← Back to branch summary

~ubuntu-branches/ubuntu/utopic/openssl/utopic

« back to all changes in this revision

Viewing changes to ssl/s3_clnt.c

  • Committer: Bazaar Package Importer
  • Author(s): Kurt Roeckx
  • Date: 2011-04-02 13:19:19 UTC
  • mfrom: (1.2.1 upstream) (11.2.2 experimental)
  • mto: This revision was merged to the branch mainline in revision 55.
  • Revision ID: james.westby@ubuntu.com-20110402131919-anszuslper64ey9e
Tags: 1.0.0d-1
http://bugs.debian.org/607609
* New upstream version
  - Fixes CVE-2011-0014
* Make libssl-doc Replaces/Breaks with old libssl-dev packages
  (Closes: #607609)
* Only export the symbols we should, instead of all.
* Add symbol file.
* Upload to unstable

Show diffs side-by-side

added added

removed removed

Lines of Context:
ssl/s3_clnt.c
56
56
 * [including the GNU Public Licence.]
57
57
 */
58
58
/* ====================================================================
59
 
 * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
 
59
 * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60
60
 *
61
61
 * Redistribution and use in source and binary forms, with or without
62
62
 * modification, are permitted provided that the following conditions
121
121
 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
122
122
 *
123
123
 */
 
124
/* ====================================================================
 
125
 * Copyright 2005 Nokia. All rights reserved.
 
126
 *
 
127
 * The portions of the attached software ("Contribution") is developed by
 
128
 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 
129
 * license.
 
130
 *
 
131
 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 
132
 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 
133
 * support (see RFC 4279) to OpenSSL.
 
134
 *
 
135
 * No patent licenses or other rights except those expressly stated in
 
136
 * the OpenSSL open source license shall be deemed granted or received
 
137
 * expressly, by implication, estoppel, or otherwise.
 
138
 *
 
139
 * No assurances are provided by Nokia that the Contribution does not
 
140
 * infringe the patent or other intellectual property rights of any third
 
141
 * party or that the license provides you with all the necessary rights
 
142
 * to make use of the Contribution.
 
143
 *
 
144
 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 
145
 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 
146
 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 
147
 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 
148
 * OTHERWISE.
 
149
 */
124
150
 
125
151
#include <stdio.h>
126
152
#include "ssl_locl.h"
130
156
#include <openssl/objects.h>
131
157
#include <openssl/evp.h>
132
158
#include <openssl/md5.h>
133
 
#ifdef OPENSSL_FIPS
134
 
#include <openssl/fips.h>
135
 
#endif
136
 
 
137
159
#ifndef OPENSSL_NO_DH
138
160
#include <openssl/dh.h>
139
161
#endif
142
164
#include <openssl/engine.h>
143
165
#endif
144
166
 
145
 
static SSL_METHOD *ssl3_get_client_method(int ver);
 
167
static const SSL_METHOD *ssl3_get_client_method(int ver);
146
168
static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
147
169
 
148
 
#ifndef OPENSSL_NO_ECDH
149
 
static int curve_id2nid(int curve_id);
150
 
int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
151
 
#endif
152
 
 
153
 
static SSL_METHOD *ssl3_get_client_method(int ver)
 
170
static const SSL_METHOD *ssl3_get_client_method(int ver)
154
171
        {
155
172
        if (ver == SSL3_VERSION)
156
173
                return(SSLv3_client_method());
166
183
int ssl3_connect(SSL *s)
167
184
        {
168
185
        BUF_MEM *buf=NULL;
169
 
        unsigned long Time=(unsigned long)time(NULL),l;
 
186
        unsigned long Time=(unsigned long)time(NULL);
170
187
        void (*cb)(const SSL *ssl,int type,int val)=NULL;
171
188
        int ret= -1;
172
189
        int new_state,state,skip=0;
261
278
                case SSL3_ST_CR_SRVR_HELLO_B:
262
279
                        ret=ssl3_get_server_hello(s);
263
280
                        if (ret <= 0) goto end;
 
281
 
264
282
                        if (s->hit)
265
283
                                s->state=SSL3_ST_CR_FINISHED_A;
266
284
                        else
285
303
                                }
286
304
#endif
287
305
                        /* Check if it is anon DH/ECDH */
288
 
                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
 
306
                        /* or PSK */
 
307
                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
 
308
                            !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK))
289
309
                                {
290
310
                                ret=ssl3_get_server_certificate(s);
291
311
                                if (ret <= 0) goto end;
360
380
                case SSL3_ST_CW_KEY_EXCH_B:
361
381
                        ret=ssl3_send_client_key_exchange(s);
362
382
                        if (ret <= 0) goto end;
363
 
                        l=s->s3->tmp.new_cipher->algorithms;
364
383
                        /* EAY EAY EAY need to check for DH fix cert
365
384
                         * sent back */
366
385
                        /* For TLS, cert_req is set to 2, so a cert chain
381
400
                                s->state=SSL3_ST_CW_CHANGE_A;
382
401
                                s->s3->change_cipher_spec=0;
383
402
                                }
 
403
                        if (s->s3->flags & TLS1_FLAGS_SKIP_CERT_VERIFY)
 
404
                                {
 
405
                                s->state=SSL3_ST_CW_CHANGE_A;
 
406
                                s->s3->change_cipher_spec=0;
 
407
                                }
384
408
 
385
409
                        s->init_num=0;
386
410
                        break;
650
674
#ifdef OPENSSL_NO_COMP
651
675
                *(p++)=1;
652
676
#else
653
 
                if (s->ctx->comp_methods == NULL)
 
677
 
 
678
                if ((s->options & SSL_OP_NO_COMPRESSION)
 
