSL2_ST_CLIENT_START_ENCRYPTION: str="SSLv2 client start encryption"; break;
79case SSL2_ST_SERVER_START_ENCRYPTION: str="SSLv2 server start encryption"; break;
80case SSL2_ST_SEND_CLIENT_HELLO_A: str="SSLv2 write client hello A"; break;
81case SSL2_ST_SEND_CLIENT_HELLO_B: str="SSLv2 write client hello B"; break;
82case SSL2_ST_GET_SERVER_HELLO_A: str="SSLv2 read server hello A"; break;
83case SSL2_ST_GET_SERVER_HELLO_B: str="SSLv2 read server hello B"; break;
84case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="SSLv2 write client master key A"; break;
85case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="SSLv2 write client master key B"; break;
86case SSL2_ST_SEND_CLIENT_FINISHED_A: str="SSLv2 write client finished A"; break;
87case SSL2_ST_SEND_CLIENT_FINISHED_B: str="SSLv2 write client finished B"; break;
88case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="SSLv2 write client certificate A"; break;
89case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="SSLv2 write client certificate B"; break;
90case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="SSLv2 write client certificate C"; break;
91case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="SSLv2 write client certificate D"; break;
92case SSL2_ST_GET_SERVER_VERIFY_A: str="SSLv2 read server verify A"; break;
93case SSL2_ST_GET_SERVER_VERIFY_B: str="SSLv2 read server verify B"; break;
94case SSL2_ST_GET_SERVER_FINISHED_A: str="SSLv2 read server finished A"; break;
95case SSL2_ST_GET_SERVER_FINISHED_B: str="SSLv2 read server finished B"; break;
96case SSL2_ST_GET_CLIENT_HELLO_A: str="SSLv2 read client hello A"; break;
97case SSL2_ST_GET_CLIENT_HELLO_B: str="SSLv2 read client hello B"; break;
98case SSL2_ST_GET_CLIENT_HELLO_C: str="SSLv2 read client hello C"; break;
99case SSL2_ST_SEND_SERVER_HELLO_A: str="SSLv2 write server hello A"; break;
100case SSL2_ST_SEND_SERVER_HELLO_B: str="SSLv2 write server hello B"; break;
101case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="SSLv2 read client master key A"; break;
102case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="SSLv2 read client master key B"; break;
103case SSL2_ST_SEND_SERVER_VERIFY_A: str="SSLv2 write server verify A"; break;
104case SSL2_ST_SEND_SERVER_VERIFY_B: str="SSLv2 write server verify B"; break;
105case SSL2_ST_SEND_SERVER_VERIFY_C: str="SSLv2 write server verify C"; break;
106case SSL2_ST_GET_CLIENT_FINISHED_A: str="SSLv2 read client finished A"; break;
107case SSL2_ST_GET_CLIENT_FINISHED_B: str="SSLv2 read client finished B"; break;
108case SSL2_ST_SEND_SERVER_FINISHED_A: str="SSLv2 write server finished A"; break;
109case SSL2_ST_SEND_SERVER_FINISHED_B: str="SSLv2 write server finished B"; break;
110case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="SSLv2 write request certificate A"; break;
111case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="SSLv2 write request certificate B"; break;
112case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="SSLv2 write request certificate C"; break;
113case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="SSLv2 write request certificate D"; break;
114case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="SSLv2 X509 read server certificate"; break;
115case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="SSLv2 X509 read client certificate"; break;
116#endif
117
118#ifndef NO_SSL3
119/* SSLv3 additions */
120case SSL3_ST_CW_CLNT_HELLO_A: str="SSLv3 write client hello A"; break;
121case SSL3_ST_CW_CLNT_HELLO_B: str="SSLv3 write client hello B"; break;
122case SSL3_ST_CR_SRVR_HELLO_A: str="SSLv3 read server hello A"; break;
123case SSL3_ST_CR_SRVR_HELLO_B: str="SSLv3 read server hello B"; break;
124case SSL3_ST_CR_CERT_A: str="SSLv3 read server certificate A"; break;
125case SSL3_ST_CR_CERT_B: str="SSLv3 read server certificate B"; break;
126case SSL3_ST_CR_KEY_EXCH_A: str="SSLv3 read server key exchange A"; break;
127case SSL3_ST_CR_KEY_EXCH_B: str="SSLv3 read server key exchange B"; break;
128case SSL3_ST_CR_CERT_REQ_A: str="SSLv3 read server certificate request A"; break;
129case SSL3_ST_CR_CERT_REQ_B: str="SSLv3 read server certificate request B"; break;
130case SSL3_ST_CR_SRVR_DONE_A: str="SSLv3 read server done A"; break;
131case SSL3_ST_CR_SRVR_DONE_B: str="SSLv3 read server done B"; break;
132case SSL3_ST_CW_CERT_A: str="SSLv3 write client certificate A"; break;
133case SSL3_ST_CW_CERT_B: str="SSLv3 write client certificate B"; break;
134case SSL3_ST_CW_CERT_C: str="SSLv3 write client certificate C"; break;
135case SSL3_ST_CW_CERT_D: str="SSLv3 write client certificate D"; break;
136case SSL3_ST_CW_KEY_EXCH_A: str="SSLv3 write client key exchange A"; break;
137case SSL3_ST_CW_KEY_EXCH_B: str="SSLv3 write client key exchange B"; break;
138case SSL3_ST_CW_CERT_VRFY_A: str="SSLv3 write certificate verify A"; break;
139case SSL3_ST_CW_CERT_VRFY_B: str="SSLv3 write certificate verify A"; break;
140
141case SSL3_ST_CW_CHANGE_A:
142case SSL3_ST_SW_CHANGE_A: str="SSLv3 write change cipher spec A"; break;
143case SSL3_ST_CW_CHANGE_B:
144case SSL3_ST_SW_CHANGE_B: str="SSLv3 write change cipher spec B"; break;
145case SSL3_ST_CW_FINISHED_A:
146case SSL3_ST_SW_FINISHED_A: str="SSLv3 write finished A"; break;
147case SSL3_ST_CW_FINISHED_B:
148case SSL3_ST_SW_FINISHED_B: str="SSLv3 write finished A"; break;
149case SSL3_ST_CR_CHANGE_A:
150case SSL3_ST_SR_CHANGE_A: str="SSLv3 read change cipher spec A"; break;
151case SSL3_ST_CR_CHANGE_B:
152case SSL3_ST_SR_CHANGE_B: str="SSLv3 read change cipher spec B"; break;
153case SSL3_ST_CR_FINISHED_A:
154case SSL3_ST_SR_FINISHED_A: str="SSLv3 read finished A"; break;
155case SSL3_ST_CR_FINISHED_B:
156case SSL3_ST_SR_FINISHED_B: str="SSLv3 read finished B"; break;
157
158case SSL3_ST_CW_FLUSH:
159case SSL3_ST_SW_FLUSH: str="SSLv3 flush data"; break;
160
161case SSL3_ST_SR_CLNT_HELLO_A: str="SSLv3 read client hello A"; break;
162case SSL3_ST_SR_CLNT_HELLO_B: str="SSLv3 read client hello B"; break;
163case SSL3_ST_SR_CLNT_HELLO_C: str="SSLv3 read client hello C"; break;
164case SSL3_ST_SW_HELLO_REQ_A: str="SSLv3 write hello request A"; break;
165case SSL3_ST_SW_HELLO_REQ_B: str="SSLv3 write hello request B"; break;
166case SSL3_ST_SW_HELLO_REQ_C: str="SSLv3 write hello request C"; break;
167case SSL3_ST_SW_SRVR_HELLO_A: str="SSLv3 write server hello A"; break;
168case SSL3_ST_SW_SRVR_HELLO_B: str="SSLv3 write server hello B"; break;
169case SSL3_ST_SW_CERT_A: str="SSLv3 write certificate A"; break;
170case SSL3_ST_SW_CERT_B: str="SSLv3 write certificate B"; break;
171case SSL3_ST_SW_KEY_EXCH_A: str="SSLv3 write key exchange A"; break;
172case SSL3_ST_SW_KEY_EXCH_B: str="SSLv3 write key exchange B"; break;
173case SSL3_ST_SW_CERT_REQ_A: str="SSLv3 write certificate request A"; break;
174case SSL3_ST_SW_CERT_REQ_B: str="SSLv3 write certificate request B"; break;
175case SSL3_ST_SW_SRVR_DONE_A: str="SSLv3 write server done A"; break;
176case SSL3_ST_SW_SRVR_DONE_B: str="SSLv3 write server done B"; break;
177case SSL3_ST_SR_CERT_A: str="SSLv3 read client certificate A"; break;
178case SSL3_ST_SR_CERT_B: str="SSLv3 read client certificate B"; break;
179case SSL3_ST_SR_KEY_EXCH_A: str="SSLv3 read client key exchange A"; break;
180case SSL3_ST_SR_KEY_EXCH_B: str="SSLv3 read client key exchange B"; break;
181case SSL3_ST_SR_CERT_VRFY_A: str="SSLv3 read certificate verify A"; break;
182case SSL3_ST_SR_CERT_VRFY_B: str="SSLv3 read certificate verify B"; break;
183#endif
184
185#if !defined(NO_SSL2) && !defined(NO_SSL3)
186/* SSLv2/v3 compatablitity states */
187/* client */
188case SSL23_ST_CW_CLNT_HELLO_A: str="SSLv2/v3 write client hello A"; break;
189case SSL23_ST_CW_CLNT_HELLO_B: str="SSLv2/v3 write client hello B"; break;
190case SSL23_ST_CR_SRVR_HELLO_A: str="SSLv2/v3 read server hello A"; break;
191case SSL23_ST_CR_SRVR_HELLO_B: str="SSLv2/v3 read server hello B"; break;
192/* server */
193case SSL23_ST_SR_CLNT_HELLO_A: str="SSLv2/v3 read client hello A"; break;
194case SSL23_ST_SR_CLNT_HELLO_B: str="SSLv2/v3 read client hello B"; break;
195#endif
196
197default: str="unknown state"; break;
198 }
199 return(str);
200 }
201
202char *SSL_rstate_string_long(SSL *s)
203 {
204 char *str;
205
206 switch (s->rstate)
207 {
208 case SSL_ST_READ_HEADER: str="read header"; break;
209 case SSL_ST_READ_BODY: str="read body"; break;
210 case SSL_ST_READ_DONE: str="read done"; break;
211 default: str="unknown"; break;
212 }
213 return(str);
214 }
215
216char *SSL_state_string(SSL *s)
217 {
218 char *str;
219
220 switch (s->state)
221 {
222case SSL_ST_BEFORE: str="PINIT "; break;
223case SSL_ST_ACCEPT: str="AINIT "; break;
224case SSL_ST_CONNECT: str="CINIT "; break;
225case SSL_ST_OK: str="SSLOK "; break;
226#ifndef NO_SSL2
227case SSL2_ST_CLIENT_START_ENCRYPTION: str="2CSENC"; break;
228case SSL2_ST_SERVER_START_ENCRYPTION: str="2SSENC"; break;
229case SSL2_ST_SEND_CLIENT_HELLO_A: str="2SCH_A"; break;
230case SSL2_ST_SEND_CLIENT_HELLO_B: str="2SCH_B"; break;
231case SSL2_ST_GET_SERVER_HELLO_A: str="2GSH_A"; break;
232case SSL2_ST_GET_SERVER_HELLO_B: str="2GSH_B"; break;
233case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="2SCMKA"; break;
234case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="2SCMKB"; break;
235case SSL2_ST_SEND_CLIENT_FINISHED_A: str="2SCF_A"; break;
236case SSL2_ST_SEND_CLIENT_FINISHED_B: str="2SCF_B"; break;
237case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="2SCC_A"; break;
238case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="2SCC_B"; break;
239case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="2SCC_C"; break;
240case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="2SCC_D"; break;
241case SSL2_ST_GET_SERVER_VERIFY_A: str="2GSV_A"; break;
242case SSL2_ST_GET_SERVER_VERIFY_B: str="2GSV_B"; break;
243case SSL2_ST_GET_SERVER_FINISHED_A: str="2GSF_A"; break;
244case SSL2_ST_GET_SERVER_FINISHED_B: str="2GSF_B"; break;
245case SSL2_ST_GET_CLIENT_HELLO_A: str="2GCH_A"; break;
246case SSL2_ST_GET_CLIENT_HELLO_B: str="2GCH_B"; break;
247case SSL2_ST_GET_CLIENT_HELLO_C: str="2GCH_C"; break;
248case SSL2_ST_SEND_SERVER_HELLO_A: str="2SSH_A"; break;
249case SSL2_ST_SEND_SERVER_HELLO_B: str="2SSH_B"; break;
250case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="2GCMKA"; break;
251case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="2GCMKA"; break;
252case SSL2_ST_SEND_SERVER_VERIFY_A: str="2SSV_A"; break;
253case SSL2_ST_SEND_SERVER_VERIFY_B: str="2SSV_B"; break;
254case SSL2_ST_SEND_SERVER_VERIFY_C: str="2SSV_C"; break;
255case SSL2_ST_GET_CLIENT_FINISHED_A: str="2GCF_A"; break;
256case SSL2_ST_GET_CLIENT_FINISHED_B: str="2GCF_B"; break;
257case SSL2_ST_SEND_SERVER_FINISHED_A: str="2SSF_A"; break;
258case SSL2_ST_SEND_SERVER_FINISHED_B: str="2SSF_B"; break;
259case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="2SRC_A"; break;
260case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="2SRC_B"; break;
261case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="2SRC_C"; break;
262case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="2SRC_D"; break;
263case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="2X9GSC"; break;
264case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="2X9GCC"; break;
265#endif
266
267#ifndef NO_SSL3
268/* SSLv3 additions */
269case SSL3_ST_SW_FLUSH:
270case SSL3_ST_CW_FLUSH: str="3FLUSH"; break;
271case SSL3_ST_CW_CLNT_HELLO_A: str="3WCH_A"; break;
272case SSL3_ST_CW_CLNT_HELLO_B: str="3WCH_B"; break;
273case SSL3_ST_CR_SRVR_HELLO_A: str="3RSH_A"; break;
274case SSL3_ST_CR_SRVR_HELLO_B: str="3RSH_B"; break;
275case SSL3_ST_CR_CERT_A: str="3RSC_A"; break;
276case SSL3_ST_CR_CERT_B: str="3RSC_B"; break;
277case SSL3_ST_CR_KEY_EXCH_A: str="3RSKEA"; break;
278case SSL3_ST_CR_KEY_EXCH_B: str="3RSKEB"; break;
279case SSL3_ST_CR_CERT_REQ_A: str="3RCR_A"; break;
280case SSL3_ST_CR_CERT_REQ_B: str="3RCR_B"; break;
281case SSL3_ST_CR_SRVR_DONE_A: str="3RSD_A"; break;
282case SSL3_ST_CR_SRVR_DONE_B: str="3RSD_B"; break;
283case SSL3_ST_CW_CERT_A: str="3WCC_A"; break;
284case SSL3_ST_CW_CERT_B: str="3WCC_B"; break;
285case SSL3_ST_CW_CERT_C: str="3WCC_C"; break;
286case SSL3_ST_CW_CERT_D: str="3WCC_D"; break;
287case SSL3_ST_CW_KEY_EXCH_A: str="3WCKEA"; break;
288case SSL3_ST_CW_KEY_EXCH_B: str="3WCKEB"; break;
289case SSL3_ST_CW_CERT_VRFY_A: str="3WCV_A"; break;
290case SSL3_ST_CW_CERT_VRFY_B: str="3WCV_B"; break;
291
292case SSL3_ST_SW_CHANGE_A:
293case SSL3_ST_CW_CHANGE_A: str="3WCCSA"; break;
294case SSL3_ST_SW_CHANGE_B:
295case SSL3_ST_CW_CHANGE_B: str="3WCCSB"; break;
296case SSL3_ST_SW_FINISHED_A:
297case SSL3_ST_CW_FINISHED_A: str="3WFINA"; break;
298case SSL3_ST_SW_FINISHED_B:
299case SSL3_ST_CW_FINISHED_B: str="3WFINB"; break;
300case SSL3_ST_SR_CHANGE_A:
301case SSL3_ST_CR_CHANGE_A: str="3RCCSA"; break;
302case SSL3_ST_SR_CHANGE_B:
303case SSL3_ST_CR_CHANGE_B: str="3RCCSB"; break;
304case SSL3_ST_SR_FINISHED_A:
305case SSL3_ST_CR_FINISHED_A: str="3RFINA"; break;
306case SSL3_ST_SR_FINISHED_B:
307case SSL3_ST_CR_FINISHED_B: str="3RFINB"; break;
308
309case SSL3_ST_SW_HELLO_REQ_A: str="3WHR_A"; break;
310case SSL3_ST_SW_HELLO_REQ_B: str="3WHR_B"; break;
311case SSL3_ST_SW_HELLO_REQ_C: str="3WHR_C"; break;
312case SSL3_ST_SR_CLNT_HELLO_A: str="3RCH_A"; break;
313case SSL3_ST_SR_CLNT_HELLO_B: str="3RCH_B"; break;
314case SSL3_ST_SR_CLNT_HELLO_C: str="3RCH_C"; break;
315case SSL3_ST_SW_SRVR_HELLO_A: str="3WSH_A"; break;
316case SSL3_ST_SW_SRVR_HELLO_B: str="3WSH_B"; break;
317case SSL3_ST_SW_CERT_A: str="3WSC_A"; break;
318case SSL3_ST_SW_CERT_B: str="3WSC_B"; break;
319case SSL3_ST_SW_KEY_EXCH_A: str="3WSKEA"; break;
320case SSL3_ST_SW_KEY_EXCH_B: str="3WSKEB"; break;
321case SSL3_ST_SW_CERT_REQ_A: str="3WCR_A"; break;
322case SSL3_ST_SW_CERT_REQ_B: str="3WCR_B"; break;
