diff options
Diffstat (limited to 'src/lib/libssl')
73 files changed, 0 insertions, 23237 deletions
diff --git a/src/lib/libssl/LICENSE b/src/lib/libssl/LICENSE deleted file mode 100644 index 3fd259ac32..0000000000 --- a/src/lib/libssl/LICENSE +++ /dev/null | |||
| @@ -1,127 +0,0 @@ | |||
| 1 | |||
| 2 | LICENSE ISSUES | ||
| 3 | ============== | ||
| 4 | |||
| 5 | The OpenSSL toolkit stays under a dual license, i.e. both the conditions of | ||
| 6 | the OpenSSL License and the original SSLeay license apply to the toolkit. | ||
| 7 | See below for the actual license texts. Actually both licenses are BSD-style | ||
| 8 | Open Source licenses. In case of any license issues related to OpenSSL | ||
| 9 | please contact openssl-core@openssl.org. | ||
| 10 | |||
| 11 | OpenSSL License | ||
| 12 | --------------- | ||
| 13 | |||
| 14 | /* ==================================================================== | ||
| 15 | * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. | ||
| 16 | * | ||
| 17 | * Redistribution and use in source and binary forms, with or without | ||
| 18 | * modification, are permitted provided that the following conditions | ||
| 19 | * are met: | ||
| 20 | * | ||
| 21 | * 1. Redistributions of source code must retain the above copyright | ||
| 22 | * notice, this list of conditions and the following disclaimer. | ||
| 23 | * | ||
| 24 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 25 | * notice, this list of conditions and the following disclaimer in | ||
| 26 | * the documentation and/or other materials provided with the | ||
| 27 | * distribution. | ||
| 28 | * | ||
| 29 | * 3. All advertising materials mentioning features or use of this | ||
| 30 | * software must display the following acknowledgment: | ||
| 31 | * "This product includes software developed by the OpenSSL Project | ||
| 32 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" | ||
| 33 | * | ||
| 34 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 35 | * endorse or promote products derived from this software without | ||
| 36 | * prior written permission. For written permission, please contact | ||
| 37 | * openssl-core@openssl.org. | ||
| 38 | * | ||
| 39 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 40 | * nor may "OpenSSL" appear in their names without prior written | ||
| 41 | * permission of the OpenSSL Project. | ||
| 42 | * | ||
| 43 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 44 | * acknowledgment: | ||
| 45 | * "This product includes software developed by the OpenSSL Project | ||
| 46 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" | ||
| 47 | * | ||
| 48 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 49 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 51 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 52 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 53 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 54 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 55 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 56 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 57 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 58 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 59 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 60 | * ==================================================================== | ||
| 61 | * | ||
| 62 | * This product includes cryptographic software written by Eric Young | ||
| 63 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
| 64 | * Hudson (tjh@cryptsoft.com). | ||
| 65 | * | ||
| 66 | */ | ||
| 67 | |||
| 68 | Original SSLeay License | ||
| 69 | ----------------------- | ||
| 70 | |||
| 71 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 72 | * All rights reserved. | ||
| 73 | * | ||
| 74 | * This package is an SSL implementation written | ||
| 75 | * by Eric Young (eay@cryptsoft.com). | ||
| 76 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 77 | * | ||
| 78 | * This library is free for commercial and non-commercial use as long as | ||
| 79 | * the following conditions are aheared to. The following conditions | ||
| 80 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 81 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 82 | * included with this distribution is covered by the same copyright terms | ||
| 83 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 84 | * | ||
| 85 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 86 | * the code are not to be removed. | ||
| 87 | * If this package is used in a product, Eric Young should be given attribution | ||
| 88 | * as the author of the parts of the library used. | ||
| 89 | * This can be in the form of a textual message at program startup or | ||
| 90 | * in documentation (online or textual) provided with the package. | ||
| 91 | * | ||
| 92 | * Redistribution and use in source and binary forms, with or without | ||
| 93 | * modification, are permitted provided that the following conditions | ||
| 94 | * are met: | ||
| 95 | * 1. Redistributions of source code must retain the copyright | ||
| 96 | * notice, this list of conditions and the following disclaimer. | ||
| 97 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 98 | * notice, this list of conditions and the following disclaimer in the | ||
| 99 | * documentation and/or other materials provided with the distribution. | ||
| 100 | * 3. All advertising materials mentioning features or use of this software | ||
| 101 | * must display the following acknowledgement: | ||
| 102 | * "This product includes cryptographic software written by | ||
| 103 | * Eric Young (eay@cryptsoft.com)" | ||
| 104 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 105 | * being used are not cryptographic related :-). | ||
| 106 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 107 | * the apps directory (application code) you must include an acknowledgement: | ||
| 108 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 109 | * | ||
| 110 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 111 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 112 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 113 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 114 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 115 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 116 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 117 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 118 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 119 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 120 | * SUCH DAMAGE. | ||
| 121 | * | ||
| 122 | * The licence and distribution terms for any publically available version or | ||
| 123 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 124 | * copied and put under another distribution licence | ||
| 125 | * [including the GNU Public Licence.] | ||
| 126 | */ | ||
| 127 | |||
diff --git a/src/lib/libssl/bio_ssl.c b/src/lib/libssl/bio_ssl.c deleted file mode 100644 index d85555a7e6..0000000000 --- a/src/lib/libssl/bio_ssl.c +++ /dev/null | |||
| @@ -1,586 +0,0 @@ | |||
| 1 | /* ssl/bio_ssl.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <stdlib.h> | ||
| 61 | #include <string.h> | ||
| 62 | #include <errno.h> | ||
| 63 | #include <openssl/crypto.h> | ||
| 64 | #include <openssl/bio.h> | ||
| 65 | #include <openssl/err.h> | ||
| 66 | #include <openssl/ssl.h> | ||
| 67 | |||
| 68 | static int ssl_write(BIO *h, const char *buf, int num); | ||
| 69 | static int ssl_read(BIO *h, char *buf, int size); | ||
| 70 | static int ssl_puts(BIO *h, const char *str); | ||
| 71 | static long ssl_ctrl(BIO *h, int cmd, long arg1, void *arg2); | ||
| 72 | static int ssl_new(BIO *h); | ||
| 73 | static int ssl_free(BIO *data); | ||
| 74 | static long ssl_callback_ctrl(BIO *h, int cmd, bio_info_cb *fp); | ||
| 75 | typedef struct bio_ssl_st | ||
| 76 | { | ||
| 77 | SSL *ssl; /* The ssl handle :-) */ | ||
| 78 | /* re-negotiate every time the total number of bytes is this size */ | ||
| 79 | int num_renegotiates; | ||
| 80 | unsigned long renegotiate_count; | ||
| 81 | unsigned long byte_count; | ||
| 82 | unsigned long renegotiate_timeout; | ||
| 83 | unsigned long last_time; | ||
| 84 | } BIO_SSL; | ||
| 85 | |||
| 86 | static BIO_METHOD methods_sslp= | ||
| 87 | { | ||
| 88 | BIO_TYPE_SSL,"ssl", | ||
| 89 | ssl_write, | ||
| 90 | ssl_read, | ||
| 91 | ssl_puts, | ||
| 92 | NULL, /* ssl_gets, */ | ||
| 93 | ssl_ctrl, | ||
| 94 | ssl_new, | ||
| 95 | ssl_free, | ||
| 96 | ssl_callback_ctrl, | ||
| 97 | }; | ||
| 98 | |||
| 99 | BIO_METHOD *BIO_f_ssl(void) | ||
| 100 | { | ||
| 101 | return(&methods_sslp); | ||
| 102 | } | ||
| 103 | |||
| 104 | static int ssl_new(BIO *bi) | ||
| 105 | { | ||
| 106 | BIO_SSL *bs; | ||
| 107 | |||
| 108 | bs=(BIO_SSL *)OPENSSL_malloc(sizeof(BIO_SSL)); | ||
| 109 | if (bs == NULL) | ||
| 110 | { | ||
| 111 | BIOerr(BIO_F_SSL_NEW,ERR_R_MALLOC_FAILURE); | ||
| 112 | return(0); | ||
| 113 | } | ||
| 114 | memset(bs,0,sizeof(BIO_SSL)); | ||
| 115 | bi->init=0; | ||
| 116 | bi->ptr=(char *)bs; | ||
| 117 | bi->flags=0; | ||
| 118 | return(1); | ||
| 119 | } | ||
| 120 | |||
| 121 | static int ssl_free(BIO *a) | ||
| 122 | { | ||
| 123 | BIO_SSL *bs; | ||
| 124 | |||
| 125 | if (a == NULL) return(0); | ||
| 126 | bs=(BIO_SSL *)a->ptr; | ||
| 127 | if (bs->ssl != NULL) SSL_shutdown(bs->ssl); | ||
| 128 | if (a->shutdown) | ||
| 129 | { | ||
| 130 | if (a->init && (bs->ssl != NULL)) | ||
| 131 | SSL_free(bs->ssl); | ||
| 132 | a->init=0; | ||
| 133 | a->flags=0; | ||
| 134 | } | ||
| 135 | if (a->ptr != NULL) | ||
| 136 | OPENSSL_free(a->ptr); | ||
| 137 | return(1); | ||
| 138 | } | ||
| 139 | |||
| 140 | static int ssl_read(BIO *b, char *out, int outl) | ||
| 141 | { | ||
| 142 | int ret=1; | ||
| 143 | BIO_SSL *sb; | ||
| 144 | SSL *ssl; | ||
| 145 | int retry_reason=0; | ||
| 146 | int r=0; | ||
| 147 | |||
| 148 | if (out == NULL) return(0); | ||
| 149 | sb=(BIO_SSL *)b->ptr; | ||
| 150 | ssl=sb->ssl; | ||
| 151 | |||
| 152 | BIO_clear_retry_flags(b); | ||
| 153 | |||
| 154 | #if 0 | ||
| 155 | if (!SSL_is_init_finished(ssl)) | ||
| 156 | { | ||
| 157 | /* ret=SSL_do_handshake(ssl); */ | ||
| 158 | if (ret > 0) | ||
| 159 | { | ||
| 160 | |||
| 161 | outflags=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY); | ||
| 162 | ret= -1; | ||
| 163 | goto end; | ||
| 164 | } | ||
| 165 | } | ||
| 166 | #endif | ||
| 167 | /* if (ret > 0) */ | ||
| 168 | ret=SSL_read(ssl,out,outl); | ||
| 169 | |||
| 170 | switch (SSL_get_error(ssl,ret)) | ||
| 171 | { | ||
| 172 | case SSL_ERROR_NONE: | ||
| 173 | if (ret <= 0) break; | ||
| 174 | if (sb->renegotiate_count > 0) | ||
| 175 | { | ||
| 176 | sb->byte_count+=ret; | ||
| 177 | if (sb->byte_count > sb->renegotiate_count) | ||
| 178 | { | ||
| 179 | sb->byte_count=0; | ||
| 180 | sb->num_renegotiates++; | ||
| 181 | SSL_renegotiate(ssl); | ||
| 182 | r=1; | ||
| 183 | } | ||
| 184 | } | ||
| 185 | if ((sb->renegotiate_timeout > 0) && (!r)) | ||
| 186 | { | ||
| 187 | unsigned long tm; | ||
| 188 | |||
| 189 | tm=(unsigned long)time(NULL); | ||
| 190 | if (tm > sb->last_time+sb->renegotiate_timeout) | ||
| 191 | { | ||
| 192 | sb->last_time=tm; | ||
| 193 | sb->num_renegotiates++; | ||
| 194 | SSL_renegotiate(ssl); | ||
| 195 | } | ||
| 196 | } | ||
| 197 | |||
| 198 | break; | ||
| 199 | case SSL_ERROR_WANT_READ: | ||
| 200 | BIO_set_retry_read(b); | ||
| 201 | break; | ||
| 202 | case SSL_ERROR_WANT_WRITE: | ||
| 203 | BIO_set_retry_write(b); | ||
| 204 | break; | ||
| 205 | case SSL_ERROR_WANT_X509_LOOKUP: | ||
| 206 | BIO_set_retry_special(b); | ||
| 207 | retry_reason=BIO_RR_SSL_X509_LOOKUP; | ||
| 208 | break; | ||
| 209 | case SSL_ERROR_WANT_CONNECT: | ||
| 210 | BIO_set_retry_special(b); | ||
| 211 | retry_reason=BIO_RR_CONNECT; | ||
| 212 | break; | ||
| 213 | case SSL_ERROR_SYSCALL: | ||
| 214 | case SSL_ERROR_SSL: | ||
| 215 | case SSL_ERROR_ZERO_RETURN: | ||
| 216 | default: | ||
| 217 | break; | ||
| 218 | } | ||
| 219 | |||
| 220 | b->retry_reason=retry_reason; | ||
| 221 | return(ret); | ||
| 222 | } | ||
| 223 | |||
| 224 | static int ssl_write(BIO *b, const char *out, int outl) | ||
| 225 | { | ||
| 226 | int ret,r=0; | ||
| 227 | int retry_reason=0; | ||
| 228 | SSL *ssl; | ||
| 229 | BIO_SSL *bs; | ||
| 230 | |||
| 231 | if (out == NULL) return(0); | ||
| 232 | bs=(BIO_SSL *)b->ptr; | ||
| 233 | ssl=bs->ssl; | ||
| 234 | |||
| 235 | BIO_clear_retry_flags(b); | ||
| 236 | |||
| 237 | /* ret=SSL_do_handshake(ssl); | ||
| 238 | if (ret > 0) */ | ||
| 239 | ret=SSL_write(ssl,out,outl); | ||
| 240 | |||
| 241 | switch (SSL_get_error(ssl,ret)) | ||
| 242 | { | ||
| 243 | case SSL_ERROR_NONE: | ||
| 244 | if (ret <= 0) break; | ||
| 245 | if (bs->renegotiate_count > 0) | ||
| 246 | { | ||
| 247 | bs->byte_count+=ret; | ||
| 248 | if (bs->byte_count > bs->renegotiate_count) | ||
| 249 | { | ||
| 250 | bs->byte_count=0; | ||
| 251 | bs->num_renegotiates++; | ||
| 252 | SSL_renegotiate(ssl); | ||
| 253 | r=1; | ||
| 254 | } | ||
| 255 | } | ||
| 256 | if ((bs->renegotiate_timeout > 0) && (!r)) | ||
| 257 | { | ||
| 258 | unsigned long tm; | ||
| 259 | |||
| 260 | tm=(unsigned long)time(NULL); | ||
| 261 | if (tm > bs->last_time+bs->renegotiate_timeout) | ||
| 262 | { | ||
| 263 | bs->last_time=tm; | ||
| 264 | bs->num_renegotiates++; | ||
| 265 | SSL_renegotiate(ssl); | ||
| 266 | } | ||
| 267 | } | ||
| 268 | break; | ||
| 269 | case SSL_ERROR_WANT_WRITE: | ||
| 270 | BIO_set_retry_write(b); | ||
| 271 | break; | ||
| 272 | case SSL_ERROR_WANT_READ: | ||
| 273 | BIO_set_retry_read(b); | ||
| 274 | break; | ||
| 275 | case SSL_ERROR_WANT_X509_LOOKUP: | ||
| 276 | BIO_set_retry_special(b); | ||
| 277 | retry_reason=BIO_RR_SSL_X509_LOOKUP; | ||
| 278 | break; | ||
| 279 | case SSL_ERROR_WANT_CONNECT: | ||
| 280 | BIO_set_retry_special(b); | ||
| 281 | retry_reason=BIO_RR_CONNECT; | ||
| 282 | case SSL_ERROR_SYSCALL: | ||
| 283 | case SSL_ERROR_SSL: | ||
| 284 | default: | ||
| 285 | break; | ||
| 286 | } | ||
| 287 | |||
| 288 | b->retry_reason=retry_reason; | ||
| 289 | return(ret); | ||
| 290 | } | ||
| 291 | |||
| 292 | static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr) | ||
| 293 | { | ||
| 294 | SSL **sslp,*ssl; | ||
| 295 | BIO_SSL *bs; | ||
| 296 | BIO *dbio,*bio; | ||
| 297 | long ret=1; | ||
| 298 | |||
| 299 | bs=(BIO_SSL *)b->ptr; | ||
| 300 | ssl=bs->ssl; | ||
| 301 | if ((ssl == NULL) && (cmd != BIO_C_SET_SSL)) | ||
| 302 | return(0); | ||
| 303 | switch (cmd) | ||
| 304 | { | ||
| 305 | case BIO_CTRL_RESET: | ||
| 306 | SSL_shutdown(ssl); | ||
| 307 | |||
| 308 | if (ssl->handshake_func == ssl->method->ssl_connect) | ||
| 309 | SSL_set_connect_state(ssl); | ||
| 310 | else if (ssl->handshake_func == ssl->method->ssl_accept) | ||
| 311 | SSL_set_accept_state(ssl); | ||
| 312 | |||
| 313 | SSL_clear(ssl); | ||
| 314 | |||
| 315 | if (b->next_bio != NULL) | ||
| 316 | ret=BIO_ctrl(b->next_bio,cmd,num,ptr); | ||
| 317 | else if (ssl->rbio != NULL) | ||
| 318 | ret=BIO_ctrl(ssl->rbio,cmd,num,ptr); | ||
| 319 | else | ||
| 320 | ret=1; | ||
| 321 | break; | ||
| 322 | case BIO_CTRL_INFO: | ||
| 323 | ret=0; | ||
| 324 | break; | ||
| 325 | case BIO_C_SSL_MODE: | ||
| 326 | if (num) /* client mode */ | ||
| 327 | SSL_set_connect_state(ssl); | ||
| 328 | else | ||
| 329 | SSL_set_accept_state(ssl); | ||
| 330 | break; | ||
| 331 | case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT: | ||
| 332 | ret=bs->renegotiate_timeout; | ||
| 333 | if (num < 60) num=5; | ||
| 334 | bs->renegotiate_timeout=(unsigned long)num; | ||
| 335 | bs->last_time=(unsigned long)time(NULL); | ||
| 336 | break; | ||
| 337 | case BIO_C_SET_SSL_RENEGOTIATE_BYTES: | ||
| 338 | ret=bs->renegotiate_count; | ||
| 339 | if ((long)num >=512) | ||
| 340 | bs->renegotiate_count=(unsigned long)num; | ||
| 341 | break; | ||
| 342 | case BIO_C_GET_SSL_NUM_RENEGOTIATES: | ||
| 343 | ret=bs->num_renegotiates; | ||
| 344 | break; | ||
| 345 | case BIO_C_SET_SSL: | ||
| 346 | if (ssl != NULL) | ||
| 347 | ssl_free(b); | ||
| 348 | b->shutdown=(int)num; | ||
| 349 | ssl=(SSL *)ptr; | ||
| 350 | ((BIO_SSL *)b->ptr)->ssl=ssl; | ||
| 351 | bio=SSL_get_rbio(ssl); | ||
| 352 | if (bio != NULL) | ||
| 353 | { | ||
| 354 | if (b->next_bio != NULL) | ||
| 355 | BIO_push(bio,b->next_bio); | ||
| 356 | b->next_bio=bio; | ||
| 357 | CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO); | ||
| 358 | } | ||
| 359 | b->init=1; | ||
| 360 | break; | ||
| 361 | case BIO_C_GET_SSL: | ||
| 362 | if (ptr != NULL) | ||
| 363 | { | ||
| 364 | sslp=(SSL **)ptr; | ||
| 365 | *sslp=ssl; | ||
| 366 | } | ||
| 367 | else | ||
| 368 | ret=0; | ||
| 369 | break; | ||
| 370 | case BIO_CTRL_GET_CLOSE: | ||
| 371 | ret=b->shutdown; | ||
| 372 | break; | ||
| 373 | case BIO_CTRL_SET_CLOSE: | ||
| 374 | b->shutdown=(int)num; | ||
| 375 | break; | ||
| 376 | case BIO_CTRL_WPENDING: | ||
| 377 | ret=BIO_ctrl(ssl->wbio,cmd,num,ptr); | ||
| 378 | break; | ||
| 379 | case BIO_CTRL_PENDING: | ||
| 380 | ret=SSL_pending(ssl); | ||
| 381 | if (ret == 0) | ||
| 382 | ret=BIO_pending(ssl->rbio); | ||
| 383 | break; | ||
| 384 | case BIO_CTRL_FLUSH: | ||
| 385 | BIO_clear_retry_flags(b); | ||
| 386 | ret=BIO_ctrl(ssl->wbio,cmd,num,ptr); | ||
| 387 | BIO_copy_next_retry(b); | ||
| 388 | break; | ||
| 389 | case BIO_CTRL_PUSH: | ||
| 390 | if ((b->next_bio != NULL) && (b->next_bio != ssl->rbio)) | ||
| 391 | { | ||
| 392 | SSL_set_bio(ssl,b->next_bio,b->next_bio); | ||
| 393 | CRYPTO_add(&b->next_bio->references,1,CRYPTO_LOCK_BIO); | ||
| 394 | } | ||
| 395 | break; | ||
| 396 | case BIO_CTRL_POP: | ||
| 397 | /* ugly bit of a hack */ | ||
| 398 | if (ssl->rbio != ssl->wbio) /* we are in trouble :-( */ | ||
| 399 | { | ||
| 400 | BIO_free_all(ssl->wbio); | ||
| 401 | } | ||
| 402 | ssl->wbio=NULL; | ||
| 403 | ssl->rbio=NULL; | ||
| 404 | break; | ||
| 405 | case BIO_C_DO_STATE_MACHINE: | ||
| 406 | BIO_clear_retry_flags(b); | ||
| 407 | |||
| 408 | b->retry_reason=0; | ||
| 409 | ret=(int)SSL_do_handshake(ssl); | ||
| 410 | |||
| 411 | switch (SSL_get_error(ssl,(int)ret)) | ||
| 412 | { | ||
| 413 | case SSL_ERROR_WANT_READ: | ||
| 414 | BIO_set_flags(b, | ||
| 415 | BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY); | ||
| 416 | break; | ||
| 417 | case SSL_ERROR_WANT_WRITE: | ||
| 418 | BIO_set_flags(b, | ||
| 419 | BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY); | ||
| 420 | break; | ||
| 421 | case SSL_ERROR_WANT_CONNECT: | ||
| 422 | BIO_set_flags(b, | ||
| 423 | BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY); | ||
| 424 | b->retry_reason=b->next_bio->retry_reason; | ||
| 425 | break; | ||
| 426 | default: | ||
| 427 | break; | ||
| 428 | } | ||
| 429 | break; | ||
| 430 | case BIO_CTRL_DUP: | ||
| 431 | dbio=(BIO *)ptr; | ||
| 432 | if (((BIO_SSL *)dbio->ptr)->ssl != NULL) | ||
| 433 | SSL_free(((BIO_SSL *)dbio->ptr)->ssl); | ||
| 434 | ((BIO_SSL *)dbio->ptr)->ssl=SSL_dup(ssl); | ||
| 435 | ((BIO_SSL *)dbio->ptr)->renegotiate_count= | ||
| 436 | ((BIO_SSL *)b->ptr)->renegotiate_count; | ||
| 437 | ((BIO_SSL *)dbio->ptr)->byte_count= | ||
| 438 | ((BIO_SSL *)b->ptr)->byte_count; | ||
| 439 | ((BIO_SSL *)dbio->ptr)->renegotiate_timeout= | ||
| 440 | ((BIO_SSL *)b->ptr)->renegotiate_timeout; | ||
| 441 | ((BIO_SSL *)dbio->ptr)->last_time= | ||
| 442 | ((BIO_SSL *)b->ptr)->last_time; | ||
| 443 | ret=(((BIO_SSL *)dbio->ptr)->ssl != NULL); | ||
| 444 | break; | ||
| 445 | case BIO_C_GET_FD: | ||
| 446 | ret=BIO_ctrl(ssl->rbio,cmd,num,ptr); | ||
| 447 | break; | ||
| 448 | case BIO_CTRL_SET_CALLBACK: | ||
| 449 | { | ||
| 450 | #if 0 /* FIXME: Should this be used? -- Richard Levitte */ | ||
| 451 | BIOerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 452 | ret = -1; | ||
| 453 | #else | ||
| 454 | ret=0; | ||
| 455 | #endif | ||
| 456 | } | ||
| 457 | break; | ||
| 458 | case BIO_CTRL_GET_CALLBACK: | ||
| 459 | { | ||
| 460 | void (**fptr)(); | ||
| 461 | |||
| 462 | fptr=(void (**)())ptr; | ||
| 463 | *fptr=SSL_get_info_callback(ssl); | ||
| 464 | } | ||
| 465 | break; | ||
| 466 | default: | ||
| 467 | ret=BIO_ctrl(ssl->rbio,cmd,num,ptr); | ||
| 468 | break; | ||
| 469 | } | ||
| 470 | return(ret); | ||
| 471 | } | ||
| 472 | |||
| 473 | static long ssl_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp) | ||
| 474 | { | ||
| 475 | SSL *ssl; | ||
| 476 | BIO_SSL *bs; | ||
| 477 | long ret=1; | ||
| 478 | |||
| 479 | bs=(BIO_SSL *)b->ptr; | ||
| 480 | ssl=bs->ssl; | ||
| 481 | switch (cmd) | ||
| 482 | { | ||
| 483 | case BIO_CTRL_SET_CALLBACK: | ||
| 484 | { | ||
| 485 | SSL_set_info_callback(ssl,fp); | ||
| 486 | } | ||
| 487 | break; | ||
| 488 | default: | ||
| 489 | ret=BIO_callback_ctrl(ssl->rbio,cmd,fp); | ||
| 490 | break; | ||
| 491 | } | ||
| 492 | return(ret); | ||
| 493 | } | ||
| 494 | |||
| 495 | static int ssl_puts(BIO *bp, const char *str) | ||
| 496 | { | ||
| 497 | int n,ret; | ||
| 498 | |||
| 499 | n=strlen(str); | ||
| 500 | ret=BIO_write(bp,str,n); | ||
| 501 | return(ret); | ||
| 502 | } | ||
| 503 | |||
| 504 | BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx) | ||
| 505 | { | ||
| 506 | BIO *ret=NULL,*buf=NULL,*ssl=NULL; | ||
| 507 | |||
| 508 | if ((buf=BIO_new(BIO_f_buffer())) == NULL) | ||
| 509 | return(NULL); | ||
| 510 | if ((ssl=BIO_new_ssl_connect(ctx)) == NULL) | ||
| 511 | goto err; | ||
| 512 | if ((ret=BIO_push(buf,ssl)) == NULL) | ||
| 513 | goto err; | ||
| 514 | return(ret); | ||
| 515 | err: | ||
| 516 | if (buf != NULL) BIO_free(buf); | ||
| 517 | if (ssl != NULL) BIO_free(ssl); | ||
| 518 | return(NULL); | ||
| 519 | } | ||
| 520 | |||
| 521 | BIO *BIO_new_ssl_connect(SSL_CTX *ctx) | ||
| 522 | { | ||
| 523 | BIO *ret=NULL,*con=NULL,*ssl=NULL; | ||
| 524 | |||
| 525 | if ((con=BIO_new(BIO_s_connect())) == NULL) | ||
| 526 | return(NULL); | ||
| 527 | if ((ssl=BIO_new_ssl(ctx,1)) == NULL) | ||
| 528 | goto err; | ||
| 529 | if ((ret=BIO_push(ssl,con)) == NULL) | ||
| 530 | goto err; | ||
| 531 | return(ret); | ||
| 532 | err: | ||
| 533 | if (con != NULL) BIO_free(con); | ||
| 534 | if (ret != NULL) BIO_free(ret); | ||
| 535 | return(NULL); | ||
| 536 | } | ||
| 537 | |||
| 538 | BIO *BIO_new_ssl(SSL_CTX *ctx, int client) | ||
| 539 | { | ||
| 540 | BIO *ret; | ||
| 541 | SSL *ssl; | ||
| 542 | |||
| 543 | if ((ret=BIO_new(BIO_f_ssl())) == NULL) | ||
| 544 | return(NULL); | ||
| 545 | if ((ssl=SSL_new(ctx)) == NULL) | ||
| 546 | { | ||
| 547 | BIO_free(ret); | ||
| 548 | return(NULL); | ||
| 549 | } | ||
| 550 | if (client) | ||
| 551 | SSL_set_connect_state(ssl); | ||
| 552 | else | ||
| 553 | SSL_set_accept_state(ssl); | ||
| 554 | |||
| 555 | BIO_set_ssl(ret,ssl,BIO_CLOSE); | ||
| 556 | return(ret); | ||
| 557 | } | ||
| 558 | |||
| 559 | int BIO_ssl_copy_session_id(BIO *t, BIO *f) | ||
| 560 | { | ||
| 561 | t=BIO_find_type(t,BIO_TYPE_SSL); | ||
| 562 | f=BIO_find_type(f,BIO_TYPE_SSL); | ||
| 563 | if ((t == NULL) || (f == NULL)) | ||
| 564 | return(0); | ||
| 565 | if ( (((BIO_SSL *)t->ptr)->ssl == NULL) || | ||
| 566 | (((BIO_SSL *)f->ptr)->ssl == NULL)) | ||
| 567 | return(0); | ||
| 568 | SSL_copy_session_id(((BIO_SSL *)t->ptr)->ssl,((BIO_SSL *)f->ptr)->ssl); | ||
| 569 | return(1); | ||
| 570 | } | ||
| 571 | |||
| 572 | void BIO_ssl_shutdown(BIO *b) | ||
| 573 | { | ||
| 574 | SSL *s; | ||
| 575 | |||
| 576 | while (b != NULL) | ||
| 577 | { | ||
| 578 | if (b->method->type == BIO_TYPE_SSL) | ||
| 579 | { | ||
| 580 | s=((BIO_SSL *)b->ptr)->ssl; | ||
| 581 | SSL_shutdown(s); | ||
| 582 | break; | ||
| 583 | } | ||
| 584 | b=b->next_bio; | ||
| 585 | } | ||
| 586 | } | ||
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf deleted file mode 100644 index dbe8cbefe0..0000000000 --- a/src/lib/libssl/doc/openssl.cnf +++ /dev/null | |||
| @@ -1,244 +0,0 @@ | |||
| 1 | # | ||
| 2 | # OpenSSL example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | |||
| 6 | # This definition stops the following lines choking if HOME isn't | ||
| 7 | # defined. | ||
| 8 | HOME = . | ||
| 9 | RANDFILE = $ENV::HOME/.rnd | ||
| 10 | |||
| 11 | # Extra OBJECT IDENTIFIER info: | ||
| 12 | #oid_file = $ENV::HOME/.oid | ||
| 13 | oid_section = new_oids | ||
| 14 | |||
| 15 | # To use this configuration file with the "-extfile" option of the | ||
| 16 | # "openssl x509" utility, name here the section containing the | ||
| 17 | # X.509v3 extensions to use: | ||
| 18 | # extensions = | ||
| 19 | # (Alternatively, use a configuration file that has only | ||
| 20 | # X.509v3 extensions in its main [= default] section.) | ||
| 21 | |||
| 22 | [ new_oids ] | ||
| 23 | |||
| 24 | # We can add new OIDs in here for use by 'ca' and 'req'. | ||
| 25 | # Add a simple OID like this: | ||
| 26 | # testoid1=1.2.3.4 | ||
| 27 | # Or use config file substitution like this: | ||
| 28 | # testoid2=${testoid1}.5.6 | ||
| 29 | |||
| 30 | #################################################################### | ||
| 31 | [ ca ] | ||
| 32 | default_ca = CA_default # The default ca section | ||
| 33 | |||
| 34 | #################################################################### | ||
| 35 | [ CA_default ] | ||
| 36 | |||
| 37 | dir = ./demoCA # Where everything is kept | ||
| 38 | certs = $dir/certs # Where the issued certs are kept | ||
| 39 | crl_dir = $dir/crl # Where the issued crl are kept | ||
| 40 | database = $dir/index.txt # database index file. | ||
| 41 | new_certs_dir = $dir/newcerts # default place for new certs. | ||
| 42 | |||
| 43 | certificate = $dir/cacert.pem # The CA certificate | ||
| 44 | serial = $dir/serial # The current serial number | ||
| 45 | crl = $dir/crl.pem # The current CRL | ||
| 46 | private_key = $dir/private/cakey.pem# The private key | ||
| 47 | RANDFILE = $dir/private/.rand # private random number file | ||
| 48 | |||
| 49 | x509_extensions = usr_cert # The extentions to add to the cert | ||
| 50 | |||
| 51 | # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs | ||
| 52 | # so this is commented out by default to leave a V1 CRL. | ||
| 53 | # crl_extensions = crl_ext | ||
| 54 | |||
| 55 | default_days = 365 # how long to certify for | ||
| 56 | default_crl_days= 30 # how long before next CRL | ||
| 57 | default_md = md5 # which md to use. | ||
| 58 | preserve = no # keep passed DN ordering | ||
| 59 | |||
| 60 | # A few difference way of specifying how similar the request should look | ||
| 61 | # For type CA, the listed attributes must be the same, and the optional | ||
| 62 | # and supplied fields are just that :-) | ||
| 63 | policy = policy_match | ||
| 64 | |||
| 65 | # For the CA policy | ||
| 66 | [ policy_match ] | ||
| 67 | countryName = match | ||
| 68 | stateOrProvinceName = match | ||
| 69 | organizationName = match | ||
| 70 | organizationalUnitName = optional | ||
| 71 | commonName = supplied | ||
| 72 | emailAddress = optional | ||
| 73 | |||
| 74 | # For the 'anything' policy | ||
| 75 | # At this point in time, you must list all acceptable 'object' | ||
| 76 | # types. | ||
| 77 | [ policy_anything ] | ||
| 78 | countryName = optional | ||
| 79 | stateOrProvinceName = optional | ||
| 80 | localityName = optional | ||
| 81 | organizationName = optional | ||
| 82 | organizationalUnitName = optional | ||
| 83 | commonName = supplied | ||
| 84 | emailAddress = optional | ||
| 85 | |||
| 86 | #################################################################### | ||
| 87 | [ req ] | ||
| 88 | default_bits = 1024 | ||
| 89 | default_keyfile = privkey.pem | ||
| 90 | distinguished_name = req_distinguished_name | ||
| 91 | attributes = req_attributes | ||
| 92 | x509_extensions = v3_ca # The extentions to add to the self signed cert | ||
| 93 | |||
| 94 | # Passwords for private keys if not present they will be prompted for | ||
| 95 | # input_password = secret | ||
| 96 | # output_password = secret | ||
| 97 | |||
| 98 | # This sets a mask for permitted string types. There are several options. | ||
| 99 | # default: PrintableString, T61String, BMPString. | ||
| 100 | # pkix : PrintableString, BMPString. | ||
| 101 | # utf8only: only UTF8Strings. | ||
| 102 | # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). | ||
| 103 | # MASK:XXXX a literal mask value. | ||
| 104 | # WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings | ||
| 105 | # so use this option with caution! | ||
| 106 | string_mask = nombstr | ||
| 107 | |||
| 108 | # req_extensions = v3_req # The extensions to add to a certificate request | ||
| 109 | |||
| 110 | [ req_distinguished_name ] | ||
| 111 | countryName = Country Name (2 letter code) | ||
| 112 | countryName_default = AU | ||
| 113 | countryName_min = 2 | ||
| 114 | countryName_max = 2 | ||
| 115 | |||
| 116 | stateOrProvinceName = State or Province Name (full name) | ||
| 117 | stateOrProvinceName_default = Some-State | ||
| 118 | |||
| 119 | localityName = Locality Name (eg, city) | ||
| 120 | |||
| 121 | 0.organizationName = Organization Name (eg, company) | ||
| 122 | 0.organizationName_default = Internet Widgits Pty Ltd | ||
| 123 | |||
| 124 | # we can do this but it is not needed normally :-) | ||
| 125 | #1.organizationName = Second Organization Name (eg, company) | ||
| 126 | #1.organizationName_default = World Wide Web Pty Ltd | ||
| 127 | |||
| 128 | organizationalUnitName = Organizational Unit Name (eg, section) | ||
| 129 | #organizationalUnitName_default = | ||
| 130 | |||
| 131 | commonName = Common Name (eg, YOUR name) | ||
| 132 | commonName_max = 64 | ||
| 133 | |||
| 134 | emailAddress = Email Address | ||
| 135 | emailAddress_max = 40 | ||
| 136 | |||
| 137 | # SET-ex3 = SET extension number 3 | ||
| 138 | |||
| 139 | [ req_attributes ] | ||
| 140 | challengePassword = A challenge password | ||
| 141 | challengePassword_min = 4 | ||
| 142 | challengePassword_max = 20 | ||
| 143 | |||
| 144 | unstructuredName = An optional company name | ||
| 145 | |||
| 146 | [ usr_cert ] | ||
| 147 | |||
| 148 | # These extensions are added when 'ca' signs a request. | ||
| 149 | |||
| 150 | # This goes against PKIX guidelines but some CAs do it and some software | ||
| 151 | # requires this to avoid interpreting an end user certificate as a CA. | ||
| 152 | |||
| 153 | basicConstraints=CA:FALSE | ||
| 154 | |||
| 155 | # Here are some examples of the usage of nsCertType. If it is omitted | ||
| 156 | # the certificate can be used for anything *except* object signing. | ||
| 157 | |||
| 158 | # This is OK for an SSL server. | ||
| 159 | # nsCertType = server | ||
| 160 | |||
| 161 | # For an object signing certificate this would be used. | ||
| 162 | # nsCertType = objsign | ||
| 163 | |||
| 164 | # For normal client use this is typical | ||
| 165 | # nsCertType = client, email | ||
| 166 | |||
| 167 | # and for everything including object signing: | ||
| 168 | # nsCertType = client, email, objsign | ||
| 169 | |||
| 170 | # This is typical in keyUsage for a client certificate. | ||
| 171 | # keyUsage = nonRepudiation, digitalSignature, keyEncipherment | ||
| 172 | |||
| 173 | # This will be displayed in Netscape's comment listbox. | ||
| 174 | nsComment = "OpenSSL Generated Certificate" | ||
| 175 | |||
| 176 | # PKIX recommendations harmless if included in all certificates. | ||
| 177 | subjectKeyIdentifier=hash | ||
| 178 | authorityKeyIdentifier=keyid,issuer:always | ||
| 179 | |||
| 180 | # This stuff is for subjectAltName and issuerAltname. | ||
| 181 | # Import the email address. | ||
| 182 | # subjectAltName=email:copy | ||
| 183 | |||
| 184 | # Copy subject details | ||
| 185 | # issuerAltName=issuer:copy | ||
| 186 | |||
| 187 | #nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem | ||
| 188 | #nsBaseUrl | ||
| 189 | #nsRevocationUrl | ||
| 190 | #nsRenewalUrl | ||
| 191 | #nsCaPolicyUrl | ||
| 192 | #nsSslServerName | ||
| 193 | |||
| 194 | [ v3_req ] | ||
| 195 | |||
| 196 | # Extensions to add to a certificate request | ||
| 197 | |||
| 198 | basicConstraints = CA:FALSE | ||
| 199 | keyUsage = nonRepudiation, digitalSignature, keyEncipherment | ||
| 200 | |||
| 201 | [ v3_ca ] | ||
| 202 | |||
| 203 | |||
| 204 | # Extensions for a typical CA | ||
| 205 | |||
| 206 | |||
| 207 | # PKIX recommendation. | ||
| 208 | |||
| 209 | subjectKeyIdentifier=hash | ||
| 210 | |||
| 211 | authorityKeyIdentifier=keyid:always,issuer:always | ||
| 212 | |||
| 213 | # This is what PKIX recommends but some broken software chokes on critical | ||
| 214 | # extensions. | ||
| 215 | #basicConstraints = critical,CA:true | ||
| 216 | # So we do this instead. | ||
| 217 | basicConstraints = CA:true | ||
| 218 | |||
| 219 | # Key usage: this is typical for a CA certificate. However since it will | ||
| 220 | # prevent it being used as an test self-signed certificate it is best | ||
| 221 | # left out by default. | ||
| 222 | # keyUsage = cRLSign, keyCertSign | ||
| 223 | |||
| 224 | # Some might want this also | ||
| 225 | # nsCertType = sslCA, emailCA | ||
| 226 | |||
| 227 | # Include email address in subject alt name: another PKIX recommendation | ||
| 228 | # subjectAltName=email:copy | ||
| 229 | # Copy issuer details | ||
| 230 | # issuerAltName=issuer:copy | ||
| 231 | |||
| 232 | # DER hex encoding of an extension: beware experts only! | ||
| 233 | # obj=DER:02:03 | ||
| 234 | # Where 'obj' is a standard or added object | ||
| 235 | # You can even override a supported extension: | ||
| 236 | # basicConstraints= critical, DER:30:03:01:01:FF | ||
| 237 | |||
| 238 | [ crl_ext ] | ||
| 239 | |||
| 240 | # CRL extensions. | ||
| 241 | # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. | ||
| 242 | |||
| 243 | # issuerAltName=issuer:copy | ||
| 244 | authorityKeyIdentifier=keyid:always,issuer:always | ||
diff --git a/src/lib/libssl/doc/openssl.txt b/src/lib/libssl/doc/openssl.txt deleted file mode 100644 index 5da519e7e4..0000000000 --- a/src/lib/libssl/doc/openssl.txt +++ /dev/null | |||
| @@ -1,1235 +0,0 @@ | |||
| 1 | |||
| 2 | This is some preliminary documentation for OpenSSL. | ||
| 3 | |||
| 4 | Contents: | ||
| 5 | |||
| 6 | OpenSSL X509V3 extension configuration | ||
| 7 | X509V3 Extension code: programmers guide | ||
| 8 | PKCS#12 Library | ||
| 9 | |||
| 10 | |||
| 11 | ============================================================================== | ||
| 12 | OpenSSL X509V3 extension configuration | ||
| 13 | ============================================================================== | ||
| 14 | |||
| 15 | OpenSSL X509V3 extension configuration: preliminary documentation. | ||
| 16 | |||
| 17 | INTRODUCTION. | ||
| 18 | |||
| 19 | For OpenSSL 0.9.2 the extension code has be considerably enhanced. It is now | ||
| 20 | possible to add and print out common X509 V3 certificate and CRL extensions. | ||
| 21 | |||
| 22 | BEGINNERS NOTE | ||
| 23 | |||
| 24 | For most simple applications you don't need to know too much about extensions: | ||
| 25 | the default openssl.cnf values will usually do sensible things. | ||
| 26 | |||
| 27 | If you want to know more you can initially quickly look through the sections | ||
| 28 | describing how the standard OpenSSL utilities display and add extensions and | ||
| 29 | then the list of supported extensions. | ||
| 30 | |||
| 31 | For more technical information about the meaning of extensions see: | ||
| 32 | |||
| 33 | http://www.imc.org/ietf-pkix/ | ||
| 34 | http://home.netscape.com/eng/security/certs.html | ||
| 35 | |||
| 36 | PRINTING EXTENSIONS. | ||
| 37 | |||
| 38 | Extension values are automatically printed out for supported extensions. | ||
| 39 | |||
| 40 | openssl x509 -in cert.pem -text | ||
| 41 | openssl crl -in crl.pem -text | ||
| 42 | |||
| 43 | will give information in the extension printout, for example: | ||
| 44 | |||
| 45 | X509v3 extensions: | ||
| 46 | X509v3 Basic Constraints: | ||
| 47 | CA:TRUE | ||
| 48 | X509v3 Subject Key Identifier: | ||
| 49 | 73:FE:F7:59:A7:E1:26:84:44:D6:44:36:EE:79:1A:95:7C:B1:4B:15 | ||
| 50 | X509v3 Authority Key Identifier: | ||
| 51 | keyid:73:FE:F7:59:A7:E1:26:84:44:D6:44:36:EE:79:1A:95:7C:B1:4B:15, DirName:/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/Email=email@1.address/Email=email@2.address, serial:00 | ||
| 52 | X509v3 Key Usage: | ||
| 53 | Certificate Sign, CRL Sign | ||
| 54 | X509v3 Subject Alternative Name: | ||
| 55 | email:email@1.address, email:email@2.address | ||
| 56 | |||
| 57 | CONFIGURATION FILES. | ||
| 58 | |||
| 59 | The OpenSSL utilities 'ca' and 'req' can now have extension sections listing | ||
| 60 | which certificate extensions to include. In each case a line: | ||
| 61 | |||
| 62 | x509_extensions = extension_section | ||
| 63 | |||
| 64 | indicates which section contains the extensions. In the case of 'req' the | ||
| 65 | extension section is used when the -x509 option is present to create a | ||
| 66 | self signed root certificate. | ||
| 67 | |||
| 68 | The 'x509' utility also supports extensions when it signs a certificate. | ||
| 69 | The -extfile option is used to set the configuration file containing the | ||
| 70 | extensions. In this case a line with: | ||
| 71 | |||
| 72 | extensions = extension_section | ||
| 73 | |||
| 74 | in the nameless (default) section is used. If no such line is included then | ||
| 75 | it uses the default section. | ||
| 76 | |||
| 77 | You can also add extensions to CRLs: a line | ||
| 78 | |||
| 79 | crl_extensions = crl_extension_section | ||
| 80 | |||
| 81 | will include extensions when the -gencrl option is used with the 'ca' utility. | ||
| 82 | You can add any extension to a CRL but of the supported extensions only | ||
| 83 | issuerAltName and authorityKeyIdentifier make any real sense. Note: these are | ||
| 84 | CRL extensions NOT CRL *entry* extensions which cannot currently be generated. | ||
| 85 | CRL entry extensions can be displayed. | ||
| 86 | |||
| 87 | NB. At this time Netscape Communicator rejects V2 CRLs: to get an old V1 CRL | ||
| 88 | you should not include a crl_extensions line in the configuration file. | ||
| 89 | |||
| 90 | As with all configuration files you can use the inbuilt environment expansion | ||
| 91 | to allow the values to be passed in the environment. Therefore if you have | ||
| 92 | several extension sections used for different purposes you can have a line: | ||
| 93 | |||
| 94 | x509_extensions = $ENV::ENV_EXT | ||
| 95 | |||
| 96 | and set the ENV_EXT environment variable before calling the relevant utility. | ||
| 97 | |||
| 98 | EXTENSION SYNTAX. | ||
| 99 | |||
| 100 | Extensions have the basic form: | ||
| 101 | |||
| 102 | extension_name=[critical,] extension_options | ||
| 103 | |||
| 104 | the use of the critical option makes the extension critical. Extreme caution | ||
| 105 | should be made when using the critical flag. If an extension is marked | ||
| 106 | as critical then any client that does not understand the extension should | ||
| 107 | reject it as invalid. Some broken software will reject certificates which | ||
| 108 | have *any* critical extensions (these violates PKIX but we have to live | ||
| 109 | with it). | ||
| 110 | |||
| 111 | There are three main types of extension: string extensions, multi-valued | ||
| 112 | extensions, and raw extensions. | ||
| 113 | |||
| 114 | String extensions simply have a string which contains either the value itself | ||
| 115 | or how it is obtained. | ||
| 116 | |||
| 117 | For example: | ||
| 118 | |||
| 119 | nsComment="This is a Comment" | ||
| 120 | |||
| 121 | Multi-valued extensions have a short form and a long form. The short form | ||
| 122 | is a list of names and values: | ||
| 123 | |||
| 124 | basicConstraints=critical,CA:true,pathlen:1 | ||
| 125 | |||
| 126 | The long form allows the values to be placed in a separate section: | ||
| 127 | |||
| 128 | basicConstraints=critical,@bs_section | ||
| 129 | |||
| 130 | [bs_section] | ||
| 131 | |||
| 132 | CA=true | ||
| 133 | pathlen=1 | ||
| 134 | |||
| 135 | Both forms are equivalent. However it should be noted that in some cases the | ||
| 136 | same name can appear multiple times, for example, | ||
| 137 | |||
| 138 | subjectAltName=email:steve@here,email:steve@there | ||
| 139 | |||
| 140 | in this case an equivalent long form is: | ||
| 141 | |||
| 142 | subjectAltName=@alt_section | ||
| 143 | |||
| 144 | [alt_section] | ||
| 145 | |||
| 146 | email.1=steve@here | ||
| 147 | email.2=steve@there | ||
| 148 | |||
| 149 | This is because the configuration file code cannot handle the same name | ||
| 150 | occurring twice in the same section. | ||
| 151 | |||
| 152 | The syntax of raw extensions is governed by the extension code: it can | ||
| 153 | for example contain data in multiple sections. The correct syntax to | ||
| 154 | use is defined by the extension code itself: check out the certificate | ||
| 155 | policies extension for an example. | ||
| 156 | |||
| 157 | In addition it is also possible to use the word DER to include arbitrary | ||
| 158 | data in any extension. | ||
| 159 | |||
| 160 | 1.2.3.4=critical,DER:01:02:03:04 | ||
| 161 | 1.2.3.4=DER:01020304 | ||
| 162 | |||
| 163 | The value following DER is a hex dump of the DER encoding of the extension | ||
| 164 | Any extension can be placed in this form to override the default behaviour. | ||
| 165 | For example: | ||
| 166 | |||
| 167 | basicConstraints=critical,DER:00:01:02:03 | ||
| 168 | |||
| 169 | WARNING: DER should be used with caution. It is possible to create totally | ||
| 170 | invalid extensions unless care is taken. | ||
| 171 | |||
| 172 | CURRENTLY SUPPORTED EXTENSIONS. | ||
| 173 | |||
| 174 | If you aren't sure about extensions then they can be largely ignored: its only | ||
| 175 | when you want to do things like restrict certificate usage when you need to | ||
| 176 | worry about them. | ||
| 177 | |||
| 178 | The only extension that a beginner might want to look at is Basic Constraints. | ||
| 179 | If in addition you want to try Netscape object signing the you should also | ||
| 180 | look at Netscape Certificate Type. | ||
| 181 | |||
| 182 | Literal String extensions. | ||
| 183 | |||
| 184 | In each case the 'value' of the extension is placed directly in the | ||
| 185 | extension. Currently supported extensions in this category are: nsBaseUrl, | ||
| 186 | nsRevocationUrl, nsCaRevocationUrl, nsRenewalUrl, nsCaPolicyUrl, | ||
| 187 | nsSslServerName and nsComment. | ||
| 188 | |||
| 189 | For example: | ||
| 190 | |||
| 191 | nsComment="This is a test comment" | ||
| 192 | |||
| 193 | Bit Strings. | ||
| 194 | |||
| 195 | Bit string extensions just consist of a list of supported bits, currently | ||
| 196 | two extensions are in this category: PKIX keyUsage and the Netscape specific | ||
| 197 | nsCertType. | ||
| 198 | |||
| 199 | nsCertType (netscape certificate type) takes the flags: client, server, email, | ||
| 200 | objsign, reserved, sslCA, emailCA, objCA. | ||
| 201 | |||
| 202 | keyUsage (PKIX key usage) takes the flags: digitalSignature, nonRepudiation, | ||
| 203 | keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, | ||
| 204 | encipherOnly, decipherOnly. | ||
| 205 | |||
| 206 | For example: | ||
| 207 | |||
| 208 | nsCertType=server | ||
| 209 | |||
| 210 | keyUsage=digitalSignature, nonRepudiation | ||
| 211 | |||
| 212 | Hints on Netscape Certificate Type. | ||
| 213 | |||
| 214 | Other than Basic Constraints this is the only extension a beginner might | ||
| 215 | want to use, if you want to try Netscape object signing, otherwise it can | ||
| 216 | be ignored. | ||
| 217 | |||
| 218 | If you want a certificate that can be used just for object signing then: | ||
| 219 | |||
| 220 | nsCertType=objsign | ||
| 221 | |||
| 222 | will do the job. If you want to use it as a normal end user and server | ||
| 223 | certificate as well then | ||
| 224 | |||
| 225 | nsCertType=objsign,email,server | ||
| 226 | |||
| 227 | is more appropriate. You cannot use a self signed certificate for object | ||
| 228 | signing (well Netscape signtool can but it cheats!) so you need to create | ||
| 229 | a CA certificate and sign an end user certificate with it. | ||
| 230 | |||
| 231 | Side note: If you want to conform to the Netscape specifications then you | ||
| 232 | should really also set: | ||
| 233 | |||
| 234 | nsCertType=objCA | ||
| 235 | |||
| 236 | in the *CA* certificate for just an object signing CA and | ||
| 237 | |||
| 238 | nsCertType=objCA,emailCA,sslCA | ||
| 239 | |||
| 240 | for everything. Current Netscape software doesn't enforce this so it can | ||
| 241 | be omitted. | ||
| 242 | |||
| 243 | Basic Constraints. | ||
| 244 | |||
| 245 | This is generally the only extension you need to worry about for simple | ||
| 246 | applications. If you want your certificate to be usable as a CA certificate | ||
| 247 | (in addition to an end user certificate) then you set this to: | ||
| 248 | |||
| 249 | basicConstraints=CA:TRUE | ||
| 250 | |||
| 251 | if you want to be certain the certificate cannot be used as a CA then do: | ||
| 252 | |||
| 253 | basicConstraints=CA:FALSE | ||
| 254 | |||
| 255 | The rest of this section describes more advanced usage. | ||
| 256 | |||
| 257 | Basic constraints is a multi-valued extension that supports a CA and an | ||
| 258 | optional pathlen option. The CA option takes the values true and false and | ||
| 259 | pathlen takes an integer. Note if the CA option is false the pathlen option | ||
| 260 | should be omitted. | ||
| 261 | |||
| 262 | The pathlen parameter indicates the maximum number of CAs that can appear | ||
| 263 | below this one in a chain. So if you have a CA with a pathlen of zero it can | ||
| 264 | only be used to sign end user certificates and not further CAs. This all | ||
| 265 | assumes that the software correctly interprets this extension of course. | ||
| 266 | |||
| 267 | Examples: | ||
| 268 | |||
| 269 | basicConstraints=CA:TRUE | ||
| 270 | basicConstraints=critical,CA:TRUE, pathlen:0 | ||
| 271 | |||
| 272 | NOTE: for a CA to be considered valid it must have the CA option set to | ||
| 273 | TRUE. An end user certificate MUST NOT have the CA value set to true. | ||
| 274 | According to PKIX recommendations it should exclude the extension entirely, | ||
| 275 | however some software may require CA set to FALSE for end entity certificates. | ||
| 276 | |||
| 277 | Extended Key Usage. | ||
| 278 | |||
| 279 | This extensions consists of a list of usages. | ||
| 280 | |||
| 281 | These can either be object short names of the dotted numerical form of OIDs. | ||
| 282 | While any OID can be used only certain values make sense. In particular the | ||
| 283 | following PKIX, NS and MS values are meaningful: | ||
| 284 | |||
| 285 | Value Meaning | ||
| 286 | ----- ------- | ||
| 287 | serverAuth SSL/TLS Web Server Authentication. | ||
| 288 | clientAuth SSL/TLS Web Client Authentication. | ||
| 289 | codeSigning Code signing. | ||
| 290 | emailProtection E-mail Protection (S/MIME). | ||
| 291 | timeStamping Trusted Timestamping | ||
| 292 | msCodeInd Microsoft Individual Code Signing (authenticode) | ||
| 293 | msCodeCom Microsoft Commercial Code Signing (authenticode) | ||
| 294 | msCTLSign Microsoft Trust List Signing | ||
| 295 | msSGC Microsoft Server Gated Crypto | ||
| 296 | msEFS Microsoft Encrypted File System | ||
| 297 | nsSGC Netscape Server Gated Crypto | ||
| 298 | |||
| 299 | For example, under IE5 a CA can be used for any purpose: by including a list | ||
| 300 | of the above usages the CA can be restricted to only authorised uses. | ||
| 301 | |||
| 302 | Note: software packages may place additional interpretations on certificate | ||
| 303 | use, in particular some usages may only work for selected CAs. Don't for example | ||
| 304 | expect just including msSGC or nsSGC will automatically mean that a certificate | ||
| 305 | can be used for SGC ("step up" encryption) otherwise anyone could use it. | ||
| 306 | |||
| 307 | Examples: | ||
| 308 | |||
| 309 | extendedKeyUsage=critical,codeSigning,1.2.3.4 | ||
| 310 | extendedKeyUsage=nsSGC,msSGC | ||
| 311 | |||
| 312 | Subject Key Identifier. | ||
| 313 | |||
| 314 | This is really a string extension and can take two possible values. Either | ||
| 315 | a hex string giving details of the extension value to include or the word | ||
| 316 | 'hash' which then automatically follow PKIX guidelines in selecting and | ||
| 317 | appropriate key identifier. The use of the hex string is strongly discouraged. | ||
| 318 | |||
| 319 | Example: subjectKeyIdentifier=hash | ||
| 320 | |||
| 321 | Authority Key Identifier. | ||
| 322 | |||
| 323 | The authority key identifier extension permits two options. keyid and issuer: | ||
| 324 | both can take the optional value "always". | ||
| 325 | |||
| 326 | If the keyid option is present an attempt is made to copy the subject key | ||
| 327 | identifier from the parent certificate. If the value "always" is present | ||
| 328 | then an error is returned if the option fails. | ||
| 329 | |||
| 330 | The issuer option copies the issuer and serial number from the issuer | ||
| 331 | certificate. Normally this will only be done if the keyid option fails or | ||
| 332 | is not included: the "always" flag will always include the value. | ||
| 333 | |||
| 334 | Subject Alternative Name. | ||
| 335 | |||
| 336 | The subject alternative name extension allows various literal values to be | ||
| 337 | included in the configuration file. These include "email" (an email address) | ||
| 338 | "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a | ||
| 339 | registered ID: OBJECT IDENTIFIER) and IP (and IP address). | ||
| 340 | |||
| 341 | Also the email option include a special 'copy' value. This will automatically | ||
| 342 | include and email addresses contained in the certificate subject name in | ||
| 343 | the extension. | ||
| 344 | |||
| 345 | Examples: | ||
| 346 | |||
| 347 | subjectAltName=email:copy,email:my@other.address,URL:http://my.url.here/ | ||
| 348 | subjectAltName=email:my@other.address,RID:1.2.3.4 | ||
| 349 | |||
| 350 | Issuer Alternative Name. | ||
| 351 | |||
| 352 | The issuer alternative name option supports all the literal options of | ||
| 353 | subject alternative name. It does *not* support the email:copy option because | ||
| 354 | that would not make sense. It does support an additional issuer:copy option | ||
| 355 | that will copy all the subject alternative name values from the issuer | ||
| 356 | certificate (if possible). | ||
| 357 | |||
| 358 | Example: | ||
| 359 | |||
| 360 | issuserAltName = issuer:copy | ||
| 361 | |||
| 362 | Authority Info Access. | ||
| 363 | |||
| 364 | The authority information access extension gives details about how to access | ||
| 365 | certain information relating to the CA. Its syntax is accessOID;location | ||
| 366 | where 'location' has the same syntax as subject alternative name (except | ||
| 367 | that email:copy is not supported). accessOID can be any valid OID but only | ||
| 368 | certain values are meaningful for example OCSP and caIssuers. OCSP gives the | ||
| 369 | location of an OCSP responder: this is used by Netscape PSM and other software. | ||
| 370 | |||
| 371 | Example: | ||
| 372 | |||
| 373 | authorityInfoAccess = OCSP;URI:http://ocsp.my.host/ | ||
| 374 | authorityInfoAccess = caIssuers;URI:http://my.ca/ca.html | ||
| 375 | |||
| 376 | CRL distribution points. | ||
| 377 | |||
| 378 | This is a multi-valued extension that supports all the literal options of | ||
| 379 | subject alternative name. Of the few software packages that currently interpret | ||
| 380 | this extension most only interpret the URI option. | ||
| 381 | |||
| 382 | Currently each option will set a new DistributionPoint with the fullName | ||
| 383 | field set to the given value. | ||
| 384 | |||
| 385 | Other fields like cRLissuer and reasons cannot currently be set or displayed: | ||
| 386 | at this time no examples were available that used these fields. | ||
| 387 | |||
| 388 | If you see this extension with <UNSUPPORTED> when you attempt to print it out | ||
| 389 | or it doesn't appear to display correctly then let me know, including the | ||
| 390 | certificate (mail me at steve@openssl.org) . | ||
| 391 | |||
| 392 | Examples: | ||
| 393 | |||
| 394 | crlDistributionPoints=URI:http://www.myhost.com/myca.crl | ||
| 395 | crlDistributionPoints=URI:http://www.my.com/my.crl,URI:http://www.oth.com/my.crl | ||
| 396 | |||
| 397 | Certificate Policies. | ||
| 398 | |||
| 399 | This is a RAW extension. It attempts to display the contents of this extension: | ||
| 400 | unfortunately this extension is often improperly encoded. | ||
| 401 | |||
| 402 | The certificate policies extension will rarely be used in practice: few | ||
| 403 | software packages interpret it correctly or at all. IE5 does partially | ||
| 404 | support this extension: but it needs the 'ia5org' option because it will | ||
| 405 | only correctly support a broken encoding. Of the options below only the | ||
| 406 | policy OID, explicitText and CPS options are displayed with IE5. | ||
| 407 | |||
| 408 | All the fields of this extension can be set by using the appropriate syntax. | ||
| 409 | |||
| 410 | If you follow the PKIX recommendations of not including any qualifiers and just | ||
| 411 | using only one OID then you just include the value of that OID. Multiple OIDs | ||
| 412 | can be set separated by commas, for example: | ||
| 413 | |||
| 414 | certificatePolicies= 1.2.4.5, 1.1.3.4 | ||
| 415 | |||
| 416 | If you wish to include qualifiers then the policy OID and qualifiers need to | ||
| 417 | be specified in a separate section: this is done by using the @section syntax | ||
| 418 | instead of a literal OID value. | ||
| 419 | |||
| 420 | The section referred to must include the policy OID using the name | ||
| 421 | policyIdentifier, cPSuri qualifiers can be included using the syntax: | ||
| 422 | |||
| 423 | CPS.nnn=value | ||
| 424 | |||
| 425 | userNotice qualifiers can be set using the syntax: | ||
| 426 | |||
| 427 | userNotice.nnn=@notice | ||
| 428 | |||
| 429 | The value of the userNotice qualifier is specified in the relevant section. | ||
| 430 | This section can include explicitText, organization and noticeNumbers | ||
| 431 | options. explicitText and organization are text strings, noticeNumbers is a | ||
| 432 | comma separated list of numbers. The organization and noticeNumbers options | ||
| 433 | (if included) must BOTH be present. If you use the userNotice option with IE5 | ||
| 434 | then you need the 'ia5org' option at the top level to modify the encoding: | ||
| 435 | otherwise it will not be interpreted properly. | ||
| 436 | |||
| 437 | Example: | ||
| 438 | |||
| 439 | certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect | ||
| 440 | |||
| 441 | [polsect] | ||
| 442 | |||
| 443 | policyIdentifier = 1.3.5.8 | ||
| 444 | CPS.1="http://my.host.name/" | ||
| 445 | CPS.2="http://my.your.name/" | ||
| 446 | userNotice.1=@notice | ||
| 447 | |||
| 448 | [notice] | ||
| 449 | |||
| 450 | explicitText="Explicit Text Here" | ||
| 451 | organization="Organisation Name" | ||
| 452 | noticeNumbers=1,2,3,4 | ||
| 453 | |||
| 454 | TECHNICAL NOTE: the ia5org option changes the type of the 'organization' field, | ||
| 455 | according to PKIX it should be of type DisplayText but Verisign uses an | ||
| 456 | IA5STRING and IE5 needs this too. | ||
| 457 | |||
| 458 | Display only extensions. | ||
| 459 | |||
| 460 | Some extensions are only partially supported and currently are only displayed | ||
| 461 | but cannot be set. These include private key usage period, CRL number, and | ||
| 462 | CRL reason. | ||
| 463 | |||
| 464 | ============================================================================== | ||
| 465 | X509V3 Extension code: programmers guide | ||
| 466 | ============================================================================== | ||
| 467 | |||
| 468 | The purpose of the extension code is twofold. It allows an extension to be | ||
| 469 | created from a string or structure describing its contents and it prints out an | ||
| 470 | extension in a human or machine readable form. | ||
| 471 | |||
| 472 | 1. Initialisation and cleanup. | ||
| 473 | |||
| 474 | No special initialisation is needed before calling the extension functions. | ||
| 475 | You used to have to call X509V3_add_standard_extensions(); but this is no longer | ||
| 476 | required and this function no longer does anything. | ||
| 477 | |||
| 478 | void X509V3_EXT_cleanup(void); | ||
| 479 | |||
| 480 | This function should be called to cleanup the extension code if any custom | ||
| 481 | extensions have been added. If no custom extensions have been added then this | ||
| 482 | call does nothing. After this call all custom extension code is freed up but | ||
| 483 | you can still use the standard extensions. | ||
| 484 | |||
| 485 | 2. Printing and parsing extensions. | ||
| 486 | |||
| 487 | The simplest way to print out extensions is via the standard X509 printing | ||
| 488 | routines: if you use the standard X509_print() function, the supported | ||
| 489 | extensions will be printed out automatically. | ||
| 490 | |||
| 491 | The following functions allow finer control over extension display: | ||
| 492 | |||
| 493 | int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent); | ||
| 494 | int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent); | ||
| 495 | |||
| 496 | These two functions print out an individual extension to a BIO or FILE pointer. | ||
| 497 | Currently the flag argument is unused and should be set to 0. The 'indent' | ||
| 498 | argument is the number of spaces to indent each line. | ||
| 499 | |||
| 500 | void *X509V3_EXT_d2i(X509_EXTENSION *ext); | ||
| 501 | |||
| 502 | This function parses an extension and returns its internal structure. The | ||
| 503 | precise structure you get back depends on the extension being parsed. If the | ||
| 504 | extension if basicConstraints you will get back a pointer to a | ||
| 505 | BASIC_CONSTRAINTS structure. Check out the source in crypto/x509v3 for more | ||
| 506 | details about the structures returned. The returned structure should be freed | ||
| 507 | after use using the relevant free function, BASIC_CONSTRAINTS_free() for | ||
| 508 | example. | ||
| 509 | |||
| 510 | void * X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx); | ||
| 511 | void * X509_CRL_get_ext_d2i(X509_CRL *x, int nid, int *crit, int *idx); | ||
| 512 | void * X509_REVOKED_get_ext_d2i(X509_REVOKED *x, int nid, int *crit, int *idx); | ||
| 513 | void * X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx); | ||
| 514 | |||
| 515 | These functions combine the operations of searching for extensions and | ||
| 516 | parsing them. They search a certificate, a CRL a CRL entry or a stack | ||
| 517 | of extensions respectively for extension whose NID is 'nid' and return | ||
| 518 | the parsed result of NULL if an error occurred. For example: | ||
| 519 | |||
| 520 | BASIC_CONSTRAINTS *bs; | ||
| 521 | bs = X509_get_ext_d2i(cert, NID_basic_constraints, NULL, NULL); | ||
| 522 | |||
| 523 | This will search for the basicConstraints extension and either return | ||
| 524 | it value or NULL. NULL can mean either the extension was not found, it | ||
| 525 | occurred more than once or it could not be parsed. | ||
| 526 | |||
| 527 | If 'idx' is NULL then an extension is only parsed if it occurs precisely | ||
| 528 | once. This is standard behaviour because extensions normally cannot occur | ||
| 529 | more than once. If however more than one extension of the same type can | ||
| 530 | occur it can be used to parse successive extensions for example: | ||
| 531 | |||
| 532 | int i; | ||
| 533 | void *ext; | ||
| 534 | |||
| 535 | i = -1; | ||
| 536 | for(;;) { | ||
| 537 | ext = X509_get_ext_d2i(x, nid, crit, &idx); | ||
| 538 | if(ext == NULL) break; | ||
| 539 | /* Do something with ext */ | ||
| 540 | } | ||
| 541 | |||
| 542 | If 'crit' is not NULL and the extension was found then the int it points to | ||
| 543 | is set to 1 for critical extensions and 0 for non critical. Therefore if the | ||
| 544 | function returns NULL but 'crit' is set to 0 or 1 then the extension was | ||
| 545 | found but it could not be parsed. | ||
| 546 | |||
| 547 | The int pointed to by crit will be set to -1 if the extension was not found | ||
| 548 | and -2 if the extension occurred more than once (this will only happen if | ||
| 549 | idx is NULL). In both cases the function will return NULL. | ||
| 550 | |||
| 551 | 3. Generating extensions. | ||
| 552 | |||
| 553 | An extension will typically be generated from a configuration file, or some | ||
| 554 | other kind of configuration database. | ||
| 555 | |||
| 556 | int X509V3_EXT_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, | ||
| 557 | X509 *cert); | ||
| 558 | int X509V3_EXT_CRL_add_conf(LHASH *conf, X509V3_CTX *ctx, char *section, | ||
| 559 | X509_CRL *crl); | ||
| 560 | |||
| 561 | These functions add all the extensions in the given section to the given | ||
| 562 | certificate or CRL. They will normally be called just before the certificate | ||
| 563 | or CRL is due to be signed. Both return 0 on error on non zero for success. | ||
| 564 | |||
| 565 | In each case 'conf' is the LHASH pointer of the configuration file to use | ||
| 566 | and 'section' is the section containing the extension details. | ||
| 567 | |||
| 568 | See the 'context functions' section for a description of the ctx parameter. | ||
| 569 | |||
| 570 | |||
| 571 | X509_EXTENSION *X509V3_EXT_conf(LHASH *conf, X509V3_CTX *ctx, char *name, | ||
| 572 | char *value); | ||
| 573 | |||
| 574 | This function returns an extension based on a name and value pair, if the | ||
| 575 | pair will not need to access other sections in a config file (or there is no | ||
| 576 | config file) then the 'conf' parameter can be set to NULL. | ||
| 577 | |||
| 578 | X509_EXTENSION *X509V3_EXT_conf_nid(char *conf, X509V3_CTX *ctx, int nid, | ||
| 579 | char *value); | ||
| 580 | |||
| 581 | This function creates an extension in the same way as X509V3_EXT_conf() but | ||
| 582 | takes the NID of the extension rather than its name. | ||
| 583 | |||
| 584 | For example to produce basicConstraints with the CA flag and a path length of | ||
| 585 | 10: | ||
| 586 | |||
| 587 | x = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints,"CA:TRUE,pathlen:10"); | ||
| 588 | |||
| 589 | |||
| 590 | X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc); | ||
| 591 | |||
| 592 | This function sets up an extension from its internal structure. The ext_nid | ||
| 593 | parameter is the NID of the extension and 'crit' is the critical flag. | ||
| 594 | |||
| 595 | 4. Context functions. | ||
| 596 | |||
| 597 | The following functions set and manipulate an extension context structure. | ||
| 598 | The purpose of the extension context is to allow the extension code to | ||
| 599 | access various structures relating to the "environment" of the certificate: | ||
| 600 | for example the issuers certificate or the certificate request. | ||
| 601 | |||
| 602 | void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject, | ||
| 603 | X509_REQ *req, X509_CRL *crl, int flags); | ||
| 604 | |||
| 605 | This function sets up an X509V3_CTX structure with details of the certificate | ||
| 606 | environment: specifically the issuers certificate, the subject certificate, | ||
| 607 | the certificate request and the CRL: if these are not relevant or not | ||
| 608 | available then they can be set to NULL. The 'flags' parameter should be set | ||
| 609 | to zero. | ||
| 610 | |||
| 611 | X509V3_set_ctx_test(ctx) | ||
| 612 | |||
| 613 | This macro is used to set the 'ctx' structure to a 'test' value: this is to | ||
| 614 | allow the syntax of an extension (or configuration file) to be tested. | ||
| 615 | |||
| 616 | X509V3_set_ctx_nodb(ctx) | ||
| 617 | |||
| 618 | This macro is used when no configuration database is present. | ||
| 619 | |||
| 620 | void X509V3_set_conf_lhash(X509V3_CTX *ctx, LHASH *lhash); | ||
| 621 | |||
| 622 | This function is used to set the configuration database when it is an LHASH | ||
| 623 | structure: typically a configuration file. | ||
| 624 | |||
| 625 | The following functions are used to access a configuration database: they | ||
| 626 | should only be used in RAW extensions. | ||
| 627 | |||
| 628 | char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section); | ||
| 629 | |||
| 630 | This function returns the value of the parameter "name" in "section", or NULL | ||
| 631 | if there has been an error. | ||
| 632 | |||
| 633 | void X509V3_string_free(X509V3_CTX *ctx, char *str); | ||
| 634 | |||
| 635 | This function frees up the string returned by the above function. | ||
| 636 | |||
| 637 | STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section); | ||
| 638 | |||
| 639 | This function returns a whole section as a STACK_OF(CONF_VALUE) . | ||
| 640 | |||
| 641 | void X509V3_section_free( X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *section); | ||
| 642 | |||
| 643 | This function frees up the STACK returned by the above function. | ||
| 644 | |||
| 645 | Note: it is possible to use the extension code with a custom configuration | ||
| 646 | database. To do this the "db_meth" element of the X509V3_CTX structure should | ||
| 647 | be set to an X509V3_CTX_METHOD structure. This structure contains the following | ||
| 648 | function pointers: | ||
| 649 | |||
| 650 | char * (*get_string)(void *db, char *section, char *value); | ||
| 651 | STACK_OF(CONF_VALUE) * (*get_section)(void *db, char *section); | ||
| 652 | void (*free_string)(void *db, char * string); | ||
| 653 | void (*free_section)(void *db, STACK_OF(CONF_VALUE) *section); | ||
| 654 | |||
| 655 | these will be called and passed the 'db' element in the X509V3_CTX structure | ||
| 656 | to access the database. If a given function is not implemented or not required | ||
| 657 | it can be set to NULL. | ||
| 658 | |||
| 659 | 5. String helper functions. | ||
| 660 | |||
| 661 | There are several "i2s" and "s2i" functions that convert structures to and | ||
| 662 | from ASCII strings. In all the "i2s" cases the returned string should be | ||
| 663 | freed using Free() after use. Since some of these are part of other extension | ||
| 664 | code they may take a 'method' parameter. Unless otherwise stated it can be | ||
| 665 | safely set to NULL. | ||
| 666 | |||
| 667 | char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, ASN1_OCTET_STRING *oct); | ||
| 668 | |||
| 669 | This returns a hex string from an ASN1_OCTET_STRING. | ||
| 670 | |||
| 671 | char * i2s_ASN1_INTEGER(X509V3_EXT_METHOD *meth, ASN1_INTEGER *aint); | ||
| 672 | char * i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint); | ||
| 673 | |||
| 674 | These return a string decimal representations of an ASN1_INTEGER and an | ||
| 675 | ASN1_ENUMERATED type, respectively. | ||
| 676 | |||
| 677 | ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, | ||
| 678 | X509V3_CTX *ctx, char *str); | ||
| 679 | |||
| 680 | This converts an ASCII hex string to an ASN1_OCTET_STRING. | ||
| 681 | |||
| 682 | ASN1_INTEGER * s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, char *value); | ||
| 683 | |||
| 684 | This converts a decimal ASCII string into an ASN1_INTEGER. | ||
| 685 | |||
| 686 | 6. Multi valued extension helper functions. | ||
| 687 | |||
| 688 | The following functions can be used to manipulate STACKs of CONF_VALUE | ||
| 689 | structures, as used by multi valued extensions. | ||
| 690 | |||
| 691 | int X509V3_get_value_bool(CONF_VALUE *value, int *asn1_bool); | ||
| 692 | |||
| 693 | This function expects a boolean value in 'value' and sets 'asn1_bool' to | ||
| 694 | it. That is it sets it to 0 for FALSE or 0xff for TRUE. The following | ||
| 695 | strings are acceptable: "TRUE", "true", "Y", "y", "YES", "yes", "FALSE" | ||
| 696 | "false", "N", "n", "NO" or "no". | ||
| 697 | |||
| 698 | int X509V3_get_value_int(CONF_VALUE *value, ASN1_INTEGER **aint); | ||
| 699 | |||
| 700 | This accepts a decimal integer of arbitrary length and sets an ASN1_INTEGER. | ||
| 701 | |||
| 702 | int X509V3_add_value(const char *name, const char *value, | ||
| 703 | STACK_OF(CONF_VALUE) **extlist); | ||
| 704 | |||
| 705 | This simply adds a string name and value pair. | ||
| 706 | |||
| 707 | int X509V3_add_value_uchar(const char *name, const unsigned char *value, | ||
| 708 | STACK_OF(CONF_VALUE) **extlist); | ||
| 709 | |||
| 710 | The same as above but for an unsigned character value. | ||
| 711 | |||
| 712 | int X509V3_add_value_bool(const char *name, int asn1_bool, | ||
| 713 | STACK_OF(CONF_VALUE) **extlist); | ||
| 714 | |||
| 715 | This adds either "TRUE" or "FALSE" depending on the value of 'asn1_bool' | ||
| 716 | |||
| 717 | int X509V3_add_value_bool_nf(char *name, int asn1_bool, | ||
| 718 | STACK_OF(CONF_VALUE) **extlist); | ||
| 719 | |||
| 720 | This is the same as above except it adds nothing if asn1_bool is FALSE. | ||
| 721 | |||
| 722 | int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint, | ||
| 723 | STACK_OF(CONF_VALUE) **extlist); | ||
| 724 | |||
| 725 | This function adds the value of the ASN1_INTEGER in decimal form. | ||
| 726 | |||
| 727 | 7. Other helper functions. | ||
| 728 | |||
| 729 | <to be added> | ||
| 730 | |||
| 731 | ADDING CUSTOM EXTENSIONS. | ||
| 732 | |||
| 733 | Currently there are three types of supported extensions. | ||
| 734 | |||
| 735 | String extensions are simple strings where the value is placed directly in the | ||
| 736 | extensions, and the string returned is printed out. | ||
| 737 | |||
| 738 | Multi value extensions are passed a STACK_OF(CONF_VALUE) name and value pairs | ||
| 739 | or return a STACK_OF(CONF_VALUE). | ||
| 740 | |||
| 741 | Raw extensions are just passed a BIO or a value and it is the extensions | ||
| 742 | responsibility to handle all the necessary printing. | ||
| 743 | |||
| 744 | There are two ways to add an extension. One is simply as an alias to an already | ||
| 745 | existing extension. An alias is an extension that is identical in ASN1 structure | ||
| 746 | to an existing extension but has a different OBJECT IDENTIFIER. This can be | ||
| 747 | done by calling: | ||
| 748 | |||
| 749 | int X509V3_EXT_add_alias(int nid_to, int nid_from); | ||
| 750 | |||
| 751 | 'nid_to' is the new extension NID and 'nid_from' is the already existing | ||
| 752 | extension NID. | ||
| 753 | |||
| 754 | Alternatively an extension can be written from scratch. This involves writing | ||
| 755 | the ASN1 code to encode and decode the extension and functions to print out and | ||
| 756 | generate the extension from strings. The relevant functions are then placed in | ||
| 757 | a X509V3_EXT_METHOD structure and int X509V3_EXT_add(X509V3_EXT_METHOD *ext); | ||
| 758 | called. | ||
| 759 | |||
| 760 | The X509V3_EXT_METHOD structure is described below. | ||
| 761 | |||
| 762 | strut { | ||
| 763 | int ext_nid; | ||
| 764 | int ext_flags; | ||
| 765 | X509V3_EXT_NEW ext_new; | ||
| 766 | X509V3_EXT_FREE ext_free; | ||
| 767 | X509V3_EXT_D2I d2i; | ||
| 768 | X509V3_EXT_I2D i2d; | ||
| 769 | X509V3_EXT_I2S i2s; | ||
| 770 | X509V3_EXT_S2I s2i; | ||
| 771 | X509V3_EXT_I2V i2v; | ||
| 772 | X509V3_EXT_V2I v2i; | ||
| 773 | X509V3_EXT_R2I r2i; | ||
| 774 | X509V3_EXT_I2R i2r; | ||
| 775 | |||
| 776 | void *usr_data; | ||
| 777 | }; | ||
| 778 | |||
| 779 | The elements have the following meanings. | ||
| 780 | |||
| 781 | ext_nid is the NID of the object identifier of the extension. | ||
| 782 | |||
| 783 | ext_flags is set of flags. Currently the only external flag is | ||
| 784 | X509V3_EXT_MULTILINE which means a multi valued extensions | ||
| 785 | should be printed on separate lines. | ||
| 786 | |||
| 787 | usr_data is an extension specific pointer to any relevant data. This | ||
| 788 | allows extensions to share identical code but have different | ||
| 789 | uses. An example of this is the bit string extension which uses | ||
| 790 | usr_data to contain a list of the bit names. | ||
| 791 | |||
| 792 | All the remaining elements are function pointers. | ||
| 793 | |||
| 794 | ext_new is a pointer to a function that allocates memory for the | ||
| 795 | extension ASN1 structure: for example ASN1_OBJECT_new(). | ||
| 796 | |||
| 797 | ext_free is a pointer to a function that free up memory of the extension | ||
| 798 | ASN1 structure: for example ASN1_OBJECT_free(). | ||
| 799 | |||
| 800 | d2i is the standard ASN1 function that converts a DER buffer into | ||
| 801 | the internal ASN1 structure: for example d2i_ASN1_IA5STRING(). | ||
| 802 | |||
| 803 | i2d is the standard ASN1 function that converts the internal | ||
| 804 | structure into the DER representation: for example | ||
| 805 | i2d_ASN1_IA5STRING(). | ||
| 806 | |||
| 807 | The remaining functions are depend on the type of extension. One i2X and | ||
| 808 | one X2i should be set and the rest set to NULL. The types set do not need | ||
| 809 | to match up, for example the extension could be set using the multi valued | ||
| 810 | v2i function and printed out using the raw i2r. | ||
| 811 | |||
| 812 | All functions have the X509V3_EXT_METHOD passed to them in the 'method' | ||
| 813 | parameter and an X509V3_CTX structure. Extension code can then access the | ||
| 814 | parent structure via the 'method' parameter to for example make use of the value | ||
| 815 | of usr_data. If the code needs to use detail relating to the request it can | ||
| 816 | use the 'ctx' parameter. | ||
| 817 | |||
| 818 | A note should be given here about the 'flags' member of the 'ctx' parameter. | ||
| 819 | If it has the value CTX_TEST then the configuration syntax is being checked | ||
| 820 | and no actual certificate or CRL exists. Therefore any attempt in the config | ||
| 821 | file to access such information should silently succeed. If the syntax is OK | ||
| 822 | then it should simply return a (possibly bogus) extension, otherwise it | ||
| 823 | should return NULL. | ||
| 824 | |||
| 825 | char *i2s(struct v3_ext_method *method, void *ext); | ||
| 826 | |||
| 827 | This function takes the internal structure in the ext parameter and returns | ||
| 828 | a Malloc'ed string representing its value. | ||
| 829 | |||
| 830 | void * s2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str); | ||
| 831 | |||
| 832 | This function takes the string representation in the ext parameter and returns | ||
| 833 | an allocated internal structure: ext_free() will be used on this internal | ||
| 834 | structure after use. | ||
| 835 | |||
| 836 | i2v and v2i handle a STACK_OF(CONF_VALUE): | ||
| 837 | |||
| 838 | typedef struct | ||
| 839 | { | ||
| 840 | char *section; | ||
| 841 | char *name; | ||
| 842 | char *value; | ||
| 843 | } CONF_VALUE; | ||
| 844 | |||
| 845 | Only the name and value members are currently used. | ||
| 846 | |||
| 847 | STACK_OF(CONF_VALUE) * i2v(struct v3_ext_method *method, void *ext); | ||
| 848 | |||
| 849 | This function is passed the internal structure in the ext parameter and | ||
| 850 | returns a STACK of CONF_VALUE structures. The values of name, value, | ||
| 851 | section and the structure itself will be freed up with Free after use. | ||
| 852 | Several helper functions are available to add values to this STACK. | ||
| 853 | |||
| 854 | void * v2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, | ||
| 855 | STACK_OF(CONF_VALUE) *values); | ||
| 856 | |||
| 857 | This function takes a STACK_OF(CONF_VALUE) structures and should set the | ||
| 858 | values of the external structure. This typically uses the name element to | ||
| 859 | determine which structure element to set and the value element to determine | ||
| 860 | what to set it to. Several helper functions are available for this | ||
| 861 | purpose (see above). | ||
| 862 | |||
| 863 | int i2r(struct v3_ext_method *method, void *ext, BIO *out, int indent); | ||
| 864 | |||
| 865 | This function is passed the internal extension structure in the ext parameter | ||
| 866 | and sends out a human readable version of the extension to out. The 'indent' | ||
| 867 | parameter should be noted to determine the necessary amount of indentation | ||
| 868 | needed on the output. | ||
| 869 | |||
| 870 | void * r2i(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str); | ||
| 871 | |||
| 872 | This is just passed the string representation of the extension. It is intended | ||
| 873 | to be used for more elaborate extensions where the standard single and multi | ||
| 874 | valued options are insufficient. They can use the 'ctx' parameter to parse the | ||
| 875 | configuration database themselves. See the context functions section for details | ||
| 876 | of how to do this. | ||
| 877 | |||
| 878 | Note: although this type takes the same parameters as the "r2s" function there | ||
| 879 | is a subtle difference. Whereas an "r2i" function can access a configuration | ||
| 880 | database an "s2i" function MUST NOT. This is so the internal code can safely | ||
| 881 | assume that an "s2i" function will work without a configuration database. | ||
| 882 | |||
| 883 | ============================================================================== | ||
| 884 | PKCS#12 Library | ||
| 885 | ============================================================================== | ||
| 886 | |||
| 887 | This section describes the internal PKCS#12 support. There are very few | ||
| 888 | differences between the old external library and the new internal code at | ||
| 889 | present. This may well change because the external library will not be updated | ||
| 890 | much in future. | ||
| 891 | |||
| 892 | This version now includes a couple of high level PKCS#12 functions which | ||
| 893 | generally "do the right thing" and should make it much easier to handle PKCS#12 | ||
| 894 | structures. | ||
| 895 | |||
| 896 | HIGH LEVEL FUNCTIONS. | ||
| 897 | |||
| 898 | For most applications you only need concern yourself with the high level | ||
| 899 | functions. They can parse and generate simple PKCS#12 files as produced by | ||
| 900 | Netscape and MSIE or indeed any compliant PKCS#12 file containing a single | ||
| 901 | private key and certificate pair. | ||
| 902 | |||
| 903 | 1. Initialisation and cleanup. | ||
| 904 | |||
| 905 | No special initialisation is needed for the internal PKCS#12 library: the | ||
| 906 | standard SSLeay_add_all_algorithms() is sufficient. If you do not wish to | ||
| 907 | add all algorithms (you should at least add SHA1 though) then you can manually | ||
| 908 | initialise the PKCS#12 library with: | ||
| 909 | |||
| 910 | PKCS12_PBE_add(); | ||
| 911 | |||
| 912 | The memory allocated by the PKCS#12 library is freed up when EVP_cleanup() is | ||
| 913 | called or it can be directly freed with: | ||
| 914 | |||
| 915 | EVP_PBE_cleanup(); | ||
| 916 | |||
| 917 | after this call (or EVP_cleanup() ) no more PKCS#12 library functions should | ||
| 918 | be called. | ||
| 919 | |||
| 920 | 2. I/O functions. | ||
| 921 | |||
| 922 | i2d_PKCS12_bio(bp, p12) | ||
| 923 | |||
| 924 | This writes out a PKCS12 structure to a BIO. | ||
| 925 | |||
| 926 | i2d_PKCS12_fp(fp, p12) | ||
| 927 | |||
| 928 | This is the same but for a FILE pointer. | ||
| 929 | |||
| 930 | d2i_PKCS12_bio(bp, p12) | ||
| 931 | |||
| 932 | This reads in a PKCS12 structure from a BIO. | ||
| 933 | |||
| 934 | d2i_PKCS12_fp(fp, p12) | ||
| 935 | |||
| 936 | This is the same but for a FILE pointer. | ||
| 937 | |||
| 938 | 3. High level functions. | ||
| 939 | |||
| 940 | 3.1 Parsing with PKCS12_parse(). | ||
| 941 | |||
| 942 | int PKCS12_parse(PKCS12 *p12, char *pass, EVP_PKEY **pkey, X509 **cert, | ||
| 943 | STACK **ca); | ||
| 944 | |||
| 945 | This function takes a PKCS12 structure and a password (ASCII, null terminated) | ||
| 946 | and returns the private key, the corresponding certificate and any CA | ||
| 947 | certificates. If any of these is not required it can be passed as a NULL. | ||
| 948 | The 'ca' parameter should be either NULL, a pointer to NULL or a valid STACK | ||
| 949 | structure. Typically to read in a PKCS#12 file you might do: | ||
| 950 | |||
| 951 | p12 = d2i_PKCS12_fp(fp, NULL); | ||
| 952 | PKCS12_parse(p12, password, &pkey, &cert, NULL); /* CAs not wanted */ | ||
| 953 | PKCS12_free(p12); | ||
| 954 | |||
| 955 | 3.2 PKCS#12 creation with PKCS12_create(). | ||
| 956 | |||
| 957 | PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, | ||
| 958 | STACK *ca, int nid_key, int nid_cert, int iter, | ||
| 959 | int mac_iter, int keytype); | ||
| 960 | |||
| 961 | This function will create a PKCS12 structure from a given password, name, | ||
| 962 | private key, certificate and optional STACK of CA certificates. The remaining | ||
| 963 | 5 parameters can be set to 0 and sensible defaults will be used. | ||
| 964 | |||
| 965 | The parameters nid_key and nid_cert are the key and certificate encryption | ||
| 966 | algorithms, iter is the encryption iteration count, mac_iter is the MAC | ||
| 967 | iteration count and keytype is the type of private key. If you really want | ||
| 968 | to know what these last 5 parameters do then read the low level section. | ||
| 969 | |||
| 970 | Typically to create a PKCS#12 file the following could be used: | ||
| 971 | |||
| 972 | p12 = PKCS12_create(pass, "My Certificate", pkey, cert, NULL, 0,0,0,0,0); | ||
| 973 | i2d_PKCS12_fp(fp, p12); | ||
| 974 | PKCS12_free(p12); | ||
| 975 | |||
| 976 | 3.3 Changing a PKCS#12 structure password. | ||
| 977 | |||
| 978 | int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass); | ||
| 979 | |||
| 980 | This changes the password of an already existing PKCS#12 structure. oldpass | ||
| 981 | is the old password and newpass is the new one. An error occurs if the old | ||
| 982 | password is incorrect. | ||
| 983 | |||
| 984 | LOW LEVEL FUNCTIONS. | ||
| 985 | |||
| 986 | In some cases the high level functions do not provide the necessary | ||
| 987 | functionality. For example if you want to generate or parse more complex | ||
| 988 | PKCS#12 files. The sample pkcs12 application uses the low level functions | ||
| 989 | to display details about the internal structure of a PKCS#12 file. | ||
| 990 | |||
| 991 | Introduction. | ||
| 992 | |||
| 993 | This is a brief description of how a PKCS#12 file is represented internally: | ||
| 994 | some knowledge of PKCS#12 is assumed. | ||
| 995 | |||
| 996 | A PKCS#12 object contains several levels. | ||
| 997 | |||
| 998 | At the lowest level is a PKCS12_SAFEBAG. This can contain a certificate, a | ||
| 999 | CRL, a private key, encrypted or unencrypted, a set of safebags (so the | ||
| 1000 | structure can be nested) or other secrets (not documented at present). | ||
| 1001 | A safebag can optionally have attributes, currently these are: a unicode | ||
| 1002 | friendlyName (a Unicode string) or a localKeyID (a string of bytes). | ||
| 1003 | |||
| 1004 | At the next level is an authSafe which is a set of safebags collected into | ||
| 1005 | a PKCS#7 ContentInfo. This can be just plain data, or encrypted itself. | ||
| 1006 | |||
| 1007 | At the top level is the PKCS12 structure itself which contains a set of | ||
| 1008 | authSafes in an embedded PKCS#7 Contentinfo of type data. In addition it | ||
| 1009 | contains a MAC which is a kind of password protected digest to preserve | ||
| 1010 | integrity (so any unencrypted stuff below can't be tampered with). | ||
| 1011 | |||
| 1012 | The reason for these levels is so various objects can be encrypted in various | ||
| 1013 | ways. For example you might want to encrypt a set of private keys with | ||
| 1014 | triple-DES and then include the related certificates either unencrypted or | ||
| 1015 | with lower encryption. Yes it's the dreaded crypto laws at work again which | ||
| 1016 | allow strong encryption on private keys and only weak encryption on other | ||
| 1017 | stuff. | ||
| 1018 | |||
| 1019 | To build one of these things you turn all certificates and keys into safebags | ||
| 1020 | (with optional attributes). You collect the safebags into (one or more) STACKS | ||
| 1021 | and convert these into authsafes (encrypted or unencrypted). The authsafes | ||
| 1022 | are collected into a STACK and added to a PKCS12 structure. Finally a MAC | ||
| 1023 | inserted. | ||
| 1024 | |||
| 1025 | Pulling one apart is basically the reverse process. The MAC is verified against | ||
| 1026 | the given password. The authsafes are extracted and each authsafe split into | ||
| 1027 | a set of safebags (possibly involving decryption). Finally the safebags are | ||
| 1028 | decomposed into the original keys and certificates and the attributes used to | ||
| 1029 | match up private key and certificate pairs. | ||
| 1030 | |||
| 1031 | Anyway here are the functions that do the dirty work. | ||
| 1032 | |||
| 1033 | 1. Construction functions. | ||
| 1034 | |||
| 1035 | 1.1 Safebag functions. | ||
| 1036 | |||
| 1037 | M_PKCS12_x5092certbag(x509) | ||
| 1038 | |||
| 1039 | This macro takes an X509 structure and returns a certificate bag. The | ||
| 1040 | X509 structure can be freed up after calling this function. | ||
| 1041 | |||
| 1042 | M_PKCS12_x509crl2certbag(crl) | ||
| 1043 | |||
| 1044 | As above but for a CRL. | ||
| 1045 | |||
| 1046 | PKCS8_PRIV_KEY_INFO *PKEY2PKCS8(EVP_PKEY *pkey) | ||
| 1047 | |||
| 1048 | Take a private key and convert it into a PKCS#8 PrivateKeyInfo structure. | ||
| 1049 | Works for both RSA and DSA private keys. NB since the PKCS#8 PrivateKeyInfo | ||
| 1050 | structure contains a private key data in plain text form it should be free'd | ||
| 1051 | up as soon as it has been encrypted for security reasons (freeing up the | ||
| 1052 | structure zeros out the sensitive data). This can be done with | ||
| 1053 | PKCS8_PRIV_KEY_INFO_free(). | ||
| 1054 | |||
| 1055 | PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage) | ||
| 1056 | |||
| 1057 | This sets the key type when a key is imported into MSIE or Outlook 98. Two | ||
| 1058 | values are currently supported: KEY_EX and KEY_SIG. KEY_EX is an exchange type | ||
| 1059 | key that can also be used for signing but its size is limited in the export | ||
| 1060 | versions of MS software to 512 bits, it is also the default. KEY_SIG is a | ||
| 1061 | signing only key but the keysize is unlimited (well 16K is supposed to work). | ||
| 1062 | If you are using the domestic version of MSIE then you can ignore this because | ||
| 1063 | KEY_EX is not limited and can be used for both. | ||
| 1064 | |||
| 1065 | PKCS12_SAFEBAG *PKCS12_MAKE_KEYBAG(PKCS8_PRIV_KEY_INFO *p8) | ||
| 1066 | |||
| 1067 | Convert a PKCS8 private key structure into a keybag. This routine embeds the | ||
| 1068 | p8 structure in the keybag so p8 should not be freed up or used after it is | ||
| 1069 | called. The p8 structure will be freed up when the safebag is freed. | ||
| 1070 | |||
| 1071 | PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8) | ||
| 1072 | |||
| 1073 | Convert a PKCS#8 structure into a shrouded key bag (encrypted). p8 is not | ||
| 1074 | embedded and can be freed up after use. | ||
| 1075 | |||
| 1076 | int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen) | ||
| 1077 | int PKCS12_add_friendlyname(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen) | ||
| 1078 | |||
| 1079 | Add a local key id or a friendlyname to a safebag. | ||
| 1080 | |||
| 1081 | 1.2 Authsafe functions. | ||
| 1082 | |||
| 1083 | PKCS7 *PKCS12_pack_p7data(STACK *sk) | ||
| 1084 | Take a stack of safebags and convert them into an unencrypted authsafe. The | ||
| 1085 | stack of safebags can be freed up after calling this function. | ||
| 1086 | |||
| 1087 | PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, STACK *bags); | ||
| 1088 | |||
| 1089 | As above but encrypted. | ||
| 1090 | |||
| 1091 | 1.3 PKCS12 functions. | ||
| 1092 | |||
| 1093 | PKCS12 *PKCS12_init(int mode) | ||
| 1094 | |||
| 1095 | Initialise a PKCS12 structure (currently mode should be NID_pkcs7_data). | ||
| 1096 | |||
| 1097 | M_PKCS12_pack_authsafes(p12, safes) | ||
| 1098 | |||
| 1099 | This macro takes a STACK of authsafes and adds them to a PKCS#12 structure. | ||
| 1100 | |||
| 1101 | int PKCS12_set_mac(PKCS12 *p12, unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, EVP_MD *md_type); | ||
| 1102 | |||
| 1103 | Add a MAC to a PKCS12 structure. If EVP_MD is NULL use SHA-1, the spec suggests | ||
| 1104 | that SHA-1 should be used. | ||
| 1105 | |||
| 1106 | 2. Extraction Functions. | ||
| 1107 | |||
| 1108 | 2.1 Safebags. | ||
| 1109 | |||
| 1110 | M_PKCS12_bag_type(bag) | ||
| 1111 | |||
| 1112 | Return the type of "bag". Returns one of the following | ||
| 1113 | |||
| 1114 | NID_keyBag | ||
| 1115 | NID_pkcs8ShroudedKeyBag 7 | ||
| 1116 | NID_certBag 8 | ||
| 1117 | NID_crlBag 9 | ||
| 1118 | NID_secretBag 10 | ||
| 1119 | NID_safeContentsBag 11 | ||
| 1120 | |||
| 1121 | M_PKCS12_cert_bag_type(bag) | ||
| 1122 | |||
| 1123 | Returns type of certificate bag, following are understood. | ||
| 1124 | |||
| 1125 | NID_x509Certificate 14 | ||
| 1126 | NID_sdsiCertificate 15 | ||
| 1127 | |||
| 1128 | M_PKCS12_crl_bag_type(bag) | ||
| 1129 | |||
| 1130 | Returns crl bag type, currently only NID_crlBag is recognised. | ||
| 1131 | |||
| 1132 | M_PKCS12_certbag2x509(bag) | ||
| 1133 | |||
| 1134 | This macro extracts an X509 certificate from a certificate bag. | ||
| 1135 | |||
| 1136 | M_PKCS12_certbag2x509crl(bag) | ||
| 1137 | |||
| 1138 | As above but for a CRL. | ||
| 1139 | |||
| 1140 | EVP_PKEY * PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8) | ||
| 1141 | |||
| 1142 | Extract a private key from a PKCS8 private key info structure. | ||
| 1143 | |||
| 1144 | M_PKCS12_decrypt_skey(bag, pass, passlen) | ||
| 1145 | |||
| 1146 | Decrypt a shrouded key bag and return a PKCS8 private key info structure. | ||
| 1147 | Works with both RSA and DSA keys | ||
| 1148 | |||
| 1149 | char *PKCS12_get_friendlyname(bag) | ||
| 1150 | |||
| 1151 | Returns the friendlyName of a bag if present or NULL if none. The returned | ||
| 1152 | string is a null terminated ASCII string allocated with Malloc(). It should | ||
| 1153 | thus be freed up with Free() after use. | ||
| 1154 | |||
| 1155 | 2.2 AuthSafe functions. | ||
| 1156 | |||
| 1157 | M_PKCS12_unpack_p7data(p7) | ||
| 1158 | |||
| 1159 | Extract a STACK of safe bags from a PKCS#7 data ContentInfo. | ||
| 1160 | |||
| 1161 | #define M_PKCS12_unpack_p7encdata(p7, pass, passlen) | ||
| 1162 | |||
| 1163 | As above but for an encrypted content info. | ||
| 1164 | |||
| 1165 | 2.3 PKCS12 functions. | ||
| 1166 | |||
| 1167 | M_PKCS12_unpack_authsafes(p12) | ||
| 1168 | |||
| 1169 | Extract a STACK of authsafes from a PKCS12 structure. | ||
| 1170 | |||
| 1171 | M_PKCS12_mac_present(p12) | ||
| 1172 | |||
| 1173 | Check to see if a MAC is present. | ||
| 1174 | |||
| 1175 | int PKCS12_verify_mac(PKCS12 *p12, unsigned char *pass, int passlen) | ||
| 1176 | |||
| 1177 | Verify a MAC on a PKCS12 structure. Returns an error if MAC not present. | ||
| 1178 | |||
| 1179 | |||
| 1180 | Notes. | ||
| 1181 | |||
| 1182 | 1. All the function return 0 or NULL on error. | ||
| 1183 | 2. Encryption based functions take a common set of parameters. These are | ||
| 1184 | described below. | ||
| 1185 | |||
| 1186 | pass, passlen | ||
| 1187 | ASCII password and length. The password on the MAC is called the "integrity | ||
| 1188 | password" the encryption password is called the "privacy password" in the | ||
| 1189 | PKCS#12 documentation. The passwords do not have to be the same. If -1 is | ||
| 1190 | passed for the length it is worked out by the function itself (currently | ||
| 1191 | this is sometimes done whatever is passed as the length but that may change). | ||
| 1192 | |||
| 1193 | salt, saltlen | ||
| 1194 | A 'salt' if salt is NULL a random salt is used. If saltlen is also zero a | ||
| 1195 | default length is used. | ||
| 1196 | |||
| 1197 | iter | ||
| 1198 | Iteration count. This is a measure of how many times an internal function is | ||
| 1199 | called to encrypt the data. The larger this value is the longer it takes, it | ||
| 1200 | makes dictionary attacks on passwords harder. NOTE: Some implementations do | ||
| 1201 | not support an iteration count on the MAC. If the password for the MAC and | ||
| 1202 | encryption is the same then there is no point in having a high iteration | ||
| 1203 | count for encryption if the MAC has no count. The MAC could be attacked | ||
| 1204 | and the password used for the main decryption. | ||
| 1205 | |||
| 1206 | pbe_nid | ||
| 1207 | This is the NID of the password based encryption method used. The following are | ||
| 1208 | supported. | ||
| 1209 | NID_pbe_WithSHA1And128BitRC4 | ||
| 1210 | NID_pbe_WithSHA1And40BitRC4 | ||
| 1211 | NID_pbe_WithSHA1And3_Key_TripleDES_CBC | ||
| 1212 | NID_pbe_WithSHA1And2_Key_TripleDES_CBC | ||
| 1213 | NID_pbe_WithSHA1And128BitRC2_CBC | ||
| 1214 | NID_pbe_WithSHA1And40BitRC2_CBC | ||
| 1215 | |||
| 1216 | Which you use depends on the implementation you are exporting to. "Export | ||
| 1217 | grade" (i.e. cryptographically challenged) products cannot support all | ||
| 1218 | algorithms. Typically you may be able to use any encryption on shrouded key | ||
| 1219 | bags but they must then be placed in an unencrypted authsafe. Other authsafes | ||
| 1220 | may only support 40bit encryption. Of course if you are using SSLeay | ||
| 1221 | throughout you can strongly encrypt everything and have high iteration counts | ||
| 1222 | on everything. | ||
| 1223 | |||
| 1224 | 3. For decryption routines only the password and length are needed. | ||
| 1225 | |||
| 1226 | 4. Unlike the external version the nid's of objects are the values of the | ||
| 1227 | constants: that is NID_certBag is the real nid, therefore there is no | ||
| 1228 | PKCS12_obj_offset() function. Note the object constants are not the same as | ||
| 1229 | those of the external version. If you use these constants then you will need | ||
| 1230 | to recompile your code. | ||
| 1231 | |||
| 1232 | 5. With the exception of PKCS12_MAKE_KEYBAG(), after calling any function or | ||
| 1233 | macro of the form PKCS12_MAKE_SOMETHING(other) the "other" structure can be | ||
| 1234 | reused or freed up safely. | ||
| 1235 | |||
diff --git a/src/lib/libssl/doc/standards.txt b/src/lib/libssl/doc/standards.txt deleted file mode 100644 index 61ccc5d7e0..0000000000 --- a/src/lib/libssl/doc/standards.txt +++ /dev/null | |||
| @@ -1,121 +0,0 @@ | |||
| 1 | Standards related to OpenSSL | ||
| 2 | ============================ | ||
| 3 | |||
| 4 | [Please, this is currently a draft. I made a first try at finding | ||
| 5 | documents that describe parts of what OpenSSL implements. There are | ||
| 6 | big gaps, and I've most certainly done something wrong. Please | ||
| 7 | correct whatever is... Also, this note should be removed when this | ||
| 8 | file is reaching a somewhat correct state. -- Richard Levitte] | ||
| 9 | |||
| 10 | |||
| 11 | All pointers in here will be either URL's or blobs of text borrowed | ||
| 12 | from miscellaneous indexes, like rfc-index.txt (index of RFCs), | ||
| 13 | 1id-index.txt (index of Internet drafts) and the like. | ||
| 14 | |||
| 15 | To find the latest possible RFCs, it's recommended to either browse | ||
| 16 | ftp://ftp.isi.edu/in-notes/ or go to http://www.rfc-editor.org/ and | ||
| 17 | use the search mechanism found there. | ||
| 18 | To find the latest possible Internet drafts, it's recommended to | ||
| 19 | browse ftp://ftp.isi.edu/internet-drafts/. | ||
| 20 | To find the latest possible PKCS, it's recommended to browse | ||
| 21 | http://www.rsasecurity.com/rsalabs/pkcs/. | ||
| 22 | |||
| 23 | |||
| 24 | Implemented: | ||
| 25 | ------------ | ||
| 26 | |||
| 27 | These are documents that describe things that are implemented in OpenSSL. | ||
| 28 | |||
| 29 | 1319 The MD2 Message-Digest Algorithm. B. Kaliski. April 1992. | ||
| 30 | (Format: TXT=25661 bytes) (Status: INFORMATIONAL) | ||
| 31 | |||
| 32 | 1320 The MD4 Message-Digest Algorithm. R. Rivest. April 1992. (Format: | ||
| 33 | TXT=32407 bytes) (Status: INFORMATIONAL) | ||
| 34 | |||
| 35 | 1321 The MD5 Message-Digest Algorithm. R. Rivest. April 1992. (Format: | ||
| 36 | TXT=35222 bytes) (Status: INFORMATIONAL) | ||
| 37 | |||
| 38 | 2246 The TLS Protocol Version 1.0. T. Dierks, C. Allen. January 1999. | ||
| 39 | (Format: TXT=170401 bytes) (Status: PROPOSED STANDARD) | ||
| 40 | |||
| 41 | 2268 A Description of the RC2(r) Encryption Algorithm. R. Rivest. | ||
| 42 | January 1998. (Format: TXT=19048 bytes) (Status: INFORMATIONAL) | ||
| 43 | |||
| 44 | 2314 PKCS 10: Certification Request Syntax Version 1.5. B. Kaliski. | ||
| 45 | March 1998. (Format: TXT=15814 bytes) (Status: INFORMATIONAL) | ||
| 46 | |||
| 47 | 2315 PKCS 7: Cryptographic Message Syntax Version 1.5. B. Kaliski. | ||
| 48 | March 1998. (Format: TXT=69679 bytes) (Status: INFORMATIONAL) | ||
| 49 | |||
| 50 | 2437 PKCS #1: RSA Cryptography Specifications Version 2.0. B. Kaliski, | ||
| 51 | J. Staddon. October 1998. (Format: TXT=73529 bytes) (Obsoletes | ||
| 52 | RFC2313) (Status: INFORMATIONAL) | ||
| 53 | |||
| 54 | 2459 Internet X.509 Public Key Infrastructure Certificate and CRL | ||
| 55 | Profile. R. Housley, W. Ford, W. Polk, D. Solo. January 1999. | ||
| 56 | (Format: TXT=278438 bytes) (Status: PROPOSED STANDARD) | ||
| 57 | |||
| 58 | PKCS#8: Private-Key Information Syntax Standard | ||
| 59 | |||
| 60 | PKCS#12: Personal Information Exchange Syntax Standard, version 1.0. | ||
| 61 | |||
| 62 | |||
| 63 | Related: | ||
| 64 | -------- | ||
| 65 | |||
| 66 | These are documents that are close to OpenSSL, for example the | ||
| 67 | STARTTLS documents. | ||
| 68 | |||
| 69 | 1421 Privacy Enhancement for Internet Electronic Mail: Part I: Message | ||
| 70 | Encryption and Authentication Procedures. J. Linn. February 1993. | ||
| 71 | (Format: TXT=103894 bytes) (Obsoletes RFC1113) (Status: PROPOSED | ||
| 72 | STANDARD) | ||
| 73 | |||
| 74 | 1422 Privacy Enhancement for Internet Electronic Mail: Part II: | ||
| 75 | Certificate-Based Key Management. S. Kent. February 1993. (Format: | ||
| 76 | TXT=86085 bytes) (Obsoletes RFC1114) (Status: PROPOSED STANDARD) | ||
| 77 | |||
| 78 | 1423 Privacy Enhancement for Internet Electronic Mail: Part III: | ||
| 79 | Algorithms, Modes, and Identifiers. D. Balenson. February 1993. | ||
| 80 | (Format: TXT=33277 bytes) (Obsoletes RFC1115) (Status: PROPOSED | ||
| 81 | STANDARD) | ||
| 82 | |||
| 83 | 1424 Privacy Enhancement for Internet Electronic Mail: Part IV: Key | ||
| 84 | Certification and Related Services. B. Kaliski. February 1993. | ||
| 85 | (Format: TXT=17537 bytes) (Status: PROPOSED STANDARD) | ||
| 86 | |||
| 87 | 2487 SMTP Service Extension for Secure SMTP over TLS. P. Hoffman. | ||
| 88 | January 1999. (Format: TXT=15120 bytes) (Status: PROPOSED STANDARD) | ||
| 89 | |||
| 90 | 2585 Internet X.509 Public Key Infrastructure Operational Protocols: | ||
| 91 | FTP and HTTP. R. Housley, P. Hoffman. May 1999. (Format: TXT=14813 | ||
| 92 | bytes) (Status: PROPOSED STANDARD) | ||
| 93 | |||
| 94 | 2595 Using TLS with IMAP, POP3 and ACAP. C. Newman. June 1999. | ||
| 95 | (Format: TXT=32440 bytes) (Status: PROPOSED STANDARD) | ||
| 96 | |||
| 97 | 2712 Addition of Kerberos Cipher Suites to Transport Layer Security | ||
| 98 | (TLS). A. Medvinsky, M. Hur. October 1999. (Format: TXT=13763 bytes) | ||
| 99 | (Status: PROPOSED STANDARD) | ||
| 100 | |||
| 101 | 2817 Upgrading to TLS Within HTTP/1.1. R. Khare, S. Lawrence. May | ||
| 102 | 2000. (Format: TXT=27598 bytes) (Updates RFC2616) (Status: PROPOSED | ||
| 103 | STANDARD) | ||
| 104 | |||
| 105 | 2818 HTTP Over TLS. E. Rescorla. May 2000. (Format: TXT=15170 bytes) | ||
| 106 | (Status: INFORMATIONAL) | ||
| 107 | |||
| 108 | "Securing FTP with TLS", 01/27/2000, <draft-murray-auth-ftp-ssl-05.txt> | ||
| 109 | |||
| 110 | |||
| 111 | To be implemented: | ||
| 112 | ------------------ | ||
| 113 | |||
| 114 | These are documents that describe things that are planed to be | ||
| 115 | implemented in the hopefully short future. | ||
| 116 | |||
| 117 | 2560 X.509 Internet Public Key Infrastructure Online Certificate | ||
| 118 | Status Protocol - OCSP. M. Myers, R. Ankney, A. Malpani, S. Galperin, | ||
| 119 | C. Adams. June 1999. (Format: TXT=43243 bytes) (Status: PROPOSED | ||
| 120 | STANDARD) | ||
| 121 | |||
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c deleted file mode 100644 index 5050a13ef2..0000000000 --- a/src/lib/libssl/s23_clnt.c +++ /dev/null | |||
| @@ -1,475 +0,0 @@ | |||
| 1 | /* ssl/s23_clnt.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/buffer.h> | ||
| 61 | #include <openssl/rand.h> | ||
| 62 | #include <openssl/objects.h> | ||
| 63 | #include <openssl/evp.h> | ||
| 64 | #include "ssl_locl.h" | ||
| 65 | |||
| 66 | static SSL_METHOD *ssl23_get_client_method(int ver); | ||
| 67 | static int ssl23_client_hello(SSL *s); | ||
| 68 | static int ssl23_get_server_hello(SSL *s); | ||
| 69 | static SSL_METHOD *ssl23_get_client_method(int ver) | ||
| 70 | { | ||
| 71 | #ifndef NO_SSL2 | ||
| 72 | if (ver == SSL2_VERSION) | ||
| 73 | return(SSLv2_client_method()); | ||
| 74 | #endif | ||
| 75 | if (ver == SSL3_VERSION) | ||
| 76 | return(SSLv3_client_method()); | ||
| 77 | else if (ver == TLS1_VERSION) | ||
| 78 | return(TLSv1_client_method()); | ||
| 79 | else | ||
| 80 | return(NULL); | ||
| 81 | } | ||
| 82 | |||
| 83 | SSL_METHOD *SSLv23_client_method(void) | ||
| 84 | { | ||
| 85 | static int init=1; | ||
| 86 | static SSL_METHOD SSLv23_client_data; | ||
| 87 | |||
| 88 | if (init) | ||
| 89 | { | ||
| 90 | memcpy((char *)&SSLv23_client_data, | ||
| 91 | (char *)sslv23_base_method(),sizeof(SSL_METHOD)); | ||
| 92 | SSLv23_client_data.ssl_connect=ssl23_connect; | ||
| 93 | SSLv23_client_data.get_ssl_method=ssl23_get_client_method; | ||
| 94 | init=0; | ||
| 95 | } | ||
| 96 | return(&SSLv23_client_data); | ||
| 97 | } | ||
| 98 | |||
| 99 | int ssl23_connect(SSL *s) | ||
| 100 | { | ||
| 101 | BUF_MEM *buf; | ||
| 102 | unsigned long Time=time(NULL); | ||
| 103 | void (*cb)()=NULL; | ||
| 104 | int ret= -1; | ||
| 105 | int new_state,state; | ||
| 106 | |||
| 107 | RAND_add(&Time,sizeof(Time),0); | ||
| 108 | ERR_clear_error(); | ||
| 109 | clear_sys_error(); | ||
| 110 | |||
| 111 | if (s->info_callback != NULL) | ||
| 112 | cb=s->info_callback; | ||
| 113 | else if (s->ctx->info_callback != NULL) | ||
| 114 | cb=s->ctx->info_callback; | ||
| 115 | |||
| 116 | if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); | ||
| 117 | s->in_handshake++; | ||
| 118 | |||
| 119 | for (;;) | ||
| 120 | { | ||
| 121 | state=s->state; | ||
| 122 | |||
| 123 | switch(s->state) | ||
| 124 | { | ||
| 125 | case SSL_ST_BEFORE: | ||
| 126 | case SSL_ST_CONNECT: | ||
| 127 | case SSL_ST_BEFORE|SSL_ST_CONNECT: | ||
| 128 | case SSL_ST_OK|SSL_ST_CONNECT: | ||
| 129 | |||
| 130 | if (s->session != NULL) | ||
| 131 | { | ||
| 132 | SSLerr(SSL_F_SSL23_CONNECT,SSL_R_SSL23_DOING_SESSION_ID_REUSE); | ||
| 133 | ret= -1; | ||
| 134 | goto end; | ||
| 135 | } | ||
| 136 | s->server=0; | ||
| 137 | if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1); | ||
| 138 | |||
| 139 | /* s->version=TLS1_VERSION; */ | ||
| 140 | s->type=SSL_ST_CONNECT; | ||
| 141 | |||
| 142 | if (s->init_buf == NULL) | ||
| 143 | { | ||
| 144 | if ((buf=BUF_MEM_new()) == NULL) | ||
| 145 | { | ||
| 146 | ret= -1; | ||
| 147 | goto end; | ||
| 148 | } | ||
| 149 | if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH)) | ||
| 150 | { | ||
| 151 | ret= -1; | ||
| 152 | goto end; | ||
| 153 | } | ||
| 154 | s->init_buf=buf; | ||
| 155 | } | ||
| 156 | |||
| 157 | if (!ssl3_setup_buffers(s)) { ret= -1; goto end; } | ||
| 158 | |||
| 159 | ssl3_init_finished_mac(s); | ||
| 160 | |||
| 161 | s->state=SSL23_ST_CW_CLNT_HELLO_A; | ||
| 162 | s->ctx->stats.sess_connect++; | ||
| 163 | s->init_num=0; | ||
| 164 | break; | ||
| 165 | |||
| 166 | case SSL23_ST_CW_CLNT_HELLO_A: | ||
| 167 | case SSL23_ST_CW_CLNT_HELLO_B: | ||
| 168 | |||
| 169 | s->shutdown=0; | ||
| 170 | ret=ssl23_client_hello(s); | ||
| 171 | if (ret <= 0) goto end; | ||
| 172 | s->state=SSL23_ST_CR_SRVR_HELLO_A; | ||
| 173 | s->init_num=0; | ||
| 174 | |||
| 175 | break; | ||
| 176 | |||
| 177 | case SSL23_ST_CR_SRVR_HELLO_A: | ||
| 178 | case SSL23_ST_CR_SRVR_HELLO_B: | ||
| 179 | ret=ssl23_get_server_hello(s); | ||
| 180 | if (ret >= 0) cb=NULL; | ||
| 181 | goto end; | ||
| 182 | /* break; */ | ||
| 183 | |||
| 184 | default: | ||
| 185 | SSLerr(SSL_F_SSL23_CONNECT,SSL_R_UNKNOWN_STATE); | ||
| 186 | ret= -1; | ||
| 187 | goto end; | ||
| 188 | /* break; */ | ||
| 189 | } | ||
| 190 | |||
| 191 | if (s->debug) { (void)BIO_flush(s->wbio); } | ||
| 192 | |||
| 193 | if ((cb != NULL) && (s->state != state)) | ||
| 194 | { | ||
| 195 | new_state=s->state; | ||
| 196 | s->state=state; | ||
| 197 | cb(s,SSL_CB_CONNECT_LOOP,1); | ||
| 198 | s->state=new_state; | ||
| 199 | } | ||
| 200 | } | ||
| 201 | end: | ||
| 202 | s->in_handshake--; | ||
| 203 | if (cb != NULL) | ||
| 204 | cb(s,SSL_CB_CONNECT_EXIT,ret); | ||
| 205 | return(ret); | ||
| 206 | } | ||
| 207 | |||
| 208 | |||
| 209 | static int ssl23_client_hello(SSL *s) | ||
| 210 | { | ||
| 211 | unsigned char *buf; | ||
| 212 | unsigned char *p,*d; | ||
| 213 | int i,ch_len; | ||
| 214 | |||