679
                                        || !s->ctx->comp_methods)
654
680
                        j=0;
655
681
                else
656
682
                        j=sk_SSL_COMP_num(s->ctx->comp_methods);
662
688
                        }
663
689
#endif
664
690
                *(p++)=0; /* Add the NULL method */
 
691
 
665
692
#ifndef OPENSSL_NO_TLSEXT
 
693
                /* TLS extensions*/
 
694
                if (ssl_prepare_clienthello_tlsext(s) <= 0)
 
695
                        {
 
696
                        SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
 
697
                        goto err;
 
698
                        }
666
699
                if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
667
700
                        {
668
701
                        SSLerr(SSL_F_SSL3_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
669
702
                        goto err;
670
703
                        }
671
 
#endif          
 
704
#endif
 
705
                
672
706
                l=(p-d);
673
707
                d=buf;
674
708
                *(d++)=SSL3_MT_CLIENT_HELLO;
689
723
int ssl3_get_server_hello(SSL *s)
690
724
        {
691
725
        STACK_OF(SSL_CIPHER) *sk;
692
 
        SSL_CIPHER *c;
 
726
        const SSL_CIPHER *c;
693
727
        unsigned char *p,*d;
694
728
        int i,al,ok;
695
729
        unsigned int j;
758
792
                goto f_err;
759
793
                }
760
794
 
 
795
#ifndef OPENSSL_NO_TLSEXT
 
796
        /* check if we want to resume the session based on external pre-shared secret */
 
797
        if (s->version >= TLS1_VERSION && s->tls_session_secret_cb)
 
798
                {
 
799
                SSL_CIPHER *pref_cipher=NULL;
 
800
                s->session->master_key_length=sizeof(s->session->master_key);
 
801
                if (s->tls_session_secret_cb(s, s->session->master_key,
 
802
                                             &s->session->master_key_length,
 
803
                                             NULL, &pref_cipher,
 
804
                                             s->tls_session_secret_cb_arg))
 
805
                        {
 
806
                        s->session->cipher = pref_cipher ?
 
807
                                pref_cipher : ssl_get_cipher_by_char(s, p+j);
 
808
                        }
 
809
                }
 
810
#endif /* OPENSSL_NO_TLSEXT */
 
811
 
761
812
        if (j != 0 && j == s->session->session_id_length
762
813
            && memcmp(p,s->session->session_id,j) == 0)
763
814
            {
827
878
                        }
828
879
                }
829
880
        s->s3->tmp.new_cipher=c;
 
881
        if (!ssl3_digest_cached_records(s))
 
882
                goto f_err;
830
883
 
831
884
        /* lets get the compression algorithm */
832
885
        /* COMPRESSION */
837
890
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
838
891
                goto f_err;
839
892
                }
 
893
        /* If compression is disabled we'd better not try to resume a session
 
894
         * using compression.
 
895
         */
 
896
        if (s->session->compress_meth != 0)
 
897
                {
 
898
                al=SSL_AD_INTERNAL_ERROR;
 
899
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_INCONSISTENT_COMPRESSION);
 
900
                goto f_err;
 
901
                }
840
902
#else
841
903
        j= *(p++);
 
904
        if (s->hit && j != s->session->compress_meth)
 
905
                {
 
906
                al=SSL_AD_ILLEGAL_PARAMETER;
 
907
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED);
 
908
                goto f_err;
 
909
                }
842
910
        if (j == 0)
843
911
                comp=NULL;
 
912
        else if (s->options & SSL_OP_NO_COMPRESSION)
 
913
                {
 
914
                al=SSL_AD_ILLEGAL_PARAMETER;
 
915
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_COMPRESSION_DISABLED);
 
916
                goto f_err;
 
917
                }
844
918
        else
845
919
                comp=ssl3_comp_find(s->ctx->comp_methods,j);
846
920
        
855
929
                s->s3->tmp.new_compression=comp;
856
930
                }
857
931
#endif
 
932
 
858
933
#ifndef OPENSSL_NO_TLSEXT
859
934
        /* TLS extensions*/
860
935
        if (s->version >= SSL3_VERSION)
873
948
                }
874
949
#endif
875
950
 
876
 
 
877
951
        if (p != (d+n))
878
952
                {
879
953
                /* wrong packet length */
911
985
        if (!ok) return((int)n);
912
986
 
913
987
        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
914
 
                ((s->s3->tmp.new_cipher->algorithms & SSL_aKRB5) && 
 
988
                ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) && 
915
989
                (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)))
916
990
                {
917
991
                s->s3->tmp.reuse_message=1;
976
1050
        i=ssl_verify_cert_chain(s,sk);
977
1051
        if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
978
1052
#ifndef OPENSSL_NO_KRB5
979
 
                && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
980
 
                != (SSL_aKRB5|SSL_kKRB5)
 
1053
            && !((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&
 
1054
                 (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
981
1055
#endif /* OPENSSL_NO_KRB5 */
982
 
                )
 
1056
                )
983
1057
                {
984
1058
                al=ssl_verify_alarm_type(s->verify_result);
985
1059
                SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
1003
1077
        pkey=X509_get_pubkey(x);
1004
1078
 
1005
1079
        /* VRS: allow null cert if auth == KRB5 */
1006
 
        need_cert =     ((s->s3->tmp.new_cipher->algorithms
1007
 
                         & (SSL_MKEY_MASK|SSL_AUTH_MASK))
1008
 
                         == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
 
1080
        need_cert = ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&
 
1081
                    (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
 
1082
                    ? 0 : 1;
1009
1083
 
1010
1084
#ifdef KSSL_DEBUG
1011
 
        printf("pkey,x = %p, %p\n", (void *)pkey,(void *)x);
 
1085
        printf("pkey,x = %p, %p\n", pkey,x);
1012
1086
        printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
1013
 
        printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
1014
 
                s->s3->tmp.new_cipher->algorithms, need_cert);
 