323case SSL3_ST_SW_SRVR_DONE_A: str="3WSD_A"; break;
324case SSL3_ST_SW_SRVR_DONE_B: str="3WSD_B"; break;
325case SSL3_ST_SR_CERT_A: str="3RCC_A"; break;
326case SSL3_ST_SR_CERT_B: str="3RCC_B"; break;
327case SSL3_ST_SR_KEY_EXCH_A: str="3RCKEA"; break;
328case SSL3_ST_SR_KEY_EXCH_B: str="3RCKEB"; break;
329case SSL3_ST_SR_CERT_VRFY_A: str="3RCV_A"; break;
330case SSL3_ST_SR_CERT_VRFY_B: str="3RCV_B"; break;
331#endif
332
333#if !defined(NO_SSL2) && !defined(NO_SSL3)
334/* SSLv2/v3 compatablitity states */
335/* client */
336case SSL23_ST_CW_CLNT_HELLO_A: str="23WCHA"; break;
337case SSL23_ST_CW_CLNT_HELLO_B: str="23WCHB"; break;
338case SSL23_ST_CR_SRVR_HELLO_A: str="23RSHA"; break;
339case SSL23_ST_CR_SRVR_HELLO_B: str="23RSHA"; break;
340/* server */
341case SSL23_ST_SR_CLNT_HELLO_A: str="23RCHA"; break;
342case SSL23_ST_SR_CLNT_HELLO_B: str="23RCHB"; break;
343#endif
344
345default: str="UNKWN "; break;
346 }
347 return(str);
348 }
349
350char *SSL_alert_type_string_long(int value)
351 {
352 value>>=8;
353 if (value == SSL3_AL_WARNING)
354 return("warning");
355 else if (value == SSL3_AL_FATAL)
356 return("fatal");
357 else
358 return("unknown");
359 }
360
361char *SSL_alert_type_string(int value)
362 {
363 value>>=8;
364 if (value == SSL3_AL_WARNING)
365 return("W");
366 else if (value == SSL3_AL_FATAL)
367 return("F");
368 else
369 return("U");
370 }
371
372char *SSL_alert_desc_string(int value)
373 {
374 char *str;
375
376 switch (value & 0xff)
377 {
378 case SSL3_AD_CLOSE_NOTIFY: str="CN"; break;
379 case SSL3_AD_UNEXPECTED_MESSAGE: str="UM"; break;
380 case SSL3_AD_BAD_RECORD_MAC: str="BM"; break;
381 case SSL3_AD_DECOMPRESSION_FAILURE: str="DF"; break;
382 case SSL3_AD_HANDSHAKE_FAILURE: str="HF"; break;
383 case SSL3_AD_NO_CERTIFICATE: str="NC"; break;
384 case SSL3_AD_BAD_CERTIFICATE: str="BC"; break;
385 case SSL3_AD_UNSUPPORTED_CERTIFICATE: str="UC"; break;
386 case SSL3_AD_CERTIFICATE_REVOKED: str="CR"; break;
387 case SSL3_AD_CERTIFICATE_EXPIRED: str="CE"; break;
388 case SSL3_AD_CERTIFICATE_UNKNOWN: str="CU"; break;
389 case SSL3_AD_ILLEGAL_PARAMETER: str="IP"; break;
390 default: str="UK"; break;
391 }
392 return(str);
393 }
394
395char *SSL_alert_desc_string_long(int value)
396 {
397 char *str;
398
399 switch (value & 0xff)
400 {
401 case SSL3_AD_CLOSE_NOTIFY:
402 str="close notify";
403 break;
404 case SSL3_AD_UNEXPECTED_MESSAGE:
405 str="unexected_message";
406 break;
407 case SSL3_AD_BAD_RECORD_MAC:
408 str="bad record mac";
409 break;
410 case SSL3_AD_DECOMPRESSION_FAILURE:
411 str="decompression failure";
412 break;
413 case SSL3_AD_HANDSHAKE_FAILURE:
414 str="handshake failure";
415 break;
416 case SSL3_AD_NO_CERTIFICATE:
417 str="no certificate";
418 break;
419 case SSL3_AD_BAD_CERTIFICATE:
420 str="bad certificate";
421 break;
422 case SSL3_AD_UNSUPPORTED_CERTIFICATE:
423 str="unsupported certificate";
424 break;
425 case SSL3_AD_CERTIFICATE_REVOKED:
426 str="certificate revoked";
427 break;
428 case SSL3_AD_CERTIFICATE_EXPIRED:
429 str="certificate expired";
430 break;
431 case SSL3_AD_CERTIFICATE_UNKNOWN:
432 str="certifcate unknown";
433 break;
434 case SSL3_AD_ILLEGAL_PARAMETER:
435 str="illegal parameter";
436 break;
437 default: str="unknown"; break;
438 }
439 return(str);
440 }
441
442char *SSL_rstate_string(SSL *s)
443 {
444 char *str;
445
446 switch (s->rstate)
447 {
448 case SSL_ST_READ_HEADER:str="RH"; break;
449 case SSL_ST_READ_BODY: str="RB"; break;
450 case SSL_ST_READ_DONE: str="RD"; break;
451 default: str="unknown"; break;
452 }
453 return(str);
454 }
diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c
deleted file mode 100644
index ca67a98d89..0000000000
--- a/src/lib/libssl/ssl_txt.c
+++ /dev/null
@@ -1,171 +0,0 @@
1/* ssl/ssl_txt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include "ssl_locl.h"
62
63#ifndef NO_FP_API
64int SSL_SESSION_print_fp(FILE *fp, SSL_SESSION *x)
65 {
66 BIO *b;
67 int ret;
68
69 if ((b=BIO_new(BIO_s_file_internal())) == NULL)
70 {
71 SSLerr(SSL_F_SSL_SESSION_PRINT_FP,ERR_R_BUF_LIB);
72 return(0);
73 }
74 BIO_set_fp(b,fp,BIO_NOCLOSE);
75 ret=SSL_SESSION_print(b,x);
76 BIO_free(b);
77 return(ret);
78 }
79#endif
80
81int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
82 {
83 unsigned int i;
84 char str[128],*s;
85
86 if (x == NULL) goto err;
87 if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err;
88 if (x->ssl_version == SSL2_VERSION)
89 s="SSLv2";
90 else if (x->ssl_version == SSL3_VERSION)
91 s="SSLv3";
92 else if (x->ssl_version == TLS1_VERSION)
93 s="TLSv1";
94 else
95 s="unknown";
96 sprintf(str," Protocol : %s\n",s);
97 if (BIO_puts(bp,str) <= 0) goto err;
98
99 if (x->cipher == NULL)
100 {
101 if (((x->cipher_id) & 0xff000000) == 0x02000000)
102 sprintf(str," Cipher : %06lX\n",x->cipher_id&0xffffff);
103 else
104 sprintf(str," Cipher : %04lX\n",x->cipher_id&0xffff);
105 }
106 else
107 sprintf(str," Cipher : %s\n",(x->cipher == NULL)?"unknown":x->cipher->name);
108 if (BIO_puts(bp,str) <= 0) goto err;
109 if (BIO_puts(bp," Session-ID: ") <= 0) goto err;
110 for (i=0; i<x->session_id_length; i++)
111 {
112 sprintf(str,"%02X",x->session_id[i]);
113 if (BIO_puts(bp,str) <= 0) goto err;
114 }
115 if (BIO_puts(bp,"\nSession-ID-ctx: ") <= 0) goto err;
116 for (i=0; i<x->sid_ctx_length; i++)
117 {
118 sprintf(str,"%02X",x->sid_ctx[i]);
119 if (BIO_puts(bp,str) <= 0) goto err;
120 }
121 if (BIO_puts(bp,"\n Master-Key: ") <= 0) goto err;
122 for (i=0; i<(unsigned int)x->master_key_length; i++)
123 {
124 sprintf(str,"%02X",x->master_key[i]);
125 if (BIO_puts(bp,str) <= 0) goto err;
126 }
127 if (BIO_puts(bp,"\n Key-Arg : ") <= 0) goto err;
128 if (x->key_arg_length == 0)
129 {
130 if (BIO_puts(bp,"None") <= 0) goto err;
131 }
132 else
133 for (i=0; i<x->key_arg_length; i++)
134 {
135 sprintf(str,"%02X",x->key_arg[i]);
136 if (BIO_puts(bp,str) <= 0) goto err;
137 }
138 if (x->compress_meth != 0)
139 {
140 SSL_COMP *comp;
141
142 ssl_cipher_get_evp(x,NULL,NULL,&comp);
143 if (comp == NULL)
144 {
145 sprintf(str,"\n Compression: %d",x->compress_meth);
146 if (BIO_puts(bp,str) <= 0) goto err;
147 }
148 else
149 {
150 sprintf(str,"\n Compression: %d (%s)",
151 comp->id,comp->method->name);
152 if (BIO_puts(bp,str) <= 0) goto err;
153 }
154 }
155 if (x->time != 0L)
156 {
157 sprintf(str,"\n Start Time: %ld",x->time);
158 if (BIO_puts(bp,str) <= 0) goto err;
159 }
160 if (x->timeout != 0L)
161 {
162 sprintf(str,"\n Timeout : %ld (sec)",x->timeout);
163 if (BIO_puts(bp,str) <= 0) goto err;
164 }
165 if (BIO_puts(bp,"\n") <= 0) goto err;
166
167 return(1);
168err:
169 return(0);
170 }
171
diff --git a/src/lib/libssl/t1_clnt.c b/src/lib/libssl/t1_clnt.c
deleted file mode 100644
index 9745630a00..0000000000
--- a/src/lib/libssl/t1_clnt.c
+++ /dev/null
@@ -1,90 +0,0 @@
1/* ssl/t1_clnt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include <openssl/rand.h>
62#include <openssl/objects.h>
63#include <openssl/evp.h>
64#include "ssl_locl.h"
65
66static SSL_METHOD *tls1_get_client_method(int ver);
67static SSL_METHOD *tls1_get_client_method(int ver)
68 {
69 if (ver == TLS1_VERSION)
70 return(TLSv1_client_method());
71 else
72 return(NULL);
73 }
74
75SSL_METHOD *TLSv1_client_method(void)
76 {
77 static int init=1;
78 static SSL_METHOD TLSv1_client_data;
79
80 if (init)
81 {
82 memcpy((char *)&TLSv1_client_data,(char *)tlsv1_base_method(),
83 sizeof(SSL_METHOD));
84 TLSv1_client_data.ssl_connect=ssl3_connect;
85 TLSv1_client_data.get_ssl_method=tls1_get_client_method;
86 init=0;
87 }
88 return(&TLSv1_client_data);
89 }
90
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
deleted file mode 100644
index 914b743498..0000000000
--- a/src/lib/libssl/t1_enc.c
+++ /dev/null
@@ -1,633 +0,0 @@
1/* ssl/t1_enc.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/comp.h>
61#include <openssl/md5.h>
62#include <openssl/sha.h>
63#include <openssl/evp.h>
64#include <openssl/hmac.h>
65#include "ssl_locl.h"
66
67static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
68 int sec_len, unsigned char *seed, int seed_len,
69 unsigned char *out, int olen)
70 {
71 int chunk,n;
72 unsigned int j;
73 HMAC_CTX ctx;
74 HMAC_CTX ctx_tmp;
75 unsigned char A1[HMAC_MAX_MD_CBLOCK];
76 unsigned int A1_len;
77
78 chunk=EVP_MD_size(md);
79
80 HMAC_Init(&ctx,sec,sec_len,md);
81 HMAC_Update(&ctx,seed,seed_len);
82 HMAC_Final(&ctx,A1,&A1_len);
83
84 n=0;
85 for (;;)
86 {
87 HMAC_Init(&ctx,NULL,0,NULL); /* re-init */
88 HMAC_Update(&ctx,A1,A1_len);
89 memcpy(&ctx_tmp,&ctx,sizeof(ctx)); /* Copy for A2 */ /* not needed for last one */
90 HMAC_Update(&ctx,seed,seed_len);
91
92 if (olen > chunk)
93 {
94 HMAC_Final(&ctx,out,&j);
95 out+=j;
96 olen-=j;
97 HMAC_Final(&ctx_tmp,A1,&A1_len); /* calc the next A1 value */
98 }
99 else /* last one */
100 {
101 HMAC_Final(&ctx,A1,&A1_len);
102 memcpy(out,A1,olen);
103 break;
104 }
105 }
106 HMAC_cleanup(&ctx);
107 HMAC_cleanup(&ctx_tmp);
108 memset(A1,0,sizeof(A1));
109 }
110
111static void tls1_PRF(const EVP_MD *md5, const EVP_MD *sha1,
112 unsigned char *label, int label_len,
113 const unsigned char *sec, int slen, unsigned char *out1,
114 unsigned char *out2, int olen)
115 {
116 int len,i;
117 const unsigned char *S1,*S2;
118
119 len=slen/2;
120 S1=sec;
121 S2= &(sec[len]);
122 len+=(slen&1); /* add for odd, make longer */
123
124
125 tls1_P_hash(md5 ,S1,len,label,label_len,out1,olen);
126 tls1_P_hash(sha1,S2,len,label,label_len,out2,olen);
127
128 for (i=0; i<olen; i++)
129 out1[i]^=out2[i];
130 }
131
132static void tls1_generate_key_block(SSL *s, unsigned char *km,
133 unsigned char *tmp, int num)
134 {
135 unsigned char *p;
136 unsigned char buf[SSL3_RANDOM_SIZE*2+
137 TLS_MD_MAX_CONST_SIZE];
138 p=buf;
139
140 memcpy(p,TLS_MD_KEY_EXPANSION_CONST,
141 TLS_MD_KEY_EXPANSION_CONST_SIZE);
142 p+=TLS_MD_KEY_EXPANSION_CONST_SIZE;
143 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
144 p+=SSL3_RANDOM_SIZE;
145 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
146 p+=SSL3_RANDOM_SIZE;
147
148 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf),
149 s->session->master_key,s->session->master_key_length,
150 km,tmp,num);
151 }
152
153int tls1_change_cipher_state(SSL *s, int which)
154 {
155 static const unsigned char empty[]="";
156 unsigned char *p,*key_block,*mac_secret;
157 unsigned char *exp_label,buf[TLS_MD_MAX_CONST_SIZE+
158 SSL3_RANDOM_SIZE*2];
159 unsigned char tmp1[EVP_MAX_KEY_LENGTH];
160 unsigned char tmp2[EVP_MAX_KEY_LENGTH];
161 unsigned char iv1[EVP_MAX_IV_LENGTH*2];
162 unsigned char iv2[EVP_MAX_IV_LENGTH*2];
163 unsigned char *ms,*key,*iv,*er1,*er2;
164 int client_write;
165 EVP_CIPHER_CTX *dd;
166 const EVP_CIPHER *c;
167 const SSL_COMP *comp;
168 const EVP_MD *m;
169 int _exp,n,i,j,k,exp_label_len,cl;
170
171 _exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
172 c=s->s3->tmp.new_sym_enc;
173 m=s->s3->tmp.new_hash;
174 comp=s->s3->tmp.new_compression;
175 key_block=s->s3->tmp.key_block;
176
177 if (which & SSL3_CC_READ)
178 {
179 if ((s->enc_read_ctx == NULL) &&
180 ((s->enc_read_ctx=(EVP_CIPHER_CTX *)
181 Malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
182 goto err;
183 dd= s->enc_read_ctx;
184 s->read_hash=m;
185 if (s->expand != NULL)
186 {
187 COMP_CTX_free(s->expand);
188 s->expand=NULL;
189 }
190 if (comp != NULL)
191 {
192 s->expand=COMP_CTX_new(comp->method);
193 if (s->expand == NULL)
194 {
195 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
196 goto err2;
197 }
198 if (s->s3->rrec.comp == NULL)
199 s->s3->rrec.comp=(unsigned char *)
200 Malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
201 if (s->s3->rrec.comp == NULL)
202 goto err;
203 }
204 memset(&(s->s3->read_sequence[0]),0,8);
205 mac_secret= &(s->s3->read_mac_secret[0]);
206 }
207 else
208 {
209 if ((s->enc_write_ctx == NULL) &&
210 ((s->enc_write_ctx=(EVP_CIPHER_CTX *)
211 Malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
212 goto err;
213 dd= s->enc_write_ctx;
214 s->write_hash=m;
215 if (s->compress != NULL)
216 {
217 COMP_CTX_free(s->compress);
218 s->compress=NULL;
219 }
220 if (comp != NULL)
221 {
222 s->compress=COMP_CTX_new(comp->method);
223 if (s->compress == NULL)
224 {
225 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
226 goto err2;
227 }
228 }
229 memset(&(s->s3->write_sequence[0]),0,8);
230 mac_secret= &(s->s3->write_mac_secret[0]);
231 }
232
233 EVP_CIPHER_CTX_init(dd);
234
235 p=s->s3->tmp.key_block;
236 i=EVP_MD_size(m);
237 cl=EVP_CIPHER_key_length(c);
238 j=_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
239 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
240 /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
241 k=EVP_CIPHER_iv_length(c);
242 er1= &(s->s3->client_random[0]);
243 er2= &(s->s3->server_random[0]);
244 if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
245 (which == SSL3_CHANGE_CIPHER_SERVER_READ))
246 {
247 ms= &(p[ 0]); n=i+i;
248 key= &(p[ n]); n+=j+j;
249 iv= &(p[ n]); n+=k+k;
250 exp_label=(unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST;
251 exp_label_len=TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE;
252 client_write=1;
253 }
254 else
255 {
256 n=i;
257 ms= &(p[ n]); n+=i+j;
258 key= &(p[ n]); n+=j+k;
259 iv= &(p[ n]); n+=k;
260 exp_label=(unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST;
261 exp_label_len=TLS_MD_SERVER_WRITE_KEY_CONST_SIZE;
262 client_write=0;
263 }
264
265 if (n > s->s3->tmp.key_block_length)
266 {
267 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_INTERNAL_ERROR);
268 goto err2;
269 }
270
271 memcpy(mac_secret,ms,i);
272#ifdef TLS_DEBUG
273printf("which = %04X\nmac key=",which);
274{ int z; for (z=0; z<i; z++) printf("%02X%c",ms[z],((z+1)%16)?' ':'\n'); }
275#endif
276 if (_exp)
277 {
278 /* In here I set both the read and write key/iv to the
279 * same value since only the correct one will be used :-).
