1/* ssl/s3_clnt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58/* ====================================================================
59 * Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
111/* ====================================================================
112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113 *
114 * Portions of the attached software ("Contribution") are developed by
115 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
116 *
117 * The Contribution is licensed pursuant to the OpenSSL open source
118 * license provided above.
119 *
120 * ECC cipher suite support in OpenSSL originally written by
121 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
122 *
123 */
124
125#include <stdio.h>
126#include "ssl_locl.h"
127#include "kssl_lcl.h"
128#include <openssl/buffer.h>
129#include <openssl/rand.h>
130#include <openssl/objects.h>
131#include <openssl/evp.h>
132#include <openssl/md5.h>
133#ifdef OPENSSL_FIPS
134#include <openssl/fips.h>
135#endif
136
137#ifndef OPENSSL_NO_DH
138#include <openssl/dh.h>
139#endif
140#include <openssl/bn.h>
141#ifndef OPENSSL_NO_ENGINE
142#include <openssl/engine.h>
143#endif
144
145static SSL_METHOD *ssl3_get_client_method(int ver);
146static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
147
148#ifndef OPENSSL_NO_ECDH
149static int curve_id2nid(int curve_id);
150int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
151#endif
152
153static SSL_METHOD *ssl3_get_client_method(int ver)
154 {
155 if (ver == SSL3_VERSION)
156 return(SSLv3_client_method());
157 else
158 return(NULL);
159 }
160
161IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
162 ssl_undefined_function,
163 ssl3_connect,
164 ssl3_get_client_method)
165
166int ssl3_connect(SSL *s)
167 {
168 BUF_MEM *buf=NULL;
169 unsigned long Time=(unsigned long)time(NULL),l;
170 void (*cb)(const SSL *ssl,int type,int val)=NULL;
171 int ret= -1;
172 int new_state,state,skip=0;
173
174 RAND_add(&Time,sizeof(Time),0);
175 ERR_clear_error();
176 clear_sys_error();
177
178 if (s->info_callback != NULL)
179 cb=s->info_callback;
180 else if (s->ctx->info_callback != NULL)
181 cb=s->ctx->info_callback;
182
183 s->in_handshake++;
184 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
185
186 for (;;)
187 {
188 state=s->state;
189
190 switch(s->state)
191 {
192 case SSL_ST_RENEGOTIATE:
193 s->new_session=1;
194 s->state=SSL_ST_CONNECT;
195 s->ctx->stats.sess_connect_renegotiate++;
196 /* break */
197 case SSL_ST_BEFORE:
198 case SSL_ST_CONNECT:
199 case SSL_ST_BEFORE|SSL_ST_CONNECT:
200 case SSL_ST_OK|SSL_ST_CONNECT:
201
202 s->server=0;
203 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
204
205 if ((s->version & 0xff00 ) != 0x0300)
206 {
207 SSLerr(SSL_F_SSL3_CONNECT, ERR_R_INTERNAL_ERROR);
208 ret = -1;
209 goto end;
210 }
211
212 /* s->version=SSL3_VERSION; */
213 s->type=SSL_ST_CONNECT;
214
215 if (s->init_buf == NULL)
216 {
217 if ((buf=BUF_MEM_new()) == NULL)
218 {
219 ret= -1;
220 goto end;
221 }
222 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
223 {
224 ret= -1;
225 goto end;
226 }
227 s->init_buf=buf;
228 buf=NULL;
229 }
230
231 if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
232
233 /* setup buffing BIO */
234 if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
235
236 /* don't push the buffering BIO quite yet */
237
238 ssl3_init_finished_mac(s);
239
240 s->state=SSL3_ST_CW_CLNT_HELLO_A;
241 s->ctx->stats.sess_connect++;
242 s->init_num=0;
243 break;
244
245 case SSL3_ST_CW_CLNT_HELLO_A:
246 case SSL3_ST_CW_CLNT_HELLO_B:
247
248 s->shutdown=0;
249 ret=ssl3_client_hello(s);
250 if (ret <= 0) goto end;
251 s->state=SSL3_ST_CR_SRVR_HELLO_A;
252 s->init_num=0;
253
254 /* turn on buffering for the next lot of output */
255 if (s->bbio != s->wbio)
256 s->wbio=BIO_push(s->bbio,s->wbio);
257
258 break;
259
260 case SSL3_ST_CR_SRVR_HELLO_A:
261 case SSL3_ST_CR_SRVR_HELLO_B:
262 ret=ssl3_get_server_hello(s);
263 if (ret <= 0) goto end;
264 if (s->hit)
265 s->state=SSL3_ST_CR_FINISHED_A;
266 else
267 s->state=SSL3_ST_CR_CERT_A;
268 s->init_num=0;
269 break;
270
271 case SSL3_ST_CR_CERT_A:
272 case SSL3_ST_CR_CERT_B:
273#ifndef OPENSSL_NO_TLSEXT
274 ret=ssl3_check_finished(s);
275 if (ret <= 0) goto end;
276 if (ret == 2)
277 {
278 s->hit = 1;
279 if (s->tlsext_ticket_expected)
280 s->state=SSL3_ST_CR_SESSION_TICKET_A;
281 else
282 s->state=SSL3_ST_CR_FINISHED_A;
283 s->init_num=0;
284 break;
285 }
286#endif
287 /* Check if it is anon DH/ECDH */
288 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
289 {
290 ret=ssl3_get_server_certificate(s);
291 if (ret <= 0) goto end;
292#ifndef OPENSSL_NO_TLSEXT
293 if (s->tlsext_status_expected)
294 s->state=SSL3_ST_CR_CERT_STATUS_A;
295 else
296 s->state=SSL3_ST_CR_KEY_EXCH_A;
297 }
298 else
299 {
300 skip = 1;
301 s->state=SSL3_ST_CR_KEY_EXCH_A;
302 }
303#else
304 }
305 else
306 skip=1;
307
308 s->state=SSL3_ST_CR_KEY_EXCH_A;
309#endif
310 s->init_num=0;
311 break;
312
313 case SSL3_ST_CR_KEY_EXCH_A:
314 case SSL3_ST_CR_KEY_EXCH_B:
315 ret=ssl3_get_key_exchange(s);
316 if (ret <= 0) goto end;
317 s->state=SSL3_ST_CR_CERT_REQ_A;
318 s->init_num=0;
319
320 /* at this point we check that we have the
321 * required stuff from the server */
322 if (!ssl3_check_cert_and_algorithm(s))
323 {
324 ret= -1;
325 goto end;
326 }
327 break;
328
329 case SSL3_ST_CR_CERT_REQ_A:
330 case SSL3_ST_CR_CERT_REQ_B:
331 ret=ssl3_get_certificate_request(s);
332 if (ret <= 0) goto end;
333 s->state=SSL3_ST_CR_SRVR_DONE_A;
334 s->init_num=0;
335 break;
336
337 case SSL3_ST_CR_SRVR_DONE_A:
338 case SSL3_ST_CR_SRVR_DONE_B:
339 ret=ssl3_get_server_done(s);
340 if (ret <= 0) goto end;
341 if (s->s3->tmp.cert_req)
342 s->state=SSL3_ST_CW_CERT_A;
343 else
344 s->state=SSL3_ST_CW_KEY_EXCH_A;
345 s->init_num=0;
346
347 break;
348
349 case SSL3_ST_CW_CERT_A:
350 case SSL3_ST_CW_CERT_B:
351 case SSL3_ST_CW_CERT_C:
352 case SSL3_ST_CW_CERT_D:
353 ret=ssl3_send_client_certificate(s);
354 if (ret <= 0) goto end;
355 s->state=SSL3_ST_CW_KEY_EXCH_A;
356 s->init_num=0;
357 break;
358
359 case SSL3_ST_CW_KEY_EXCH_A:
360 case SSL3_ST_CW_KEY_EXCH_B:
361 ret=ssl3_send_client_key_exchange(s);
362 if (ret <= 0) goto end;
363 l=s->s3->tmp.new_cipher->algorithms;
364 /* EAY EAY EAY need to check for DH fix cert
365 * sent back */
366 /* For TLS, cert_req is set to 2, so a cert chain
367 * of nothing is sent, but no verify packet is sent */
368 /* XXX: For now, we do not support client
369 * authentication in ECDH cipher suites with
370 * ECDH (rather than ECDSA) certificates.
371 * We need to skip the certificate verify
372 * message when client's ECDH public key is sent
373 * inside the client certificate.
374 */
375 if (s->s3->tmp.cert_req == 1)
376 {
377 s->state=SSL3_ST_CW_CERT_VRFY_A;
378 }
379 else
380 {
381 s->state=SSL3_ST_CW_CHANGE_A;
382 s->s3->change_cipher_spec=0;
383 }
384
385 s->init_num=0;
386 break;
387
388 case SSL3_ST_CW_CERT_VRFY_A:
389 case SSL3_ST_CW_CERT_VRFY_B:
390 ret=ssl3_send_client_verify(s);
391 if (ret <= 0) goto end;
392 s->state=SSL3_ST_CW_CHANGE_A;
393 s->init_num=0;
394 s->s3->change_cipher_spec=0;
395 break;
396
397 case SSL3_ST_CW_CHANGE_A:
398 case SSL3_ST_CW_CHANGE_B:
399 ret=ssl3_send_change_cipher_spec(s,
400 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
401 if (ret <= 0) goto end;
402 s->state=SSL3_ST_CW_FINISHED_A;
403 s->init_num=0;
404
405 s->session->cipher=s->s3->tmp.new_cipher;
406#ifdef OPENSSL_NO_COMP
407 s->session->compress_meth=0;
408#else
409 if (s->s3->tmp.new_compression == NULL)
410 s->session->compress_meth=0;
411 else
412 s->session->compress_meth=
413 s->s3->tmp.new_compression->id;
414#endif
415 if (!s->method->ssl3_enc->setup_key_block(s))
416 {
417 ret= -1;
418 goto end;
419 }
420
421 if (!s->method->ssl3_enc->change_cipher_state(s,
422 SSL3_CHANGE_CIPHER_CLIENT_WRITE))
423 {
424 ret= -1;
425 goto end;
426 }
427
428 break;
429
430 case SSL3_ST_CW_FINISHED_A:
431 case SSL3_ST_CW_FINISHED_B:
432 ret=ssl3_send_finished(s,
433 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
434 s->method->ssl3_enc->client_finished_label,
435 s->method->ssl3_enc->client_finished_label_len);
436 if (ret <= 0) goto end;
437 s->state=SSL3_ST_CW_FLUSH;
438
439 /* clear flags */
440 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
441 if (s->hit)
442 {
443 s->s3->tmp.next_state=SSL_ST_OK;
444 if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED)
445 {
446 s->state=SSL_ST_OK;
447 s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
448 s->s3->delay_buf_pop_ret=0;
449 }
450 }
451 else
452 {
453#ifndef OPENSSL_NO_TLSEXT
454 /* Allow NewSessionTicket if ticket expected */
455 if (s->tlsext_ticket_expected)
456 s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
457 else
458#endif
459
460 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
461 }
462 s->init_num=0;
463 break;
464
465#ifndef OPENSSL_NO_TLSEXT
466 case SSL3_ST_CR_SESSION_TICKET_A:
467 case SSL3_ST_CR_SESSION_TICKET_B:
468 ret=ssl3_get_new_session_ticket(s);
469 if (ret <= 0) goto end;
470 s->state=SSL3_ST_CR_FINISHED_A;
471 s->init_num=0;
472 break;
473
474 case SSL3_ST_CR_CERT_STATUS_A:
475 case SSL3_ST_CR_CERT_STATUS_B:
476 ret=ssl3_get_cert_status(s);
477 if (ret <= 0) goto end;
478 s->state=SSL3_ST_CR_KEY_EXCH_A;
479 s->init_num=0;
480 break;
481#endif
482
483 case SSL3_ST_CR_FINISHED_A:
484 case SSL3_ST_CR_FINISHED_B:
485
486 ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
487 SSL3_ST_CR_FINISHED_B);
488 if (ret <= 0) goto end;
489
490 if (s->hit)
491 s->state=SSL3_ST_CW_CHANGE_A;
492 else
493 s->state=SSL_ST_OK;
494 s->init_num=0;
495 break;
496
497 case SSL3_ST_CW_FLUSH:
498 s->rwstate=SSL_WRITING;
499 if (BIO_flush(s->wbio) <= 0)
500 {
501 ret= -1;
502 goto end;
503 }
504 s->rwstate=SSL_NOTHING;
505 s->state=s->s3->tmp.next_state;
506 break;
507
508 case SSL_ST_OK:
509 /* clean a few things up */
510 ssl3_cleanup_key_block(s);
511
512 if (s->init_buf != NULL)
513 {
514 BUF_MEM_free(s->init_buf);
515 s->init_buf=NULL;
516 }
517
518 /* If we are not 'joining' the last two packets,
519 * remove the buffering now */
520 if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
521 ssl_free_wbio_buffer(s);
522 /* else do it later in ssl3_write */
523
524 s->init_num=0;
525 s->new_session=0;
526
527 ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
528 if (s->hit) s->ctx->stats.sess_hit++;
529
530 ret=1;
531 /* s->server=0; */
532 s->handshake_func=ssl3_connect;
533 s->ctx->stats.sess_connect_good++;
534
535 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
536
537 goto end;
538 /* break; */
539
540 default:
541 SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE);
542 ret= -1;
543 goto end;
544 /* break; */
545 }
546
547 /* did we do anything */
548 if (!s->s3->tmp.reuse_message && !skip)
549 {
550 if (s->debug)
551 {
552 if ((ret=BIO_flush(s->wbio)) <= 0)
553 goto end;
554 }
555
556 if ((cb != NULL) && (s->state != state))
557 {
558 new_state=s->state;
559 s->state=state;
560 cb(s,SSL_CB_CONNECT_LOOP,1);
561 s->state=new_state;
562 }
563 }
564 skip=0;
565 }
566end:
567 s->in_handshake--;
568 if (buf != NULL)
569 BUF_MEM_free(buf);
570 if (cb != NULL)
571 cb(s,SSL_CB_CONNECT_EXIT,ret);
572 return(ret);
573 }
574
575
576int ssl3_client_hello(SSL *s)
577 {
578 unsigned char *buf;
579 unsigned char *p,*d;
580 int i;
581 unsigned long Time,l;
582#ifndef OPENSSL_NO_COMP
583 int j;
584 SSL_COMP *comp;
585#endif
586
587 buf=(unsigned char *)s->init_buf->data;
588 if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
589 {
590 SSL_SESSION *sess = s->session;
591 if ((sess == NULL) ||
592 (sess->ssl_version != s->version) ||
593#ifdef OPENSSL_NO_TLSEXT
594 !sess->session_id_length ||
595#else
596 (!sess->session_id_length && !sess->tlsext_tick) ||
597#endif
598 (sess->not_resumable))
599 {
600 if (!ssl_get_new_session(s,0))
601 goto err;
602 }
603 /* else use the pre-loaded session */
604
605 p=s->s3->client_random;
606 Time=(unsigned long)time(NULL); /* Time */
607 l2n(Time,p);
608 if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
609 goto err;
610
611 /* Do the message type and length last */
612 d=p= &(buf[4]);
613
614 *(p++)=s->version>>8;
615 *(p++)=s->version&0xff;
616 s->client_version=s->version;
617
618 /* Random stuff */
619 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
620 p+=SSL3_RANDOM_SIZE;
621
622 /* Session ID */
623 if (s->new_session)
624 i=0;
625 else
626 i=s->session->session_id_length;
627 *(p++)=i;
628 if (i != 0)
629 {
630 if (i > (int)sizeof(s->session->session_id))
631 {
632 SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
633 goto err;
634 }
635 memcpy(p,s->session->session_id,i);
636 p+=i;
637 }
638
639 /* Ciphers supported */
640 i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),0);
641 if (i == 0)
642 {
643 SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);
644 goto err;
645 }
646 s2n(i,p);
647 p+=i;
648
649 /* COMPRESSION */
650#ifdef OPENSSL_NO_COMP
651 *(p++)=1;
652#else
653 if (s->ctx->comp_methods == NULL)
654 j=0;
655 else
656 j=sk_SSL_COMP_num(s->ctx->comp_methods);
657 *(p++)=1+j;
658 for (i=0; i<j; i++)
659 {
660 comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
661 *(p++)=comp->id;
662 }
663#endif
664 *(p++)=0; /* Add the NULL method */
665#ifndef OPENSSL_NO_TLSEXT
666 if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
667 {
668 SSLerr(SSL_F_SSL3_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
669 goto err;
670 }
671#endif
672 l=(p-d);
673 d=buf;
674 *(d++)=SSL3_MT_CLIENT_HELLO;
675 l2n3(l,d);
676
677 s->state=SSL3_ST_CW_CLNT_HELLO_B;
678 /* number of bytes to write */
679 s->init_num=p-buf;
680 s->init_off=0;
681 }
682
683 /* SSL3_ST_CW_CLNT_HELLO_B */
684 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
685err:
686 return(-1);
687 }
688
689int ssl3_get_server_hello(SSL *s)
690 {
691 STACK_OF(SSL_CIPHER) *sk;
692 SSL_CIPHER *c;
693 unsigned char *p,*d;
694 int i,al,ok;
695 unsigned int j;
696 long n;
697#ifndef OPENSSL_NO_COMP
698 SSL_COMP *comp;
699#endif
700
701 n=s->method->ssl_get_message(s,
702 SSL3_ST_CR_SRVR_HELLO_A,
703 SSL3_ST_CR_SRVR_HELLO_B,
704 -1,
705 20000, /* ?? */
706 &ok);
707
708 if (!ok) return((int)n);
709
710 if ( SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
711 {
712 if ( s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST)
713 {
714 if ( s->d1->send_cookie == 0)
715 {
716 s->s3->tmp.reuse_message = 1;
717 return 1;
718 }
719 else /* already sent a cookie */
720 {
721 al=SSL_AD_UNEXPECTED_MESSAGE;
722 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
723 goto f_err;
724 }
725 }
726 }
727
728 if ( s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO)
729 {
730 al=SSL_AD_UNEXPECTED_MESSAGE;
731 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
732 goto f_err;
733 }
734
735 d=p=(unsigned char *)s->init_msg;
736
737 if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
738 {
739 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION);
740 s->version=(s->version&0xff00)|p[1];
741 al=SSL_AD_PROTOCOL_VERSION;
742 goto f_err;
743 }
744 p+=2;
745
746 /* load the server hello data */
747 /* load the server random */
748 memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE);
749 p+=SSL3_RANDOM_SIZE;
750
751 /* get the session-id */
752 j= *(p++);
753
754 if ((j > sizeof s->session->session_id) || (j > SSL3_SESSION_ID_SIZE))