1087
        printf("cipher, alg, nc = %s, %lx, %lx, %d\n", s->s3->tmp.new_cipher->name,
 
1088
                s->s3->tmp.new_cipher->algorithm_mkey, s->s3->tmp.new_cipher->algorithm_auth, need_cert);
1015
1089
#endif    /* KSSL_DEBUG */
1016
1090
 
1017
1091
        if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
1083
1157
        EVP_MD_CTX md_ctx;
1084
1158
        unsigned char *param,*p;
1085
1159
        int al,i,j,param_len,ok;
1086
 
        long n,alg;
 
1160
        long n,alg_k,alg_a;
1087
1161
        EVP_PKEY *pkey=NULL;
1088
1162
#ifndef OPENSSL_NO_RSA
1089
1163
        RSA *rsa=NULL;
1107
1181
                -1,
1108
1182
                s->max_cert_list,
1109
1183
                &ok);
1110
 
 
1111
1184
        if (!ok) return((int)n);
1112
1185
 
1113
1186
        if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
1114
1187
                {
 
1188
#ifndef OPENSSL_NO_PSK
 
1189
                /* In plain PSK ciphersuite, ServerKeyExchange can be
 
1190
                   omitted if no identity hint is sent. Set
 
1191
                   session->sess_cert anyway to avoid problems
 
1192
                   later.*/
 
1193
                if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)
 
1194
                        {
 
1195
                        s->session->sess_cert=ssl_sess_cert_new();
 
1196
                        if (s->ctx->psk_identity_hint)
 
1197
                                OPENSSL_free(s->ctx->psk_identity_hint);
 
1198
                        s->ctx->psk_identity_hint = NULL;
 
1199
                        }
 
1200
#endif
1115
1201
                s->s3->tmp.reuse_message=1;
1116
1202
                return(1);
1117
1203
                }
1118
1204
 
1119
1205
        param=p=(unsigned char *)s->init_msg;
1120
 
 
1121
1206
        if (s->session->sess_cert != NULL)
1122
1207
                {
1123
1208
#ifndef OPENSSL_NO_RSA
1148
1233
                }
1149
1234
 
1150
1235
        param_len=0;
1151
 
        alg=s->s3->tmp.new_cipher->algorithms;
 
1236
        alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
 
1237
        alg_a=s->s3->tmp.new_cipher->algorithm_auth;
1152
1238
        EVP_MD_CTX_init(&md_ctx);
1153
1239
 
 
1240
#ifndef OPENSSL_NO_PSK
 
1241
        if (alg_k & SSL_kPSK)
 
1242
                {
 
1243
                char tmp_id_hint[PSK_MAX_IDENTITY_LEN+1];
 
1244
 
 
1245
                al=SSL_AD_HANDSHAKE_FAILURE;
 
1246
                n2s(p,i);
 
1247
                param_len=i+2;
 
1248
                /* Store PSK identity hint for later use, hint is used
 
1249
                 * in ssl3_send_client_key_exchange.  Assume that the
 
1250
                 * maximum length of a PSK identity hint can be as
 
1251
                 * long as the maximum length of a PSK identity. */
 
1252
                if (i > PSK_MAX_IDENTITY_LEN)
 
1253
                        {
 
1254
                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
 
1255
                                SSL_R_DATA_LENGTH_TOO_LONG);
 
1256
                        goto f_err;
 
1257
                        }
 
1258
                if (param_len > n)
 
1259
                        {
 
1260
                        al=SSL_AD_DECODE_ERROR;
 
1261
                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
 
1262
                                SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH);
 
1263
                        goto f_err;
 
1264
                        }
 
1265
                /* If received PSK identity hint contains NULL
 
1266
                 * characters, the hint is truncated from the first
 
1267
                 * NULL. p may not be ending with NULL, so create a
 
1268
                 * NULL-terminated string. */
 
1269
                memcpy(tmp_id_hint, p, i);
 
1270
                memset(tmp_id_hint+i, 0, PSK_MAX_IDENTITY_LEN+1-i);
 
1271
                if (s->ctx->psk_identity_hint != NULL)
 
1272
                        OPENSSL_free(s->ctx->psk_identity_hint);
 
1273
                s->ctx->psk_identity_hint = BUF_strdup(tmp_id_hint);
 
1274
                if (s->ctx->psk_identity_hint == NULL)
 
1275
                        {
 
1276
                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
 
1277
                        goto f_err;
 
1278
                        }          
 
1279
 
 
1280
                p+=i;
 
1281
                n-=param_len;
 
1282
                }
 
1283
        else
 
1284
#endif /* !OPENSSL_NO_PSK */
1154
1285
#ifndef OPENSSL_NO_RSA
1155
 
        if (alg & SSL_kRSA)
 
1286
        if (alg_k & SSL_kRSA)
1156
1287
                {
1157
1288
                if ((rsa=RSA_new()) == NULL)
1158
1289
                        {
1191
1322
                n-=param_len;
1192
1323
 
1193
1324
                /* this should be because we are using an export cipher */
1194
 
                if (alg & SSL_aRSA)
 
1325
                if (alg_a & SSL_aRSA)
1195
1326
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1196
1327
                else
1197
1328
                        {
1206
1337
                ;
1207
1338
#endif
1208
1339
#ifndef OPENSSL_NO_DH
1209
 
        else if (alg & SSL_kEDH)
 
1340
        else if (alg_k & SSL_kEDH)
1210
1341
                {
1211
1342
                if ((dh=DH_new()) == NULL)
1212
1343
                        {
1260
1391
                n-=param_len;
1261
1392
 
1262
1393
#ifndef OPENSSL_NO_RSA
1263
 
                if (alg & SSL_aRSA)
 