| 215 | buf=(unsigned char *)s->init_buf->data; | ||
| 216 | if (s->state == SSL23_ST_CW_CLNT_HELLO_A) | ||
| 217 | { | ||
| 218 | #if 0 | ||
| 219 | /* don't reuse session-id's */ | ||
| 220 | if (!ssl_get_new_session(s,0)) | ||
| 221 | { | ||
| 222 | return(-1); | ||
| 223 | } | ||
| 224 | #endif | ||
| 225 | |||
| 226 | p=s->s3->client_random; | ||
| 227 | RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE); | ||
| 228 | |||
| 229 | /* Do the message type and length last */ | ||
| 230 | d= &(buf[2]); | ||
| 231 | p=d+9; | ||
| 232 | |||
| 233 | *(d++)=SSL2_MT_CLIENT_HELLO; | ||
| 234 | if (!(s->options & SSL_OP_NO_TLSv1)) | ||
| 235 | { | ||
| 236 | *(d++)=TLS1_VERSION_MAJOR; | ||
| 237 | *(d++)=TLS1_VERSION_MINOR; | ||
| 238 | s->client_version=TLS1_VERSION; | ||
| 239 | } | ||
| 240 | else if (!(s->options & SSL_OP_NO_SSLv3)) | ||
| 241 | { | ||
| 242 | *(d++)=SSL3_VERSION_MAJOR; | ||
| 243 | *(d++)=SSL3_VERSION_MINOR; | ||
| 244 | s->client_version=SSL3_VERSION; | ||
| 245 | } | ||
| 246 | else if (!(s->options & SSL_OP_NO_SSLv2)) | ||
| 247 | { | ||
| 248 | *(d++)=SSL2_VERSION_MAJOR; | ||
| 249 | *(d++)=SSL2_VERSION_MINOR; | ||
| 250 | s->client_version=SSL2_VERSION; | ||
| 251 | } | ||
| 252 | else | ||
| 253 | { | ||
| 254 | SSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_PROTOCOLS_AVAILABLE); | ||
| 255 | return(-1); | ||
| 256 | } | ||
| 257 | |||
| 258 | /* Ciphers supported */ | ||
| 259 | i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),p); | ||
| 260 | if (i == 0) | ||
| 261 | { | ||
| 262 | /* no ciphers */ | ||
| 263 | SSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE); | ||
| 264 | return(-1); | ||
| 265 | } | ||
| 266 | s2n(i,d); | ||
| 267 | p+=i; | ||
| 268 | |||
| 269 | /* put in the session-id, zero since there is no | ||
| 270 | * reuse. */ | ||
| 271 | #if 0 | ||
| 272 | s->session->session_id_length=0; | ||
| 273 | #endif | ||
| 274 | s2n(0,d); | ||
| 275 | |||
| 276 | if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG) | ||
| 277 | ch_len=SSL2_CHALLENGE_LENGTH; | ||
| 278 | else | ||
| 279 | ch_len=SSL2_MAX_CHALLENGE_LENGTH; | ||
| 280 | |||
| 281 | /* write out sslv2 challenge */ | ||
| 282 | if (SSL3_RANDOM_SIZE < ch_len) | ||
| 283 | i=SSL3_RANDOM_SIZE; | ||
| 284 | else | ||
| 285 | i=ch_len; | ||
| 286 | s2n(i,d); | ||
| 287 | memset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE); | ||
| 288 | RAND_pseudo_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i); | ||
| 289 | memcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i); | ||
| 290 | p+=i; | ||
| 291 | |||
| 292 | i= p- &(buf[2]); | ||
| 293 | buf[0]=((i>>8)&0xff)|0x80; | ||
| 294 | buf[1]=(i&0xff); | ||
| 295 | |||
| 296 | s->state=SSL23_ST_CW_CLNT_HELLO_B; | ||
| 297 | /* number of bytes to write */ | ||
| 298 | s->init_num=i+2; | ||
| 299 | s->init_off=0; | ||
| 300 | |||
| 301 | ssl3_finish_mac(s,&(buf[2]),i); | ||
| 302 | } | ||
| 303 | |||
| 304 | /* SSL3_ST_CW_CLNT_HELLO_B */ | ||
| 305 | return(ssl23_write_bytes(s)); | ||
| 306 | } | ||
| 307 | |||
| 308 | static int ssl23_get_server_hello(SSL *s) | ||
| 309 | { | ||
| 310 | char buf[8]; | ||
| 311 | unsigned char *p; | ||
| 312 | int i; | ||
| 313 | int n; | ||
| 314 | |||
| 315 | n=ssl23_read_bytes(s,7); | ||
| 316 | |||
| 317 | if (n != 7) return(n); | ||
| 318 | p=s->packet; | ||
| 319 | |||
| 320 | memcpy(buf,p,n); | ||
| 321 | |||
| 322 | if ((p[0] & 0x80) && (p[2] == SSL2_MT_SERVER_HELLO) && | ||
| 323 | (p[5] == 0x00) && (p[6] == 0x02)) | ||
| 324 | { | ||
| 325 | #ifdef NO_SSL2 | ||
| 326 | SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); | ||
| 327 | goto err; | ||
| 328 | #else | ||
| 329 | /* we are talking sslv2 */ | ||
| 330 | /* we need to clean up the SSLv3 setup and put in the | ||
| 331 | * sslv2 stuff. */ | ||
| 332 | int ch_len; | ||
| 333 | |||
| 334 | if (s->options & SSL_OP_NO_SSLv2) | ||
| 335 | { | ||
| 336 | SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); | ||
| 337 | goto err; | ||
| 338 | } | ||
| 339 | if (s->s2 == NULL) | ||
| 340 | { | ||
| 341 | if (!ssl2_new(s)) | ||
| 342 | goto err; | ||
| 343 | } | ||
| 344 | else | ||
| 345 | ssl2_clear(s); | ||
| 346 | |||
| 347 | if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG) | ||
| 348 | ch_len=SSL2_CHALLENGE_LENGTH; | ||
| 349 | else | ||
| 350 | ch_len=SSL2_MAX_CHALLENGE_LENGTH; | ||
| 351 | |||
| 352 | /* write out sslv2 challenge */ | ||
| 353 | i=(SSL3_RANDOM_SIZE < ch_len) | ||
| 354 | ?SSL3_RANDOM_SIZE:ch_len; | ||
| 355 | s->s2->challenge_length=i; | ||
| 356 | memcpy(s->s2->challenge, | ||
| 357 | &(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i); | ||
| 358 | |||
| 359 | if (s->s3 != NULL) ssl3_free(s); | ||
| 360 | |||
| 361 | if (!BUF_MEM_grow(s->init_buf, | ||
| 362 | SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)) | ||
| 363 | { | ||
| 364 | SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,ERR_R_BUF_LIB); | ||
| 365 | goto err; | ||
| 366 | } | ||
| 367 | |||
| 368 | s->state=SSL2_ST_GET_SERVER_HELLO_A; | ||
| 369 | if (!(s->client_version == SSL2_VERSION)) | ||
| 370 | /* use special padding (SSL 3.0 draft/RFC 2246, App. E.2) */ | ||
| 371 | s->s2->ssl2_rollback=1; | ||
| 372 | |||
| 373 | /* setup the 5 bytes we have read so we get them from | ||
| 374 | * the sslv2 buffer */ | ||
| 375 | s->rstate=SSL_ST_READ_HEADER; | ||
| 376 | s->packet_length=n; | ||
| 377 | s->packet= &(s->s2->rbuf[0]); | ||
| 378 | memcpy(s->packet,buf,n); | ||
| 379 | s->s2->rbuf_left=n; | ||
| 380 | s->s2->rbuf_offs=0; | ||
| 381 | |||
| 382 | /* we have already written one */ | ||
| 383 | s->s2->write_sequence=1; | ||
| 384 | |||
| 385 | s->method=SSLv2_client_method(); | ||
| 386 | s->handshake_func=s->method->ssl_connect; | ||
| 387 | #endif | ||
| 388 | } | ||
| 389 | else if ((p[0] == SSL3_RT_HANDSHAKE) && | ||
| 390 | (p[1] == SSL3_VERSION_MAJOR) && | ||
| 391 | ((p[2] == SSL3_VERSION_MINOR) || | ||
| 392 | (p[2] == TLS1_VERSION_MINOR)) && | ||
| 393 | (p[5] == SSL3_MT_SERVER_HELLO)) | ||
| 394 | { | ||
| 395 | /* we have sslv3 or tls1 */ | ||
| 396 | |||
| 397 | if (!ssl_init_wbio_buffer(s,1)) goto err; | ||
| 398 | |||
| 399 | /* we are in this state */ | ||
| 400 | s->state=SSL3_ST_CR_SRVR_HELLO_A; | ||
| 401 | |||
| 402 | /* put the 5 bytes we have read into the input buffer | ||
| 403 | * for SSLv3 */ | ||
| 404 | s->rstate=SSL_ST_READ_HEADER; | ||
| 405 | s->packet_length=n; | ||
| 406 | s->packet= &(s->s3->rbuf.buf[0]); | ||
| 407 | memcpy(s->packet,buf,n); | ||
| 408 | s->s3->rbuf.left=n; | ||
| 409 | s->s3->rbuf.offset=0; | ||
| 410 | |||
| 411 | if ((p[2] == SSL3_VERSION_MINOR) && | ||
| 412 | !(s->options & SSL_OP_NO_SSLv3)) | ||
| 413 | { | ||
| 414 | s->version=SSL3_VERSION; | ||
| 415 | s->method=SSLv3_client_method(); | ||
| 416 | } | ||
| 417 | else if ((p[2] == TLS1_VERSION_MINOR) && | ||
| 418 | !(s->options & SSL_OP_NO_TLSv1)) | ||
| 419 | { | ||
| 420 | s->version=TLS1_VERSION; | ||
| 421 | s->method=TLSv1_client_method(); | ||
| 422 | } | ||
| 423 | else | ||
| 424 | { | ||
| 425 | SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); | ||
| 426 | goto err; | ||
| 427 | } | ||
| 428 | |||
| 429 | s->handshake_func=s->method->ssl_connect; | ||
| 430 | } | ||
| 431 | else if ((p[0] == SSL3_RT_ALERT) && | ||
| 432 | (p[1] == SSL3_VERSION_MAJOR) && | ||
| 433 | ((p[2] == SSL3_VERSION_MINOR) || | ||
| 434 | (p[2] == TLS1_VERSION_MINOR)) && | ||
| 435 | (p[3] == 0) && | ||
| 436 | (p[4] == 2)) | ||
| 437 | { | ||
| 438 | void (*cb)()=NULL; | ||
| 439 | int j; | ||
| 440 | |||
| 441 | /* An alert */ | ||
| 442 | if (s->info_callback != NULL) | ||
| 443 | cb=s->info_callback; | ||
| 444 | else if (s->ctx->info_callback != NULL) | ||
| 445 | cb=s->ctx->info_callback; | ||
| 446 | |||
| 447 | i=p[5]; | ||
| 448 | if (cb != NULL) | ||
| 449 | { | ||
| 450 | j=(i<<8)|p[6]; | ||
| 451 | cb(s,SSL_CB_READ_ALERT,j); | ||
| 452 | } | ||
| 453 | |||
| 454 | s->rwstate=SSL_NOTHING; | ||
| 455 | SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_AD_REASON_OFFSET+p[6]); | ||
| 456 | goto err; | ||
| 457 | } | ||
| 458 | else | ||
| 459 | { | ||
| 460 | SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNKNOWN_PROTOCOL); | ||
| 461 | goto err; | ||
| 462 | } | ||
| 463 | s->init_num=0; | ||
| 464 | |||
| 465 | /* Since, if we are sending a ssl23 client hello, we are not | ||
| 466 | * reusing a session-id */ | ||
| 467 | if (!ssl_get_new_session(s,0)) | ||
| 468 | goto err; | ||
| 469 | |||
| 470 | s->first_packet=1; | ||
| 471 | return(SSL_connect(s)); | ||
| 472 | err: | ||
| 473 | return(-1); | ||
| 474 | } | ||
| 475 | |||
diff --git a/src/lib/libssl/s23_lib.c b/src/lib/libssl/s23_lib.c deleted file mode 100644 index ad2d8dadf7..0000000000 --- a/src/lib/libssl/s23_lib.c +++ /dev/null | |||
| @@ -1,236 +0,0 @@ | |||
| 1 | /* ssl/s23_lib.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/objects.h> | ||
| 61 | #include "ssl_locl.h" | ||
| 62 | |||
| 63 | static int ssl23_num_ciphers(void ); | ||
| 64 | static SSL_CIPHER *ssl23_get_cipher(unsigned int u); | ||
| 65 | static int ssl23_read(SSL *s, void *buf, int len); | ||
| 66 | static int ssl23_peek(SSL *s, void *buf, int len); | ||
| 67 | static int ssl23_write(SSL *s, const void *buf, int len); | ||
| 68 | static long ssl23_default_timeout(void ); | ||
| 69 | static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p); | ||
| 70 | static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p); | ||
| 71 | const char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT; | ||
| 72 | |||
| 73 | static SSL_METHOD SSLv23_data= { | ||
| 74 | TLS1_VERSION, | ||
| 75 | tls1_new, | ||
| 76 | tls1_clear, | ||
| 77 | tls1_free, | ||
| 78 | ssl_undefined_function, | ||
| 79 | ssl_undefined_function, | ||
| 80 | ssl23_read, | ||
| 81 | ssl23_peek, | ||
| 82 | ssl23_write, | ||
| 83 | ssl_undefined_function, | ||
| 84 | ssl_undefined_function, | ||
| 85 | ssl_ok, | ||
| 86 | ssl3_ctrl, | ||
| 87 | ssl3_ctx_ctrl, | ||
| 88 | ssl23_get_cipher_by_char, | ||
| 89 | ssl23_put_cipher_by_char, | ||
| 90 | ssl_undefined_function, | ||
| 91 | ssl23_num_ciphers, | ||
| 92 | ssl23_get_cipher, | ||
| 93 | ssl_bad_method, | ||
| 94 | ssl23_default_timeout, | ||
| 95 | &ssl3_undef_enc_method, | ||
| 96 | ssl_undefined_function, | ||
| 97 | ssl3_callback_ctrl, | ||
| 98 | ssl3_ctx_callback_ctrl, | ||
| 99 | }; | ||
| 100 | |||
| 101 | static long ssl23_default_timeout(void) | ||
| 102 | { | ||
| 103 | return(300); | ||
| 104 | } | ||
| 105 | |||
| 106 | SSL_METHOD *sslv23_base_method(void) | ||
| 107 | { | ||
| 108 | return(&SSLv23_data); | ||
| 109 | } | ||
| 110 | |||
| 111 | static int ssl23_num_ciphers(void) | ||
| 112 | { | ||
| 113 | return(ssl3_num_ciphers() | ||
| 114 | #ifndef NO_SSL2 | ||
| 115 | + ssl2_num_ciphers() | ||
| 116 | #endif | ||
| 117 | ); | ||
| 118 | } | ||
| 119 | |||
| 120 | static SSL_CIPHER *ssl23_get_cipher(unsigned int u) | ||
| 121 | { | ||
| 122 | unsigned int uu=ssl3_num_ciphers(); | ||
| 123 | |||
| 124 | if (u < uu) | ||
| 125 | return(ssl3_get_cipher(u)); | ||
| 126 | else | ||
| 127 | #ifndef NO_SSL2 | ||
| 128 | return(ssl2_get_cipher(u-uu)); | ||
| 129 | #else | ||
| 130 | return(NULL); | ||
| 131 | #endif | ||
| 132 | } | ||
| 133 | |||
| 134 | /* This function needs to check if the ciphers required are actually | ||
| 135 | * available */ | ||
| 136 | static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p) | ||
| 137 | { | ||
| 138 | SSL_CIPHER c,*cp; | ||
| 139 | unsigned long id; | ||
| 140 | int n; | ||
| 141 | |||
| 142 | n=ssl3_num_ciphers(); | ||
| 143 | id=0x03000000|((unsigned long)p[0]<<16L)| | ||
| 144 | ((unsigned long)p[1]<<8L)|(unsigned long)p[2]; | ||
| 145 | c.id=id; | ||
| 146 | cp=ssl3_get_cipher_by_char(p); | ||
| 147 | #ifndef NO_SSL2 | ||
| 148 | if (cp == NULL) | ||
| 149 | cp=ssl2_get_cipher_by_char(p); | ||
| 150 | #endif | ||
| 151 | return(cp); | ||
| 152 | } | ||
| 153 | |||
| 154 | static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p) | ||
| 155 | { | ||
| 156 | long l; | ||
| 157 | |||
| 158 | /* We can write SSLv2 and SSLv3 ciphers */ | ||
| 159 | if (p != NULL) | ||
| 160 | { | ||
| 161 | l=c->id; | ||
| 162 | p[0]=((unsigned char)(l>>16L))&0xFF; | ||
| 163 | p[1]=((unsigned char)(l>> 8L))&0xFF; | ||
| 164 | p[2]=((unsigned char)(l ))&0xFF; | ||
| 165 | } | ||
| 166 | return(3); | ||
| 167 | } | ||
| 168 | |||
| 169 | static int ssl23_read(SSL *s, void *buf, int len) | ||
| 170 | { | ||
| 171 | int n; | ||
| 172 | |||
| 173 | clear_sys_error(); | ||
| 174 | if (SSL_in_init(s) && (!s->in_handshake)) | ||
| 175 | { | ||
| 176 | n=s->handshake_func(s); | ||
| 177 | if (n < 0) return(n); | ||
| 178 | if (n == 0) | ||
| 179 | { | ||
| 180 | SSLerr(SSL_F_SSL23_READ,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 181 | return(-1); | ||
| 182 | } | ||
| 183 | return(SSL_read(s,buf,len)); | ||
| 184 | } | ||
| 185 | else | ||
| 186 | { | ||
| 187 | ssl_undefined_function(s); | ||
| 188 | return(-1); | ||
| 189 | } | ||
| 190 | } | ||
| 191 | |||
| 192 | static int ssl23_peek(SSL *s, void *buf, int len) | ||
| 193 | { | ||
| 194 | int n; | ||
| 195 | |||
| 196 | clear_sys_error(); | ||
| 197 | if (SSL_in_init(s) && (!s->in_handshake)) | ||
| 198 | { | ||
| 199 | n=s->handshake_func(s); | ||
| 200 | if (n < 0) return(n); | ||
| 201 | if (n == 0) | ||
| 202 | { | ||
| 203 | SSLerr(SSL_F_SSL23_PEEK,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 204 | return(-1); | ||
| 205 | } | ||
| 206 | return(SSL_peek(s,buf,len)); | ||
| 207 | } | ||
| 208 | else | ||
| 209 | { | ||
| 210 | ssl_undefined_function(s); | ||
| 211 | return(-1); | ||
| 212 | } | ||
| 213 | } | ||
| 214 | |||
| 215 | static int ssl23_write(SSL *s, const void *buf, int len) | ||
| 216 | { | ||
| 217 | int n; | ||
| 218 | |||
| 219 | clear_sys_error(); | ||
| 220 | if (SSL_in_init(s) && (!s->in_handshake)) | ||
| 221 | { | ||
| 222 | n=s->handshake_func(s); | ||
| 223 | if (n < 0) return(n); | ||
| 224 | if (n == 0) | ||
| 225 | { | ||
| 226 | SSLerr(SSL_F_SSL23_WRITE,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 227 | return(-1); | ||
| 228 | } | ||
| 229 | return(SSL_write(s,buf,len)); | ||
| 230 | } | ||
| 231 | else | ||
| 232 | { | ||
| 233 | ssl_undefined_function(s); | ||
| 234 | return(-1); | ||
| 235 | } | ||
| 236 | } | ||
diff --git a/src/lib/libssl/s23_pkt.c b/src/lib/libssl/s23_pkt.c deleted file mode 100644 index f45e1ce3d8..0000000000 --- a/src/lib/libssl/s23_pkt.c +++ /dev/null | |||
| @@ -1,117 +0,0 @@ | |||
| 1 | /* ssl/s23_pkt.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <errno.h> | ||
| 61 | #define USE_SOCKETS | ||
| 62 | #include <openssl/evp.h> | ||
| 63 | #include <openssl/buffer.h> | ||
| 64 | #include "ssl_locl.h" | ||
| 65 | |||
| 66 | int ssl23_write_bytes(SSL *s) | ||
| 67 | { | ||
| 68 | int i,num,tot; | ||
| 69 | char *buf; | ||
| 70 | |||
| 71 | buf=s->init_buf->data; | ||
| 72 | tot=s->init_off; | ||
| 73 | num=s->init_num; | ||
| 74 | for (;;) | ||
| 75 | { | ||
| 76 | s->rwstate=SSL_WRITING; | ||
| 77 | i=BIO_write(s->wbio,&(buf[tot]),num); | ||
| 78 | if (i <= 0) | ||
| 79 | { | ||
| 80 | s->init_off=tot; | ||
| 81 | s->init_num=num; | ||
| 82 | return(i); | ||
| 83 | } | ||
| 84 | s->rwstate=SSL_NOTHING; | ||
| 85 | if (i == num) return(tot+i); | ||
| 86 | |||
| 87 | num-=i; | ||
| 88 | tot+=i; | ||
| 89 | } | ||
| 90 | } | ||
| 91 | |||
| 92 | /* return regularly only when we have read (at least) 'n' bytes */ | ||
| 93 | int ssl23_read_bytes(SSL *s, int n) | ||
| 94 | { | ||
| 95 | unsigned char *p; | ||
| 96 | int j; | ||
| 97 | |||
| 98 | if (s->packet_length < (unsigned int)n) | ||
| 99 | { | ||
| 100 | p=s->packet; | ||
| 101 | |||
| 102 | for (;;) | ||
| 103 | { | ||
| 104 | s->rwstate=SSL_READING; | ||
| 105 | j=BIO_read(s->rbio,(char *)&(p[s->packet_length]), | ||
| 106 | n-s->packet_length); | ||
| 107 | if (j <= 0) | ||
| 108 | return(j); | ||
| 109 | s->rwstate=SSL_NOTHING; | ||
| 110 | s->packet_length+=j; | ||
| 111 | if (s->packet_length >= (unsigned int)n) | ||
| 112 | return(s->packet_length); | ||
| 113 | } | ||
| 114 | } | ||
| 115 | return(n); | ||
| 116 | } | ||
| 117 | |||
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c deleted file mode 100644 index 050618235f..0000000000 --- a/src/lib/libssl/s23_srvr.c +++ /dev/null | |||
| @@ -1,576 +0,0 @@ | |||
| 1 | /* ssl/s23_srvr.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/buffer.h> | ||
| 61 | #include <openssl/rand.h> | ||
| 62 | #include <openssl/objects.h> | ||
| 63 | #include <openssl/evp.h> | ||
| 64 | #include "ssl_locl.h" | ||
| 65 | |||
| 66 | static SSL_METHOD *ssl23_get_server_method(int ver); | ||
| 67 | int ssl23_get_client_hello(SSL *s); | ||
| 68 | static SSL_METHOD *ssl23_get_server_method(int ver) | ||
| 69 | { | ||
| 70 | #ifndef NO_SSL2 | ||
| 71 | if (ver == SSL2_VERSION) | ||
| 72 | return(SSLv2_server_method()); | ||
| 73 | #endif | ||
| 74 | if (ver == SSL3_VERSION) | ||
| 75 | return(SSLv3_server_method()); | ||
| 76 | else if (ver == TLS1_VERSION) | ||
| 77 | return(TLSv1_server_method()); | ||
| 78 | else | ||
| 79 | return(NULL); | ||
| 80 | } | ||
| 81 | |||
| 82 | SSL_METHOD *SSLv23_server_method(void) | ||
| 83 | { | ||
| 84 | static int init=1; | ||
| 85 | static SSL_METHOD SSLv23_server_data; | ||
| 86 | |||
| 87 | if (init) | ||
| 88 | { | ||
| 89 | memcpy((char *)&SSLv23_server_data, | ||
| 90 | (char *)sslv23_base_method(),sizeof(SSL_METHOD)); | ||
| 91 | SSLv23_server_data.ssl_accept=ssl23_accept; | ||
| 92 | SSLv23_server_data.get_ssl_method=ssl23_get_server_method; | ||
| 93 | init=0; | ||
| 94 | } | ||
| 95 | return(&SSLv23_server_data); | ||
| 96 | } | ||
| 97 | |||
| 98 | int ssl23_accept(SSL *s) | ||
| 99 | { | ||
| 100 | BUF_MEM *buf; | ||
| 101 | unsigned long Time=time(NULL); | ||
| 102 | void (*cb)()=NULL; | ||
| 103 | int ret= -1; | ||
| 104 | int new_state,state; | ||
| 105 | |||
| 106 | RAND_add(&Time,sizeof(Time),0); | ||
| 107 | ERR_clear_error(); | ||
| 108 | clear_sys_error(); | ||
| 109 | |||
| 110 | if (s->info_callback != NULL) | ||
| 111 | cb=s->info_callback; | ||
| 112 | else if (s->ctx->info_callback != NULL) | ||
| 113 | cb=s->ctx->info_callback; | ||
| 114 | |||
| 115 | if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); | ||
| 116 | s->in_handshake++; | ||
| 117 | |||
| 118 | for (;;) | ||
| 119 | { | ||
| 120 | state=s->state; | ||
| 121 | |||
| 122 | switch(s->state) | ||
| 123 | { | ||
| 124 | case SSL_ST_BEFORE: | ||
| 125 | case SSL_ST_ACCEPT: | ||
| 126 | case SSL_ST_BEFORE|SSL_ST_ACCEPT: | ||
| 127 | case SSL_ST_OK|SSL_ST_ACCEPT: | ||
| 128 | |||
| 129 | s->server=1; | ||
| 130 | if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1); | ||
| 131 | |||
| 132 | /* s->version=SSL3_VERSION; */ | ||
| 133 | s->type=SSL_ST_ACCEPT; | ||
| 134 | |||
| 135 | if (s->init_buf == NULL) | ||
| 136 | { | ||
| 137 | if ((buf=BUF_MEM_new()) == NULL) | ||
| 138 | { | ||
| 139 | ret= -1; | ||
| 140 | goto end; | ||
| 141 | } | ||
| 142 | if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH)) | ||
| 143 | { | ||
| 144 | ret= -1; | ||
| 145 | goto end; | ||
| 146 | } | ||
| 147 | s->init_buf=buf; | ||
| 148 | } | ||
| 149 | |||
| 150 | ssl3_init_finished_mac(s); | ||
| 151 | |||
| 152 | s->state=SSL23_ST_SR_CLNT_HELLO_A; | ||
| 153 | s->ctx->stats.sess_accept++; | ||
| 154 | s->init_num=0; | ||
| 155 | break; | ||
| 156 | |||
| 157 | case SSL23_ST_SR_CLNT_HELLO_A: | ||
| 158 | case SSL23_ST_SR_CLNT_HELLO_B: | ||
| 159 | |||
| 160 | s->shutdown=0; | ||
| 161 | ret=ssl23_get_client_hello(s); | ||
| 162 | if (ret >= 0) cb=NULL; | ||
| 163 | goto end; | ||
| 164 | /* break; */ | ||
| 165 | |||
| 166 | default: | ||
| 167 | SSLerr(SSL_F_SSL23_ACCEPT,SSL_R_UNKNOWN_STATE); | ||
| 168 | ret= -1; | ||
| 169 | goto end; | ||
| 170 | /* break; */ | ||
| 171 | } | ||
| 172 | |||
| 173 | if ((cb != NULL) && (s->state != state)) | ||
| 174 | { | ||
| 175 | new_state=s->state; | ||
| 176 | s->state=state; | ||
| 177 | cb(s,SSL_CB_ACCEPT_LOOP,1); | ||
| 178 | s->state=new_state; | ||
| 179 | } | ||
| 180 | } | ||
| 181 | end: | ||
| 182 | if (cb != NULL) | ||
| 183 | cb(s,SSL_CB_ACCEPT_EXIT,ret); | ||
| 184 | s->in_handshake--; | ||
| 185 | return(ret); | ||
| 186 | } | ||
| 187 | |||
| 188 | |||
| 189 | int ssl23_get_client_hello(SSL *s) | ||
| 190 | { | ||
| 191 | char buf_space[11]; /* Request this many bytes in initial read. | ||
| 192 | * We can detect SSL 3.0/TLS 1.0 Client Hellos | ||
| 193 | * ('type == 3') correctly only when the following | ||
| 194 | * is in a single record, which is not guaranteed by | ||
| 195 | * the protocol specification: | ||
| 196 | * Byte Content | ||
| 197 | * 0 type \ | ||
| 198 | * 1/2 version > record header | ||
| 199 | * 3/4 length / | ||
| 200 | * 5 msg_type \ | ||
| 201 | * 6-8 length > Client Hello message | ||
| 202 | * 9/10 client_version / | ||
| 203 | */ | ||
| 204 | char *buf= &(buf_space[0]); | ||
| 205 | unsigned char *p,*d,*dd; | ||
| 206 | unsigned int i; | ||
| 207 | unsigned int csl,sil,cl; | ||
| 208 | int n=0,j; | ||
| 209 | int type=0; | ||
| 210 | int v[2]; | ||
| 211 | #ifndef NO_RSA | ||
| 212 | int use_sslv2_strong=0; | ||
| 213 | #endif | ||
| 214 | |||
| 215 | if (s->state == SSL23_ST_SR_CLNT_HELLO_A) | ||
| 216 | { | ||
| 217 | /* read the initial header */ | ||
| 218 | v[0]=v[1]=0; | ||
| 219 | |||
| 220 | if (!ssl3_setup_buffers(s)) goto err; | ||
| 221 | |||
| 222 | n=ssl23_read_bytes(s, sizeof buf_space); | ||
| 223 | if (n != sizeof buf_space) return(n); /* n == -1 || n == 0 */ | ||
| 224 | |||
| 225 | p=s->packet; | ||
| 226 | |||
| 227 | memcpy(buf,p,n); | ||
| 228 | |||
| 229 | if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) | ||
| 230 | { | ||
| 231 | /* | ||
| 232 | * SSLv2 header | ||
| 233 | */ | ||
| 234 | if ((p[3] == 0x00) && (p[4] == 0x02)) | ||
| 235 | { | ||
| 236 | v[0]=p[3]; v[1]=p[4]; | ||
| 237 | /* SSLv2 */ | ||
| 238 | if (!(s->options & SSL_OP_NO_SSLv2)) | ||
| 239 | type=1; | ||
| 240 | } | ||
| 241 | else if (p[3] == SSL3_VERSION_MAJOR) | ||
| 242 | { | ||
| 243 | v[0]=p[3]; v[1]=p[4]; | ||
| 244 | /* SSLv3/TLSv1 */ | ||
| 245 | if (p[4] >= TLS1_VERSION_MINOR) | ||
| 246 | { | ||
| 247 | if (!(s->options & SSL_OP_NO_TLSv1)) | ||
| 248 | { | ||
| 249 | s->version=TLS1_VERSION; | ||
| 250 | /* type=2; */ /* done later to survive restarts */ | ||
| 251 | s->state=SSL23_ST_SR_CLNT_HELLO_B; | ||
| 252 | } | ||
| 253 | else if (!(s->options & SSL_OP_NO_SSLv3)) | ||
| 254 | { | ||
| 255 | s->version=SSL3_VERSION; | ||
| 256 | /* type=2; */ | ||
| 257 | s->state=SSL23_ST_SR_CLNT_HELLO_B; | ||
| 258 | } | ||
| 259 | else if (!(s->options & SSL_OP_NO_SSLv2)) | ||
| 260 | { | ||
| 261 | type=1; | ||
| 262 | } | ||
| 263 | } | ||
| 264 | else if (!(s->options & SSL_OP_NO_SSLv3)) | ||
| 265 | { | ||
| 266 | s->version=SSL3_VERSION; | ||
| 267 | /* type=2; */ | ||
| 268 | s->state=SSL23_ST_SR_CLNT_HELLO_B; | ||
| 269 | } | ||
| 270 | else if (!(s->options & SSL_OP_NO_SSLv2)) | ||
| 271 | type=1; | ||
| 272 | |||
| 273 | if (s->options & SSL_OP_NON_EXPORT_FIRST) | ||
| 274 | /* Not only utterly confusing, but broken | ||
| 275 | * ('fractured programming'?) -- the details | ||
| 276 | * of this block nearly make it work | ||
| 277 | * as intended in this environment, but on one | ||
| 278 | * of the fine points (w.r.t. restarts) it fails. | ||
| 279 | * The obvious fix would be even more devastating | ||
| 280 | * to program structure; if you want the functionality, | ||
| 281 | * throw this away and implement it in a way | ||
| 282 | * that makes sense */ | ||
| 283 | { | ||
| 284 | #if 0 | ||
| 285 | STACK_OF(SSL_CIPHER) *sk; | ||
| 286 | SSL_CIPHER *c; | ||
| 287 | int ne2,ne3; | ||
| 288 | |||
| 289 | j=((p[0]&0x7f)<<8)|p[1]; | ||
| 290 | if (j > (1024*4)) | ||
| 291 | { | ||
| 292 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE); | ||
| 293 | goto err; | ||
| 294 | } | ||
| 295 | |||
| 296 | n=ssl23_read_bytes(s,j+2); | ||
| 297 | if (n <= 0) return(n); | ||
| 298 | p=s->packet; | ||
| 299 | |||
| 300 | if ((buf=OPENSSL_malloc(n)) == NULL) | ||
| 301 | { | ||
| 302 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,ERR_R_MALLOC_FAILURE); | ||
| 303 | goto err; | ||
| 304 | } | ||
| 305 | memcpy(buf,p,n); | ||
| 306 | |||
| 307 | p+=5; | ||
| 308 | n2s(p,csl); | ||
| 309 | p+=4; | ||
| 310 | |||
| 311 | sk=ssl_bytes_to_cipher_list( | ||
| 312 | s,p,csl,NULL); | ||
| 313 | if (sk != NULL) | ||
| 314 | { | ||
| 315 | ne2=ne3=0; | ||
| 316 | for (j=0; j<sk_SSL_CIPHER_num(sk); j++) | ||
| 317 | { | ||
| 318 | c=sk_SSL_CIPHER_value(sk,j); | ||
| 319 | if (!SSL_C_IS_EXPORT(c)) | ||
| 320 | { | ||
| 321 | if ((c->id>>24L) == 2L) | ||
| 322 | ne2=1; | ||
| 323 | else | ||
| 324 | ne3=1; | ||
| 325 | } | ||
| 326 | } | ||
| 327 | if (ne2 && !ne3) | ||
| 328 | { | ||
| 329 | type=1; | ||
| 330 | use_sslv2_strong=1; | ||
| 331 | goto next_bit; | ||
| 332 | } | ||
| 333 | } | ||
| 334 | #else | ||
| 335 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_OPTION); | ||
| 336 | goto err; | ||
| 337 | #endif | ||
| 338 | } | ||
| 339 | } | ||
| 340 | } | ||
| 341 | else if ((p[0] == SSL3_RT_HANDSHAKE) && | ||
| 342 | (p[1] == SSL3_VERSION_MAJOR) && | ||
| 343 | (p[5] == SSL3_MT_CLIENT_HELLO) && | ||
| 344 | ((p[3] == 0 && p[4] < 5 /* silly record length? */) | ||
| 345 | || (p[9] == p[1]))) | ||
| 346 | { | ||
| 347 | /* | ||
| 348 | * SSLv3 or tls1 header | ||
| 349 | */ | ||
| 350 | |||
| 351 | v[0]=p[1]; /* major version (= SSL3_VERSION_MAJOR) */ | ||
| 352 | /* We must look at client_version inside the Client Hello message | ||
| 353 | * to get the correct minor version. | ||
| 354 | * However if we have only a pathologically small fragment of the | ||
| 355 | * Client Hello message, this would be difficult, we'd have | ||
| 356 | * to read at least one additional record to find out. | ||
| 357 | * This doesn't usually happen in real life, so we just complain | ||
| 358 | * for now. | ||
| 359 | */ | ||
| 360 | if (p[3] == 0 && p[4] < 6) | ||
| 361 | { | ||
| 362 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_SMALL); | ||
| 363 | goto err; | ||
| 364 | } | ||
| 365 | v[1]=p[10]; /* minor version according to client_version */ | ||
| 366 | if (v[1] >= TLS1_VERSION_MINOR) | ||
| 367 | { | ||
| 368 | if (!(s->options & SSL_OP_NO_TLSv1)) | ||
| 369 | { | ||
| 370 | s->version=TLS1_VERSION; | ||
| 371 | type=3; | ||
| 372 | } | ||
| 373 | else if (!(s->options & SSL_OP_NO_SSLv3)) | ||
| 374 | { | ||
| 375 | s->version=SSL3_VERSION; | ||
| 376 | type=3; | ||
| 377 | } | ||
| 378 | } | ||
| 379 | else if (!(s->options & SSL_OP_NO_SSLv3)) | ||
| 380 | { | ||
| 381 | s->version=SSL3_VERSION; | ||
| 382 | type=3; | ||
| 383 | } | ||
| 384 | } | ||
| 385 | else if ((strncmp("GET ", (char *)p,4) == 0) || | ||
| 386 | (strncmp("POST ",(char *)p,5) == 0) || | ||
| 387 | (strncmp("HEAD ",(char *)p,5) == 0) || | ||
| 388 | (strncmp("PUT ", (char *)p,4) == 0)) | ||
| 389 | { | ||
| 390 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_HTTP_REQUEST); | ||
| 391 | goto err; | ||
| 392 | } | ||
| 393 | else if (strncmp("CONNECT",(char *)p,7) == 0) | ||
| 394 | { | ||
| 395 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_HTTPS_PROXY_REQUEST); | ||
| 396 | goto err; | ||
| 397 | } | ||
| 398 | } | ||
| 399 | |||
| 400 | if (s->state == SSL23_ST_SR_CLNT_HELLO_B) | ||
| 401 | { | ||
| 402 | /* we have SSLv3/TLSv1 in an SSLv2 header | ||
| 403 | * (other cases skip this state) */ | ||
| 404 | |||
| 405 | type=2; | ||
| 406 | p=s->packet; | ||
| 407 | v[0] = p[3]; /* == SSL3_VERSION_MAJOR */ | ||
| 408 | v[1] = p[4]; | ||
| 409 | |||
| 410 | n=((p[0]&0x7f)<<8)|p[1]; | ||
| 411 | if (n > (1024*4)) | ||
| 412 | { | ||
| 413 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE); | ||
| 414 | goto err; | ||
| 415 | } | ||
| 416 | |||
| 417 | j=ssl23_read_bytes(s,n+2); | ||
| 418 | if (j <= 0) return(j); | ||
| 419 | |||
| 420 | ssl3_finish_mac(s,&(s->packet[2]),s->packet_length-2); | ||
| 421 | |||
| 422 | p=s->packet; | ||
| 423 | p+=5; | ||
| 424 | n2s(p,csl); | ||
| 425 | n2s(p,sil); | ||
| 426 | n2s(p,cl); | ||
| 427 | d=(unsigned char *)s->init_buf->data; | ||
| 428 | if ((csl+sil+cl+11) != s->packet_length) | ||
| 429 | { | ||
| 430 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_LENGTH_MISMATCH); | ||
| 431 | goto err; | ||
| 432 | } | ||
| 433 | |||
| 434 | *(d++) = SSL3_VERSION_MAJOR; /* == v[0] */ | ||
| 435 | *(d++) = v[1]; | ||
| 436 | |||
| 437 | /* lets populate the random area */ | ||
| 438 | /* get the challenge_length */ | ||
| 439 | i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl; | ||
| 440 | memset(d,0,SSL3_RANDOM_SIZE); | ||
| 441 | memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i); | ||
| 442 | d+=SSL3_RANDOM_SIZE; | ||
| 443 | |||
| 444 | /* no session-id reuse */ | ||
| 445 | *(d++)=0; | ||
| 446 | |||
| 447 | /* ciphers */ | ||
| 448 | j=0; | ||
| 449 | dd=d; | ||
| 450 | d+=2; | ||
| 451 | for (i=0; i<csl; i+=3) | ||
| 452 | { | ||
| 453 | if (p[i] != 0) continue; | ||
| 454 | *(d++)=p[i+1]; | ||
| 455 | *(d++)=p[i+2]; | ||
| 456 | j+=2; | ||
| 457 | } | ||
| 458 | s2n(j,dd); | ||
| 459 | |||
| 460 | /* COMPRESSION */ | ||
| 461 | *(d++)=1; | ||
| 462 | *(d++)=0; | ||
| 463 | |||
| 464 | i=(d-(unsigned char *)s->init_buf->data); | ||
| 465 | |||
| 466 | /* get the data reused from the init_buf */ | ||
| 467 | s->s3->tmp.reuse_message=1; | ||
| 468 | s->s3->tmp.message_type=SSL3_MT_CLIENT_HELLO; | ||
| 469 | s->s3->tmp.message_size=i; | ||
| 470 | } | ||
| 471 | |||
| 472 | /* imaginary new state (for program structure): */ | ||
| 473 | /* s->state = SSL23_SR_CLNT_HELLO_C */ | ||
| 474 | |||
| 475 | if (type == 1) | ||
| 476 | { | ||
| 477 | #ifdef NO_SSL2 | ||
| 478 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL); | ||
| 479 | goto err; | ||
| 480 | #else | ||
| 481 | /* we are talking sslv2 */ | ||
| 482 | /* we need to clean up the SSLv3/TLSv1 setup and put in the | ||
| 483 | * sslv2 stuff. */ | ||
| 484 | |||
| 485 | if (s->s2 == NULL) | ||
| 486 | { | ||
| 487 | if (!ssl2_new(s)) | ||
| 488 | goto err; | ||
| 489 | } | ||
| 490 | else | ||
| 491 | ssl2_clear(s); | ||
| 492 | |||
| 493 | if (s->s3 != NULL) ssl3_free(s); | ||
| 494 | |||
| 495 | if (!BUF_MEM_grow(s->init_buf, | ||
| 496 | SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)) | ||
| 497 | { | ||
| 498 | goto err; | ||
| 499 | } | ||
| 500 | |||
| 501 | s->state=SSL2_ST_GET_CLIENT_HELLO_A; | ||
| 502 | if ((s->options & SSL_OP_MSIE_SSLV2_RSA_PADDING) || | ||
| 503 | use_sslv2_strong || | ||
| 504 | (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)) | ||
| 505 | s->s2->ssl2_rollback=0; | ||
| 506 | else | ||
| 507 | /* reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0 | ||
| 508 | * (SSL 3.0 draft/RFC 2246, App. E.2) */ | ||
| 509 | s->s2->ssl2_rollback=1; | ||
| 510 | |||
| 511 | /* setup the n bytes we have read so we get them from | ||
| 512 | * the sslv2 buffer */ | ||
| 513 | s->rstate=SSL_ST_READ_HEADER; | ||
| 514 | s->packet_length=n; | ||
| 515 | s->packet= &(s->s2->rbuf[0]); | ||
| 516 | memcpy(s->packet,buf,n); | ||
| 517 | s->s2->rbuf_left=n; | ||
| 518 | s->s2->rbuf_offs=0; | ||
| 519 | |||
| 520 | s->method=SSLv2_server_method(); | ||
| 521 | s->handshake_func=s->method->ssl_accept; | ||
| 522 | #endif | ||
| 523 | } | ||
| 524 | |||
| 525 | if ((type == 2) || (type == 3)) | ||
| 526 | { | ||
| 527 | /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */ | ||
| 528 | |||
| 529 | if (!ssl_init_wbio_buffer(s,1)) goto err; | ||
| 530 | |||
| 531 | /* we are in this state */ | ||
| 532 | s->state=SSL3_ST_SR_CLNT_HELLO_A; | ||
| 533 | |||
| 534 | if (type == 3) | ||
| 535 | { | ||
| 536 | /* put the 'n' bytes we have read into the input buffer | ||
| 537 | * for SSLv3 */ | ||
| 538 | s->rstate=SSL_ST_READ_HEADER; | ||
| 539 | s->packet_length=n; | ||
| 540 | s->packet= &(s->s3->rbuf.buf[0]); | ||
| 541 | memcpy(s->packet,buf,n); | ||
| 542 | s->s3->rbuf.left=n; | ||
| 543 | s->s3->rbuf.offset=0; | ||
| 544 | } | ||
| 545 | else | ||
| 546 | { | ||
| 547 | s->packet_length=0; | ||
| 548 | s->s3->rbuf.left=0; | ||
| 549 | s->s3->rbuf.offset=0; | ||
| 550 | } | ||
| 551 | |||
| 552 | if (s->version == TLS1_VERSION) | ||
| 553 | s->method = TLSv1_server_method(); | ||
| 554 | else | ||
| 555 | s->method = SSLv3_server_method(); | ||
| 556 | #if 0 /* ssl3_get_client_hello does this */ | ||
| 557 | s->client_version=(v[0]<<8)|v[1]; | ||
| 558 | #endif | ||
| 559 | s->handshake_func=s->method->ssl_accept; | ||
| 560 | } | ||
| 561 | |||
| 562 | if ((type < 1) || (type > 3)) | ||
| 563 | { | ||
| 564 | /* bad, very bad */ | ||
| 565 | SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNKNOWN_PROTOCOL); | ||
| 566 | goto err; | ||
| 567 | } | ||
| 568 | s->init_num=0; | ||
| 569 | |||
| 570 | if (buf != buf_space) OPENSSL_free(buf); | ||
| 571 | s->first_packet=1; | ||
| 572 | return(SSL_accept(s)); | ||
| 573 | err: | ||
| 574 | if (buf != buf_space) OPENSSL_free(buf); | ||
| 575 | return(-1); | ||
| 576 | } | ||
diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c deleted file mode 100644 index 10d8d3b15a..0000000000 --- a/src/lib/libssl/s3_both.c +++ /dev/null | |||
| @@ -1,588 +0,0 @@ | |||
| 1 | /* ssl/s3_both.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | /* ==================================================================== | ||
| 59 | * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. | ||
| 60 | * | ||
| 61 | * Redistribution and use in source and binary forms, with or without | ||
| 62 | * modification, are permitted provided that the following conditions | ||
| 63 | * are met: | ||
| 64 | * | ||
| 65 | * 1. Redistributions of source code must retain the above copyright | ||
| 66 | * notice, this list of conditions and the following disclaimer. | ||
| 67 | * | ||
| 68 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 69 | * notice, this list of conditions and the following disclaimer in | ||
| 70 | * the documentation and/or other materials provided with the | ||
| 71 | * distribution. | ||
| 72 | * | ||
| 73 | * 3. All advertising materials mentioning features or use of this | ||
| 74 | * software must display the following acknowledgment: | ||
| 75 | * "This product includes software developed by the OpenSSL Project | ||
| 76 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" | ||
| 77 | * | ||
| 78 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 79 | * endorse or promote products derived from this software without | ||
| 80 | * prior written permission. For written permission, please contact | ||
| 81 | * openssl-core@openssl.org. | ||
| 82 | * | ||
| 83 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 84 | * nor may "OpenSSL" appear in their names without prior written | ||
| 85 | * permission of the OpenSSL Project. | ||
| 86 | * | ||
| 87 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 88 | * acknowledgment: | ||
| 89 | * "This product includes software developed by the OpenSSL Project | ||
| 90 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" | ||
| 91 | * | ||
| 92 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 93 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 94 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 95 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 96 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 97 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 98 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 99 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 100 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 101 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 102 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 103 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 104 | * ==================================================================== | ||
| 105 | * | ||
| 106 | * This product includes cryptographic software written by Eric Young | ||
| 107 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
| 108 | * Hudson (tjh@cryptsoft.com). | ||
| 109 | * | ||
| 110 | */ | ||
| 111 | |||
| 112 | #include <string.h> | ||
| 113 | #include <stdio.h> | ||
| 114 | #include <openssl/buffer.h> | ||
| 115 | #include <openssl/rand.h> | ||
| 116 | #include <openssl/objects.h> | ||
| 117 | #include <openssl/evp.h> | ||
| 118 | #include <openssl/x509.h> | ||
| 119 | #include "ssl_locl.h" | ||
| 120 | |||
| 121 | /* send s->init_buf in records of type 'type' */ | ||
| 122 | int ssl3_do_write(SSL *s, int type) | ||
| 123 | { | ||
| 124 | int ret; | ||
| 125 | |||
| 126 | ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off], | ||
| 127 | s->init_num); | ||
| 128 | if (ret < 0) return(-1); | ||
| 129 | if (type == SSL3_RT_HANDSHAKE) | ||
| 130 | /* should not be done for 'Hello Request's, but in that case | ||
| 131 | * we'll ignore the result anyway */ | ||
| 132 | ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off],ret); | ||
| 133 | |||
| 134 | if (ret == s->init_num) | ||
| 135 | return(1); | ||
| 136 | s->init_off+=ret; | ||
| 137 | s->init_num-=ret; | ||
| 138 | return(0); | ||
| 139 | } | ||
| 140 | |||
| 141 | int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen) | ||
| 142 | { | ||
| 143 | unsigned char *p,*d; | ||
| 144 | int i; | ||
| 145 | unsigned long l; | ||
| 146 | |||
| 147 | if (s->state == a) | ||
| 148 | { | ||
| 149 | d=(unsigned char *)s->init_buf->data; | ||
| 150 | p= &(d[4]); | ||
| 151 | |||
| 152 | i=s->method->ssl3_enc->final_finish_mac(s, | ||
| 153 | &(s->s3->finish_dgst1), | ||
| 154 | &(s->s3->finish_dgst2), | ||
| 155 | sender,slen,s->s3->tmp.finish_md); | ||
| 156 | s->s3->tmp.finish_md_len = i; | ||
| 157 | memcpy(p, s->s3->tmp.finish_md, i); | ||
| 158 | p+=i; | ||
| 159 | l=i; | ||
| 160 | |||
| 161 | #ifdef WIN16 | ||
| 162 | /* MSVC 1.5 does not clear the top bytes of the word unless | ||
| 163 | * I do this. | ||
| 164 | */ | ||
| 165 | l&=0xffff; | ||
| 166 | #endif | ||
| 167 | |||
| 168 | *(d++)=SSL3_MT_FINISHED; | ||
| 169 | l2n3(l,d); | ||
| 170 | s->init_num=(int)l+4; | ||
| 171 | s->init_off=0; | ||
| 172 | |||
| 173 | s->state=b; | ||
| 174 | } | ||
| 175 | |||
| 176 | /* SSL3_ST_SEND_xxxxxx_HELLO_B */ | ||
| 177 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 178 | } | ||
| 179 | |||
| 180 | int ssl3_get_finished(SSL *s, int a, int b) | ||
| 181 | { | ||
| 182 | int al,i,ok; | ||
| 183 | long n; | ||
| 184 | unsigned char *p; | ||
| 185 | |||
| 186 | /* the mac has already been generated when we received the | ||
| 187 | * change cipher spec message and is in s->s3->tmp.peer_finish_md | ||
| 188 | */ | ||
| 189 | |||
| 190 | n=ssl3_get_message(s, | ||
| 191 | a, | ||
| 192 | b, | ||
| 193 | SSL3_MT_FINISHED, | ||
| 194 | 64, /* should actually be 36+4 :-) */ | ||
| 195 | &ok); | ||
| 196 | |||
| 197 | if (!ok) return((int)n); | ||
| 198 | |||
| 199 | /* If this occurs, we have missed a message */ | ||
| 200 | if (!s->s3->change_cipher_spec) | ||
| 201 | { | ||
| 202 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 203 | SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_GOT_A_FIN_BEFORE_A_CCS); | ||
| 204 | goto f_err; | ||
| 205 | } | ||
| 206 | s->s3->change_cipher_spec=0; | ||
| 207 | |||
| 208 | p = (unsigned char *)s->init_buf->data; | ||
| 209 | i = s->s3->tmp.peer_finish_md_len; | ||
| 210 | |||
| 211 | if (i != n) | ||
| 212 | { | ||
| 213 | al=SSL_AD_DECODE_ERROR; | ||
| 214 | SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_BAD_DIGEST_LENGTH); | ||
| 215 | goto f_err; | ||
| 216 | } | ||
| 217 | |||
| 218 | if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0) | ||
| 219 | { | ||
| 220 | al=SSL_AD_DECRYPT_ERROR; | ||
| 221 | SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED); | ||
| 222 | goto f_err; | ||
| 223 | } | ||
| 224 | |||
| 225 | return(1); | ||
| 226 | f_err: | ||
| 227 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 228 | return(0); | ||
| 229 | } | ||
| 230 | |||
| 231 | /* for these 2 messages, we need to | ||
| 232 | * ssl->enc_read_ctx re-init | ||
| 233 | * ssl->s3->read_sequence zero | ||
| 234 | * ssl->s3->read_mac_secret re-init | ||
| 235 | * ssl->session->read_sym_enc assign | ||
| 236 | * ssl->session->read_compression assign | ||
| 237 | * ssl->session->read_hash assign | ||
| 238 | */ | ||
| 239 | int ssl3_send_change_cipher_spec(SSL *s, int a, int b) | ||
| 240 | { | ||
| 241 | unsigned char *p; | ||
| 242 | |||
| 243 | if (s->state == a) | ||
| 244 | { | ||
| 245 | p=(unsigned char *)s->init_buf->data; | ||
| 246 | *p=SSL3_MT_CCS; | ||
| 247 | s->init_num=1; | ||
| 248 | s->init_off=0; | ||
| 249 | |||
| 250 | s->state=b; | ||
| 251 | } | ||
| 252 | |||
| 253 | /* SSL3_ST_CW_CHANGE_B */ | ||
| 254 | return(ssl3_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC)); | ||
| 255 | } | ||
| 256 | |||
| 257 | unsigned long ssl3_output_cert_chain(SSL *s, X509 *x) | ||
| 258 | { | ||
| 259 | unsigned char *p; | ||
| 260 | int n,i; | ||
| 261 | unsigned long l=7; | ||
| 262 | BUF_MEM *buf; | ||
| 263 | X509_STORE_CTX xs_ctx; | ||
| 264 | X509_OBJECT obj; | ||
| 265 | |||
| 266 | /* TLSv1 sends a chain with nothing in it, instead of an alert */ | ||
| 267 | buf=s->init_buf; | ||
| 268 | if (!BUF_MEM_grow(buf,(int)(10))) | ||
| 269 | { | ||
| 270 | SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB); | ||
| 271 | return(0); | ||
| 272 | } | ||
| 273 | if (x != NULL) | ||
| 274 | { | ||
| 275 | X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL); | ||
| 276 | |||
| 277 | for (;;) | ||
| 278 | { | ||
| 279 | n=i2d_X509(x,NULL); | ||
| 280 | if (!BUF_MEM_grow(buf,(int)(n+l+3))) | ||
| 281 | { | ||
| 282 | SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB); | ||
| 283 | return(0); | ||
| 284 | } | ||
| 285 | p=(unsigned char *)&(buf->data[l]); | ||
| 286 | l2n3(n,p); | ||
| 287 | i2d_X509(x,&p); | ||
| 288 | l+=n+3; | ||
| 289 | if (X509_NAME_cmp(X509_get_subject_name(x), | ||
| 290 | X509_get_issuer_name(x)) == 0) break; | ||
| 291 | |||
| 292 | i=X509_STORE_get_by_subject(&xs_ctx,X509_LU_X509, | ||
| 293 | X509_get_issuer_name(x),&obj); | ||
| 294 | if (i <= 0) break; | ||
| 295 | x=obj.data.x509; | ||
| 296 | /* Count is one too high since the X509_STORE_get uped the | ||
| 297 | * ref count */ | ||
| 298 | X509_free(x); | ||
| 299 | } | ||
| 300 | |||
| 301 | X509_STORE_CTX_cleanup(&xs_ctx); | ||
| 302 | } | ||
| 303 | |||
| 304 | /* Thawte special :-) */ | ||
| 305 | if (s->ctx->extra_certs != NULL) | ||
| 306 | for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++) | ||
| 307 | { | ||
| 308 | x=sk_X509_value(s->ctx->extra_certs,i); | ||
| 309 | n=i2d_X509(x,NULL); | ||
| 310 | if (!BUF_MEM_grow(buf,(int)(n+l+3))) | ||
| 311 | { | ||
| 312 | SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB); | ||
| 313 | return(0); | ||
| 314 | } | ||
| 315 | p=(unsigned char *)&(buf->data[l]); | ||
| 316 | l2n3(n,p); | ||
| 317 | i2d_X509(x,&p); | ||
| 318 | l+=n+3; | ||
| 319 | } | ||
| 320 | |||
| 321 | l-=7; | ||
| 322 | p=(unsigned char *)&(buf->data[4]); | ||
| 323 | l2n3(l,p); | ||
| 324 | l+=3; | ||
| 325 | p=(unsigned char *)&(buf->data[0]); | ||
| 326 | *(p++)=SSL3_MT_CERTIFICATE; | ||
| 327 | l2n3(l,p); | ||
| 328 | l+=4; | ||
| 329 | return(l); | ||
| 330 | } | ||
| 331 | |||
| 332 | /* Obtain handshake message of message type 'mt' (any if mt == -1), | ||
| 333 | * maximum acceptable body length 'max'. | ||
| 334 | * The first four bytes (msg_type and length) are read in state 'st1', | ||
| 335 | * the body is read in state 'stn'. | ||
| 336 | */ | ||
| 337 | long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) | ||
| 338 | { | ||
| 339 | unsigned char *p; | ||
| 340 | unsigned long l; | ||
| 341 | long n; | ||
| 342 | int i,al; | ||
| 343 | |||
| 344 | if (s->s3->tmp.reuse_message) | ||
| 345 | { | ||
| 346 | s->s3->tmp.reuse_message=0; | ||
| 347 | if ((mt >= 0) && (s->s3->tmp.message_type != mt)) | ||
| 348 | { | ||
| 349 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 350 | SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE); | ||
| 351 | goto f_err; | ||
| 352 | } | ||
| 353 | *ok=1; | ||
| 354 | return((int)s->s3->tmp.message_size); | ||
| 355 | } | ||
| 356 | |||
| 357 | p=(unsigned char *)s->init_buf->data; | ||
| 358 | |||
| 359 | if (s->state == st1) /* s->init_num < 4 */ | ||
| 360 | { | ||
| 361 | int skip_message; | ||
| 362 | |||
| 363 | do | ||
| 364 | { | ||
| 365 | while (s->init_num < 4) | ||
| 366 | { | ||
| 367 | i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num], | ||
| 368 | 4 - s->init_num, 0); | ||
| 369 | if (i <= 0) | ||
| 370 | { | ||
| 371 | s->rwstate=SSL_READING; | ||
| 372 | *ok = 0; | ||
| 373 | return i; | ||
| 374 | } | ||
| 375 | s->init_num+=i; | ||
| 376 | } | ||
| 377 | |||
| 378 | skip_message = 0; | ||
| 379 | if (!s->server) | ||
| 380 | if (p[0] == SSL3_MT_HELLO_REQUEST) | ||
| 381 | /* The server may always send 'Hello Request' messages -- | ||
| 382 | * we are doing a handshake anyway now, so ignore them | ||
| 383 | * if their format is correct. Does not count for | ||
| 384 | * 'Finished' MAC. */ | ||
| 385 | if (p[1] == 0 && p[2] == 0 &&p[3] == 0) | ||
| 386 | skip_message = 1; | ||
| 387 | } | ||
| 388 | while (skip_message); | ||
| 389 | |||
| 390 | /* s->init_num == 4 */ | ||
| 391 | |||
| 392 | if ((mt >= 0) && (*p != mt)) | ||
| 393 | { | ||
| 394 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 395 | SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE); | ||
| 396 | goto f_err; | ||
| 397 | } | ||
| 398 | if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) && | ||
| 399 | (st1 == SSL3_ST_SR_CERT_A) && | ||
| 400 | (stn == SSL3_ST_SR_CERT_B)) | ||
| 401 | { | ||
| 402 | /* At this point we have got an MS SGC second client | ||
| 403 | * hello (maybe we should always allow the client to | ||
| 404 | * start a new handshake?). We need to restart the mac. | ||
| 405 | * Don't increment {num,total}_renegotiations because | ||
| 406 | * we have not completed the handshake. */ | ||
| 407 | ssl3_init_finished_mac(s); | ||
| 408 | } | ||
| 409 | |||
| 410 | ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 4); | ||
| 411 | |||
| 412 | s->s3->tmp.message_type= *(p++); | ||
| 413 | |||
| 414 | n2l3(p,l); | ||
| 415 | if (l > (unsigned long)max) | ||
| 416 | { | ||
| 417 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 418 | SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE); | ||
| 419 | goto f_err; | ||
| 420 | } | ||
| 421 | if (l && !BUF_MEM_grow(s->init_buf,(int)l)) | ||
| 422 | { | ||
| 423 | SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB); | ||
| 424 | goto err; | ||
| 425 | } | ||
| 426 | s->s3->tmp.message_size=l; | ||
| 427 | s->state=stn; | ||
| 428 | |||
| 429 | s->init_num=0; | ||
| 430 | } | ||
| 431 | |||
| 432 | /* next state (stn) */ | ||
| 433 | p=(unsigned char *)s->init_buf->data; | ||
| 434 | n=s->s3->tmp.message_size; | ||
| 435 | while (n > 0) | ||
| 436 | { | ||
| 437 | i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0); | ||
| 438 | if (i <= 0) | ||
| 439 | { | ||
| 440 | s->rwstate=SSL_READING; | ||
| 441 | *ok = 0; | ||
| 442 | return i; | ||
| 443 | } | ||
| 444 | s->init_num += i; | ||
| 445 | n -= i; | ||
| 446 | } | ||
| 447 | ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num); | ||
| 448 | *ok=1; | ||
| 449 | return s->init_num; | ||
| 450 | f_err: | ||
| 451 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 452 | err: | ||
| 453 | *ok=0; | ||
| 454 | return(-1); | ||
| 455 | } | ||
| 456 | |||
| 457 | int ssl_cert_type(X509 *x, EVP_PKEY *pkey) | ||
| 458 | { | ||
| 459 | EVP_PKEY *pk; | ||
| 460 | int ret= -1,i,j; | ||
| 461 | |||
| 462 | if (pkey == NULL) | ||
| 463 | pk=X509_get_pubkey(x); | ||
| 464 | else | ||
| 465 | pk=pkey; | ||
| 466 | if (pk == NULL) goto err; | ||
| 467 | |||
| 468 | i=pk->type; | ||
| 469 | if (i == EVP_PKEY_RSA) | ||
| 470 | { | ||
| 471 | ret=SSL_PKEY_RSA_ENC; | ||
| 472 | if (x != NULL) | ||
| 473 | { | ||
| 474 | j=X509_get_ext_count(x); | ||
| 475 | /* check to see if this is a signing only certificate */ | ||
| 476 | /* EAY EAY EAY EAY */ | ||
| 477 | } | ||
| 478 | } | ||
| 479 | else if (i == EVP_PKEY_DSA) | ||
| 480 | { | ||
| 481 | ret=SSL_PKEY_DSA_SIGN; | ||
| 482 | } | ||
| 483 | else if (i == EVP_PKEY_DH) | ||
| 484 | { | ||
| 485 | /* if we just have a key, we needs to be guess */ | ||
| 486 | |||
| 487 | if (x == NULL) | ||
| 488 | ret=SSL_PKEY_DH_DSA; | ||
| 489 | else | ||
| 490 | { | ||
| 491 | j=X509_get_signature_type(x); | ||
| 492 | if (j == EVP_PKEY_RSA) | ||
| 493 | ret=SSL_PKEY_DH_RSA; | ||
| 494 | else if (j== EVP_PKEY_DSA) | ||
| 495 | ret=SSL_PKEY_DH_DSA; | ||
| 496 | else ret= -1; | ||
| 497 | } | ||
| 498 | } | ||
| 499 | else | ||
| 500 | ret= -1; | ||
| 501 | |||
| 502 | err: | ||
| 503 | if(!pkey) EVP_PKEY_free(pk); | ||
| 504 | return(ret); | ||
| 505 | } | ||
| 506 | |||
| 507 | int ssl_verify_alarm_type(long type) | ||
| 508 | { | ||
| 509 | int al; | ||
| 510 | |||
| 511 | switch(type) | ||
| 512 | { | ||
| 513 | case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: | ||
| 514 | case X509_V_ERR_UNABLE_TO_GET_CRL: | ||
| 515 | al=SSL_AD_UNKNOWN_CA; | ||
| 516 | break; | ||
| 517 | case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: | ||
| 518 | case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: | ||
| 519 | case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: | ||
| 520 | case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: | ||
| 521 | case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: | ||
| 522 | case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: | ||
| 523 | case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: | ||
| 524 | case X509_V_ERR_CERT_NOT_YET_VALID: | ||
| 525 | case X509_V_ERR_CRL_NOT_YET_VALID: | ||
| 526 | al=SSL_AD_BAD_CERTIFICATE; | ||
| 527 | break; | ||
| 528 | case X509_V_ERR_CERT_SIGNATURE_FAILURE: | ||
| 529 | case X509_V_ERR_CRL_SIGNATURE_FAILURE: | ||
| 530 | al=SSL_AD_DECRYPT_ERROR; | ||
| 531 | break; | ||
| 532 | case X509_V_ERR_CERT_HAS_EXPIRED: | ||
| 533 | case X509_V_ERR_CRL_HAS_EXPIRED: | ||
| 534 | al=SSL_AD_CERTIFICATE_EXPIRED; | ||
| 535 | break; | ||
| 536 | case X509_V_ERR_CERT_REVOKED: | ||
| 537 | al=SSL_AD_CERTIFICATE_REVOKED; | ||
| 538 | break; | ||
| 539 | case X509_V_ERR_OUT_OF_MEM: | ||
| 540 | al=SSL_AD_INTERNAL_ERROR; | ||
| 541 | break; | ||
| 542 | case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: | ||
| 543 | case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: | ||
| 544 | case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: | ||
| 545 | case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: | ||
| 546 | case X509_V_ERR_CERT_CHAIN_TOO_LONG: | ||
| 547 | al=SSL_AD_UNKNOWN_CA; | ||
| 548 | break; | ||
| 549 | case X509_V_ERR_APPLICATION_VERIFICATION: | ||
| 550 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 551 | break; | ||
| 552 | default: | ||
| 553 | al=SSL_AD_CERTIFICATE_UNKNOWN; | ||
| 554 | break; | ||
| 555 | } | ||
| 556 | return(al); | ||
| 557 | } | ||
| 558 | |||
| 559 | int ssl3_setup_buffers(SSL *s) | ||
| 560 | { | ||
| 561 | unsigned char *p; | ||
| 562 | unsigned int extra; | ||
| 563 | |||
| 564 | if (s->s3->rbuf.buf == NULL) | ||
| 565 | { | ||
| 566 | if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) | ||
| 567 | extra=SSL3_RT_MAX_EXTRA; | ||
| 568 | else | ||
| 569 | extra=0; | ||
| 570 | if ((p=OPENSSL_malloc(SSL3_RT_MAX_PACKET_SIZE+extra)) | ||
| 571 | == NULL) | ||
| 572 | goto err; | ||
| 573 | s->s3->rbuf.buf=p; | ||
| 574 | } | ||
| 575 | |||
| 576 | if (s->s3->wbuf.buf == NULL) | ||
| 577 | { | ||
| 578 | if ((p=OPENSSL_malloc(SSL3_RT_MAX_PACKET_SIZE)) | ||
| 579 | == NULL) | ||
| 580 | goto err; | ||
| 581 | s->s3->wbuf.buf=p; | ||
| 582 | } | ||
| 583 | s->packet= &(s->s3->rbuf.buf[0]); | ||
| 584 | return(1); | ||
| 585 | err: | ||
| 586 | SSLerr(SSL_F_SSL3_SETUP_BUFFERS,ERR_R_MALLOC_FAILURE); | ||
| 587 | return(0); | ||
| 588 | } | ||
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c deleted file mode 100644 index eec45cfa48..0000000000 --- a/src/lib/libssl/s3_clnt.c +++ /dev/null | |||
| @@ -1,1741 +0,0 @@ | |||
| 1 | /* ssl/s3_clnt.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/buffer.h> | ||
| 61 | #include <openssl/rand.h> | ||
| 62 | #include <openssl/objects.h> | ||
| 63 | #include <openssl/md5.h> | ||
| 64 | #include <openssl/sha.h> | ||
| 65 | #include <openssl/evp.h> | ||
| 66 | #include "ssl_locl.h" | ||
| 67 | |||
| 68 | static SSL_METHOD *ssl3_get_client_method(int ver); | ||
| 69 | static int ssl3_client_hello(SSL *s); | ||
| 70 | static int ssl3_get_server_hello(SSL *s); | ||
| 71 | static int ssl3_get_certificate_request(SSL *s); | ||
| 72 | static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b); | ||
| 73 | static int ssl3_get_server_done(SSL *s); | ||
| 74 | static int ssl3_send_client_verify(SSL *s); | ||
| 75 | static int ssl3_send_client_certificate(SSL *s); | ||
| 76 | static int ssl3_send_client_key_exchange(SSL *s); | ||
| 77 | static int ssl3_get_key_exchange(SSL *s); | ||
| 78 | static int ssl3_get_server_certificate(SSL *s); | ||
| 79 | static int ssl3_check_cert_and_algorithm(SSL *s); | ||
| 80 | static SSL_METHOD *ssl3_get_client_method(int ver) | ||
| 81 | { | ||
| 82 | if (ver == SSL3_VERSION) | ||
| 83 | return(SSLv3_client_method()); | ||
| 84 | else | ||
| 85 | return(NULL); | ||
| 86 | } | ||
| 87 | |||
| 88 | SSL_METHOD *SSLv3_client_method(void) | ||
| 89 | { | ||
| 90 | static int init=1; | ||
| 91 | static SSL_METHOD SSLv3_client_data; | ||
| 92 | |||
| 93 | if (init) | ||
| 94 | { | ||
| 95 | init=0; | ||
| 96 | memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(), | ||
| 97 | sizeof(SSL_METHOD)); | ||
| 98 | SSLv3_client_data.ssl_connect=ssl3_connect; | ||
| 99 | SSLv3_client_data.get_ssl_method=ssl3_get_client_method; | ||
| 100 | } | ||
| 101 | return(&SSLv3_client_data); | ||
| 102 | } | ||
| 103 | |||
| 104 | int ssl3_connect(SSL *s) | ||
| 105 | { | ||
| 106 | BUF_MEM *buf; | ||
| 107 | unsigned long Time=time(NULL),l; | ||
| 108 | long num1; | ||
| 109 | void (*cb)()=NULL; | ||
| 110 | int ret= -1; | ||
| 111 | int new_state,state,skip=0;; | ||
| 112 | |||
| 113 | RAND_add(&Time,sizeof(Time),0); | ||
| 114 | ERR_clear_error(); | ||
| 115 | clear_sys_error(); | ||
| 116 | |||
| 117 | if (s->info_callback != NULL) | ||
| 118 | cb=s->info_callback; | ||
| 119 | else if (s->ctx->info_callback != NULL) | ||
| 120 | cb=s->ctx->info_callback; | ||
| 121 | |||
| 122 | if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); | ||
| 123 | s->in_handshake++; | ||
| 124 | |||
| 125 | for (;;) | ||
| 126 | { | ||
| 127 | state=s->state; | ||
| 128 | |||
| 129 | switch(s->state) | ||
| 130 | { | ||
| 131 | case SSL_ST_RENEGOTIATE: | ||
| 132 | s->new_session=1; | ||
| 133 | s->state=SSL_ST_CONNECT; | ||
| 134 | s->ctx->stats.sess_connect_renegotiate++; | ||
| 135 | /* break */ | ||
| 136 | case SSL_ST_BEFORE: | ||
| 137 | case SSL_ST_CONNECT: | ||
| 138 | case SSL_ST_BEFORE|SSL_ST_CONNECT: | ||
| 139 | case SSL_ST_OK|SSL_ST_CONNECT: | ||
| 140 | |||
| 141 | s->server=0; | ||
| 142 | if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1); | ||
| 143 | |||
| 144 | if ((s->version & 0xff00 ) != 0x0300) | ||
| 145 | { | ||
| 146 | SSLerr(SSL_F_SSL3_CONNECT, SSL_R_INTERNAL_ERROR); | ||
| 147 | ret = -1; | ||
| 148 | goto end; | ||
| 149 | } | ||
| 150 | |||
| 151 | /* s->version=SSL3_VERSION; */ | ||
| 152 | s->type=SSL_ST_CONNECT; | ||
| 153 | |||
| 154 | if (s->init_buf == NULL) | ||
| 155 | { | ||
| 156 | if ((buf=BUF_MEM_new()) == NULL) | ||
| 157 | { | ||
| 158 | ret= -1; | ||
| 159 | goto end; | ||
| 160 | } | ||
| 161 | if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH)) | ||
| 162 | { | ||
| 163 | ret= -1; | ||
| 164 | goto end; | ||
| 165 | } | ||
| 166 | s->init_buf=buf; | ||
| 167 | } | ||
| 168 | |||
| 169 | if (!ssl3_setup_buffers(s)) { ret= -1; goto end; } | ||
| 170 | |||
| 171 | /* setup buffing BIO */ | ||
| 172 | if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; } | ||
| 173 | |||
| 174 | /* don't push the buffering BIO quite yet */ | ||
| 175 | |||
| 176 | ssl3_init_finished_mac(s); | ||
| 177 | |||
| 178 | s->state=SSL3_ST_CW_CLNT_HELLO_A; | ||
| 179 | s->ctx->stats.sess_connect++; | ||
| 180 | s->init_num=0; | ||
| 181 | break; | ||
| 182 | |||
| 183 | case SSL3_ST_CW_CLNT_HELLO_A: | ||
| 184 | case SSL3_ST_CW_CLNT_HELLO_B: | ||
| 185 | |||
| 186 | s->shutdown=0; | ||
| 187 | ret=ssl3_client_hello(s); | ||
| 188 | if (ret <= 0) goto end; | ||
| 189 | s->state=SSL3_ST_CR_SRVR_HELLO_A; | ||
| 190 | s->init_num=0; | ||
| 191 | |||
| 192 | /* turn on buffering for the next lot of output */ | ||
| 193 | if (s->bbio != s->wbio) | ||
| 194 | s->wbio=BIO_push(s->bbio,s->wbio); | ||
| 195 | |||
| 196 | break; | ||
| 197 | |||
| 198 | case SSL3_ST_CR_SRVR_HELLO_A: | ||
| 199 | case SSL3_ST_CR_SRVR_HELLO_B: | ||
| 200 | ret=ssl3_get_server_hello(s); | ||
| 201 | if (ret <= 0) goto end; | ||
| 202 | if (s->hit) | ||
| 203 | s->state=SSL3_ST_CR_FINISHED_A; | ||
| 204 | else | ||
| 205 | s->state=SSL3_ST_CR_CERT_A; | ||
| 206 | s->init_num=0; | ||
| 207 | break; | ||
| 208 | |||
| 209 | case SSL3_ST_CR_CERT_A: | ||
| 210 | case SSL3_ST_CR_CERT_B: | ||
| 211 | /* Check if it is anon DH */ | ||
| 212 | if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)) | ||
| 213 | { | ||
| 214 | ret=ssl3_get_server_certificate(s); | ||
| 215 | if (ret <= 0) goto end; | ||
| 216 | } | ||
| 217 | else | ||
| 218 | skip=1; | ||
| 219 | s->state=SSL3_ST_CR_KEY_EXCH_A; | ||
| 220 | s->init_num=0; | ||
| 221 | break; | ||
| 222 | |||
| 223 | case SSL3_ST_CR_KEY_EXCH_A: | ||
| 224 | case SSL3_ST_CR_KEY_EXCH_B: | ||
| 225 | ret=ssl3_get_key_exchange(s); | ||
| 226 | if (ret <= 0) goto end; | ||
| 227 | s->state=SSL3_ST_CR_CERT_REQ_A; | ||
| 228 | s->init_num=0; | ||
| 229 | |||
| 230 | /* at this point we check that we have the | ||
| 231 | * required stuff from the server */ | ||
| 232 | if (!ssl3_check_cert_and_algorithm(s)) | ||
| 233 | { | ||
| 234 | ret= -1; | ||
| 235 | goto end; | ||
| 236 | } | ||
| 237 | break; | ||
| 238 | |||
| 239 | case SSL3_ST_CR_CERT_REQ_A: | ||
| 240 | case SSL3_ST_CR_CERT_REQ_B: | ||
| 241 | ret=ssl3_get_certificate_request(s); | ||
| 242 | if (ret <= 0) goto end; | ||
| 243 | s->state=SSL3_ST_CR_SRVR_DONE_A; | ||
| 244 | s->init_num=0; | ||
| 245 | break; | ||
| 246 | |||
| 247 | case SSL3_ST_CR_SRVR_DONE_A: | ||
| 248 | case SSL3_ST_CR_SRVR_DONE_B: | ||
| 249 | ret=ssl3_get_server_done(s); | ||
| 250 | if (ret <= 0) goto end; | ||
| 251 | if (s->s3->tmp.cert_req) | ||
| 252 | s->state=SSL3_ST_CW_CERT_A; | ||
| 253 | else | ||
| 254 | s->state=SSL3_ST_CW_KEY_EXCH_A; | ||
| 255 | s->init_num=0; | ||
| 256 | |||
| 257 | break; | ||
| 258 | |||
| 259 | case SSL3_ST_CW_CERT_A: | ||
| 260 | case SSL3_ST_CW_CERT_B: | ||
| 261 | case SSL3_ST_CW_CERT_C: | ||
| 262 | case SSL3_ST_CW_CERT_D: | ||
| 263 | ret=ssl3_send_client_certificate(s); | ||
| 264 | if (ret <= 0) goto end; | ||
| 265 | s->state=SSL3_ST_CW_KEY_EXCH_A; | ||
| 266 | s->init_num=0; | ||
| 267 | break; | ||
| 268 | |||
| 269 | case SSL3_ST_CW_KEY_EXCH_A: | ||
| 270 | case SSL3_ST_CW_KEY_EXCH_B: | ||
| 271 | ret=ssl3_send_client_key_exchange(s); | ||
| 272 | if (ret <= 0) goto end; | ||
| 273 | l=s->s3->tmp.new_cipher->algorithms; | ||
| 274 | /* EAY EAY EAY need to check for DH fix cert | ||
| 275 | * sent back */ | ||
| 276 | /* For TLS, cert_req is set to 2, so a cert chain | ||
| 277 | * of nothing is sent, but no verify packet is sent */ | ||
| 278 | if (s->s3->tmp.cert_req == 1) | ||
| 279 | { | ||
| 280 | s->state=SSL3_ST_CW_CERT_VRFY_A; | ||
| 281 | } | ||
| 282 | else | ||
| 283 | { | ||
| 284 | s->state=SSL3_ST_CW_CHANGE_A; | ||
| 285 | s->s3->change_cipher_spec=0; | ||
| 286 | } | ||
| 287 | |||
| 288 | s->init_num=0; | ||
| 289 | break; | ||
| 290 | |||
| 291 | case SSL3_ST_CW_CERT_VRFY_A: | ||
| 292 | case SSL3_ST_CW_CERT_VRFY_B: | ||
| 293 | ret=ssl3_send_client_verify(s); | ||
| 294 | if (ret <= 0) goto end; | ||
| 295 | s->state=SSL3_ST_CW_CHANGE_A; | ||
| 296 | s->init_num=0; | ||
| 297 | s->s3->change_cipher_spec=0; | ||
| 298 | break; | ||
| 299 | |||
| 300 | case SSL3_ST_CW_CHANGE_A: | ||
| 301 | case SSL3_ST_CW_CHANGE_B: | ||
| 302 | ret=ssl3_send_change_cipher_spec(s, | ||
| 303 | SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B); | ||
| 304 | if (ret <= 0) goto end; | ||
| 305 | s->state=SSL3_ST_CW_FINISHED_A; | ||
| 306 | s->init_num=0; | ||
| 307 | |||
| 308 | s->session->cipher=s->s3->tmp.new_cipher; | ||
| 309 | if (s->s3->tmp.new_compression == NULL) | ||
| 310 | s->session->compress_meth=0; | ||
| 311 | else | ||
| 312 | s->session->compress_meth= | ||
| 313 | s->s3->tmp.new_compression->id; | ||
| 314 | if (!s->method->ssl3_enc->setup_key_block(s)) | ||
| 315 | { | ||
| 316 | ret= -1; | ||
| 317 | goto end; | ||
| 318 | } | ||
| 319 | |||
| 320 | if (!s->method->ssl3_enc->change_cipher_state(s, | ||
| 321 | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) | ||
| 322 | { | ||
| 323 | ret= -1; | ||
| 324 | goto end; | ||
| 325 | } | ||
| 326 | |||
| 327 | break; | ||
| 328 | |||
| 329 | case SSL3_ST_CW_FINISHED_A: | ||
| 330 | case SSL3_ST_CW_FINISHED_B: | ||
| 331 | ret=ssl3_send_finished(s, | ||
| 332 | SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B, | ||
| 333 | s->method->ssl3_enc->client_finished_label, | ||
| 334 | s->method->ssl3_enc->client_finished_label_len); | ||
| 335 | if (ret <= 0) goto end; | ||
| 336 | s->state=SSL3_ST_CW_FLUSH; | ||
| 337 | |||
| 338 | /* clear flags */ | ||
| 339 | s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; | ||
| 340 | if (s->hit) | ||
| 341 | { | ||
| 342 | s->s3->tmp.next_state=SSL_ST_OK; | ||
| 343 | if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED) | ||
| 344 | { | ||
| 345 | s->state=SSL_ST_OK; | ||
| 346 | s->s3->flags|=SSL3_FLAGS_POP_BUFFER; | ||
| 347 | s->s3->delay_buf_pop_ret=0; | ||
| 348 | } | ||
| 349 | } | ||
| 350 | else | ||
| 351 | { | ||
| 352 | s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A; | ||
| 353 | } | ||
| 354 | s->init_num=0; | ||
| 355 | break; | ||
| 356 | |||
| 357 | case SSL3_ST_CR_FINISHED_A: | ||
| 358 | case SSL3_ST_CR_FINISHED_B: | ||
| 359 | |||
| 360 | ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A, | ||
| 361 | SSL3_ST_CR_FINISHED_B); | ||
| 362 | if (ret <= 0) goto end; | ||
| 363 | |||
| 364 | if (s->hit) | ||
| 365 | s->state=SSL3_ST_CW_CHANGE_A; | ||
| 366 | else | ||
| 367 | s->state=SSL_ST_OK; | ||
| 368 | s->init_num=0; | ||
| 369 | break; | ||
| 370 | |||
| 371 | case SSL3_ST_CW_FLUSH: | ||
| 372 | /* number of bytes to be flushed */ | ||
| 373 | num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL); | ||
| 374 | if (num1 > 0) | ||
| 375 | { | ||
| 376 | s->rwstate=SSL_WRITING; | ||
| 377 | num1=BIO_flush(s->wbio); | ||
| 378 | if (num1 <= 0) { ret= -1; goto end; } | ||
| 379 | s->rwstate=SSL_NOTHING; | ||
| 380 | } | ||
| 381 | |||
| 382 | s->state=s->s3->tmp.next_state; | ||
| 383 | break; | ||
| 384 | |||
| 385 | case SSL_ST_OK: | ||
| 386 | /* clean a few things up */ | ||
| 387 | ssl3_cleanup_key_block(s); | ||
| 388 | |||
| 389 | if (s->init_buf != NULL) | ||
| 390 | { | ||
| 391 | BUF_MEM_free(s->init_buf); | ||
| 392 | s->init_buf=NULL; | ||
| 393 | } | ||
| 394 | |||
| 395 | /* If we are not 'joining' the last two packets, | ||
| 396 | * remove the buffering now */ | ||
| 397 | if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER)) | ||
| 398 | ssl_free_wbio_buffer(s); | ||
| 399 | /* else do it later in ssl3_write */ | ||
| 400 | |||
| 401 | s->init_num=0; | ||
| 402 | s->new_session=0; | ||
| 403 | |||
| 404 | ssl_update_cache(s,SSL_SESS_CACHE_CLIENT); | ||
| 405 | if (s->hit) s->ctx->stats.sess_hit++; | ||
| 406 | |||
| 407 | ret=1; | ||
| 408 | /* s->server=0; */ | ||
| 409 | s->handshake_func=ssl3_connect; | ||
| 410 | s->ctx->stats.sess_connect_good++; | ||
| 411 | |||
| 412 | if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1); | ||
| 413 | |||
| 414 | goto end; | ||
| 415 | /* break; */ | ||
| 416 | |||
| 417 | default: | ||
| 418 | SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE); | ||
| 419 | ret= -1; | ||
| 420 | goto end; | ||
| 421 | /* break; */ | ||
| 422 | } | ||
| 423 | |||
| 424 | /* did we do anything */ | ||
| 425 | if (!s->s3->tmp.reuse_message && !skip) | ||
| 426 | { | ||
| 427 | if (s->debug) | ||
| 428 | { | ||
| 429 | if ((ret=BIO_flush(s->wbio)) <= 0) | ||
| 430 | goto end; | ||
| 431 | } | ||
| 432 | |||
| 433 | if ((cb != NULL) && (s->state != state)) | ||
| 434 | { | ||
| 435 | new_state=s->state; | ||
| 436 | s->state=state; | ||
| 437 | cb(s,SSL_CB_CONNECT_LOOP,1); | ||
| 438 | s->state=new_state; | ||
| 439 | } | ||
| 440 | } | ||
| 441 | skip=0; | ||
| 442 | } | ||
| 443 | end: | ||
| 444 | if (cb != NULL) | ||
| 445 | cb(s,SSL_CB_CONNECT_EXIT,ret); | ||
| 446 | s->in_handshake--; | ||
| 447 | return(ret); | ||
| 448 | } | ||
| 449 | |||
| 450 | |||
| 451 | static int ssl3_client_hello(SSL *s) | ||
| 452 | { | ||
| 453 | unsigned char *buf; | ||
| 454 | unsigned char *p,*d; | ||
| 455 | int i,j; | ||
| 456 | unsigned long Time,l; | ||
| 457 | SSL_COMP *comp; | ||
| 458 | |||
| 459 | buf=(unsigned char *)s->init_buf->data; | ||
| 460 | if (s->state == SSL3_ST_CW_CLNT_HELLO_A) | ||
| 461 | { | ||
| 462 | if ((s->session == NULL) || | ||
| 463 | (s->session->ssl_version != s->version) || | ||
| 464 | (s->session->not_resumable)) | ||
| 465 | { | ||
| 466 | if (!ssl_get_new_session(s,0)) | ||
| 467 | goto err; | ||
| 468 | } | ||
| 469 | /* else use the pre-loaded session */ | ||
| 470 | |||
| 471 | p=s->s3->client_random; | ||
| 472 | Time=time(NULL); /* Time */ | ||
| 473 | l2n(Time,p); | ||
| 474 | RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time)); | ||
| 475 | |||
| 476 | /* Do the message type and length last */ | ||
| 477 | d=p= &(buf[4]); | ||
| 478 | |||
| 479 | *(p++)=s->version>>8; | ||
| 480 | *(p++)=s->version&0xff; | ||
| 481 | s->client_version=s->version; | ||
| 482 | |||
| 483 | /* Random stuff */ | ||
| 484 | memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE); | ||
| 485 | p+=SSL3_RANDOM_SIZE; | ||
| 486 | |||
| 487 | /* Session ID */ | ||
| 488 | if (s->new_session) | ||
| 489 | i=0; | ||
| 490 | else | ||
| 491 | i=s->session->session_id_length; | ||
| 492 | *(p++)=i; | ||
| 493 | if (i != 0) | ||
| 494 | { | ||
| 495 | memcpy(p,s->session->session_id,i); | ||
| 496 | p+=i; | ||
| 497 | } | ||
| 498 | |||
| 499 | /* Ciphers supported */ | ||
| 500 | i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2])); | ||
| 501 | if (i == 0) | ||
| 502 | { | ||
| 503 | SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE); | ||
| 504 | goto err; | ||
| 505 | } | ||
| 506 | s2n(i,p); | ||
| 507 | p+=i; | ||
| 508 | |||
| 509 | /* COMPRESSION */ | ||
| 510 | if (s->ctx->comp_methods == NULL) | ||
| 511 | j=0; | ||
| 512 | else | ||
| 513 | j=sk_SSL_COMP_num(s->ctx->comp_methods); | ||
| 514 | *(p++)=1+j; | ||
| 515 | for (i=0; i<j; i++) | ||
| 516 | { | ||
| 517 | comp=sk_SSL_COMP_value(s->ctx->comp_methods,i); | ||
| 518 | *(p++)=comp->id; | ||
| 519 | } | ||
| 520 | *(p++)=0; /* Add the NULL method */ | ||
| 521 | |||
| 522 | l=(p-d); | ||
| 523 | d=buf; | ||
| 524 | *(d++)=SSL3_MT_CLIENT_HELLO; | ||
| 525 | l2n3(l,d); | ||
| 526 | |||
| 527 | s->state=SSL3_ST_CW_CLNT_HELLO_B; | ||
| 528 | /* number of bytes to write */ | ||
| 529 | s->init_num=p-buf; | ||
| 530 | s->init_off=0; | ||
| 531 | } | ||
| 532 | |||
| 533 | /* SSL3_ST_CW_CLNT_HELLO_B */ | ||
| 534 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 535 | err: | ||
| 536 | return(-1); | ||
| 537 | } | ||
| 538 | |||
| 539 | static int ssl3_get_server_hello(SSL *s) | ||
| 540 | { | ||
| 541 | STACK_OF(SSL_CIPHER) *sk; | ||
| 542 | SSL_CIPHER *c; | ||
| 543 | unsigned char *p,*d; | ||
| 544 | int i,al,ok; | ||
| 545 | unsigned int j; | ||
| 546 | long n; | ||
| 547 | SSL_COMP *comp; | ||
| 548 | |||
| 549 | n=ssl3_get_message(s, | ||
| 550 | SSL3_ST_CR_SRVR_HELLO_A, | ||
| 551 | SSL3_ST_CR_SRVR_HELLO_B, | ||
| 552 | SSL3_MT_SERVER_HELLO, | ||
| 553 | 300, /* ?? */ | ||
| 554 | &ok); | ||
| 555 | |||
| 556 | if (!ok) return((int)n); | ||
| 557 | d=p=(unsigned char *)s->init_buf->data; | ||
| 558 | |||
| 559 | if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff))) | ||
| 560 | { | ||
| 561 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION); | ||
| 562 | s->version=(s->version&0xff00)|p[1]; | ||
| 563 | al=SSL_AD_PROTOCOL_VERSION; | ||
| 564 | goto f_err; | ||
| 565 | } | ||
| 566 | p+=2; | ||
| 567 | |||
| 568 | /* load the server hello data */ | ||
| 569 | /* load the server random */ | ||
| 570 | memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE); | ||
| 571 | p+=SSL3_RANDOM_SIZE; | ||
| 572 | |||
| 573 | /* get the session-id */ | ||
| 574 | j= *(p++); | ||
| 575 | |||
| 576 | if ((j != 0) && (j != SSL3_SESSION_ID_SIZE)) | ||
| 577 | { | ||
| 578 | /* SSLref returns 16 :-( */ | ||
| 579 | if (j < SSL2_SSL_SESSION_ID_LENGTH) | ||
| 580 | { | ||
| 581 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 582 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_SHORT); | ||
| 583 | goto f_err; | ||
| 584 | } | ||
| 585 | } | ||
| 586 | if (j != 0 && j == s->session->session_id_length | ||
| 587 | && memcmp(p,s->session->session_id,j) == 0) | ||
| 588 | { | ||
| 589 | if(s->sid_ctx_length != s->session->sid_ctx_length | ||
| 590 | || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length)) | ||
| 591 | { | ||
| 592 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 593 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); | ||
| 594 | goto f_err; | ||
| 595 | } | ||
| 596 | s->hit=1; | ||
| 597 | } | ||
| 598 | else /* a miss or crap from the other end */ | ||
| 599 | { | ||
| 600 | /* If we were trying for session-id reuse, make a new | ||
| 601 | * SSL_SESSION so we don't stuff up other people */ | ||
| 602 | s->hit=0; | ||
| 603 | if (s->session->session_id_length > 0) | ||
| 604 | { | ||
| 605 | if (!ssl_get_new_session(s,0)) | ||
| 606 | { | ||
| 607 | al=SSL_AD_INTERNAL_ERROR; | ||
| 608 | goto f_err; | ||
| 609 | } | ||
| 610 | } | ||
| 611 | s->session->session_id_length=j; | ||
| 612 | memcpy(s->session->session_id,p,j); /* j could be 0 */ | ||
| 613 | } | ||
| 614 | p+=j; | ||
| 615 | c=ssl_get_cipher_by_char(s,p); | ||
| 616 | if (c == NULL) | ||
| 617 | { | ||
| 618 | /* unknown cipher */ | ||
| 619 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 620 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED); | ||
| 621 | goto f_err; | ||
| 622 | } | ||
| 623 | p+=ssl_put_cipher_by_char(s,NULL,NULL); | ||
| 624 | |||
| 625 | sk=ssl_get_ciphers_by_id(s); | ||
| 626 | i=sk_SSL_CIPHER_find(sk,c); | ||
| 627 | if (i < 0) | ||
| 628 | { | ||
| 629 | /* we did not say we would use this cipher */ | ||
| 630 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 631 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED); | ||
| 632 | goto f_err; | ||
| 633 | } | ||
| 634 | |||
| 635 | if (s->hit && (s->session->cipher != c)) | ||
| 636 | { | ||
| 637 | if (!(s->options & | ||
| 638 | SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) | ||
| 639 | { | ||
| 640 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 641 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); | ||
| 642 | goto f_err; | ||
| 643 | } | ||
| 644 | } | ||
| 645 | s->s3->tmp.new_cipher=c; | ||
| 646 | |||
| 647 | /* lets get the compression algorithm */ | ||
| 648 | /* COMPRESSION */ | ||
| 649 | j= *(p++); | ||
| 650 | if (j == 0) | ||
| 651 | comp=NULL; | ||
| 652 | else | ||
| 653 | comp=ssl3_comp_find(s->ctx->comp_methods,j); | ||
| 654 | |||
| 655 | if ((j != 0) && (comp == NULL)) | ||
| 656 | { | ||
| 657 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 658 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); | ||
| 659 | goto f_err; | ||
| 660 | } | ||
| 661 | else | ||
| 662 | { | ||
| 663 | s->s3->tmp.new_compression=comp; | ||
| 664 | } | ||
| 665 | |||
| 666 | if (p != (d+n)) | ||
| 667 | { | ||
| 668 | /* wrong packet length */ | ||
| 669 | al=SSL_AD_DECODE_ERROR; | ||
| 670 | SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH); | ||
| 671 | goto err; | ||
| 672 | } | ||
| 673 | |||
| 674 | return(1); | ||
| 675 | f_err: | ||
| 676 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 677 | err: | ||
| 678 | return(-1); | ||
| 679 | } | ||
| 680 | |||
| 681 | static int ssl3_get_server_certificate(SSL *s) | ||
| 682 | { | ||
| 683 | int al,i,ok,ret= -1; | ||
| 684 | unsigned long n,nc,llen,l; | ||
| 685 | X509 *x=NULL; | ||
| 686 | unsigned char *p,*d,*q; | ||
| 687 | STACK_OF(X509) *sk=NULL; | ||
| 688 | SESS_CERT *sc; | ||
| 689 | EVP_PKEY *pkey=NULL; | ||
| 690 | |||
| 691 | n=ssl3_get_message(s, | ||
| 692 | SSL3_ST_CR_CERT_A, | ||
| 693 | SSL3_ST_CR_CERT_B, | ||
| 694 | -1, | ||
| 695 | #if defined(MSDOS) && !defined(WIN32) | ||
| 696 | 1024*30, /* 30k max cert list :-) */ | ||
| 697 | #else | ||
| 698 | 1024*100, /* 100k max cert list :-) */ | ||
| 699 | #endif | ||
| 700 | &ok); | ||
| 701 | |||
| 702 | if (!ok) return((int)n); | ||
| 703 | |||
| 704 | if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) | ||
| 705 | { | ||
| 706 | s->s3->tmp.reuse_message=1; | ||
| 707 | return(1); | ||
| 708 | } | ||
| 709 | |||
| 710 | if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE) | ||
| 711 | { | ||
| 712 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 713 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE); | ||
| 714 | goto f_err; | ||
| 715 | } | ||
| 716 | d=p=(unsigned char *)s->init_buf->data; | ||
| 717 | |||
| 718 | if ((sk=sk_X509_new_null()) == NULL) | ||
| 719 | { | ||
| 720 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE); | ||
| 721 | goto err; | ||
| 722 | } | ||
| 723 | |||
| 724 | n2l3(p,llen); | ||
| 725 | if (llen+3 != n) | ||
| 726 | { | ||
| 727 | al=SSL_AD_DECODE_ERROR; | ||
| 728 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH); | ||
| 729 | goto f_err; | ||
| 730 | } | ||
| 731 | for (nc=0; nc<llen; ) | ||
| 732 | { | ||
| 733 | n2l3(p,l); | ||
| 734 | if ((l+nc+3) > llen) | ||
| 735 | { | ||
| 736 | al=SSL_AD_DECODE_ERROR; | ||
| 737 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); | ||
| 738 | goto f_err; | ||
| 739 | } | ||
| 740 | |||
| 741 | q=p; | ||
| 742 | x=d2i_X509(NULL,&q,l); | ||
| 743 | if (x == NULL) | ||
| 744 | { | ||
| 745 | al=SSL_AD_BAD_CERTIFICATE; | ||
| 746 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB); | ||
| 747 | goto f_err; | ||
| 748 | } | ||
| 749 | if (q != (p+l)) | ||
| 750 | { | ||
| 751 | al=SSL_AD_DECODE_ERROR; | ||
| 752 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); | ||
| 753 | goto f_err; | ||
| 754 | } | ||
| 755 | if (!sk_X509_push(sk,x)) | ||
| 756 | { | ||
| 757 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE); | ||
| 758 | goto err; | ||
| 759 | } | ||
| 760 | x=NULL; | ||
| 761 | nc+=l+3; | ||
| 762 | p=q; | ||
| 763 | } | ||
| 764 | |||
| 765 | i=ssl_verify_cert_chain(s,sk); | ||
| 766 | if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)) | ||
| 767 | { | ||
| 768 | al=ssl_verify_alarm_type(s->verify_result); | ||
| 769 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED); | ||
| 770 | goto f_err; | ||
| 771 | } | ||
| 772 | ERR_clear_error(); /* but we keep s->verify_result */ | ||
| 773 | |||
| 774 | sc=ssl_sess_cert_new(); | ||
| 775 | if (sc == NULL) goto err; | ||
| 776 | |||
| 777 | if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert); | ||
| 778 | s->session->sess_cert=sc; | ||
| 779 | |||
| 780 | sc->cert_chain=sk; | ||
| 781 | /* Inconsistency alert: cert_chain does include the peer's | ||
| 782 | * certificate, which we don't include in s3_srvr.c */ | ||
| 783 | x=sk_X509_value(sk,0); | ||
| 784 | sk=NULL; | ||
| 785 | |||
| 786 | pkey=X509_get_pubkey(x); | ||
| 787 | |||
| 788 | if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)) | ||
| 789 | { | ||
| 790 | x=NULL; | ||
| 791 | al=SSL3_AL_FATAL; | ||
| 792 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); | ||
| 793 | goto f_err; | ||
| 794 | } | ||
| 795 | |||
| 796 | i=ssl_cert_type(x,pkey); | ||
| 797 | if (i < 0) | ||
| 798 | { | ||
| 799 | x=NULL; | ||
| 800 | al=SSL3_AL_FATAL; | ||
| 801 | SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNKNOWN_CERTIFICATE_TYPE); | ||
| 802 | goto f_err; | ||
| 803 | } | ||
| 804 | |||
| 805 | sc->peer_cert_type=i; | ||
| 806 | CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); | ||
| 807 | if (sc->peer_pkeys[i].x509 != NULL) /* Why would this ever happen? | ||
| 808 | * We just created sc a couple of | ||
| 809 | * lines ago. */ | ||
| 810 | X509_free(sc->peer_pkeys[i].x509); | ||
| 811 | sc->peer_pkeys[i].x509=x; | ||
| 812 | sc->peer_key= &(sc->peer_pkeys[i]); | ||
| 813 | |||
| 814 | if (s->session->peer != NULL) | ||
| 815 | X509_free(s->session->peer); | ||
| 816 | CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); | ||
| 817 | s->session->peer=x; | ||
| 818 | s->session->verify_result = s->verify_result; | ||
| 819 | |||
| 820 | x=NULL; | ||
| 821 | ret=1; | ||
| 822 | |||
| 823 | if (0) | ||
| 824 | { | ||
| 825 | f_err: | ||
| 826 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 827 | } | ||
| 828 | err: | ||
| 829 | EVP_PKEY_free(pkey); | ||
| 830 | X509_free(x); | ||
| 831 | sk_X509_pop_free(sk,X509_free); | ||
| 832 | return(ret); | ||
| 833 | } | ||
| 834 | |||
| 835 | static int ssl3_get_key_exchange(SSL *s) | ||
| 836 | { | ||
| 837 | #ifndef NO_RSA | ||
| 838 | unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2]; | ||
| 839 | #endif | ||
| 840 | EVP_MD_CTX md_ctx; | ||
| 841 | unsigned char *param,*p; | ||
| 842 | int al,i,j,param_len,ok; | ||
| 843 | long n,alg; | ||
| 844 | EVP_PKEY *pkey=NULL; | ||
| 845 | #ifndef NO_RSA | ||
| 846 | RSA *rsa=NULL; | ||
| 847 | #endif | ||
| 848 | #ifndef NO_DH | ||
| 849 | DH *dh=NULL; | ||
| 850 | #endif | ||
| 851 | |||
| 852 | n=ssl3_get_message(s, | ||
| 853 | SSL3_ST_CR_KEY_EXCH_A, | ||
| 854 | SSL3_ST_CR_KEY_EXCH_B, | ||
| 855 | -1, | ||
| 856 | 1024*8, /* ?? */ | ||
| 857 | &ok); | ||
| 858 | |||
| 859 | if (!ok) return((int)n); | ||
| 860 | |||
| 861 | if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE) | ||
| 862 | { | ||
| 863 | s->s3->tmp.reuse_message=1; | ||
| 864 | return(1); | ||
| 865 | } | ||
| 866 | |||
| 867 | param=p=(unsigned char *)s->init_buf->data; | ||
| 868 | |||
| 869 | if (s->session->sess_cert != NULL) | ||
| 870 | { | ||
| 871 | #ifndef NO_RSA | ||
| 872 | if (s->session->sess_cert->peer_rsa_tmp != NULL) | ||
| 873 | { | ||
| 874 | RSA_free(s->session->sess_cert->peer_rsa_tmp); | ||
| 875 | s->session->sess_cert->peer_rsa_tmp=NULL; | ||
| 876 | } | ||
| 877 | #endif | ||
| 878 | #ifndef NO_DH | ||
| 879 | if (s->session->sess_cert->peer_dh_tmp) | ||
| 880 | { | ||
| 881 | DH_free(s->session->sess_cert->peer_dh_tmp); | ||
| 882 | s->session->sess_cert->peer_dh_tmp=NULL; | ||
| 883 | } | ||
| 884 | #endif | ||
| 885 | } | ||
| 886 | else | ||
| 887 | { | ||
| 888 | s->session->sess_cert=ssl_sess_cert_new(); | ||
| 889 | } | ||
| 890 | |||
| 891 | param_len=0; | ||
| 892 | alg=s->s3->tmp.new_cipher->algorithms; | ||
| 893 | |||
| 894 | #ifndef NO_RSA | ||
| 895 | if (alg & SSL_kRSA) | ||
| 896 | { | ||
| 897 | if ((rsa=RSA_new()) == NULL) | ||
| 898 | { | ||
| 899 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE); | ||
| 900 | goto err; | ||
| 901 | } | ||
| 902 | n2s(p,i); | ||
| 903 | param_len=i+2; | ||
| 904 | if (param_len > n) | ||
| 905 | { | ||
| 906 | al=SSL_AD_DECODE_ERROR; | ||
| 907 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH); | ||
| 908 | goto f_err; | ||
| 909 | } | ||
| 910 | if (!(rsa->n=BN_bin2bn(p,i,rsa->n))) | ||
| 911 | { | ||
| 912 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); | ||
| 913 | goto err; | ||
| 914 | } | ||
| 915 | p+=i; | ||
| 916 | |||
| 917 | n2s(p,i); | ||
| 918 | param_len+=i+2; | ||
| 919 | if (param_len > n) | ||
| 920 | { | ||
| 921 | al=SSL_AD_DECODE_ERROR; | ||
| 922 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH); | ||
| 923 | goto f_err; | ||
| 924 | } | ||
| 925 | if (!(rsa->e=BN_bin2bn(p,i,rsa->e))) | ||
| 926 | { | ||
| 927 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); | ||
| 928 | goto err; | ||
| 929 | } | ||
| 930 | p+=i; | ||
| 931 | n-=param_len; | ||
| 932 | |||
| 933 | /* this should be because we are using an export cipher */ | ||
| 934 | if (alg & SSL_aRSA) | ||
| 935 | pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); | ||
| 936 | else | ||
| 937 | { | ||
| 938 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); | ||
| 939 | goto err; | ||
| 940 | } | ||
| 941 | s->session->sess_cert->peer_rsa_tmp=rsa; | ||
| 942 | rsa=NULL; | ||
| 943 | } | ||
| 944 | #else /* NO_RSA */ | ||
| 945 | if (0) | ||
| 946 | ; | ||
| 947 | #endif | ||
| 948 | #ifndef NO_DH | ||
| 949 | else if (alg & SSL_kEDH) | ||
| 950 | { | ||
| 951 | if ((dh=DH_new()) == NULL) | ||
| 952 | { | ||
| 953 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 954 | goto err; | ||
| 955 | } | ||
| 956 | n2s(p,i); | ||
| 957 | param_len=i+2; | ||
| 958 | if (param_len > n) | ||
| 959 | { | ||
| 960 | al=SSL_AD_DECODE_ERROR; | ||
| 961 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH); | ||
| 962 | goto f_err; | ||
| 963 | } | ||
| 964 | if (!(dh->p=BN_bin2bn(p,i,NULL))) | ||
| 965 | { | ||
| 966 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); | ||
| 967 | goto err; | ||
| 968 | } | ||
| 969 | p+=i; | ||
| 970 | |||
| 971 | n2s(p,i); | ||
| 972 | param_len+=i+2; | ||
| 973 | if (param_len > n) | ||
| 974 | { | ||
| 975 | al=SSL_AD_DECODE_ERROR; | ||
| 976 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH); | ||
| 977 | goto f_err; | ||
| 978 | } | ||
| 979 | if (!(dh->g=BN_bin2bn(p,i,NULL))) | ||
| 980 | { | ||
| 981 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); | ||
| 982 | goto err; | ||
| 983 | } | ||
| 984 | p+=i; | ||
| 985 | |||
| 986 | n2s(p,i); | ||
| 987 | param_len+=i+2; | ||
| 988 | if (param_len > n) | ||
| 989 | { | ||
| 990 | al=SSL_AD_DECODE_ERROR; | ||
| 991 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH); | ||
| 992 | goto f_err; | ||
| 993 | } | ||
| 994 | if (!(dh->pub_key=BN_bin2bn(p,i,NULL))) | ||
| 995 | { | ||
| 996 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); | ||
| 997 | goto err; | ||
| 998 | } | ||
| 999 | p+=i; | ||
| 1000 | n-=param_len; | ||
| 1001 | |||
| 1002 | #ifndef NO_RSA | ||
| 1003 | if (alg & SSL_aRSA) | ||
| 1004 | pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); | ||
| 1005 | #else | ||
| 1006 | if (0) | ||
| 1007 | ; | ||
| 1008 | #endif | ||
| 1009 | #ifndef NO_DSA | ||
| 1010 | else if (alg & SSL_aDSS) | ||
| 1011 | pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509); | ||
| 1012 | #endif | ||
| 1013 | /* else anonymous DH, so no certificate or pkey. */ | ||
| 1014 | |||
| 1015 | s->session->sess_cert->peer_dh_tmp=dh; | ||
| 1016 | dh=NULL; | ||
| 1017 | } | ||
| 1018 | else if ((alg & SSL_kDHr) || (alg & SSL_kDHd)) | ||
| 1019 | { | ||
| 1020 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 1021 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); | ||
| 1022 | goto f_err; | ||
| 1023 | } | ||
| 1024 | #endif /* !NO_DH */ | ||
| 1025 | if (alg & SSL_aFZA) | ||
| 1026 | { | ||
| 1027 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1028 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); | ||
| 1029 | goto f_err; | ||
| 1030 | } | ||
| 1031 | |||
| 1032 | |||
| 1033 | /* p points to the next byte, there are 'n' bytes left */ | ||
| 1034 | |||
| 1035 | |||
| 1036 | /* if it was signed, check the signature */ | ||
| 1037 | if (pkey != NULL) | ||
| 1038 | { | ||
| 1039 | n2s(p,i); | ||
| 1040 | n-=2; | ||
| 1041 | j=EVP_PKEY_size(pkey); | ||
| 1042 | |||
| 1043 | if ((i != n) || (n > j) || (n <= 0)) | ||
| 1044 | { | ||
| 1045 | /* wrong packet length */ | ||
| 1046 | al=SSL_AD_DECODE_ERROR; | ||
| 1047 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH); | ||
| 1048 | goto f_err; | ||
| 1049 | } | ||
| 1050 | |||
| 1051 | #ifndef NO_RSA | ||
| 1052 | if (pkey->type == EVP_PKEY_RSA) | ||
| 1053 | { | ||
| 1054 | int num; | ||
| 1055 | |||
| 1056 | j=0; | ||
| 1057 | q=md_buf; | ||
| 1058 | for (num=2; num > 0; num--) | ||
| 1059 | { | ||
| 1060 | EVP_DigestInit(&md_ctx,(num == 2) | ||
| 1061 | ?s->ctx->md5:s->ctx->sha1); | ||
| 1062 | EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); | ||
| 1063 | EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); | ||
| 1064 | EVP_DigestUpdate(&md_ctx,param,param_len); | ||
| 1065 | EVP_DigestFinal(&md_ctx,q,(unsigned int *)&i); | ||
| 1066 | q+=i; | ||
| 1067 | j+=i; | ||
| 1068 | } | ||
| 1069 | i=RSA_verify(NID_md5_sha1, md_buf, j, p, n, | ||
| 1070 | pkey->pkey.rsa); | ||
| 1071 | if (i < 0) | ||
| 1072 | { | ||
| 1073 | al=SSL_AD_DECRYPT_ERROR; | ||
| 1074 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); | ||
| 1075 | goto f_err; | ||
| 1076 | } | ||
| 1077 | if (i == 0) | ||
| 1078 | { | ||
| 1079 | /* bad signature */ | ||
| 1080 | al=SSL_AD_DECRYPT_ERROR; | ||
| 1081 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE); | ||
| 1082 | goto f_err; | ||
| 1083 | } | ||
| 1084 | } | ||
| 1085 | else | ||
| 1086 | #endif | ||
| 1087 | #ifndef NO_DSA | ||
| 1088 | if (pkey->type == EVP_PKEY_DSA) | ||
| 1089 | { | ||
| 1090 | /* lets do DSS */ | ||
| 1091 | EVP_VerifyInit(&md_ctx,EVP_dss1()); | ||
| 1092 | EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); | ||
| 1093 | EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); | ||
| 1094 | EVP_VerifyUpdate(&md_ctx,param,param_len); | ||
| 1095 | if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) | ||
| 1096 | { | ||
| 1097 | /* bad signature */ | ||
| 1098 | al=SSL_AD_DECRYPT_ERROR; | ||
| 1099 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE); | ||
| 1100 | goto f_err; | ||
| 1101 | } | ||
| 1102 | } | ||
| 1103 | else | ||
| 1104 | #endif | ||
| 1105 | { | ||
| 1106 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); | ||
| 1107 | goto err; | ||
| 1108 | } | ||
| 1109 | } | ||
| 1110 | else | ||
| 1111 | { | ||
| 1112 | /* still data left over */ | ||
| 1113 | if (!(alg & SSL_aNULL)) | ||
| 1114 | { | ||
| 1115 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); | ||
| 1116 | goto err; | ||
| 1117 | } | ||
| 1118 | if (n != 0) | ||
| 1119 | { | ||
| 1120 | al=SSL_AD_DECODE_ERROR; | ||
| 1121 | SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE); | ||
| 1122 | goto f_err; | ||
| 1123 | } | ||
| 1124 | } | ||
| 1125 | EVP_PKEY_free(pkey); | ||
| 1126 | return(1); | ||
| 1127 | f_err: | ||
| 1128 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 1129 | err: | ||
| 1130 | EVP_PKEY_free(pkey); | ||
| 1131 | #ifndef NO_RSA | ||
| 1132 | if (rsa != NULL) | ||
| 1133 | RSA_free(rsa); | ||
| 1134 | #endif | ||
| 1135 | #ifndef NO_DH | ||
| 1136 | if (dh != NULL) | ||
| 1137 | DH_free(dh); | ||
| 1138 | #endif | ||
| 1139 | return(-1); | ||
| 1140 | } | ||
| 1141 | |||
| 1142 | static int ssl3_get_certificate_request(SSL *s) | ||
| 1143 | { | ||
| 1144 | int ok,ret=0; | ||
| 1145 | unsigned long n,nc,l; | ||
| 1146 | unsigned int llen,ctype_num,i; | ||
| 1147 | X509_NAME *xn=NULL; | ||
| 1148 | unsigned char *p,*d,*q; | ||
| 1149 | STACK_OF(X509_NAME) *ca_sk=NULL; | ||
| 1150 | |||
| 1151 | n=ssl3_get_message(s, | ||
| 1152 | SSL3_ST_CR_CERT_REQ_A, | ||
| 1153 | SSL3_ST_CR_CERT_REQ_B, | ||
| 1154 | -1, | ||
| 1155 | #if defined(MSDOS) && !defined(WIN32) | ||
| 1156 | 1024*30, /* 30k max cert list :-) */ | ||
| 1157 | #else | ||
| 1158 | 1024*100, /* 100k max cert list :-) */ | ||
| 1159 | #endif | ||
| 1160 | &ok); | ||
| 1161 | |||
| 1162 | if (!ok) return((int)n); | ||
| 1163 | |||
| 1164 | s->s3->tmp.cert_req=0; | ||
| 1165 | |||
| 1166 | if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE) | ||
| 1167 | { | ||
| 1168 | s->s3->tmp.reuse_message=1; | ||
| 1169 | return(1); | ||
| 1170 | } | ||
| 1171 | |||
| 1172 | if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST) | ||
| 1173 | { | ||
| 1174 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); | ||
| 1175 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE); | ||
| 1176 | goto err; | ||
| 1177 | } | ||
| 1178 | |||
| 1179 | /* TLS does not like anon-DH with client cert */ | ||
| 1180 | if (s->version > SSL3_VERSION) | ||
| 1181 | { | ||
| 1182 | l=s->s3->tmp.new_cipher->algorithms; | ||
| 1183 | if (l & SSL_aNULL) | ||
| 1184 | { | ||
| 1185 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); | ||
| 1186 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER); | ||
| 1187 | goto err; | ||
| 1188 | } | ||
| 1189 | } | ||
| 1190 | |||
| 1191 | d=p=(unsigned char *)s->init_buf->data; | ||
| 1192 | |||
| 1193 | if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL) | ||
| 1194 | { | ||
| 1195 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE); | ||
| 1196 | goto err; | ||
| 1197 | } | ||
| 1198 | |||
| 1199 | /* get the certificate types */ | ||
| 1200 | ctype_num= *(p++); | ||
| 1201 | if (ctype_num > SSL3_CT_NUMBER) | ||
| 1202 | ctype_num=SSL3_CT_NUMBER; | ||
| 1203 | for (i=0; i<ctype_num; i++) | ||
| 1204 | s->s3->tmp.ctype[i]= p[i]; | ||
| 1205 | p+=ctype_num; | ||
| 1206 | |||
| 1207 | /* get the CA RDNs */ | ||
| 1208 | n2s(p,llen); | ||
| 1209 | #if 0 | ||
| 1210 | { | ||
| 1211 | FILE *out; | ||
| 1212 | out=fopen("/tmp/vsign.der","w"); | ||
| 1213 | fwrite(p,1,llen,out); | ||
| 1214 | fclose(out); | ||
| 1215 | } | ||
| 1216 | #endif | ||
| 1217 | |||
| 1218 | if ((llen+ctype_num+2+1) != n) | ||
| 1219 | { | ||
| 1220 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); | ||
| 1221 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH); | ||
| 1222 | goto err; | ||
| 1223 | } | ||
| 1224 | |||
| 1225 | for (nc=0; nc<llen; ) | ||
| 1226 | { | ||
| 1227 | n2s(p,l); | ||
| 1228 | if ((l+nc+2) > llen) | ||
| 1229 | { | ||
| 1230 | if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG)) | ||
| 1231 | goto cont; /* netscape bugs */ | ||
| 1232 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); | ||
| 1233 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG); | ||
| 1234 | goto err; | ||
| 1235 | } | ||
| 1236 | |||
| 1237 | q=p; | ||
| 1238 | |||
| 1239 | if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL) | ||
| 1240 | { | ||
| 1241 | /* If netscape tolerance is on, ignore errors */ | ||
| 1242 | if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG) | ||
| 1243 | goto cont; | ||
| 1244 | else | ||
| 1245 | { | ||
| 1246 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); | ||
| 1247 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB); | ||
| 1248 | goto err; | ||
| 1249 | } | ||
| 1250 | } | ||
| 1251 | |||
| 1252 | if (q != (p+l)) | ||
| 1253 | { | ||
| 1254 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); | ||
| 1255 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH); | ||
| 1256 | goto err; | ||
| 1257 | } | ||
| 1258 | if (!sk_X509_NAME_push(ca_sk,xn)) | ||
| 1259 | { | ||
| 1260 | SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE); | ||
| 1261 | goto err; | ||
| 1262 | } | ||
| 1263 | |||
| 1264 | p+=l; | ||
| 1265 | nc+=l+2; | ||
| 1266 | } | ||
| 1267 | |||
| 1268 | if (0) | ||
| 1269 | { | ||
| 1270 | cont: | ||
| 1271 | ERR_clear_error(); | ||
| 1272 | } | ||
| 1273 | |||
| 1274 | /* we should setup a certificate to return.... */ | ||
| 1275 | s->s3->tmp.cert_req=1; | ||
| 1276 | s->s3->tmp.ctype_num=ctype_num; | ||
| 1277 | if (s->s3->tmp.ca_names != NULL) | ||
| 1278 | sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); | ||
| 1279 | s->s3->tmp.ca_names=ca_sk; | ||
| 1280 | ca_sk=NULL; | ||
| 1281 | |||
| 1282 | ret=1; | ||
| 1283 | err: | ||
| 1284 | if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free); | ||
| 1285 | return(ret); | ||
| 1286 | } | ||
| 1287 | |||
| 1288 | static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b) | ||
| 1289 | { | ||
| 1290 | return(X509_NAME_cmp(*a,*b)); | ||
| 1291 | } | ||
| 1292 | |||
| 1293 | static int ssl3_get_server_done(SSL *s) | ||
| 1294 | { | ||
| 1295 | int ok,ret=0; | ||
| 1296 | long n; | ||
| 1297 | |||
| 1298 | n=ssl3_get_message(s, | ||
| 1299 | SSL3_ST_CR_SRVR_DONE_A, | ||
| 1300 | SSL3_ST_CR_SRVR_DONE_B, | ||
| 1301 | SSL3_MT_SERVER_DONE, | ||
| 1302 | 30, /* should be very small, like 0 :-) */ | ||
| 1303 | &ok); | ||
| 1304 | |||
| 1305 | if (!ok) return((int)n); | ||
| 1306 | if (n > 0) | ||
| 1307 | { | ||
| 1308 | /* should contain no data */ | ||
| 1309 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); | ||
| 1310 | SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH); | ||
| 1311 | } | ||
| 1312 | ret=1; | ||
| 1313 | return(ret); | ||
| 1314 | } | ||
| 1315 | |||
| 1316 | static int ssl3_send_client_key_exchange(SSL *s) | ||
| 1317 | { | ||
| 1318 | unsigned char *p,*d; | ||
| 1319 | int n; | ||
| 1320 | unsigned long l; | ||
| 1321 | #ifndef NO_RSA | ||
| 1322 | unsigned char *q; | ||
| 1323 | EVP_PKEY *pkey=NULL; | ||
| 1324 | #endif | ||
| 1325 | |||
| 1326 | if (s->state == SSL3_ST_CW_KEY_EXCH_A) | ||
| 1327 | { | ||
| 1328 | d=(unsigned char *)s->init_buf->data; | ||
| 1329 | p= &(d[4]); | ||
| 1330 | |||
| 1331 | l=s->s3->tmp.new_cipher->algorithms; | ||
| 1332 | |||
| 1333 | #ifndef NO_RSA | ||
| 1334 | if (l & SSL_kRSA) | ||
| 1335 | { | ||
| 1336 | RSA *rsa; | ||
| 1337 | unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH]; | ||
| 1338 | |||
| 1339 | if (s->session->sess_cert->peer_rsa_tmp != NULL) | ||
| 1340 | rsa=s->session->sess_cert->peer_rsa_tmp; | ||
| 1341 | else | ||
| 1342 | { | ||
| 1343 | pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); | ||
| 1344 | if ((pkey == NULL) || | ||
| 1345 | (pkey->type != EVP_PKEY_RSA) || | ||
| 1346 | (pkey->pkey.rsa == NULL)) | ||
| 1347 | { | ||
| 1348 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); | ||
| 1349 | goto err; | ||
| 1350 | } | ||
| 1351 | rsa=pkey->pkey.rsa; | ||
| 1352 | EVP_PKEY_free(pkey); | ||
| 1353 | } | ||
| 1354 | |||
| 1355 | tmp_buf[0]=s->client_version>>8; | ||
| 1356 | tmp_buf[1]=s->client_version&0xff; | ||
| 1357 | if (RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2) <= 0) | ||
| 1358 | goto err; | ||
| 1359 | |||
| 1360 | s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; | ||
| 1361 | |||
| 1362 | q=p; | ||
| 1363 | /* Fix buf for TLS and beyond */ | ||
| 1364 | if (s->version > SSL3_VERSION) | ||
| 1365 | p+=2; | ||
| 1366 | n=RSA_public_encrypt(SSL_MAX_MASTER_KEY_LENGTH, | ||
| 1367 | tmp_buf,p,rsa,RSA_PKCS1_PADDING); | ||
| 1368 | #ifdef PKCS1_CHECK | ||
| 1369 | if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++; | ||
| 1370 | if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70; | ||
| 1371 | #endif | ||
| 1372 | if (n <= 0) | ||
| 1373 | { | ||
| 1374 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT); | ||
| 1375 | goto err; | ||
| 1376 | } | ||
| 1377 | |||
| 1378 | /* Fix buf for TLS and beyond */ | ||
| 1379 | if (s->version > SSL3_VERSION) | ||
| 1380 | { | ||
| 1381 | s2n(n,q); | ||
| 1382 | n+=2; | ||
| 1383 | } | ||
| 1384 | |||
| 1385 | s->session->master_key_length= | ||
| 1386 | s->method->ssl3_enc->generate_master_secret(s, | ||
| 1387 | s->session->master_key, | ||
| 1388 | tmp_buf,SSL_MAX_MASTER_KEY_LENGTH); | ||
| 1389 | memset(tmp_buf,0,SSL_MAX_MASTER_KEY_LENGTH); | ||
| 1390 | } | ||
| 1391 | else | ||
| 1392 | #endif | ||
| 1393 | #ifndef NO_DH | ||
| 1394 | if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) | ||
| 1395 | { | ||
| 1396 | DH *dh_srvr,*dh_clnt; | ||
| 1397 | |||
| 1398 | if (s->session->sess_cert->peer_dh_tmp != NULL) | ||
| 1399 | dh_srvr=s->session->sess_cert->peer_dh_tmp; | ||
| 1400 | else | ||
| 1401 | { | ||
| 1402 | /* we get them from the cert */ | ||
| 1403 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); | ||
| 1404 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS); | ||
| 1405 | goto err; | ||
| 1406 | } | ||
| 1407 | |||
| 1408 | /* generate a new random key */ | ||
| 1409 | if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL) | ||
| 1410 | { | ||
| 1411 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 1412 | goto err; | ||
| 1413 | } | ||
| 1414 | if (!DH_generate_key(dh_clnt)) | ||
| 1415 | { | ||
| 1416 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 1417 | goto err; | ||
| 1418 | } | ||
| 1419 | |||
| 1420 | /* use the 'p' output buffer for the DH key, but | ||
| 1421 | * make sure to clear it out afterwards */ | ||
| 1422 | |||
| 1423 | n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt); | ||
| 1424 | |||
| 1425 | if (n <= 0) | ||
| 1426 | { | ||
| 1427 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 1428 | goto err; | ||
| 1429 | } | ||
| 1430 | |||
| 1431 | /* generate master key from the result */ | ||
| 1432 | s->session->master_key_length= | ||
| 1433 | s->method->ssl3_enc->generate_master_secret(s, | ||
| 1434 | s->session->master_key,p,n); | ||
| 1435 | /* clean up */ | ||
| 1436 | memset(p,0,n); | ||
| 1437 | |||
| 1438 | /* send off the data */ | ||
| 1439 | n=BN_num_bytes(dh_clnt->pub_key); | ||
| 1440 | s2n(n,p); | ||
| 1441 | BN_bn2bin(dh_clnt->pub_key,p); | ||
| 1442 | n+=2; | ||
| 1443 | |||
| 1444 | DH_free(dh_clnt); | ||
| 1445 | |||
| 1446 | /* perhaps clean things up a bit EAY EAY EAY EAY*/ | ||
| 1447 | } | ||
| 1448 | else | ||
| 1449 | #endif | ||
| 1450 | { | ||
| 1451 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); | ||
| 1452 | SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); | ||
| 1453 | goto err; | ||
| 1454 | } | ||
| 1455 | |||
| 1456 | *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE; | ||
| 1457 | l2n3(n,d); | ||
| 1458 | |||
| 1459 | s->state=SSL3_ST_CW_KEY_EXCH_B; | ||
| 1460 | /* number of bytes to write */ | ||
| 1461 | s->init_num=n+4; | ||
| 1462 | s->init_off=0; | ||
| 1463 | } | ||
| 1464 | |||
| 1465 | /* SSL3_ST_CW_KEY_EXCH_B */ | ||
| 1466 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 1467 | err: | ||
| 1468 | return(-1); | ||
| 1469 | } | ||
| 1470 | |||
| 1471 | static int ssl3_send_client_verify(SSL *s) | ||
| 1472 | { | ||
| 1473 | unsigned char *p,*d; | ||
| 1474 | unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH]; | ||
| 1475 | EVP_PKEY *pkey; | ||
| 1476 | #ifndef NO_RSA | ||
| 1477 | unsigned u=0; | ||
| 1478 | #endif | ||
| 1479 | unsigned long n; | ||
| 1480 | #ifndef NO_DSA | ||
| 1481 | int j; | ||
| 1482 | #endif | ||
| 1483 | |||
| 1484 | if (s->state == SSL3_ST_CW_CERT_VRFY_A) | ||
| 1485 | { | ||
| 1486 | d=(unsigned char *)s->init_buf->data; | ||
| 1487 | p= &(d[4]); | ||
| 1488 | pkey=s->cert->key->privatekey; | ||
| 1489 | |||
| 1490 | s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2), | ||
| 1491 | &(data[MD5_DIGEST_LENGTH])); | ||
| 1492 | |||
| 1493 | #ifndef NO_RSA | ||
| 1494 | if (pkey->type == EVP_PKEY_RSA) | ||
| 1495 | { | ||
| 1496 | s->method->ssl3_enc->cert_verify_mac(s, | ||
| 1497 | &(s->s3->finish_dgst1),&(data[0])); | ||
| 1498 | if (RSA_sign(NID_md5_sha1, data, | ||
| 1499 | MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, | ||
| 1500 | &(p[2]), &u, pkey->pkey.rsa) <= 0 ) | ||
| 1501 | { | ||
| 1502 | SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB); | ||
| 1503 | goto err; | ||
| 1504 | } | ||
| 1505 | s2n(u,p); | ||
| 1506 | n=u+2; | ||
| 1507 | } | ||
| 1508 | else | ||
| 1509 | #endif | ||
| 1510 | #ifndef NO_DSA | ||
| 1511 | if (pkey->type == EVP_PKEY_DSA) | ||
| 1512 | { | ||
| 1513 | if (!DSA_sign(pkey->save_type, | ||
| 1514 | &(data[MD5_DIGEST_LENGTH]), | ||
| 1515 | SHA_DIGEST_LENGTH,&(p[2]), | ||
| 1516 | (unsigned int *)&j,pkey->pkey.dsa)) | ||
| 1517 | { | ||
| 1518 | SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB); | ||
| 1519 | goto err; | ||
| 1520 | } | ||
| 1521 | s2n(j,p); | ||
| 1522 | n=j+2; | ||
| 1523 | } | ||
| 1524 | else | ||
| 1525 | #endif | ||
| 1526 | { | ||
| 1527 | SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,SSL_R_INTERNAL_ERROR); | ||
| 1528 | goto err; | ||
| 1529 | } | ||
| 1530 | *(d++)=SSL3_MT_CERTIFICATE_VERIFY; | ||
| 1531 | l2n3(n,d); | ||
| 1532 | |||
| 1533 | s->init_num=(int)n+4; | ||
| 1534 | s->init_off=0; | ||
| 1535 | } | ||
| 1536 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 1537 | err: | ||
| 1538 | return(-1); | ||
| 1539 | } | ||
| 1540 | |||
| 1541 | static int ssl3_send_client_certificate(SSL *s) | ||
| 1542 | { | ||
| 1543 | X509 *x509=NULL; | ||
| 1544 | EVP_PKEY *pkey=NULL; | ||
| 1545 | int i; | ||
| 1546 | unsigned long l; | ||
| 1547 | |||
| 1548 | if (s->state == SSL3_ST_CW_CERT_A) | ||
| 1549 | { | ||
| 1550 | if ((s->cert == NULL) || | ||
| 1551 | (s->cert->key->x509 == NULL) || | ||
| 1552 | (s->cert->key->privatekey == NULL)) | ||
| 1553 | s->state=SSL3_ST_CW_CERT_B; | ||
| 1554 | else | ||
| 1555 | s->state=SSL3_ST_CW_CERT_C; | ||
| 1556 | } | ||
| 1557 | |||
| 1558 | /* We need to get a client cert */ | ||
| 1559 | if (s->state == SSL3_ST_CW_CERT_B) | ||
| 1560 | { | ||
| 1561 | /* If we get an error, we need to | ||
| 1562 | * ssl->rwstate=SSL_X509_LOOKUP; return(-1); | ||
| 1563 | * We then get retied later */ | ||
| 1564 | i=0; | ||
| 1565 | if (s->ctx->client_cert_cb != NULL) | ||
| 1566 | i=s->ctx->client_cert_cb(s,&(x509),&(pkey)); | ||
| 1567 | if (i < 0) | ||
| 1568 | { | ||
| 1569 | s->rwstate=SSL_X509_LOOKUP; | ||
| 1570 | return(-1); | ||
| 1571 | } | ||
| 1572 | s->rwstate=SSL_NOTHING; | ||
| 1573 | if ((i == 1) && (pkey != NULL) && (x509 != NULL)) | ||
| 1574 | { | ||
| 1575 | s->state=SSL3_ST_CW_CERT_B; | ||
| 1576 | if ( !SSL_use_certificate(s,x509) || | ||
| 1577 | !SSL_use_PrivateKey(s,pkey)) | ||
| 1578 | i=0; | ||
| 1579 | } | ||
| 1580 | else if (i == 1) | ||
| 1581 | { | ||
| 1582 | i=0; | ||
| 1583 | SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); | ||
| 1584 | } | ||
| 1585 | |||
| 1586 | if (x509 != NULL) X509_free(x509); | ||
| 1587 | if (pkey != NULL) EVP_PKEY_free(pkey); | ||
| 1588 | if (i == 0) | ||
| 1589 | { | ||
| 1590 | if (s->version == SSL3_VERSION) | ||
| 1591 | { | ||
| 1592 | s->s3->tmp.cert_req=0; | ||
| 1593 | ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE); | ||
| 1594 | return(1); | ||
| 1595 | } | ||
| 1596 | else | ||
| 1597 | { | ||
| 1598 | s->s3->tmp.cert_req=2; | ||
| 1599 | } | ||
| 1600 | } | ||
| 1601 | |||
| 1602 | /* Ok, we have a cert */ | ||
| 1603 | s->state=SSL3_ST_CW_CERT_C; | ||
| 1604 | } | ||
| 1605 | |||
| 1606 | if (s->state == SSL3_ST_CW_CERT_C) | ||
| 1607 | { | ||
| 1608 | s->state=SSL3_ST_CW_CERT_D; | ||
| 1609 | l=ssl3_output_cert_chain(s, | ||
| 1610 | (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509); | ||
| 1611 | s->init_num=(int)l; | ||
| 1612 | s->init_off=0; | ||
| 1613 | } | ||
| 1614 | /* SSL3_ST_CW_CERT_D */ | ||
| 1615 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 1616 | } | ||
| 1617 | |||
| 1618 | #define has_bits(i,m) (((i)&(m)) == (m)) | ||
| 1619 | |||
| 1620 | static int ssl3_check_cert_and_algorithm(SSL *s) | ||
| 1621 | { | ||
| 1622 | int i,idx; | ||
| 1623 | long algs; | ||
| 1624 | EVP_PKEY *pkey=NULL; | ||
| 1625 | SESS_CERT *sc; | ||
| 1626 | #ifndef NO_RSA | ||
| 1627 | RSA *rsa; | ||
| 1628 | #endif | ||
| 1629 | #ifndef NO_DH | ||
| 1630 | DH *dh; | ||
| 1631 | #endif | ||
| 1632 | |||
| 1633 | sc=s->session->sess_cert; | ||
| 1634 | |||
| 1635 | if (sc == NULL) | ||
| 1636 | { | ||
| 1637 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR); | ||
| 1638 | goto err; | ||
| 1639 | } | ||
| 1640 | |||
| 1641 | algs=s->s3->tmp.new_cipher->algorithms; | ||
| 1642 | |||
| 1643 | /* we don't have a certificate */ | ||
| 1644 | if (algs & (SSL_aDH|SSL_aNULL)) | ||
| 1645 | return(1); | ||
| 1646 | |||
| 1647 | #ifndef NO_RSA | ||
| 1648 | rsa=s->session->sess_cert->peer_rsa_tmp; | ||
| 1649 | #endif | ||
| 1650 | #ifndef NO_DH | ||
| 1651 | dh=s->session->sess_cert->peer_dh_tmp; | ||
| 1652 | #endif | ||
| 1653 | |||
| 1654 | /* This is the passed certificate */ | ||
| 1655 | |||
| 1656 | idx=sc->peer_cert_type; | ||
| 1657 | pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509); | ||
| 1658 | i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey); | ||
| 1659 | EVP_PKEY_free(pkey); | ||
| 1660 | |||
| 1661 | |||
| 1662 | /* Check that we have a certificate if we require one */ | ||
| 1663 | if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN)) | ||
| 1664 | { | ||
| 1665 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT); | ||
| 1666 | goto f_err; | ||
| 1667 | } | ||
| 1668 | #ifndef NO_DSA | ||
| 1669 | else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN)) | ||
| 1670 | { | ||
| 1671 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT); | ||
| 1672 | goto f_err; | ||
| 1673 | } | ||
| 1674 | #endif | ||
| 1675 | #ifndef NO_RSA | ||
| 1676 | if ((algs & SSL_kRSA) && | ||
| 1677 | !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL))) | ||
| 1678 | { | ||
| 1679 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT); | ||
| 1680 | goto f_err; | ||
| 1681 | } | ||
| 1682 | #endif | ||
| 1683 | #ifndef NO_DH | ||
| 1684 | if ((algs & SSL_kEDH) && | ||
| 1685 | !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) | ||
| 1686 | { | ||
| 1687 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY); | ||
| 1688 | goto f_err; | ||
| 1689 | } | ||
| 1690 | else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA)) | ||
| 1691 | { | ||
| 1692 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT); | ||
| 1693 | goto f_err; | ||
| 1694 | } | ||
| 1695 | #ifndef NO_DSA | ||
| 1696 | else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA)) | ||
| 1697 | { | ||