755 {
756 al=SSL_AD_ILLEGAL_PARAMETER;
757 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_LONG);
758 goto f_err;
759 }
760
761 if (j != 0 && j == s->session->session_id_length
762 && memcmp(p,s->session->session_id,j) == 0)
763 {
764 if(s->sid_ctx_length != s->session->sid_ctx_length
765 || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
766 {
767 /* actually a client application bug */
768 al=SSL_AD_ILLEGAL_PARAMETER;
769 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
770 goto f_err;
771 }
772 s->hit=1;
773 }
774 else /* a miss or crap from the other end */
775 {
776 /* If we were trying for session-id reuse, make a new
777 * SSL_SESSION so we don't stuff up other people */
778 s->hit=0;
779 if (s->session->session_id_length > 0)
780 {
781 if (!ssl_get_new_session(s,0))
782 {
783 al=SSL_AD_INTERNAL_ERROR;
784 goto f_err;
785 }
786 }
787 s->session->session_id_length=j;
788 memcpy(s->session->session_id,p,j); /* j could be 0 */
789 }
790 p+=j;
791 c=ssl_get_cipher_by_char(s,p);
792 if (c == NULL)
793 {
794 /* unknown cipher */
795 al=SSL_AD_ILLEGAL_PARAMETER;
796 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED);
797 goto f_err;
798 }
799 p+=ssl_put_cipher_by_char(s,NULL,NULL);
800
801 sk=ssl_get_ciphers_by_id(s);
802 i=sk_SSL_CIPHER_find(sk,c);
803 if (i < 0)
804 {
805 /* we did not say we would use this cipher */
806 al=SSL_AD_ILLEGAL_PARAMETER;
807 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED);
808 goto f_err;
809 }
810
811 /* Depending on the session caching (internal/external), the cipher
812 and/or cipher_id values may not be set. Make sure that
813 cipher_id is set and use it for comparison. */
814 if (s->session->cipher)
815 s->session->cipher_id = s->session->cipher->id;
816 if (s->hit && (s->session->cipher_id != c->id))
817 {
818 if (!(s->options &
819 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
820 {
821 al=SSL_AD_ILLEGAL_PARAMETER;
822 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
823 goto f_err;
824 }
825 }
826 s->s3->tmp.new_cipher=c;
827
828 /* lets get the compression algorithm */
829 /* COMPRESSION */
830#ifdef OPENSSL_NO_COMP
831 if (*(p++) != 0)
832 {
833 al=SSL_AD_ILLEGAL_PARAMETER;
834 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
835 goto f_err;
836 }
837#else
838 j= *(p++);
839 if (j == 0)
840 comp=NULL;
841 else
842 comp=ssl3_comp_find(s->ctx->comp_methods,j);
843
844 if ((j != 0) && (comp == NULL))
845 {
846 al=SSL_AD_ILLEGAL_PARAMETER;
847 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
848 goto f_err;
849 }
850 else
851 {
852 s->s3->tmp.new_compression=comp;
853 }
854#endif
855#ifndef OPENSSL_NO_TLSEXT
856 /* TLS extensions*/
857 if (s->version >= SSL3_VERSION)
858 {
859 if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))
860 {
861 /* 'al' set by ssl_parse_serverhello_tlsext */
862 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_PARSE_TLSEXT);
863 goto f_err;
864 }
865 if (ssl_check_serverhello_tlsext(s) <= 0)
866 {
867 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);
868 goto err;
869 }
870 }
871#endif
872
873
874 if (p != (d+n))
875 {
876 /* wrong packet length */
877 al=SSL_AD_DECODE_ERROR;
878 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH);
879 goto err;
880 }
881
882 return(1);
883f_err:
884 ssl3_send_alert(s,SSL3_AL_FATAL,al);
885err:
886 return(-1);
887 }
888
889int ssl3_get_server_certificate(SSL *s)
890 {
891 int al,i,ok,ret= -1;
892 unsigned long n,nc,llen,l;
893 X509 *x=NULL;
894 const unsigned char *q,*p;
895 unsigned char *d;
896 STACK_OF(X509) *sk=NULL;
897 SESS_CERT *sc;
898 EVP_PKEY *pkey=NULL;
899 int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
900
901 n=s->method->ssl_get_message(s,
902 SSL3_ST_CR_CERT_A,
903 SSL3_ST_CR_CERT_B,
904 -1,
905 s->max_cert_list,
906 &ok);
907
908 if (!ok) return((int)n);
909
910 if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
911 ((s->s3->tmp.new_cipher->algorithms & SSL_aKRB5) &&
912 (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)))
913 {
914 s->s3->tmp.reuse_message=1;
915 return(1);
916 }
917
918 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
919 {
920 al=SSL_AD_UNEXPECTED_MESSAGE;
921 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
922 goto f_err;
923 }
924 p=d=(unsigned char *)s->init_msg;
925
926 if ((sk=sk_X509_new_null()) == NULL)
927 {
928 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
929 goto err;
930 }
931
932 n2l3(p,llen);
933 if (llen+3 != n)
934 {
935 al=SSL_AD_DECODE_ERROR;
936 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
937 goto f_err;
938 }
939 for (nc=0; nc<llen; )
940 {
941 n2l3(p,l);
942 if ((l+nc+3) > llen)
943 {
944 al=SSL_AD_DECODE_ERROR;
945 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
946 goto f_err;
947 }
948
949 q=p;
950 x=d2i_X509(NULL,&q,l);
951 if (x == NULL)
952 {
953 al=SSL_AD_BAD_CERTIFICATE;
954 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);
955 goto f_err;
956 }
957 if (q != (p+l))
958 {
959 al=SSL_AD_DECODE_ERROR;
960 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
961 goto f_err;
962 }
963 if (!sk_X509_push(sk,x))
964 {
965 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
966 goto err;
967 }
968 x=NULL;
969 nc+=l+3;
970 p=q;
971 }
972
973 i=ssl_verify_cert_chain(s,sk);
974 if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
975#ifndef OPENSSL_NO_KRB5
976 && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
977 != (SSL_aKRB5|SSL_kKRB5)
978#endif /* OPENSSL_NO_KRB5 */
979 )
980 {
981 al=ssl_verify_alarm_type(s->verify_result);
982 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
983 goto f_err;
984 }
985 ERR_clear_error(); /* but we keep s->verify_result */
986
987 sc=ssl_sess_cert_new();
988 if (sc == NULL) goto err;
989
990 if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
991 s->session->sess_cert=sc;
992
993 sc->cert_chain=sk;
994 /* Inconsistency alert: cert_chain does include the peer's
995 * certificate, which we don't include in s3_srvr.c */
996 x=sk_X509_value(sk,0);
997 sk=NULL;
998 /* VRS 19990621: possible memory leak; sk=null ==> !sk_pop_free() @end*/
999
1000 pkey=X509_get_pubkey(x);
1001
1002 /* VRS: allow null cert if auth == KRB5 */
1003 need_cert = ((s->s3->tmp.new_cipher->algorithms
1004 & (SSL_MKEY_MASK|SSL_AUTH_MASK))
1005 == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
1006
1007#ifdef KSSL_DEBUG
1008 printf("pkey,x = %p, %p\n", (void *)pkey,(void *)x);
1009 printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
1010 printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
1011 s->s3->tmp.new_cipher->algorithms, need_cert);
1012#endif /* KSSL_DEBUG */
1013
1014 if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
1015 {
1016 x=NULL;
1017 al=SSL3_AL_FATAL;
1018 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
1019 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
1020 goto f_err;
1021 }
1022
1023 i=ssl_cert_type(x,pkey);
1024 if (need_cert && i < 0)
1025 {
1026 x=NULL;
1027 al=SSL3_AL_FATAL;
1028 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
1029 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1030 goto f_err;
1031 }
1032
1033 if (need_cert)
1034 {
1035 sc->peer_cert_type=i;
1036 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
1037 /* Why would the following ever happen?
1038 * We just created sc a couple of lines ago. */
1039 if (sc->peer_pkeys[i].x509 != NULL)
1040 X509_free(sc->peer_pkeys[i].x509);
1041 sc->peer_pkeys[i].x509=x;
1042 sc->peer_key= &(sc->peer_pkeys[i]);
1043
1044 if (s->session->peer != NULL)
1045 X509_free(s->session->peer);
1046 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
1047 s->session->peer=x;
1048 }
1049 else
1050 {
1051 sc->peer_cert_type=i;
1052 sc->peer_key= NULL;
1053
1054 if (s->session->peer != NULL)
1055 X509_free(s->session->peer);
1056 s->session->peer=NULL;
1057 }
1058 s->session->verify_result = s->verify_result;
1059
1060 x=NULL;
1061 ret=1;
1062
1063 if (0)
1064 {
1065f_err:
1066 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1067 }
1068err:
1069 EVP_PKEY_free(pkey);
1070 X509_free(x);
1071 sk_X509_pop_free(sk,X509_free);
1072 return(ret);
1073 }
1074
1075int ssl3_get_key_exchange(SSL *s)
1076 {
1077#ifndef OPENSSL_NO_RSA
1078 unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
1079#endif
1080 EVP_MD_CTX md_ctx;
1081 unsigned char *param,*p;
1082 int al,i,j,param_len,ok;
1083 long n,alg;
1084 EVP_PKEY *pkey=NULL;
1085#ifndef OPENSSL_NO_RSA
1086 RSA *rsa=NULL;
1087#endif
1088#ifndef OPENSSL_NO_DH
1089 DH *dh=NULL;
1090#endif
1091#ifndef OPENSSL_NO_ECDH
1092 EC_KEY *ecdh = NULL;
1093 BN_CTX *bn_ctx = NULL;
1094 EC_POINT *srvr_ecpoint = NULL;
1095 int curve_nid = 0;
1096 int encoded_pt_len = 0;
1097#endif
1098
1099 /* use same message size as in ssl3_get_certificate_request()
1100 * as ServerKeyExchange message may be skipped */
1101 n=s->method->ssl_get_message(s,
1102 SSL3_ST_CR_KEY_EXCH_A,
1103 SSL3_ST_CR_KEY_EXCH_B,
1104 -1,
1105 s->max_cert_list,
1106 &ok);
1107
1108 if (!ok) return((int)n);
1109
1110 if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
1111 {
1112 s->s3->tmp.reuse_message=1;
1113 return(1);
1114 }
1115
1116 param=p=(unsigned char *)s->init_msg;
1117
1118 if (s->session->sess_cert != NULL)
1119 {
1120#ifndef OPENSSL_NO_RSA
1121 if (s->session->sess_cert->peer_rsa_tmp != NULL)
1122 {
1123 RSA_free(s->session->sess_cert->peer_rsa_tmp);
1124 s->session->sess_cert->peer_rsa_tmp=NULL;
1125 }
1126#endif
1127#ifndef OPENSSL_NO_DH
1128 if (s->session->sess_cert->peer_dh_tmp)
1129 {
1130 DH_free(s->session->sess_cert->peer_dh_tmp);
1131 s->session->sess_cert->peer_dh_tmp=NULL;
1132 }
1133#endif
1134#ifndef OPENSSL_NO_ECDH
1135 if (s->session->sess_cert->peer_ecdh_tmp)
1136 {
1137 EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
1138 s->session->sess_cert->peer_ecdh_tmp=NULL;
1139 }
1140#endif
1141 }
1142 else
1143 {
1144 s->session->sess_cert=ssl_sess_cert_new();
1145 }
1146
1147 param_len=0;
1148 alg=s->s3->tmp.new_cipher->algorithms;
1149 EVP_MD_CTX_init(&md_ctx);
1150
1151#ifndef OPENSSL_NO_RSA
1152 if (alg & SSL_kRSA)
1153 {
1154 if ((rsa=RSA_new()) == NULL)
1155 {
1156 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
1157 goto err;
1158 }
1159 n2s(p,i);
1160 param_len=i+2;
1161 if (param_len > n)
1162 {
1163 al=SSL_AD_DECODE_ERROR;
1164 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH);
1165 goto f_err;
1166 }
1167 if (!(rsa->n=BN_bin2bn(p,i,rsa->n)))
1168 {
1169 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1170 goto err;
1171 }
1172 p+=i;
1173
1174 n2s(p,i);
1175 param_len+=i+2;
1176 if (param_len > n)
1177 {
1178 al=SSL_AD_DECODE_ERROR;
1179 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH);
1180 goto f_err;
1181 }
1182 if (!(rsa->e=BN_bin2bn(p,i,rsa->e)))
1183 {
1184 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1185 goto err;
1186 }
1187 p+=i;
1188 n-=param_len;
1189
1190 /* this should be because we are using an export cipher */
1191 if (alg & SSL_aRSA)
1192 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1193 else
1194 {
1195 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1196 goto err;
1197 }
1198 s->session->sess_cert->peer_rsa_tmp=rsa;
1199 rsa=NULL;
1200 }
1201#else /* OPENSSL_NO_RSA */
1202 if (0)
1203 ;
1204#endif
1205#ifndef OPENSSL_NO_DH
1206 else if (alg & SSL_kEDH)
1207 {
1208 if ((dh=DH_new()) == NULL)
1209 {
1210 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB);
1211 goto err;
1212 }
1213 n2s(p,i);
1214 param_len=i+2;
1215 if (param_len > n)
1216 {
1217 al=SSL_AD_DECODE_ERROR;
1218 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH);
1219 goto f_err;
1220 }
1221 if (!(dh->p=BN_bin2bn(p,i,NULL)))
1222 {
1223 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1224 goto err;
1225 }
1226 p+=i;
1227
1228 n2s(p,i);
1229 param_len+=i+2;
1230 if (param_len > n)
1231 {
1232 al=SSL_AD_DECODE_ERROR;
1233 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH);
1234 goto f_err;
1235 }
1236 if (!(dh->g=BN_bin2bn(p,i,NULL)))
1237 {
1238 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1239 goto err;
1240 }
1241 p+=i;
1242
1243 n2s(p,i);
1244 param_len+=i+2;
1245 if (param_len > n)
1246 {
1247 al=SSL_AD_DECODE_ERROR;
1248 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH);
1249 goto f_err;
1250 }
1251 if (!(dh->pub_key=BN_bin2bn(p,i,NULL)))
1252 {
1253 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1254 goto err;
1255 }
1256 p+=i;
1257 n-=param_len;
1258
1259#ifndef OPENSSL_NO_RSA
1260 if (alg & SSL_aRSA)
1261 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1262#else
1263 if (0)
1264 ;
1265#endif
1266#ifndef OPENSSL_NO_DSA
1267 else if (alg & SSL_aDSS)
1268 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509);
1269#endif
1270 /* else anonymous DH, so no certificate or pkey. */
1271
1272 s->session->sess_cert->peer_dh_tmp=dh;
1273 dh=NULL;
1274 }
1275 else if ((alg & SSL_kDHr) || (alg & SSL_kDHd))
1276 {
1277 al=SSL_AD_ILLEGAL_PARAMETER;
1278 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1279 goto f_err;
1280 }
1281#endif /* !OPENSSL_NO_DH */
1282
1283#ifndef OPENSSL_NO_ECDH
1284 else if (alg & SSL_kECDHE)
1285 {
1286 EC_GROUP *ngroup;
1287 const EC_GROUP *group;
1288
1289 if ((ecdh=EC_KEY_new()) == NULL)
1290 {
1291 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
1292 goto err;
1293 }
1294
1295 /* Extract elliptic curve parameters and the
1296 * server's ephemeral ECDH public key.
1297 * Keep accumulating lengths of various components in
1298 * param_len and make sure it never exceeds n.
1299 */
1300
1301 /* XXX: For now we only support named (not generic) curves
1302 * and the ECParameters in this case is just three bytes.
1303 */
1304 param_len=3;
1305 if ((param_len > n) ||
1306 (*p != NAMED_CURVE_TYPE) ||
1307 ((curve_nid = curve_id2nid(*(p + 2))) == 0))
1308 {
1309 al=SSL_AD_INTERNAL_ERROR;
1310 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
1311 goto f_err;
1312 }
1313
1314 ngroup = EC_GROUP_new_by_curve_name(curve_nid);
1315 if (ngroup == NULL)
1316 {
1317 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
1318 goto err;
1319 }
1320 if (EC_KEY_set_group(ecdh, ngroup) == 0)
1321 {
1322 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
1323 goto err;
1324 }
1325 EC_GROUP_free(ngroup);
1326
1327 group = EC_KEY_get0_group(ecdh);
1328
1329 if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
1330 (EC_GROUP_get_degree(group) > 163))
1331 {
1332 al=SSL_AD_EXPORT_RESTRICTION;
1333 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
1334 goto f_err;
1335 }
1336
1337 p+=3;
1338
1339 /* Next, get the encoded ECPoint */
1340 if (((srvr_ecpoint = EC_POINT_new(group)) == NULL) ||
1341 ((bn_ctx = BN_CTX_new()) == NULL))
1342 {
1343 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
1344 goto err;
1345 }
1346
1347 encoded_pt_len = *p; /* length of encoded point */
1348 p+=1;
1349 param_len += (1 + encoded_pt_len);
1350 if ((param_len > n) ||
1351 (EC_POINT_oct2point(group, srvr_ecpoint,
1352 p, encoded_pt_len, bn_ctx) == 0))
1353 {
1354 al=SSL_AD_DECODE_ERROR;
1355 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT);
1356 goto f_err;
1357 }
1358
1359 n-=param_len;
1360 p+=encoded_pt_len;
1361
1362 /* The ECC/TLS specification does not mention
1363 * the use of DSA to sign ECParameters in the server
1364 * key exchange message. We do support RSA and ECDSA.