1394
                if (alg_a & SSL_aRSA)
1264
1395
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1265
1396
#else
1266
1397
                if (0)
1267
1398
                        ;
1268
1399
#endif
1269
1400
#ifndef OPENSSL_NO_DSA
1270
 
                else if (alg & SSL_aDSS)
 
1401
                else if (alg_a & SSL_aDSS)
1271
1402
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509);
1272
1403
#endif
1273
1404
                /* else anonymous DH, so no certificate or pkey. */
1275
1406
                s->session->sess_cert->peer_dh_tmp=dh;
1276
1407
                dh=NULL;
1277
1408
                }
1278
 
        else if ((alg & SSL_kDHr) || (alg & SSL_kDHd))
 
1409
        else if ((alg_k & SSL_kDHr) || (alg_k & SSL_kDHd))
1279
1410
                {
1280
1411
                al=SSL_AD_ILLEGAL_PARAMETER;
1281
1412
                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1284
1415
#endif /* !OPENSSL_NO_DH */
1285
1416
 
1286
1417
#ifndef OPENSSL_NO_ECDH
1287
 
        else if (alg & SSL_kECDHE)
 
1418
        else if (alg_k & SSL_kEECDH)
1288
1419
                {
1289
1420
                EC_GROUP *ngroup;
1290
1421
                const EC_GROUP *group;
1307
1438
                param_len=3;
1308
1439
                if ((param_len > n) ||
1309
1440
                    (*p != NAMED_CURVE_TYPE) || 
1310
 
                    ((curve_nid = curve_id2nid(*(p + 2))) == 0)) 
 
1441
                    ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) 
1311
1442
                        {
1312
1443
                        al=SSL_AD_INTERNAL_ERROR;
1313
1444
                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
1368
1499
                 */
1369
1500
                if (0) ;
1370
1501
#ifndef OPENSSL_NO_RSA
1371
 
                else if (alg & SSL_aRSA)
 
1502
                else if (alg_a & SSL_aRSA)
1372
1503
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1373
1504
#endif
1374
1505
#ifndef OPENSSL_NO_ECDSA
1375
 
                else if (alg & SSL_aECDSA)
 
1506
                else if (alg_a & SSL_aECDSA)
1376
1507
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
1377
1508
#endif
1378
1509
                /* else anonymous ECDH, so no certificate or pkey. */
1384
1515
                EC_POINT_free(srvr_ecpoint);
1385
1516
                srvr_ecpoint = NULL;
1386
1517
                }
1387
 
        else if (alg & SSL_kECDH)
 
1518
        else if (alg_k)
1388
1519
                {
1389
1520
                al=SSL_AD_UNEXPECTED_MESSAGE;
1390
1521
                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
1391
1522
                goto f_err;
1392
1523
                }
1393
1524
#endif /* !OPENSSL_NO_ECDH */
1394
 
        if (alg & SSL_aFZA)
1395
 
                {
1396
 
                al=SSL_AD_HANDSHAKE_FAILURE;
1397
 
                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1398
 
                goto f_err;
1399
 
                }
1400
1525
 
1401
1526
 
1402
1527
        /* p points to the next byte, there are 'n' bytes left */
1425
1550
                        q=md_buf;
1426
1551
                        for (num=2; num > 0; num--)
1427
1552
                                {
1428
 
                                EVP_MD_CTX_set_flags(&md_ctx,
1429
 
                                        EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
1430
1553
                                EVP_DigestInit_ex(&md_ctx,(num == 2)
1431
1554
                                        ?s->ctx->md5:s->ctx->sha1, NULL);
1432
1555
                                EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1497
1620
                }
1498
1621
        else
1499
1622
                {
 
1623
                if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK))
 
1624
                        /* aNULL or kPSK do not need public keys */
 
1625
                        {
 
1626
                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
 
1627
                        goto err;
 
1628
                        }
1500
1629
                /* still data left over */
1501
 
                if (!(alg & SSL_aNULL))
1502
 
                        {
1503
 
                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1504
 
                        goto err;
1505
 
                        }
1506
1630
                if (n != 0)
1507
1631
                        {
1508
1632
                        al=SSL_AD_DECODE_ERROR;
1572
1696
        /* TLS does not like anon-DH with client cert */
1573
1697
        if (s->version > SSL3_VERSION)
1574
1698
                {
1575
 
                l=s->s3->tmp.new_cipher->algorithms;
1576
 
                if (l & SSL_aNULL)
 
1699
                if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
1577
1700
                        {
1578
1701
                        ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1579
1702
                        SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER);
1775
1898
int ssl3_get_cert_status(SSL *s)
1776
1899
        {
1777
1900
        int ok, al;
1778
 
        unsigned long resplen;
1779
 
        long n;
 
1901
        unsigned long resplen,n;
1780
1902
        const unsigned char *p;
1781
1903
 
1782
1904
        n=s->method->ssl_get_message(s,
1802
1924
                goto f_err;
1803
1925
                }
1804
1926
        n2l3(p, resplen);
1805
 
        if (resplen + 4 != (unsigned long)n)
 
1927
        if (resplen + 4 != n)
1806
1928
                {
1807
1929
                al = SSL_AD_DECODE_ERROR;
1808
1930
                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
1871
1993
        {
1872
1994
        unsigned char *p,*d;
1873
1995
        int n;
1874
 
        unsigned long l;
 
1996
        unsigned long alg_k;
1875
1997
#ifndef OPENSSL_NO_RSA
1876
1998
        unsigned char *q;
1877
1999
        EVP_PKEY *pkey=NULL;
1893
2015
                d=(unsigned char *)s->init_buf->data;
1894
2016
                p= &(d[4]);
1895
2017
 
1896
 
                l=s->s3->tmp.new_cipher->algorithms;
 
2018
                alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
1897
2019
 