280 */
281 p=buf;
282 memcpy(p,exp_label,exp_label_len);
283 p+=exp_label_len;
284 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
285 p+=SSL3_RANDOM_SIZE;
286 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
287 p+=SSL3_RANDOM_SIZE;
288 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf),key,j,
289 tmp1,tmp2,EVP_CIPHER_key_length(c));
290 key=tmp1;
291
292 if (k > 0)
293 {
294 p=buf;
295 memcpy(p,TLS_MD_IV_BLOCK_CONST,
296 TLS_MD_IV_BLOCK_CONST_SIZE);
297 p+=TLS_MD_IV_BLOCK_CONST_SIZE;
298 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
299 p+=SSL3_RANDOM_SIZE;
300 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
301 p+=SSL3_RANDOM_SIZE;
302 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,p-buf,empty,0,
303 iv1,iv2,k*2);
304 if (client_write)
305 iv=iv1;
306 else
307 iv= &(iv1[k]);
308 }
309 }
310
311 s->session->key_arg_length=0;
312
313 EVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE));
314#ifdef TLS_DEBUG
315printf("which = %04X\nkey=",which);
316{ int z; for (z=0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c",key[z],((z+1)%16)?' ':'\n'); }
317printf("\niv=");
318{ int z; for (z=0; z<k; z++) printf("%02X%c",iv[z],((z+1)%16)?' ':'\n'); }
319printf("\n");
320#endif
321
322 memset(tmp1,0,sizeof(tmp1));
323 memset(tmp2,0,sizeof(tmp1));
324 memset(iv1,0,sizeof(iv1));
325 memset(iv2,0,sizeof(iv2));
326 return(1);
327err:
328 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
329err2:
330 return(0);
331 }
332
333int tls1_setup_key_block(SSL *s)
334 {
335 unsigned char *p1,*p2;
336 const EVP_CIPHER *c;
337 const EVP_MD *hash;
338 int num;
339 SSL_COMP *comp;
340
341 if (s->s3->tmp.key_block_length != 0)
342 return(1);
343
344 if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp))
345 {
346 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
347 return(0);
348 }
349
350 s->s3->tmp.new_sym_enc=c;
351 s->s3->tmp.new_hash=hash;
352
353 num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
354 num*=2;
355
356 ssl3_cleanup_key_block(s);
357
358 if ((p1=(unsigned char *)Malloc(num)) == NULL)
359 goto err;
360 if ((p2=(unsigned char *)Malloc(num)) == NULL)
361 goto err;
362
363 s->s3->tmp.key_block_length=num;
364 s->s3->tmp.key_block=p1;
365
366
367#ifdef TLS_DEBUG
368printf("client random\n");
369{ int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->client_random[z],((z+1)%16)?' ':'\n'); }
370printf("server random\n");
371{ int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->server_random[z],((z+1)%16)?' ':'\n'); }
372printf("pre-master\n");
373{ int z; for (z=0; z<s->session->master_key_length; z++) printf("%02X%c",s->session->master_key[z],((z+1)%16)?' ':'\n'); }
374#endif
375 tls1_generate_key_block(s,p1,p2,num);
376 memset(p2,0,num);
377 Free(p2);
378#ifdef TLS_DEBUG
379printf("\nkey block\n");
380{ int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }
381#endif
382
383 return(1);
384err:
385 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
386 return(0);
387 }
388
389int tls1_enc(SSL *s, int send)
390 {
391 SSL3_RECORD *rec;
392 EVP_CIPHER_CTX *ds;
393 unsigned long l;
394 int bs,i,ii,j,k,n=0;
395 const EVP_CIPHER *enc;
396
397 if (send)
398 {
399 if (s->write_hash != NULL)
400 n=EVP_MD_size(s->write_hash);
401 ds=s->enc_write_ctx;
402 rec= &(s->s3->wrec);
403 if (s->enc_write_ctx == NULL)
404 enc=NULL;
405 else
406 enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
407 }
408 else
409 {
410 if (s->read_hash != NULL)
411 n=EVP_MD_size(s->read_hash);
412 ds=s->enc_read_ctx;
413 rec= &(s->s3->rrec);
414 if (s->enc_read_ctx == NULL)
415 enc=NULL;
416 else
417 enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
418 }
419
420 if ((s->session == NULL) || (ds == NULL) ||
421 (enc == NULL))
422 {
423 memcpy(rec->data,rec->input,rec->length);
424 rec->input=rec->data;
425 }
426 else
427 {
428 l=rec->length;
429 bs=EVP_CIPHER_block_size(ds->cipher);
430
431 if ((bs != 1) && send)
432 {
433 i=bs-((int)l%bs);
434
435 /* Add weird padding of upto 256 bytes */
436
437 /* we need to add 'i' padding bytes of value j */
438 j=i-1;
439 if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)
440 {
441 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
442 j++;
443 }
444 for (k=(int)l; k<(int)(l+i); k++)
445 rec->input[k]=j;
446 l+=i;
447 rec->length+=i;
448 }
449
450 EVP_Cipher(ds,rec->data,rec->input,l);
451
452 if ((bs != 1) && !send)
453 {
454 ii=i=rec->data[l-1];
455 i++;
456 if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
457 {
458 /* First packet is even in size, so check */
459 if ((memcmp(s->s3->read_sequence,
460 "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
461 s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
462 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
463 i--;
464 }
465 if (i > (int)rec->length)
466 {
467 SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
468 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
469 return(0);
470 }
471 for (j=(int)(l-i); j<(int)l; j++)
472 {
473 if (rec->data[j] != ii)
474 {
475 SSLerr(SSL_F_TLS1_ENC,SSL_R_DECRYPTION_FAILED);
476 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
477 return(0);
478 }
479 }
480 rec->length-=i;
481 }
482 }
483 return(1);
484 }
485
486int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out)
487 {
488 unsigned int ret;
489 EVP_MD_CTX ctx;
490
491 EVP_MD_CTX_copy(&ctx,in_ctx);
492 EVP_DigestFinal(&ctx,out,&ret);
493 return((int)ret);
494 }
495
496int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
497 unsigned char *str, int slen, unsigned char *out)
498 {
499 unsigned int i;
500 EVP_MD_CTX ctx;
501 unsigned char buf[TLS_MD_MAX_CONST_SIZE+MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
502 unsigned char *q,buf2[12];
503
504 q=buf;
505 memcpy(q,str,slen);
506 q+=slen;
507
508 EVP_MD_CTX_copy(&ctx,in1_ctx);
509 EVP_DigestFinal(&ctx,q,&i);
510 q+=i;
511 EVP_MD_CTX_copy(&ctx,in2_ctx);
512 EVP_DigestFinal(&ctx,q,&i);
513 q+=i;
514
515 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(q-buf),
516 s->session->master_key,s->session->master_key_length,
517 out,buf2,12);
518 memset(&ctx,0,sizeof(EVP_MD_CTX));
519
520 return((int)12);
521 }
522
523int tls1_mac(SSL *ssl, unsigned char *md, int send)
524 {
525 SSL3_RECORD *rec;
526 unsigned char *mac_sec,*seq;
527 const EVP_MD *hash;
528 unsigned int md_size;
529 int i;
530 HMAC_CTX hmac;
531 unsigned char buf[5];
532
533 if (send)
534 {
535 rec= &(ssl->s3->wrec);
536 mac_sec= &(ssl->s3->write_mac_secret[0]);
537 seq= &(ssl->s3->write_sequence[0]);
538 hash=ssl->write_hash;
539 }
540 else
541 {
542 rec= &(ssl->s3->rrec);
543 mac_sec= &(ssl->s3->read_mac_secret[0]);
544 seq= &(ssl->s3->read_sequence[0]);
545 hash=ssl->read_hash;
546 }
547
548 md_size=EVP_MD_size(hash);
549
550 buf[0]=rec->type;
551 buf[1]=TLS1_VERSION_MAJOR;
552 buf[2]=TLS1_VERSION_MINOR;
553 buf[3]=rec->length>>8;
554 buf[4]=rec->length&0xff;
555
556 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
557 HMAC_Init(&hmac,mac_sec,EVP_MD_size(hash),hash);
558 HMAC_Update(&hmac,seq,8);
559 HMAC_Update(&hmac,buf,5);
560 HMAC_Update(&hmac,rec->input,rec->length);
561 HMAC_Final(&hmac,md,&md_size);
562
563#ifdef TLS_DEBUG
564printf("sec=");
565{unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); }
566printf("seq=");
567{int z; for (z=0; z<8; z++) printf("%02X ",seq[z]); printf("\n"); }
568printf("buf=");
569{int z; for (z=0; z<5; z++) printf("%02X ",buf[z]); printf("\n"); }
570printf("rec=");
571{unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
572#endif
573
574 for (i=7; i>=0; i--)
575 if (++seq[i]) break;
576
577#ifdef TLS_DEBUG
578{unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",md[z]); printf("\n"); }
579#endif
580 return(md_size);
581 }
582
583int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
584 int len)
585 {
586 unsigned char buf[SSL3_RANDOM_SIZE*2+TLS_MD_MASTER_SECRET_CONST_SIZE];
587 unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH];
588
589 /* Setup the stuff to munge */
590 memcpy(buf,TLS_MD_MASTER_SECRET_CONST,
591 TLS_MD_MASTER_SECRET_CONST_SIZE);
592 memcpy(&(buf[TLS_MD_MASTER_SECRET_CONST_SIZE]),
593 s->s3->client_random,SSL3_RANDOM_SIZE);
594 memcpy(&(buf[SSL3_RANDOM_SIZE+TLS_MD_MASTER_SECRET_CONST_SIZE]),
595 s->s3->server_random,SSL3_RANDOM_SIZE);
596 tls1_PRF(s->ctx->md5,s->ctx->sha1,
597 buf,TLS_MD_MASTER_SECRET_CONST_SIZE+SSL3_RANDOM_SIZE*2,p,len,
598 s->session->master_key,buff,SSL3_MASTER_SECRET_SIZE);
599 return(SSL3_MASTER_SECRET_SIZE);
600 }
601
602int tls1_alert_code(int code)
603 {
604 switch (code)
605 {
606 case SSL_AD_CLOSE_NOTIFY: return(SSL3_AD_CLOSE_NOTIFY);
607 case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE);
608 case SSL_AD_BAD_RECORD_MAC: return(SSL3_AD_BAD_RECORD_MAC);
609 case SSL_AD_DECRYPTION_FAILED: return(TLS1_AD_DECRYPTION_FAILED);
610 case SSL_AD_RECORD_OVERFLOW: return(TLS1_AD_RECORD_OVERFLOW);
611 case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE);
612 case SSL_AD_HANDSHAKE_FAILURE: return(SSL3_AD_HANDSHAKE_FAILURE);
613 case SSL_AD_NO_CERTIFICATE: return(-1);
614 case SSL_AD_BAD_CERTIFICATE: return(SSL3_AD_BAD_CERTIFICATE);
615 case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE);
616 case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED);
617 case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED);
618 case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN);
619 case SSL_AD_ILLEGAL_PARAMETER: return(SSL3_AD_ILLEGAL_PARAMETER);
620 case SSL_AD_UNKNOWN_CA: return(TLS1_AD_UNKNOWN_CA);
621 case SSL_AD_ACCESS_DENIED: return(TLS1_AD_ACCESS_DENIED);
622 case SSL_AD_DECODE_ERROR: return(TLS1_AD_DECODE_ERROR);
623 case SSL_AD_DECRYPT_ERROR: return(TLS1_AD_DECRYPT_ERROR);
624 case SSL_AD_EXPORT_RESTRICION: return(TLS1_AD_EXPORT_RESTRICION);
625 case SSL_AD_PROTOCOL_VERSION: return(TLS1_AD_PROTOCOL_VERSION);
626 case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY);
627 case SSL_AD_INTERNAL_ERROR: return(TLS1_AD_INTERNAL_ERROR);
628 case SSL_AD_USER_CANCLED: return(TLS1_AD_USER_CANCLED);
629 case SSL_AD_NO_RENEGOTIATION: return(TLS1_AD_NO_RENEGOTIATION);
630 default: return(-1);
631 }
632 }
633
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
deleted file mode 100644
index ddf5c15799..0000000000
--- a/src/lib/libssl/t1_lib.c
+++ /dev/null
@@ -1,145 +0,0 @@
1/* ssl/t1_lib.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/objects.h>
61#include "ssl_locl.h"
62
63char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
64
65#ifndef NO_PROTO
66static long tls1_default_timeout(void);
67#else
68static long tls1_default_timeout();
69#endif
70
71static SSL3_ENC_METHOD TLSv1_enc_data={
72 tls1_enc,
73 tls1_mac,
74 tls1_setup_key_block,
75 tls1_generate_master_secret,
76 tls1_change_cipher_state,
77 tls1_final_finish_mac,
78 TLS1_FINISH_MAC_LENGTH,
79 tls1_cert_verify_mac,
80 TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
81 TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
82 tls1_alert_code,
83 };
84
85static SSL_METHOD TLSv1_data= {
86 TLS1_VERSION,
87 tls1_new,
88 tls1_clear,
89 tls1_free,
90 ssl_undefined_function,
91 ssl_undefined_function,
92 ssl3_read,
93 ssl3_peek,
94 ssl3_write,
95 ssl3_shutdown,
96 ssl3_renegotiate,
97 ssl3_renegotiate_check,
98 ssl3_ctrl,
99 ssl3_ctx_ctrl,
100 ssl3_get_cipher_by_char,
101 ssl3_put_cipher_by_char,
102 ssl3_pending,
103 ssl3_num_ciphers,
104 ssl3_get_cipher,
105 ssl_bad_method,
106 tls1_default_timeout,
107 &TLSv1_enc_data,
108 };
109
110static long tls1_default_timeout(void)
111 {
112 /* 2 hours, the 24 hours mentioned in the TLSv1 spec
113 * is way too long for http, the cache would over fill */
114 return(60*60*2);
115 }
116
117SSL_METHOD *tlsv1_base_method(void)
118 {
119 return(&TLSv1_data);
120 }
121
122int tls1_new(SSL *s)
123 {
124 if (!ssl3_new(s)) return(0);
125 s->method->ssl_clear(s);
126 return(1);
127 }
128
129void tls1_free(SSL *s)
130 {
131 ssl3_free(s);
132 }
133
134void tls1_clear(SSL *s)