| 1698 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT); | ||
| 1699 | goto f_err; | ||
| 1700 | } | ||
| 1701 | #endif | ||
| 1702 | #endif | ||
| 1703 | |||
| 1704 | if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP)) | ||
| 1705 | { | ||
| 1706 | #ifndef NO_RSA | ||
| 1707 | if (algs & SSL_kRSA) | ||
| 1708 | { | ||
| 1709 | if (rsa == NULL | ||
| 1710 | || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) | ||
| 1711 | { | ||
| 1712 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY); | ||
| 1713 | goto f_err; | ||
| 1714 | } | ||
| 1715 | } | ||
| 1716 | else | ||
| 1717 | #endif | ||
| 1718 | #ifndef NO_DH | ||
| 1719 | if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) | ||
| 1720 | { | ||
| 1721 | if (dh == NULL | ||
| 1722 | || DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) | ||
| 1723 | { | ||
| 1724 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY); | ||
| 1725 | goto f_err; | ||
| 1726 | } | ||
| 1727 | } | ||
| 1728 | else | ||
| 1729 | #endif | ||
| 1730 | { | ||
| 1731 | SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); | ||
| 1732 | goto f_err; | ||
| 1733 | } | ||
| 1734 | } | ||
| 1735 | return(1); | ||
| 1736 | f_err: | ||
| 1737 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); | ||
| 1738 | err: | ||
| 1739 | return(0); | ||
| 1740 | } | ||
| 1741 | |||
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c deleted file mode 100644 index c32c06de32..0000000000 --- a/src/lib/libssl/s3_lib.c +++ /dev/null | |||
| @@ -1,1379 +0,0 @@ | |||
| 1 | /* ssl/s3_lib.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | /* ==================================================================== | ||
| 59 | * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. | ||
| 60 | * | ||
| 61 | * Redistribution and use in source and binary forms, with or without | ||
| 62 | * modification, are permitted provided that the following conditions | ||
| 63 | * are met: | ||
| 64 | * | ||
| 65 | * 1. Redistributions of source code must retain the above copyright | ||
| 66 | * notice, this list of conditions and the following disclaimer. | ||
| 67 | * | ||
| 68 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 69 | * notice, this list of conditions and the following disclaimer in | ||
| 70 | * the documentation and/or other materials provided with the | ||
| 71 | * distribution. | ||
| 72 | * | ||
| 73 | * 3. All advertising materials mentioning features or use of this | ||
| 74 | * software must display the following acknowledgment: | ||
| 75 | * "This product includes software developed by the OpenSSL Project | ||
| 76 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" | ||
| 77 | * | ||
| 78 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 79 | * endorse or promote products derived from this software without | ||
| 80 | * prior written permission. For written permission, please contact | ||
| 81 | * openssl-core@openssl.org. | ||
| 82 | * | ||
| 83 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 84 | * nor may "OpenSSL" appear in their names without prior written | ||
| 85 | * permission of the OpenSSL Project. | ||
| 86 | * | ||
| 87 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 88 | * acknowledgment: | ||
| 89 | * "This product includes software developed by the OpenSSL Project | ||
| 90 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" | ||
| 91 | * | ||
| 92 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 93 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 94 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 95 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 96 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 97 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 98 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 99 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 100 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 101 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 102 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 103 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 104 | * ==================================================================== | ||
| 105 | * | ||
| 106 | * This product includes cryptographic software written by Eric Young | ||
| 107 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
| 108 | * Hudson (tjh@cryptsoft.com). | ||
| 109 | * | ||
| 110 | */ | ||
| 111 | |||
| 112 | #include <stdio.h> | ||
| 113 | #include <openssl/md5.h> | ||
| 114 | #include <openssl/sha.h> | ||
| 115 | #include <openssl/objects.h> | ||
| 116 | #include "ssl_locl.h" | ||
| 117 | |||
| 118 | const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT; | ||
| 119 | |||
| 120 | #define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER)) | ||
| 121 | |||
| 122 | static long ssl3_default_timeout(void ); | ||
| 123 | |||
| 124 | OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={ | ||
| 125 | /* The RSA ciphers */ | ||
| 126 | /* Cipher 01 */ | ||
| 127 | { | ||
| 128 | 1, | ||
| 129 | SSL3_TXT_RSA_NULL_MD5, | ||
| 130 | SSL3_CK_RSA_NULL_MD5, | ||
| 131 | SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3, | ||
| 132 | SSL_NOT_EXP, | ||
| 133 | 0, | ||
| 134 | 0, | ||
| 135 | 0, | ||
| 136 | SSL_ALL_CIPHERS, | ||
| 137 | SSL_ALL_STRENGTHS, | ||
| 138 | }, | ||
| 139 | /* Cipher 02 */ | ||
| 140 | { | ||
| 141 | 1, | ||
| 142 | SSL3_TXT_RSA_NULL_SHA, | ||
| 143 | SSL3_CK_RSA_NULL_SHA, | ||
| 144 | SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3, | ||
| 145 | SSL_NOT_EXP, | ||
| 146 | 0, | ||
| 147 | 0, | ||
| 148 | 0, | ||
| 149 | SSL_ALL_CIPHERS, | ||
| 150 | SSL_ALL_STRENGTHS, | ||
| 151 | }, | ||
| 152 | |||
| 153 | /* anon DH */ | ||
| 154 | /* Cipher 17 */ | ||
| 155 | { | ||
| 156 | 1, | ||
| 157 | SSL3_TXT_ADH_RC4_40_MD5, | ||
| 158 | SSL3_CK_ADH_RC4_40_MD5, | ||
| 159 | SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, | ||
| 160 | SSL_EXPORT|SSL_EXP40, | ||
| 161 | 0, | ||
| 162 | 40, | ||
| 163 | 128, | ||
| 164 | SSL_ALL_CIPHERS, | ||
| 165 | SSL_ALL_STRENGTHS, | ||
| 166 | }, | ||
| 167 | /* Cipher 18 */ | ||
| 168 | { | ||
| 169 | 1, | ||
| 170 | SSL3_TXT_ADH_RC4_128_MD5, | ||
| 171 | SSL3_CK_ADH_RC4_128_MD5, | ||
| 172 | SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, | ||
| 173 | SSL_NOT_EXP, | ||
| 174 | 0, | ||
| 175 | 128, | ||
| 176 | 128, | ||
| 177 | SSL_ALL_CIPHERS, | ||
| 178 | SSL_ALL_STRENGTHS, | ||
| 179 | }, | ||
| 180 | /* Cipher 19 */ | ||
| 181 | { | ||
| 182 | 1, | ||
| 183 | SSL3_TXT_ADH_DES_40_CBC_SHA, | ||
| 184 | SSL3_CK_ADH_DES_40_CBC_SHA, | ||
| 185 | SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3, | ||
| 186 | SSL_EXPORT|SSL_EXP40, | ||
| 187 | 0, | ||
| 188 | 40, | ||
| 189 | 128, | ||
| 190 | SSL_ALL_CIPHERS, | ||
| 191 | SSL_ALL_STRENGTHS, | ||
| 192 | }, | ||
| 193 | /* Cipher 1A */ | ||
| 194 | { | ||
| 195 | 1, | ||
| 196 | SSL3_TXT_ADH_DES_64_CBC_SHA, | ||
| 197 | SSL3_CK_ADH_DES_64_CBC_SHA, | ||
| 198 | SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3, | ||
| 199 | SSL_NOT_EXP, | ||
| 200 | 0, | ||
| 201 | 56, | ||
| 202 | 56, | ||
| 203 | SSL_ALL_CIPHERS, | ||
| 204 | SSL_ALL_STRENGTHS, | ||
| 205 | }, | ||
| 206 | /* Cipher 1B */ | ||
| 207 | { | ||
| 208 | 1, | ||
| 209 | SSL3_TXT_ADH_DES_192_CBC_SHA, | ||
| 210 | SSL3_CK_ADH_DES_192_CBC_SHA, | ||
| 211 | SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3, | ||
| 212 | SSL_NOT_EXP, | ||
| 213 | 0, | ||
| 214 | 168, | ||
| 215 | 168, | ||
| 216 | SSL_ALL_CIPHERS, | ||
| 217 | SSL_ALL_STRENGTHS, | ||
| 218 | }, | ||
| 219 | |||
| 220 | /* RSA again */ | ||
| 221 | /* Cipher 03 */ | ||
| 222 | { | ||
| 223 | 1, | ||
| 224 | SSL3_TXT_RSA_RC4_40_MD5, | ||
| 225 | SSL3_CK_RSA_RC4_40_MD5, | ||
| 226 | SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_SSLV3, | ||
| 227 | SSL_EXPORT|SSL_EXP40, | ||
| 228 | 0, | ||
| 229 | 40, | ||
| 230 | 128, | ||
| 231 | SSL_ALL_CIPHERS, | ||
| 232 | SSL_ALL_STRENGTHS, | ||
| 233 | }, | ||
| 234 | /* Cipher 04 */ | ||
| 235 | { | ||
| 236 | 1, | ||
| 237 | SSL3_TXT_RSA_RC4_128_MD5, | ||
| 238 | SSL3_CK_RSA_RC4_128_MD5, | ||
| 239 | SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_SSLV3, | ||
| 240 | SSL_NOT_EXP|SSL_MEDIUM, | ||
| 241 | 0, | ||
| 242 | 128, | ||
| 243 | 128, | ||
| 244 | SSL_ALL_CIPHERS, | ||
| 245 | SSL_ALL_STRENGTHS, | ||
| 246 | }, | ||
| 247 | /* Cipher 05 */ | ||
| 248 | { | ||
| 249 | 1, | ||
| 250 | SSL3_TXT_RSA_RC4_128_SHA, | ||
| 251 | SSL3_CK_RSA_RC4_128_SHA, | ||
| 252 | SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_SSLV3, | ||
| 253 | SSL_NOT_EXP|SSL_MEDIUM, | ||
| 254 | 0, | ||
| 255 | 128, | ||
| 256 | 128, | ||
| 257 | SSL_ALL_CIPHERS, | ||
| 258 | SSL_ALL_STRENGTHS, | ||
| 259 | }, | ||
| 260 | /* Cipher 06 */ | ||
| 261 | { | ||
| 262 | 1, | ||
| 263 | SSL3_TXT_RSA_RC2_40_MD5, | ||
| 264 | SSL3_CK_RSA_RC2_40_MD5, | ||
| 265 | SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_SSLV3, | ||
| 266 | SSL_EXPORT|SSL_EXP40, | ||
| 267 | 0, | ||
| 268 | 40, | ||
| 269 | 128, | ||
| 270 | SSL_ALL_CIPHERS, | ||
| 271 | SSL_ALL_STRENGTHS, | ||
| 272 | }, | ||
| 273 | /* Cipher 07 */ | ||
| 274 | { | ||
| 275 | 1, | ||
| 276 | SSL3_TXT_RSA_IDEA_128_SHA, | ||
| 277 | SSL3_CK_RSA_IDEA_128_SHA, | ||
| 278 | SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3, | ||
| 279 | SSL_NOT_EXP|SSL_MEDIUM, | ||
| 280 | 0, | ||
| 281 | 128, | ||
| 282 | 128, | ||
| 283 | SSL_ALL_CIPHERS, | ||
| 284 | SSL_ALL_STRENGTHS, | ||
| 285 | }, | ||
| 286 | /* Cipher 08 */ | ||
| 287 | { | ||
| 288 | 1, | ||
| 289 | SSL3_TXT_RSA_DES_40_CBC_SHA, | ||
| 290 | SSL3_CK_RSA_DES_40_CBC_SHA, | ||
| 291 | SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, | ||
| 292 | SSL_EXPORT|SSL_EXP40, | ||
| 293 | 0, | ||
| 294 | 40, | ||
| 295 | 56, | ||
| 296 | SSL_ALL_CIPHERS, | ||
| 297 | SSL_ALL_STRENGTHS, | ||
| 298 | }, | ||
| 299 | /* Cipher 09 */ | ||
| 300 | { | ||
| 301 | 1, | ||
| 302 | SSL3_TXT_RSA_DES_64_CBC_SHA, | ||
| 303 | SSL3_CK_RSA_DES_64_CBC_SHA, | ||
| 304 | SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, | ||
| 305 | SSL_NOT_EXP|SSL_LOW, | ||
| 306 | 0, | ||
| 307 | 56, | ||
| 308 | 56, | ||
| 309 | SSL_ALL_CIPHERS, | ||
| 310 | SSL_ALL_STRENGTHS, | ||
| 311 | }, | ||
| 312 | /* Cipher 0A */ | ||
| 313 | { | ||
| 314 | 1, | ||
| 315 | SSL3_TXT_RSA_DES_192_CBC3_SHA, | ||
| 316 | SSL3_CK_RSA_DES_192_CBC3_SHA, | ||
| 317 | SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, | ||
| 318 | SSL_NOT_EXP|SSL_HIGH, | ||
| 319 | 0, | ||
| 320 | 168, | ||
| 321 | 168, | ||
| 322 | SSL_ALL_CIPHERS, | ||
| 323 | SSL_ALL_STRENGTHS, | ||
| 324 | }, | ||
| 325 | |||
| 326 | /* The DH ciphers */ | ||
| 327 | /* Cipher 0B */ | ||
| 328 | { | ||
| 329 | 0, | ||
| 330 | SSL3_TXT_DH_DSS_DES_40_CBC_SHA, | ||
| 331 | SSL3_CK_DH_DSS_DES_40_CBC_SHA, | ||
| 332 | SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, | ||
| 333 | SSL_EXPORT|SSL_EXP40, | ||
| 334 | 0, | ||
| 335 | 40, | ||
| 336 | 56, | ||
| 337 | SSL_ALL_CIPHERS, | ||
| 338 | SSL_ALL_STRENGTHS, | ||
| 339 | }, | ||
| 340 | /* Cipher 0C */ | ||
| 341 | { | ||
| 342 | 0, | ||
| 343 | SSL3_TXT_DH_DSS_DES_64_CBC_SHA, | ||
| 344 | SSL3_CK_DH_DSS_DES_64_CBC_SHA, | ||
| 345 | SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, | ||
| 346 | SSL_NOT_EXP|SSL_LOW, | ||
| 347 | 0, | ||
| 348 | 56, | ||
| 349 | 56, | ||
| 350 | SSL_ALL_CIPHERS, | ||
| 351 | SSL_ALL_STRENGTHS, | ||
| 352 | }, | ||
| 353 | /* Cipher 0D */ | ||
| 354 | { | ||
| 355 | 0, | ||
| 356 | SSL3_TXT_DH_DSS_DES_192_CBC3_SHA, | ||
| 357 | SSL3_CK_DH_DSS_DES_192_CBC3_SHA, | ||
| 358 | SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, | ||
| 359 | SSL_NOT_EXP|SSL_HIGH, | ||
| 360 | 0, | ||
| 361 | 168, | ||
| 362 | 168, | ||
| 363 | SSL_ALL_CIPHERS, | ||
| 364 | SSL_ALL_STRENGTHS, | ||
| 365 | }, | ||
| 366 | /* Cipher 0E */ | ||
| 367 | { | ||
| 368 | 0, | ||
| 369 | SSL3_TXT_DH_RSA_DES_40_CBC_SHA, | ||
| 370 | SSL3_CK_DH_RSA_DES_40_CBC_SHA, | ||
| 371 | SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, | ||
| 372 | SSL_EXPORT|SSL_EXP40, | ||
| 373 | 0, | ||
| 374 | 40, | ||
| 375 | 56, | ||
| 376 | SSL_ALL_CIPHERS, | ||
| 377 | SSL_ALL_STRENGTHS, | ||
| 378 | }, | ||
| 379 | /* Cipher 0F */ | ||
| 380 | { | ||
| 381 | 0, | ||
| 382 | SSL3_TXT_DH_RSA_DES_64_CBC_SHA, | ||
| 383 | SSL3_CK_DH_RSA_DES_64_CBC_SHA, | ||
| 384 | SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, | ||
| 385 | SSL_NOT_EXP|SSL_LOW, | ||
| 386 | 0, | ||
| 387 | 56, | ||
| 388 | 56, | ||
| 389 | SSL_ALL_CIPHERS, | ||
| 390 | SSL_ALL_STRENGTHS, | ||
| 391 | }, | ||
| 392 | /* Cipher 10 */ | ||
| 393 | { | ||
| 394 | 0, | ||
| 395 | SSL3_TXT_DH_RSA_DES_192_CBC3_SHA, | ||
| 396 | SSL3_CK_DH_RSA_DES_192_CBC3_SHA, | ||
| 397 | SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, | ||
| 398 | SSL_NOT_EXP|SSL_HIGH, | ||
| 399 | 0, | ||
| 400 | 168, | ||
| 401 | 168, | ||
| 402 | SSL_ALL_CIPHERS, | ||
| 403 | SSL_ALL_STRENGTHS, | ||
| 404 | }, | ||
| 405 | |||
| 406 | /* The Ephemeral DH ciphers */ | ||
| 407 | /* Cipher 11 */ | ||
| 408 | { | ||
| 409 | 1, | ||
| 410 | SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, | ||
| 411 | SSL3_CK_EDH_DSS_DES_40_CBC_SHA, | ||
| 412 | SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3, | ||
| 413 | SSL_EXPORT|SSL_EXP40, | ||
| 414 | 0, | ||
| 415 | 40, | ||
| 416 | 56, | ||
| 417 | SSL_ALL_CIPHERS, | ||
| 418 | SSL_ALL_STRENGTHS, | ||
| 419 | }, | ||
| 420 | /* Cipher 12 */ | ||
| 421 | { | ||
| 422 | 1, | ||
| 423 | SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, | ||
| 424 | SSL3_CK_EDH_DSS_DES_64_CBC_SHA, | ||
| 425 | SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3, | ||
| 426 | SSL_NOT_EXP|SSL_LOW, | ||
| 427 | 0, | ||
| 428 | 56, | ||
| 429 | 56, | ||
| 430 | SSL_ALL_CIPHERS, | ||
| 431 | SSL_ALL_STRENGTHS, | ||
| 432 | }, | ||
| 433 | /* Cipher 13 */ | ||
| 434 | { | ||
| 435 | 1, | ||
| 436 | SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, | ||
| 437 | SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, | ||
| 438 | SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3, | ||
| 439 | SSL_NOT_EXP|SSL_HIGH, | ||
| 440 | 0, | ||
| 441 | 168, | ||
| 442 | 168, | ||
| 443 | SSL_ALL_CIPHERS, | ||
| 444 | SSL_ALL_STRENGTHS, | ||
| 445 | }, | ||
| 446 | /* Cipher 14 */ | ||
| 447 | { | ||
| 448 | 1, | ||
| 449 | SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, | ||
| 450 | SSL3_CK_EDH_RSA_DES_40_CBC_SHA, | ||
| 451 | SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, | ||
| 452 | SSL_EXPORT|SSL_EXP40, | ||
| 453 | 0, | ||
| 454 | 40, | ||
| 455 | 56, | ||
| 456 | SSL_ALL_CIPHERS, | ||
| 457 | SSL_ALL_STRENGTHS, | ||
| 458 | }, | ||
| 459 | /* Cipher 15 */ | ||
| 460 | { | ||
| 461 | 1, | ||
| 462 | SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, | ||
| 463 | SSL3_CK_EDH_RSA_DES_64_CBC_SHA, | ||
| 464 | SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, | ||
| 465 | SSL_NOT_EXP|SSL_LOW, | ||
| 466 | 0, | ||
| 467 | 56, | ||
| 468 | 56, | ||
| 469 | SSL_ALL_CIPHERS, | ||
| 470 | SSL_ALL_STRENGTHS, | ||
| 471 | }, | ||
| 472 | /* Cipher 16 */ | ||
| 473 | { | ||
| 474 | 1, | ||
| 475 | SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, | ||
| 476 | SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, | ||
| 477 | SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, | ||
| 478 | SSL_NOT_EXP|SSL_HIGH, | ||
| 479 | 0, | ||
| 480 | 168, | ||
| 481 | 168, | ||
| 482 | SSL_ALL_CIPHERS, | ||
| 483 | SSL_ALL_STRENGTHS, | ||
| 484 | }, | ||
| 485 | |||
| 486 | /* Fortezza */ | ||
| 487 | /* Cipher 1C */ | ||
| 488 | { | ||
| 489 | 0, | ||
| 490 | SSL3_TXT_FZA_DMS_NULL_SHA, | ||
| 491 | SSL3_CK_FZA_DMS_NULL_SHA, | ||
| 492 | SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3, | ||
| 493 | SSL_NOT_EXP, | ||
| 494 | 0, | ||
| 495 | 0, | ||
| 496 | 0, | ||
| 497 | SSL_ALL_CIPHERS, | ||
| 498 | SSL_ALL_STRENGTHS, | ||
| 499 | }, | ||
| 500 | |||
| 501 | /* Cipher 1D */ | ||
| 502 | { | ||
| 503 | 0, | ||
| 504 | SSL3_TXT_FZA_DMS_FZA_SHA, | ||
| 505 | SSL3_CK_FZA_DMS_FZA_SHA, | ||
| 506 | SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3, | ||
| 507 | SSL_NOT_EXP, | ||
| 508 | 0, | ||
| 509 | 0, | ||
| 510 | 0, | ||
| 511 | SSL_ALL_CIPHERS, | ||
| 512 | SSL_ALL_STRENGTHS, | ||
| 513 | }, | ||
| 514 | |||
| 515 | /* Cipher 1E */ | ||
| 516 | { | ||
| 517 | 0, | ||
| 518 | SSL3_TXT_FZA_DMS_RC4_SHA, | ||
| 519 | SSL3_CK_FZA_DMS_RC4_SHA, | ||
| 520 | SSL_kFZA|SSL_aFZA |SSL_RC4 |SSL_SHA1|SSL_SSLV3, | ||
| 521 | SSL_NOT_EXP, | ||
| 522 | 0, | ||
| 523 | 128, | ||
| 524 | 128, | ||
| 525 | SSL_ALL_CIPHERS, | ||
| 526 | SSL_ALL_STRENGTHS, | ||
| 527 | }, | ||
| 528 | |||
| 529 | #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES | ||
| 530 | /* New TLS Export CipherSuites */ | ||
| 531 | /* Cipher 60 */ | ||
| 532 | { | ||
| 533 | 1, | ||
| 534 | TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5, | ||
| 535 | TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5, | ||
| 536 | SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1, | ||
| 537 | SSL_EXPORT|SSL_EXP56, | ||
| 538 | 0, | ||
| 539 | 56, | ||
| 540 | 128, | ||
| 541 | SSL_ALL_CIPHERS, | ||
| 542 | SSL_ALL_STRENGTHS, | ||
| 543 | }, | ||
| 544 | /* Cipher 61 */ | ||
| 545 | { | ||
| 546 | 1, | ||
| 547 | TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, | ||
| 548 | TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, | ||
| 549 | SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1, | ||
| 550 | SSL_EXPORT|SSL_EXP56, | ||
| 551 | 0, | ||
| 552 | 56, | ||
| 553 | 128, | ||
| 554 | SSL_ALL_CIPHERS, | ||
| 555 | SSL_ALL_STRENGTHS, | ||
| 556 | }, | ||
| 557 | /* Cipher 62 */ | ||
| 558 | { | ||
| 559 | 1, | ||
| 560 | TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA, | ||
| 561 | TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA, | ||
| 562 | SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1, | ||
| 563 | SSL_EXPORT|SSL_EXP56, | ||
| 564 | 0, | ||
| 565 | 56, | ||
| 566 | 56, | ||
| 567 | SSL_ALL_CIPHERS, | ||
| 568 | SSL_ALL_STRENGTHS, | ||
| 569 | }, | ||
| 570 | /* Cipher 63 */ | ||
| 571 | { | ||
| 572 | 1, | ||
| 573 | TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, | ||
| 574 | TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, | ||
| 575 | SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1, | ||
| 576 | SSL_EXPORT|SSL_EXP56, | ||
| 577 | 0, | ||
| 578 | 56, | ||
| 579 | 56, | ||
| 580 | SSL_ALL_CIPHERS, | ||
| 581 | SSL_ALL_STRENGTHS, | ||
| 582 | }, | ||
| 583 | /* Cipher 64 */ | ||
| 584 | { | ||
| 585 | 1, | ||
| 586 | TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA, | ||
| 587 | TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA, | ||
| 588 | SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1, | ||
| 589 | SSL_EXPORT|SSL_EXP56, | ||
| 590 | 0, | ||
| 591 | 56, | ||
| 592 | 128, | ||
| 593 | SSL_ALL_CIPHERS, | ||
| 594 | SSL_ALL_STRENGTHS, | ||
| 595 | }, | ||
| 596 | /* Cipher 65 */ | ||
| 597 | { | ||
| 598 | 1, | ||
| 599 | TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, | ||
| 600 | TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, | ||
| 601 | SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, | ||
| 602 | SSL_EXPORT|SSL_EXP56, | ||
| 603 | 0, | ||
| 604 | 56, | ||
| 605 | 128, | ||
| 606 | SSL_ALL_CIPHERS, | ||
| 607 | SSL_ALL_STRENGTHS, | ||
| 608 | }, | ||
| 609 | /* Cipher 66 */ | ||
| 610 | { | ||
| 611 | 1, | ||
| 612 | TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA, | ||
| 613 | TLS1_CK_DHE_DSS_WITH_RC4_128_SHA, | ||
| 614 | SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, | ||
| 615 | SSL_NOT_EXP, | ||
| 616 | 0, | ||
| 617 | 128, | ||
| 618 | 128, | ||
| 619 | SSL_ALL_CIPHERS, | ||
| 620 | SSL_ALL_STRENGTHS | ||
| 621 | }, | ||
| 622 | #endif | ||
| 623 | |||
| 624 | /* end of list */ | ||
| 625 | }; | ||
| 626 | |||
| 627 | static SSL3_ENC_METHOD SSLv3_enc_data={ | ||
| 628 | ssl3_enc, | ||
| 629 | ssl3_mac, | ||
| 630 | ssl3_setup_key_block, | ||
| 631 | ssl3_generate_master_secret, | ||
| 632 | ssl3_change_cipher_state, | ||
| 633 | ssl3_final_finish_mac, | ||
| 634 | MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, | ||
| 635 | ssl3_cert_verify_mac, | ||
| 636 | SSL3_MD_CLIENT_FINISHED_CONST,4, | ||
| 637 | SSL3_MD_SERVER_FINISHED_CONST,4, | ||
| 638 | ssl3_alert_code, | ||
| 639 | }; | ||
| 640 | |||
| 641 | static SSL_METHOD SSLv3_data= { | ||
| 642 | SSL3_VERSION, | ||
| 643 | ssl3_new, | ||
| 644 | ssl3_clear, | ||
| 645 | ssl3_free, | ||
| 646 | ssl_undefined_function, | ||
| 647 | ssl_undefined_function, | ||
| 648 | ssl3_read, | ||
| 649 | ssl3_peek, | ||
| 650 | ssl3_write, | ||
| 651 | ssl3_shutdown, | ||
| 652 | ssl3_renegotiate, | ||
| 653 | ssl3_renegotiate_check, | ||
| 654 | ssl3_ctrl, | ||
| 655 | ssl3_ctx_ctrl, | ||
| 656 | ssl3_get_cipher_by_char, | ||
| 657 | ssl3_put_cipher_by_char, | ||
| 658 | ssl3_pending, | ||
| 659 | ssl3_num_ciphers, | ||
| 660 | ssl3_get_cipher, | ||
| 661 | ssl_bad_method, | ||
| 662 | ssl3_default_timeout, | ||
| 663 | &SSLv3_enc_data, | ||
| 664 | ssl_undefined_function, | ||
| 665 | ssl3_callback_ctrl, | ||
| 666 | ssl3_ctx_callback_ctrl, | ||
| 667 | }; | ||
| 668 | |||
| 669 | static long ssl3_default_timeout(void) | ||
| 670 | { | ||
| 671 | /* 2 hours, the 24 hours mentioned in the SSLv3 spec | ||
| 672 | * is way too long for http, the cache would over fill */ | ||
| 673 | return(60*60*2); | ||
| 674 | } | ||
| 675 | |||
| 676 | SSL_METHOD *sslv3_base_method(void) | ||
| 677 | { | ||
| 678 | return(&SSLv3_data); | ||
| 679 | } | ||
| 680 | |||
| 681 | int ssl3_num_ciphers(void) | ||
| 682 | { | ||
| 683 | return(SSL3_NUM_CIPHERS); | ||
| 684 | } | ||
| 685 | |||
| 686 | SSL_CIPHER *ssl3_get_cipher(unsigned int u) | ||
| 687 | { | ||
| 688 | if (u < SSL3_NUM_CIPHERS) | ||
| 689 | return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u])); | ||
| 690 | else | ||
| 691 | return(NULL); | ||
| 692 | } | ||
| 693 | |||
| 694 | int ssl3_pending(SSL *s) | ||
| 695 | { | ||
| 696 | return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0; | ||
| 697 | } | ||
| 698 | |||
| 699 | int ssl3_new(SSL *s) | ||
| 700 | { | ||
| 701 | SSL3_STATE *s3; | ||
| 702 | |||
| 703 | if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err; | ||
| 704 | memset(s3,0,sizeof *s3); | ||
| 705 | |||
| 706 | s->s3=s3; | ||
| 707 | |||
| 708 | s->method->ssl_clear(s); | ||
| 709 | return(1); | ||
| 710 | err: | ||
| 711 | return(0); | ||
| 712 | } | ||
| 713 | |||
| 714 | void ssl3_free(SSL *s) | ||
| 715 | { | ||
| 716 | if(s == NULL) | ||
| 717 | return; | ||
| 718 | |||
| 719 | ssl3_cleanup_key_block(s); | ||
| 720 | if (s->s3->rbuf.buf != NULL) | ||
| 721 | OPENSSL_free(s->s3->rbuf.buf); | ||
| 722 | if (s->s3->wbuf.buf != NULL) | ||
| 723 | OPENSSL_free(s->s3->wbuf.buf); | ||
| 724 | if (s->s3->rrec.comp != NULL) | ||
| 725 | OPENSSL_free(s->s3->rrec.comp); | ||
| 726 | #ifndef NO_DH | ||
| 727 | if (s->s3->tmp.dh != NULL) | ||
| 728 | DH_free(s->s3->tmp.dh); | ||
| 729 | #endif | ||
| 730 | if (s->s3->tmp.ca_names != NULL) | ||
| 731 | sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); | ||
| 732 | memset(s->s3,0,sizeof *s->s3); | ||
| 733 | OPENSSL_free(s->s3); | ||
| 734 | s->s3=NULL; | ||
| 735 | } | ||
| 736 | |||
| 737 | void ssl3_clear(SSL *s) | ||
| 738 | { | ||
| 739 | unsigned char *rp,*wp; | ||
| 740 | |||
| 741 | ssl3_cleanup_key_block(s); | ||
| 742 | if (s->s3->tmp.ca_names != NULL) | ||
| 743 | sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); | ||
| 744 | |||
| 745 | if (s->s3->rrec.comp != NULL) | ||
| 746 | { | ||
| 747 | OPENSSL_free(s->s3->rrec.comp); | ||
| 748 | s->s3->rrec.comp=NULL; | ||
| 749 | } | ||
| 750 | #ifndef NO_DH | ||
| 751 | if (s->s3->tmp.dh != NULL) | ||
| 752 | DH_free(s->s3->tmp.dh); | ||
| 753 | #endif | ||
| 754 | |||
| 755 | rp=s->s3->rbuf.buf; | ||
| 756 | wp=s->s3->wbuf.buf; | ||
| 757 | |||
| 758 | memset(s->s3,0,sizeof *s->s3); | ||
| 759 | if (rp != NULL) s->s3->rbuf.buf=rp; | ||
| 760 | if (wp != NULL) s->s3->wbuf.buf=wp; | ||
| 761 | |||
| 762 | ssl_free_wbio_buffer(s); | ||
| 763 | |||
| 764 | s->packet_length=0; | ||
| 765 | s->s3->renegotiate=0; | ||
| 766 | s->s3->total_renegotiations=0; | ||
| 767 | s->s3->num_renegotiations=0; | ||
| 768 | s->s3->in_read_app_data=0; | ||
| 769 | s->version=SSL3_VERSION; | ||
| 770 | } | ||
| 771 | |||
| 772 | long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg) | ||
| 773 | { | ||
| 774 | int ret=0; | ||
| 775 | |||
| 776 | #if !defined(NO_DSA) || !defined(NO_RSA) | ||
| 777 | if ( | ||
| 778 | #ifndef NO_RSA | ||
| 779 | cmd == SSL_CTRL_SET_TMP_RSA || | ||
| 780 | cmd == SSL_CTRL_SET_TMP_RSA_CB || | ||
| 781 | #endif | ||
| 782 | #ifndef NO_DSA | ||
| 783 | cmd == SSL_CTRL_SET_TMP_DH || | ||
| 784 | cmd == SSL_CTRL_SET_TMP_DH_CB || | ||
| 785 | #endif | ||
| 786 | 0) | ||
| 787 | { | ||
| 788 | if (!ssl_cert_inst(&s->cert)) | ||
| 789 | { | ||
| 790 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE); | ||
| 791 | return(0); | ||
| 792 | } | ||
| 793 | } | ||
| 794 | #endif | ||
| 795 | |||
| 796 | switch (cmd) | ||
| 797 | { | ||
| 798 | case SSL_CTRL_GET_SESSION_REUSED: | ||
| 799 | ret=s->hit; | ||
| 800 | break; | ||
| 801 | case SSL_CTRL_GET_CLIENT_CERT_REQUEST: | ||
| 802 | break; | ||
| 803 | case SSL_CTRL_GET_NUM_RENEGOTIATIONS: | ||
| 804 | ret=s->s3->num_renegotiations; | ||
| 805 | break; | ||
| 806 | case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS: | ||
| 807 | ret=s->s3->num_renegotiations; | ||
| 808 | s->s3->num_renegotiations=0; | ||
| 809 | break; | ||
| 810 | case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS: | ||
| 811 | ret=s->s3->total_renegotiations; | ||
| 812 | break; | ||
| 813 | case SSL_CTRL_GET_FLAGS: | ||
| 814 | ret=(int)(s->s3->flags); | ||
| 815 | break; | ||
| 816 | #ifndef NO_RSA | ||
| 817 | case SSL_CTRL_NEED_TMP_RSA: | ||
| 818 | if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) && | ||
| 819 | ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || | ||
| 820 | (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))) | ||
| 821 | ret = 1; | ||
| 822 | break; | ||
| 823 | case SSL_CTRL_SET_TMP_RSA: | ||
| 824 | { | ||
| 825 | RSA *rsa = (RSA *)parg; | ||
| 826 | if (rsa == NULL) | ||
| 827 | { | ||
| 828 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); | ||
| 829 | return(ret); | ||
| 830 | } | ||
| 831 | if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) | ||
| 832 | { | ||
| 833 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB); | ||
| 834 | return(ret); | ||
| 835 | } | ||
| 836 | if (s->cert->rsa_tmp != NULL) | ||
| 837 | RSA_free(s->cert->rsa_tmp); | ||
| 838 | s->cert->rsa_tmp = rsa; | ||
| 839 | ret = 1; | ||
| 840 | } | ||
| 841 | break; | ||
| 842 | case SSL_CTRL_SET_TMP_RSA_CB: | ||
| 843 | { | ||
| 844 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 845 | return(ret); | ||
| 846 | } | ||
| 847 | break; | ||
| 848 | #endif | ||
| 849 | #ifndef NO_DH | ||
| 850 | case SSL_CTRL_SET_TMP_DH: | ||
| 851 | { | ||
| 852 | DH *dh = (DH *)parg; | ||
| 853 | if (dh == NULL) | ||
| 854 | { | ||
| 855 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); | ||
| 856 | return(ret); | ||
| 857 | } | ||
| 858 | if ((dh = DHparams_dup(dh)) == NULL) | ||
| 859 | { | ||
| 860 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); | ||
| 861 | return(ret); | ||
| 862 | } | ||
| 863 | if (!(s->options & SSL_OP_SINGLE_DH_USE)) | ||
| 864 | { | ||
| 865 | if (!DH_generate_key(dh)) | ||
| 866 | { | ||
| 867 | DH_free(dh); | ||
| 868 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); | ||
| 869 | return(ret); | ||
| 870 | } | ||
| 871 | } | ||
| 872 | if (s->cert->dh_tmp != NULL) | ||
| 873 | DH_free(s->cert->dh_tmp); | ||
| 874 | s->cert->dh_tmp = dh; | ||
| 875 | ret = 1; | ||
| 876 | } | ||
| 877 | break; | ||
| 878 | case SSL_CTRL_SET_TMP_DH_CB: | ||
| 879 | { | ||
| 880 | SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 881 | return(ret); | ||
| 882 | } | ||
| 883 | break; | ||
| 884 | #endif | ||
| 885 | default: | ||
| 886 | break; | ||
| 887 | } | ||
| 888 | return(ret); | ||
| 889 | } | ||
| 890 | |||
| 891 | long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)()) | ||
| 892 | { | ||
| 893 | int ret=0; | ||
| 894 | |||
| 895 | #if !defined(NO_DSA) || !defined(NO_RSA) | ||
| 896 | if ( | ||
| 897 | #ifndef NO_RSA | ||
| 898 | cmd == SSL_CTRL_SET_TMP_RSA_CB || | ||
| 899 | #endif | ||
| 900 | #ifndef NO_DSA | ||
| 901 | cmd == SSL_CTRL_SET_TMP_DH_CB || | ||
| 902 | #endif | ||
| 903 | 0) | ||
| 904 | { | ||
| 905 | if (!ssl_cert_inst(&s->cert)) | ||
| 906 | { | ||
| 907 | SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE); | ||
| 908 | return(0); | ||
| 909 | } | ||
| 910 | } | ||
| 911 | #endif | ||
| 912 | |||
| 913 | switch (cmd) | ||
| 914 | { | ||
| 915 | #ifndef NO_RSA | ||
| 916 | case SSL_CTRL_SET_TMP_RSA_CB: | ||
| 917 | { | ||
| 918 | s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; | ||
| 919 | } | ||
| 920 | break; | ||
| 921 | #endif | ||
| 922 | #ifndef NO_DH | ||
| 923 | case SSL_CTRL_SET_TMP_DH_CB: | ||
| 924 | { | ||
| 925 | s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; | ||
| 926 | } | ||
| 927 | break; | ||
| 928 | #endif | ||
| 929 | default: | ||
| 930 | break; | ||
| 931 | } | ||
| 932 | return(ret); | ||
| 933 | } | ||
| 934 | |||
| 935 | long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg) | ||
| 936 | { | ||
| 937 | CERT *cert; | ||
| 938 | |||
| 939 | cert=ctx->cert; | ||
| 940 | |||
| 941 | switch (cmd) | ||
| 942 | { | ||
| 943 | #ifndef NO_RSA | ||
| 944 | case SSL_CTRL_NEED_TMP_RSA: | ||
| 945 | if ( (cert->rsa_tmp == NULL) && | ||
| 946 | ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || | ||
| 947 | (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))) | ||
| 948 | ) | ||
| 949 | return(1); | ||
| 950 | else | ||
| 951 | return(0); | ||
| 952 | /* break; */ | ||
| 953 | case SSL_CTRL_SET_TMP_RSA: | ||
| 954 | { | ||
| 955 | RSA *rsa; | ||
| 956 | int i; | ||
| 957 | |||
| 958 | rsa=(RSA *)parg; | ||
| 959 | i=1; | ||
| 960 | if (rsa == NULL) | ||
| 961 | i=0; | ||
| 962 | else | ||
| 963 | { | ||
| 964 | if ((rsa=RSAPrivateKey_dup(rsa)) == NULL) | ||
| 965 | i=0; | ||
| 966 | } | ||
| 967 | if (!i) | ||
| 968 | { | ||
| 969 | SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB); | ||
| 970 | return(0); | ||
| 971 | } | ||
| 972 | else | ||
| 973 | { | ||
| 974 | if (cert->rsa_tmp != NULL) | ||
| 975 | RSA_free(cert->rsa_tmp); | ||
| 976 | cert->rsa_tmp=rsa; | ||
| 977 | return(1); | ||
| 978 | } | ||
| 979 | } | ||
| 980 | /* break; */ | ||
| 981 | case SSL_CTRL_SET_TMP_RSA_CB: | ||
| 982 | { | ||
| 983 | SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 984 | return(0); | ||
| 985 | } | ||
| 986 | break; | ||
| 987 | #endif | ||
| 988 | #ifndef NO_DH | ||
| 989 | case SSL_CTRL_SET_TMP_DH: | ||
| 990 | { | ||
| 991 | DH *new=NULL,*dh; | ||
| 992 | |||
| 993 | dh=(DH *)parg; | ||
| 994 | if ((new=DHparams_dup(dh)) == NULL) | ||
| 995 | { | ||
| 996 | SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); | ||
| 997 | return 0; | ||
| 998 | } | ||
| 999 | if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) | ||
| 1000 | { | ||
| 1001 | if (!DH_generate_key(new)) | ||
| 1002 | { | ||
| 1003 | SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); | ||
| 1004 | DH_free(new); | ||
| 1005 | return 0; | ||
| 1006 | } | ||
| 1007 | } | ||
| 1008 | if (cert->dh_tmp != NULL) | ||
| 1009 | DH_free(cert->dh_tmp); | ||
| 1010 | cert->dh_tmp=new; | ||
| 1011 | return 1; | ||
| 1012 | } | ||
| 1013 | /*break; */ | ||
| 1014 | case SSL_CTRL_SET_TMP_DH_CB: | ||
| 1015 | { | ||
| 1016 | SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 1017 | return(0); | ||
| 1018 | } | ||
| 1019 | break; | ||
| 1020 | #endif | ||
| 1021 | /* A Thawte special :-) */ | ||
| 1022 | case SSL_CTRL_EXTRA_CHAIN_CERT: | ||
| 1023 | if (ctx->extra_certs == NULL) | ||
| 1024 | { | ||
| 1025 | if ((ctx->extra_certs=sk_X509_new_null()) == NULL) | ||
| 1026 | return(0); | ||
| 1027 | } | ||
| 1028 | sk_X509_push(ctx->extra_certs,(X509 *)parg); | ||
| 1029 | break; | ||
| 1030 | |||
| 1031 | default: | ||
| 1032 | return(0); | ||
| 1033 | } | ||
| 1034 | return(1); | ||
| 1035 | } | ||
| 1036 | |||
| 1037 | long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)()) | ||
| 1038 | { | ||
| 1039 | CERT *cert; | ||
| 1040 | |||
| 1041 | cert=ctx->cert; | ||
| 1042 | |||
| 1043 | switch (cmd) | ||
| 1044 | { | ||
| 1045 | #ifndef NO_RSA | ||
| 1046 | case SSL_CTRL_SET_TMP_RSA_CB: | ||
| 1047 | { | ||
| 1048 | cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; | ||
| 1049 | } | ||
| 1050 | break; | ||
| 1051 | #endif | ||
| 1052 | #ifndef NO_DH | ||
| 1053 | case SSL_CTRL_SET_TMP_DH_CB: | ||
| 1054 | { | ||
| 1055 | cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; | ||
| 1056 | } | ||
| 1057 | break; | ||
| 1058 | #endif | ||
| 1059 | default: | ||
| 1060 | return(0); | ||
| 1061 | } | ||
| 1062 | return(1); | ||
| 1063 | } | ||
| 1064 | |||
| 1065 | /* This function needs to check if the ciphers required are actually | ||
| 1066 | * available */ | ||
| 1067 | SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p) | ||
| 1068 | { | ||
| 1069 | static int init=1; | ||
| 1070 | static SSL_CIPHER *sorted[SSL3_NUM_CIPHERS]; | ||
| 1071 | SSL_CIPHER c,*cp= &c,**cpp; | ||
| 1072 | unsigned long id; | ||
| 1073 | int i; | ||
| 1074 | |||
| 1075 | if (init) | ||
| 1076 | { | ||
| 1077 | CRYPTO_w_lock(CRYPTO_LOCK_SSL); | ||
| 1078 | |||
| 1079 | for (i=0; i<SSL3_NUM_CIPHERS; i++) | ||
| 1080 | sorted[i]= &(ssl3_ciphers[i]); | ||
| 1081 | |||
| 1082 | qsort( (char *)sorted, | ||
| 1083 | SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *), | ||
| 1084 | FP_ICC ssl_cipher_ptr_id_cmp); | ||
| 1085 | |||
| 1086 | CRYPTO_w_unlock(CRYPTO_LOCK_SSL); | ||
| 1087 | |||
| 1088 | init=0; | ||
| 1089 | } | ||
| 1090 | |||
| 1091 | id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1]; | ||
| 1092 | c.id=id; | ||
| 1093 | cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp, | ||
| 1094 | (char *)sorted, | ||
| 1095 | SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *), | ||
| 1096 | FP_ICC ssl_cipher_ptr_id_cmp); | ||
| 1097 | if ((cpp == NULL) || !(*cpp)->valid) | ||
| 1098 | return(NULL); | ||
| 1099 | else | ||
| 1100 | return(*cpp); | ||
| 1101 | } | ||
| 1102 | |||
| 1103 | int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p) | ||
| 1104 | { | ||
| 1105 | long l; | ||
| 1106 | |||
| 1107 | if (p != NULL) | ||
| 1108 | { | ||
| 1109 | l=c->id; | ||
| 1110 | if ((l & 0xff000000) != 0x03000000) return(0); | ||
| 1111 | p[0]=((unsigned char)(l>> 8L))&0xFF; | ||
| 1112 | p[1]=((unsigned char)(l ))&0xFF; | ||
| 1113 | } | ||
| 1114 | return(2); | ||
| 1115 | } | ||
| 1116 | |||
| 1117 | SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have, | ||
| 1118 | STACK_OF(SSL_CIPHER) *pref) | ||
| 1119 | { | ||
| 1120 | SSL_CIPHER *c,*ret=NULL; | ||
| 1121 | int i,j,ok; | ||
| 1122 | CERT *cert; | ||
| 1123 | unsigned long alg,mask,emask; | ||
| 1124 | |||
| 1125 | /* Let's see which ciphers we can support */ | ||
| 1126 | cert=s->cert; | ||
| 1127 | |||
| 1128 | sk_SSL_CIPHER_set_cmp_func(pref,ssl_cipher_ptr_id_cmp); | ||
| 1129 | |||
| 1130 | #ifdef CIPHER_DEBUG | ||
| 1131 | printf("Have:\n"); | ||
| 1132 | for(i=0 ; i < sk_num(pref) ; ++i) | ||
| 1133 | { | ||
| 1134 | c=(SSL_CIPHER *)sk_value(pref,i); | ||
| 1135 | printf("%p:%s\n",c,c->name); | ||
| 1136 | } | ||
| 1137 | #endif | ||
| 1138 | |||
| 1139 | for (i=0; i<sk_SSL_CIPHER_num(have); i++) | ||
| 1140 | { | ||
| 1141 | c=sk_SSL_CIPHER_value(have,i); | ||
| 1142 | |||
| 1143 | ssl_set_cert_masks(cert,c); | ||
| 1144 | mask=cert->mask; | ||
| 1145 | emask=cert->export_mask; | ||
| 1146 | |||
| 1147 | alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK); | ||
| 1148 | if (SSL_C_IS_EXPORT(c)) | ||
| 1149 | { | ||
| 1150 | ok=((alg & emask) == alg)?1:0; | ||
| 1151 | #ifdef CIPHER_DEBUG | ||
| 1152 | printf("%d:[%08lX:%08lX]%p:%s (export)\n",ok,alg,emask, | ||
| 1153 | c,c->name); | ||
| 1154 | #endif | ||
| 1155 | } | ||
| 1156 | else | ||
| 1157 | { | ||
| 1158 | ok=((alg & mask) == alg)?1:0; | ||
| 1159 | #ifdef CIPHER_DEBUG | ||
| 1160 | printf("%d:[%08lX:%08lX]%p:%s\n",ok,alg,mask,c, | ||
| 1161 | c->name); | ||
| 1162 | #endif | ||
| 1163 | } | ||
| 1164 | |||
| 1165 | if (!ok) continue; | ||
| 1166 | |||
| 1167 | j=sk_SSL_CIPHER_find(pref,c); | ||
| 1168 | if (j >= 0) | ||
| 1169 | { | ||
| 1170 | ret=sk_SSL_CIPHER_value(pref,j); | ||
| 1171 | break; | ||
| 1172 | } | ||
| 1173 | } | ||
| 1174 | return(ret); | ||
| 1175 | } | ||
| 1176 | |||
| 1177 | int ssl3_get_req_cert_type(SSL *s, unsigned char *p) | ||
| 1178 | { | ||
| 1179 | int ret=0; | ||
| 1180 | unsigned long alg; | ||
| 1181 | |||
| 1182 | alg=s->s3->tmp.new_cipher->algorithms; | ||
| 1183 | |||
| 1184 | #ifndef NO_DH | ||
| 1185 | if (alg & (SSL_kDHr|SSL_kEDH)) | ||
| 1186 | { | ||
| 1187 | # ifndef NO_RSA | ||
| 1188 | p[ret++]=SSL3_CT_RSA_FIXED_DH; | ||
| 1189 | # endif | ||
| 1190 | # ifndef NO_DSA | ||
| 1191 | p[ret++]=SSL3_CT_DSS_FIXED_DH; | ||
| 1192 | # endif | ||
| 1193 | } | ||
| 1194 | if ((s->version == SSL3_VERSION) && | ||
| 1195 | (alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) | ||
| 1196 | { | ||
| 1197 | # ifndef NO_RSA | ||
| 1198 | p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH; | ||
| 1199 | # endif | ||
| 1200 | # ifndef NO_DSA | ||
| 1201 | p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH; | ||
| 1202 | # endif | ||
| 1203 | } | ||
| 1204 | #endif /* !NO_DH */ | ||
| 1205 | #ifndef NO_RSA | ||
| 1206 | p[ret++]=SSL3_CT_RSA_SIGN; | ||
| 1207 | #endif | ||
| 1208 | #ifndef NO_DSA | ||
| 1209 | p[ret++]=SSL3_CT_DSS_SIGN; | ||
| 1210 | #endif | ||
| 1211 | return(ret); | ||
| 1212 | } | ||
| 1213 | |||
| 1214 | int ssl3_shutdown(SSL *s) | ||
| 1215 | { | ||
| 1216 | |||
| 1217 | /* Don't do anything much if we have not done the handshake or | ||
| 1218 | * we don't want to send messages :-) */ | ||
| 1219 | if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) | ||
| 1220 | { | ||
| 1221 | s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); | ||
| 1222 | return(1); | ||
| 1223 | } | ||
| 1224 | |||
| 1225 | if (!(s->shutdown & SSL_SENT_SHUTDOWN)) | ||
| 1226 | { | ||
| 1227 | s->shutdown|=SSL_SENT_SHUTDOWN; | ||
| 1228 | #if 1 | ||
| 1229 | ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY); | ||
| 1230 | #endif | ||
| 1231 | /* our shutdown alert has been sent now, and if it still needs | ||
| 1232 | * to be written, s->s3->alert_dispatch will be true */ | ||
| 1233 | } | ||
| 1234 | else if (s->s3->alert_dispatch) | ||
| 1235 | { | ||
| 1236 | /* resend it if not sent */ | ||
| 1237 | #if 1 | ||
| 1238 | ssl3_dispatch_alert(s); | ||
| 1239 | #endif | ||
| 1240 | } | ||
| 1241 | else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) | ||
| 1242 | { | ||
| 1243 | /* If we are waiting for a close from our peer, we are closed */ | ||
| 1244 | ssl3_read_bytes(s,0,NULL,0,0); | ||
| 1245 | } | ||
| 1246 | |||
| 1247 | if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) && | ||
| 1248 | !s->s3->alert_dispatch) | ||
| 1249 | return(1); | ||
| 1250 | else | ||
| 1251 | return(0); | ||
| 1252 | } | ||
| 1253 | |||
| 1254 | int ssl3_write(SSL *s, const void *buf, int len) | ||
| 1255 | { | ||
| 1256 | int ret,n; | ||
| 1257 | |||
| 1258 | #if 0 | ||
| 1259 | if (s->shutdown & SSL_SEND_SHUTDOWN) | ||
| 1260 | { | ||
| 1261 | s->rwstate=SSL_NOTHING; | ||
| 1262 | return(0); | ||
| 1263 | } | ||
| 1264 | #endif | ||
| 1265 | clear_sys_error(); | ||
| 1266 | if (s->s3->renegotiate) ssl3_renegotiate_check(s); | ||
| 1267 | |||
| 1268 | /* This is an experimental flag that sends the | ||
| 1269 | * last handshake message in the same packet as the first | ||
| 1270 | * use data - used to see if it helps the TCP protocol during | ||
| 1271 | * session-id reuse */ | ||
| 1272 | /* The second test is because the buffer may have been removed */ | ||
| 1273 | if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) | ||
| 1274 | { | ||
| 1275 | /* First time through, we write into the buffer */ | ||
| 1276 | if (s->s3->delay_buf_pop_ret == 0) | ||
| 1277 | { | ||
| 1278 | ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, | ||
| 1279 | buf,len); | ||
| 1280 | if (ret <= 0) return(ret); | ||
| 1281 | |||
| 1282 | s->s3->delay_buf_pop_ret=ret; | ||
| 1283 | } | ||
| 1284 | |||
| 1285 | s->rwstate=SSL_WRITING; | ||
| 1286 | n=BIO_flush(s->wbio); | ||
| 1287 | if (n <= 0) return(n); | ||
| 1288 | s->rwstate=SSL_NOTHING; | ||
| 1289 | |||
| 1290 | /* We have flushed the buffer, so remove it */ | ||
| 1291 | ssl_free_wbio_buffer(s); | ||
| 1292 | s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; | ||
| 1293 | |||
| 1294 | ret=s->s3->delay_buf_pop_ret; | ||
| 1295 | s->s3->delay_buf_pop_ret=0; | ||
| 1296 | } | ||
| 1297 | else | ||
| 1298 | { | ||
| 1299 | ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, | ||
| 1300 | buf,len); | ||
| 1301 | if (ret <= 0) return(ret); | ||
| 1302 | } | ||
| 1303 | |||
| 1304 | return(ret); | ||
| 1305 | } | ||
| 1306 | |||
| 1307 | static int ssl3_read_internal(SSL *s, void *buf, int len, int peek) | ||
| 1308 | { | ||
| 1309 | int ret; | ||
| 1310 | |||
| 1311 | clear_sys_error(); | ||
| 1312 | if (s->s3->renegotiate) ssl3_renegotiate_check(s); | ||
| 1313 | s->s3->in_read_app_data=1; | ||
| 1314 | ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek); | ||
| 1315 | if ((ret == -1) && (s->s3->in_read_app_data == 0)) | ||
| 1316 | { | ||
| 1317 | /* ssl3_read_bytes decided to call s->handshake_func, which | ||
| 1318 | * called ssl3_read_bytes to read handshake data. | ||
| 1319 | * However, ssl3_read_bytes actually found application data | ||
| 1320 | * and thinks that application data makes sense here (signalled | ||
| 1321 | * by resetting 'in_read_app_data', strangely); so disable | ||
| 1322 | * handshake processing and try to read application data again. */ | ||
| 1323 | s->in_handshake++; | ||
| 1324 | ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek); | ||
| 1325 | s->in_handshake--; | ||
| 1326 | } | ||
| 1327 | else | ||
| 1328 | s->s3->in_read_app_data=0; | ||
| 1329 | |||
| 1330 | return(ret); | ||
| 1331 | } | ||
| 1332 | |||
| 1333 | int ssl3_read(SSL *s, void *buf, int len) | ||
| 1334 | { | ||
| 1335 | return ssl3_read_internal(s, buf, len, 0); | ||
| 1336 | } | ||
| 1337 | |||
| 1338 | int ssl3_peek(SSL *s, void *buf, int len) | ||
| 1339 | { | ||
| 1340 | return ssl3_read_internal(s, buf, len, 1); | ||
| 1341 | } | ||
| 1342 | |||
| 1343 | int ssl3_renegotiate(SSL *s) | ||
| 1344 | { | ||
| 1345 | if (s->handshake_func == NULL) | ||
| 1346 | return(1); | ||
| 1347 | |||
| 1348 | if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) | ||
| 1349 | return(0); | ||
| 1350 | |||
| 1351 | s->s3->renegotiate=1; | ||
| 1352 | return(1); | ||
| 1353 | } | ||
| 1354 | |||
| 1355 | int ssl3_renegotiate_check(SSL *s) | ||
| 1356 | { | ||
| 1357 | int ret=0; | ||
| 1358 | |||
| 1359 | if (s->s3->renegotiate) | ||
| 1360 | { | ||
| 1361 | if ( (s->s3->rbuf.left == 0) && | ||
| 1362 | (s->s3->wbuf.left == 0) && | ||
| 1363 | !SSL_in_init(s)) | ||
| 1364 | { | ||
| 1365 | /* | ||
| 1366 | if we are the server, and we have sent a 'RENEGOTIATE' message, we | ||
| 1367 | need to go to SSL_ST_ACCEPT. | ||
| 1368 | */ | ||
| 1369 | /* SSL_ST_ACCEPT */ | ||
| 1370 | s->state=SSL_ST_RENEGOTIATE; | ||
| 1371 | s->s3->renegotiate=0; | ||
| 1372 | s->s3->num_renegotiations++; | ||
| 1373 | s->s3->total_renegotiations++; | ||
| 1374 | ret=1; | ||
| 1375 | } | ||
| 1376 | } | ||
| 1377 | return(ret); | ||
| 1378 | } | ||
| 1379 | |||
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c deleted file mode 100644 index 9ab76604a6..0000000000 --- a/src/lib/libssl/s3_pkt.c +++ /dev/null | |||
| @@ -1,1204 +0,0 @@ | |||
| 1 | /* ssl/s3_pkt.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | /* ==================================================================== | ||
| 59 | * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. | ||
| 60 | * | ||
| 61 | * Redistribution and use in source and binary forms, with or without | ||
| 62 | * modification, are permitted provided that the following conditions | ||
| 63 | * are met: | ||
| 64 | * | ||
| 65 | * 1. Redistributions of source code must retain the above copyright | ||
| 66 | * notice, this list of conditions and the following disclaimer. | ||
| 67 | * | ||
| 68 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 69 | * notice, this list of conditions and the following disclaimer in | ||
| 70 | * the documentation and/or other materials provided with the | ||
| 71 | * distribution. | ||
| 72 | * | ||
| 73 | * 3. All advertising materials mentioning features or use of this | ||
| 74 | * software must display the following acknowledgment: | ||
| 75 | * "This product includes software developed by the OpenSSL Project | ||
| 76 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" | ||
| 77 | * | ||
| 78 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 79 | * endorse or promote products derived from this software without | ||
| 80 | * prior written permission. For written permission, please contact | ||
| 81 | * openssl-core@openssl.org. | ||
| 82 | * | ||
| 83 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 84 | * nor may "OpenSSL" appear in their names without prior written | ||
| 85 | * permission of the OpenSSL Project. | ||
| 86 | * | ||
| 87 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 88 | * acknowledgment: | ||
| 89 | * "This product includes software developed by the OpenSSL Project | ||
| 90 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" | ||
| 91 | * | ||
| 92 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 93 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 94 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 95 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 96 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 97 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 98 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 99 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 100 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 101 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 102 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 103 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 104 | * ==================================================================== | ||
| 105 | * | ||
| 106 | * This product includes cryptographic software written by Eric Young | ||
| 107 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
| 108 | * Hudson (tjh@cryptsoft.com). | ||
| 109 | * | ||
| 110 | */ | ||
| 111 | |||
| 112 | #include <stdio.h> | ||
| 113 | #include <errno.h> | ||
| 114 | #define USE_SOCKETS | ||
| 115 | #include <openssl/evp.h> | ||
| 116 | #include <openssl/buffer.h> | ||
| 117 | #include "ssl_locl.h" | ||
| 118 | |||
| 119 | static int do_ssl3_write(SSL *s, int type, const unsigned char *buf, | ||
| 120 | unsigned int len); | ||
| 121 | static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, | ||
| 122 | unsigned int len); | ||
| 123 | static int ssl3_get_record(SSL *s); | ||
| 124 | static int do_compress(SSL *ssl); | ||
| 125 | static int do_uncompress(SSL *ssl); | ||
| 126 | static int do_change_cipher_spec(SSL *ssl); | ||
| 127 | |||
| 128 | /* used only by ssl3_get_record */ | ||
| 129 | static int ssl3_read_n(SSL *s, int n, int max, int extend) | ||
| 130 | { | ||
| 131 | /* If extend == 0, obtain new n-byte packet; if extend == 1, increase | ||
| 132 | * packet by another n bytes. | ||
| 133 | * The packet will be in the sub-array of s->s3->rbuf.buf specified | ||
| 134 | * by s->packet and s->packet_length. | ||
| 135 | * (If s->read_ahead is set, 'max' bytes may be stored in rbuf | ||
| 136 | * [plus s->packet_length bytes if extend == 1].) | ||
| 137 | */ | ||
| 138 | int i,off,newb; | ||
| 139 | |||
| 140 | if (!extend) | ||
| 141 | { | ||
| 142 | /* start with empty packet ... */ | ||
| 143 | if (s->s3->rbuf.left == 0) | ||
| 144 | s->s3->rbuf.offset = 0; | ||
| 145 | s->packet = s->s3->rbuf.buf + s->s3->rbuf.offset; | ||
| 146 | s->packet_length = 0; | ||
| 147 | /* ... now we can act as if 'extend' was set */ | ||
| 148 | } | ||
| 149 | |||
| 150 | /* if there is enough in the buffer from a previous read, take some */ | ||
| 151 | if (s->s3->rbuf.left >= (int)n) | ||
| 152 | { | ||
| 153 | s->packet_length+=n; | ||
| 154 | s->s3->rbuf.left-=n; | ||
| 155 | s->s3->rbuf.offset+=n; | ||
| 156 | return(n); | ||
| 157 | } | ||
| 158 | |||
| 159 | /* else we need to read more data */ | ||
| 160 | if (!s->read_ahead) | ||
| 161 | max=n; | ||
| 162 | |||
| 163 | { | ||
| 164 | /* avoid buffer overflow */ | ||
| 165 | int max_max = SSL3_RT_MAX_PACKET_SIZE - s->packet_length; | ||
| 166 | if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) | ||
| 167 | max_max += SSL3_RT_MAX_EXTRA; | ||
| 168 | if (max > max_max) | ||
| 169 | max = max_max; | ||
| 170 | } | ||
| 171 | if (n > max) /* does not happen */ | ||
| 172 | { | ||
| 173 | SSLerr(SSL_F_SSL3_READ_N,SSL_R_INTERNAL_ERROR); | ||
| 174 | return -1; | ||
| 175 | } | ||
| 176 | |||
| 177 | off = s->packet_length; | ||
| 178 | newb = s->s3->rbuf.left; | ||
| 179 | /* Move any available bytes to front of buffer: | ||
| 180 | * 'off' bytes already pointed to by 'packet', | ||
| 181 | * 'newb' extra ones at the end */ | ||
| 182 | if (s->packet != s->s3->rbuf.buf) | ||
| 183 | { | ||
| 184 | /* off > 0 */ | ||
| 185 | memmove(s->s3->rbuf.buf, s->packet, off+newb); | ||
| 186 | s->packet = s->s3->rbuf.buf; | ||
| 187 | } | ||
| 188 | |||
| 189 | while (newb < n) | ||
| 190 | { | ||
| 191 | /* Now we have off+newb bytes at the front of s->s3->rbuf.buf and need | ||
| 192 | * to read in more until we have off+n (up to off+max if possible) */ | ||
| 193 | |||
| 194 | clear_sys_error(); | ||
| 195 | if (s->rbio != NULL) | ||
| 196 | { | ||
| 197 | s->rwstate=SSL_READING; | ||
| 198 | i=BIO_read(s->rbio, &(s->s3->rbuf.buf[off+newb]), max-newb); | ||
| 199 | } | ||
| 200 | else | ||
| 201 | { | ||
| 202 | SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET); | ||
| 203 | i = -1; | ||
| 204 | } | ||
| 205 | |||
| 206 | if (i <= 0) | ||
| 207 | { | ||
| 208 | s->s3->rbuf.left = newb; | ||
| 209 | return(i); | ||
| 210 | } | ||
| 211 | newb+=i; | ||
| 212 | } | ||
| 213 | |||
| 214 | /* done reading, now the book-keeping */ | ||
| 215 | s->s3->rbuf.offset = off + n; | ||
| 216 | s->s3->rbuf.left = newb - n; | ||
| 217 | s->packet_length += n; | ||
| 218 | s->rwstate=SSL_NOTHING; | ||
| 219 | return(n); | ||
| 220 | } | ||
| 221 | |||
| 222 | /* Call this to get a new input record. | ||
| 223 | * It will return <= 0 if more data is needed, normally due to an error | ||
| 224 | * or non-blocking IO. | ||
| 225 | * When it finishes, one packet has been decoded and can be found in | ||
| 226 | * ssl->s3->rrec.type - is the type of record | ||
| 227 | * ssl->s3->rrec.data, - data | ||
| 228 | * ssl->s3->rrec.length, - number of bytes | ||
| 229 | */ | ||
| 230 | /* used only by ssl3_read_bytes */ | ||
| 231 | static int ssl3_get_record(SSL *s) | ||
| 232 | { | ||
| 233 | int ssl_major,ssl_minor,al; | ||
| 234 | int n,i,ret= -1; | ||
| 235 | SSL3_RECORD *rr; | ||
| 236 | SSL_SESSION *sess; | ||
| 237 | unsigned char *p; | ||
| 238 | unsigned char md[EVP_MAX_MD_SIZE]; | ||
| 239 | short version; | ||
| 240 | unsigned int mac_size; | ||
| 241 | int clear=0,extra; | ||
| 242 | |||
| 243 | rr= &(s->s3->rrec); | ||
| 244 | sess=s->session; | ||
| 245 | |||
| 246 | if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) | ||
| 247 | extra=SSL3_RT_MAX_EXTRA; | ||
| 248 | else | ||
| 249 | extra=0; | ||
| 250 | |||
| 251 | again: | ||
| 252 | /* check if we have the header */ | ||
| 253 | if ( (s->rstate != SSL_ST_READ_BODY) || | ||
| 254 | (s->packet_length < SSL3_RT_HEADER_LENGTH)) | ||
| 255 | { | ||
| 256 | n=ssl3_read_n(s,SSL3_RT_HEADER_LENGTH, | ||
| 257 | SSL3_RT_MAX_PACKET_SIZE,0); | ||
| 258 | if (n <= 0) return(n); /* error or non-blocking */ | ||
| 259 | s->rstate=SSL_ST_READ_BODY; | ||
| 260 | |||
| 261 | p=s->packet; | ||
| 262 | |||
| 263 | /* Pull apart the header into the SSL3_RECORD */ | ||
| 264 | rr->type= *(p++); | ||
| 265 | ssl_major= *(p++); | ||
| 266 | ssl_minor= *(p++); | ||
| 267 | version=(ssl_major<<8)|ssl_minor; | ||
| 268 | n2s(p,rr->length); | ||
| 269 | |||
| 270 | /* Lets check version */ | ||
| 271 | if (s->first_packet) | ||
| 272 | { | ||
| 273 | s->first_packet=0; | ||
| 274 | } | ||
| 275 | else | ||
| 276 | { | ||
| 277 | if (version != s->version) | ||
| 278 | { | ||
| 279 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER); | ||
| 280 | /* Send back error using their | ||
| 281 | * version number :-) */ | ||
| 282 | s->version=version; | ||
| 283 | al=SSL_AD_PROTOCOL_VERSION; | ||
| 284 | goto f_err; | ||
| 285 | } | ||
| 286 | } | ||
| 287 | |||
| 288 | if ((version>>8) != SSL3_VERSION_MAJOR) | ||
| 289 | { | ||
| 290 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER); | ||
| 291 | goto err; | ||
| 292 | } | ||
| 293 | |||
| 294 | if (rr->length > | ||
| 295 | (unsigned int)SSL3_RT_MAX_ENCRYPTED_LENGTH+extra) | ||
| 296 | { | ||
| 297 | al=SSL_AD_RECORD_OVERFLOW; | ||
| 298 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG); | ||
| 299 | goto f_err; | ||
| 300 | } | ||
| 301 | |||
| 302 | /* now s->rstate == SSL_ST_READ_BODY */ | ||
| 303 | } | ||
| 304 | |||
| 305 | /* s->rstate == SSL_ST_READ_BODY, get and decode the data */ | ||
| 306 | |||
| 307 | if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH)) | ||
| 308 | { | ||
| 309 | /* now s->packet_length == SSL3_RT_HEADER_LENGTH */ | ||
| 310 | i=rr->length; | ||
| 311 | n=ssl3_read_n(s,i,i,1); | ||
| 312 | if (n <= 0) return(n); /* error or non-blocking io */ | ||
| 313 | /* now n == rr->length, | ||
| 314 | * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */ | ||
| 315 | } | ||
| 316 | |||
| 317 | s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */ | ||
| 318 | |||
| 319 | /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length, | ||
| 320 | * and we have that many bytes in s->packet | ||
| 321 | */ | ||
| 322 | rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]); | ||
| 323 | |||
| 324 | /* ok, we can now read from 's->packet' data into 'rr' | ||
| 325 | * rr->input points at rr->length bytes, which | ||
| 326 | * need to be copied into rr->data by either | ||
| 327 | * the decryption or by the decompression | ||
| 328 | * When the data is 'copied' into the rr->data buffer, | ||
| 329 | * rr->input will be pointed at the new buffer */ | ||
| 330 | |||
| 331 | /* We now have - encrypted [ MAC [ compressed [ plain ] ] ] | ||
| 332 | * rr->length bytes of encrypted compressed stuff. */ | ||
| 333 | |||
| 334 | /* check is not needed I believe */ | ||
| 335 | if (rr->length > (unsigned int)SSL3_RT_MAX_ENCRYPTED_LENGTH+extra) | ||
| 336 | { | ||
| 337 | al=SSL_AD_RECORD_OVERFLOW; | ||
| 338 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG); | ||
| 339 | goto f_err; | ||
| 340 | } | ||
| 341 | |||
| 342 | /* decrypt in place in 'rr->input' */ | ||
| 343 | rr->data=rr->input; | ||
| 344 | |||
| 345 | if (!s->method->ssl3_enc->enc(s,0)) | ||
| 346 | { | ||
| 347 | al=SSL_AD_DECRYPT_ERROR; | ||
| 348 | goto f_err; | ||
| 349 | } | ||
| 350 | #ifdef TLS_DEBUG | ||
| 351 | printf("dec %d\n",rr->length); | ||
| 352 | { unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); } | ||
| 353 | printf("\n"); | ||
| 354 | #endif | ||
| 355 | /* r->length is now the compressed data plus mac */ | ||
| 356 | if ( (sess == NULL) || | ||
| 357 | (s->enc_read_ctx == NULL) || | ||
| 358 | (s->read_hash == NULL)) | ||
| 359 | clear=1; | ||
| 360 | |||
| 361 | if (!clear) | ||
| 362 | { | ||
| 363 | mac_size=EVP_MD_size(s->read_hash); | ||
| 364 | |||
| 365 | if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size) | ||
| 366 | { | ||
| 367 | al=SSL_AD_RECORD_OVERFLOW; | ||
| 368 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG); | ||
| 369 | goto f_err; | ||
| 370 | } | ||
| 371 | /* check the MAC for rr->input (it's in mac_size bytes at the tail) */ | ||
| 372 | if (rr->length < mac_size) | ||
| 373 | { | ||
| 374 | al=SSL_AD_DECODE_ERROR; | ||
| 375 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT); | ||
| 376 | goto f_err; | ||
| 377 | } | ||
| 378 | rr->length-=mac_size; | ||
| 379 | i=s->method->ssl3_enc->mac(s,md,0); | ||
| 380 | if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0) | ||
| 381 | { | ||
| 382 | al=SSL_AD_BAD_RECORD_MAC; | ||
| 383 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_MAC_DECODE); | ||
| 384 | ret= -1; | ||
| 385 | goto f_err; | ||
| 386 | } | ||
| 387 | } | ||
| 388 | |||
| 389 | /* r->length is now just compressed */ | ||
| 390 | if (s->expand != NULL) | ||
| 391 | { | ||
| 392 | if (rr->length > | ||
| 393 | (unsigned int)SSL3_RT_MAX_COMPRESSED_LENGTH+extra) | ||
| 394 | { | ||
| 395 | al=SSL_AD_RECORD_OVERFLOW; | ||
| 396 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG); | ||
| 397 | goto f_err; | ||
| 398 | } | ||
| 399 | if (!do_uncompress(s)) | ||
| 400 | { | ||
| 401 | al=SSL_AD_DECOMPRESSION_FAILURE; | ||
| 402 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION); | ||
| 403 | goto f_err; | ||
| 404 | } | ||
| 405 | } | ||
| 406 | |||
| 407 | if (rr->length > (unsigned int)SSL3_RT_MAX_PLAIN_LENGTH+extra) | ||
| 408 | { | ||
| 409 | al=SSL_AD_RECORD_OVERFLOW; | ||
| 410 | SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG); | ||
| 411 | goto f_err; | ||
| 412 | } | ||
| 413 | |||
| 414 | rr->off=0; | ||
| 415 | /* So at this point the following is true | ||
| 416 | * ssl->s3->rrec.type is the type of record | ||
| 417 | * ssl->s3->rrec.length == number of bytes in record | ||
| 418 | * ssl->s3->rrec.off == offset to first valid byte | ||
| 419 | * ssl->s3->rrec.data == where to take bytes from, increment | ||
| 420 | * after use :-). | ||
| 421 | */ | ||
| 422 | |||
| 423 | /* we have pulled in a full packet so zero things */ | ||
| 424 | s->packet_length=0; | ||
| 425 | |||
| 426 | /* just read a 0 length packet */ | ||
| 427 | if (rr->length == 0) goto again; | ||
| 428 | |||
| 429 | return(1); | ||
| 430 | f_err: | ||
| 431 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 432 | err: | ||
| 433 | return(ret); | ||
| 434 | } | ||
| 435 | |||
| 436 | static int do_uncompress(SSL *ssl) | ||
| 437 | { | ||
| 438 | int i; | ||
| 439 | SSL3_RECORD *rr; | ||
| 440 | |||
| 441 | rr= &(ssl->s3->rrec); | ||
| 442 | i=COMP_expand_block(ssl->expand,rr->comp, | ||
| 443 | SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length); | ||
| 444 | if (i < 0) | ||
| 445 | return(0); | ||
| 446 | else | ||
| 447 | rr->length=i; | ||
| 448 | rr->data=rr->comp; | ||
| 449 | |||
| 450 | return(1); | ||
| 451 | } | ||
| 452 | |||
| 453 | static int do_compress(SSL *ssl) | ||
| 454 | { | ||
| 455 | int i; | ||
| 456 | SSL3_RECORD *wr; | ||
| 457 | |||
| 458 | wr= &(ssl->s3->wrec); | ||
| 459 | i=COMP_compress_block(ssl->compress,wr->data, | ||
| 460 | SSL3_RT_MAX_COMPRESSED_LENGTH, | ||
| 461 | wr->input,(int)wr->length); | ||
| 462 | if (i < 0) | ||
| 463 | return(0); | ||
| 464 | else | ||
| 465 | wr->length=i; | ||
| 466 | |||
| 467 | wr->input=wr->data; | ||
| 468 | return(1); | ||
| 469 | } | ||
| 470 | |||
| 471 | /* Call this to write data in records of type 'type' | ||
| 472 | * It will return <= 0 if not all data has been sent or non-blocking IO. | ||
| 473 | */ | ||
| 474 | int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len) | ||
| 475 | { | ||
| 476 | const unsigned char *buf=buf_; | ||
| 477 | unsigned int tot,n,nw; | ||
| 478 | int i; | ||
| 479 | |||
| 480 | s->rwstate=SSL_NOTHING; | ||
| 481 | tot=s->s3->wnum; | ||
| 482 | s->s3->wnum=0; | ||
| 483 | |||
| 484 | if (SSL_in_init(s) && !s->in_handshake) | ||
| 485 | { | ||
| 486 | i=s->handshake_func(s); | ||
| 487 | if (i < 0) return(i); | ||
| 488 | if (i == 0) | ||
| 489 | { | ||
| 490 | SSLerr(SSL_F_SSL3_WRITE_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 491 | return(-1); | ||
| 492 | } | ||
| 493 | } | ||
| 494 | |||
| 495 | n=(len-tot); | ||
| 496 | for (;;) | ||
| 497 | { | ||
| 498 | if (n > SSL3_RT_MAX_PLAIN_LENGTH) | ||
| 499 | nw=SSL3_RT_MAX_PLAIN_LENGTH; | ||
| 500 | else | ||
| 501 | nw=n; | ||
| 502 | |||
| 503 | i=do_ssl3_write(s,type,&(buf[tot]),nw); | ||
| 504 | if (i <= 0) | ||
| 505 | { | ||
| 506 | s->s3->wnum=tot; | ||
| 507 | return(i); | ||
| 508 | } | ||
| 509 | |||
| 510 | if ((i == (int)n) || | ||
| 511 | (type == SSL3_RT_APPLICATION_DATA && | ||
| 512 | (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE))) | ||
| 513 | { | ||
| 514 | return(tot+i); | ||
| 515 | } | ||
| 516 | |||
| 517 | n-=i; | ||
| 518 | tot+=i; | ||
| 519 | } | ||
| 520 | } | ||
| 521 | |||
| 522 | static int do_ssl3_write(SSL *s, int type, const unsigned char *buf, | ||
| 523 | unsigned int len) | ||
| 524 | { | ||
| 525 | unsigned char *p,*plen; | ||
| 526 | int i,mac_size,clear=0; | ||
| 527 | SSL3_RECORD *wr; | ||
| 528 | SSL3_BUFFER *wb; | ||
| 529 | SSL_SESSION *sess; | ||
| 530 | |||
| 531 | /* first check is there is a SSL3_RECORD still being written | ||
| 532 | * out. This will happen with non blocking IO */ | ||
| 533 | if (s->s3->wbuf.left != 0) | ||
| 534 | return(ssl3_write_pending(s,type,buf,len)); | ||
| 535 | |||
| 536 | /* If we have an alert to send, lets send it */ | ||
| 537 | if (s->s3->alert_dispatch) | ||
| 538 | { | ||
| 539 | i=ssl3_dispatch_alert(s); | ||
| 540 | if (i <= 0) | ||
| 541 | return(i); | ||
| 542 | /* if it went, fall through and send more stuff */ | ||
| 543 | } | ||
| 544 | |||
| 545 | if (len == 0) return(len); | ||
| 546 | |||
| 547 | wr= &(s->s3->wrec); | ||
| 548 | wb= &(s->s3->wbuf); | ||
| 549 | sess=s->session; | ||
| 550 | |||
| 551 | if ( (sess == NULL) || | ||
| 552 | (s->enc_write_ctx == NULL) || | ||
| 553 | (s->write_hash == NULL)) | ||
| 554 | clear=1; | ||
| 555 | |||
| 556 | if (clear) | ||
| 557 | mac_size=0; | ||
| 558 | else | ||
| 559 | mac_size=EVP_MD_size(s->write_hash); | ||
| 560 | |||
| 561 | p=wb->buf; | ||
| 562 | |||
| 563 | /* write the header */ | ||
| 564 | *(p++)=type&0xff; | ||
| 565 | wr->type=type; | ||
| 566 | |||
| 567 | *(p++)=(s->version>>8); | ||
| 568 | *(p++)=s->version&0xff; | ||
| 569 | |||
| 570 | /* record where we are to write out packet length */ | ||
| 571 | plen=p; | ||
| 572 | p+=2; | ||
| 573 | |||
| 574 | /* lets setup the record stuff. */ | ||
| 575 | wr->data=p; | ||
| 576 | wr->length=(int)len; | ||
| 577 | wr->input=(unsigned char *)buf; | ||
| 578 | |||
| 579 | /* we now 'read' from wr->input, wr->length bytes into | ||
| 580 | * wr->data */ | ||
| 581 | |||
| 582 | /* first we compress */ | ||
| 583 | if (s->compress != NULL) | ||
| 584 | { | ||
| 585 | if (!do_compress(s)) | ||
| 586 | { | ||
| 587 | SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE); | ||
| 588 | goto err; | ||
| 589 | } | ||
| 590 | } | ||
| 591 | else | ||
| 592 | { | ||
| 593 | memcpy(wr->data,wr->input,wr->length); | ||
| 594 | wr->input=wr->data; | ||
| 595 | } | ||
| 596 | |||
| 597 | /* we should still have the output to wr->data and the input | ||
| 598 | * from wr->input. Length should be wr->length. | ||
| 599 | * wr->data still points in the wb->buf */ | ||
| 600 | |||
| 601 | if (mac_size != 0) | ||
| 602 | { | ||
| 603 | s->method->ssl3_enc->mac(s,&(p[wr->length]),1); | ||
| 604 | wr->length+=mac_size; | ||
| 605 | wr->input=p; | ||
| 606 | wr->data=p; | ||
| 607 | } | ||
| 608 | |||
| 609 | /* ssl3_enc can only have an error on read */ | ||
| 610 | s->method->ssl3_enc->enc(s,1); | ||
| 611 | |||
| 612 | /* record length after mac and block padding */ | ||
| 613 | s2n(wr->length,plen); | ||
| 614 | |||
| 615 | /* we should now have | ||
| 616 | * wr->data pointing to the encrypted data, which is | ||
| 617 | * wr->length long */ | ||
| 618 | wr->type=type; /* not needed but helps for debugging */ | ||
| 619 | wr->length+=SSL3_RT_HEADER_LENGTH; | ||
| 620 | |||
| 621 | /* Now lets setup wb */ | ||
| 622 | wb->left=wr->length; | ||
| 623 | wb->offset=0; | ||
| 624 | |||
| 625 | s->s3->wpend_tot=len; | ||
| 626 | s->s3->wpend_buf=buf; | ||
| 627 | s->s3->wpend_type=type; | ||
| 628 | s->s3->wpend_ret=len; | ||
| 629 | |||
| 630 | /* we now just need to write the buffer */ | ||
| 631 | return(ssl3_write_pending(s,type,buf,len)); | ||
| 632 | err: | ||
| 633 | return(-1); | ||
| 634 | } | ||
| 635 | |||
| 636 | /* if s->s3->wbuf.left != 0, we need to call this */ | ||
| 637 | static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, | ||
| 638 | unsigned int len) | ||
| 639 | { | ||
| 640 | int i; | ||
| 641 | |||
| 642 | /* XXXX */ | ||
| 643 | if ((s->s3->wpend_tot > (int)len) | ||
| 644 | || ((s->s3->wpend_buf != buf) && | ||
| 645 | !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) | ||
| 646 | || (s->s3->wpend_type != type)) | ||
| 647 | { | ||
| 648 | SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BAD_WRITE_RETRY); | ||
| 649 | return(-1); | ||
| 650 | } | ||
| 651 | |||
| 652 | for (;;) | ||
| 653 | { | ||
| 654 | clear_sys_error(); | ||
| 655 | if (s->wbio != NULL) | ||
| 656 | { | ||
| 657 | s->rwstate=SSL_WRITING; | ||
| 658 | i=BIO_write(s->wbio, | ||
| 659 | (char *)&(s->s3->wbuf.buf[s->s3->wbuf.offset]), | ||
| 660 | (unsigned int)s->s3->wbuf.left); | ||
| 661 | } | ||
| 662 | else | ||
| 663 | { | ||
| 664 | SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BIO_NOT_SET); | ||
| 665 | i= -1; | ||
| 666 | } | ||
| 667 | if (i == s->s3->wbuf.left) | ||
| 668 | { | ||
| 669 | s->s3->wbuf.left=0; | ||
| 670 | s->rwstate=SSL_NOTHING; | ||
| 671 | return(s->s3->wpend_ret); | ||
| 672 | } | ||
| 673 | else if (i <= 0) | ||
| 674 | return(i); | ||
| 675 | s->s3->wbuf.offset+=i; | ||
| 676 | s->s3->wbuf.left-=i; | ||
| 677 | } | ||
| 678 | } | ||
| 679 | |||
| 680 | /* Return up to 'len' payload bytes received in 'type' records. | ||
| 681 | * 'type' is one of the following: | ||
| 682 | * | ||
| 683 | * - SSL3_RT_HANDSHAKE (when ssl3_get_message calls us) | ||
| 684 | * - SSL3_RT_APPLICATION_DATA (when ssl3_read calls us) | ||
| 685 | * - 0 (during a shutdown, no data has to be returned) | ||
| 686 | * | ||
| 687 | * If we don't have stored data to work from, read a SSL/TLS record first | ||
| 688 | * (possibly multiple records if we still don't have anything to return). | ||
| 689 | * | ||
| 690 | * This function must handle any surprises the peer may have for us, such as | ||
| 691 | * Alert records (e.g. close_notify), ChangeCipherSpec records (not really | ||
| 692 | * a surprise, but handled as if it were), or renegotiation requests. | ||
| 693 | * Also if record payloads contain fragments too small to process, we store | ||
| 694 | * them until there is enough for the respective protocol (the record protocol | ||
| 695 | * may use arbitrary fragmentation and even interleaving): | ||
| 696 | * Change cipher spec protocol | ||
| 697 | * just 1 byte needed, no need for keeping anything stored | ||
| 698 | * Alert protocol | ||
| 699 | * 2 bytes needed (AlertLevel, AlertDescription) | ||
| 700 | * Handshake protocol | ||
| 701 | * 4 bytes needed (HandshakeType, uint24 length) -- we just have | ||
| 702 | * to detect unexpected Client Hello and Hello Request messages | ||
| 703 | * here, anything else is handled by higher layers | ||
| 704 | * Application data protocol | ||
| 705 | * none of our business | ||
| 706 | */ | ||
| 707 | int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek) | ||
| 708 | { | ||
| 709 | int al,i,j,ret; | ||
| 710 | unsigned int n; | ||
| 711 | SSL3_RECORD *rr; | ||
| 712 | void (*cb)()=NULL; | ||
| 713 | |||
| 714 | if (s->s3->rbuf.buf == NULL) /* Not initialized yet */ | ||
| 715 | if (!ssl3_setup_buffers(s)) | ||
| 716 | return(-1); | ||
| 717 | |||
| 718 | if ((type && (type != SSL3_RT_APPLICATION_DATA) && (type != SSL3_RT_HANDSHAKE) && type) || | ||
| 719 | (peek && (type != SSL3_RT_APPLICATION_DATA))) | ||
| 720 | { | ||
| 721 | SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_INTERNAL_ERROR); | ||
| 722 | return -1; | ||
| 723 | } | ||
| 724 | |||
| 725 | if ((type == SSL3_RT_HANDSHAKE) && (s->s3->handshake_fragment_len > 0)) | ||
| 726 | /* (partially) satisfy request from storage */ | ||
| 727 | { | ||
| 728 | unsigned char *src = s->s3->handshake_fragment; | ||
| 729 | unsigned char *dst = buf; | ||
| 730 | unsigned int k; | ||
| 731 | |||
| 732 | /* peek == 0 */ | ||
| 733 | n = 0; | ||
| 734 | while ((len > 0) && (s->s3->handshake_fragment_len > 0)) | ||
| 735 | { | ||
| 736 | *dst++ = *src++; | ||
| 737 | len--; s->s3->handshake_fragment_len--; | ||
| 738 | n++; | ||
| 739 | } | ||
| 740 | /* move any remaining fragment bytes: */ | ||
| 741 | for (k = 0; k < s->s3->handshake_fragment_len; k++) | ||
| 742 | s->s3->handshake_fragment[k] = *src++; | ||
| 743 | return n; | ||
| 744 | } | ||
| 745 | |||
| 746 | /* Now s->s3->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */ | ||
| 747 | |||
| 748 | if (!s->in_handshake && SSL_in_init(s)) | ||
| 749 | { | ||
| 750 | /* type == SSL3_RT_APPLICATION_DATA */ | ||
| 751 | i=s->handshake_func(s); | ||
| 752 | if (i < 0) return(i); | ||
| 753 | if (i == 0) | ||
| 754 | { | ||
| 755 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 756 | return(-1); | ||
| 757 | } | ||
| 758 | } | ||
| 759 | start: | ||
| 760 | s->rwstate=SSL_NOTHING; | ||
| 761 | |||
| 762 | /* s->s3->rrec.type - is the type of record | ||
| 763 | * s->s3->rrec.data, - data | ||
| 764 | * s->s3->rrec.off, - offset into 'data' for next read | ||
| 765 | * s->s3->rrec.length, - number of bytes. */ | ||
| 766 | rr = &(s->s3->rrec); | ||
| 767 | |||
| 768 | /* get new packet if necessary */ | ||
| 769 | if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY)) | ||
| 770 | { | ||
| 771 | ret=ssl3_get_record(s); | ||
| 772 | if (ret <= 0) return(ret); | ||
| 773 | } | ||
| 774 | |||
| 775 | /* we now have a packet which can be read and processed */ | ||
| 776 | |||
| 777 | if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec, | ||
| 778 | * reset by ssl3_get_finished */ | ||
| 779 | && (rr->type != SSL3_RT_HANDSHAKE)) | ||
| 780 | { | ||
| 781 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 782 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED); | ||
| 783 | goto err; | ||
| 784 | } | ||
| 785 | |||
| 786 | /* If the other end has shut down, throw anything we read away | ||
| 787 | * (even in 'peek' mode) */ | ||
| 788 | if (s->shutdown & SSL_RECEIVED_SHUTDOWN) | ||
| 789 | { | ||
| 790 | rr->length=0; | ||
| 791 | s->rwstate=SSL_NOTHING; | ||
| 792 | return(0); | ||
| 793 | } | ||
| 794 | |||
| 795 | |||
| 796 | if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */ | ||
| 797 | { | ||
| 798 | /* make sure that we are not getting application data when we | ||
| 799 | * are doing a handshake for the first time */ | ||
| 800 | if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) && | ||
| 801 | (s->enc_read_ctx == NULL)) | ||
| 802 | { | ||
| 803 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 804 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE); | ||
| 805 | goto f_err; | ||
| 806 | } | ||
| 807 | |||
| 808 | if (len <= 0) return(len); | ||
| 809 | |||
| 810 | if ((unsigned int)len > rr->length) | ||
| 811 | n = rr->length; | ||
| 812 | else | ||
| 813 | n = (unsigned int)len; | ||
| 814 | |||
| 815 | memcpy(buf,&(rr->data[rr->off]),n); | ||
| 816 | if (!peek) | ||
| 817 | { | ||
| 818 | rr->length-=n; | ||
| 819 | rr->off+=n; | ||
| 820 | if (rr->length == 0) | ||
| 821 | { | ||
| 822 | s->rstate=SSL_ST_READ_HEADER; | ||
| 823 | rr->off=0; | ||
| 824 | } | ||
| 825 | } | ||
| 826 | return(n); | ||
| 827 | } | ||
| 828 | |||
| 829 | |||
| 830 | /* If we get here, then type != rr->type; if we have a handshake | ||
| 831 | * message, then it was unexpected (Hello Request or Client Hello). */ | ||
| 832 | |||
| 833 | /* In case of record types for which we have 'fragment' storage, | ||
| 834 | * fill that so that we can process the data at a fixed place. | ||
| 835 | */ | ||
| 836 | { | ||
| 837 | unsigned int dest_maxlen = 0; | ||
| 838 | unsigned char *dest = NULL; | ||
| 839 | unsigned int *dest_len = NULL; | ||
| 840 | |||
| 841 | if (rr->type == SSL3_RT_HANDSHAKE) | ||
| 842 | { | ||
| 843 | dest_maxlen = sizeof s->s3->handshake_fragment; | ||
| 844 | dest = s->s3->handshake_fragment; | ||
| 845 | dest_len = &s->s3->handshake_fragment_len; | ||
| 846 | } | ||
| 847 | else if (rr->type == SSL3_RT_ALERT) | ||
| 848 | { | ||
| 849 | dest_maxlen = sizeof s->s3->alert_fragment; | ||
| 850 | dest = s->s3->alert_fragment; | ||
| 851 | dest_len = &s->s3->alert_fragment_len; | ||
| 852 | } | ||
| 853 | |||
| 854 | if (dest_maxlen > 0) | ||
| 855 | { | ||
| 856 | n = dest_maxlen - *dest_len; /* available space in 'dest' */ | ||
| 857 | if (rr->length < n) | ||
| 858 | n = rr->length; /* available bytes */ | ||
| 859 | |||
| 860 | /* now move 'n' bytes: */ | ||
| 861 | while (n-- > 0) | ||
| 862 | { | ||
| 863 | dest[(*dest_len)++] = rr->data[rr->off++]; | ||
| 864 | rr->length--; | ||
| 865 | } | ||
| 866 | |||
| 867 | if (*dest_len < dest_maxlen) | ||
| 868 | goto start; /* fragment was too small */ | ||
| 869 | } | ||
| 870 | } | ||
| 871 | |||
| 872 | /* s->s3->handshake_fragment_len == 4 iff rr->type == SSL3_RT_HANDSHAKE; | ||
| 873 | * s->s3->alert_fragment_len == 2 iff rr->type == SSL3_RT_ALERT. | ||
| 874 | * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */ | ||
| 875 | |||
| 876 | /* If we are a client, check for an incoming 'Hello Request': */ | ||
| 877 | if ((!s->server) && | ||
| 878 | (s->s3->handshake_fragment_len >= 4) && | ||
| 879 | (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) && | ||
| 880 | (s->session != NULL) && (s->session->cipher != NULL)) | ||
| 881 | { | ||
| 882 | s->s3->handshake_fragment_len = 0; | ||
| 883 | |||
| 884 | if ((s->s3->handshake_fragment[1] != 0) || | ||
| 885 | (s->s3->handshake_fragment[2] != 0) || | ||
| 886 | (s->s3->handshake_fragment[3] != 0)) | ||
| 887 | { | ||
| 888 | al=SSL_AD_DECODE_ERROR; | ||
| 889 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_HELLO_REQUEST); | ||
| 890 | goto err; | ||
| 891 | } | ||
| 892 | |||
| 893 | if (SSL_is_init_finished(s) && | ||
| 894 | !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) && | ||
| 895 | !s->s3->renegotiate) | ||
| 896 | { | ||
| 897 | ssl3_renegotiate(s); | ||
| 898 | if (ssl3_renegotiate_check(s)) | ||
| 899 | { | ||
| 900 | i=s->handshake_func(s); | ||
| 901 | if (i < 0) return(i); | ||
| 902 | if (i == 0) | ||
| 903 | { | ||
| 904 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 905 | return(-1); | ||
| 906 | } | ||
| 907 | |||
| 908 | if (!(s->mode & SSL_MODE_AUTO_RETRY)) | ||
| 909 | { | ||
| 910 | if (s->s3->rbuf.left == 0) /* no read-ahead left? */ | ||
| 911 | { | ||
| 912 | BIO *bio; | ||
| 913 | /* In the case where we try to read application data, | ||
| 914 | * but we trigger an SSL handshake, we return -1 with | ||
| 915 | * the retry option set. Otherwise renegotiation may | ||
| 916 | * cause nasty problems in the blocking world */ | ||
| 917 | s->rwstate=SSL_READING; | ||
| 918 | bio=SSL_get_rbio(s); | ||
| 919 | BIO_clear_retry_flags(bio); | ||
| 920 | BIO_set_retry_read(bio); | ||
| 921 | return(-1); | ||
| 922 | } | ||
| 923 | } | ||
| 924 | } | ||
| 925 | } | ||
| 926 | /* we either finished a handshake or ignored the request, | ||
| 927 | * now try again to obtain the (application) data we were asked for */ | ||
| 928 | goto start; | ||
| 929 | } | ||
| 930 | |||
| 931 | if (s->s3->alert_fragment_len >= 2) | ||
| 932 | { | ||
| 933 | int alert_level = s->s3->alert_fragment[0]; | ||
| 934 | int alert_descr = s->s3->alert_fragment[1]; | ||
| 935 | |||
| 936 | s->s3->alert_fragment_len = 0; | ||
| 937 | |||
| 938 | if (s->info_callback != NULL) | ||
| 939 | cb=s->info_callback; | ||
| 940 | else if (s->ctx->info_callback != NULL) | ||
| 941 | cb=s->ctx->info_callback; | ||
| 942 | |||
| 943 | if (cb != NULL) | ||
| 944 | { | ||
| 945 | j = (alert_level << 8) | alert_descr; | ||
| 946 | cb(s, SSL_CB_READ_ALERT, j); | ||
| 947 | } | ||
| 948 | |||
| 949 | if (alert_level == 1) /* warning */ | ||
| 950 | { | ||
| 951 | s->s3->warn_alert = alert_descr; | ||
| 952 | if (alert_descr == SSL_AD_CLOSE_NOTIFY) | ||
| 953 | { | ||
| 954 | s->shutdown |= SSL_RECEIVED_SHUTDOWN; | ||
| 955 | return(0); | ||
| 956 | } | ||
| 957 | } | ||
| 958 | else if (alert_level == 2) /* fatal */ | ||
| 959 | { | ||
| 960 | char tmp[16]; | ||
| 961 | |||
| 962 | s->rwstate=SSL_NOTHING; | ||
| 963 | s->s3->fatal_alert = alert_descr; | ||
| 964 | SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr); | ||
| 965 | BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr); | ||
| 966 | ERR_add_error_data(2,"SSL alert number ",tmp); | ||
| 967 | s->shutdown|=SSL_RECEIVED_SHUTDOWN; | ||
| 968 | SSL_CTX_remove_session(s->ctx,s->session); | ||
| 969 | return(0); | ||
| 970 | } | ||
| 971 | else | ||
| 972 | { | ||
| 973 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 974 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE); | ||
| 975 | goto f_err; | ||
| 976 | } | ||
| 977 | |||
| 978 | goto start; | ||
| 979 | } | ||
| 980 | |||
| 981 | if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */ | ||
| 982 | { | ||
| 983 | s->rwstate=SSL_NOTHING; | ||
| 984 | rr->length=0; | ||
| 985 | return(0); | ||
| 986 | } | ||
| 987 | |||
| 988 | if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC) | ||
| 989 | { | ||
| 990 | /* 'Change Cipher Spec' is just a single byte, so we know | ||
| 991 | * exactly what the record payload has to look like */ | ||
| 992 | if ( (rr->length != 1) || (rr->off != 0) || | ||
| 993 | (rr->data[0] != SSL3_MT_CCS)) | ||
| 994 | { | ||
| 995 | i=SSL_AD_ILLEGAL_PARAMETER; | ||
| 996 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC); | ||
| 997 | goto err; | ||
| 998 | } | ||
| 999 | |||
| 1000 | rr->length=0; | ||
| 1001 | s->s3->change_cipher_spec=1; | ||
| 1002 | if (!do_change_cipher_spec(s)) | ||
| 1003 | goto err; | ||
| 1004 | else | ||
| 1005 | goto start; | ||
| 1006 | } | ||
| 1007 | |||
| 1008 | /* Unexpected handshake message (Client Hello, or protocol violation) */ | ||
| 1009 | if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) | ||
| 1010 | { | ||
| 1011 | if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && | ||
| 1012 | !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) | ||
| 1013 | { | ||
| 1014 | #if 0 /* worked only because C operator preferences are not as expected (and | ||
| 1015 | * because this is not really needed for clients except for detecting | ||
| 1016 | * protocol violations): */ | ||
| 1017 | s->state=SSL_ST_BEFORE|(s->server) | ||
| 1018 | ?SSL_ST_ACCEPT | ||
| 1019 | :SSL_ST_CONNECT; | ||
| 1020 | #else | ||
| 1021 | s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT; | ||
| 1022 | #endif | ||
| 1023 | s->new_session=1; | ||
| 1024 | } | ||
| 1025 | i=s->handshake_func(s); | ||
| 1026 | if (i < 0) return(i); | ||
| 1027 | if (i == 0) | ||
| 1028 | { | ||
| 1029 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE); | ||
| 1030 | return(-1); | ||
| 1031 | } | ||
| 1032 | |||
| 1033 | if (!(s->mode & SSL_MODE_AUTO_RETRY)) | ||
| 1034 | { | ||
| 1035 | if (s->s3->rbuf.left == 0) /* no read-ahead left? */ | ||
| 1036 | { | ||
| 1037 | BIO *bio; | ||
| 1038 | /* In the case where we try to read application data, | ||
| 1039 | * but we trigger an SSL handshake, we return -1 with | ||
| 1040 | * the retry option set. Otherwise renegotiation may | ||
| 1041 | * cause nasty problems in the blocking world */ | ||
| 1042 | s->rwstate=SSL_READING; | ||
| 1043 | bio=SSL_get_rbio(s); | ||
| 1044 | BIO_clear_retry_flags(bio); | ||
| 1045 | BIO_set_retry_read(bio); | ||
| 1046 | return(-1); | ||
| 1047 | } | ||
| 1048 | } | ||
| 1049 | goto start; | ||
| 1050 | } | ||
| 1051 | |||
| 1052 | switch (rr->type) | ||
| 1053 | { | ||
| 1054 | default: | ||
| 1055 | #ifndef NO_TLS | ||
| 1056 | /* TLS just ignores unknown message types */ | ||
| 1057 | if (s->version == TLS1_VERSION) | ||
| 1058 | { | ||
| 1059 | goto start; | ||
| 1060 | } | ||
| 1061 | #endif | ||
| 1062 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1063 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD); | ||
| 1064 | goto f_err; | ||
| 1065 | case SSL3_RT_CHANGE_CIPHER_SPEC: | ||
| 1066 | case SSL3_RT_ALERT: | ||
| 1067 | case SSL3_RT_HANDSHAKE: | ||
| 1068 | /* we already handled all of these, with the possible exception | ||
| 1069 | * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that | ||
| 1070 | * should not happen when type != rr->type */ | ||
| 1071 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1072 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_INTERNAL_ERROR); | ||
| 1073 | goto f_err; | ||
| 1074 | case SSL3_RT_APPLICATION_DATA: | ||
| 1075 | /* At this point, we were expecting handshake data, | ||
| 1076 | * but have application data. If the library was | ||
| 1077 | * running inside ssl3_read() (i.e. in_read_app_data | ||
| 1078 | * is set) and it makes sense to read application data | ||
| 1079 | * at this point (session renegotiation not yet started), | ||
| 1080 | * we will indulge it. | ||
| 1081 | */ | ||
| 1082 | if (s->s3->in_read_app_data && | ||
| 1083 | (s->s3->total_renegotiations != 0) && | ||
| 1084 | (( | ||
| 1085 | (s->state & SSL_ST_CONNECT) && | ||
| 1086 | (s->state >= SSL3_ST_CW_CLNT_HELLO_A) && | ||
| 1087 | (s->state <= SSL3_ST_CR_SRVR_HELLO_A) | ||
| 1088 | ) || ( | ||
| 1089 | (s->state & SSL_ST_ACCEPT) && | ||
| 1090 | (s->state <= SSL3_ST_SW_HELLO_REQ_A) && | ||
| 1091 | (s->state >= SSL3_ST_SR_CLNT_HELLO_A) | ||
| 1092 | ) | ||
| 1093 | )) | ||
| 1094 | { | ||
| 1095 | s->s3->in_read_app_data=0; | ||
| 1096 | return(-1); | ||
| 1097 | } | ||
| 1098 | else | ||
| 1099 | { | ||
| 1100 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1101 | SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD); | ||
| 1102 | goto f_err; | ||
| 1103 | } | ||
| 1104 | } | ||
| 1105 | /* not reached */ | ||
| 1106 | |||
| 1107 | f_err: | ||
| 1108 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 1109 | err: | ||
| 1110 | return(-1); | ||
| 1111 | } | ||
| 1112 | |||
| 1113 | static int do_change_cipher_spec(SSL *s) | ||
| 1114 | { | ||
| 1115 | int i; | ||
| 1116 | const char *sender; | ||
| 1117 | int slen; | ||
| 1118 | |||
| 1119 | if (s->state & SSL_ST_ACCEPT) | ||
| 1120 | i=SSL3_CHANGE_CIPHER_SERVER_READ; | ||
| 1121 | else | ||
| 1122 | i=SSL3_CHANGE_CIPHER_CLIENT_READ; | ||
| 1123 | |||
| 1124 | if (s->s3->tmp.key_block == NULL) | ||
| 1125 | { | ||
| 1126 | s->session->cipher=s->s3->tmp.new_cipher; | ||
| 1127 | if (!s->method->ssl3_enc->setup_key_block(s)) return(0); | ||
| 1128 | } | ||
| 1129 | |||
| 1130 | if (!s->method->ssl3_enc->change_cipher_state(s,i)) | ||
| 1131 | return(0); | ||
| 1132 | |||
| 1133 | /* we have to record the message digest at | ||
| 1134 | * this point so we can get it before we read | ||
| 1135 | * the finished message */ | ||
| 1136 | if (s->state & SSL_ST_CONNECT) | ||
| 1137 | { | ||
| 1138 | sender=s->method->ssl3_enc->server_finished_label; | ||
| 1139 | slen=s->method->ssl3_enc->server_finished_label_len; | ||
| 1140 | } | ||
| 1141 | else | ||
| 1142 | { | ||
| 1143 | sender=s->method->ssl3_enc->client_finished_label; | ||
| 1144 | slen=s->method->ssl3_enc->client_finished_label_len; | ||
| 1145 | } | ||
| 1146 | |||
| 1147 | s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s, | ||
| 1148 | &(s->s3->finish_dgst1), | ||
| 1149 | &(s->s3->finish_dgst2), | ||
| 1150 | sender,slen,s->s3->tmp.peer_finish_md); | ||
| 1151 | |||
| 1152 | return(1); | ||
| 1153 | } | ||
| 1154 | |||
| 1155 | void ssl3_send_alert(SSL *s, int level, int desc) | ||
| 1156 | { | ||
| 1157 | /* Map tls/ssl alert value to correct one */ | ||
| 1158 | desc=s->method->ssl3_enc->alert_value(desc); | ||
| 1159 | if (desc < 0) return; | ||
| 1160 | /* If a fatal one, remove from cache */ | ||
| 1161 | if ((level == 2) && (s->session != NULL)) | ||
| 1162 | SSL_CTX_remove_session(s->ctx,s->session); | ||
| 1163 | |||
| 1164 | s->s3->alert_dispatch=1; | ||
| 1165 | s->s3->send_alert[0]=level; | ||
| 1166 | s->s3->send_alert[1]=desc; | ||
| 1167 | if (s->s3->wbuf.left == 0) /* data still being written out */ | ||
| 1168 | ssl3_dispatch_alert(s); | ||
| 1169 | /* else data is still being written out, we will get written | ||
| 1170 | * some time in the future */ | ||
| 1171 | } | ||
| 1172 | |||
| 1173 | int ssl3_dispatch_alert(SSL *s) | ||
| 1174 | { | ||
| 1175 | int i,j; | ||
| 1176 | void (*cb)()=NULL; | ||
| 1177 | |||
| 1178 | s->s3->alert_dispatch=0; | ||
| 1179 | i=do_ssl3_write(s,SSL3_RT_ALERT,&s->s3->send_alert[0],2); | ||
| 1180 | if (i <= 0) | ||
| 1181 | { | ||
| 1182 | s->s3->alert_dispatch=1; | ||
| 1183 | } | ||
| 1184 | else | ||
| 1185 | { | ||
| 1186 | /* If it is important, send it now. If the message | ||
| 1187 | * does not get sent due to non-blocking IO, we will | ||
| 1188 | * not worry too much. */ | ||
| 1189 | if (s->s3->send_alert[0] == SSL3_AL_FATAL) | ||
| 1190 | (void)BIO_flush(s->wbio); | ||
| 1191 | |||
| 1192 | if (s->info_callback != NULL) | ||
| 1193 | cb=s->info_callback; | ||
| 1194 | else if (s->ctx->info_callback != NULL) | ||
| 1195 | cb=s->ctx->info_callback; | ||
| 1196 | |||
| 1197 | if (cb != NULL) | ||
| 1198 | { | ||
| 1199 | j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1]; | ||
| 1200 | cb(s,SSL_CB_WRITE_ALERT,j); | ||
| 1201 | } | ||
| 1202 | } | ||
| 1203 | return(i); | ||
| 1204 | } | ||
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c deleted file mode 100644 index 258af84867..0000000000 --- a/src/lib/libssl/s3_srvr.c +++ /dev/null | |||
| @@ -1,1777 +0,0 @@ | |||
| 1 | /* ssl/s3_srvr.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #define REUSE_CIPHER_BUG | ||
| 60 | #define NETSCAPE_HANG_BUG | ||
| 61 | |||
| 62 | |||
| 63 | #include <stdio.h> | ||
| 64 | #include <openssl/buffer.h> | ||
| 65 | #include <openssl/rand.h> | ||
| 66 | #include <openssl/objects.h> | ||
| 67 | #include <openssl/md5.h> | ||
| 68 | #include <openssl/sha.h> | ||
| 69 | #include <openssl/evp.h> | ||
| 70 | #include <openssl/x509.h> | ||
| 71 | #include "ssl_locl.h" | ||
| 72 | |||
| 73 | static SSL_METHOD *ssl3_get_server_method(int ver); | ||
| 74 | static int ssl3_get_client_hello(SSL *s); | ||
| 75 | static int ssl3_check_client_hello(SSL *s); | ||
| 76 | static int ssl3_send_server_hello(SSL *s); | ||
| 77 | static int ssl3_send_server_key_exchange(SSL *s); | ||
| 78 | static int ssl3_send_certificate_request(SSL *s); | ||
| 79 | static int ssl3_send_server_done(SSL *s); | ||
| 80 | static int ssl3_get_client_key_exchange(SSL *s); | ||
| 81 | static int ssl3_get_client_certificate(SSL *s); | ||
| 82 | static int ssl3_get_cert_verify(SSL *s); | ||
| 83 | static int ssl3_send_hello_request(SSL *s); | ||
| 84 | |||
| 85 | static SSL_METHOD *ssl3_get_server_method(int ver) | ||
| 86 | { | ||
| 87 | if (ver == SSL3_VERSION) | ||
| 88 | return(SSLv3_server_method()); | ||
| 89 | else | ||
| 90 | return(NULL); | ||
| 91 | } | ||
| 92 | |||
| 93 | SSL_METHOD *SSLv3_server_method(void) | ||
| 94 | { | ||
| 95 | static int init=1; | ||
| 96 | static SSL_METHOD SSLv3_server_data; | ||
| 97 | |||
| 98 | if (init) | ||
| 99 | { | ||
| 100 | memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(), | ||
| 101 | sizeof(SSL_METHOD)); | ||
| 102 | SSLv3_server_data.ssl_accept=ssl3_accept; | ||
| 103 | SSLv3_server_data.get_ssl_method=ssl3_get_server_method; | ||
| 104 | init=0; | ||
| 105 | } | ||
| 106 | return(&SSLv3_server_data); | ||
| 107 | } | ||
| 108 | |||
| 109 | int ssl3_accept(SSL *s) | ||
| 110 | { | ||
| 111 | BUF_MEM *buf; | ||
| 112 | unsigned long l,Time=time(NULL); | ||
| 113 | void (*cb)()=NULL; | ||
| 114 | long num1; | ||
| 115 | int ret= -1; | ||
| 116 | int new_state,state,skip=0; | ||
| 117 | |||
| 118 | RAND_add(&Time,sizeof(Time),0); | ||
| 119 | ERR_clear_error(); | ||
| 120 | clear_sys_error(); | ||
| 121 | |||
| 122 | if (s->info_callback != NULL) | ||
| 123 | cb=s->info_callback; | ||
| 124 | else if (s->ctx->info_callback != NULL) | ||
| 125 | cb=s->ctx->info_callback; | ||
| 126 | |||
| 127 | /* init things to blank */ | ||
| 128 | if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); | ||
| 129 | s->in_handshake++; | ||
| 130 | |||
| 131 | if (s->cert == NULL) | ||
| 132 | { | ||
| 133 | SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_NO_CERTIFICATE_SET); | ||
| 134 | return(-1); | ||
| 135 | } | ||
| 136 | |||
| 137 | for (;;) | ||
| 138 | { | ||
| 139 | state=s->state; | ||
| 140 | |||
| 141 | switch (s->state) | ||
| 142 | { | ||
| 143 | case SSL_ST_RENEGOTIATE: | ||
| 144 | s->new_session=1; | ||
| 145 | /* s->state=SSL_ST_ACCEPT; */ | ||
| 146 | |||
| 147 | case SSL_ST_BEFORE: | ||
| 148 | case SSL_ST_ACCEPT: | ||
| 149 | case SSL_ST_BEFORE|SSL_ST_ACCEPT: | ||
| 150 | case SSL_ST_OK|SSL_ST_ACCEPT: | ||
| 151 | |||
| 152 | s->server=1; | ||
| 153 | if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1); | ||
| 154 | |||
| 155 | if ((s->version>>8) != 3) | ||
| 156 | { | ||
| 157 | SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_INTERNAL_ERROR); | ||
| 158 | return -1; | ||
| 159 | } | ||
| 160 | s->type=SSL_ST_ACCEPT; | ||
| 161 | |||
| 162 | if (s->init_buf == NULL) | ||
| 163 | { | ||
| 164 | if ((buf=BUF_MEM_new()) == NULL) | ||
| 165 | { | ||
| 166 | ret= -1; | ||
| 167 | goto end; | ||
| 168 | } | ||
| 169 | if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH)) | ||
| 170 | { | ||
| 171 | ret= -1; | ||
| 172 | goto end; | ||
| 173 | } | ||
| 174 | s->init_buf=buf; | ||
| 175 | } | ||
| 176 | |||
| 177 | if (!ssl3_setup_buffers(s)) | ||
| 178 | { | ||
| 179 | ret= -1; | ||
| 180 | goto end; | ||
| 181 | } | ||
| 182 | |||
| 183 | /* Ok, we now need to push on a buffering BIO so that | ||
| 184 | * the output is sent in a way that TCP likes :-) | ||
| 185 | */ | ||
| 186 | if (!ssl_init_wbio_buffer(s,1)) { ret= -1; goto end; } | ||
| 187 | |||
| 188 | s->init_num=0; | ||
| 189 | |||
| 190 | if (s->state != SSL_ST_RENEGOTIATE) | ||
| 191 | { | ||
| 192 | ssl3_init_finished_mac(s); | ||
| 193 | s->state=SSL3_ST_SR_CLNT_HELLO_A; | ||
| 194 | s->ctx->stats.sess_accept++; | ||
| 195 | } | ||
| 196 | else | ||
| 197 | { | ||
| 198 | s->ctx->stats.sess_accept_renegotiate++; | ||
| 199 | s->state=SSL3_ST_SW_HELLO_REQ_A; | ||
| 200 | } | ||
| 201 | break; | ||
| 202 | |||
| 203 | case SSL3_ST_SW_HELLO_REQ_A: | ||
| 204 | case SSL3_ST_SW_HELLO_REQ_B: | ||
| 205 | |||
| 206 | s->shutdown=0; | ||
| 207 | ret=ssl3_send_hello_request(s); | ||
| 208 | if (ret <= 0) goto end; | ||
| 209 | s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C; | ||
| 210 | s->state=SSL3_ST_SW_FLUSH; | ||
| 211 | s->init_num=0; | ||
| 212 | |||
| 213 | ssl3_init_finished_mac(s); | ||
| 214 | break; | ||
| 215 | |||
| 216 | case SSL3_ST_SW_HELLO_REQ_C: | ||
| 217 | s->state=SSL_ST_OK; | ||
| 218 | ret=1; | ||
| 219 | goto end; | ||
| 220 | /* break; */ | ||
| 221 | |||
| 222 | case SSL3_ST_SR_CLNT_HELLO_A: | ||
| 223 | case SSL3_ST_SR_CLNT_HELLO_B: | ||
| 224 | case SSL3_ST_SR_CLNT_HELLO_C: | ||
| 225 | |||
| 226 | s->shutdown=0; | ||
| 227 | ret=ssl3_get_client_hello(s); | ||
| 228 | if (ret <= 0) goto end; | ||
| 229 | s->state=SSL3_ST_SW_SRVR_HELLO_A; | ||
| 230 | s->init_num=0; | ||
| 231 | break; | ||
| 232 | |||
| 233 | case SSL3_ST_SW_SRVR_HELLO_A: | ||
| 234 | case SSL3_ST_SW_SRVR_HELLO_B: | ||
| 235 | ret=ssl3_send_server_hello(s); | ||
| 236 | if (ret <= 0) goto end; | ||
| 237 | |||
| 238 | if (s->hit) | ||
| 239 | s->state=SSL3_ST_SW_CHANGE_A; | ||
| 240 | else | ||
| 241 | s->state=SSL3_ST_SW_CERT_A; | ||
| 242 | s->init_num=0; | ||
| 243 | break; | ||
| 244 | |||
| 245 | case SSL3_ST_SW_CERT_A: | ||
| 246 | case SSL3_ST_SW_CERT_B: | ||
| 247 | /* Check if it is anon DH */ | ||
| 248 | if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)) | ||
| 249 | { | ||
| 250 | ret=ssl3_send_server_certificate(s); | ||
| 251 | if (ret <= 0) goto end; | ||
| 252 | } | ||
| 253 | else | ||
| 254 | skip=1; | ||
| 255 | s->state=SSL3_ST_SW_KEY_EXCH_A; | ||
| 256 | s->init_num=0; | ||
| 257 | break; | ||
| 258 | |||
| 259 | case SSL3_ST_SW_KEY_EXCH_A: | ||
| 260 | case SSL3_ST_SW_KEY_EXCH_B: | ||
| 261 | l=s->s3->tmp.new_cipher->algorithms; | ||
| 262 | |||
| 263 | /* clear this, it may get reset by | ||
| 264 | * send_server_key_exchange */ | ||
| 265 | if (s->options & SSL_OP_EPHEMERAL_RSA) | ||
| 266 | s->s3->tmp.use_rsa_tmp=1; | ||
| 267 | else | ||
| 268 | s->s3->tmp.use_rsa_tmp=0; | ||
| 269 | |||
| 270 | /* only send if a DH key exchange, fortezza or | ||
| 271 | * RSA but we have a sign only certificate */ | ||
| 272 | if (s->s3->tmp.use_rsa_tmp | ||
| 273 | || (l & (SSL_DH|SSL_kFZA)) | ||
| 274 | || ((l & SSL_kRSA) | ||
| 275 | && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL | ||
| 276 | || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) | ||
| 277 | && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher) | ||
| 278 | ) | ||
| 279 | ) | ||
| 280 | ) | ||
| 281 | ) | ||
| 282 | { | ||
| 283 | ret=ssl3_send_server_key_exchange(s); | ||
| 284 | if (ret <= 0) goto end; | ||
| 285 | } | ||
| 286 | else | ||
| 287 | skip=1; | ||
| 288 | |||
| 289 | s->state=SSL3_ST_SW_CERT_REQ_A; | ||
| 290 | s->init_num=0; | ||
| 291 | break; | ||
| 292 | |||
| 293 | case SSL3_ST_SW_CERT_REQ_A: | ||
| 294 | case SSL3_ST_SW_CERT_REQ_B: | ||
| 295 | if (/* don't request cert unless asked for it: */ | ||
| 296 | !(s->verify_mode & SSL_VERIFY_PEER) || | ||
| 297 | /* if SSL_VERIFY_CLIENT_ONCE is set, | ||
| 298 | * don't request cert during re-negotiation: */ | ||
| 299 | ((s->session->peer != NULL) && | ||
| 300 | (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) || | ||
| 301 | /* never request cert in anonymous ciphersuites | ||
| 302 | * (see section "Certificate request" in SSL 3 drafts | ||
| 303 | * and in RFC 2246): */ | ||
| 304 | ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) && | ||
| 305 | /* ... except when the application insists on verification | ||
| 306 | * (against the specs, but s3_clnt.c accepts this for SSL 3) */ | ||
| 307 | !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) | ||
| 308 | { | ||
| 309 | /* no cert request */ | ||
| 310 | skip=1; | ||
| 311 | s->s3->tmp.cert_request=0; | ||
| 312 | s->state=SSL3_ST_SW_SRVR_DONE_A; | ||
| 313 | } | ||
| 314 | else | ||
| 315 | { | ||
| 316 | s->s3->tmp.cert_request=1; | ||
| 317 | ret=ssl3_send_certificate_request(s); | ||
| 318 | if (ret <= 0) goto end; | ||
| 319 | #ifndef NETSCAPE_HANG_BUG | ||
| 320 | s->state=SSL3_ST_SW_SRVR_DONE_A; | ||
| 321 | #else | ||
| 322 | s->state=SSL3_ST_SW_FLUSH; | ||
| 323 | s->s3->tmp.next_state=SSL3_ST_SR_CERT_A; | ||
| 324 | #endif | ||
| 325 | s->init_num=0; | ||
| 326 | } | ||
| 327 | break; | ||
| 328 | |||
| 329 | case SSL3_ST_SW_SRVR_DONE_A: | ||
| 330 | case SSL3_ST_SW_SRVR_DONE_B: | ||
| 331 | ret=ssl3_send_server_done(s); | ||
| 332 | if (ret <= 0) goto end; | ||
| 333 | s->s3->tmp.next_state=SSL3_ST_SR_CERT_A; | ||
| 334 | s->state=SSL3_ST_SW_FLUSH; | ||
| 335 | s->init_num=0; | ||
| 336 | break; | ||
| 337 | |||
| 338 | case SSL3_ST_SW_FLUSH: | ||
| 339 | /* number of bytes to be flushed */ | ||
| 340 | num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL); | ||
| 341 | if (num1 > 0) | ||
| 342 | { | ||
| 343 | s->rwstate=SSL_WRITING; | ||
| 344 | num1=BIO_flush(s->wbio); | ||
| 345 | if (num1 <= 0) { ret= -1; goto end; } | ||
| 346 | s->rwstate=SSL_NOTHING; | ||
| 347 | } | ||
| 348 | |||
| 349 | s->state=s->s3->tmp.next_state; | ||
| 350 | break; | ||
| 351 | |||
| 352 | case SSL3_ST_SR_CERT_A: | ||
| 353 | case SSL3_ST_SR_CERT_B: | ||
| 354 | /* Check for second client hello (MS SGC) */ | ||
| 355 | ret = ssl3_check_client_hello(s); | ||
| 356 | if (ret <= 0) | ||
| 357 | goto end; | ||
| 358 | if (ret == 2) | ||
| 359 | s->state = SSL3_ST_SR_CLNT_HELLO_C; | ||
| 360 | else { | ||
| 361 | /* could be sent for a DH cert, even if we | ||
| 362 | * have not asked for it :-) */ | ||
| 363 | ret=ssl3_get_client_certificate(s); | ||
| 364 | if (ret <= 0) goto end; | ||
| 365 | s->init_num=0; | ||
| 366 | s->state=SSL3_ST_SR_KEY_EXCH_A; | ||
| 367 | } | ||
| 368 | break; | ||
| 369 | |||
| 370 | case SSL3_ST_SR_KEY_EXCH_A: | ||
| 371 | case SSL3_ST_SR_KEY_EXCH_B: | ||
| 372 | ret=ssl3_get_client_key_exchange(s); | ||
| 373 | if (ret <= 0) goto end; | ||
| 374 | s->state=SSL3_ST_SR_CERT_VRFY_A; | ||
| 375 | s->init_num=0; | ||
| 376 | |||
| 377 | /* We need to get hashes here so if there is | ||
| 378 | * a client cert, it can be verified */ | ||
| 379 | s->method->ssl3_enc->cert_verify_mac(s, | ||
| 380 | &(s->s3->finish_dgst1), | ||
| 381 | &(s->s3->tmp.cert_verify_md[0])); | ||
| 382 | s->method->ssl3_enc->cert_verify_mac(s, | ||
| 383 | &(s->s3->finish_dgst2), | ||
| 384 | &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH])); | ||
| 385 | |||
| 386 | break; | ||
| 387 | |||
| 388 | case SSL3_ST_SR_CERT_VRFY_A: | ||
| 389 | case SSL3_ST_SR_CERT_VRFY_B: | ||
| 390 | |||
| 391 | /* we should decide if we expected this one */ | ||
| 392 | ret=ssl3_get_cert_verify(s); | ||
| 393 | if (ret <= 0) goto end; | ||
| 394 | |||
| 395 | s->state=SSL3_ST_SR_FINISHED_A; | ||
| 396 | s->init_num=0; | ||
| 397 | break; | ||
| 398 | |||
| 399 | case SSL3_ST_SR_FINISHED_A: | ||
| 400 | case SSL3_ST_SR_FINISHED_B: | ||
| 401 | ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A, | ||
| 402 | SSL3_ST_SR_FINISHED_B); | ||
| 403 | if (ret <= 0) goto end; | ||
| 404 | if (s->hit) | ||
| 405 | s->state=SSL_ST_OK; | ||
| 406 | else | ||
| 407 | s->state=SSL3_ST_SW_CHANGE_A; | ||
| 408 | s->init_num=0; | ||
| 409 | break; | ||
| 410 | |||
| 411 | case SSL3_ST_SW_CHANGE_A: | ||
| 412 | case SSL3_ST_SW_CHANGE_B: | ||
| 413 | |||
| 414 | s->session->cipher=s->s3->tmp.new_cipher; | ||
| 415 | if (!s->method->ssl3_enc->setup_key_block(s)) | ||
| 416 | { ret= -1; goto end; } | ||
| 417 | |||
| 418 | ret=ssl3_send_change_cipher_spec(s, | ||
| 419 | SSL3_ST_SW_CHANGE_A,SSL3_ST_SW_CHANGE_B); | ||
| 420 | |||
| 421 | if (ret <= 0) goto end; | ||
| 422 | s->state=SSL3_ST_SW_FINISHED_A; | ||
| 423 | s->init_num=0; | ||
| 424 | |||
| 425 | if (!s->method->ssl3_enc->change_cipher_state(s, | ||
| 426 | SSL3_CHANGE_CIPHER_SERVER_WRITE)) | ||
| 427 | { | ||
| 428 | ret= -1; | ||
| 429 | goto end; | ||
| 430 | } | ||
| 431 | |||
| 432 | break; | ||
| 433 | |||
| 434 | case SSL3_ST_SW_FINISHED_A: | ||
| 435 | case SSL3_ST_SW_FINISHED_B: | ||
| 436 | ret=ssl3_send_finished(s, | ||
| 437 | SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B, | ||
| 438 | s->method->ssl3_enc->server_finished_label, | ||
| 439 | s->method->ssl3_enc->server_finished_label_len); | ||
| 440 | if (ret <= 0) goto end; | ||
| 441 | s->state=SSL3_ST_SW_FLUSH; | ||
| 442 | if (s->hit) | ||
| 443 | s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A; | ||
| 444 | else | ||
| 445 | s->s3->tmp.next_state=SSL_ST_OK; | ||
| 446 | s->init_num=0; | ||
| 447 | break; | ||
| 448 | |||
| 449 | case SSL_ST_OK: | ||
| 450 | /* clean a few things up */ | ||
| 451 | ssl3_cleanup_key_block(s); | ||
| 452 | |||
| 453 | BUF_MEM_free(s->init_buf); | ||
| 454 | s->init_buf=NULL; | ||
| 455 | |||
| 456 | /* remove buffering on output */ | ||
| 457 | ssl_free_wbio_buffer(s); | ||
| 458 | |||
| 459 | s->new_session=0; | ||
| 460 | s->init_num=0; | ||
| 461 | |||
| 462 | ssl_update_cache(s,SSL_SESS_CACHE_SERVER); | ||
| 463 | |||
| 464 | s->ctx->stats.sess_accept_good++; | ||
| 465 | /* s->server=1; */ | ||
| 466 | s->handshake_func=ssl3_accept; | ||
| 467 | ret=1; | ||
| 468 | |||
| 469 | if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1); | ||
| 470 | |||
| 471 | goto end; | ||
| 472 | /* break; */ | ||
| 473 | |||
| 474 | default: | ||
| 475 | SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_UNKNOWN_STATE); | ||
| 476 | ret= -1; | ||
| 477 | goto end; | ||
| 478 | /* break; */ | ||
| 479 | } | ||
| 480 | |||
| 481 | if (!s->s3->tmp.reuse_message && !skip) | ||
| 482 | { | ||
| 483 | if (s->debug) | ||
| 484 | { | ||
| 485 | if ((ret=BIO_flush(s->wbio)) <= 0) | ||
| 486 | goto end; | ||
| 487 | } | ||
| 488 | |||
| 489 | |||
| 490 | if ((cb != NULL) && (s->state != state)) | ||
| 491 | { | ||
| 492 | new_state=s->state; | ||
| 493 | s->state=state; | ||
| 494 | cb(s,SSL_CB_ACCEPT_LOOP,1); | ||
| 495 | s->state=new_state; | ||
| 496 | } | ||
| 497 | } | ||
| 498 | skip=0; | ||
| 499 | } | ||
| 500 | end: | ||
| 501 | /* BIO_flush(s->wbio); */ | ||
| 502 | |||
| 503 | if (cb != NULL) | ||
| 504 | cb(s,SSL_CB_ACCEPT_EXIT,ret); | ||
| 505 | s->in_handshake--; | ||
| 506 | return(ret); | ||
| 507 | } | ||
| 508 | |||
| 509 | static int ssl3_send_hello_request(SSL *s) | ||
| 510 | { | ||
| 511 | unsigned char *p; | ||
| 512 | |||
| 513 | if (s->state == SSL3_ST_SW_HELLO_REQ_A) | ||
| 514 | { | ||
| 515 | p=(unsigned char *)s->init_buf->data; | ||
| 516 | *(p++)=SSL3_MT_HELLO_REQUEST; | ||
| 517 | *(p++)=0; | ||
| 518 | *(p++)=0; | ||
| 519 | *(p++)=0; | ||
| 520 | |||
| 521 | s->state=SSL3_ST_SW_HELLO_REQ_B; | ||
| 522 | /* number of bytes to write */ | ||
| 523 | s->init_num=4; | ||
| 524 | s->init_off=0; | ||
| 525 | } | ||
| 526 | |||
| 527 | /* SSL3_ST_SW_HELLO_REQ_B */ | ||
| 528 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 529 | } | ||
| 530 | |||
| 531 | static int ssl3_check_client_hello(SSL *s) | ||
| 532 | { | ||
| 533 | int ok; | ||
| 534 | long n; | ||
| 535 | |||
| 536 | n=ssl3_get_message(s, | ||
| 537 | SSL3_ST_SR_CERT_A, | ||
| 538 | SSL3_ST_SR_CERT_B, | ||
| 539 | -1, | ||
| 540 | SSL3_RT_MAX_PLAIN_LENGTH, | ||
| 541 | &ok); | ||
| 542 | if (!ok) return((int)n); | ||
| 543 | s->s3->tmp.reuse_message = 1; | ||
| 544 | if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO) | ||
| 545 | { | ||
| 546 | /* Throw away what we have done so far in the current handshake, | ||
| 547 | * which will now be aborted. (A full SSL_clear would be too much.) | ||
| 548 | * I hope that tmp.dh is the only thing that may need to be cleared | ||
| 549 | * when a handshake is not completed ... */ | ||
| 550 | #ifndef NO_DH | ||
| 551 | if (s->s3->tmp.dh != NULL) | ||
| 552 | { | ||
| 553 | DH_free(s->s3->tmp.dh); | ||
| 554 | s->s3->tmp.dh = NULL; | ||
| 555 | } | ||
| 556 | #endif | ||
| 557 | return 2; | ||
| 558 | } | ||
| 559 | return 1; | ||
| 560 | } | ||
| 561 | |||
| 562 | static int ssl3_get_client_hello(SSL *s) | ||
| 563 | { | ||
| 564 | int i,j,ok,al,ret= -1; | ||
| 565 | long n; | ||
| 566 | unsigned long id; | ||
| 567 | unsigned char *p,*d,*q; | ||
| 568 | SSL_CIPHER *c; | ||
| 569 | SSL_COMP *comp=NULL; | ||
| 570 | STACK_OF(SSL_CIPHER) *ciphers=NULL; | ||
| 571 | |||
| 572 | /* We do this so that we will respond with our native type. | ||
| 573 | * If we are TLSv1 and we get SSLv3, we will respond with TLSv1, | ||
| 574 | * This down switching should be handled by a different method. | ||
| 575 | * If we are SSLv3, we will respond with SSLv3, even if prompted with | ||
| 576 | * TLSv1. | ||
| 577 | */ | ||
| 578 | if (s->state == SSL3_ST_SR_CLNT_HELLO_A) | ||
| 579 | { | ||
| 580 | s->first_packet=1; | ||
| 581 | s->state=SSL3_ST_SR_CLNT_HELLO_B; | ||
| 582 | } | ||
| 583 | n=ssl3_get_message(s, | ||
| 584 | SSL3_ST_SR_CLNT_HELLO_B, | ||
| 585 | SSL3_ST_SR_CLNT_HELLO_C, | ||
| 586 | SSL3_MT_CLIENT_HELLO, | ||
| 587 | SSL3_RT_MAX_PLAIN_LENGTH, | ||
| 588 | &ok); | ||
| 589 | |||
| 590 | if (!ok) return((int)n); | ||
| 591 | d=p=(unsigned char *)s->init_buf->data; | ||
| 592 | |||
| 593 | /* use version from inside client hello, not from record header | ||
| 594 | * (may differ: see RFC 2246, Appendix E, second paragraph) */ | ||
| 595 | s->client_version=(((int)p[0])<<8)|(int)p[1]; | ||
| 596 | p+=2; | ||
| 597 | |||
| 598 | /* load the client random */ | ||
| 599 | memcpy(s->s3->client_random,p,SSL3_RANDOM_SIZE); | ||
| 600 | p+=SSL3_RANDOM_SIZE; | ||
| 601 | |||
| 602 | /* get the session-id */ | ||
| 603 | j= *(p++); | ||
| 604 | |||
| 605 | s->hit=0; | ||
| 606 | if (j == 0) | ||
| 607 | { | ||
| 608 | if (!ssl_get_new_session(s,1)) | ||
| 609 | goto err; | ||
| 610 | } | ||
| 611 | else | ||
| 612 | { | ||
| 613 | i=ssl_get_prev_session(s,p,j); | ||
| 614 | if (i == 1) | ||
| 615 | { /* previous session */ | ||
| 616 | s->hit=1; | ||
| 617 | } | ||
| 618 | else if (i == -1) | ||
| 619 | goto err; | ||
| 620 | else /* i == 0 */ | ||
| 621 | { | ||
| 622 | if (!ssl_get_new_session(s,1)) | ||
| 623 | goto err; | ||
| 624 | } | ||
| 625 | } | ||
| 626 | |||
| 627 | p+=j; | ||
| 628 | n2s(p,i); | ||
| 629 | if ((i == 0) && (j != 0)) | ||
| 630 | { | ||
| 631 | /* we need a cipher if we are not resuming a session */ | ||
| 632 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 633 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_SPECIFIED); | ||
| 634 | goto f_err; | ||
| 635 | } | ||
| 636 | if ((i+p) > (d+n)) | ||
| 637 | { | ||
| 638 | /* not enough data */ | ||
| 639 | al=SSL_AD_DECODE_ERROR; | ||
| 640 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH); | ||
| 641 | goto f_err; | ||
| 642 | } | ||
| 643 | if ((i > 0) && (ssl_bytes_to_cipher_list(s,p,i,&(ciphers)) | ||
| 644 | == NULL)) | ||
| 645 | { | ||
| 646 | goto err; | ||
| 647 | } | ||
| 648 | p+=i; | ||
| 649 | |||
| 650 | /* If it is a hit, check that the cipher is in the list */ | ||