1365 */
1366 if (0) ;
1367#ifndef OPENSSL_NO_RSA
1368 else if (alg & SSL_aRSA)
1369 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1370#endif
1371#ifndef OPENSSL_NO_ECDSA
1372 else if (alg & SSL_aECDSA)
1373 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
1374#endif
1375 /* else anonymous ECDH, so no certificate or pkey. */
1376 EC_KEY_set_public_key(ecdh, srvr_ecpoint);
1377 s->session->sess_cert->peer_ecdh_tmp=ecdh;
1378 ecdh=NULL;
1379 BN_CTX_free(bn_ctx);
| 1/* ssl/s3_clnt.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58/* ====================================================================
59 * Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
111/* ====================================================================
112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113 *
114 * Portions of the attached software ("Contribution") are developed by
115 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
116 *
117 * The Contribution is licensed pursuant to the OpenSSL open source
118 * license provided above.
119 *
120 * ECC cipher suite support in OpenSSL originally written by
121 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
122 *
123 */
124
125#include <stdio.h>
126#include "ssl_locl.h"
127#include "kssl_lcl.h"
128#include <openssl/buffer.h>
129#include <openssl/rand.h>
130#include <openssl/objects.h>
131#include <openssl/evp.h>
132#include <openssl/md5.h>
133#ifdef OPENSSL_FIPS
134#include <openssl/fips.h>
135#endif
136
137#ifndef OPENSSL_NO_DH
138#include <openssl/dh.h>
139#endif
140#include <openssl/bn.h>
141#ifndef OPENSSL_NO_ENGINE
142#include <openssl/engine.h>
143#endif
144
145static SSL_METHOD *ssl3_get_client_method(int ver);
146static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
147
148#ifndef OPENSSL_NO_ECDH
149static int curve_id2nid(int curve_id);
150int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
151#endif
152
153static SSL_METHOD *ssl3_get_client_method(int ver)
154 {
155 if (ver == SSL3_VERSION)
156 return(SSLv3_client_method());
157 else
158 return(NULL);
159 }
160
161IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
162 ssl_undefined_function,
163 ssl3_connect,
164 ssl3_get_client_method)
165
166int ssl3_connect(SSL *s)
167 {
168 BUF_MEM *buf=NULL;
169 unsigned long Time=(unsigned long)time(NULL),l;
170 void (*cb)(const SSL *ssl,int type,int val)=NULL;
171 int ret= -1;
172 int new_state,state,skip=0;
173
174 RAND_add(&Time,sizeof(Time),0);
175 ERR_clear_error();
176 clear_sys_error();
177
178 if (s->info_callback != NULL)
179 cb=s->info_callback;
180 else if (s->ctx->info_callback != NULL)
181 cb=s->ctx->info_callback;
182
183 s->in_handshake++;
184 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
185
186 for (;;)
187 {
188 state=s->state;
189
190 switch(s->state)
191 {
192 case SSL_ST_RENEGOTIATE:
193 s->new_session=1;
194 s->state=SSL_ST_CONNECT;
195 s->ctx->stats.sess_connect_renegotiate++;
196 /* break */
197 case SSL_ST_BEFORE:
198 case SSL_ST_CONNECT:
199 case SSL_ST_BEFORE|SSL_ST_CONNECT:
200 case SSL_ST_OK|SSL_ST_CONNECT:
201
202 s->server=0;
203 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
204
205 if ((s->version & 0xff00 ) != 0x0300)
206 {
207 SSLerr(SSL_F_SSL3_CONNECT, ERR_R_INTERNAL_ERROR);
208 ret = -1;
209 goto end;
210 }
211
212 /* s->version=SSL3_VERSION; */
213 s->type=SSL_ST_CONNECT;
214
215 if (s->init_buf == NULL)
216 {
217 if ((buf=BUF_MEM_new()) == NULL)
218 {
219 ret= -1;
220 goto end;
221 }
222 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
223 {
224 ret= -1;
225 goto end;
226 }
227 s->init_buf=buf;
228 buf=NULL;
229 }
230
231 if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
232
233 /* setup buffing BIO */
234 if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
235
236 /* don't push the buffering BIO quite yet */
237
238 ssl3_init_finished_mac(s);
239
240 s->state=SSL3_ST_CW_CLNT_HELLO_A;
241 s->ctx->stats.sess_connect++;
242 s->init_num=0;
243 break;
244
245 case SSL3_ST_CW_CLNT_HELLO_A:
246 case SSL3_ST_CW_CLNT_HELLO_B:
247
248 s->shutdown=0;
249 ret=ssl3_client_hello(s);
250 if (ret <= 0) goto end;
251 s->state=SSL3_ST_CR_SRVR_HELLO_A;
252 s->init_num=0;
253
254 /* turn on buffering for the next lot of output */
255 if (s->bbio != s->wbio)
256 s->wbio=BIO_push(s->bbio,s->wbio);
257
258 break;
259
260 case SSL3_ST_CR_SRVR_HELLO_A:
261 case SSL3_ST_CR_SRVR_HELLO_B:
262 ret=ssl3_get_server_hello(s);
263 if (ret <= 0) goto end;
264 if (s->hit)
265 s->state=SSL3_ST_CR_FINISHED_A;
266 else
267 s->state=SSL3_ST_CR_CERT_A;
268 s->init_num=0;
269 break;
270
271 case SSL3_ST_CR_CERT_A:
272 case SSL3_ST_CR_CERT_B:
273#ifndef OPENSSL_NO_TLSEXT
274 ret=ssl3_check_finished(s);
275 if (ret <= 0) goto end;
276 if (ret == 2)
277 {
278 s->hit = 1;
279 if (s->tlsext_ticket_expected)
280 s->state=SSL3_ST_CR_SESSION_TICKET_A;
281 else
282 s->state=SSL3_ST_CR_FINISHED_A;
283 s->init_num=0;
284 break;
285 }
286#endif
287 /* Check if it is anon DH/ECDH */
288 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
289 {
290 ret=ssl3_get_server_certificate(s);
291 if (ret <= 0) goto end;
292#ifndef OPENSSL_NO_TLSEXT
293 if (s->tlsext_status_expected)
294 s->state=SSL3_ST_CR_CERT_STATUS_A;
295 else
296 s->state=SSL3_ST_CR_KEY_EXCH_A;
297 }
298 else
299 {
300 skip = 1;
301 s->state=SSL3_ST_CR_KEY_EXCH_A;
302 }
303#else
304 }
305 else
306 skip=1;
307
308 s->state=SSL3_ST_CR_KEY_EXCH_A;
309#endif
310 s->init_num=0;
311 break;
312
313 case SSL3_ST_CR_KEY_EXCH_A:
314 case SSL3_ST_CR_KEY_EXCH_B:
315 ret=ssl3_get_key_exchange(s);
316 if (ret <= 0) goto end;
317 s->state=SSL3_ST_CR_CERT_REQ_A;
318 s->init_num=0;
319
320 /* at this point we check that we have the
321 * required stuff from the server */
322 if (!ssl3_check_cert_and_algorithm(s))
323 {
324 ret= -1;
325 goto end;
326 }
327 break;
328
329 case SSL3_ST_CR_CERT_REQ_A:
330 case SSL3_ST_CR_CERT_REQ_B:
331 ret=ssl3_get_certificate_request(s);
332 if (ret <= 0) goto end;
333 s->state=SSL3_ST_CR_SRVR_DONE_A;
334 s->init_num=0;
335 break;
336
337 case SSL3_ST_CR_SRVR_DONE_A:
338 case SSL3_ST_CR_SRVR_DONE_B:
339 ret=ssl3_get_server_done(s);
340 if (ret <= 0) goto end;
341 if (s->s3->tmp.cert_req)
342 s->state=SSL3_ST_CW_CERT_A;
343 else
344 s->state=SSL3_ST_CW_KEY_EXCH_A;
345 s->init_num=0;
346
347 break;
348
349 case SSL3_ST_CW_CERT_A:
350 case SSL3_ST_CW_CERT_B:
351 case SSL3_ST_CW_CERT_C:
352 case SSL3_ST_CW_CERT_D:
353 ret=ssl3_send_client_certificate(s);
354 if (ret <= 0) goto end;
355 s->state=SSL3_ST_CW_KEY_EXCH_A;
356 s->init_num=0;
357 break;
358
359 case SSL3_ST_CW_KEY_EXCH_A:
360 case SSL3_ST_CW_KEY_EXCH_B:
361 ret=ssl3_send_client_key_exchange(s);
362 if (ret <= 0) goto end;
363 l=s->s3->tmp.new_cipher->algorithms;
364 /* EAY EAY EAY need to check for DH fix cert
365 * sent back */
366 /* For TLS, cert_req is set to 2, so a cert chain
367 * of nothing is sent, but no verify packet is sent */
368 /* XXX: For now, we do not support client
369 * authentication in ECDH cipher suites with
370 * ECDH (rather than ECDSA) certificates.
371 * We need to skip the certificate verify
372 * message when client's ECDH public key is sent
373 * inside the client certificate.
374 */
375 if (s->s3->tmp.cert_req == 1)
376 {
377 s->state=SSL3_ST_CW_CERT_VRFY_A;
378 }
379 else
380 {
381 s->state=SSL3_ST_CW_CHANGE_A;
382 s->s3->change_cipher_spec=0;
383 }
384
385 s->init_num=0;
386 break;
387
388 case SSL3_ST_CW_CERT_VRFY_A:
389 case SSL3_ST_CW_CERT_VRFY_B:
390 ret=ssl3_send_client_verify(s);
391 if (ret <= 0) goto end;
392 s->state=SSL3_ST_CW_CHANGE_A;
393 s->init_num=0;
394 s->s3->change_cipher_spec=0;
395 break;
396
397 case SSL3_ST_CW_CHANGE_A:
398 case SSL3_ST_CW_CHANGE_B:
399 ret=ssl3_send_change_cipher_spec(s,
400 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
401 if (ret <= 0) goto end;
402 s->state=SSL3_ST_CW_FINISHED_A;
403 s->init_num=0;
404
405 s->session->cipher=s->s3->tmp.new_cipher;
406#ifdef OPENSSL_NO_COMP
407 s->session->compress_meth=0;
408#else
409 if (s->s3->tmp.new_compression == NULL)
410 s->session->compress_meth=0;
411 else
412 s->session->compress_meth=
413 s->s3->tmp.new_compression->id;
414#endif
415 if (!s->method->ssl3_enc->setup_key_block(s))
416 {
417 ret= -1;
418 goto end;
419 }
420
421 if (!s->method->ssl3_enc->change_cipher_state(s,
422 SSL3_CHANGE_CIPHER_CLIENT_WRITE))
423 {
424 ret= -1;
425 goto end;
426 }
427
428 break;
429
430 case SSL3_ST_CW_FINISHED_A:
431 case SSL3_ST_CW_FINISHED_B:
432 ret=ssl3_send_finished(s,
433 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
434 s->method->ssl3_enc->client_finished_label,
435 s->method->ssl3_enc->client_finished_label_len);
436 if (ret <= 0) goto end;
437 s->state=SSL3_ST_CW_FLUSH;
438
439 /* clear flags */
440 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
441 if (s->hit)
442 {
443 s->s3->tmp.next_state=SSL_ST_OK;
444 if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED)
445 {
446 s->state=SSL_ST_OK;
447 s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
448 s->s3->delay_buf_pop_ret=0;
449 }
450 }
451 else
452 {
453#ifndef OPENSSL_NO_TLSEXT
454 /* Allow NewSessionTicket if ticket expected */
455 if (s->tlsext_ticket_expected)
456 s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
457 else
458#endif
459
460 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
461 }
462 s->init_num=0;
463 break;
464
465#ifndef OPENSSL_NO_TLSEXT
466 case SSL3_ST_CR_SESSION_TICKET_A:
467 case SSL3_ST_CR_SESSION_TICKET_B:
468 ret=ssl3_get_new_session_ticket(s);
469 if (ret <= 0) goto end;
470 s->state=SSL3_ST_CR_FINISHED_A;
471 s->init_num=0;
472 break;
473
474 case SSL3_ST_CR_CERT_STATUS_A:
475 case SSL3_ST_CR_CERT_STATUS_B:
476 ret=ssl3_get_cert_status(s);
477 if (ret <= 0) goto end;
478 s->state=SSL3_ST_CR_KEY_EXCH_A;
479 s->init_num=0;
480 break;
481#endif
482
483 case SSL3_ST_CR_FINISHED_A:
484 case SSL3_ST_CR_FINISHED_B:
485
486 ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
487 SSL3_ST_CR_FINISHED_B);
488 if (ret <= 0) goto end;
489
490 if (s->hit)
491 s->state=SSL3_ST_CW_CHANGE_A;
492 else
493 s->state=SSL_ST_OK;
494 s->init_num=0;
495 break;
496
497 case SSL3_ST_CW_FLUSH:
498 s->rwstate=SSL_WRITING;
499 if (BIO_flush(s->wbio) <= 0)
500 {
501 ret= -1;
502 goto end;
503 }
504 s->rwstate=SSL_NOTHING;
505 s->state=s->s3->tmp.next_state;
506 break;
507
508 case SSL_ST_OK:
509 /* clean a few things up */
510 ssl3_cleanup_key_block(s);
511
512 if (s->init_buf != NULL)
513 {
514 BUF_MEM_free(s->init_buf);
515 s->init_buf=NULL;
516 }
517
518 /* If we are not 'joining' the last two packets,
519 * remove the buffering now */
520 if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
521 ssl_free_wbio_buffer(s);
522 /* else do it later in ssl3_write */
523
524 s->init_num=0;
525 s->new_session=0;
526
527 ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
528 if (s->hit) s->ctx->stats.sess_hit++;
529
530 ret=1;
531 /* s->server=0; */
532 s->handshake_func=ssl3_connect;
533 s->ctx->stats.sess_connect_good++;
534
535 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
536
537 goto end;
538 /* break; */
539
540 default:
541 SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE);
542 ret= -1;
543 goto end;
544 /* break; */
545 }
546
547 /* did we do anything */
548 if (!s->s3->tmp.reuse_message && !skip)
549 {
550 if (s->debug)
551 {
552 if ((ret=BIO_flush(s->wbio)) <= 0)
553 goto end;
554 }
555
556 if ((cb != NULL) && (s->state != state))
557 {
558 new_state=s->state;
559 s->state=state;
560 cb(s,SSL_CB_CONNECT_LOOP,1);
561 s->state=new_state;
562 }
563 }
564 skip=0;
565 }
566end:
567 s->in_handshake--;
568 if (buf != NULL)
569 BUF_MEM_free(buf);
570 if (cb != NULL)
571 cb(s,SSL_CB_CONNECT_EXIT,ret);
572 return(ret);
573 }
574
575
576int ssl3_client_hello(SSL *s)
577 {
578 unsigned char *buf;
579 unsigned char *p,*d;
580 int i;
581 unsigned long Time,l;
582#ifndef OPENSSL_NO_COMP
583 int j;
584 SSL_COMP *comp;
585#endif
586
587 buf=(unsigned char *)s->init_buf->data;
588 if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
589 {
590 SSL_SESSION *sess = s->session;
591 if ((sess == NULL) ||
592 (sess->ssl_version != s->version) ||
593#ifdef OPENSSL_NO_TLSEXT
594 !sess->session_id_length ||
595#else
596 (!sess->session_id_length && !sess->tlsext_tick) ||
597#endif
598 (sess->not_resumable))
599 {
600 if (!ssl_get_new_session(s,0))
601 goto err;
602 }
603 /* else use the pre-loaded session */
604
605 p=s->s3->client_random;
606 Time=(unsigned long)time(NULL); /* Time */
607 l2n(Time,p);
608 if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
609 goto err;
610
611 /* Do the message type and length last */
612 d=p= &(buf[4]);
613
614 *(p++)=s->version>>8;
615 *(p++)=s->version&0xff;
616 s->client_version=s->version;
617
618 /* Random stuff */
619 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
620 p+=SSL3_RANDOM_SIZE;
621
622 /* Session ID */
623 if (s->new_session)
624 i=0;
625 else
626 i=s->session->session_id_length;
627 *(p++)=i;
628 if (i != 0)
629 {
630 if (i > (int)sizeof(s->session->session_id))
631 {
632 SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
633 goto err;
634 }
635 memcpy(p,s->session->session_id,i);
636 p+=i;
637 }
638
639 /* Ciphers supported */
640 i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),0);
641 if (i == 0)
642 {
643 SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);
644 goto err;
645 }
646 s2n(i,p);
647 p+=i;
648
649 /* COMPRESSION */
650#ifdef OPENSSL_NO_COMP
651 *(p++)=1;
652#else
653 if (s->ctx->comp_methods == NULL)
654 j=0;
655 else
656 j=sk_SSL_COMP_num(s->ctx->comp_methods);
657 *(p++)=1+j;
658 for (i=0; i<j; i++)
659 {
660 comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
661 *(p++)=comp->id;
662 }
663#endif
664 *(p++)=0; /* Add the NULL method */
665#ifndef OPENSSL_NO_TLSEXT
666 if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
667 {
668 SSLerr(SSL_F_SSL3_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
669 goto err;
670 }
671#endif
672 l=(p-d);
673 d=buf;
674 *(d++)=SSL3_MT_CLIENT_HELLO;
675 l2n3(l,d);
676
677 s->state=SSL3_ST_CW_CLNT_HELLO_B;
678 /* number of bytes to write */
679 s->init_num=p-buf;
680 s->init_off=0;
681 }
682
683 /* SSL3_ST_CW_CLNT_HELLO_B */
684 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
685err:
686 return(-1);
687 }
688
689int ssl3_get_server_hello(SSL *s)
690 {
691 STACK_OF(SSL_CIPHER) *sk;
692 SSL_CIPHER *c;
693 unsigned char *p,*d;
694 int i,al,ok;
695 unsigned int j;
696 long n;
697#ifndef OPENSSL_NO_COMP
698 SSL_COMP *comp;
699#endif
700
701 n=s->method->ssl_get_message(s,
702 SSL3_ST_CR_SRVR_HELLO_A,
703 SSL3_ST_CR_SRVR_HELLO_B,
704 -1,
705 20000, /* ?? */