135 {
136 ssl3_clear(s);
137 s->version=TLS1_VERSION;
138 }
139
140#if 0
141long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
142 {
143 return(0);
144 }
145#endif
diff --git a/src/lib/libssl/t1_meth.c b/src/lib/libssl/t1_meth.c
deleted file mode 100644
index 9bb36a7d1c..0000000000
--- a/src/lib/libssl/t1_meth.c
+++ /dev/null
@@ -1,88 +0,0 @@
1/* ssl/t1_meth.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/objects.h>
61#include "ssl_locl.h"
62
63static SSL_METHOD *tls1_get_method(int ver);
64static SSL_METHOD *tls1_get_method(int ver)
65 {
66 if (ver == TLS1_VERSION)
67 return(TLSv1_method());
68 else
69 return(NULL);
70 }
71
72SSL_METHOD *TLSv1_method(void)
73 {
74 static int init=1;
75 static SSL_METHOD TLSv1_data;
76
77 if (init)
78 {
79 memcpy((char *)&TLSv1_data,(char *)tlsv1_base_method(),
80 sizeof(SSL_METHOD));
81 TLSv1_data.ssl_connect=ssl3_connect;
82 TLSv1_data.ssl_accept=ssl3_accept;
83 TLSv1_data.get_ssl_method=tls1_get_method;
84 init=0;
85 }
86 return(&TLSv1_data);
87 }
88
diff --git a/src/lib/libssl/t1_srvr.c b/src/lib/libssl/t1_srvr.c
deleted file mode 100644
index 996b7ca8e2..0000000000
--- a/src/lib/libssl/t1_srvr.c
+++ /dev/null
@@ -1,91 +0,0 @@
1/* ssl/t1_srvr.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/buffer.h>
61#include <openssl/rand.h>
62#include <openssl/objects.h>
63#include <openssl/evp.h>
64#include <openssl/x509.h>
65#include "ssl_locl.h"
66
67static SSL_METHOD *tls1_get_server_method(int ver);
68static SSL_METHOD *tls1_get_server_method(int ver)
69 {
70 if (ver == TLS1_VERSION)
71 return(TLSv1_server_method());
72 else
73 return(NULL);
74 }
75
76SSL_METHOD *TLSv1_server_method(void)
77 {
78 static int init=1;
79 static SSL_METHOD TLSv1_server_data;
80
81 if (init)
82 {
83 memcpy((char *)&TLSv1_server_data,(char *)tlsv1_base_method(),
84 sizeof(SSL_METHOD));
85 TLSv1_server_data.ssl_accept=ssl3_accept;
86 TLSv1_server_data.get_ssl_method=tls1_get_server_method;
87 init=0;
88 }
89 return(&TLSv1_server_data);
90 }
91
diff --git a/src/lib/libssl/test/CAss.cnf b/src/lib/libssl/test/CAss.cnf
deleted file mode 100644
index b941b7ae15..0000000000
--- a/src/lib/libssl/test/CAss.cnf
+++ /dev/null
@@ -1,25 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5
6RANDFILE = ./.rnd
7
8####################################################################
9[ req ]
10default_bits = 512
11default_keyfile = keySS.pem
12distinguished_name = req_distinguished_name
13encrypt_rsa_key = no
14default_md = sha1
15
16[ req_distinguished_name ]
17countryName = Country Name (2 letter code)
18countryName_default = AU
19countryName_value = AU
20
21organizationName = Organization Name (eg, company)
22organizationName_value = Dodgy Brothers
23
24commonName = Common Name (eg, YOUR name)
25commonName_value = Dodgy CA
diff --git a/src/lib/libssl/test/CAssdh.cnf b/src/lib/libssl/test/CAssdh.cnf
deleted file mode 100644
index 4e0a908679..0000000000
--- a/src/lib/libssl/test/CAssdh.cnf
+++ /dev/null
@@ -1,24 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5# hacked by iang to do DH certs - CA
6
7RANDFILE = ./.rnd
8
9####################################################################
10[ req ]
11distinguished_name = req_distinguished_name
12encrypt_rsa_key = no
13
14[ req_distinguished_name ]
15countryName = Country Name (2 letter code)
16countryName_default = CU
17countryName_value = CU
18
19organizationName = Organization Name (eg, company)
20organizationName_value = La Junta de la Revolucion
21
22commonName = Common Name (eg, YOUR name)
23commonName_value = Junta
24
diff --git a/src/lib/libssl/test/CAssdsa.cnf b/src/lib/libssl/test/CAssdsa.cnf
deleted file mode 100644
index a6b4d1810c..0000000000
--- a/src/lib/libssl/test/CAssdsa.cnf
+++ /dev/null
@@ -1,23 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5# hacked by iang to do DSA certs - CA
6
7RANDFILE = ./.rnd
8
9####################################################################
10[ req ]
11distinguished_name = req_distinguished_name
12encrypt_rsa_key = no
13
14[ req_distinguished_name ]
15countryName = Country Name (2 letter code)
16countryName_default = ES
17countryName_value = ES
18
19organizationName = Organization Name (eg, company)
20organizationName_value = Hermanos Locos
21
22commonName = Common Name (eg, YOUR name)
23commonName_value = Hermanos Locos CA
diff --git a/src/lib/libssl/test/CAssrsa.cnf b/src/lib/libssl/test/CAssrsa.cnf
deleted file mode 100644
index eb24a6dfc0..0000000000
--- a/src/lib/libssl/test/CAssrsa.cnf
+++ /dev/null
@@ -1,24 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5# create RSA certs - CA
6
7RANDFILE = ./.rnd
8
9####################################################################
10[ req ]
11distinguished_name = req_distinguished_name
12encrypt_key = no
13
14[ req_distinguished_name ]
15countryName = Country Name (2 letter code)
16countryName_default = ES
17countryName_value = ES
18
19organizationName = Organization Name (eg, company)
20organizationName_value = Hermanos Locos
21
22commonName = Common Name (eg, YOUR name)
23commonName_value = Hermanos Locos CA
24
diff --git a/src/lib/libssl/test/Sssdsa.cnf b/src/lib/libssl/test/Sssdsa.cnf
deleted file mode 100644
index 8e170a28ef..0000000000
--- a/src/lib/libssl/test/Sssdsa.cnf
+++ /dev/null
@@ -1,27 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5# hacked by iang to do DSA certs - Server
6
7RANDFILE = ./.rnd
8
9####################################################################
10[ req ]
11distinguished_name = req_distinguished_name
12encrypt_rsa_key = no
13
14[ req_distinguished_name ]
15countryName = Country Name (2 letter code)
16countryName_default = ES
17countryName_value = ES
18
19organizationName = Organization Name (eg, company)
20organizationName_value = Tortilleras S.A.
21
220.commonName = Common Name (eg, YOUR name)
230.commonName_value = Torti
24
251.commonName = Common Name (eg, YOUR name)
261.commonName_value = Gordita
27
diff --git a/src/lib/libssl/test/Sssrsa.cnf b/src/lib/libssl/test/Sssrsa.cnf
deleted file mode 100644
index 8c79a03fca..0000000000
--- a/src/lib/libssl/test/Sssrsa.cnf
+++ /dev/null
@@ -1,26 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5# create RSA certs - Server
6
7RANDFILE = ./.rnd
8
9####################################################################
10[ req ]
11distinguished_name = req_distinguished_name
12encrypt_key = no
13
14[ req_distinguished_name ]
15countryName = Country Name (2 letter code)
16countryName_default = ES
17countryName_value = ES
18
19organizationName = Organization Name (eg, company)
20organizationName_value = Tortilleras S.A.
21
220.commonName = Common Name (eg, YOUR name)
230.commonName_value = Torti
24
251.commonName = Common Name (eg, YOUR name)
261.commonName_value = Gordita
diff --git a/src/lib/libssl/test/Uss.cnf b/src/lib/libssl/test/Uss.cnf
deleted file mode 100644
index c89692d519..0000000000
--- a/src/lib/libssl/test/Uss.cnf
+++ /dev/null
@@ -1,28 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5
6RANDFILE = ./.rnd
7
8####################################################################
9[ req ]
10default_bits = 512
11default_keyfile = keySS.pem
12distinguished_name = req_distinguished_name
13encrypt_rsa_key = no
14default_md = md2
15
16[ req_distinguished_name ]
17countryName = Country Name (2 letter code)
18countryName_default = AU
19countryName_value = AU
20
21organizationName = Organization Name (eg, company)
22organizationName_value = Dodgy Brothers
23
240.commonName = Common Name (eg, YOUR name)
250.commonName_value = Brother 1
26
271.commonName = Common Name (eg, YOUR name)
281.commonName_value = Brother 2
diff --git a/src/lib/libssl/test/VMSca-response.1 b/src/lib/libssl/test/VMSca-response.1
deleted file mode 100644
index 8b13789179..0000000000
--- a/src/lib/libssl/test/VMSca-response.1
+++ /dev/null
@@ -1 +0,0 @@
1
diff --git a/src/lib/libssl/test/VMSca-response.2 b/src/lib/libssl/test/VMSca-response.2
deleted file mode 100644
index 9b48ee4cf9..0000000000
--- a/src/lib/libssl/test/VMSca-response.2
+++ /dev/null
@@ -1,2 +0,0 @@
1y
2y
diff --git a/src/lib/libssl/test/methtest.c b/src/lib/libssl/test/methtest.c
deleted file mode 100644
index 06ccb3b310..0000000000
--- a/src/lib/libssl/test/methtest.c
+++ /dev/null
@@ -1,105 +0,0 @@
1/* test/methtest.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <stdlib.h>
61#include <openssl/rsa.h>
62#include <openssl/x509.h>
63#include "meth.h"
64#include <openssl/err.h>
65
66int main(argc,argv)
67int argc;
68char *argv[];
69 {
70 METHOD_CTX *top,*tmp1,*tmp2;
71
72 top=METH_new(x509_lookup()); /* get a top level context */
73 if (top == NULL) goto err;
74
75 tmp1=METH_new(x509_by_file());
76 if (top == NULL) goto err;
77 METH_arg(tmp1,METH_TYPE_FILE,"cafile1");
78 METH_arg(tmp1,METH_TYPE_FILE,"cafile2");
79 METH_push(top,METH_X509_CA_BY_SUBJECT,tmp1);
80
81 tmp2=METH_new(x509_by_dir());
82 METH_arg(tmp2,METH_TYPE_DIR,"/home/eay/.CAcerts");
83 METH_arg(tmp2,METH_TYPE_DIR,"/home/eay/SSLeay/certs");
84 METH_arg(tmp2,METH_TYPE_DIR,"/usr/local/ssl/certs");
85 METH_push(top,METH_X509_CA_BY_SUBJECT,tmp2);
86
87/* tmp=METH_new(x509_by_issuer_dir);
88 METH_arg(tmp,METH_TYPE_DIR,"/home/eay/.mycerts");
89 METH_push(top,METH_X509_BY_ISSUER,tmp);
90
91 tmp=METH_new(x509_by_issuer_primary);
92 METH_arg(tmp,METH_TYPE_FILE,"/home/eay/.mycerts/primary.pem");
93 METH_push(top,METH_X509_BY_ISSUER,tmp);
94*/
95
96 METH_init(top);
97 METH_control(tmp1,METH_CONTROL_DUMP,stdout);
98 METH_control(tmp2,METH_CONTROL_DUMP,stdout);
99 exit(0);
100err:
101 ERR_load_crypto_strings();
102 ERR_print_errors_fp(stderr);
103 exit(1);
104 return(0);
105 }
diff --git a/src/lib/libssl/test/pkcs7-1.pem b/src/lib/libssl/test/pkcs7-1.pem
deleted file mode 100644
index c47b27af88..0000000000
--- a/src/lib/libssl/test/pkcs7-1.pem
+++ /dev/null
@@ -1,15 +0,0 @@
1-----BEGIN PKCS7-----
2MIICUAYJKoZIhvcNAQcCoIICQTCCAj0CAQExDjAMBggqhkiG9w0CAgUAMCgGCSqG
3SIb3DQEHAaAbBBlFdmVyeW9uZSBnZXRzIEZyaWRheSBvZmYuoIIBXjCCAVowggEE
4AgQUAAApMA0GCSqGSIb3DQEBAgUAMCwxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRF
5eGFtcGxlIE9yZ2FuaXphdGlvbjAeFw05MjA5MDkyMjE4MDZaFw05NDA5MDkyMjE4
6MDVaMEIxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRFeGFtcGxlIE9yZ2FuaXphdGlv
7bjEUMBIGA1UEAxMLVGVzdCBVc2VyIDEwWzANBgkqhkiG9w0BAQEFAANKADBHAkAK
8ZnkdxpiBaN56t3QZu3+wwAHGJxAnAHUUKULhmo2MUdBTs+N4Kh3l3Fr06+mUaBcB
9FKHf5nzcmpr1XWVWILurAgMBAAEwDQYJKoZIhvcNAQECBQADQQBFGqHhqncgSl/N
109XYGnQL3MsJvNnsNV4puZPOakR9Hld8JlDQFEaDR30ogsmp3TMrvdfxpLlTCoZN8
11BxEmnZsWMYGbMIGYAgEBMDQwLDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFEV4YW1w
12bGUgT3JnYW5pemF0aW9uAgQUAAApMAwGCCqGSIb3DQICBQAwDQYJKoZIhvcNAQEB
13BQAEQAX6aoEvx9+L9PJUJQngPoRuEbnGIL4gCe+0QO+8xmkhaZSsBPNBtX0FIC1C
14j7Kie1x339mxW/w9VZNTUDQQweHh
15-----END PKCS7-----
diff --git a/src/lib/libssl/test/pkcs7.pem b/src/lib/libssl/test/pkcs7.pem
deleted file mode 100644
index d55c60b94e..0000000000
--- a/src/lib/libssl/test/pkcs7.pem
+++ /dev/null
@@ -1,54 +0,0 @@
1 MIAGCSqGSIb3DQEHAqCAMIACAQExADCABgkqhkiG9w0BBwEAAKCAMIIE+DCCBGGg
2 AwIBAgIQaGSF/JpbS1C223+yrc+N1DANBgkqhkiG9w0BAQQFADBiMREwDwYDVQQH
3 EwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1Zl
4 cmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXIwHhcNOTYw
5 ODEyMDAwMDAwWhcNOTYwODE3MjM1OTU5WjCCASAxETAPBgNVBAcTCEludGVybmV0
6 MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNpZ24gQ2xh
7 c3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjE3MDUGA1UECxMuRGlnaXRh
8 bCBJRCBDbGFzcyAxIC0gU01JTUUgVmVyaVNpZ24sIEluYy4gVEVTVDFGMEQGA1UE
9 CxM9d3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0b3J5L0NQUyBJbmNvcnAuIGJ5IFJl
10 Zi4sTElBQi5MVEQoYyk5NjEZMBcGA1UEAxMQQWxleGFuZHJlIERlYWNvbjEgMB4G
11 CSqGSIb3DQEJARYRYWxleEB2ZXJpc2lnbi5jb20wWzANBgkqhkiG9w0BAQEFAANK
12 ADBHAkAOy7xxCAIkOfuIA2LyRpxgKlDORl8htdXYhF5iBGUx1GYaK6KF+bK/CCI0
13 l4j2OfWGFBUrwGoWqxTNcWgTfMzRAgMBAAGjggIyMIICLjAJBgNVHRMEAjAAMIIC
14 HwYDVR0DBIICFjCCAhIwggIOMIICCgYLYIZIAYb4RQEHAQEwggH5FoIBp1RoaXMg