| 651 | if ((s->hit) && (i > 0)) | ||
| 652 | { | ||
| 653 | j=0; | ||
| 654 | id=s->session->cipher->id; | ||
| 655 | |||
| 656 | #ifdef CIPHER_DEBUG | ||
| 657 | printf("client sent %d ciphers\n",sk_num(ciphers)); | ||
| 658 | #endif | ||
| 659 | for (i=0; i<sk_SSL_CIPHER_num(ciphers); i++) | ||
| 660 | { | ||
| 661 | c=sk_SSL_CIPHER_value(ciphers,i); | ||
| 662 | #ifdef CIPHER_DEBUG | ||
| 663 | printf("client [%2d of %2d]:%s\n", | ||
| 664 | i,sk_num(ciphers),SSL_CIPHER_get_name(c)); | ||
| 665 | #endif | ||
| 666 | if (c->id == id) | ||
| 667 | { | ||
| 668 | j=1; | ||
| 669 | break; | ||
| 670 | } | ||
| 671 | } | ||
| 672 | if (j == 0) | ||
| 673 | { | ||
| 674 | if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) | ||
| 675 | { | ||
| 676 | /* Very bad for multi-threading.... */ | ||
| 677 | s->session->cipher=sk_SSL_CIPHER_value(ciphers, | ||
| 678 | 0); | ||
| 679 | } | ||
| 680 | else | ||
| 681 | { | ||
| 682 | /* we need to have the cipher in the cipher | ||
| 683 | * list if we are asked to reuse it */ | ||
| 684 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 685 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING); | ||
| 686 | goto f_err; | ||
| 687 | } | ||
| 688 | } | ||
| 689 | } | ||
| 690 | |||
| 691 | /* compression */ | ||
| 692 | i= *(p++); | ||
| 693 | q=p; | ||
| 694 | for (j=0; j<i; j++) | ||
| 695 | { | ||
| 696 | if (p[j] == 0) break; | ||
| 697 | } | ||
| 698 | |||
| 699 | p+=i; | ||
| 700 | if (j >= i) | ||
| 701 | { | ||
| 702 | /* no compress */ | ||
| 703 | al=SSL_AD_DECODE_ERROR; | ||
| 704 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_COMPRESSION_SPECIFIED); | ||
| 705 | goto f_err; | ||
| 706 | } | ||
| 707 | |||
| 708 | /* Worst case, we will use the NULL compression, but if we have other | ||
| 709 | * options, we will now look for them. We have i-1 compression | ||
| 710 | * algorithms from the client, starting at q. */ | ||
| 711 | s->s3->tmp.new_compression=NULL; | ||
| 712 | if (s->ctx->comp_methods != NULL) | ||
| 713 | { /* See if we have a match */ | ||
| 714 | int m,nn,o,v,done=0; | ||
| 715 | |||
| 716 | nn=sk_SSL_COMP_num(s->ctx->comp_methods); | ||
| 717 | for (m=0; m<nn; m++) | ||
| 718 | { | ||
| 719 | comp=sk_SSL_COMP_value(s->ctx->comp_methods,m); | ||
| 720 | v=comp->id; | ||
| 721 | for (o=0; o<i; o++) | ||
| 722 | { | ||
| 723 | if (v == q[o]) | ||
| 724 | { | ||
| 725 | done=1; | ||
| 726 | break; | ||
| 727 | } | ||
| 728 | } | ||
| 729 | if (done) break; | ||
| 730 | } | ||
| 731 | if (done) | ||
| 732 | s->s3->tmp.new_compression=comp; | ||
| 733 | else | ||
| 734 | comp=NULL; | ||
| 735 | } | ||
| 736 | |||
| 737 | /* TLS does not mind if there is extra stuff */ | ||
| 738 | if (s->version == SSL3_VERSION) | ||
| 739 | { | ||
| 740 | if (p > (d+n)) | ||
| 741 | { | ||
| 742 | /* wrong number of bytes, | ||
| 743 | * there could be more to follow */ | ||
| 744 | al=SSL_AD_DECODE_ERROR; | ||
| 745 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH); | ||
| 746 | goto f_err; | ||
| 747 | } | ||
| 748 | } | ||
| 749 | |||
| 750 | /* Given s->session->ciphers and ssl_get_ciphers_by_id(s), we must | ||
| 751 | * pick a cipher */ | ||
| 752 | |||
| 753 | if (!s->hit) | ||
| 754 | { | ||
| 755 | s->session->compress_meth=(comp == NULL)?0:comp->id; | ||
| 756 | if (s->session->ciphers != NULL) | ||
| 757 | sk_SSL_CIPHER_free(s->session->ciphers); | ||
| 758 | s->session->ciphers=ciphers; | ||
| 759 | if (ciphers == NULL) | ||
| 760 | { | ||
| 761 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 762 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_PASSED); | ||
| 763 | goto f_err; | ||
| 764 | } | ||
| 765 | ciphers=NULL; | ||
| 766 | c=ssl3_choose_cipher(s,s->session->ciphers, | ||
| 767 | ssl_get_ciphers_by_id(s)); | ||
| 768 | |||
| 769 | if (c == NULL) | ||
| 770 | { | ||
| 771 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 772 | SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER); | ||
| 773 | goto f_err; | ||
| 774 | } | ||
| 775 | s->s3->tmp.new_cipher=c; | ||
| 776 | } | ||
| 777 | else | ||
| 778 | { | ||
| 779 | /* Session-id reuse */ | ||
| 780 | #ifdef REUSE_CIPHER_BUG | ||
| 781 | STACK_OF(SSL_CIPHER) *sk; | ||
| 782 | SSL_CIPHER *nc=NULL; | ||
| 783 | SSL_CIPHER *ec=NULL; | ||
| 784 | |||
| 785 | if (s->options & SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG) | ||
| 786 | { | ||
| 787 | sk=s->session->ciphers; | ||
| 788 | for (i=0; i<sk_SSL_CIPHER_num(sk); i++) | ||
| 789 | { | ||
| 790 | c=sk_SSL_CIPHER_value(sk,i); | ||
| 791 | if (c->algorithms & SSL_eNULL) | ||
| 792 | nc=c; | ||
| 793 | if (SSL_C_IS_EXPORT(c)) | ||
| 794 | ec=c; | ||
| 795 | } | ||
| 796 | if (nc != NULL) | ||
| 797 | s->s3->tmp.new_cipher=nc; | ||
| 798 | else if (ec != NULL) | ||
| 799 | s->s3->tmp.new_cipher=ec; | ||
| 800 | else | ||
| 801 | s->s3->tmp.new_cipher=s->session->cipher; | ||
| 802 | } | ||
| 803 | else | ||
| 804 | #endif | ||
| 805 | s->s3->tmp.new_cipher=s->session->cipher; | ||
| 806 | } | ||
| 807 | |||
| 808 | /* we now have the following setup. | ||
| 809 | * client_random | ||
| 810 | * cipher_list - our prefered list of ciphers | ||
| 811 | * ciphers - the clients prefered list of ciphers | ||
| 812 | * compression - basically ignored right now | ||
| 813 | * ssl version is set - sslv3 | ||
| 814 | * s->session - The ssl session has been setup. | ||
| 815 | * s->hit - session reuse flag | ||
| 816 | * s->tmp.new_cipher - the new cipher to use. | ||
| 817 | */ | ||
| 818 | |||
| 819 | ret=1; | ||
| 820 | if (0) | ||
| 821 | { | ||
| 822 | f_err: | ||
| 823 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 824 | } | ||
| 825 | err: | ||
| 826 | if (ciphers != NULL) sk_SSL_CIPHER_free(ciphers); | ||
| 827 | return(ret); | ||
| 828 | } | ||
| 829 | |||
| 830 | static int ssl3_send_server_hello(SSL *s) | ||
| 831 | { | ||
| 832 | unsigned char *buf; | ||
| 833 | unsigned char *p,*d; | ||
| 834 | int i,sl; | ||
| 835 | unsigned long l,Time; | ||
| 836 | |||
| 837 | if (s->state == SSL3_ST_SW_SRVR_HELLO_A) | ||
| 838 | { | ||
| 839 | buf=(unsigned char *)s->init_buf->data; | ||
| 840 | p=s->s3->server_random; | ||
| 841 | Time=time(NULL); /* Time */ | ||
| 842 | l2n(Time,p); | ||
| 843 | RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time)); | ||
| 844 | /* Do the message type and length last */ | ||
| 845 | d=p= &(buf[4]); | ||
| 846 | |||
| 847 | *(p++)=s->version>>8; | ||
| 848 | *(p++)=s->version&0xff; | ||
| 849 | |||
| 850 | /* Random stuff */ | ||
| 851 | memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE); | ||
| 852 | p+=SSL3_RANDOM_SIZE; | ||
| 853 | |||
| 854 | /* now in theory we have 3 options to sending back the | ||
| 855 | * session id. If it is a re-use, we send back the | ||
| 856 | * old session-id, if it is a new session, we send | ||
| 857 | * back the new session-id or we send back a 0 length | ||
| 858 | * session-id if we want it to be single use. | ||
| 859 | * Currently I will not implement the '0' length session-id | ||
| 860 | * 12-Jan-98 - I'll now support the '0' length stuff. | ||
| 861 | */ | ||
| 862 | if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)) | ||
| 863 | s->session->session_id_length=0; | ||
| 864 | |||
| 865 | sl=s->session->session_id_length; | ||
| 866 | *(p++)=sl; | ||
| 867 | memcpy(p,s->session->session_id,sl); | ||
| 868 | p+=sl; | ||
| 869 | |||
| 870 | /* put the cipher */ | ||
| 871 | i=ssl3_put_cipher_by_char(s->s3->tmp.new_cipher,p); | ||
| 872 | p+=i; | ||
| 873 | |||
| 874 | /* put the compression method */ | ||
| 875 | if (s->s3->tmp.new_compression == NULL) | ||
| 876 | *(p++)=0; | ||
| 877 | else | ||
| 878 | *(p++)=s->s3->tmp.new_compression->id; | ||
| 879 | |||
| 880 | /* do the header */ | ||
| 881 | l=(p-d); | ||
| 882 | d=buf; | ||
| 883 | *(d++)=SSL3_MT_SERVER_HELLO; | ||
| 884 | l2n3(l,d); | ||
| 885 | |||
| 886 | s->state=SSL3_ST_CW_CLNT_HELLO_B; | ||
| 887 | /* number of bytes to write */ | ||
| 888 | s->init_num=p-buf; | ||
| 889 | s->init_off=0; | ||
| 890 | } | ||
| 891 | |||
| 892 | /* SSL3_ST_CW_CLNT_HELLO_B */ | ||
| 893 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 894 | } | ||
| 895 | |||
| 896 | static int ssl3_send_server_done(SSL *s) | ||
| 897 | { | ||
| 898 | unsigned char *p; | ||
| 899 | |||
| 900 | if (s->state == SSL3_ST_SW_SRVR_DONE_A) | ||
| 901 | { | ||
| 902 | p=(unsigned char *)s->init_buf->data; | ||
| 903 | |||
| 904 | /* do the header */ | ||
| 905 | *(p++)=SSL3_MT_SERVER_DONE; | ||
| 906 | *(p++)=0; | ||
| 907 | *(p++)=0; | ||
| 908 | *(p++)=0; | ||
| 909 | |||
| 910 | s->state=SSL3_ST_SW_SRVR_DONE_B; | ||
| 911 | /* number of bytes to write */ | ||
| 912 | s->init_num=4; | ||
| 913 | s->init_off=0; | ||
| 914 | } | ||
| 915 | |||
| 916 | /* SSL3_ST_CW_CLNT_HELLO_B */ | ||
| 917 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 918 | } | ||
| 919 | |||
| 920 | static int ssl3_send_server_key_exchange(SSL *s) | ||
| 921 | { | ||
| 922 | #ifndef NO_RSA | ||
| 923 | unsigned char *q; | ||
| 924 | int j,num; | ||
| 925 | RSA *rsa; | ||
| 926 | unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH]; | ||
| 927 | unsigned int u; | ||
| 928 | #endif | ||
| 929 | #ifndef NO_DH | ||
| 930 | DH *dh=NULL,*dhp; | ||
| 931 | #endif | ||
| 932 | EVP_PKEY *pkey; | ||
| 933 | unsigned char *p,*d; | ||
| 934 | int al,i; | ||
| 935 | unsigned long type; | ||
| 936 | int n; | ||
| 937 | CERT *cert; | ||
| 938 | BIGNUM *r[4]; | ||
| 939 | int nr[4],kn; | ||
| 940 | BUF_MEM *buf; | ||
| 941 | EVP_MD_CTX md_ctx; | ||
| 942 | |||
| 943 | if (s->state == SSL3_ST_SW_KEY_EXCH_A) | ||
| 944 | { | ||
| 945 | type=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK; | ||
| 946 | cert=s->cert; | ||
| 947 | |||
| 948 | buf=s->init_buf; | ||
| 949 | |||
| 950 | r[0]=r[1]=r[2]=r[3]=NULL; | ||
| 951 | n=0; | ||
| 952 | #ifndef NO_RSA | ||
| 953 | if (type & SSL_kRSA) | ||
| 954 | { | ||
| 955 | rsa=cert->rsa_tmp; | ||
| 956 | if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) | ||
| 957 | { | ||
| 958 | rsa=s->cert->rsa_tmp_cb(s, | ||
| 959 | SSL_C_IS_EXPORT(s->s3->tmp.new_cipher), | ||
| 960 | SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)); | ||
| 961 | if(rsa == NULL) | ||
| 962 | { | ||
| 963 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 964 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ERROR_GENERATING_TMP_RSA_KEY); | ||
| 965 | goto f_err; | ||
| 966 | } | ||
| 967 | CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA); | ||
| 968 | cert->rsa_tmp=rsa; | ||
| 969 | } | ||
| 970 | if (rsa == NULL) | ||
| 971 | { | ||
| 972 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 973 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY); | ||
| 974 | goto f_err; | ||
| 975 | } | ||
| 976 | r[0]=rsa->n; | ||
| 977 | r[1]=rsa->e; | ||
| 978 | s->s3->tmp.use_rsa_tmp=1; | ||
| 979 | } | ||
| 980 | else | ||
| 981 | #endif | ||
| 982 | #ifndef NO_DH | ||
| 983 | if (type & SSL_kEDH) | ||
| 984 | { | ||
| 985 | dhp=cert->dh_tmp; | ||
| 986 | if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) | ||
| 987 | dhp=s->cert->dh_tmp_cb(s, | ||
| 988 | SSL_C_IS_EXPORT(s->s3->tmp.new_cipher), | ||
| 989 | SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)); | ||
| 990 | if (dhp == NULL) | ||
| 991 | { | ||
| 992 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 993 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY); | ||
| 994 | goto f_err; | ||
| 995 | } | ||
| 996 | |||
| 997 | if (s->s3->tmp.dh != NULL) | ||
| 998 | { | ||
| 999 | DH_free(dh); | ||
| 1000 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, SSL_R_INTERNAL_ERROR); | ||
| 1001 | goto err; | ||
| 1002 | } | ||
| 1003 | |||
| 1004 | if ((dh=DHparams_dup(dhp)) == NULL) | ||
| 1005 | { | ||
| 1006 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 1007 | goto err; | ||
| 1008 | } | ||
| 1009 | |||
| 1010 | s->s3->tmp.dh=dh; | ||
| 1011 | if ((dhp->pub_key == NULL || | ||
| 1012 | dhp->priv_key == NULL || | ||
| 1013 | (s->options & SSL_OP_SINGLE_DH_USE))) | ||
| 1014 | { | ||
| 1015 | if(!DH_generate_key(dh)) | ||
| 1016 | { | ||
| 1017 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, | ||
| 1018 | ERR_R_DH_LIB); | ||
| 1019 | goto err; | ||
| 1020 | } | ||
| 1021 | } | ||
| 1022 | else | ||
| 1023 | { | ||
| 1024 | dh->pub_key=BN_dup(dhp->pub_key); | ||
| 1025 | dh->priv_key=BN_dup(dhp->priv_key); | ||
| 1026 | if ((dh->pub_key == NULL) || | ||
| 1027 | (dh->priv_key == NULL)) | ||
| 1028 | { | ||
| 1029 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 1030 | goto err; | ||
| 1031 | } | ||
| 1032 | } | ||
| 1033 | r[0]=dh->p; | ||
| 1034 | r[1]=dh->g; | ||
| 1035 | r[2]=dh->pub_key; | ||
| 1036 | } | ||
| 1037 | else | ||
| 1038 | #endif | ||
| 1039 | { | ||
| 1040 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1041 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); | ||
| 1042 | goto f_err; | ||
| 1043 | } | ||
| 1044 | for (i=0; r[i] != NULL; i++) | ||
| 1045 | { | ||
| 1046 | nr[i]=BN_num_bytes(r[i]); | ||
| 1047 | n+=2+nr[i]; | ||
| 1048 | } | ||
| 1049 | |||
| 1050 | if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)) | ||
| 1051 | { | ||
| 1052 | if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher)) | ||
| 1053 | == NULL) | ||
| 1054 | { | ||
| 1055 | al=SSL_AD_DECODE_ERROR; | ||
| 1056 | goto f_err; | ||
| 1057 | } | ||
| 1058 | kn=EVP_PKEY_size(pkey); | ||
| 1059 | } | ||
| 1060 | else | ||
| 1061 | { | ||
| 1062 | pkey=NULL; | ||
| 1063 | kn=0; | ||
| 1064 | } | ||
| 1065 | |||
| 1066 | if (!BUF_MEM_grow(buf,n+4+kn)) | ||
| 1067 | { | ||
| 1068 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF); | ||
| 1069 | goto err; | ||
| 1070 | } | ||
| 1071 | d=(unsigned char *)s->init_buf->data; | ||
| 1072 | p= &(d[4]); | ||
| 1073 | |||
| 1074 | for (i=0; r[i] != NULL; i++) | ||
| 1075 | { | ||
| 1076 | s2n(nr[i],p); | ||
| 1077 | BN_bn2bin(r[i],p); | ||
| 1078 | p+=nr[i]; | ||
| 1079 | } | ||
| 1080 | |||
| 1081 | /* not anonymous */ | ||
| 1082 | if (pkey != NULL) | ||
| 1083 | { | ||
| 1084 | /* n is the length of the params, they start at &(d[4]) | ||
| 1085 | * and p points to the space at the end. */ | ||
| 1086 | #ifndef NO_RSA | ||
| 1087 | if (pkey->type == EVP_PKEY_RSA) | ||
| 1088 | { | ||
| 1089 | q=md_buf; | ||
| 1090 | j=0; | ||
| 1091 | for (num=2; num > 0; num--) | ||
| 1092 | { | ||
| 1093 | EVP_DigestInit(&md_ctx,(num == 2) | ||
| 1094 | ?s->ctx->md5:s->ctx->sha1); | ||
| 1095 | EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); | ||
| 1096 | EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); | ||
| 1097 | EVP_DigestUpdate(&md_ctx,&(d[4]),n); | ||
| 1098 | EVP_DigestFinal(&md_ctx,q, | ||
| 1099 | (unsigned int *)&i); | ||
| 1100 | q+=i; | ||
| 1101 | j+=i; | ||
| 1102 | } | ||
| 1103 | if (RSA_sign(NID_md5_sha1, md_buf, j, | ||
| 1104 | &(p[2]), &u, pkey->pkey.rsa) <= 0) | ||
| 1105 | { | ||
| 1106 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA); | ||
| 1107 | goto err; | ||
| 1108 | } | ||
| 1109 | s2n(u,p); | ||
| 1110 | n+=u+2; | ||
| 1111 | } | ||
| 1112 | else | ||
| 1113 | #endif | ||
| 1114 | #if !defined(NO_DSA) | ||
| 1115 | if (pkey->type == EVP_PKEY_DSA) | ||
| 1116 | { | ||
| 1117 | /* lets do DSS */ | ||
| 1118 | EVP_SignInit(&md_ctx,EVP_dss1()); | ||
| 1119 | EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); | ||
| 1120 | EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); | ||
| 1121 | EVP_SignUpdate(&md_ctx,&(d[4]),n); | ||
| 1122 | if (!EVP_SignFinal(&md_ctx,&(p[2]), | ||
| 1123 | (unsigned int *)&i,pkey)) | ||
| 1124 | { | ||
| 1125 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA); | ||
| 1126 | goto err; | ||
| 1127 | } | ||
| 1128 | s2n(i,p); | ||
| 1129 | n+=i+2; | ||
| 1130 | } | ||
| 1131 | else | ||
| 1132 | #endif | ||
| 1133 | { | ||
| 1134 | /* Is this error check actually needed? */ | ||
| 1135 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1136 | SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE); | ||
| 1137 | goto f_err; | ||
| 1138 | } | ||
| 1139 | } | ||
| 1140 | |||
| 1141 | *(d++)=SSL3_MT_SERVER_KEY_EXCHANGE; | ||
| 1142 | l2n3(n,d); | ||
| 1143 | |||
| 1144 | /* we should now have things packed up, so lets send | ||
| 1145 | * it off */ | ||
| 1146 | s->init_num=n+4; | ||
| 1147 | s->init_off=0; | ||
| 1148 | } | ||
| 1149 | |||
| 1150 | s->state = SSL3_ST_SW_KEY_EXCH_B; | ||
| 1151 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 1152 | f_err: | ||
| 1153 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 1154 | err: | ||
| 1155 | return(-1); | ||
| 1156 | } | ||
| 1157 | |||
| 1158 | static int ssl3_send_certificate_request(SSL *s) | ||
| 1159 | { | ||
| 1160 | unsigned char *p,*d; | ||
| 1161 | int i,j,nl,off,n; | ||
| 1162 | STACK_OF(X509_NAME) *sk=NULL; | ||
| 1163 | X509_NAME *name; | ||
| 1164 | BUF_MEM *buf; | ||
| 1165 | |||
| 1166 | if (s->state == SSL3_ST_SW_CERT_REQ_A) | ||
| 1167 | { | ||
| 1168 | buf=s->init_buf; | ||
| 1169 | |||
| 1170 | d=p=(unsigned char *)&(buf->data[4]); | ||
| 1171 | |||
| 1172 | /* get the list of acceptable cert types */ | ||
| 1173 | p++; | ||
| 1174 | n=ssl3_get_req_cert_type(s,p); | ||
| 1175 | d[0]=n; | ||
| 1176 | p+=n; | ||
| 1177 | n++; | ||
| 1178 | |||
| 1179 | off=n; | ||
| 1180 | p+=2; | ||
| 1181 | n+=2; | ||
| 1182 | |||
| 1183 | sk=SSL_get_client_CA_list(s); | ||
| 1184 | nl=0; | ||
| 1185 | if (sk != NULL) | ||
| 1186 | { | ||
| 1187 | for (i=0; i<sk_X509_NAME_num(sk); i++) | ||
| 1188 | { | ||
| 1189 | name=sk_X509_NAME_value(sk,i); | ||
| 1190 | j=i2d_X509_NAME(name,NULL); | ||
| 1191 | if (!BUF_MEM_grow(buf,4+n+j+2)) | ||
| 1192 | { | ||
| 1193 | SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB); | ||
| 1194 | goto err; | ||
| 1195 | } | ||
| 1196 | p=(unsigned char *)&(buf->data[4+n]); | ||
| 1197 | if (!(s->options & SSL_OP_NETSCAPE_CA_DN_BUG)) | ||
| 1198 | { | ||
| 1199 | s2n(j,p); | ||
| 1200 | i2d_X509_NAME(name,&p); | ||
| 1201 | n+=2+j; | ||
| 1202 | nl+=2+j; | ||
| 1203 | } | ||
| 1204 | else | ||
| 1205 | { | ||
| 1206 | d=p; | ||
| 1207 | i2d_X509_NAME(name,&p); | ||
| 1208 | j-=2; s2n(j,d); j+=2; | ||
| 1209 | n+=j; | ||
| 1210 | nl+=j; | ||
| 1211 | } | ||
| 1212 | } | ||
| 1213 | } | ||
| 1214 | /* else no CA names */ | ||
| 1215 | p=(unsigned char *)&(buf->data[4+off]); | ||
| 1216 | s2n(nl,p); | ||
| 1217 | |||
| 1218 | d=(unsigned char *)buf->data; | ||
| 1219 | *(d++)=SSL3_MT_CERTIFICATE_REQUEST; | ||
| 1220 | l2n3(n,d); | ||
| 1221 | |||
| 1222 | /* we should now have things packed up, so lets send | ||
| 1223 | * it off */ | ||
| 1224 | |||
| 1225 | s->init_num=n+4; | ||
| 1226 | s->init_off=0; | ||
| 1227 | #ifdef NETSCAPE_HANG_BUG | ||
| 1228 | p=(unsigned char *)s->init_buf->data + s->init_num; | ||
| 1229 | |||
| 1230 | /* do the header */ | ||
| 1231 | *(p++)=SSL3_MT_SERVER_DONE; | ||
| 1232 | *(p++)=0; | ||
| 1233 | *(p++)=0; | ||
| 1234 | *(p++)=0; | ||
| 1235 | s->init_num += 4; | ||
| 1236 | #endif | ||
| 1237 | |||
| 1238 | } | ||
| 1239 | |||
| 1240 | /* SSL3_ST_SW_CERT_REQ_B */ | ||
| 1241 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 1242 | err: | ||
| 1243 | return(-1); | ||
| 1244 | } | ||
| 1245 | |||
| 1246 | static int ssl3_get_client_key_exchange(SSL *s) | ||
| 1247 | { | ||
| 1248 | int i,al,ok; | ||
| 1249 | long n; | ||
| 1250 | unsigned long l; | ||
| 1251 | unsigned char *p; | ||
| 1252 | #ifndef NO_RSA | ||
| 1253 | RSA *rsa=NULL; | ||
| 1254 | EVP_PKEY *pkey=NULL; | ||
| 1255 | #endif | ||
| 1256 | #ifndef NO_DH | ||
| 1257 | BIGNUM *pub=NULL; | ||
| 1258 | DH *dh_srvr; | ||
| 1259 | #endif | ||
| 1260 | |||
| 1261 | n=ssl3_get_message(s, | ||
| 1262 | SSL3_ST_SR_KEY_EXCH_A, | ||
| 1263 | SSL3_ST_SR_KEY_EXCH_B, | ||
| 1264 | SSL3_MT_CLIENT_KEY_EXCHANGE, | ||
| 1265 | 400, /* ???? */ | ||
| 1266 | &ok); | ||
| 1267 | |||
| 1268 | if (!ok) return((int)n); | ||
| 1269 | p=(unsigned char *)s->init_buf->data; | ||
| 1270 | |||
| 1271 | l=s->s3->tmp.new_cipher->algorithms; | ||
| 1272 | |||
| 1273 | #ifndef NO_RSA | ||
| 1274 | if (l & SSL_kRSA) | ||
| 1275 | { | ||
| 1276 | /* FIX THIS UP EAY EAY EAY EAY */ | ||
| 1277 | if (s->s3->tmp.use_rsa_tmp) | ||
| 1278 | { | ||
| 1279 | if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL)) | ||
| 1280 | rsa=s->cert->rsa_tmp; | ||
| 1281 | /* Don't do a callback because rsa_tmp should | ||
| 1282 | * be sent already */ | ||
| 1283 | if (rsa == NULL) | ||
| 1284 | { | ||
| 1285 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1286 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_PKEY); | ||
| 1287 | goto f_err; | ||
| 1288 | |||
| 1289 | } | ||
| 1290 | } | ||
| 1291 | else | ||
| 1292 | { | ||
| 1293 | pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey; | ||
| 1294 | if ( (pkey == NULL) || | ||
| 1295 | (pkey->type != EVP_PKEY_RSA) || | ||
| 1296 | (pkey->pkey.rsa == NULL)) | ||
| 1297 | { | ||
| 1298 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1299 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_RSA_CERTIFICATE); | ||
| 1300 | goto f_err; | ||
| 1301 | } | ||
| 1302 | rsa=pkey->pkey.rsa; | ||
| 1303 | } | ||
| 1304 | |||
| 1305 | /* TLS */ | ||
| 1306 | if (s->version > SSL3_VERSION) | ||
| 1307 | { | ||
| 1308 | n2s(p,i); | ||
| 1309 | if (n != i+2) | ||
| 1310 | { | ||
| 1311 | if (!(s->options & SSL_OP_TLS_D5_BUG)) | ||
| 1312 | { | ||
| 1313 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG); | ||
| 1314 | goto err; | ||
| 1315 | } | ||
| 1316 | else | ||
| 1317 | p-=2; | ||
| 1318 | } | ||
| 1319 | else | ||
| 1320 | n=i; | ||
| 1321 | } | ||
| 1322 | |||
| 1323 | i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING); | ||
| 1324 | |||
| 1325 | al = -1; | ||
| 1326 | |||
| 1327 | if (i != SSL_MAX_MASTER_KEY_LENGTH) | ||
| 1328 | { | ||
| 1329 | al=SSL_AD_DECODE_ERROR; | ||
| 1330 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); | ||
| 1331 | } | ||
| 1332 | |||
| 1333 | if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff)))) | ||
| 1334 | { | ||
| 1335 | /* The premaster secret must contain the same version number as the | ||
| 1336 | * ClientHello to detect version rollback attacks (strangely, the | ||
| 1337 | * protocol does not offer such protection for DH ciphersuites). | ||
| 1338 | * However, buggy clients exist that send the negotiated protocol | ||
| 1339 | * version instead if the server does not support the requested | ||
| 1340 | * protocol version. | ||
| 1341 | * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */ | ||
| 1342 | if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) && | ||
| 1343 | (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff)))) | ||
| 1344 | { | ||
| 1345 | al=SSL_AD_DECODE_ERROR; | ||
| 1346 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); | ||
| 1347 | goto f_err; | ||
| 1348 | } | ||
| 1349 | } | ||
| 1350 | |||
| 1351 | if (al != -1) | ||
| 1352 | { | ||
| 1353 | #if 0 | ||
| 1354 | goto f_err; | ||
| 1355 | #else | ||
| 1356 | /* Some decryption failure -- use random value instead as countermeasure | ||
| 1357 | * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding | ||
| 1358 | * (see RFC 2246, section 7.4.7.1). | ||
| 1359 | * But note that due to length and protocol version checking, the | ||
| 1360 | * attack is impractical anyway (see section 5 in D. Bleichenbacher: | ||
| 1361 | * "Chosen Ciphertext Attacks Against Protocols Based on the RSA | ||
| 1362 | * Encryption Standard PKCS #1", CRYPTO '98, LNCS 1462, pp. 1-12). | ||
| 1363 | */ | ||
| 1364 | ERR_clear_error(); | ||
| 1365 | i = SSL_MAX_MASTER_KEY_LENGTH; | ||
| 1366 | p[0] = s->client_version >> 8; | ||
| 1367 | p[1] = s->client_version & 0xff; | ||
| 1368 | RAND_pseudo_bytes(p+2, i-2); /* should be RAND_bytes, but we cannot work around a failure */ | ||
| 1369 | #endif | ||
| 1370 | } | ||
| 1371 | |||
| 1372 | s->session->master_key_length= | ||
| 1373 | s->method->ssl3_enc->generate_master_secret(s, | ||
| 1374 | s->session->master_key, | ||
| 1375 | p,i); | ||
| 1376 | memset(p,0,i); | ||
| 1377 | } | ||
| 1378 | else | ||
| 1379 | #endif | ||
| 1380 | #ifndef NO_DH | ||
| 1381 | if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) | ||
| 1382 | { | ||
| 1383 | n2s(p,i); | ||
| 1384 | if (n != i+2) | ||
| 1385 | { | ||
| 1386 | if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG)) | ||
| 1387 | { | ||
| 1388 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG); | ||
| 1389 | goto err; | ||
| 1390 | } | ||
| 1391 | else | ||
| 1392 | { | ||
| 1393 | p-=2; | ||
| 1394 | i=(int)n; | ||
| 1395 | } | ||
| 1396 | } | ||
| 1397 | |||
| 1398 | if (n == 0L) /* the parameters are in the cert */ | ||
| 1399 | { | ||
| 1400 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1401 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_DECODE_DH_CERTS); | ||
| 1402 | goto f_err; | ||
| 1403 | } | ||
| 1404 | else | ||
| 1405 | { | ||
| 1406 | if (s->s3->tmp.dh == NULL) | ||
| 1407 | { | ||
| 1408 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1409 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY); | ||
| 1410 | goto f_err; | ||
| 1411 | } | ||
| 1412 | else | ||
| 1413 | dh_srvr=s->s3->tmp.dh; | ||
| 1414 | } | ||
| 1415 | |||
| 1416 | pub=BN_bin2bn(p,i,NULL); | ||
| 1417 | if (pub == NULL) | ||
| 1418 | { | ||
| 1419 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB); | ||
| 1420 | goto err; | ||
| 1421 | } | ||
| 1422 | |||
| 1423 | i=DH_compute_key(p,pub,dh_srvr); | ||
| 1424 | |||
| 1425 | if (i <= 0) | ||
| 1426 | { | ||
| 1427 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); | ||
| 1428 | goto err; | ||
| 1429 | } | ||
| 1430 | |||
| 1431 | DH_free(s->s3->tmp.dh); | ||
| 1432 | s->s3->tmp.dh=NULL; | ||
| 1433 | |||
| 1434 | BN_clear_free(pub); | ||
| 1435 | pub=NULL; | ||
| 1436 | s->session->master_key_length= | ||
| 1437 | s->method->ssl3_enc->generate_master_secret(s, | ||
| 1438 | s->session->master_key,p,i); | ||
| 1439 | memset(p,0,i); | ||
| 1440 | } | ||
| 1441 | else | ||
| 1442 | #endif | ||
| 1443 | { | ||
| 1444 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1445 | SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNKNOWN_CIPHER_TYPE); | ||
| 1446 | goto f_err; | ||
| 1447 | } | ||
| 1448 | |||
| 1449 | return(1); | ||
| 1450 | f_err: | ||
| 1451 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 1452 | #if !defined(NO_DH) || !defined(NO_RSA) | ||
| 1453 | err: | ||
| 1454 | #endif | ||
| 1455 | return(-1); | ||
| 1456 | } | ||
| 1457 | |||
| 1458 | static int ssl3_get_cert_verify(SSL *s) | ||
| 1459 | { | ||
| 1460 | EVP_PKEY *pkey=NULL; | ||
| 1461 | unsigned char *p; | ||
| 1462 | int al,ok,ret=0; | ||
| 1463 | long n; | ||
| 1464 | int type=0,i,j; | ||
| 1465 | X509 *peer; | ||
| 1466 | |||
| 1467 | n=ssl3_get_message(s, | ||
| 1468 | SSL3_ST_SR_CERT_VRFY_A, | ||
| 1469 | SSL3_ST_SR_CERT_VRFY_B, | ||
| 1470 | -1, | ||
| 1471 | 512, /* 512? */ | ||
| 1472 | &ok); | ||
| 1473 | |||
| 1474 | if (!ok) return((int)n); | ||
| 1475 | |||
| 1476 | if (s->session->peer != NULL) | ||
| 1477 | { | ||
| 1478 | peer=s->session->peer; | ||
| 1479 | pkey=X509_get_pubkey(peer); | ||
| 1480 | type=X509_certificate_type(peer,pkey); | ||
| 1481 | } | ||
| 1482 | else | ||
| 1483 | { | ||
| 1484 | peer=NULL; | ||
| 1485 | pkey=NULL; | ||
| 1486 | } | ||
| 1487 | |||
| 1488 | if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY) | ||
| 1489 | { | ||
| 1490 | s->s3->tmp.reuse_message=1; | ||
| 1491 | if ((peer != NULL) && (type | EVP_PKT_SIGN)) | ||
| 1492 | { | ||
| 1493 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1494 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE); | ||
| 1495 | goto f_err; | ||
| 1496 | } | ||
| 1497 | ret=1; | ||
| 1498 | goto end; | ||
| 1499 | } | ||
| 1500 | |||
| 1501 | if (peer == NULL) | ||
| 1502 | { | ||
| 1503 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED); | ||
| 1504 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1505 | goto f_err; | ||
| 1506 | } | ||
| 1507 | |||
| 1508 | if (!(type & EVP_PKT_SIGN)) | ||
| 1509 | { | ||
| 1510 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE); | ||
| 1511 | al=SSL_AD_ILLEGAL_PARAMETER; | ||
| 1512 | goto f_err; | ||
| 1513 | } | ||
| 1514 | |||
| 1515 | if (s->s3->change_cipher_spec) | ||
| 1516 | { | ||
| 1517 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY); | ||
| 1518 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1519 | goto f_err; | ||
| 1520 | } | ||
| 1521 | |||
| 1522 | /* we now have a signature that we need to verify */ | ||
| 1523 | p=(unsigned char *)s->init_buf->data; | ||
| 1524 | n2s(p,i); | ||
| 1525 | n-=2; | ||
| 1526 | if (i > n) | ||
| 1527 | { | ||
| 1528 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH); | ||
| 1529 | al=SSL_AD_DECODE_ERROR; | ||
| 1530 | goto f_err; | ||
| 1531 | } | ||
| 1532 | |||
| 1533 | j=EVP_PKEY_size(pkey); | ||
| 1534 | if ((i > j) || (n > j) || (n <= 0)) | ||
| 1535 | { | ||
| 1536 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE); | ||
| 1537 | al=SSL_AD_DECODE_ERROR; | ||
| 1538 | goto f_err; | ||
| 1539 | } | ||
| 1540 | |||
| 1541 | #ifndef NO_RSA | ||
| 1542 | if (pkey->type == EVP_PKEY_RSA) | ||
| 1543 | { | ||
| 1544 | i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md, | ||
| 1545 | MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i, | ||
| 1546 | pkey->pkey.rsa); | ||
| 1547 | if (i < 0) | ||
| 1548 | { | ||
| 1549 | al=SSL_AD_DECRYPT_ERROR; | ||
| 1550 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT); | ||
| 1551 | goto f_err; | ||
| 1552 | } | ||
| 1553 | if (i == 0) | ||
| 1554 | { | ||
| 1555 | al=SSL_AD_DECRYPT_ERROR; | ||
| 1556 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE); | ||
| 1557 | goto f_err; | ||
| 1558 | } | ||
| 1559 | } | ||
| 1560 | else | ||
| 1561 | #endif | ||
| 1562 | #ifndef NO_DSA | ||
| 1563 | if (pkey->type == EVP_PKEY_DSA) | ||
| 1564 | { | ||
| 1565 | j=DSA_verify(pkey->save_type, | ||
| 1566 | &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]), | ||
| 1567 | SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa); | ||
| 1568 | if (j <= 0) | ||
| 1569 | { | ||
| 1570 | /* bad signature */ | ||
| 1571 | al=SSL_AD_DECRYPT_ERROR; | ||
| 1572 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE); | ||
| 1573 | goto f_err; | ||
| 1574 | } | ||
| 1575 | } | ||
| 1576 | else | ||
| 1577 | #endif | ||
| 1578 | { | ||
| 1579 | SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR); | ||
| 1580 | al=SSL_AD_UNSUPPORTED_CERTIFICATE; | ||
| 1581 | goto f_err; | ||
| 1582 | } | ||
| 1583 | |||
| 1584 | |||
| 1585 | ret=1; | ||
| 1586 | if (0) | ||
| 1587 | { | ||
| 1588 | f_err: | ||
| 1589 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 1590 | } | ||
| 1591 | end: | ||
| 1592 | EVP_PKEY_free(pkey); | ||
| 1593 | return(ret); | ||
| 1594 | } | ||
| 1595 | |||
| 1596 | static int ssl3_get_client_certificate(SSL *s) | ||
| 1597 | { | ||
| 1598 | int i,ok,al,ret= -1; | ||
| 1599 | X509 *x=NULL; | ||
| 1600 | unsigned long l,nc,llen,n; | ||
| 1601 | unsigned char *p,*d,*q; | ||
| 1602 | STACK_OF(X509) *sk=NULL; | ||
| 1603 | |||
| 1604 | n=ssl3_get_message(s, | ||
| 1605 | SSL3_ST_SR_CERT_A, | ||
| 1606 | SSL3_ST_SR_CERT_B, | ||
| 1607 | -1, | ||
| 1608 | #if defined(MSDOS) && !defined(WIN32) | ||
| 1609 | 1024*30, /* 30k max cert list :-) */ | ||
| 1610 | #else | ||
| 1611 | 1024*100, /* 100k max cert list :-) */ | ||
| 1612 | #endif | ||
| 1613 | &ok); | ||
| 1614 | |||
| 1615 | if (!ok) return((int)n); | ||
| 1616 | |||
| 1617 | if (s->s3->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE) | ||
| 1618 | { | ||
| 1619 | if ( (s->verify_mode & SSL_VERIFY_PEER) && | ||
| 1620 | (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) | ||
| 1621 | { | ||
| 1622 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); | ||
| 1623 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1624 | goto f_err; | ||
| 1625 | } | ||
| 1626 | /* If tls asked for a client cert, the client must return a 0 list */ | ||
| 1627 | if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request) | ||
| 1628 | { | ||
| 1629 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST); | ||
| 1630 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1631 | goto f_err; | ||
| 1632 | } | ||
| 1633 | s->s3->tmp.reuse_message=1; | ||
| 1634 | return(1); | ||
| 1635 | } | ||
| 1636 | |||
| 1637 | if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE) | ||
| 1638 | { | ||
| 1639 | al=SSL_AD_UNEXPECTED_MESSAGE; | ||
| 1640 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_WRONG_MESSAGE_TYPE); | ||
| 1641 | goto f_err; | ||
| 1642 | } | ||
| 1643 | d=p=(unsigned char *)s->init_buf->data; | ||
| 1644 | |||
| 1645 | if ((sk=sk_X509_new_null()) == NULL) | ||
| 1646 | { | ||
| 1647 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE); | ||
| 1648 | goto err; | ||
| 1649 | } | ||
| 1650 | |||
| 1651 | n2l3(p,llen); | ||
| 1652 | if (llen+3 != n) | ||
| 1653 | { | ||
| 1654 | al=SSL_AD_DECODE_ERROR; | ||
| 1655 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_LENGTH_MISMATCH); | ||
| 1656 | goto f_err; | ||
| 1657 | } | ||
| 1658 | for (nc=0; nc<llen; ) | ||
| 1659 | { | ||
| 1660 | n2l3(p,l); | ||
| 1661 | if ((l+nc+3) > llen) | ||
| 1662 | { | ||
| 1663 | al=SSL_AD_DECODE_ERROR; | ||
| 1664 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); | ||
| 1665 | goto f_err; | ||
| 1666 | } | ||
| 1667 | |||
| 1668 | q=p; | ||
| 1669 | x=d2i_X509(NULL,&p,l); | ||
| 1670 | if (x == NULL) | ||
| 1671 | { | ||
| 1672 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_ASN1_LIB); | ||
| 1673 | goto err; | ||
| 1674 | } | ||
| 1675 | if (p != (q+l)) | ||
| 1676 | { | ||
| 1677 | al=SSL_AD_DECODE_ERROR; | ||
| 1678 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); | ||
| 1679 | goto f_err; | ||
| 1680 | } | ||
| 1681 | if (!sk_X509_push(sk,x)) | ||
| 1682 | { | ||
| 1683 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE); | ||
| 1684 | goto err; | ||
| 1685 | } | ||
| 1686 | x=NULL; | ||
| 1687 | nc+=l+3; | ||
| 1688 | } | ||
| 1689 | |||
| 1690 | if (sk_X509_num(sk) <= 0) | ||
| 1691 | { | ||
| 1692 | /* TLS does not mind 0 certs returned */ | ||
| 1693 | if (s->version == SSL3_VERSION) | ||
| 1694 | { | ||
| 1695 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1696 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATES_RETURNED); | ||
| 1697 | goto f_err; | ||
| 1698 | } | ||
| 1699 | /* Fail for TLS only if we required a certificate */ | ||
| 1700 | else if ((s->verify_mode & SSL_VERIFY_PEER) && | ||
| 1701 | (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) | ||
| 1702 | { | ||
| 1703 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); | ||
| 1704 | al=SSL_AD_HANDSHAKE_FAILURE; | ||
| 1705 | goto f_err; | ||
| 1706 | } | ||
| 1707 | } | ||
| 1708 | else | ||
| 1709 | { | ||
| 1710 | i=ssl_verify_cert_chain(s,sk); | ||
| 1711 | if (!i) | ||
| 1712 | { | ||
| 1713 | al=ssl_verify_alarm_type(s->verify_result); | ||
| 1714 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED); | ||
| 1715 | goto f_err; | ||
| 1716 | } | ||
| 1717 | } | ||
| 1718 | |||
| 1719 | if (s->session->peer != NULL) /* This should not be needed */ | ||
| 1720 | X509_free(s->session->peer); | ||
| 1721 | s->session->peer=sk_X509_shift(sk); | ||
| 1722 | s->session->verify_result = s->verify_result; | ||
| 1723 | |||
| 1724 | /* With the current implementation, sess_cert will always be NULL | ||
| 1725 | * when we arrive here. */ | ||
| 1726 | if (s->session->sess_cert == NULL) | ||
| 1727 | { | ||
| 1728 | s->session->sess_cert = ssl_sess_cert_new(); | ||
| 1729 | if (s->session->sess_cert == NULL) | ||
| 1730 | { | ||
| 1731 | SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE); | ||
| 1732 | goto err; | ||
| 1733 | } | ||
| 1734 | } | ||
| 1735 | if (s->session->sess_cert->cert_chain != NULL) | ||
| 1736 | sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free); | ||
| 1737 | s->session->sess_cert->cert_chain=sk; | ||
| 1738 | /* Inconsistency alert: cert_chain does *not* include the | ||
| 1739 | * peer's own certificate, while we do include it in s3_clnt.c */ | ||
| 1740 | |||
| 1741 | sk=NULL; | ||
| 1742 | |||
| 1743 | ret=1; | ||
| 1744 | if (0) | ||
| 1745 | { | ||
| 1746 | f_err: | ||
| 1747 | ssl3_send_alert(s,SSL3_AL_FATAL,al); | ||
| 1748 | } | ||
| 1749 | err: | ||
| 1750 | if (x != NULL) X509_free(x); | ||
| 1751 | if (sk != NULL) sk_X509_pop_free(sk,X509_free); | ||
| 1752 | return(ret); | ||
| 1753 | } | ||
| 1754 | |||
| 1755 | int ssl3_send_server_certificate(SSL *s) | ||
| 1756 | { | ||
| 1757 | unsigned long l; | ||
| 1758 | X509 *x; | ||
| 1759 | |||
| 1760 | if (s->state == SSL3_ST_SW_CERT_A) | ||
| 1761 | { | ||
| 1762 | x=ssl_get_server_send_cert(s); | ||
| 1763 | if (x == NULL) | ||
| 1764 | { | ||
| 1765 | SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,SSL_R_INTERNAL_ERROR); | ||
| 1766 | return(0); | ||
| 1767 | } | ||
| 1768 | |||
| 1769 | l=ssl3_output_cert_chain(s,x); | ||
| 1770 | s->state=SSL3_ST_SW_CERT_B; | ||
| 1771 | s->init_num=(int)l; | ||
| 1772 | s->init_off=0; | ||
| 1773 | } | ||
| 1774 | |||
| 1775 | /* SSL3_ST_SW_CERT_B */ | ||
| 1776 | return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); | ||
| 1777 | } | ||
diff --git a/src/lib/libssl/shlib_version b/src/lib/libssl/shlib_version deleted file mode 100644 index 900b4048a9..0000000000 --- a/src/lib/libssl/shlib_version +++ /dev/null | |||
| @@ -1,2 +0,0 @@ | |||
| 1 | major=5 | ||
| 2 | minor=1 | ||
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h deleted file mode 100644 index 9de9e611ab..0000000000 --- a/src/lib/libssl/ssl.h +++ /dev/null | |||
| @@ -1,1566 +0,0 @@ | |||
| 1 | /* ssl/ssl.h */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #ifndef HEADER_SSL_H | ||
| 60 | #define HEADER_SSL_H | ||
| 61 | |||
| 62 | #ifndef NO_COMP | ||
| 63 | #include <openssl/comp.h> | ||
| 64 | #endif | ||
| 65 | #ifndef NO_BIO | ||
| 66 | #include <openssl/bio.h> | ||
| 67 | #endif | ||
| 68 | #ifndef NO_X509 | ||
| 69 | #include <openssl/x509.h> | ||
| 70 | #endif | ||
| 71 | #include <openssl/safestack.h> | ||
| 72 | |||
| 73 | #ifdef __cplusplus | ||
| 74 | extern "C" { | ||
| 75 | #endif | ||
| 76 | |||
| 77 | /* SSLeay version number for ASN.1 encoding of the session information */ | ||
| 78 | /* Version 0 - initial version | ||
| 79 | * Version 1 - added the optional peer certificate | ||
| 80 | */ | ||
| 81 | #define SSL_SESSION_ASN1_VERSION 0x0001 | ||
| 82 | |||
| 83 | /* text strings for the ciphers */ | ||
| 84 | #define SSL_TXT_NULL_WITH_MD5 SSL2_TXT_NULL_WITH_MD5 | ||
| 85 | #define SSL_TXT_RC4_128_WITH_MD5 SSL2_TXT_RC4_128_WITH_MD5 | ||
| 86 | #define SSL_TXT_RC4_128_EXPORT40_WITH_MD5 SSL2_TXT_RC4_128_EXPORT40_WITH_MD5 | ||
| 87 | #define SSL_TXT_RC2_128_CBC_WITH_MD5 SSL2_TXT_RC2_128_CBC_WITH_MD5 | ||
| 88 | #define SSL_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 | ||
| 89 | #define SSL_TXT_IDEA_128_CBC_WITH_MD5 SSL2_TXT_IDEA_128_CBC_WITH_MD5 | ||
| 90 | #define SSL_TXT_DES_64_CBC_WITH_MD5 SSL2_TXT_DES_64_CBC_WITH_MD5 | ||
| 91 | #define SSL_TXT_DES_64_CBC_WITH_SHA SSL2_TXT_DES_64_CBC_WITH_SHA | ||
| 92 | #define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5 | ||
| 93 | #define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA | ||
| 94 | |||
| 95 | #define SSL_MAX_SSL_SESSION_ID_LENGTH 32 | ||
| 96 | #define SSL_MAX_SID_CTX_LENGTH 32 | ||
| 97 | |||
| 98 | #define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8) | ||
| 99 | #define SSL_MAX_KEY_ARG_LENGTH 8 | ||
| 100 | #define SSL_MAX_MASTER_KEY_LENGTH 48 | ||
| 101 | |||
| 102 | /* These are used to specify which ciphers to use and not to use */ | ||
| 103 | #define SSL_TXT_LOW "LOW" | ||
| 104 | #define SSL_TXT_MEDIUM "MEDIUM" | ||
| 105 | #define SSL_TXT_HIGH "HIGH" | ||
| 106 | #define SSL_TXT_kFZA "kFZA" | ||
| 107 | #define SSL_TXT_aFZA "aFZA" | ||
| 108 | #define SSL_TXT_eFZA "eFZA" | ||
| 109 | #define SSL_TXT_FZA "FZA" | ||
| 110 | |||
| 111 | #define SSL_TXT_aNULL "aNULL" | ||
| 112 | #define SSL_TXT_eNULL "eNULL" | ||
| 113 | #define SSL_TXT_NULL "NULL" | ||
| 114 | |||
| 115 | #define SSL_TXT_kRSA "kRSA" | ||
| 116 | #define SSL_TXT_kDHr "kDHr" | ||
| 117 | #define SSL_TXT_kDHd "kDHd" | ||
| 118 | #define SSL_TXT_kEDH "kEDH" | ||
| 119 | #define SSL_TXT_aRSA "aRSA" | ||
| 120 | #define SSL_TXT_aDSS "aDSS" | ||
| 121 | #define SSL_TXT_aDH "aDH" | ||
| 122 | #define SSL_TXT_DSS "DSS" | ||
| 123 | #define SSL_TXT_DH "DH" | ||
| 124 | #define SSL_TXT_EDH "EDH" | ||
| 125 | #define SSL_TXT_ADH "ADH" | ||
| 126 | #define SSL_TXT_RSA "RSA" | ||
| 127 | #define SSL_TXT_DES "DES" | ||
| 128 | #define SSL_TXT_3DES "3DES" | ||
| 129 | #define SSL_TXT_RC4 "RC4" | ||
| 130 | #define SSL_TXT_RC2 "RC2" | ||
| 131 | #define SSL_TXT_IDEA "IDEA" | ||
| 132 | #define SSL_TXT_MD5 "MD5" | ||
| 133 | #define SSL_TXT_SHA1 "SHA1" | ||
| 134 | #define SSL_TXT_SHA "SHA" | ||
| 135 | #define SSL_TXT_EXP "EXP" | ||
| 136 | #define SSL_TXT_EXPORT "EXPORT" | ||
| 137 | #define SSL_TXT_EXP40 "EXPORT40" | ||
| 138 | #define SSL_TXT_EXP56 "EXPORT56" | ||
| 139 | #define SSL_TXT_SSLV2 "SSLv2" | ||
| 140 | #define SSL_TXT_SSLV3 "SSLv3" | ||
| 141 | #define SSL_TXT_TLSV1 "TLSv1" | ||
| 142 | #define SSL_TXT_ALL "ALL" | ||
| 143 | |||
| 144 | /* 'DEFAULT' at the start of the cipher list insert the following string | ||
| 145 | * in addition to this being the default cipher string */ | ||
| 146 | #define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH" | ||
| 147 | |||
| 148 | /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ | ||
| 149 | #define SSL_SENT_SHUTDOWN 1 | ||
| 150 | #define SSL_RECEIVED_SHUTDOWN 2 | ||
| 151 | |||
| 152 | #ifdef __cplusplus | ||
| 153 | } | ||
| 154 | #endif | ||
| 155 | |||
| 156 | #include <openssl/crypto.h> | ||
| 157 | #include <openssl/lhash.h> | ||
| 158 | #include <openssl/buffer.h> | ||
| 159 | #include <openssl/bio.h> | ||
| 160 | #include <openssl/pem.h> | ||
| 161 | #include <openssl/x509.h> | ||
| 162 | |||
| 163 | #ifdef __cplusplus | ||
| 164 | extern "C" { | ||
| 165 | #endif | ||
| 166 | |||
| 167 | #if (defined(NO_RSA) || defined(NO_MD5)) && !defined(NO_SSL2) | ||
| 168 | #define NO_SSL2 | ||
| 169 | #endif | ||
| 170 | |||
| 171 | #define SSL_FILETYPE_ASN1 X509_FILETYPE_ASN1 | ||
| 172 | #define SSL_FILETYPE_PEM X509_FILETYPE_PEM | ||
| 173 | |||
| 174 | /* This is needed to stop compilers complaining about the | ||
| 175 | * 'struct ssl_st *' function parameters used to prototype callbacks | ||
| 176 | * in SSL_CTX. */ | ||
| 177 | typedef struct ssl_st *ssl_crock_st; | ||
| 178 | |||
| 179 | /* used to hold info on the particular ciphers used */ | ||
| 180 | typedef struct ssl_cipher_st | ||
| 181 | { | ||
| 182 | int valid; | ||
| 183 | const char *name; /* text name */ | ||
| 184 | unsigned long id; /* id, 4 bytes, first is version */ | ||
| 185 | unsigned long algorithms; /* what ciphers are used */ | ||
| 186 | unsigned long algo_strength; /* strength and export flags */ | ||
| 187 | unsigned long algorithm2; /* Extra flags */ | ||
| 188 | int strength_bits; /* Number of bits really used */ | ||
| 189 | int alg_bits; /* Number of bits for algorithm */ | ||
| 190 | unsigned long mask; /* used for matching */ | ||
| 191 | unsigned long mask_strength; /* also used for matching */ | ||
| 192 | } SSL_CIPHER; | ||
| 193 | |||
| 194 | DECLARE_STACK_OF(SSL_CIPHER) | ||
| 195 | |||
| 196 | typedef struct ssl_st SSL; | ||
| 197 | typedef struct ssl_ctx_st SSL_CTX; | ||
| 198 | |||
| 199 | /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */ | ||
| 200 | typedef struct ssl_method_st | ||
| 201 | { | ||
| 202 | int version; | ||
| 203 | int (*ssl_new)(SSL *s); | ||
| 204 | void (*ssl_clear)(SSL *s); | ||
| 205 | void (*ssl_free)(SSL *s); | ||
| 206 | int (*ssl_accept)(SSL *s); | ||
| 207 | int (*ssl_connect)(SSL *s); | ||
| 208 | int (*ssl_read)(SSL *s,void *buf,int len); | ||
| 209 | int (*ssl_peek)(SSL *s,void *buf,int len); | ||
| 210 | int (*ssl_write)(SSL *s,const void *buf,int len); | ||
| 211 | int (*ssl_shutdown)(SSL *s); | ||
| 212 | int (*ssl_renegotiate)(SSL *s); | ||
| 213 | int (*ssl_renegotiate_check)(SSL *s); | ||
| 214 | long (*ssl_ctrl)(SSL *s,int cmd,long larg,char *parg); | ||
| 215 | long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,char *parg); | ||
| 216 | SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr); | ||
| 217 | int (*put_cipher_by_char)(const SSL_CIPHER *cipher,unsigned char *ptr); | ||
| 218 | int (*ssl_pending)(SSL *s); | ||
| 219 | int (*num_ciphers)(void); | ||
| 220 | SSL_CIPHER *(*get_cipher)(unsigned ncipher); | ||
| 221 | struct ssl_method_st *(*get_ssl_method)(int version); | ||
| 222 | long (*get_timeout)(void); | ||
| 223 | struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */ | ||
| 224 | int (*ssl_version)(); | ||
| 225 | long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)()); | ||
| 226 | long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)()); | ||
| 227 | } SSL_METHOD; | ||
| 228 | |||
| 229 | /* Lets make this into an ASN.1 type structure as follows | ||
| 230 | * SSL_SESSION_ID ::= SEQUENCE { | ||
| 231 | * version INTEGER, -- structure version number | ||
| 232 | * SSLversion INTEGER, -- SSL version number | ||
| 233 | * Cipher OCTET_STRING, -- the 3 byte cipher ID | ||
| 234 | * Session_ID OCTET_STRING, -- the Session ID | ||
| 235 | * Master_key OCTET_STRING, -- the master key | ||
| 236 | * Key_Arg [ 0 ] IMPLICIT OCTET_STRING, -- the optional Key argument | ||
| 237 | * Time [ 1 ] EXPLICIT INTEGER, -- optional Start Time | ||
| 238 | * Timeout [ 2 ] EXPLICIT INTEGER, -- optional Timeout ins seconds | ||
| 239 | * Peer [ 3 ] EXPLICIT X509, -- optional Peer Certificate | ||
| 240 | * Session_ID_context [ 4 ] EXPLICIT OCTET_STRING, -- the Session ID context | ||
| 241 | * Verify_result [ 5 ] EXPLICIT INTEGER -- X509_V_... code for `Peer' | ||
| 242 | * Compression [6] IMPLICIT ASN1_OBJECT -- compression OID XXXXX | ||
| 243 | * } | ||
| 244 | * Look in ssl/ssl_asn1.c for more details | ||
| 245 | * I'm using EXPLICIT tags so I can read the damn things using asn1parse :-). | ||
| 246 | */ | ||
| 247 | typedef struct ssl_session_st | ||
| 248 | { | ||
| 249 | int ssl_version; /* what ssl version session info is | ||
| 250 | * being kept in here? */ | ||
| 251 | |||
| 252 | /* only really used in SSLv2 */ | ||
| 253 | unsigned int key_arg_length; | ||
| 254 | unsigned char key_arg[SSL_MAX_KEY_ARG_LENGTH]; | ||
| 255 | int master_key_length; | ||
| 256 | unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH]; | ||
| 257 | /* session_id - valid? */ | ||
| 258 | unsigned int session_id_length; | ||
| 259 | unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH]; | ||
| 260 | /* this is used to determine whether the session is being reused in | ||
| 261 | * the appropriate context. It is up to the application to set this, | ||
| 262 | * via SSL_new */ | ||
| 263 | unsigned int sid_ctx_length; | ||
| 264 | unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH]; | ||
| 265 | |||
| 266 | int not_resumable; | ||
| 267 | |||
| 268 | /* The cert is the certificate used to establish this connection */ | ||
| 269 | struct sess_cert_st /* SESS_CERT */ *sess_cert; | ||
| 270 | |||
| 271 | /* This is the cert for the other end. | ||
| 272 | * On clients, it will be the same as sess_cert->peer_key->x509 | ||
| 273 | * (the latter is not enough as sess_cert is not retained | ||
| 274 | * in the external representation of sessions, see ssl_asn1.c). */ | ||
| 275 | X509 *peer; | ||
| 276 | /* when app_verify_callback accepts a session where the peer's certificate | ||
| 277 | * is not ok, we must remember the error for session reuse: */ | ||
| 278 | long verify_result; /* only for servers */ | ||
| 279 | |||
| 280 | int references; | ||
| 281 | long timeout; | ||
| 282 | long time; | ||
| 283 | |||
| 284 | int compress_meth; /* Need to lookup the method */ | ||
| 285 | |||
| 286 | SSL_CIPHER *cipher; | ||
| 287 | unsigned long cipher_id; /* when ASN.1 loaded, this | ||
| 288 | * needs to be used to load | ||
| 289 | * the 'cipher' structure */ | ||
| 290 | |||
| 291 | STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */ | ||
| 292 | |||
| 293 | CRYPTO_EX_DATA ex_data; /* application specific data */ | ||
| 294 | |||
| 295 | /* These are used to make removal of session-ids more | ||
| 296 | * efficient and to implement a maximum cache size. */ | ||
| 297 | struct ssl_session_st *prev,*next; | ||
| 298 | } SSL_SESSION; | ||
| 299 | |||
| 300 | #define SSL_OP_MICROSOFT_SESS_ID_BUG 0x00000001L | ||
| 301 | #define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x00000002L | ||
| 302 | #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x00000008L | ||
| 303 | #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x00000010L | ||
| 304 | #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x00000020L | ||
| 305 | #define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x00000040L | ||
| 306 | #define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x00000080L | ||
| 307 | #define SSL_OP_TLS_D5_BUG 0x00000100L | ||
| 308 | #define SSL_OP_TLS_BLOCK_PADDING_BUG 0x00000200L | ||
| 309 | #define SSL_OP_TLS_ROLLBACK_BUG 0x00000400L | ||
| 310 | |||
| 311 | /* If set, always create a new key when using tmp_dh parameters */ | ||
| 312 | #define SSL_OP_SINGLE_DH_USE 0x00100000L | ||
| 313 | /* Set to also use the tmp_rsa key when doing RSA operations. */ | ||
| 314 | #define SSL_OP_EPHEMERAL_RSA 0x00200000L | ||
| 315 | |||
| 316 | /* The next flag deliberately changes the ciphertest, this is a check | ||
| 317 | * for the PKCS#1 attack */ | ||
| 318 | #define SSL_OP_PKCS1_CHECK_1 0x08000000L | ||
| 319 | #define SSL_OP_PKCS1_CHECK_2 0x10000000L | ||
| 320 | #define SSL_OP_NETSCAPE_CA_DN_BUG 0x20000000L | ||
| 321 | /* SSL_OP_NON_EXPORT_FIRST looks utterly broken .. */ | ||
| 322 | #define SSL_OP_NON_EXPORT_FIRST 0x40000000L | ||
| 323 | #define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG 0x80000000L | ||
| 324 | #define SSL_OP_ALL 0x000FFFFFL | ||
| 325 | |||
| 326 | #define SSL_OP_NO_SSLv2 0x01000000L | ||
| 327 | #define SSL_OP_NO_SSLv3 0x02000000L | ||
| 328 | #define SSL_OP_NO_TLSv1 0x04000000L | ||
| 329 | |||
| 330 | /* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success | ||
| 331 | * when just a single record has been written): */ | ||
| 332 | #define SSL_MODE_ENABLE_PARTIAL_WRITE 0x00000001L | ||
| 333 | /* Make it possible to retry SSL_write() with changed buffer location | ||
| 334 | * (buffer contents must stay the same!); this is not the default to avoid | ||
| 335 | * the misconception that non-blocking SSL_write() behaves like | ||
| 336 | * non-blocking write(): */ | ||
| 337 | #define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L | ||
| 338 | /* Never bother the application with retries if the transport | ||
| 339 | * is blocking: */ | ||
| 340 | #define SSL_MODE_AUTO_RETRY 0x00000004L | ||
| 341 | |||
| 342 | /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, | ||
| 343 | * they cannot be used to clear bits. */ | ||
| 344 | |||
| 345 | #define SSL_CTX_set_options(ctx,op) \ | ||
| 346 | SSL_CTX_ctrl(ctx,SSL_CTRL_OPTIONS,op,NULL) | ||
| 347 | #define SSL_CTX_get_options(ctx) \ | ||
| 348 | SSL_CTX_ctrl(ctx,SSL_CTRL_OPTIONS,0,NULL) | ||
| 349 | #define SSL_set_options(ssl,op) \ | ||
| 350 | SSL_ctrl(ssl,SSL_CTRL_OPTIONS,op,NULL) | ||
| 351 | #define SSL_get_options(ssl) \ | ||
| 352 | SSL_ctrl(ssl,SSL_CTRL_OPTIONS,0,NULL) | ||
| 353 | |||
| 354 | #define SSL_CTX_set_mode(ctx,op) \ | ||
| 355 | SSL_CTX_ctrl(ctx,SSL_CTRL_MODE,op,NULL) | ||
| 356 | #define SSL_CTX_get_mode(ctx) \ | ||
| 357 | SSL_CTX_ctrl(ctx,SSL_CTRL_MODE,0,NULL) | ||
| 358 | #define SSL_set_mode(ssl,op) \ | ||
| 359 | SSL_ctrl(ssl,SSL_CTRL_MODE,op,NULL) | ||
| 360 | #define SSL_get_mode(ssl) \ | ||
| 361 | SSL_ctrl(ssl,SSL_CTRL_MODE,0,NULL) | ||
| 362 | |||
| 363 | #define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT (1024*20) | ||
| 364 | |||
| 365 | typedef struct ssl_comp_st | ||
| 366 | { | ||
| 367 | int id; | ||
| 368 | char *name; | ||
| 369 | #ifndef NO_COMP | ||
| 370 | COMP_METHOD *method; | ||
| 371 | #else | ||
| 372 | char *method; | ||
| 373 | #endif | ||
| 374 | } SSL_COMP; | ||
| 375 | |||
| 376 | DECLARE_STACK_OF(SSL_COMP) | ||
| 377 | |||
| 378 | struct ssl_ctx_st | ||
| 379 | { | ||
| 380 | SSL_METHOD *method; | ||
| 381 | unsigned long options; | ||
| 382 | unsigned long mode; | ||
| 383 | |||
| 384 | STACK_OF(SSL_CIPHER) *cipher_list; | ||
| 385 | /* same as above but sorted for lookup */ | ||
| 386 | STACK_OF(SSL_CIPHER) *cipher_list_by_id; | ||
| 387 | |||
| 388 | struct x509_store_st /* X509_STORE */ *cert_store; | ||
| 389 | struct lhash_st /* LHASH */ *sessions; /* a set of SSL_SESSIONs */ | ||
| 390 | /* Most session-ids that will be cached, default is | ||
| 391 | * SSL_SESSION_CACHE_MAX_SIZE_DEFAULT. 0 is unlimited. */ | ||
| 392 | unsigned long session_cache_size; | ||
| 393 | struct ssl_session_st *session_cache_head; | ||
| 394 | struct ssl_session_st *session_cache_tail; | ||
| 395 | |||
| 396 | /* This can have one of 2 values, ored together, | ||
| 397 | * SSL_SESS_CACHE_CLIENT, | ||
| 398 | * SSL_SESS_CACHE_SERVER, | ||
| 399 | * Default is SSL_SESSION_CACHE_SERVER, which means only | ||
| 400 | * SSL_accept which cache SSL_SESSIONS. */ | ||
| 401 | int session_cache_mode; | ||
| 402 | |||
| 403 | /* If timeout is not 0, it is the default timeout value set | ||
| 404 | * when SSL_new() is called. This has been put in to make | ||
| 405 | * life easier to set things up */ | ||
| 406 | long session_timeout; | ||
| 407 | |||
| 408 | /* If this callback is not null, it will be called each | ||
| 409 | * time a session id is added to the cache. If this function | ||
| 410 | * returns 1, it means that the callback will do a | ||
| 411 | * SSL_SESSION_free() when it has finished using it. Otherwise, | ||
| 412 | * on 0, it means the callback has finished with it. | ||
| 413 | * If remove_session_cb is not null, it will be called when | ||
| 414 | * a session-id is removed from the cache. After the call, | ||
| 415 | * OpenSSL will SSL_SESSION_free() it. */ | ||
| 416 | int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess); | ||
| 417 | void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess); | ||
| 418 | SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl, | ||
| 419 | unsigned char *data,int len,int *copy); | ||
| 420 | struct | ||
| 421 | { | ||
| 422 | int sess_connect; /* SSL new conn - started */ | ||
| 423 | int sess_connect_renegotiate;/* SSL reneg - requested */ | ||
| 424 | int sess_connect_good; /* SSL new conne/reneg - finished */ | ||
| 425 | int sess_accept; /* SSL new accept - started */ | ||
| 426 | int sess_accept_renegotiate;/* SSL reneg - requested */ | ||
| 427 | int sess_accept_good; /* SSL accept/reneg - finished */ | ||
| 428 | int sess_miss; /* session lookup misses */ | ||
| 429 | int sess_timeout; /* reuse attempt on timeouted session */ | ||
| 430 | int sess_cache_full; /* session removed due to full cache */ | ||
| 431 | int sess_hit; /* session reuse actually done */ | ||
| 432 | int sess_cb_hit; /* session-id that was not | ||
| 433 | * in the cache was | ||
| 434 | * passed back via the callback. This | ||
| 435 | * indicates that the application is | ||
| 436 | * supplying session-id's from other | ||
| 437 | * processes - spooky :-) */ | ||
| 438 | } stats; | ||
| 439 | |||
| 440 | int references; | ||
| 441 | |||
| 442 | /**/ void (*info_callback)(); | ||
| 443 | |||
| 444 | /* if defined, these override the X509_verify_cert() calls */ | ||
| 445 | /**/ int (*app_verify_callback)(); | ||
| 446 | /**/ char *app_verify_arg; /* never used; should be void * */ | ||
| 447 | |||
| 448 | /* default values to use in SSL structures */ | ||
| 449 | /**/ struct cert_st /* CERT */ *cert; | ||
| 450 | /**/ int read_ahead; | ||
| 451 | /**/ int verify_mode; | ||
| 452 | /**/ int verify_depth; | ||
| 453 | /**/ unsigned int sid_ctx_length; | ||
| 454 | /**/ unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH]; | ||
| 455 | /**/ int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx); | ||
| 456 | |||
| 457 | int purpose; /* Purpose setting */ | ||
| 458 | int trust; /* Trust setting */ | ||
| 459 | |||
| 460 | /* Default password callback. */ | ||
| 461 | /**/ pem_password_cb *default_passwd_callback; | ||
| 462 | |||
| 463 | /* Default password callback user data. */ | ||
| 464 | /**/ void *default_passwd_callback_userdata; | ||
| 465 | |||
| 466 | /* get client cert callback */ | ||
| 467 | /**/ int (*client_cert_cb)(/* SSL *ssl, X509 **x509, EVP_PKEY **pkey */); | ||
| 468 | |||
| 469 | /* what we put in client cert requests */ | ||
| 470 | STACK_OF(X509_NAME) *client_CA; | ||
| 471 | |||
| 472 | /**/ int quiet_shutdown; | ||
| 473 | |||
| 474 | CRYPTO_EX_DATA ex_data; | ||
| 475 | |||
| 476 | const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */ | ||
| 477 | const EVP_MD *md5; /* For SSLv3/TLSv1 'ssl3-md5' */ | ||
| 478 | const EVP_MD *sha1; /* For SSLv3/TLSv1 'ssl3->sha1' */ | ||
| 479 | |||
| 480 | STACK_OF(X509) *extra_certs; | ||
| 481 | STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */ | ||
| 482 | }; | ||
| 483 | |||
| 484 | #define SSL_SESS_CACHE_OFF 0x0000 | ||
| 485 | #define SSL_SESS_CACHE_CLIENT 0x0001 | ||
| 486 | #define SSL_SESS_CACHE_SERVER 0x0002 | ||
| 487 | #define SSL_SESS_CACHE_BOTH (SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER) | ||
| 488 | #define SSL_SESS_CACHE_NO_AUTO_CLEAR 0x0080 | ||
| 489 | /* This one, when set, makes the server session-id lookup not look | ||
| 490 | * in the cache. If there is an application get_session callback | ||
| 491 | * defined, this will still get called. */ | ||
| 492 | #define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP 0x0100 | ||
| 493 | |||
| 494 | struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx); | ||
| 495 | #define SSL_CTX_sess_number(ctx) \ | ||
| 496 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL) | ||
| 497 | #define SSL_CTX_sess_connect(ctx) \ | ||
| 498 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL) | ||
| 499 | #define SSL_CTX_sess_connect_good(ctx) \ | ||
| 500 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL) | ||
| 501 | #define SSL_CTX_sess_connect_renegotiate(ctx) \ | ||
| 502 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL) | ||
| 503 | #define SSL_CTX_sess_accept(ctx) \ | ||
| 504 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL) | ||
| 505 | #define SSL_CTX_sess_accept_renegotiate(ctx) \ | ||
| 506 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL) | ||
| 507 | #define SSL_CTX_sess_accept_good(ctx) \ | ||
| 508 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL) | ||
| 509 | #define SSL_CTX_sess_hits(ctx) \ | ||
| 510 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL) | ||
| 511 | #define SSL_CTX_sess_cb_hits(ctx) \ | ||
| 512 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL) | ||
| 513 | #define SSL_CTX_sess_misses(ctx) \ | ||
| 514 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL) | ||
| 515 | #define SSL_CTX_sess_timeouts(ctx) \ | ||
| 516 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL) | ||
| 517 | #define SSL_CTX_sess_cache_full(ctx) \ | ||
| 518 | SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL) | ||
| 519 | |||
| 520 | #define SSL_CTX_sess_set_new_cb(ctx,cb) ((ctx)->new_session_cb=(cb)) | ||
| 521 | #define SSL_CTX_sess_get_new_cb(ctx) ((ctx)->new_session_cb) | ||
| 522 | #define SSL_CTX_sess_set_remove_cb(ctx,cb) ((ctx)->remove_session_cb=(cb)) | ||
| 523 | #define SSL_CTX_sess_get_remove_cb(ctx) ((ctx)->remove_session_cb) | ||
| 524 | #define SSL_CTX_sess_set_get_cb(ctx,cb) ((ctx)->get_session_cb=(cb)) | ||
| 525 | #define SSL_CTX_sess_get_get_cb(ctx) ((ctx)->get_session_cb) | ||
| 526 | #define SSL_CTX_set_info_callback(ctx,cb) ((ctx)->info_callback=(cb)) | ||
| 527 | #define SSL_CTX_get_info_callback(ctx) ((ctx)->info_callback) | ||
| 528 | #define SSL_CTX_set_client_cert_cb(ctx,cb) ((ctx)->client_cert_cb=(cb)) | ||
| 529 | #define SSL_CTX_get_client_cert_cb(ctx) ((ctx)->client_cert_cb) | ||
| 530 | |||
| 531 | #define SSL_NOTHING 1 | ||
| 532 | #define SSL_WRITING 2 | ||
| 533 | #define SSL_READING 3 | ||
| 534 | #define SSL_X509_LOOKUP 4 | ||
| 535 | |||
| 536 | /* These will only be used when doing non-blocking IO */ | ||
| 537 | #define SSL_want_nothing(s) (SSL_want(s) == SSL_NOTHING) | ||
| 538 | #define SSL_want_read(s) (SSL_want(s) == SSL_READING) | ||
| 539 | #define SSL_want_write(s) (SSL_want(s) == SSL_WRITING) | ||
| 540 | #define SSL_want_x509_lookup(s) (SSL_want(s) == SSL_X509_LOOKUP) | ||
| 541 | |||
| 542 | struct ssl_st | ||
| 543 | { | ||
| 544 | /* protocol version | ||
| 545 | * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION) | ||
| 546 | */ | ||
| 547 | int version; | ||
| 548 | int type; /* SSL_ST_CONNECT or SSL_ST_ACCEPT */ | ||
| 549 | |||
| 550 | SSL_METHOD *method; /* SSLv3 */ | ||
| 551 | |||
| 552 | /* There are 2 BIO's even though they are normally both the | ||
| 553 | * same. This is so data can be read and written to different | ||
| 554 | * handlers */ | ||
| 555 | |||
| 556 | #ifndef NO_BIO | ||
| 557 | BIO *rbio; /* used by SSL_read */ | ||
| 558 | BIO *wbio; /* used by SSL_write */ | ||
| 559 | BIO *bbio; /* used during session-id reuse to concatenate | ||
| 560 | * messages */ | ||
| 561 | #else | ||
| 562 | char *rbio; /* used by SSL_read */ | ||
| 563 | char *wbio; /* used by SSL_write */ | ||
| 564 | char *bbio; | ||
| 565 | #endif | ||
| 566 | /* This holds a variable that indicates what we were doing | ||
| 567 | * when a 0 or -1 is returned. This is needed for | ||
| 568 | * non-blocking IO so we know what request needs re-doing when | ||
| 569 | * in SSL_accept or SSL_connect */ | ||
| 570 | int rwstate; | ||
| 571 | |||
| 572 | /* true when we are actually in SSL_accept() or SSL_connect() */ | ||
| 573 | int in_handshake; | ||
| 574 | int (*handshake_func)(); | ||
| 575 | |||
| 576 | /* Imagine that here's a boolean member "init" that is | ||
| 577 | * switched as soon as SSL_set_{accept/connect}_state | ||
| 578 | * is called for the first time, so that "state" and | ||
| 579 | * "handshake_func" are properly initialized. But as | ||
| 580 | * handshake_func is == 0 until then, we use this | ||
| 581 | * test instead of an "init" member. | ||
| 582 | */ | ||
| 583 | |||
| 584 | int server; /* are we the server side? - mostly used by SSL_clear*/ | ||
| 585 | |||
| 586 | int new_session;/* 1 if we are to use a new session */ | ||
| 587 | int quiet_shutdown;/* don't send shutdown packets */ | ||
| 588 | int shutdown; /* we have shut things down, 0x01 sent, 0x02 | ||
| 589 | * for received */ | ||
| 590 | int state; /* where we are */ | ||
| 591 | int rstate; /* where we are when reading */ | ||
| 592 | |||
| 593 | BUF_MEM *init_buf; /* buffer used during init */ | ||
| 594 | int init_num; /* amount read/written */ | ||
| 595 | int init_off; /* amount read/written */ | ||
| 596 | |||
| 597 | /* used internally to point at a raw packet */ | ||
| 598 | unsigned char *packet; | ||
| 599 | unsigned int packet_length; | ||
| 600 | |||
| 601 | struct ssl2_state_st *s2; /* SSLv2 variables */ | ||
| 602 | struct ssl3_state_st *s3; /* SSLv3 variables */ | ||
| 603 | |||
| 604 | int read_ahead; /* Read as many input bytes as possible | ||
| 605 | * (for non-blocking reads) */ | ||
| 606 | int hit; /* reusing a previous session */ | ||
| 607 | |||
| 608 | int purpose; /* Purpose setting */ | ||
| 609 | int trust; /* Trust setting */ | ||
| 610 | |||
| 611 | /* crypto */ | ||
| 612 | STACK_OF(SSL_CIPHER) *cipher_list; | ||
| 613 | STACK_OF(SSL_CIPHER) *cipher_list_by_id; | ||
| 614 | |||
| 615 | /* These are the ones being used, the ones in SSL_SESSION are | ||
| 616 | * the ones to be 'copied' into these ones */ | ||
| 617 | |||
| 618 | EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */ | ||
| 619 | const EVP_MD *read_hash; /* used for mac generation */ | ||
| 620 | #ifndef NO_COMP | ||
| 621 | COMP_CTX *expand; /* uncompress */ | ||
| 622 | #else | ||
| 623 | char *expand; | ||
| 624 | #endif | ||
| 625 | |||
| 626 | EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */ | ||
| 627 | const EVP_MD *write_hash; /* used for mac generation */ | ||
| 628 | #ifndef NO_COMP | ||
| 629 | COMP_CTX *compress; /* compression */ | ||
| 630 | #else | ||
| 631 | char *compress; | ||
| 632 | #endif | ||
| 633 | |||
| 634 | /* session info */ | ||
| 635 | |||
| 636 | /* client cert? */ | ||
| 637 | /* This is used to hold the server certificate used */ | ||
| 638 | struct cert_st /* CERT */ *cert; | ||
| 639 | |||
| 640 | /* the session_id_context is used to ensure sessions are only reused | ||
| 641 | * in the appropriate context */ | ||
| 642 | unsigned int sid_ctx_length; | ||
| 643 | unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH]; | ||
| 644 | |||
| 645 | /* This can also be in the session once a session is established */ | ||
| 646 | SSL_SESSION *session; | ||
| 647 | |||
| 648 | /* Used in SSL2 and SSL3 */ | ||
| 649 | int verify_mode; /* 0 don't care about verify failure. | ||
| 650 | * 1 fail if verify fails */ | ||
| 651 | int verify_depth; | ||
| 652 | int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */ | ||
| 653 | void (*info_callback)(); /* optional informational callback */ | ||
| 654 | |||
| 655 | int error; /* error bytes to be written */ | ||
| 656 | int error_code; /* actual code */ | ||
| 657 | |||
| 658 | SSL_CTX *ctx; | ||
| 659 | /* set this flag to 1 and a sleep(1) is put into all SSL_read() | ||
| 660 | * and SSL_write() calls, good for nbio debuging :-) */ | ||
| 661 | int debug; | ||
| 662 | |||
| 663 | /* extra application data */ | ||
| 664 | long verify_result; | ||
| 665 | CRYPTO_EX_DATA ex_data; | ||
| 666 | |||
| 667 | /* for server side, keep the list of CA_dn we can use */ | ||
| 668 | STACK_OF(X509_NAME) *client_CA; | ||
| 669 | |||
| 670 | int references; | ||
| 671 | unsigned long options; /* protocol behaviour */ | ||
| 672 | unsigned long mode; /* API behaviour */ | ||
| 673 | int first_packet; | ||
| 674 | int client_version; /* what was passed, used for | ||
| 675 | * SSLv3/TLS rollback check */ | ||
| 676 | }; | ||
| 677 | |||
| 678 | #ifdef __cplusplus | ||
| 679 | } | ||
| 680 | #endif | ||
| 681 | |||
| 682 | #include <openssl/ssl2.h> | ||
| 683 | #include <openssl/ssl3.h> | ||
| 684 | #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */ | ||
| 685 | #include <openssl/ssl23.h> | ||
| 686 | |||
| 687 | #ifdef __cplusplus | ||
| 688 | extern "C" { | ||
| 689 | #endif | ||
| 690 | |||
| 691 | /* compatibility */ | ||
| 692 | #define SSL_set_app_data(s,arg) (SSL_set_ex_data(s,0,(char *)arg)) | ||
| 693 | #define SSL_get_app_data(s) (SSL_get_ex_data(s,0)) | ||
| 694 | #define SSL_SESSION_set_app_data(s,a) (SSL_SESSION_set_ex_data(s,0,(char *)a)) | ||
| 695 | #define SSL_SESSION_get_app_data(s) (SSL_SESSION_get_ex_data(s,0)) | ||
| 696 | #define SSL_CTX_get_app_data(ctx) (SSL_CTX_get_ex_data(ctx,0)) | ||
| 697 | #define SSL_CTX_set_app_data(ctx,arg) (SSL_CTX_set_ex_data(ctx,0,(char *)arg)) | ||
| 698 | |||
| 699 | /* The following are the possible values for ssl->state are are | ||
| 700 | * used to indicate where we are up to in the SSL connection establishment. | ||
| 701 | * The macros that follow are about the only things you should need to use | ||
| 702 | * and even then, only when using non-blocking IO. | ||
| 703 | * It can also be useful to work out where you were when the connection | ||
| 704 | * failed */ | ||
| 705 | |||
| 706 | #define SSL_ST_CONNECT 0x1000 | ||
| 707 | #define SSL_ST_ACCEPT 0x2000 | ||
| 708 | #define SSL_ST_MASK 0x0FFF | ||
| 709 | #define SSL_ST_INIT (SSL_ST_CONNECT|SSL_ST_ACCEPT) | ||
| 710 | #define SSL_ST_BEFORE 0x4000 | ||
| 711 | #define SSL_ST_OK 0x03 | ||
| 712 | #define SSL_ST_RENEGOTIATE (0x04|SSL_ST_INIT) | ||
| 713 | |||
| 714 | #define SSL_CB_LOOP 0x01 | ||
| 715 | #define SSL_CB_EXIT 0x02 | ||
| 716 | #define SSL_CB_READ 0x04 | ||
| 717 | #define SSL_CB_WRITE 0x08 | ||
| 718 | #define SSL_CB_ALERT 0x4000 /* used in callback */ | ||
| 719 | #define SSL_CB_READ_ALERT (SSL_CB_ALERT|SSL_CB_READ) | ||
| 720 | #define SSL_CB_WRITE_ALERT (SSL_CB_ALERT|SSL_CB_WRITE) | ||
| 721 | #define SSL_CB_ACCEPT_LOOP (SSL_ST_ACCEPT|SSL_CB_LOOP) | ||
| 722 | #define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT|SSL_CB_EXIT) | ||
| 723 | #define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT|SSL_CB_LOOP) | ||
| 724 | #define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT|SSL_CB_EXIT) | ||
| 725 | #define SSL_CB_HANDSHAKE_START 0x10 | ||
| 726 | #define SSL_CB_HANDSHAKE_DONE 0x20 | ||
| 727 | |||
| 728 | /* Is the SSL_connection established? */ | ||
| 729 | #define SSL_get_state(a) SSL_state(a) | ||
| 730 | #define SSL_is_init_finished(a) (SSL_state(a) == SSL_ST_OK) | ||
| 731 | #define SSL_in_init(a) (SSL_state(a)&SSL_ST_INIT) | ||
| 732 | #define SSL_in_before(a) (SSL_state(a)&SSL_ST_BEFORE) | ||
| 733 | #define SSL_in_connect_init(a) (SSL_state(a)&SSL_ST_CONNECT) | ||
| 734 | #define SSL_in_accept_init(a) (SSL_state(a)&SSL_ST_ACCEPT) | ||
| 735 | |||
| 736 | /* The following 2 states are kept in ssl->rstate when reads fail, | ||
| 737 | * you should not need these */ | ||
| 738 | #define SSL_ST_READ_HEADER 0xF0 | ||
| 739 | #define SSL_ST_READ_BODY 0xF1 | ||
| 740 | #define SSL_ST_READ_DONE 0xF2 | ||
| 741 | |||
| 742 | /* Obtain latest Finished message | ||
| 743 | * -- that we sent (SSL_get_finished) | ||
| 744 | * -- that we expected from peer (SSL_get_peer_finished). | ||
| 745 | * Returns length (0 == no Finished so far), copies up to 'count' bytes. */ | ||
| 746 | size_t SSL_get_finished(SSL *s, void *buf, size_t count); | ||
| 747 | size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count); | ||
| 748 | |||
| 749 | /* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options | ||
| 750 | * are 'ored' with SSL_VERIFY_PEER if they are desired */ | ||
| 751 | #define SSL_VERIFY_NONE 0x00 | ||
| 752 | #define SSL_VERIFY_PEER 0x01 | ||
| 753 | #define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02 | ||
| 754 | #define SSL_VERIFY_CLIENT_ONCE 0x04 | ||
| 755 | |||
| 756 | #define OpenSSL_add_ssl_algorithms() SSL_library_init() | ||
| 757 | #define SSLeay_add_ssl_algorithms() SSL_library_init() | ||
| 758 | |||
| 759 | /* this is for backward compatibility */ | ||
| 760 | #if 0 /* NEW_SSLEAY */ | ||
| 761 | #define SSL_CTX_set_default_verify(a,b,c) SSL_CTX_set_verify(a,b,c) | ||
| 762 | #define SSL_set_pref_cipher(c,n) SSL_set_cipher_list(c,n) | ||
| 763 | #define SSL_add_session(a,b) SSL_CTX_add_session((a),(b)) | ||
| 764 | #define SSL_remove_session(a,b) SSL_CTX_remove_session((a),(b)) | ||
| 765 | #define SSL_flush_sessions(a,b) SSL_CTX_flush_sessions((a),(b)) | ||
| 766 | #endif | ||
| 767 | /* More backward compatibility */ | ||
| 768 | #define SSL_get_cipher(s) \ | ||
| 769 | SSL_CIPHER_get_name(SSL_get_current_cipher(s)) | ||
| 770 | #define SSL_get_cipher_bits(s,np) \ | ||
| 771 | SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np) | ||
| 772 | #define SSL_get_cipher_version(s) \ | ||
| 773 | SSL_CIPHER_get_version(SSL_get_current_cipher(s)) | ||
| 774 | #define SSL_get_cipher_name(s) \ | ||
| 775 | SSL_CIPHER_get_name(SSL_get_current_cipher(s)) | ||
| 776 | #define SSL_get_time(a) SSL_SESSION_get_time(a) | ||
| 777 | #define SSL_set_time(a,b) SSL_SESSION_set_time((a),(b)) | ||
| 778 | #define SSL_get_timeout(a) SSL_SESSION_get_timeout(a) | ||
| 779 | #define SSL_set_timeout(a,b) SSL_SESSION_set_timeout((a),(b)) | ||
| 780 | |||
| 781 | #if 1 /*SSLEAY_MACROS*/ | ||
| 782 | #define d2i_SSL_SESSION_bio(bp,s_id) (SSL_SESSION *)ASN1_d2i_bio( \ | ||
| 783 | (char *(*)())SSL_SESSION_new,(char *(*)())d2i_SSL_SESSION, \ | ||
| 784 | (bp),(unsigned char **)(s_id)) | ||
| 785 | #define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio(i2d_SSL_SESSION, \ | ||
| 786 | bp,(unsigned char *)s_id) | ||
| 787 | #define PEM_read_SSL_SESSION(fp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read( \ | ||
| 788 | (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,fp,(char **)x,cb,u) | ||
| 789 | #define PEM_read_bio_SSL_SESSION(bp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read_bio( \ | ||
| 790 | (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,(char **)x,cb,u) | ||
| 791 | #define PEM_write_SSL_SESSION(fp,x) \ | ||
| 792 | PEM_ASN1_write((int (*)())i2d_SSL_SESSION, \ | ||
| 793 | PEM_STRING_SSL_SESSION,fp, (char *)x, NULL,NULL,0,NULL,NULL) | ||
| 794 | #define PEM_write_bio_SSL_SESSION(bp,x) \ | ||
| 795 | PEM_ASN1_write_bio((int (*)())i2d_SSL_SESSION, \ | ||
| 796 | PEM_STRING_SSL_SESSION,bp, (char *)x, NULL,NULL,0,NULL,NULL) | ||
| 797 | #endif | ||
| 798 | |||
| 799 | #define SSL_AD_REASON_OFFSET 1000 | ||
| 800 | /* These alert types are for SSLv3 and TLSv1 */ | ||
| 801 | #define SSL_AD_CLOSE_NOTIFY SSL3_AD_CLOSE_NOTIFY | ||
| 802 | #define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE /* fatal */ | ||
| 803 | #define SSL_AD_BAD_RECORD_MAC SSL3_AD_BAD_RECORD_MAC /* fatal */ | ||
| 804 | #define SSL_AD_DECRYPTION_FAILED TLS1_AD_DECRYPTION_FAILED | ||
| 805 | #define SSL_AD_RECORD_OVERFLOW TLS1_AD_RECORD_OVERFLOW | ||
| 806 | #define SSL_AD_DECOMPRESSION_FAILURE SSL3_AD_DECOMPRESSION_FAILURE/* fatal */ | ||
| 807 | #define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE/* fatal */ | ||
| 808 | #define SSL_AD_NO_CERTIFICATE SSL3_AD_NO_CERTIFICATE /* Not for TLS */ | ||
| 809 | #define SSL_AD_BAD_CERTIFICATE SSL3_AD_BAD_CERTIFICATE | ||
| 810 | #define SSL_AD_UNSUPPORTED_CERTIFICATE SSL3_AD_UNSUPPORTED_CERTIFICATE | ||
| 811 | #define SSL_AD_CERTIFICATE_REVOKED SSL3_AD_CERTIFICATE_REVOKED | ||
| 812 | #define SSL_AD_CERTIFICATE_EXPIRED SSL3_AD_CERTIFICATE_EXPIRED | ||
| 813 | #define SSL_AD_CERTIFICATE_UNKNOWN SSL3_AD_CERTIFICATE_UNKNOWN | ||
| 814 | #define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER /* fatal */ | ||
| 815 | #define SSL_AD_UNKNOWN_CA TLS1_AD_UNKNOWN_CA /* fatal */ | ||
| 816 | #define SSL_AD_ACCESS_DENIED TLS1_AD_ACCESS_DENIED /* fatal */ | ||
| 817 | #define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR /* fatal */ | ||
| 818 | #define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR | ||
| 819 | #define SSL_AD_EXPORT_RESTRICTION TLS1_AD_EXPORT_RESTRICTION/* fatal */ | ||
| 820 | #define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION /* fatal */ | ||
| 821 | #define SSL_AD_INSUFFICIENT_SECURITY TLS1_AD_INSUFFICIENT_SECURITY/* fatal */ | ||
| 822 | #define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR /* fatal */ | ||
| 823 | #define SSL_AD_USER_CANCELLED TLS1_AD_USER_CANCELLED | ||
| 824 | #define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION | ||
| 825 | |||
| 826 | #define SSL_ERROR_NONE 0 | ||
| 827 | #define SSL_ERROR_SSL 1 | ||
| 828 | #define SSL_ERROR_WANT_READ 2 | ||
| 829 | #define SSL_ERROR_WANT_WRITE 3 | ||
| 830 | #define SSL_ERROR_WANT_X509_LOOKUP 4 | ||
| 831 | #define SSL_ERROR_SYSCALL 5 /* look at error stack/return value/errno */ | ||
| 832 | #define SSL_ERROR_ZERO_RETURN 6 | ||
| 833 | #define SSL_ERROR_WANT_CONNECT 7 | ||
| 834 | |||
| 835 | #define SSL_CTRL_NEED_TMP_RSA 1 | ||
| 836 | #define SSL_CTRL_SET_TMP_RSA 2 | ||
| 837 | #define SSL_CTRL_SET_TMP_DH 3 | ||
| 838 | #define SSL_CTRL_SET_TMP_RSA_CB 4 | ||
| 839 | #define SSL_CTRL_SET_TMP_DH_CB 5 | ||
| 840 | /* Add these ones */ | ||
| 841 | #define SSL_CTRL_GET_SESSION_REUSED 6 | ||
| 842 | #define SSL_CTRL_GET_CLIENT_CERT_REQUEST 7 | ||
| 843 | #define SSL_CTRL_GET_NUM_RENEGOTIATIONS 8 | ||
| 844 | #define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS 9 | ||
| 845 | #define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS 10 | ||
| 846 | #define SSL_CTRL_GET_FLAGS 11 | ||
| 847 | #define SSL_CTRL_EXTRA_CHAIN_CERT 12 | ||
| 848 | |||
| 849 | /* Stats */ | ||
| 850 | #define SSL_CTRL_SESS_NUMBER 20 | ||
| 851 | #define SSL_CTRL_SESS_CONNECT 21 | ||
| 852 | #define SSL_CTRL_SESS_CONNECT_GOOD 22 | ||
| 853 | #define SSL_CTRL_SESS_CONNECT_RENEGOTIATE 23 | ||
| 854 | #define SSL_CTRL_SESS_ACCEPT 24 | ||
| 855 | #define SSL_CTRL_SESS_ACCEPT_GOOD 25 | ||
| 856 | #define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE 26 | ||
| 857 | #define SSL_CTRL_SESS_HIT 27 | ||
| 858 | #define SSL_CTRL_SESS_CB_HIT 28 | ||
| 859 | #define SSL_CTRL_SESS_MISSES 29 | ||
| 860 | #define SSL_CTRL_SESS_TIMEOUTS 30 | ||
| 861 | #define SSL_CTRL_SESS_CACHE_FULL 31 | ||
| 862 | #define SSL_CTRL_OPTIONS 32 | ||
| 863 | #define SSL_CTRL_MODE 33 | ||
| 864 | |||
| 865 | #define SSL_CTRL_GET_READ_AHEAD 40 | ||
| 866 | #define SSL_CTRL_SET_READ_AHEAD 41 | ||
| 867 | #define SSL_CTRL_SET_SESS_CACHE_SIZE 42 | ||
| 868 | #define SSL_CTRL_GET_SESS_CACHE_SIZE 43 | ||
| 869 | #define SSL_CTRL_SET_SESS_CACHE_MODE 44 | ||
| 870 | #define SSL_CTRL_GET_SESS_CACHE_MODE 45 | ||
| 871 | |||
| 872 | #define SSL_session_reused(ssl) \ | ||
| 873 | SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL) | ||
| 874 | #define SSL_num_renegotiations(ssl) \ | ||
| 875 | SSL_ctrl((ssl),SSL_CTRL_GET_NUM_RENEGOTIATIONS,0,NULL) | ||
| 876 | #define SSL_clear_num_renegotiations(ssl) \ | ||
| 877 | SSL_ctrl((ssl),SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS,0,NULL) | ||
| 878 | #define SSL_total_renegotiations(ssl) \ | ||
| 879 | SSL_ctrl((ssl),SSL_CTRL_GET_TOTAL_RENEGOTIATIONS,0,NULL) | ||
| 880 | |||
| 881 | #define SSL_CTX_need_tmp_RSA(ctx) \ | ||
| 882 | SSL_CTX_ctrl(ctx,SSL_CTRL_NEED_TMP_RSA,0,NULL) | ||
| 883 | #define SSL_CTX_set_tmp_rsa(ctx,rsa) \ | ||
| 884 | SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa) | ||
| 885 | #define SSL_CTX_set_tmp_dh(ctx,dh) \ | ||
| 886 | SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh) | ||
| 887 | |||
| 888 | #define SSL_need_tmp_RSA(ssl) \ | ||
| 889 | SSL_ctrl(ssl,SSL_CTRL_NEED_TMP_RSA,0,NULL) | ||
| 890 | #define SSL_set_tmp_rsa(ssl,rsa) \ | ||
| 891 | SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa) | ||
| 892 | #define SSL_set_tmp_dh(ssl,dh) \ | ||
| 893 | SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)dh) | ||
| 894 | |||
| 895 | #define SSL_CTX_add_extra_chain_cert(ctx,x509) \ | ||
| 896 | SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509) | ||
| 897 | |||
| 898 | /* VMS uses only 31 characters for symbols. */ | ||
| 899 | #ifdef VMS | ||
| 900 | #undef SSL_CTX_set_cert_verify_callback | ||
| 901 | #define SSL_CTX_set_cert_verify_callback SSL_CTX_set_cert_verify_cb | ||
| 902 | #undef SSL_CTX_use_certificate_chain_file | ||
| 903 | #define SSL_CTX_use_certificate_chain_file SSL_CTX_use_cert_chain_file | ||
| 904 | #undef SSL_CTX_set_default_verify_paths | ||
| 905 | #define SSL_CTX_set_default_verify_paths SSL_CTX_set_def_verify_paths | ||
| 906 | #undef SSL_get_ex_data_X509_STORE_CTX_idx | ||
| 907 | #define SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_ex_data_X509_STOR_CTX_i | ||
| 908 | #undef SSL_add_file_cert_subjects_to_stack | ||
| 909 | #define SSL_add_file_cert_subjects_to_stack SSL_add_file_cert_sub_to_stack | ||
| 910 | #undef SSL_add_dir_cert_subjects_to_stack | ||
| 911 | #define SSL_add_dir_cert_subjects_to_stack SSL_add_dir_cert_sub_to_stack | ||
| 912 | #endif | ||
| 913 | |||
| 914 | #ifndef NO_BIO | ||
| 915 | BIO_METHOD *BIO_f_ssl(void); | ||
| 916 | BIO *BIO_new_ssl(SSL_CTX *ctx,int client); | ||
| 917 | BIO *BIO_new_ssl_connect(SSL_CTX *ctx); | ||
| 918 | BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx); | ||
| 919 | int BIO_ssl_copy_session_id(BIO *to,BIO *from); | ||
| 920 | void BIO_ssl_shutdown(BIO *ssl_bio); | ||
| 921 | |||
| 922 | #endif | ||
| 923 | |||
| 924 | int SSL_CTX_set_cipher_list(SSL_CTX *,const char *str); | ||
| 925 | SSL_CTX *SSL_CTX_new(SSL_METHOD *meth); | ||
| 926 | void SSL_CTX_free(SSL_CTX *); | ||
| 927 | long SSL_CTX_set_timeout(SSL_CTX *ctx,long t); | ||
| 928 | long SSL_CTX_get_timeout(SSL_CTX *ctx); | ||
| 929 | X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *); | ||
| 930 | void SSL_CTX_set_cert_store(SSL_CTX *,X509_STORE *); | ||
| 931 | int SSL_want(SSL *s); | ||
| 932 | int SSL_clear(SSL *s); | ||
| 933 | |||
| 934 | void SSL_CTX_flush_sessions(SSL_CTX *ctx,long tm); | ||
| 935 | |||
| 936 | SSL_CIPHER *SSL_get_current_cipher(SSL *s); | ||
| 937 | int SSL_CIPHER_get_bits(SSL_CIPHER *c,int *alg_bits); | ||
| 938 | char * SSL_CIPHER_get_version(SSL_CIPHER *c); | ||
| 939 | const char * SSL_CIPHER_get_name(SSL_CIPHER *c); | ||
| 940 | |||
| 941 | int SSL_get_fd(SSL *s); | ||
| 942 | const char * SSL_get_cipher_list(SSL *s,int n); | ||
| 943 | char * SSL_get_shared_ciphers(SSL *s, char *buf, int len); | ||
| 944 | int SSL_get_read_ahead(SSL * s); | ||
| 945 | int SSL_pending(SSL *s); | ||
| 946 | #ifndef NO_SOCK | ||
| 947 | int SSL_set_fd(SSL *s, int fd); | ||
| 948 | int SSL_set_rfd(SSL *s, int fd); | ||
| 949 | int SSL_set_wfd(SSL *s, int fd); | ||
| 950 | #endif | ||
| 951 | #ifndef NO_BIO | ||
| 952 | void SSL_set_bio(SSL *s, BIO *rbio,BIO *wbio); | ||
| 953 | BIO * SSL_get_rbio(SSL *s); | ||
| 954 | BIO * SSL_get_wbio(SSL *s); | ||
| 955 | #endif | ||
| 956 | int SSL_set_cipher_list(SSL *s, const char *str); | ||
| 957 | void SSL_set_read_ahead(SSL *s, int yes); | ||
| 958 | int SSL_get_verify_mode(SSL *s); | ||
| 959 | int SSL_get_verify_depth(SSL *s); | ||
| 960 | int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *); | ||
| 961 | void SSL_set_verify(SSL *s, int mode, | ||
| 962 | int (*callback)(int ok,X509_STORE_CTX *ctx)); | ||
| 963 | void SSL_set_verify_depth(SSL *s, int depth); | ||
| 964 | #ifndef NO_RSA | ||
| 965 | int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa); | ||
| 966 | #endif | ||
| 967 | int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len); | ||
| 968 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey); | ||
| 969 | int SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, unsigned char *d, long len); | ||
| 970 | int SSL_use_certificate(SSL *ssl, X509 *x); | ||
| 971 | int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len); | ||
| 972 | |||
| 973 | #ifndef NO_STDIO | ||
| 974 | int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type); | ||
| 975 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type); | ||
| 976 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type); | ||
| 977 | int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type); | ||
| 978 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type); | ||
| 979 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type); | ||
| 980 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); /* PEM type */ | ||
| 981 | STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file); | ||
| 982 | int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, | ||
| 983 | const char *file); | ||
| 984 | int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, | ||
| 985 | const char *dir); | ||
| 986 | #endif | ||
| 987 | |||
| 988 | void ERR_load_SSL_strings(void ); | ||
| 989 | void SSL_load_error_strings(void ); | ||
| 990 | char * SSL_state_string(SSL *s); | ||
| 991 | char * SSL_rstate_string(SSL *s); | ||
| 992 | char * SSL_state_string_long(SSL *s); | ||
| 993 | char * SSL_rstate_string_long(SSL *s); | ||
| 994 | long SSL_SESSION_get_time(SSL_SESSION *s); | ||
| 995 | long SSL_SESSION_set_time(SSL_SESSION *s, long t); | ||
| 996 | long SSL_SESSION_get_timeout(SSL_SESSION *s); | ||
| 997 | long SSL_SESSION_set_timeout(SSL_SESSION *s, long t); | ||
| 998 | void SSL_copy_session_id(SSL *to,SSL *from); | ||
| 999 | |||
| 1000 | SSL_SESSION *SSL_SESSION_new(void); | ||
| 1001 | unsigned long SSL_SESSION_hash(SSL_SESSION *a); | ||
| 1002 | int SSL_SESSION_cmp(SSL_SESSION *a,SSL_SESSION *b); | ||
| 1003 | #ifndef NO_FP_API | ||
| 1004 | int SSL_SESSION_print_fp(FILE *fp,SSL_SESSION *ses); | ||
| 1005 | #endif | ||
| 1006 | #ifndef NO_BIO | ||
| 1007 | int SSL_SESSION_print(BIO *fp,SSL_SESSION *ses); | ||
| 1008 | #endif | ||
| 1009 | void SSL_SESSION_free(SSL_SESSION *ses); | ||
| 1010 | int i2d_SSL_SESSION(SSL_SESSION *in,unsigned char **pp); | ||
| 1011 | int SSL_set_session(SSL *to, SSL_SESSION *session); | ||
| 1012 | int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c); | ||
| 1013 | int SSL_CTX_remove_session(SSL_CTX *,SSL_SESSION *c); | ||
| 1014 | SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a,unsigned char **pp,long length); | ||
| 1015 | |||
| 1016 | #ifdef HEADER_X509_H | ||
| 1017 | X509 * SSL_get_peer_certificate(SSL *s); | ||
| 1018 | #endif | ||
| 1019 | |||
| 1020 | STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s); | ||
| 1021 | |||
| 1022 | #ifdef VMS | ||
| 1023 | #define SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_def_passwd_cb_ud | ||
| 1024 | #endif | ||
| 1025 | |||
| 1026 | int SSL_CTX_get_verify_mode(SSL_CTX *ctx); | ||
| 1027 | int SSL_CTX_get_verify_depth(SSL_CTX *ctx); | ||
| 1028 | int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *); | ||
| 1029 | void SSL_CTX_set_verify(SSL_CTX *ctx,int mode, | ||
| 1030 | int (*callback)(int, X509_STORE_CTX *)); | ||
| 1031 | void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth); | ||
| 1032 | void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(),char *arg); | ||
| 1033 | #ifndef NO_RSA | ||
| 1034 | int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa); | ||
| 1035 | #endif | ||
| 1036 | int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len); | ||
| 1037 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey); | ||
| 1038 | int SSL_CTX_use_PrivateKey_ASN1(int pk,SSL_CTX *ctx, | ||
| 1039 | unsigned char *d, long len); | ||
| 1040 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); | ||
| 1041 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d); | ||
| 1042 | |||
| 1043 | void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb); | ||
| 1044 | void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u); | ||
| 1045 | |||
| 1046 | int SSL_CTX_check_private_key(SSL_CTX *ctx); | ||
| 1047 | int SSL_check_private_key(SSL *ctx); | ||
| 1048 | |||
| 1049 | int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx, | ||
| 1050 | unsigned int sid_ctx_len); | ||
| 1051 | |||
| 1052 | SSL * SSL_new(SSL_CTX *ctx); | ||
| 1053 | int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx, | ||
| 1054 | unsigned int sid_ctx_len); | ||
| 1055 | |||
| 1056 | int SSL_CTX_set_purpose(SSL_CTX *s, int purpose); | ||
| 1057 | int SSL_set_purpose(SSL *s, int purpose); | ||
| 1058 | int SSL_CTX_set_trust(SSL_CTX *s, int trust); | ||
| 1059 | int SSL_set_trust(SSL *s, int trust); | ||
| 1060 | |||
| 1061 | void SSL_free(SSL *ssl); | ||
| 1062 | int SSL_accept(SSL *ssl); | ||
| 1063 | int SSL_connect(SSL *ssl); | ||
| 1064 | int SSL_read(SSL *ssl,void *buf,int num); | ||
| 1065 | int SSL_peek(SSL *ssl,void *buf,int num); | ||
| 1066 | int SSL_write(SSL *ssl,const void *buf,int num); | ||
| 1067 | long SSL_ctrl(SSL *ssl,int cmd, long larg, char *parg); | ||
| 1068 | long SSL_callback_ctrl(SSL *, int, void (*)()); | ||
| 1069 | long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd, long larg, char *parg); | ||
| 1070 | long SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)()); | ||
| 1071 | |||
| 1072 | int SSL_get_error(SSL *s,int ret_code); | ||
| 1073 | const char *SSL_get_version(SSL *s); | ||
| 1074 | |||
| 1075 | /* This sets the 'default' SSL version that SSL_new() will create */ | ||
| 1076 | int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth); | ||
| 1077 | |||
| 1078 | SSL_METHOD *SSLv2_method(void); /* SSLv2 */ | ||
| 1079 | SSL_METHOD *SSLv2_server_method(void); /* SSLv2 */ | ||
| 1080 | SSL_METHOD *SSLv2_client_method(void); /* SSLv2 */ | ||
| 1081 | |||
| 1082 | SSL_METHOD *SSLv3_method(void); /* SSLv3 */ | ||
| 1083 | SSL_METHOD *SSLv3_server_method(void); /* SSLv3 */ | ||
| 1084 | SSL_METHOD *SSLv3_client_method(void); /* SSLv3 */ | ||
| 1085 | |||
| 1086 | SSL_METHOD *SSLv23_method(void); /* SSLv3 but can rollback to v2 */ | ||
| 1087 | SSL_METHOD *SSLv23_server_method(void); /* SSLv3 but can rollback to v2 */ | ||
| 1088 | SSL_METHOD *SSLv23_client_method(void); /* SSLv3 but can rollback to v2 */ | ||
| 1089 | |||
| 1090 | SSL_METHOD *TLSv1_method(void); /* TLSv1.0 */ | ||
| 1091 | SSL_METHOD *TLSv1_server_method(void); /* TLSv1.0 */ | ||
| 1092 | SSL_METHOD *TLSv1_client_method(void); /* TLSv1.0 */ | ||
| 1093 | |||
| 1094 | STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s); | ||
| 1095 | |||
| 1096 | int SSL_do_handshake(SSL *s); | ||
| 1097 | int SSL_renegotiate(SSL *s); | ||
| 1098 | int SSL_shutdown(SSL *s); | ||
| 1099 | |||
| 1100 | SSL_METHOD *SSL_get_ssl_method(SSL *s); | ||
| 1101 | int SSL_set_ssl_method(SSL *s,SSL_METHOD *method); | ||
| 1102 | char *SSL_alert_type_string_long(int value); | ||
| 1103 | char *SSL_alert_type_string(int value); | ||
| 1104 | char *SSL_alert_desc_string_long(int value); | ||
| 1105 | char *SSL_alert_desc_string(int value); | ||
| 1106 | |||
| 1107 | void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list); | ||
| 1108 | void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list); | ||
| 1109 | STACK_OF(X509_NAME) *SSL_get_client_CA_list(SSL *s); | ||
| 1110 | STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(SSL_CTX *s); | ||
| 1111 | int SSL_add_client_CA(SSL *ssl,X509 *x); | ||
| 1112 | int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x); | ||
| 1113 | |||
| 1114 | void SSL_set_connect_state(SSL *s); | ||
| 1115 | void SSL_set_accept_state(SSL *s); | ||
| 1116 | |||
| 1117 | long SSL_get_default_timeout(SSL *s); | ||
| 1118 | |||
| 1119 | int SSL_library_init(void ); | ||
| 1120 | |||
| 1121 | char *SSL_CIPHER_description(SSL_CIPHER *,char *buf,int size); | ||
| 1122 | STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk); | ||
| 1123 | |||
| 1124 | SSL *SSL_dup(SSL *ssl); | ||
| 1125 | |||
| 1126 | X509 *SSL_get_certificate(SSL *ssl); | ||
| 1127 | /* EVP_PKEY */ struct evp_pkey_st *SSL_get_privatekey(SSL *ssl); | ||
| 1128 | |||
| 1129 | void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode); | ||
| 1130 | int SSL_CTX_get_quiet_shutdown(SSL_CTX *ctx); | ||
| 1131 | void SSL_set_quiet_shutdown(SSL *ssl,int mode); | ||
| 1132 | int SSL_get_quiet_shutdown(SSL *ssl); | ||
| 1133 | void SSL_set_shutdown(SSL *ssl,int mode); | ||
| 1134 | int SSL_get_shutdown(SSL *ssl); | ||
| 1135 | int SSL_version(SSL *ssl); | ||
| 1136 | int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx); | ||
| 1137 | int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, | ||
| 1138 | const char *CApath); | ||
| 1139 | #define SSL_get0_session SSL_get_session /* just peek at pointer */ | ||
| 1140 | SSL_SESSION *SSL_get_session(SSL *ssl); | ||
| 1141 | SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */ | ||
| 1142 | SSL_CTX *SSL_get_SSL_CTX(SSL *ssl); | ||
| 1143 | void SSL_set_info_callback(SSL *ssl,void (*cb)()); | ||
| 1144 | void (*SSL_get_info_callback(SSL *ssl))(); | ||
| 1145 | int SSL_state(SSL *ssl); | ||
| 1146 | |||
| 1147 | void SSL_set_verify_result(SSL *ssl,long v); | ||
| 1148 | long SSL_get_verify_result(SSL *ssl); | ||
| 1149 | |||
| 1150 | int SSL_set_ex_data(SSL *ssl,int idx,void *data); | ||
| 1151 | void *SSL_get_ex_data(SSL *ssl,int idx); | ||
| 1152 | int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, | ||
| 1153 | CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); | ||
| 1154 | |||
| 1155 | int SSL_SESSION_set_ex_data(SSL_SESSION *ss,int idx,void *data); | ||
| 1156 | void *SSL_SESSION_get_ex_data(SSL_SESSION *ss,int idx); | ||
| 1157 | int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, | ||
| 1158 | CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); | ||
| 1159 | |||
| 1160 | int SSL_CTX_set_ex_data(SSL_CTX *ssl,int idx,void *data); | ||
| 1161 | void *SSL_CTX_get_ex_data(SSL_CTX *ssl,int idx); | ||
| 1162 | int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, | ||
| 1163 | CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); | ||
| 1164 | |||
| 1165 | int SSL_get_ex_data_X509_STORE_CTX_idx(void ); | ||
| 1166 | |||
| 1167 | #define SSL_CTX_sess_set_cache_size(ctx,t) \ | ||
| 1168 | SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_SIZE,t,NULL) | ||
| 1169 | #define SSL_CTX_sess_get_cache_size(ctx) \ | ||
| 1170 | SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_SIZE,0,NULL) | ||
| 1171 | #define SSL_CTX_set_session_cache_mode(ctx,m) \ | ||
| 1172 | SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL) | ||
| 1173 | #define SSL_CTX_get_session_cache_mode(ctx) \ | ||
| 1174 | SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL) | ||
| 1175 | |||
| 1176 | #define SSL_CTX_get_default_read_ahead(ctx) SSL_CTX_get_read_ahead(ctx) | ||
| 1177 | #define SSL_CTX_set_default_read_ahead(ctx,m) SSL_CTX_set_read_ahead(ctx,m) | ||
| 1178 | #define SSL_CTX_get_read_ahead(ctx) \ | ||
| 1179 | SSL_CTX_ctrl(ctx,SSL_CTRL_GET_READ_AHEAD,0,NULL) | ||
| 1180 | #define SSL_CTX_set_read_ahead(ctx,m) \ | ||
| 1181 | SSL_CTX_ctrl(ctx,SSL_CTRL_SET_READ_AHEAD,m,NULL) | ||
| 1182 | |||
| 1183 | /* NB: the keylength is only applicable when is_export is true */ | ||
| 1184 | #ifndef NO_RSA | ||
| 1185 | void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx, | ||
| 1186 | RSA *(*cb)(SSL *ssl,int is_export, | ||
| 1187 | int keylength)); | ||
| 1188 | |||
| 1189 | void SSL_set_tmp_rsa_callback(SSL *ssl, | ||
| 1190 | RSA *(*cb)(SSL *ssl,int is_export, | ||
| 1191 | int keylength)); | ||
| 1192 | #endif | ||
| 1193 | #ifndef NO_DH | ||
| 1194 | void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, | ||
| 1195 | DH *(*dh)(SSL *ssl,int is_export, | ||
| 1196 | int keylength)); | ||
| 1197 | void SSL_set_tmp_dh_callback(SSL *ssl, | ||
| 1198 | DH *(*dh)(SSL *ssl,int is_export, | ||
| 1199 | int keylength)); | ||
| 1200 | #endif | ||
| 1201 | |||
| 1202 | #ifndef NO_COMP | ||
| 1203 | int SSL_COMP_add_compression_method(int id,COMP_METHOD *cm); | ||
| 1204 | #else | ||
| 1205 | int SSL_COMP_add_compression_method(int id,char *cm); | ||
| 1206 | #endif | ||
| 1207 | |||
| 1208 | /* BEGIN ERROR CODES */ | ||
| 1209 | /* The following lines are auto generated by the script mkerr.pl. Any changes | ||
| 1210 | * made after this point may be overwritten when the script is next run. | ||
| 1211 | */ | ||
| 1212 | void ERR_load_SSL_strings(void); | ||
| 1213 | |||
| 1214 | /* Error codes for the SSL functions. */ | ||
| 1215 | |||
| 1216 | /* Function codes. */ | ||
| 1217 | #define SSL_F_CLIENT_CERTIFICATE 100 | ||
| 1218 | #define SSL_F_CLIENT_HELLO 101 | ||
| 1219 | #define SSL_F_CLIENT_MASTER_KEY 102 | ||
| 1220 | #define SSL_F_D2I_SSL_SESSION 103 | ||
| 1221 | #define SSL_F_DO_SSL3_WRITE 104 | ||
| 1222 | #define SSL_F_GET_CLIENT_FINISHED 105 | ||
| 1223 | #define SSL_F_GET_CLIENT_HELLO 106 | ||
| 1224 | #define SSL_F_GET_CLIENT_MASTER_KEY 107 | ||
| 1225 | #define SSL_F_GET_SERVER_FINISHED 108 | ||
| 1226 | #define SSL_F_GET_SERVER_HELLO 109 | ||
| 1227 | #define SSL_F_GET_SERVER_VERIFY 110 | ||
| 1228 | #define SSL_F_I2D_SSL_SESSION 111 | ||
| 1229 | #define SSL_F_READ_N 112 | ||
| 1230 | #define SSL_F_REQUEST_CERTIFICATE 113 | ||
| 1231 | #define SSL_F_SERVER_HELLO 114 | ||
| 1232 | #define SSL_F_SSL23_ACCEPT 115 | ||
| 1233 | #define SSL_F_SSL23_CLIENT_HELLO 116 | ||
| 1234 | #define SSL_F_SSL23_CONNECT 117 | ||
| 1235 | #define SSL_F_SSL23_GET_CLIENT_HELLO 118 | ||
| 1236 | #define SSL_F_SSL23_GET_SERVER_HELLO 119 | ||
| 1237 | #define SSL_F_SSL23_PEEK 237 | ||
| 1238 | #define SSL_F_SSL23_READ 120 | ||
| 1239 | #define SSL_F_SSL23_WRITE 121 | ||
| 1240 | #define SSL_F_SSL2_ACCEPT 122 | ||
| 1241 | #define SSL_F_SSL2_CONNECT 123 | ||
| 1242 | #define SSL_F_SSL2_ENC_INIT 124 | ||
| 1243 | #define SSL_F_SSL2_PEEK 234 | ||
| 1244 | #define SSL_F_SSL2_READ 125 | ||
| 1245 | #define SSL_F_SSL2_READ_INTERNAL 236 | ||
| 1246 | #define SSL_F_SSL2_SET_CERTIFICATE 126 | ||
| 1247 | #define SSL_F_SSL2_WRITE 127 | ||
| 1248 | #define SSL_F_SSL3_ACCEPT 128 | ||
| 1249 | #define SSL_F_SSL3_CALLBACK_CTRL 233 | ||
| 1250 | #define SSL_F_SSL3_CHANGE_CIPHER_STATE 129 | ||
| 1251 | #define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130 | ||
| 1252 | #define SSL_F_SSL3_CLIENT_HELLO 131 | ||
| 1253 | #define SSL_F_SSL3_CONNECT 132 | ||
| 1254 | #define SSL_F_SSL3_CTRL 213 | ||
| 1255 | #define SSL_F_SSL3_CTX_CTRL 133 | ||
| 1256 | #define SSL_F_SSL3_ENC 134 | ||
| 1257 | #define SSL_F_SSL3_GET_CERTIFICATE_REQUEST 135 | ||
| 1258 | #define SSL_F_SSL3_GET_CERT_VERIFY 136 | ||
| 1259 | #define SSL_F_SSL3_GET_CLIENT_CERTIFICATE 137 | ||
| 1260 | #define SSL_F_SSL3_GET_CLIENT_HELLO 138 | ||
| 1261 | #define SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE 139 | ||
| 1262 | #define SSL_F_SSL3_GET_FINISHED 140 | ||
| 1263 | #define SSL_F_SSL3_GET_KEY_EXCHANGE 141 | ||
| 1264 | #define SSL_F_SSL3_GET_MESSAGE 142 | ||
| 1265 | #define SSL_F_SSL3_GET_RECORD 143 | ||
| 1266 | #define SSL_F_SSL3_GET_SERVER_CERTIFICATE 144 | ||
| 1267 | #define SSL_F_SSL3_GET_SERVER_DONE 145 | ||
| 1268 | #define SSL_F_SSL3_GET_SERVER_HELLO 146 | ||
| 1269 | #define SSL_F_SSL3_OUTPUT_CERT_CHAIN 147 | ||
| 1270 | #define SSL_F_SSL3_PEEK 235 | ||
| 1271 | #define SSL_F_SSL3_READ_BYTES 148 | ||
| 1272 | #define SSL_F_SSL3_READ_N 149 | ||
| 1273 | #define SSL_F_SSL3_SEND_CERTIFICATE_REQUEST 150 | ||
| 1274 | #define SSL_F_SSL3_SEND_CLIENT_CERTIFICATE 151 | ||
| 1275 | #define SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE 152 | ||
| 1276 | #define SSL_F_SSL3_SEND_CLIENT_VERIFY 153 | ||
| 1277 | #define SSL_F_SSL3_SEND_SERVER_CERTIFICATE 154 | ||
| 1278 | #define SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE 155 | ||
| 1279 | #define SSL_F_SSL3_SETUP_BUFFERS 156 | ||
| 1280 | #define SSL_F_SSL3_SETUP_KEY_BLOCK 157 | ||
| 1281 | #define SSL_F_SSL3_WRITE_BYTES 158 | ||
| 1282 | #define SSL_F_SSL3_WRITE_PENDING 159 | ||
| 1283 | #define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK 215 | ||
| 1284 | #define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK 216 | ||
| 1285 | #define SSL_F_SSL_BAD_METHOD 160 | ||
| 1286 | #define SSL_F_SSL_BYTES_TO_CIPHER_LIST 161 | ||
| 1287 | #define SSL_F_SSL_CERT_DUP 221 | ||
| 1288 | #define SSL_F_SSL_CERT_INST 222 | ||
| 1289 | #define SSL_F_SSL_CERT_INSTANTIATE 214 | ||
| 1290 | #define SSL_F_SSL_CERT_NEW 162 | ||
| 1291 | #define SSL_F_SSL_CHECK_PRIVATE_KEY 163 | ||
| 1292 | #define SSL_F_SSL_CIPHER_PROCESS_RULESTR 230 | ||
| 1293 | #define SSL_F_SSL_CIPHER_STRENGTH_SORT 231 | ||
| 1294 | #define SSL_F_SSL_CLEAR 164 | ||
| 1295 | #define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD 165 | ||
| 1296 | #define SSL_F_SSL_CREATE_CIPHER_LIST 166 | ||
| 1297 | #define SSL_F_SSL_CTRL 232 | ||
| 1298 | #define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY 168 | ||
| 1299 | #define SSL_F_SSL_CTX_NEW 169 | ||
| 1300 | #define SSL_F_SSL_CTX_SET_PURPOSE 226 | ||
| 1301 | #define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT 219 | ||
| 1302 | #define SSL_F_SSL_CTX_SET_SSL_VERSION 170 | ||
| 1303 | #define SSL_F_SSL_CTX_SET_TRUST 229 | ||
| 1304 | #define SSL_F_SSL_CTX_USE_CERTIFICATE 171 | ||
| 1305 | #define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1 172 | ||
| 1306 | #define SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE 220 | ||
| 1307 | #define SSL_F_SSL_CTX_USE_CERTIFICATE_FILE 173 | ||
| 1308 | #define SSL_F_SSL_CTX_USE_PRIVATEKEY 174 | ||
| 1309 | #define SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1 175 | ||
| 1310 | #define SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE 176 | ||
| 1311 | #define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY 177 | ||
| 1312 | #define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1 178 | ||
| 1313 | #define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE 179 | ||
| 1314 | #define SSL_F_SSL_DO_HANDSHAKE 180 | ||
| 1315 | #define SSL_F_SSL_GET_NEW_SESSION 181 | ||
| 1316 | #define SSL_F_SSL_GET_PREV_SESSION 217 | ||
| 1317 | #define SSL_F_SSL_GET_SERVER_SEND_CERT 182 | ||
| 1318 | #define SSL_F_SSL_GET_SIGN_PKEY 183 | ||
| 1319 | #define SSL_F_SSL_INIT_WBIO_BUFFER 184 | ||
| 1320 | #define SSL_F_SSL_LOAD_CLIENT_CA_FILE 185 | ||
| 1321 | #define SSL_F_SSL_NEW 186 | ||
| 1322 | #define SSL_F_SSL_READ 223 | ||
| 1323 | #define SSL_F_SSL_RSA_PRIVATE_DECRYPT 187 | ||
| 1324 | #define SSL_F_SSL_RSA_PUBLIC_ENCRYPT 188 | ||
| 1325 | #define SSL_F_SSL_SESSION_NEW 189 | ||
| 1326 | #define SSL_F_SSL_SESSION_PRINT_FP 190 | ||
| 1327 | #define SSL_F_SSL_SESS_CERT_NEW 225 | ||
| 1328 | #define SSL_F_SSL_SET_CERT 191 | ||
| 1329 | #define SSL_F_SSL_SET_FD 192 | ||
| 1330 | #define SSL_F_SSL_SET_PKEY 193 | ||
| 1331 | #define SSL_F_SSL_SET_PURPOSE 227 | ||
| 1332 | #define SSL_F_SSL_SET_RFD 194 | ||
| 1333 | #define SSL_F_SSL_SET_SESSION 195 | ||
| 1334 | #define SSL_F_SSL_SET_SESSION_ID_CONTEXT 218 | ||
| 1335 | #define SSL_F_SSL_SET_TRUST 228 | ||
| 1336 | #define SSL_F_SSL_SET_WFD 196 | ||
| 1337 | #define SSL_F_SSL_SHUTDOWN 224 | ||
| 1338 | #define SSL_F_SSL_UNDEFINED_FUNCTION 197 | ||
| 1339 | #define SSL_F_SSL_USE_CERTIFICATE 198 | ||
| 1340 | #define SSL_F_SSL_USE_CERTIFICATE_ASN1 199 | ||
| 1341 | #define SSL_F_SSL_USE_CERTIFICATE_FILE 200 | ||
| 1342 | #define SSL_F_SSL_USE_PRIVATEKEY 201 | ||
| 1343 | #define SSL_F_SSL_USE_PRIVATEKEY_ASN1 202 | ||
| 1344 | #define SSL_F_SSL_USE_PRIVATEKEY_FILE 203 | ||
| 1345 | #define SSL_F_SSL_USE_RSAPRIVATEKEY 204 | ||
| 1346 | #define SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1 205 | ||
| 1347 | #define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 206 | ||
| 1348 | #define SSL_F_SSL_VERIFY_CERT_CHAIN 207 | ||
| 1349 | #define SSL_F_SSL_WRITE 208 | ||
| 1350 | #define SSL_F_TLS1_CHANGE_CIPHER_STATE 209 | ||
| 1351 | #define SSL_F_TLS1_ENC 210 | ||
| 1352 | #define SSL_F_TLS1_SETUP_KEY_BLOCK 211 | ||
| 1353 | #define SSL_F_WRITE_PENDING 212 | ||
| 1354 | |||
| 1355 | /* Reason codes. */ | ||
| 1356 | #define SSL_R_APP_DATA_IN_HANDSHAKE 100 | ||
| 1357 | #define SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT 272 | ||
| 1358 | #define SSL_R_BAD_ALERT_RECORD 101 | ||
| 1359 | #define SSL_R_BAD_AUTHENTICATION_TYPE 102 | ||
| 1360 | #define SSL_R_BAD_CHANGE_CIPHER_SPEC 103 | ||
| 1361 | #define SSL_R_BAD_CHECKSUM 104 | ||
| 1362 | #define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK 106 | ||
| 1363 | #define SSL_R_BAD_DECOMPRESSION 107 | ||
| 1364 | #define SSL_R_BAD_DH_G_LENGTH 108 | ||
| 1365 | #define SSL_R_BAD_DH_PUB_KEY_LENGTH 109 | ||
| 1366 | #define SSL_R_BAD_DH_P_LENGTH 110 | ||
| 1367 | #define SSL_R_BAD_DIGEST_LENGTH 111 | ||
| 1368 | #define SSL_R_BAD_DSA_SIGNATURE 112 | ||
| 1369 | #define SSL_R_BAD_HELLO_REQUEST 105 | ||
| 1370 | #define SSL_R_BAD_LENGTH 271 | ||
| 1371 | #define SSL_R_BAD_MAC_DECODE 113 | ||
| 1372 | #define SSL_R_BAD_MESSAGE_TYPE 114 | ||
| 1373 | #define SSL_R_BAD_PACKET_LENGTH 115 | ||
| 1374 | #define SSL_R_BAD_PROTOCOL_VERSION_NUMBER 116 | ||
| 1375 | #define SSL_R_BAD_RESPONSE_ARGUMENT 117 | ||
| 1376 | #define SSL_R_BAD_RSA_DECRYPT 118 | ||
| 1377 | #define SSL_R_BAD_RSA_ENCRYPT 119 | ||
| 1378 | #define SSL_R_BAD_RSA_E_LENGTH 120 | ||
| 1379 | #define SSL_R_BAD_RSA_MODULUS_LENGTH 121 | ||
| 1380 | #define SSL_R_BAD_RSA_SIGNATURE 122 | ||
| 1381 | #define SSL_R_BAD_SIGNATURE 123 | ||
| 1382 | #define SSL_R_BAD_SSL_FILETYPE 124 | ||
| 1383 | #define SSL_R_BAD_SSL_SESSION_ID_LENGTH 125 | ||
| 1384 | #define SSL_R_BAD_STATE 126 | ||
| 1385 | #define SSL_R_BAD_WRITE_RETRY 127 | ||
| 1386 | #define SSL_R_BIO_NOT_SET 128 | ||
| 1387 | #define SSL_R_BLOCK_CIPHER_PAD_IS_WRONG 129 | ||
| 1388 | #define SSL_R_BN_LIB 130 | ||
| 1389 | #define SSL_R_CA_DN_LENGTH_MISMATCH 131 | ||
| 1390 | #define SSL_R_CA_DN_TOO_LONG 132 | ||
| 1391 | #define SSL_R_CCS_RECEIVED_EARLY 133 | ||
| 1392 | #define SSL_R_CERTIFICATE_VERIFY_FAILED 134 | ||
| 1393 | #define SSL_R_CERT_LENGTH_MISMATCH 135 | ||
| 1394 | #define SSL_R_CHALLENGE_IS_DIFFERENT 136 | ||
| 1395 | #define SSL_R_CIPHER_CODE_WRONG_LENGTH 137 | ||
| 1396 | #define SSL_R_CIPHER_OR_HASH_UNAVAILABLE 138 | ||
| 1397 | #define SSL_R_CIPHER_TABLE_SRC_ERROR 139 | ||
| 1398 | #define SSL_R_COMPRESSED_LENGTH_TOO_LONG 140 | ||
| 1399 | #define SSL_R_COMPRESSION_FAILURE 141 | ||
| 1400 | #define SSL_R_COMPRESSION_LIBRARY_ERROR 142 | ||
| 1401 | #define SSL_R_CONNECTION_ID_IS_DIFFERENT 143 | ||
| 1402 | #define SSL_R_CONNECTION_TYPE_NOT_SET 144 | ||
| 1403 | #define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED 145 | ||
| 1404 | #define SSL_R_DATA_LENGTH_TOO_LONG 146 | ||
| 1405 | #define SSL_R_DECRYPTION_FAILED 147 | ||
| 1406 | #define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG 148 | ||
| 1407 | #define SSL_R_DIGEST_CHECK_FAILED 149 | ||
| 1408 | #define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 150 | ||
| 1409 | #define SSL_R_ERROR_GENERATING_TMP_RSA_KEY 1092 | ||
| 1410 | #define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 151 | ||
| 1411 | #define SSL_R_EXCESSIVE_MESSAGE_SIZE 152 | ||
| 1412 | #define SSL_R_EXTRA_DATA_IN_MESSAGE 153 | ||
| 1413 | #define SSL_R_GOT_A_FIN_BEFORE_A_CCS 154 | ||
| 1414 | #define SSL_R_HTTPS_PROXY_REQUEST 155 | ||
| 1415 | #define SSL_R_HTTP_REQUEST 156 | ||
| 1416 | #define SSL_R_INTERNAL_ERROR 157 | ||
| 1417 | #define SSL_R_INVALID_CHALLENGE_LENGTH 158 | ||
| 1418 | #define SSL_R_INVALID_COMMAND 280 | ||
| 1419 | #define SSL_R_INVALID_PURPOSE 278 | ||
| 1420 | #define SSL_R_INVALID_TRUST 279 | ||
| 1421 | #define SSL_R_LENGTH_MISMATCH 159 | ||
| 1422 | #define SSL_R_LENGTH_TOO_SHORT 160 | ||
| 1423 | #define SSL_R_LIBRARY_BUG 274 | ||