706 &ok);
707
708 if (!ok) return((int)n);
709
710 if ( SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
711 {
712 if ( s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST)
713 {
714 if ( s->d1->send_cookie == 0)
715 {
716 s->s3->tmp.reuse_message = 1;
717 return 1;
718 }
719 else /* already sent a cookie */
720 {
721 al=SSL_AD_UNEXPECTED_MESSAGE;
722 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
723 goto f_err;
724 }
725 }
726 }
727
728 if ( s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO)
729 {
730 al=SSL_AD_UNEXPECTED_MESSAGE;
731 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
732 goto f_err;
733 }
734
735 d=p=(unsigned char *)s->init_msg;
736
737 if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
738 {
739 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION);
740 s->version=(s->version&0xff00)|p[1];
741 al=SSL_AD_PROTOCOL_VERSION;
742 goto f_err;
743 }
744 p+=2;
745
746 /* load the server hello data */
747 /* load the server random */
748 memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE);
749 p+=SSL3_RANDOM_SIZE;
750
751 /* get the session-id */
752 j= *(p++);
753
754 if ((j > sizeof s->session->session_id) || (j > SSL3_SESSION_ID_SIZE))
755 {
756 al=SSL_AD_ILLEGAL_PARAMETER;
757 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_LONG);
758 goto f_err;
759 }
760
761 if (j != 0 && j == s->session->session_id_length
762 && memcmp(p,s->session->session_id,j) == 0)
763 {
764 if(s->sid_ctx_length != s->session->sid_ctx_length
765 || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
766 {
767 /* actually a client application bug */
768 al=SSL_AD_ILLEGAL_PARAMETER;
769 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
770 goto f_err;
771 }
772 s->hit=1;
773 }
774 else /* a miss or crap from the other end */
775 {
776 /* If we were trying for session-id reuse, make a new
777 * SSL_SESSION so we don't stuff up other people */
778 s->hit=0;
779 if (s->session->session_id_length > 0)
780 {
781 if (!ssl_get_new_session(s,0))
782 {
783 al=SSL_AD_INTERNAL_ERROR;
784 goto f_err;
785 }
786 }
787 s->session->session_id_length=j;
788 memcpy(s->session->session_id,p,j); /* j could be 0 */
789 }
790 p+=j;
791 c=ssl_get_cipher_by_char(s,p);
792 if (c == NULL)
793 {
794 /* unknown cipher */
795 al=SSL_AD_ILLEGAL_PARAMETER;
796 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED);
797 goto f_err;
798 }
799 p+=ssl_put_cipher_by_char(s,NULL,NULL);
800
801 sk=ssl_get_ciphers_by_id(s);
802 i=sk_SSL_CIPHER_find(sk,c);
803 if (i < 0)
804 {
805 /* we did not say we would use this cipher */
806 al=SSL_AD_ILLEGAL_PARAMETER;
807 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED);
808 goto f_err;
809 }
810
811 /* Depending on the session caching (internal/external), the cipher
812 and/or cipher_id values may not be set. Make sure that
813 cipher_id is set and use it for comparison. */
814 if (s->session->cipher)
815 s->session->cipher_id = s->session->cipher->id;
816 if (s->hit && (s->session->cipher_id != c->id))
817 {
818 if (!(s->options &
819 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
820 {
821 al=SSL_AD_ILLEGAL_PARAMETER;
822 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
823 goto f_err;
824 }
825 }
826 s->s3->tmp.new_cipher=c;
827
828 /* lets get the compression algorithm */
829 /* COMPRESSION */
830#ifdef OPENSSL_NO_COMP
831 if (*(p++) != 0)
832 {
833 al=SSL_AD_ILLEGAL_PARAMETER;
834 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
835 goto f_err;
836 }
837#else
838 j= *(p++);
839 if (j == 0)
840 comp=NULL;
841 else
842 comp=ssl3_comp_find(s->ctx->comp_methods,j);
843
844 if ((j != 0) && (comp == NULL))
845 {
846 al=SSL_AD_ILLEGAL_PARAMETER;
847 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
848 goto f_err;
849 }
850 else
851 {
852 s->s3->tmp.new_compression=comp;
853 }
854#endif
855#ifndef OPENSSL_NO_TLSEXT
856 /* TLS extensions*/
857 if (s->version >= SSL3_VERSION)
858 {
859 if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))
860 {
861 /* 'al' set by ssl_parse_serverhello_tlsext */
862 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_PARSE_TLSEXT);
863 goto f_err;
864 }
865 if (ssl_check_serverhello_tlsext(s) <= 0)
866 {
867 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);
868 goto err;
869 }
870 }
871#endif
872
873
874 if (p != (d+n))
875 {
876 /* wrong packet length */
877 al=SSL_AD_DECODE_ERROR;
878 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH);
879 goto err;
880 }
881
882 return(1);
883f_err:
884 ssl3_send_alert(s,SSL3_AL_FATAL,al);
885err:
886 return(-1);
887 }
888
889int ssl3_get_server_certificate(SSL *s)
890 {
891 int al,i,ok,ret= -1;
892 unsigned long n,nc,llen,l;
893 X509 *x=NULL;
894 const unsigned char *q,*p;
895 unsigned char *d;
896 STACK_OF(X509) *sk=NULL;
897 SESS_CERT *sc;
898 EVP_PKEY *pkey=NULL;
899 int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
900
901 n=s->method->ssl_get_message(s,
902 SSL3_ST_CR_CERT_A,
903 SSL3_ST_CR_CERT_B,
904 -1,
905 s->max_cert_list,
906 &ok);
907
908 if (!ok) return((int)n);
909
910 if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
911 ((s->s3->tmp.new_cipher->algorithms & SSL_aKRB5) &&
912 (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)))
913 {
914 s->s3->tmp.reuse_message=1;
915 return(1);
916 }
917
918 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
919 {
920 al=SSL_AD_UNEXPECTED_MESSAGE;
921 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
922 goto f_err;
923 }
924 p=d=(unsigned char *)s->init_msg;
925
926 if ((sk=sk_X509_new_null()) == NULL)
927 {
928 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
929 goto err;
930 }
931
932 n2l3(p,llen);
933 if (llen+3 != n)
934 {
935 al=SSL_AD_DECODE_ERROR;
936 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
937 goto f_err;
938 }
939 for (nc=0; nc<llen; )
940 {
941 n2l3(p,l);
942 if ((l+nc+3) > llen)
943 {
944 al=SSL_AD_DECODE_ERROR;
945 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
946 goto f_err;
947 }
948
949 q=p;
950 x=d2i_X509(NULL,&q,l);
951 if (x == NULL)
952 {
953 al=SSL_AD_BAD_CERTIFICATE;
954 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);
955 goto f_err;
956 }
957 if (q != (p+l))
958 {
959 al=SSL_AD_DECODE_ERROR;
960 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
961 goto f_err;
962 }
963 if (!sk_X509_push(sk,x))
964 {
965 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
966 goto err;
967 }
968 x=NULL;
969 nc+=l+3;
970 p=q;
971 }
972
973 i=ssl_verify_cert_chain(s,sk);
974 if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
975#ifndef OPENSSL_NO_KRB5
976 && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
977 != (SSL_aKRB5|SSL_kKRB5)
978#endif /* OPENSSL_NO_KRB5 */
979 )
980 {
981 al=ssl_verify_alarm_type(s->verify_result);
982 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
983 goto f_err;
984 }
985 ERR_clear_error(); /* but we keep s->verify_result */
986
987 sc=ssl_sess_cert_new();
988 if (sc == NULL) goto err;
989
990 if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
991 s->session->sess_cert=sc;
992
993 sc->cert_chain=sk;
994 /* Inconsistency alert: cert_chain does include the peer's
995 * certificate, which we don't include in s3_srvr.c */
996 x=sk_X509_value(sk,0);
997 sk=NULL;
998 /* VRS 19990621: possible memory leak; sk=null ==> !sk_pop_free() @end*/
999
1000 pkey=X509_get_pubkey(x);
1001
1002 /* VRS: allow null cert if auth == KRB5 */
1003 need_cert = ((s->s3->tmp.new_cipher->algorithms
1004 & (SSL_MKEY_MASK|SSL_AUTH_MASK))
1005 == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
1006
1007#ifdef KSSL_DEBUG
1008 printf("pkey,x = %p, %p\n", (void *)pkey,(void *)x);
1009 printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
1010 printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
1011 s->s3->tmp.new_cipher->algorithms, need_cert);
1012#endif /* KSSL_DEBUG */
1013
1014 if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
1015 {
1016 x=NULL;
1017 al=SSL3_AL_FATAL;
1018 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
1019 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
1020 goto f_err;
1021 }
1022
1023 i=ssl_cert_type(x,pkey);
1024 if (need_cert && i < 0)
1025 {
1026 x=NULL;
1027 al=SSL3_AL_FATAL;
1028 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
1029 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1030 goto f_err;
1031 }
1032
1033 if (need_cert)
1034 {
1035 sc->peer_cert_type=i;
1036 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
1037 /* Why would the following ever happen?
1038 * We just created sc a couple of lines ago. */
1039 if (sc->peer_pkeys[i].x509 != NULL)
1040 X509_free(sc->peer_pkeys[i].x509);
1041 sc->peer_pkeys[i].x509=x;
1042 sc->peer_key= &(sc->peer_pkeys[i]);
1043
1044 if (s->session->peer != NULL)
1045 X509_free(s->session->peer);
1046 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
1047 s->session->peer=x;
1048 }
1049 else
1050 {
1051 sc->peer_cert_type=i;
1052 sc->peer_key= NULL;
1053
1054 if (s->session->peer != NULL)
1055 X509_free(s->session->peer);
1056 s->session->peer=NULL;
1057 }
1058 s->session->verify_result = s->verify_result;
1059
1060 x=NULL;
1061 ret=1;
1062
1063 if (0)
1064 {
1065f_err:
1066 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1067 }
1068err:
1069 EVP_PKEY_free(pkey);
1070 X509_free(x);
1071 sk_X509_pop_free(sk,X509_free);
1072 return(ret);
1073 }
1074
1075int ssl3_get_key_exchange(SSL *s)
1076 {
1077#ifndef OPENSSL_NO_RSA
1078 unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
1079#endif
1080 EVP_MD_CTX md_ctx;
1081 unsigned char *param,*p;
1082 int al,i,j,param_len,ok;
1083 long n,alg;
1084 EVP_PKEY *pkey=NULL;
1085#ifndef OPENSSL_NO_RSA
1086 RSA *rsa=NULL;
1087#endif
1088#ifndef OPENSSL_NO_DH
1089 DH *dh=NULL;
1090#endif
1091#ifndef OPENSSL_NO_ECDH
1092 EC_KEY *ecdh = NULL;
1093 BN_CTX *bn_ctx = NULL;
1094 EC_POINT *srvr_ecpoint = NULL;
1095 int curve_nid = 0;
1096 int encoded_pt_len = 0;
1097#endif
1098
1099 /* use same message size as in ssl3_get_certificate_request()
1100 * as ServerKeyExchange message may be skipped */
1101 n=s->method->ssl_get_message(s,
1102 SSL3_ST_CR_KEY_EXCH_A,
1103 SSL3_ST_CR_KEY_EXCH_B,
1104 -1,
1105 s->max_cert_list,
1106 &ok);
1107
1108 if (!ok) return((int)n);
1109
1110 if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
1111 {
1112 s->s3->tmp.reuse_message=1;
1113 return(1);
1114 }
1115
1116 param=p=(unsigned char *)s->init_msg;
1117
1118 if (s->session->sess_cert != NULL)
1119 {
1120#ifndef OPENSSL_NO_RSA
1121 if (s->session->sess_cert->peer_rsa_tmp != NULL)
1122 {
1123 RSA_free(s->session->sess_cert->peer_rsa_tmp);
1124 s->session->sess_cert->peer_rsa_tmp=NULL;
1125 }
1126#endif
1127#ifndef OPENSSL_NO_DH
1128 if (s->session->sess_cert->peer_dh_tmp)
1129 {
1130 DH_free(s->session->sess_cert->peer_dh_tmp);
1131 s->session->sess_cert->peer_dh_tmp=NULL;
1132 }
1133#endif
1134#ifndef OPENSSL_NO_ECDH
1135 if (s->session->sess_cert->peer_ecdh_tmp)
1136 {
1137 EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
1138 s->session->sess_cert->peer_ecdh_tmp=NULL;
1139 }
1140#endif
1141 }
1142 else
1143 {
1144 s->session->sess_cert=ssl_sess_cert_new();
1145 }
1146
1147 param_len=0;
1148 alg=s->s3->tmp.new_cipher->algorithms;
1149 EVP_MD_CTX_init(&md_ctx);
1150
1151#ifndef OPENSSL_NO_RSA
1152 if (alg & SSL_kRSA)
1153 {
1154 if ((rsa=RSA_new()) == NULL)
1155 {
1156 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
1157 goto err;
1158 }
1159 n2s(p,i);
1160 param_len=i+2;
1161 if (param_len > n)
1162 {
1163 al=SSL_AD_DECODE_ERROR;
1164 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH);
1165 goto f_err;
1166 }
1167 if (!(rsa->n=BN_bin2bn(p,i,rsa->n)))
1168 {
1169 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1170 goto err;
1171 }
1172 p+=i;
1173
1174 n2s(p,i);
1175 param_len+=i+2;
1176 if (param_len > n)
1177 {
1178 al=SSL_AD_DECODE_ERROR;
1179 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH);
1180 goto f_err;
1181 }
1182 if (!(rsa->e=BN_bin2bn(p,i,rsa->e)))
1183 {
1184 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1185 goto err;
1186 }
1187 p+=i;
1188 n-=param_len;
1189
1190 /* this should be because we are using an export cipher */
1191 if (alg & SSL_aRSA)
1192 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1193 else
1194 {
1195 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1196 goto err;
1197 }
1198 s->session->sess_cert->peer_rsa_tmp=rsa;
1199 rsa=NULL;
1200 }
1201#else /* OPENSSL_NO_RSA */
1202 if (0)
1203 ;
1204#endif
1205#ifndef OPENSSL_NO_DH
1206 else if (alg & SSL_kEDH)
1207 {
1208 if ((dh=DH_new()) == NULL)
1209 {
1210 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB);
1211 goto err;
1212 }
1213 n2s(p,i);
1214 param_len=i+2;
1215 if (param_len > n)
1216 {
1217 al=SSL_AD_DECODE_ERROR;
1218 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH);
1219 goto f_err;
1220 }
1221 if (!(dh->p=BN_bin2bn(p,i,NULL)))
1222 {
1223 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1224 goto err;
1225 }
1226 p+=i;
1227
1228 n2s(p,i);
1229 param_len+=i+2;
1230 if (param_len > n)
1231 {
1232 al=SSL_AD_DECODE_ERROR;
1233 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH);
1234 goto f_err;
1235 }
1236 if (!(dh->g=BN_bin2bn(p,i,NULL)))
1237 {
1238 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1239 goto err;
1240 }
1241 p+=i;
1242
1243 n2s(p,i);
1244 param_len+=i+2;
1245 if (param_len > n)
1246 {
1247 al=SSL_AD_DECODE_ERROR;
1248 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH);
1249 goto f_err;
1250 }
1251 if (!(dh->pub_key=BN_bin2bn(p,i,NULL)))
1252 {
1253 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
1254 goto err;
1255 }
1256 p+=i;
1257 n-=param_len;
1258
1259#ifndef OPENSSL_NO_RSA
1260 if (alg & SSL_aRSA)
1261 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1262#else
1263 if (0)
1264 ;
1265#endif
1266#ifndef OPENSSL_NO_DSA
1267 else if (alg & SSL_aDSS)
1268 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509);
1269#endif
1270 /* else anonymous DH, so no certificate or pkey. */
1271
1272 s->session->sess_cert->peer_dh_tmp=dh;
1273 dh=NULL;
1274 }
1275 else if ((alg & SSL_kDHr) || (alg & SSL_kDHd))
1276 {
1277 al=SSL_AD_ILLEGAL_PARAMETER;
1278 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1279 goto f_err;
1280 }
1281#endif /* !OPENSSL_NO_DH */
1282
1283#ifndef OPENSSL_NO_ECDH
1284 else if (alg & SSL_kECDHE)
1285 {
1286 EC_GROUP *ngroup;
1287 const EC_GROUP *group;
1288
1289 if ((ecdh=EC_KEY_new()) == NULL)
1290 {
1291 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
1292 goto err;
1293 }
1294
1295 /* Extract elliptic curve parameters and the
1296 * server's ephemeral ECDH public key.