15 Y2VydGlmaWNhdGUgaW5jb3Jwb3JhdGVzIGJ5IHJlZmVyZW5jZSwgYW5kIGl0cyB1
16 c2UgaXMgc3RyaWN0bHkgc3ViamVjdCB0bywgdGhlIFZlcmlTaWduIENlcnRpZmlj
17 YXRpb24gUHJhY3RpY2UgU3RhdGVtZW50IChDUFMpLCBhdmFpbGFibGUgYXQ6IGh0
18 dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9DUFM7IGJ5IEUtbWFpbCBhdCBDUFMtcmVx
19 dWVzdHNAdmVyaXNpZ24uY29tOyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMu
20 LCAyNTkzIENvYXN0IEF2ZS4sIE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBU
21 ZWwuICsxICg0MTUpIDk2MS04ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2ln
22 biwgSW5jLiAgQWxsIFJpZ2h0cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVT
23 IERJU0NMQUlNRUQgYW5kIExJQUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcB
24 AQGhDgYMYIZIAYb4RQEHAQECMCwwKhYoaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t
25 L3JlcG9zaXRvcnkvQ1BTIDANBgkqhkiG9w0BAQQFAAOBgQAimWMGQwwwxk+b3KAL
26 HlSWXtU7LWHe29CEG8XeVNTvrqs6SBqT7OoENOkGxpfdpVgZ3Qw2SKjxDvbvpfSF
27 slsqcxWSgB/hWuaVuZCkvTw/dYGGOxkTJGxvDCfl1PZjX4dKbatslsi9Z9HpGWT7
28 ttItRwKqcBKgmCJvKi1pGWED0zCCAnkwggHioAMCAQICEDURpVKQb+fQKaRAGdQR
29 /D4wDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlT
30 aWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp
31 ZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2MDYyNzAwMDAwMFoXDTk3MDYyNzIzNTk1
32 OVowYjERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMu
33 MTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJz
34 Y3JpYmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2FKbPTdAFDdjKI9Bv
35 qrQpkmOOLPhvltcunXZLEbE2jVfJw/0cxrr+Hgi6M8qV6r7jW80GqLd5HUQq7XPy
36 sVKDaBBwZJHXPmv5912dFEObbpdFmIFH0S3L3bty10w/cariQPJUObwW7s987Lrb
37 P2wqsxaxhhKdrpM01bjV0Pc+qQIDAQABozMwMTAPBgNVHRMECDAGAQH/AgEBMAsG
38 A1UdDwQEAwIBBjARBglghkgBhvhCAQEEBAMCAgQwDQYJKoZIhvcNAQECBQADgYEA
39 KeXHoBmnbxRCgk0jM9e9mDppdxpsipIna/J8DOHEUuD4nONAr4+xOg73SBl026n7
40 Bk55A2wvAMGo7+kKTZ+rHaFDDcmq4O+rzFri2RIOeGAncj1IcGptAQhvXoIhFMG4
41 Jlzg1KlHZHqy7D3jex78zcSU7kKOu8f5tAX1jC3+sToAAKGAMIIBJzCBkTANBgkq
42 hkiG9w0BAQIFADBiMREwDwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNp
43 Z24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlk
44 dWFsIFN1YnNjcmliZXIXDTk2MDcwMTE3MzA0MFoXDTk3MDcwMTAwMDAwMFowDQYJ
45 KoZIhvcNAQECBQADgYEAGLuQ6PX8A7AiqBEtWzYtl6lZNSDI0bR5YUo+D2Jzkw30
46 dxQnJSbKXEc6XYuzAW5HvrzATXu5c19WWPT4cRDwmjH71i9QcDysWwf/wE0qGTiW
47 I3tQT0I5VGh7jIJD07nlBw3R4Xl8dH9kr85JsWinqDH5YKpIo9o8knY5n7+qjOow
48 ggEkMIGOMA0GCSqGSIb3DQEBAgUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5W
49 ZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJpbWFyeSBD
50 ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eRcNOTYwNzE2MjMxMTI5WhcNOTYwODE1MDAw
51 MDAwWjANBgkqhkiG9w0BAQIFAAOBgQAXsLE4vnsY6sY67QrmWec7iaU2ehzxanEK
52 /9wKHZNuhlNzk+qGZZw2evxfUe2OaRbYpl8zuZvhK9BHD3ad14OSe9/zx5hOPgP/
53 DQXt6R4R8Q/1JheBrolrgbavjvI2wKS8/Psp2prBrkF4T48+AKRmS8Zzh1guxgvP
54 b+xSu/jH0gAAMYAAAAAAAAAAAA==
diff --git a/src/lib/libssl/test/r160test.c b/src/lib/libssl/test/r160test.c
deleted file mode 100644
index a172e393ca..0000000000
--- a/src/lib/libssl/test/r160test.c
+++ /dev/null
@@ -1,57 +0,0 @@
1/* test/r160test.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
diff --git a/src/lib/libssl/test/tcrl b/src/lib/libssl/test/tcrl
deleted file mode 100644
index acaf8f3c47..0000000000
--- a/src/lib/libssl/test/tcrl
+++ /dev/null
@@ -1,81 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl crl'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=testcrl.pem
12fi
13
14echo testing crl conversions
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20#echo "p -> t"
21#$cmd -in fff.p -inform p -outform t >f.t
22#if [ $? != 0 ]; then exit 1; fi
23echo "p -> p"
24$cmd -in fff.p -inform p -outform p >f.p
25if [ $? != 0 ]; then exit 1; fi
26
27echo "d -> d"
28$cmd -in f.d -inform d -outform d >ff.d1
29if [ $? != 0 ]; then exit 1; fi
30#echo "t -> d"
31#$cmd -in f.t -inform t -outform d >ff.d2
32#if [ $? != 0 ]; then exit 1; fi
33echo "p -> d"
34$cmd -in f.p -inform p -outform d >ff.d3
35if [ $? != 0 ]; then exit 1; fi
36
37#echo "d -> t"
38#$cmd -in f.d -inform d -outform t >ff.t1
39#if [ $? != 0 ]; then exit 1; fi
40#echo "t -> t"
41#$cmd -in f.t -inform t -outform t >ff.t2
42#if [ $? != 0 ]; then exit 1; fi
43#echo "p -> t"
44#$cmd -in f.p -inform p -outform t >ff.t3
45#if [ $? != 0 ]; then exit 1; fi
46
47echo "d -> p"
48$cmd -in f.d -inform d -outform p >ff.p1
49if [ $? != 0 ]; then exit 1; fi
50#echo "t -> p"
51#$cmd -in f.t -inform t -outform p >ff.p2
52#if [ $? != 0 ]; then exit 1; fi
53echo "p -> p"
54$cmd -in f.p -inform p -outform p >ff.p3
55if [ $? != 0 ]; then exit 1; fi
56
57cmp fff.p f.p
58if [ $? != 0 ]; then exit 1; fi
59cmp fff.p ff.p1
60if [ $? != 0 ]; then exit 1; fi
61#cmp fff.p ff.p2
62#if [ $? != 0 ]; then exit 1; fi
63cmp fff.p ff.p3
64if [ $? != 0 ]; then exit 1; fi
65
66#cmp f.t ff.t1
67#if [ $? != 0 ]; then exit 1; fi
68#cmp f.t ff.t2
69#if [ $? != 0 ]; then exit 1; fi
70#cmp f.t ff.t3
71#if [ $? != 0 ]; then exit 1; fi
72
73cmp f.p ff.p1
74if [ $? != 0 ]; then exit 1; fi
75#cmp f.p ff.p2
76#if [ $? != 0 ]; then exit 1; fi
77cmp f.p ff.p3
78if [ $? != 0 ]; then exit 1; fi
79
80/bin/rm -f f.* ff.* fff.*
81exit 0
diff --git a/src/lib/libssl/test/test.cnf b/src/lib/libssl/test/test.cnf
deleted file mode 100644
index faad3914a8..0000000000
--- a/src/lib/libssl/test/test.cnf
+++ /dev/null
@@ -1,88 +0,0 @@
1#
2# SSLeay example configuration file.
3# This is mostly being used for generation of certificate requests.
4#
5
6RANDFILE = ./.rnd
7
8####################################################################
9[ ca ]
10default_ca = CA_default # The default ca section
11
12####################################################################
13[ CA_default ]
14
15dir = ./demoCA # Where everything is kept
16certs = $dir/certs # Where the issued certs are kept
17crl_dir = $dir/crl # Where the issued crl are kept
18database = $dir/index.txt # database index file.
19new_certs_dir = $dir/new_certs # default place for new certs.
20
21certificate = $dir/CAcert.pem # The CA certificate
22serial = $dir/serial # The current serial number
23crl = $dir/crl.pem # The current CRL
24private_key = $dir/private/CAkey.pem# The private key
25RANDFILE = $dir/private/.rand # private random number file
26
27default_days = 365 # how long to certify for
28default_crl_days= 30 # how long before next CRL
29default_md = md5 # which md to use.
30
31# A few difference way of specifying how similar the request should look
32# For type CA, the listed attributes must be the same, and the optional
33# and supplied fields are just that :-)
34policy = policy_match
35
36# For the CA policy
37[ policy_match ]
38countryName = match
39stateOrProvinceName = match
40organizationName = match
41organizationalUnitName = optional
42commonName = supplied
43emailAddress = optional
44
45# For the 'anything' policy
46# At this point in time, you must list all acceptable 'object'
47# types.
48[ policy_anything ]
49countryName = optional
50stateOrProvinceName = optional
51localityName = optional
52organizationName = optional
53organizationalUnitName = optional
54commonName = supplied
55emailAddress = optional
56
57####################################################################
58[ req ]
59default_bits = 512
60default_keyfile = testkey.pem
61distinguished_name = req_distinguished_name
62encrypt_rsa_key = no
63
64[ req_distinguished_name ]
65countryName = Country Name (2 letter code)
66countryName_default = AU
67countryName_value = AU
68
69stateOrProvinceName = State or Province Name (full name)
70stateOrProvinceName_default = Queensland
71stateOrProvinceName_value =
72
73localityName = Locality Name (eg, city)
74localityName_value = Brisbane
75
76organizationName = Organization Name (eg, company)
77organizationName_default =
78organizationName_value = CryptSoft Pty Ltd
79
80organizationalUnitName = Organizational Unit Name (eg, section)
81organizationalUnitName_default =
82organizationalUnitName_value = .
83
84commonName = Common Name (eg, YOUR name)
85commonName_value = Eric Young
86
87emailAddress = Email Address
88emailAddress_value = eay@mincom.oz.au
diff --git a/src/lib/libssl/test/testca b/src/lib/libssl/test/testca
deleted file mode 100644
index 88c186b6ab..0000000000
--- a/src/lib/libssl/test/testca
+++ /dev/null
@@ -1,44 +0,0 @@
1#!/bin/sh
2
3SH="/bin/sh"
4PATH=../apps:$PATH
5export SH PATH
6
7SSLEAY_CONFIG="-config CAss.cnf"
8export SSLEAY_CONFIG
9
10/bin/rm -fr demoCA
11$SH ../apps/CA.sh -newca <<EOF
12EOF
13
14if [ $? != 0 ]; then
15 exit 1;
16fi
17
18SSLEAY_CONFIG="-config Uss.cnf"
19export SSLEAY_CONFIG
20$SH ../apps/CA.sh -newreq
21if [ $? != 0 ]; then
22 exit 1;
23fi
24
25
26SSLEAY_CONFIG="-config ../apps/openssl.cnf"
27export SSLEAY_CONFIG
28$SH ../apps/CA.sh -sign <<EOF
29y
30y
31EOF
32if [ $? != 0 ]; then
33 exit 1;
34fi
35
36
37$SH ../apps/CA.sh -verify newcert.pem
38if [ $? != 0 ]; then
39 exit 1;
40fi
41
42/bin/rm -fr demoCA newcert.pem newreq.pem
43#usage: CA -newcert|-newreq|-newca|-sign|-verify
44
diff --git a/src/lib/libssl/test/testcrl.pem b/src/lib/libssl/test/testcrl.pem
deleted file mode 100644
index 0989788354..0000000000
--- a/src/lib/libssl/test/testcrl.pem
+++ /dev/null
@@ -1,16 +0,0 @@
1-----BEGIN X509 CRL-----
2MIICjTCCAfowDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxIDAeBgNVBAoT
3F1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYDVQQLEyVTZWN1cmUgU2VydmVy
4IENlcnRpZmljYXRpb24gQXV0aG9yaXR5Fw05NTA1MDIwMjEyMjZaFw05NTA2MDEw
5MDAxNDlaMIIBaDAWAgUCQQAABBcNOTUwMjAxMTcyNDI2WjAWAgUCQQAACRcNOTUw
6MjEwMDIxNjM5WjAWAgUCQQAADxcNOTUwMjI0MDAxMjQ5WjAWAgUCQQAADBcNOTUw
7MjI1MDA0NjQ0WjAWAgUCQQAAGxcNOTUwMzEzMTg0MDQ5WjAWAgUCQQAAFhcNOTUw
8MzE1MTkxNjU0WjAWAgUCQQAAGhcNOTUwMzE1MTk0MDQxWjAWAgUCQQAAHxcNOTUw
9MzI0MTk0NDMzWjAWAgUCcgAABRcNOTUwMzI5MjAwNzExWjAWAgUCcgAAERcNOTUw
10MzMwMDIzNDI2WjAWAgUCQQAAIBcNOTUwNDA3MDExMzIxWjAWAgUCcgAAHhcNOTUw
11NDA4MDAwMjU5WjAWAgUCcgAAQRcNOTUwNDI4MTcxNzI0WjAWAgUCcgAAOBcNOTUw
12NDI4MTcyNzIxWjAWAgUCcgAATBcNOTUwNTAyMDIxMjI2WjANBgkqhkiG9w0BAQIF
13AAN+AHqOEJXSDejYy0UwxxrH/9+N2z5xu/if0J6qQmK92W0hW158wpJg+ovV3+wQ
14wvIEPRL2rocL0tKfAsVq1IawSJzSNgxG0lrcla3MrJBnZ4GaZDu4FutZh72MR3Gt
15JaAL3iTJHJD55kK2D/VoyY1djlsPuNh6AEgdVwFAyp0v
16-----END X509 CRL-----
diff --git a/src/lib/libssl/test/testenc b/src/lib/libssl/test/testenc
deleted file mode 100644
index 0656c7f525..0000000000
--- a/src/lib/libssl/test/testenc
+++ /dev/null
@@ -1,54 +0,0 @@
1#!/bin/sh
2
3testsrc=Makefile.ssl
4test=./p
5cmd=../apps/openssl
6
7cat $testsrc >$test;
8
9echo cat
10$cmd enc < $test > $test.cipher
11$cmd enc < $test.cipher >$test.clear
12cmp $test $test.clear
13if [ $? != 0 ]
14then
15 exit 1
16else
17 /bin/rm $test.cipher $test.clear
18fi
19echo base64
20$cmd enc -a -e < $test > $test.cipher
21$cmd enc -a -d < $test.cipher >$test.clear
22cmp $test $test.clear
23if [ $? != 0 ]
24then
25 exit 1
26else
27 /bin/rm $test.cipher $test.clear
28fi
29
30for i in `$cmd list-cipher-commands`
31do
32 echo $i
33 $cmd $i -bufsize 113 -e -k test < $test > $test.$i.cipher
34 $cmd $i -bufsize 157 -d -k test < $test.$i.cipher >$test.$i.clear
35 cmp $test $test.$i.clear
36 if [ $? != 0 ]
37 then
38 exit 1
39 else
40 /bin/rm $test.$i.cipher $test.$i.clear
41 fi
42
43 echo $i base64
44 $cmd $i -bufsize 113 -a -e -k test < $test > $test.$i.cipher
45 $cmd $i -bufsize 157 -a -d -k test < $test.$i.cipher >$test.$i.clear
46 cmp $test $test.$i.clear
47 if [ $? != 0 ]
48 then
49 exit 1
50 else
51 /bin/rm $test.$i.cipher $test.$i.clear
52 fi
53done
54rm -f $test
diff --git a/src/lib/libssl/test/testgen b/src/lib/libssl/test/testgen
deleted file mode 100644
index 3534f5821f..0000000000
--- a/src/lib/libssl/test/testgen
+++ /dev/null
@@ -1,30 +0,0 @@
1#!/bin/sh
2
3T=testcert
4KEY=512
5CA=../certs/testca.pem
6
7/bin/rm -f $T.1 $T.2 $T.key
8
9PATH=../apps:$PATH;
10export PATH
11
12echo "generating certificate request"
13
14echo "There should be a 2 sequences of .'s and some +'s."