1898
2020
                /* Fool emacs indentation */
1899
2021
                if (0) {}
1900
2022
#ifndef OPENSSL_NO_RSA
1901
 
                else if (l & SSL_kRSA)
 
2023
                else if (alg_k & SSL_kRSA)
1902
2024
                        {
1903
2025
                        RSA *rsa;
1904
2026
                        unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1957
2079
                        }
1958
2080
#endif
1959
2081
#ifndef OPENSSL_NO_KRB5
1960
 
                else if (l & SSL_kKRB5)
 
2082
                else if (alg_k & SSL_kKRB5)
1961
2083
                        {
1962
2084
                        krb5_error_code krb5rc;
1963
2085
                        KSSL_CTX        *kssl_ctx = s->kssl_ctx;
1965
2087
                        krb5_data       *enc_ticket;
1966
2088
                        krb5_data       authenticator, *authp = NULL;
1967
2089
                        EVP_CIPHER_CTX  ciph_ctx;
1968
 
                        EVP_CIPHER      *enc = NULL;
 
2090
                        const EVP_CIPHER *enc = NULL;
1969
2091
                        unsigned char   iv[EVP_MAX_IV_LENGTH];
1970
2092
                        unsigned char   tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1971
2093
                        unsigned char   epms[SSL_MAX_MASTER_KEY_LENGTH 
1976
2098
 
1977
2099
#ifdef KSSL_DEBUG
1978
2100
                        printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
1979
 
                                l, SSL_kKRB5);
 
2101
                                alg_k, SSL_kKRB5);
1980
2102
#endif  /* KSSL_DEBUG */
1981
2103
 
1982
2104
                        authp = NULL;
2068
2190
                                sizeof tmp_buf);
2069
2191
                        EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
2070
2192
                        outl += padl;
2071
 
                        if (outl > sizeof epms)
 
2193
                        if (outl > (int)sizeof epms)
2072
2194
                                {
2073
2195
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2074
2196
                                goto err;
2082
2204
                        n+=outl + 2;
2083
2205
 
2084
2206
                        s->session->master_key_length=
2085
 
                                s->method->ssl3_enc->generate_master_secret(s,
 
2207
                                s->method->ssl3_enc->generate_master_secret(s,
2086
2208
                                        s->session->master_key,
2087
2209
                                        tmp_buf, sizeof tmp_buf);
2088
2210
 
2091
2213
                        }
2092
2214
#endif
2093
2215
#ifndef OPENSSL_NO_DH
2094
 
                else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
 
2216
                else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2095
2217
                        {
2096
2218
                        DH *dh_srvr,*dh_clnt;
2097
2219
 
2100
2222
                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
2101
2223
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
2102
2224
                                goto err;
2103
 
                                }
 
2225
                                }
2104
2226
 
2105
2227
                        if (s->session->sess_cert->peer_dh_tmp != NULL)
2106
2228
                                dh_srvr=s->session->sess_cert->peer_dh_tmp;
2155
2277
#endif
2156
2278
 
2157
2279
#ifndef OPENSSL_NO_ECDH 
2158
 
                else if ((l & SSL_kECDH) || (l & SSL_kECDHE))
 
2280
                else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
2159
2281
                        {
2160
2282
                        const EC_GROUP *srvr_group = NULL;
2161
2283
                        EC_KEY *tkey;
2167
2289
                         * computation as part of client certificate?
2168
2290
                         * If so, set ecdh_clnt_cert to 1.
2169
2291
                         */
2170
 
                        if ((l & SSL_kECDH) && (s->cert != NULL)) 
 
2292
                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->cert != NULL)) 
2171
2293
                                {
2172
2294
                                /* XXX: For now, we do not support client
2173
2295
                                 * authentication using ECDH certificates.
2339
2461
                        EVP_PKEY_free(srvr_pub_pkey);
2340
2462
                        }
2341
2463
#endif /* !OPENSSL_NO_ECDH */
 
2464
                else if (alg_k & SSL_kGOST) 
 
2465
                        {
 
2466
                        /* GOST key exchange message creation */
 
2467
                        EVP_PKEY_CTX *pkey_ctx;
 
2468
                        X509 *peer_cert; 
 
2469
                        size_t msglen;
 
2470
                        unsigned int md_len;
 
2471
                        int keytype;
 
2472
                        unsigned char premaster_secret[32],shared_ukm[32], tmp[256];
 
2473
                        EVP_MD_CTX *ukm_hash;
 
2474
                        EVP_PKEY *pub_key;
 
2475
 
 
2476
                        /* Get server sertificate PKEY and create ctx from it */
 
2477
                        peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
 
2478
                        if (!peer_cert) 
 
2479
                                peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
 
2480
                        if (!peer_cert)         {
 
2481
                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
 
2482
                                        goto err;
 
2483
                                }       
 
2484
                                
 
2485
                        pkey_ctx=EVP_PKEY_CTX_new(pub_key=X509_get_pubkey(peer_cert),NULL);
 
2486
                        /* If we have send a certificate, and certificate key
 
2487
 
 
2488
                         * parameters match those of server certificate, use
 
2489
                         * certificate key for key exchange
 
2490
                         */
 
2491
 
 
2492
                         /* Otherwise, generate ephemeral key pair */
 
2493
                                        
 
2494
                        EVP_PKEY_encrypt_init(pkey_ctx);
 
2495
                          /* Generate session key */    
 
2496
                    RAND_bytes(premaster_secret,32);
 
2497
                        /* If we have client certificate, use its secret as peer key */
 
2498
                        if (s->s3->tmp.cert_req && s->cert->key->privatekey) {
 
2499
                                if (EVP_PKEY_derive_set_peer(pkey_ctx,s->cert->key->privatekey) <=0) {
 
2500
                                        /* If there was an error - just ignore it. Ephemeral key
 