1297 * Keep accumulating lengths of various components in
1298 * param_len and make sure it never exceeds n.
1299 */
1300
1301 /* XXX: For now we only support named (not generic) curves
1302 * and the ECParameters in this case is just three bytes.
1303 */
1304 param_len=3;
1305 if ((param_len > n) ||
1306 (*p != NAMED_CURVE_TYPE) ||
1307 ((curve_nid = curve_id2nid(*(p + 2))) == 0))
1308 {
1309 al=SSL_AD_INTERNAL_ERROR;
1310 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
1311 goto f_err;
1312 }
1313
1314 ngroup = EC_GROUP_new_by_curve_name(curve_nid);
1315 if (ngroup == NULL)
1316 {
1317 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
1318 goto err;
1319 }
1320 if (EC_KEY_set_group(ecdh, ngroup) == 0)
1321 {
1322 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
1323 goto err;
1324 }
1325 EC_GROUP_free(ngroup);
1326
1327 group = EC_KEY_get0_group(ecdh);
1328
1329 if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
1330 (EC_GROUP_get_degree(group) > 163))
1331 {
1332 al=SSL_AD_EXPORT_RESTRICTION;
1333 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
1334 goto f_err;
1335 }
1336
1337 p+=3;
1338
1339 /* Next, get the encoded ECPoint */
1340 if (((srvr_ecpoint = EC_POINT_new(group)) == NULL) ||
1341 ((bn_ctx = BN_CTX_new()) == NULL))
1342 {
1343 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
1344 goto err;
1345 }
1346
1347 encoded_pt_len = *p; /* length of encoded point */
1348 p+=1;
1349 param_len += (1 + encoded_pt_len);
1350 if ((param_len > n) ||
1351 (EC_POINT_oct2point(group, srvr_ecpoint,
1352 p, encoded_pt_len, bn_ctx) == 0))
1353 {
1354 al=SSL_AD_DECODE_ERROR;
1355 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT);
1356 goto f_err;
1357 }
1358
1359 n-=param_len;
1360 p+=encoded_pt_len;
1361
1362 /* The ECC/TLS specification does not mention
1363 * the use of DSA to sign ECParameters in the server
1364 * key exchange message. We do support RSA and ECDSA.
1365 */
1366 if (0) ;
1367#ifndef OPENSSL_NO_RSA
1368 else if (alg & SSL_aRSA)
1369 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1370#endif
1371#ifndef OPENSSL_NO_ECDSA
1372 else if (alg & SSL_aECDSA)
1373 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
1374#endif
1375 /* else anonymous ECDH, so no certificate or pkey. */
1376 EC_KEY_set_public_key(ecdh, srvr_ecpoint);
1377 s->session->sess_cert->peer_ecdh_tmp=ecdh;
1378 ecdh=NULL;
1379 BN_CTX_free(bn_ctx);
|
1380 EC_POINT_free(srvr_ecpoint);
1381 srvr_ecpoint = NULL;
1382 }
1383 else if (alg & SSL_kECDH)
1384 {
1385 al=SSL_AD_UNEXPECTED_MESSAGE;
1386 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
1387 goto f_err;
1388 }
1389#endif /* !OPENSSL_NO_ECDH */
1390 if (alg & SSL_aFZA)
1391 {
1392 al=SSL_AD_HANDSHAKE_FAILURE;
1393 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1394 goto f_err;
1395 }
1396
1397
1398 /* p points to the next byte, there are 'n' bytes left */
1399
1400 /* if it was signed, check the signature */
1401 if (pkey != NULL)
1402 {
1403 n2s(p,i);
1404 n-=2;
1405 j=EVP_PKEY_size(pkey);
1406
1407 if ((i != n) || (n > j) || (n <= 0))
1408 {
1409 /* wrong packet length */
1410 al=SSL_AD_DECODE_ERROR;
1411 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH);
1412 goto f_err;
1413 }
1414
1415#ifndef OPENSSL_NO_RSA
1416 if (pkey->type == EVP_PKEY_RSA)
1417 {
1418 int num;
1419
1420 j=0;
1421 q=md_buf;
1422 for (num=2; num > 0; num--)
1423 {
1424 EVP_MD_CTX_set_flags(&md_ctx,
1425 EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
1426 EVP_DigestInit_ex(&md_ctx,(num == 2)
1427 ?s->ctx->md5:s->ctx->sha1, NULL);
1428 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1429 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1430 EVP_DigestUpdate(&md_ctx,param,param_len);
1431 EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i);
1432 q+=i;
1433 j+=i;
1434 }
1435 i=RSA_verify(NID_md5_sha1, md_buf, j, p, n,
1436 pkey->pkey.rsa);
1437 if (i < 0)
1438 {
1439 al=SSL_AD_DECRYPT_ERROR;
1440 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
1441 goto f_err;
1442 }
1443 if (i == 0)
1444 {
1445 /* bad signature */
1446 al=SSL_AD_DECRYPT_ERROR;
1447 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1448 goto f_err;
1449 }
1450 }
1451 else
1452#endif
1453#ifndef OPENSSL_NO_DSA
1454 if (pkey->type == EVP_PKEY_DSA)
1455 {
1456 /* lets do DSS */
1457 EVP_VerifyInit_ex(&md_ctx,EVP_dss1(), NULL);
1458 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1459 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1460 EVP_VerifyUpdate(&md_ctx,param,param_len);
1461 if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
1462 {
1463 /* bad signature */
1464 al=SSL_AD_DECRYPT_ERROR;
1465 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1466 goto f_err;
1467 }
1468 }
1469 else
1470#endif
1471#ifndef OPENSSL_NO_ECDSA
1472 if (pkey->type == EVP_PKEY_EC)
1473 {
1474 /* let's do ECDSA */
1475 EVP_VerifyInit_ex(&md_ctx,EVP_ecdsa(), NULL);
1476 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1477 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1478 EVP_VerifyUpdate(&md_ctx,param,param_len);
1479 if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
1480 {
1481 /* bad signature */
1482 al=SSL_AD_DECRYPT_ERROR;
1483 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1484 goto f_err;
1485 }
1486 }
1487 else
1488#endif
1489 {
1490 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1491 goto err;
1492 }
1493 }
1494 else
1495 {
1496 /* still data left over */
1497 if (!(alg & SSL_aNULL))
1498 {
1499 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1500 goto err;
1501 }
1502 if (n != 0)
1503 {
1504 al=SSL_AD_DECODE_ERROR;
1505 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE);
1506 goto f_err;
1507 }
1508 }
1509 EVP_PKEY_free(pkey);
1510 EVP_MD_CTX_cleanup(&md_ctx);
1511 return(1);
1512f_err:
1513 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1514err:
1515 EVP_PKEY_free(pkey);
1516#ifndef OPENSSL_NO_RSA
1517 if (rsa != NULL)
1518 RSA_free(rsa);
1519#endif
1520#ifndef OPENSSL_NO_DH
1521 if (dh != NULL)
1522 DH_free(dh);
1523#endif
1524#ifndef OPENSSL_NO_ECDH
1525 BN_CTX_free(bn_ctx);
1526 EC_POINT_free(srvr_ecpoint);
1527 if (ecdh != NULL)
1528 EC_KEY_free(ecdh);
1529#endif
1530 EVP_MD_CTX_cleanup(&md_ctx);
1531 return(-1);
1532 }
1533
1534int ssl3_get_certificate_request(SSL *s)
1535 {
1536 int ok,ret=0;
1537 unsigned long n,nc,l;
1538 unsigned int llen,ctype_num,i;
1539 X509_NAME *xn=NULL;
1540 const unsigned char *p,*q;
1541 unsigned char *d;
1542 STACK_OF(X509_NAME) *ca_sk=NULL;
1543
1544 n=s->method->ssl_get_message(s,
1545 SSL3_ST_CR_CERT_REQ_A,
1546 SSL3_ST_CR_CERT_REQ_B,
1547 -1,
1548 s->max_cert_list,
1549 &ok);
1550
1551 if (!ok) return((int)n);
1552
1553 s->s3->tmp.cert_req=0;
1554
1555 if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)
1556 {
1557 s->s3->tmp.reuse_message=1;
1558 return(1);
1559 }
1560
1561 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST)
1562 {
1563 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1564 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE);
1565 goto err;
1566 }
1567
1568 /* TLS does not like anon-DH with client cert */
1569 if (s->version > SSL3_VERSION)
1570 {
1571 l=s->s3->tmp.new_cipher->algorithms;
1572 if (l & SSL_aNULL)
1573 {
1574 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1575 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER);
1576 goto err;
1577 }
1578 }
1579
1580 p=d=(unsigned char *)s->init_msg;
1581
1582 if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
1583 {
1584 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
1585 goto err;
1586 }
1587
1588 /* get the certificate types */
1589 ctype_num= *(p++);
1590 if (ctype_num > SSL3_CT_NUMBER)
1591 ctype_num=SSL3_CT_NUMBER;
1592 for (i=0; i<ctype_num; i++)
1593 s->s3->tmp.ctype[i]= p[i];
1594 p+=ctype_num;
1595
1596 /* get the CA RDNs */
1597 n2s(p,llen);
1598#if 0
1599{
1600FILE *out;
1601out=fopen("/tmp/vsign.der","w");
1602fwrite(p,1,llen,out);
1603fclose(out);
1604}
1605#endif
1606
1607 if ((llen+ctype_num+2+1) != n)
1608 {
1609 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1610 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH);
1611 goto err;
1612 }
1613
1614 for (nc=0; nc<llen; )
1615 {
1616 n2s(p,l);
1617 if ((l+nc+2) > llen)
1618 {
1619 if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1620 goto cont; /* netscape bugs */
1621 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1622 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG);
1623 goto err;
1624 }
1625
1626 q=p;
1627
1628 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL)
1629 {
1630 /* If netscape tolerance is on, ignore errors */
1631 if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG)
1632 goto cont;
1633 else
1634 {
1635 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1636 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB);
1637 goto err;
1638 }
1639 }
1640
1641 if (q != (p+l))
1642 {
1643 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1644 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH);
1645 goto err;
1646 }
1647 if (!sk_X509_NAME_push(ca_sk,xn))
1648 {
1649 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
1650 goto err;
1651 }
1652
1653 p+=l;
1654 nc+=l+2;
1655 }
1656
1657 if (0)
1658 {
1659cont:
1660 ERR_clear_error();
1661 }
1662
1663 /* we should setup a certificate to return.... */
1664 s->s3->tmp.cert_req=1;
1665 s->s3->tmp.ctype_num=ctype_num;
1666 if (s->s3->tmp.ca_names != NULL)
1667 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
1668 s->s3->tmp.ca_names=ca_sk;
1669 ca_sk=NULL;
1670
1671 ret=1;
1672err:
1673 if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free);
1674 return(ret);
1675 }
1676
1677static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
1678 {
1679 return(X509_NAME_cmp(*a,*b));
1680 }
1681#ifndef OPENSSL_NO_TLSEXT
1682int ssl3_get_new_session_ticket(SSL *s)
1683 {
1684 int ok,al,ret=0, ticklen;
1685 long n;
1686 const unsigned char *p;
1687 unsigned char *d;
1688
1689 n=s->method->ssl_get_message(s,
1690 SSL3_ST_CR_SESSION_TICKET_A,
1691 SSL3_ST_CR_SESSION_TICKET_B,
1692 -1,
1693 16384,
1694 &ok);
1695
1696 if (!ok)
1697 return((int)n);
1698
1699 if (s->s3->tmp.message_type == SSL3_MT_FINISHED)
1700 {
1701 s->s3->tmp.reuse_message=1;
1702 return(1);
1703 }
1704 if (s->s3->tmp.message_type != SSL3_MT_NEWSESSION_TICKET)
1705 {
1706 al=SSL_AD_UNEXPECTED_MESSAGE;
1707 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_BAD_MESSAGE_TYPE);
1708 goto f_err;
1709 }
1710 if (n < 6)
1711 {
1712 /* need at least ticket_lifetime_hint + ticket length */
1713 al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
1714 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
1715 goto f_err;
1716 }
1717
1718 p=d=(unsigned char *)s->init_msg;
1719 n2l(p, s->session->tlsext_tick_lifetime_hint);
1720 n2s(p, ticklen);
1721 /* ticket_lifetime_hint + ticket_length + ticket */
1722 if (ticklen + 6 != n)
1723 {
1724 al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
1725 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
1726 goto f_err;
1727 }
1728 if (s->session->tlsext_tick)
1729 {
1730 OPENSSL_free(s->session->tlsext_tick);
1731 s->session->tlsext_ticklen = 0;
1732 }
1733 s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1734 if (!s->session->tlsext_tick)
1735 {
1736 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,ERR_R_MALLOC_FAILURE);
1737 goto err;
1738 }
1739 memcpy(s->session->tlsext_tick, p, ticklen);
1740 s->session->tlsext_ticklen = ticklen;
1741 /* There are two ways to detect a resumed ticket sesion.
1742 * One is to set an appropriate session ID and then the server
1743 * must return a match in ServerHello. This allows the normal
1744 * client session ID matching to work and we know much
1745 * earlier that the ticket has been accepted.
1746 *
1747 * The other way is to set zero length session ID when the
1748 * ticket is presented and rely on the handshake to determine
1749 * session resumption.
1750 *
1751 * We choose the former approach because this fits in with
1752 * assumptions elsewhere in OpenSSL. The session ID is set
1753 * to the SHA256 (or SHA1 is SHA256 is disabled) hash of the
1754 * ticket.