15echo "There should not be more that at most 80 per line"
16echo "This could take some time."
17
18../apps/openssl req -config test.cnf -new -out testreq.pem
19if [ $? != 0 ]; then
20echo problems creating request
21exit 1
22fi
23
24../apps/openssl req -config test.cnf -verify -in testreq.pem -noout
25if [ $? != 0 ]; then
26echo signature on req is wrong
27exit 1
28fi
29
30exit 0
diff --git a/src/lib/libssl/test/testp7.pem b/src/lib/libssl/test/testp7.pem
deleted file mode 100644
index 6bba16f137..0000000000
--- a/src/lib/libssl/test/testp7.pem
+++ /dev/null
@@ -1,46 +0,0 @@
1-----BEGIN PKCS7-----
2MIAGCSqGSIb3DQEHAqCAMIIIBwIBATEAMIAGCSqGSIb3DQEHAQAAoIIGPDCCBHIw
3ggQcoAMCAQICEHkvjiX1iVGQMenF9HgIjI8wDQYJKoZIhvcNAQEEBQAwYjERMA8G
4A1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQL
5EytWZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMB4X
6DTk2MDcxOTAwMDAwMFoXDTk3MDMzMDIzNTk1OVowgdUxETAPBgNVBAcTCEludGVy
7bmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNpZ24g
8Q2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjEoMCYGA1UECxMfRGln
9aXRhbCBJRCBDbGFzcyAxIC0gU01JTUUgVGVzdDFHMEUGA1UECxM+d3d3LnZlcmlz
10aWduLmNvbS9yZXBvc2l0b3J5L0NQUy0xLjAgSW5jLiBieSBSZWYuLExJQUIuTFRE
11KGMpOTYwWzANBgkqhkiG9w0BAQEFAANKADBHAkAOy7xxCAIkOfuIA2LyRpxgKlDO
12Rl8htdXYhF5iBGUx1GYaK6KF+bK/CCI0l4j2OfWGFBUrwGoWqxTNcWgTfMzRAgMB
13AAGjggI5MIICNTAJBgNVHRMEAjAAMIICJgYDVR0DBIICHTCCAhkwggIVMIICEQYL
14YIZIAYb4RQEHAQEwggIAFoIBq1RoaXMgY2VydGlmaWNhdGUgaW5jb3Jwb3JhdGVz
15IGJ5IHJlZmVyZW5jZSwgYW5kIGl0cyB1c2UgaXMgc3RyaWN0bHkgc3ViamVjdCB0
16bywgdGhlIFZlcmlTaWduIENlcnRpZmljYXRpb24gUHJhY3RpY2UgU3RhdGVtZW50
17IChDUFMpLCBhdmFpbGFibGUgYXQ6IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9D
18UFMtMS4wOyBieSBFLW1haWwgYXQgQ1BTLXJlcXVlc3RzQHZlcmlzaWduLmNvbTsg
19b3IgYnkgbWFpbCBhdCBWZXJpU2lnbiwgSW5jLiwgMjU5MyBDb2FzdCBBdmUuLCBN
20b3VudGFpbiBWaWV3LCBDQSA5NDA0MyBVU0EgVGVsLiArMSAoNDE1KSA5NjEtODgz
21MCBDb3B5cmlnaHQgKGMpIDE5OTYgVmVyaVNpZ24sIEluYy4gIEFsbCBSaWdodHMg
22UmVzZXJ2ZWQuIENFUlRBSU4gV0FSUkFOVElFUyBESVNDTEFJTUVEIGFuZCBMSUFC
23SUxJVFkgTElNSVRFRC6gDgYMYIZIAYb4RQEHAQEBoQ4GDGCGSAGG+EUBBwEBAjAv
24MC0WK2h0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0b3J5L0NQUy0xLgMw
25DQYJKoZIhvcNAQEEBQADQQDAmA7km/3iJWEsWN9Z2WU2gmZAknx45WnDKHxMa3Bf
26gNsh6BLk/ngkJKjNKTDR13XVHqEPUY1flbjATZputw1GMIIBwjCCAWygAwIBAgIQ
27fAmE6tW5ERSQWDneu3KfSTANBgkqhkiG9w0BAQIFADA+MQswCQYDVQQGEwJVUzEX
28MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xFjAUBgNVBAsTDVRFU1QgUm9vdCBQQ0Ew
29HhcNOTYwNzE3MDAwMDAwWhcNOTcwNzE3MjM1OTU5WjBiMREwDwYDVQQHEwhJbnRl
30cm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWdu
31IENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXIwXDANBgkqhkiG9w0B
32AQEFAANLADBIAkEA7Fc6zYJw4WwCWa1ni3fYNbzGSQNluuw990024GusjLfhEk1h
33MsIUukTT/n8yxoO7rYp4x+LS+tHF2tBtuxg7CwIDAQABoyIwIDALBgNVHQ8EBAMC
34AQYwEQYJYIZIAYb4QgEBBAQDAgIEMA0GCSqGSIb3DQEBAgUAA0EAFKem0cJGg9nd
35TAbP5o1HIEyNn11ZlvLU5v1Hejs1MKQt72IMm4jjgOH+pjguXW8lB6yzrK4oVOO2
36UNCaNQ1H26GCAa0wgcEwbTANBgkqhkiG9w0BAQIFADA+MQswCQYDVQQGEwJVUzEX
37MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xFjAUBgNVBAsTDVRFU1QgUm9vdCBQQ0EX
38DTk2MDcxNzE3NDQwOVoXDTk4MDcxNzAwMDAwMFowDQYJKoZIhvcNAQECBQADQQB4
39rQNP8QLpAox83odQDE/5dqAuvDfshW/miTxwQTMXOoBtjGiowTcG+YXF1JZTJRMT
40jQN47tdH+6MCKt7N8MddMIHmMIGRMA0GCSqGSIb3DQEBAgUAMGIxETAPBgNVBAcT
41CEludGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVy
42aVNpZ24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlchcNOTYwNzE3
43MTc1OTI5WhcNOTcwNzE4MDAwMDAwWjANBgkqhkiG9w0BAQIFAANBALm1VmE7FrEJ
44rLXvX/lIDMPAZIw5TNuX8EC6wn5ppy8Y3sHstdJEkTsqVGiS2/q+KEQC3NHxvV32
45bGooiIKLUB4xAAAAAAA=
46-----END PKCS7-----
diff --git a/src/lib/libssl/test/testreq2.pem b/src/lib/libssl/test/testreq2.pem
deleted file mode 100644
index c3cdcffcbc..0000000000
--- a/src/lib/libssl/test/testreq2.pem
+++ /dev/null
@@ -1,7 +0,0 @@
1-----BEGIN CERTIFICATE REQUEST-----
2MIHaMIGFAgEAMA4xDDAKBgNVBAMTA2NuNDBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC
3QQCQsnkyUGDY2R3mYoeTprFJKgWuJ3f1jUjlIuW5+wfAUoeMt35c4vcFZ2mIBpEG
4DtzkNQN1kr2O9ldm9zYnYhyhAgMBAAGgEjAQBgorBgEEAYI3AgEOMQIwADANBgkq
5hkiG9w0BAQQFAANBAAb2szZgVIxg3vK6kYLjGSBISyuzcXJ6IvuPW6M+yzi1Qgoi
6gQhazHTJp91T8ItZEzUJGZSZl2e5iXlnffWB+/U=
7-----END CERTIFICATE REQUEST-----
diff --git a/src/lib/libssl/test/testrsa.pem b/src/lib/libssl/test/testrsa.pem
deleted file mode 100644
index aad21067a8..0000000000
--- a/src/lib/libssl/test/testrsa.pem
+++ /dev/null
@@ -1,9 +0,0 @@
1-----BEGIN RSA PRIVATE KEY-----
2MIIBPAIBAAJBAKrbeqkuRk8VcRmWFmtP+LviMB3+6dizWW3DwaffznyHGAFwUJ/I
3Tv0XtbsCyl3QoyKGhrOAy3RvPK5M38iuXT0CAwEAAQJAZ3cnzaHXM/bxGaR5CR1R
4rD1qFBAVfoQFiOH9uPJgMaoAuoQEisPHVcZDKcOv4wEg6/TInAIXBnEigtqvRzuy
5oQIhAPcgZzUq3yVooAaoov8UbXPxqHlwo6GBMqnv20xzkf6ZAiEAsP4BnIaQTM8S
6mvcpHZwQJdmdHHkGKAs37Dfxi67HbkUCIQCeZGliHXFa071Fp06ZeWlR2ADonTZz
7rJBhdTe0v5pCeQIhAIZfkiGgGBX4cIuuckzEm43g9WMUjxP/0GlK39vIyihxAiEA
8mymehFRT0MvqW5xAKAx7Pgkt8HVKwVhc2LwGKHE0DZM=
9-----END RSA PRIVATE KEY-----
diff --git a/src/lib/libssl/test/testsid.pem b/src/lib/libssl/test/testsid.pem
deleted file mode 100644
index 7ffd008f66..0000000000
--- a/src/lib/libssl/test/testsid.pem
+++ /dev/null
@@ -1,12 +0,0 @@
1-----BEGIN SSL SESSION PARAMETERS-----
2MIIB1gIBAQIBAgQDAQCABBCi11xa5qkOP8xrr02K/NQCBBBkIYQZM0Bt95W0EHNV
3bA58oQYCBDIBr7WiBAICASyjggGGMIIBgjCCASwCAQMwDQYJKoZIhvcNAQEEBQAw
4ODELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3Jz
5YSB0ZXN0IENBMB4XDTk1MTAwOTIzMzEzNFoXDTk4MDcwNTIzMzEzNFowYDELMAkG
6A1UEBhMCQVUxDDAKBgNVBAgTA1FMRDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRk
7LjELMAkGA1UECxMCQ1MxGzAZBgNVBAMTElNTTGVheSBkZW1vIGNsaWVudDBcMA0G
8CSqGSIb3DQEBAQUAA0sAMEgCQQC4pcXEL1lgVA+B5Q3TcuW/O3LZHoA73IYm8oFD
9TezgCDhL2RTMn+seKWF36UtJKRIOBU9jZHCVVd0Me5ls6BEjAgMBAAEwDQYJKoZI
10hvcNAQEEBQADQQBoIpOcwUY1qlVF7j3ROSGvUsbvByOBFmYWkIBgsCqR+9qo1A7L
11CrWF5i8LWt/vLwAHaxWNx2YuBJMFyuK81fTvpA0EC3Rlc3Rjb250ZXh0
12-----END SSL SESSION PARAMETERS-----
diff --git a/src/lib/libssl/test/testss b/src/lib/libssl/test/testss
deleted file mode 100644
index da62997a5f..0000000000
--- a/src/lib/libssl/test/testss
+++ /dev/null
@@ -1,90 +0,0 @@
1#!/bin/sh
2
3digest='-mdc2'
4reqcmd="../apps/openssl req"
5x509cmd="../apps/openssl x509 $digest"
6verifycmd="../apps/openssl verify"
7dummycnf="../apps/openssl.cnf"
8
9CAkey="keyCA.ss"
10CAcert="certCA.ss"
11CAreq="reqCA.ss"
12CAconf="CAss.cnf"
13CAreq2="req2CA.ss" # temp
14
15Uconf="Uss.cnf"
16Ukey="keyU.ss"
17Ureq="reqU.ss"
18Ucert="certU.ss"
19
20echo
21echo "make a certificate request using 'req'"
22$reqcmd -config $CAconf -out $CAreq -keyout $CAkey -new #>err.ss
23if [ $? != 0 ]; then
24 echo "error using 'req' to generate a certificate request"
25 exit 1
26fi
27echo
28echo "convert the certificate request into a self signed certificate using 'x509'"
29$x509cmd -CAcreateserial -in $CAreq -days 30 -req -out $CAcert -signkey $CAkey >err.ss
30if [ $? != 0 ]; then
31 echo "error using 'x509' to self sign a certificate request"
32 exit 1
33fi
34
35echo
36echo "convert a certificate into a certificate request using 'x509'"
37$x509cmd -in $CAcert -x509toreq -signkey $CAkey -out $CAreq2 >err.ss
38if [ $? != 0 ]; then
39 echo "error using 'x509' convert a certificate to a certificate request"
40 exit 1
41fi
42
43$reqcmd -config $dummycnf -verify -in $CAreq -noout
44if [ $? != 0 ]; then
45 echo first generated request is invalid
46 exit 1
47fi
48
49$reqcmd -config $dummycnf -verify -in $CAreq2 -noout
50if [ $? != 0 ]; then
51 echo second generated request is invalid
52 exit 1
53fi
54
55$verifycmd -CAfile $CAcert $CAcert
56if [ $? != 0 ]; then
57 echo first generated cert is invalid
58 exit 1
59fi
60
61echo
62echo "make another certificate request using 'req'"
63$reqcmd -config $Uconf -out $Ureq -keyout $Ukey -new >err.ss
64if [ $? != 0 ]; then
65 echo "error using 'req' to generate a certificate request"
66 exit 1
67fi
68
69echo
70echo "sign certificate request with the just created CA via 'x509'"
71$x509cmd -CAcreateserial -in $Ureq -days 30 -req -out $Ucert -CA $CAcert -CAkey $CAkey >err.ss
72if [ $? != 0 ]; then
73 echo "error using 'x509' to sign a certificate request"
74 exit 1
75fi
76
77$verifycmd -CAfile $CAcert $Ucert
78echo
79echo "Certificate details"
80$x509cmd -subject -issuer -startdate -enddate -noout -in $Ucert
81
82echo
83echo The generated CA certificate is $CAcert
84echo The generated CA private key is $CAkey
85
86echo The generated user certificate is $Ucert
87echo The generated user private key is $Ukey
88
89/bin/rm err.ss
90exit 0
diff --git a/src/lib/libssl/test/testssl b/src/lib/libssl/test/testssl
deleted file mode 100644
index 255ae5e976..0000000000
--- a/src/lib/libssl/test/testssl
+++ /dev/null
@@ -1,75 +0,0 @@
1#!/bin/sh
2
3echo test sslv2
4./ssltest -ssl2 || exit 1
5
6echo test sslv2 with server authentication
7./ssltest -ssl2 -server_auth -CApath ../certs || exit 1
8
9echo test sslv2 with client authentication
10./ssltest -ssl2 -client_auth -CApath ../certs || exit 1
11
12echo test sslv2 with both client and server authentication
13./ssltest -ssl2 -server_auth -client_auth -CApath ../certs || exit 1
14
15echo test sslv3
16./ssltest -ssl3 || exit 1
17
18echo test sslv3 with server authentication
19./ssltest -ssl3 -server_auth -CApath ../certs || exit 1
20
21echo test sslv3 with client authentication
22./ssltest -ssl3 -client_auth -CApath ../certs || exit 1
23
24echo test sslv3 with both client and server authentication
25./ssltest -ssl3 -server_auth -client_auth -CApath ../certs || exit 1
26
27echo test sslv2/sslv3
28./ssltest || exit 1
29
30echo test sslv2/sslv3 with server authentication
31./ssltest -server_auth -CApath ../certs || exit 1
32
33echo test sslv2/sslv3 with client authentication
34./ssltest -client_auth -CApath ../certs || exit 1
35
36echo test sslv2/sslv3 with both client and server authentication
37./ssltest -server_auth -client_auth -CApath ../certs || exit 1
38
39echo test sslv2 via BIO pair
40./ssltest -bio_pair -ssl2 || exit 1
41
42echo test sslv2 with server authentication via BIO pair
43./ssltest -bio_pair -ssl2 -server_auth -CApath ../certs || exit 1
44
45echo test sslv2 with client authentication via BIO pair
46./ssltest -bio_pair -ssl2 -client_auth -CApath ../certs || exit 1
47
48echo test sslv2 with both client and server authentication via BIO pair
49./ssltest -bio_pair -ssl2 -server_auth -client_auth -CApath ../certs || exit 1
50
51echo test sslv3 via BIO pair
52./ssltest -bio_pair -ssl3 || exit 1
53
54echo test sslv3 with server authentication via BIO pair
55./ssltest -bio_pair -ssl3 -server_auth -CApath ../certs || exit 1
56
57echo test sslv3 with client authentication via BIO pair
58./ssltest -bio_pair -ssl3 -client_auth -CApath ../certs || exit 1
59
60echo test sslv3 with both client and server authentication via BIO pair
61./ssltest -bio_pair -ssl3 -server_auth -client_auth -CApath ../certs || exit 1
62
63echo test sslv2/sslv3 via BIO pair
64./ssltest || exit 1
65
66echo test sslv2/sslv3 with server authentication
67./ssltest -bio_pair -server_auth -CApath ../certs || exit 1
68
69echo test sslv2/sslv3 with client authentication via BIO pair
70./ssltest -bio_pair -client_auth -CApath ../certs || exit 1
71
72echo test sslv2/sslv3 with both client and server authentication via BIO pair
73./ssltest -bio_pair -server_auth -client_auth -CApath ../certs || exit 1
74
75exit 0
diff --git a/src/lib/libssl/test/testx509.pem b/src/lib/libssl/test/testx509.pem
deleted file mode 100644
index 8a85d14964..0000000000
--- a/src/lib/libssl/test/testx509.pem
+++ /dev/null
@@ -1,10 +0,0 @@
1-----BEGIN CERTIFICATE-----
2MIIBWzCCAQYCARgwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV
3BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MDYxOTIz
4MzMxMloXDTk1MDcxNzIzMzMxMlowOjELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM
5RDEdMBsGA1UEAxMUU1NMZWF5L3JzYSB0ZXN0IGNlcnQwXDANBgkqhkiG9w0BAQEF
6AANLADBIAkEAqtt6qS5GTxVxGZYWa0/4u+IwHf7p2LNZbcPBp9/OfIcYAXBQn8hO
7/Re1uwLKXdCjIoaGs4DLdG88rkzfyK5dPQIDAQABMAwGCCqGSIb3DQIFBQADQQAE
8Wc7EcF8po2/ZO6kNCwK/ICH6DobgLekA5lSLr5EvuioZniZp5lFzAw4+YzPQ7XKJ
9zl9HYIMxATFyqSiD9jsx
10-----END CERTIFICATE-----
diff --git a/src/lib/libssl/test/times b/src/lib/libssl/test/times
deleted file mode 100644
index 49aeebf216..0000000000
--- a/src/lib/libssl/test/times
+++ /dev/null
@@ -1,113 +0,0 @@
1
2More number for the questions about SSL overheads....