| 1424 | #define SSL_R_LIBRARY_HAS_NO_CIPHERS 161 | ||
| 1425 | #define SSL_R_MISSING_DH_DSA_CERT 162 | ||
| 1426 | #define SSL_R_MISSING_DH_KEY 163 | ||
| 1427 | #define SSL_R_MISSING_DH_RSA_CERT 164 | ||
| 1428 | #define SSL_R_MISSING_DSA_SIGNING_CERT 165 | ||
| 1429 | #define SSL_R_MISSING_EXPORT_TMP_DH_KEY 166 | ||
| 1430 | #define SSL_R_MISSING_EXPORT_TMP_RSA_KEY 167 | ||
| 1431 | #define SSL_R_MISSING_RSA_CERTIFICATE 168 | ||
| 1432 | #define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169 | ||
| 1433 | #define SSL_R_MISSING_RSA_SIGNING_CERT 170 | ||
| 1434 | #define SSL_R_MISSING_TMP_DH_KEY 171 | ||
| 1435 | #define SSL_R_MISSING_TMP_RSA_KEY 172 | ||
| 1436 | #define SSL_R_MISSING_TMP_RSA_PKEY 173 | ||
| 1437 | #define SSL_R_MISSING_VERIFY_MESSAGE 174 | ||
| 1438 | #define SSL_R_NON_SSLV2_INITIAL_PACKET 175 | ||
| 1439 | #define SSL_R_NO_CERTIFICATES_RETURNED 176 | ||
| 1440 | #define SSL_R_NO_CERTIFICATE_ASSIGNED 177 | ||
| 1441 | #define SSL_R_NO_CERTIFICATE_RETURNED 178 | ||
| 1442 | #define SSL_R_NO_CERTIFICATE_SET 179 | ||
| 1443 | #define SSL_R_NO_CERTIFICATE_SPECIFIED 180 | ||
| 1444 | #define SSL_R_NO_CIPHERS_AVAILABLE 181 | ||
| 1445 | #define SSL_R_NO_CIPHERS_PASSED 182 | ||
| 1446 | #define SSL_R_NO_CIPHERS_SPECIFIED 183 | ||
| 1447 | #define SSL_R_NO_CIPHER_LIST 184 | ||
| 1448 | #define SSL_R_NO_CIPHER_MATCH 185 | ||
| 1449 | #define SSL_R_NO_CLIENT_CERT_RECEIVED 186 | ||
| 1450 | #define SSL_R_NO_COMPRESSION_SPECIFIED 187 | ||
| 1451 | #define SSL_R_NO_METHOD_SPECIFIED 188 | ||
| 1452 | #define SSL_R_NO_PRIVATEKEY 189 | ||
| 1453 | #define SSL_R_NO_PRIVATE_KEY_ASSIGNED 190 | ||
| 1454 | #define SSL_R_NO_PROTOCOLS_AVAILABLE 191 | ||
| 1455 | #define SSL_R_NO_PUBLICKEY 192 | ||
| 1456 | #define SSL_R_NO_SHARED_CIPHER 193 | ||
| 1457 | #define SSL_R_NO_VERIFY_CALLBACK 194 | ||
| 1458 | #define SSL_R_NULL_SSL_CTX 195 | ||
| 1459 | #define SSL_R_NULL_SSL_METHOD_PASSED 196 | ||
| 1460 | #define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED 197 | ||
| 1461 | #define SSL_R_PACKET_LENGTH_TOO_LONG 198 | ||
| 1462 | #define SSL_R_PATH_TOO_LONG 270 | ||
| 1463 | #define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE 199 | ||
| 1464 | #define SSL_R_PEER_ERROR 200 | ||
| 1465 | #define SSL_R_PEER_ERROR_CERTIFICATE 201 | ||
| 1466 | #define SSL_R_PEER_ERROR_NO_CERTIFICATE 202 | ||
| 1467 | #define SSL_R_PEER_ERROR_NO_CIPHER 203 | ||
| 1468 | #define SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE 204 | ||
| 1469 | #define SSL_R_PRE_MAC_LENGTH_TOO_LONG 205 | ||
| 1470 | #define SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS 206 | ||
| 1471 | #define SSL_R_PROTOCOL_IS_SHUTDOWN 207 | ||
| 1472 | #define SSL_R_PUBLIC_KEY_ENCRYPT_ERROR 208 | ||
| 1473 | #define SSL_R_PUBLIC_KEY_IS_NOT_RSA 209 | ||
| 1474 | #define SSL_R_PUBLIC_KEY_NOT_RSA 210 | ||
| 1475 | #define SSL_R_READ_BIO_NOT_SET 211 | ||
| 1476 | #define SSL_R_READ_WRONG_PACKET_TYPE 212 | ||
| 1477 | #define SSL_R_RECORD_LENGTH_MISMATCH 213 | ||
| 1478 | #define SSL_R_RECORD_TOO_LARGE 214 | ||
| 1479 | #define SSL_R_RECORD_TOO_SMALL 1093 | ||
| 1480 | #define SSL_R_REQUIRED_CIPHER_MISSING 215 | ||
| 1481 | #define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO 216 | ||
| 1482 | #define SSL_R_REUSE_CERT_TYPE_NOT_ZERO 217 | ||
| 1483 | #define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO 218 | ||
| 1484 | #define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277 | ||
| 1485 | #define SSL_R_SHORT_READ 219 | ||
| 1486 | #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220 | ||
| 1487 | #define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221 | ||
| 1488 | #define SSL_R_SSL3_SESSION_ID_TOO_SHORT 222 | ||
| 1489 | #define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 1042 | ||
| 1490 | #define SSL_R_SSLV3_ALERT_BAD_RECORD_MAC 1020 | ||
| 1491 | #define SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED 1045 | ||
| 1492 | #define SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED 1044 | ||
| 1493 | #define SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN 1046 | ||
| 1494 | #define SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE 1030 | ||
| 1495 | #define SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE 1040 | ||
| 1496 | #define SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER 1047 | ||
| 1497 | #define SSL_R_SSLV3_ALERT_NO_CERTIFICATE 1041 | ||
| 1498 | #define SSL_R_SSLV3_ALERT_PEER_ERROR_CERTIFICATE 223 | ||
| 1499 | #define SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CERTIFICATE 224 | ||
| 1500 | #define SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CIPHER 225 | ||
| 1501 | #define SSL_R_SSLV3_ALERT_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE 226 | ||
| 1502 | #define SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010 | ||
| 1503 | #define SSL_R_SSLV3_ALERT_UNKNOWN_REMOTE_ERROR_TYPE 227 | ||
| 1504 | #define SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE 1043 | ||
| 1505 | #define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228 | ||
| 1506 | #define SSL_R_SSL_HANDSHAKE_FAILURE 229 | ||
| 1507 | #define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS 230 | ||
| 1508 | #define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG 273 | ||
| 1509 | #define SSL_R_SSL_SESSION_ID_IS_DIFFERENT 231 | ||
| 1510 | #define SSL_R_TLSV1_ALERT_ACCESS_DENIED 1049 | ||
| 1511 | #define SSL_R_TLSV1_ALERT_DECODE_ERROR 1050 | ||
| 1512 | #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 | ||
| 1513 | #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 | ||
| 1514 | #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 | ||
| 1515 | #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 | ||
| 1516 | #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 | ||
| 1517 | #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 | ||
| 1518 | #define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION 1070 | ||
| 1519 | #define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW 1022 | ||
| 1520 | #define SSL_R_TLSV1_ALERT_UNKNOWN_CA 1048 | ||
| 1521 | #define SSL_R_TLSV1_ALERT_USER_CANCELLED 1090 | ||
| 1522 | #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER 232 | ||
| 1523 | #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233 | ||
| 1524 | #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG 234 | ||
| 1525 | #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER 235 | ||
| 1526 | #define SSL_R_UNABLE_TO_DECODE_DH_CERTS 236 | ||
| 1527 | #define SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY 237 | ||
| 1528 | #define SSL_R_UNABLE_TO_FIND_DH_PARAMETERS 238 | ||
| 1529 | #define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS 239 | ||
| 1530 | #define SSL_R_UNABLE_TO_FIND_SSL_METHOD 240 | ||
| 1531 | #define SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES 241 | ||
| 1532 | #define SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES 242 | ||
| 1533 | #define SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES 243 | ||
| 1534 | #define SSL_R_UNEXPECTED_MESSAGE 244 | ||
| 1535 | #define SSL_R_UNEXPECTED_RECORD 245 | ||
| 1536 | #define SSL_R_UNINITIALIZED 276 | ||
| 1537 | #define SSL_R_UNKNOWN_ALERT_TYPE 246 | ||
| 1538 | #define SSL_R_UNKNOWN_CERTIFICATE_TYPE 247 | ||
| 1539 | #define SSL_R_UNKNOWN_CIPHER_RETURNED 248 | ||
| 1540 | #define SSL_R_UNKNOWN_CIPHER_TYPE 249 | ||
| 1541 | #define SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE 250 | ||
| 1542 | #define SSL_R_UNKNOWN_PKEY_TYPE 251 | ||
| 1543 | #define SSL_R_UNKNOWN_PROTOCOL 252 | ||
| 1544 | #define SSL_R_UNKNOWN_REMOTE_ERROR_TYPE 253 | ||
| 1545 | #define SSL_R_UNKNOWN_SSL_VERSION 254 | ||
| 1546 | #define SSL_R_UNKNOWN_STATE 255 | ||
| 1547 | #define SSL_R_UNSUPPORTED_CIPHER 256 | ||
| 1548 | #define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM 257 | ||
| 1549 | #define SSL_R_UNSUPPORTED_OPTION 1091 | ||
| 1550 | #define SSL_R_UNSUPPORTED_PROTOCOL 258 | ||
| 1551 | #define SSL_R_UNSUPPORTED_SSL_VERSION 259 | ||
| 1552 | #define SSL_R_WRITE_BIO_NOT_SET 260 | ||
| 1553 | #define SSL_R_WRONG_CIPHER_RETURNED 261 | ||
| 1554 | #define SSL_R_WRONG_MESSAGE_TYPE 262 | ||
| 1555 | #define SSL_R_WRONG_NUMBER_OF_KEY_BITS 263 | ||
| 1556 | #define SSL_R_WRONG_SIGNATURE_LENGTH 264 | ||
| 1557 | #define SSL_R_WRONG_SIGNATURE_SIZE 265 | ||
| 1558 | #define SSL_R_WRONG_SSL_VERSION 266 | ||
| 1559 | #define SSL_R_WRONG_VERSION_NUMBER 267 | ||
| 1560 | #define SSL_R_X509_LIB 268 | ||
| 1561 | #define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS 269 | ||
| 1562 | |||
| 1563 | #ifdef __cplusplus | ||
| 1564 | } | ||
| 1565 | #endif | ||
| 1566 | #endif | ||
diff --git a/src/lib/libssl/ssl2.h b/src/lib/libssl/ssl2.h deleted file mode 100644 index f8b56afb6b..0000000000 --- a/src/lib/libssl/ssl2.h +++ /dev/null | |||
| @@ -1,269 +0,0 @@ | |||
| 1 | /* ssl/ssl2.h */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #ifndef HEADER_SSL2_H | ||
| 60 | #define HEADER_SSL2_H | ||
| 61 | |||
| 62 | #ifdef __cplusplus | ||
| 63 | extern "C" { | ||
| 64 | #endif | ||
| 65 | |||
| 66 | /* Protocol Version Codes */ | ||
| 67 | #define SSL2_VERSION 0x0002 | ||
| 68 | #define SSL2_VERSION_MAJOR 0x00 | ||
| 69 | #define SSL2_VERSION_MINOR 0x02 | ||
| 70 | /* #define SSL2_CLIENT_VERSION 0x0002 */ | ||
| 71 | /* #define SSL2_SERVER_VERSION 0x0002 */ | ||
| 72 | |||
| 73 | /* Protocol Message Codes */ | ||
| 74 | #define SSL2_MT_ERROR 0 | ||
| 75 | #define SSL2_MT_CLIENT_HELLO 1 | ||
| 76 | #define SSL2_MT_CLIENT_MASTER_KEY 2 | ||
| 77 | #define SSL2_MT_CLIENT_FINISHED 3 | ||
| 78 | #define SSL2_MT_SERVER_HELLO 4 | ||
| 79 | #define SSL2_MT_SERVER_VERIFY 5 | ||
| 80 | #define SSL2_MT_SERVER_FINISHED 6 | ||
| 81 | #define SSL2_MT_REQUEST_CERTIFICATE 7 | ||
| 82 | #define SSL2_MT_CLIENT_CERTIFICATE 8 | ||
| 83 | |||
| 84 | /* Error Message Codes */ | ||
| 85 | #define SSL2_PE_UNDEFINED_ERROR 0x0000 | ||
| 86 | #define SSL2_PE_NO_CIPHER 0x0001 | ||
| 87 | #define SSL2_PE_NO_CERTIFICATE 0x0002 | ||
| 88 | #define SSL2_PE_BAD_CERTIFICATE 0x0004 | ||
| 89 | #define SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE 0x0006 | ||
| 90 | |||
| 91 | /* Cipher Kind Values */ | ||
| 92 | #define SSL2_CK_NULL_WITH_MD5 0x02000000 /* v3 */ | ||
| 93 | #define SSL2_CK_RC4_128_WITH_MD5 0x02010080 | ||
| 94 | #define SSL2_CK_RC4_128_EXPORT40_WITH_MD5 0x02020080 | ||
| 95 | #define SSL2_CK_RC2_128_CBC_WITH_MD5 0x02030080 | ||
| 96 | #define SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5 0x02040080 | ||
| 97 | #define SSL2_CK_IDEA_128_CBC_WITH_MD5 0x02050080 | ||
| 98 | #define SSL2_CK_DES_64_CBC_WITH_MD5 0x02060040 | ||
| 99 | #define SSL2_CK_DES_64_CBC_WITH_SHA 0x02060140 /* v3 */ | ||
| 100 | #define SSL2_CK_DES_192_EDE3_CBC_WITH_MD5 0x020700c0 | ||
| 101 | #define SSL2_CK_DES_192_EDE3_CBC_WITH_SHA 0x020701c0 /* v3 */ | ||
| 102 | #define SSL2_CK_RC4_64_WITH_MD5 0x02080080 /* MS hack */ | ||
| 103 | |||
| 104 | #define SSL2_CK_DES_64_CFB64_WITH_MD5_1 0x02ff0800 /* SSLeay */ | ||
| 105 | #define SSL2_CK_NULL 0x02ff0810 /* SSLeay */ | ||
| 106 | |||
| 107 | #define SSL2_TXT_DES_64_CFB64_WITH_MD5_1 "DES-CFB-M1" | ||
| 108 | #define SSL2_TXT_NULL_WITH_MD5 "NULL-MD5" | ||
| 109 | #define SSL2_TXT_RC4_128_WITH_MD5 "RC4-MD5" | ||
| 110 | #define SSL2_TXT_RC4_128_EXPORT40_WITH_MD5 "EXP-RC4-MD5" | ||
| 111 | #define SSL2_TXT_RC2_128_CBC_WITH_MD5 "RC2-CBC-MD5" | ||
| 112 | #define SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 "EXP-RC2-CBC-MD5" | ||
| 113 | #define SSL2_TXT_IDEA_128_CBC_WITH_MD5 "IDEA-CBC-MD5" | ||
| 114 | #define SSL2_TXT_DES_64_CBC_WITH_MD5 "DES-CBC-MD5" | ||
| 115 | #define SSL2_TXT_DES_64_CBC_WITH_SHA "DES-CBC-SHA" | ||
| 116 | #define SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5 "DES-CBC3-MD5" | ||
| 117 | #define SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA "DES-CBC3-SHA" | ||
| 118 | #define SSL2_TXT_RC4_64_WITH_MD5 "RC4-64-MD5" | ||
| 119 | |||
| 120 | #define SSL2_TXT_NULL "NULL" | ||
| 121 | |||
| 122 | /* Flags for the SSL_CIPHER.algorithm2 field */ | ||
| 123 | #define SSL2_CF_5_BYTE_ENC 0x01 | ||
| 124 | #define SSL2_CF_8_BYTE_ENC 0x02 | ||
| 125 | |||
| 126 | /* Certificate Type Codes */ | ||
| 127 | #define SSL2_CT_X509_CERTIFICATE 0x01 | ||
| 128 | |||
| 129 | /* Authentication Type Code */ | ||
| 130 | #define SSL2_AT_MD5_WITH_RSA_ENCRYPTION 0x01 | ||
| 131 | |||
| 132 | #define SSL2_MAX_SSL_SESSION_ID_LENGTH 32 | ||
| 133 | |||
| 134 | /* Upper/Lower Bounds */ | ||
| 135 | #define SSL2_MAX_MASTER_KEY_LENGTH_IN_BITS 256 | ||
| 136 | #ifdef MPE | ||
| 137 | #define SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER 29998u | ||
| 138 | #else | ||
| 139 | #define SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER 32767u /* 2^15-1 */ | ||
| 140 | #endif | ||
| 141 | #define SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER 16383 /* 2^14-1 */ | ||
| 142 | |||
| 143 | #define SSL2_CHALLENGE_LENGTH 16 | ||
| 144 | /*#define SSL2_CHALLENGE_LENGTH 32 */ | ||
| 145 | #define SSL2_MIN_CHALLENGE_LENGTH 16 | ||
| 146 | #define SSL2_MAX_CHALLENGE_LENGTH 32 | ||
| 147 | #define SSL2_CONNECTION_ID_LENGTH 16 | ||
| 148 | #define SSL2_MAX_CONNECTION_ID_LENGTH 16 | ||
| 149 | #define SSL2_SSL_SESSION_ID_LENGTH 16 | ||
| 150 | #define SSL2_MAX_CERT_CHALLENGE_LENGTH 32 | ||
| 151 | #define SSL2_MIN_CERT_CHALLENGE_LENGTH 16 | ||
| 152 | #define SSL2_MAX_KEY_MATERIAL_LENGTH 24 | ||
| 153 | |||
| 154 | #ifndef HEADER_SSL_LOCL_H | ||
| 155 | #define CERT char | ||
| 156 | #endif | ||
| 157 | |||
| 158 | typedef struct ssl2_state_st | ||
| 159 | { | ||
| 160 | int three_byte_header; | ||
| 161 | int clear_text; /* clear text */ | ||
| 162 | int escape; /* not used in SSLv2 */ | ||
| 163 | int ssl2_rollback; /* used if SSLv23 rolled back to SSLv2 */ | ||
| 164 | |||
| 165 | /* non-blocking io info, used to make sure the same | ||
| 166 | * args were passwd */ | ||
| 167 | unsigned int wnum; /* number of bytes sent so far */ | ||
| 168 | int wpend_tot; | ||
| 169 | const unsigned char *wpend_buf; | ||
| 170 | |||
| 171 | int wpend_off; /* offset to data to write */ | ||
| 172 | int wpend_len; /* number of bytes passwd to write */ | ||
| 173 | int wpend_ret; /* number of bytes to return to caller */ | ||
| 174 | |||
| 175 | /* buffer raw data */ | ||
| 176 | int rbuf_left; | ||
| 177 | int rbuf_offs; | ||
| 178 | unsigned char *rbuf; | ||
| 179 | unsigned char *wbuf; | ||
| 180 | |||
| 181 | unsigned char *write_ptr;/* used to point to the start due to | ||
| 182 | * 2/3 byte header. */ | ||
| 183 | |||
| 184 | unsigned int padding; | ||
| 185 | unsigned int rlength; /* passed to ssl2_enc */ | ||
| 186 | int ract_data_length; /* Set when things are encrypted. */ | ||
| 187 | unsigned int wlength; /* passed to ssl2_enc */ | ||
| 188 | int wact_data_length; /* Set when things are decrypted. */ | ||
| 189 | unsigned char *ract_data; | ||
| 190 | unsigned char *wact_data; | ||
| 191 | unsigned char *mac_data; | ||
| 192 | unsigned char *pad_data; | ||
| 193 | |||
| 194 | unsigned char *read_key; | ||
| 195 | unsigned char *write_key; | ||
| 196 | |||
| 197 | /* Stuff specifically to do with this SSL session */ | ||
| 198 | unsigned int challenge_length; | ||
| 199 | unsigned char challenge[SSL2_MAX_CHALLENGE_LENGTH]; | ||
| 200 | unsigned int conn_id_length; | ||
| 201 | unsigned char conn_id[SSL2_MAX_CONNECTION_ID_LENGTH]; | ||
| 202 | unsigned int key_material_length; | ||
| 203 | unsigned char key_material[SSL2_MAX_KEY_MATERIAL_LENGTH*2]; | ||
| 204 | |||
| 205 | unsigned long read_sequence; | ||
| 206 | unsigned long write_sequence; | ||
| 207 | |||
| 208 | struct { | ||
| 209 | unsigned int conn_id_length; | ||
| 210 | unsigned int cert_type; | ||
| 211 | unsigned int cert_length; | ||
| 212 | int csl; | ||
| 213 | int clear; | ||
| 214 | unsigned int enc; | ||
| 215 | unsigned char ccl[SSL2_MAX_CERT_CHALLENGE_LENGTH]; | ||
| 216 | int cipher_spec_length; | ||
| 217 | unsigned int session_id_length; | ||
| 218 | unsigned int clen; | ||
| 219 | unsigned int rlen; | ||
| 220 | } tmp; | ||
| 221 | } SSL2_STATE; | ||
| 222 | |||
| 223 | /* SSLv2 */ | ||
| 224 | /* client */ | ||
| 225 | #define SSL2_ST_SEND_CLIENT_HELLO_A (0x10|SSL_ST_CONNECT) | ||
| 226 | #define SSL2_ST_SEND_CLIENT_HELLO_B (0x11|SSL_ST_CONNECT) | ||
| 227 | #define SSL2_ST_GET_SERVER_HELLO_A (0x20|SSL_ST_CONNECT) | ||
| 228 | #define SSL2_ST_GET_SERVER_HELLO_B (0x21|SSL_ST_CONNECT) | ||
| 229 | #define SSL2_ST_SEND_CLIENT_MASTER_KEY_A (0x30|SSL_ST_CONNECT) | ||
| 230 | #define SSL2_ST_SEND_CLIENT_MASTER_KEY_B (0x31|SSL_ST_CONNECT) | ||
| 231 | #define SSL2_ST_SEND_CLIENT_FINISHED_A (0x40|SSL_ST_CONNECT) | ||
| 232 | #define SSL2_ST_SEND_CLIENT_FINISHED_B (0x41|SSL_ST_CONNECT) | ||
| 233 | #define SSL2_ST_SEND_CLIENT_CERTIFICATE_A (0x50|SSL_ST_CONNECT) | ||
| 234 | #define SSL2_ST_SEND_CLIENT_CERTIFICATE_B (0x51|SSL_ST_CONNECT) | ||
| 235 | #define SSL2_ST_SEND_CLIENT_CERTIFICATE_C (0x52|SSL_ST_CONNECT) | ||
| 236 | #define SSL2_ST_SEND_CLIENT_CERTIFICATE_D (0x53|SSL_ST_CONNECT) | ||
| 237 | #define SSL2_ST_GET_SERVER_VERIFY_A (0x60|SSL_ST_CONNECT) | ||
| 238 | #define SSL2_ST_GET_SERVER_VERIFY_B (0x61|SSL_ST_CONNECT) | ||
| 239 | #define SSL2_ST_GET_SERVER_FINISHED_A (0x70|SSL_ST_CONNECT) | ||
| 240 | #define SSL2_ST_GET_SERVER_FINISHED_B (0x71|SSL_ST_CONNECT) | ||
| 241 | #define SSL2_ST_CLIENT_START_ENCRYPTION (0x80|SSL_ST_CONNECT) | ||
| 242 | #define SSL2_ST_X509_GET_CLIENT_CERTIFICATE (0x90|SSL_ST_CONNECT) | ||
| 243 | /* server */ | ||
| 244 | #define SSL2_ST_GET_CLIENT_HELLO_A (0x10|SSL_ST_ACCEPT) | ||
| 245 | #define SSL2_ST_GET_CLIENT_HELLO_B (0x11|SSL_ST_ACCEPT) | ||
| 246 | #define SSL2_ST_GET_CLIENT_HELLO_C (0x12|SSL_ST_ACCEPT) | ||
| 247 | #define SSL2_ST_SEND_SERVER_HELLO_A (0x20|SSL_ST_ACCEPT) | ||
| 248 | #define SSL2_ST_SEND_SERVER_HELLO_B (0x21|SSL_ST_ACCEPT) | ||
| 249 | #define SSL2_ST_GET_CLIENT_MASTER_KEY_A (0x30|SSL_ST_ACCEPT) | ||
| 250 | #define SSL2_ST_GET_CLIENT_MASTER_KEY_B (0x31|SSL_ST_ACCEPT) | ||
| 251 | #define SSL2_ST_SEND_SERVER_VERIFY_A (0x40|SSL_ST_ACCEPT) | ||
| 252 | #define SSL2_ST_SEND_SERVER_VERIFY_B (0x41|SSL_ST_ACCEPT) | ||
| 253 | #define SSL2_ST_SEND_SERVER_VERIFY_C (0x42|SSL_ST_ACCEPT) | ||
| 254 | #define SSL2_ST_GET_CLIENT_FINISHED_A (0x50|SSL_ST_ACCEPT) | ||
| 255 | #define SSL2_ST_GET_CLIENT_FINISHED_B (0x51|SSL_ST_ACCEPT) | ||
| 256 | #define SSL2_ST_SEND_SERVER_FINISHED_A (0x60|SSL_ST_ACCEPT) | ||
| 257 | #define SSL2_ST_SEND_SERVER_FINISHED_B (0x61|SSL_ST_ACCEPT) | ||
| 258 | #define SSL2_ST_SEND_REQUEST_CERTIFICATE_A (0x70|SSL_ST_ACCEPT) | ||
| 259 | #define SSL2_ST_SEND_REQUEST_CERTIFICATE_B (0x71|SSL_ST_ACCEPT) | ||
| 260 | #define SSL2_ST_SEND_REQUEST_CERTIFICATE_C (0x72|SSL_ST_ACCEPT) | ||
| 261 | #define SSL2_ST_SEND_REQUEST_CERTIFICATE_D (0x73|SSL_ST_ACCEPT) | ||
| 262 | #define SSL2_ST_SERVER_START_ENCRYPTION (0x80|SSL_ST_ACCEPT) | ||
| 263 | #define SSL2_ST_X509_GET_SERVER_CERTIFICATE (0x90|SSL_ST_ACCEPT) | ||
| 264 | |||
| 265 | #ifdef __cplusplus | ||
| 266 | } | ||
| 267 | #endif | ||
| 268 | #endif | ||
| 269 | |||
diff --git a/src/lib/libssl/ssl23.h b/src/lib/libssl/ssl23.h deleted file mode 100644 index d3228983c7..0000000000 --- a/src/lib/libssl/ssl23.h +++ /dev/null | |||
| @@ -1,83 +0,0 @@ | |||
| 1 | /* ssl/ssl23.h */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #ifndef HEADER_SSL23_H | ||
| 60 | #define HEADER_SSL23_H | ||
| 61 | |||
| 62 | #ifdef __cplusplus | ||
| 63 | extern "C" { | ||
| 64 | #endif | ||
| 65 | |||
| 66 | /*client */ | ||
| 67 | /* write to server */ | ||
| 68 | #define SSL23_ST_CW_CLNT_HELLO_A (0x210|SSL_ST_CONNECT) | ||
| 69 | #define SSL23_ST_CW_CLNT_HELLO_B (0x211|SSL_ST_CONNECT) | ||
| 70 | /* read from server */ | ||
| 71 | #define SSL23_ST_CR_SRVR_HELLO_A (0x220|SSL_ST_CONNECT) | ||
| 72 | #define SSL23_ST_CR_SRVR_HELLO_B (0x221|SSL_ST_CONNECT) | ||
| 73 | |||
| 74 | /* server */ | ||
| 75 | /* read from client */ | ||
| 76 | #define SSL23_ST_SR_CLNT_HELLO_A (0x210|SSL_ST_ACCEPT) | ||
| 77 | #define SSL23_ST_SR_CLNT_HELLO_B (0x211|SSL_ST_ACCEPT) | ||
| 78 | |||
| 79 | #ifdef __cplusplus | ||
| 80 | } | ||
| 81 | #endif | ||
| 82 | #endif | ||
| 83 | |||
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h deleted file mode 100644 index 7ee1feaa67..0000000000 --- a/src/lib/libssl/ssl3.h +++ /dev/null | |||
| @@ -1,429 +0,0 @@ | |||
| 1 | /* ssl/ssl3.h */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #ifndef HEADER_SSL3_H | ||
| 60 | #define HEADER_SSL3_H | ||
| 61 | |||
| 62 | #ifndef NO_COMP | ||
| 63 | #include <openssl/comp.h> | ||
| 64 | #endif | ||
| 65 | #include <openssl/buffer.h> | ||
| 66 | #include <openssl/evp.h> | ||
| 67 | #include <openssl/ssl.h> | ||
| 68 | |||
| 69 | #ifdef __cplusplus | ||
| 70 | extern "C" { | ||
| 71 | #endif | ||
| 72 | |||
| 73 | #define SSL3_CK_RSA_NULL_MD5 0x03000001 | ||
| 74 | #define SSL3_CK_RSA_NULL_SHA 0x03000002 | ||
| 75 | #define SSL3_CK_RSA_RC4_40_MD5 0x03000003 | ||
| 76 | #define SSL3_CK_RSA_RC4_128_MD5 0x03000004 | ||
| 77 | #define SSL3_CK_RSA_RC4_128_SHA 0x03000005 | ||
| 78 | #define SSL3_CK_RSA_RC2_40_MD5 0x03000006 | ||
| 79 | #define SSL3_CK_RSA_IDEA_128_SHA 0x03000007 | ||
| 80 | #define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008 | ||
| 81 | #define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009 | ||
| 82 | #define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A | ||
| 83 | |||
| 84 | #define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B | ||
| 85 | #define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C | ||
| 86 | #define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D | ||
| 87 | #define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E | ||
| 88 | #define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F | ||
| 89 | #define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010 | ||
| 90 | |||
| 91 | #define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011 | ||
| 92 | #define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012 | ||
| 93 | #define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013 | ||
| 94 | #define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014 | ||
| 95 | #define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015 | ||
| 96 | #define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016 | ||
| 97 | |||
| 98 | #define SSL3_CK_ADH_RC4_40_MD5 0x03000017 | ||
| 99 | #define SSL3_CK_ADH_RC4_128_MD5 0x03000018 | ||
| 100 | #define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019 | ||
| 101 | #define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A | ||
| 102 | #define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B | ||
| 103 | |||
| 104 | #define SSL3_CK_FZA_DMS_NULL_SHA 0x0300001C | ||
| 105 | #define SSL3_CK_FZA_DMS_FZA_SHA 0x0300001D | ||
| 106 | #define SSL3_CK_FZA_DMS_RC4_SHA 0x0300001E | ||
| 107 | |||
| 108 | #define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5" | ||
| 109 | #define SSL3_TXT_RSA_NULL_SHA "NULL-SHA" | ||
| 110 | #define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5" | ||
| 111 | #define SSL3_TXT_RSA_RC4_128_MD5 "RC4-MD5" | ||
| 112 | #define SSL3_TXT_RSA_RC4_128_SHA "RC4-SHA" | ||
| 113 | #define SSL3_TXT_RSA_RC2_40_MD5 "EXP-RC2-CBC-MD5" | ||
| 114 | #define SSL3_TXT_RSA_IDEA_128_SHA "IDEA-CBC-SHA" | ||
| 115 | #define SSL3_TXT_RSA_DES_40_CBC_SHA "EXP-DES-CBC-SHA" | ||
| 116 | #define SSL3_TXT_RSA_DES_64_CBC_SHA "DES-CBC-SHA" | ||
| 117 | #define SSL3_TXT_RSA_DES_192_CBC3_SHA "DES-CBC3-SHA" | ||
| 118 | |||
| 119 | #define SSL3_TXT_DH_DSS_DES_40_CBC_SHA "EXP-DH-DSS-DES-CBC-SHA" | ||
| 120 | #define SSL3_TXT_DH_DSS_DES_64_CBC_SHA "DH-DSS-DES-CBC-SHA" | ||
| 121 | #define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA" | ||
| 122 | #define SSL3_TXT_DH_RSA_DES_40_CBC_SHA "EXP-DH-RSA-DES-CBC-SHA" | ||
| 123 | #define SSL3_TXT_DH_RSA_DES_64_CBC_SHA "DH-RSA-DES-CBC-SHA" | ||
| 124 | #define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA" | ||
| 125 | |||
| 126 | #define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA "EXP-EDH-DSS-DES-CBC-SHA" | ||
| 127 | #define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA "EDH-DSS-DES-CBC-SHA" | ||
| 128 | #define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA" | ||
| 129 | #define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA "EXP-EDH-RSA-DES-CBC-SHA" | ||
| 130 | #define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA "EDH-RSA-DES-CBC-SHA" | ||
| 131 | #define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA" | ||
| 132 | |||
| 133 | #define SSL3_TXT_ADH_RC4_40_MD5 "EXP-ADH-RC4-MD5" | ||
| 134 | #define SSL3_TXT_ADH_RC4_128_MD5 "ADH-RC4-MD5" | ||
| 135 | #define SSL3_TXT_ADH_DES_40_CBC_SHA "EXP-ADH-DES-CBC-SHA" | ||
| 136 | #define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA" | ||
| 137 | #define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA" | ||
| 138 | |||
| 139 | #define SSL3_TXT_FZA_DMS_NULL_SHA "FZA-NULL-SHA" | ||
| 140 | #define SSL3_TXT_FZA_DMS_FZA_SHA "FZA-FZA-CBC-SHA" | ||
| 141 | #define SSL3_TXT_FZA_DMS_RC4_SHA "FZA-RC4-SHA" | ||
| 142 | |||
| 143 | #define SSL3_SSL_SESSION_ID_LENGTH 32 | ||
| 144 | #define SSL3_MAX_SSL_SESSION_ID_LENGTH 32 | ||
| 145 | |||
| 146 | #define SSL3_MASTER_SECRET_SIZE 48 | ||
| 147 | #define SSL3_RANDOM_SIZE 32 | ||
| 148 | #define SSL3_SESSION_ID_SIZE 32 | ||
| 149 | #define SSL3_RT_HEADER_LENGTH 5 | ||
| 150 | |||
| 151 | /* Due to MS stuffing up, this can change.... */ | ||
| 152 | #if defined(WIN16) || (defined(MSDOS) && !defined(WIN32)) | ||
| 153 | #define SSL3_RT_MAX_EXTRA (14000) | ||
| 154 | #else | ||
| 155 | #define SSL3_RT_MAX_EXTRA (16384) | ||
| 156 | #endif | ||
| 157 | |||
| 158 | #define SSL3_RT_MAX_PLAIN_LENGTH 16384 | ||
| 159 | #define SSL3_RT_MAX_COMPRESSED_LENGTH (1024+SSL3_RT_MAX_PLAIN_LENGTH) | ||
| 160 | #define SSL3_RT_MAX_ENCRYPTED_LENGTH (1024+SSL3_RT_MAX_COMPRESSED_LENGTH) | ||
| 161 | #define SSL3_RT_MAX_PACKET_SIZE (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH) | ||
| 162 | #define SSL3_RT_MAX_DATA_SIZE (1024*1024) | ||
| 163 | |||
| 164 | #define SSL3_MD_CLIENT_FINISHED_CONST "\x43\x4C\x4E\x54" | ||
| 165 | #define SSL3_MD_SERVER_FINISHED_CONST "\x53\x52\x56\x52" | ||
| 166 | |||
| 167 | #define SSL3_VERSION 0x0300 | ||
| 168 | #define SSL3_VERSION_MAJOR 0x03 | ||
| 169 | #define SSL3_VERSION_MINOR 0x00 | ||
| 170 | |||
| 171 | #define SSL3_RT_CHANGE_CIPHER_SPEC 20 | ||
| 172 | #define SSL3_RT_ALERT 21 | ||
| 173 | #define SSL3_RT_HANDSHAKE 22 | ||
| 174 | #define SSL3_RT_APPLICATION_DATA 23 | ||
| 175 | |||
| 176 | #define SSL3_AL_WARNING 1 | ||
| 177 | #define SSL3_AL_FATAL 2 | ||
| 178 | |||
| 179 | #define SSL3_AD_CLOSE_NOTIFY 0 | ||
| 180 | #define SSL3_AD_UNEXPECTED_MESSAGE 10 /* fatal */ | ||
| 181 | #define SSL3_AD_BAD_RECORD_MAC 20 /* fatal */ | ||
| 182 | #define SSL3_AD_DECOMPRESSION_FAILURE 30 /* fatal */ | ||
| 183 | #define SSL3_AD_HANDSHAKE_FAILURE 40 /* fatal */ | ||
| 184 | #define SSL3_AD_NO_CERTIFICATE 41 | ||
| 185 | #define SSL3_AD_BAD_CERTIFICATE 42 | ||
| 186 | #define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 | ||
| 187 | #define SSL3_AD_CERTIFICATE_REVOKED 44 | ||
| 188 | #define SSL3_AD_CERTIFICATE_EXPIRED 45 | ||
| 189 | #define SSL3_AD_CERTIFICATE_UNKNOWN 46 | ||
| 190 | #define SSL3_AD_ILLEGAL_PARAMETER 47 /* fatal */ | ||
| 191 | |||
| 192 | typedef struct ssl3_record_st | ||
| 193 | { | ||
| 194 | /*r */ int type; /* type of record */ | ||
| 195 | /*rw*/ unsigned int length; /* How many bytes available */ | ||
| 196 | /*r */ unsigned int off; /* read/write offset into 'buf' */ | ||
| 197 | /*rw*/ unsigned char *data; /* pointer to the record data */ | ||
| 198 | /*rw*/ unsigned char *input; /* where the decode bytes are */ | ||
| 199 | /*r */ unsigned char *comp; /* only used with decompression - malloc()ed */ | ||
| 200 | } SSL3_RECORD; | ||
| 201 | |||
| 202 | typedef struct ssl3_buffer_st | ||
| 203 | { | ||
| 204 | unsigned char *buf; /* SSL3_RT_MAX_PACKET_SIZE bytes (more if | ||
| 205 | * SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER is set) */ | ||
| 206 | int offset; /* where to 'copy from' */ | ||
| 207 | int left; /* how many bytes left */ | ||
| 208 | } SSL3_BUFFER; | ||
| 209 | |||
| 210 | #define SSL3_CT_RSA_SIGN 1 | ||
| 211 | #define SSL3_CT_DSS_SIGN 2 | ||
| 212 | #define SSL3_CT_RSA_FIXED_DH 3 | ||
| 213 | #define SSL3_CT_DSS_FIXED_DH 4 | ||
| 214 | #define SSL3_CT_RSA_EPHEMERAL_DH 5 | ||
| 215 | #define SSL3_CT_DSS_EPHEMERAL_DH 6 | ||
| 216 | #define SSL3_CT_FORTEZZA_DMS 20 | ||
| 217 | #define SSL3_CT_NUMBER 7 | ||
| 218 | |||
| 219 | #define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS 0x0001 | ||
| 220 | #define SSL3_FLAGS_DELAY_CLIENT_FINISHED 0x0002 | ||
| 221 | #define SSL3_FLAGS_POP_BUFFER 0x0004 | ||
| 222 | #define TLS1_FLAGS_TLS_PADDING_BUG 0x0008 | ||
| 223 | |||
| 224 | typedef struct ssl3_state_st | ||
| 225 | { | ||
| 226 | long flags; | ||
| 227 | int delay_buf_pop_ret; | ||
| 228 | |||
| 229 | unsigned char read_sequence[8]; | ||
| 230 | unsigned char read_mac_secret[EVP_MAX_MD_SIZE]; | ||
| 231 | unsigned char write_sequence[8]; | ||
| 232 | unsigned char write_mac_secret[EVP_MAX_MD_SIZE]; | ||
| 233 | |||
| 234 | unsigned char server_random[SSL3_RANDOM_SIZE]; | ||
| 235 | unsigned char client_random[SSL3_RANDOM_SIZE]; | ||
| 236 | |||
| 237 | SSL3_BUFFER rbuf; /* read IO goes into here */ | ||
| 238 | SSL3_BUFFER wbuf; /* write IO goes into here */ | ||
| 239 | |||
| 240 | SSL3_RECORD rrec; /* each decoded record goes in here */ | ||
| 241 | SSL3_RECORD wrec; /* goes out from here */ | ||
| 242 | |||
| 243 | /* storage for Alert/Handshake protocol data received but not | ||
| 244 | * yet processed by ssl3_read_bytes: */ | ||
| 245 | unsigned char alert_fragment[2]; | ||
| 246 | unsigned int alert_fragment_len; | ||
| 247 | unsigned char handshake_fragment[4]; | ||
| 248 | unsigned int handshake_fragment_len; | ||
| 249 | |||
| 250 | /* partial write - check the numbers match */ | ||
| 251 | unsigned int wnum; /* number of bytes sent so far */ | ||
| 252 | int wpend_tot; /* number bytes written */ | ||
| 253 | int wpend_type; | ||
| 254 | int wpend_ret; /* number of bytes submitted */ | ||
| 255 | const unsigned char *wpend_buf; | ||
| 256 | |||
| 257 | /* used during startup, digest all incoming/outgoing packets */ | ||
| 258 | EVP_MD_CTX finish_dgst1; | ||
| 259 | EVP_MD_CTX finish_dgst2; | ||
| 260 | |||
| 261 | /* this is set whenerver we see a change_cipher_spec message | ||
| 262 | * come in when we are not looking for one */ | ||
| 263 | int change_cipher_spec; | ||
| 264 | |||
| 265 | int warn_alert; | ||
| 266 | int fatal_alert; | ||
| 267 | /* we allow one fatal and one warning alert to be outstanding, | ||
| 268 | * send close alert via the warning alert */ | ||
| 269 | int alert_dispatch; | ||
| 270 | unsigned char send_alert[2]; | ||
| 271 | |||
| 272 | /* This flag is set when we should renegotiate ASAP, basically when | ||
| 273 | * there is no more data in the read or write buffers */ | ||
| 274 | int renegotiate; | ||
| 275 | int total_renegotiations; | ||
| 276 | int num_renegotiations; | ||
| 277 | |||
| 278 | int in_read_app_data; | ||
| 279 | |||
| 280 | struct { | ||
| 281 | /* actually only needs to be 16+20 */ | ||
| 282 | unsigned char cert_verify_md[EVP_MAX_MD_SIZE*2]; | ||
| 283 | |||
| 284 | /* actually only need to be 16+20 for SSLv3 and 12 for TLS */ | ||
| 285 | unsigned char finish_md[EVP_MAX_MD_SIZE*2]; | ||
| 286 | int finish_md_len; | ||
| 287 | unsigned char peer_finish_md[EVP_MAX_MD_SIZE*2]; | ||
| 288 | int peer_finish_md_len; | ||
| 289 | |||
| 290 | unsigned long message_size; | ||
| 291 | int message_type; | ||
| 292 | |||
| 293 | /* used to hold the new cipher we are going to use */ | ||
| 294 | SSL_CIPHER *new_cipher; | ||
| 295 | #ifndef NO_DH | ||
| 296 | DH *dh; | ||
| 297 | #endif | ||
| 298 | /* used when SSL_ST_FLUSH_DATA is entered */ | ||
| 299 | int next_state; | ||
| 300 | |||
| 301 | int reuse_message; | ||
| 302 | |||
| 303 | /* used for certificate requests */ | ||
| 304 | int cert_req; | ||
| 305 | int ctype_num; | ||
| 306 | char ctype[SSL3_CT_NUMBER]; | ||
| 307 | STACK_OF(X509_NAME) *ca_names; | ||
| 308 | |||
| 309 | int use_rsa_tmp; | ||
| 310 | |||
| 311 | int key_block_length; | ||
| 312 | unsigned char *key_block; | ||
| 313 | |||
| 314 | const EVP_CIPHER *new_sym_enc; | ||
| 315 | const EVP_MD *new_hash; | ||
| 316 | #ifndef NO_COMP | ||
| 317 | const SSL_COMP *new_compression; | ||
| 318 | #else | ||
| 319 | char *new_compression; | ||
| 320 | #endif | ||
| 321 | int cert_request; | ||
| 322 | } tmp; | ||
| 323 | |||
| 324 | } SSL3_STATE; | ||
| 325 | |||
| 326 | /* SSLv3 */ | ||
| 327 | /*client */ | ||
| 328 | /* extra state */ | ||
| 329 | #define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT) | ||
| 330 | /* write to server */ | ||
| 331 | #define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT) | ||
| 332 | #define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT) | ||
| 333 | /* read from server */ | ||
| 334 | #define SSL3_ST_CR_SRVR_HELLO_A (0x120|SSL_ST_CONNECT) | ||
| 335 | #define SSL3_ST_CR_SRVR_HELLO_B (0x121|SSL_ST_CONNECT) | ||
| 336 | #define SSL3_ST_CR_CERT_A (0x130|SSL_ST_CONNECT) | ||
| 337 | #define SSL3_ST_CR_CERT_B (0x131|SSL_ST_CONNECT) | ||
| 338 | #define SSL3_ST_CR_KEY_EXCH_A (0x140|SSL_ST_CONNECT) | ||
| 339 | #define SSL3_ST_CR_KEY_EXCH_B (0x141|SSL_ST_CONNECT) | ||
| 340 | #define SSL3_ST_CR_CERT_REQ_A (0x150|SSL_ST_CONNECT) | ||
| 341 | #define SSL3_ST_CR_CERT_REQ_B (0x151|SSL_ST_CONNECT) | ||
| 342 | #define SSL3_ST_CR_SRVR_DONE_A (0x160|SSL_ST_CONNECT) | ||
| 343 | #define SSL3_ST_CR_SRVR_DONE_B (0x161|SSL_ST_CONNECT) | ||
| 344 | /* write to server */ | ||
| 345 | #define SSL3_ST_CW_CERT_A (0x170|SSL_ST_CONNECT) | ||
| 346 | #define SSL3_ST_CW_CERT_B (0x171|SSL_ST_CONNECT) | ||
| 347 | #define SSL3_ST_CW_CERT_C (0x172|SSL_ST_CONNECT) | ||
| 348 | #define SSL3_ST_CW_CERT_D (0x173|SSL_ST_CONNECT) | ||
| 349 | #define SSL3_ST_CW_KEY_EXCH_A (0x180|SSL_ST_CONNECT) | ||
| 350 | #define SSL3_ST_CW_KEY_EXCH_B (0x181|SSL_ST_CONNECT) | ||
| 351 | #define SSL3_ST_CW_CERT_VRFY_A (0x190|SSL_ST_CONNECT) | ||
| 352 | #define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT) | ||
| 353 | #define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT) | ||
| 354 | #define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT) | ||
| 355 | #define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT) | ||
| 356 | #define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT) | ||
| 357 | /* read from server */ | ||
| 358 | #define SSL3_ST_CR_CHANGE_A (0x1C0|SSL_ST_CONNECT) | ||
| 359 | #define SSL3_ST_CR_CHANGE_B (0x1C1|SSL_ST_CONNECT) | ||
| 360 | #define SSL3_ST_CR_FINISHED_A (0x1D0|SSL_ST_CONNECT) | ||
| 361 | #define SSL3_ST_CR_FINISHED_B (0x1D1|SSL_ST_CONNECT) | ||
| 362 | |||
| 363 | /* server */ | ||
| 364 | /* extra state */ | ||
| 365 | #define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT) | ||
| 366 | /* read from client */ | ||
| 367 | /* Do not change the number values, they do matter */ | ||
| 368 | #define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT) | ||
| 369 | #define SSL3_ST_SR_CLNT_HELLO_B (0x111|SSL_ST_ACCEPT) | ||
| 370 | #define SSL3_ST_SR_CLNT_HELLO_C (0x112|SSL_ST_ACCEPT) | ||
| 371 | /* write to client */ | ||
| 372 | #define SSL3_ST_SW_HELLO_REQ_A (0x120|SSL_ST_ACCEPT) | ||
| 373 | #define SSL3_ST_SW_HELLO_REQ_B (0x121|SSL_ST_ACCEPT) | ||
| 374 | #define SSL3_ST_SW_HELLO_REQ_C (0x122|SSL_ST_ACCEPT) | ||
| 375 | #define SSL3_ST_SW_SRVR_HELLO_A (0x130|SSL_ST_ACCEPT) | ||
| 376 | #define SSL3_ST_SW_SRVR_HELLO_B (0x131|SSL_ST_ACCEPT) | ||
| 377 | #define SSL3_ST_SW_CERT_A (0x140|SSL_ST_ACCEPT) | ||
| 378 | #define SSL3_ST_SW_CERT_B (0x141|SSL_ST_ACCEPT) | ||
| 379 | #define SSL3_ST_SW_KEY_EXCH_A (0x150|SSL_ST_ACCEPT) | ||
| 380 | #define SSL3_ST_SW_KEY_EXCH_B (0x151|SSL_ST_ACCEPT) | ||
| 381 | #define SSL3_ST_SW_CERT_REQ_A (0x160|SSL_ST_ACCEPT) | ||
| 382 | #define SSL3_ST_SW_CERT_REQ_B (0x161|SSL_ST_ACCEPT) | ||
| 383 | #define SSL3_ST_SW_SRVR_DONE_A (0x170|SSL_ST_ACCEPT) | ||
| 384 | #define SSL3_ST_SW_SRVR_DONE_B (0x171|SSL_ST_ACCEPT) | ||
| 385 | /* read from client */ | ||
| 386 | #define SSL3_ST_SR_CERT_A (0x180|SSL_ST_ACCEPT) | ||
| 387 | #define SSL3_ST_SR_CERT_B (0x181|SSL_ST_ACCEPT) | ||
| 388 | #define SSL3_ST_SR_KEY_EXCH_A (0x190|SSL_ST_ACCEPT) | ||
| 389 | #define SSL3_ST_SR_KEY_EXCH_B (0x191|SSL_ST_ACCEPT) | ||
| 390 | #define SSL3_ST_SR_CERT_VRFY_A (0x1A0|SSL_ST_ACCEPT) | ||
| 391 | #define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT) | ||
| 392 | #define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT) | ||
| 393 | #define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT) | ||
| 394 | #define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT) | ||
| 395 | #define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT) | ||
| 396 | /* write to client */ | ||
| 397 | #define SSL3_ST_SW_CHANGE_A (0x1D0|SSL_ST_ACCEPT) | ||
| 398 | #define SSL3_ST_SW_CHANGE_B (0x1D1|SSL_ST_ACCEPT) | ||
| 399 | #define SSL3_ST_SW_FINISHED_A (0x1E0|SSL_ST_ACCEPT) | ||
| 400 | #define SSL3_ST_SW_FINISHED_B (0x1E1|SSL_ST_ACCEPT) | ||
| 401 | |||
| 402 | #define SSL3_MT_HELLO_REQUEST 0 | ||
| 403 | #define SSL3_MT_CLIENT_HELLO 1 | ||
| 404 | #define SSL3_MT_SERVER_HELLO 2 | ||
| 405 | #define SSL3_MT_CERTIFICATE 11 | ||
| 406 | #define SSL3_MT_SERVER_KEY_EXCHANGE 12 | ||
| 407 | #define SSL3_MT_CERTIFICATE_REQUEST 13 | ||
| 408 | #define SSL3_MT_SERVER_DONE 14 | ||
| 409 | #define SSL3_MT_CERTIFICATE_VERIFY 15 | ||
| 410 | #define SSL3_MT_CLIENT_KEY_EXCHANGE 16 | ||
| 411 | #define SSL3_MT_FINISHED 20 | ||
| 412 | |||
| 413 | #define SSL3_MT_CCS 1 | ||
| 414 | |||
| 415 | /* These are used when changing over to a new cipher */ | ||
| 416 | #define SSL3_CC_READ 0x01 | ||
| 417 | #define SSL3_CC_WRITE 0x02 | ||
| 418 | #define SSL3_CC_CLIENT 0x10 | ||
| 419 | #define SSL3_CC_SERVER 0x20 | ||
| 420 | #define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE) | ||
| 421 | #define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER|SSL3_CC_READ) | ||
| 422 | #define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT|SSL3_CC_READ) | ||
| 423 | #define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE) | ||
| 424 | |||
| 425 | #ifdef __cplusplus | ||
| 426 | } | ||
| 427 | #endif | ||
| 428 | #endif | ||
| 429 | |||
diff --git a/src/lib/libssl/ssl_algs.c b/src/lib/libssl/ssl_algs.c deleted file mode 100644 index dde8918fe0..0000000000 --- a/src/lib/libssl/ssl_algs.c +++ /dev/null | |||
| @@ -1,107 +0,0 @@ | |||
| 1 | /* ssl/ssl_algs.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/objects.h> | ||
| 61 | #include <openssl/lhash.h> | ||
| 62 | #include "ssl_locl.h" | ||
| 63 | |||
| 64 | int SSL_library_init(void) | ||
| 65 | { | ||
| 66 | #ifndef NO_DES | ||
| 67 | EVP_add_cipher(EVP_des_cbc()); | ||
| 68 | EVP_add_cipher(EVP_des_ede3_cbc()); | ||
| 69 | #endif | ||
| 70 | #ifndef NO_IDEA | ||
| 71 | EVP_add_cipher(EVP_idea_cbc()); | ||
| 72 | #endif | ||
| 73 | #ifndef NO_RC4 | ||
| 74 | EVP_add_cipher(EVP_rc4()); | ||
| 75 | #endif | ||
| 76 | #ifndef NO_RC2 | ||
| 77 | EVP_add_cipher(EVP_rc2_cbc()); | ||
| 78 | #endif | ||
| 79 | |||
| 80 | #ifndef NO_MD2 | ||
| 81 | EVP_add_digest(EVP_md2()); | ||
| 82 | #endif | ||
| 83 | #ifndef NO_MD5 | ||
| 84 | EVP_add_digest(EVP_md5()); | ||
| 85 | EVP_add_digest_alias(SN_md5,"ssl2-md5"); | ||
| 86 | EVP_add_digest_alias(SN_md5,"ssl3-md5"); | ||
| 87 | #endif | ||
| 88 | #ifndef NO_SHA | ||
| 89 | EVP_add_digest(EVP_sha1()); /* RSA with sha1 */ | ||
| 90 | EVP_add_digest_alias(SN_sha1,"ssl3-sha1"); | ||
| 91 | EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA); | ||
| 92 | #endif | ||
| 93 | #if !defined(NO_SHA) && !defined(NO_DSA) | ||
| 94 | EVP_add_digest(EVP_dss1()); /* DSA with sha1 */ | ||
| 95 | EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2); | ||
| 96 | EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1"); | ||
| 97 | EVP_add_digest_alias(SN_dsaWithSHA1,"dss1"); | ||
| 98 | #endif | ||
| 99 | |||
| 100 | /* If you want support for phased out ciphers, add the following */ | ||
| 101 | #if 0 | ||
| 102 | EVP_add_digest(EVP_sha()); | ||
| 103 | EVP_add_digest(EVP_dss()); | ||
| 104 | #endif | ||
| 105 | return(1); | ||
| 106 | } | ||
| 107 | |||
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c deleted file mode 100644 index fa6456e4f5..0000000000 --- a/src/lib/libssl/ssl_asn1.c +++ /dev/null | |||
| @@ -1,349 +0,0 @@ | |||
| 1 | /* ssl/ssl_asn1.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <stdlib.h> | ||
| 61 | #include <openssl/asn1_mac.h> | ||
| 62 | #include <openssl/objects.h> | ||
| 63 | #include <openssl/x509.h> | ||
| 64 | #include "ssl_locl.h" | ||
| 65 | |||
| 66 | typedef struct ssl_session_asn1_st | ||
| 67 | { | ||
| 68 | ASN1_INTEGER version; | ||
| 69 | ASN1_INTEGER ssl_version; | ||
| 70 | ASN1_OCTET_STRING cipher; | ||
| 71 | ASN1_OCTET_STRING master_key; | ||
| 72 | ASN1_OCTET_STRING session_id; | ||
| 73 | ASN1_OCTET_STRING session_id_context; | ||
| 74 | ASN1_OCTET_STRING key_arg; | ||
| 75 | ASN1_INTEGER time; | ||
| 76 | ASN1_INTEGER timeout; | ||
| 77 | ASN1_INTEGER verify_result; | ||
| 78 | } SSL_SESSION_ASN1; | ||
| 79 | |||
| 80 | int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp) | ||
| 81 | { | ||
| 82 | #define LSIZE2 (sizeof(long)*2) | ||
| 83 | int v1=0,v2=0,v3=0,v4=0,v5=0; | ||
| 84 | unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2]; | ||
| 85 | unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2]; | ||
| 86 | long l; | ||
| 87 | SSL_SESSION_ASN1 a; | ||
| 88 | M_ASN1_I2D_vars(in); | ||
| 89 | |||
| 90 | if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0))) | ||
| 91 | return(0); | ||
| 92 | |||
| 93 | /* Note that I cheat in the following 2 assignments. I know | ||
| 94 | * that if the ASN1_INTEGER passed to ASN1_INTEGER_set | ||
| 95 | * is > sizeof(long)+1, the buffer will not be re-OPENSSL_malloc()ed. | ||
| 96 | * This is a bit evil but makes things simple, no dynamic allocation | ||
| 97 | * to clean up :-) */ | ||
| 98 | a.version.length=LSIZE2; | ||
| 99 | a.version.type=V_ASN1_INTEGER; | ||
| 100 | a.version.data=ibuf1; | ||
| 101 | ASN1_INTEGER_set(&(a.version),SSL_SESSION_ASN1_VERSION); | ||
| 102 | |||
| 103 | a.ssl_version.length=LSIZE2; | ||
| 104 | a.ssl_version.type=V_ASN1_INTEGER; | ||
| 105 | a.ssl_version.data=ibuf2; | ||
| 106 | ASN1_INTEGER_set(&(a.ssl_version),in->ssl_version); | ||
| 107 | |||
| 108 | a.cipher.type=V_ASN1_OCTET_STRING; | ||
| 109 | a.cipher.data=buf; | ||
| 110 | |||
| 111 | if (in->cipher == NULL) | ||
| 112 | l=in->cipher_id; | ||
| 113 | else | ||
| 114 | l=in->cipher->id; | ||
| 115 | if (in->ssl_version == SSL2_VERSION) | ||
| 116 | { | ||
| 117 | a.cipher.length=3; | ||
| 118 | buf[0]=((unsigned char)(l>>16L))&0xff; | ||
| 119 | buf[1]=((unsigned char)(l>> 8L))&0xff; | ||
| 120 | buf[2]=((unsigned char)(l ))&0xff; | ||
| 121 | } | ||
| 122 | else | ||
| 123 | { | ||
| 124 | a.cipher.length=2; | ||
| 125 | buf[0]=((unsigned char)(l>>8L))&0xff; | ||
| 126 | buf[1]=((unsigned char)(l ))&0xff; | ||
| 127 | } | ||
| 128 | |||
| 129 | a.master_key.length=in->master_key_length; | ||
| 130 | a.master_key.type=V_ASN1_OCTET_STRING; | ||
| 131 | a.master_key.data=in->master_key; | ||
| 132 | |||
| 133 | a.session_id.length=in->session_id_length; | ||
| 134 | a.session_id.type=V_ASN1_OCTET_STRING; | ||
| 135 | a.session_id.data=in->session_id; | ||
| 136 | |||
| 137 | a.session_id_context.length=in->sid_ctx_length; | ||
| 138 | a.session_id_context.type=V_ASN1_OCTET_STRING; | ||
| 139 | a.session_id_context.data=in->sid_ctx; | ||
| 140 | |||
| 141 | a.key_arg.length=in->key_arg_length; | ||
| 142 | a.key_arg.type=V_ASN1_OCTET_STRING; | ||
| 143 | a.key_arg.data=in->key_arg; | ||
| 144 | |||
| 145 | if (in->time != 0L) | ||
| 146 | { | ||
| 147 | a.time.length=LSIZE2; | ||
| 148 | a.time.type=V_ASN1_INTEGER; | ||
| 149 | a.time.data=ibuf3; | ||
| 150 | ASN1_INTEGER_set(&(a.time),in->time); | ||
| 151 | } | ||
| 152 | |||
| 153 | if (in->timeout != 0L) | ||
| 154 | { | ||
| 155 | a.timeout.length=LSIZE2; | ||
| 156 | a.timeout.type=V_ASN1_INTEGER; | ||
| 157 | a.timeout.data=ibuf4; | ||
| 158 | ASN1_INTEGER_set(&(a.timeout),in->timeout); | ||
| 159 | } | ||
| 160 | |||
| 161 | if (in->verify_result != X509_V_OK) | ||
| 162 | { | ||
| 163 | a.verify_result.length=LSIZE2; | ||
| 164 | a.verify_result.type=V_ASN1_INTEGER; | ||
| 165 | a.verify_result.data=ibuf5; | ||
| 166 | ASN1_INTEGER_set(&a.verify_result,in->verify_result); | ||
| 167 | } | ||
| 168 | |||
| 169 | M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER); | ||
| 170 | M_ASN1_I2D_len(&(a.ssl_version), i2d_ASN1_INTEGER); | ||
| 171 | M_ASN1_I2D_len(&(a.cipher), i2d_ASN1_OCTET_STRING); | ||
| 172 | M_ASN1_I2D_len(&(a.session_id), i2d_ASN1_OCTET_STRING); | ||
| 173 | M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING); | ||
| 174 | if (in->key_arg_length > 0) | ||
| 175 | M_ASN1_I2D_len_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING); | ||
| 176 | if (in->time != 0L) | ||
| 177 | M_ASN1_I2D_len_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); | ||
| 178 | if (in->timeout != 0L) | ||
| 179 | M_ASN1_I2D_len_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); | ||
| 180 | if (in->peer != NULL) | ||
| 181 | M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3); | ||
| 182 | M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4); | ||
| 183 | if (in->verify_result != X509_V_OK) | ||
| 184 | M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5); | ||
| 185 | |||
| 186 | M_ASN1_I2D_seq_total(); | ||
| 187 | |||
| 188 | M_ASN1_I2D_put(&(a.version), i2d_ASN1_INTEGER); | ||
| 189 | M_ASN1_I2D_put(&(a.ssl_version), i2d_ASN1_INTEGER); | ||
| 190 | M_ASN1_I2D_put(&(a.cipher), i2d_ASN1_OCTET_STRING); | ||
| 191 | M_ASN1_I2D_put(&(a.session_id), i2d_ASN1_OCTET_STRING); | ||
| 192 | M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING); | ||
| 193 | if (in->key_arg_length > 0) | ||
| 194 | M_ASN1_I2D_put_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING,0); | ||
| 195 | if (in->time != 0L) | ||
| 196 | M_ASN1_I2D_put_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); | ||
| 197 | if (in->timeout != 0L) | ||
| 198 | M_ASN1_I2D_put_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); | ||
| 199 | if (in->peer != NULL) | ||
| 200 | M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3); | ||
| 201 | M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4, | ||
| 202 | v4); | ||
| 203 | if (in->verify_result != X509_V_OK) | ||
| 204 | M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5); | ||
| 205 | M_ASN1_I2D_finish(); | ||
| 206 | } | ||
| 207 | |||
| 208 | SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp, | ||
| 209 | long length) | ||
| 210 | { | ||
| 211 | int version,ssl_version=0,i; | ||
| 212 | long id; | ||
| 213 | ASN1_INTEGER ai,*aip; | ||
| 214 | ASN1_OCTET_STRING os,*osp; | ||
| 215 | M_ASN1_D2I_vars(a,SSL_SESSION *,SSL_SESSION_new); | ||
| 216 | |||
| 217 | aip= &ai; | ||
| 218 | osp= &os; | ||
| 219 | |||
| 220 | M_ASN1_D2I_Init(); | ||
| 221 | M_ASN1_D2I_start_sequence(); | ||
| 222 | |||
| 223 | ai.data=NULL; ai.length=0; | ||
| 224 | M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER); | ||
| 225 | version=(int)ASN1_INTEGER_get(aip); | ||
| 226 | if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } | ||
| 227 | |||
| 228 | /* we don't care about the version right now :-) */ | ||
| 229 | M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER); | ||
| 230 | ssl_version=(int)ASN1_INTEGER_get(aip); | ||
| 231 | ret->ssl_version=ssl_version; | ||
| 232 | if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } | ||
| 233 | |||
| 234 | os.data=NULL; os.length=0; | ||
| 235 | M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); | ||
| 236 | if (ssl_version == SSL2_VERSION) | ||
| 237 | { | ||
| 238 | if (os.length != 3) | ||
| 239 | { | ||
| 240 | c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; | ||
| 241 | goto err; | ||
| 242 | } | ||
| 243 | id=0x02000000L| | ||
| 244 | ((unsigned long)os.data[0]<<16L)| | ||
| 245 | ((unsigned long)os.data[1]<< 8L)| | ||
| 246 | (unsigned long)os.data[2]; | ||
| 247 | } | ||
| 248 | else if ((ssl_version>>8) == 3) | ||
| 249 | { | ||
| 250 | if (os.length != 2) | ||
| 251 | { | ||
| 252 | c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; | ||
| 253 | goto err; | ||
| 254 | } | ||
| 255 | id=0x03000000L| | ||
| 256 | ((unsigned long)os.data[0]<<8L)| | ||
| 257 | (unsigned long)os.data[1]; | ||
| 258 | } | ||
| 259 | else | ||
| 260 | { | ||
| 261 | SSLerr(SSL_F_D2I_SSL_SESSION,SSL_R_UNKNOWN_SSL_VERSION); | ||
| 262 | return(NULL); | ||
| 263 | } | ||
| 264 | |||
| 265 | ret->cipher=NULL; | ||
| 266 | ret->cipher_id=id; | ||
| 267 | |||
| 268 | M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); | ||
| 269 | if ((ssl_version>>8) == SSL3_VERSION) | ||
| 270 | i=SSL3_MAX_SSL_SESSION_ID_LENGTH; | ||
| 271 | else /* if (ssl_version == SSL2_VERSION) */ | ||
| 272 | i=SSL2_MAX_SSL_SESSION_ID_LENGTH; | ||
| 273 | |||
| 274 | if (os.length > i) | ||
| 275 | os.length=i; | ||
| 276 | |||
| 277 | ret->session_id_length=os.length; | ||
| 278 | memcpy(ret->session_id,os.data,os.length); | ||
| 279 | |||
| 280 | M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); | ||
| 281 | if (ret->master_key_length > SSL_MAX_MASTER_KEY_LENGTH) | ||
| 282 | ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; | ||
| 283 | else | ||
| 284 | ret->master_key_length=os.length; | ||
| 285 | memcpy(ret->master_key,os.data,ret->master_key_length); | ||
| 286 | |||
| 287 | os.length=0; | ||
| 288 | M_ASN1_D2I_get_IMP_opt(osp,d2i_ASN1_OCTET_STRING,0,V_ASN1_OCTET_STRING); | ||
| 289 | if (os.length > SSL_MAX_KEY_ARG_LENGTH) | ||
| 290 | ret->key_arg_length=SSL_MAX_KEY_ARG_LENGTH; | ||
| 291 | else | ||
| 292 | ret->key_arg_length=os.length; | ||
| 293 | memcpy(ret->key_arg,os.data,ret->key_arg_length); | ||
| 294 | if (os.data != NULL) OPENSSL_free(os.data); | ||
| 295 | |||
| 296 | ai.length=0; | ||
| 297 | M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,1); | ||
| 298 | if (ai.data != NULL) | ||
| 299 | { | ||
| 300 | ret->time=ASN1_INTEGER_get(aip); | ||
| 301 | OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; | ||
| 302 | } | ||
| 303 | else | ||
| 304 | ret->time=time(NULL); | ||
| 305 | |||
| 306 | ai.length=0; | ||
| 307 | M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,2); | ||
| 308 | if (ai.data != NULL) | ||
| 309 | { | ||
| 310 | ret->timeout=ASN1_INTEGER_get(aip); | ||
| 311 | OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; | ||
| 312 | } | ||
| 313 | else | ||
| 314 | ret->timeout=3; | ||
| 315 | |||
| 316 | if (ret->peer != NULL) | ||
| 317 | { | ||
| 318 | X509_free(ret->peer); | ||
| 319 | ret->peer=NULL; | ||
| 320 | } | ||
| 321 | M_ASN1_D2I_get_EXP_opt(ret->peer,d2i_X509,3); | ||
| 322 | |||
| 323 | os.length=0; | ||
| 324 | os.data=NULL; | ||
| 325 | M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,4); | ||
| 326 | |||
| 327 | if(os.data != NULL) | ||
| 328 | { | ||
| 329 | if (os.length > SSL_MAX_SID_CTX_LENGTH) | ||
| 330 | SSLerr(SSL_F_D2I_SSL_SESSION,SSL_R_BAD_LENGTH); | ||
| 331 | ret->sid_ctx_length=os.length; | ||
| 332 | memcpy(ret->sid_ctx,os.data,os.length); | ||
| 333 | OPENSSL_free(os.data); os.data=NULL; os.length=0; | ||
| 334 | } | ||
| 335 | else | ||
| 336 | ret->sid_ctx_length=0; | ||
| 337 | |||
| 338 | ai.length=0; | ||
| 339 | M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,5); | ||
| 340 | if (ai.data != NULL) | ||
| 341 | { | ||
| 342 | ret->verify_result=ASN1_INTEGER_get(aip); | ||
| 343 | OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; | ||
| 344 | } | ||
| 345 | else | ||
| 346 | ret->verify_result=X509_V_OK; | ||
| 347 | |||
| 348 | M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION); | ||
| 349 | } | ||
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c deleted file mode 100644 index 27e7fcc60a..0000000000 --- a/src/lib/libssl/ssl_cert.c +++ /dev/null | |||
| @@ -1,757 +0,0 @@ | |||
| 1 | /*! \file ssl/ssl_cert.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | /* ==================================================================== | ||
| 59 | * Copyright (c) 1999 The OpenSSL Project. All rights reserved. | ||
| 60 | * | ||
| 61 | * Redistribution and use in source and binary forms, with or without | ||
| 62 | * modification, are permitted provided that the following conditions | ||
| 63 | * are met: | ||
| 64 | * | ||
| 65 | * 1. Redistributions of source code must retain the above copyright | ||
| 66 | * notice, this list of conditions and the following disclaimer. | ||
| 67 | * | ||
| 68 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 69 | * notice, this list of conditions and the following disclaimer in | ||
| 70 | * the documentation and/or other materials provided with the | ||
| 71 | * distribution. | ||
| 72 | * | ||
| 73 | * 3. All advertising materials mentioning features or use of this | ||
| 74 | * software must display the following acknowledgment: | ||
| 75 | * "This product includes software developed by the OpenSSL Project | ||
| 76 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" | ||
| 77 | * | ||
| 78 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 79 | * endorse or promote products derived from this software without | ||
| 80 | * prior written permission. For written permission, please contact | ||
| 81 | * openssl-core@OpenSSL.org. | ||
| 82 | * | ||
| 83 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 84 | * nor may "OpenSSL" appear in their names without prior written | ||
| 85 | * permission of the OpenSSL Project. | ||
| 86 | * | ||
| 87 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 88 | * acknowledgment: | ||
| 89 | * "This product includes software developed by the OpenSSL Project | ||
| 90 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" | ||
| 91 | * | ||
| 92 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 93 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 94 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 95 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 96 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 97 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 98 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 99 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 100 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 101 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 102 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 103 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 104 | * ==================================================================== | ||
| 105 | */ | ||
| 106 | |||
| 107 | #include <stdio.h> | ||
| 108 | |||
| 109 | #include "openssl/e_os.h" | ||
| 110 | |||
| 111 | #ifndef NO_SYS_TYPES_H | ||
| 112 | # include <sys/types.h> | ||
| 113 | #endif | ||
| 114 | |||
| 115 | #if !defined(WIN32) && !defined(VSM) && !defined(NeXT) && !defined(MAC_OS_pre_X) | ||
| 116 | #include <dirent.h> | ||
| 117 | #endif | ||
| 118 | |||
| 119 | #ifdef NeXT | ||
| 120 | #include <sys/dir.h> | ||
| 121 | #define dirent direct | ||
| 122 | #endif | ||
| 123 | |||
| 124 | #include <openssl/objects.h> | ||
| 125 | #include <openssl/bio.h> | ||
| 126 | #include <openssl/pem.h> | ||
| 127 | #include <openssl/x509v3.h> | ||
| 128 | #include "ssl_locl.h" | ||
| 129 | |||
| 130 | int SSL_get_ex_data_X509_STORE_CTX_idx(void) | ||
| 131 | { | ||
| 132 | static int ssl_x509_store_ctx_idx= -1; | ||
| 133 | |||
| 134 | if (ssl_x509_store_ctx_idx < 0) | ||
| 135 | { | ||
| 136 | ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index( | ||
| 137 | 0,"SSL for verify callback",NULL,NULL,NULL); | ||
| 138 | } | ||
| 139 | return(ssl_x509_store_ctx_idx); | ||
| 140 | } | ||
| 141 | |||
| 142 | CERT *ssl_cert_new(void) | ||
| 143 | { | ||
| 144 | CERT *ret; | ||
| 145 | |||
| 146 | ret=(CERT *)OPENSSL_malloc(sizeof(CERT)); | ||
| 147 | if (ret == NULL) | ||
| 148 | { | ||
| 149 | SSLerr(SSL_F_SSL_CERT_NEW,ERR_R_MALLOC_FAILURE); | ||
| 150 | return(NULL); | ||
| 151 | } | ||
| 152 | memset(ret,0,sizeof(CERT)); | ||
| 153 | |||
| 154 | ret->key= &(ret->pkeys[SSL_PKEY_RSA_ENC]); | ||
| 155 | ret->references=1; | ||
| 156 | |||
| 157 | return(ret); | ||
| 158 | } | ||
| 159 | |||
| 160 | CERT *ssl_cert_dup(CERT *cert) | ||
| 161 | { | ||
| 162 | CERT *ret; | ||
| 163 | int i; | ||
| 164 | |||
| 165 | ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); | ||
| 166 | if (ret == NULL) | ||
| 167 | { | ||
| 168 | SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE); | ||
| 169 | return(NULL); | ||
| 170 | } | ||
| 171 | |||
| 172 | memset(ret, 0, sizeof(CERT)); | ||
| 173 | |||
| 174 | ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]]; | ||
| 175 | /* or ret->key = ret->pkeys + (cert->key - cert->pkeys), | ||
| 176 | * if you find that more readable */ | ||
| 177 | |||
| 178 | ret->valid = cert->valid; | ||
| 179 | ret->mask = cert->mask; | ||
| 180 | ret->export_mask = cert->export_mask; | ||
| 181 | |||
| 182 | #ifndef NO_RSA | ||
| 183 | if (cert->rsa_tmp != NULL) | ||
| 184 | { | ||
| 185 | ret->rsa_tmp = cert->rsa_tmp; | ||
| 186 | CRYPTO_add(&ret->rsa_tmp->references, 1, CRYPTO_LOCK_RSA); | ||
| 187 | } | ||
| 188 | ret->rsa_tmp_cb = cert->rsa_tmp_cb; | ||
| 189 | #endif | ||
| 190 | |||
| 191 | #ifndef NO_DH | ||
| 192 | if (cert->dh_tmp != NULL) | ||
| 193 | { | ||
| 194 | /* DH parameters don't have a reference count */ | ||
| 195 | ret->dh_tmp = DHparams_dup(cert->dh_tmp); | ||
| 196 | if (ret->dh_tmp == NULL) | ||
| 197 | { | ||
| 198 | SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB); | ||
| 199 | goto err; | ||
| 200 | } | ||
| 201 | if (cert->dh_tmp->priv_key) | ||
| 202 | { | ||
| 203 | BIGNUM *b = BN_dup(cert->dh_tmp->priv_key); | ||
| 204 | if (!b) | ||
| 205 | { | ||
| 206 | SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); | ||
| 207 | goto err; | ||
| 208 | } | ||
| 209 | ret->dh_tmp->priv_key = b; | ||
| 210 | } | ||
| 211 | if (cert->dh_tmp->pub_key) | ||
| 212 | { | ||
| 213 | BIGNUM *b = BN_dup(cert->dh_tmp->pub_key); | ||
| 214 | if (!b) | ||
| 215 | { | ||
| 216 | SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); | ||
| 217 | goto err; | ||
| 218 | } | ||
| 219 | ret->dh_tmp->pub_key = b; | ||
| 220 | } | ||
| 221 | } | ||
| 222 | ret->dh_tmp_cb = cert->dh_tmp_cb; | ||
| 223 | #endif | ||
| 224 | |||
| 225 | for (i = 0; i < SSL_PKEY_NUM; i++) | ||
| 226 | { | ||
| 227 | if (cert->pkeys[i].x509 != NULL) | ||
| 228 | { | ||
| 229 | ret->pkeys[i].x509 = cert->pkeys[i].x509; | ||
| 230 | CRYPTO_add(&ret->pkeys[i].x509->references, 1, | ||
| 231 | CRYPTO_LOCK_X509); | ||
| 232 | } | ||
| 233 | |||
| 234 | if (cert->pkeys[i].privatekey != NULL) | ||
| 235 | { | ||
| 236 | ret->pkeys[i].privatekey = cert->pkeys[i].privatekey; | ||
| 237 | CRYPTO_add(&ret->pkeys[i].privatekey->references, 1, | ||
| 238 | CRYPTO_LOCK_EVP_PKEY); | ||
| 239 | |||
| 240 | switch(i) | ||
| 241 | { | ||
| 242 | /* If there was anything special to do for | ||
| 243 | * certain types of keys, we'd do it here. | ||
| 244 | * (Nothing at the moment, I think.) */ | ||
| 245 | |||
| 246 | case SSL_PKEY_RSA_ENC: | ||
| 247 | case SSL_PKEY_RSA_SIGN: | ||
| 248 | /* We have an RSA key. */ | ||
| 249 | break; | ||
| 250 | |||
| 251 | case SSL_PKEY_DSA_SIGN: | ||
| 252 | /* We have a DSA key. */ | ||
| 253 | break; | ||
| 254 | |||
| 255 | case SSL_PKEY_DH_RSA: | ||
| 256 | case SSL_PKEY_DH_DSA: | ||
| 257 | /* We have a DH key. */ | ||
| 258 | break; | ||
| 259 | |||
| 260 | default: | ||
| 261 | /* Can't happen. */ | ||
| 262 | SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG); | ||
| 263 | } | ||
| 264 | } | ||
| 265 | } | ||
| 266 | |||
| 267 | /* ret->extra_certs *should* exist, but currently the own certificate | ||
| 268 | * chain is held inside SSL_CTX */ | ||
| 269 | |||
| 270 | ret->references=1; | ||
| 271 | |||
| 272 | return(ret); | ||
| 273 | |||
| 274 | #ifndef NO_DH /* avoid 'unreferenced label' warning if NO_DH is defined */ | ||
| 275 | err: | ||
| 276 | #endif | ||
| 277 | #ifndef NO_RSA | ||
| 278 | if (ret->rsa_tmp != NULL) | ||
| 279 | RSA_free(ret->rsa_tmp); | ||
| 280 | #endif | ||
| 281 | #ifndef NO_DH | ||
| 282 | if (ret->dh_tmp != NULL) | ||
| 283 | DH_free(ret->dh_tmp); | ||
| 284 | #endif | ||
| 285 | |||
| 286 | for (i = 0; i < SSL_PKEY_NUM; i++) | ||
| 287 | { | ||
| 288 | if (ret->pkeys[i].x509 != NULL) | ||
| 289 | X509_free(ret->pkeys[i].x509); | ||
| 290 | if (ret->pkeys[i].privatekey != NULL) | ||
| 291 | EVP_PKEY_free(ret->pkeys[i].privatekey); | ||
| 292 | } | ||
| 293 | |||
| 294 | return NULL; | ||
| 295 | } | ||
| 296 | |||
| 297 | |||
| 298 | void ssl_cert_free(CERT *c) | ||
| 299 | { | ||
| 300 | int i; | ||
| 301 | |||
| 302 | if(c == NULL) | ||
| 303 | return; | ||
| 304 | |||
| 305 | i=CRYPTO_add(&c->references,-1,CRYPTO_LOCK_SSL_CERT); | ||
| 306 | #ifdef REF_PRINT | ||
| 307 | REF_PRINT("CERT",c); | ||
| 308 | #endif | ||
| 309 | if (i > 0) return; | ||
| 310 | #ifdef REF_CHECK | ||
| 311 | if (i < 0) | ||
| 312 | { | ||
| 313 | fprintf(stderr,"ssl_cert_free, bad reference count\n"); | ||
| 314 | abort(); /* ok */ | ||
| 315 | } | ||
| 316 | #endif | ||
| 317 | |||
| 318 | #ifndef NO_RSA | ||
| 319 | if (c->rsa_tmp) RSA_free(c->rsa_tmp); | ||
| 320 | #endif | ||
| 321 | #ifndef NO_DH | ||
| 322 | if (c->dh_tmp) DH_free(c->dh_tmp); | ||
| 323 | #endif | ||
| 324 | |||
| 325 | for (i=0; i<SSL_PKEY_NUM; i++) | ||
| 326 | { | ||
| 327 | if (c->pkeys[i].x509 != NULL) | ||
| 328 | X509_free(c->pkeys[i].x509); | ||
| 329 | if (c->pkeys[i].privatekey != NULL) | ||
| 330 | EVP_PKEY_free(c->pkeys[i].privatekey); | ||
| 331 | #if 0 | ||
| 332 | if (c->pkeys[i].publickey != NULL) | ||
| 333 | EVP_PKEY_free(c->pkeys[i].publickey); | ||
| 334 | #endif | ||
| 335 | } | ||
| 336 | OPENSSL_free(c); | ||
| 337 | } | ||
| 338 | |||
| 339 | int ssl_cert_inst(CERT **o) | ||
| 340 | { | ||
| 341 | /* Create a CERT if there isn't already one | ||
| 342 | * (which cannot really happen, as it is initially created in | ||
| 343 | * SSL_CTX_new; but the earlier code usually allows for that one | ||
| 344 | * being non-existant, so we follow that behaviour, as it might | ||
| 345 | * turn out that there actually is a reason for it -- but I'm | ||
| 346 | * not sure that *all* of the existing code could cope with | ||
| 347 | * s->cert being NULL, otherwise we could do without the | ||
| 348 | * initialization in SSL_CTX_new). | ||
| 349 | */ | ||
| 350 | |||
| 351 | if (o == NULL) | ||
| 352 | { | ||
| 353 | SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER); | ||
| 354 | return(0); | ||
| 355 | } | ||
| 356 | if (*o == NULL) | ||
| 357 | { | ||
| 358 | if ((*o = ssl_cert_new()) == NULL) | ||
| 359 | { | ||
| 360 | SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE); | ||
| 361 | return(0); | ||
| 362 | } | ||
| 363 | } | ||
| 364 | return(1); | ||
| 365 | } | ||
| 366 | |||
| 367 | |||
| 368 | SESS_CERT *ssl_sess_cert_new(void) | ||
| 369 | { | ||
| 370 | SESS_CERT *ret; | ||
| 371 | |||
| 372 | ret = OPENSSL_malloc(sizeof *ret); | ||
| 373 | if (ret == NULL) | ||
| 374 | { | ||
| 375 | SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); | ||
| 376 | return NULL; | ||
| 377 | } | ||
| 378 | |||
| 379 | memset(ret, 0 ,sizeof *ret); | ||
| 380 | ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); | ||
| 381 | ret->references = 1; | ||
| 382 | |||
| 383 | return ret; | ||
| 384 | } | ||
| 385 | |||
| 386 | void ssl_sess_cert_free(SESS_CERT *sc) | ||
| 387 | { | ||
| 388 | int i; | ||
| 389 | |||
| 390 | if (sc == NULL) | ||
| 391 | return; | ||
| 392 | |||
| 393 | i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT); | ||
| 394 | #ifdef REF_PRINT | ||
| 395 | REF_PRINT("SESS_CERT", sc); | ||
| 396 | #endif | ||
| 397 | if (i > 0) | ||
| 398 | return; | ||
| 399 | #ifdef REF_CHECK | ||
| 400 | if (i < 0) | ||
| 401 | { | ||
| 402 | fprintf(stderr,"ssl_sess_cert_free, bad reference count\n"); | ||
| 403 | abort(); /* ok */ | ||
| 404 | } | ||
| 405 | #endif | ||
| 406 | |||
| 407 | /* i == 0 */ | ||
| 408 | if (sc->cert_chain != NULL) | ||
| 409 | sk_X509_pop_free(sc->cert_chain, X509_free); | ||
| 410 | for (i = 0; i < SSL_PKEY_NUM; i++) | ||
| 411 | { | ||
| 412 | if (sc->peer_pkeys[i].x509 != NULL) | ||
| 413 | X509_free(sc->peer_pkeys[i].x509); | ||
| 414 | #if 0 /* We don't have the peer's private key. These lines are just | ||
| 415 | * here as a reminder that we're still using a not-quite-appropriate | ||
| 416 | * data structure. */ | ||
| 417 | if (sc->peer_pkeys[i].privatekey != NULL) | ||
| 418 | EVP_PKEY_free(sc->peer_pkeys[i].privatekey); | ||
| 419 | #endif | ||
| 420 | } | ||
| 421 | |||
| 422 | #ifndef NO_RSA | ||
| 423 | if (sc->peer_rsa_tmp != NULL) | ||
| 424 | RSA_free(sc->peer_rsa_tmp); | ||
| 425 | #endif | ||
| 426 | #ifndef NO_DH | ||
| 427 | if (sc->peer_dh_tmp != NULL) | ||
| 428 | DH_free(sc->peer_dh_tmp); | ||
| 429 | #endif | ||
| 430 | |||
| 431 | OPENSSL_free(sc); | ||
| 432 | } | ||
| 433 | |||
| 434 | int ssl_set_peer_cert_type(SESS_CERT *sc,int type) | ||
| 435 | { | ||
| 436 | sc->peer_cert_type = type; | ||
| 437 | return(1); | ||
| 438 | } | ||
| 439 | |||
| 440 | int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk) | ||
| 441 | { | ||
| 442 | X509 *x; | ||
| 443 | int i; | ||
| 444 | X509_STORE_CTX ctx; | ||
| 445 | |||
| 446 | if ((sk == NULL) || (sk_X509_num(sk) == 0)) | ||
| 447 | return(0); | ||
| 448 | |||
| 449 | x=sk_X509_value(sk,0); | ||
| 450 | X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk); | ||
| 451 | if (SSL_get_verify_depth(s) >= 0) | ||
| 452 | X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s)); | ||
| 453 | X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s); | ||
| 454 | /* We need to set the verify purpose. The purpose can be determined by | ||
| 455 | * the context: if its a server it will verify SSL client certificates | ||
| 456 | * or vice versa. | ||
| 457 | */ | ||
| 458 | |||
| 459 | if(s->server) i = X509_PURPOSE_SSL_CLIENT; | ||
| 460 | else i = X509_PURPOSE_SSL_SERVER; | ||
| 461 | |||
| 462 | X509_STORE_CTX_purpose_inherit(&ctx, i, s->purpose, s->trust); | ||
| 463 | |||
| 464 | if (s->ctx->app_verify_callback != NULL) | ||
| 465 | i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */ | ||
| 466 | else | ||
| 467 | { | ||
| 468 | #ifndef NO_X509_VERIFY | ||
| 469 | i=X509_verify_cert(&ctx); | ||
| 470 | #else | ||
| 471 | i=0; | ||
| 472 | ctx.error=X509_V_ERR_APPLICATION_VERIFICATION; | ||
| 473 | SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,SSL_R_NO_VERIFY_CALLBACK); | ||
| 474 | #endif | ||
| 475 | } | ||
| 476 | |||
| 477 | s->verify_result=ctx.error; | ||
| 478 | X509_STORE_CTX_cleanup(&ctx); | ||
| 479 | |||
| 480 | return(i); | ||
| 481 | } | ||
| 482 | |||
| 483 | static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *list) | ||
| 484 | { | ||
| 485 | if (*ca_list != NULL) | ||
| 486 | sk_X509_NAME_pop_free(*ca_list,X509_NAME_free); | ||
| 487 | |||
| 488 | *ca_list=list; | ||
| 489 | } | ||
| 490 | |||
| 491 | STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk) | ||
| 492 | { | ||
| 493 | int i; | ||
| 494 | STACK_OF(X509_NAME) *ret; | ||
| 495 | X509_NAME *name; | ||
| 496 | |||
| 497 | ret=sk_X509_NAME_new_null(); | ||
| 498 | for (i=0; i<sk_X509_NAME_num(sk); i++) | ||
| 499 | { | ||
| 500 | name=X509_NAME_dup(sk_X509_NAME_value(sk,i)); | ||
| 501 | if ((name == NULL) || !sk_X509_NAME_push(ret,name)) | ||
| 502 | { | ||
| 503 | sk_X509_NAME_pop_free(ret,X509_NAME_free); | ||
| 504 | return(NULL); | ||
| 505 | } | ||
| 506 | } | ||
| 507 | return(ret); | ||
| 508 | } | ||
| 509 | |||
| 510 | void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *list) | ||
| 511 | { | ||
| 512 | set_client_CA_list(&(s->client_CA),list); | ||
| 513 | } | ||
| 514 | |||
| 515 | void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *list) | ||
| 516 | { | ||
| 517 | set_client_CA_list(&(ctx->client_CA),list); | ||
| 518 | } | ||
| 519 | |||
| 520 | STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(SSL_CTX *ctx) | ||
| 521 | { | ||
| 522 | return(ctx->client_CA); | ||
| 523 | } | ||
| 524 | |||
| 525 | STACK_OF(X509_NAME) *SSL_get_client_CA_list(SSL *s) | ||
| 526 | { | ||
| 527 | if (s->type == SSL_ST_CONNECT) | ||
| 528 | { /* we are in the client */ | ||
| 529 | if (((s->version>>8) == SSL3_VERSION_MAJOR) && | ||
| 530 | (s->s3 != NULL)) | ||
| 531 | return(s->s3->tmp.ca_names); | ||
| 532 | else | ||
| 533 | return(NULL); | ||
| 534 | } | ||
| 535 | else | ||
| 536 | { | ||
| 537 | if (s->client_CA != NULL) | ||
| 538 | return(s->client_CA); | ||
| 539 | else | ||
| 540 | return(s->ctx->client_CA); | ||
| 541 | } | ||
| 542 | } | ||
| 543 | |||
| 544 | static int add_client_CA(STACK_OF(X509_NAME) **sk,X509 *x) | ||
| 545 | { | ||
| 546 | X509_NAME *name; | ||
| 547 | |||
| 548 | if (x == NULL) return(0); | ||
| 549 | if ((*sk == NULL) && ((*sk=sk_X509_NAME_new_null()) == NULL)) | ||
| 550 | return(0); | ||
| 551 | |||
| 552 | if ((name=X509_NAME_dup(X509_get_subject_name(x))) == NULL) | ||
| 553 | return(0); | ||
| 554 | |||
| 555 | if (!sk_X509_NAME_push(*sk,name)) | ||
| 556 | { | ||
| 557 | X509_NAME_free(name); | ||
| 558 | return(0); | ||
| 559 | } | ||
| 560 | return(1); | ||
| 561 | } | ||
| 562 | |||
| 563 | int SSL_add_client_CA(SSL *ssl,X509 *x) | ||
| 564 | { | ||
| 565 | return(add_client_CA(&(ssl->client_CA),x)); | ||
| 566 | } | ||
| 567 | |||
| 568 | int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x) | ||
| 569 | { | ||
| 570 | return(add_client_CA(&(ctx->client_CA),x)); | ||
| 571 | } | ||
| 572 | |||
| 573 | static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b) | ||
| 574 | { | ||
| 575 | return(X509_NAME_cmp(*a,*b)); | ||
| 576 | } | ||
| 577 | |||
| 578 | #ifndef NO_STDIO | ||
| 579 | /*! | ||
| 580 | * Load CA certs from a file into a ::STACK. Note that it is somewhat misnamed; | ||
| 581 | * it doesn't really have anything to do with clients (except that a common use | ||
| 582 | * for a stack of CAs is to send it to the client). Actually, it doesn't have | ||
| 583 | * much to do with CAs, either, since it will load any old cert. | ||
| 584 | * \param file the file containing one or more certs. | ||
| 585 | * \return a ::STACK containing the certs. | ||
| 586 | */ | ||
| 587 | STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) | ||
| 588 | { | ||
| 589 | BIO *in; | ||
| 590 | X509 *x=NULL; | ||
| 591 | X509_NAME *xn=NULL; | ||
| 592 | STACK_OF(X509_NAME) *ret,*sk; | ||
| 593 | |||
| 594 | ret=sk_X509_NAME_new_null(); | ||
| 595 | sk=sk_X509_NAME_new(xname_cmp); | ||
| 596 | |||
| 597 | in=BIO_new(BIO_s_file_internal()); | ||
| 598 | |||
| 599 | if ((ret == NULL) || (sk == NULL) || (in == NULL)) | ||
| 600 | { | ||
| 601 | SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE); | ||
| 602 | goto err; | ||
| 603 | } | ||
| 604 | |||
| 605 | if (!BIO_read_filename(in,file)) | ||
| 606 | goto err; | ||
| 607 | |||
| 608 | for (;;) | ||
| 609 | { | ||
| 610 | if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL) | ||
| 611 | break; | ||
| 612 | if ((xn=X509_get_subject_name(x)) == NULL) goto err; | ||
| 613 | /* check for duplicates */ | ||
| 614 | xn=X509_NAME_dup(xn); | ||
| 615 | if (xn == NULL) goto err; | ||
| 616 | if (sk_X509_NAME_find(sk,xn) >= 0) | ||
| 617 | X509_NAME_free(xn); | ||
| 618 | else | ||
| 619 | { | ||
| 620 | sk_X509_NAME_push(sk,xn); | ||
| 621 | sk_X509_NAME_push(ret,xn); | ||
| 622 | } | ||
| 623 | } | ||
| 624 | |||
| 625 | if (0) | ||
| 626 | { | ||
| 627 | err: | ||
| 628 | if (ret != NULL) sk_X509_NAME_pop_free(ret,X509_NAME_free); | ||
| 629 | ret=NULL; | ||
| 630 | } | ||
| 631 | if (sk != NULL) sk_X509_NAME_free(sk); | ||
| 632 | if (in != NULL) BIO_free(in); | ||
| 633 | if (x != NULL) X509_free(x); | ||
| 634 | return(ret); | ||
| 635 | } | ||
| 636 | #endif | ||
| 637 | |||
| 638 | /*! | ||
| 639 | * Add a file of certs to a stack. | ||
| 640 | * \param stack the stack to add to. | ||
| 641 | * \param file the file to add from. All certs in this file that are not | ||
| 642 | * already in the stack will be added. | ||
| 643 | * \return 1 for success, 0 for failure. Note that in the case of failure some | ||
| 644 | * certs may have been added to \c stack. | ||
| 645 | */ | ||
| 646 | |||
| 647 | int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, | ||
| 648 | const char *file) | ||
| 649 | { | ||
| 650 | BIO *in; | ||
| 651 | X509 *x=NULL; | ||
| 652 | X509_NAME *xn=NULL; | ||
| 653 | int ret=1; | ||
| 654 | int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b); | ||
| 655 | |||
| 656 | oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp); | ||
| 657 | |||
| 658 | in=BIO_new(BIO_s_file_internal()); | ||
| 659 | |||
| 660 | if (in == NULL) | ||
| 661 | { | ||
| 662 | SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE); | ||
| 663 | goto err; | ||
| 664 | } | ||
| 665 | |||
| 666 | if (!BIO_read_filename(in,file)) | ||
| 667 | goto err; | ||
| 668 | |||
| 669 | for (;;) | ||
| 670 | { | ||
| 671 | if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL) | ||
| 672 | break; | ||
| 673 | if ((xn=X509_get_subject_name(x)) == NULL) goto err; | ||
| 674 | xn=X509_NAME_dup(xn); | ||
| 675 | if (xn == NULL) goto err; | ||
| 676 | if (sk_X509_NAME_find(stack,xn) >= 0) | ||
| 677 | X509_NAME_free(xn); | ||
| 678 | else | ||
| 679 | sk_X509_NAME_push(stack,xn); | ||
| 680 | } | ||
| 681 | |||
| 682 | if (0) | ||
| 683 | { | ||
| 684 | err: | ||
| 685 | ret=0; | ||
| 686 | } | ||
| 687 | if(in != NULL) | ||
| 688 | BIO_free(in); | ||
| 689 | if(x != NULL) | ||
| 690 | X509_free(x); | ||
| 691 | |||
| 692 | sk_X509_NAME_set_cmp_func(stack,oldcmp); | ||
| 693 | |||
| 694 | return ret; | ||
| 695 | } | ||
| 696 | |||
| 697 | /*! | ||
| 698 | * Add a directory of certs to a stack. | ||
| 699 | * \param stack the stack to append to. | ||
| 700 | * \param dir the directory to append from. All files in this directory will be | ||
| 701 | * examined as potential certs. Any that are acceptable to | ||
| 702 | * SSL_add_dir_cert_subjects_to_stack() that are not already in the stack will be | ||
| 703 | * included. | ||
| 704 | * \return 1 for success, 0 for failure. Note that in the case of failure some | ||
| 705 | * certs may have been added to \c stack. | ||
| 706 | */ | ||
| 707 | |||
| 708 | #ifndef WIN32 | ||
| 709 | #ifndef VMS /* XXXX This may be fixed in the future */ | ||
| 710 | #ifndef MAC_OS_pre_X | ||
| 711 | |||
| 712 | int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, | ||
| 713 | const char *dir) | ||
| 714 | { | ||
| 715 | DIR *d; | ||
| 716 | struct dirent *dstruct; | ||
| 717 | int ret = 0; | ||
| 718 | |||
| 719 | CRYPTO_w_lock(CRYPTO_LOCK_READDIR); | ||
| 720 | d = opendir(dir); | ||
| 721 | |||
| 722 | /* Note that a side effect is that the CAs will be sorted by name */ | ||
| 723 | if(!d) | ||
| 724 | { | ||
| 725 | SYSerr(SYS_F_OPENDIR, get_last_sys_error()); | ||
| 726 | ERR_add_error_data(3, "opendir('", dir, "')"); | ||
| 727 | SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB); | ||
| 728 | goto err; | ||
| 729 | } | ||
| 730 | |||
| 731 | while((dstruct=readdir(d))) | ||
| 732 | { | ||
| 733 | char buf[1024]; | ||
| 734 | int r; | ||
| 735 | |||
| 736 | if(strlen(dir)+strlen(dstruct->d_name)+2 > sizeof buf) | ||
| 737 | { | ||
| 738 | SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG); | ||
| 739 | goto err; | ||
| 740 | } | ||
| 741 | |||
| 742 | r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,dstruct->d_name); | ||
| 743 | if (r <= 0 || r >= sizeof buf) | ||
| 744 | goto err; | ||
| 745 | if(!SSL_add_file_cert_subjects_to_stack(stack,buf)) | ||
| 746 | goto err; | ||
| 747 | } | ||
| 748 | ret = 1; | ||
| 749 | |||
| 750 | err: | ||
| 751 | CRYPTO_w_unlock(CRYPTO_LOCK_READDIR); | ||
| 752 | return ret; | ||
| 753 | } | ||
| 754 | |||
| 755 | #endif | ||
| 756 | #endif | ||
| 757 | #endif | ||
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c deleted file mode 100644 index f63163f26c..0000000000 --- a/src/lib/libssl/ssl_ciph.c +++ /dev/null | |||
| @@ -1,1071 +0,0 @@ | |||
| 1 | /* ssl/ssl_ciph.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/objects.h> | ||
| 61 | #include <openssl/comp.h> | ||
| 62 | #include "ssl_locl.h" | ||
| 63 | |||
| 64 | #define SSL_ENC_DES_IDX 0 | ||
| 65 | #define SSL_ENC_3DES_IDX 1 | ||
| 66 | #define SSL_ENC_RC4_IDX 2 | ||
| 67 | #define SSL_ENC_RC2_IDX 3 | ||
| 68 | #define SSL_ENC_IDEA_IDX 4 | ||
| 69 | #define SSL_ENC_eFZA_IDX 5 | ||
| 70 | #define SSL_ENC_NULL_IDX 6 | ||
| 71 | #define SSL_ENC_NUM_IDX 7 | ||
| 72 | |||
| 73 | static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={ | ||
| 74 | NULL,NULL,NULL,NULL,NULL,NULL, | ||
| 75 | }; | ||
| 76 | |||
| 77 | static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL; | ||
| 78 | |||
| 79 | #define SSL_MD_MD5_IDX 0 | ||
| 80 | #define SSL_MD_SHA1_IDX 1 | ||
| 81 | #define SSL_MD_NUM_IDX 2 | ||
| 82 | static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={ | ||
| 83 | NULL,NULL, | ||
| 84 | }; | ||
| 85 | |||
| 86 | #define CIPHER_ADD 1 | ||
| 87 | #define CIPHER_KILL 2 | ||
| 88 | #define CIPHER_DEL 3 | ||
| 89 | #define CIPHER_ORD 4 | ||
| 90 | #define CIPHER_SPECIAL 5 | ||
| 91 | |||
| 92 | typedef struct cipher_order_st | ||
| 93 | { | ||
| 94 | SSL_CIPHER *cipher; | ||
| 95 | int active; | ||
| 96 | int dead; | ||
| 97 | struct cipher_order_st *next,*prev; | ||
| 98 | } CIPHER_ORDER; | ||
| 99 | |||
| 100 | static const SSL_CIPHER cipher_aliases[]={ | ||
| 101 | /* Don't include eNULL unless specifically enabled */ | ||
| 102 | {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */ | ||
| 103 | {0,SSL_TXT_kRSA,0,SSL_kRSA, 0,0,0,0,SSL_MKEY_MASK,0}, | ||
| 104 | {0,SSL_TXT_kDHr,0,SSL_kDHr, 0,0,0,0,SSL_MKEY_MASK,0}, | ||
| 105 | {0,SSL_TXT_kDHd,0,SSL_kDHd, 0,0,0,0,SSL_MKEY_MASK,0}, | ||
| 106 | {0,SSL_TXT_kEDH,0,SSL_kEDH, 0,0,0,0,SSL_MKEY_MASK,0}, | ||
| 107 | {0,SSL_TXT_kFZA,0,SSL_kFZA, 0,0,0,0,SSL_MKEY_MASK,0}, | ||
| 108 | {0,SSL_TXT_DH, 0,SSL_DH, 0,0,0,0,SSL_MKEY_MASK,0}, | ||
| 109 | {0,SSL_TXT_EDH, 0,SSL_EDH, 0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0}, | ||
| 110 | |||
| 111 | {0,SSL_TXT_aRSA,0,SSL_aRSA, 0,0,0,0,SSL_AUTH_MASK,0}, | ||
| 112 | {0,SSL_TXT_aDSS,0,SSL_aDSS, 0,0,0,0,SSL_AUTH_MASK,0}, | ||
| 113 | {0,SSL_TXT_aFZA,0,SSL_aFZA, 0,0,0,0,SSL_AUTH_MASK,0}, | ||
| 114 | {0,SSL_TXT_aNULL,0,SSL_aNULL,0,0,0,0,SSL_AUTH_MASK,0}, | ||
| 115 | {0,SSL_TXT_aDH, 0,SSL_aDH, 0,0,0,0,SSL_AUTH_MASK,0}, | ||
| 116 | {0,SSL_TXT_DSS, 0,SSL_DSS, 0,0,0,0,SSL_AUTH_MASK,0}, | ||
| 117 | |||
| 118 | {0,SSL_TXT_DES, 0,SSL_DES, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 119 | {0,SSL_TXT_3DES,0,SSL_3DES, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 120 | {0,SSL_TXT_RC4, 0,SSL_RC4, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 121 | {0,SSL_TXT_RC2, 0,SSL_RC2, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 122 | {0,SSL_TXT_IDEA,0,SSL_IDEA, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 123 | {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0}, | ||
| 124 | {0,SSL_TXT_eFZA,0,SSL_eFZA, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 125 | |||
| 126 | {0,SSL_TXT_MD5, 0,SSL_MD5, 0,0,0,0,SSL_MAC_MASK,0}, | ||
| 127 | {0,SSL_TXT_SHA1,0,SSL_SHA1, 0,0,0,0,SSL_MAC_MASK,0}, | ||
| 128 | {0,SSL_TXT_SHA, 0,SSL_SHA, 0,0,0,0,SSL_MAC_MASK,0}, | ||
| 129 | |||
| 130 | {0,SSL_TXT_NULL,0,SSL_NULL, 0,0,0,0,SSL_ENC_MASK,0}, | ||
| 131 | {0,SSL_TXT_RSA, 0,SSL_RSA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0}, | ||
| 132 | {0,SSL_TXT_ADH, 0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0}, | ||
| 133 | {0,SSL_TXT_FZA, 0,SSL_FZA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0}, | ||
| 134 | |||
| 135 | {0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,0,0,0,SSL_SSL_MASK,0}, | ||
| 136 | {0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,0,0,0,SSL_SSL_MASK,0}, | ||
| 137 | {0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,0,0,0,SSL_SSL_MASK,0}, | ||
| 138 | |||
| 139 | {0,SSL_TXT_EXP ,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK}, | ||
| 140 | {0,SSL_TXT_EXPORT,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK}, | ||
| 141 | {0,SSL_TXT_EXP40, 0, 0, SSL_EXP40, 0,0,0,0,SSL_STRONG_MASK}, | ||
| 142 | {0,SSL_TXT_EXP56, 0, 0, SSL_EXP56, 0,0,0,0,SSL_STRONG_MASK}, | ||
| 143 | {0,SSL_TXT_LOW, 0, 0, SSL_LOW, 0,0,0,0,SSL_STRONG_MASK}, | ||
| 144 | {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK}, | ||
| 145 | {0,SSL_TXT_HIGH, 0, 0, SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK}, | ||
| 146 | }; | ||
| 147 | |||
| 148 | static int init_ciphers=1; | ||
| 149 | |||
| 150 | static void load_ciphers(void) | ||
| 151 | { | ||
| 152 | init_ciphers=0; | ||
| 153 | ssl_cipher_methods[SSL_ENC_DES_IDX]= | ||
| 154 | EVP_get_cipherbyname(SN_des_cbc); | ||
| 155 | ssl_cipher_methods[SSL_ENC_3DES_IDX]= | ||
| 156 | EVP_get_cipherbyname(SN_des_ede3_cbc); | ||
| 157 | ssl_cipher_methods[SSL_ENC_RC4_IDX]= | ||
| 158 | EVP_get_cipherbyname(SN_rc4); | ||
| 159 | ssl_cipher_methods[SSL_ENC_RC2_IDX]= | ||
| 160 | EVP_get_cipherbyname(SN_rc2_cbc); | ||
| 161 | ssl_cipher_methods[SSL_ENC_IDEA_IDX]= | ||
| 162 | EVP_get_cipherbyname(SN_idea_cbc); | ||
| 163 | |||
| 164 | ssl_digest_methods[SSL_MD_MD5_IDX]= | ||
| 165 | EVP_get_digestbyname(SN_md5); | ||
| 166 | ssl_digest_methods[SSL_MD_SHA1_IDX]= | ||
| 167 | EVP_get_digestbyname(SN_sha1); | ||
| 168 | } | ||
| 169 | |||
| 170 | int ssl_cipher_get_evp(SSL_SESSION *s, const EVP_CIPHER **enc, | ||
| 171 | const EVP_MD **md, SSL_COMP **comp) | ||
| 172 | { | ||
| 173 | int i; | ||
| 174 | SSL_CIPHER *c; | ||
| 175 | |||
| 176 | c=s->cipher; | ||
| 177 | if (c == NULL) return(0); | ||
| 178 | if (comp != NULL) | ||
| 179 | { | ||
| 180 | SSL_COMP ctmp; | ||
| 181 | |||
| 182 | if (s->compress_meth == 0) | ||
| 183 | *comp=NULL; | ||
| 184 | else if (ssl_comp_methods == NULL) | ||
| 185 | { | ||
| 186 | /* bad */ | ||
| 187 | *comp=NULL; | ||
| 188 | } | ||
| 189 | else | ||
| 190 | { | ||
| 191 | |||
| 192 | ctmp.id=s->compress_meth; | ||
| 193 | i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp); | ||
| 194 | if (i >= 0) | ||
| 195 | *comp=sk_SSL_COMP_value(ssl_comp_methods,i); | ||
| 196 | else | ||
| 197 | *comp=NULL; | ||
| 198 | } | ||
| 199 | } | ||
| 200 | |||
| 201 | if ((enc == NULL) || (md == NULL)) return(0); | ||
| 202 | |||
| 203 | switch (c->algorithms & SSL_ENC_MASK) | ||
| 204 | { | ||
| 205 | case SSL_DES: | ||
| 206 | i=SSL_ENC_DES_IDX; | ||
| 207 | break; | ||
| 208 | case SSL_3DES: | ||
| 209 | i=SSL_ENC_3DES_IDX; | ||
| 210 | break; | ||
| 211 | case SSL_RC4: | ||
| 212 | i=SSL_ENC_RC4_IDX; | ||
| 213 | break; | ||
| 214 | case SSL_RC2: | ||
| 215 | i=SSL_ENC_RC2_IDX; | ||
| 216 | break; | ||
| 217 | case SSL_IDEA: | ||
| 218 | i=SSL_ENC_IDEA_IDX; | ||
| 219 | break; | ||
| 220 | case SSL_eNULL: | ||
| 221 | i=SSL_ENC_NULL_IDX; | ||
| 222 | break; | ||
| 223 | default: | ||
| 224 | i= -1; | ||
| 225 | break; | ||
| 226 | } | ||
| 227 | |||
| 228 | if ((i < 0) || (i > SSL_ENC_NUM_IDX)) | ||
| 229 | *enc=NULL; | ||
| 230 | else | ||
| 231 | { | ||
| 232 | if (i == SSL_ENC_NULL_IDX) | ||
| 233 | *enc=EVP_enc_null(); | ||
| 234 | else | ||
| 235 | *enc=ssl_cipher_methods[i]; | ||
| 236 | } | ||
| 237 | |||
| 238 | switch (c->algorithms & SSL_MAC_MASK) | ||
| 239 | { | ||
| 240 | case SSL_MD5: | ||
| 241 | i=SSL_MD_MD5_IDX; | ||
| 242 | break; | ||
| 243 | case SSL_SHA1: | ||
| 244 | i=SSL_MD_SHA1_IDX; | ||
| 245 | break; | ||
| 246 | default: | ||
| 247 | i= -1; | ||
| 248 | break; | ||
| 249 | } | ||
| 250 | if ((i < 0) || (i > SSL_MD_NUM_IDX)) | ||
| 251 | *md=NULL; | ||
| 252 | else | ||
| 253 | *md=ssl_digest_methods[i]; | ||
| 254 | |||
| 255 | if ((*enc != NULL) && (*md != NULL)) | ||
| 256 | return(1); | ||
| 257 | else | ||
| 258 | return(0); | ||
| 259 | } | ||
| 260 | |||
| 261 | #define ITEM_SEP(a) \ | ||
| 262 | (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ',')) | ||
| 263 | |||
| 264 | static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr, | ||
| 265 | CIPHER_ORDER **tail) | ||
| 266 | { | ||
| 267 | if (curr == *tail) return; | ||
| 268 | if (curr == *head) | ||
| 269 | *head=curr->next; | ||
| 270 | if (curr->prev != NULL) | ||
| 271 | curr->prev->next=curr->next; | ||
| 272 | if (curr->next != NULL) /* should always be true */ | ||
| 273 | curr->next->prev=curr->prev; | ||
| 274 | (*tail)->next=curr; | ||
| 275 | curr->prev= *tail; | ||
| 276 | curr->next=NULL; | ||
| 277 | *tail=curr; | ||
| 278 | } | ||
| 279 | |||
| 280 | static unsigned long ssl_cipher_get_disabled(void) | ||
| 281 | { | ||
| 282 | unsigned long mask; | ||
| 283 | |||
| 284 | mask = SSL_kFZA; | ||
| 285 | #ifdef NO_RSA | ||
| 286 | mask |= SSL_aRSA|SSL_kRSA; | ||
| 287 | #endif | ||
| 288 | #ifdef NO_DSA | ||
| 289 | mask |= SSL_aDSS; | ||
| 290 | #endif | ||
| 291 | #ifdef NO_DH | ||
| 292 | mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH; | ||
| 293 | #endif | ||
| 294 | |||
| 295 | #ifdef SSL_FORBID_ENULL | ||
| 296 | mask |= SSL_eNULL; | ||
| 297 | #endif | ||
| 298 | |||
| 299 | mask |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES :0; | ||
| 300 | mask |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES:0; | ||
| 301 | mask |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 :0; | ||
| 302 | mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0; | ||
| 303 | mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0; | ||
| 304 | mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0; | ||
| 305 | |||
| 306 | mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0; | ||
| 307 | mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0; | ||
| 308 | |||
| 309 | return(mask); | ||
| 310 | } | ||
| 311 | |||
| 312 | static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, | ||
| 313 | int num_of_ciphers, unsigned long mask, CIPHER_ORDER *list, | ||
| 314 | CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) | ||
| 315 | { | ||
| 316 | int i, list_num; | ||
| 317 | SSL_CIPHER *c; | ||
| 318 | |||
| 319 | /* | ||
| 320 | * We have num_of_ciphers descriptions compiled in, depending on the | ||
| 321 | * method selected (SSLv2 and/or SSLv3, TLSv1 etc). | ||
| 322 | * These will later be sorted in a linked list with at most num | ||
| 323 | * entries. | ||
| 324 | */ | ||
| 325 | |||
| 326 | /* Get the initial list of ciphers */ | ||
| 327 | list_num = 0; /* actual count of ciphers */ | ||
| 328 | for (i = 0; i < num_of_ciphers; i++) | ||
| 329 | { | ||
| 330 | c = ssl_method->get_cipher(i); | ||
| 331 | /* drop those that use any of that is not available */ | ||
| 332 | if ((c != NULL) && c->valid && !(c->algorithms & mask)) | ||
| 333 | { | ||
| 334 | list[list_num].cipher = c; | ||
| 335 | list[list_num].next = NULL; | ||
| 336 | list[list_num].prev = NULL; | ||
| 337 | list[list_num].active = 0; | ||
| 338 | list_num++; | ||
| 339 | /* | ||
| 340 | if (!sk_push(ca_list,(char *)c)) goto err; | ||
| 341 | */ | ||
| 342 | } | ||
| 343 | } | ||
| 344 | |||
| 345 | /* | ||
| 346 | * Prepare linked list from list entries | ||
| 347 | */ | ||
| 348 | for (i = 1; i < list_num - 1; i++) | ||
| 349 | { | ||
| 350 | list[i].prev = &(list[i-1]); | ||
| 351 | list[i].next = &(list[i+1]); | ||
| 352 | } | ||
| 353 | if (list_num > 0) | ||
| 354 | { | ||
| 355 | (*head_p) = &(list[0]); | ||
| 356 | (*head_p)->prev = NULL; | ||
| 357 | (*head_p)->next = &(list[1]); | ||
| 358 | (*tail_p) = &(list[list_num - 1]); | ||
| 359 | (*tail_p)->prev = &(list[list_num - 2]); | ||
| 360 | (*tail_p)->next = NULL; | ||
| 361 | } | ||
| 362 | } | ||
| 363 | |||
| 364 | static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list, | ||
| 365 | int num_of_group_aliases, unsigned long mask, | ||
| 366 | CIPHER_ORDER *head) | ||
| 367 | { | ||
| 368 | CIPHER_ORDER *ciph_curr; | ||
| 369 | SSL_CIPHER **ca_curr; | ||
| 370 | int i; | ||
| 371 | |||
| 372 | /* | ||
| 373 | * First, add the real ciphers as already collected | ||
| 374 | */ | ||
| 375 | ciph_curr = head; | ||
| 376 | ca_curr = ca_list; | ||
| 377 | while (ciph_curr != NULL) | ||
| 378 | { | ||
| 379 | *ca_curr = ciph_curr->cipher; | ||
| 380 | ca_curr++; | ||
| 381 | ciph_curr = ciph_curr->next; | ||
| 382 | } | ||
| 383 | |||
| 384 | /* | ||
| 385 | * Now we add the available ones from the cipher_aliases[] table. | ||
| 386 | * They represent either an algorithm, that must be fully | ||
| 387 | * supported (not match any bit in mask) or represent a cipher | ||
| 388 | * strength value (will be added in any case because algorithms=0). | ||
| 389 | */ | ||
| 390 | for (i = 0; i < num_of_group_aliases; i++) | ||
| 391 | { | ||
| 392 | if ((i == 0) || /* always fetch "ALL" */ | ||
| 393 | !(cipher_aliases[i].algorithms & mask)) | ||
| 394 | { | ||
| 395 | *ca_curr = (SSL_CIPHER *)(cipher_aliases + i); | ||
| 396 | ca_curr++; | ||
| 397 | } | ||
| 398 | } | ||
| 399 | |||
| 400 | *ca_curr = NULL; /* end of list */ | ||
| 401 | } | ||
| 402 | |||
| 403 | static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, | ||
| 404 | unsigned long algo_strength, unsigned long mask_strength, | ||
| 405 | int rule, int strength_bits, CIPHER_ORDER *list, | ||
| 406 | CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) | ||
| 407 | { | ||
| 408 | CIPHER_ORDER *head, *tail, *curr, *curr2, *tail2; | ||
| 409 | SSL_CIPHER *cp; | ||
| 410 | unsigned long ma, ma_s; | ||
| 411 | |||
| 412 | #ifdef CIPHER_DEBUG | ||
| 413 | printf("Applying rule %d with %08lx %08lx %08lx %08lx (%d)\n", | ||
| 414 | rule, algorithms, mask, algo_strength, mask_strength, | ||
| 415 | strength_bits); | ||
| 416 | #endif | ||
| 417 | |||
| 418 | curr = head = *head_p; | ||
| 419 | curr2 = head; | ||
| 420 | tail2 = tail = *tail_p; | ||
| 421 | for (;;) | ||
| 422 | { | ||
| 423 | if ((curr == NULL) || (curr == tail2)) break; | ||
| 424 | curr = curr2; | ||
| 425 | curr2 = curr->next; | ||
| 426 | |||
| 427 | cp = curr->cipher; | ||
| 428 | |||
| 429 | /* | ||
| 430 | * Selection criteria is either the number of strength_bits | ||
| 431 | * or the algorithm used. | ||
| 432 | */ | ||
| 433 | if (strength_bits == -1) | ||
| 434 | { | ||
| 435 | ma = mask & cp->algorithms; | ||
| 436 | ma_s = mask_strength & cp->algo_strength; | ||
| 437 | |||
| 438 | #ifdef CIPHER_DEBUG | ||
| 439 | printf("\nName: %s:\nAlgo = %08lx Algo_strength = %08lx\nMask = %08lx Mask_strength %08lx\n", cp->name, cp->algorithms, cp->algo_strength, mask, mask_strength); | ||
| 440 | printf("ma = %08lx ma_s %08lx, ma&algo=%08lx, ma_s&algos=%08lx\n", ma, ma_s, ma&algorithms, ma_s&algo_strength); | ||
| 441 | #endif | ||
| 442 | /* | ||
| 443 | * Select: if none of the mask bit was met from the | ||
| 444 | * cipher or not all of the bits were met, the | ||
| 445 | * selection does not apply. | ||
| 446 | */ | ||
| 447 | if (((ma == 0) && (ma_s == 0)) || | ||
| 448 | ((ma & algorithms) != ma) || | ||
| 449 | ((ma_s & algo_strength) != ma_s)) | ||
| 450 | continue; /* does not apply */ | ||
| 451 | } | ||
| 452 | else if (strength_bits != cp->strength_bits) | ||
| 453 | continue; /* does not apply */ | ||
| 454 | |||
| 455 | #ifdef CIPHER_DEBUG | ||
| 456 | printf("Action = %d\n", rule); | ||
| 457 | #endif | ||
| 458 | |||
| 459 | /* add the cipher if it has not been added yet. */ | ||
| 460 | if (rule == CIPHER_ADD) | ||
| 461 | { | ||
| 462 | if (!curr->active) | ||
| 463 | { | ||
| 464 | ll_append_tail(&head, curr, &tail); | ||
| 465 | curr->active = 1; | ||
| 466 | } | ||
| 467 | } | ||
| 468 | /* Move the added cipher to this location */ | ||
| 469 | else if (rule == CIPHER_ORD) | ||
| 470 | { | ||
| 471 | if (curr->active) | ||
| 472 | { | ||
| 473 | ll_append_tail(&head, curr, &tail); | ||
| 474 | } | ||
| 475 | } | ||
| 476 | else if (rule == CIPHER_DEL) | ||
| 477 | curr->active = 0; | ||
| 478 | else if (rule == CIPHER_KILL) | ||
| 479 | { | ||
| 480 | if (head == curr) | ||
| 481 | head = curr->next; | ||
| 482 | else | ||
| 483 | curr->prev->next = curr->next; | ||
| 484 | if (tail == curr) | ||
| 485 | tail = curr->prev; | ||
| 486 | curr->active = 0; | ||
| 487 | if (curr->next != NULL) | ||
| 488 | curr->next->prev = curr->prev; | ||
| 489 | if (curr->prev != NULL) | ||
| 490 | curr->prev->next = curr->next; | ||
| 491 | curr->next = NULL; | ||
| 492 | curr->prev = NULL; | ||
| 493 | } | ||
| 494 | } | ||
| 495 | |||
| 496 | *head_p = head; | ||
| 497 | *tail_p = tail; | ||
| 498 | } | ||
| 499 | |||
| 500 | static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p, | ||
| 501 | CIPHER_ORDER **tail_p) | ||
| 502 | { | ||
| 503 | int max_strength_bits, i, *number_uses; | ||
| 504 | CIPHER_ORDER *curr; | ||
| 505 | |||
| 506 | /* | ||
| 507 | * This routine sorts the ciphers with descending strength. The sorting | ||
| 508 | * must keep the pre-sorted sequence, so we apply the normal sorting | ||
| 509 | * routine as '+' movement to the end of the list. | ||
| 510 | */ | ||
| 511 | max_strength_bits = 0; | ||
| 512 | curr = *head_p; | ||
| 513 | while (curr != NULL) | ||
| 514 | { | ||
| 515 | if (curr->active && | ||
| 516 | (curr->cipher->strength_bits > max_strength_bits)) | ||
| 517 | max_strength_bits = curr->cipher->strength_bits; | ||
| 518 | curr = curr->next; | ||
| 519 | } | ||
| 520 | |||
| 521 | number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int)); | ||
| 522 | if (!number_uses) | ||
| 523 | { | ||
| 524 | SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE); | ||
| 525 | return(0); | ||
| 526 | } | ||
| 527 | memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int)); | ||
| 528 | |||
| 529 | /* | ||
| 530 | * Now find the strength_bits values actually used | ||
| 531 | */ | ||
| 532 | curr = *head_p; | ||
| 533 | while (curr != NULL) | ||
| 534 | { | ||
| 535 | if (curr->active) | ||
| 536 | number_uses[curr->cipher->strength_bits]++; | ||
| 537 | curr = curr->next; | ||
| 538 | } | ||
| 539 | /* | ||
| 540 | * Go through the list of used strength_bits values in descending | ||
| 541 | * order. | ||
| 542 | */ | ||
| 543 | for (i = max_strength_bits; i >= 0; i--) | ||
| 544 | if (number_uses[i] > 0) | ||
| 545 | ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i, | ||
| 546 | list, head_p, tail_p); | ||
| 547 | |||
| 548 | OPENSSL_free(number_uses); | ||
| 549 | return(1); | ||
| 550 | } | ||
| 551 | |||
| 552 | static int ssl_cipher_process_rulestr(const char *rule_str, | ||
| 553 | CIPHER_ORDER *list, CIPHER_ORDER **head_p, | ||
| 554 | CIPHER_ORDER **tail_p, SSL_CIPHER **ca_list) | ||
| 555 | { | ||
| 556 | unsigned long algorithms, mask, algo_strength, mask_strength; | ||
| 557 | const char *l, *start, *buf; | ||
| 558 | int j, multi, found, rule, retval, ok, buflen; | ||
| 559 | char ch; | ||
| 560 | |||
| 561 | retval = 1; | ||
| 562 | l = rule_str; | ||
| 563 | for (;;) | ||
| 564 | { | ||
| 565 | ch = *l; | ||
| 566 | |||
| 567 | if (ch == '\0') | ||
| 568 | break; /* done */ | ||
| 569 | if (ch == '-') | ||
| 570 | { rule = CIPHER_DEL; l++; } | ||
| 571 | else if (ch == '+') | ||
| 572 | { rule = CIPHER_ORD; l++; } | ||
| 573 | else if (ch == '!') | ||
| 574 | { rule = CIPHER_KILL; l++; } | ||
| 575 | else if (ch == '@') | ||
| 576 | { rule = CIPHER_SPECIAL; l++; } | ||
| 577 | else | ||
| 578 | { rule = CIPHER_ADD; } | ||
| 579 | |||
| 580 | if (ITEM_SEP(ch)) | ||
| 581 | { | ||
| 582 | l++; | ||
| 583 | continue; | ||
| 584 | } | ||
| 585 | |||
| 586 | algorithms = mask = algo_strength = mask_strength = 0; | ||
| 587 | |||
| 588 | start=l; | ||
| 589 | for (;;) | ||
| 590 | { | ||
| 591 | ch = *l; | ||
| 592 | buf = l; | ||
| 593 | buflen = 0; | ||
| 594 | #ifndef CHARSET_EBCDIC | ||
| 595 | while ( ((ch >= 'A') && (ch <= 'Z')) || | ||
| 596 | ((ch >= '0') && (ch <= '9')) || | ||
| 597 | ((ch >= 'a') && (ch <= 'z')) || | ||
| 598 | (ch == '-')) | ||
| 599 | #else | ||
| 600 | while ( isalnum(ch) || (ch == '-')) | ||
| 601 | #endif | ||
| 602 | { | ||
| 603 | ch = *(++l); | ||
| 604 | buflen++; | ||
| 605 | } | ||
| 606 | |||
| 607 | if (buflen == 0) | ||
| 608 | { | ||
| 609 | /* | ||
| 610 | * We hit something we cannot deal with, | ||
| 611 | * it is no command or separator nor | ||
| 612 | * alphanumeric, so we call this an error. | ||
| 613 | */ | ||
| 614 | SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, | ||
| 615 | SSL_R_INVALID_COMMAND); | ||
| 616 | retval = found = 0; | ||
| 617 | l++; | ||
| 618 | break; | ||
| 619 | } | ||
| 620 | |||
| 621 | if (rule == CIPHER_SPECIAL) | ||
| 622 | { | ||
| 623 | found = 0; /* unused -- avoid compiler warning */ | ||
| 624 | break; /* special treatment */ | ||
| 625 | } | ||
| 626 | |||
| 627 | /* check for multi-part specification */ | ||
| 628 | if (ch == '+') | ||
| 629 | { | ||
| 630 | multi=1; | ||
| 631 | l++; | ||
| 632 | } | ||
| 633 | else | ||
| 634 | multi=0; | ||
| 635 | |||
| 636 | /* | ||
| 637 | * Now search for the cipher alias in the ca_list. Be careful | ||
| 638 | * with the strncmp, because the "buflen" limitation | ||
| 639 | * will make the rule "ADH:SOME" and the cipher | ||
| 640 | * "ADH-MY-CIPHER" look like a match for buflen=3. | ||
| 641 | * So additionally check whether the cipher name found | ||
| 642 | * has the correct length. We can save a strlen() call: | ||
| 643 | * just checking for the '\0' at the right place is | ||
| 644 | * sufficient, we have to strncmp() anyway. | ||
| 645 | */ | ||
| 646 | j = found = 0; | ||
| 647 | while (ca_list[j]) | ||
| 648 | { | ||
| 649 | if ((ca_list[j]->name[buflen] == '\0') && | ||
| 650 | !strncmp(buf, ca_list[j]->name, buflen)) | ||
| 651 | { | ||
| 652 | found = 1; | ||
| 653 | break; | ||
| 654 | } | ||
| 655 | else | ||
| 656 | j++; | ||
| 657 | } | ||
| 658 | if (!found) | ||
| 659 | break; /* ignore this entry */ | ||
| 660 | |||
| 661 | algorithms |= ca_list[j]->algorithms; | ||
| 662 | mask |= ca_list[j]->mask; | ||
| 663 | algo_strength |= ca_list[j]->algo_strength; | ||
| 664 | mask_strength |= ca_list[j]->mask_strength; | ||
| 665 | |||
| 666 | if (!multi) break; | ||
| 667 | } | ||
| 668 | |||
| 669 | /* | ||
| 670 | * Ok, we have the rule, now apply it | ||
| 671 | */ | ||
| 672 | if (rule == CIPHER_SPECIAL) | ||
| 673 | { /* special command */ | ||
| 674 | ok = 0; | ||
| 675 | if ((buflen == 8) && | ||
| 676 | !strncmp(buf, "STRENGTH", 8)) | ||
| 677 | ok = ssl_cipher_strength_sort(list, | ||
| 678 | head_p, tail_p); | ||
| 679 | else | ||
| 680 | SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, | ||
| 681 | SSL_R_INVALID_COMMAND); | ||
| 682 | if (ok == 0) | ||
| 683 | retval = 0; | ||
| 684 | /* | ||
| 685 | * We do not support any "multi" options | ||
| 686 | * together with "@", so throw away the | ||
| 687 | * rest of the command, if any left, until | ||
| 688 | * end or ':' is found. | ||
| 689 | */ | ||
| 690 | while ((*l != '\0') && ITEM_SEP(*l)) | ||
| 691 | l++; | ||
| 692 | } | ||
| 693 | else if (found) | ||
| 694 | { | ||
| 695 | ssl_cipher_apply_rule(algorithms, mask, | ||
| 696 | algo_strength, mask_strength, rule, -1, | ||
| 697 | list, head_p, tail_p); | ||
| 698 | } | ||
| 699 | else | ||
| 700 | { | ||
| 701 | while ((*l != '\0') && ITEM_SEP(*l)) | ||
| 702 | l++; | ||
| 703 | } | ||
| 704 | if (*l == '\0') break; /* done */ | ||
| 705 | } | ||
| 706 | |||
| 707 | return(retval); | ||
| 708 | } | ||
| 709 | |||
| 710 | STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | ||
| 711 | STACK_OF(SSL_CIPHER) **cipher_list, | ||
| 712 | STACK_OF(SSL_CIPHER) **cipher_list_by_id, | ||
| 713 | const char *rule_str) | ||
| 714 | { | ||
| 715 | int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases; | ||
| 716 | unsigned long disabled_mask; | ||
| 717 | STACK_OF(SSL_CIPHER) *cipherstack; | ||
| 718 | const char *rule_p; | ||
| 719 | CIPHER_ORDER *list = NULL, *head = NULL, *tail = NULL, *curr; | ||
| 720 | SSL_CIPHER **ca_list = NULL; | ||
| 721 | |||
| 722 | /* | ||
| 723 | * Return with error if nothing to do. | ||
| 724 | */ | ||
| 725 | if (rule_str == NULL) return(NULL); | ||
| 726 | |||
| 727 | if (init_ciphers) load_ciphers(); | ||
| 728 | |||
| 729 | /* | ||
| 730 | * To reduce the work to do we only want to process the compiled | ||
| 731 | * in algorithms, so we first get the mask of disabled ciphers. | ||
| 732 | */ | ||
| 733 | disabled_mask = ssl_cipher_get_disabled(); | ||
| 734 | |||
| 735 | /* | ||
| 736 | * Now we have to collect the available ciphers from the compiled | ||
| 737 | * in ciphers. We cannot get more than the number compiled in, so | ||
| 738 | * it is used for allocation. | ||
| 739 | */ | ||
| 740 | num_of_ciphers = ssl_method->num_ciphers(); | ||
| 741 | list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers); | ||
| 742 | if (list == NULL) | ||
| 743 | { | ||
| 744 | SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); | ||
| 745 | return(NULL); /* Failure */ | ||
| 746 | } | ||
| 747 | |||
| 748 | ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask, | ||
| 749 | list, &head, &tail); | ||
| 750 | |||
| 751 | /* | ||
| 752 | * We also need cipher aliases for selecting based on the rule_str. | ||
| 753 | * There might be two types of entries in the rule_str: 1) names | ||
| 754 | * of ciphers themselves 2) aliases for groups of ciphers. | ||
| 755 | * For 1) we need the available ciphers and for 2) the cipher | ||
| 756 | * groups of cipher_aliases added together in one list (otherwise | ||
| 757 | * we would be happy with just the cipher_aliases table). | ||
| 758 | */ | ||
| 759 | num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER); | ||
| 760 | num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1; | ||
| 761 | ca_list = | ||
| 762 | (SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max); | ||
| 763 | if (ca_list == NULL) | ||
| 764 | { | ||
| 765 | OPENSSL_free(list); | ||
| 766 | SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); | ||
| 767 | return(NULL); /* Failure */ | ||
| 768 | } | ||
| 769 | ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask, | ||
| 770 | head); | ||
| 771 | |||
| 772 | /* | ||
| 773 | * If the rule_string begins with DEFAULT, apply the default rule | ||
| 774 | * before using the (possibly available) additional rules. | ||
| 775 | */ | ||
| 776 | ok = 1; | ||
| 777 | rule_p = rule_str; | ||
| 778 | if (strncmp(rule_str,"DEFAULT",7) == 0) | ||
| 779 | { | ||
| 780 | ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, | ||
| 781 | list, &head, &tail, ca_list); | ||
| 782 | rule_p += 7; | ||
| 783 | if (*rule_p == ':') | ||
| 784 | rule_p++; | ||
| 785 | } | ||
| 786 | |||
| 787 | if (ok && (strlen(rule_p) > 0)) | ||
| 788 | ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail, | ||
| 789 | ca_list); | ||
| 790 | |||
| 791 | OPENSSL_free(ca_list); /* Not needed anymore */ | ||
| 792 | |||
| 793 | if (!ok) | ||
| 794 | { /* Rule processing failure */ | ||
| 795 | OPENSSL_free(list); | ||
| 796 | return(NULL); | ||
| 797 | } | ||
| 798 | /* | ||
| 799 | * Allocate new "cipherstack" for the result, return with error | ||
| 800 | * if we cannot get one. | ||
| 801 | */ | ||
| 802 | if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) | ||
| 803 | { | ||
| 804 | OPENSSL_free(list); | ||
| 805 | return(NULL); | ||
| 806 | } | ||
| 807 | |||
| 808 | /* | ||
| 809 | * The cipher selection for the list is done. The ciphers are added | ||
| 810 | * to the resulting precedence to the STACK_OF(SSL_CIPHER). | ||
| 811 | */ | ||
| 812 | for (curr = head; curr != NULL; curr = curr->next) | ||
| 813 | { | ||
| 814 | if (curr->active) | ||
| 815 | { | ||
| 816 | sk_SSL_CIPHER_push(cipherstack, curr->cipher); | ||
| 817 | #ifdef CIPHER_DEBUG | ||
| 818 | printf("<%s>\n",curr->cipher->name); | ||
| 819 | #endif | ||
| 820 | } | ||
| 821 | } | ||
| 822 | OPENSSL_free(list); /* Not needed any longer */ | ||
| 823 | |||
| 824 | /* | ||
| 825 | * The following passage is a little bit odd. If pointer variables | ||
| 826 | * were supplied to hold STACK_OF(SSL_CIPHER) return information, | ||
| 827 | * the old memory pointed to is free()ed. Then, however, the | ||
| 828 | * cipher_list entry will be assigned just a copy of the returned | ||
| 829 | * cipher stack. For cipher_list_by_id a copy of the cipher stack | ||
| 830 | * will be created. See next comment... | ||
| 831 | */ | ||
| 832 | if (cipher_list != NULL) | ||
| 833 | { | ||
| 834 | if (*cipher_list != NULL) | ||
| 835 | sk_SSL_CIPHER_free(*cipher_list); | ||
| 836 | *cipher_list = cipherstack; | ||
| 837 | } | ||
| 838 | |||
| 839 | if (cipher_list_by_id != NULL) | ||
| 840 | { | ||
| 841 | if (*cipher_list_by_id != NULL) | ||
| 842 | sk_SSL_CIPHER_free(*cipher_list_by_id); | ||
| 843 | *cipher_list_by_id = sk_SSL_CIPHER_dup(cipherstack); | ||
| 844 | } | ||
| 845 | |||
| 846 | /* | ||
| 847 | * Now it is getting really strange. If something failed during | ||
| 848 | * the previous pointer assignment or if one of the pointers was | ||
| 849 | * not requested, the error condition is met. That might be | ||
| 850 | * discussable. The strange thing is however that in this case | ||
| 851 | * the memory "ret" pointed to is "free()ed" and hence the pointer | ||
| 852 | * cipher_list becomes wild. The memory reserved for | ||
| 853 | * cipher_list_by_id however is not "free()ed" and stays intact. | ||
| 854 | */ | ||
| 855 | if ( (cipher_list_by_id == NULL) || | ||
| 856 | (*cipher_list_by_id == NULL) || | ||