1755 */
1756 EVP_Digest(p, ticklen,
1757 s->session->session_id, &s->session->session_id_length,
1758#ifndef OPENSSL_NO_SHA256
1759 EVP_sha256(), NULL);
1760#else
1761 EVP_sha1(), NULL);
1762#endif
1763 ret=1;
1764 return(ret);
1765f_err:
1766 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1767err:
1768 return(-1);
1769 }
1770
1771int ssl3_get_cert_status(SSL *s)
1772 {
1773 int ok, al;
1774 unsigned long resplen;
1775 long n;
1776 const unsigned char *p;
1777
1778 n=s->method->ssl_get_message(s,
1779 SSL3_ST_CR_CERT_STATUS_A,
1780 SSL3_ST_CR_CERT_STATUS_B,
1781 SSL3_MT_CERTIFICATE_STATUS,
1782 16384,
1783 &ok);
1784
1785 if (!ok) return((int)n);
1786 if (n < 4)
1787 {
1788 /* need at least status type + length */
1789 al = SSL_AD_DECODE_ERROR;
1790 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
1791 goto f_err;
1792 }
1793 p = (unsigned char *)s->init_msg;
1794 if (*p++ != TLSEXT_STATUSTYPE_ocsp)
1795 {
1796 al = SSL_AD_DECODE_ERROR;
1797 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_UNSUPPORTED_STATUS_TYPE);
1798 goto f_err;
1799 }
1800 n2l3(p, resplen);
1801 if (resplen + 4 != (unsigned long)n)
1802 {
1803 al = SSL_AD_DECODE_ERROR;
1804 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
1805 goto f_err;
1806 }
1807 if (s->tlsext_ocsp_resp)
1808 OPENSSL_free(s->tlsext_ocsp_resp);
1809 s->tlsext_ocsp_resp = BUF_memdup(p, resplen);
1810 if (!s->tlsext_ocsp_resp)
1811 {
1812 al = SSL_AD_INTERNAL_ERROR;
1813 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
1814 goto f_err;
1815 }
1816 s->tlsext_ocsp_resplen = resplen;
1817 if (s->ctx->tlsext_status_cb)
1818 {
1819 int ret;
1820 ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1821 if (ret == 0)
1822 {
1823 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1824 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_INVALID_STATUS_RESPONSE);
1825 goto f_err;
1826 }
1827 if (ret < 0)
1828 {
1829 al = SSL_AD_INTERNAL_ERROR;
1830 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
1831 goto f_err;
1832 }
1833 }
1834 return 1;
1835f_err:
1836 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1837 return(-1);
1838 }
1839#endif
1840
1841int ssl3_get_server_done(SSL *s)
1842 {
1843 int ok,ret=0;
1844 long n;
1845
1846 n=s->method->ssl_get_message(s,
1847 SSL3_ST_CR_SRVR_DONE_A,
1848 SSL3_ST_CR_SRVR_DONE_B,
1849 SSL3_MT_SERVER_DONE,
1850 30, /* should be very small, like 0 :-) */
1851 &ok);
1852
1853 if (!ok) return((int)n);
1854 if (n > 0)
1855 {
1856 /* should contain no data */
1857 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1858 SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH);
1859 return -1;
1860 }
1861 ret=1;
1862 return(ret);
1863 }
1864
1865
1866int ssl3_send_client_key_exchange(SSL *s)
1867 {
1868 unsigned char *p,*d;
1869 int n;
1870 unsigned long l;
1871#ifndef OPENSSL_NO_RSA
1872 unsigned char *q;
1873 EVP_PKEY *pkey=NULL;
1874#endif
1875#ifndef OPENSSL_NO_KRB5
1876 KSSL_ERR kssl_err;
1877#endif /* OPENSSL_NO_KRB5 */
1878#ifndef OPENSSL_NO_ECDH
1879 EC_KEY *clnt_ecdh = NULL;
1880 const EC_POINT *srvr_ecpoint = NULL;
1881 EVP_PKEY *srvr_pub_pkey = NULL;
1882 unsigned char *encodedPoint = NULL;
1883 int encoded_pt_len = 0;
1884 BN_CTX * bn_ctx = NULL;
1885#endif
1886
1887 if (s->state == SSL3_ST_CW_KEY_EXCH_A)
1888 {
1889 d=(unsigned char *)s->init_buf->data;
1890 p= &(d[4]);
1891
1892 l=s->s3->tmp.new_cipher->algorithms;
1893
1894 /* Fool emacs indentation */
1895 if (0) {}
1896#ifndef OPENSSL_NO_RSA
1897 else if (l & SSL_kRSA)
1898 {
1899 RSA *rsa;
1900 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1901
1902 if (s->session->sess_cert->peer_rsa_tmp != NULL)
1903 rsa=s->session->sess_cert->peer_rsa_tmp;
1904 else
1905 {
1906 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1907 if ((pkey == NULL) ||
1908 (pkey->type != EVP_PKEY_RSA) ||
1909 (pkey->pkey.rsa == NULL))
1910 {
1911 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1912 goto err;
1913 }
1914 rsa=pkey->pkey.rsa;
1915 EVP_PKEY_free(pkey);
1916 }
1917
1918 tmp_buf[0]=s->client_version>>8;
1919 tmp_buf[1]=s->client_version&0xff;
1920 if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
1921 goto err;
1922
1923 s->session->master_key_length=sizeof tmp_buf;
1924
1925 q=p;
1926 /* Fix buf for TLS and beyond */
1927 if (s->version > SSL3_VERSION)
1928 p+=2;
1929 n=RSA_public_encrypt(sizeof tmp_buf,
1930 tmp_buf,p,rsa,RSA_PKCS1_PADDING);
1931#ifdef PKCS1_CHECK
1932 if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
1933 if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70;
1934#endif
1935 if (n <= 0)
1936 {
1937 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT);
1938 goto err;
1939 }
1940
1941 /* Fix buf for TLS and beyond */
1942 if (s->version > SSL3_VERSION)
1943 {
1944 s2n(n,q);
1945 n+=2;
1946 }
1947
1948 s->session->master_key_length=
1949 s->method->ssl3_enc->generate_master_secret(s,
1950 s->session->master_key,
1951 tmp_buf,sizeof tmp_buf);
1952 OPENSSL_cleanse(tmp_buf,sizeof tmp_buf);
1953 }
1954#endif
1955#ifndef OPENSSL_NO_KRB5
1956 else if (l & SSL_kKRB5)
1957 {
1958 krb5_error_code krb5rc;
1959 KSSL_CTX *kssl_ctx = s->kssl_ctx;
1960 /* krb5_data krb5_ap_req; */
1961 krb5_data *enc_ticket;
1962 krb5_data authenticator, *authp = NULL;
1963 EVP_CIPHER_CTX ciph_ctx;
1964 EVP_CIPHER *enc = NULL;
1965 unsigned char iv[EVP_MAX_IV_LENGTH];
1966 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1967 unsigned char epms[SSL_MAX_MASTER_KEY_LENGTH
1968 + EVP_MAX_IV_LENGTH];
1969 int padl, outl = sizeof(epms);
1970
1971 EVP_CIPHER_CTX_init(&ciph_ctx);
1972
1973#ifdef KSSL_DEBUG
1974 printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
1975 l, SSL_kKRB5);
1976#endif /* KSSL_DEBUG */
1977
1978 authp = NULL;
1979#ifdef KRB5SENDAUTH
1980 if (KRB5SENDAUTH) authp = &authenticator;
1981#endif /* KRB5SENDAUTH */
1982
1983 krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
1984 &kssl_err);
1985 enc = kssl_map_enc(kssl_ctx->enctype);
1986 if (enc == NULL)
1987 goto err;
1988#ifdef KSSL_DEBUG
1989 {
1990 printf("kssl_cget_tkt rtn %d\n", krb5rc);
1991 if (krb5rc && kssl_err.text)
1992 printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
1993 }
1994#endif /* KSSL_DEBUG */
1995
1996 if (krb5rc)
1997 {
1998 ssl3_send_alert(s,SSL3_AL_FATAL,
1999 SSL_AD_HANDSHAKE_FAILURE);
2000 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2001 kssl_err.reason);
2002 goto err;
2003 }
2004
2005 /* 20010406 VRS - Earlier versions used KRB5 AP_REQ
2006 ** in place of RFC 2712 KerberosWrapper, as in:
2007 **
2008 ** Send ticket (copy to *p, set n = length)
2009 ** n = krb5_ap_req.length;
2010 ** memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
2011 ** if (krb5_ap_req.data)
2012 ** kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
2013 **
2014 ** Now using real RFC 2712 KerberosWrapper
2015 ** (Thanks to Simon Wilkinson <sxw@sxw.org.uk>)
2016 ** Note: 2712 "opaque" types are here replaced
2017 ** with a 2-byte length followed by the value.
2018 ** Example:
2019 ** KerberosWrapper= xx xx asn1ticket 0 0 xx xx encpms
2020 ** Where "xx xx" = length bytes. Shown here with
2021 ** optional authenticator omitted.
2022 */
2023
2024 /* KerberosWrapper.Ticket */
2025 s2n(enc_ticket->length,p);
2026 memcpy(p, enc_ticket->data, enc_ticket->length);
2027 p+= enc_ticket->length;
2028 n = enc_ticket->length + 2;
2029
2030 /* KerberosWrapper.Authenticator */
2031 if (authp && authp->length)
2032 {
2033 s2n(authp->length,p);
2034 memcpy(p, authp->data, authp->length);
2035 p+= authp->length;
2036 n+= authp->length + 2;
2037
2038 free(authp->data);
2039 authp->data = NULL;
2040 authp->length = 0;
2041 }
2042 else
2043 {
2044 s2n(0,p);/* null authenticator length */
2045 n+=2;
2046 }
2047
2048 tmp_buf[0]=s->client_version>>8;
2049 tmp_buf[1]=s->client_version&0xff;
2050 if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
2051 goto err;
2052
2053 /* 20010420 VRS. Tried it this way; failed.
2054 ** EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
2055 ** EVP_CIPHER_CTX_set_key_length(&ciph_ctx,
2056 ** kssl_ctx->length);
2057 ** EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
2058 */
2059
2060 memset(iv, 0, sizeof iv); /* per RFC 1510 */
2061 EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
2062 kssl_ctx->key,iv);
2063 EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
2064 sizeof tmp_buf);
2065 EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
2066 outl += padl;
2067 if (outl > sizeof epms)
2068 {
2069 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2070 goto err;
2071 }
2072 EVP_CIPHER_CTX_cleanup(&ciph_ctx);
2073
2074 /* KerberosWrapper.EncryptedPreMasterSecret */
2075 s2n(outl,p);
2076 memcpy(p, epms, outl);
2077 p+=outl;
2078 n+=outl + 2;
2079
2080 s->session->master_key_length=
2081 s->method->ssl3_enc->generate_master_secret(s,
2082 s->session->master_key,
2083 tmp_buf, sizeof tmp_buf);
2084
2085 OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
2086 OPENSSL_cleanse(epms, outl);
2087 }
2088#endif
2089#ifndef OPENSSL_NO_DH
2090 else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2091 {
2092 DH *dh_srvr,*dh_clnt;
2093
2094 if (s->session->sess_cert == NULL)
2095 {
2096 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
2097 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
2098 goto err;
2099 }
2100
2101 if (s->session->sess_cert->peer_dh_tmp != NULL)
2102 dh_srvr=s->session->sess_cert->peer_dh_tmp;
2103 else
2104 {
2105 /* we get them from the cert */
2106 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
2107 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
2108 goto err;
2109 }
2110
2111 /* generate a new random key */
2112 if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL)
2113 {
2114 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
2115 goto err;
2116 }
2117 if (!DH_generate_key(dh_clnt))
2118 {
2119 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
2120 goto err;
2121 }
2122
2123 /* use the 'p' output buffer for the DH key, but
2124 * make sure to clear it out afterwards */
2125
2126 n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt);
2127
2128 if (n <= 0)
2129 {
2130 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
2131 goto err;
2132 }
2133
2134 /* generate master key from the result */
2135 s->session->master_key_length=
2136 s->method->ssl3_enc->generate_master_secret(s,
2137 s->session->master_key,p,n);
2138 /* clean up */
2139 memset(p,0,n);
2140
2141 /* send off the data */
2142 n=BN_num_bytes(dh_clnt->pub_key);
2143 s2n(n,p);
2144 BN_bn2bin(dh_clnt->pub_key,p);
2145 n+=2;
2146
2147 DH_free(dh_clnt);
2148
2149 /* perhaps clean things up a bit EAY EAY EAY EAY*/
2150 }
2151#endif
2152
2153#ifndef OPENSSL_NO_ECDH
2154 else if ((l & SSL_kECDH) || (l & SSL_kECDHE))
2155 {
2156 const EC_GROUP *srvr_group = NULL;
2157 EC_KEY *tkey;
2158 int ecdh_clnt_cert = 0;
2159 int field_size = 0;
2160
2161 /* Did we send out the client's
2162 * ECDH share for use in premaster
2163 * computation as part of client certificate?
2164 * If so, set ecdh_clnt_cert to 1.
2165 */
2166 if ((l & SSL_kECDH) && (s->cert != NULL))
2167 {
2168 /* XXX: For now, we do not support client
2169 * authentication using ECDH certificates.
2170 * To add such support, one needs to add
2171 * code that checks for appropriate
2172 * conditions and sets ecdh_clnt_cert to 1.
2173 * For example, the cert have an ECC
2174 * key on the same curve as the server's
2175 * and the key should be authorized for
2176 * key agreement.
2177 *
2178 * One also needs to add code in ssl3_connect
2179 * to skip sending the certificate verify
2180 * message.
2181 *
2182 * if ((s->cert->key->privatekey != NULL) &&
2183 * (s->cert->key->privatekey->type ==
2184 * EVP_PKEY_EC) && ...)
2185 * ecdh_clnt_cert = 1;
2186 */
2187 }
2188
2189 if (s->session->sess_cert->peer_ecdh_tmp != NULL)
2190 {
2191 tkey = s->session->sess_cert->peer_ecdh_tmp;
2192 }
2193 else
2194 {
2195 /* Get the Server Public Key from Cert */
2196 srvr_pub_pkey = X509_get_pubkey(s->session-> \
2197 sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
2198 if ((srvr_pub_pkey == NULL) ||
2199 (srvr_pub_pkey->type != EVP_PKEY_EC) ||
2200 (srvr_pub_pkey->pkey.ec == NULL))
2201 {
2202 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2203 ERR_R_INTERNAL_ERROR);
2204 goto err;
2205 }
2206
2207 tkey = srvr_pub_pkey->pkey.ec;
2208 }
2209
2210 srvr_group = EC_KEY_get0_group(tkey);
2211 srvr_ecpoint = EC_KEY_get0_public_key(tkey);
2212
2213 if ((srvr_group == NULL) || (srvr_ecpoint == NULL))
2214 {
2215 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2216 ERR_R_INTERNAL_ERROR);
2217 goto err;
2218 }
2219
2220 if ((clnt_ecdh=EC_KEY_new()) == NULL)
2221 {
2222 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
2223 goto err;
2224 }
2225
2226 if (!EC_KEY_set_group(clnt_ecdh, srvr_group))
2227 {
2228 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
2229 goto err;
2230 }
2231 if (ecdh_clnt_cert)
2232 {
2233 /* Reuse key info from our certificate
2234 * We only need our private key to perform
2235 * the ECDH computation.
2236 */
2237 const BIGNUM *priv_key;
2238 tkey = s->cert->key->privatekey->pkey.ec;
2239 priv_key = EC_KEY_get0_private_key(tkey);
2240 if (priv_key == NULL)
2241 {
2242 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
2243 goto err;
2244 }
2245 if (!EC_KEY_set_private_key(clnt_ecdh, priv_key))
2246 {
2247 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
2248 goto err;
2249 }
2250 }
2251 else
2252 {
2253 /* Generate a new ECDH key pair */
2254 if (!(EC_KEY_generate_key(clnt_ecdh)))
2255 {
2256 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
2257 goto err;
2258 }
2259 }
2260
2261 /* use the 'p' output buffer for the ECDH key, but
2262 * make sure to clear it out afterwards
2263 */
2264
2265 field_size = EC_GROUP_get_degree(srvr_group);
2266 if (field_size <= 0)
2267 {
2268 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2269 ERR_R_ECDH_LIB);
2270 goto err;
2271 }
2272 n=ECDH_compute_key(p, (field_size+7)/8, srvr_ecpoint, clnt_ecdh, NULL);
2273 if (n <= 0)
2274 {
2275 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2276 ERR_R_ECDH_LIB);
2277 goto err;
2278 }
2279
2280 /* generate master key from the result */
2281 s->session->master_key_length = s->method->ssl3_enc \
2282 -> generate_master_secret(s,
2283 s->session->master_key,
2284 p, n);
2285
2286 memset(p, 0, n); /* clean up */
2287
2288 if (ecdh_clnt_cert)
2289 {
2290 /* Send empty client key exch message */
2291 n = 0;
2292 }
2293 else
2294 {
2295 /* First check the size of encoding and
2296 * allocate memory accordingly.