3
4The following numbers were generated on a pentium pro 200, running linux.
5They give an indication of the SSL protocol and encryption overheads.
6
7The program that generated them is an unreleased version of ssl/ssltest.c
8which is the SSLeay ssl protocol testing program. It is a single process that
9talks both sides of the SSL protocol via a non-blocking memory buffer
10interface.
11
12How do I read this? The protocol and cipher are reasonable obvious.
13The next number is the number of connections being made. The next is the
14number of bytes exchanged bewteen the client and server side of the protocol.
15This is the number of bytes that the client sends to the server, and then
16the server sends back. Because this is all happening in one process,
17the data is being encrypted, decrypted, encrypted and then decrypted again.
18It is a round trip of that many bytes. Because the one process performs
19both the client and server sides of the protocol and it sends this many bytes
20each direction, multiply this number by 4 to generate the number
21of bytes encrypted/decrypted/MACed. The first time value is how many seconds
22elapsed doing a full SSL handshake, the second is the cost of one
23full handshake and the rest being session-id reuse.
24
25SSLv2 RC4-MD5 1000 x 1 12.83s 0.70s
26SSLv3 NULL-MD5 1000 x 1 14.35s 1.47s
27SSLv3 RC4-MD5 1000 x 1 14.46s 1.56s
28SSLv3 RC4-MD5 1000 x 1 51.93s 1.62s 1024bit RSA
29SSLv3 RC4-SHA 1000 x 1 14.61s 1.83s
30SSLv3 DES-CBC-SHA 1000 x 1 14.70s 1.89s
31SSLv3 DES-CBC3-SHA 1000 x 1 15.16s 2.16s
32
33SSLv2 RC4-MD5 1000 x 1024 13.72s 1.27s
34SSLv3 NULL-MD5 1000 x 1024 14.79s 1.92s
35SSLv3 RC4-MD5 1000 x 1024 52.58s 2.29s 1024bit RSA
36SSLv3 RC4-SHA 1000 x 1024 15.39s 2.67s
37SSLv3 DES-CBC-SHA 1000 x 1024 16.45s 3.55s
38SSLv3 DES-CBC3-SHA 1000 x 1024 18.21s 5.38s
39
40SSLv2 RC4-MD5 1000 x 10240 18.97s 6.52s
41SSLv3 NULL-MD5 1000 x 10240 17.79s 5.11s
42SSLv3 RC4-MD5 1000 x 10240 20.25s 7.90s
43SSLv3 RC4-MD5 1000 x 10240 58.26s 8.08s 1024bit RSA
44SSLv3 RC4-SHA 1000 x 10240 22.96s 11.44s
45SSLv3 DES-CBC-SHA 1000 x 10240 30.65s 18.41s
46SSLv3 DES-CBC3-SHA 1000 x 10240 47.04s 34.53s
47
48SSLv2 RC4-MD5 1000 x 102400 70.22s 57.74s
49SSLv3 NULL-MD5 1000 x 102400 43.73s 31.03s
50SSLv3 RC4-MD5 1000 x 102400 71.32s 58.83s
51SSLv3 RC4-MD5 1000 x 102400 109.66s 59.20s 1024bit RSA
52SSLv3 RC4-SHA 1000 x 102400 95.88s 82.21s
53SSLv3 DES-CBC-SHA 1000 x 102400 173.22s 160.55s
54SSLv3 DES-CBC3-SHA 1000 x 102400 336.61s 323.82s
55
56What does this all mean? Well for a server, with no session-id reuse, with
57a transfer size of 10240 bytes, using RC4-MD5 and a 512bit server key,
58a pentium pro 200 running linux can handle the SSLv3 protocol overheads of
59about 49 connections a second. Reality will be quite different :-).
60
61Remeber the first number is 1000 full ssl handshakes, the second is
621 full and 999 with session-id reuse. The RSA overheads for each exchange
63would be one public and one private operation, but the protocol/MAC/cipher
64cost would be quite similar in both the client and server.
65
66eric (adding numbers to speculation)
67
68--- Appendix ---
69- The time measured is user time but these number a very rough.
70- Remember this is the cost of both client and server sides of the protocol.
71- The TCP/kernal overhead of connection establishment is normally the
72 killer in SSL. Often delays in the TCP protocol will make session-id
73 reuse look slower that new sessions, but this would not be the case on
74 a loaded server.
75- The TCP round trip latencies, while slowing indervidual connections,
76 would have minimal impact on throughput.
77- Instead of sending one 102400 byte buffer, one 8k buffer is sent until
78- the required number of bytes are processed.
79- The SSLv3 connections were actually SSLv2 compatable SSLv3 headers.
80- A 512bit server key was being used except where noted.
81- No server key verification was being performed on the client side of the
82 protocol. This would slow things down very little.
83- The library being used is SSLeay 0.8.x.
84- The normal mesauring system was commands of the form
85 time ./ssltest -num 1000 -bytes 102400 -cipher DES-CBC-SHA -reuse
86 This modified version of ssltest should be in the next public release of
87 SSLeay.
88
89The general cipher performace number for this platform are
90
91SSLeay 0.8.2a 04-Sep-1997
92built on Fri Sep 5 17:37:05 EST 1997
93options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) idea(int) blowfish(ptr2)
94C flags:gcc -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall -Wuninitialized
95The 'numbers' are in 1000s of bytes per second processed.
96type 8 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
97md2 131.02k 368.41k 500.57k 549.21k 566.09k
98mdc2 535.60k 589.10k 595.88k 595.97k 594.54k
99md5 1801.53k 9674.77k 17484.03k 21849.43k 23592.96k
100sha 1261.63k 5533.25k 9285.63k 11187.88k 11913.90k
101sha1 1103.13k 4782.53k 7933.78k 9472.34k 10070.70k
102rc4 10722.53k 14443.93k 15215.79k 15299.24k 15219.59k
103des cbc 3286.57k 3827.73k 3913.39k 3931.82k 3926.70k
104des ede3 1443.50k 1549.08k 1561.17k 1566.38k 1564.67k
105idea cbc 2203.64k 2508.16k 2538.33k 2543.62k 2547.71k
106rc2 cbc 1430.94k 1511.59k 1524.82k 1527.13k 1523.33k
107blowfish cbc 4716.07k 5965.82k 6190.17k 6243.67k 6234.11k
108 sign verify
109rsa 512 bits 0.0100s 0.0011s
110rsa 1024 bits 0.0451s 0.0012s
111rsa 2048 bits 0.2605s 0.0086s
112rsa 4096 bits 1.6883s 0.0302s
113
diff --git a/src/lib/libssl/test/tpkcs7 b/src/lib/libssl/test/tpkcs7
deleted file mode 100644
index 15bbba42c0..0000000000
--- a/src/lib/libssl/test/tpkcs7
+++ /dev/null
@@ -1,51 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl pkcs7'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=testp7.pem
12fi
13
14echo testing pkcs7 conversions
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20echo "p -> p"
21$cmd -in fff.p -inform p -outform p >f.p
22if [ $? != 0 ]; then exit 1; fi
23
24echo "d -> d"
25$cmd -in f.d -inform d -outform d >ff.d1
26if [ $? != 0 ]; then exit 1; fi
27echo "p -> d"
28$cmd -in f.p -inform p -outform d >ff.d3
29if [ $? != 0 ]; then exit 1; fi
30
31echo "d -> p"
32$cmd -in f.d -inform d -outform p >ff.p1
33if [ $? != 0 ]; then exit 1; fi
34echo "p -> p"
35$cmd -in f.p -inform p -outform p >ff.p3
36if [ $? != 0 ]; then exit 1; fi
37
38cmp fff.p f.p
39if [ $? != 0 ]; then exit 1; fi
40cmp fff.p ff.p1
41if [ $? != 0 ]; then exit 1; fi
42cmp fff.p ff.p3
43if [ $? != 0 ]; then exit 1; fi
44
45cmp f.p ff.p1
46if [ $? != 0 ]; then exit 1; fi
47cmp f.p ff.p3
48if [ $? != 0 ]; then exit 1; fi
49
50/bin/rm -f f.* ff.* fff.*
51exit 0
diff --git a/src/lib/libssl/test/tpkcs7d b/src/lib/libssl/test/tpkcs7d
deleted file mode 100644
index 46e5aa2bd6..0000000000
--- a/src/lib/libssl/test/tpkcs7d
+++ /dev/null
@@ -1,44 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl pkcs7'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=pkcs7-1.pem
12fi
13
14echo "testing pkcs7 conversions (2)"
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20echo "p -> p"
21$cmd -in fff.p -inform p -outform p >f.p
22if [ $? != 0 ]; then exit 1; fi
23
24echo "d -> d"
25$cmd -in f.d -inform d -outform d >ff.d1
26if [ $? != 0 ]; then exit 1; fi
27echo "p -> d"
28$cmd -in f.p -inform p -outform d >ff.d3
29if [ $? != 0 ]; then exit 1; fi
30
31echo "d -> p"
32$cmd -in f.d -inform d -outform p >ff.p1
33if [ $? != 0 ]; then exit 1; fi
34echo "p -> p"
35$cmd -in f.p -inform p -outform p >ff.p3
36if [ $? != 0 ]; then exit 1; fi
37
38cmp f.p ff.p1
39if [ $? != 0 ]; then exit 1; fi
40cmp f.p ff.p3
41if [ $? != 0 ]; then exit 1; fi
42
43/bin/rm -f f.* ff.* fff.*
44exit 0
diff --git a/src/lib/libssl/test/treq b/src/lib/libssl/test/treq
deleted file mode 100644
index 0464c9d902..0000000000
--- a/src/lib/libssl/test/treq
+++ /dev/null
@@ -1,81 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl req -config ../apps/openssl.cnf'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=testreq.pem
12fi
13
14echo testing req conversions
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20#echo "p -> t"
21#$cmd -in fff.p -inform p -outform t >f.t
22#if [ $? != 0 ]; then exit 1; fi
23echo "p -> p"
24$cmd -in fff.p -inform p -outform p >f.p
25if [ $? != 0 ]; then exit 1; fi
26
27echo "d -> d"
28$cmd -verify -in f.d -inform d -outform d >ff.d1
29if [ $? != 0 ]; then exit 1; fi
30#echo "t -> d"
31#$cmd -in f.t -inform t -outform d >ff.d2
32#if [ $? != 0 ]; then exit 1; fi
33echo "p -> d"
34$cmd -verify -in f.p -inform p -outform d >ff.d3
35if [ $? != 0 ]; then exit 1; fi
36
37#echo "d -> t"
38#$cmd -in f.d -inform d -outform t >ff.t1
39#if [ $? != 0 ]; then exit 1; fi
40#echo "t -> t"
41#$cmd -in f.t -inform t -outform t >ff.t2
42#if [ $? != 0 ]; then exit 1; fi
43#echo "p -> t"
44#$cmd -in f.p -inform p -outform t >ff.t3
45#if [ $? != 0 ]; then exit 1; fi
46
47echo "d -> p"
48$cmd -in f.d -inform d -outform p >ff.p1
49if [ $? != 0 ]; then exit 1; fi
50#echo "t -> p"
51#$cmd -in f.t -inform t -outform p >ff.p2
52#if [ $? != 0 ]; then exit 1; fi
53echo "p -> p"
54$cmd -in f.p -inform p -outform p >ff.p3
55if [ $? != 0 ]; then exit 1; fi
56
57cmp fff.p f.p
58if [ $? != 0 ]; then exit 1; fi
59cmp fff.p ff.p1
60if [ $? != 0 ]; then exit 1; fi
61#cmp fff.p ff.p2
62#if [ $? != 0 ]; then exit 1; fi
63cmp fff.p ff.p3
64if [ $? != 0 ]; then exit 1; fi
65
66#cmp f.t ff.t1
67#if [ $? != 0 ]; then exit 1; fi
68#cmp f.t ff.t2
69#if [ $? != 0 ]; then exit 1; fi
70#cmp f.t ff.t3
71#if [ $? != 0 ]; then exit 1; fi
72
73cmp f.p ff.p1
74if [ $? != 0 ]; then exit 1; fi
75#cmp f.p ff.p2
76#if [ $? != 0 ]; then exit 1; fi
77cmp f.p ff.p3
78if [ $? != 0 ]; then exit 1; fi
79
80/bin/rm -f f.* ff.* fff.*
81exit 0
diff --git a/src/lib/libssl/test/trsa b/src/lib/libssl/test/trsa
deleted file mode 100644
index d6a4dd826d..0000000000
--- a/src/lib/libssl/test/trsa
+++ /dev/null
@@ -1,81 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl rsa'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=testrsa.pem
12fi
13
14echo testing rsa conversions
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20#echo "p -> t"
21#$cmd -in fff.p -inform p -outform t >f.t
22#if [ $? != 0 ]; then exit 1; fi
23echo "p -> p"
24$cmd -in fff.p -inform p -outform p >f.p
25if [ $? != 0 ]; then exit 1; fi
26
27echo "d -> d"
28$cmd -in f.d -inform d -outform d >ff.d1
29if [ $? != 0 ]; then exit 1; fi
30#echo "t -> d"
31#$cmd -in f.t -inform t -outform d >ff.d2
32#if [ $? != 0 ]; then exit 1; fi
33echo "p -> d"
34$cmd -in f.p -inform p -outform d >ff.d3
35if [ $? != 0 ]; then exit 1; fi
36
37#echo "d -> t"
38#$cmd -in f.d -inform d -outform t >ff.t1
39#if [ $? != 0 ]; then exit 1; fi
40#echo "t -> t"
41#$cmd -in f.t -inform t -outform t >ff.t2
42#if [ $? != 0 ]; then exit 1; fi
43#echo "p -> t"
44#$cmd -in f.p -inform p -outform t >ff.t3
45#if [ $? != 0 ]; then exit 1; fi
46
47echo "d -> p"
48$cmd -in f.d -inform d -outform p >ff.p1
49if [ $? != 0 ]; then exit 1; fi
50#echo "t -> p"
51#$cmd -in f.t -inform t -outform p >ff.p2
52#if [ $? != 0 ]; then exit 1; fi
53echo "p -> p"
54$cmd -in f.p -inform p -outform p >ff.p3
55if [ $? != 0 ]; then exit 1; fi
56
57cmp fff.p f.p
58if [ $? != 0 ]; then exit 1; fi
59cmp fff.p ff.p1
60if [ $? != 0 ]; then exit 1; fi
61#cmp fff.p ff.p2
62#if [ $? != 0 ]; then exit 1; fi
63cmp fff.p ff.p3