2501
                                        * would be used
 
2502
                                        */
 
2503
                                        ERR_clear_error();
 
2504
                                }
 
2505
                        }                       
 
2506
                        /* Compute shared IV and store it in algorithm-specific
 
2507
                         * context data */
 
2508
                        ukm_hash = EVP_MD_CTX_create();
 
2509
                        EVP_DigestInit(ukm_hash,EVP_get_digestbynid(NID_id_GostR3411_94));
 
2510
                        EVP_DigestUpdate(ukm_hash,s->s3->client_random,SSL3_RANDOM_SIZE);
 
2511
                        EVP_DigestUpdate(ukm_hash,s->s3->server_random,SSL3_RANDOM_SIZE);
 
2512
                        EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len);
 
2513
                        EVP_MD_CTX_destroy(ukm_hash);
 
2514
                        if (EVP_PKEY_CTX_ctrl(pkey_ctx,-1,EVP_PKEY_OP_ENCRYPT,EVP_PKEY_CTRL_SET_IV,
 
2515
                                8,shared_ukm)<0) {
 
2516
                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2517
                                                SSL_R_LIBRARY_BUG);
 
2518
                                        goto err;
 
2519
                                }       
 
2520
                        /* Make GOST keytransport blob message */
 
2521
                        /*Encapsulate it into sequence */
 
2522
                        *(p++)=V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED;
 
2523
                        msglen=255;
 
2524
                        if (EVP_PKEY_encrypt(pkey_ctx,tmp,&msglen,premaster_secret,32)<0) {
 
2525
                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2526
                                        SSL_R_LIBRARY_BUG);
 
2527
                                goto err;
 
2528
                        }
 
2529
                        if (msglen >= 0x80)
 
2530
                                {
 
2531
                                *(p++)=0x81;
 
2532
                                *(p++)= msglen & 0xff;
 
2533
                                n=msglen+3;
 
2534
                                }
 
2535
                        else
 
2536
                                {
 
2537
                                *(p++)= msglen & 0xff;
 
2538
                                n=msglen+2;
 
2539
                                }
 
2540
                        memcpy(p, tmp, msglen);
 
2541
                        /* Check if pubkey from client certificate was used */
 
2542
                        if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)
 
2543
                                {
 
2544
                                /* Set flag "skip certificate verify" */
 
2545
                                s->s3->flags |= TLS1_FLAGS_SKIP_CERT_VERIFY;
 
2546
                                }
 
2547
                        EVP_PKEY_CTX_free(pkey_ctx);
 
2548
                        s->session->master_key_length=
 
2549
                                s->method->ssl3_enc->generate_master_secret(s,
 
2550
                                        s->session->master_key,premaster_secret,32);
 
2551
                        EVP_PKEY_free(pub_key);
 
2552
 
 
2553
                        }
 
2554
#ifndef OPENSSL_NO_PSK
 
2555
                else if (alg_k & SSL_kPSK)
 
2556
                        {
 
2557
                        char identity[PSK_MAX_IDENTITY_LEN];
 
2558
                        unsigned char *t = NULL;
 
2559
                        unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4];
 
2560
                        unsigned int pre_ms_len = 0, psk_len = 0;
 
2561
                        int psk_err = 1;
 
2562
 
 
2563
                        n = 0;
 
2564
                        if (s->psk_client_callback == NULL)
 
2565
                                {
 
2566
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2567
                                        SSL_R_PSK_NO_CLIENT_CB);
 
2568
                                goto err;
 
2569
                                }
 
2570
 
 
2571
                        psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint,
 
2572
                                identity, PSK_MAX_IDENTITY_LEN,
 
2573
                                psk_or_pre_ms, sizeof(psk_or_pre_ms));
 
2574
                        if (psk_len > PSK_MAX_PSK_LEN)
 
2575
                                {
 
2576
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2577
                                        ERR_R_INTERNAL_ERROR);
 
2578
                                goto psk_err;
 
2579
                                }
 
2580
                        else if (psk_len == 0)
 
2581
                                {
 
2582
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2583
                                        SSL_R_PSK_IDENTITY_NOT_FOUND);
 
2584
                                goto psk_err;
 
2585
                                }
 
2586
 
 
2587
                        /* create PSK pre_master_secret */
 
2588
                        pre_ms_len = 2+psk_len+2+psk_len;
 
2589
                        t = psk_or_pre_ms;
 
2590
                        memmove(psk_or_pre_ms+psk_len+4, psk_or_pre_ms, psk_len);
 
2591
                        s2n(psk_len, t);
 
2592
                        memset(t, 0, psk_len);
 
2593
                        t+=psk_len;
 
2594
                        s2n(psk_len, t);
 
2595
 
 
2596
                        if (s->session->psk_identity_hint != NULL)
 
2597
                                OPENSSL_free(s->session->psk_identity_hint);
 
2598
                        s->session->psk_identity_hint = BUF_strdup(s->ctx->psk_identity_hint);
 
2599
                        if (s->ctx->psk_identity_hint != NULL &&
 
2600
                                s->session->psk_identity_hint == NULL)
 
2601
                                {
 
2602
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2603
                                        ERR_R_MALLOC_FAILURE);
 
2604
                                goto psk_err;
 
2605
                                }
 
2606
 
 
2607
                        if (s->session->psk_identity != NULL)
 
2608
                                OPENSSL_free(s->session->psk_identity);
 
2609
                        s->session->psk_identity = BUF_strdup(identity);
 
2610
                        if (s->session->psk_identity == NULL)
 
2611
                                {
 
2612
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 
2613
                                        ERR_R_MALLOC_FAILURE);
 
2614
                                goto psk_err;
 
2615
                                }
 
2616
 
 
2617
                        s->session->master_key_length =
 
2618
                                s->method->ssl3_enc->generate_master_secret(s,
 