| 857 | (cipher_list == NULL) || | ||
| 858 | (*cipher_list == NULL)) | ||
| 859 | { | ||
| 860 | sk_SSL_CIPHER_free(cipherstack); | ||
| 861 | return(NULL); | ||
| 862 | } | ||
| 863 | |||
| 864 | sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp); | ||
| 865 | |||
| 866 | return(cipherstack); | ||
| 867 | } | ||
| 868 | |||
| 869 | char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len) | ||
| 870 | { | ||
| 871 | int is_export,pkl,kl; | ||
| 872 | char *ver,*exp; | ||
| 873 | char *kx,*au,*enc,*mac; | ||
| 874 | unsigned long alg,alg2,alg_s; | ||
| 875 | static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n"; | ||
| 876 | |||
| 877 | alg=cipher->algorithms; | ||
| 878 | alg_s=cipher->algo_strength; | ||
| 879 | alg2=cipher->algorithm2; | ||
| 880 | |||
| 881 | is_export=SSL_C_IS_EXPORT(cipher); | ||
| 882 | pkl=SSL_C_EXPORT_PKEYLENGTH(cipher); | ||
| 883 | kl=SSL_C_EXPORT_KEYLENGTH(cipher); | ||
| 884 | exp=is_export?" export":""; | ||
| 885 | |||
| 886 | if (alg & SSL_SSLV2) | ||
| 887 | ver="SSLv2"; | ||
| 888 | else if (alg & SSL_SSLV3) | ||
| 889 | ver="SSLv3"; | ||
| 890 | else | ||
| 891 | ver="unknown"; | ||
| 892 | |||
| 893 | switch (alg&SSL_MKEY_MASK) | ||
| 894 | { | ||
| 895 | case SSL_kRSA: | ||
| 896 | kx=is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA"; | ||
| 897 | break; | ||
| 898 | case SSL_kDHr: | ||
| 899 | kx="DH/RSA"; | ||
| 900 | break; | ||
| 901 | case SSL_kDHd: | ||
| 902 | kx="DH/DSS"; | ||
| 903 | break; | ||
| 904 | case SSL_kFZA: | ||
| 905 | kx="Fortezza"; | ||
| 906 | break; | ||
| 907 | case SSL_kEDH: | ||
| 908 | kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH"; | ||
| 909 | break; | ||
| 910 | default: | ||
| 911 | kx="unknown"; | ||
| 912 | } | ||
| 913 | |||
| 914 | switch (alg&SSL_AUTH_MASK) | ||
| 915 | { | ||
| 916 | case SSL_aRSA: | ||
| 917 | au="RSA"; | ||
| 918 | break; | ||
| 919 | case SSL_aDSS: | ||
| 920 | au="DSS"; | ||
| 921 | break; | ||
| 922 | case SSL_aDH: | ||
| 923 | au="DH"; | ||
| 924 | break; | ||
| 925 | case SSL_aFZA: | ||
| 926 | case SSL_aNULL: | ||
| 927 | au="None"; | ||
| 928 | break; | ||
| 929 | default: | ||
| 930 | au="unknown"; | ||
| 931 | break; | ||
| 932 | } | ||
| 933 | |||
| 934 | switch (alg&SSL_ENC_MASK) | ||
| 935 | { | ||
| 936 | case SSL_DES: | ||
| 937 | enc=(is_export && kl == 5)?"DES(40)":"DES(56)"; | ||
| 938 | break; | ||
| 939 | case SSL_3DES: | ||
| 940 | enc="3DES(168)"; | ||
| 941 | break; | ||
| 942 | case SSL_RC4: | ||
| 943 | enc=is_export?(kl == 5 ? "RC4(40)" : "RC4(56)") | ||
| 944 | :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)"); | ||
| 945 | break; | ||
| 946 | case SSL_RC2: | ||
| 947 | enc=is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)"; | ||
| 948 | break; | ||
| 949 | case SSL_IDEA: | ||
| 950 | enc="IDEA(128)"; | ||
| 951 | break; | ||
| 952 | case SSL_eFZA: | ||
| 953 | enc="Fortezza"; | ||
| 954 | break; | ||
| 955 | case SSL_eNULL: | ||
| 956 | enc="None"; | ||
| 957 | break; | ||
| 958 | default: | ||
| 959 | enc="unknown"; | ||
| 960 | break; | ||
| 961 | } | ||
| 962 | |||
| 963 | switch (alg&SSL_MAC_MASK) | ||
| 964 | { | ||
| 965 | case SSL_MD5: | ||
| 966 | mac="MD5"; | ||
| 967 | break; | ||
| 968 | case SSL_SHA1: | ||
| 969 | mac="SHA1"; | ||
| 970 | break; | ||
| 971 | default: | ||
| 972 | mac="unknown"; | ||
| 973 | break; | ||
| 974 | } | ||
| 975 | |||
| 976 | if (buf == NULL) | ||
| 977 | { | ||
| 978 | len=128; | ||
| 979 | buf=OPENSSL_malloc(len); | ||
| 980 | if (buf == NULL) return("OPENSSL_malloc Error"); | ||
| 981 | } | ||
| 982 | else if (len < 128) | ||
| 983 | return("Buffer too small"); | ||
| 984 | |||
| 985 | BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp); | ||
| 986 | return(buf); | ||
| 987 | } | ||
| 988 | |||
| 989 | char *SSL_CIPHER_get_version(SSL_CIPHER *c) | ||
| 990 | { | ||
| 991 | int i; | ||
| 992 | |||
| 993 | if (c == NULL) return("(NONE)"); | ||
| 994 | i=(int)(c->id>>24L); | ||
| 995 | if (i == 3) | ||
| 996 | return("TLSv1/SSLv3"); | ||
| 997 | else if (i == 2) | ||
| 998 | return("SSLv2"); | ||
| 999 | else | ||
| 1000 | return("unknown"); | ||
| 1001 | } | ||
| 1002 | |||
| 1003 | /* return the actual cipher being used */ | ||
| 1004 | const char *SSL_CIPHER_get_name(SSL_CIPHER *c) | ||
| 1005 | { | ||
| 1006 | if (c != NULL) | ||
| 1007 | return(c->name); | ||
| 1008 | return("(NONE)"); | ||
| 1009 | } | ||
| 1010 | |||
| 1011 | /* number of bits for symmetric cipher */ | ||
| 1012 | int SSL_CIPHER_get_bits(SSL_CIPHER *c, int *alg_bits) | ||
| 1013 | { | ||
| 1014 | int ret=0; | ||
| 1015 | |||
| 1016 | if (c != NULL) | ||
| 1017 | { | ||
| 1018 | if (alg_bits != NULL) *alg_bits = c->alg_bits; | ||
| 1019 | ret = c->strength_bits; | ||
| 1020 | } | ||
| 1021 | return(ret); | ||
| 1022 | } | ||
| 1023 | |||
| 1024 | SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n) | ||
| 1025 | { | ||
| 1026 | SSL_COMP *ctmp; | ||
| 1027 | int i,nn; | ||
| 1028 | |||
| 1029 | if ((n == 0) || (sk == NULL)) return(NULL); | ||
| 1030 | nn=sk_SSL_COMP_num(sk); | ||
| 1031 | for (i=0; i<nn; i++) | ||
| 1032 | { | ||
| 1033 | ctmp=sk_SSL_COMP_value(sk,i); | ||
| 1034 | if (ctmp->id == n) | ||
| 1035 | return(ctmp); | ||
| 1036 | } | ||
| 1037 | return(NULL); | ||
| 1038 | } | ||
| 1039 | |||
| 1040 | static int sk_comp_cmp(const SSL_COMP * const *a, | ||
| 1041 | const SSL_COMP * const *b) | ||
| 1042 | { | ||
| 1043 | return((*a)->id-(*b)->id); | ||
| 1044 | } | ||
| 1045 | |||
| 1046 | STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) | ||
| 1047 | { | ||
| 1048 | return(ssl_comp_methods); | ||
| 1049 | } | ||
| 1050 | |||
| 1051 | int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) | ||
| 1052 | { | ||
| 1053 | SSL_COMP *comp; | ||
| 1054 | STACK_OF(SSL_COMP) *sk; | ||
| 1055 | |||
| 1056 | comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP)); | ||
| 1057 | comp->id=id; | ||
| 1058 | comp->method=cm; | ||
| 1059 | if (ssl_comp_methods == NULL) | ||
| 1060 | sk=ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp); | ||
| 1061 | else | ||
| 1062 | sk=ssl_comp_methods; | ||
| 1063 | if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp)) | ||
| 1064 | { | ||
| 1065 | SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE); | ||
| 1066 | return(0); | ||
| 1067 | } | ||
| 1068 | else | ||
| 1069 | return(1); | ||
| 1070 | } | ||
| 1071 | |||
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c deleted file mode 100644 index 1ae3333407..0000000000 --- a/src/lib/libssl/ssl_err.c +++ /dev/null | |||
| @@ -1,435 +0,0 @@ | |||
| 1 | /* ssl/ssl_err.c */ | ||
| 2 | /* ==================================================================== | ||
| 3 | * Copyright (c) 1999 The OpenSSL Project. All rights reserved. | ||
| 4 | * | ||
| 5 | * Redistribution and use in source and binary forms, with or without | ||
| 6 | * modification, are permitted provided that the following conditions | ||
| 7 | * are met: | ||
| 8 | * | ||
| 9 | * 1. Redistributions of source code must retain the above copyright | ||
| 10 | * notice, this list of conditions and the following disclaimer. | ||
| 11 | * | ||
| 12 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 13 | * notice, this list of conditions and the following disclaimer in | ||
| 14 | * the documentation and/or other materials provided with the | ||
| 15 | * distribution. | ||
| 16 | * | ||
| 17 | * 3. All advertising materials mentioning features or use of this | ||
| 18 | * software must display the following acknowledgment: | ||
| 19 | * "This product includes software developed by the OpenSSL Project | ||
| 20 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" | ||
| 21 | * | ||
| 22 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 23 | * endorse or promote products derived from this software without | ||
| 24 | * prior written permission. For written permission, please contact | ||
| 25 | * openssl-core@OpenSSL.org. | ||
| 26 | * | ||
| 27 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 28 | * nor may "OpenSSL" appear in their names without prior written | ||
| 29 | * permission of the OpenSSL Project. | ||
| 30 | * | ||
| 31 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 32 | * acknowledgment: | ||
| 33 | * "This product includes software developed by the OpenSSL Project | ||
| 34 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" | ||
| 35 | * | ||
| 36 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 37 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 38 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 39 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 40 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 41 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 42 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 43 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 44 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 45 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 46 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 47 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 48 | * ==================================================================== | ||
| 49 | * | ||
| 50 | * This product includes cryptographic software written by Eric Young | ||
| 51 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
| 52 | * Hudson (tjh@cryptsoft.com). | ||
| 53 | * | ||
| 54 | */ | ||
| 55 | |||
| 56 | /* NOTE: this file was auto generated by the mkerr.pl script: any changes | ||
| 57 | * made to it will be overwritten when the script next updates this file, | ||
| 58 | * only reason strings will be preserved. | ||
| 59 | */ | ||
| 60 | |||
| 61 | #include <stdio.h> | ||
| 62 | #include <openssl/err.h> | ||
| 63 | #include <openssl/ssl.h> | ||
| 64 | |||
| 65 | /* BEGIN ERROR CODES */ | ||
| 66 | #ifndef NO_ERR | ||
| 67 | static ERR_STRING_DATA SSL_str_functs[]= | ||
| 68 | { | ||
| 69 | {ERR_PACK(0,SSL_F_CLIENT_CERTIFICATE,0), "CLIENT_CERTIFICATE"}, | ||
| 70 | {ERR_PACK(0,SSL_F_CLIENT_HELLO,0), "CLIENT_HELLO"}, | ||
| 71 | {ERR_PACK(0,SSL_F_CLIENT_MASTER_KEY,0), "CLIENT_MASTER_KEY"}, | ||
| 72 | {ERR_PACK(0,SSL_F_D2I_SSL_SESSION,0), "d2i_SSL_SESSION"}, | ||
| 73 | {ERR_PACK(0,SSL_F_DO_SSL3_WRITE,0), "DO_SSL3_WRITE"}, | ||
| 74 | {ERR_PACK(0,SSL_F_GET_CLIENT_FINISHED,0), "GET_CLIENT_FINISHED"}, | ||
| 75 | {ERR_PACK(0,SSL_F_GET_CLIENT_HELLO,0), "GET_CLIENT_HELLO"}, | ||
| 76 | {ERR_PACK(0,SSL_F_GET_CLIENT_MASTER_KEY,0), "GET_CLIENT_MASTER_KEY"}, | ||
| 77 | {ERR_PACK(0,SSL_F_GET_SERVER_FINISHED,0), "GET_SERVER_FINISHED"}, | ||
| 78 | {ERR_PACK(0,SSL_F_GET_SERVER_HELLO,0), "GET_SERVER_HELLO"}, | ||
| 79 | {ERR_PACK(0,SSL_F_GET_SERVER_VERIFY,0), "GET_SERVER_VERIFY"}, | ||
| 80 | {ERR_PACK(0,SSL_F_I2D_SSL_SESSION,0), "i2d_SSL_SESSION"}, | ||
| 81 | {ERR_PACK(0,SSL_F_READ_N,0), "READ_N"}, | ||
| 82 | {ERR_PACK(0,SSL_F_REQUEST_CERTIFICATE,0), "REQUEST_CERTIFICATE"}, | ||
| 83 | {ERR_PACK(0,SSL_F_SERVER_HELLO,0), "SERVER_HELLO"}, | ||
| 84 | {ERR_PACK(0,SSL_F_SSL23_ACCEPT,0), "SSL23_ACCEPT"}, | ||
| 85 | {ERR_PACK(0,SSL_F_SSL23_CLIENT_HELLO,0), "SSL23_CLIENT_HELLO"}, | ||
| 86 | {ERR_PACK(0,SSL_F_SSL23_CONNECT,0), "SSL23_CONNECT"}, | ||
| 87 | {ERR_PACK(0,SSL_F_SSL23_GET_CLIENT_HELLO,0), "SSL23_GET_CLIENT_HELLO"}, | ||
| 88 | {ERR_PACK(0,SSL_F_SSL23_GET_SERVER_HELLO,0), "SSL23_GET_SERVER_HELLO"}, | ||
| 89 | {ERR_PACK(0,SSL_F_SSL23_PEEK,0), "SSL23_PEEK"}, | ||
| 90 | {ERR_PACK(0,SSL_F_SSL23_READ,0), "SSL23_READ"}, | ||
| 91 | {ERR_PACK(0,SSL_F_SSL23_WRITE,0), "SSL23_WRITE"}, | ||
| 92 | {ERR_PACK(0,SSL_F_SSL2_ACCEPT,0), "SSL2_ACCEPT"}, | ||
| 93 | {ERR_PACK(0,SSL_F_SSL2_CONNECT,0), "SSL2_CONNECT"}, | ||
| 94 | {ERR_PACK(0,SSL_F_SSL2_ENC_INIT,0), "SSL2_ENC_INIT"}, | ||
| 95 | {ERR_PACK(0,SSL_F_SSL2_PEEK,0), "SSL2_PEEK"}, | ||
| 96 | {ERR_PACK(0,SSL_F_SSL2_READ,0), "SSL2_READ"}, | ||
| 97 | {ERR_PACK(0,SSL_F_SSL2_READ_INTERNAL,0), "SSL2_READ_INTERNAL"}, | ||
| 98 | {ERR_PACK(0,SSL_F_SSL2_SET_CERTIFICATE,0), "SSL2_SET_CERTIFICATE"}, | ||
| 99 | {ERR_PACK(0,SSL_F_SSL2_WRITE,0), "SSL2_WRITE"}, | ||
| 100 | {ERR_PACK(0,SSL_F_SSL3_ACCEPT,0), "SSL3_ACCEPT"}, | ||
| 101 | {ERR_PACK(0,SSL_F_SSL3_CALLBACK_CTRL,0), "SSL3_CALLBACK_CTRL"}, | ||
| 102 | {ERR_PACK(0,SSL_F_SSL3_CHANGE_CIPHER_STATE,0), "SSL3_CHANGE_CIPHER_STATE"}, | ||
| 103 | {ERR_PACK(0,SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,0), "SSL3_CHECK_CERT_AND_ALGORITHM"}, | ||
| 104 | {ERR_PACK(0,SSL_F_SSL3_CLIENT_HELLO,0), "SSL3_CLIENT_HELLO"}, | ||
| 105 | {ERR_PACK(0,SSL_F_SSL3_CONNECT,0), "SSL3_CONNECT"}, | ||
| 106 | {ERR_PACK(0,SSL_F_SSL3_CTRL,0), "SSL3_CTRL"}, | ||
| 107 | {ERR_PACK(0,SSL_F_SSL3_CTX_CTRL,0), "SSL3_CTX_CTRL"}, | ||
| 108 | {ERR_PACK(0,SSL_F_SSL3_ENC,0), "SSL3_ENC"}, | ||
| 109 | {ERR_PACK(0,SSL_F_SSL3_GET_CERTIFICATE_REQUEST,0), "SSL3_GET_CERTIFICATE_REQUEST"}, | ||
| 110 | {ERR_PACK(0,SSL_F_SSL3_GET_CERT_VERIFY,0), "SSL3_GET_CERT_VERIFY"}, | ||
| 111 | {ERR_PACK(0,SSL_F_SSL3_GET_CLIENT_CERTIFICATE,0), "SSL3_GET_CLIENT_CERTIFICATE"}, | ||
| 112 | {ERR_PACK(0,SSL_F_SSL3_GET_CLIENT_HELLO,0), "SSL3_GET_CLIENT_HELLO"}, | ||
| 113 | {ERR_PACK(0,SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,0), "SSL3_GET_CLIENT_KEY_EXCHANGE"}, | ||
| 114 | {ERR_PACK(0,SSL_F_SSL3_GET_FINISHED,0), "SSL3_GET_FINISHED"}, | ||
| 115 | {ERR_PACK(0,SSL_F_SSL3_GET_KEY_EXCHANGE,0), "SSL3_GET_KEY_EXCHANGE"}, | ||
| 116 | {ERR_PACK(0,SSL_F_SSL3_GET_MESSAGE,0), "SSL3_GET_MESSAGE"}, | ||
| 117 | {ERR_PACK(0,SSL_F_SSL3_GET_RECORD,0), "SSL3_GET_RECORD"}, | ||
| 118 | {ERR_PACK(0,SSL_F_SSL3_GET_SERVER_CERTIFICATE,0), "SSL3_GET_SERVER_CERTIFICATE"}, | ||
| 119 | {ERR_PACK(0,SSL_F_SSL3_GET_SERVER_DONE,0), "SSL3_GET_SERVER_DONE"}, | ||
| 120 | {ERR_PACK(0,SSL_F_SSL3_GET_SERVER_HELLO,0), "SSL3_GET_SERVER_HELLO"}, | ||
| 121 | {ERR_PACK(0,SSL_F_SSL3_OUTPUT_CERT_CHAIN,0), "SSL3_OUTPUT_CERT_CHAIN"}, | ||
| 122 | {ERR_PACK(0,SSL_F_SSL3_PEEK,0), "SSL3_PEEK"}, | ||
| 123 | {ERR_PACK(0,SSL_F_SSL3_READ_BYTES,0), "SSL3_READ_BYTES"}, | ||
| 124 | {ERR_PACK(0,SSL_F_SSL3_READ_N,0), "SSL3_READ_N"}, | ||
| 125 | {ERR_PACK(0,SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,0), "SSL3_SEND_CERTIFICATE_REQUEST"}, | ||
| 126 | {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,0), "SSL3_SEND_CLIENT_CERTIFICATE"}, | ||
| 127 | {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,0), "SSL3_SEND_CLIENT_KEY_EXCHANGE"}, | ||
| 128 | {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_VERIFY,0), "SSL3_SEND_CLIENT_VERIFY"}, | ||
| 129 | {ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_CERTIFICATE,0), "SSL3_SEND_SERVER_CERTIFICATE"}, | ||
| 130 | {ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,0), "SSL3_SEND_SERVER_KEY_EXCHANGE"}, | ||
| 131 | {ERR_PACK(0,SSL_F_SSL3_SETUP_BUFFERS,0), "SSL3_SETUP_BUFFERS"}, | ||
| 132 | {ERR_PACK(0,SSL_F_SSL3_SETUP_KEY_BLOCK,0), "SSL3_SETUP_KEY_BLOCK"}, | ||
| 133 | {ERR_PACK(0,SSL_F_SSL3_WRITE_BYTES,0), "SSL3_WRITE_BYTES"}, | ||
| 134 | {ERR_PACK(0,SSL_F_SSL3_WRITE_PENDING,0), "SSL3_WRITE_PENDING"}, | ||
| 135 | {ERR_PACK(0,SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,0), "SSL_add_dir_cert_subjects_to_stack"}, | ||
| 136 | {ERR_PACK(0,SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,0), "SSL_add_file_cert_subjects_to_stack"}, | ||
| 137 | {ERR_PACK(0,SSL_F_SSL_BAD_METHOD,0), "SSL_BAD_METHOD"}, | ||
| 138 | {ERR_PACK(0,SSL_F_SSL_BYTES_TO_CIPHER_LIST,0), "SSL_BYTES_TO_CIPHER_LIST"}, | ||
| 139 | {ERR_PACK(0,SSL_F_SSL_CERT_DUP,0), "SSL_CERT_DUP"}, | ||
| 140 | {ERR_PACK(0,SSL_F_SSL_CERT_INST,0), "SSL_CERT_INST"}, | ||
| 141 | {ERR_PACK(0,SSL_F_SSL_CERT_INSTANTIATE,0), "SSL_CERT_INSTANTIATE"}, | ||
| 142 | {ERR_PACK(0,SSL_F_SSL_CERT_NEW,0), "SSL_CERT_NEW"}, | ||
| 143 | {ERR_PACK(0,SSL_F_SSL_CHECK_PRIVATE_KEY,0), "SSL_check_private_key"}, | ||
| 144 | {ERR_PACK(0,SSL_F_SSL_CIPHER_PROCESS_RULESTR,0), "SSL_CIPHER_PROCESS_RULESTR"}, | ||
| 145 | {ERR_PACK(0,SSL_F_SSL_CIPHER_STRENGTH_SORT,0), "SSL_CIPHER_STRENGTH_SORT"}, | ||
| 146 | {ERR_PACK(0,SSL_F_SSL_CLEAR,0), "SSL_clear"}, | ||
| 147 | {ERR_PACK(0,SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,0), "SSL_COMP_add_compression_method"}, | ||
| 148 | {ERR_PACK(0,SSL_F_SSL_CREATE_CIPHER_LIST,0), "SSL_CREATE_CIPHER_LIST"}, | ||
| 149 | {ERR_PACK(0,SSL_F_SSL_CTRL,0), "SSL_ctrl"}, | ||
| 150 | {ERR_PACK(0,SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,0), "SSL_CTX_check_private_key"}, | ||
| 151 | {ERR_PACK(0,SSL_F_SSL_CTX_NEW,0), "SSL_CTX_new"}, | ||
| 152 | {ERR_PACK(0,SSL_F_SSL_CTX_SET_PURPOSE,0), "SSL_CTX_set_purpose"}, | ||
| 153 | {ERR_PACK(0,SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,0), "SSL_CTX_set_session_id_context"}, | ||
| 154 | {ERR_PACK(0,SSL_F_SSL_CTX_SET_SSL_VERSION,0), "SSL_CTX_set_ssl_version"}, | ||
| 155 | {ERR_PACK(0,SSL_F_SSL_CTX_SET_TRUST,0), "SSL_CTX_set_trust"}, | ||
| 156 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE,0), "SSL_CTX_use_certificate"}, | ||
| 157 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,0), "SSL_CTX_use_certificate_ASN1"}, | ||
| 158 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,0), "SSL_CTX_use_certificate_chain_file"}, | ||
| 159 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,0), "SSL_CTX_use_certificate_file"}, | ||
| 160 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_PRIVATEKEY,0), "SSL_CTX_use_PrivateKey"}, | ||
| 161 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,0), "SSL_CTX_use_PrivateKey_ASN1"}, | ||
| 162 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,0), "SSL_CTX_use_PrivateKey_file"}, | ||
| 163 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,0), "SSL_CTX_use_RSAPrivateKey"}, | ||
| 164 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,0), "SSL_CTX_use_RSAPrivateKey_ASN1"}, | ||
| 165 | {ERR_PACK(0,SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,0), "SSL_CTX_use_RSAPrivateKey_file"}, | ||
| 166 | {ERR_PACK(0,SSL_F_SSL_DO_HANDSHAKE,0), "SSL_do_handshake"}, | ||
| 167 | {ERR_PACK(0,SSL_F_SSL_GET_NEW_SESSION,0), "SSL_GET_NEW_SESSION"}, | ||
| 168 | {ERR_PACK(0,SSL_F_SSL_GET_PREV_SESSION,0), "SSL_GET_PREV_SESSION"}, | ||
| 169 | {ERR_PACK(0,SSL_F_SSL_GET_SERVER_SEND_CERT,0), "SSL_GET_SERVER_SEND_CERT"}, | ||
| 170 | {ERR_PACK(0,SSL_F_SSL_GET_SIGN_PKEY,0), "SSL_GET_SIGN_PKEY"}, | ||
| 171 | {ERR_PACK(0,SSL_F_SSL_INIT_WBIO_BUFFER,0), "SSL_INIT_WBIO_BUFFER"}, | ||
| 172 | {ERR_PACK(0,SSL_F_SSL_LOAD_CLIENT_CA_FILE,0), "SSL_load_client_CA_file"}, | ||
| 173 | {ERR_PACK(0,SSL_F_SSL_NEW,0), "SSL_new"}, | ||
| 174 | {ERR_PACK(0,SSL_F_SSL_READ,0), "SSL_read"}, | ||
| 175 | {ERR_PACK(0,SSL_F_SSL_RSA_PRIVATE_DECRYPT,0), "SSL_RSA_PRIVATE_DECRYPT"}, | ||
| 176 | {ERR_PACK(0,SSL_F_SSL_RSA_PUBLIC_ENCRYPT,0), "SSL_RSA_PUBLIC_ENCRYPT"}, | ||
| 177 | {ERR_PACK(0,SSL_F_SSL_SESSION_NEW,0), "SSL_SESSION_new"}, | ||
| 178 | {ERR_PACK(0,SSL_F_SSL_SESSION_PRINT_FP,0), "SSL_SESSION_print_fp"}, | ||
| 179 | {ERR_PACK(0,SSL_F_SSL_SESS_CERT_NEW,0), "SSL_SESS_CERT_NEW"}, | ||
| 180 | {ERR_PACK(0,SSL_F_SSL_SET_CERT,0), "SSL_SET_CERT"}, | ||
| 181 | {ERR_PACK(0,SSL_F_SSL_SET_FD,0), "SSL_set_fd"}, | ||
| 182 | {ERR_PACK(0,SSL_F_SSL_SET_PKEY,0), "SSL_SET_PKEY"}, | ||
| 183 | {ERR_PACK(0,SSL_F_SSL_SET_PURPOSE,0), "SSL_set_purpose"}, | ||
| 184 | {ERR_PACK(0,SSL_F_SSL_SET_RFD,0), "SSL_set_rfd"}, | ||
| 185 | {ERR_PACK(0,SSL_F_SSL_SET_SESSION,0), "SSL_set_session"}, | ||
| 186 | {ERR_PACK(0,SSL_F_SSL_SET_SESSION_ID_CONTEXT,0), "SSL_set_session_id_context"}, | ||
| 187 | {ERR_PACK(0,SSL_F_SSL_SET_TRUST,0), "SSL_set_trust"}, | ||
| 188 | {ERR_PACK(0,SSL_F_SSL_SET_WFD,0), "SSL_set_wfd"}, | ||
| 189 | {ERR_PACK(0,SSL_F_SSL_SHUTDOWN,0), "SSL_shutdown"}, | ||
| 190 | {ERR_PACK(0,SSL_F_SSL_UNDEFINED_FUNCTION,0), "SSL_UNDEFINED_FUNCTION"}, | ||
| 191 | {ERR_PACK(0,SSL_F_SSL_USE_CERTIFICATE,0), "SSL_use_certificate"}, | ||
| 192 | {ERR_PACK(0,SSL_F_SSL_USE_CERTIFICATE_ASN1,0), "SSL_use_certificate_ASN1"}, | ||
| 193 | {ERR_PACK(0,SSL_F_SSL_USE_CERTIFICATE_FILE,0), "SSL_use_certificate_file"}, | ||
| 194 | {ERR_PACK(0,SSL_F_SSL_USE_PRIVATEKEY,0), "SSL_use_PrivateKey"}, | ||
| 195 | {ERR_PACK(0,SSL_F_SSL_USE_PRIVATEKEY_ASN1,0), "SSL_use_PrivateKey_ASN1"}, | ||
| 196 | {ERR_PACK(0,SSL_F_SSL_USE_PRIVATEKEY_FILE,0), "SSL_use_PrivateKey_file"}, | ||
| 197 | {ERR_PACK(0,SSL_F_SSL_USE_RSAPRIVATEKEY,0), "SSL_use_RSAPrivateKey"}, | ||
| 198 | {ERR_PACK(0,SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,0), "SSL_use_RSAPrivateKey_ASN1"}, | ||
| 199 | {ERR_PACK(0,SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,0), "SSL_use_RSAPrivateKey_file"}, | ||
| 200 | {ERR_PACK(0,SSL_F_SSL_VERIFY_CERT_CHAIN,0), "SSL_VERIFY_CERT_CHAIN"}, | ||
| 201 | {ERR_PACK(0,SSL_F_SSL_WRITE,0), "SSL_write"}, | ||
| 202 | {ERR_PACK(0,SSL_F_TLS1_CHANGE_CIPHER_STATE,0), "TLS1_CHANGE_CIPHER_STATE"}, | ||
| 203 | {ERR_PACK(0,SSL_F_TLS1_ENC,0), "TLS1_ENC"}, | ||
| 204 | {ERR_PACK(0,SSL_F_TLS1_SETUP_KEY_BLOCK,0), "TLS1_SETUP_KEY_BLOCK"}, | ||
| 205 | {ERR_PACK(0,SSL_F_WRITE_PENDING,0), "WRITE_PENDING"}, | ||
| 206 | {0,NULL} | ||
| 207 | }; | ||
| 208 | |||
| 209 | static ERR_STRING_DATA SSL_str_reasons[]= | ||
| 210 | { | ||
| 211 | {SSL_R_APP_DATA_IN_HANDSHAKE ,"app data in handshake"}, | ||
| 212 | {SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT,"attempt to reuse session in different context"}, | ||
| 213 | {SSL_R_BAD_ALERT_RECORD ,"bad alert record"}, | ||
| 214 | {SSL_R_BAD_AUTHENTICATION_TYPE ,"bad authentication type"}, | ||
| 215 | {SSL_R_BAD_CHANGE_CIPHER_SPEC ,"bad change cipher spec"}, | ||
| 216 | {SSL_R_BAD_CHECKSUM ,"bad checksum"}, | ||
| 217 | {SSL_R_BAD_DATA_RETURNED_BY_CALLBACK ,"bad data returned by callback"}, | ||
| 218 | {SSL_R_BAD_DECOMPRESSION ,"bad decompression"}, | ||
| 219 | {SSL_R_BAD_DH_G_LENGTH ,"bad dh g length"}, | ||
| 220 | {SSL_R_BAD_DH_PUB_KEY_LENGTH ,"bad dh pub key length"}, | ||
| 221 | {SSL_R_BAD_DH_P_LENGTH ,"bad dh p length"}, | ||
| 222 | {SSL_R_BAD_DIGEST_LENGTH ,"bad digest length"}, | ||
| 223 | {SSL_R_BAD_DSA_SIGNATURE ,"bad dsa signature"}, | ||
| 224 | {SSL_R_BAD_HELLO_REQUEST ,"bad hello request"}, | ||
| 225 | {SSL_R_BAD_LENGTH ,"bad length"}, | ||
| 226 | {SSL_R_BAD_MAC_DECODE ,"bad mac decode"}, | ||
| 227 | {SSL_R_BAD_MESSAGE_TYPE ,"bad message type"}, | ||
| 228 | {SSL_R_BAD_PACKET_LENGTH ,"bad packet length"}, | ||
| 229 | {SSL_R_BAD_PROTOCOL_VERSION_NUMBER ,"bad protocol version number"}, | ||
| 230 | {SSL_R_BAD_RESPONSE_ARGUMENT ,"bad response argument"}, | ||
| 231 | {SSL_R_BAD_RSA_DECRYPT ,"bad rsa decrypt"}, | ||
| 232 | {SSL_R_BAD_RSA_ENCRYPT ,"bad rsa encrypt"}, | ||
| 233 | {SSL_R_BAD_RSA_E_LENGTH ,"bad rsa e length"}, | ||
| 234 | {SSL_R_BAD_RSA_MODULUS_LENGTH ,"bad rsa modulus length"}, | ||
| 235 | {SSL_R_BAD_RSA_SIGNATURE ,"bad rsa signature"}, | ||
| 236 | {SSL_R_BAD_SIGNATURE ,"bad signature"}, | ||
| 237 | {SSL_R_BAD_SSL_FILETYPE ,"bad ssl filetype"}, | ||
| 238 | {SSL_R_BAD_SSL_SESSION_ID_LENGTH ,"bad ssl session id length"}, | ||
| 239 | {SSL_R_BAD_STATE ,"bad state"}, | ||
| 240 | {SSL_R_BAD_WRITE_RETRY ,"bad write retry"}, | ||
| 241 | {SSL_R_BIO_NOT_SET ,"bio not set"}, | ||
| 242 | {SSL_R_BLOCK_CIPHER_PAD_IS_WRONG ,"block cipher pad is wrong"}, | ||
| 243 | {SSL_R_BN_LIB ,"bn lib"}, | ||
| 244 | {SSL_R_CA_DN_LENGTH_MISMATCH ,"ca dn length mismatch"}, | ||
| 245 | {SSL_R_CA_DN_TOO_LONG ,"ca dn too long"}, | ||
| 246 | {SSL_R_CCS_RECEIVED_EARLY ,"ccs received early"}, | ||
| 247 | {SSL_R_CERTIFICATE_VERIFY_FAILED ,"certificate verify failed"}, | ||
| 248 | {SSL_R_CERT_LENGTH_MISMATCH ,"cert length mismatch"}, | ||
| 249 | {SSL_R_CHALLENGE_IS_DIFFERENT ,"challenge is different"}, | ||
| 250 | {SSL_R_CIPHER_CODE_WRONG_LENGTH ,"cipher code wrong length"}, | ||
| 251 | {SSL_R_CIPHER_OR_HASH_UNAVAILABLE ,"cipher or hash unavailable"}, | ||
| 252 | {SSL_R_CIPHER_TABLE_SRC_ERROR ,"cipher table src error"}, | ||
| 253 | {SSL_R_COMPRESSED_LENGTH_TOO_LONG ,"compressed length too long"}, | ||
| 254 | {SSL_R_COMPRESSION_FAILURE ,"compression failure"}, | ||
| 255 | {SSL_R_COMPRESSION_LIBRARY_ERROR ,"compression library error"}, | ||
| 256 | {SSL_R_CONNECTION_ID_IS_DIFFERENT ,"connection id is different"}, | ||
| 257 | {SSL_R_CONNECTION_TYPE_NOT_SET ,"connection type not set"}, | ||
| 258 | {SSL_R_DATA_BETWEEN_CCS_AND_FINISHED ,"data between ccs and finished"}, | ||
| 259 | {SSL_R_DATA_LENGTH_TOO_LONG ,"data length too long"}, | ||
| 260 | {SSL_R_DECRYPTION_FAILED ,"decryption failed"}, | ||
| 261 | {SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG ,"dh public value length is wrong"}, | ||
| 262 | {SSL_R_DIGEST_CHECK_FAILED ,"digest check failed"}, | ||
| 263 | {SSL_R_ENCRYPTED_LENGTH_TOO_LONG ,"encrypted length too long"}, | ||
| 264 | {SSL_R_ERROR_GENERATING_TMP_RSA_KEY ,"error generating tmp rsa key"}, | ||
| 265 | {SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST ,"error in received cipher list"}, | ||
| 266 | {SSL_R_EXCESSIVE_MESSAGE_SIZE ,"excessive message size"}, | ||
| 267 | {SSL_R_EXTRA_DATA_IN_MESSAGE ,"extra data in message"}, | ||
| 268 | {SSL_R_GOT_A_FIN_BEFORE_A_CCS ,"got a fin before a ccs"}, | ||
| 269 | {SSL_R_HTTPS_PROXY_REQUEST ,"https proxy request"}, | ||
| 270 | {SSL_R_HTTP_REQUEST ,"http request"}, | ||
| 271 | {SSL_R_INTERNAL_ERROR ,"internal error"}, | ||
| 272 | {SSL_R_INVALID_CHALLENGE_LENGTH ,"invalid challenge length"}, | ||
| 273 | {SSL_R_INVALID_COMMAND ,"invalid command"}, | ||
| 274 | {SSL_R_INVALID_PURPOSE ,"invalid purpose"}, | ||
| 275 | {SSL_R_INVALID_TRUST ,"invalid trust"}, | ||
| 276 | {SSL_R_LENGTH_MISMATCH ,"length mismatch"}, | ||
| 277 | {SSL_R_LENGTH_TOO_SHORT ,"length too short"}, | ||
| 278 | {SSL_R_LIBRARY_BUG ,"library bug"}, | ||
| 279 | {SSL_R_LIBRARY_HAS_NO_CIPHERS ,"library has no ciphers"}, | ||
| 280 | {SSL_R_MISSING_DH_DSA_CERT ,"missing dh dsa cert"}, | ||
| 281 | {SSL_R_MISSING_DH_KEY ,"missing dh key"}, | ||
| 282 | {SSL_R_MISSING_DH_RSA_CERT ,"missing dh rsa cert"}, | ||
| 283 | {SSL_R_MISSING_DSA_SIGNING_CERT ,"missing dsa signing cert"}, | ||
| 284 | {SSL_R_MISSING_EXPORT_TMP_DH_KEY ,"missing export tmp dh key"}, | ||
| 285 | {SSL_R_MISSING_EXPORT_TMP_RSA_KEY ,"missing export tmp rsa key"}, | ||
| 286 | {SSL_R_MISSING_RSA_CERTIFICATE ,"missing rsa certificate"}, | ||
| 287 | {SSL_R_MISSING_RSA_ENCRYPTING_CERT ,"missing rsa encrypting cert"}, | ||
| 288 | {SSL_R_MISSING_RSA_SIGNING_CERT ,"missing rsa signing cert"}, | ||
| 289 | {SSL_R_MISSING_TMP_DH_KEY ,"missing tmp dh key"}, | ||
| 290 | {SSL_R_MISSING_TMP_RSA_KEY ,"missing tmp rsa key"}, | ||
| 291 | {SSL_R_MISSING_TMP_RSA_PKEY ,"missing tmp rsa pkey"}, | ||
| 292 | {SSL_R_MISSING_VERIFY_MESSAGE ,"missing verify message"}, | ||
| 293 | {SSL_R_NON_SSLV2_INITIAL_PACKET ,"non sslv2 initial packet"}, | ||
| 294 | {SSL_R_NO_CERTIFICATES_RETURNED ,"no certificates returned"}, | ||
| 295 | {SSL_R_NO_CERTIFICATE_ASSIGNED ,"no certificate assigned"}, | ||
| 296 | {SSL_R_NO_CERTIFICATE_RETURNED ,"no certificate returned"}, | ||
| 297 | {SSL_R_NO_CERTIFICATE_SET ,"no certificate set"}, | ||
| 298 | {SSL_R_NO_CERTIFICATE_SPECIFIED ,"no certificate specified"}, | ||
| 299 | {SSL_R_NO_CIPHERS_AVAILABLE ,"no ciphers available"}, | ||
| 300 | {SSL_R_NO_CIPHERS_PASSED ,"no ciphers passed"}, | ||
| 301 | {SSL_R_NO_CIPHERS_SPECIFIED ,"no ciphers specified"}, | ||
| 302 | {SSL_R_NO_CIPHER_LIST ,"no cipher list"}, | ||
| 303 | {SSL_R_NO_CIPHER_MATCH ,"no cipher match"}, | ||
| 304 | {SSL_R_NO_CLIENT_CERT_RECEIVED ,"no client cert received"}, | ||
| 305 | {SSL_R_NO_COMPRESSION_SPECIFIED ,"no compression specified"}, | ||
| 306 | {SSL_R_NO_METHOD_SPECIFIED ,"no method specified"}, | ||
| 307 | {SSL_R_NO_PRIVATEKEY ,"no privatekey"}, | ||
| 308 | {SSL_R_NO_PRIVATE_KEY_ASSIGNED ,"no private key assigned"}, | ||
| 309 | {SSL_R_NO_PROTOCOLS_AVAILABLE ,"no protocols available"}, | ||
| 310 | {SSL_R_NO_PUBLICKEY ,"no publickey"}, | ||
| 311 | {SSL_R_NO_SHARED_CIPHER ,"no shared cipher"}, | ||
| 312 | {SSL_R_NO_VERIFY_CALLBACK ,"no verify callback"}, | ||
| 313 | {SSL_R_NULL_SSL_CTX ,"null ssl ctx"}, | ||
| 314 | {SSL_R_NULL_SSL_METHOD_PASSED ,"null ssl method passed"}, | ||
| 315 | {SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED ,"old session cipher not returned"}, | ||
| 316 | {SSL_R_PACKET_LENGTH_TOO_LONG ,"packet length too long"}, | ||
| 317 | {SSL_R_PATH_TOO_LONG ,"path too long"}, | ||
| 318 | {SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE ,"peer did not return a certificate"}, | ||
| 319 | {SSL_R_PEER_ERROR ,"peer error"}, | ||
| 320 | {SSL_R_PEER_ERROR_CERTIFICATE ,"peer error certificate"}, | ||
| 321 | {SSL_R_PEER_ERROR_NO_CERTIFICATE ,"peer error no certificate"}, | ||
| 322 | {SSL_R_PEER_ERROR_NO_CIPHER ,"peer error no cipher"}, | ||
| 323 | {SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE,"peer error unsupported certificate type"}, | ||
| 324 | {SSL_R_PRE_MAC_LENGTH_TOO_LONG ,"pre mac length too long"}, | ||
| 325 | {SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS ,"problems mapping cipher functions"}, | ||
| 326 | {SSL_R_PROTOCOL_IS_SHUTDOWN ,"protocol is shutdown"}, | ||
| 327 | {SSL_R_PUBLIC_KEY_ENCRYPT_ERROR ,"public key encrypt error"}, | ||
| 328 | {SSL_R_PUBLIC_KEY_IS_NOT_RSA ,"public key is not rsa"}, | ||
| 329 | {SSL_R_PUBLIC_KEY_NOT_RSA ,"public key not rsa"}, | ||
| 330 | {SSL_R_READ_BIO_NOT_SET ,"read bio not set"}, | ||
| 331 | {SSL_R_READ_WRONG_PACKET_TYPE ,"read wrong packet type"}, | ||
| 332 | {SSL_R_RECORD_LENGTH_MISMATCH ,"record length mismatch"}, | ||
| 333 | {SSL_R_RECORD_TOO_LARGE ,"record too large"}, | ||
| 334 | {SSL_R_RECORD_TOO_SMALL ,"record too small"}, | ||
| 335 | {SSL_R_REQUIRED_CIPHER_MISSING ,"required cipher missing"}, | ||
| 336 | {SSL_R_REUSE_CERT_LENGTH_NOT_ZERO ,"reuse cert length not zero"}, | ||
| 337 | {SSL_R_REUSE_CERT_TYPE_NOT_ZERO ,"reuse cert type not zero"}, | ||
| 338 | {SSL_R_REUSE_CIPHER_LIST_NOT_ZERO ,"reuse cipher list not zero"}, | ||
| 339 | {SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED ,"session id context uninitialized"}, | ||
| 340 | {SSL_R_SHORT_READ ,"short read"}, | ||
| 341 | {SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE,"signature for non signing certificate"}, | ||
| 342 | {SSL_R_SSL23_DOING_SESSION_ID_REUSE ,"ssl23 doing session id reuse"}, | ||
| 343 | {SSL_R_SSL3_SESSION_ID_TOO_SHORT ,"ssl3 session id too short"}, | ||
| 344 | {SSL_R_SSLV3_ALERT_BAD_CERTIFICATE ,"sslv3 alert bad certificate"}, | ||
| 345 | {SSL_R_SSLV3_ALERT_BAD_RECORD_MAC ,"sslv3 alert bad record mac"}, | ||
| 346 | {SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED ,"sslv3 alert certificate expired"}, | ||
| 347 | {SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED ,"sslv3 alert certificate revoked"}, | ||
| 348 | {SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN ,"sslv3 alert certificate unknown"}, | ||
| 349 | {SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE ,"sslv3 alert decompression failure"}, | ||
| 350 | {SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE ,"sslv3 alert handshake failure"}, | ||
| 351 | {SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER ,"sslv3 alert illegal parameter"}, | ||
| 352 | {SSL_R_SSLV3_ALERT_NO_CERTIFICATE ,"sslv3 alert no certificate"}, | ||
| 353 | {SSL_R_SSLV3_ALERT_PEER_ERROR_CERTIFICATE,"sslv3 alert peer error certificate"}, | ||
| 354 | {SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CERTIFICATE,"sslv3 alert peer error no certificate"}, | ||
| 355 | {SSL_R_SSLV3_ALERT_PEER_ERROR_NO_CIPHER ,"sslv3 alert peer error no cipher"}, | ||
| 356 | {SSL_R_SSLV3_ALERT_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE,"sslv3 alert peer error unsupported certificate type"}, | ||
| 357 | {SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE ,"sslv3 alert unexpected message"}, | ||
| 358 | {SSL_R_SSLV3_ALERT_UNKNOWN_REMOTE_ERROR_TYPE,"sslv3 alert unknown remote error type"}, | ||
| 359 | {SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE,"sslv3 alert unsupported certificate"}, | ||
| 360 | {SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION,"ssl ctx has no default ssl version"}, | ||
| 361 | {SSL_R_SSL_HANDSHAKE_FAILURE ,"ssl handshake failure"}, | ||
| 362 | {SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS ,"ssl library has no ciphers"}, | ||
| 363 | {SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG ,"ssl session id context too long"}, | ||
| 364 | {SSL_R_SSL_SESSION_ID_IS_DIFFERENT ,"ssl session id is different"}, | ||
| 365 | {SSL_R_TLSV1_ALERT_ACCESS_DENIED ,"tlsv1 alert access denied"}, | ||
| 366 | {SSL_R_TLSV1_ALERT_DECODE_ERROR ,"tlsv1 alert decode error"}, | ||
| 367 | {SSL_R_TLSV1_ALERT_DECRYPTION_FAILED ,"tlsv1 alert decryption failed"}, | ||
| 368 | {SSL_R_TLSV1_ALERT_DECRYPT_ERROR ,"tlsv1 alert decrypt error"}, | ||
| 369 | {SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION ,"tlsv1 alert export restriction"}, | ||
| 370 | {SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY ,"tlsv1 alert insufficient security"}, | ||
| 371 | {SSL_R_TLSV1_ALERT_INTERNAL_ERROR ,"tlsv1 alert internal error"}, | ||
| 372 | {SSL_R_TLSV1_ALERT_NO_RENEGOTIATION ,"tlsv1 alert no renegotiation"}, | ||
| 373 | {SSL_R_TLSV1_ALERT_PROTOCOL_VERSION ,"tlsv1 alert protocol version"}, | ||
| 374 | {SSL_R_TLSV1_ALERT_RECORD_OVERFLOW ,"tlsv1 alert record overflow"}, | ||
| 375 | {SSL_R_TLSV1_ALERT_UNKNOWN_CA ,"tlsv1 alert unknown ca"}, | ||
| 376 | {SSL_R_TLSV1_ALERT_USER_CANCELLED ,"tlsv1 alert user cancelled"}, | ||
| 377 | {SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER,"tls client cert req with anon cipher"}, | ||
| 378 | {SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST,"tls peer did not respond with certificate list"}, | ||
| 379 | {SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG,"tls rsa encrypted value length is wrong"}, | ||
| 380 | {SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER ,"tried to use unsupported cipher"}, | ||
| 381 | {SSL_R_UNABLE_TO_DECODE_DH_CERTS ,"unable to decode dh certs"}, | ||
| 382 | {SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY ,"unable to extract public key"}, | ||
| 383 | {SSL_R_UNABLE_TO_FIND_DH_PARAMETERS ,"unable to find dh parameters"}, | ||
| 384 | {SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS,"unable to find public key parameters"}, | ||
| 385 | {SSL_R_UNABLE_TO_FIND_SSL_METHOD ,"unable to find ssl method"}, | ||
| 386 | {SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES ,"unable to load ssl2 md5 routines"}, | ||
| 387 | {SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES ,"unable to load ssl3 md5 routines"}, | ||
| 388 | {SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES ,"unable to load ssl3 sha1 routines"}, | ||
| 389 | {SSL_R_UNEXPECTED_MESSAGE ,"unexpected message"}, | ||
| 390 | {SSL_R_UNEXPECTED_RECORD ,"unexpected record"}, | ||
| 391 | {SSL_R_UNINITIALIZED ,"uninitialized"}, | ||
| 392 | {SSL_R_UNKNOWN_ALERT_TYPE ,"unknown alert type"}, | ||
| 393 | {SSL_R_UNKNOWN_CERTIFICATE_TYPE ,"unknown certificate type"}, | ||
| 394 | {SSL_R_UNKNOWN_CIPHER_RETURNED ,"unknown cipher returned"}, | ||
| 395 | {SSL_R_UNKNOWN_CIPHER_TYPE ,"unknown cipher type"}, | ||
| 396 | {SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE ,"unknown key exchange type"}, | ||
| 397 | {SSL_R_UNKNOWN_PKEY_TYPE ,"unknown pkey type"}, | ||
| 398 | {SSL_R_UNKNOWN_PROTOCOL ,"unknown protocol"}, | ||
| 399 | {SSL_R_UNKNOWN_REMOTE_ERROR_TYPE ,"unknown remote error type"}, | ||
| 400 | {SSL_R_UNKNOWN_SSL_VERSION ,"unknown ssl version"}, | ||
| 401 | {SSL_R_UNKNOWN_STATE ,"unknown state"}, | ||
| 402 | {SSL_R_UNSUPPORTED_CIPHER ,"unsupported cipher"}, | ||
| 403 | {SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM ,"unsupported compression algorithm"}, | ||
| 404 | {SSL_R_UNSUPPORTED_OPTION ,"unsupported option"}, | ||
| 405 | {SSL_R_UNSUPPORTED_PROTOCOL ,"unsupported protocol"}, | ||
| 406 | {SSL_R_UNSUPPORTED_SSL_VERSION ,"unsupported ssl version"}, | ||
| 407 | {SSL_R_WRITE_BIO_NOT_SET ,"write bio not set"}, | ||
| 408 | {SSL_R_WRONG_CIPHER_RETURNED ,"wrong cipher returned"}, | ||
| 409 | {SSL_R_WRONG_MESSAGE_TYPE ,"wrong message type"}, | ||
| 410 | {SSL_R_WRONG_NUMBER_OF_KEY_BITS ,"wrong number of key bits"}, | ||
| 411 | {SSL_R_WRONG_SIGNATURE_LENGTH ,"wrong signature length"}, | ||
| 412 | {SSL_R_WRONG_SIGNATURE_SIZE ,"wrong signature size"}, | ||
| 413 | {SSL_R_WRONG_SSL_VERSION ,"wrong ssl version"}, | ||
| 414 | {SSL_R_WRONG_VERSION_NUMBER ,"wrong version number"}, | ||
| 415 | {SSL_R_X509_LIB ,"x509 lib"}, | ||
| 416 | {SSL_R_X509_VERIFICATION_SETUP_PROBLEMS ,"x509 verification setup problems"}, | ||
| 417 | {0,NULL} | ||
| 418 | }; | ||
| 419 | |||
| 420 | #endif | ||
| 421 | |||
| 422 | void ERR_load_SSL_strings(void) | ||
| 423 | { | ||
| 424 | static int init=1; | ||
| 425 | |||
| 426 | if (init) | ||
| 427 | { | ||
| 428 | init=0; | ||
| 429 | #ifndef NO_ERR | ||
| 430 | ERR_load_strings(ERR_LIB_SSL,SSL_str_functs); | ||
| 431 | ERR_load_strings(ERR_LIB_SSL,SSL_str_reasons); | ||
| 432 | #endif | ||
| 433 | |||
| 434 | } | ||
| 435 | } | ||
diff --git a/src/lib/libssl/ssl_err2.c b/src/lib/libssl/ssl_err2.c deleted file mode 100644 index cc089a612b..0000000000 --- a/src/lib/libssl/ssl_err2.c +++ /dev/null | |||
| @@ -1,70 +0,0 @@ | |||
| 1 | /* ssl/ssl_err2.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/err.h> | ||
| 61 | #include <openssl/ssl.h> | ||
| 62 | |||
| 63 | void SSL_load_error_strings(void) | ||
| 64 | { | ||
| 65 | #ifndef NO_ERR | ||
| 66 | ERR_load_crypto_strings(); | ||
| 67 | ERR_load_SSL_strings(); | ||
| 68 | #endif | ||
| 69 | } | ||
| 70 | |||
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c deleted file mode 100644 index 1fe85b6cb7..0000000000 --- a/src/lib/libssl/ssl_lib.c +++ /dev/null | |||
| @@ -1,2074 +0,0 @@ | |||
| 1 | /*! \file ssl/ssl_lib.c | ||
| 2 | * \brief Version independent SSL functions. | ||
| 3 | */ | ||
| 4 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 5 | * All rights reserved. | ||
| 6 | * | ||
| 7 | * This package is an SSL implementation written | ||
| 8 | * by Eric Young (eay@cryptsoft.com). | ||
| 9 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 10 | * | ||
| 11 | * This library is free for commercial and non-commercial use as long as | ||
| 12 | * the following conditions are aheared to. The following conditions | ||
| 13 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 14 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 15 | * included with this distribution is covered by the same copyright terms | ||
| 16 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 17 | * | ||
| 18 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 19 | * the code are not to be removed. | ||
| 20 | * If this package is used in a product, Eric Young should be given attribution | ||
| 21 | * as the author of the parts of the library used. | ||
| 22 | * This can be in the form of a textual message at program startup or | ||
| 23 | * in documentation (online or textual) provided with the package. | ||
| 24 | * | ||
| 25 | * Redistribution and use in source and binary forms, with or without | ||
| 26 | * modification, are permitted provided that the following conditions | ||
| 27 | * are met: | ||
| 28 | * 1. Redistributions of source code must retain the copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer. | ||
| 30 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 31 | * notice, this list of conditions and the following disclaimer in the | ||
| 32 | * documentation and/or other materials provided with the distribution. | ||
| 33 | * 3. All advertising materials mentioning features or use of this software | ||
| 34 | * must display the following acknowledgement: | ||
| 35 | * "This product includes cryptographic software written by | ||
| 36 | * Eric Young (eay@cryptsoft.com)" | ||
| 37 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 38 | * being used are not cryptographic related :-). | ||
| 39 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 40 | * the apps directory (application code) you must include an acknowledgement: | ||
| 41 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 42 | * | ||
| 43 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 44 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 45 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 46 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 47 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 48 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 49 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 50 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 51 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 52 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 53 | * SUCH DAMAGE. | ||
| 54 | * | ||
| 55 | * The licence and distribution terms for any publically available version or | ||
| 56 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 57 | * copied and put under another distribution licence | ||
| 58 | * [including the GNU Public Licence.] | ||
| 59 | */ | ||
| 60 | |||
| 61 | |||
| 62 | #include <assert.h> | ||
| 63 | #include <stdio.h> | ||
| 64 | #include <openssl/objects.h> | ||
| 65 | #include <openssl/lhash.h> | ||
| 66 | #include <openssl/x509v3.h> | ||
| 67 | #include "ssl_locl.h" | ||
| 68 | |||
| 69 | const char *SSL_version_str=OPENSSL_VERSION_TEXT; | ||
| 70 | |||
| 71 | static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_meth=NULL; | ||
| 72 | static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_ctx_meth=NULL; | ||
| 73 | static int ssl_meth_num=0; | ||
| 74 | static int ssl_ctx_meth_num=0; | ||
| 75 | |||
| 76 | OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={ | ||
| 77 | /* evil casts, but these functions are only called if there's a library bug */ | ||
| 78 | (int (*)(SSL *,int))ssl_undefined_function, | ||
| 79 | (int (*)(SSL *, unsigned char *, int))ssl_undefined_function, | ||
| 80 | ssl_undefined_function, | ||
| 81 | (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function, | ||
| 82 | (int (*)(SSL*, int))ssl_undefined_function, | ||
| 83 | (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function | ||
| 84 | }; | ||
| 85 | |||
| 86 | int SSL_clear(SSL *s) | ||
| 87 | { | ||
| 88 | int state; | ||
| 89 | |||
| 90 | if (s->method == NULL) | ||
| 91 | { | ||
| 92 | SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED); | ||
| 93 | return(0); | ||
| 94 | } | ||
| 95 | |||
| 96 | s->error=0; | ||
| 97 | s->hit=0; | ||
| 98 | s->shutdown=0; | ||
| 99 | |||
| 100 | #if 0 /* Disabled since version 1.10 of this file (early return not | ||
| 101 | * needed because SSL_clear is not called when doing renegotiation) */ | ||
| 102 | /* This is set if we are doing dynamic renegotiation so keep | ||
| 103 | * the old cipher. It is sort of a SSL_clear_lite :-) */ | ||
| 104 | if (s->new_session) return(1); | ||
| 105 | #else | ||
| 106 | if (s->new_session) | ||
| 107 | { | ||
| 108 | SSLerr(SSL_F_SSL_CLEAR,SSL_R_INTERNAL_ERROR); | ||
| 109 | return 0; | ||
| 110 | } | ||
| 111 | #endif | ||
| 112 | |||
| 113 | state=s->state; /* Keep to check if we throw away the session-id */ | ||
| 114 | s->type=0; | ||
| 115 | |||
| 116 | s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT); | ||
| 117 | |||
| 118 | s->version=s->method->version; | ||
| 119 | s->client_version=s->version; | ||
| 120 | s->rwstate=SSL_NOTHING; | ||
| 121 | s->rstate=SSL_ST_READ_HEADER; | ||
| 122 | #if 0 | ||
| 123 | s->read_ahead=s->ctx->read_ahead; | ||
| 124 | #endif | ||
| 125 | |||
| 126 | if (s->init_buf != NULL) | ||
| 127 | { | ||
| 128 | BUF_MEM_free(s->init_buf); | ||
| 129 | s->init_buf=NULL; | ||
| 130 | } | ||
| 131 | |||
| 132 | ssl_clear_cipher_ctx(s); | ||
| 133 | |||
| 134 | if (ssl_clear_bad_session(s)) | ||
| 135 | { | ||
| 136 | SSL_SESSION_free(s->session); | ||
| 137 | s->session=NULL; | ||
| 138 | } | ||
| 139 | |||
| 140 | s->first_packet=0; | ||
| 141 | |||
| 142 | #if 1 | ||
| 143 | /* Check to see if we were changed into a different method, if | ||
| 144 | * so, revert back if we are not doing session-id reuse. */ | ||
| 145 | if ((s->session == NULL) && (s->method != s->ctx->method)) | ||
| 146 | { | ||
| 147 | s->method->ssl_free(s); | ||
| 148 | s->method=s->ctx->method; | ||
| 149 | if (!s->method->ssl_new(s)) | ||
| 150 | return(0); | ||
| 151 | } | ||
| 152 | else | ||
| 153 | #endif | ||
| 154 | s->method->ssl_clear(s); | ||
| 155 | return(1); | ||
| 156 | } | ||
| 157 | |||
| 158 | /** Used to change an SSL_CTXs default SSL method type */ | ||
| 159 | int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth) | ||
| 160 | { | ||
| 161 | STACK_OF(SSL_CIPHER) *sk; | ||
| 162 | |||
| 163 | ctx->method=meth; | ||
| 164 | |||
| 165 | sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list), | ||
| 166 | &(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST); | ||
| 167 | if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) | ||
| 168 | { | ||
| 169 | SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); | ||
| 170 | return(0); | ||
| 171 | } | ||
| 172 | return(1); | ||
| 173 | } | ||
| 174 | |||
| 175 | SSL *SSL_new(SSL_CTX *ctx) | ||
| 176 | { | ||
| 177 | SSL *s; | ||
| 178 | |||
| 179 | if (ctx == NULL) | ||
| 180 | { | ||
| 181 | SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX); | ||
| 182 | return(NULL); | ||
| 183 | } | ||
| 184 | if (ctx->method == NULL) | ||
| 185 | { | ||
| 186 | SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); | ||
| 187 | return(NULL); | ||
| 188 | } | ||
| 189 | |||
| 190 | s=(SSL *)OPENSSL_malloc(sizeof(SSL)); | ||
| 191 | if (s == NULL) goto err; | ||
| 192 | memset(s,0,sizeof(SSL)); | ||
| 193 | |||
| 194 | if (ctx->cert != NULL) | ||
| 195 | { | ||
| 196 | /* Earlier library versions used to copy the pointer to | ||
| 197 | * the CERT, not its contents; only when setting new | ||
| 198 | * parameters for the per-SSL copy, ssl_cert_new would be | ||
| 199 | * called (and the direct reference to the per-SSL_CTX | ||
| 200 | * settings would be lost, but those still were indirectly | ||
| 201 | * accessed for various purposes, and for that reason they | ||
| 202 | * used to be known as s->ctx->default_cert). | ||
| 203 | * Now we don't look at the SSL_CTX's CERT after having | ||
| 204 | * duplicated it once. */ | ||
| 205 | |||
| 206 | s->cert = ssl_cert_dup(ctx->cert); | ||
| 207 | if (s->cert == NULL) | ||
| 208 | goto err; | ||
| 209 | } | ||
| 210 | else | ||
| 211 | s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */ | ||
| 212 | s->sid_ctx_length=ctx->sid_ctx_length; | ||
| 213 | memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx)); | ||
| 214 | s->verify_mode=ctx->verify_mode; | ||
| 215 | s->verify_depth=ctx->verify_depth; | ||
| 216 | s->verify_callback=ctx->default_verify_callback; | ||
| 217 | s->purpose = ctx->purpose; | ||
| 218 | s->trust = ctx->trust; | ||
| 219 | CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); | ||
| 220 | s->ctx=ctx; | ||
| 221 | |||
| 222 | s->verify_result=X509_V_OK; | ||
| 223 | |||
| 224 | s->method=ctx->method; | ||
| 225 | |||
| 226 | if (!s->method->ssl_new(s)) | ||
| 227 | goto err; | ||
| 228 | |||
| 229 | s->quiet_shutdown=ctx->quiet_shutdown; | ||
| 230 | s->references=1; | ||
| 231 | s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1; | ||
| 232 | s->options=ctx->options; | ||
| 233 | s->mode=ctx->mode; | ||
| 234 | s->read_ahead=ctx->read_ahead; /* used to happen in SSL_clear */ | ||
| 235 | SSL_clear(s); | ||
| 236 | |||
| 237 | CRYPTO_new_ex_data(ssl_meth,s,&s->ex_data); | ||
| 238 | |||
| 239 | return(s); | ||
| 240 | err: | ||
| 241 | if (s != NULL) | ||
| 242 | { | ||
| 243 | if (s->cert != NULL) | ||
| 244 | ssl_cert_free(s->cert); | ||
| 245 | if (s->ctx != NULL) | ||
| 246 | SSL_CTX_free(s->ctx); /* decrement reference count */ | ||
| 247 | OPENSSL_free(s); | ||
| 248 | } | ||
| 249 | SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE); | ||
| 250 | return(NULL); | ||
| 251 | } | ||
| 252 | |||
| 253 | int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx, | ||
| 254 | unsigned int sid_ctx_len) | ||
| 255 | { | ||
| 256 | if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) | ||
| 257 | { | ||
| 258 | SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); | ||
| 259 | return 0; | ||
| 260 | } | ||
| 261 | ctx->sid_ctx_length=sid_ctx_len; | ||
| 262 | memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len); | ||
| 263 | |||
| 264 | return 1; | ||
| 265 | } | ||
| 266 | |||
| 267 | int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx, | ||
| 268 | unsigned int sid_ctx_len) | ||
| 269 | { | ||
| 270 | if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) | ||
| 271 | { | ||
| 272 | SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); | ||
| 273 | return 0; | ||
| 274 | } | ||
| 275 | ssl->sid_ctx_length=sid_ctx_len; | ||
| 276 | memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len); | ||
| 277 | |||
| 278 | return 1; | ||
| 279 | } | ||
| 280 | |||
| 281 | int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) | ||
| 282 | { | ||
| 283 | if(X509_PURPOSE_get_by_id(purpose) == -1) { | ||
| 284 | SSLerr(SSL_F_SSL_CTX_SET_PURPOSE, SSL_R_INVALID_PURPOSE); | ||
| 285 | return 0; | ||
| 286 | } | ||
| 287 | s->purpose = purpose; | ||
| 288 | return 1; | ||
| 289 | } | ||
| 290 | |||
| 291 | int SSL_set_purpose(SSL *s, int purpose) | ||
| 292 | { | ||
| 293 | if(X509_PURPOSE_get_by_id(purpose) == -1) { | ||
| 294 | SSLerr(SSL_F_SSL_SET_PURPOSE, SSL_R_INVALID_PURPOSE); | ||
| 295 | return 0; | ||
| 296 | } | ||
| 297 | s->purpose = purpose; | ||
| 298 | return 1; | ||
| 299 | } | ||
| 300 | |||
| 301 | int SSL_CTX_set_trust(SSL_CTX *s, int trust) | ||
| 302 | { | ||
| 303 | if(X509_TRUST_get_by_id(trust) == -1) { | ||
| 304 | SSLerr(SSL_F_SSL_CTX_SET_TRUST, SSL_R_INVALID_TRUST); | ||
| 305 | return 0; | ||
| 306 | } | ||
| 307 | s->trust = trust; | ||
| 308 | return 1; | ||
| 309 | } | ||
| 310 | |||
| 311 | int SSL_set_trust(SSL *s, int trust) | ||
| 312 | { | ||
| 313 | if(X509_TRUST_get_by_id(trust) == -1) { | ||
| 314 | SSLerr(SSL_F_SSL_SET_TRUST, SSL_R_INVALID_TRUST); | ||
| 315 | return 0; | ||
| 316 | } | ||
| 317 | s->trust = trust; | ||
| 318 | return 1; | ||
| 319 | } | ||
| 320 | |||
| 321 | void SSL_free(SSL *s) | ||
| 322 | { | ||
| 323 | int i; | ||
| 324 | |||
| 325 | if(s == NULL) | ||
| 326 | return; | ||
| 327 | |||
| 328 | i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL); | ||
| 329 | #ifdef REF_PRINT | ||
| 330 | REF_PRINT("SSL",s); | ||
| 331 | #endif | ||
| 332 | if (i > 0) return; | ||
| 333 | #ifdef REF_CHECK | ||
| 334 | if (i < 0) | ||
| 335 | { | ||
| 336 | fprintf(stderr,"SSL_free, bad reference count\n"); | ||
| 337 | abort(); /* ok */ | ||
| 338 | } | ||
| 339 | #endif | ||
| 340 | |||
| 341 | CRYPTO_free_ex_data(ssl_meth,(char *)s,&s->ex_data); | ||
| 342 | |||
| 343 | if (s->bbio != NULL) | ||
| 344 | { | ||
| 345 | /* If the buffering BIO is in place, pop it off */ | ||
| 346 | if (s->bbio == s->wbio) | ||
| 347 | { | ||
| 348 | s->wbio=BIO_pop(s->wbio); | ||
| 349 | } | ||
| 350 | BIO_free(s->bbio); | ||
| 351 | s->bbio=NULL; | ||
| 352 | } | ||
| 353 | if (s->rbio != NULL) | ||
| 354 | BIO_free_all(s->rbio); | ||
| 355 | if ((s->wbio != NULL) && (s->wbio != s->rbio)) | ||
| 356 | BIO_free_all(s->wbio); | ||
| 357 | |||
| 358 | if (s->init_buf != NULL) BUF_MEM_free(s->init_buf); | ||
| 359 | |||
| 360 | /* add extra stuff */ | ||
| 361 | if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list); | ||
| 362 | if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id); | ||
| 363 | |||
| 364 | /* Make the next call work :-) */ | ||
| 365 | if (s->session != NULL) | ||
| 366 | { | ||
| 367 | ssl_clear_bad_session(s); | ||
| 368 | SSL_SESSION_free(s->session); | ||
| 369 | } | ||
| 370 | |||
| 371 | ssl_clear_cipher_ctx(s); | ||
| 372 | |||
| 373 | if (s->cert != NULL) ssl_cert_free(s->cert); | ||
| 374 | /* Free up if allocated */ | ||
| 375 | |||
| 376 | if (s->ctx) SSL_CTX_free(s->ctx); | ||
| 377 | |||
| 378 | if (s->client_CA != NULL) | ||
| 379 | sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free); | ||
| 380 | |||
| 381 | if (s->method != NULL) s->method->ssl_free(s); | ||
| 382 | |||
| 383 | OPENSSL_free(s); | ||
| 384 | } | ||
| 385 | |||
| 386 | void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio) | ||
| 387 | { | ||
| 388 | /* If the output buffering BIO is still in place, remove it | ||
| 389 | */ | ||
| 390 | if (s->bbio != NULL) | ||
| 391 | { | ||
| 392 | if (s->wbio == s->bbio) | ||
| 393 | { | ||
| 394 | s->wbio=s->wbio->next_bio; | ||
| 395 | s->bbio->next_bio=NULL; | ||
| 396 | } | ||
| 397 | } | ||
| 398 | if ((s->rbio != NULL) && (s->rbio != rbio)) | ||
| 399 | BIO_free_all(s->rbio); | ||
| 400 | if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio)) | ||
| 401 | BIO_free_all(s->wbio); | ||
| 402 | s->rbio=rbio; | ||
| 403 | s->wbio=wbio; | ||
| 404 | } | ||
| 405 | |||
| 406 | BIO *SSL_get_rbio(SSL *s) | ||
| 407 | { return(s->rbio); } | ||
| 408 | |||
| 409 | BIO *SSL_get_wbio(SSL *s) | ||
| 410 | { return(s->wbio); } | ||
| 411 | |||
| 412 | int SSL_get_fd(SSL *s) | ||
| 413 | { | ||
| 414 | int ret= -1; | ||
| 415 | BIO *b,*r; | ||
| 416 | |||
| 417 | b=SSL_get_rbio(s); | ||
| 418 | r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR); | ||
| 419 | if (r != NULL) | ||
| 420 | BIO_get_fd(r,&ret); | ||
| 421 | return(ret); | ||
| 422 | } | ||
| 423 | |||
| 424 | #ifndef NO_SOCK | ||
| 425 | int SSL_set_fd(SSL *s,int fd) | ||
| 426 | { | ||
| 427 | int ret=0; | ||
| 428 | BIO *bio=NULL; | ||
| 429 | |||
| 430 | bio=BIO_new(BIO_s_socket()); | ||
| 431 | |||
| 432 | if (bio == NULL) | ||
| 433 | { | ||
| 434 | SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB); | ||
| 435 | goto err; | ||
| 436 | } | ||
| 437 | BIO_set_fd(bio,fd,BIO_NOCLOSE); | ||
| 438 | SSL_set_bio(s,bio,bio); | ||
| 439 | ret=1; | ||
| 440 | err: | ||
| 441 | return(ret); | ||
| 442 | } | ||
| 443 | |||
| 444 | int SSL_set_wfd(SSL *s,int fd) | ||
| 445 | { | ||
| 446 | int ret=0; | ||
| 447 | BIO *bio=NULL; | ||
| 448 | |||
| 449 | if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET) | ||
| 450 | || ((int)BIO_get_fd(s->rbio,NULL) != fd)) | ||
| 451 | { | ||
| 452 | bio=BIO_new(BIO_s_socket()); | ||
| 453 | |||
| 454 | if (bio == NULL) | ||
| 455 | { SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; } | ||
| 456 | BIO_set_fd(bio,fd,BIO_NOCLOSE); | ||
| 457 | SSL_set_bio(s,SSL_get_rbio(s),bio); | ||
| 458 | } | ||
| 459 | else | ||
| 460 | SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s)); | ||
| 461 | ret=1; | ||
| 462 | err: | ||
| 463 | return(ret); | ||
| 464 | } | ||
| 465 | |||
| 466 | int SSL_set_rfd(SSL *s,int fd) | ||
| 467 | { | ||
| 468 | int ret=0; | ||
| 469 | BIO *bio=NULL; | ||
| 470 | |||
| 471 | if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET) | ||
| 472 | || ((int)BIO_get_fd(s->wbio,NULL) != fd)) | ||
| 473 | { | ||
| 474 | bio=BIO_new(BIO_s_socket()); | ||
| 475 | |||
| 476 | if (bio == NULL) | ||
| 477 | { | ||
| 478 | SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB); | ||
| 479 | goto err; | ||
| 480 | } | ||
| 481 | BIO_set_fd(bio,fd,BIO_NOCLOSE); | ||
| 482 | SSL_set_bio(s,bio,SSL_get_wbio(s)); | ||
| 483 | } | ||
| 484 | else | ||
| 485 | SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s)); | ||
| 486 | ret=1; | ||
| 487 | err: | ||
| 488 | return(ret); | ||
| 489 | } | ||
| 490 | #endif | ||
| 491 | |||
| 492 | |||
| 493 | /* return length of latest Finished message we sent, copy to 'buf' */ | ||
| 494 | size_t SSL_get_finished(SSL *s, void *buf, size_t count) | ||
| 495 | { | ||
| 496 | size_t ret = 0; | ||
| 497 | |||
| 498 | if (s->s3 != NULL) | ||
| 499 | { | ||
| 500 | ret = s->s3->tmp.finish_md_len; | ||
| 501 | if (count > ret) | ||
| 502 | count = ret; | ||
| 503 | memcpy(buf, s->s3->tmp.finish_md, count); | ||
| 504 | } | ||
| 505 | return ret; | ||
| 506 | } | ||
| 507 | |||
| 508 | /* return length of latest Finished message we expected, copy to 'buf' */ | ||
| 509 | size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count) | ||
| 510 | { | ||
| 511 | size_t ret = 0; | ||
| 512 | |||
| 513 | if (s->s3 != NULL) | ||
| 514 | { | ||
| 515 | ret = s->s3->tmp.peer_finish_md_len; | ||
| 516 | if (count > ret) | ||
| 517 | count = ret; | ||
| 518 | memcpy(buf, s->s3->tmp.peer_finish_md, count); | ||
| 519 | } | ||
| 520 | return ret; | ||
| 521 | } | ||
| 522 | |||
| 523 | |||
| 524 | int SSL_get_verify_mode(SSL *s) | ||
| 525 | { | ||
| 526 | return(s->verify_mode); | ||
| 527 | } | ||
| 528 | |||
| 529 | int SSL_get_verify_depth(SSL *s) | ||
| 530 | { | ||
| 531 | return(s->verify_depth); | ||
| 532 | } | ||
| 533 | |||
| 534 | int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *) | ||
| 535 | { | ||
| 536 | return(s->verify_callback); | ||
| 537 | } | ||
| 538 | |||
| 539 | int SSL_CTX_get_verify_mode(SSL_CTX *ctx) | ||
| 540 | { | ||
| 541 | return(ctx->verify_mode); | ||
| 542 | } | ||
| 543 | |||
| 544 | int SSL_CTX_get_verify_depth(SSL_CTX *ctx) | ||
| 545 | { | ||
| 546 | return(ctx->verify_depth); | ||
| 547 | } | ||
| 548 | |||
| 549 | int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *) | ||
| 550 | { | ||
| 551 | return(ctx->default_verify_callback); | ||
| 552 | } | ||
| 553 | |||
| 554 | void SSL_set_verify(SSL *s,int mode, | ||
| 555 | int (*callback)(int ok,X509_STORE_CTX *ctx)) | ||
| 556 | { | ||
| 557 | s->verify_mode=mode; | ||
| 558 | if (callback != NULL) | ||
| 559 | s->verify_callback=callback; | ||
| 560 | } | ||
| 561 | |||
| 562 | void SSL_set_verify_depth(SSL *s,int depth) | ||
| 563 | { | ||
| 564 | s->verify_depth=depth; | ||
| 565 | } | ||
| 566 | |||
| 567 | void SSL_set_read_ahead(SSL *s,int yes) | ||
| 568 | { | ||
| 569 | s->read_ahead=yes; | ||
| 570 | } | ||
| 571 | |||
| 572 | int SSL_get_read_ahead(SSL *s) | ||
| 573 | { | ||
| 574 | return(s->read_ahead); | ||
| 575 | } | ||
| 576 | |||
| 577 | int SSL_pending(SSL *s) | ||
| 578 | { | ||
| 579 | return(s->method->ssl_pending(s)); | ||
| 580 | } | ||
| 581 | |||
| 582 | X509 *SSL_get_peer_certificate(SSL *s) | ||
| 583 | { | ||
| 584 | X509 *r; | ||
| 585 | |||
| 586 | if ((s == NULL) || (s->session == NULL)) | ||
| 587 | r=NULL; | ||
| 588 | else | ||
| 589 | r=s->session->peer; | ||
| 590 | |||
| 591 | if (r == NULL) return(r); | ||
| 592 | |||
| 593 | CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509); | ||
| 594 | |||
| 595 | return(r); | ||
| 596 | } | ||
| 597 | |||
| 598 | STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s) | ||
| 599 | { | ||
| 600 | STACK_OF(X509) *r; | ||
| 601 | |||
| 602 | if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL)) | ||
| 603 | r=NULL; | ||
| 604 | else | ||
| 605 | r=s->session->sess_cert->cert_chain; | ||
| 606 | |||
| 607 | /* If we are a client, cert_chain includes the peer's own | ||
| 608 | * certificate; if we are a server, it does not. */ | ||
| 609 | |||
| 610 | return(r); | ||
| 611 | } | ||
| 612 | |||
| 613 | /* Now in theory, since the calling process own 't' it should be safe to | ||
| 614 | * modify. We need to be able to read f without being hassled */ | ||
| 615 | void SSL_copy_session_id(SSL *t,SSL *f) | ||
| 616 | { | ||
| 617 | CERT *tmp; | ||
| 618 | |||
| 619 | /* Do we need to to SSL locking? */ | ||
| 620 | SSL_set_session(t,SSL_get_session(f)); | ||
| 621 | |||
| 622 | /* what if we are setup as SSLv2 but want to talk SSLv3 or | ||
| 623 | * vice-versa */ | ||
| 624 | if (t->method != f->method) | ||
| 625 | { | ||
| 626 | t->method->ssl_free(t); /* cleanup current */ | ||
| 627 | t->method=f->method; /* change method */ | ||
| 628 | t->method->ssl_new(t); /* setup new */ | ||
| 629 | } | ||
| 630 | |||
| 631 | tmp=t->cert; | ||
| 632 | if (f->cert != NULL) | ||
| 633 | { | ||
| 634 | CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT); | ||
| 635 | t->cert=f->cert; | ||
| 636 | } | ||
| 637 | else | ||
| 638 | t->cert=NULL; | ||
| 639 | if (tmp != NULL) ssl_cert_free(tmp); | ||
| 640 | SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length); | ||
| 641 | } | ||
| 642 | |||
| 643 | /* Fix this so it checks all the valid key/cert options */ | ||
| 644 | int SSL_CTX_check_private_key(SSL_CTX *ctx) | ||
| 645 | { | ||
| 646 | if ( (ctx == NULL) || | ||
| 647 | (ctx->cert == NULL) || | ||
| 648 | (ctx->cert->key->x509 == NULL)) | ||
| 649 | { | ||
| 650 | SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED); | ||
| 651 | return(0); | ||
| 652 | } | ||
| 653 | if (ctx->cert->key->privatekey == NULL) | ||
| 654 | { | ||
| 655 | SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED); | ||
| 656 | return(0); | ||
| 657 | } | ||
| 658 | return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey)); | ||
| 659 | } | ||
| 660 | |||
| 661 | /* Fix this function so that it takes an optional type parameter */ | ||
| 662 | int SSL_check_private_key(SSL *ssl) | ||
| 663 | { | ||
| 664 | if (ssl == NULL) | ||
| 665 | { | ||
| 666 | SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER); | ||
| 667 | return(0); | ||
| 668 | } | ||
| 669 | if (ssl->cert == NULL) | ||
| 670 | { | ||
| 671 | SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED); | ||
| 672 | return 0; | ||
| 673 | } | ||
| 674 | if (ssl->cert->key->x509 == NULL) | ||
| 675 | { | ||
| 676 | SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED); | ||
| 677 | return(0); | ||
| 678 | } | ||
| 679 | if (ssl->cert->key->privatekey == NULL) | ||
| 680 | { | ||
| 681 | SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED); | ||
| 682 | return(0); | ||
| 683 | } | ||
| 684 | return(X509_check_private_key(ssl->cert->key->x509, | ||
| 685 | ssl->cert->key->privatekey)); | ||
| 686 | } | ||
| 687 | |||
| 688 | int SSL_accept(SSL *s) | ||
| 689 | { | ||
| 690 | if (s->handshake_func == 0) | ||
| 691 | /* Not properly initialized yet */ | ||
| 692 | SSL_set_accept_state(s); | ||
| 693 | |||
| 694 | return(s->method->ssl_accept(s)); | ||
| 695 | } | ||
| 696 | |||
| 697 | int SSL_connect(SSL *s) | ||
| 698 | { | ||
| 699 | if (s->handshake_func == 0) | ||
| 700 | /* Not properly initialized yet */ | ||
| 701 | SSL_set_connect_state(s); | ||
| 702 | |||
| 703 | return(s->method->ssl_connect(s)); | ||
| 704 | } | ||
| 705 | |||
| 706 | long SSL_get_default_timeout(SSL *s) | ||
| 707 | { | ||
| 708 | return(s->method->get_timeout()); | ||
| 709 | } | ||
| 710 | |||
| 711 | int SSL_read(SSL *s,void *buf,int num) | ||
| 712 | { | ||
| 713 | if (s->handshake_func == 0) | ||
| 714 | { | ||
| 715 | SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED); | ||
| 716 | return -1; | ||
| 717 | } | ||
| 718 | |||
| 719 | if (s->shutdown & SSL_RECEIVED_SHUTDOWN) | ||
| 720 | { | ||
| 721 | s->rwstate=SSL_NOTHING; | ||
| 722 | return(0); | ||
| 723 | } | ||
| 724 | return(s->method->ssl_read(s,buf,num)); | ||
| 725 | } | ||
| 726 | |||
| 727 | int SSL_peek(SSL *s,void *buf,int num) | ||
| 728 | { | ||
| 729 | if (s->handshake_func == 0) | ||
| 730 | { | ||
| 731 | SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED); | ||
| 732 | return -1; | ||
| 733 | } | ||
| 734 | |||
| 735 | if (s->shutdown & SSL_RECEIVED_SHUTDOWN) | ||
| 736 | { | ||
| 737 | return(0); | ||
| 738 | } | ||
| 739 | return(s->method->ssl_peek(s,buf,num)); | ||
| 740 | } | ||
| 741 | |||
| 742 | int SSL_write(SSL *s,const void *buf,int num) | ||
| 743 | { | ||
| 744 | if (s->handshake_func == 0) | ||
| 745 | { | ||
| 746 | SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED); | ||
| 747 | return -1; | ||
| 748 | } | ||
| 749 | |||
| 750 | if (s->shutdown & SSL_SENT_SHUTDOWN) | ||
| 751 | { | ||
| 752 | s->rwstate=SSL_NOTHING; | ||
| 753 | SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN); | ||
| 754 | return(-1); | ||
| 755 | } | ||
| 756 | return(s->method->ssl_write(s,buf,num)); | ||
| 757 | } | ||
| 758 | |||
| 759 | int SSL_shutdown(SSL *s) | ||
| 760 | { | ||
| 761 | /* Note that this function behaves differently from what one might | ||
| 762 | * expect. Return values are 0 for no success (yet), | ||
| 763 | * 1 for success; but calling it once is usually not enough, | ||
| 764 | * even if blocking I/O is used (see ssl3_shutdown). | ||
| 765 | */ | ||
| 766 | |||
| 767 | if (s->handshake_func == 0) | ||
| 768 | { | ||
| 769 | SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED); | ||
| 770 | return -1; | ||
| 771 | } | ||
| 772 | |||
| 773 | if ((s != NULL) && !SSL_in_init(s)) | ||
| 774 | return(s->method->ssl_shutdown(s)); | ||
| 775 | else | ||
| 776 | return(1); | ||
| 777 | } | ||
| 778 | |||
| 779 | int SSL_renegotiate(SSL *s) | ||
| 780 | { | ||
| 781 | s->new_session=1; | ||
| 782 | return(s->method->ssl_renegotiate(s)); | ||
| 783 | } | ||
| 784 | |||
| 785 | long SSL_ctrl(SSL *s,int cmd,long larg,char *parg) | ||
| 786 | { | ||
| 787 | long l; | ||
| 788 | |||
| 789 | switch (cmd) | ||
| 790 | { | ||
| 791 | case SSL_CTRL_GET_READ_AHEAD: | ||
| 792 | return(s->read_ahead); | ||
| 793 | case SSL_CTRL_SET_READ_AHEAD: | ||
| 794 | l=s->read_ahead; | ||
| 795 | s->read_ahead=larg; | ||
| 796 | return(l); | ||
| 797 | case SSL_CTRL_OPTIONS: | ||
| 798 | return(s->options|=larg); | ||
| 799 | case SSL_CTRL_MODE: | ||
| 800 | return(s->mode|=larg); | ||
| 801 | default: | ||
| 802 | return(s->method->ssl_ctrl(s,cmd,larg,parg)); | ||
| 803 | } | ||
| 804 | } | ||
| 805 | |||
| 806 | long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)()) | ||
| 807 | { | ||
| 808 | switch(cmd) | ||
| 809 | { | ||
| 810 | default: | ||
| 811 | return(s->method->ssl_callback_ctrl(s,cmd,fp)); | ||
| 812 | } | ||
| 813 | } | ||
| 814 | |||
| 815 | struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx) | ||
| 816 | { | ||
| 817 | return ctx->sessions; | ||
| 818 | } | ||
| 819 | |||
| 820 | long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg) | ||
| 821 | { | ||
| 822 | long l; | ||
| 823 | |||
| 824 | switch (cmd) | ||
| 825 | { | ||
| 826 | case SSL_CTRL_GET_READ_AHEAD: | ||
| 827 | return(ctx->read_ahead); | ||
| 828 | case SSL_CTRL_SET_READ_AHEAD: | ||
| 829 | l=ctx->read_ahead; | ||
| 830 | ctx->read_ahead=larg; | ||
| 831 | return(l); | ||
| 832 | |||
| 833 | case SSL_CTRL_SET_SESS_CACHE_SIZE: | ||
| 834 | l=ctx->session_cache_size; | ||
| 835 | ctx->session_cache_size=larg; | ||
| 836 | return(l); | ||
| 837 | case SSL_CTRL_GET_SESS_CACHE_SIZE: | ||
| 838 | return(ctx->session_cache_size); | ||
| 839 | case SSL_CTRL_SET_SESS_CACHE_MODE: | ||
| 840 | l=ctx->session_cache_mode; | ||
| 841 | ctx->session_cache_mode=larg; | ||
| 842 | return(l); | ||
| 843 | case SSL_CTRL_GET_SESS_CACHE_MODE: | ||
| 844 | return(ctx->session_cache_mode); | ||
| 845 | |||
| 846 | case SSL_CTRL_SESS_NUMBER: | ||
| 847 | return(ctx->sessions->num_items); | ||
| 848 | case SSL_CTRL_SESS_CONNECT: | ||
| 849 | return(ctx->stats.sess_connect); | ||
| 850 | case SSL_CTRL_SESS_CONNECT_GOOD: | ||
| 851 | return(ctx->stats.sess_connect_good); | ||
| 852 | case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: | ||
| 853 | return(ctx->stats.sess_connect_renegotiate); | ||
| 854 | case SSL_CTRL_SESS_ACCEPT: | ||
| 855 | return(ctx->stats.sess_accept); | ||
| 856 | case SSL_CTRL_SESS_ACCEPT_GOOD: | ||
| 857 | return(ctx->stats.sess_accept_good); | ||
| 858 | case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE: | ||
| 859 | return(ctx->stats.sess_accept_renegotiate); | ||
| 860 | case SSL_CTRL_SESS_HIT: | ||
| 861 | return(ctx->stats.sess_hit); | ||
| 862 | case SSL_CTRL_SESS_CB_HIT: | ||
| 863 | return(ctx->stats.sess_cb_hit); | ||
| 864 | case SSL_CTRL_SESS_MISSES: | ||
| 865 | return(ctx->stats.sess_miss); | ||
| 866 | case SSL_CTRL_SESS_TIMEOUTS: | ||
| 867 | return(ctx->stats.sess_timeout); | ||
| 868 | case SSL_CTRL_SESS_CACHE_FULL: | ||
| 869 | return(ctx->stats.sess_cache_full); | ||
| 870 | case SSL_CTRL_OPTIONS: | ||
| 871 | return(ctx->options|=larg); | ||
| 872 | case SSL_CTRL_MODE: | ||
| 873 | return(ctx->mode|=larg); | ||
| 874 | default: | ||
| 875 | return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg)); | ||
| 876 | } | ||
| 877 | } | ||
| 878 | |||
| 879 | long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)()) | ||
| 880 | { | ||
| 881 | switch(cmd) | ||
| 882 | { | ||
| 883 | default: | ||
| 884 | return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp)); | ||
| 885 | } | ||
| 886 | } | ||
| 887 | |||
| 888 | int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b) | ||
| 889 | { | ||
| 890 | long l; | ||
| 891 | |||
| 892 | l=a->id-b->id; | ||
| 893 | if (l == 0L) | ||
| 894 | return(0); | ||
| 895 | else | ||
| 896 | return((l > 0)?1:-1); | ||
| 897 | } | ||
| 898 | |||
| 899 | int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap, | ||
| 900 | const SSL_CIPHER * const *bp) | ||
| 901 | { | ||
| 902 | long l; | ||
| 903 | |||
| 904 | l=(*ap)->id-(*bp)->id; | ||
| 905 | if (l == 0L) | ||
| 906 | return(0); | ||
| 907 | else | ||
| 908 | return((l > 0)?1:-1); | ||
| 909 | } | ||
| 910 | |||
| 911 | /** return a STACK of the ciphers available for the SSL and in order of | ||
| 912 | * preference */ | ||
| 913 | STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s) | ||
| 914 | { | ||
| 915 | if ((s != NULL) && (s->cipher_list != NULL)) | ||
| 916 | { | ||
| 917 | return(s->cipher_list); | ||
| 918 | } | ||
| 919 | else if ((s->ctx != NULL) && | ||
| 920 | (s->ctx->cipher_list != NULL)) | ||
| 921 | { | ||
| 922 | return(s->ctx->cipher_list); | ||
| 923 | } | ||
| 924 | return(NULL); | ||
| 925 | } | ||
| 926 | |||
| 927 | /** return a STACK of the ciphers available for the SSL and in order of | ||
| 928 | * algorithm id */ | ||
| 929 | STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s) | ||
| 930 | { | ||
| 931 | if ((s != NULL) && (s->cipher_list_by_id != NULL)) | ||
| 932 | { | ||
| 933 | return(s->cipher_list_by_id); | ||
| 934 | } | ||
| 935 | else if ((s != NULL) && (s->ctx != NULL) && | ||
| 936 | (s->ctx->cipher_list_by_id != NULL)) | ||
| 937 | { | ||
| 938 | return(s->ctx->cipher_list_by_id); | ||
| 939 | } | ||
| 940 | return(NULL); | ||
| 941 | } | ||
| 942 | |||
| 943 | /** The old interface to get the same thing as SSL_get_ciphers() */ | ||
| 944 | const char *SSL_get_cipher_list(SSL *s,int n) | ||
| 945 | { | ||
| 946 | SSL_CIPHER *c; | ||
| 947 | STACK_OF(SSL_CIPHER) *sk; | ||
| 948 | |||
| 949 | if (s == NULL) return(NULL); | ||
| 950 | sk=SSL_get_ciphers(s); | ||
| 951 | if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n)) | ||
| 952 | return(NULL); | ||
| 953 | c=sk_SSL_CIPHER_value(sk,n); | ||
| 954 | if (c == NULL) return(NULL); | ||
| 955 | return(c->name); | ||
| 956 | } | ||
| 957 | |||
| 958 | /** specify the ciphers to be used by default by the SSL_CTX */ | ||
| 959 | int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) | ||
| 960 | { | ||
| 961 | STACK_OF(SSL_CIPHER) *sk; | ||
| 962 | |||
| 963 | sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list, | ||
| 964 | &ctx->cipher_list_by_id,str); | ||
| 965 | /* XXXX */ | ||
| 966 | return((sk == NULL)?0:1); | ||
| 967 | } | ||
| 968 | |||
| 969 | /** specify the ciphers to be used by the SSL */ | ||
| 970 | int SSL_set_cipher_list(SSL *s,const char *str) | ||
| 971 | { | ||
| 972 | STACK_OF(SSL_CIPHER) *sk; | ||
| 973 | |||
| 974 | sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list, | ||
| 975 | &s->cipher_list_by_id,str); | ||
| 976 | /* XXXX */ | ||
| 977 | return((sk == NULL)?0:1); | ||
| 978 | } | ||
| 979 | |||
| 980 | /* works well for SSLv2, not so good for SSLv3 */ | ||
| 981 | char *SSL_get_shared_ciphers(SSL *s,char *buf,int len) | ||
| 982 | { | ||
| 983 | char *p; | ||
| 984 | const char *cp; | ||
| 985 | STACK_OF(SSL_CIPHER) *sk; | ||
| 986 | SSL_CIPHER *c; | ||
| 987 | int i; | ||
| 988 | |||
| 989 | if ((s->session == NULL) || (s->session->ciphers == NULL) || | ||
| 990 | (len < 2)) | ||
| 991 | return(NULL); | ||
| 992 | |||
| 993 | p=buf; | ||
| 994 | sk=s->session->ciphers; | ||
| 995 | for (i=0; i<sk_SSL_CIPHER_num(sk); i++) | ||
| 996 | { | ||
| 997 | /* Decrement for either the ':' or a '\0' */ | ||
| 998 | len--; | ||
| 999 | c=sk_SSL_CIPHER_value(sk,i); | ||
| 1000 | for (cp=c->name; *cp; ) | ||
| 1001 | { | ||
| 1002 | if (len-- == 0) | ||
| 1003 | { | ||
| 1004 | *p='\0'; | ||
| 1005 | return(buf); | ||
| 1006 | } | ||
| 1007 | else | ||
| 1008 | *(p++)= *(cp++); | ||
| 1009 | } | ||
| 1010 | *(p++)=':'; | ||
| 1011 | } | ||
| 1012 | p[-1]='\0'; | ||
| 1013 | return(buf); | ||
| 1014 | } | ||
| 1015 | |||
| 1016 | int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p) | ||
| 1017 | { | ||
| 1018 | int i,j=0; | ||
| 1019 | SSL_CIPHER *c; | ||
| 1020 | unsigned char *q; | ||
| 1021 | |||
| 1022 | if (sk == NULL) return(0); | ||
| 1023 | q=p; | ||
| 1024 | |||
| 1025 | for (i=0; i<sk_SSL_CIPHER_num(sk); i++) | ||
| 1026 | { | ||
| 1027 | c=sk_SSL_CIPHER_value(sk,i); | ||
| 1028 | j=ssl_put_cipher_by_char(s,c,p); | ||
| 1029 | p+=j; | ||
| 1030 | } | ||
| 1031 | return(p-q); | ||
| 1032 | } | ||
| 1033 | |||
| 1034 | STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num, | ||
| 1035 | STACK_OF(SSL_CIPHER) **skp) | ||
| 1036 | { | ||
| 1037 | SSL_CIPHER *c; | ||
| 1038 | STACK_OF(SSL_CIPHER) *sk; | ||
| 1039 | int i,n; | ||
| 1040 | |||
| 1041 | n=ssl_put_cipher_by_char(s,NULL,NULL); | ||
| 1042 | if ((num%n) != 0) | ||
| 1043 | { | ||
| 1044 | SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); | ||
| 1045 | return(NULL); | ||
| 1046 | } | ||
| 1047 | if ((skp == NULL) || (*skp == NULL)) | ||
| 1048 | sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */ | ||
| 1049 | else | ||
| 1050 | { | ||
| 1051 | sk= *skp; | ||
| 1052 | sk_SSL_CIPHER_zero(sk); | ||
| 1053 | } | ||
| 1054 | |||
| 1055 | for (i=0; i<num; i+=n) | ||
| 1056 | { | ||
| 1057 | c=ssl_get_cipher_by_char(s,p); | ||
| 1058 | p+=n; | ||
| 1059 | if (c != NULL) | ||
| 1060 | { | ||
| 1061 | if (!sk_SSL_CIPHER_push(sk,c)) | ||
| 1062 | { | ||
| 1063 | SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE); | ||
| 1064 | goto err; | ||
| 1065 | } | ||
| 1066 | } | ||
| 1067 | } | ||
| 1068 | |||
| 1069 | if (skp != NULL) | ||
| 1070 | *skp=sk; | ||
| 1071 | return(sk); | ||
| 1072 | err: | ||
| 1073 | if ((skp == NULL) || (*skp == NULL)) | ||
| 1074 | sk_SSL_CIPHER_free(sk); | ||
| 1075 | return(NULL); | ||
| 1076 | } | ||
| 1077 | |||
| 1078 | unsigned long SSL_SESSION_hash(SSL_SESSION *a) | ||
| 1079 | { | ||
| 1080 | unsigned long l; | ||
| 1081 | |||
| 1082 | l=(unsigned long) | ||
| 1083 | ((unsigned int) a->session_id[0] )| | ||
| 1084 | ((unsigned int) a->session_id[1]<< 8L)| | ||
| 1085 | ((unsigned long)a->session_id[2]<<16L)| | ||
| 1086 | ((unsigned long)a->session_id[3]<<24L); | ||
| 1087 | return(l); | ||
| 1088 | } | ||
| 1089 | |||
| 1090 | int SSL_SESSION_cmp(SSL_SESSION *a,SSL_SESSION *b) | ||
| 1091 | { | ||
| 1092 | if (a->ssl_version != b->ssl_version) | ||
| 1093 | return(1); | ||
| 1094 | if (a->session_id_length != b->session_id_length) | ||
| 1095 | return(1); | ||
| 1096 | return(memcmp(a->session_id,b->session_id,a->session_id_length)); | ||
| 1097 | } | ||
| 1098 | |||
| 1099 | SSL_CTX *SSL_CTX_new(SSL_METHOD *meth) | ||
| 1100 | { | ||
| 1101 | SSL_CTX *ret=NULL; | ||
| 1102 | |||
| 1103 | if (meth == NULL) | ||
| 1104 | { | ||
| 1105 | SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED); | ||
| 1106 | return(NULL); | ||
| 1107 | } | ||
| 1108 | |||
| 1109 | if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) | ||
| 1110 | { | ||
| 1111 | SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); | ||
| 1112 | goto err; | ||
| 1113 | } | ||
| 1114 | ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX)); | ||
| 1115 | if (ret == NULL) | ||
| 1116 | goto err; | ||
| 1117 | |||
| 1118 | memset(ret,0,sizeof(SSL_CTX)); | ||
| 1119 | |||
| 1120 | ret->method=meth; | ||
| 1121 | |||
| 1122 | ret->cert_store=NULL; | ||
| 1123 | ret->session_cache_mode=SSL_SESS_CACHE_SERVER; | ||
| 1124 | ret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT; | ||
| 1125 | ret->session_cache_head=NULL; | ||
| 1126 | ret->session_cache_tail=NULL; | ||
| 1127 | |||
| 1128 | /* We take the system default */ | ||
| 1129 | ret->session_timeout=meth->get_timeout(); | ||
| 1130 | |||
| 1131 | ret->new_session_cb=NULL; | ||
| 1132 | ret->remove_session_cb=NULL; | ||
| 1133 | ret->get_session_cb=NULL; | ||
| 1134 | |||
| 1135 | memset((char *)&ret->stats,0,sizeof(ret->stats)); | ||
| 1136 | |||
| 1137 | ret->references=1; | ||
| 1138 | ret->quiet_shutdown=0; | ||
| 1139 | |||
| 1140 | /* ret->cipher=NULL;*/ | ||
| 1141 | /* ret->s2->challenge=NULL; | ||
| 1142 | ret->master_key=NULL; | ||
| 1143 | ret->key_arg=NULL; | ||
| 1144 | ret->s2->conn_id=NULL; */ | ||
| 1145 | |||
| 1146 | ret->info_callback=NULL; | ||
| 1147 | |||
| 1148 | ret->app_verify_callback=NULL; | ||
| 1149 | ret->app_verify_arg=NULL; | ||
| 1150 | |||
| 1151 | ret->read_ahead=0; | ||
| 1152 | ret->verify_mode=SSL_VERIFY_NONE; | ||
| 1153 | ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */ | ||
| 1154 | ret->default_verify_callback=NULL; | ||
| 1155 | if ((ret->cert=ssl_cert_new()) == NULL) | ||
| 1156 | goto err; | ||
| 1157 | |||
| 1158 | ret->default_passwd_callback=NULL; | ||
| 1159 | ret->default_passwd_callback_userdata=NULL; | ||
| 1160 | ret->client_cert_cb=NULL; | ||
| 1161 | |||
| 1162 | ret->sessions=lh_new(SSL_SESSION_hash,SSL_SESSION_cmp); | ||
| 1163 | if (ret->sessions == NULL) goto err; | ||
| 1164 | ret->cert_store=X509_STORE_new(); | ||
| 1165 | if (ret->cert_store == NULL) goto err; | ||
| 1166 | |||
| 1167 | ssl_create_cipher_list(ret->method, | ||
| 1168 | &ret->cipher_list,&ret->cipher_list_by_id, | ||
| 1169 | SSL_DEFAULT_CIPHER_LIST); | ||
| 1170 | if (ret->cipher_list == NULL | ||
| 1171 | || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) | ||
| 1172 | { | ||
| 1173 | SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS); | ||
| 1174 | goto err2; | ||
| 1175 | } | ||
| 1176 | |||
| 1177 | if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL) | ||
| 1178 | { | ||
| 1179 | SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES); | ||
| 1180 | goto err2; | ||
| 1181 | } | ||
| 1182 | if ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL) | ||
| 1183 | { | ||
| 1184 | SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES); | ||
| 1185 | goto err2; | ||
| 1186 | } | ||
| 1187 | if ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL) | ||
| 1188 | { | ||
| 1189 | SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES); | ||
| 1190 | goto err2; | ||
| 1191 | } | ||
| 1192 | |||
| 1193 | if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL) | ||
| 1194 | goto err; | ||
| 1195 | |||
| 1196 | CRYPTO_new_ex_data(ssl_ctx_meth,(char *)ret,&ret->ex_data); | ||
| 1197 | |||
| 1198 | ret->extra_certs=NULL; | ||
| 1199 | ret->comp_methods=SSL_COMP_get_compression_methods(); | ||
| 1200 | |||
| 1201 | return(ret); | ||
| 1202 | err: | ||
| 1203 | SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE); | ||
| 1204 | err2: | ||
| 1205 | if (ret != NULL) SSL_CTX_free(ret); | ||
| 1206 | return(NULL); | ||
| 1207 | } | ||
| 1208 | |||
| 1209 | static void SSL_COMP_free(SSL_COMP *comp) | ||
| 1210 | { OPENSSL_free(comp); } | ||
| 1211 | |||
| 1212 | void SSL_CTX_free(SSL_CTX *a) | ||
| 1213 | { | ||
| 1214 | int i; | ||
| 1215 | |||
| 1216 | if (a == NULL) return; | ||
| 1217 | |||
| 1218 | i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX); | ||
| 1219 | #ifdef REF_PRINT | ||
| 1220 | REF_PRINT("SSL_CTX",a); | ||
| 1221 | #endif | ||
| 1222 | if (i > 0) return; | ||
| 1223 | #ifdef REF_CHECK | ||
| 1224 | if (i < 0) | ||
| 1225 | { | ||
| 1226 | fprintf(stderr,"SSL_CTX_free, bad reference count\n"); | ||
| 1227 | abort(); /* ok */ | ||
| 1228 | } | ||
| 1229 | #endif | ||
| 1230 | CRYPTO_free_ex_data(ssl_ctx_meth,(char *)a,&a->ex_data); | ||
| 1231 | |||
| 1232 | if (a->sessions != NULL) | ||
| 1233 | { | ||
| 1234 | SSL_CTX_flush_sessions(a,0); | ||
| 1235 | lh_free(a->sessions); | ||
| 1236 | } | ||
| 1237 | if (a->cert_store != NULL) | ||
| 1238 | X509_STORE_free(a->cert_store); | ||
| 1239 | if (a->cipher_list != NULL) | ||
| 1240 | sk_SSL_CIPHER_free(a->cipher_list); | ||
| 1241 | if (a->cipher_list_by_id != NULL) | ||
| 1242 | sk_SSL_CIPHER_free(a->cipher_list_by_id); | ||
| 1243 | if (a->cert != NULL) | ||
| 1244 | ssl_cert_free(a->cert); | ||
| 1245 | if (a->client_CA != NULL) | ||
| 1246 | sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free); | ||
| 1247 | if (a->extra_certs != NULL) | ||
| 1248 | sk_X509_pop_free(a->extra_certs,X509_free); | ||
| 1249 | if (a->comp_methods != NULL) | ||
| 1250 | sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free); | ||
| 1251 | OPENSSL_free(a); | ||
| 1252 | } | ||
| 1253 | |||
| 1254 | void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) | ||
| 1255 | { | ||
| 1256 | ctx->default_passwd_callback=cb; | ||
| 1257 | } | ||
| 1258 | |||
| 1259 | void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u) | ||
| 1260 | { | ||
| 1261 | ctx->default_passwd_callback_userdata=u; | ||
| 1262 | } | ||
| 1263 | |||
| 1264 | void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,int (*cb)(),char *arg) | ||
| 1265 | { | ||
| 1266 | /* now | ||
| 1267 | * int (*cb)(X509_STORE_CTX *), | ||
| 1268 | * but should be | ||
| 1269 | * int (*cb)(X509_STORE_CTX *, void *arg) | ||
| 1270 | */ | ||
| 1271 | ctx->app_verify_callback=cb; | ||
| 1272 | ctx->app_verify_arg=arg; /* never used */ | ||
| 1273 | } | ||
| 1274 | |||
| 1275 | void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *)) | ||
| 1276 | { | ||
| 1277 | ctx->verify_mode=mode; | ||
| 1278 | ctx->default_verify_callback=cb; | ||
| 1279 | /* This needs cleaning up EAY EAY EAY */ | ||
| 1280 | X509_STORE_set_verify_cb_func(ctx->cert_store,cb); | ||
| 1281 | } | ||
| 1282 | |||
| 1283 | void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth) | ||
| 1284 | { | ||
| 1285 | ctx->verify_depth=depth; | ||
| 1286 | } | ||
| 1287 | |||
| 1288 | void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher) | ||
| 1289 | { | ||
| 1290 | CERT_PKEY *cpk; | ||
| 1291 | int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign; | ||
| 1292 | int rsa_enc_export,dh_rsa_export,dh_dsa_export; | ||
| 1293 | int rsa_tmp_export,dh_tmp_export,kl; | ||
| 1294 | unsigned long mask,emask; | ||
| 1295 | |||
| 1296 | if (c == NULL) return; | ||
| 1297 | |||
| 1298 | kl=SSL_C_EXPORT_PKEYLENGTH(cipher); | ||
| 1299 | |||
| 1300 | #ifndef NO_RSA | ||
| 1301 | rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL); | ||
| 1302 | rsa_tmp_export=(c->rsa_tmp_cb != NULL || | ||
| 1303 | (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl)); | ||
| 1304 | #else | ||
| 1305 | rsa_tmp=rsa_tmp_export=0; | ||
| 1306 | #endif | ||
| 1307 | #ifndef NO_DH | ||
| 1308 | dh_tmp=(c->dh_tmp != NULL || c->dh_tmp_cb != NULL); | ||
| 1309 | dh_tmp_export=(c->dh_tmp_cb != NULL || | ||
| 1310 | (dh_tmp && DH_size(c->dh_tmp)*8 <= kl)); | ||
| 1311 | #else | ||
| 1312 | dh_tmp=dh_tmp_export=0; | ||
| 1313 | #endif | ||
| 1314 | |||
| 1315 | cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]); | ||
| 1316 | rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL); | ||
| 1317 | rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl); | ||
| 1318 | cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]); | ||
| 1319 | rsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); | ||
| 1320 | cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]); | ||
| 1321 | dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); | ||
| 1322 | cpk= &(c->pkeys[SSL_PKEY_DH_RSA]); | ||
| 1323 | dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL); | ||
| 1324 | dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); | ||
| 1325 | cpk= &(c->pkeys[SSL_PKEY_DH_DSA]); | ||
| 1326 | /* FIX THIS EAY EAY EAY */ | ||
| 1327 | dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL); | ||
| 1328 | dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); | ||
| 1329 | |||
| 1330 | mask=0; | ||
| 1331 | emask=0; | ||
| 1332 | |||
| 1333 | #ifdef CIPHER_DEBUG | ||
| 1334 | printf("rt=%d rte=%d dht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n", | ||
| 1335 | rsa_tmp,rsa_tmp_export,dh_tmp, | ||
| 1336 | rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa); | ||
| 1337 | #endif | ||
| 1338 | |||
| 1339 | if (rsa_enc || (rsa_tmp && rsa_sign)) | ||
| 1340 | mask|=SSL_kRSA; | ||
| 1341 | if (rsa_enc_export || (rsa_tmp_export && (rsa_sign || rsa_enc))) | ||
| 1342 | emask|=SSL_kRSA; | ||
| 1343 | |||
| 1344 | #if 0 | ||
| 1345 | /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */ | ||
| 1346 | if ( (dh_tmp || dh_rsa || dh_dsa) && | ||
| 1347 | (rsa_enc || rsa_sign || dsa_sign)) | ||
| 1348 | mask|=SSL_kEDH; | ||
| 1349 | if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) && | ||
| 1350 | (rsa_enc || rsa_sign || dsa_sign)) | ||
| 1351 | emask|=SSL_kEDH; | ||
| 1352 | #endif | ||
| 1353 | |||
| 1354 | if (dh_tmp_export) | ||
| 1355 | emask|=SSL_kEDH; | ||
| 1356 | |||
| 1357 | if (dh_tmp) | ||
| 1358 | mask|=SSL_kEDH; | ||
| 1359 | |||
| 1360 | if (dh_rsa) mask|=SSL_kDHr; | ||
| 1361 | if (dh_rsa_export) emask|=SSL_kDHr; | ||
| 1362 | |||
| 1363 | if (dh_dsa) mask|=SSL_kDHd; | ||
| 1364 | if (dh_dsa_export) emask|=SSL_kDHd; | ||
| 1365 | |||
| 1366 | if (rsa_enc || rsa_sign) | ||
| 1367 | { | ||
| 1368 | mask|=SSL_aRSA; | ||
| 1369 | emask|=SSL_aRSA; | ||
| 1370 | } | ||
| 1371 | |||
| 1372 | if (dsa_sign) | ||
| 1373 | { | ||
| 1374 | mask|=SSL_aDSS; | ||
| 1375 | emask|=SSL_aDSS; | ||
| 1376 | } | ||
| 1377 | |||
| 1378 | mask|=SSL_aNULL; | ||
| 1379 | emask|=SSL_aNULL; | ||
| 1380 | |||
| 1381 | c->mask=mask; | ||
| 1382 | c->export_mask=emask; | ||
| 1383 | c->valid=1; | ||
| 1384 | } | ||
| 1385 | |||
| 1386 | /* THIS NEEDS CLEANING UP */ | ||
| 1387 | X509 *ssl_get_server_send_cert(SSL *s) | ||
| 1388 | { | ||
| 1389 | unsigned long alg,mask,kalg; | ||
| 1390 | CERT *c; | ||
| 1391 | int i,is_export; | ||
| 1392 | |||
| 1393 | c=s->cert; | ||
| 1394 | ssl_set_cert_masks(c, s->s3->tmp.new_cipher); | ||
| 1395 | alg=s->s3->tmp.new_cipher->algorithms; | ||
| 1396 | is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); | ||
| 1397 | mask=is_export?c->export_mask:c->mask; | ||
| 1398 | kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK); | ||
| 1399 | |||
| 1400 | if (kalg & SSL_kDHr) | ||
| 1401 | i=SSL_PKEY_DH_RSA; | ||
| 1402 | else if (kalg & SSL_kDHd) | ||
| 1403 | i=SSL_PKEY_DH_DSA; | ||
| 1404 | else if (kalg & SSL_aDSS) | ||
| 1405 | i=SSL_PKEY_DSA_SIGN; | ||
| 1406 | else if (kalg & SSL_aRSA) | ||
| 1407 | { | ||
| 1408 | if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL) | ||
| 1409 | i=SSL_PKEY_RSA_SIGN; | ||
| 1410 | else | ||
| 1411 | i=SSL_PKEY_RSA_ENC; | ||
| 1412 | } | ||
| 1413 | else /* if (kalg & SSL_aNULL) */ | ||
| 1414 | { | ||
| 1415 | SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,SSL_R_INTERNAL_ERROR); | ||
| 1416 | return(NULL); | ||
| 1417 | } | ||
| 1418 | if (c->pkeys[i].x509 == NULL) return(NULL); | ||
| 1419 | return(c->pkeys[i].x509); | ||
| 1420 | } | ||
| 1421 | |||
| 1422 | EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher) | ||
| 1423 | { | ||
| 1424 | unsigned long alg; | ||
| 1425 | CERT *c; | ||
| 1426 | |||
| 1427 | alg=cipher->algorithms; | ||
| 1428 | c=s->cert; | ||
| 1429 | |||
| 1430 | if ((alg & SSL_aDSS) && | ||
| 1431 | (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL)) | ||
| 1432 | return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey); | ||
| 1433 | else if (alg & SSL_aRSA) | ||
| 1434 | { | ||
| 1435 | if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL) | ||
| 1436 | return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey); | ||
| 1437 | else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL) | ||
| 1438 | return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey); | ||
| 1439 | else | ||
| 1440 | return(NULL); | ||
| 1441 | } | ||
| 1442 | else /* if (alg & SSL_aNULL) */ | ||
| 1443 | { | ||
| 1444 | SSLerr(SSL_F_SSL_GET_SIGN_PKEY,SSL_R_INTERNAL_ERROR); | ||
| 1445 | return(NULL); | ||
| 1446 | } | ||
| 1447 | } | ||
| 1448 | |||
| 1449 | void ssl_update_cache(SSL *s,int mode) | ||
| 1450 | { | ||
| 1451 | int i; | ||
| 1452 | |||
| 1453 | /* If the session_id_length is 0, we are not supposed to cache it, | ||
| 1454 | * and it would be rather hard to do anyway :-) */ | ||
| 1455 | if (s->session->session_id_length == 0) return; | ||
| 1456 | |||
| 1457 | if ((s->ctx->session_cache_mode & mode) | ||
| 1458 | && (!s->hit) | ||
| 1459 | && SSL_CTX_add_session(s->ctx,s->session) | ||
| 1460 | && (s->ctx->new_session_cb != NULL)) | ||
| 1461 | { | ||
| 1462 | CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION); | ||
| 1463 | if (!s->ctx->new_session_cb(s,s->session)) | ||
| 1464 | SSL_SESSION_free(s->session); | ||
| 1465 | } | ||
| 1466 | |||
| 1467 | /* auto flush every 255 connections */ | ||
| 1468 | i=s->ctx->session_cache_mode; | ||
| 1469 | if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && | ||
| 1470 | ((i & mode) == mode)) | ||
| 1471 | { | ||
| 1472 | if ( (((mode & SSL_SESS_CACHE_CLIENT) | ||
| 1473 | ?s->ctx->stats.sess_connect_good | ||
| 1474 | :s->ctx->stats.sess_accept_good) & 0xff) == 0xff) | ||
| 1475 | { | ||
| 1476 | SSL_CTX_flush_sessions(s->ctx,time(NULL)); | ||
| 1477 | } | ||
| 1478 | } | ||
| 1479 | } | ||
| 1480 | |||
| 1481 | SSL_METHOD *SSL_get_ssl_method(SSL *s) | ||
| 1482 | { | ||
| 1483 | return(s->method); | ||
| 1484 | } | ||
| 1485 | |||
| 1486 | int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth) | ||
| 1487 | { | ||
| 1488 | int conn= -1; | ||
| 1489 | int ret=1; | ||
| 1490 | |||
| 1491 | if (s->method != meth) | ||
| 1492 | { | ||
| 1493 | if (s->handshake_func != NULL) | ||
| 1494 | conn=(s->handshake_func == s->method->ssl_connect); | ||
| 1495 | |||
| 1496 | if (s->method->version == meth->version) | ||
| 1497 | s->method=meth; | ||
| 1498 | else | ||
| 1499 | { | ||
| 1500 | s->method->ssl_free(s); | ||
| 1501 | s->method=meth; | ||
| 1502 | ret=s->method->ssl_new(s); | ||
| 1503 | } | ||
| 1504 | |||
| 1505 | if (conn == 1) | ||
| 1506 | s->handshake_func=meth->ssl_connect; | ||
| 1507 | else if (conn == 0) | ||
| 1508 | s->handshake_func=meth->ssl_accept; | ||
| 1509 | } | ||
| 1510 | return(ret); | ||
| 1511 | } | ||
| 1512 | |||
| 1513 | int SSL_get_error(SSL *s,int i) | ||
| 1514 | { | ||
| 1515 | int reason; | ||
| 1516 | unsigned long l; | ||
| 1517 | BIO *bio; | ||
| 1518 | |||
| 1519 | if (i > 0) return(SSL_ERROR_NONE); | ||
| 1520 | |||
| 1521 | /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake | ||
| 1522 | * etc, where we do encode the error */ | ||
| 1523 | if ((l=ERR_peek_error()) != 0) | ||
| 1524 | { | ||
| 1525 | if (ERR_GET_LIB(l) == ERR_LIB_SYS) | ||
| 1526 | return(SSL_ERROR_SYSCALL); | ||
| 1527 | else | ||
| 1528 | return(SSL_ERROR_SSL); | ||
| 1529 | } | ||
| 1530 | |||
| 1531 | if ((i < 0) && SSL_want_read(s)) | ||
| 1532 | { | ||
| 1533 | bio=SSL_get_rbio(s); | ||
| 1534 | if (BIO_should_read(bio)) | ||
| 1535 | return(SSL_ERROR_WANT_READ); | ||
| 1536 | else if (BIO_should_write(bio)) | ||
| 1537 | /* This one doesn't make too much sense ... We never try | ||
| 1538 | * to write to the rbio, and an application program where | ||
| 1539 | * rbio and wbio are separate couldn't even know what it | ||
| 1540 | * should wait for. | ||
| 1541 | * However if we ever set s->rwstate incorrectly | ||
| 1542 | * (so that we have SSL_want_read(s) instead of | ||
| 1543 | * SSL_want_write(s)) and rbio and wbio *are* the same, | ||
| 1544 | * this test works around that bug; so it might be safer | ||
| 1545 | * to keep it. */ | ||
| 1546 | return(SSL_ERROR_WANT_WRITE); | ||
| 1547 | else if (BIO_should_io_special(bio)) | ||
| 1548 | { | ||
| 1549 | reason=BIO_get_retry_reason(bio); | ||
| 1550 | if (reason == BIO_RR_CONNECT) | ||
| 1551 | return(SSL_ERROR_WANT_CONNECT); | ||
| 1552 | else | ||
| 1553 | return(SSL_ERROR_SYSCALL); /* unknown */ | ||
| 1554 | } | ||
| 1555 | } | ||
| 1556 | |||
| 1557 | if ((i < 0) && SSL_want_write(s)) | ||
| 1558 | { | ||
| 1559 | bio=SSL_get_wbio(s); | ||
| 1560 | if (BIO_should_write(bio)) | ||
| 1561 | return(SSL_ERROR_WANT_WRITE); | ||
| 1562 | else if (BIO_should_read(bio)) | ||
| 1563 | /* See above (SSL_want_read(s) with BIO_should_write(bio)) */ | ||
| 1564 | return(SSL_ERROR_WANT_READ); | ||
| 1565 | else if (BIO_should_io_special(bio)) | ||
| 1566 | { | ||
| 1567 | reason=BIO_get_retry_reason(bio); | ||
| 1568 | if (reason == BIO_RR_CONNECT) | ||
| 1569 | return(SSL_ERROR_WANT_CONNECT); | ||
| 1570 | else | ||
| 1571 | return(SSL_ERROR_SYSCALL); | ||
| 1572 | } | ||
| 1573 | } | ||
| 1574 | if ((i < 0) && SSL_want_x509_lookup(s)) | ||
| 1575 | { | ||
| 1576 | return(SSL_ERROR_WANT_X509_LOOKUP); | ||
| 1577 | } | ||
| 1578 | |||
| 1579 | if (i == 0) | ||
| 1580 | { | ||
| 1581 | if (s->version == SSL2_VERSION) | ||
| 1582 | { | ||
| 1583 | /* assume it is the socket being closed */ | ||
| 1584 | return(SSL_ERROR_ZERO_RETURN); | ||
| 1585 | } | ||
| 1586 | else | ||
| 1587 | { | ||
| 1588 | if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) && | ||
| 1589 | (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY)) | ||
| 1590 | return(SSL_ERROR_ZERO_RETURN); | ||
| 1591 | } | ||
| 1592 | } | ||
| 1593 | return(SSL_ERROR_SYSCALL); | ||
| 1594 | } | ||
| 1595 | |||
| 1596 | int SSL_do_handshake(SSL *s) | ||
| 1597 | { | ||
| 1598 | int ret=1; | ||
| 1599 | |||
| 1600 | if (s->handshake_func == NULL) | ||
| 1601 | { | ||
| 1602 | SSLerr(SSL_F_SSL_DO_HANDSHAKE,SSL_R_CONNECTION_TYPE_NOT_SET); | ||
| 1603 | return(-1); | ||
| 1604 | } | ||
| 1605 | |||
| 1606 | s->method->ssl_renegotiate_check(s); | ||
| 1607 | |||
| 1608 | if (SSL_in_init(s) || SSL_in_before(s)) | ||
| 1609 | { | ||
| 1610 | ret=s->handshake_func(s); | ||
| 1611 | } | ||
| 1612 | return(ret); | ||
| 1613 | } | ||
| 1614 | |||
| 1615 | /* For the next 2 functions, SSL_clear() sets shutdown and so | ||
| 1616 | * one of these calls will reset it */ | ||
| 1617 | void SSL_set_accept_state(SSL *s) | ||
| 1618 | { | ||
| 1619 | s->server=1; | ||
| 1620 | s->shutdown=0; | ||
| 1621 | s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE; | ||
| 1622 | s->handshake_func=s->method->ssl_accept; | ||
| 1623 | /* clear the current cipher */ | ||
| 1624 | ssl_clear_cipher_ctx(s); | ||
| 1625 | } | ||
| 1626 | |||
| 1627 | void SSL_set_connect_state(SSL *s) | ||
| 1628 | { | ||
| 1629 | s->server=0; | ||
| 1630 | s->shutdown=0; | ||
| 1631 | s->state=SSL_ST_CONNECT|SSL_ST_BEFORE; | ||
| 1632 | s->handshake_func=s->method->ssl_connect; | ||
| 1633 | /* clear the current cipher */ | ||
| 1634 | ssl_clear_cipher_ctx(s); | ||
| 1635 | } | ||
| 1636 | |||
| 1637 | int ssl_undefined_function(SSL *s) | ||
| 1638 | { | ||
| 1639 | SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 1640 | return(0); | ||
| 1641 | } | ||
| 1642 | |||
| 1643 | SSL_METHOD *ssl_bad_method(int ver) | ||
| 1644 | { | ||
| 1645 | SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | ||
| 1646 | return(NULL); | ||
| 1647 | } | ||
| 1648 | |||
| 1649 | const char *SSL_get_version(SSL *s) | ||
| 1650 | { | ||
| 1651 | if (s->version == TLS1_VERSION) | ||
| 1652 | return("TLSv1"); | ||
| 1653 | else if (s->version == SSL3_VERSION) | ||
| 1654 | return("SSLv3"); | ||
| 1655 | else if (s->version == SSL2_VERSION) | ||
| 1656 | return("SSLv2"); | ||
| 1657 | else | ||
| 1658 | return("unknown"); | ||
| 1659 | } | ||
| 1660 | |||
| 1661 | SSL *SSL_dup(SSL *s) | ||
| 1662 | { | ||
| 1663 | STACK_OF(X509_NAME) *sk; | ||
| 1664 | X509_NAME *xn; | ||
| 1665 | SSL *ret; | ||
| 1666 | int i; | ||
| 1667 | |||
| 1668 | if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL) | ||
| 1669 | return(NULL); | ||
| 1670 | |||
| 1671 | if (s->session != NULL) | ||
| 1672 | { | ||
| 1673 | /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */ | ||
| 1674 | SSL_copy_session_id(ret,s); | ||
| 1675 | } | ||
| 1676 | else | ||
| 1677 | { | ||
| 1678 | /* No session has been established yet, so we have to expect | ||
| 1679 | * that s->cert or ret->cert will be changed later -- | ||
| 1680 | * they should not both point to the same object, | ||
| 1681 | * and thus we can't use SSL_copy_session_id. */ | ||
| 1682 | |||
| 1683 | ret->method = s->method; | ||
| 1684 | ret->method->ssl_new(ret); | ||
| 1685 | |||
| 1686 | if (s->cert != NULL) | ||
| 1687 | { | ||
| 1688 | if (ret->cert != NULL) | ||
| 1689 | { | ||
| 1690 | ssl_cert_free(ret->cert); | ||
| 1691 | } | ||
| 1692 | ret->cert = ssl_cert_dup(s->cert); | ||
| 1693 | if (ret->cert == NULL) | ||
| 1694 | goto err; | ||
| 1695 | } | ||
| 1696 | |||
| 1697 | SSL_set_session_id_context(ret, | ||
| 1698 | s->sid_ctx, s->sid_ctx_length); | ||
| 1699 | } | ||
| 1700 | |||
| 1701 | SSL_set_read_ahead(ret,SSL_get_read_ahead(s)); | ||
| 1702 | SSL_set_verify(ret,SSL_get_verify_mode(s), | ||
| 1703 | SSL_get_verify_callback(s)); | ||
| 1704 | SSL_set_verify_depth(ret,SSL_get_verify_depth(s)); | ||
| 1705 | |||
| 1706 | SSL_set_info_callback(ret,SSL_get_info_callback(s)); | ||
| 1707 | |||
| 1708 | ret->debug=s->debug; | ||
| 1709 | ret->options=s->options; | ||
| 1710 | |||
| 1711 | /* copy app data, a little dangerous perhaps */ | ||
| 1712 | if (!CRYPTO_dup_ex_data(ssl_meth,&ret->ex_data,&s->ex_data)) | ||
| 1713 | goto err; | ||
| 1714 | |||
| 1715 | /* setup rbio, and wbio */ | ||
| 1716 | if (s->rbio != NULL) | ||
| 1717 | { | ||
| 1718 | if (!BIO_dup_state(s->rbio,(char *)&ret->rbio)) | ||
| 1719 | goto err; | ||
| 1720 | } | ||
| 1721 | if (s->wbio != NULL) | ||
| 1722 | { | ||
| 1723 | if (s->wbio != s->rbio) | ||
| 1724 | { | ||
| 1725 | if (!BIO_dup_state(s->wbio,(char *)&ret->wbio)) | ||
| 1726 | goto err; | ||
| 1727 | } | ||
| 1728 | else | ||
| 1729 | ret->wbio=ret->rbio; | ||
| 1730 | } | ||
| 1731 | |||
| 1732 | /* dup the cipher_list and cipher_list_by_id stacks */ | ||
| 1733 | if (s->cipher_list != NULL) | ||
| 1734 | { | ||
| 1735 | if ((ret->cipher_list=sk_SSL_CIPHER_dup(s->cipher_list)) == NULL) | ||
| 1736 | goto err; | ||
| 1737 | } | ||
| 1738 | if (s->cipher_list_by_id != NULL) | ||
| 1739 | if ((ret->cipher_list_by_id=sk_SSL_CIPHER_dup(s->cipher_list_by_id)) | ||
| 1740 | == NULL) | ||
| 1741 | goto err; | ||
| 1742 | |||
| 1743 | /* Dup the client_CA list */ | ||
| 1744 | if (s->client_CA != NULL) | ||
| 1745 | { | ||
| 1746 | if ((sk=sk_X509_NAME_dup(s->client_CA)) == NULL) goto err; | ||
| 1747 | ret->client_CA=sk; | ||
| 1748 | for (i=0; i<sk_X509_NAME_num(sk); i++) | ||
| 1749 | { | ||
| 1750 | xn=sk_X509_NAME_value(sk,i); | ||
| 1751 | if (sk_X509_NAME_set(sk,i,X509_NAME_dup(xn)) == NULL) | ||
| 1752 | { | ||
| 1753 | X509_NAME_free(xn); | ||
| 1754 | goto err; | ||
| 1755 | } | ||
| 1756 | } | ||
| 1757 | } | ||
| 1758 | |||
| 1759 | ret->shutdown=s->shutdown; | ||
| 1760 | ret->state=s->state; | ||
| 1761 | ret->handshake_func=s->handshake_func; | ||
| 1762 | ret->server=s->server; | ||
| 1763 | |||
| 1764 | if (0) | ||
| 1765 | { | ||
| 1766 | err: | ||
| 1767 | if (ret != NULL) SSL_free(ret); | ||
| 1768 | ret=NULL; | ||
| 1769 | } | ||
| 1770 | return(ret); | ||
| 1771 | } | ||
| 1772 | |||
| 1773 | void ssl_clear_cipher_ctx(SSL *s) | ||
| 1774 | { | ||
| 1775 | if (s->enc_read_ctx != NULL) | ||
| 1776 | { | ||
| 1777 | EVP_CIPHER_CTX_cleanup(s->enc_read_ctx); | ||
| 1778 | OPENSSL_free(s->enc_read_ctx); | ||
| 1779 | s->enc_read_ctx=NULL; | ||
| 1780 | } | ||
| 1781 | if (s->enc_write_ctx != NULL) | ||
| 1782 | { | ||
| 1783 | EVP_CIPHER_CTX_cleanup(s->enc_write_ctx); | ||
| 1784 | OPENSSL_free(s->enc_write_ctx); | ||
| 1785 | s->enc_write_ctx=NULL; | ||
| 1786 | } | ||
| 1787 | if (s->expand != NULL) | ||
| 1788 | { | ||
| 1789 | COMP_CTX_free(s->expand); | ||
| 1790 | s->expand=NULL; | ||
| 1791 | } | ||
| 1792 | if (s->compress != NULL) | ||
| 1793 | { | ||
| 1794 | COMP_CTX_free(s->compress); | ||
| 1795 | s->compress=NULL; | ||
| 1796 | } | ||
| 1797 | } | ||
| 1798 | |||
| 1799 | /* Fix this function so that it takes an optional type parameter */ | ||
| 1800 | X509 *SSL_get_certificate(SSL *s) | ||
| 1801 | { | ||
| 1802 | if (s->cert != NULL) | ||
| 1803 | return(s->cert->key->x509); | ||
| 1804 | else | ||
| 1805 | return(NULL); | ||
| 1806 | } | ||
| 1807 | |||
| 1808 | /* Fix this function so that it takes an optional type parameter */ | ||
| 1809 | EVP_PKEY *SSL_get_privatekey(SSL *s) | ||
| 1810 | { | ||
| 1811 | if (s->cert != NULL) | ||
| 1812 | return(s->cert->key->privatekey); | ||
| 1813 | else | ||
| 1814 | return(NULL); | ||
| 1815 | } | ||
| 1816 | |||
| 1817 | SSL_CIPHER *SSL_get_current_cipher(SSL *s) | ||
| 1818 | { | ||
| 1819 | if ((s->session != NULL) && (s->session->cipher != NULL)) | ||
| 1820 | return(s->session->cipher); | ||
| 1821 | return(NULL); | ||
| 1822 | } | ||
| 1823 | |||
| 1824 | int ssl_init_wbio_buffer(SSL *s,int push) | ||
| 1825 | { | ||
| 1826 | BIO *bbio; | ||
| 1827 | |||
| 1828 | if (s->bbio == NULL) | ||
| 1829 | { | ||
| 1830 | bbio=BIO_new(BIO_f_buffer()); | ||
| 1831 | if (bbio == NULL) return(0); | ||
| 1832 | s->bbio=bbio; | ||
| 1833 | } | ||
| 1834 | else | ||
| 1835 | { | ||
| 1836 | bbio=s->bbio; | ||
| 1837 | if (s->bbio == s->wbio) | ||
| 1838 | s->wbio=BIO_pop(s->wbio); | ||
| 1839 | } | ||
| 1840 | (void)BIO_reset(bbio); | ||
| 1841 | /* if (!BIO_set_write_buffer_size(bbio,16*1024)) */ | ||
| 1842 | if (!BIO_set_read_buffer_size(bbio,1)) | ||
| 1843 | { | ||
| 1844 | SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER,ERR_R_BUF_LIB); | ||
| 1845 | return(0); | ||
| 1846 | } | ||
| 1847 | if (push) | ||
| 1848 | { | ||
| 1849 | if (s->wbio != bbio) | ||
| 1850 | s->wbio=BIO_push(bbio,s->wbio); | ||
| 1851 | } | ||
| 1852 | else | ||
| 1853 | { | ||
| 1854 | if (s->wbio == bbio) | ||
| 1855 | s->wbio=BIO_pop(bbio); | ||
| 1856 | } | ||
| 1857 | return(1); | ||
| 1858 | } | ||
| 1859 | |||
| 1860 | void ssl_free_wbio_buffer(SSL *s) | ||
| 1861 | { | ||
| 1862 | if (s->bbio == NULL) return; | ||
| 1863 | |||
| 1864 | if (s->bbio == s->wbio) | ||
| 1865 | { | ||
| 1866 | /* remove buffering */ | ||
| 1867 | s->wbio=BIO_pop(s->wbio); | ||
| 1868 | #ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */ | ||
| 1869 | assert(s->wbio != NULL); | ||
| 1870 | #endif | ||
| 1871 | } | ||
| 1872 | BIO_free(s->bbio); | ||
| 1873 | s->bbio=NULL; | ||
| 1874 | } | ||
| 1875 | |||
| 1876 | void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode) | ||
| 1877 | { | ||
| 1878 | ctx->quiet_shutdown=mode; | ||
| 1879 | } | ||
| 1880 | |||
| 1881 | int SSL_CTX_get_quiet_shutdown(SSL_CTX *ctx) | ||
| 1882 | { | ||
| 1883 | return(ctx->quiet_shutdown); | ||
| 1884 | } | ||
| 1885 | |||
| 1886 | void SSL_set_quiet_shutdown(SSL *s,int mode) | ||
| 1887 | { | ||
| 1888 | s->quiet_shutdown=mode; | ||
| 1889 | } | ||
| 1890 | |||
| 1891 | int SSL_get_quiet_shutdown(SSL *s) | ||
| 1892 | { | ||
| 1893 | return(s->quiet_shutdown); | ||
| 1894 | } | ||
| 1895 | |||
| 1896 | void SSL_set_shutdown(SSL *s,int mode) | ||
| 1897 | { | ||
| 1898 | s->shutdown=mode; | ||
| 1899 | } | ||
| 1900 | |||
| 1901 | int SSL_get_shutdown(SSL *s) | ||
| 1902 | { | ||
| 1903 | return(s->shutdown); | ||
| 1904 | } | ||
| 1905 | |||
| 1906 | int SSL_version(SSL *s) | ||
| 1907 | { | ||
| 1908 | return(s->version); | ||
| 1909 | } | ||
| 1910 | |||
| 1911 | SSL_CTX *SSL_get_SSL_CTX(SSL *ssl) | ||
| 1912 | { | ||
| 1913 | return(ssl->ctx); | ||
| 1914 | } | ||
| 1915 | |||
| 1916 | #ifndef NO_STDIO | ||
| 1917 | int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) | ||
| 1918 | { | ||
| 1919 | return(X509_STORE_set_default_paths(ctx->cert_store)); | ||
| 1920 | } | ||
| 1921 | |||
| 1922 | int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, | ||
| 1923 | const char *CApath) | ||
| 1924 | { | ||
| 1925 | return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath)); | ||
| 1926 | } | ||
| 1927 | #endif | ||
| 1928 | |||
| 1929 | void SSL_set_info_callback(SSL *ssl,void (*cb)()) | ||
| 1930 | { | ||
| 1931 | ssl->info_callback=cb; | ||
| 1932 | } | ||
| 1933 | |||
| 1934 | void (*SSL_get_info_callback(SSL *ssl))(void) | ||
| 1935 | { | ||
| 1936 | return((void (*)())ssl->info_callback); | ||
| 1937 | } | ||
| 1938 | |||
| 1939 | int SSL_state(SSL *ssl) | ||
| 1940 | { | ||
| 1941 | return(ssl->state); | ||
| 1942 | } | ||
| 1943 | |||
| 1944 | void SSL_set_verify_result(SSL *ssl,long arg) | ||
| 1945 | { | ||
| 1946 | ssl->verify_result=arg; | ||
| 1947 | } | ||
| 1948 | |||
| 1949 | long SSL_get_verify_result(SSL *ssl) | ||
| 1950 | { | ||
| 1951 | return(ssl->verify_result); | ||
| 1952 | } | ||
| 1953 | |||
| 1954 | int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func, | ||
| 1955 | CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func) | ||
| 1956 | { | ||
| 1957 | ssl_meth_num++; | ||
| 1958 | return(CRYPTO_get_ex_new_index(ssl_meth_num-1, | ||
| 1959 | &ssl_meth,argl,argp,new_func,dup_func,free_func)); | ||
| 1960 | } | ||
| 1961 | |||
| 1962 | int SSL_set_ex_data(SSL *s,int idx,void *arg) | ||
| 1963 | { | ||
| 1964 | return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); | ||
| 1965 | } | ||
| 1966 | |||
| 1967 | void *SSL_get_ex_data(SSL *s,int idx) | ||
| 1968 | { | ||
| 1969 | return(CRYPTO_get_ex_data(&s->ex_data,idx)); | ||
| 1970 | } | ||
| 1971 | |||
| 1972 | int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func, | ||
| 1973 | CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func) | ||
| 1974 | { | ||
| 1975 | ssl_ctx_meth_num++; | ||
| 1976 | return(CRYPTO_get_ex_new_index(ssl_ctx_meth_num-1, | ||
| 1977 | &ssl_ctx_meth,argl,argp,new_func,dup_func,free_func)); | ||