64if [ $? != 0 ]; then exit 1; fi
65
66#cmp f.t ff.t1
67#if [ $? != 0 ]; then exit 1; fi
68#cmp f.t ff.t2
69#if [ $? != 0 ]; then exit 1; fi
70#cmp f.t ff.t3
71#if [ $? != 0 ]; then exit 1; fi
72
73cmp f.p ff.p1
74if [ $? != 0 ]; then exit 1; fi
75#cmp f.p ff.p2
76#if [ $? != 0 ]; then exit 1; fi
77cmp f.p ff.p3
78if [ $? != 0 ]; then exit 1; fi
79
80/bin/rm -f f.* ff.* fff.*
81exit 0
diff --git a/src/lib/libssl/test/tsid b/src/lib/libssl/test/tsid
deleted file mode 100644
index 9e0854516c..0000000000
--- a/src/lib/libssl/test/tsid
+++ /dev/null
@@ -1,81 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl sess_id'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=testsid.pem
12fi
13
14echo testing session-id conversions
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20#echo "p -> t"
21#$cmd -in fff.p -inform p -outform t >f.t
22#if [ $? != 0 ]; then exit 1; fi
23echo "p -> p"
24$cmd -in fff.p -inform p -outform p >f.p
25if [ $? != 0 ]; then exit 1; fi
26
27echo "d -> d"
28$cmd -in f.d -inform d -outform d >ff.d1
29if [ $? != 0 ]; then exit 1; fi
30#echo "t -> d"
31#$cmd -in f.t -inform t -outform d >ff.d2
32#if [ $? != 0 ]; then exit 1; fi
33echo "p -> d"
34$cmd -in f.p -inform p -outform d >ff.d3
35if [ $? != 0 ]; then exit 1; fi
36
37#echo "d -> t"
38#$cmd -in f.d -inform d -outform t >ff.t1
39#if [ $? != 0 ]; then exit 1; fi
40#echo "t -> t"
41#$cmd -in f.t -inform t -outform t >ff.t2
42#if [ $? != 0 ]; then exit 1; fi
43#echo "p -> t"
44#$cmd -in f.p -inform p -outform t >ff.t3
45#if [ $? != 0 ]; then exit 1; fi
46
47echo "d -> p"
48$cmd -in f.d -inform d -outform p >ff.p1
49if [ $? != 0 ]; then exit 1; fi
50#echo "t -> p"
51#$cmd -in f.t -inform t -outform p >ff.p2
52#if [ $? != 0 ]; then exit 1; fi
53echo "p -> p"
54$cmd -in f.p -inform p -outform p >ff.p3
55if [ $? != 0 ]; then exit 1; fi
56
57cmp fff.p f.p
58if [ $? != 0 ]; then exit 1; fi
59cmp fff.p ff.p1
60if [ $? != 0 ]; then exit 1; fi
61#cmp fff.p ff.p2
62#if [ $? != 0 ]; then exit 1; fi
63cmp fff.p ff.p3
64if [ $? != 0 ]; then exit 1; fi
65
66#cmp f.t ff.t1
67#if [ $? != 0 ]; then exit 1; fi
68#cmp f.t ff.t2
69#if [ $? != 0 ]; then exit 1; fi
70#cmp f.t ff.t3
71#if [ $? != 0 ]; then exit 1; fi
72
73cmp f.p ff.p1
74if [ $? != 0 ]; then exit 1; fi
75#cmp f.p ff.p2
76#if [ $? != 0 ]; then exit 1; fi
77cmp f.p ff.p3
78if [ $? != 0 ]; then exit 1; fi
79
80/bin/rm -f f.* ff.* fff.*
81exit 0
diff --git a/src/lib/libssl/test/tx509 b/src/lib/libssl/test/tx509
deleted file mode 100644
index 35169f3a43..0000000000
--- a/src/lib/libssl/test/tx509
+++ /dev/null
@@ -1,81 +0,0 @@
1#!/bin/sh
2
3PATH=../apps:$PATH
4export PATH
5
6cmd='../apps/openssl x509'
7
8if [ "$1"x != "x" ]; then
9 t=$1
10else
11 t=testx509.pem
12fi
13
14echo testing X509 conversions
15cp $t fff.p
16
17echo "p -> d"
18$cmd -in fff.p -inform p -outform d >f.d
19if [ $? != 0 ]; then exit 1; fi
20echo "p -> n"
21$cmd -in fff.p -inform p -outform n >f.n
22if [ $? != 0 ]; then exit 1; fi
23echo "p -> p"
24$cmd -in fff.p -inform p -outform p >f.p
25if [ $? != 0 ]; then exit 1; fi
26
27echo "d -> d"
28$cmd -in f.d -inform d -outform d >ff.d1
29if [ $? != 0 ]; then exit 1; fi
30echo "n -> d"
31$cmd -in f.n -inform n -outform d >ff.d2
32if [ $? != 0 ]; then exit 1; fi
33echo "p -> d"
34$cmd -in f.p -inform p -outform d >ff.d3
35if [ $? != 0 ]; then exit 1; fi
36
37echo "d -> n"
38$cmd -in f.d -inform d -outform n >ff.n1
39if [ $? != 0 ]; then exit 1; fi
40echo "n -> n"
41$cmd -in f.n -inform n -outform n >ff.n2
42if [ $? != 0 ]; then exit 1; fi
43echo "p -> n"
44$cmd -in f.p -inform p -outform n >ff.n3
45if [ $? != 0 ]; then exit 1; fi
46
47echo "d -> p"
48$cmd -in f.d -inform d -outform p >ff.p1
49if [ $? != 0 ]; then exit 1; fi
50echo "n -> p"
51$cmd -in f.n -inform n -outform p >ff.p2
52if [ $? != 0 ]; then exit 1; fi
53echo "p -> p"
54$cmd -in f.p -inform p -outform p >ff.p3
55if [ $? != 0 ]; then exit 1; fi
56
57cmp fff.p f.p
58if [ $? != 0 ]; then exit 1; fi
59cmp fff.p ff.p1
60if [ $? != 0 ]; then exit 1; fi
61cmp fff.p ff.p2
62if [ $? != 0 ]; then exit 1; fi
63cmp fff.p ff.p3
64if [ $? != 0 ]; then exit 1; fi
65
66cmp f.n ff.n1
67if [ $? != 0 ]; then exit 1; fi
68cmp f.n ff.n2
69if [ $? != 0 ]; then exit 1; fi
70cmp f.n ff.n3
71if [ $? != 0 ]; then exit 1; fi
72
73cmp f.p ff.p1
74if [ $? != 0 ]; then exit 1; fi
75cmp f.p ff.p2
76if [ $? != 0 ]; then exit 1; fi
77cmp f.p ff.p3
78if [ $? != 0 ]; then exit 1; fi
79
80/bin/rm -f f.* ff.* fff.*
81exit 0
diff --git a/src/lib/libssl/test/v3-cert1.pem b/src/lib/libssl/test/v3-cert1.pem
deleted file mode 100644
index 0da253d5c3..0000000000
--- a/src/lib/libssl/test/v3-cert1.pem
+++ /dev/null
@@ -1,16 +0,0 @@
1-----BEGIN CERTIFICATE-----
2MIICjTCCAfigAwIBAgIEMaYgRzALBgkqhkiG9w0BAQQwRTELMAkGA1UEBhMCVVMx
3NjA0BgNVBAoTLU5hdGlvbmFsIEFlcm9uYXV0aWNzIGFuZCBTcGFjZSBBZG1pbmlz
4dHJhdGlvbjAmFxE5NjA1MjgxMzQ5MDUrMDgwMBcROTgwNTI4MTM0OTA1KzA4MDAw
5ZzELMAkGA1UEBhMCVVMxNjA0BgNVBAoTLU5hdGlvbmFsIEFlcm9uYXV0aWNzIGFu
6ZCBTcGFjZSBBZG1pbmlzdHJhdGlvbjEgMAkGA1UEBRMCMTYwEwYDVQQDEwxTdGV2
7ZSBTY2hvY2gwWDALBgkqhkiG9w0BAQEDSQAwRgJBALrAwyYdgxmzNP/ts0Uyf6Bp
8miJYktU/w4NG67ULaN4B5CnEz7k57s9o3YY3LecETgQ5iQHmkwlYDTL2fTgVfw0C
9AQOjgaswgagwZAYDVR0ZAQH/BFowWDBWMFQxCzAJBgNVBAYTAlVTMTYwNAYDVQQK
10Ey1OYXRpb25hbCBBZXJvbmF1dGljcyBhbmQgU3BhY2UgQWRtaW5pc3RyYXRpb24x
11DTALBgNVBAMTBENSTDEwFwYDVR0BAQH/BA0wC4AJODMyOTcwODEwMBgGA1UdAgQR
12MA8ECTgzMjk3MDgyM4ACBSAwDQYDVR0KBAYwBAMCBkAwCwYJKoZIhvcNAQEEA4GB
13AH2y1VCEw/A4zaXzSYZJTTUi3uawbbFiS2yxHvgf28+8Js0OHXk1H1w2d6qOHH21
14X82tZXd/0JtG0g1T9usFFBDvYK8O0ebgz/P5ELJnBL2+atObEuJy1ZZ0pBDWINR3
15WkDNLCGiTkCKp0F5EWIrVDwh54NNevkCQRZita+z4IBO
16-----END CERTIFICATE-----
diff --git a/src/lib/libssl/test/v3-cert2.pem b/src/lib/libssl/test/v3-cert2.pem
deleted file mode 100644
index de0723ff8d..0000000000
--- a/src/lib/libssl/test/v3-cert2.pem
+++ /dev/null
@@ -1,16 +0,0 @@
1-----BEGIN CERTIFICATE-----
2MIICiTCCAfKgAwIBAgIEMeZfHzANBgkqhkiG9w0BAQQFADB9MQswCQYDVQQGEwJD
3YTEPMA0GA1UEBxMGTmVwZWFuMR4wHAYDVQQLExVObyBMaWFiaWxpdHkgQWNjZXB0
4ZWQxHzAdBgNVBAoTFkZvciBEZW1vIFB1cnBvc2VzIE9ubHkxHDAaBgNVBAMTE0Vu
5dHJ1c3QgRGVtbyBXZWIgQ0EwHhcNOTYwNzEyMTQyMDE1WhcNOTYxMDEyMTQyMDE1
6WjB0MSQwIgYJKoZIhvcNAQkBExVjb29rZUBpc3NsLmF0bC5ocC5jb20xCzAJBgNV
7BAYTAlVTMScwJQYDVQQLEx5IZXdsZXR0IFBhY2thcmQgQ29tcGFueSAoSVNTTCkx
8FjAUBgNVBAMTDVBhdWwgQS4gQ29va2UwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA
96ceSq9a9AU6g+zBwaL/yVmW1/9EE8s5you1mgjHnj0wAILuoB3L6rm6jmFRy7QZT
10G43IhVZdDua4e+5/n1ZslwIDAQABo2MwYTARBglghkgBhvhCAQEEBAMCB4AwTAYJ
11YIZIAYb4QgENBD8WPVRoaXMgY2VydGlmaWNhdGUgaXMgb25seSBpbnRlbmRlZCBm
12b3IgZGVtb25zdHJhdGlvbiBwdXJwb3Nlcy4wDQYJKoZIhvcNAQEEBQADgYEAi8qc
13F3zfFqy1sV8NhjwLVwOKuSfhR/Z8mbIEUeSTlnH3QbYt3HWZQ+vXI8mvtZoBc2Fz
14lexKeIkAZXCesqGbs6z6nCt16P6tmdfbZF3I3AWzLquPcOXjPf4HgstkyvVBn0Ap
15jAFN418KF/Cx4qyHB4cjdvLrRjjQLnb2+ibo7QU=
16-----END CERTIFICATE-----
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
deleted file mode 100644
index a931efa936..0000000000
--- a/src/lib/libssl/tls1.h
+++ /dev/null
@@ -1,153 +0,0 @@
1/* ssl/tls1.h */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#ifndef HEADER_TLS1_H
60#define HEADER_TLS1_H
61
62#include <openssl/buffer.h>
63
64#ifdef __cplusplus
65extern "C" {
66#endif
67
68#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0
69
70#define TLS1_VERSION 0x0301
71#define TLS1_VERSION_MAJOR 0x03
72#define TLS1_VERSION_MINOR 0x01
73
74#define TLS1_AD_DECRYPTION_FAILED 21
75#define TLS1_AD_RECORD_OVERFLOW 22
76#define TLS1_AD_UNKNOWN_CA 48 /* fatal */
77#define TLS1_AD_ACCESS_DENIED 49 /* fatal */
78#define TLS1_AD_DECODE_ERROR 50 /* fatal */
79#define TLS1_AD_DECRYPT_ERROR 51
80#define TLS1_AD_EXPORT_RESTRICION 60 /* fatal */
81#define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */
82#define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */
83#define TLS1_AD_INTERNAL_ERROR 80 /* fatal */
84#define TLS1_AD_USER_CANCLED 90
85#define TLS1_AD_NO_RENEGOTIATION 100
86
87#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 0x03000060
88#define TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 0x03000061
89#define TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x03000062
90#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x03000063
91#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA 0x03000064
92#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065
93#define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066
94
95#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 "EXP1024-RC4-MD5"
96#define TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 "EXP1024-RC2-CBC-MD5"
97#define TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DES-CBC-SHA"
98#define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DHE-DSS-DES-CBC-SHA"
99#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA "EXP1024-RC4-SHA"
100#define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA "EXP1024-DHE-DSS-RC4-SHA"
101#define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA "DHE-DSS-RC4-SHA"
102
103
104#define TLS_CT_RSA_SIGN 1
105#define TLS_CT_DSS_SIGN 2
106#define TLS_CT_RSA_FIXED_DH 3
107#define TLS_CT_DSS_FIXED_DH 4
108#define TLS_CT_NUMBER 4
109
110#define TLS1_FINISH_MAC_LENGTH 12
111
112#define TLS_MD_MAX_CONST_SIZE 20
113#define TLS_MD_CLIENT_FINISH_CONST "client finished"
114#define TLS_MD_CLIENT_FINISH_CONST_SIZE 15
115#define TLS_MD_SERVER_FINISH_CONST "server finished"
116#define TLS_MD_SERVER_FINISH_CONST_SIZE 15
117#define TLS_MD_SERVER_WRITE_KEY_CONST "server write key"
118#define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16
119#define TLS_MD_KEY_EXPANSION_CONST "key expansion"
120#define TLS_MD_KEY_EXPANSION_CONST_SIZE 13
121#define TLS_MD_CLIENT_WRITE_KEY_CONST "client write key"
122#define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16
123#define TLS_MD_SERVER_WRITE_KEY_CONST "server write key"
124#define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16
125#define TLS_MD_IV_BLOCK_CONST "IV block"
126#define TLS_MD_IV_BLOCK_CONST_SIZE 8
127#define TLS_MD_MASTER_SECRET_CONST "master secret"
128#define TLS_MD_MASTER_SECRET_CONST_SIZE 13
129
130#ifdef CHARSET_EBCDIC
131#undef TLS_MD_CLIENT_FINISH_CONST
132#define TLS_MD_CLIENT_FINISH_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x66\x69\x6e\x69\x73\x68\x65\x64" /*client finished*/
133#undef TLS_MD_SERVER_FINISH_CONST
134#define TLS_MD_SERVER_FINISH_CONST "\x73\x65\x72\x76\x65\x72\x20\x66\x69\x6e\x69\x73\x68\x65\x64" /*server finished*/
135#undef TLS_MD_SERVER_WRITE_KEY_CONST
136#define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" /*server write key*/
137#undef TLS_MD_KEY_EXPANSION_CONST
138#define TLS_MD_KEY_EXPANSION_CONST "\x6b\x65\x79\x20\x65\x78\x70\x61\x6e\x73\x69\x6f\x6e" /*key expansion*/
139#undef TLS_MD_CLIENT_WRITE_KEY_CONST
140#define TLS_MD_CLIENT_WRITE_KEY_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" /*client write key*/
141#undef TLS_MD_SERVER_WRITE_KEY_CONST
142#define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" /*server write key*/
143#undef TLS_MD_IV_BLOCK_CONST
144#define TLS_MD_IV_BLOCK_CONST "\x49\x56\x20\x62\x6c\x6f\x63\x6b" /*IV block*/
145#undef TLS_MD_MASTER_SECRET_CONST
146#define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/
147#endif
148
149#ifdef __cplusplus
150}
151#endif
152#endif
153
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-17 07:43:26 +0000