2297 */
2298 encoded_pt_len =
2299 EC_POINT_point2oct(srvr_group,
2300 EC_KEY_get0_public_key(clnt_ecdh),
2301 POINT_CONVERSION_UNCOMPRESSED,
2302 NULL, 0, NULL);
2303
2304 encodedPoint = (unsigned char *)
2305 OPENSSL_malloc(encoded_pt_len *
2306 sizeof(unsigned char));
2307 bn_ctx = BN_CTX_new();
2308 if ((encodedPoint == NULL) ||
2309 (bn_ctx == NULL))
2310 {
2311 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
2312 goto err;
2313 }
2314
2315 /* Encode the public key */
2316 n = EC_POINT_point2oct(srvr_group,
2317 EC_KEY_get0_public_key(clnt_ecdh),
2318 POINT_CONVERSION_UNCOMPRESSED,
2319 encodedPoint, encoded_pt_len, bn_ctx);
2320
2321 *p = n; /* length of encoded point */
2322 /* Encoded point will be copied here */
2323 p += 1;
2324 /* copy the point */
2325 memcpy((unsigned char *)p, encodedPoint, n);
2326 /* increment n to account for length field */
2327 n += 1;
2328 }
2329
2330 /* Free allocated memory */
2331 BN_CTX_free(bn_ctx);
2332 if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
2333 if (clnt_ecdh != NULL)
2334 EC_KEY_free(clnt_ecdh);
2335 EVP_PKEY_free(srvr_pub_pkey);
2336 }
2337#endif /* !OPENSSL_NO_ECDH */
2338 else
2339 {
2340 ssl3_send_alert(s, SSL3_AL_FATAL,
2341 SSL_AD_HANDSHAKE_FAILURE);
2342 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2343 ERR_R_INTERNAL_ERROR);
2344 goto err;
2345 }
2346
2347 *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE;
2348 l2n3(n,d);
2349
2350 s->state=SSL3_ST_CW_KEY_EXCH_B;
2351 /* number of bytes to write */
2352 s->init_num=n+4;
2353 s->init_off=0;
2354 }
2355
2356 /* SSL3_ST_CW_KEY_EXCH_B */
2357 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2358err:
2359#ifndef OPENSSL_NO_ECDH
2360 BN_CTX_free(bn_ctx);
2361 if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
2362 if (clnt_ecdh != NULL)
2363 EC_KEY_free(clnt_ecdh);
2364 EVP_PKEY_free(srvr_pub_pkey);
2365#endif
2366 return(-1);
2367 }
2368
2369int ssl3_send_client_verify(SSL *s)
2370 {
2371 unsigned char *p,*d;
2372 unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
2373 EVP_PKEY *pkey;
2374#ifndef OPENSSL_NO_RSA
2375 unsigned u=0;
2376#endif
2377 unsigned long n;
2378#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
2379 int j;
2380#endif
2381
2382 if (s->state == SSL3_ST_CW_CERT_VRFY_A)
2383 {
2384 d=(unsigned char *)s->init_buf->data;
2385 p= &(d[4]);
2386 pkey=s->cert->key->privatekey;
2387
2388 s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2),
2389 &(data[MD5_DIGEST_LENGTH]));
2390
2391#ifndef OPENSSL_NO_RSA
2392 if (pkey->type == EVP_PKEY_RSA)
2393 {
2394 s->method->ssl3_enc->cert_verify_mac(s,
2395 &(s->s3->finish_dgst1),&(data[0]));
2396 if (RSA_sign(NID_md5_sha1, data,
2397 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
2398 &(p[2]), &u, pkey->pkey.rsa) <= 0 )
2399 {
2400 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
2401 goto err;
2402 }
2403 s2n(u,p);
2404 n=u+2;
2405 }
2406 else
2407#endif
2408#ifndef OPENSSL_NO_DSA
2409 if (pkey->type == EVP_PKEY_DSA)
2410 {
2411 if (!DSA_sign(pkey->save_type,
2412 &(data[MD5_DIGEST_LENGTH]),
2413 SHA_DIGEST_LENGTH,&(p[2]),
2414 (unsigned int *)&j,pkey->pkey.dsa))
2415 {
2416 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB);
2417 goto err;
2418 }
2419 s2n(j,p);
2420 n=j+2;
2421 }
2422 else
2423#endif
2424#ifndef OPENSSL_NO_ECDSA
2425 if (pkey->type == EVP_PKEY_EC)
2426 {
2427 if (!ECDSA_sign(pkey->save_type,
2428 &(data[MD5_DIGEST_LENGTH]),
2429 SHA_DIGEST_LENGTH,&(p[2]),
2430 (unsigned int *)&j,pkey->pkey.ec))
2431 {
2432 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
2433 ERR_R_ECDSA_LIB);
2434 goto err;
2435 }
2436 s2n(j,p);
2437 n=j+2;
2438 }
2439 else
2440#endif
2441 {
2442 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
2443 goto err;
2444 }
2445 *(d++)=SSL3_MT_CERTIFICATE_VERIFY;
2446 l2n3(n,d);
2447
2448 s->state=SSL3_ST_CW_CERT_VRFY_B;
2449 s->init_num=(int)n+4;
2450 s->init_off=0;
2451 }
2452 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2453err:
2454 return(-1);
2455 }
2456
2457int ssl3_send_client_certificate(SSL *s)
2458 {
2459 X509 *x509=NULL;
2460 EVP_PKEY *pkey=NULL;
2461 int i;
2462 unsigned long l;
2463
2464 if (s->state == SSL3_ST_CW_CERT_A)
2465 {
2466 if ((s->cert == NULL) ||
2467 (s->cert->key->x509 == NULL) ||
2468 (s->cert->key->privatekey == NULL))
2469 s->state=SSL3_ST_CW_CERT_B;
2470 else
2471 s->state=SSL3_ST_CW_CERT_C;
2472 }
2473
2474 /* We need to get a client cert */
2475 if (s->state == SSL3_ST_CW_CERT_B)
2476 {
2477 /* If we get an error, we need to
2478 * ssl->rwstate=SSL_X509_LOOKUP; return(-1);
2479 * We then get retied later */
2480 i=0;
2481 i = ssl_do_client_cert_cb(s, &x509, &pkey);
2482 if (i < 0)
2483 {
2484 s->rwstate=SSL_X509_LOOKUP;
2485 return(-1);
2486 }
2487 s->rwstate=SSL_NOTHING;
2488 if ((i == 1) && (pkey != NULL) && (x509 != NULL))
2489 {
2490 s->state=SSL3_ST_CW_CERT_B;
2491 if ( !SSL_use_certificate(s,x509) ||
2492 !SSL_use_PrivateKey(s,pkey))
2493 i=0;
2494 }
2495 else if (i == 1)
2496 {
2497 i=0;
2498 SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
2499 }
2500
2501 if (x509 != NULL) X509_free(x509);
2502 if (pkey != NULL) EVP_PKEY_free(pkey);
2503 if (i == 0)
2504 {
2505 if (s->version == SSL3_VERSION)
2506 {
2507 s->s3->tmp.cert_req=0;
2508 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE);
2509 return(1);
2510 }
2511 else
2512 {
2513 s->s3->tmp.cert_req=2;
2514 }
2515 }
2516
2517 /* Ok, we have a cert */
2518 s->state=SSL3_ST_CW_CERT_C;
2519 }
2520
2521 if (s->state == SSL3_ST_CW_CERT_C)
2522 {
2523 s->state=SSL3_ST_CW_CERT_D;
2524 l=ssl3_output_cert_chain(s,
2525 (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509);
2526 s->init_num=(int)l;
2527 s->init_off=0;
2528 }
2529 /* SSL3_ST_CW_CERT_D */
2530 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2531 }
2532
2533#define has_bits(i,m) (((i)&(m)) == (m))
2534
2535int ssl3_check_cert_and_algorithm(SSL *s)
2536 {
2537 int i,idx;
2538 long algs;
2539 EVP_PKEY *pkey=NULL;
2540 SESS_CERT *sc;
2541#ifndef OPENSSL_NO_RSA
2542 RSA *rsa;
2543#endif
2544#ifndef OPENSSL_NO_DH
2545 DH *dh;
2546#endif
2547
2548 sc=s->session->sess_cert;
2549
2550 algs=s->s3->tmp.new_cipher->algorithms;
2551
2552 /* we don't have a certificate */
2553 if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
2554 return(1);
2555
2556 if (sc == NULL)
2557 {
2558 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
2559 goto err;
2560 }
2561
2562#ifndef OPENSSL_NO_RSA
2563 rsa=s->session->sess_cert->peer_rsa_tmp;
2564#endif
2565#ifndef OPENSSL_NO_DH
2566 dh=s->session->sess_cert->peer_dh_tmp;
2567#endif
2568
2569 /* This is the passed certificate */
2570
2571 idx=sc->peer_cert_type;
2572#ifndef OPENSSL_NO_ECDH
2573 if (idx == SSL_PKEY_ECC)
2574 {
2575 if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
2576 s->s3->tmp.new_cipher) == 0)
2577 { /* check failed */
2578 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
2579 goto f_err;
2580 }
2581 else
2582 {
2583 return 1;
2584 }
2585 }
2586#endif
2587 pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2588 i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2589 EVP_PKEY_free(pkey);
2590
2591
2592 /* Check that we have a certificate if we require one */
2593 if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
2594 {
2595 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
2596 goto f_err;
2597 }
2598#ifndef OPENSSL_NO_DSA
2599 else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
2600 {
2601 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
2602 goto f_err;
2603 }
2604#endif
2605#ifndef OPENSSL_NO_RSA
2606 if ((algs & SSL_kRSA) &&
2607 !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
2608 {
2609 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
2610 goto f_err;
2611 }
2612#endif
2613#ifndef OPENSSL_NO_DH
2614 if ((algs & SSL_kEDH) &&
2615 !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
2616 {
2617 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
2618 goto f_err;
2619 }
2620 else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
2621 {
2622 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
2623 goto f_err;
2624 }
2625#ifndef OPENSSL_NO_DSA
2626 else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
2627 {
2628 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
2629 goto f_err;
2630 }
2631#endif
2632#endif
2633
2634 if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
2635 {
2636#ifndef OPENSSL_NO_RSA
2637 if (algs & SSL_kRSA)
2638 {
2639 if (rsa == NULL
2640 || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2641 {
2642 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
2643 goto f_err;
2644 }
2645 }
2646 else
2647#endif
2648#ifndef OPENSSL_NO_DH
2649 if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2650 {
2651 if (dh == NULL
2652 || DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2653 {
2654 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
2655 goto f_err;
2656 }
2657 }
2658 else
2659#endif
2660 {
2661 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
2662 goto f_err;
2663 }
2664 }
2665 return(1);
2666f_err:
2667 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
2668err:
2669 return(0);
2670 }
2671
2672
2673#ifndef OPENSSL_NO_ECDH
2674/* This is the complement of nid2curve_id in s3_srvr.c. */
2675static int curve_id2nid(int curve_id)
2676{
2677 /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
2678 * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
2679 static int nid_list[26] =
2680 {
2681 0,
2682 NID_sect163k1, /* sect163k1 (1) */
2683 NID_sect163r1, /* sect163r1 (2) */
2684 NID_sect163r2, /* sect163r2 (3) */
2685 NID_sect193r1, /* sect193r1 (4) */
2686 NID_sect193r2, /* sect193r2 (5) */
2687 NID_sect233k1, /* sect233k1 (6) */
2688 NID_sect233r1, /* sect233r1 (7) */
2689 NID_sect239k1, /* sect239k1 (8) */
2690 NID_sect283k1, /* sect283k1 (9) */
2691 NID_sect283r1, /* sect283r1 (10) */
2692 NID_sect409k1, /* sect409k1 (11) */
2693 NID_sect409r1, /* sect409r1 (12) */
2694 NID_sect571k1, /* sect571k1 (13) */
2695 NID_sect571r1, /* sect571r1 (14) */
2696 NID_secp160k1, /* secp160k1 (15) */
2697 NID_secp160r1, /* secp160r1 (16) */
2698 NID_secp160r2, /* secp160r2 (17) */
2699 NID_secp192k1, /* secp192k1 (18) */
2700 NID_X9_62_prime192v1, /* secp192r1 (19) */
2701 NID_secp224k1, /* secp224k1 (20) */
2702 NID_secp224r1, /* secp224r1 (21) */
2703 NID_secp256k1, /* secp256k1 (22) */
2704 NID_X9_62_prime256v1, /* secp256r1 (23) */
2705 NID_secp384r1, /* secp384r1 (24) */
2706 NID_secp521r1 /* secp521r1 (25) */
2707 };
2708
2709 if ((curve_id < 1) || (curve_id > 25)) return 0;
2710
2711 return nid_list[curve_id];
2712}
2713#endif
2714
2715/* Check to see if handshake is full or resumed. Usually this is just a
2716 * case of checking to see if a cache hit has occurred. In the case of
2717 * session tickets we have to check the next message to be sure.
2718 */
2719
2720#ifndef OPENSSL_NO_TLSEXT
2721int ssl3_check_finished(SSL *s)
2722 {
2723 int ok;
2724 long n;
2725 /* If we have no ticket or session ID is non-zero length (a match of
2726 * a non-zero session length would never reach here) it cannot be a
2727 * resumed session.
2728 */
2729 if (!s->session->tlsext_tick || s->session->session_id_length)
2730 return 1;
2731 /* this function is called when we really expect a Certificate
2732 * message, so permit appropriate message length */
2733 n=s->method->ssl_get_message(s,
2734 SSL3_ST_CR_CERT_A,
2735 SSL3_ST_CR_CERT_B,
2736 -1,
2737 s->max_cert_list,
2738 &ok);
2739 if (!ok) return((int)n);
2740 s->s3->tmp.reuse_message = 1;
2741 if ((s->s3->tmp.message_type == SSL3_MT_FINISHED)
2742 || (s->s3->tmp.message_type == SSL3_MT_NEWSESSION_TICKET))
2743 return 2;
2744
2745 return 1;
2746 }
2747#endif
2748
2749int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey)
2750 {
2751 int i = 0;
2752#ifndef OPENSSL_NO_ENGINE
2753 if (s->ctx->client_cert_engine)
2754 {
2755 i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s,
2756 SSL_get_client_CA_list(s),
2757 px509, ppkey, NULL, NULL, NULL);
2758 if (i != 0)
2759 return i;
2760 }
2761#endif
2762 if (s->ctx->client_cert_cb)
2763 i = s->ctx->client_cert_cb(s,px509,ppkey);
2764 return i;
2765 }
| 1381 EC_POINT_free(srvr_ecpoint);
1382 srvr_ecpoint = NULL;
1383 }
1384 else if (alg & SSL_kECDH)
1385 {
1386 al=SSL_AD_UNEXPECTED_MESSAGE;
1387 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
1388 goto f_err;
1389 }
1390#endif /* !OPENSSL_NO_ECDH */
1391 if (alg & SSL_aFZA)
1392 {
1393 al=SSL_AD_HANDSHAKE_FAILURE;
1394 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
1395 goto f_err;
1396 }
1397
1398
1399 /* p points to the next byte, there are 'n' bytes left */
1400
1401 /* if it was signed, check the signature */
1402 if (pkey != NULL)
1403 {
1404 n2s(p,i);
1405 n-=2;
1406 j=EVP_PKEY_size(pkey);
1407
1408 if ((i != n) || (n > j) || (n <= 0))
1409 {
1410 /* wrong packet length */
1411 al=SSL_AD_DECODE_ERROR;
1412 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH);
1413 goto f_err;
1414 }
1415
1416#ifndef OPENSSL_NO_RSA
1417 if (pkey->type == EVP_PKEY_RSA)
1418 {
1419 int num;
1420
1421 j=0;
1422 q=md_buf;
1423 for (num=2; num > 0; num--)
1424 {
1425 EVP_MD_CTX_set_flags(&md_ctx,
1426 EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
1427 EVP_DigestInit_ex(&md_ctx,(num == 2)
1428 ?s->ctx->md5:s->ctx->sha1, NULL);
1429 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1430 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1431 EVP_DigestUpdate(&md_ctx,param,param_len);
1432 EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i);
1433 q+=i;
1434 j+=i;
1435 }
1436 i=RSA_verify(NID_md5_sha1, md_buf, j, p, n,
1437 pkey->pkey.rsa);
1438 if (i < 0)
1439 {
1440 al=SSL_AD_DECRYPT_ERROR;
1441 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
1442 goto f_err;
1443 }
1444 if (i == 0)
1445 {
1446 /* bad signature */
1447 al=SSL_AD_DECRYPT_ERROR;
1448 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1449 goto f_err;
1450 }
1451 }
1452 else
1453#endif
1454#ifndef OPENSSL_NO_DSA
1455 if (pkey->type == EVP_PKEY_DSA)
1456 {
1457 /* lets do DSS */
1458 EVP_VerifyInit_ex(&md_ctx,EVP_dss1(), NULL);
1459 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1460 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1461 EVP_VerifyUpdate(&md_ctx,param,param_len);
1462 if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
1463 {
1464 /* bad signature */
1465 al=SSL_AD_DECRYPT_ERROR;
1466 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1467 goto f_err;
1468 }
1469 }
1470 else
1471#endif
1472#ifndef OPENSSL_NO_ECDSA
1473 if (pkey->type == EVP_PKEY_EC)
1474 {
1475 /* let's do ECDSA */
1476 EVP_VerifyInit_ex(&md_ctx,EVP_ecdsa(), NULL);
1477 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1478 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1479 EVP_VerifyUpdate(&md_ctx,param,param_len);
1480 if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
1481 {
1482 /* bad signature */
1483 al=SSL_AD_DECRYPT_ERROR;
1484 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
1485 goto f_err;
1486 }
1487 }
1488 else
1489#endif
1490 {
1491 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1492 goto err;
1493 }
1494 }
1495 else
1496 {
1497 /* still data left over */
1498 if (!(alg & SSL_aNULL))
1499 {
1500 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1501 goto err;
1502 }
1503 if (n != 0)
1504 {
1505 al=SSL_AD_DECODE_ERROR;
1506 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE);
1507 goto f_err;
1508 }
1509 }
1510 EVP_PKEY_free(pkey);
1511 EVP_MD_CTX_cleanup(&md_ctx);
1512 return(1);
1513f_err:
1514 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1515err:
1516 EVP_PKEY_free(pkey);
1517#ifndef OPENSSL_NO_RSA
1518 if (rsa != NULL)
1519 RSA_free(rsa);
1520#endif
1521#ifndef OPENSSL_NO_DH
1522 if (dh != NULL)
1523 DH_free(dh);
1524#endif
1525#ifndef OPENSSL_NO_ECDH
1526 BN_CTX_free(bn_ctx);
1527 EC_POINT_free(srvr_ecpoint);
1528 if (ecdh != NULL)
1529 EC_KEY_free(ecdh);
1530#endif
1531 EVP_MD_CTX_cleanup(&md_ctx);
1532 return(-1);
1533 }
1534
1535int ssl3_get_certificate_request(SSL *s)
1536 {
1537 int ok,ret=0;
1538 unsigned long n,nc,l;
1539 unsigned int llen,ctype_num,i;
1540 X509_NAME *xn=NULL;
1541 const unsigned char *p,*q;
1542 unsigned char *d;
1543 STACK_OF(X509_NAME) *ca_sk=NULL;
1544
1545 n=s->method->ssl_get_message(s,
1546 SSL3_ST_CR_CERT_REQ_A,
1547 SSL3_ST_CR_CERT_REQ_B,
1548 -1,
1549 s->max_cert_list,
1550 &ok);
1551
1552 if (!ok) return((int)n);
1553
1554 s->s3->tmp.cert_req=0;
1555
1556 if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)
1557 {
1558 s->s3->tmp.reuse_message=1;
1559 return(1);
1560 }
1561
1562 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST)
1563 {
1564 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1565 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE);
1566 goto err;
1567 }
1568
1569 /* TLS does not like anon-DH with client cert */
1570 if (s->version > SSL3_VERSION)
1571 {
1572 l=s->s3->tmp.new_cipher->algorithms;
1573 if (l & SSL_aNULL)
1574 {
1575 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1576 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER);
1577 goto err;
1578 }
1579 }
1580
1581 p=d=(unsigned char *)s->init_msg;
1582
1583 if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
1584 {
1585 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
1586 goto err;
1587 }
1588
1589 /* get the certificate types */
1590 ctype_num= *(p++);
1591 if (ctype_num > SSL3_CT_NUMBER)
1592 ctype_num=SSL3_CT_NUMBER;
1593 for (i=0; i<ctype_num; i++)
1594 s->s3->tmp.ctype[i]= p[i];
1595 p+=ctype_num;
1596
1597 /* get the CA RDNs */
1598 n2s(p,llen);
1599#if 0
1600{
1601FILE *out;
1602out=fopen("/tmp/vsign.der","w");
1603fwrite(p,1,llen,out);
1604fclose(out);
1605}
1606#endif
1607
1608 if ((llen+ctype_num+2+1) != n)
1609 {
1610 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1611 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH);
1612 goto err;
1613 }
1614
1615 for (nc=0; nc<llen; )
1616 {
1617 n2s(p,l);
1618 if ((l+nc+2) > llen)
1619 {
1620 if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1621 goto cont; /* netscape bugs */
1622 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1623 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG);
1624 goto err;
1625 }
1626
1627 q=p;
1628
1629 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL)
1630 {
1631 /* If netscape tolerance is on, ignore errors */
1632 if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG)
1633 goto cont;
1634 else
1635 {
1636 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1637 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB);
1638 goto err;
1639 }
1640 }
1641
1642 if (q != (p+l))
1643 {
1644 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1645 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH);
1646 goto err;
1647 }
1648 if (!sk_X509_NAME_push(ca_sk,xn))
1649 {
1650 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
1651 goto err;
1652 }
1653
1654 p+=l;
1655 nc+=l+2;
1656 }
1657
1658 if (0)
1659 {
1660cont:
1661 ERR_clear_error();
1662 }
1663
1664 /* we should setup a certificate to return.... */
1665 s->s3->tmp.cert_req=1;
1666 s->s3->tmp.ctype_num=ctype_num;
1667 if (s->s3->tmp.ca_names != NULL)
1668 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
1669 s->s3->tmp.ca_names=ca_sk;
1670 ca_sk=NULL;
1671
1672 ret=1;
1673err:
1674 if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free);
1675 return(ret);
1676 }
1677
1678static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
1679 {
1680 return(X509_NAME_cmp(*a,*b));
1681 }
1682#ifndef OPENSSL_NO_TLSEXT
1683int ssl3_get_new_session_ticket(SSL *s)
1684 {
1685 int ok,al,ret=0, ticklen;
1686 long n;
1687 const unsigned char *p;
1688 unsigned char *d;
1689
1690 n=s->method->ssl_get_message(s,
1691 SSL3_ST_CR_SESSION_TICKET_A,
1692 SSL3_ST_CR_SESSION_TICKET_B,
1693 -1,
1694 16384,
1695 &ok);
1696
1697 if (!ok)
1698 return((int)n);
1699
1700 if (s->s3->tmp.message_type == SSL3_MT_FINISHED)
1701 {
1702 s->s3->tmp.reuse_message=1;
1703 return(1);
1704 }
1705 if (s->s3->tmp.message_type != SSL3_MT_NEWSESSION_TICKET)
1706 {
1707 al=SSL_AD_UNEXPECTED_MESSAGE;
1708 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_BAD_MESSAGE_TYPE);
1709 goto f_err;
1710 }
1711 if (n < 6)
1712 {
1713 /* need at least ticket_lifetime_hint + ticket length */
1714 al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
1715 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
1716 goto f_err;
1717 }
1718
1719 p=d=(unsigned char *)s->init_msg;
1720 n2l(p, s->session->tlsext_tick_lifetime_hint);
1721 n2s(p, ticklen);
1722 /* ticket_lifetime_hint + ticket_length + ticket */
1723 if (ticklen + 6 != n)
1724 {
1725 al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
1726 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
1727 goto f_err;
1728 }
1729 if (s->session->tlsext_tick)
1730 {
1731 OPENSSL_free(s->session->tlsext_tick);
1732 s->session->tlsext_ticklen = 0;
1733 }
1734 s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1735 if (!s->session->tlsext_tick)
1736 {
1737 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,ERR_R_MALLOC_FAILURE);
1738 goto err;
1739 }
1740 memcpy(s->session->tlsext_tick, p, ticklen);
1741 s->session->tlsext_ticklen = ticklen;
1742 /* There are two ways to detect a resumed ticket sesion.