| 1978 | } | ||
| 1979 | |||
| 1980 | int SSL_CTX_set_ex_data(SSL_CTX *s,int idx,void *arg) | ||
| 1981 | { | ||
| 1982 | return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); | ||
| 1983 | } | ||
| 1984 | |||
| 1985 | void *SSL_CTX_get_ex_data(SSL_CTX *s,int idx) | ||
| 1986 | { | ||
| 1987 | return(CRYPTO_get_ex_data(&s->ex_data,idx)); | ||
| 1988 | } | ||
| 1989 | |||
| 1990 | int ssl_ok(SSL *s) | ||
| 1991 | { | ||
| 1992 | return(1); | ||
| 1993 | } | ||
| 1994 | |||
| 1995 | X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *ctx) | ||
| 1996 | { | ||
| 1997 | return(ctx->cert_store); | ||
| 1998 | } | ||
| 1999 | |||
| 2000 | void SSL_CTX_set_cert_store(SSL_CTX *ctx,X509_STORE *store) | ||
| 2001 | { | ||
| 2002 | if (ctx->cert_store != NULL) | ||
| 2003 | X509_STORE_free(ctx->cert_store); | ||
| 2004 | ctx->cert_store=store; | ||
| 2005 | } | ||
| 2006 | |||
| 2007 | int SSL_want(SSL *s) | ||
| 2008 | { | ||
| 2009 | return(s->rwstate); | ||
| 2010 | } | ||
| 2011 | |||
| 2012 | /*! | ||
| 2013 | * \brief Set the callback for generating temporary RSA keys. | ||
| 2014 | * \param ctx the SSL context. | ||
| 2015 | * \param cb the callback | ||
| 2016 | */ | ||
| 2017 | |||
| 2018 | #ifndef NO_RSA | ||
| 2019 | void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl, | ||
| 2020 | int is_export, | ||
| 2021 | int keylength)) | ||
| 2022 | { | ||
| 2023 | SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb); | ||
| 2024 | } | ||
| 2025 | |||
| 2026 | void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl, | ||
| 2027 | int is_export, | ||
| 2028 | int keylength)) | ||
| 2029 | { | ||
| 2030 | SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb); | ||
| 2031 | } | ||
| 2032 | #endif | ||
| 2033 | |||
| 2034 | #ifdef DOXYGEN | ||
| 2035 | /*! | ||
| 2036 | * \brief The RSA temporary key callback function. | ||
| 2037 | * \param ssl the SSL session. | ||
| 2038 | * \param is_export \c TRUE if the temp RSA key is for an export ciphersuite. | ||
| 2039 | * \param keylength if \c is_export is \c TRUE, then \c keylength is the size | ||
| 2040 | * of the required key in bits. | ||
| 2041 | * \return the temporary RSA key. | ||
| 2042 | * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback | ||
| 2043 | */ | ||
| 2044 | |||
| 2045 | RSA *cb(SSL *ssl,int is_export,int keylength) | ||
| 2046 | {} | ||
| 2047 | #endif | ||
| 2048 | |||
| 2049 | /*! | ||
| 2050 | * \brief Set the callback for generating temporary DH keys. | ||
| 2051 | * \param ctx the SSL context. | ||
| 2052 | * \param dh the callback | ||
| 2053 | */ | ||
| 2054 | |||
| 2055 | #ifndef NO_DH | ||
| 2056 | void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export, | ||
| 2057 | int keylength)) | ||
| 2058 | { | ||
| 2059 | SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh); | ||
| 2060 | } | ||
| 2061 | |||
| 2062 | void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export, | ||
| 2063 | int keylength)) | ||
| 2064 | { | ||
| 2065 | SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh); | ||
| 2066 | } | ||
| 2067 | #endif | ||
| 2068 | |||
| 2069 | #if defined(_WINDLL) && defined(WIN16) | ||
| 2070 | #include "../crypto/bio/bss_file.c" | ||
| 2071 | #endif | ||
| 2072 | |||
| 2073 | IMPLEMENT_STACK_OF(SSL_CIPHER) | ||
| 2074 | IMPLEMENT_STACK_OF(SSL_COMP) | ||
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h deleted file mode 100644 index 516d3cc5ae..0000000000 --- a/src/lib/libssl/ssl_locl.h +++ /dev/null | |||
| @@ -1,609 +0,0 @@ | |||
| 1 | /* ssl/ssl_locl.h */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | /* ==================================================================== | ||
| 59 | * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. | ||
| 60 | * | ||
| 61 | * Redistribution and use in source and binary forms, with or without | ||
| 62 | * modification, are permitted provided that the following conditions | ||
| 63 | * are met: | ||
| 64 | * | ||
| 65 | * 1. Redistributions of source code must retain the above copyright | ||
| 66 | * notice, this list of conditions and the following disclaimer. | ||
| 67 | * | ||
| 68 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 69 | * notice, this list of conditions and the following disclaimer in | ||
| 70 | * the documentation and/or other materials provided with the | ||
| 71 | * distribution. | ||
| 72 | * | ||
| 73 | * 3. All advertising materials mentioning features or use of this | ||
| 74 | * software must display the following acknowledgment: | ||
| 75 | * "This product includes software developed by the OpenSSL Project | ||
| 76 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" | ||
| 77 | * | ||
| 78 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
| 79 | * endorse or promote products derived from this software without | ||
| 80 | * prior written permission. For written permission, please contact | ||
| 81 | * openssl-core@openssl.org. | ||
| 82 | * | ||
| 83 | * 5. Products derived from this software may not be called "OpenSSL" | ||
| 84 | * nor may "OpenSSL" appear in their names without prior written | ||
| 85 | * permission of the OpenSSL Project. | ||
| 86 | * | ||
| 87 | * 6. Redistributions of any form whatsoever must retain the following | ||
| 88 | * acknowledgment: | ||
| 89 | * "This product includes software developed by the OpenSSL Project | ||
| 90 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" | ||
| 91 | * | ||
| 92 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
| 93 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 94 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
| 95 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
| 96 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
| 97 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 98 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
| 99 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 100 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
| 101 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| 102 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
| 103 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 104 | * ==================================================================== | ||
| 105 | * | ||
| 106 | * This product includes cryptographic software written by Eric Young | ||
| 107 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
| 108 | * Hudson (tjh@cryptsoft.com). | ||
| 109 | * | ||
| 110 | */ | ||
| 111 | |||
| 112 | #ifndef HEADER_SSL_LOCL_H | ||
| 113 | #define HEADER_SSL_LOCL_H | ||
| 114 | #include <stdlib.h> | ||
| 115 | #include <time.h> | ||
| 116 | #include <string.h> | ||
| 117 | #include <errno.h> | ||
| 118 | |||
| 119 | #include "openssl/e_os.h" | ||
| 120 | |||
| 121 | #include <openssl/buffer.h> | ||
| 122 | #include <openssl/comp.h> | ||
| 123 | #include <openssl/bio.h> | ||
| 124 | #include <openssl/crypto.h> | ||
| 125 | #include <openssl/evp.h> | ||
| 126 | #include <openssl/stack.h> | ||
| 127 | #include <openssl/x509.h> | ||
| 128 | #include <openssl/err.h> | ||
| 129 | #include <openssl/ssl.h> | ||
| 130 | |||
| 131 | #define PKCS1_CHECK | ||
| 132 | |||
| 133 | #define c2l(c,l) (l = ((unsigned long)(*((c)++))) , \ | ||
| 134 | l|=(((unsigned long)(*((c)++)))<< 8), \ | ||
| 135 | l|=(((unsigned long)(*((c)++)))<<16), \ | ||
| 136 | l|=(((unsigned long)(*((c)++)))<<24)) | ||
| 137 | |||
| 138 | /* NOTE - c is not incremented as per c2l */ | ||
| 139 | #define c2ln(c,l1,l2,n) { \ | ||
| 140 | c+=n; \ | ||
| 141 | l1=l2=0; \ | ||
| 142 | switch (n) { \ | ||
| 143 | case 8: l2 =((unsigned long)(*(--(c))))<<24; \ | ||
| 144 | case 7: l2|=((unsigned long)(*(--(c))))<<16; \ | ||
| 145 | case 6: l2|=((unsigned long)(*(--(c))))<< 8; \ | ||
| 146 | case 5: l2|=((unsigned long)(*(--(c)))); \ | ||
| 147 | case 4: l1 =((unsigned long)(*(--(c))))<<24; \ | ||
| 148 | case 3: l1|=((unsigned long)(*(--(c))))<<16; \ | ||
| 149 | case 2: l1|=((unsigned long)(*(--(c))))<< 8; \ | ||
| 150 | case 1: l1|=((unsigned long)(*(--(c)))); \ | ||
| 151 | } \ | ||
| 152 | } | ||
| 153 | |||
| 154 | #define l2c(l,c) (*((c)++)=(unsigned char)(((l) )&0xff), \ | ||
| 155 | *((c)++)=(unsigned char)(((l)>> 8)&0xff), \ | ||
| 156 | *((c)++)=(unsigned char)(((l)>>16)&0xff), \ | ||
| 157 | *((c)++)=(unsigned char)(((l)>>24)&0xff)) | ||
| 158 | |||
| 159 | #define n2l(c,l) (l =((unsigned long)(*((c)++)))<<24, \ | ||
| 160 | l|=((unsigned long)(*((c)++)))<<16, \ | ||
| 161 | l|=((unsigned long)(*((c)++)))<< 8, \ | ||
| 162 | l|=((unsigned long)(*((c)++)))) | ||
| 163 | |||
| 164 | #define l2n(l,c) (*((c)++)=(unsigned char)(((l)>>24)&0xff), \ | ||
| 165 | *((c)++)=(unsigned char)(((l)>>16)&0xff), \ | ||
| 166 | *((c)++)=(unsigned char)(((l)>> 8)&0xff), \ | ||
| 167 | *((c)++)=(unsigned char)(((l) )&0xff)) | ||
| 168 | |||
| 169 | /* NOTE - c is not incremented as per l2c */ | ||
| 170 | #define l2cn(l1,l2,c,n) { \ | ||
| 171 | c+=n; \ | ||
| 172 | switch (n) { \ | ||
| 173 | case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \ | ||
| 174 | case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \ | ||
| 175 | case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \ | ||
| 176 | case 5: *(--(c))=(unsigned char)(((l2) )&0xff); \ | ||
| 177 | case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \ | ||
| 178 | case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \ | ||
| 179 | case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \ | ||
| 180 | case 1: *(--(c))=(unsigned char)(((l1) )&0xff); \ | ||
| 181 | } \ | ||
| 182 | } | ||
| 183 | |||
| 184 | #define n2s(c,s) ((s=(((unsigned int)(c[0]))<< 8)| \ | ||
| 185 | (((unsigned int)(c[1])) )),c+=2) | ||
| 186 | #define s2n(s,c) ((c[0]=(unsigned char)(((s)>> 8)&0xff), \ | ||
| 187 | c[1]=(unsigned char)(((s) )&0xff)),c+=2) | ||
| 188 | |||
| 189 | #define n2l3(c,l) ((l =(((unsigned long)(c[0]))<<16)| \ | ||
| 190 | (((unsigned long)(c[1]))<< 8)| \ | ||
| 191 | (((unsigned long)(c[2])) )),c+=3) | ||
| 192 | |||
| 193 | #define l2n3(l,c) ((c[0]=(unsigned char)(((l)>>16)&0xff), \ | ||
| 194 | c[1]=(unsigned char)(((l)>> 8)&0xff), \ | ||
| 195 | c[2]=(unsigned char)(((l) )&0xff)),c+=3) | ||
| 196 | |||
| 197 | /* LOCAL STUFF */ | ||
| 198 | |||
| 199 | #define SSL_DECRYPT 0 | ||
| 200 | #define SSL_ENCRYPT 1 | ||
| 201 | |||
| 202 | #define TWO_BYTE_BIT 0x80 | ||
| 203 | #define SEC_ESC_BIT 0x40 | ||
| 204 | #define TWO_BYTE_MASK 0x7fff | ||
| 205 | #define THREE_BYTE_MASK 0x3fff | ||
| 206 | |||
| 207 | #define INC32(a) ((a)=((a)+1)&0xffffffffL) | ||
| 208 | #define DEC32(a) ((a)=((a)-1)&0xffffffffL) | ||
| 209 | #define MAX_MAC_SIZE 20 /* up from 16 for SSLv3 */ | ||
| 210 | |||
| 211 | /* | ||
| 212 | * Define the Bitmasks for SSL_CIPHER.algorithms. | ||
| 213 | * This bits are used packed as dense as possible. If new methods/ciphers | ||
| 214 | * etc will be added, the bits a likely to change, so this information | ||
| 215 | * is for internal library use only, even though SSL_CIPHER.algorithms | ||
| 216 | * can be publicly accessed. | ||
| 217 | * Use the according functions for cipher management instead. | ||
| 218 | * | ||
| 219 | * The bit mask handling in the selection and sorting scheme in | ||
| 220 | * ssl_create_cipher_list() has only limited capabilities, reflecting | ||
| 221 | * that the different entities within are mutually exclusive: | ||
| 222 | * ONLY ONE BIT PER MASK CAN BE SET AT A TIME. | ||
| 223 | */ | ||
| 224 | #define SSL_MKEY_MASK 0x0000001FL | ||
| 225 | #define SSL_kRSA 0x00000001L /* RSA key exchange */ | ||
| 226 | #define SSL_kDHr 0x00000002L /* DH cert RSA CA cert */ | ||
| 227 | #define SSL_kDHd 0x00000004L /* DH cert DSA CA cert */ | ||
| 228 | #define SSL_kFZA 0x00000008L | ||
| 229 | #define SSL_kEDH 0x00000010L /* tmp DH key no DH cert */ | ||
| 230 | #define SSL_EDH (SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL)) | ||
| 231 | |||
| 232 | #define SSL_AUTH_MASK 0x000003e0L | ||
| 233 | #define SSL_aRSA 0x00000020L /* Authenticate with RSA */ | ||
| 234 | #define SSL_aDSS 0x00000040L /* Authenticate with DSS */ | ||
| 235 | #define SSL_DSS SSL_aDSS | ||
| 236 | #define SSL_aFZA 0x00000080L | ||
| 237 | #define SSL_aNULL 0x00000100L /* no Authenticate, ADH */ | ||
| 238 | #define SSL_aDH 0x00000200L /* no Authenticate, ADH */ | ||
| 239 | |||
| 240 | #define SSL_NULL (SSL_eNULL) | ||
| 241 | #define SSL_ADH (SSL_kEDH|SSL_aNULL) | ||
| 242 | #define SSL_RSA (SSL_kRSA|SSL_aRSA) | ||
| 243 | #define SSL_DH (SSL_kDHr|SSL_kDHd|SSL_kEDH) | ||
| 244 | #define SSL_FZA (SSL_aFZA|SSL_kFZA|SSL_eFZA) | ||
| 245 | |||
| 246 | #define SSL_ENC_MASK 0x0001Fc00L | ||
| 247 | #define SSL_DES 0x00000400L | ||
| 248 | #define SSL_3DES 0x00000800L | ||
| 249 | #define SSL_RC4 0x00001000L | ||
| 250 | #define SSL_RC2 0x00002000L | ||
| 251 | #define SSL_IDEA 0x00004000L | ||
| 252 | #define SSL_eFZA 0x00008000L | ||
| 253 | #define SSL_eNULL 0x00010000L | ||
| 254 | |||
| 255 | #define SSL_MAC_MASK 0x00060000L | ||
| 256 | #define SSL_MD5 0x00020000L | ||
| 257 | #define SSL_SHA1 0x00040000L | ||
| 258 | #define SSL_SHA (SSL_SHA1) | ||
| 259 | |||
| 260 | #define SSL_SSL_MASK 0x00180000L | ||
| 261 | #define SSL_SSLV2 0x00080000L | ||
| 262 | #define SSL_SSLV3 0x00100000L | ||
| 263 | #define SSL_TLSV1 SSL_SSLV3 /* for now */ | ||
| 264 | |||
| 265 | /* we have used 001fffff - 11 bits left to go */ | ||
| 266 | |||
| 267 | /* | ||
| 268 | * Export and cipher strength information. For each cipher we have to decide | ||
| 269 | * whether it is exportable or not. This information is likely to change | ||
| 270 | * over time, since the export control rules are no static technical issue. | ||
| 271 | * | ||
| 272 | * Independent of the export flag the cipher strength is sorted into classes. | ||
| 273 | * SSL_EXP40 was denoting the 40bit US export limit of past times, which now | ||
| 274 | * is at 56bit (SSL_EXP56). If the exportable cipher class is going to change | ||
| 275 | * again (eg. to 64bit) the use of "SSL_EXP*" becomes blurred even more, | ||
| 276 | * since SSL_EXP64 could be similar to SSL_LOW. | ||
| 277 | * For this reason SSL_MICRO and SSL_MINI macros are included to widen the | ||
| 278 | * namespace of SSL_LOW-SSL_HIGH to lower values. As development of speed | ||
| 279 | * and ciphers goes, another extension to SSL_SUPER and/or SSL_ULTRA would | ||
| 280 | * be possible. | ||
| 281 | */ | ||
| 282 | #define SSL_EXP_MASK 0x00000003L | ||
| 283 | #define SSL_NOT_EXP 0x00000001L | ||
| 284 | #define SSL_EXPORT 0x00000002L | ||
| 285 | |||
| 286 | #define SSL_STRONG_MASK 0x0000007cL | ||
| 287 | #define SSL_EXP40 0x00000004L | ||
| 288 | #define SSL_MICRO (SSL_EXP40) | ||
| 289 | #define SSL_EXP56 0x00000008L | ||
| 290 | #define SSL_MINI (SSL_EXP56) | ||
| 291 | #define SSL_LOW 0x00000010L | ||
| 292 | #define SSL_MEDIUM 0x00000020L | ||
| 293 | #define SSL_HIGH 0x00000040L | ||
| 294 | |||
| 295 | /* we have used 0000007f - 25 bits left to go */ | ||
| 296 | |||
| 297 | /* | ||
| 298 | * Macros to check the export status and cipher strength for export ciphers. | ||
| 299 | * Even though the macros for EXPORT and EXPORT40/56 have similar names, | ||
| 300 | * their meaning is different: | ||
| 301 | * *_EXPORT macros check the 'exportable' status. | ||
| 302 | * *_EXPORT40/56 macros are used to check whether a certain cipher strength | ||
| 303 | * is given. | ||
| 304 | * Since the SSL_IS_EXPORT* and SSL_EXPORT* macros depend on the correct | ||
| 305 | * algorithm structure element to be passed (algorithms, algo_strength) and no | ||
| 306 | * typechecking can be done as they are all of type unsigned long, their | ||
| 307 | * direct usage is discouraged. | ||
| 308 | * Use the SSL_C_* macros instead. | ||
| 309 | */ | ||
| 310 | #define SSL_IS_EXPORT(a) ((a)&SSL_EXPORT) | ||
| 311 | #define SSL_IS_EXPORT56(a) ((a)&SSL_EXP56) | ||
| 312 | #define SSL_IS_EXPORT40(a) ((a)&SSL_EXP40) | ||
| 313 | #define SSL_C_IS_EXPORT(c) SSL_IS_EXPORT((c)->algo_strength) | ||
| 314 | #define SSL_C_IS_EXPORT56(c) SSL_IS_EXPORT56((c)->algo_strength) | ||
| 315 | #define SSL_C_IS_EXPORT40(c) SSL_IS_EXPORT40((c)->algo_strength) | ||
| 316 | |||
| 317 | #define SSL_EXPORT_KEYLENGTH(a,s) (SSL_IS_EXPORT40(s) ? 5 : \ | ||
| 318 | ((a)&SSL_ENC_MASK) == SSL_DES ? 8 : 7) | ||
| 319 | #define SSL_EXPORT_PKEYLENGTH(a) (SSL_IS_EXPORT40(a) ? 512 : 1024) | ||
| 320 | #define SSL_C_EXPORT_KEYLENGTH(c) SSL_EXPORT_KEYLENGTH((c)->algorithms, \ | ||
| 321 | (c)->algo_strength) | ||
| 322 | #define SSL_C_EXPORT_PKEYLENGTH(c) SSL_EXPORT_PKEYLENGTH((c)->algo_strength) | ||
| 323 | |||
| 324 | |||
| 325 | #define SSL_ALL 0xffffffffL | ||
| 326 | #define SSL_ALL_CIPHERS (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|\ | ||
| 327 | SSL_MAC_MASK) | ||
| 328 | #define SSL_ALL_STRENGTHS (SSL_EXP_MASK|SSL_STRONG_MASK) | ||
| 329 | |||
| 330 | /* Mostly for SSLv3 */ | ||
| 331 | #define SSL_PKEY_RSA_ENC 0 | ||
| 332 | #define SSL_PKEY_RSA_SIGN 1 | ||
| 333 | #define SSL_PKEY_DSA_SIGN 2 | ||
| 334 | #define SSL_PKEY_DH_RSA 3 | ||
| 335 | #define SSL_PKEY_DH_DSA 4 | ||
| 336 | #define SSL_PKEY_NUM 5 | ||
| 337 | |||
| 338 | /* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) | | ||
| 339 | * <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN) | ||
| 340 | * SSL_kDH <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN) | ||
| 341 | * SSL_kEDH <- RSA_ENC | RSA_SIGN | DSA_SIGN | ||
| 342 | * SSL_aRSA <- RSA_ENC | RSA_SIGN | ||
| 343 | * SSL_aDSS <- DSA_SIGN | ||
| 344 | */ | ||
| 345 | |||
| 346 | /* | ||
| 347 | #define CERT_INVALID 0 | ||
| 348 | #define CERT_PUBLIC_KEY 1 | ||
| 349 | #define CERT_PRIVATE_KEY 2 | ||
| 350 | */ | ||
| 351 | |||
| 352 | typedef struct cert_pkey_st | ||
| 353 | { | ||
| 354 | X509 *x509; | ||
| 355 | EVP_PKEY *privatekey; | ||
| 356 | } CERT_PKEY; | ||
| 357 | |||
| 358 | typedef struct cert_st | ||
| 359 | { | ||
| 360 | /* Current active set */ | ||
| 361 | CERT_PKEY *key; /* ALWAYS points to an element of the pkeys array | ||
| 362 | * Probably it would make more sense to store | ||
| 363 | * an index, not a pointer. */ | ||
| 364 | |||
| 365 | /* The following masks are for the key and auth | ||
| 366 | * algorithms that are supported by the certs below */ | ||
| 367 | int valid; | ||
| 368 | unsigned long mask; | ||
| 369 | unsigned long export_mask; | ||
| 370 | #ifndef NO_RSA | ||
| 371 | RSA *rsa_tmp; | ||
| 372 | RSA *(*rsa_tmp_cb)(SSL *ssl,int is_export,int keysize); | ||
| 373 | #endif | ||
| 374 | #ifndef NO_DH | ||
| 375 | DH *dh_tmp; | ||
| 376 | DH *(*dh_tmp_cb)(SSL *ssl,int is_export,int keysize); | ||
| 377 | #endif | ||
| 378 | |||
| 379 | CERT_PKEY pkeys[SSL_PKEY_NUM]; | ||
| 380 | |||
| 381 | int references; /* >1 only if SSL_copy_session_id is used */ | ||
| 382 | } CERT; | ||
| 383 | |||
| 384 | |||
| 385 | typedef struct sess_cert_st | ||
| 386 | { | ||
| 387 | STACK_OF(X509) *cert_chain; /* as received from peer (not for SSL2) */ | ||
| 388 | |||
| 389 | /* The 'peer_...' members are used only by clients. */ | ||
| 390 | int peer_cert_type; | ||
| 391 | |||
| 392 | CERT_PKEY *peer_key; /* points to an element of peer_pkeys (never NULL!) */ | ||
| 393 | CERT_PKEY peer_pkeys[SSL_PKEY_NUM]; | ||
| 394 | /* Obviously we don't have the private keys of these, | ||
| 395 | * so maybe we shouldn't even use the CERT_PKEY type here. */ | ||
| 396 | |||
| 397 | #ifndef NO_RSA | ||
| 398 | RSA *peer_rsa_tmp; /* not used for SSL 2 */ | ||
| 399 | #endif | ||
| 400 | #ifndef NO_DH | ||
| 401 | DH *peer_dh_tmp; /* not used for SSL 2 */ | ||
| 402 | #endif | ||
| 403 | |||
| 404 | int references; /* actually always 1 at the moment */ | ||
| 405 | } SESS_CERT; | ||
| 406 | |||
| 407 | |||
| 408 | /*#define MAC_DEBUG */ | ||
| 409 | |||
| 410 | /*#define ERR_DEBUG */ | ||
| 411 | /*#define ABORT_DEBUG */ | ||
| 412 | /*#define PKT_DEBUG 1 */ | ||
| 413 | /*#define DES_DEBUG */ | ||
| 414 | /*#define DES_OFB_DEBUG */ | ||
| 415 | /*#define SSL_DEBUG */ | ||
| 416 | /*#define RSA_DEBUG */ | ||
| 417 | /*#define IDEA_DEBUG */ | ||
| 418 | |||
| 419 | #define FP_ICC (int (*)(const void *,const void *)) | ||
| 420 | #define ssl_put_cipher_by_char(ssl,ciph,ptr) \ | ||
| 421 | ((ssl)->method->put_cipher_by_char((ciph),(ptr))) | ||
| 422 | #define ssl_get_cipher_by_char(ssl,ptr) \ | ||
| 423 | ((ssl)->method->get_cipher_by_char(ptr)) | ||
| 424 | |||
| 425 | /* This is for the SSLv3/TLSv1.0 differences in crypto/hash stuff | ||
| 426 | * It is a bit of a mess of functions, but hell, think of it as | ||
| 427 | * an opaque structure :-) */ | ||
| 428 | typedef struct ssl3_enc_method | ||
| 429 | { | ||
| 430 | int (*enc)(SSL *, int); | ||
| 431 | int (*mac)(SSL *, unsigned char *, int); | ||
| 432 | int (*setup_key_block)(SSL *); | ||
| 433 | int (*generate_master_secret)(SSL *, unsigned char *, unsigned char *, int); | ||
| 434 | int (*change_cipher_state)(SSL *, int); | ||
| 435 | int (*final_finish_mac)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char *, int, unsigned char *); | ||
| 436 | int finish_mac_length; | ||
| 437 | int (*cert_verify_mac)(SSL *, EVP_MD_CTX *, unsigned char *); | ||
| 438 | const char *client_finished_label; | ||
| 439 | int client_finished_label_len; | ||
| 440 | const char *server_finished_label; | ||
| 441 | int server_finished_label_len; | ||
| 442 | int (*alert_value)(int); | ||
| 443 | } SSL3_ENC_METHOD; | ||
| 444 | |||
| 445 | /* Used for holding the relevant compression methods loaded into SSL_CTX */ | ||
| 446 | typedef struct ssl3_comp_st | ||
| 447 | { | ||
| 448 | int comp_id; /* The identifier byte for this compression type */ | ||
| 449 | char *name; /* Text name used for the compression type */ | ||
| 450 | COMP_METHOD *method; /* The method :-) */ | ||
| 451 | } SSL3_COMP; | ||
| 452 | |||
| 453 | OPENSSL_EXTERN SSL3_ENC_METHOD ssl3_undef_enc_method; | ||
| 454 | OPENSSL_EXTERN SSL_CIPHER ssl2_ciphers[]; | ||
| 455 | OPENSSL_EXTERN SSL_CIPHER ssl3_ciphers[]; | ||
| 456 | |||
| 457 | #ifdef VMS | ||
| 458 | #undef SSL_COMP_get_compression_methods | ||
| 459 | #define SSL_COMP_get_compression_methods SSL_COMP_get_compress_methods | ||
| 460 | #endif | ||
| 461 | |||
| 462 | |||
| 463 | SSL_METHOD *ssl_bad_method(int ver); | ||
| 464 | SSL_METHOD *sslv2_base_method(void); | ||
| 465 | SSL_METHOD *sslv23_base_method(void); | ||
| 466 | SSL_METHOD *sslv3_base_method(void); | ||
| 467 | |||
| 468 | void ssl_clear_cipher_ctx(SSL *s); | ||
| 469 | int ssl_clear_bad_session(SSL *s); | ||
| 470 | CERT *ssl_cert_new(void); | ||
| 471 | CERT *ssl_cert_dup(CERT *cert); | ||
| 472 | int ssl_cert_inst(CERT **o); | ||
| 473 | void ssl_cert_free(CERT *c); | ||
| 474 | SESS_CERT *ssl_sess_cert_new(void); | ||
| 475 | void ssl_sess_cert_free(SESS_CERT *sc); | ||
| 476 | int ssl_set_peer_cert_type(SESS_CERT *c, int type); | ||
| 477 | int ssl_get_new_session(SSL *s, int session); | ||
| 478 | int ssl_get_prev_session(SSL *s, unsigned char *session,int len); | ||
| 479 | int ssl_cipher_id_cmp(const SSL_CIPHER *a,const SSL_CIPHER *b); | ||
| 480 | int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap, | ||
| 481 | const SSL_CIPHER * const *bp); | ||
| 482 | STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num, | ||
| 483 | STACK_OF(SSL_CIPHER) **skp); | ||
| 484 | int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p); | ||
| 485 | STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth, | ||
| 486 | STACK_OF(SSL_CIPHER) **pref, | ||
| 487 | STACK_OF(SSL_CIPHER) **sorted, | ||
| 488 | const char *rule_str); | ||
| 489 | void ssl_update_cache(SSL *s, int mode); | ||
| 490 | int ssl_cipher_get_evp(SSL_SESSION *s,const EVP_CIPHER **enc,const EVP_MD **md, | ||
| 491 | SSL_COMP **comp); | ||
| 492 | int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk); | ||
| 493 | int ssl_undefined_function(SSL *s); | ||
| 494 | X509 *ssl_get_server_send_cert(SSL *); | ||
| 495 | EVP_PKEY *ssl_get_sign_pkey(SSL *,SSL_CIPHER *); | ||
| 496 | int ssl_cert_type(X509 *x,EVP_PKEY *pkey); | ||
| 497 | void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher); | ||
| 498 | STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s); | ||
| 499 | int ssl_verify_alarm_type(long type); | ||
| 500 | |||
| 501 | int ssl2_enc_init(SSL *s, int client); | ||
| 502 | void ssl2_generate_key_material(SSL *s); | ||
| 503 | void ssl2_enc(SSL *s,int send_data); | ||
| 504 | void ssl2_mac(SSL *s,unsigned char *mac,int send_data); | ||
| 505 | SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p); | ||
| 506 | int ssl2_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p); | ||
| 507 | int ssl2_part_read(SSL *s, unsigned long f, int i); | ||
| 508 | int ssl2_do_write(SSL *s); | ||
| 509 | int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data); | ||
| 510 | void ssl2_return_error(SSL *s,int reason); | ||
| 511 | void ssl2_write_error(SSL *s); | ||
| 512 | int ssl2_num_ciphers(void); | ||
| 513 | SSL_CIPHER *ssl2_get_cipher(unsigned int u); | ||
| 514 | int ssl2_new(SSL *s); | ||
| 515 | void ssl2_free(SSL *s); | ||
| 516 | int ssl2_accept(SSL *s); | ||
| 517 | int ssl2_connect(SSL *s); | ||
| 518 | int ssl2_read(SSL *s, void *buf, int len); | ||
| 519 | int ssl2_peek(SSL *s, void *buf, int len); | ||
| 520 | int ssl2_write(SSL *s, const void *buf, int len); | ||
| 521 | int ssl2_shutdown(SSL *s); | ||
| 522 | void ssl2_clear(SSL *s); | ||
| 523 | long ssl2_ctrl(SSL *s,int cmd, long larg, char *parg); | ||
| 524 | long ssl2_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg); | ||
| 525 | long ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)()); | ||
| 526 | long ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)()); | ||
| 527 | int ssl2_pending(SSL *s); | ||
| 528 | |||
| 529 | SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p); | ||
| 530 | int ssl3_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p); | ||
| 531 | void ssl3_init_finished_mac(SSL *s); | ||
| 532 | int ssl3_send_server_certificate(SSL *s); | ||
| 533 | int ssl3_get_finished(SSL *s,int state_a,int state_b); | ||
| 534 | int ssl3_setup_key_block(SSL *s); | ||
| 535 | int ssl3_send_change_cipher_spec(SSL *s,int state_a,int state_b); | ||
| 536 | int ssl3_change_cipher_state(SSL *s,int which); | ||
| 537 | void ssl3_cleanup_key_block(SSL *s); | ||
| 538 | int ssl3_do_write(SSL *s,int type); | ||
| 539 | void ssl3_send_alert(SSL *s,int level, int desc); | ||
| 540 | int ssl3_generate_master_secret(SSL *s, unsigned char *out, | ||
| 541 | unsigned char *p, int len); | ||
| 542 | int ssl3_get_req_cert_type(SSL *s,unsigned char *p); | ||
| 543 | long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok); | ||
| 544 | int ssl3_send_finished(SSL *s, int a, int b, const char *sender,int slen); | ||
| 545 | int ssl3_num_ciphers(void); | ||
| 546 | SSL_CIPHER *ssl3_get_cipher(unsigned int u); | ||
| 547 | int ssl3_renegotiate(SSL *ssl); | ||
| 548 | int ssl3_renegotiate_check(SSL *ssl); | ||
| 549 | int ssl3_dispatch_alert(SSL *s); | ||
| 550 | int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek); | ||
| 551 | int ssl3_write_bytes(SSL *s, int type, const void *buf, int len); | ||
| 552 | int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2, | ||
| 553 | const char *sender, int slen,unsigned char *p); | ||
| 554 | int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p); | ||
| 555 | void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len); | ||
| 556 | int ssl3_enc(SSL *s, int send_data); | ||
| 557 | int ssl3_mac(SSL *ssl, unsigned char *md, int send_data); | ||
| 558 | unsigned long ssl3_output_cert_chain(SSL *s, X509 *x); | ||
| 559 | SSL_CIPHER *ssl3_choose_cipher(SSL *ssl,STACK_OF(SSL_CIPHER) *have, | ||
| 560 | STACK_OF(SSL_CIPHER) *pref); | ||
| 561 | int ssl3_setup_buffers(SSL *s); | ||
| 562 | int ssl3_new(SSL *s); | ||
| 563 | void ssl3_free(SSL *s); | ||
| 564 | int ssl3_accept(SSL *s); | ||
| 565 | int ssl3_connect(SSL *s); | ||
| 566 | int ssl3_read(SSL *s, void *buf, int len); | ||
| 567 | int ssl3_peek(SSL *s, void *buf, int len); | ||
| 568 | int ssl3_write(SSL *s, const void *buf, int len); | ||
| 569 | int ssl3_shutdown(SSL *s); | ||
| 570 | void ssl3_clear(SSL *s); | ||
| 571 | long ssl3_ctrl(SSL *s,int cmd, long larg, char *parg); | ||
| 572 | long ssl3_ctx_ctrl(SSL_CTX *s,int cmd, long larg, char *parg); | ||
| 573 | long ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)()); | ||
| 574 | long ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)()); | ||
| 575 | int ssl3_pending(SSL *s); | ||
| 576 | |||
| 577 | int ssl23_accept(SSL *s); | ||
| 578 | int ssl23_connect(SSL *s); | ||
| 579 | int ssl23_read_bytes(SSL *s, int n); | ||
| 580 | int ssl23_write_bytes(SSL *s); | ||
| 581 | |||
| 582 | int tls1_new(SSL *s); | ||
| 583 | void tls1_free(SSL *s); | ||
| 584 | void tls1_clear(SSL *s); | ||
| 585 | long tls1_ctrl(SSL *s,int cmd, long larg, char *parg); | ||
| 586 | long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)()); | ||
| 587 | SSL_METHOD *tlsv1_base_method(void ); | ||
| 588 | |||
| 589 | int ssl_init_wbio_buffer(SSL *s, int push); | ||
| 590 | void ssl_free_wbio_buffer(SSL *s); | ||
| 591 | |||
| 592 | int tls1_change_cipher_state(SSL *s, int which); | ||
| 593 | int tls1_setup_key_block(SSL *s); | ||
| 594 | int tls1_enc(SSL *s, int snd); | ||
| 595 | int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx, | ||
| 596 | const char *str, int slen, unsigned char *p); | ||
| 597 | int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p); | ||
| 598 | int tls1_mac(SSL *ssl, unsigned char *md, int snd); | ||
| 599 | int tls1_generate_master_secret(SSL *s, unsigned char *out, | ||
| 600 | unsigned char *p, int len); | ||
| 601 | int tls1_alert_code(int code); | ||
| 602 | int ssl3_alert_code(int code); | ||
| 603 | int ssl_ok(SSL *s); | ||
| 604 | |||
| 605 | SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n); | ||
| 606 | STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void); | ||
| 607 | |||
| 608 | |||
| 609 | #endif | ||
diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c deleted file mode 100644 index 6ec7a5cdb1..0000000000 --- a/src/lib/libssl/ssl_rsa.c +++ /dev/null | |||
| @@ -1,815 +0,0 @@ | |||
| 1 | /* ssl/ssl_rsa.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/bio.h> | ||
| 61 | #include <openssl/objects.h> | ||
| 62 | #include <openssl/evp.h> | ||
| 63 | #include <openssl/x509.h> | ||
| 64 | #include <openssl/pem.h> | ||
| 65 | #include "ssl_locl.h" | ||
| 66 | |||
| 67 | static int ssl_set_cert(CERT *c, X509 *x509); | ||
| 68 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); | ||
| 69 | int SSL_use_certificate(SSL *ssl, X509 *x) | ||
| 70 | { | ||
| 71 | if (x == NULL) | ||
| 72 | { | ||
| 73 | SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER); | ||
| 74 | return(0); | ||
| 75 | } | ||
| 76 | if (!ssl_cert_inst(&ssl->cert)) | ||
| 77 | { | ||
| 78 | SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE); | ||
| 79 | return(0); | ||
| 80 | } | ||
| 81 | return(ssl_set_cert(ssl->cert,x)); | ||
| 82 | } | ||
| 83 | |||
| 84 | #ifndef NO_STDIO | ||
| 85 | int SSL_use_certificate_file(SSL *ssl, const char *file, int type) | ||
| 86 | { | ||
| 87 | int j; | ||
| 88 | BIO *in; | ||
| 89 | int ret=0; | ||
| 90 | X509 *x=NULL; | ||
| 91 | |||
| 92 | in=BIO_new(BIO_s_file_internal()); | ||
| 93 | if (in == NULL) | ||
| 94 | { | ||
| 95 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB); | ||
| 96 | goto end; | ||
| 97 | } | ||
| 98 | |||
| 99 | if (BIO_read_filename(in,file) <= 0) | ||
| 100 | { | ||
| 101 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB); | ||
| 102 | goto end; | ||
| 103 | } | ||
| 104 | if (type == SSL_FILETYPE_ASN1) | ||
| 105 | { | ||
| 106 | j=ERR_R_ASN1_LIB; | ||
| 107 | x=d2i_X509_bio(in,NULL); | ||
| 108 | } | ||
| 109 | else if (type == SSL_FILETYPE_PEM) | ||
| 110 | { | ||
| 111 | j=ERR_R_PEM_LIB; | ||
| 112 | x=PEM_read_bio_X509(in,NULL,ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); | ||
| 113 | } | ||
| 114 | else | ||
| 115 | { | ||
| 116 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE); | ||
| 117 | goto end; | ||
| 118 | } | ||
| 119 | |||
| 120 | if (x == NULL) | ||
| 121 | { | ||
| 122 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,j); | ||
| 123 | goto end; | ||
| 124 | } | ||
| 125 | |||
| 126 | ret=SSL_use_certificate(ssl,x); | ||
| 127 | end: | ||
| 128 | if (x != NULL) X509_free(x); | ||
| 129 | if (in != NULL) BIO_free(in); | ||
| 130 | return(ret); | ||
| 131 | } | ||
| 132 | #endif | ||
| 133 | |||
| 134 | int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len) | ||
| 135 | { | ||
| 136 | X509 *x; | ||
| 137 | int ret; | ||
| 138 | |||
| 139 | x=d2i_X509(NULL,&d,(long)len); | ||
| 140 | if (x == NULL) | ||
| 141 | { | ||
| 142 | SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); | ||
| 143 | return(0); | ||
| 144 | } | ||
| 145 | |||
| 146 | ret=SSL_use_certificate(ssl,x); | ||
| 147 | X509_free(x); | ||
| 148 | return(ret); | ||
| 149 | } | ||
| 150 | |||
| 151 | #ifndef NO_RSA | ||
| 152 | int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) | ||
| 153 | { | ||
| 154 | EVP_PKEY *pkey; | ||
| 155 | int ret; | ||
| 156 | |||
| 157 | if (rsa == NULL) | ||
| 158 | { | ||
| 159 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); | ||
| 160 | return(0); | ||
| 161 | } | ||
| 162 | if (!ssl_cert_inst(&ssl->cert)) | ||
| 163 | { | ||
| 164 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); | ||
| 165 | return(0); | ||
| 166 | } | ||
| 167 | if ((pkey=EVP_PKEY_new()) == NULL) | ||
| 168 | { | ||
| 169 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB); | ||
| 170 | return(0); | ||
| 171 | } | ||
| 172 | |||
| 173 | CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA); | ||
| 174 | EVP_PKEY_assign_RSA(pkey,rsa); | ||
| 175 | |||
| 176 | ret=ssl_set_pkey(ssl->cert,pkey); | ||
| 177 | EVP_PKEY_free(pkey); | ||
| 178 | return(ret); | ||
| 179 | } | ||
| 180 | #endif | ||
| 181 | |||
| 182 | static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) | ||
| 183 | { | ||
| 184 | int i,ok=0,bad=0; | ||
| 185 | |||
| 186 | i=ssl_cert_type(NULL,pkey); | ||
| 187 | if (i < 0) | ||
| 188 | { | ||
| 189 | SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE); | ||
| 190 | return(0); | ||
| 191 | } | ||
| 192 | |||
| 193 | if (c->pkeys[i].x509 != NULL) | ||
| 194 | { | ||
| 195 | EVP_PKEY *pktmp; | ||
| 196 | pktmp = X509_get_pubkey(c->pkeys[i].x509); | ||
| 197 | EVP_PKEY_copy_parameters(pktmp,pkey); | ||
| 198 | EVP_PKEY_free(pktmp); | ||
| 199 | ERR_clear_error(); | ||
| 200 | |||
| 201 | #ifndef NO_RSA | ||
| 202 | /* Don't check the public/private key, this is mostly | ||
| 203 | * for smart cards. */ | ||
| 204 | if ((pkey->type == EVP_PKEY_RSA) && | ||
| 205 | (RSA_flags(pkey->pkey.rsa) & | ||
| 206 | RSA_METHOD_FLAG_NO_CHECK)) | ||
| 207 | ok=1; | ||
| 208 | else | ||
| 209 | #endif | ||
| 210 | if (!X509_check_private_key(c->pkeys[i].x509,pkey)) | ||
| 211 | { | ||
| 212 | if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA)) | ||
| 213 | { | ||
| 214 | i=(i == SSL_PKEY_DH_RSA)? | ||
| 215 | SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA; | ||
| 216 | |||
| 217 | if (c->pkeys[i].x509 == NULL) | ||
| 218 | ok=1; | ||
| 219 | else | ||
| 220 | { | ||
| 221 | if (!X509_check_private_key( | ||
| 222 | c->pkeys[i].x509,pkey)) | ||
| 223 | bad=1; | ||
| 224 | else | ||
| 225 | ok=1; | ||
| 226 | } | ||
| 227 | } | ||
| 228 | else | ||
| 229 | bad=1; | ||
| 230 | } | ||
| 231 | else | ||
| 232 | ok=1; | ||
| 233 | } | ||
| 234 | else | ||
| 235 | ok=1; | ||
| 236 | |||
| 237 | if (bad) | ||
| 238 | { | ||
| 239 | X509_free(c->pkeys[i].x509); | ||
| 240 | c->pkeys[i].x509=NULL; | ||
| 241 | return(0); | ||
| 242 | } | ||
| 243 | |||
| 244 | if (c->pkeys[i].privatekey != NULL) | ||
| 245 | EVP_PKEY_free(c->pkeys[i].privatekey); | ||
| 246 | CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY); | ||
| 247 | c->pkeys[i].privatekey=pkey; | ||
| 248 | c->key= &(c->pkeys[i]); | ||
| 249 | |||
| 250 | c->valid=0; | ||
| 251 | return(1); | ||
| 252 | } | ||
| 253 | |||
| 254 | #ifndef NO_RSA | ||
| 255 | #ifndef NO_STDIO | ||
| 256 | int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type) | ||
| 257 | { | ||
| 258 | int j,ret=0; | ||
| 259 | BIO *in; | ||
| 260 | RSA *rsa=NULL; | ||
| 261 | |||
| 262 | in=BIO_new(BIO_s_file_internal()); | ||
| 263 | if (in == NULL) | ||
| 264 | { | ||
| 265 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB); | ||
| 266 | goto end; | ||
| 267 | } | ||
| 268 | |||
| 269 | if (BIO_read_filename(in,file) <= 0) | ||
| 270 | { | ||
| 271 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB); | ||
| 272 | goto end; | ||
| 273 | } | ||
| 274 | if (type == SSL_FILETYPE_ASN1) | ||
| 275 | { | ||
| 276 | j=ERR_R_ASN1_LIB; | ||
| 277 | rsa=d2i_RSAPrivateKey_bio(in,NULL); | ||
| 278 | } | ||
| 279 | else if (type == SSL_FILETYPE_PEM) | ||
| 280 | { | ||
| 281 | j=ERR_R_PEM_LIB; | ||
| 282 | rsa=PEM_read_bio_RSAPrivateKey(in,NULL, | ||
| 283 | ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); | ||
| 284 | } | ||
| 285 | else | ||
| 286 | { | ||
| 287 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); | ||
| 288 | goto end; | ||
| 289 | } | ||
| 290 | if (rsa == NULL) | ||
| 291 | { | ||
| 292 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,j); | ||
| 293 | goto end; | ||
| 294 | } | ||
| 295 | ret=SSL_use_RSAPrivateKey(ssl,rsa); | ||
| 296 | RSA_free(rsa); | ||
| 297 | end: | ||
| 298 | if (in != NULL) BIO_free(in); | ||
| 299 | return(ret); | ||
| 300 | } | ||
| 301 | #endif | ||
| 302 | |||
| 303 | int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len) | ||
| 304 | { | ||
| 305 | int ret; | ||
| 306 | unsigned char *p; | ||
| 307 | RSA *rsa; | ||
| 308 | |||
| 309 | p=d; | ||
| 310 | if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) | ||
| 311 | { | ||
| 312 | SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); | ||
| 313 | return(0); | ||
| 314 | } | ||
| 315 | |||
| 316 | ret=SSL_use_RSAPrivateKey(ssl,rsa); | ||
| 317 | RSA_free(rsa); | ||
| 318 | return(ret); | ||
| 319 | } | ||
| 320 | #endif /* !NO_RSA */ | ||
| 321 | |||
| 322 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) | ||
| 323 | { | ||
| 324 | int ret; | ||
| 325 | |||
| 326 | if (pkey == NULL) | ||
| 327 | { | ||
| 328 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); | ||
| 329 | return(0); | ||
| 330 | } | ||
| 331 | if (!ssl_cert_inst(&ssl->cert)) | ||
| 332 | { | ||
| 333 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE); | ||
| 334 | return(0); | ||
| 335 | } | ||
| 336 | ret=ssl_set_pkey(ssl->cert,pkey); | ||
| 337 | return(ret); | ||
| 338 | } | ||
| 339 | |||
| 340 | #ifndef NO_STDIO | ||
| 341 | int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) | ||
| 342 | { | ||
| 343 | int j,ret=0; | ||
| 344 | BIO *in; | ||
| 345 | EVP_PKEY *pkey=NULL; | ||
| 346 | |||
| 347 | in=BIO_new(BIO_s_file_internal()); | ||
| 348 | if (in == NULL) | ||
| 349 | { | ||
| 350 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB); | ||
| 351 | goto end; | ||
| 352 | } | ||
| 353 | |||
| 354 | if (BIO_read_filename(in,file) <= 0) | ||
| 355 | { | ||
| 356 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB); | ||
| 357 | goto end; | ||
| 358 | } | ||
| 359 | if (type == SSL_FILETYPE_PEM) | ||
| 360 | { | ||
| 361 | j=ERR_R_PEM_LIB; | ||
| 362 | pkey=PEM_read_bio_PrivateKey(in,NULL, | ||
| 363 | ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); | ||
| 364 | } | ||
| 365 | else | ||
| 366 | { | ||
| 367 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); | ||
| 368 | goto end; | ||
| 369 | } | ||
| 370 | if (pkey == NULL) | ||
| 371 | { | ||
| 372 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,j); | ||
| 373 | goto end; | ||
| 374 | } | ||
| 375 | ret=SSL_use_PrivateKey(ssl,pkey); | ||
| 376 | EVP_PKEY_free(pkey); | ||
| 377 | end: | ||
| 378 | if (in != NULL) BIO_free(in); | ||
| 379 | return(ret); | ||
| 380 | } | ||
| 381 | #endif | ||
| 382 | |||
| 383 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, unsigned char *d, long len) | ||
| 384 | { | ||
| 385 | int ret; | ||
| 386 | unsigned char *p; | ||
| 387 | EVP_PKEY *pkey; | ||
| 388 | |||
| 389 | p=d; | ||
| 390 | if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) | ||
| 391 | { | ||
| 392 | SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); | ||
| 393 | return(0); | ||
| 394 | } | ||
| 395 | |||
| 396 | ret=SSL_use_PrivateKey(ssl,pkey); | ||
| 397 | EVP_PKEY_free(pkey); | ||
| 398 | return(ret); | ||
| 399 | } | ||
| 400 | |||
| 401 | int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) | ||
| 402 | { | ||
| 403 | if (x == NULL) | ||
| 404 | { | ||
| 405 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER); | ||
| 406 | return(0); | ||
| 407 | } | ||
| 408 | if (!ssl_cert_inst(&ctx->cert)) | ||
| 409 | { | ||
| 410 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE); | ||
| 411 | return(0); | ||
| 412 | } | ||
| 413 | return(ssl_set_cert(ctx->cert, x)); | ||
| 414 | } | ||
| 415 | |||
| 416 | static int ssl_set_cert(CERT *c, X509 *x) | ||
| 417 | { | ||
| 418 | EVP_PKEY *pkey; | ||
| 419 | int i,ok=0,bad=0; | ||
| 420 | |||
| 421 | pkey=X509_get_pubkey(x); | ||
| 422 | if (pkey == NULL) | ||
| 423 | { | ||
| 424 | SSLerr(SSL_F_SSL_SET_CERT,SSL_R_X509_LIB); | ||
| 425 | return(0); | ||
| 426 | } | ||
| 427 | |||
| 428 | i=ssl_cert_type(x,pkey); | ||
| 429 | if (i < 0) | ||
| 430 | { | ||
| 431 | SSLerr(SSL_F_SSL_SET_CERT,SSL_R_UNKNOWN_CERTIFICATE_TYPE); | ||
| 432 | EVP_PKEY_free(pkey); | ||
| 433 | return(0); | ||
| 434 | } | ||
| 435 | |||
| 436 | if (c->pkeys[i].privatekey != NULL) | ||
| 437 | { | ||
| 438 | EVP_PKEY_copy_parameters(pkey,c->pkeys[i].privatekey); | ||
| 439 | ERR_clear_error(); | ||
| 440 | |||
| 441 | #ifndef NO_RSA | ||
| 442 | /* Don't check the public/private key, this is mostly | ||
| 443 | * for smart cards. */ | ||
| 444 | if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) && | ||
| 445 | (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) & | ||
| 446 | RSA_METHOD_FLAG_NO_CHECK)) | ||
| 447 | ok=1; | ||
| 448 | else | ||
| 449 | #endif | ||
| 450 | { | ||
| 451 | if (!X509_check_private_key(x,c->pkeys[i].privatekey)) | ||
| 452 | { | ||
| 453 | if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA)) | ||
| 454 | { | ||
| 455 | i=(i == SSL_PKEY_DH_RSA)? | ||
| 456 | SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA; | ||
| 457 | |||
| 458 | if (c->pkeys[i].privatekey == NULL) | ||
| 459 | ok=1; | ||
| 460 | else | ||
| 461 | { | ||
| 462 | if (!X509_check_private_key(x, | ||
| 463 | c->pkeys[i].privatekey)) | ||
| 464 | bad=1; | ||
| 465 | else | ||
| 466 | ok=1; | ||
| 467 | } | ||
| 468 | } | ||
| 469 | else | ||
| 470 | bad=1; | ||
| 471 | } | ||
| 472 | else | ||
| 473 | ok=1; | ||
| 474 | } /* NO_RSA */ | ||
| 475 | } | ||
| 476 | else | ||
| 477 | ok=1; | ||
| 478 | |||
| 479 | EVP_PKEY_free(pkey); | ||
| 480 | if (bad) | ||
| 481 | { | ||
| 482 | EVP_PKEY_free(c->pkeys[i].privatekey); | ||
| 483 | c->pkeys[i].privatekey=NULL; | ||
| 484 | } | ||
| 485 | |||
| 486 | if (c->pkeys[i].x509 != NULL) | ||
| 487 | X509_free(c->pkeys[i].x509); | ||
| 488 | CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); | ||
| 489 | c->pkeys[i].x509=x; | ||
| 490 | c->key= &(c->pkeys[i]); | ||
| 491 | |||
| 492 | c->valid=0; | ||
| 493 | return(1); | ||
| 494 | } | ||
| 495 | |||
| 496 | #ifndef NO_STDIO | ||
| 497 | int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) | ||
| 498 | { | ||
| 499 | int j; | ||
| 500 | BIO *in; | ||
| 501 | int ret=0; | ||
| 502 | X509 *x=NULL; | ||
| 503 | |||
| 504 | in=BIO_new(BIO_s_file_internal()); | ||
| 505 | if (in == NULL) | ||
| 506 | { | ||
| 507 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB); | ||
| 508 | goto end; | ||
| 509 | } | ||
| 510 | |||
| 511 | if (BIO_read_filename(in,file) <= 0) | ||
| 512 | { | ||
| 513 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB); | ||
| 514 | goto end; | ||
| 515 | } | ||
| 516 | if (type == SSL_FILETYPE_ASN1) | ||
| 517 | { | ||
| 518 | j=ERR_R_ASN1_LIB; | ||
| 519 | x=d2i_X509_bio(in,NULL); | ||
| 520 | } | ||
| 521 | else if (type == SSL_FILETYPE_PEM) | ||
| 522 | { | ||
| 523 | j=ERR_R_PEM_LIB; | ||
| 524 | x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); | ||
| 525 | } | ||
| 526 | else | ||
| 527 | { | ||
| 528 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE); | ||
| 529 | goto end; | ||
| 530 | } | ||
| 531 | |||
| 532 | if (x == NULL) | ||
| 533 | { | ||
| 534 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,j); | ||
| 535 | goto end; | ||
| 536 | } | ||
| 537 | |||
| 538 | ret=SSL_CTX_use_certificate(ctx,x); | ||
| 539 | end: | ||
| 540 | if (x != NULL) X509_free(x); | ||
| 541 | if (in != NULL) BIO_free(in); | ||
| 542 | return(ret); | ||
| 543 | } | ||
| 544 | #endif | ||
| 545 | |||
| 546 | int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d) | ||
| 547 | { | ||
| 548 | X509 *x; | ||
| 549 | int ret; | ||
| 550 | |||
| 551 | x=d2i_X509(NULL,&d,(long)len); | ||
| 552 | if (x == NULL) | ||
| 553 | { | ||
| 554 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); | ||
| 555 | return(0); | ||
| 556 | } | ||
| 557 | |||
| 558 | ret=SSL_CTX_use_certificate(ctx,x); | ||
| 559 | X509_free(x); | ||
| 560 | return(ret); | ||
| 561 | } | ||
| 562 | |||
| 563 | #ifndef NO_RSA | ||
| 564 | int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) | ||
| 565 | { | ||
| 566 | int ret; | ||
| 567 | EVP_PKEY *pkey; | ||
| 568 | |||
| 569 | if (rsa == NULL) | ||
| 570 | { | ||
| 571 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); | ||
| 572 | return(0); | ||
| 573 | } | ||
| 574 | if (!ssl_cert_inst(&ctx->cert)) | ||
| 575 | { | ||
| 576 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); | ||
| 577 | return(0); | ||
| 578 | } | ||
| 579 | if ((pkey=EVP_PKEY_new()) == NULL) | ||
| 580 | { | ||
| 581 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB); | ||
| 582 | return(0); | ||
| 583 | } | ||
| 584 | |||
| 585 | CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA); | ||
| 586 | EVP_PKEY_assign_RSA(pkey,rsa); | ||
| 587 | |||
| 588 | ret=ssl_set_pkey(ctx->cert, pkey); | ||
| 589 | EVP_PKEY_free(pkey); | ||
| 590 | return(ret); | ||
| 591 | } | ||
| 592 | |||
| 593 | #ifndef NO_STDIO | ||
| 594 | int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) | ||
| 595 | { | ||
| 596 | int j,ret=0; | ||
| 597 | BIO *in; | ||
| 598 | RSA *rsa=NULL; | ||
| 599 | |||
| 600 | in=BIO_new(BIO_s_file_internal()); | ||
| 601 | if (in == NULL) | ||
| 602 | { | ||
| 603 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB); | ||
| 604 | goto end; | ||
| 605 | } | ||
| 606 | |||
| 607 | if (BIO_read_filename(in,file) <= 0) | ||
| 608 | { | ||
| 609 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB); | ||
| 610 | goto end; | ||
| 611 | } | ||
| 612 | if (type == SSL_FILETYPE_ASN1) | ||
| 613 | { | ||
| 614 | j=ERR_R_ASN1_LIB; | ||
| 615 | rsa=d2i_RSAPrivateKey_bio(in,NULL); | ||
| 616 | } | ||
| 617 | else if (type == SSL_FILETYPE_PEM) | ||
| 618 | { | ||
| 619 | j=ERR_R_PEM_LIB; | ||
| 620 | rsa=PEM_read_bio_RSAPrivateKey(in,NULL, | ||
| 621 | ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); | ||
| 622 | } | ||
| 623 | else | ||
| 624 | { | ||
| 625 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); | ||
| 626 | goto end; | ||
| 627 | } | ||
| 628 | if (rsa == NULL) | ||
| 629 | { | ||
| 630 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,j); | ||
| 631 | goto end; | ||
| 632 | } | ||
| 633 | ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); | ||
| 634 | RSA_free(rsa); | ||
| 635 | end: | ||
| 636 | if (in != NULL) BIO_free(in); | ||
| 637 | return(ret); | ||
| 638 | } | ||
| 639 | #endif | ||
| 640 | |||
| 641 | int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len) | ||
| 642 | { | ||
| 643 | int ret; | ||
| 644 | unsigned char *p; | ||
| 645 | RSA *rsa; | ||
| 646 | |||
| 647 | p=d; | ||
| 648 | if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) | ||
| 649 | { | ||
| 650 | SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); | ||
| 651 | return(0); | ||
| 652 | } | ||
| 653 | |||
| 654 | ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); | ||
| 655 | RSA_free(rsa); | ||
| 656 | return(ret); | ||
| 657 | } | ||
| 658 | #endif /* !NO_RSA */ | ||
| 659 | |||
| 660 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) | ||
| 661 | { | ||
| 662 | if (pkey == NULL) | ||
| 663 | { | ||
| 664 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); | ||
| 665 | return(0); | ||
| 666 | } | ||
| 667 | if (!ssl_cert_inst(&ctx->cert)) | ||
| 668 | { | ||
| 669 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE); | ||
| 670 | return(0); | ||
| 671 | } | ||
| 672 | return(ssl_set_pkey(ctx->cert,pkey)); | ||
| 673 | } | ||
| 674 | |||
| 675 | #ifndef NO_STDIO | ||
| 676 | int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) | ||
| 677 | { | ||
| 678 | int j,ret=0; | ||
| 679 | BIO *in; | ||
| 680 | EVP_PKEY *pkey=NULL; | ||
| 681 | |||
| 682 | in=BIO_new(BIO_s_file_internal()); | ||
| 683 | if (in == NULL) | ||
| 684 | { | ||
| 685 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB); | ||
| 686 | goto end; | ||
| 687 | } | ||
| 688 | |||
| 689 | if (BIO_read_filename(in,file) <= 0) | ||
| 690 | { | ||
| 691 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB); | ||
| 692 | goto end; | ||
| 693 | } | ||
| 694 | if (type == SSL_FILETYPE_PEM) | ||
| 695 | { | ||
| 696 | j=ERR_R_PEM_LIB; | ||
| 697 | pkey=PEM_read_bio_PrivateKey(in,NULL, | ||
| 698 | ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); | ||
| 699 | } | ||
| 700 | else | ||
| 701 | { | ||
| 702 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE); | ||
| 703 | goto end; | ||
| 704 | } | ||
| 705 | if (pkey == NULL) | ||
| 706 | { | ||
| 707 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,j); | ||
| 708 | goto end; | ||
| 709 | } | ||
| 710 | ret=SSL_CTX_use_PrivateKey(ctx,pkey); | ||
| 711 | EVP_PKEY_free(pkey); | ||
| 712 | end: | ||
| 713 | if (in != NULL) BIO_free(in); | ||
| 714 | return(ret); | ||
| 715 | } | ||
| 716 | #endif | ||
| 717 | |||
| 718 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, unsigned char *d, | ||
| 719 | long len) | ||
| 720 | { | ||
| 721 | int ret; | ||
| 722 | unsigned char *p; | ||
| 723 | EVP_PKEY *pkey; | ||
| 724 | |||
| 725 | p=d; | ||
| 726 | if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) | ||
| 727 | { | ||
| 728 | SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); | ||
| 729 | return(0); | ||
| 730 | } | ||
| 731 | |||
| 732 | ret=SSL_CTX_use_PrivateKey(ctx,pkey); | ||
| 733 | EVP_PKEY_free(pkey); | ||
| 734 | return(ret); | ||
| 735 | } | ||
| 736 | |||
| 737 | |||
| 738 | #ifndef NO_STDIO | ||
| 739 | /* Read a file that contains our certificate in "PEM" format, | ||
| 740 | * possibly followed by a sequence of CA certificates that should be | ||
| 741 | * sent to the peer in the Certificate message. | ||
| 742 | */ | ||
| 743 | int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) | ||
| 744 | { | ||
| 745 | BIO *in; | ||
| 746 | int ret=0; | ||
| 747 | X509 *x=NULL; | ||
| 748 | |||
| 749 | in=BIO_new(BIO_s_file_internal()); | ||
| 750 | if (in == NULL) | ||
| 751 | { | ||
| 752 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB); | ||
| 753 | goto end; | ||
| 754 | } | ||
| 755 | |||
| 756 | if (BIO_read_filename(in,file) <= 0) | ||
| 757 | { | ||
| 758 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_SYS_LIB); | ||
| 759 | goto end; | ||
| 760 | } | ||
| 761 | |||
| 762 | x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); | ||
| 763 | if (x == NULL) | ||
| 764 | { | ||
| 765 | SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB); | ||
| 766 | goto end; | ||
| 767 | } | ||
| 768 | |||
| 769 | ret=SSL_CTX_use_certificate(ctx,x); | ||
| 770 | if (ERR_peek_error() != 0) | ||
| 771 | ret = 0; /* Key/certificate mismatch doesn't imply ret==0 ... */ | ||
| 772 | if (ret) | ||
| 773 | { | ||
| 774 | /* If we could set up our certificate, now proceed to | ||
| 775 | * the CA certificates. | ||
| 776 | */ | ||
| 777 | X509 *ca; | ||
| 778 | int r; | ||
| 779 | unsigned long err; | ||
| 780 | |||
| 781 | if (ctx->extra_certs != NULL) | ||
| 782 | { | ||
| 783 | sk_X509_pop_free(ctx->extra_certs, X509_free); | ||
| 784 | ctx->extra_certs = NULL; | ||
| 785 | } | ||
| 786 | |||
| 787 | while ((ca = PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata)) | ||
| 788 | != NULL) | ||
| 789 | { | ||
| 790 | r = SSL_CTX_add_extra_chain_cert(ctx, ca); | ||
| 791 | if (!r) | ||
| 792 | { | ||
| 793 | X509_free(ca); | ||
| 794 | ret = 0; | ||
| 795 | goto end; | ||
| 796 | } | ||
| 797 | /* Note that we must not free r if it was successfully | ||
| 798 | * added to the chain (while we must free the main | ||
| 799 | * certificate, since its reference count is increased | ||
| 800 | * by SSL_CTX_use_certificate). */ | ||
| 801 | } | ||
| 802 | /* When the while loop ends, it's usually just EOF. */ | ||
| 803 | err = ERR_peek_error(); | ||
| 804 | if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) | ||
| 805 | (void) ERR_get_error(); | ||
| 806 | else | ||
| 807 | ret = 0; /* some real error */ | ||
| 808 | } | ||
| 809 | |||
| 810 | end: | ||
| 811 | if (x != NULL) X509_free(x); | ||
| 812 | if (in != NULL) BIO_free(in); | ||
| 813 | return(ret); | ||
| 814 | } | ||
| 815 | #endif | ||
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c deleted file mode 100644 index 7064262def..0000000000 --- a/src/lib/libssl/ssl_sess.c +++ /dev/null | |||
| @@ -1,681 +0,0 @@ | |||
| 1 | /* ssl/ssl_sess.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/lhash.h> | ||
| 61 | #include <openssl/rand.h> | ||
| 62 | #include "ssl_locl.h" | ||
| 63 | |||
| 64 | static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s); | ||
| 65 | static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s); | ||
| 66 | static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck); | ||
| 67 | static int ssl_session_num=0; | ||
| 68 | static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_session_meth=NULL; | ||
| 69 | |||
| 70 | SSL_SESSION *SSL_get_session(SSL *ssl) | ||
| 71 | /* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */ | ||
| 72 | { | ||
| 73 | return(ssl->session); | ||
| 74 | } | ||
| 75 | |||
| 76 | SSL_SESSION *SSL_get1_session(SSL *ssl) | ||
| 77 | /* variant of SSL_get_session: caller really gets something */ | ||
| 78 | { | ||
| 79 | SSL_SESSION *sess; | ||
| 80 | /* Need to lock this all up rather than just use CRYPTO_add so that | ||
| 81 | * somebody doesn't free ssl->session between when we check it's | ||
| 82 | * non-null and when we up the reference count. */ | ||
| 83 | CRYPTO_r_lock(CRYPTO_LOCK_SSL_SESSION); | ||
| 84 | sess = ssl->session; | ||
| 85 | if(sess) | ||
| 86 | sess->references++; | ||
| 87 | CRYPTO_r_unlock(CRYPTO_LOCK_SSL_SESSION); | ||
| 88 | return(sess); | ||
| 89 | } | ||
| 90 | |||
| 91 | int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, | ||
| 92 | CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func) | ||
| 93 | { | ||
| 94 | ssl_session_num++; | ||
| 95 | return(CRYPTO_get_ex_new_index(ssl_session_num-1, | ||
| 96 | &ssl_session_meth, | ||
| 97 | argl,argp,new_func,dup_func,free_func)); | ||
| 98 | } | ||
| 99 | |||
| 100 | int SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg) | ||
| 101 | { | ||
| 102 | return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); | ||
| 103 | } | ||
| 104 | |||
| 105 | void *SSL_SESSION_get_ex_data(SSL_SESSION *s, int idx) | ||
| 106 | { | ||
| 107 | return(CRYPTO_get_ex_data(&s->ex_data,idx)); | ||
| 108 | } | ||
| 109 | |||
| 110 | SSL_SESSION *SSL_SESSION_new(void) | ||
| 111 | { | ||
| 112 | SSL_SESSION *ss; | ||
| 113 | |||
| 114 | ss=(SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION)); | ||
| 115 | if (ss == NULL) | ||
| 116 | { | ||
| 117 | SSLerr(SSL_F_SSL_SESSION_NEW,ERR_R_MALLOC_FAILURE); | ||
| 118 | return(0); | ||
| 119 | } | ||
| 120 | memset(ss,0,sizeof(SSL_SESSION)); | ||
| 121 | |||
| 122 | ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */ | ||
| 123 | ss->references=1; | ||
| 124 | ss->timeout=60*5+4; /* 5 minute timeout by default */ | ||
| 125 | ss->time=time(NULL); | ||
| 126 | ss->prev=NULL; | ||
| 127 | ss->next=NULL; | ||
| 128 | ss->compress_meth=0; | ||
| 129 | CRYPTO_new_ex_data(ssl_session_meth,ss,&ss->ex_data); | ||
| 130 | return(ss); | ||
| 131 | } | ||
| 132 | |||
| 133 | int ssl_get_new_session(SSL *s, int session) | ||
| 134 | { | ||
| 135 | /* This gets used by clients and servers. */ | ||
| 136 | |||
| 137 | SSL_SESSION *ss=NULL; | ||
| 138 | |||
| 139 | if ((ss=SSL_SESSION_new()) == NULL) return(0); | ||
| 140 | |||
| 141 | /* If the context has a default timeout, use it */ | ||
| 142 | if (s->ctx->session_timeout == 0) | ||
| 143 | ss->timeout=SSL_get_default_timeout(s); | ||
| 144 | else | ||
| 145 | ss->timeout=s->ctx->session_timeout; | ||
| 146 | |||
| 147 | if (s->session != NULL) | ||
| 148 | { | ||
| 149 | SSL_SESSION_free(s->session); | ||
| 150 | s->session=NULL; | ||
| 151 | } | ||
| 152 | |||
| 153 | if (session) | ||
| 154 | { | ||
| 155 | if (s->version == SSL2_VERSION) | ||
| 156 | { | ||
| 157 | ss->ssl_version=SSL2_VERSION; | ||
| 158 | ss->session_id_length=SSL2_SSL_SESSION_ID_LENGTH; | ||
| 159 | } | ||
| 160 | else if (s->version == SSL3_VERSION) | ||
| 161 | { | ||
| 162 | ss->ssl_version=SSL3_VERSION; | ||
| 163 | ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; | ||
| 164 | } | ||
| 165 | else if (s->version == TLS1_VERSION) | ||
| 166 | { | ||
| 167 | ss->ssl_version=TLS1_VERSION; | ||
| 168 | ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; | ||
| 169 | } | ||
| 170 | else | ||
| 171 | { | ||
| 172 | SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION); | ||
| 173 | SSL_SESSION_free(ss); | ||
| 174 | return(0); | ||
| 175 | } | ||
| 176 | |||
| 177 | for (;;) | ||
| 178 | { | ||
| 179 | SSL_SESSION *r; | ||
| 180 | |||
| 181 | RAND_pseudo_bytes(ss->session_id,ss->session_id_length); | ||
| 182 | CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); | ||
| 183 | r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions, ss); | ||
| 184 | CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); | ||
| 185 | if (r == NULL) break; | ||
| 186 | /* else - woops a session_id match */ | ||
| 187 | /* XXX We should also check the external cache -- | ||
| 188 | * but the probability of a collision is negligible, and | ||
| 189 | * we could not prevent the concurrent creation of sessions | ||
| 190 | * with identical IDs since we currently don't have means | ||
| 191 | * to atomically check whether a session ID already exists | ||
| 192 | * and make a reservation for it if it does not | ||
| 193 | * (this problem applies to the internal cache as well). | ||
| 194 | */ | ||
| 195 | } | ||
| 196 | } | ||
| 197 | else | ||
| 198 | { | ||
| 199 | ss->session_id_length=0; | ||
| 200 | } | ||
| 201 | |||
| 202 | memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length); | ||
| 203 | ss->sid_ctx_length=s->sid_ctx_length; | ||
| 204 | s->session=ss; | ||
| 205 | ss->ssl_version=s->version; | ||
| 206 | ss->verify_result = X509_V_OK; | ||
| 207 | |||
| 208 | return(1); | ||
| 209 | } | ||
| 210 | |||
| 211 | int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len) | ||
| 212 | { | ||
| 213 | /* This is used only by servers. */ | ||
| 214 | |||
| 215 | SSL_SESSION *ret=NULL,data; | ||
| 216 | int fatal = 0; | ||
| 217 | |||
| 218 | data.ssl_version=s->version; | ||
| 219 | data.session_id_length=len; | ||
| 220 | if (len > SSL_MAX_SSL_SESSION_ID_LENGTH) | ||
| 221 | goto err; | ||
| 222 | memcpy(data.session_id,session_id,len); | ||
| 223 | |||
| 224 | if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) | ||
| 225 | { | ||
| 226 | CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); | ||
| 227 | ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,&data); | ||
| 228 | if (ret != NULL) | ||
| 229 | /* don't allow other threads to steal it: */ | ||
| 230 | CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); | ||
| 231 | CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); | ||
| 232 | } | ||
| 233 | |||
| 234 | if (ret == NULL) | ||
| 235 | { | ||
| 236 | int copy=1; | ||
| 237 | |||
| 238 | s->ctx->stats.sess_miss++; | ||
| 239 | ret=NULL; | ||
| 240 | if (s->ctx->get_session_cb != NULL | ||
| 241 | && (ret=s->ctx->get_session_cb(s,session_id,len,©)) | ||
| 242 | != NULL) | ||
| 243 | { | ||
| 244 | s->ctx->stats.sess_cb_hit++; | ||
| 245 | |||
| 246 | /* Increment reference count now if the session callback | ||
| 247 | * asks us to do so (note that if the session structures | ||
| 248 | * returned by the callback are shared between threads, | ||
| 249 | * it must handle the reference count itself [i.e. copy == 0], | ||
| 250 | * or things won't be thread-safe). */ | ||
| 251 | if (copy) | ||
| 252 | CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); | ||
| 253 | |||
| 254 | /* The following should not return 1, otherwise, | ||
| 255 | * things are very strange */ | ||
| 256 | SSL_CTX_add_session(s->ctx,ret); | ||
| 257 | } | ||
| 258 | if (ret == NULL) | ||
| 259 | goto err; | ||
| 260 | } | ||
| 261 | |||
| 262 | /* Now ret is non-NULL, and we own one of its reference counts. */ | ||
| 263 | |||
| 264 | if((s->verify_mode&SSL_VERIFY_PEER) | ||
| 265 | && (!s->sid_ctx_length || ret->sid_ctx_length != s->sid_ctx_length | ||
| 266 | || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length))) | ||
| 267 | { | ||
| 268 | /* We've found the session named by the client, but we don't | ||
| 269 | * want to use it in this context. */ | ||
| 270 | |||
| 271 | if (s->sid_ctx_length == 0) | ||
| 272 | { | ||
| 273 | /* application should have used SSL[_CTX]_set_session_id_context | ||
| 274 | * -- we could tolerate this and just pretend we never heard | ||
| 275 | * of this session, but then applications could effectively | ||
| 276 | * disable the session cache by accident without anyone noticing */ | ||
| 277 | |||
| 278 | SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED); | ||
| 279 | fatal = 1; | ||
| 280 | goto err; | ||
| 281 | } | ||
| 282 | else | ||
| 283 | { | ||
| 284 | #if 0 /* The client cannot always know when a session is not appropriate, | ||
| 285 | * so we shouldn't generate an error message. */ | ||
| 286 | |||
| 287 | SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); | ||
| 288 | #endif | ||
| 289 | goto err; /* treat like cache miss */ | ||
| 290 | } | ||
| 291 | } | ||
| 292 | |||
| 293 | if (ret->cipher == NULL) | ||
| 294 | { | ||
| 295 | unsigned char buf[5],*p; | ||
| 296 | unsigned long l; | ||
| 297 | |||
| 298 | p=buf; | ||
| 299 | l=ret->cipher_id; | ||
| 300 | l2n(l,p); | ||
| 301 | if ((ret->ssl_version>>8) == SSL3_VERSION_MAJOR) | ||
| 302 | ret->cipher=ssl_get_cipher_by_char(s,&(buf[2])); | ||
| 303 | else | ||
| 304 | ret->cipher=ssl_get_cipher_by_char(s,&(buf[1])); | ||
| 305 | if (ret->cipher == NULL) | ||
| 306 | goto err; | ||
| 307 | } | ||
| 308 | |||
| 309 | |||
| 310 | #if 0 /* This is way too late. */ | ||
| 311 | |||
| 312 | /* If a thread got the session, then 'swaped', and another got | ||
| 313 | * it and then due to a time-out decided to 'OPENSSL_free' it we could | ||
| 314 | * be in trouble. So I'll increment it now, then double decrement | ||
| 315 | * later - am I speaking rubbish?. */ | ||
| 316 | CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); | ||
| 317 | #endif | ||
| 318 | |||
| 319 | if ((long)(ret->time+ret->timeout) < (long)time(NULL)) /* timeout */ | ||
| 320 | { | ||
| 321 | s->ctx->stats.sess_timeout++; | ||
| 322 | /* remove it from the cache */ | ||
| 323 | SSL_CTX_remove_session(s->ctx,ret); | ||
| 324 | goto err; | ||
| 325 | } | ||
| 326 | |||
| 327 | s->ctx->stats.sess_hit++; | ||
| 328 | |||
| 329 | /* ret->time=time(NULL); */ /* rezero timeout? */ | ||
| 330 | /* again, just leave the session | ||
| 331 | * if it is the same session, we have just incremented and | ||
| 332 | * then decremented the reference count :-) */ | ||
| 333 | if (s->session != NULL) | ||
| 334 | SSL_SESSION_free(s->session); | ||
| 335 | s->session=ret; | ||
| 336 | s->verify_result = s->session->verify_result; | ||
| 337 | return(1); | ||
| 338 | |||
| 339 | err: | ||
| 340 | if (ret != NULL) | ||
| 341 | SSL_SESSION_free(ret); | ||
| 342 | if (fatal) | ||
| 343 | return -1; | ||
| 344 | else | ||
| 345 | return 0; | ||
| 346 | } | ||
| 347 | |||
| 348 | int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c) | ||
| 349 | { | ||
| 350 | int ret=0; | ||
| 351 | SSL_SESSION *s; | ||
| 352 | |||
| 353 | /* add just 1 reference count for the SSL_CTX's session cache | ||
| 354 | * even though it has two ways of access: each session is in a | ||
| 355 | * doubly linked list and an lhash */ | ||
| 356 | CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION); | ||
| 357 | /* if session c is in already in cache, we take back the increment later */ | ||
| 358 | |||
| 359 | CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); | ||
| 360 | s=(SSL_SESSION *)lh_insert(ctx->sessions,c); | ||
| 361 | |||
| 362 | /* s != NULL iff we already had a session with the given PID. | ||
| 363 | * In this case, s == c should hold (then we did not really modify | ||
| 364 | * ctx->sessions), or we're in trouble. */ | ||
| 365 | if (s != NULL && s != c) | ||
| 366 | { | ||
| 367 | /* We *are* in trouble ... */ | ||
| 368 | SSL_SESSION_list_remove(ctx,s); | ||
| 369 | SSL_SESSION_free(s); | ||
| 370 | /* ... so pretend the other session did not exist in cache | ||
| 371 | * (we cannot handle two SSL_SESSION structures with identical | ||
| 372 | * session ID in the same cache, which could happen e.g. when | ||
| 373 | * two threads concurrently obtain the same session from an external | ||
| 374 | * cache) */ | ||
| 375 | s = NULL; | ||
| 376 | } | ||
| 377 | |||
| 378 | /* Put at the head of the queue unless it is already in the cache */ | ||
| 379 | if (s == NULL) | ||
| 380 | SSL_SESSION_list_add(ctx,c); | ||
| 381 | |||
| 382 | if (s != NULL) | ||
| 383 | { | ||
| 384 | /* existing cache entry -- decrement previously incremented reference | ||
| 385 | * count because it already takes into account the cache */ | ||
| 386 | |||
| 387 | SSL_SESSION_free(s); /* s == c */ | ||
| 388 | ret=0; | ||
| 389 | } | ||
| 390 | else | ||
| 391 | { | ||
| 392 | /* new cache entry -- remove old ones if cache has become too large */ | ||
| 393 | |||
| 394 | ret=1; | ||
| 395 | |||
| 396 | if (SSL_CTX_sess_get_cache_size(ctx) > 0) | ||
| 397 | { | ||
| 398 | while (SSL_CTX_sess_number(ctx) > | ||
| 399 | SSL_CTX_sess_get_cache_size(ctx)) | ||
| 400 | { | ||
| 401 | if (!remove_session_lock(ctx, | ||
| 402 | ctx->session_cache_tail, 0)) | ||
| 403 | break; | ||
| 404 | else | ||
| 405 | ctx->stats.sess_cache_full++; | ||
| 406 | } | ||
| 407 | } | ||
| 408 | } | ||
| 409 | CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); | ||
| 410 | return(ret); | ||
| 411 | } | ||
| 412 | |||
| 413 | int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c) | ||
| 414 | { | ||
| 415 | return remove_session_lock(ctx, c, 1); | ||
| 416 | } | ||
| 417 | |||
| 418 | static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck) | ||
| 419 | { | ||
| 420 | SSL_SESSION *r; | ||
| 421 | int ret=0; | ||
| 422 | |||
| 423 | if ((c != NULL) && (c->session_id_length != 0)) | ||
| 424 | { | ||
| 425 | if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); | ||
| 426 | r=(SSL_SESSION *)lh_delete(ctx->sessions,c); | ||
| 427 | if (r != NULL) | ||
| 428 | { | ||
| 429 | ret=1; | ||
| 430 | SSL_SESSION_list_remove(ctx,c); | ||
| 431 | } | ||
| 432 | |||
| 433 | if(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); | ||
| 434 | |||
| 435 | if (ret) | ||
| 436 | { | ||
| 437 | r->not_resumable=1; | ||
| 438 | if (ctx->remove_session_cb != NULL) | ||
| 439 | ctx->remove_session_cb(ctx,r); | ||
| 440 | SSL_SESSION_free(r); | ||
| 441 | } | ||
| 442 | } | ||
| 443 | else | ||
| 444 | ret=0; | ||
| 445 | return(ret); | ||
| 446 | } | ||
| 447 | |||
| 448 | void SSL_SESSION_free(SSL_SESSION *ss) | ||
| 449 | { | ||
| 450 | int i; | ||
| 451 | |||
| 452 | if(ss == NULL) | ||
| 453 | return; | ||
| 454 | |||
| 455 | i=CRYPTO_add(&ss->references,-1,CRYPTO_LOCK_SSL_SESSION); | ||
| 456 | #ifdef REF_PRINT | ||
| 457 | REF_PRINT("SSL_SESSION",ss); | ||
| 458 | #endif | ||
| 459 | if (i > 0) return; | ||
| 460 | #ifdef REF_CHECK | ||
| 461 | if (i < 0) | ||
| 462 | { | ||
| 463 | fprintf(stderr,"SSL_SESSION_free, bad reference count\n"); | ||
| 464 | abort(); /* ok */ | ||
| 465 | } | ||
| 466 | #endif | ||
| 467 | |||
| 468 | CRYPTO_free_ex_data(ssl_session_meth,ss,&ss->ex_data); | ||
| 469 | |||
| 470 | memset(ss->key_arg,0,SSL_MAX_KEY_ARG_LENGTH); | ||
| 471 | memset(ss->master_key,0,SSL_MAX_MASTER_KEY_LENGTH); | ||
| 472 | memset(ss->session_id,0,SSL_MAX_SSL_SESSION_ID_LENGTH); | ||
| 473 | if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert); | ||
| 474 | if (ss->peer != NULL) X509_free(ss->peer); | ||
| 475 | if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers); | ||
| 476 | memset(ss,0,sizeof(*ss)); | ||
| 477 | OPENSSL_free(ss); | ||
| 478 | } | ||
| 479 | |||
| 480 | int SSL_set_session(SSL *s, SSL_SESSION *session) | ||
| 481 | { | ||
| 482 | int ret=0; | ||
| 483 | SSL_METHOD *meth; | ||
| 484 | |||
| 485 | if (session != NULL) | ||
| 486 | { | ||
| 487 | meth=s->ctx->method->get_ssl_method(session->ssl_version); | ||
| 488 | if (meth == NULL) | ||
| 489 | meth=s->method->get_ssl_method(session->ssl_version); | ||
| 490 | if (meth == NULL) | ||
| 491 | { | ||
| 492 | SSLerr(SSL_F_SSL_SET_SESSION,SSL_R_UNABLE_TO_FIND_SSL_METHOD); | ||
| 493 | return(0); | ||
| 494 | } | ||
| 495 | |||
| 496 | if (meth != s->method) | ||
| 497 | { | ||
| 498 | if (!SSL_set_ssl_method(s,meth)) | ||
| 499 | return(0); | ||
| 500 | if (s->ctx->session_timeout == 0) | ||
| 501 | session->timeout=SSL_get_default_timeout(s); | ||
| 502 | else | ||
| 503 | session->timeout=s->ctx->session_timeout; | ||
| 504 | } | ||
| 505 | |||
| 506 | /* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/ | ||
| 507 | CRYPTO_add(&session->references,1,CRYPTO_LOCK_SSL_SESSION); | ||
| 508 | if (s->session != NULL) | ||
| 509 | SSL_SESSION_free(s->session); | ||
| 510 | s->session=session; | ||
| 511 | s->verify_result = s->session->verify_result; | ||
| 512 | /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/ | ||
| 513 | ret=1; | ||
| 514 | } | ||
| 515 | else | ||
| 516 | { | ||
| 517 | if (s->session != NULL) | ||
| 518 | { | ||
| 519 | SSL_SESSION_free(s->session); | ||
| 520 | s->session=NULL; | ||
| 521 | } | ||
| 522 | |||
| 523 | meth=s->ctx->method; | ||
| 524 | if (meth != s->method) | ||
| 525 | { | ||
| 526 | if (!SSL_set_ssl_method(s,meth)) | ||
| 527 | return(0); | ||
| 528 | } | ||
| 529 | ret=1; | ||
| 530 | } | ||
| 531 | return(ret); | ||
| 532 | } | ||
| 533 | |||
| 534 | long SSL_SESSION_set_timeout(SSL_SESSION *s, long t) | ||
| 535 | { | ||
| 536 | if (s == NULL) return(0); | ||
| 537 | s->timeout=t; | ||
| 538 | return(1); | ||
| 539 | } | ||
| 540 | |||
| 541 | long SSL_SESSION_get_timeout(SSL_SESSION *s) | ||
| 542 | { | ||
| 543 | if (s == NULL) return(0); | ||
| 544 | return(s->timeout); | ||
| 545 | } | ||
| 546 | |||
| 547 | long SSL_SESSION_get_time(SSL_SESSION *s) | ||
| 548 | { | ||
| 549 | if (s == NULL) return(0); | ||
| 550 | return(s->time); | ||
| 551 | } | ||
| 552 | |||
| 553 | long SSL_SESSION_set_time(SSL_SESSION *s, long t) | ||
| 554 | { | ||
| 555 | if (s == NULL) return(0); | ||
| 556 | s->time=t; | ||
| 557 | return(t); | ||
| 558 | } | ||
| 559 | |||
| 560 | long SSL_CTX_set_timeout(SSL_CTX *s, long t) | ||
| 561 | { | ||
| 562 | long l; | ||
| 563 | if (s == NULL) return(0); | ||
| 564 | l=s->session_timeout; | ||
| 565 | s->session_timeout=t; | ||
| 566 | return(l); | ||
| 567 | } | ||
| 568 | |||
| 569 | long SSL_CTX_get_timeout(SSL_CTX *s) | ||
| 570 | { | ||
| 571 | if (s == NULL) return(0); | ||
| 572 | return(s->session_timeout); | ||
| 573 | } | ||
| 574 | |||
| 575 | typedef struct timeout_param_st | ||
| 576 | { | ||
| 577 | SSL_CTX *ctx; | ||
| 578 | long time; | ||
| 579 | LHASH *cache; | ||
| 580 | } TIMEOUT_PARAM; | ||
| 581 | |||
| 582 | static void timeout(SSL_SESSION *s, TIMEOUT_PARAM *p) | ||
| 583 | { | ||
| 584 | if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */ | ||
| 585 | { | ||
| 586 | /* The reason we don't call SSL_CTX_remove_session() is to | ||
| 587 | * save on locking overhead */ | ||
| 588 | lh_delete(p->cache,s); | ||
| 589 | SSL_SESSION_list_remove(p->ctx,s); | ||
| 590 | s->not_resumable=1; | ||
| 591 | if (p->ctx->remove_session_cb != NULL) | ||
| 592 | p->ctx->remove_session_cb(p->ctx,s); | ||
| 593 | SSL_SESSION_free(s); | ||
| 594 | } | ||
| 595 | } | ||
| 596 | |||
| 597 | void SSL_CTX_flush_sessions(SSL_CTX *s, long t) | ||
| 598 | { | ||
| 599 | unsigned long i; | ||
| 600 | TIMEOUT_PARAM tp; | ||
| 601 | |||
| 602 | tp.ctx=s; | ||
| 603 | tp.cache=s->sessions; | ||
| 604 | if (tp.cache == NULL) return; | ||
| 605 | tp.time=t; | ||
| 606 | CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); | ||
| 607 | i=tp.cache->down_load; | ||
| 608 | tp.cache->down_load=0; | ||
| 609 | lh_doall_arg(tp.cache,(void (*)())timeout,&tp); | ||
| 610 | tp.cache->down_load=i; | ||
| 611 | CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); | ||
| 612 | } | ||
| 613 | |||
| 614 | int ssl_clear_bad_session(SSL *s) | ||
| 615 | { | ||
| 616 | if ( (s->session != NULL) && | ||
| 617 | !(s->shutdown & SSL_SENT_SHUTDOWN) && | ||
| 618 | !(SSL_in_init(s) || SSL_in_before(s))) | ||
| 619 | { | ||
| 620 | SSL_CTX_remove_session(s->ctx,s->session); | ||
| 621 | return(1); | ||
| 622 | } | ||
| 623 | else | ||
| 624 | return(0); | ||
| 625 | } | ||
| 626 | |||
| 627 | /* locked by SSL_CTX in the calling function */ | ||
| 628 | static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s) | ||
| 629 | { | ||
| 630 | if ((s->next == NULL) || (s->prev == NULL)) return; | ||
| 631 | |||
| 632 | if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail)) | ||
| 633 | { /* last element in list */ | ||
| 634 | if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) | ||
| 635 | { /* only one element in list */ | ||
| 636 | ctx->session_cache_head=NULL; | ||
| 637 | ctx->session_cache_tail=NULL; | ||
| 638 | } | ||
| 639 | else | ||
| 640 | { | ||
| 641 | ctx->session_cache_tail=s->prev; | ||
| 642 | s->prev->next=(SSL_SESSION *)&(ctx->session_cache_tail); | ||
| 643 | } | ||
| 644 | } | ||
| 645 | else | ||
| 646 | { | ||
| 647 | if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) | ||
| 648 | { /* first element in list */ | ||
| 649 | ctx->session_cache_head=s->next; | ||
| 650 | s->next->prev=(SSL_SESSION *)&(ctx->session_cache_head); | ||
| 651 | } | ||
| 652 | else | ||
| 653 | { /* middle of list */ | ||
| 654 | s->next->prev=s->prev; | ||
| 655 | s->prev->next=s->next; | ||
| 656 | } | ||
| 657 | } | ||
| 658 | s->prev=s->next=NULL; | ||
| 659 | } | ||
| 660 | |||
| 661 | static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s) | ||
| 662 | { | ||
| 663 | if ((s->next != NULL) && (s->prev != NULL)) | ||
| 664 | SSL_SESSION_list_remove(ctx,s); | ||
| 665 | |||
| 666 | if (ctx->session_cache_head == NULL) | ||
| 667 | { | ||
| 668 | ctx->session_cache_head=s; | ||
| 669 | ctx->session_cache_tail=s; | ||
| 670 | s->prev=(SSL_SESSION *)&(ctx->session_cache_head); | ||
| 671 | s->next=(SSL_SESSION *)&(ctx->session_cache_tail); | ||
| 672 | } | ||
| 673 | else | ||
| 674 | { | ||
| 675 | s->next=ctx->session_cache_head; | ||
| 676 | s->next->prev=s; | ||
| 677 | s->prev=(SSL_SESSION *)&(ctx->session_cache_head); | ||
| 678 | ctx->session_cache_head=s; | ||
| 679 | } | ||
| 680 | } | ||
| 681 | |||
diff --git a/src/lib/libssl/ssl_stat.c b/src/lib/libssl/ssl_stat.c deleted file mode 100644 index 8e12461f3b..0000000000 --- a/src/lib/libssl/ssl_stat.c +++ /dev/null | |||
| @@ -1,454 +0,0 @@ | |||
| 1 | /* ssl/ssl_stat.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include "ssl_locl.h" | ||
| 61 | |||
| 62 | char *SSL_state_string_long(SSL *s) | ||
| 63 | { | ||
| 64 | char *str; | ||
| 65 | |||
| 66 | switch (s->state) | ||
| 67 | { | ||
| 68 | case SSL_ST_BEFORE: str="before SSL initialization"; break; | ||
| 69 | case SSL_ST_ACCEPT: str="before accept initialization"; break; | ||
| 70 | case SSL_ST_CONNECT: str="before connect initialization"; break; | ||
| 71 | case SSL_ST_OK: str="SSL negotiation finished successfully"; break; | ||
| 72 | case SSL_ST_RENEGOTIATE: str="SSL renegotiate ciphers"; break; | ||
| 73 | case SSL_ST_BEFORE|SSL_ST_CONNECT: str="before/connect initialization"; break; | ||
| 74 | case SSL_ST_OK|SSL_ST_CONNECT: str="ok/connect SSL initialization"; break; | ||
| 75 | case SSL_ST_BEFORE|SSL_ST_ACCEPT: str="before/accept initialization"; break; | ||
| 76 | case SSL_ST_OK|SSL_ST_ACCEPT: str="ok/accept SSL initialization"; break; | ||
| 77 | #ifndef NO_SSL2 | ||
| 78 | case SSL2_ST_CLIENT_START_ENCRYPTION: str="SSLv2 client start encryption"; break; | ||
| 79 | case SSL2_ST_SERVER_START_ENCRYPTION: str="SSLv2 server start encryption"; break; | ||
| 80 | case SSL2_ST_SEND_CLIENT_HELLO_A: str="SSLv2 write client hello A"; break; | ||
| 81 | case SSL2_ST_SEND_CLIENT_HELLO_B: str="SSLv2 write client hello B"; break; | ||
| 82 | case SSL2_ST_GET_SERVER_HELLO_A: str="SSLv2 read server hello A"; break; | ||
| 83 | case SSL2_ST_GET_SERVER_HELLO_B: str="SSLv2 read server hello B"; break; | ||
| 84 | case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="SSLv2 write client master key A"; break; | ||
| 85 | case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="SSLv2 write client master key B"; break; | ||
| 86 | case SSL2_ST_SEND_CLIENT_FINISHED_A: str="SSLv2 write client finished A"; break; | ||
| 87 | case SSL2_ST_SEND_CLIENT_FINISHED_B: str="SSLv2 write client finished B"; break; | ||
| 88 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="SSLv2 write client certificate A"; break; | ||
| 89 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="SSLv2 write client certificate B"; break; | ||
| 90 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="SSLv2 write client certificate C"; break; | ||
| 91 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="SSLv2 write client certificate D"; break; | ||
| 92 | case SSL2_ST_GET_SERVER_VERIFY_A: str="SSLv2 read server verify A"; break; | ||
| 93 | case SSL2_ST_GET_SERVER_VERIFY_B: str="SSLv2 read server verify B"; break; | ||
| 94 | case SSL2_ST_GET_SERVER_FINISHED_A: str="SSLv2 read server finished A"; break; | ||
| 95 | case SSL2_ST_GET_SERVER_FINISHED_B: str="SSLv2 read server finished B"; break; | ||
| 96 | case SSL2_ST_GET_CLIENT_HELLO_A: str="SSLv2 read client hello A"; break; | ||
| 97 | case SSL2_ST_GET_CLIENT_HELLO_B: str="SSLv2 read client hello B"; break; | ||
| 98 | case SSL2_ST_GET_CLIENT_HELLO_C: str="SSLv2 read client hello C"; break; | ||
| 99 | case SSL2_ST_SEND_SERVER_HELLO_A: str="SSLv2 write server hello A"; break; | ||
| 100 | case SSL2_ST_SEND_SERVER_HELLO_B: str="SSLv2 write server hello B"; break; | ||
| 101 | case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="SSLv2 read client master key A"; break; | ||
| 102 | case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="SSLv2 read client master key B"; break; | ||
| 103 | case SSL2_ST_SEND_SERVER_VERIFY_A: str="SSLv2 write server verify A"; break; | ||
| 104 | case SSL2_ST_SEND_SERVER_VERIFY_B: str="SSLv2 write server verify B"; break; | ||
| 105 | case SSL2_ST_SEND_SERVER_VERIFY_C: str="SSLv2 write server verify C"; break; | ||
| 106 | case SSL2_ST_GET_CLIENT_FINISHED_A: str="SSLv2 read client finished A"; break; | ||
| 107 | case SSL2_ST_GET_CLIENT_FINISHED_B: str="SSLv2 read client finished B"; break; | ||
| 108 | case SSL2_ST_SEND_SERVER_FINISHED_A: str="SSLv2 write server finished A"; break; | ||
| 109 | case SSL2_ST_SEND_SERVER_FINISHED_B: str="SSLv2 write server finished B"; break; | ||
| 110 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="SSLv2 write request certificate A"; break; | ||
| 111 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="SSLv2 write request certificate B"; break; | ||
| 112 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="SSLv2 write request certificate C"; break; | ||
| 113 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="SSLv2 write request certificate D"; break; | ||
| 114 | case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="SSLv2 X509 read server certificate"; break; | ||
| 115 | case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="SSLv2 X509 read client certificate"; break; | ||
| 116 | #endif | ||
| 117 | |||
| 118 | #ifndef NO_SSL3 | ||
| 119 | /* SSLv3 additions */ | ||
| 120 | case SSL3_ST_CW_CLNT_HELLO_A: str="SSLv3 write client hello A"; break; | ||
| 121 | case SSL3_ST_CW_CLNT_HELLO_B: str="SSLv3 write client hello B"; break; | ||
| 122 | case SSL3_ST_CR_SRVR_HELLO_A: str="SSLv3 read server hello A"; break; | ||
| 123 | case SSL3_ST_CR_SRVR_HELLO_B: str="SSLv3 read server hello B"; break; | ||
| 124 | case SSL3_ST_CR_CERT_A: str="SSLv3 read server certificate A"; break; | ||
| 125 | case SSL3_ST_CR_CERT_B: str="SSLv3 read server certificate B"; break; | ||
| 126 | case SSL3_ST_CR_KEY_EXCH_A: str="SSLv3 read server key exchange A"; break; | ||
| 127 | case SSL3_ST_CR_KEY_EXCH_B: str="SSLv3 read server key exchange B"; break; | ||
| 128 | case SSL3_ST_CR_CERT_REQ_A: str="SSLv3 read server certificate request A"; break; | ||
| 129 | case SSL3_ST_CR_CERT_REQ_B: str="SSLv3 read server certificate request B"; break; | ||
| 130 | case SSL3_ST_CR_SRVR_DONE_A: str="SSLv3 read server done A"; break; | ||
| 131 | case SSL3_ST_CR_SRVR_DONE_B: str="SSLv3 read server done B"; break; | ||
| 132 | case SSL3_ST_CW_CERT_A: str="SSLv3 write client certificate A"; break; | ||
| 133 | case SSL3_ST_CW_CERT_B: str="SSLv3 write client certificate B"; break; | ||
| 134 | case SSL3_ST_CW_CERT_C: str="SSLv3 write client certificate C"; break; | ||
| 135 | case SSL3_ST_CW_CERT_D: str="SSLv3 write client certificate D"; break; | ||
| 136 | case SSL3_ST_CW_KEY_EXCH_A: str="SSLv3 write client key exchange A"; break; | ||
| 137 | case SSL3_ST_CW_KEY_EXCH_B: str="SSLv3 write client key exchange B"; break; | ||
| 138 | case SSL3_ST_CW_CERT_VRFY_A: str="SSLv3 write certificate verify A"; break; | ||
| 139 | case SSL3_ST_CW_CERT_VRFY_B: str="SSLv3 write certificate verify A"; break; | ||
| 140 | |||
| 141 | case SSL3_ST_CW_CHANGE_A: | ||
| 142 | case SSL3_ST_SW_CHANGE_A: str="SSLv3 write change cipher spec A"; break; | ||
| 143 | case SSL3_ST_CW_CHANGE_B: | ||
| 144 | case SSL3_ST_SW_CHANGE_B: str="SSLv3 write change cipher spec B"; break; | ||
| 145 | case SSL3_ST_CW_FINISHED_A: | ||
| 146 | case SSL3_ST_SW_FINISHED_A: str="SSLv3 write finished A"; break; | ||
| 147 | case SSL3_ST_CW_FINISHED_B: | ||
| 148 | case SSL3_ST_SW_FINISHED_B: str="SSLv3 write finished A"; break; | ||
| 149 | case SSL3_ST_CR_CHANGE_A: | ||
| 150 | case SSL3_ST_SR_CHANGE_A: str="SSLv3 read change cipher spec A"; break; | ||
| 151 | case SSL3_ST_CR_CHANGE_B: | ||
| 152 | case SSL3_ST_SR_CHANGE_B: str="SSLv3 read change cipher spec B"; break; | ||
| 153 | case SSL3_ST_CR_FINISHED_A: | ||
| 154 | case SSL3_ST_SR_FINISHED_A: str="SSLv3 read finished A"; break; | ||
| 155 | case SSL3_ST_CR_FINISHED_B: | ||
| 156 | case SSL3_ST_SR_FINISHED_B: str="SSLv3 read finished B"; break; | ||
| 157 | |||
| 158 | case SSL3_ST_CW_FLUSH: | ||
| 159 | case SSL3_ST_SW_FLUSH: str="SSLv3 flush data"; break; | ||
| 160 | |||
| 161 | case SSL3_ST_SR_CLNT_HELLO_A: str="SSLv3 read client hello A"; break; | ||
| 162 | case SSL3_ST_SR_CLNT_HELLO_B: str="SSLv3 read client hello B"; break; | ||
| 163 | case SSL3_ST_SR_CLNT_HELLO_C: str="SSLv3 read client hello C"; break; | ||
| 164 | case SSL3_ST_SW_HELLO_REQ_A: str="SSLv3 write hello request A"; break; | ||
| 165 | case SSL3_ST_SW_HELLO_REQ_B: str="SSLv3 write hello request B"; break; | ||
| 166 | case SSL3_ST_SW_HELLO_REQ_C: str="SSLv3 write hello request C"; break; | ||
| 167 | case SSL3_ST_SW_SRVR_HELLO_A: str="SSLv3 write server hello A"; break; | ||
| 168 | case SSL3_ST_SW_SRVR_HELLO_B: str="SSLv3 write server hello B"; break; | ||
| 169 | case SSL3_ST_SW_CERT_A: str="SSLv3 write certificate A"; break; | ||
| 170 | case SSL3_ST_SW_CERT_B: str="SSLv3 write certificate B"; break; | ||
| 171 | case SSL3_ST_SW_KEY_EXCH_A: str="SSLv3 write key exchange A"; break; | ||
| 172 | case SSL3_ST_SW_KEY_EXCH_B: str="SSLv3 write key exchange B"; break; | ||
| 173 | case SSL3_ST_SW_CERT_REQ_A: str="SSLv3 write certificate request A"; break; | ||
| 174 | case SSL3_ST_SW_CERT_REQ_B: str="SSLv3 write certificate request B"; break; | ||
| 175 | case SSL3_ST_SW_SRVR_DONE_A: str="SSLv3 write server done A"; break; | ||
| 176 | case SSL3_ST_SW_SRVR_DONE_B: str="SSLv3 write server done B"; break; | ||
| 177 | case SSL3_ST_SR_CERT_A: str="SSLv3 read client certificate A"; break; | ||
| 178 | case SSL3_ST_SR_CERT_B: str="SSLv3 read client certificate B"; break; | ||
| 179 | case SSL3_ST_SR_KEY_EXCH_A: str="SSLv3 read client key exchange A"; break; | ||
| 180 | case SSL3_ST_SR_KEY_EXCH_B: str="SSLv3 read client key exchange B"; break; | ||
| 181 | case SSL3_ST_SR_CERT_VRFY_A: str="SSLv3 read certificate verify A"; break; | ||
| 182 | case SSL3_ST_SR_CERT_VRFY_B: str="SSLv3 read certificate verify B"; break; | ||
| 183 | #endif | ||
| 184 | |||
| 185 | #if !defined(NO_SSL2) && !defined(NO_SSL3) | ||
| 186 | /* SSLv2/v3 compatibility states */ | ||
| 187 | /* client */ | ||
| 188 | case SSL23_ST_CW_CLNT_HELLO_A: str="SSLv2/v3 write client hello A"; break; | ||
| 189 | case SSL23_ST_CW_CLNT_HELLO_B: str="SSLv2/v3 write client hello B"; break; | ||
| 190 | case SSL23_ST_CR_SRVR_HELLO_A: str="SSLv2/v3 read server hello A"; break; | ||
| 191 | case SSL23_ST_CR_SRVR_HELLO_B: str="SSLv2/v3 read server hello B"; break; | ||
| 192 | /* server */ | ||
| 193 | case SSL23_ST_SR_CLNT_HELLO_A: str="SSLv2/v3 read client hello A"; break; | ||
| 194 | case SSL23_ST_SR_CLNT_HELLO_B: str="SSLv2/v3 read client hello B"; break; | ||
| 195 | #endif | ||
| 196 | |||
| 197 | default: str="unknown state"; break; | ||
| 198 | } | ||
| 199 | return(str); | ||
| 200 | } | ||
| 201 | |||
| 202 | char *SSL_rstate_string_long(SSL *s) | ||
| 203 | { | ||
| 204 | char *str; | ||
| 205 | |||
| 206 | switch (s->rstate) | ||
| 207 | { | ||
| 208 | case SSL_ST_READ_HEADER: str="read header"; break; | ||
| 209 | case SSL_ST_READ_BODY: str="read body"; break; | ||
| 210 | case SSL_ST_READ_DONE: str="read done"; break; | ||
| 211 | default: str="unknown"; break; | ||
| 212 | } | ||
| 213 | return(str); | ||
| 214 | } | ||
| 215 | |||
| 216 | char *SSL_state_string(SSL *s) | ||
| 217 | { | ||
| 218 | char *str; | ||
| 219 | |||
| 220 | switch (s->state) | ||
| 221 | { | ||
| 222 | case SSL_ST_BEFORE: str="PINIT "; break; | ||
| 223 | case SSL_ST_ACCEPT: str="AINIT "; break; | ||
| 224 | case SSL_ST_CONNECT: str="CINIT "; break; | ||
| 225 | case SSL_ST_OK: str="SSLOK "; break; | ||
| 226 | #ifndef NO_SSL2 | ||
| 227 | case SSL2_ST_CLIENT_START_ENCRYPTION: str="2CSENC"; break; | ||
| 228 | case SSL2_ST_SERVER_START_ENCRYPTION: str="2SSENC"; break; | ||
| 229 | case SSL2_ST_SEND_CLIENT_HELLO_A: str="2SCH_A"; break; | ||
| 230 | case SSL2_ST_SEND_CLIENT_HELLO_B: str="2SCH_B"; break; | ||
| 231 | case SSL2_ST_GET_SERVER_HELLO_A: str="2GSH_A"; break; | ||
| 232 | case SSL2_ST_GET_SERVER_HELLO_B: str="2GSH_B"; break; | ||
| 233 | case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="2SCMKA"; break; | ||
| 234 | case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="2SCMKB"; break; | ||
| 235 | case SSL2_ST_SEND_CLIENT_FINISHED_A: str="2SCF_A"; break; | ||
| 236 | case SSL2_ST_SEND_CLIENT_FINISHED_B: str="2SCF_B"; break; | ||
| 237 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="2SCC_A"; break; | ||
| 238 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="2SCC_B"; break; | ||
| 239 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="2SCC_C"; break; | ||
| 240 | case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="2SCC_D"; break; | ||
| 241 | case SSL2_ST_GET_SERVER_VERIFY_A: str="2GSV_A"; break; | ||
| 242 | case SSL2_ST_GET_SERVER_VERIFY_B: str="2GSV_B"; break; | ||
| 243 | case SSL2_ST_GET_SERVER_FINISHED_A: str="2GSF_A"; break; | ||
| 244 | case SSL2_ST_GET_SERVER_FINISHED_B: str="2GSF_B"; break; | ||
| 245 | case SSL2_ST_GET_CLIENT_HELLO_A: str="2GCH_A"; break; | ||
| 246 | case SSL2_ST_GET_CLIENT_HELLO_B: str="2GCH_B"; break; | ||
| 247 | case SSL2_ST_GET_CLIENT_HELLO_C: str="2GCH_C"; break; | ||
| 248 | case SSL2_ST_SEND_SERVER_HELLO_A: str="2SSH_A"; break; | ||
| 249 | case SSL2_ST_SEND_SERVER_HELLO_B: str="2SSH_B"; break; | ||
| 250 | case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="2GCMKA"; break; | ||
| 251 | case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="2GCMKA"; break; | ||
| 252 | case SSL2_ST_SEND_SERVER_VERIFY_A: str="2SSV_A"; break; | ||
| 253 | case SSL2_ST_SEND_SERVER_VERIFY_B: str="2SSV_B"; break; | ||
| 254 | case SSL2_ST_SEND_SERVER_VERIFY_C: str="2SSV_C"; break; | ||
| 255 | case SSL2_ST_GET_CLIENT_FINISHED_A: str="2GCF_A"; break; | ||
| 256 | case SSL2_ST_GET_CLIENT_FINISHED_B: str="2GCF_B"; break; | ||
| 257 | case SSL2_ST_SEND_SERVER_FINISHED_A: str="2SSF_A"; break; | ||
| 258 | case SSL2_ST_SEND_SERVER_FINISHED_B: str="2SSF_B"; break; | ||
| 259 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="2SRC_A"; break; | ||
| 260 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="2SRC_B"; break; | ||
| 261 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="2SRC_C"; break; | ||
| 262 | case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="2SRC_D"; break; | ||
| 263 | case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="2X9GSC"; break; | ||
| 264 | case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="2X9GCC"; break; | ||
| 265 | #endif | ||
| 266 | |||
| 267 | #ifndef NO_SSL3 | ||
| 268 | /* SSLv3 additions */ | ||
| 269 | case SSL3_ST_SW_FLUSH: | ||
| 270 | case SSL3_ST_CW_FLUSH: str="3FLUSH"; break; | ||
| 271 | case SSL3_ST_CW_CLNT_HELLO_A: str="3WCH_A"; break; | ||
| 272 | case SSL3_ST_CW_CLNT_HELLO_B: str="3WCH_B"; break; | ||
| 273 | case SSL3_ST_CR_SRVR_HELLO_A: str="3RSH_A"; break; | ||
| 274 | case SSL3_ST_CR_SRVR_HELLO_B: str="3RSH_B"; break; | ||
| 275 | case SSL3_ST_CR_CERT_A: str="3RSC_A"; break; | ||
| 276 | case SSL3_ST_CR_CERT_B: str="3RSC_B"; break; | ||
| 277 | case SSL3_ST_CR_KEY_EXCH_A: str="3RSKEA"; break; | ||
| 278 | case SSL3_ST_CR_KEY_EXCH_B: str="3RSKEB"; break; | ||
| 279 | case SSL3_ST_CR_CERT_REQ_A: str="3RCR_A"; break; | ||
| 280 | case SSL3_ST_CR_CERT_REQ_B: str="3RCR_B"; break; | ||
| 281 | case SSL3_ST_CR_SRVR_DONE_A: str="3RSD_A"; break; | ||
| 282 | case SSL3_ST_CR_SRVR_DONE_B: str="3RSD_B"; break; | ||
| 283 | case SSL3_ST_CW_CERT_A: str="3WCC_A"; break; | ||
| 284 | case SSL3_ST_CW_CERT_B: str="3WCC_B"; break; | ||
| 285 | case SSL3_ST_CW_CERT_C: str="3WCC_C"; break; | ||
| 286 | case SSL3_ST_CW_CERT_D: str="3WCC_D"; break; | ||
| 287 | case SSL3_ST_CW_KEY_EXCH_A: str="3WCKEA"; break; | ||
| 288 | case SSL3_ST_CW_KEY_EXCH_B: str="3WCKEB"; break; | ||
| 289 | case SSL3_ST_CW_CERT_VRFY_A: str="3WCV_A"; break; | ||
| 290 | case SSL3_ST_CW_CERT_VRFY_B: str="3WCV_B"; break; | ||
| 291 | |||
| 292 | case SSL3_ST_SW_CHANGE_A: | ||
| 293 | case SSL3_ST_CW_CHANGE_A: str="3WCCSA"; break; | ||
| 294 | case SSL3_ST_SW_CHANGE_B: | ||
| 295 | case SSL3_ST_CW_CHANGE_B: str="3WCCSB"; break; | ||
| 296 | case SSL3_ST_SW_FINISHED_A: | ||
| 297 | case SSL3_ST_CW_FINISHED_A: str="3WFINA"; break; | ||
| 298 | case SSL3_ST_SW_FINISHED_B: | ||
| 299 | case SSL3_ST_CW_FINISHED_B: str="3WFINB"; break; | ||
| 300 | case SSL3_ST_SR_CHANGE_A: | ||
| 301 | case SSL3_ST_CR_CHANGE_A: str="3RCCSA"; break; | ||
| 302 | case SSL3_ST_SR_CHANGE_B: | ||
| 303 | case SSL3_ST_CR_CHANGE_B: str="3RCCSB"; break; | ||
| 304 | case SSL3_ST_SR_FINISHED_A: | ||
| 305 | case SSL3_ST_CR_FINISHED_A: str="3RFINA"; break; | ||
| 306 | case SSL3_ST_SR_FINISHED_B: | ||
| 307 | case SSL3_ST_CR_FINISHED_B: str="3RFINB"; break; | ||
| 308 | |||
| 309 | case SSL3_ST_SW_HELLO_REQ_A: str="3WHR_A"; break; | ||
| 310 | case SSL3_ST_SW_HELLO_REQ_B: str="3WHR_B"; break; | ||
| 311 | case SSL3_ST_SW_HELLO_REQ_C: str="3WHR_C"; break; | ||
| 312 | case SSL3_ST_SR_CLNT_HELLO_A: str="3RCH_A"; break; | ||
| 313 | case SSL3_ST_SR_CLNT_HELLO_B: str="3RCH_B"; break; | ||
| 314 | case SSL3_ST_SR_CLNT_HELLO_C: str="3RCH_C"; break; | ||
| 315 | case SSL3_ST_SW_SRVR_HELLO_A: str="3WSH_A"; break; | ||
| 316 | case SSL3_ST_SW_SRVR_HELLO_B: str="3WSH_B"; break; | ||
| 317 | case SSL3_ST_SW_CERT_A: str="3WSC_A"; break; | ||
| 318 | case SSL3_ST_SW_CERT_B: str="3WSC_B"; break; | ||
| 319 | case SSL3_ST_SW_KEY_EXCH_A: str="3WSKEA"; break; | ||
| 320 | case SSL3_ST_SW_KEY_EXCH_B: str="3WSKEB"; break; | ||
| 321 | case SSL3_ST_SW_CERT_REQ_A: str="3WCR_A"; break; | ||
| 322 | case SSL3_ST_SW_CERT_REQ_B: str="3WCR_B"; break; | ||
| 323 | case SSL3_ST_SW_SRVR_DONE_A: str="3WSD_A"; break; | ||
| 324 | case SSL3_ST_SW_SRVR_DONE_B: str="3WSD_B"; break; | ||
| 325 | case SSL3_ST_SR_CERT_A: str="3RCC_A"; break; | ||
| 326 | case SSL3_ST_SR_CERT_B: str="3RCC_B"; break; | ||
| 327 | case SSL3_ST_SR_KEY_EXCH_A: str="3RCKEA"; break; | ||
| 328 | case SSL3_ST_SR_KEY_EXCH_B: str="3RCKEB"; break; | ||
| 329 | case SSL3_ST_SR_CERT_VRFY_A: str="3RCV_A"; break; | ||
| 330 | case SSL3_ST_SR_CERT_VRFY_B: str="3RCV_B"; break; | ||
| 331 | #endif | ||
| 332 | |||
| 333 | #if !defined(NO_SSL2) && !defined(NO_SSL3) | ||
| 334 | /* SSLv2/v3 compatibility states */ | ||
| 335 | /* client */ | ||
| 336 | case SSL23_ST_CW_CLNT_HELLO_A: str="23WCHA"; break; | ||
| 337 | case SSL23_ST_CW_CLNT_HELLO_B: str="23WCHB"; break; | ||
| 338 | case SSL23_ST_CR_SRVR_HELLO_A: str="23RSHA"; break; | ||
| 339 | case SSL23_ST_CR_SRVR_HELLO_B: str="23RSHA"; break; | ||
| 340 | /* server */ | ||
| 341 | case SSL23_ST_SR_CLNT_HELLO_A: str="23RCHA"; break; | ||
| 342 | case SSL23_ST_SR_CLNT_HELLO_B: str="23RCHB"; break; | ||
| 343 | #endif | ||
| 344 | |||
| 345 | default: str="UNKWN "; break; | ||
| 346 | } | ||
| 347 | return(str); | ||
| 348 | } | ||
| 349 | |||
| 350 | char *SSL_alert_type_string_long(int value) | ||
| 351 | { | ||
| 352 | value>>=8; | ||
| 353 | if (value == SSL3_AL_WARNING) | ||
| 354 | return("warning"); | ||
| 355 | else if (value == SSL3_AL_FATAL) | ||
| 356 | return("fatal"); | ||
| 357 | else | ||
| 358 | return("unknown"); | ||
| 359 | } | ||
| 360 | |||
| 361 | char *SSL_alert_type_string(int value) | ||
| 362 | { | ||
| 363 | value>>=8; | ||
| 364 | if (value == SSL3_AL_WARNING) | ||
| 365 | return("W"); | ||
| 366 | else if (value == SSL3_AL_FATAL) | ||
| 367 | return("F"); | ||
| 368 | else | ||
| 369 | return("U"); | ||
| 370 | } | ||
| 371 | |||
| 372 | char *SSL_alert_desc_string(int value) | ||
| 373 | { | ||
| 374 | char *str; | ||
| 375 | |||
| 376 | switch (value & 0xff) | ||
| 377 | { | ||
| 378 | case SSL3_AD_CLOSE_NOTIFY: str="CN"; break; | ||
| 379 | case SSL3_AD_UNEXPECTED_MESSAGE: str="UM"; break; | ||
| 380 | case SSL3_AD_BAD_RECORD_MAC: str="BM"; break; | ||
| 381 | case SSL3_AD_DECOMPRESSION_FAILURE: str="DF"; break; | ||
| 382 | case SSL3_AD_HANDSHAKE_FAILURE: str="HF"; break; | ||
| 383 | case SSL3_AD_NO_CERTIFICATE: str="NC"; break; | ||
| 384 | case SSL3_AD_BAD_CERTIFICATE: str="BC"; break; | ||
| 385 | case SSL3_AD_UNSUPPORTED_CERTIFICATE: str="UC"; break; | ||
| 386 | case SSL3_AD_CERTIFICATE_REVOKED: str="CR"; break; | ||
| 387 | case SSL3_AD_CERTIFICATE_EXPIRED: str="CE"; break; | ||
| 388 | case SSL3_AD_CERTIFICATE_UNKNOWN: str="CU"; break; | ||
| 389 | case SSL3_AD_ILLEGAL_PARAMETER: str="IP"; break; | ||
| 390 | default: str="UK"; break; | ||
| 391 | } | ||
| 392 | return(str); | ||
| 393 | } | ||
| 394 | |||
| 395 | char *SSL_alert_desc_string_long(int value) | ||
| 396 | { | ||
| 397 | char *str; | ||
| 398 | |||
| 399 | switch (value & 0xff) | ||
| 400 | { | ||
| 401 | case SSL3_AD_CLOSE_NOTIFY: | ||
| 402 | str="close notify"; | ||
| 403 | break; | ||
| 404 | case SSL3_AD_UNEXPECTED_MESSAGE: | ||
| 405 | str="unexpected_message"; | ||
| 406 | break; | ||
| 407 | case SSL3_AD_BAD_RECORD_MAC: | ||
| 408 | str="bad record mac"; | ||
| 409 | break; | ||
| 410 | case SSL3_AD_DECOMPRESSION_FAILURE: | ||
| 411 | str="decompression failure"; | ||
| 412 | break; | ||
| 413 | case SSL3_AD_HANDSHAKE_FAILURE: | ||
| 414 | str="handshake failure"; | ||
| 415 | break; | ||
| 416 | case SSL3_AD_NO_CERTIFICATE: | ||
| 417 | str="no certificate"; | ||
| 418 | break; | ||
| 419 | case SSL3_AD_BAD_CERTIFICATE: | ||
| 420 | str="bad certificate"; | ||
| 421 | break; | ||
| 422 | case SSL3_AD_UNSUPPORTED_CERTIFICATE: | ||
| 423 | str="unsupported certificate"; | ||
| 424 | break; | ||
| 425 | case SSL3_AD_CERTIFICATE_REVOKED: | ||
| 426 | str="certificate revoked"; | ||
| 427 | break; | ||
| 428 | case SSL3_AD_CERTIFICATE_EXPIRED: | ||
| 429 | str="certificate expired"; | ||
| 430 | break; | ||
| 431 | case SSL3_AD_CERTIFICATE_UNKNOWN: | ||
| 432 | str="certificate unknown"; | ||
| 433 | break; | ||
| 434 | case SSL3_AD_ILLEGAL_PARAMETER: | ||
| 435 | str="illegal parameter"; | ||
| 436 | break; | ||
| 437 | default: str="unknown"; break; | ||
| 438 | } | ||
| 439 | return(str); | ||
| 440 | } | ||
| 441 | |||
| 442 | char *SSL_rstate_string(SSL *s) | ||
| 443 | { | ||
| 444 | char *str; | ||
| 445 | |||
| 446 | switch (s->rstate) | ||
| 447 | { | ||
| 448 | case SSL_ST_READ_HEADER:str="RH"; break; | ||
| 449 | case SSL_ST_READ_BODY: str="RB"; break; | ||
| 450 | case SSL_ST_READ_DONE: str="RD"; break; | ||
| 451 | default: str="unknown"; break; | ||
| 452 | } | ||
| 453 | return(str); | ||
| 454 | } | ||
diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c deleted file mode 100644 index 6e33eec3e4..0000000000 --- a/src/lib/libssl/ssl_txt.c +++ /dev/null | |||
| @@ -1,174 +0,0 @@ | |||
| 1 | /* ssl/ssl_txt.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/buffer.h> | ||
| 61 | #include "ssl_locl.h" | ||
| 62 | |||
| 63 | #ifndef NO_FP_API | ||
| 64 | int SSL_SESSION_print_fp(FILE *fp, SSL_SESSION *x) | ||
| 65 | { | ||
| 66 | BIO *b; | ||
| 67 | int ret; | ||
| 68 | |||
| 69 | if ((b=BIO_new(BIO_s_file_internal())) == NULL) | ||
| 70 | { | ||
| 71 | SSLerr(SSL_F_SSL_SESSION_PRINT_FP,ERR_R_BUF_LIB); | ||
| 72 | return(0); | ||
| 73 | } | ||
| 74 | BIO_set_fp(b,fp,BIO_NOCLOSE); | ||
| 75 | ret=SSL_SESSION_print(b,x); | ||
| 76 | BIO_free(b); | ||
| 77 | return(ret); | ||
| 78 | } | ||
| 79 | #endif | ||
| 80 | |||
| 81 | int SSL_SESSION_print(BIO *bp, SSL_SESSION *x) | ||
| 82 | { | ||
| 83 | unsigned int i; | ||
| 84 | char *s; | ||
| 85 | |||
| 86 | if (x == NULL) goto err; | ||
| 87 | if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err; | ||
| 88 | if (x->ssl_version == SSL2_VERSION) | ||
| 89 | s="SSLv2"; | ||
| 90 | else if (x->ssl_version == SSL3_VERSION) | ||
| 91 | s="SSLv3"; | ||
| 92 | else if (x->ssl_version == TLS1_VERSION) | ||
| 93 | s="TLSv1"; | ||
| 94 | else | ||
| 95 | s="unknown"; | ||
| 96 | if (BIO_printf(bp," Protocol : %s\n",s) <= 0) goto err; | ||
| 97 | |||
| 98 | if (x->cipher == NULL) | ||
| 99 | { | ||
| 100 | if (((x->cipher_id) & 0xff000000) == 0x02000000) | ||
| 101 | { | ||
| 102 | if (BIO_printf(bp," Cipher : %06lX\n",x->cipher_id&0xffffff) <= 0) | ||
| 103 | goto err; | ||
| 104 | } | ||
| 105 | else | ||
| 106 | { | ||
| 107 | if (BIO_printf(bp," Cipher : %04lX\n",x->cipher_id&0xffff) <= 0) | ||
| 108 | goto err; | ||
| 109 | } | ||
| 110 | } | ||
| 111 | else | ||
| 112 | { | ||
| 113 | if (BIO_printf(bp," Cipher : %s\n",((x->cipher == NULL)?"unknown":x->cipher->name)) <= 0) | ||
| 114 | goto err; | ||
| 115 | } | ||
| 116 | if (BIO_puts(bp," Session-ID: ") <= 0) goto err; | ||
| 117 | for (i=0; i<x->session_id_length; i++) | ||
| 118 | { | ||
| 119 | if (BIO_printf(bp,"%02X",x->session_id[i]) <= 0) goto err; | ||
| 120 | } | ||
| 121 | if (BIO_puts(bp,"\n Session-ID-ctx: ") <= 0) goto err; | ||
| 122 | for (i=0; i<x->sid_ctx_length; i++) | ||
| 123 | { | ||
| 124 | if (BIO_printf(bp,"%02X",x->sid_ctx[i]) <= 0) | ||
| 125 | goto err; | ||
| 126 | } | ||
| 127 | if (BIO_puts(bp,"\n Master-Key: ") <= 0) goto err; | ||
| 128 | for (i=0; i<(unsigned int)x->master_key_length; i++) | ||
| 129 | { | ||
| 130 | if (BIO_printf(bp,"%02X",x->master_key[i]) <= 0) goto err; | ||
| 131 | } | ||
| 132 | if (BIO_puts(bp,"\n Key-Arg : ") <= 0) goto err; | ||
| 133 | if (x->key_arg_length == 0) | ||
| 134 | { | ||
| 135 | if (BIO_puts(bp,"None") <= 0) goto err; | ||
| 136 | } | ||
| 137 | else | ||
| 138 | for (i=0; i<x->key_arg_length; i++) | ||
| 139 | { | ||
| 140 | if (BIO_printf(bp,"%02X",x->key_arg[i]) <= 0) goto err; | ||
| 141 | } | ||
| 142 | if (x->compress_meth != 0) | ||
| 143 | { | ||
| 144 | SSL_COMP *comp; | ||
| 145 | |||
| 146 | ssl_cipher_get_evp(x,NULL,NULL,&comp); | ||
| 147 | if (comp == NULL) | ||
| 148 | { | ||
| 149 | if (BIO_printf(bp,"\n Compression: %d",x->compress_meth) <= 0) goto err; | ||
| 150 | } | ||
| 151 | else | ||
| 152 | { | ||
| 153 | if (BIO_printf(bp,"\n Compression: %d (%s)", comp->id,comp->method->name) <= 0) goto err; | ||
| 154 | } | ||
| 155 | } | ||
| 156 | if (x->time != 0L) | ||
| 157 | { | ||
| 158 | if (BIO_printf(bp, "\n Start Time: %ld",x->time) <= 0) goto err; | ||
| 159 | } | ||
| 160 | if (x->timeout != 0L) | ||
| 161 | { | ||
| 162 | if (BIO_printf(bp, "\n Timeout : %ld (sec)",x->timeout) <= 0) goto err; | ||
| 163 | } | ||
| 164 | if (BIO_puts(bp,"\n") <= 0) goto err; | ||
| 165 | |||
| 166 | if (BIO_puts(bp, " Verify return code: ") <= 0) goto err; | ||
| 167 | if (BIO_printf(bp, "%ld (%s)\n", x->verify_result, | ||
| 168 | X509_verify_cert_error_string(x->verify_result)) <= 0) goto err; | ||
| 169 | |||
| 170 | return(1); | ||
| 171 | err: | ||
| 172 | return(0); | ||
| 173 | } | ||
| 174 | |||
diff --git a/src/lib/libssl/t1_clnt.c b/src/lib/libssl/t1_clnt.c deleted file mode 100644 index 9745630a00..0000000000 --- a/src/lib/libssl/t1_clnt.c +++ /dev/null | |||
| @@ -1,90 +0,0 @@ | |||
| 1 | /* ssl/t1_clnt.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/buffer.h> | ||
| 61 | #include <openssl/rand.h> | ||
| 62 | #include <openssl/objects.h> | ||
| 63 | #include <openssl/evp.h> | ||
| 64 | #include "ssl_locl.h" | ||
| 65 | |||
| 66 | static SSL_METHOD *tls1_get_client_method(int ver); | ||
| 67 | static SSL_METHOD *tls1_get_client_method(int ver) | ||
| 68 | { | ||
| 69 | if (ver == TLS1_VERSION) | ||
| 70 | return(TLSv1_client_method()); | ||
| 71 | else | ||
| 72 | return(NULL); | ||
| 73 | } | ||
| 74 | |||
| 75 | SSL_METHOD *TLSv1_client_method(void) | ||
| 76 | { | ||
| 77 | static int init=1; | ||
| 78 | static SSL_METHOD TLSv1_client_data; | ||
| 79 | |||
| 80 | if (init) | ||
| 81 | { | ||
| 82 | memcpy((char *)&TLSv1_client_data,(char *)tlsv1_base_method(), | ||
| 83 | sizeof(SSL_METHOD)); | ||
| 84 | TLSv1_client_data.ssl_connect=ssl3_connect; | ||
| 85 | TLSv1_client_data.get_ssl_method=tls1_get_client_method; | ||
| 86 | init=0; | ||
| 87 | } | ||
| 88 | return(&TLSv1_client_data); | ||
| 89 | } | ||
| 90 | |||
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c deleted file mode 100644 index a0758e9261..0000000000 --- a/src/lib/libssl/t1_enc.c +++ /dev/null | |||
| @@ -1,648 +0,0 @@ | |||
| 1 | /* ssl/t1_enc.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/comp.h> | ||
| 61 | #include <openssl/md5.h> | ||
| 62 | #include <openssl/sha.h> | ||
| 63 | #include <openssl/evp.h> | ||
| 64 | #include <openssl/hmac.h> | ||
| 65 | #include "ssl_locl.h" | ||
| 66 | |||
| 67 | static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec, | ||
| 68 | int sec_len, unsigned char *seed, int seed_len, | ||
| 69 | unsigned char *out, int olen) | ||
| 70 | { | ||
| 71 | int chunk,n; | ||
| 72 | unsigned int j; | ||
| 73 | HMAC_CTX ctx; | ||
| 74 | HMAC_CTX ctx_tmp; | ||
| 75 | unsigned char A1[HMAC_MAX_MD_CBLOCK]; | ||
| 76 | unsigned int A1_len; | ||
| 77 | |||
| 78 | chunk=EVP_MD_size(md); | ||
| 79 | |||
| 80 | HMAC_Init(&ctx,sec,sec_len,md); | ||
| 81 | HMAC_Update(&ctx,seed,seed_len); | ||
| 82 | HMAC_Final(&ctx,A1,&A1_len); | ||
| 83 | |||
| 84 | n=0; | ||
| 85 | for (;;) | ||
| 86 | { | ||
| 87 | HMAC_Init(&ctx,NULL,0,NULL); /* re-init */ | ||
| 88 | HMAC_Update(&ctx,A1,A1_len); | ||
| 89 | memcpy(&ctx_tmp,&ctx,sizeof(ctx)); /* Copy for A2 */ /* not needed for last one */ | ||
| 90 | HMAC_Update(&ctx,seed,seed_len); | ||
| 91 | |||
| 92 | if (olen > chunk) | ||
| 93 | { | ||
| 94 | HMAC_Final(&ctx,out,&j); | ||
| 95 | out+=j; | ||
| 96 | olen-=j; | ||
| 97 | HMAC_Final(&ctx_tmp,A1,&A1_len); /* calc the next A1 value */ | ||
| 98 | } | ||
| 99 | else /* last one */ | ||
| 100 | { | ||
| 101 | HMAC_Final(&ctx,A1,&A1_len); | ||
| 102 | memcpy(out,A1,olen); | ||
| 103 | break; | ||
| 104 | } | ||
| 105 | } | ||
| 106 | HMAC_cleanup(&ctx); | ||
| 107 | HMAC_cleanup(&ctx_tmp); | ||
| 108 | memset(A1,0,sizeof(A1)); | ||
| 109 | } | ||
| 110 | |||
| 111 | static void tls1_PRF(const EVP_MD *md5, const EVP_MD *sha1, | ||
| 112 | unsigned char *label, int label_len, | ||
| 113 | const unsigned char *sec, int slen, unsigned char *out1, | ||
| 114 | unsigned char *out2, int olen) | ||
| 115 | { | ||
| 116 | int len,i; | ||
| 117 | const unsigned char *S1,*S2; | ||