2619
                                        s->session->master_key,
 
2620
                                        psk_or_pre_ms, pre_ms_len); 
 
2621
                        n = strlen(identity);
 
2622
                        s2n(n, p);
 
2623
                        memcpy(p, identity, n);
 
2624
                        n+=2;
 
2625
                        psk_err = 0;
 
2626
                psk_err:
 
2627
                        OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN);
 
2628
                        OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
 
2629
                        if (psk_err != 0)
 
2630
                                {
 
2631
                                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
 
2632
                                goto err;
 
2633
                                }
 
2634
                        }
 
2635
#endif
2342
2636
                else
2343
2637
                        {
2344
2638
                        ssl3_send_alert(s, SSL3_AL_FATAL,
2375
2669
        unsigned char *p,*d;
2376
2670
        unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
2377
2671
        EVP_PKEY *pkey;
 
2672
        EVP_PKEY_CTX *pctx=NULL;
2378
2673
#ifndef OPENSSL_NO_RSA
2379
2674
        unsigned u=0;
2380
2675
#endif
2381
2676
        unsigned long n;
2382
 
#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
2383
2677
        int j;
2384
 
#endif
2385
2678
 
2386
2679
        if (s->state == SSL3_ST_CW_CERT_VRFY_A)
2387
2680
                {
2388
2681
                d=(unsigned char *)s->init_buf->data;
2389
2682
                p= &(d[4]);
2390
2683
                pkey=s->cert->key->privatekey;
2391
 
 
2392
 
                s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2),
2393
 
                        &(data[MD5_DIGEST_LENGTH]));
2394
 
 
 
2684
/* Create context from key and test if sha1 is allowed as digest */
 
2685
                pctx = EVP_PKEY_CTX_new(pkey,NULL);
 
2686
                EVP_PKEY_sign_init(pctx);
 
2687
                if (EVP_PKEY_CTX_set_signature_md(pctx, EVP_sha1())>0)
 
2688
                        {
 
2689
                        s->method->ssl3_enc->cert_verify_mac(s,
 
2690
                                                NID_sha1,
 
2691
                                                &(data[MD5_DIGEST_LENGTH]));
 
2692
                        }
 
2693
                else
 
2694
                        {
 
2695
                        ERR_clear_error();
 
2696
                        }
2395
2697
#ifndef OPENSSL_NO_RSA
2396
2698
                if (pkey->type == EVP_PKEY_RSA)
2397
2699
                        {
2398
2700
                        s->method->ssl3_enc->cert_verify_mac(s,
2399
 
                                &(s->s3->finish_dgst1),&(data[0]));
 
2701
                                NID_md5,
 
2702
                                &(data[0]));
2400
2703
                        if (RSA_sign(NID_md5_sha1, data,
2401
2704
                                         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
2402
2705
                                        &(p[2]), &u, pkey->pkey.rsa) <= 0 )
2442
2745
                        }
2443
2746
                else
2444
2747
#endif
2445
 
                        {
 
2748
                if (pkey->type == NID_id_GostR3410_94 || pkey->type == NID_id_GostR3410_2001) 
 
2749
                {
 
2750
                unsigned char signbuf[64];
 
2751
                int i;
 
2752
                size_t sigsize=64;
 
2753
                s->method->ssl3_enc->cert_verify_mac(s,
 
2754
                        NID_id_GostR3411_94,
 
2755
                        data);
 
2756
                if (EVP_PKEY_sign(pctx, signbuf, &sigsize, data, 32) <= 0) {
 
2757
                        SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
 
2758
                        ERR_R_INTERNAL_ERROR);
 
2759
                        goto err;
 
2760
                }
 
2761
                for (i=63,j=0; i>=0; j++, i--) {
 
2762
                        p[2+j]=signbuf[i];
 
2763
                }       
 
2764
                s2n(j,p);
 
2765
                n=j+2;
 
2766
                }
 
2767
                else
 
2768
                {
2446
2769
                        SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
2447
2770
                        goto err;
2448
 
                        }
 
2771
                }
2449
2772
                *(d++)=SSL3_MT_CERTIFICATE_VERIFY;
2450
2773
                l2n3(n,d);
2451
2774
 
2453
2776
                s->init_num=(int)n+4;
2454
2777
                s->init_off=0;
2455
2778
                }
 
2779
        EVP_PKEY_CTX_free(pctx);
2456
2780
        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2457
2781
err:
 
2782
        EVP_PKEY_CTX_free(pctx);
2458
2783
        return(-1);
2459
2784
        }
2460
2785
 
2539
2864
int ssl3_check_cert_and_algorithm(SSL *s)
2540
2865
        {
2541
2866
        int i,idx;
2542
 
        long algs;
 
2867
        long alg_k,alg_a;
2543
2868
        EVP_PKEY *pkey=NULL;
2544
2869
        SESS_CERT *sc;
2545
2870
#ifndef OPENSSL_NO_RSA
2549
2874
        DH *dh;
2550
2875
#endif
2551
2876
 
 
2877
        alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
 
2878
        alg_a=s->s3->tmp.new_cipher->algorithm_auth;
 
2879
 
 
2880
        /* we don't have a certificate */
 
2881
        if ((alg_a & (SSL_aDH|SSL_aNULL|SSL_aKRB5)) || (alg_k & SSL_kPSK))
 
2882
                return(1);
 
2883
 
2552
2884
        sc=s->session->sess_cert;
2553
 
 
2554
 
        algs=s->s3->tmp.new_cipher->algorithms;
2555
 
 
2556
 
        /* we don't have a certificate */
2557
 
        if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
2558
 
                return(1);
2559
 
 
2560
2885
        if (sc == NULL)
2561
2886
                {
2562
2887
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
2576
2901
#ifndef OPENSSL_NO_ECDH
2577
2902
        if (idx == SSL_PKEY_ECC)
2578
2903
                {
2579
 
                if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
 
2904
                if (ssl_check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
2580
2905
                    s->s3->tmp.new_cipher) == 0) 
2581
2906
                        { /* check failed */
2582
2907
                        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
2583
 