| 118 | |||
| 119 | len=slen/2; | ||
| 120 | S1=sec; | ||
| 121 | S2= &(sec[len]); | ||
| 122 | len+=(slen&1); /* add for odd, make longer */ | ||
| 123 | |||
| 124 | |||
| 125 | tls1_P_hash(md5 ,S1,len,label,label_len,out1,olen); | ||
| 126 | tls1_P_hash(sha1,S2,len,label,label_len,out2,olen); | ||
| 127 | |||
| 128 | for (i=0; i<olen; i++) | ||
| 129 | out1[i]^=out2[i]; | ||
| 130 | } | ||
| 131 | |||
| 132 | static void tls1_generate_key_block(SSL *s, unsigned char *km, | ||
| 133 | unsigned char *tmp, int num) | ||
| 134 | { | ||
| 135 | unsigned char *p; | ||
| 136 | unsigned char buf[SSL3_RANDOM_SIZE*2+ | ||
| 137 | TLS_MD_MAX_CONST_SIZE]; | ||
| 138 | p=buf; | ||
| 139 | |||
| 140 | memcpy(p,TLS_MD_KEY_EXPANSION_CONST, | ||
| 141 | TLS_MD_KEY_EXPANSION_CONST_SIZE); | ||
| 142 | p+=TLS_MD_KEY_EXPANSION_CONST_SIZE; | ||
| 143 | memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE); | ||
| 144 | p+=SSL3_RANDOM_SIZE; | ||
| 145 | memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE); | ||
| 146 | p+=SSL3_RANDOM_SIZE; | ||
| 147 | |||
| 148 | tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf), | ||
| 149 | s->session->master_key,s->session->master_key_length, | ||
| 150 | km,tmp,num); | ||
| 151 | } | ||
| 152 | |||
| 153 | int tls1_change_cipher_state(SSL *s, int which) | ||
| 154 | { | ||
| 155 | static const unsigned char empty[]=""; | ||
| 156 | unsigned char *p,*key_block,*mac_secret; | ||
| 157 | unsigned char *exp_label,buf[TLS_MD_MAX_CONST_SIZE+ | ||
| 158 | SSL3_RANDOM_SIZE*2]; | ||
| 159 | unsigned char tmp1[EVP_MAX_KEY_LENGTH]; | ||
| 160 | unsigned char tmp2[EVP_MAX_KEY_LENGTH]; | ||
| 161 | unsigned char iv1[EVP_MAX_IV_LENGTH*2]; | ||
| 162 | unsigned char iv2[EVP_MAX_IV_LENGTH*2]; | ||
| 163 | unsigned char *ms,*key,*iv,*er1,*er2; | ||
| 164 | int client_write; | ||
| 165 | EVP_CIPHER_CTX *dd; | ||
| 166 | const EVP_CIPHER *c; | ||
| 167 | const SSL_COMP *comp; | ||
| 168 | const EVP_MD *m; | ||
| 169 | int _exp,n,i,j,k,exp_label_len,cl; | ||
| 170 | |||
| 171 | _exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); | ||
| 172 | c=s->s3->tmp.new_sym_enc; | ||
| 173 | m=s->s3->tmp.new_hash; | ||
| 174 | comp=s->s3->tmp.new_compression; | ||
| 175 | key_block=s->s3->tmp.key_block; | ||
| 176 | |||
| 177 | if (which & SSL3_CC_READ) | ||
| 178 | { | ||
| 179 | if ((s->enc_read_ctx == NULL) && | ||
| 180 | ((s->enc_read_ctx=(EVP_CIPHER_CTX *) | ||
| 181 | OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)) | ||
| 182 | goto err; | ||
| 183 | dd= s->enc_read_ctx; | ||
| 184 | s->read_hash=m; | ||
| 185 | if (s->expand != NULL) | ||
| 186 | { | ||
| 187 | COMP_CTX_free(s->expand); | ||
| 188 | s->expand=NULL; | ||
| 189 | } | ||
| 190 | if (comp != NULL) | ||
| 191 | { | ||
| 192 | s->expand=COMP_CTX_new(comp->method); | ||
| 193 | if (s->expand == NULL) | ||
| 194 | { | ||
| 195 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR); | ||
| 196 | goto err2; | ||
| 197 | } | ||
| 198 | if (s->s3->rrec.comp == NULL) | ||
| 199 | s->s3->rrec.comp=(unsigned char *) | ||
| 200 | OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH); | ||
| 201 | if (s->s3->rrec.comp == NULL) | ||
| 202 | goto err; | ||
| 203 | } | ||
| 204 | memset(&(s->s3->read_sequence[0]),0,8); | ||
| 205 | mac_secret= &(s->s3->read_mac_secret[0]); | ||
| 206 | } | ||
| 207 | else | ||
| 208 | { | ||
| 209 | if ((s->enc_write_ctx == NULL) && | ||
| 210 | ((s->enc_write_ctx=(EVP_CIPHER_CTX *) | ||
| 211 | OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)) | ||
| 212 | goto err; | ||
| 213 | dd= s->enc_write_ctx; | ||
| 214 | s->write_hash=m; | ||
| 215 | if (s->compress != NULL) | ||
| 216 | { | ||
| 217 | COMP_CTX_free(s->compress); | ||
| 218 | s->compress=NULL; | ||
| 219 | } | ||
| 220 | if (comp != NULL) | ||
| 221 | { | ||
| 222 | s->compress=COMP_CTX_new(comp->method); | ||
| 223 | if (s->compress == NULL) | ||
| 224 | { | ||
| 225 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR); | ||
| 226 | goto err2; | ||
| 227 | } | ||
| 228 | } | ||
| 229 | memset(&(s->s3->write_sequence[0]),0,8); | ||
| 230 | mac_secret= &(s->s3->write_mac_secret[0]); | ||
| 231 | } | ||
| 232 | |||
| 233 | EVP_CIPHER_CTX_init(dd); | ||
| 234 | |||
| 235 | p=s->s3->tmp.key_block; | ||
| 236 | i=EVP_MD_size(m); | ||
| 237 | cl=EVP_CIPHER_key_length(c); | ||
| 238 | j=_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ? | ||
| 239 | cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl; | ||
| 240 | /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ | ||
| 241 | k=EVP_CIPHER_iv_length(c); | ||
| 242 | er1= &(s->s3->client_random[0]); | ||
| 243 | er2= &(s->s3->server_random[0]); | ||
| 244 | if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || | ||
| 245 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) | ||
| 246 | { | ||
| 247 | ms= &(p[ 0]); n=i+i; | ||
| 248 | key= &(p[ n]); n+=j+j; | ||
| 249 | iv= &(p[ n]); n+=k+k; | ||
| 250 | exp_label=(unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST; | ||
| 251 | exp_label_len=TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE; | ||
| 252 | client_write=1; | ||
| 253 | } | ||
| 254 | else | ||
| 255 | { | ||
| 256 | n=i; | ||
| 257 | ms= &(p[ n]); n+=i+j; | ||
| 258 | key= &(p[ n]); n+=j+k; | ||
| 259 | iv= &(p[ n]); n+=k; | ||
| 260 | exp_label=(unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST; | ||
| 261 | exp_label_len=TLS_MD_SERVER_WRITE_KEY_CONST_SIZE; | ||
| 262 | client_write=0; | ||
| 263 | } | ||
| 264 | |||
| 265 | if (n > s->s3->tmp.key_block_length) | ||
| 266 | { | ||
| 267 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_INTERNAL_ERROR); | ||
| 268 | goto err2; | ||
| 269 | } | ||
| 270 | |||
| 271 | memcpy(mac_secret,ms,i); | ||
| 272 | #ifdef TLS_DEBUG | ||
| 273 | printf("which = %04X\nmac key=",which); | ||
| 274 | { int z; for (z=0; z<i; z++) printf("%02X%c",ms[z],((z+1)%16)?' ':'\n'); } | ||
| 275 | #endif | ||
| 276 | if (_exp) | ||
| 277 | { | ||
| 278 | /* In here I set both the read and write key/iv to the | ||
| 279 | * same value since only the correct one will be used :-). | ||
| 280 | */ | ||
| 281 | p=buf; | ||
| 282 | memcpy(p,exp_label,exp_label_len); | ||
| 283 | p+=exp_label_len; | ||
| 284 | memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE); | ||
| 285 | p+=SSL3_RANDOM_SIZE; | ||
| 286 | memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE); | ||
| 287 | p+=SSL3_RANDOM_SIZE; | ||
| 288 | tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf),key,j, | ||
| 289 | tmp1,tmp2,EVP_CIPHER_key_length(c)); | ||
| 290 | key=tmp1; | ||
| 291 | |||
| 292 | if (k > 0) | ||
| 293 | { | ||
| 294 | p=buf; | ||
| 295 | memcpy(p,TLS_MD_IV_BLOCK_CONST, | ||
| 296 | TLS_MD_IV_BLOCK_CONST_SIZE); | ||
| 297 | p+=TLS_MD_IV_BLOCK_CONST_SIZE; | ||
| 298 | memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE); | ||
| 299 | p+=SSL3_RANDOM_SIZE; | ||
| 300 | memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE); | ||
| 301 | p+=SSL3_RANDOM_SIZE; | ||
| 302 | tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,p-buf,empty,0, | ||
| 303 | iv1,iv2,k*2); | ||
| 304 | if (client_write) | ||
| 305 | iv=iv1; | ||
| 306 | else | ||
| 307 | iv= &(iv1[k]); | ||
| 308 | } | ||
| 309 | } | ||
| 310 | |||
| 311 | s->session->key_arg_length=0; | ||
| 312 | |||
| 313 | EVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE)); | ||
| 314 | #ifdef TLS_DEBUG | ||
| 315 | printf("which = %04X\nkey=",which); | ||
| 316 | { int z; for (z=0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c",key[z],((z+1)%16)?' ':'\n'); } | ||
| 317 | printf("\niv="); | ||
| 318 | { int z; for (z=0; z<k; z++) printf("%02X%c",iv[z],((z+1)%16)?' ':'\n'); } | ||
| 319 | printf("\n"); | ||
| 320 | #endif | ||
| 321 | |||
| 322 | memset(tmp1,0,sizeof(tmp1)); | ||
| 323 | memset(tmp2,0,sizeof(tmp1)); | ||
| 324 | memset(iv1,0,sizeof(iv1)); | ||
| 325 | memset(iv2,0,sizeof(iv2)); | ||
| 326 | return(1); | ||
| 327 | err: | ||
| 328 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE); | ||
| 329 | err2: | ||
| 330 | return(0); | ||
| 331 | } | ||
| 332 | |||
| 333 | int tls1_setup_key_block(SSL *s) | ||
| 334 | { | ||
| 335 | unsigned char *p1,*p2; | ||
| 336 | const EVP_CIPHER *c; | ||
| 337 | const EVP_MD *hash; | ||
| 338 | int num; | ||
| 339 | SSL_COMP *comp; | ||
| 340 | |||
| 341 | if (s->s3->tmp.key_block_length != 0) | ||
| 342 | return(1); | ||
| 343 | |||
| 344 | if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp)) | ||
| 345 | { | ||
| 346 | SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE); | ||
| 347 | return(0); | ||
| 348 | } | ||
| 349 | |||
| 350 | s->s3->tmp.new_sym_enc=c; | ||
| 351 | s->s3->tmp.new_hash=hash; | ||
| 352 | |||
| 353 | num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c); | ||
| 354 | num*=2; | ||
| 355 | |||
| 356 | ssl3_cleanup_key_block(s); | ||
| 357 | |||
| 358 | if ((p1=(unsigned char *)OPENSSL_malloc(num)) == NULL) | ||
| 359 | goto err; | ||
| 360 | if ((p2=(unsigned char *)OPENSSL_malloc(num)) == NULL) | ||
| 361 | goto err; | ||
| 362 | |||
| 363 | s->s3->tmp.key_block_length=num; | ||
| 364 | s->s3->tmp.key_block=p1; | ||
| 365 | |||
| 366 | |||
| 367 | #ifdef TLS_DEBUG | ||
| 368 | printf("client random\n"); | ||
| 369 | { int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->client_random[z],((z+1)%16)?' ':'\n'); } | ||
| 370 | printf("server random\n"); | ||
| 371 | { int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->server_random[z],((z+1)%16)?' ':'\n'); } | ||
| 372 | printf("pre-master\n"); | ||
| 373 | { int z; for (z=0; z<s->session->master_key_length; z++) printf("%02X%c",s->session->master_key[z],((z+1)%16)?' ':'\n'); } | ||
| 374 | #endif | ||
| 375 | tls1_generate_key_block(s,p1,p2,num); | ||
| 376 | memset(p2,0,num); | ||
| 377 | OPENSSL_free(p2); | ||
| 378 | #ifdef TLS_DEBUG | ||
| 379 | printf("\nkey block\n"); | ||
| 380 | { int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); } | ||
| 381 | #endif | ||
| 382 | |||
| 383 | return(1); | ||
| 384 | err: | ||
| 385 | SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE); | ||
| 386 | return(0); | ||
| 387 | } | ||
| 388 | |||
| 389 | int tls1_enc(SSL *s, int send) | ||
| 390 | { | ||
| 391 | SSL3_RECORD *rec; | ||
| 392 | EVP_CIPHER_CTX *ds; | ||
| 393 | unsigned long l; | ||
| 394 | int bs,i,ii,j,k,n=0; | ||
| 395 | const EVP_CIPHER *enc; | ||
| 396 | |||
| 397 | if (send) | ||
| 398 | { | ||
| 399 | if (s->write_hash != NULL) | ||
| 400 | n=EVP_MD_size(s->write_hash); | ||
| 401 | ds=s->enc_write_ctx; | ||
| 402 | rec= &(s->s3->wrec); | ||
| 403 | if (s->enc_write_ctx == NULL) | ||
| 404 | enc=NULL; | ||
| 405 | else | ||
| 406 | enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx); | ||
| 407 | } | ||
| 408 | else | ||
| 409 | { | ||
| 410 | if (s->read_hash != NULL) | ||
| 411 | n=EVP_MD_size(s->read_hash); | ||
| 412 | ds=s->enc_read_ctx; | ||
| 413 | rec= &(s->s3->rrec); | ||
| 414 | if (s->enc_read_ctx == NULL) | ||
| 415 | enc=NULL; | ||
| 416 | else | ||
| 417 | enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx); | ||
| 418 | } | ||
| 419 | |||
| 420 | if ((s->session == NULL) || (ds == NULL) || | ||
| 421 | (enc == NULL)) | ||
| 422 | { | ||
| 423 | memmove(rec->data,rec->input,rec->length); | ||
| 424 | rec->input=rec->data; | ||
| 425 | } | ||
| 426 | else | ||
| 427 | { | ||
| 428 | l=rec->length; | ||
| 429 | bs=EVP_CIPHER_block_size(ds->cipher); | ||
| 430 | |||
| 431 | if ((bs != 1) && send) | ||
| 432 | { | ||
| 433 | i=bs-((int)l%bs); | ||
| 434 | |||
| 435 | /* Add weird padding of upto 256 bytes */ | ||
| 436 | |||
| 437 | /* we need to add 'i' padding bytes of value j */ | ||
| 438 | j=i-1; | ||
| 439 | if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) | ||
| 440 | { | ||
| 441 | if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) | ||
| 442 | j++; | ||
| 443 | } | ||
| 444 | for (k=(int)l; k<(int)(l+i); k++) | ||
| 445 | rec->input[k]=j; | ||
| 446 | l+=i; | ||
| 447 | rec->length+=i; | ||
| 448 | } | ||
| 449 | |||
| 450 | if (!send) | ||
| 451 | { | ||
| 452 | if (l == 0 || l%bs != 0) | ||
| 453 | { | ||
| 454 | SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG); | ||
| 455 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR); | ||
| 456 | return(0); | ||
| 457 | } | ||
| 458 | } | ||
| 459 | |||
| 460 | EVP_Cipher(ds,rec->data,rec->input,l); | ||
| 461 | |||
| 462 | if ((bs != 1) && !send) | ||
| 463 | { | ||
| 464 | ii=i=rec->data[l-1]; /* padding_length */ | ||
| 465 | i++; | ||
| 466 | if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) | ||
| 467 | { | ||
| 468 | /* First packet is even in size, so check */ | ||
| 469 | if ((memcmp(s->s3->read_sequence, | ||
| 470 | "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1)) | ||
| 471 | s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG; | ||
| 472 | if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) | ||
| 473 | i--; | ||
| 474 | } | ||
| 475 | /* TLS 1.0 does not bound the number of padding bytes by the block size. | ||
| 476 | * All of them must have value 'padding_length'. */ | ||
| 477 | if (i > (int)rec->length) | ||
| 478 | { | ||
| 479 | SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG); | ||
| 480 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED); | ||
| 481 | return(0); | ||
| 482 | } | ||
| 483 | for (j=(int)(l-i); j<(int)l; j++) | ||
| 484 | { | ||
| 485 | if (rec->data[j] != ii) | ||
| 486 | { | ||
| 487 | SSLerr(SSL_F_TLS1_ENC,SSL_R_DECRYPTION_FAILED); | ||
| 488 | ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED); | ||
| 489 | return(0); | ||
| 490 | } | ||
| 491 | } | ||
| 492 | rec->length-=i; | ||
| 493 | } | ||
| 494 | } | ||
| 495 | return(1); | ||
| 496 | } | ||
| 497 | |||
| 498 | int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out) | ||
| 499 | { | ||
| 500 | unsigned int ret; | ||
| 501 | EVP_MD_CTX ctx; | ||
| 502 | |||
| 503 | EVP_MD_CTX_copy(&ctx,in_ctx); | ||
| 504 | EVP_DigestFinal(&ctx,out,&ret); | ||
| 505 | return((int)ret); | ||
| 506 | } | ||
| 507 | |||
| 508 | int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx, | ||
| 509 | const char *str, int slen, unsigned char *out) | ||
| 510 | { | ||
| 511 | unsigned int i; | ||
| 512 | EVP_MD_CTX ctx; | ||
| 513 | unsigned char buf[TLS_MD_MAX_CONST_SIZE+MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH]; | ||
| 514 | unsigned char *q,buf2[12]; | ||
| 515 | |||
| 516 | q=buf; | ||
| 517 | memcpy(q,str,slen); | ||
| 518 | q+=slen; | ||
| 519 | |||
| 520 | EVP_MD_CTX_copy(&ctx,in1_ctx); | ||
| 521 | EVP_DigestFinal(&ctx,q,&i); | ||
| 522 | q+=i; | ||
| 523 | EVP_MD_CTX_copy(&ctx,in2_ctx); | ||
| 524 | EVP_DigestFinal(&ctx,q,&i); | ||
| 525 | q+=i; | ||
| 526 | |||
| 527 | tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(q-buf), | ||
| 528 | s->session->master_key,s->session->master_key_length, | ||
| 529 | out,buf2,12); | ||
| 530 | memset(&ctx,0,sizeof(EVP_MD_CTX)); | ||
| 531 | |||
| 532 | return((int)12); | ||
| 533 | } | ||
| 534 | |||
| 535 | int tls1_mac(SSL *ssl, unsigned char *md, int send) | ||
| 536 | { | ||
| 537 | SSL3_RECORD *rec; | ||
| 538 | unsigned char *mac_sec,*seq; | ||
| 539 | const EVP_MD *hash; | ||
| 540 | unsigned int md_size; | ||
| 541 | int i; | ||
| 542 | HMAC_CTX hmac; | ||
| 543 | unsigned char buf[5]; | ||
| 544 | |||
| 545 | if (send) | ||
| 546 | { | ||
| 547 | rec= &(ssl->s3->wrec); | ||
| 548 | mac_sec= &(ssl->s3->write_mac_secret[0]); | ||
| 549 | seq= &(ssl->s3->write_sequence[0]); | ||
| 550 | hash=ssl->write_hash; | ||
| 551 | } | ||
| 552 | else | ||
| 553 | { | ||
| 554 | rec= &(ssl->s3->rrec); | ||
| 555 | mac_sec= &(ssl->s3->read_mac_secret[0]); | ||
| 556 | seq= &(ssl->s3->read_sequence[0]); | ||
| 557 | hash=ssl->read_hash; | ||
| 558 | } | ||
| 559 | |||
| 560 | md_size=EVP_MD_size(hash); | ||
| 561 | |||
| 562 | buf[0]=rec->type; | ||
| 563 | buf[1]=TLS1_VERSION_MAJOR; | ||
| 564 | buf[2]=TLS1_VERSION_MINOR; | ||
| 565 | buf[3]=rec->length>>8; | ||
| 566 | buf[4]=rec->length&0xff; | ||
| 567 | |||
| 568 | /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */ | ||
| 569 | HMAC_Init(&hmac,mac_sec,EVP_MD_size(hash),hash); | ||
| 570 | HMAC_Update(&hmac,seq,8); | ||
| 571 | HMAC_Update(&hmac,buf,5); | ||
| 572 | HMAC_Update(&hmac,rec->input,rec->length); | ||
| 573 | HMAC_Final(&hmac,md,&md_size); | ||
| 574 | |||
| 575 | #ifdef TLS_DEBUG | ||
| 576 | printf("sec="); | ||
| 577 | {unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); } | ||
| 578 | printf("seq="); | ||
| 579 | {int z; for (z=0; z<8; z++) printf("%02X ",seq[z]); printf("\n"); } | ||
| 580 | printf("buf="); | ||
| 581 | {int z; for (z=0; z<5; z++) printf("%02X ",buf[z]); printf("\n"); } | ||
| 582 | printf("rec="); | ||
| 583 | {unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); } | ||
| 584 | #endif | ||
| 585 | |||
| 586 | for (i=7; i>=0; i--) | ||
| 587 | { | ||
| 588 | ++seq[i]; | ||
| 589 | if (seq[i] != 0) break; | ||
| 590 | } | ||
| 591 | |||
| 592 | #ifdef TLS_DEBUG | ||
| 593 | {unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",md[z]); printf("\n"); } | ||
| 594 | #endif | ||
| 595 | return(md_size); | ||
| 596 | } | ||
| 597 | |||
| 598 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, | ||
| 599 | int len) | ||
| 600 | { | ||
| 601 | unsigned char buf[SSL3_RANDOM_SIZE*2+TLS_MD_MASTER_SECRET_CONST_SIZE]; | ||
| 602 | unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH]; | ||
| 603 | |||
| 604 | /* Setup the stuff to munge */ | ||
| 605 | memcpy(buf,TLS_MD_MASTER_SECRET_CONST, | ||
| 606 | TLS_MD_MASTER_SECRET_CONST_SIZE); | ||
| 607 | memcpy(&(buf[TLS_MD_MASTER_SECRET_CONST_SIZE]), | ||
| 608 | s->s3->client_random,SSL3_RANDOM_SIZE); | ||
| 609 | memcpy(&(buf[SSL3_RANDOM_SIZE+TLS_MD_MASTER_SECRET_CONST_SIZE]), | ||
| 610 | s->s3->server_random,SSL3_RANDOM_SIZE); | ||
| 611 | tls1_PRF(s->ctx->md5,s->ctx->sha1, | ||
| 612 | buf,TLS_MD_MASTER_SECRET_CONST_SIZE+SSL3_RANDOM_SIZE*2,p,len, | ||
| 613 | s->session->master_key,buff,SSL3_MASTER_SECRET_SIZE); | ||
| 614 | return(SSL3_MASTER_SECRET_SIZE); | ||
| 615 | } | ||
| 616 | |||
| 617 | int tls1_alert_code(int code) | ||
| 618 | { | ||
| 619 | switch (code) | ||
| 620 | { | ||
| 621 | case SSL_AD_CLOSE_NOTIFY: return(SSL3_AD_CLOSE_NOTIFY); | ||
| 622 | case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE); | ||
| 623 | case SSL_AD_BAD_RECORD_MAC: return(SSL3_AD_BAD_RECORD_MAC); | ||
| 624 | case SSL_AD_DECRYPTION_FAILED: return(TLS1_AD_DECRYPTION_FAILED); | ||
| 625 | case SSL_AD_RECORD_OVERFLOW: return(TLS1_AD_RECORD_OVERFLOW); | ||
| 626 | case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE); | ||
| 627 | case SSL_AD_HANDSHAKE_FAILURE: return(SSL3_AD_HANDSHAKE_FAILURE); | ||
| 628 | case SSL_AD_NO_CERTIFICATE: return(-1); | ||
| 629 | case SSL_AD_BAD_CERTIFICATE: return(SSL3_AD_BAD_CERTIFICATE); | ||
| 630 | case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE); | ||
| 631 | case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED); | ||
| 632 | case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED); | ||
| 633 | case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN); | ||
| 634 | case SSL_AD_ILLEGAL_PARAMETER: return(SSL3_AD_ILLEGAL_PARAMETER); | ||
| 635 | case SSL_AD_UNKNOWN_CA: return(TLS1_AD_UNKNOWN_CA); | ||
| 636 | case SSL_AD_ACCESS_DENIED: return(TLS1_AD_ACCESS_DENIED); | ||
| 637 | case SSL_AD_DECODE_ERROR: return(TLS1_AD_DECODE_ERROR); | ||
| 638 | case SSL_AD_DECRYPT_ERROR: return(TLS1_AD_DECRYPT_ERROR); | ||
| 639 | case SSL_AD_EXPORT_RESTRICTION: return(TLS1_AD_EXPORT_RESTRICTION); | ||
| 640 | case SSL_AD_PROTOCOL_VERSION: return(TLS1_AD_PROTOCOL_VERSION); | ||
| 641 | case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY); | ||
| 642 | case SSL_AD_INTERNAL_ERROR: return(TLS1_AD_INTERNAL_ERROR); | ||
| 643 | case SSL_AD_USER_CANCELLED: return(TLS1_AD_USER_CANCELLED); | ||
| 644 | case SSL_AD_NO_RENEGOTIATION: return(TLS1_AD_NO_RENEGOTIATION); | ||
| 645 | default: return(-1); | ||
| 646 | } | ||
| 647 | } | ||
| 648 | |||
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c deleted file mode 100644 index ca6c03d5af..0000000000 --- a/src/lib/libssl/t1_lib.c +++ /dev/null | |||
| @@ -1,149 +0,0 @@ | |||
| 1 | /* ssl/t1_lib.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/objects.h> | ||
| 61 | #include "ssl_locl.h" | ||
| 62 | |||
| 63 | const char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT; | ||
| 64 | |||
| 65 | static long tls1_default_timeout(void); | ||
| 66 | |||
| 67 | static SSL3_ENC_METHOD TLSv1_enc_data={ | ||
| 68 | tls1_enc, | ||
| 69 | tls1_mac, | ||
| 70 | tls1_setup_key_block, | ||
| 71 | tls1_generate_master_secret, | ||
| 72 | tls1_change_cipher_state, | ||
| 73 | tls1_final_finish_mac, | ||
| 74 | TLS1_FINISH_MAC_LENGTH, | ||
| 75 | tls1_cert_verify_mac, | ||
| 76 | TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE, | ||
| 77 | TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE, | ||
| 78 | tls1_alert_code, | ||
| 79 | }; | ||
| 80 | |||
| 81 | static SSL_METHOD TLSv1_data= { | ||
| 82 | TLS1_VERSION, | ||
| 83 | tls1_new, | ||
| 84 | tls1_clear, | ||
| 85 | tls1_free, | ||
| 86 | ssl_undefined_function, | ||
| 87 | ssl_undefined_function, | ||
| 88 | ssl3_read, | ||
| 89 | ssl3_peek, | ||
| 90 | ssl3_write, | ||
| 91 | ssl3_shutdown, | ||
| 92 | ssl3_renegotiate, | ||
| 93 | ssl3_renegotiate_check, | ||
| 94 | ssl3_ctrl, | ||
| 95 | ssl3_ctx_ctrl, | ||
| 96 | ssl3_get_cipher_by_char, | ||
| 97 | ssl3_put_cipher_by_char, | ||
| 98 | ssl3_pending, | ||
| 99 | ssl3_num_ciphers, | ||
| 100 | ssl3_get_cipher, | ||
| 101 | ssl_bad_method, | ||
| 102 | tls1_default_timeout, | ||
| 103 | &TLSv1_enc_data, | ||
| 104 | ssl_undefined_function, | ||
| 105 | ssl3_callback_ctrl, | ||
| 106 | ssl3_ctx_callback_ctrl, | ||
| 107 | }; | ||
| 108 | |||
| 109 | static long tls1_default_timeout(void) | ||
| 110 | { | ||
| 111 | /* 2 hours, the 24 hours mentioned in the TLSv1 spec | ||
| 112 | * is way too long for http, the cache would over fill */ | ||
| 113 | return(60*60*2); | ||
| 114 | } | ||
| 115 | |||
| 116 | SSL_METHOD *tlsv1_base_method(void) | ||
| 117 | { | ||
| 118 | return(&TLSv1_data); | ||
| 119 | } | ||
| 120 | |||
| 121 | int tls1_new(SSL *s) | ||
| 122 | { | ||
| 123 | if (!ssl3_new(s)) return(0); | ||
| 124 | s->method->ssl_clear(s); | ||
| 125 | return(1); | ||
| 126 | } | ||
| 127 | |||
| 128 | void tls1_free(SSL *s) | ||
| 129 | { | ||
| 130 | ssl3_free(s); | ||
| 131 | } | ||
| 132 | |||
| 133 | void tls1_clear(SSL *s) | ||
| 134 | { | ||
| 135 | ssl3_clear(s); | ||
| 136 | s->version=TLS1_VERSION; | ||
| 137 | } | ||
| 138 | |||
| 139 | #if 0 | ||
| 140 | long tls1_ctrl(SSL *s, int cmd, long larg, char *parg) | ||
| 141 | { | ||
| 142 | return(0); | ||
| 143 | } | ||
| 144 | |||
| 145 | long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)()) | ||
| 146 | { | ||
| 147 | return(0); | ||
| 148 | } | ||
| 149 | #endif | ||
diff --git a/src/lib/libssl/t1_meth.c b/src/lib/libssl/t1_meth.c deleted file mode 100644 index 9bb36a7d1c..0000000000 --- a/src/lib/libssl/t1_meth.c +++ /dev/null | |||
| @@ -1,88 +0,0 @@ | |||
| 1 | /* ssl/t1_meth.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/objects.h> | ||
| 61 | #include "ssl_locl.h" | ||
| 62 | |||
| 63 | static SSL_METHOD *tls1_get_method(int ver); | ||
| 64 | static SSL_METHOD *tls1_get_method(int ver) | ||
| 65 | { | ||
| 66 | if (ver == TLS1_VERSION) | ||
| 67 | return(TLSv1_method()); | ||
| 68 | else | ||
| 69 | return(NULL); | ||
| 70 | } | ||
| 71 | |||
| 72 | SSL_METHOD *TLSv1_method(void) | ||
| 73 | { | ||
| 74 | static int init=1; | ||
| 75 | static SSL_METHOD TLSv1_data; | ||
| 76 | |||
| 77 | if (init) | ||
| 78 | { | ||
| 79 | memcpy((char *)&TLSv1_data,(char *)tlsv1_base_method(), | ||
| 80 | sizeof(SSL_METHOD)); | ||
| 81 | TLSv1_data.ssl_connect=ssl3_connect; | ||
| 82 | TLSv1_data.ssl_accept=ssl3_accept; | ||
| 83 | TLSv1_data.get_ssl_method=tls1_get_method; | ||
| 84 | init=0; | ||
| 85 | } | ||
| 86 | return(&TLSv1_data); | ||
| 87 | } | ||
| 88 | |||
diff --git a/src/lib/libssl/t1_srvr.c b/src/lib/libssl/t1_srvr.c deleted file mode 100644 index 996b7ca8e2..0000000000 --- a/src/lib/libssl/t1_srvr.c +++ /dev/null | |||
| @@ -1,91 +0,0 @@ | |||
| 1 | /* ssl/t1_srvr.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <openssl/buffer.h> | ||
| 61 | #include <openssl/rand.h> | ||
| 62 | #include <openssl/objects.h> | ||
| 63 | #include <openssl/evp.h> | ||
| 64 | #include <openssl/x509.h> | ||
| 65 | #include "ssl_locl.h" | ||
| 66 | |||
| 67 | static SSL_METHOD *tls1_get_server_method(int ver); | ||
| 68 | static SSL_METHOD *tls1_get_server_method(int ver) | ||
| 69 | { | ||
| 70 | if (ver == TLS1_VERSION) | ||
| 71 | return(TLSv1_server_method()); | ||
| 72 | else | ||
| 73 | return(NULL); | ||
| 74 | } | ||
| 75 | |||
| 76 | SSL_METHOD *TLSv1_server_method(void) | ||
| 77 | { | ||
| 78 | static int init=1; | ||
| 79 | static SSL_METHOD TLSv1_server_data; | ||
| 80 | |||
| 81 | if (init) | ||
| 82 | { | ||
| 83 | memcpy((char *)&TLSv1_server_data,(char *)tlsv1_base_method(), | ||
| 84 | sizeof(SSL_METHOD)); | ||
| 85 | TLSv1_server_data.ssl_accept=ssl3_accept; | ||
| 86 | TLSv1_server_data.get_ssl_method=tls1_get_server_method; | ||
| 87 | init=0; | ||
| 88 | } | ||
| 89 | return(&TLSv1_server_data); | ||
| 90 | } | ||
| 91 | |||
diff --git a/src/lib/libssl/test/CAss.cnf b/src/lib/libssl/test/CAss.cnf deleted file mode 100644 index b941b7ae15..0000000000 --- a/src/lib/libssl/test/CAss.cnf +++ /dev/null | |||
| @@ -1,25 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | |||
| 6 | RANDFILE = ./.rnd | ||
| 7 | |||
| 8 | #################################################################### | ||
| 9 | [ req ] | ||
| 10 | default_bits = 512 | ||
| 11 | default_keyfile = keySS.pem | ||
| 12 | distinguished_name = req_distinguished_name | ||
| 13 | encrypt_rsa_key = no | ||
| 14 | default_md = sha1 | ||
| 15 | |||
| 16 | [ req_distinguished_name ] | ||
| 17 | countryName = Country Name (2 letter code) | ||
| 18 | countryName_default = AU | ||
| 19 | countryName_value = AU | ||
| 20 | |||
| 21 | organizationName = Organization Name (eg, company) | ||
| 22 | organizationName_value = Dodgy Brothers | ||
| 23 | |||
| 24 | commonName = Common Name (eg, YOUR name) | ||
| 25 | commonName_value = Dodgy CA | ||
diff --git a/src/lib/libssl/test/CAssdh.cnf b/src/lib/libssl/test/CAssdh.cnf deleted file mode 100644 index 4e0a908679..0000000000 --- a/src/lib/libssl/test/CAssdh.cnf +++ /dev/null | |||
| @@ -1,24 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | # hacked by iang to do DH certs - CA | ||
| 6 | |||
| 7 | RANDFILE = ./.rnd | ||
| 8 | |||
| 9 | #################################################################### | ||
| 10 | [ req ] | ||
| 11 | distinguished_name = req_distinguished_name | ||
| 12 | encrypt_rsa_key = no | ||
| 13 | |||
| 14 | [ req_distinguished_name ] | ||
| 15 | countryName = Country Name (2 letter code) | ||
| 16 | countryName_default = CU | ||
| 17 | countryName_value = CU | ||
| 18 | |||
| 19 | organizationName = Organization Name (eg, company) | ||
| 20 | organizationName_value = La Junta de la Revolucion | ||
| 21 | |||
| 22 | commonName = Common Name (eg, YOUR name) | ||
| 23 | commonName_value = Junta | ||
| 24 | |||
diff --git a/src/lib/libssl/test/CAssdsa.cnf b/src/lib/libssl/test/CAssdsa.cnf deleted file mode 100644 index a6b4d1810c..0000000000 --- a/src/lib/libssl/test/CAssdsa.cnf +++ /dev/null | |||
| @@ -1,23 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | # hacked by iang to do DSA certs - CA | ||
| 6 | |||
| 7 | RANDFILE = ./.rnd | ||
| 8 | |||
| 9 | #################################################################### | ||
| 10 | [ req ] | ||
| 11 | distinguished_name = req_distinguished_name | ||
| 12 | encrypt_rsa_key = no | ||
| 13 | |||
| 14 | [ req_distinguished_name ] | ||
| 15 | countryName = Country Name (2 letter code) | ||
| 16 | countryName_default = ES | ||
| 17 | countryName_value = ES | ||
| 18 | |||
| 19 | organizationName = Organization Name (eg, company) | ||
| 20 | organizationName_value = Hermanos Locos | ||
| 21 | |||
| 22 | commonName = Common Name (eg, YOUR name) | ||
| 23 | commonName_value = Hermanos Locos CA | ||
diff --git a/src/lib/libssl/test/CAssrsa.cnf b/src/lib/libssl/test/CAssrsa.cnf deleted file mode 100644 index eb24a6dfc0..0000000000 --- a/src/lib/libssl/test/CAssrsa.cnf +++ /dev/null | |||
| @@ -1,24 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | # create RSA certs - CA | ||
| 6 | |||
| 7 | RANDFILE = ./.rnd | ||
| 8 | |||
| 9 | #################################################################### | ||
| 10 | [ req ] | ||
| 11 | distinguished_name = req_distinguished_name | ||
| 12 | encrypt_key = no | ||
| 13 | |||
| 14 | [ req_distinguished_name ] | ||
| 15 | countryName = Country Name (2 letter code) | ||
| 16 | countryName_default = ES | ||
| 17 | countryName_value = ES | ||
| 18 | |||
| 19 | organizationName = Organization Name (eg, company) | ||
| 20 | organizationName_value = Hermanos Locos | ||
| 21 | |||
| 22 | commonName = Common Name (eg, YOUR name) | ||
| 23 | commonName_value = Hermanos Locos CA | ||
| 24 | |||
diff --git a/src/lib/libssl/test/Sssdsa.cnf b/src/lib/libssl/test/Sssdsa.cnf deleted file mode 100644 index 8e170a28ef..0000000000 --- a/src/lib/libssl/test/Sssdsa.cnf +++ /dev/null | |||
| @@ -1,27 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | # hacked by iang to do DSA certs - Server | ||
| 6 | |||
| 7 | RANDFILE = ./.rnd | ||
| 8 | |||
| 9 | #################################################################### | ||
| 10 | [ req ] | ||
| 11 | distinguished_name = req_distinguished_name | ||
| 12 | encrypt_rsa_key = no | ||
| 13 | |||
| 14 | [ req_distinguished_name ] | ||
| 15 | countryName = Country Name (2 letter code) | ||
| 16 | countryName_default = ES | ||
| 17 | countryName_value = ES | ||
| 18 | |||
| 19 | organizationName = Organization Name (eg, company) | ||
| 20 | organizationName_value = Tortilleras S.A. | ||
| 21 | |||
| 22 | 0.commonName = Common Name (eg, YOUR name) | ||
| 23 | 0.commonName_value = Torti | ||
| 24 | |||
| 25 | 1.commonName = Common Name (eg, YOUR name) | ||
| 26 | 1.commonName_value = Gordita | ||
| 27 | |||
diff --git a/src/lib/libssl/test/Sssrsa.cnf b/src/lib/libssl/test/Sssrsa.cnf deleted file mode 100644 index 8c79a03fca..0000000000 --- a/src/lib/libssl/test/Sssrsa.cnf +++ /dev/null | |||
| @@ -1,26 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | # create RSA certs - Server | ||
| 6 | |||
| 7 | RANDFILE = ./.rnd | ||
| 8 | |||
| 9 | #################################################################### | ||
| 10 | [ req ] | ||
| 11 | distinguished_name = req_distinguished_name | ||
| 12 | encrypt_key = no | ||
| 13 | |||
| 14 | [ req_distinguished_name ] | ||
| 15 | countryName = Country Name (2 letter code) | ||
| 16 | countryName_default = ES | ||
| 17 | countryName_value = ES | ||
| 18 | |||
| 19 | organizationName = Organization Name (eg, company) | ||
| 20 | organizationName_value = Tortilleras S.A. | ||
| 21 | |||
| 22 | 0.commonName = Common Name (eg, YOUR name) | ||
| 23 | 0.commonName_value = Torti | ||
| 24 | |||
| 25 | 1.commonName = Common Name (eg, YOUR name) | ||
| 26 | 1.commonName_value = Gordita | ||
diff --git a/src/lib/libssl/test/Uss.cnf b/src/lib/libssl/test/Uss.cnf deleted file mode 100644 index c89692d519..0000000000 --- a/src/lib/libssl/test/Uss.cnf +++ /dev/null | |||
| @@ -1,28 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | |||
| 6 | RANDFILE = ./.rnd | ||
| 7 | |||
| 8 | #################################################################### | ||
| 9 | [ req ] | ||
| 10 | default_bits = 512 | ||
| 11 | default_keyfile = keySS.pem | ||
| 12 | distinguished_name = req_distinguished_name | ||
| 13 | encrypt_rsa_key = no | ||
| 14 | default_md = md2 | ||
| 15 | |||
| 16 | [ req_distinguished_name ] | ||
| 17 | countryName = Country Name (2 letter code) | ||
| 18 | countryName_default = AU | ||
| 19 | countryName_value = AU | ||
| 20 | |||
| 21 | organizationName = Organization Name (eg, company) | ||
| 22 | organizationName_value = Dodgy Brothers | ||
| 23 | |||
| 24 | 0.commonName = Common Name (eg, YOUR name) | ||
| 25 | 0.commonName_value = Brother 1 | ||
| 26 | |||
| 27 | 1.commonName = Common Name (eg, YOUR name) | ||
| 28 | 1.commonName_value = Brother 2 | ||
diff --git a/src/lib/libssl/test/VMSca-response.1 b/src/lib/libssl/test/VMSca-response.1 deleted file mode 100644 index 8b13789179..0000000000 --- a/src/lib/libssl/test/VMSca-response.1 +++ /dev/null | |||
| @@ -1 +0,0 @@ | |||
| 1 | |||
diff --git a/src/lib/libssl/test/VMSca-response.2 b/src/lib/libssl/test/VMSca-response.2 deleted file mode 100644 index 9b48ee4cf9..0000000000 --- a/src/lib/libssl/test/VMSca-response.2 +++ /dev/null | |||
| @@ -1,2 +0,0 @@ | |||
| 1 | y | ||
| 2 | y | ||
diff --git a/src/lib/libssl/test/bctest b/src/lib/libssl/test/bctest deleted file mode 100644 index bdb3218f7a..0000000000 --- a/src/lib/libssl/test/bctest +++ /dev/null | |||
| @@ -1,111 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | # This script is used by test/Makefile.ssl to check whether a sane 'bc' | ||
| 4 | # is installed. | ||
| 5 | # ('make test_bn' should not try to run 'bc' if it does not exist or if | ||
| 6 | # it is a broken 'bc' version that is known to cause trouble.) | ||
| 7 | # | ||
| 8 | # If 'bc' works, we also test if it knows the 'print' command. | ||
| 9 | # | ||
| 10 | # In any case, output an appropriate command line for running (or not | ||
| 11 | # running) bc. | ||
| 12 | |||
| 13 | |||
| 14 | IFS=: | ||
| 15 | try_without_dir=true | ||
| 16 | # First we try "bc", then "$dir/bc" for each item in $PATH. | ||
| 17 | for dir in dummy:$PATH; do | ||
| 18 | if [ "$try_without_dir" = true ]; then | ||
| 19 | # first iteration | ||
| 20 | bc=bc | ||
| 21 | try_without_dir=false | ||
| 22 | else | ||
| 23 | # second and later iterations | ||
| 24 | bc="$dir/bc" | ||
| 25 | if [ ! -f "$bc" ]; then # '-x' is not available on Ultrix | ||
| 26 | bc='' | ||
| 27 | fi | ||
| 28 | fi | ||
| 29 | |||
| 30 | if [ ! "$bc" = '' ]; then | ||
| 31 | failure=none | ||
| 32 | |||
| 33 | |||
| 34 | # Test for SunOS 5.[78] bc bug | ||
| 35 | "$bc" >tmp.bctest <<\EOF | ||
| 36 | obase=16 | ||
| 37 | ibase=16 | ||
| 38 | a=AD88C418F31B3FC712D0425001D522B3AE9134FF3A98C13C1FCC1682211195406C1A6C66C6A\ | ||
| 39 | CEEC1A0EC16950233F77F1C2F2363D56DD71A36C57E0B2511FC4BA8F22D261FE2E9356D99AF57\ | ||
| 40 | 10F3817C0E05BF79C423C3F66FDF321BE8D3F18F625D91B670931C1EF25F28E489BDA1C5422D1\ | ||
| 41 | C3F6F7A1AD21585746ECC4F10A14A778AF56F08898E965E9909E965E0CB6F85B514150C644759\ | ||
| 42 | 3BE731877B16EA07B552088FF2EA728AC5E0FF3A23EB939304519AB8B60F2C33D6BA0945B66F0\ | ||
| 43 | 4FC3CADF855448B24A9D7640BCF473E | ||
| 44 | b=DCE91E7D120B983EA9A104B5A96D634DD644C37657B1C7860B45E6838999B3DCE5A555583C6\ | ||
| 45 | 9209E41F413422954175A06E67FFEF6746DD652F0F48AEFECC3D8CAC13523BDAAD3F5AF4212BD\ | ||
| 46 | 8B3CD64126E1A82E190228020C05B91C8B141F1110086FC2A4C6ED631EBA129D04BB9A19FC53D\ | ||
| 47 | 3ED0E2017D60A68775B75481449 | ||
| 48 | (a/b)*b + (a%b) - a | ||
| 49 | EOF | ||
| 50 | if [ 0 != "`cat tmp.bctest`" ]; then | ||
| 51 | failure=SunOStest | ||
| 52 | fi | ||
| 53 | |||
| 54 | |||
| 55 | if [ "$failure" = none ]; then | ||
| 56 | # Test for SCO bc bug. | ||
| 57 | "$bc" >tmp.bctest <<\EOF | ||
| 58 | obase=16 | ||
| 59 | ibase=16 | ||
| 60 | -FFDD63BA1A4648F0D804F8A1C66C53F0D2110590E8A3907EC73B4AEC6F15AC177F176F2274D2\ | ||
| 61 | 9DC8022EA0D7DD3ABE9746D2D46DD3EA5B5F6F69DF12877E0AC5E7F5ADFACEE54573F5D256A06\ | ||
| 62 | 11B5D2BC24947724E22AE4EC3FB0C39D9B4694A01AFE5E43B4D99FB9812A0E4A5773D8B254117\ | ||
| 63 | 1239157EC6E3D8D50199 * -FFDD63BA1A4648F0D804F8A1C66C53F0D2110590E8A3907EC73B4\ | ||
| 64 | AEC6F15AC177F176F2274D29DC8022EA0D7DD3ABE9746D2D46DD3EA5B5F6F69DF12877E0AC5E7\ | ||
| 65 | F5ADFACEE54573F5D256A0611B5D2BC24947724E22AE4EC3FB0C39D9B4694A01AFE5E43B4D99F\ | ||
| 66 | B9812A0E4A5773D8B2541171239157EC6E3D8D50199 - FFBACC221682DA464B6D7F123482522\ | ||
| 67 | 02EDAEDCA38C3B69E9B7BBCD6165A9CD8716C4903417F23C09A85B851961F92C217258CEEB866\ | ||
| 68 | 85EFCC5DD131853A02C07A873B8E2AF2E40C6D5ED598CD0E8F35AD49F3C3A17FDB7653E4E2DC4\ | ||
| 69 | A8D23CC34686EE4AD01F7407A7CD74429AC6D36DBF0CB6A3E302D0E5BDFCD048A3B90C1BE5AA8\ | ||
| 70 | E16C3D5884F9136B43FF7BB443764153D4AEC176C681B078F4CC53D6EB6AB76285537DDEE7C18\ | ||
| 71 | 8C72441B52EDBDDBC77E02D34E513F2AABF92F44109CAFE8242BD0ECBAC5604A94B02EA44D43C\ | ||
| 72 | 04E9476E6FBC48043916BFA1485C6093603600273C9C33F13114D78064AE42F3DC466C7DA543D\ | ||
| 73 | 89C8D71 | ||
| 74 | AD534AFBED2FA39EE9F40E20FCF9E2C861024DB98DDCBA1CD118C49CA55EEBC20D6BA51B2271C\ | ||
| 75 | 928B693D6A73F67FEB1B4571448588B46194617D25D910C6A9A130CC963155CF34079CB218A44\ | ||
| 76 | 8A1F57E276D92A33386DDCA3D241DB78C8974ABD71DD05B0FA555709C9910D745185E6FE108E3\ | ||
| 77 | 37F1907D0C56F8BFBF52B9704 % -E557905B56B13441574CAFCE2BD257A750B1A8B2C88D0E36\ | ||
| 78 | E18EF7C38DAC80D3948E17ED63AFF3B3467866E3B89D09A81B3D16B52F6A3C7134D3C6F5123E9\ | ||
| 79 | F617E3145BBFBE9AFD0D6E437EA4FF6F04BC67C4F1458B4F0F47B64 - 1C2BBBB19B74E86FD32\ | ||
| 80 | 9E8DB6A8C3B1B9986D57ED5419C2E855F7D5469E35E76334BB42F4C43E3F3A31B9697C171DAC4\ | ||
| 81 | D97935A7E1A14AD209D6CF811F55C6DB83AA9E6DFECFCD6669DED7171EE22A40C6181615CAF3F\ | ||
| 82 | 5296964 | ||
| 83 | EOF | ||
| 84 | if [ "0 | ||
| 85 | 0" != "`cat tmp.bctest`" ]; then | ||
| 86 | failure=SCOtest | ||
| 87 | fi | ||
| 88 | fi | ||
| 89 | |||
| 90 | |||
| 91 | if [ "$failure" = none ]; then | ||
| 92 | # bc works; now check if it knows the 'print' command. | ||
| 93 | if [ "OK" = "`echo 'print \"OK\"' | $bc 2>/dev/null`" ] | ||
| 94 | then | ||
| 95 | echo "$bc" | ||
| 96 | else | ||
| 97 | echo "sed 's/print.*//' | $bc" | ||
| 98 | fi | ||
| 99 | exit 0 | ||
| 100 | fi | ||
| 101 | |||
| 102 | echo "$bc does not work properly ('$failure' failed). Looking for another bc ..." >&2 | ||
| 103 | fi | ||
| 104 | done | ||
| 105 | |||
| 106 | echo "No working bc found. Consider installing GNU bc." >&2 | ||
| 107 | if [ "$1" = ignore ]; then | ||
| 108 | echo "cat >/dev/null" | ||
| 109 | exit 0 | ||
| 110 | fi | ||
| 111 | exit 1 | ||
diff --git a/src/lib/libssl/test/methtest.c b/src/lib/libssl/test/methtest.c deleted file mode 100644 index 06ccb3b310..0000000000 --- a/src/lib/libssl/test/methtest.c +++ /dev/null | |||
| @@ -1,105 +0,0 @@ | |||
| 1 | /* test/methtest.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #include <stdio.h> | ||
| 60 | #include <stdlib.h> | ||
| 61 | #include <openssl/rsa.h> | ||
| 62 | #include <openssl/x509.h> | ||
| 63 | #include "meth.h" | ||
| 64 | #include <openssl/err.h> | ||
| 65 | |||
| 66 | int main(argc,argv) | ||
| 67 | int argc; | ||
| 68 | char *argv[]; | ||
| 69 | { | ||
| 70 | METHOD_CTX *top,*tmp1,*tmp2; | ||
| 71 | |||
| 72 | top=METH_new(x509_lookup()); /* get a top level context */ | ||
| 73 | if (top == NULL) goto err; | ||
| 74 | |||
| 75 | tmp1=METH_new(x509_by_file()); | ||
| 76 | if (top == NULL) goto err; | ||
| 77 | METH_arg(tmp1,METH_TYPE_FILE,"cafile1"); | ||
| 78 | METH_arg(tmp1,METH_TYPE_FILE,"cafile2"); | ||
| 79 | METH_push(top,METH_X509_CA_BY_SUBJECT,tmp1); | ||
| 80 | |||
| 81 | tmp2=METH_new(x509_by_dir()); | ||
| 82 | METH_arg(tmp2,METH_TYPE_DIR,"/home/eay/.CAcerts"); | ||
| 83 | METH_arg(tmp2,METH_TYPE_DIR,"/home/eay/SSLeay/certs"); | ||
| 84 | METH_arg(tmp2,METH_TYPE_DIR,"/usr/local/ssl/certs"); | ||
| 85 | METH_push(top,METH_X509_CA_BY_SUBJECT,tmp2); | ||
| 86 | |||
| 87 | /* tmp=METH_new(x509_by_issuer_dir); | ||
| 88 | METH_arg(tmp,METH_TYPE_DIR,"/home/eay/.mycerts"); | ||
| 89 | METH_push(top,METH_X509_BY_ISSUER,tmp); | ||
| 90 | |||
| 91 | tmp=METH_new(x509_by_issuer_primary); | ||
| 92 | METH_arg(tmp,METH_TYPE_FILE,"/home/eay/.mycerts/primary.pem"); | ||
| 93 | METH_push(top,METH_X509_BY_ISSUER,tmp); | ||
| 94 | */ | ||
| 95 | |||
| 96 | METH_init(top); | ||
| 97 | METH_control(tmp1,METH_CONTROL_DUMP,stdout); | ||
| 98 | METH_control(tmp2,METH_CONTROL_DUMP,stdout); | ||
| 99 | exit(0); | ||
| 100 | err: | ||
| 101 | ERR_load_crypto_strings(); | ||
| 102 | ERR_print_errors_fp(stderr); | ||
| 103 | exit(1); | ||
| 104 | return(0); | ||
| 105 | } | ||
diff --git a/src/lib/libssl/test/pkcs7-1.pem b/src/lib/libssl/test/pkcs7-1.pem deleted file mode 100644 index c47b27af88..0000000000 --- a/src/lib/libssl/test/pkcs7-1.pem +++ /dev/null | |||
| @@ -1,15 +0,0 @@ | |||
| 1 | -----BEGIN PKCS7----- | ||
| 2 | MIICUAYJKoZIhvcNAQcCoIICQTCCAj0CAQExDjAMBggqhkiG9w0CAgUAMCgGCSqG | ||
| 3 | SIb3DQEHAaAbBBlFdmVyeW9uZSBnZXRzIEZyaWRheSBvZmYuoIIBXjCCAVowggEE | ||
| 4 | AgQUAAApMA0GCSqGSIb3DQEBAgUAMCwxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRF | ||
| 5 | eGFtcGxlIE9yZ2FuaXphdGlvbjAeFw05MjA5MDkyMjE4MDZaFw05NDA5MDkyMjE4 | ||
| 6 | MDVaMEIxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRFeGFtcGxlIE9yZ2FuaXphdGlv | ||
| 7 | bjEUMBIGA1UEAxMLVGVzdCBVc2VyIDEwWzANBgkqhkiG9w0BAQEFAANKADBHAkAK | ||
| 8 | ZnkdxpiBaN56t3QZu3+wwAHGJxAnAHUUKULhmo2MUdBTs+N4Kh3l3Fr06+mUaBcB | ||
| 9 | FKHf5nzcmpr1XWVWILurAgMBAAEwDQYJKoZIhvcNAQECBQADQQBFGqHhqncgSl/N | ||
| 10 | 9XYGnQL3MsJvNnsNV4puZPOakR9Hld8JlDQFEaDR30ogsmp3TMrvdfxpLlTCoZN8 | ||
| 11 | BxEmnZsWMYGbMIGYAgEBMDQwLDELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFEV4YW1w | ||
| 12 | bGUgT3JnYW5pemF0aW9uAgQUAAApMAwGCCqGSIb3DQICBQAwDQYJKoZIhvcNAQEB | ||
| 13 | BQAEQAX6aoEvx9+L9PJUJQngPoRuEbnGIL4gCe+0QO+8xmkhaZSsBPNBtX0FIC1C | ||
| 14 | j7Kie1x339mxW/w9VZNTUDQQweHh | ||
| 15 | -----END PKCS7----- | ||
diff --git a/src/lib/libssl/test/pkcs7.pem b/src/lib/libssl/test/pkcs7.pem deleted file mode 100644 index d55c60b94e..0000000000 --- a/src/lib/libssl/test/pkcs7.pem +++ /dev/null | |||
| @@ -1,54 +0,0 @@ | |||
| 1 | MIAGCSqGSIb3DQEHAqCAMIACAQExADCABgkqhkiG9w0BBwEAAKCAMIIE+DCCBGGg | ||
| 2 | AwIBAgIQaGSF/JpbS1C223+yrc+N1DANBgkqhkiG9w0BAQQFADBiMREwDwYDVQQH | ||
| 3 | EwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1Zl | ||
| 4 | cmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXIwHhcNOTYw | ||
| 5 | ODEyMDAwMDAwWhcNOTYwODE3MjM1OTU5WjCCASAxETAPBgNVBAcTCEludGVybmV0 | ||
| 6 | MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNpZ24gQ2xh | ||
| 7 | c3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjE3MDUGA1UECxMuRGlnaXRh | ||
| 8 | bCBJRCBDbGFzcyAxIC0gU01JTUUgVmVyaVNpZ24sIEluYy4gVEVTVDFGMEQGA1UE | ||
| 9 | CxM9d3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0b3J5L0NQUyBJbmNvcnAuIGJ5IFJl | ||
| 10 | Zi4sTElBQi5MVEQoYyk5NjEZMBcGA1UEAxMQQWxleGFuZHJlIERlYWNvbjEgMB4G | ||
| 11 | CSqGSIb3DQEJARYRYWxleEB2ZXJpc2lnbi5jb20wWzANBgkqhkiG9w0BAQEFAANK | ||
| 12 | ADBHAkAOy7xxCAIkOfuIA2LyRpxgKlDORl8htdXYhF5iBGUx1GYaK6KF+bK/CCI0 | ||
| 13 | l4j2OfWGFBUrwGoWqxTNcWgTfMzRAgMBAAGjggIyMIICLjAJBgNVHRMEAjAAMIIC | ||
| 14 | HwYDVR0DBIICFjCCAhIwggIOMIICCgYLYIZIAYb4RQEHAQEwggH5FoIBp1RoaXMg | ||
| 15 | Y2VydGlmaWNhdGUgaW5jb3Jwb3JhdGVzIGJ5IHJlZmVyZW5jZSwgYW5kIGl0cyB1 | ||
| 16 | c2UgaXMgc3RyaWN0bHkgc3ViamVjdCB0bywgdGhlIFZlcmlTaWduIENlcnRpZmlj | ||
| 17 | YXRpb24gUHJhY3RpY2UgU3RhdGVtZW50IChDUFMpLCBhdmFpbGFibGUgYXQ6IGh0 | ||
| 18 | dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9DUFM7IGJ5IEUtbWFpbCBhdCBDUFMtcmVx | ||
| 19 | dWVzdHNAdmVyaXNpZ24uY29tOyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMu | ||
| 20 | LCAyNTkzIENvYXN0IEF2ZS4sIE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBU | ||
| 21 | ZWwuICsxICg0MTUpIDk2MS04ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2ln | ||
| 22 | biwgSW5jLiAgQWxsIFJpZ2h0cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVT | ||
| 23 | IERJU0NMQUlNRUQgYW5kIExJQUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcB | ||
| 24 | AQGhDgYMYIZIAYb4RQEHAQECMCwwKhYoaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t | ||
| 25 | L3JlcG9zaXRvcnkvQ1BTIDANBgkqhkiG9w0BAQQFAAOBgQAimWMGQwwwxk+b3KAL | ||
| 26 | HlSWXtU7LWHe29CEG8XeVNTvrqs6SBqT7OoENOkGxpfdpVgZ3Qw2SKjxDvbvpfSF | ||
| 27 | slsqcxWSgB/hWuaVuZCkvTw/dYGGOxkTJGxvDCfl1PZjX4dKbatslsi9Z9HpGWT7 | ||
| 28 | ttItRwKqcBKgmCJvKi1pGWED0zCCAnkwggHioAMCAQICEDURpVKQb+fQKaRAGdQR | ||
| 29 | /D4wDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlT | ||
| 30 | aWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp | ||
| 31 | ZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2MDYyNzAwMDAwMFoXDTk3MDYyNzIzNTk1 | ||
| 32 | OVowYjERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMu | ||
| 33 | MTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJz | ||
| 34 | Y3JpYmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2FKbPTdAFDdjKI9Bv | ||
| 35 | qrQpkmOOLPhvltcunXZLEbE2jVfJw/0cxrr+Hgi6M8qV6r7jW80GqLd5HUQq7XPy | ||
| 36 | sVKDaBBwZJHXPmv5912dFEObbpdFmIFH0S3L3bty10w/cariQPJUObwW7s987Lrb | ||
| 37 | P2wqsxaxhhKdrpM01bjV0Pc+qQIDAQABozMwMTAPBgNVHRMECDAGAQH/AgEBMAsG | ||
| 38 | A1UdDwQEAwIBBjARBglghkgBhvhCAQEEBAMCAgQwDQYJKoZIhvcNAQECBQADgYEA | ||
| 39 | KeXHoBmnbxRCgk0jM9e9mDppdxpsipIna/J8DOHEUuD4nONAr4+xOg73SBl026n7 | ||
| 40 | Bk55A2wvAMGo7+kKTZ+rHaFDDcmq4O+rzFri2RIOeGAncj1IcGptAQhvXoIhFMG4 | ||
| 41 | Jlzg1KlHZHqy7D3jex78zcSU7kKOu8f5tAX1jC3+sToAAKGAMIIBJzCBkTANBgkq | ||
| 42 | hkiG9w0BAQIFADBiMREwDwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNp | ||
| 43 | Z24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlk | ||
| 44 | dWFsIFN1YnNjcmliZXIXDTk2MDcwMTE3MzA0MFoXDTk3MDcwMTAwMDAwMFowDQYJ | ||
| 45 | KoZIhvcNAQECBQADgYEAGLuQ6PX8A7AiqBEtWzYtl6lZNSDI0bR5YUo+D2Jzkw30 | ||
| 46 | dxQnJSbKXEc6XYuzAW5HvrzATXu5c19WWPT4cRDwmjH71i9QcDysWwf/wE0qGTiW | ||
| 47 | I3tQT0I5VGh7jIJD07nlBw3R4Xl8dH9kr85JsWinqDH5YKpIo9o8knY5n7+qjOow | ||
| 48 | ggEkMIGOMA0GCSqGSIb3DQEBAgUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5W | ||
| 49 | ZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJpbWFyeSBD | ||
| 50 | ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eRcNOTYwNzE2MjMxMTI5WhcNOTYwODE1MDAw | ||
| 51 | MDAwWjANBgkqhkiG9w0BAQIFAAOBgQAXsLE4vnsY6sY67QrmWec7iaU2ehzxanEK | ||
| 52 | /9wKHZNuhlNzk+qGZZw2evxfUe2OaRbYpl8zuZvhK9BHD3ad14OSe9/zx5hOPgP/ | ||
| 53 | DQXt6R4R8Q/1JheBrolrgbavjvI2wKS8/Psp2prBrkF4T48+AKRmS8Zzh1guxgvP | ||
| 54 | b+xSu/jH0gAAMYAAAAAAAAAAAA== | ||
diff --git a/src/lib/libssl/test/r160test.c b/src/lib/libssl/test/r160test.c deleted file mode 100644 index a172e393ca..0000000000 --- a/src/lib/libssl/test/r160test.c +++ /dev/null | |||
| @@ -1,57 +0,0 @@ | |||
| 1 | /* test/r160test.c */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
diff --git a/src/lib/libssl/test/tcrl b/src/lib/libssl/test/tcrl deleted file mode 100644 index acaf8f3c47..0000000000 --- a/src/lib/libssl/test/tcrl +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl crl' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=testcrl.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo testing crl conversions | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | #echo "p -> t" | ||
| 21 | #$cmd -in fff.p -inform p -outform t >f.t | ||
| 22 | #if [ $? != 0 ]; then exit 1; fi | ||
| 23 | echo "p -> p" | ||
| 24 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 25 | if [ $? != 0 ]; then exit 1; fi | ||
| 26 | |||
| 27 | echo "d -> d" | ||
| 28 | $cmd -in f.d -inform d -outform d >ff.d1 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | #echo "t -> d" | ||
| 31 | #$cmd -in f.t -inform t -outform d >ff.d2 | ||
| 32 | #if [ $? != 0 ]; then exit 1; fi | ||
| 33 | echo "p -> d" | ||
| 34 | $cmd -in f.p -inform p -outform d >ff.d3 | ||
| 35 | if [ $? != 0 ]; then exit 1; fi | ||
| 36 | |||
| 37 | #echo "d -> t" | ||
| 38 | #$cmd -in f.d -inform d -outform t >ff.t1 | ||
| 39 | #if [ $? != 0 ]; then exit 1; fi | ||
| 40 | #echo "t -> t" | ||
| 41 | #$cmd -in f.t -inform t -outform t >ff.t2 | ||
| 42 | #if [ $? != 0 ]; then exit 1; fi | ||
| 43 | #echo "p -> t" | ||
| 44 | #$cmd -in f.p -inform p -outform t >ff.t3 | ||
| 45 | #if [ $? != 0 ]; then exit 1; fi | ||
| 46 | |||
| 47 | echo "d -> p" | ||
| 48 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 49 | if [ $? != 0 ]; then exit 1; fi | ||
| 50 | #echo "t -> p" | ||
| 51 | #$cmd -in f.t -inform t -outform p >ff.p2 | ||
| 52 | #if [ $? != 0 ]; then exit 1; fi | ||
| 53 | echo "p -> p" | ||
| 54 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 55 | if [ $? != 0 ]; then exit 1; fi | ||
| 56 | |||
| 57 | cmp fff.p f.p | ||
| 58 | if [ $? != 0 ]; then exit 1; fi | ||
| 59 | cmp fff.p ff.p1 | ||
| 60 | if [ $? != 0 ]; then exit 1; fi | ||
| 61 | #cmp fff.p ff.p2 | ||
| 62 | #if [ $? != 0 ]; then exit 1; fi | ||
| 63 | cmp fff.p ff.p3 | ||
| 64 | if [ $? != 0 ]; then exit 1; fi | ||
| 65 | |||
| 66 | #cmp f.t ff.t1 | ||
| 67 | #if [ $? != 0 ]; then exit 1; fi | ||
| 68 | #cmp f.t ff.t2 | ||
| 69 | #if [ $? != 0 ]; then exit 1; fi | ||
| 70 | #cmp f.t ff.t3 | ||
| 71 | #if [ $? != 0 ]; then exit 1; fi | ||
| 72 | |||
| 73 | cmp f.p ff.p1 | ||
| 74 | if [ $? != 0 ]; then exit 1; fi | ||
| 75 | #cmp f.p ff.p2 | ||
| 76 | #if [ $? != 0 ]; then exit 1; fi | ||
| 77 | cmp f.p ff.p3 | ||
| 78 | if [ $? != 0 ]; then exit 1; fi | ||
| 79 | |||
| 80 | /bin/rm -f f.* ff.* fff.* | ||
| 81 | exit 0 | ||
diff --git a/src/lib/libssl/test/test.cnf b/src/lib/libssl/test/test.cnf deleted file mode 100644 index faad3914a8..0000000000 --- a/src/lib/libssl/test/test.cnf +++ /dev/null | |||
| @@ -1,88 +0,0 @@ | |||
| 1 | # | ||
| 2 | # SSLeay example configuration file. | ||
| 3 | # This is mostly being used for generation of certificate requests. | ||
| 4 | # | ||
| 5 | |||
| 6 | RANDFILE = ./.rnd | ||
| 7 | |||
| 8 | #################################################################### | ||
| 9 | [ ca ] | ||
| 10 | default_ca = CA_default # The default ca section | ||
| 11 | |||
| 12 | #################################################################### | ||
| 13 | [ CA_default ] | ||
| 14 | |||
| 15 | dir = ./demoCA # Where everything is kept | ||
| 16 | certs = $dir/certs # Where the issued certs are kept | ||
| 17 | crl_dir = $dir/crl # Where the issued crl are kept | ||
| 18 | database = $dir/index.txt # database index file. | ||
| 19 | new_certs_dir = $dir/new_certs # default place for new certs. | ||
| 20 | |||
| 21 | certificate = $dir/CAcert.pem # The CA certificate | ||
| 22 | serial = $dir/serial # The current serial number | ||
| 23 | crl = $dir/crl.pem # The current CRL | ||
| 24 | private_key = $dir/private/CAkey.pem# The private key | ||
| 25 | RANDFILE = $dir/private/.rand # private random number file | ||
| 26 | |||
| 27 | default_days = 365 # how long to certify for | ||
| 28 | default_crl_days= 30 # how long before next CRL | ||
| 29 | default_md = md5 # which md to use. | ||
| 30 | |||
| 31 | # A few difference way of specifying how similar the request should look | ||
| 32 | # For type CA, the listed attributes must be the same, and the optional | ||
| 33 | # and supplied fields are just that :-) | ||
| 34 | policy = policy_match | ||
| 35 | |||
| 36 | # For the CA policy | ||
| 37 | [ policy_match ] | ||
| 38 | countryName = match | ||
| 39 | stateOrProvinceName = match | ||
| 40 | organizationName = match | ||
| 41 | organizationalUnitName = optional | ||
| 42 | commonName = supplied | ||
| 43 | emailAddress = optional | ||
| 44 | |||
| 45 | # For the 'anything' policy | ||
| 46 | # At this point in time, you must list all acceptable 'object' | ||
| 47 | # types. | ||
| 48 | [ policy_anything ] | ||
| 49 | countryName = optional | ||
| 50 | stateOrProvinceName = optional | ||
| 51 | localityName = optional | ||
| 52 | organizationName = optional | ||
| 53 | organizationalUnitName = optional | ||
| 54 | commonName = supplied | ||
| 55 | emailAddress = optional | ||
| 56 | |||
| 57 | #################################################################### | ||
| 58 | [ req ] | ||
| 59 | default_bits = 512 | ||
| 60 | default_keyfile = testkey.pem | ||
| 61 | distinguished_name = req_distinguished_name | ||
| 62 | encrypt_rsa_key = no | ||
| 63 | |||
| 64 | [ req_distinguished_name ] | ||
| 65 | countryName = Country Name (2 letter code) | ||
| 66 | countryName_default = AU | ||
| 67 | countryName_value = AU | ||
| 68 | |||
| 69 | stateOrProvinceName = State or Province Name (full name) | ||
| 70 | stateOrProvinceName_default = Queensland | ||
| 71 | stateOrProvinceName_value = | ||
| 72 | |||
| 73 | localityName = Locality Name (eg, city) | ||
| 74 | localityName_value = Brisbane | ||
| 75 | |||
| 76 | organizationName = Organization Name (eg, company) | ||
| 77 | organizationName_default = | ||
| 78 | organizationName_value = CryptSoft Pty Ltd | ||
| 79 | |||
| 80 | organizationalUnitName = Organizational Unit Name (eg, section) | ||
| 81 | organizationalUnitName_default = | ||
| 82 | organizationalUnitName_value = . | ||
| 83 | |||
| 84 | commonName = Common Name (eg, YOUR name) | ||
| 85 | commonName_value = Eric Young | ||
| 86 | |||
| 87 | emailAddress = Email Address | ||
| 88 | emailAddress_value = eay@mincom.oz.au | ||
diff --git a/src/lib/libssl/test/testca b/src/lib/libssl/test/testca deleted file mode 100644 index 88c186b6ab..0000000000 --- a/src/lib/libssl/test/testca +++ /dev/null | |||
| @@ -1,44 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | SH="/bin/sh" | ||
| 4 | PATH=../apps:$PATH | ||
| 5 | export SH PATH | ||
| 6 | |||
| 7 | SSLEAY_CONFIG="-config CAss.cnf" | ||
| 8 | export SSLEAY_CONFIG | ||
| 9 | |||
| 10 | /bin/rm -fr demoCA | ||
| 11 | $SH ../apps/CA.sh -newca <<EOF | ||
| 12 | EOF | ||
| 13 | |||
| 14 | if [ $? != 0 ]; then | ||
| 15 | exit 1; | ||
| 16 | fi | ||
| 17 | |||
| 18 | SSLEAY_CONFIG="-config Uss.cnf" | ||
| 19 | export SSLEAY_CONFIG | ||
| 20 | $SH ../apps/CA.sh -newreq | ||
| 21 | if [ $? != 0 ]; then | ||
| 22 | exit 1; | ||
| 23 | fi | ||
| 24 | |||
| 25 | |||
| 26 | SSLEAY_CONFIG="-config ../apps/openssl.cnf" | ||
| 27 | export SSLEAY_CONFIG | ||
| 28 | $SH ../apps/CA.sh -sign <<EOF | ||
| 29 | y | ||
| 30 | y | ||
| 31 | EOF | ||
| 32 | if [ $? != 0 ]; then | ||
| 33 | exit 1; | ||
| 34 | fi | ||
| 35 | |||
| 36 | |||
| 37 | $SH ../apps/CA.sh -verify newcert.pem | ||
| 38 | if [ $? != 0 ]; then | ||
| 39 | exit 1; | ||
| 40 | fi | ||
| 41 | |||
| 42 | /bin/rm -fr demoCA newcert.pem newreq.pem | ||
| 43 | #usage: CA -newcert|-newreq|-newca|-sign|-verify | ||
| 44 | |||
diff --git a/src/lib/libssl/test/testcrl.pem b/src/lib/libssl/test/testcrl.pem deleted file mode 100644 index 0989788354..0000000000 --- a/src/lib/libssl/test/testcrl.pem +++ /dev/null | |||
| @@ -1,16 +0,0 @@ | |||
| 1 | -----BEGIN X509 CRL----- | ||
| 2 | MIICjTCCAfowDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxIDAeBgNVBAoT | ||
| 3 | F1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYDVQQLEyVTZWN1cmUgU2VydmVy | ||
| 4 | IENlcnRpZmljYXRpb24gQXV0aG9yaXR5Fw05NTA1MDIwMjEyMjZaFw05NTA2MDEw | ||
| 5 | MDAxNDlaMIIBaDAWAgUCQQAABBcNOTUwMjAxMTcyNDI2WjAWAgUCQQAACRcNOTUw | ||
| 6 | MjEwMDIxNjM5WjAWAgUCQQAADxcNOTUwMjI0MDAxMjQ5WjAWAgUCQQAADBcNOTUw | ||
| 7 | MjI1MDA0NjQ0WjAWAgUCQQAAGxcNOTUwMzEzMTg0MDQ5WjAWAgUCQQAAFhcNOTUw | ||
| 8 | MzE1MTkxNjU0WjAWAgUCQQAAGhcNOTUwMzE1MTk0MDQxWjAWAgUCQQAAHxcNOTUw | ||
| 9 | MzI0MTk0NDMzWjAWAgUCcgAABRcNOTUwMzI5MjAwNzExWjAWAgUCcgAAERcNOTUw | ||
| 10 | MzMwMDIzNDI2WjAWAgUCQQAAIBcNOTUwNDA3MDExMzIxWjAWAgUCcgAAHhcNOTUw | ||
| 11 | NDA4MDAwMjU5WjAWAgUCcgAAQRcNOTUwNDI4MTcxNzI0WjAWAgUCcgAAOBcNOTUw | ||
| 12 | NDI4MTcyNzIxWjAWAgUCcgAATBcNOTUwNTAyMDIxMjI2WjANBgkqhkiG9w0BAQIF | ||
| 13 | AAN+AHqOEJXSDejYy0UwxxrH/9+N2z5xu/if0J6qQmK92W0hW158wpJg+ovV3+wQ | ||
| 14 | wvIEPRL2rocL0tKfAsVq1IawSJzSNgxG0lrcla3MrJBnZ4GaZDu4FutZh72MR3Gt | ||
| 15 | JaAL3iTJHJD55kK2D/VoyY1djlsPuNh6AEgdVwFAyp0v | ||
| 16 | -----END X509 CRL----- | ||
diff --git a/src/lib/libssl/test/testenc b/src/lib/libssl/test/testenc deleted file mode 100644 index 0656c7f525..0000000000 --- a/src/lib/libssl/test/testenc +++ /dev/null | |||
| @@ -1,54 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | testsrc=Makefile.ssl | ||
| 4 | test=./p | ||
| 5 | cmd=../apps/openssl | ||
| 6 | |||
| 7 | cat $testsrc >$test; | ||
| 8 | |||
| 9 | echo cat | ||
| 10 | $cmd enc < $test > $test.cipher | ||
| 11 | $cmd enc < $test.cipher >$test.clear | ||
| 12 | cmp $test $test.clear | ||
| 13 | if [ $? != 0 ] | ||
| 14 | then | ||
| 15 | exit 1 | ||
| 16 | else | ||
| 17 | /bin/rm $test.cipher $test.clear | ||
| 18 | fi | ||
| 19 | echo base64 | ||
| 20 | $cmd enc -a -e < $test > $test.cipher | ||
| 21 | $cmd enc -a -d < $test.cipher >$test.clear | ||
| 22 | cmp $test $test.clear | ||
| 23 | if [ $? != 0 ] | ||
| 24 | then | ||
| 25 | exit 1 | ||
| 26 | else | ||
| 27 | /bin/rm $test.cipher $test.clear | ||
| 28 | fi | ||
| 29 | |||
| 30 | for i in `$cmd list-cipher-commands` | ||
| 31 | do | ||
| 32 | echo $i | ||
| 33 | $cmd $i -bufsize 113 -e -k test < $test > $test.$i.cipher | ||
| 34 | $cmd $i -bufsize 157 -d -k test < $test.$i.cipher >$test.$i.clear | ||
| 35 | cmp $test $test.$i.clear | ||
| 36 | if [ $? != 0 ] | ||
| 37 | then | ||
| 38 | exit 1 | ||
| 39 | else | ||
| 40 | /bin/rm $test.$i.cipher $test.$i.clear | ||
| 41 | fi | ||
| 42 | |||
| 43 | echo $i base64 | ||
| 44 | $cmd $i -bufsize 113 -a -e -k test < $test > $test.$i.cipher | ||
| 45 | $cmd $i -bufsize 157 -a -d -k test < $test.$i.cipher >$test.$i.clear | ||
| 46 | cmp $test $test.$i.clear | ||
| 47 | if [ $? != 0 ] | ||
| 48 | then | ||
| 49 | exit 1 | ||
| 50 | else | ||
| 51 | /bin/rm $test.$i.cipher $test.$i.clear | ||
| 52 | fi | ||
| 53 | done | ||
| 54 | rm -f $test | ||
diff --git a/src/lib/libssl/test/testgen b/src/lib/libssl/test/testgen deleted file mode 100644 index c5f61b582b..0000000000 --- a/src/lib/libssl/test/testgen +++ /dev/null | |||
| @@ -1,32 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | T=testcert | ||
| 4 | KEY=512 | ||
| 5 | CA=../certs/testca.pem | ||
| 6 | |||
| 7 | /bin/rm -f $T.1 $T.2 $T.key | ||
| 8 | |||
| 9 | PATH=../apps:$PATH; | ||
| 10 | export PATH | ||
| 11 | |||
| 12 | echo "generating certificate request" | ||
| 13 | |||
| 14 | echo "There should be a 2 sequences of .'s and some +'s." | ||
| 15 | echo "There should not be more that at most 80 per line" | ||
| 16 | echo "This could take some time." | ||
| 17 | |||
| 18 | echo "string to make the random number generator think it has entropy" >> ./.rnd | ||
| 19 | |||
| 20 | ../apps/openssl req -config test.cnf -new -out testreq.pem | ||
| 21 | if [ $? != 0 ]; then | ||
| 22 | echo problems creating request | ||
| 23 | exit 1 | ||
| 24 | fi | ||
| 25 | |||
| 26 | ../apps/openssl req -config test.cnf -verify -in testreq.pem -noout | ||
| 27 | if [ $? != 0 ]; then | ||
| 28 | echo signature on req is wrong | ||
| 29 | exit 1 | ||
| 30 | fi | ||
| 31 | |||
| 32 | exit 0 | ||
diff --git a/src/lib/libssl/test/testp7.pem b/src/lib/libssl/test/testp7.pem deleted file mode 100644 index e5b7866c31..0000000000 --- a/src/lib/libssl/test/testp7.pem +++ /dev/null | |||
| @@ -1,46 +0,0 @@ | |||
| 1 | -----BEGIN PKCS7----- | ||
| 2 | MIIIGAYJKoZIhvcNAQcCoIIICTCCCAUCAQExADALBgkqhkiG9w0BBwGgggY8MIIE | ||
| 3 | cjCCBBygAwIBAgIQeS+OJfWJUZAx6cX0eAiMjzANBgkqhkiG9w0BAQQFADBiMREw | ||
| 4 | DwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNV | ||
| 5 | BAsTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXIw | ||
| 6 | HhcNOTYwNzE5MDAwMDAwWhcNOTcwMzMwMjM1OTU5WjCB1TERMA8GA1UEBxMISW50 | ||
| 7 | ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2ln | ||
| 8 | biBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMSgwJgYDVQQLEx9E | ||
| 9 | aWdpdGFsIElEIENsYXNzIDEgLSBTTUlNRSBUZXN0MUcwRQYDVQQLEz53d3cudmVy | ||
| 10 | aXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTLTEuMCBJbmMuIGJ5IFJlZi4sTElBQi5M | ||
| 11 | VEQoYyk5NjBbMA0GCSqGSIb3DQEBAQUAA0oAMEcCQA7LvHEIAiQ5+4gDYvJGnGAq | ||
| 12 | UM5GXyG11diEXmIEZTHUZhorooX5sr8IIjSXiPY59YYUFSvAaharFM1xaBN8zNEC | ||
| 13 | AwEAAaOCAjkwggI1MAkGA1UdEwQCMAAwggImBgNVHQMEggIdMIICGTCCAhUwggIR | ||
| 14 | BgtghkgBhvhFAQcBATCCAgAWggGrVGhpcyBjZXJ0aWZpY2F0ZSBpbmNvcnBvcmF0 | ||
| 15 | ZXMgYnkgcmVmZXJlbmNlLCBhbmQgaXRzIHVzZSBpcyBzdHJpY3RseSBzdWJqZWN0 | ||
| 16 | IHRvLCB0aGUgVmVyaVNpZ24gQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1l | ||
| 17 | bnQgKENQUyksIGF2YWlsYWJsZSBhdDogaHR0cHM6Ly93d3cudmVyaXNpZ24uY29t | ||
| 18 | L0NQUy0xLjA7IGJ5IEUtbWFpbCBhdCBDUFMtcmVxdWVzdHNAdmVyaXNpZ24uY29t | ||
| 19 | OyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMuLCAyNTkzIENvYXN0IEF2ZS4s | ||
| 20 | IE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBUZWwuICsxICg0MTUpIDk2MS04 | ||
| 21 | ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2lnbiwgSW5jLiAgQWxsIFJpZ2h0 | ||
| 22 | cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVTIERJU0NMQUlNRUQgYW5kIExJ | ||
| 23 | QUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcBAQGhDgYMYIZIAYb4RQEHAQEC | ||
| 24 | MC8wLRYraHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTLTEu | ||
| 25 | AzANBgkqhkiG9w0BAQQFAANBAMCYDuSb/eIlYSxY31nZZTaCZkCSfHjlacMofExr | ||
| 26 | cF+A2yHoEuT+eCQkqM0pMNHXddUeoQ9RjV+VuMBNmm63DUYwggHCMIIBbKADAgEC | ||
| 27 | AhB8CYTq1bkRFJBYOd67cp9JMA0GCSqGSIb3DQEBAgUAMD4xCzAJBgNVBAYTAlVT | ||
| 28 | MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEWMBQGA1UECxMNVEVTVCBSb290IFBD | ||
| 29 | QTAeFw05NjA3MTcwMDAwMDBaFw05NzA3MTcyMzU5NTlaMGIxETAPBgNVBAcTCElu | ||
| 30 | dGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVyaVNp | ||
| 31 | Z24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjBcMA0GCSqGSIb3 | ||
| 32 | DQEBAQUAA0sAMEgCQQDsVzrNgnDhbAJZrWeLd9g1vMZJA2W67D33TTbga6yMt+ES | ||
| 33 | TWEywhS6RNP+fzLGg7utinjH4tL60cXa0G27GDsLAgMBAAGjIjAgMAsGA1UdDwQE | ||
| 34 | AwIBBjARBglghkgBhvhCAQEEBAMCAgQwDQYJKoZIhvcNAQECBQADQQAUp6bRwkaD | ||
| 35 | 2d1MBs/mjUcgTI2fXVmW8tTm/Ud6OzUwpC3vYgybiOOA4f6mOC5dbyUHrLOsrihU | ||
| 36 | 47ZQ0Jo1DUfboYIBrTCBwTBtMA0GCSqGSIb3DQEBAgUAMD4xCzAJBgNVBAYTAlVT | ||
| 37 | MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEWMBQGA1UECxMNVEVTVCBSb290IFBD | ||
| 38 | QRcNOTYwNzE3MTc0NDA5WhcNOTgwNzE3MDAwMDAwWjANBgkqhkiG9w0BAQIFAANB | ||
| 39 | AHitA0/xAukCjHzeh1AMT/l2oC68N+yFb+aJPHBBMxc6gG2MaKjBNwb5hcXUllMl | ||
| 40 | ExONA3ju10f7owIq3s3wx10wgeYwgZEwDQYJKoZIhvcNAQECBQAwYjERMA8GA1UE | ||
| 41 | BxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytW | ||
| 42 | ZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyFw05NjA3 | ||
| 43 | MTcxNzU5MjlaFw05NzA3MTgwMDAwMDBaMA0GCSqGSIb3DQEBAgUAA0EAubVWYTsW | ||
| 44 | sQmste9f+UgMw8BkjDlM25fwQLrCfmmnLxjewey10kSROypUaJLb+r4oRALc0fG9 | ||
| 45 | XfZsaiiIgotQHjEA | ||
| 46 | -----END PKCS7----- | ||
diff --git a/src/lib/libssl/test/testreq2.pem b/src/lib/libssl/test/testreq2.pem deleted file mode 100644 index c3cdcffcbc..0000000000 --- a/src/lib/libssl/test/testreq2.pem +++ /dev/null | |||
| @@ -1,7 +0,0 @@ | |||
| 1 | -----BEGIN CERTIFICATE REQUEST----- | ||
| 2 | MIHaMIGFAgEAMA4xDDAKBgNVBAMTA2NuNDBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC | ||
| 3 | QQCQsnkyUGDY2R3mYoeTprFJKgWuJ3f1jUjlIuW5+wfAUoeMt35c4vcFZ2mIBpEG | ||
| 4 | DtzkNQN1kr2O9ldm9zYnYhyhAgMBAAGgEjAQBgorBgEEAYI3AgEOMQIwADANBgkq | ||
| 5 | hkiG9w0BAQQFAANBAAb2szZgVIxg3vK6kYLjGSBISyuzcXJ6IvuPW6M+yzi1Qgoi | ||
| 6 | gQhazHTJp91T8ItZEzUJGZSZl2e5iXlnffWB+/U= | ||
| 7 | -----END CERTIFICATE REQUEST----- | ||
diff --git a/src/lib/libssl/test/testrsa.pem b/src/lib/libssl/test/testrsa.pem deleted file mode 100644 index aad21067a8..0000000000 --- a/src/lib/libssl/test/testrsa.pem +++ /dev/null | |||
| @@ -1,9 +0,0 @@ | |||
| 1 | -----BEGIN RSA PRIVATE KEY----- | ||
| 2 | MIIBPAIBAAJBAKrbeqkuRk8VcRmWFmtP+LviMB3+6dizWW3DwaffznyHGAFwUJ/I | ||
| 3 | Tv0XtbsCyl3QoyKGhrOAy3RvPK5M38iuXT0CAwEAAQJAZ3cnzaHXM/bxGaR5CR1R | ||
| 4 | rD1qFBAVfoQFiOH9uPJgMaoAuoQEisPHVcZDKcOv4wEg6/TInAIXBnEigtqvRzuy | ||
| 5 | oQIhAPcgZzUq3yVooAaoov8UbXPxqHlwo6GBMqnv20xzkf6ZAiEAsP4BnIaQTM8S | ||
| 6 | mvcpHZwQJdmdHHkGKAs37Dfxi67HbkUCIQCeZGliHXFa071Fp06ZeWlR2ADonTZz | ||
| 7 | rJBhdTe0v5pCeQIhAIZfkiGgGBX4cIuuckzEm43g9WMUjxP/0GlK39vIyihxAiEA | ||
| 8 | mymehFRT0MvqW5xAKAx7Pgkt8HVKwVhc2LwGKHE0DZM= | ||
| 9 | -----END RSA PRIVATE KEY----- | ||
diff --git a/src/lib/libssl/test/testsid.pem b/src/lib/libssl/test/testsid.pem deleted file mode 100644 index 7ffd008f66..0000000000 --- a/src/lib/libssl/test/testsid.pem +++ /dev/null | |||
| @@ -1,12 +0,0 @@ | |||
| 1 | -----BEGIN SSL SESSION PARAMETERS----- | ||
| 2 | MIIB1gIBAQIBAgQDAQCABBCi11xa5qkOP8xrr02K/NQCBBBkIYQZM0Bt95W0EHNV | ||
| 3 | bA58oQYCBDIBr7WiBAICASyjggGGMIIBgjCCASwCAQMwDQYJKoZIhvcNAQEEBQAw | ||
| 4 | ODELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3Jz | ||
| 5 | YSB0ZXN0IENBMB4XDTk1MTAwOTIzMzEzNFoXDTk4MDcwNTIzMzEzNFowYDELMAkG | ||
| 6 | A1UEBhMCQVUxDDAKBgNVBAgTA1FMRDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRk | ||
| 7 | LjELMAkGA1UECxMCQ1MxGzAZBgNVBAMTElNTTGVheSBkZW1vIGNsaWVudDBcMA0G | ||
| 8 | CSqGSIb3DQEBAQUAA0sAMEgCQQC4pcXEL1lgVA+B5Q3TcuW/O3LZHoA73IYm8oFD | ||
| 9 | TezgCDhL2RTMn+seKWF36UtJKRIOBU9jZHCVVd0Me5ls6BEjAgMBAAEwDQYJKoZI | ||
| 10 | hvcNAQEEBQADQQBoIpOcwUY1qlVF7j3ROSGvUsbvByOBFmYWkIBgsCqR+9qo1A7L | ||
| 11 | CrWF5i8LWt/vLwAHaxWNx2YuBJMFyuK81fTvpA0EC3Rlc3Rjb250ZXh0 | ||
| 12 | -----END SSL SESSION PARAMETERS----- | ||
diff --git a/src/lib/libssl/test/testss b/src/lib/libssl/test/testss deleted file mode 100644 index da62997a5f..0000000000 --- a/src/lib/libssl/test/testss +++ /dev/null | |||
| @@ -1,90 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | digest='-mdc2' | ||
| 4 | reqcmd="../apps/openssl req" | ||
| 5 | x509cmd="../apps/openssl x509 $digest" | ||
| 6 | verifycmd="../apps/openssl verify" | ||
| 7 | dummycnf="../apps/openssl.cnf" | ||
| 8 | |||
| 9 | CAkey="keyCA.ss" | ||
| 10 | CAcert="certCA.ss" | ||
| 11 | CAreq="reqCA.ss" | ||
| 12 | CAconf="CAss.cnf" | ||
| 13 | CAreq2="req2CA.ss" # temp | ||
| 14 | |||
| 15 | Uconf="Uss.cnf" | ||
| 16 | Ukey="keyU.ss" | ||
| 17 | Ureq="reqU.ss" | ||
| 18 | Ucert="certU.ss" | ||
| 19 | |||
| 20 | echo | ||
| 21 | echo "make a certificate request using 'req'" | ||
| 22 | $reqcmd -config $CAconf -out $CAreq -keyout $CAkey -new #>err.ss | ||
| 23 | if [ $? != 0 ]; then | ||
| 24 | echo "error using 'req' to generate a certificate request" | ||
| 25 | exit 1 | ||
| 26 | fi | ||
| 27 | echo | ||
| 28 | echo "convert the certificate request into a self signed certificate using 'x509'" | ||
| 29 | $x509cmd -CAcreateserial -in $CAreq -days 30 -req -out $CAcert -signkey $CAkey >err.ss | ||
| 30 | if [ $? != 0 ]; then | ||
| 31 | echo "error using 'x509' to self sign a certificate request" | ||
| 32 | exit 1 | ||
| 33 | fi | ||
| 34 | |||
| 35 | echo | ||
| 36 | echo "convert a certificate into a certificate request using 'x509'" | ||
| 37 | $x509cmd -in $CAcert -x509toreq -signkey $CAkey -out $CAreq2 >err.ss | ||
| 38 | if [ $? != 0 ]; then | ||
| 39 | echo "error using 'x509' convert a certificate to a certificate request" | ||
| 40 | exit 1 | ||
| 41 | fi | ||
| 42 | |||
| 43 | $reqcmd -config $dummycnf -verify -in $CAreq -noout | ||
| 44 | if [ $? != 0 ]; then | ||
| 45 | echo first generated request is invalid | ||
| 46 | exit 1 | ||
| 47 | fi | ||
| 48 | |||
| 49 | $reqcmd -config $dummycnf -verify -in $CAreq2 -noout | ||
| 50 | if [ $? != 0 ]; then | ||
| 51 | echo second generated request is invalid | ||
| 52 | exit 1 | ||
| 53 | fi | ||
| 54 | |||
| 55 | $verifycmd -CAfile $CAcert $CAcert | ||
| 56 | if [ $? != 0 ]; then | ||
| 57 | echo first generated cert is invalid | ||
| 58 | exit 1 | ||
| 59 | fi | ||
| 60 | |||
| 61 | echo | ||
| 62 | echo "make another certificate request using 'req'" | ||
| 63 | $reqcmd -config $Uconf -out $Ureq -keyout $Ukey -new >err.ss | ||
| 64 | if [ $? != 0 ]; then | ||
| 65 | echo "error using 'req' to generate a certificate request" | ||
| 66 | exit 1 | ||
| 67 | fi | ||
| 68 | |||
| 69 | echo | ||
| 70 | echo "sign certificate request with the just created CA via 'x509'" | ||
| 71 | $x509cmd -CAcreateserial -in $Ureq -days 30 -req -out $Ucert -CA $CAcert -CAkey $CAkey >err.ss | ||
| 72 | if [ $? != 0 ]; then | ||
| 73 | echo "error using 'x509' to sign a certificate request" | ||
| 74 | exit 1 | ||
| 75 | fi | ||
| 76 | |||
| 77 | $verifycmd -CAfile $CAcert $Ucert | ||
| 78 | echo | ||
| 79 | echo "Certificate details" | ||
| 80 | $x509cmd -subject -issuer -startdate -enddate -noout -in $Ucert | ||
| 81 | |||
| 82 | echo | ||
| 83 | echo The generated CA certificate is $CAcert | ||
| 84 | echo The generated CA private key is $CAkey | ||
| 85 | |||
| 86 | echo The generated user certificate is $Ucert | ||
| 87 | echo The generated user private key is $Ukey | ||
| 88 | |||
| 89 | /bin/rm err.ss | ||
| 90 | exit 0 | ||
diff --git a/src/lib/libssl/test/testssl b/src/lib/libssl/test/testssl deleted file mode 100644 index a88e290c57..0000000000 --- a/src/lib/libssl/test/testssl +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | echo test sslv2 | ||
| 4 | ./ssltest -ssl2 || exit 1 | ||
| 5 | |||
| 6 | echo test sslv2 with server authentication | ||
| 7 | ./ssltest -ssl2 -server_auth -CApath ../certs || exit 1 | ||
| 8 | |||
| 9 | echo test sslv2 with client authentication | ||
| 10 | ./ssltest -ssl2 -client_auth -CApath ../certs || exit 1 | ||
| 11 | |||
| 12 | echo test sslv2 with both client and server authentication | ||
| 13 | ./ssltest -ssl2 -server_auth -client_auth -CApath ../certs || exit 1 | ||
| 14 | |||
| 15 | echo test sslv3 | ||
| 16 | ./ssltest -ssl3 || exit 1 | ||
| 17 | |||
| 18 | echo test sslv3 with server authentication | ||
| 19 | ./ssltest -ssl3 -server_auth -CApath ../certs || exit 1 | ||
| 20 | |||
| 21 | echo test sslv3 with client authentication | ||
| 22 | ./ssltest -ssl3 -client_auth -CApath ../certs || exit 1 | ||
| 23 | |||
| 24 | echo test sslv3 with both client and server authentication | ||
| 25 | ./ssltest -ssl3 -server_auth -client_auth -CApath ../certs || exit 1 | ||
| 26 | |||
| 27 | echo test sslv2/sslv3 | ||
| 28 | ./ssltest || exit 1 | ||
| 29 | |||
| 30 | echo test sslv2/sslv3 with server authentication | ||
| 31 | ./ssltest -server_auth -CApath ../certs || exit 1 | ||
| 32 | |||
| 33 | echo test sslv2/sslv3 with client authentication | ||
| 34 | ./ssltest -client_auth -CApath ../certs || exit 1 | ||
| 35 | |||
| 36 | echo test sslv2/sslv3 with both client and server authentication | ||
| 37 | ./ssltest -server_auth -client_auth -CApath ../certs || exit 1 | ||
| 38 | |||
| 39 | echo test sslv2 via BIO pair | ||
| 40 | ./ssltest -bio_pair -ssl2 || exit 1 | ||
| 41 | |||
| 42 | echo test sslv2 with server authentication via BIO pair | ||
| 43 | ./ssltest -bio_pair -ssl2 -server_auth -CApath ../certs || exit 1 | ||
| 44 | |||
| 45 | echo test sslv2 with client authentication via BIO pair | ||
| 46 | ./ssltest -bio_pair -ssl2 -client_auth -CApath ../certs || exit 1 | ||
| 47 | |||
| 48 | echo test sslv2 with both client and server authentication via BIO pair | ||
| 49 | ./ssltest -bio_pair -ssl2 -server_auth -client_auth -CApath ../certs || exit 1 | ||
| 50 | |||
| 51 | echo test sslv3 via BIO pair | ||
| 52 | ./ssltest -bio_pair -ssl3 || exit 1 | ||
| 53 | |||
| 54 | echo test sslv3 with server authentication via BIO pair | ||
| 55 | ./ssltest -bio_pair -ssl3 -server_auth -CApath ../certs || exit 1 | ||
| 56 | |||
| 57 | echo test sslv3 with client authentication via BIO pair | ||
| 58 | ./ssltest -bio_pair -ssl3 -client_auth -CApath ../certs || exit 1 | ||
| 59 | |||
| 60 | echo test sslv3 with both client and server authentication via BIO pair | ||
| 61 | ./ssltest -bio_pair -ssl3 -server_auth -client_auth -CApath ../certs || exit 1 | ||
| 62 | |||
| 63 | echo test sslv2/sslv3 via BIO pair | ||
| 64 | ./ssltest || exit 1 | ||
| 65 | |||
| 66 | echo test sslv2/sslv3 w/o DHE via BIO pair | ||
| 67 | ./ssltest -bio_pair -no_dhe || exit 1 | ||
| 68 | |||
| 69 | echo test sslv2/sslv3 with 1024bit DHE | ||
| 70 | ./ssltest -bio_pair -dhe1024 -v || exit 1 | ||
| 71 | |||
| 72 | echo test sslv2/sslv3 with server authentication | ||
| 73 | ./ssltest -bio_pair -server_auth -CApath ../certs || exit 1 | ||
| 74 | |||
| 75 | echo test sslv2/sslv3 with client authentication via BIO pair | ||
| 76 | ./ssltest -bio_pair -client_auth -CApath ../certs || exit 1 | ||
| 77 | |||
| 78 | echo test sslv2/sslv3 with both client and server authentication via BIO pair | ||
| 79 | ./ssltest -bio_pair -server_auth -client_auth -CApath ../certs || exit 1 | ||
| 80 | |||
| 81 | exit 0 | ||
diff --git a/src/lib/libssl/test/testx509.pem b/src/lib/libssl/test/testx509.pem deleted file mode 100644 index 8a85d14964..0000000000 --- a/src/lib/libssl/test/testx509.pem +++ /dev/null | |||
| @@ -1,10 +0,0 @@ | |||
| 1 | -----BEGIN CERTIFICATE----- | ||
| 2 | MIIBWzCCAQYCARgwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV | ||
| 3 | BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MDYxOTIz | ||
| 4 | MzMxMloXDTk1MDcxNzIzMzMxMlowOjELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM | ||
| 5 | RDEdMBsGA1UEAxMUU1NMZWF5L3JzYSB0ZXN0IGNlcnQwXDANBgkqhkiG9w0BAQEF | ||
| 6 | AANLADBIAkEAqtt6qS5GTxVxGZYWa0/4u+IwHf7p2LNZbcPBp9/OfIcYAXBQn8hO | ||
| 7 | /Re1uwLKXdCjIoaGs4DLdG88rkzfyK5dPQIDAQABMAwGCCqGSIb3DQIFBQADQQAE | ||
| 8 | Wc7EcF8po2/ZO6kNCwK/ICH6DobgLekA5lSLr5EvuioZniZp5lFzAw4+YzPQ7XKJ | ||
| 9 | zl9HYIMxATFyqSiD9jsx | ||
| 10 | -----END CERTIFICATE----- | ||
diff --git a/src/lib/libssl/test/times b/src/lib/libssl/test/times deleted file mode 100644 index 49aeebf216..0000000000 --- a/src/lib/libssl/test/times +++ /dev/null | |||
| @@ -1,113 +0,0 @@ | |||
| 1 | |||
| 2 | More number for the questions about SSL overheads.... | ||
| 3 | |||
| 4 | The following numbers were generated on a pentium pro 200, running linux. | ||
| 5 | They give an indication of the SSL protocol and encryption overheads. | ||
| 6 | |||
| 7 | The program that generated them is an unreleased version of ssl/ssltest.c | ||
| 8 | which is the SSLeay ssl protocol testing program. It is a single process that | ||
| 9 | talks both sides of the SSL protocol via a non-blocking memory buffer | ||
| 10 | interface. | ||
| 11 | |||
| 12 | How do I read this? The protocol and cipher are reasonable obvious. | ||
| 13 | The next number is the number of connections being made. The next is the | ||
| 14 | number of bytes exchanged bewteen the client and server side of the protocol. | ||
| 15 | This is the number of bytes that the client sends to the server, and then | ||
| 16 | the server sends back. Because this is all happening in one process, | ||
| 17 | the data is being encrypted, decrypted, encrypted and then decrypted again. | ||
| 18 | It is a round trip of that many bytes. Because the one process performs | ||
| 19 | both the client and server sides of the protocol and it sends this many bytes | ||
| 20 | each direction, multiply this number by 4 to generate the number | ||
| 21 | of bytes encrypted/decrypted/MACed. The first time value is how many seconds | ||
| 22 | elapsed doing a full SSL handshake, the second is the cost of one | ||
| 23 | full handshake and the rest being session-id reuse. | ||
| 24 | |||
| 25 | SSLv2 RC4-MD5 1000 x 1 12.83s 0.70s | ||
| 26 | SSLv3 NULL-MD5 1000 x 1 14.35s 1.47s | ||
| 27 | SSLv3 RC4-MD5 1000 x 1 14.46s 1.56s | ||
| 28 | SSLv3 RC4-MD5 1000 x 1 51.93s 1.62s 1024bit RSA | ||
| 29 | SSLv3 RC4-SHA 1000 x 1 14.61s 1.83s | ||
| 30 | SSLv3 DES-CBC-SHA 1000 x 1 14.70s 1.89s | ||
| 31 | SSLv3 DES-CBC3-SHA 1000 x 1 15.16s 2.16s | ||
| 32 | |||
| 33 | SSLv2 RC4-MD5 1000 x 1024 13.72s 1.27s | ||
| 34 | SSLv3 NULL-MD5 1000 x 1024 14.79s 1.92s | ||
| 35 | SSLv3 RC4-MD5 1000 x 1024 52.58s 2.29s 1024bit RSA | ||
| 36 | SSLv3 RC4-SHA 1000 x 1024 15.39s 2.67s | ||
| 37 | SSLv3 DES-CBC-SHA 1000 x 1024 16.45s 3.55s | ||
| 38 | SSLv3 DES-CBC3-SHA 1000 x 1024 18.21s 5.38s | ||
| 39 | |||
| 40 | SSLv2 RC4-MD5 1000 x 10240 18.97s 6.52s | ||
| 41 | SSLv3 NULL-MD5 1000 x 10240 17.79s 5.11s | ||
| 42 | SSLv3 RC4-MD5 1000 x 10240 20.25s 7.90s | ||
| 43 | SSLv3 RC4-MD5 1000 x 10240 58.26s 8.08s 1024bit RSA | ||
| 44 | SSLv3 RC4-SHA 1000 x 10240 22.96s 11.44s | ||
| 45 | SSLv3 DES-CBC-SHA 1000 x 10240 30.65s 18.41s | ||
| 46 | SSLv3 DES-CBC3-SHA 1000 x 10240 47.04s 34.53s | ||
| 47 | |||
| 48 | SSLv2 RC4-MD5 1000 x 102400 70.22s 57.74s | ||
| 49 | SSLv3 NULL-MD5 1000 x 102400 43.73s 31.03s | ||
| 50 | SSLv3 RC4-MD5 1000 x 102400 71.32s 58.83s | ||
| 51 | SSLv3 RC4-MD5 1000 x 102400 109.66s 59.20s 1024bit RSA | ||
| 52 | SSLv3 RC4-SHA 1000 x 102400 95.88s 82.21s | ||
| 53 | SSLv3 DES-CBC-SHA 1000 x 102400 173.22s 160.55s | ||
| 54 | SSLv3 DES-CBC3-SHA 1000 x 102400 336.61s 323.82s | ||
| 55 | |||
| 56 | What does this all mean? Well for a server, with no session-id reuse, with | ||
| 57 | a transfer size of 10240 bytes, using RC4-MD5 and a 512bit server key, | ||
| 58 | a pentium pro 200 running linux can handle the SSLv3 protocol overheads of | ||
| 59 | about 49 connections a second. Reality will be quite different :-). | ||
| 60 | |||
| 61 | Remeber the first number is 1000 full ssl handshakes, the second is | ||
| 62 | 1 full and 999 with session-id reuse. The RSA overheads for each exchange | ||
| 63 | would be one public and one private operation, but the protocol/MAC/cipher | ||
| 64 | cost would be quite similar in both the client and server. | ||
| 65 | |||
| 66 | eric (adding numbers to speculation) | ||
| 67 | |||
| 68 | --- Appendix --- | ||
| 69 | - The time measured is user time but these number a very rough. | ||
| 70 | - Remember this is the cost of both client and server sides of the protocol. | ||
| 71 | - The TCP/kernal overhead of connection establishment is normally the | ||
| 72 | killer in SSL. Often delays in the TCP protocol will make session-id | ||
| 73 | reuse look slower that new sessions, but this would not be the case on | ||
| 74 | a loaded server. | ||
| 75 | - The TCP round trip latencies, while slowing indervidual connections, | ||
| 76 | would have minimal impact on throughput. | ||
| 77 | - Instead of sending one 102400 byte buffer, one 8k buffer is sent until | ||
| 78 | - the required number of bytes are processed. | ||
| 79 | - The SSLv3 connections were actually SSLv2 compatable SSLv3 headers. | ||
| 80 | - A 512bit server key was being used except where noted. | ||
| 81 | - No server key verification was being performed on the client side of the | ||
| 82 | protocol. This would slow things down very little. | ||
| 83 | - The library being used is SSLeay 0.8.x. | ||
| 84 | - The normal mesauring system was commands of the form | ||
| 85 | time ./ssltest -num 1000 -bytes 102400 -cipher DES-CBC-SHA -reuse | ||
| 86 | This modified version of ssltest should be in the next public release of | ||
| 87 | SSLeay. | ||
| 88 | |||
| 89 | The general cipher performace number for this platform are | ||
| 90 | |||
| 91 | SSLeay 0.8.2a 04-Sep-1997 | ||
| 92 | built on Fri Sep 5 17:37:05 EST 1997 | ||
| 93 | options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) idea(int) blowfish(ptr2) | ||
| 94 | C flags:gcc -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall -Wuninitialized | ||
| 95 | The 'numbers' are in 1000s of bytes per second processed. | ||
| 96 | type 8 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes | ||
| 97 | md2 131.02k 368.41k 500.57k 549.21k 566.09k | ||
| 98 | mdc2 535.60k 589.10k 595.88k 595.97k 594.54k | ||
| 99 | md5 1801.53k 9674.77k 17484.03k 21849.43k 23592.96k | ||
| 100 | sha 1261.63k 5533.25k 9285.63k 11187.88k 11913.90k | ||
| 101 | sha1 1103.13k 4782.53k 7933.78k 9472.34k 10070.70k | ||
| 102 | rc4 10722.53k 14443.93k 15215.79k 15299.24k 15219.59k | ||
| 103 | des cbc 3286.57k 3827.73k 3913.39k 3931.82k 3926.70k | ||
| 104 | des ede3 1443.50k 1549.08k 1561.17k 1566.38k 1564.67k | ||
| 105 | idea cbc 2203.64k 2508.16k 2538.33k 2543.62k 2547.71k | ||
| 106 | rc2 cbc 1430.94k 1511.59k 1524.82k 1527.13k 1523.33k | ||
| 107 | blowfish cbc 4716.07k 5965.82k 6190.17k 6243.67k 6234.11k | ||
| 108 | sign verify | ||
| 109 | rsa 512 bits 0.0100s 0.0011s | ||
| 110 | rsa 1024 bits 0.0451s 0.0012s | ||
| 111 | rsa 2048 bits 0.2605s 0.0086s | ||
| 112 | rsa 4096 bits 1.6883s 0.0302s | ||
| 113 | |||
diff --git a/src/lib/libssl/test/tpkcs7 b/src/lib/libssl/test/tpkcs7 deleted file mode 100644 index 15bbba42c0..0000000000 --- a/src/lib/libssl/test/tpkcs7 +++ /dev/null | |||
| @@ -1,51 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl pkcs7' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=testp7.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo testing pkcs7 conversions | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | echo "p -> p" | ||
| 21 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 22 | if [ $? != 0 ]; then exit 1; fi | ||
| 23 | |||
| 24 | echo "d -> d" | ||
| 25 | $cmd -in f.d -inform d -outform d >ff.d1 | ||
| 26 | if [ $? != 0 ]; then exit 1; fi | ||
| 27 | echo "p -> d" | ||
| 28 | $cmd -in f.p -inform p -outform d >ff.d3 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | |||
| 31 | echo "d -> p" | ||
| 32 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 33 | if [ $? != 0 ]; then exit 1; fi | ||
| 34 | echo "p -> p" | ||
| 35 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 36 | if [ $? != 0 ]; then exit 1; fi | ||
| 37 | |||
| 38 | cmp fff.p f.p | ||
| 39 | if [ $? != 0 ]; then exit 1; fi | ||
| 40 | cmp fff.p ff.p1 | ||
| 41 | if [ $? != 0 ]; then exit 1; fi | ||
| 42 | cmp fff.p ff.p3 | ||
| 43 | if [ $? != 0 ]; then exit 1; fi | ||
| 44 | |||
| 45 | cmp f.p ff.p1 | ||
| 46 | if [ $? != 0 ]; then exit 1; fi | ||
| 47 | cmp f.p ff.p3 | ||
| 48 | if [ $? != 0 ]; then exit 1; fi | ||
| 49 | |||
| 50 | /bin/rm -f f.* ff.* fff.* | ||
| 51 | exit 0 | ||
diff --git a/src/lib/libssl/test/tpkcs7d b/src/lib/libssl/test/tpkcs7d deleted file mode 100644 index 46e5aa2bd6..0000000000 --- a/src/lib/libssl/test/tpkcs7d +++ /dev/null | |||
| @@ -1,44 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl pkcs7' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=pkcs7-1.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo "testing pkcs7 conversions (2)" | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | echo "p -> p" | ||
| 21 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 22 | if [ $? != 0 ]; then exit 1; fi | ||
| 23 | |||
| 24 | echo "d -> d" | ||
| 25 | $cmd -in f.d -inform d -outform d >ff.d1 | ||
| 26 | if [ $? != 0 ]; then exit 1; fi | ||
| 27 | echo "p -> d" | ||
| 28 | $cmd -in f.p -inform p -outform d >ff.d3 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | |||
| 31 | echo "d -> p" | ||
| 32 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 33 | if [ $? != 0 ]; then exit 1; fi | ||
| 34 | echo "p -> p" | ||
| 35 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 36 | if [ $? != 0 ]; then exit 1; fi | ||
| 37 | |||
| 38 | cmp f.p ff.p1 | ||
| 39 | if [ $? != 0 ]; then exit 1; fi | ||
| 40 | cmp f.p ff.p3 | ||
| 41 | if [ $? != 0 ]; then exit 1; fi | ||
| 42 | |||
| 43 | /bin/rm -f f.* ff.* fff.* | ||
| 44 | exit 0 | ||
diff --git a/src/lib/libssl/test/treq b/src/lib/libssl/test/treq deleted file mode 100644 index 0464c9d902..0000000000 --- a/src/lib/libssl/test/treq +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl req -config ../apps/openssl.cnf' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=testreq.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo testing req conversions | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | #echo "p -> t" | ||
| 21 | #$cmd -in fff.p -inform p -outform t >f.t | ||
| 22 | #if [ $? != 0 ]; then exit 1; fi | ||
| 23 | echo "p -> p" | ||
| 24 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 25 | if [ $? != 0 ]; then exit 1; fi | ||
| 26 | |||
| 27 | echo "d -> d" | ||
| 28 | $cmd -verify -in f.d -inform d -outform d >ff.d1 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | #echo "t -> d" | ||
| 31 | #$cmd -in f.t -inform t -outform d >ff.d2 | ||
| 32 | #if [ $? != 0 ]; then exit 1; fi | ||
| 33 | echo "p -> d" | ||
| 34 | $cmd -verify -in f.p -inform p -outform d >ff.d3 | ||
| 35 | if [ $? != 0 ]; then exit 1; fi | ||
| 36 | |||
| 37 | #echo "d -> t" | ||
| 38 | #$cmd -in f.d -inform d -outform t >ff.t1 | ||
| 39 | #if [ $? != 0 ]; then exit 1; fi | ||
| 40 | #echo "t -> t" | ||
| 41 | #$cmd -in f.t -inform t -outform t >ff.t2 | ||
| 42 | #if [ $? != 0 ]; then exit 1; fi | ||
| 43 | #echo "p -> t" | ||
| 44 | #$cmd -in f.p -inform p -outform t >ff.t3 | ||
| 45 | #if [ $? != 0 ]; then exit 1; fi | ||
| 46 | |||
| 47 | echo "d -> p" | ||
| 48 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 49 | if [ $? != 0 ]; then exit 1; fi | ||
| 50 | #echo "t -> p" | ||
| 51 | #$cmd -in f.t -inform t -outform p >ff.p2 | ||
| 52 | #if [ $? != 0 ]; then exit 1; fi | ||
| 53 | echo "p -> p" | ||
| 54 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 55 | if [ $? != 0 ]; then exit 1; fi | ||
| 56 | |||
| 57 | cmp fff.p f.p | ||
| 58 | if [ $? != 0 ]; then exit 1; fi | ||
| 59 | cmp fff.p ff.p1 | ||
| 60 | if [ $? != 0 ]; then exit 1; fi | ||
| 61 | #cmp fff.p ff.p2 | ||
| 62 | #if [ $? != 0 ]; then exit 1; fi | ||
| 63 | cmp fff.p ff.p3 | ||
| 64 | if [ $? != 0 ]; then exit 1; fi | ||
| 65 | |||
| 66 | #cmp f.t ff.t1 | ||
| 67 | #if [ $? != 0 ]; then exit 1; fi | ||
| 68 | #cmp f.t ff.t2 | ||
| 69 | #if [ $? != 0 ]; then exit 1; fi | ||
| 70 | #cmp f.t ff.t3 | ||
| 71 | #if [ $? != 0 ]; then exit 1; fi | ||
| 72 | |||
| 73 | cmp f.p ff.p1 | ||
| 74 | if [ $? != 0 ]; then exit 1; fi | ||
| 75 | #cmp f.p ff.p2 | ||
| 76 | #if [ $? != 0 ]; then exit 1; fi | ||
| 77 | cmp f.p ff.p3 | ||
| 78 | if [ $? != 0 ]; then exit 1; fi | ||
| 79 | |||
| 80 | /bin/rm -f f.* ff.* fff.* | ||
| 81 | exit 0 | ||
diff --git a/src/lib/libssl/test/trsa b/src/lib/libssl/test/trsa deleted file mode 100644 index d6a4dd826d..0000000000 --- a/src/lib/libssl/test/trsa +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl rsa' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=testrsa.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo testing rsa conversions | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | #echo "p -> t" | ||
| 21 | #$cmd -in fff.p -inform p -outform t >f.t | ||
| 22 | #if [ $? != 0 ]; then exit 1; fi | ||
| 23 | echo "p -> p" | ||
| 24 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 25 | if [ $? != 0 ]; then exit 1; fi | ||
| 26 | |||
| 27 | echo "d -> d" | ||
| 28 | $cmd -in f.d -inform d -outform d >ff.d1 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | #echo "t -> d" | ||
| 31 | #$cmd -in f.t -inform t -outform d >ff.d2 | ||
| 32 | #if [ $? != 0 ]; then exit 1; fi | ||
| 33 | echo "p -> d" | ||
| 34 | $cmd -in f.p -inform p -outform d >ff.d3 | ||
| 35 | if [ $? != 0 ]; then exit 1; fi | ||
| 36 | |||
| 37 | #echo "d -> t" | ||
| 38 | #$cmd -in f.d -inform d -outform t >ff.t1 | ||
| 39 | #if [ $? != 0 ]; then exit 1; fi | ||
| 40 | #echo "t -> t" | ||
| 41 | #$cmd -in f.t -inform t -outform t >ff.t2 | ||
| 42 | #if [ $? != 0 ]; then exit 1; fi | ||
| 43 | #echo "p -> t" | ||
| 44 | #$cmd -in f.p -inform p -outform t >ff.t3 | ||
| 45 | #if [ $? != 0 ]; then exit 1; fi | ||
| 46 | |||
| 47 | echo "d -> p" | ||
| 48 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 49 | if [ $? != 0 ]; then exit 1; fi | ||
| 50 | #echo "t -> p" | ||
| 51 | #$cmd -in f.t -inform t -outform p >ff.p2 | ||
| 52 | #if [ $? != 0 ]; then exit 1; fi | ||
| 53 | echo "p -> p" | ||
| 54 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 55 | if [ $? != 0 ]; then exit 1; fi | ||
| 56 | |||
| 57 | cmp fff.p f.p | ||
| 58 | if [ $? != 0 ]; then exit 1; fi | ||
| 59 | cmp fff.p ff.p1 | ||
| 60 | if [ $? != 0 ]; then exit 1; fi | ||
| 61 | #cmp fff.p ff.p2 | ||
| 62 | #if [ $? != 0 ]; then exit 1; fi | ||
| 63 | cmp fff.p ff.p3 | ||
| 64 | if [ $? != 0 ]; then exit 1; fi | ||
| 65 | |||
| 66 | #cmp f.t ff.t1 | ||
| 67 | #if [ $? != 0 ]; then exit 1; fi | ||
| 68 | #cmp f.t ff.t2 | ||
| 69 | #if [ $? != 0 ]; then exit 1; fi | ||
| 70 | #cmp f.t ff.t3 | ||
| 71 | #if [ $? != 0 ]; then exit 1; fi | ||
| 72 | |||
| 73 | cmp f.p ff.p1 | ||
| 74 | if [ $? != 0 ]; then exit 1; fi | ||
| 75 | #cmp f.p ff.p2 | ||
| 76 | #if [ $? != 0 ]; then exit 1; fi | ||
| 77 | cmp f.p ff.p3 | ||
| 78 | if [ $? != 0 ]; then exit 1; fi | ||
| 79 | |||
| 80 | /bin/rm -f f.* ff.* fff.* | ||
| 81 | exit 0 | ||
diff --git a/src/lib/libssl/test/tsid b/src/lib/libssl/test/tsid deleted file mode 100644 index 9e0854516c..0000000000 --- a/src/lib/libssl/test/tsid +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl sess_id' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=testsid.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo testing session-id conversions | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | #echo "p -> t" | ||
| 21 | #$cmd -in fff.p -inform p -outform t >f.t | ||
| 22 | #if [ $? != 0 ]; then exit 1; fi | ||
| 23 | echo "p -> p" | ||
| 24 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 25 | if [ $? != 0 ]; then exit 1; fi | ||
| 26 | |||
| 27 | echo "d -> d" | ||
| 28 | $cmd -in f.d -inform d -outform d >ff.d1 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | #echo "t -> d" | ||
| 31 | #$cmd -in f.t -inform t -outform d >ff.d2 | ||
| 32 | #if [ $? != 0 ]; then exit 1; fi | ||
| 33 | echo "p -> d" | ||
| 34 | $cmd -in f.p -inform p -outform d >ff.d3 | ||
| 35 | if [ $? != 0 ]; then exit 1; fi | ||
| 36 | |||
| 37 | #echo "d -> t" | ||
| 38 | #$cmd -in f.d -inform d -outform t >ff.t1 | ||
| 39 | #if [ $? != 0 ]; then exit 1; fi | ||
| 40 | #echo "t -> t" | ||
| 41 | #$cmd -in f.t -inform t -outform t >ff.t2 | ||
| 42 | #if [ $? != 0 ]; then exit 1; fi | ||
| 43 | #echo "p -> t" | ||
| 44 | #$cmd -in f.p -inform p -outform t >ff.t3 | ||
| 45 | #if [ $? != 0 ]; then exit 1; fi | ||
| 46 | |||
| 47 | echo "d -> p" | ||
| 48 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 49 | if [ $? != 0 ]; then exit 1; fi | ||
| 50 | #echo "t -> p" | ||
| 51 | #$cmd -in f.t -inform t -outform p >ff.p2 | ||
| 52 | #if [ $? != 0 ]; then exit 1; fi | ||
| 53 | echo "p -> p" | ||
| 54 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 55 | if [ $? != 0 ]; then exit 1; fi | ||
| 56 | |||
| 57 | cmp fff.p f.p | ||
| 58 | if [ $? != 0 ]; then exit 1; fi | ||
| 59 | cmp fff.p ff.p1 | ||
| 60 | if [ $? != 0 ]; then exit 1; fi | ||
| 61 | #cmp fff.p ff.p2 | ||
| 62 | #if [ $? != 0 ]; then exit 1; fi | ||
| 63 | cmp fff.p ff.p3 | ||
| 64 | if [ $? != 0 ]; then exit 1; fi | ||
| 65 | |||
| 66 | #cmp f.t ff.t1 | ||
| 67 | #if [ $? != 0 ]; then exit 1; fi | ||
| 68 | #cmp f.t ff.t2 | ||
| 69 | #if [ $? != 0 ]; then exit 1; fi | ||
| 70 | #cmp f.t ff.t3 | ||
| 71 | #if [ $? != 0 ]; then exit 1; fi | ||
| 72 | |||
| 73 | cmp f.p ff.p1 | ||
| 74 | if [ $? != 0 ]; then exit 1; fi | ||
| 75 | #cmp f.p ff.p2 | ||
| 76 | #if [ $? != 0 ]; then exit 1; fi | ||
| 77 | cmp f.p ff.p3 | ||
| 78 | if [ $? != 0 ]; then exit 1; fi | ||
| 79 | |||
| 80 | /bin/rm -f f.* ff.* fff.* | ||
| 81 | exit 0 | ||
diff --git a/src/lib/libssl/test/tx509 b/src/lib/libssl/test/tx509 deleted file mode 100644 index 35169f3a43..0000000000 --- a/src/lib/libssl/test/tx509 +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | PATH=../apps:$PATH | ||
| 4 | export PATH | ||
| 5 | |||
| 6 | cmd='../apps/openssl x509' | ||
| 7 | |||
| 8 | if [ "$1"x != "x" ]; then | ||
| 9 | t=$1 | ||
| 10 | else | ||
| 11 | t=testx509.pem | ||
| 12 | fi | ||
| 13 | |||
| 14 | echo testing X509 conversions | ||
| 15 | cp $t fff.p | ||
| 16 | |||
| 17 | echo "p -> d" | ||
| 18 | $cmd -in fff.p -inform p -outform d >f.d | ||
| 19 | if [ $? != 0 ]; then exit 1; fi | ||
| 20 | echo "p -> n" | ||
| 21 | $cmd -in fff.p -inform p -outform n >f.n | ||
| 22 | if [ $? != 0 ]; then exit 1; fi | ||
| 23 | echo "p -> p" | ||
| 24 | $cmd -in fff.p -inform p -outform p >f.p | ||
| 25 | if [ $? != 0 ]; then exit 1; fi | ||
| 26 | |||
| 27 | echo "d -> d" | ||
| 28 | $cmd -in f.d -inform d -outform d >ff.d1 | ||
| 29 | if [ $? != 0 ]; then exit 1; fi | ||
| 30 | echo "n -> d" | ||
| 31 | $cmd -in f.n -inform n -outform d >ff.d2 | ||
| 32 | if [ $? != 0 ]; then exit 1; fi | ||
| 33 | echo "p -> d" | ||
| 34 | $cmd -in f.p -inform p -outform d >ff.d3 | ||
| 35 | if [ $? != 0 ]; then exit 1; fi | ||
| 36 | |||
| 37 | echo "d -> n" | ||
| 38 | $cmd -in f.d -inform d -outform n >ff.n1 | ||
| 39 | if [ $? != 0 ]; then exit 1; fi | ||
| 40 | echo "n -> n" | ||
| 41 | $cmd -in f.n -inform n -outform n >ff.n2 | ||
| 42 | if [ $? != 0 ]; then exit 1; fi | ||
| 43 | echo "p -> n" | ||
| 44 | $cmd -in f.p -inform p -outform n >ff.n3 | ||
| 45 | if [ $? != 0 ]; then exit 1; fi | ||
| 46 | |||
| 47 | echo "d -> p" | ||
| 48 | $cmd -in f.d -inform d -outform p >ff.p1 | ||
| 49 | if [ $? != 0 ]; then exit 1; fi | ||
| 50 | echo "n -> p" | ||
| 51 | $cmd -in f.n -inform n -outform p >ff.p2 | ||
| 52 | if [ $? != 0 ]; then exit 1; fi | ||
| 53 | echo "p -> p" | ||
| 54 | $cmd -in f.p -inform p -outform p >ff.p3 | ||
| 55 | if [ $? != 0 ]; then exit 1; fi | ||
| 56 | |||
| 57 | cmp fff.p f.p | ||
| 58 | if [ $? != 0 ]; then exit 1; fi | ||
| 59 | cmp fff.p ff.p1 | ||
| 60 | if [ $? != 0 ]; then exit 1; fi | ||
| 61 | cmp fff.p ff.p2 | ||
| 62 | if [ $? != 0 ]; then exit 1; fi | ||
| 63 | cmp fff.p ff.p3 | ||
| 64 | if [ $? != 0 ]; then exit 1; fi | ||
| 65 | |||
| 66 | cmp f.n ff.n1 | ||
| 67 | if [ $? != 0 ]; then exit 1; fi | ||
| 68 | cmp f.n ff.n2 | ||
| 69 | if [ $? != 0 ]; then exit 1; fi | ||
| 70 | cmp f.n ff.n3 | ||
| 71 | if [ $? != 0 ]; then exit 1; fi | ||
| 72 | |||
| 73 | cmp f.p ff.p1 | ||
| 74 | if [ $? != 0 ]; then exit 1; fi | ||
| 75 | cmp f.p ff.p2 | ||
| 76 | if [ $? != 0 ]; then exit 1; fi | ||
| 77 | cmp f.p ff.p3 | ||
| 78 | if [ $? != 0 ]; then exit 1; fi | ||
| 79 | |||
| 80 | /bin/rm -f f.* ff.* fff.* | ||
| 81 | exit 0 | ||
diff --git a/src/lib/libssl/test/v3-cert1.pem b/src/lib/libssl/test/v3-cert1.pem deleted file mode 100644 index 0da253d5c3..0000000000 --- a/src/lib/libssl/test/v3-cert1.pem +++ /dev/null | |||
| @@ -1,16 +0,0 @@ | |||
| 1 | -----BEGIN CERTIFICATE----- | ||
| 2 | MIICjTCCAfigAwIBAgIEMaYgRzALBgkqhkiG9w0BAQQwRTELMAkGA1UEBhMCVVMx | ||
| 3 | NjA0BgNVBAoTLU5hdGlvbmFsIEFlcm9uYXV0aWNzIGFuZCBTcGFjZSBBZG1pbmlz | ||
| 4 | dHJhdGlvbjAmFxE5NjA1MjgxMzQ5MDUrMDgwMBcROTgwNTI4MTM0OTA1KzA4MDAw | ||
| 5 | ZzELMAkGA1UEBhMCVVMxNjA0BgNVBAoTLU5hdGlvbmFsIEFlcm9uYXV0aWNzIGFu | ||
| 6 | ZCBTcGFjZSBBZG1pbmlzdHJhdGlvbjEgMAkGA1UEBRMCMTYwEwYDVQQDEwxTdGV2 | ||
| 7 | ZSBTY2hvY2gwWDALBgkqhkiG9w0BAQEDSQAwRgJBALrAwyYdgxmzNP/ts0Uyf6Bp | ||
| 8 | miJYktU/w4NG67ULaN4B5CnEz7k57s9o3YY3LecETgQ5iQHmkwlYDTL2fTgVfw0C | ||
| 9 | AQOjgaswgagwZAYDVR0ZAQH/BFowWDBWMFQxCzAJBgNVBAYTAlVTMTYwNAYDVQQK | ||
| 10 | Ey1OYXRpb25hbCBBZXJvbmF1dGljcyBhbmQgU3BhY2UgQWRtaW5pc3RyYXRpb24x | ||
| 11 | DTALBgNVBAMTBENSTDEwFwYDVR0BAQH/BA0wC4AJODMyOTcwODEwMBgGA1UdAgQR | ||
| 12 | MA8ECTgzMjk3MDgyM4ACBSAwDQYDVR0KBAYwBAMCBkAwCwYJKoZIhvcNAQEEA4GB | ||
| 13 | AH2y1VCEw/A4zaXzSYZJTTUi3uawbbFiS2yxHvgf28+8Js0OHXk1H1w2d6qOHH21 | ||
| 14 | X82tZXd/0JtG0g1T9usFFBDvYK8O0ebgz/P5ELJnBL2+atObEuJy1ZZ0pBDWINR3 | ||
| 15 | WkDNLCGiTkCKp0F5EWIrVDwh54NNevkCQRZita+z4IBO | ||
| 16 | -----END CERTIFICATE----- | ||
diff --git a/src/lib/libssl/test/v3-cert2.pem b/src/lib/libssl/test/v3-cert2.pem deleted file mode 100644 index de0723ff8d..0000000000 --- a/src/lib/libssl/test/v3-cert2.pem +++ /dev/null | |||
| @@ -1,16 +0,0 @@ | |||
| 1 | -----BEGIN CERTIFICATE----- | ||
| 2 | MIICiTCCAfKgAwIBAgIEMeZfHzANBgkqhkiG9w0BAQQFADB9MQswCQYDVQQGEwJD | ||
| 3 | YTEPMA0GA1UEBxMGTmVwZWFuMR4wHAYDVQQLExVObyBMaWFiaWxpdHkgQWNjZXB0 | ||
| 4 | ZWQxHzAdBgNVBAoTFkZvciBEZW1vIFB1cnBvc2VzIE9ubHkxHDAaBgNVBAMTE0Vu | ||
| 5 | dHJ1c3QgRGVtbyBXZWIgQ0EwHhcNOTYwNzEyMTQyMDE1WhcNOTYxMDEyMTQyMDE1 | ||
| 6 | WjB0MSQwIgYJKoZIhvcNAQkBExVjb29rZUBpc3NsLmF0bC5ocC5jb20xCzAJBgNV | ||
| 7 | BAYTAlVTMScwJQYDVQQLEx5IZXdsZXR0IFBhY2thcmQgQ29tcGFueSAoSVNTTCkx | ||
| 8 | FjAUBgNVBAMTDVBhdWwgQS4gQ29va2UwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA | ||
| 9 | 6ceSq9a9AU6g+zBwaL/yVmW1/9EE8s5you1mgjHnj0wAILuoB3L6rm6jmFRy7QZT | ||
| 10 | G43IhVZdDua4e+5/n1ZslwIDAQABo2MwYTARBglghkgBhvhCAQEEBAMCB4AwTAYJ | ||
| 11 | YIZIAYb4QgENBD8WPVRoaXMgY2VydGlmaWNhdGUgaXMgb25seSBpbnRlbmRlZCBm | ||
| 12 | b3IgZGVtb25zdHJhdGlvbiBwdXJwb3Nlcy4wDQYJKoZIhvcNAQEEBQADgYEAi8qc | ||
| 13 | F3zfFqy1sV8NhjwLVwOKuSfhR/Z8mbIEUeSTlnH3QbYt3HWZQ+vXI8mvtZoBc2Fz | ||
| 14 | lexKeIkAZXCesqGbs6z6nCt16P6tmdfbZF3I3AWzLquPcOXjPf4HgstkyvVBn0Ap | ||
| 15 | jAFN418KF/Cx4qyHB4cjdvLrRjjQLnb2+ibo7QU= | ||
| 16 | -----END CERTIFICATE----- | ||
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h deleted file mode 100644 index cf92ae034f..0000000000 --- a/src/lib/libssl/tls1.h +++ /dev/null | |||
| @@ -1,164 +0,0 @@ | |||
| 1 | /* ssl/tls1.h */ | ||
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | ||
| 3 | * All rights reserved. | ||
| 4 | * | ||
| 5 | * This package is an SSL implementation written | ||
| 6 | * by Eric Young (eay@cryptsoft.com). | ||
| 7 | * The implementation was written so as to conform with Netscapes SSL. | ||
| 8 | * | ||
| 9 | * This library is free for commercial and non-commercial use as long as | ||
| 10 | * the following conditions are aheared to. The following conditions | ||
| 11 | * apply to all code found in this distribution, be it the RC4, RSA, | ||
| 12 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation | ||
| 13 | * included with this distribution is covered by the same copyright terms | ||
| 14 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). | ||
| 15 | * | ||
| 16 | * Copyright remains Eric Young's, and as such any Copyright notices in | ||
| 17 | * the code are not to be removed. | ||
| 18 | * If this package is used in a product, Eric Young should be given attribution | ||
| 19 | * as the author of the parts of the library used. | ||
| 20 | * This can be in the form of a textual message at program startup or | ||
| 21 | * in documentation (online or textual) provided with the package. | ||
| 22 | * | ||
| 23 | * Redistribution and use in source and binary forms, with or without | ||
| 24 | * modification, are permitted provided that the following conditions | ||
| 25 | * are met: | ||
| 26 | * 1. Redistributions of source code must retain the copyright | ||
| 27 | * notice, this list of conditions and the following disclaimer. | ||
| 28 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 29 | * notice, this list of conditions and the following disclaimer in the | ||
| 30 | * documentation and/or other materials provided with the distribution. | ||
| 31 | * 3. All advertising materials mentioning features or use of this software | ||
| 32 | * must display the following acknowledgement: | ||
| 33 | * "This product includes cryptographic software written by | ||
| 34 | * Eric Young (eay@cryptsoft.com)" | ||
| 35 | * The word 'cryptographic' can be left out if the rouines from the library | ||
| 36 | * being used are not cryptographic related :-). | ||
| 37 | * 4. If you include any Windows specific code (or a derivative thereof) from | ||
| 38 | * the apps directory (application code) you must include an acknowledgement: | ||
| 39 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" | ||
| 40 | * | ||
| 41 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND | ||
| 42 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| 43 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | ||
| 44 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE | ||
| 45 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| 46 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | ||
| 47 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
| 48 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| 49 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||
| 50 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||
| 51 | * SUCH DAMAGE. | ||
| 52 | * | ||
| 53 | * The licence and distribution terms for any publically available version or | ||
| 54 | * derivative of this code cannot be changed. i.e. this code cannot simply be | ||
| 55 | * copied and put under another distribution licence | ||
| 56 | * [including the GNU Public Licence.] | ||
| 57 | */ | ||
| 58 | |||
| 59 | #ifndef HEADER_TLS1_H | ||
| 60 | #define HEADER_TLS1_H | ||
| 61 | |||
| 62 | #include <openssl/buffer.h> | ||
| 63 | |||
| 64 | #ifdef __cplusplus | ||
| 65 | extern "C" { | ||
| 66 | #endif | ||
| 67 | |||
| 68 | #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 1 | ||
| 69 | |||
| 70 | #define TLS1_VERSION 0x0301 | ||
| 71 | #define TLS1_VERSION_MAJOR 0x03 | ||
| 72 | #define TLS1_VERSION_MINOR 0x01 | ||
| 73 | |||
| 74 | #define TLS1_AD_DECRYPTION_FAILED 21 | ||
| 75 | #define TLS1_AD_RECORD_OVERFLOW 22 | ||
| 76 | #define TLS1_AD_UNKNOWN_CA 48 /* fatal */ | ||
| 77 | #define TLS1_AD_ACCESS_DENIED 49 /* fatal */ | ||
| 78 | #define TLS1_AD_DECODE_ERROR 50 /* fatal */ | ||
| 79 | #define TLS1_AD_DECRYPT_ERROR 51 | ||
| 80 | #define TLS1_AD_EXPORT_RESTRICTION 60 /* fatal */ | ||
| 81 | #define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */ | ||
| 82 | #define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */ | ||
| 83 | #define TLS1_AD_INTERNAL_ERROR 80 /* fatal */ | ||
| 84 | #define TLS1_AD_USER_CANCELLED 90 | ||
| 85 | #define TLS1_AD_NO_RENEGOTIATION 100 | ||
| 86 | |||
| 87 | /* Additional TLS ciphersuites from draft-ietf-tls-56-bit-ciphersuites-00.txt | ||
| 88 | * (available if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is defined, see | ||
| 89 | * s3_lib.c). We actually treat them like SSL 3.0 ciphers, which we probably | ||
| 90 | * shouldn't. */ | ||
| 91 | #define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 0x03000060 | ||
| 92 | #define TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 0x03000061 | ||
| 93 | #define TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x03000062 | ||
| 94 | #define TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x03000063 | ||
| 95 | #define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA 0x03000064 | ||
| 96 | #define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065 | ||
| 97 | #define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066 | ||
| 98 | |||
| 99 | /* XXX | ||
| 100 | * Inconsistency alert: | ||
| 101 | * The OpenSSL names of ciphers with ephemeral DH here include the string | ||
| 102 | * "DHE", while elsewhere it has always been "EDH". | ||
| 103 | * (The alias for the list of all such ciphers also is "EDH".) | ||
| 104 | * The specifications speak of "EDH"; maybe we should allow both forms | ||
| 105 | * for everything. */ | ||
| 106 | #define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 "EXP1024-RC4-MD5" | ||
| 107 | #define TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 "EXP1024-RC2-CBC-MD5" | ||
| 108 | #define TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DES-CBC-SHA" | ||
| 109 | #define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DHE-DSS-DES-CBC-SHA" | ||
| 110 | #define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA "EXP1024-RC4-SHA" | ||
| 111 | #define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA "EXP1024-DHE-DSS-RC4-SHA" | ||
| 112 | #define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA "DHE-DSS-RC4-SHA" | ||
| 113 | |||
| 114 | |||
| 115 | #define TLS_CT_RSA_SIGN 1 | ||
| 116 | #define TLS_CT_DSS_SIGN 2 | ||
| 117 | #define TLS_CT_RSA_FIXED_DH 3 | ||
| 118 | #define TLS_CT_DSS_FIXED_DH 4 | ||
| 119 | #define TLS_CT_NUMBER 4 | ||
| 120 | |||
| 121 | #define TLS1_FINISH_MAC_LENGTH 12 | ||
| 122 | |||
| 123 | #define TLS_MD_MAX_CONST_SIZE 20 | ||
| 124 | #define TLS_MD_CLIENT_FINISH_CONST "client finished" | ||
| 125 | #define TLS_MD_CLIENT_FINISH_CONST_SIZE 15 | ||
| 126 | #define TLS_MD_SERVER_FINISH_CONST "server finished" | ||
| 127 | #define TLS_MD_SERVER_FINISH_CONST_SIZE 15 | ||
| 128 | #define TLS_MD_SERVER_WRITE_KEY_CONST "server write key" | ||
| 129 | #define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16 | ||
| 130 | #define TLS_MD_KEY_EXPANSION_CONST "key expansion" | ||
| 131 | #define TLS_MD_KEY_EXPANSION_CONST_SIZE 13 | ||
| 132 | #define TLS_MD_CLIENT_WRITE_KEY_CONST "client write key" | ||
| 133 | #define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16 | ||
| 134 | #define TLS_MD_SERVER_WRITE_KEY_CONST "server write key" | ||
| 135 | #define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16 | ||
| 136 | #define TLS_MD_IV_BLOCK_CONST "IV block" | ||
| 137 | #define TLS_MD_IV_BLOCK_CONST_SIZE 8 | ||
| 138 | #define TLS_MD_MASTER_SECRET_CONST "master secret" | ||
| 139 | #define TLS_MD_MASTER_SECRET_CONST_SIZE 13 | ||
| 140 | |||
| 141 | #ifdef CHARSET_EBCDIC | ||
| 142 | #undef TLS_MD_CLIENT_FINISH_CONST | ||
| 143 | #define TLS_MD_CLIENT_FINISH_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x66\x69\x6e\x69\x73\x68\x65\x64" /*client finished*/ | ||
| 144 | #undef TLS_MD_SERVER_FINISH_CONST | ||
| 145 | #define TLS_MD_SERVER_FINISH_CONST "\x73\x65\x72\x76\x65\x72\x20\x66\x69\x6e\x69\x73\x68\x65\x64" /*server finished*/ | ||
| 146 | #undef TLS_MD_SERVER_WRITE_KEY_CONST | ||
| 147 | #define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" /*server write key*/ | ||
| 148 | #undef TLS_MD_KEY_EXPANSION_CONST | ||
| 149 | #define TLS_MD_KEY_EXPANSION_CONST "\x6b\x65\x79\x20\x65\x78\x70\x61\x6e\x73\x69\x6f\x6e" /*key expansion*/ | ||
| 150 | #undef TLS_MD_CLIENT_WRITE_KEY_CONST | ||
| 151 | #define TLS_MD_CLIENT_WRITE_KEY_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" /*client write key*/ | ||
| 152 | #undef TLS_MD_SERVER_WRITE_KEY_CONST | ||
| 153 | #define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79" /*server write key*/ | ||
| 154 | #undef TLS_MD_IV_BLOCK_CONST | ||
| 155 | #define TLS_MD_IV_BLOCK_CONST "\x49\x56\x20\x62\x6c\x6f\x63\x6b" /*IV block*/ | ||
| 156 | #undef TLS_MD_MASTER_SECRET_CONST | ||
| 157 | #define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/ | ||
| 158 | #endif | ||
| 159 | |||
| 160 | #ifdef __cplusplus | ||
| 161 | } | ||
| 162 | #endif | ||
| 163 | #endif | ||
| 164 | |||