                        goto f_err;                     
 
2908
                        goto f_err;
2584
2909
                        }
2585
2910
                else 
2586
2911
                        {
2594
2919
 
2595
2920
        
2596
2921
        /* Check that we have a certificate if we require one */
2597
 
        if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
 
2922
        if ((alg_a & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
2598
2923
                {
2599
2924
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
2600
2925
                goto f_err;
2601
2926
                }
2602
2927
#ifndef OPENSSL_NO_DSA
2603
 
        else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
 
2928
        else if ((alg_a & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
2604
2929
                {
2605
2930
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
2606
2931
                goto f_err;
2607
2932
                }
2608
2933
#endif
2609
2934
#ifndef OPENSSL_NO_RSA
2610
 
        if ((algs & SSL_kRSA) &&
 
2935
        if ((alg_k & SSL_kRSA) &&
2611
2936
                !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
2612
2937
                {
2613
2938
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
2615
2940
                }
2616
2941
#endif
2617
2942
#ifndef OPENSSL_NO_DH
2618
 
        if ((algs & SSL_kEDH) &&
 
2943
        if ((alg_k & SSL_kEDH) &&
2619
2944
                !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
2620
2945
                {
2621
2946
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
2622
2947
                goto f_err;
2623
2948
                }
2624
 
        else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
 
2949
        else if ((alg_k & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
2625
2950
                {
2626
2951
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
2627
2952
                goto f_err;
2628
2953
                }
2629
2954
#ifndef OPENSSL_NO_DSA
2630
 
        else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
 
2955
        else if ((alg_k & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
2631
2956
                {
2632
2957
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
2633
2958
                goto f_err;
2638
2963
        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
2639
2964
                {
2640
2965
#ifndef OPENSSL_NO_RSA
2641
 
                if (algs & SSL_kRSA)
 
2966
                if (alg_k & SSL_kRSA)
2642
2967
                        {
2643
2968
                        if (rsa == NULL
2644
2969
                            || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2650
2975
                else
2651
2976
#endif
2652
2977
#ifndef OPENSSL_NO_DH
2653
 
                        if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
 
2978
                        if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2654
2979
                            {
2655
2980
                            if (dh == NULL
2656
2981
                                || DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2673
2998
        return(0);
2674
2999
        }
2675
3000
 
2676
 
 
2677
 
#ifndef OPENSSL_NO_ECDH
2678
 
/* This is the complement of nid2curve_id in s3_srvr.c. */
2679
 
static int curve_id2nid(int curve_id)
2680
 
{
2681
 
        /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
2682
 
         * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
2683
 
        static int nid_list[26] =
2684
 
        {
2685
 
                0,
2686
 
                NID_sect163k1, /* sect163k1 (1) */
2687
 
                NID_sect163r1, /* sect163r1 (2) */
2688
 
                NID_sect163r2, /* sect163r2 (3) */
2689
 
                NID_sect193r1, /* sect193r1 (4) */ 
2690
 
                NID_sect193r2, /* sect193r2 (5) */ 
2691
 
                NID_sect233k1, /* sect233k1 (6) */
2692
 
                NID_sect233r1, /* sect233r1 (7) */ 
2693
 
                NID_sect239k1, /* sect239k1 (8) */ 
2694
 
                NID_sect283k1, /* sect283k1 (9) */
2695
 
                NID_sect283r1, /* sect283r1 (10) */ 
2696
 
                NID_sect409k1, /* sect409k1 (11) */ 
2697
 
                NID_sect409r1, /* sect409r1 (12) */
2698
 
                NID_sect571k1, /* sect571k1 (13) */ 
2699
 
                NID_sect571r1, /* sect571r1 (14) */ 
2700
 
                NID_secp160k1, /* secp160k1 (15) */
2701
 
                NID_secp160r1, /* secp160r1 (16) */ 
2702
 
                NID_secp160r2, /* secp160r2 (17) */ 
2703
 
                NID_secp192k1, /* secp192k1 (18) */
2704
 
                NID_X9_62_prime192v1, /* secp192r1 (19) */ 
2705
 
                NID_secp224k1, /* secp224k1 (20) */ 
2706
 
                NID_secp224r1, /* secp224r1 (21) */
2707
 
                NID_secp256k1, /* secp256k1 (22) */ 
2708
 
                NID_X9_62_prime256v1, /* secp256r1 (23) */ 
2709
 
                NID_secp384r1, /* secp384r1 (24) */
2710
 
                NID_secp521r1  /* secp521r1 (25) */     
2711
 
        };
2712
 
        
2713
 
        if ((curve_id < 1) || (curve_id > 25)) return 0;
2714
 
 
2715
 
        return nid_list[curve_id];
2716
 
}
2717
 
#endif
2718
 
 
2719
3001
/* Check to see if handshake is full or resumed. Usually this is just a
2720
3002
 * case of checking to see if a cache hit has occurred. In the case of
2721
3003
 * session tickets we have to check the next message to be sure.
2726
3008
        {
2727
3009
        int ok;
2728
3010
        long n;
2729
 
        /* If we have no ticket or session ID is non-zero length (a match of
2730
 
         * a non-zero session length would never reach here) it cannot be a
2731
 
         * resumed session.
2732
 
         */
2733
 
        if (!s->session->tlsext_tick || s->session->session_id_length)
 
3011
        /* If we have no ticket it cannot be a resumed session. */
 
3012
        if (!s->session->tlsext_tick)
2734
3013
                return 1;
2735
3014
        /* this function is called when we really expect a Certificate
2736
3015
         * message, so permit appropriate message length */