1743 * One is to set an appropriate session ID and then the server
1744 * must return a match in ServerHello. This allows the normal
1745 * client session ID matching to work and we know much
1746 * earlier that the ticket has been accepted.
1747 *
1748 * The other way is to set zero length session ID when the
1749 * ticket is presented and rely on the handshake to determine
1750 * session resumption.
1751 *
1752 * We choose the former approach because this fits in with
1753 * assumptions elsewhere in OpenSSL. The session ID is set
1754 * to the SHA256 (or SHA1 is SHA256 is disabled) hash of the
1755 * ticket.
1756 */
1757 EVP_Digest(p, ticklen,
1758 s->session->session_id, &s->session->session_id_length,
1759#ifndef OPENSSL_NO_SHA256
1760 EVP_sha256(), NULL);
1761#else
1762 EVP_sha1(), NULL);
1763#endif
1764 ret=1;
1765 return(ret);
1766f_err:
1767 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1768err:
1769 return(-1);
1770 }
1771
1772int ssl3_get_cert_status(SSL *s)
1773 {
1774 int ok, al;
1775 unsigned long resplen;
1776 long n;
1777 const unsigned char *p;
1778
1779 n=s->method->ssl_get_message(s,
1780 SSL3_ST_CR_CERT_STATUS_A,
1781 SSL3_ST_CR_CERT_STATUS_B,
1782 SSL3_MT_CERTIFICATE_STATUS,
1783 16384,
1784 &ok);
1785
1786 if (!ok) return((int)n);
1787 if (n < 4)
1788 {
1789 /* need at least status type + length */
1790 al = SSL_AD_DECODE_ERROR;
1791 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
1792 goto f_err;
1793 }
1794 p = (unsigned char *)s->init_msg;
1795 if (*p++ != TLSEXT_STATUSTYPE_ocsp)
1796 {
1797 al = SSL_AD_DECODE_ERROR;
1798 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_UNSUPPORTED_STATUS_TYPE);
1799 goto f_err;
1800 }
1801 n2l3(p, resplen);
1802 if (resplen + 4 != (unsigned long)n)
1803 {
1804 al = SSL_AD_DECODE_ERROR;
1805 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
1806 goto f_err;
1807 }
1808 if (s->tlsext_ocsp_resp)
1809 OPENSSL_free(s->tlsext_ocsp_resp);
1810 s->tlsext_ocsp_resp = BUF_memdup(p, resplen);
1811 if (!s->tlsext_ocsp_resp)
1812 {
1813 al = SSL_AD_INTERNAL_ERROR;
1814 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
1815 goto f_err;
1816 }
1817 s->tlsext_ocsp_resplen = resplen;
1818 if (s->ctx->tlsext_status_cb)
1819 {
1820 int ret;
1821 ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1822 if (ret == 0)
1823 {
1824 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1825 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_INVALID_STATUS_RESPONSE);
1826 goto f_err;
1827 }
1828 if (ret < 0)
1829 {
1830 al = SSL_AD_INTERNAL_ERROR;
1831 SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
1832 goto f_err;
1833 }
1834 }
1835 return 1;
1836f_err:
1837 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1838 return(-1);
1839 }
1840#endif
1841
1842int ssl3_get_server_done(SSL *s)
1843 {
1844 int ok,ret=0;
1845 long n;
1846
1847 n=s->method->ssl_get_message(s,
1848 SSL3_ST_CR_SRVR_DONE_A,
1849 SSL3_ST_CR_SRVR_DONE_B,
1850 SSL3_MT_SERVER_DONE,
1851 30, /* should be very small, like 0 :-) */
1852 &ok);
1853
1854 if (!ok) return((int)n);
1855 if (n > 0)
1856 {
1857 /* should contain no data */
1858 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1859 SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH);
1860 return -1;
1861 }
1862 ret=1;
1863 return(ret);
1864 }
1865
1866
1867int ssl3_send_client_key_exchange(SSL *s)
1868 {
1869 unsigned char *p,*d;
1870 int n;
1871 unsigned long l;
1872#ifndef OPENSSL_NO_RSA
1873 unsigned char *q;
1874 EVP_PKEY *pkey=NULL;
1875#endif
1876#ifndef OPENSSL_NO_KRB5
1877 KSSL_ERR kssl_err;
1878#endif /* OPENSSL_NO_KRB5 */
1879#ifndef OPENSSL_NO_ECDH
1880 EC_KEY *clnt_ecdh = NULL;
1881 const EC_POINT *srvr_ecpoint = NULL;
1882 EVP_PKEY *srvr_pub_pkey = NULL;
1883 unsigned char *encodedPoint = NULL;
1884 int encoded_pt_len = 0;
1885 BN_CTX * bn_ctx = NULL;
1886#endif
1887
1888 if (s->state == SSL3_ST_CW_KEY_EXCH_A)
1889 {
1890 d=(unsigned char *)s->init_buf->data;
1891 p= &(d[4]);
1892
1893 l=s->s3->tmp.new_cipher->algorithms;
1894
1895 /* Fool emacs indentation */
1896 if (0) {}
1897#ifndef OPENSSL_NO_RSA
1898 else if (l & SSL_kRSA)
1899 {
1900 RSA *rsa;
1901 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1902
1903 if (s->session->sess_cert->peer_rsa_tmp != NULL)
1904 rsa=s->session->sess_cert->peer_rsa_tmp;
1905 else
1906 {
1907 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1908 if ((pkey == NULL) ||
1909 (pkey->type != EVP_PKEY_RSA) ||
1910 (pkey->pkey.rsa == NULL))
1911 {
1912 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1913 goto err;
1914 }
1915 rsa=pkey->pkey.rsa;
1916 EVP_PKEY_free(pkey);
1917 }
1918
1919 tmp_buf[0]=s->client_version>>8;
1920 tmp_buf[1]=s->client_version&0xff;
1921 if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
1922 goto err;
1923
1924 s->session->master_key_length=sizeof tmp_buf;
1925
1926 q=p;
1927 /* Fix buf for TLS and beyond */
1928 if (s->version > SSL3_VERSION)
1929 p+=2;
1930 n=RSA_public_encrypt(sizeof tmp_buf,
1931 tmp_buf,p,rsa,RSA_PKCS1_PADDING);
1932#ifdef PKCS1_CHECK
1933 if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
1934 if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70;
1935#endif
1936 if (n <= 0)
1937 {
1938 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT);
1939 goto err;
1940 }
1941
1942 /* Fix buf for TLS and beyond */
1943 if (s->version > SSL3_VERSION)
1944 {
1945 s2n(n,q);
1946 n+=2;
1947 }
1948
1949 s->session->master_key_length=
1950 s->method->ssl3_enc->generate_master_secret(s,
1951 s->session->master_key,
1952 tmp_buf,sizeof tmp_buf);
1953 OPENSSL_cleanse(tmp_buf,sizeof tmp_buf);
1954 }
1955#endif
1956#ifndef OPENSSL_NO_KRB5
1957 else if (l & SSL_kKRB5)
1958 {
1959 krb5_error_code krb5rc;
1960 KSSL_CTX *kssl_ctx = s->kssl_ctx;
1961 /* krb5_data krb5_ap_req; */
1962 krb5_data *enc_ticket;
1963 krb5_data authenticator, *authp = NULL;
1964 EVP_CIPHER_CTX ciph_ctx;
1965 EVP_CIPHER *enc = NULL;
1966 unsigned char iv[EVP_MAX_IV_LENGTH];
1967 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1968 unsigned char epms[SSL_MAX_MASTER_KEY_LENGTH
1969 + EVP_MAX_IV_LENGTH];
1970 int padl, outl = sizeof(epms);
1971
1972 EVP_CIPHER_CTX_init(&ciph_ctx);
1973
1974#ifdef KSSL_DEBUG
1975 printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
1976 l, SSL_kKRB5);
1977#endif /* KSSL_DEBUG */
1978
1979 authp = NULL;
1980#ifdef KRB5SENDAUTH
1981 if (KRB5SENDAUTH) authp = &authenticator;
1982#endif /* KRB5SENDAUTH */
1983
1984 krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
1985 &kssl_err);
1986 enc = kssl_map_enc(kssl_ctx->enctype);
1987 if (enc == NULL)
1988 goto err;
1989#ifdef KSSL_DEBUG
1990 {
1991 printf("kssl_cget_tkt rtn %d\n", krb5rc);
1992 if (krb5rc && kssl_err.text)
1993 printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
1994 }
1995#endif /* KSSL_DEBUG */
1996
1997 if (krb5rc)
1998 {
1999 ssl3_send_alert(s,SSL3_AL_FATAL,
2000 SSL_AD_HANDSHAKE_FAILURE);
2001 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2002 kssl_err.reason);
2003 goto err;
2004 }
2005
2006 /* 20010406 VRS - Earlier versions used KRB5 AP_REQ
2007 ** in place of RFC 2712 KerberosWrapper, as in:
2008 **
2009 ** Send ticket (copy to *p, set n = length)
2010 ** n = krb5_ap_req.length;
2011 ** memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
2012 ** if (krb5_ap_req.data)
2013 ** kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
2014 **
2015 ** Now using real RFC 2712 KerberosWrapper
2016 ** (Thanks to Simon Wilkinson <sxw@sxw.org.uk>)
2017 ** Note: 2712 "opaque" types are here replaced
2018 ** with a 2-byte length followed by the value.
2019 ** Example:
2020 ** KerberosWrapper= xx xx asn1ticket 0 0 xx xx encpms
2021 ** Where "xx xx" = length bytes. Shown here with
2022 ** optional authenticator omitted.
2023 */
2024
2025 /* KerberosWrapper.Ticket */
2026 s2n(enc_ticket->length,p);
2027 memcpy(p, enc_ticket->data, enc_ticket->length);
2028 p+= enc_ticket->length;
2029 n = enc_ticket->length + 2;
2030
2031 /* KerberosWrapper.Authenticator */
2032 if (authp && authp->length)
2033 {
2034 s2n(authp->length,p);
2035 memcpy(p, authp->data, authp->length);
2036 p+= authp->length;
2037 n+= authp->length + 2;
2038
2039 free(authp->data);
2040 authp->data = NULL;
2041 authp->length = 0;
2042 }
2043 else
2044 {
2045 s2n(0,p);/* null authenticator length */
2046 n+=2;
2047 }
2048
2049 tmp_buf[0]=s->client_version>>8;
2050 tmp_buf[1]=s->client_version&0xff;
2051 if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
2052 goto err;
2053
2054 /* 20010420 VRS. Tried it this way; failed.
2055 ** EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
2056 ** EVP_CIPHER_CTX_set_key_length(&ciph_ctx,
2057 ** kssl_ctx->length);
2058 ** EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
2059 */
2060
2061 memset(iv, 0, sizeof iv); /* per RFC 1510 */
2062 EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
2063 kssl_ctx->key,iv);
2064 EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
2065 sizeof tmp_buf);
2066 EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
2067 outl += padl;
2068 if (outl > sizeof epms)
2069 {
2070 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2071 goto err;
2072 }
2073 EVP_CIPHER_CTX_cleanup(&ciph_ctx);
2074
2075 /* KerberosWrapper.EncryptedPreMasterSecret */
2076 s2n(outl,p);
2077 memcpy(p, epms, outl);
2078 p+=outl;
2079 n+=outl + 2;
2080
2081 s->session->master_key_length=
2082 s->method->ssl3_enc->generate_master_secret(s,
2083 s->session->master_key,
2084 tmp_buf, sizeof tmp_buf);
2085
2086 OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
2087 OPENSSL_cleanse(epms, outl);
2088 }
2089#endif
2090#ifndef OPENSSL_NO_DH
2091 else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2092 {
2093 DH *dh_srvr,*dh_clnt;
2094
2095 if (s->session->sess_cert == NULL)
2096 {
2097 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
2098 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
2099 goto err;
2100 }
2101
2102 if (s->session->sess_cert->peer_dh_tmp != NULL)
2103 dh_srvr=s->session->sess_cert->peer_dh_tmp;
2104 else
2105 {
2106 /* we get them from the cert */
2107 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
2108 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
2109 goto err;
2110 }
2111
2112 /* generate a new random key */
2113 if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL)
2114 {
2115 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
2116 goto err;
2117 }
2118 if (!DH_generate_key(dh_clnt))
2119 {
2120 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
2121 goto err;
2122 }
2123
2124 /* use the 'p' output buffer for the DH key, but
2125 * make sure to clear it out afterwards */
2126
2127 n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt);
2128
2129 if (n <= 0)
2130 {
2131 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
2132 goto err;
2133 }
2134
2135 /* generate master key from the result */
2136 s->session->master_key_length=
2137 s->method->ssl3_enc->generate_master_secret(s,
2138 s->session->master_key,p,n);
2139 /* clean up */
2140 memset(p,0,n);
2141
2142 /* send off the data */
2143 n=BN_num_bytes(dh_clnt->pub_key);
2144 s2n(n,p);
2145 BN_bn2bin(dh_clnt->pub_key,p);
2146 n+=2;
2147
2148 DH_free(dh_clnt);
2149
2150 /* perhaps clean things up a bit EAY EAY EAY EAY*/
2151 }
2152#endif
2153
2154#ifndef OPENSSL_NO_ECDH
2155 else if ((l & SSL_kECDH) || (l & SSL_kECDHE))
2156 {
2157 const EC_GROUP *srvr_group = NULL;
2158 EC_KEY *tkey;
2159 int ecdh_clnt_cert = 0;
2160 int field_size = 0;
2161
2162 /* Did we send out the client's
2163 * ECDH share for use in premaster
2164 * computation as part of client certificate?
2165 * If so, set ecdh_clnt_cert to 1.
2166 */
2167 if ((l & SSL_kECDH) && (s->cert != NULL))
2168 {
2169 /* XXX: For now, we do not support client
2170 * authentication using ECDH certificates.
2171 * To add such support, one needs to add
2172 * code that checks for appropriate
2173 * conditions and sets ecdh_clnt_cert to 1.
2174 * For example, the cert have an ECC
2175 * key on the same curve as the server's
2176 * and the key should be authorized for
2177 * key agreement.
2178 *
2179 * One also needs to add code in ssl3_connect
2180 * to skip sending the certificate verify
2181 * message.
2182 *
2183 * if ((s->cert->key->privatekey != NULL) &&
2184 * (s->cert->key->privatekey->type ==
2185 * EVP_PKEY_EC) && ...)
2186 * ecdh_clnt_cert = 1;
2187 */
2188 }
2189
2190 if (s->session->sess_cert->peer_ecdh_tmp != NULL)
2191 {
2192 tkey = s->session->sess_cert->peer_ecdh_tmp;
2193 }
2194 else
2195 {
2196 /* Get the Server Public Key from Cert */
2197 srvr_pub_pkey = X509_get_pubkey(s->session-> \
2198 sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
2199 if ((srvr_pub_pkey == NULL) ||
2200 (srvr_pub_pkey->type != EVP_PKEY_EC) ||
2201 (srvr_pub_pkey->pkey.ec == NULL))
2202 {
2203 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2204 ERR_R_INTERNAL_ERROR);
2205 goto err;
2206 }
2207
2208 tkey = srvr_pub_pkey->pkey.ec;
2209 }
2210
2211 srvr_group = EC_KEY_get0_group(tkey);
2212 srvr_ecpoint = EC_KEY_get0_public_key(tkey);
2213
2214 if ((srvr_group == NULL) || (srvr_ecpoint == NULL))
2215 {
2216 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2217 ERR_R_INTERNAL_ERROR);
2218 goto err;
2219 }
2220
2221 if ((clnt_ecdh=EC_KEY_new()) == NULL)
2222 {
2223 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
2224 goto err;
2225 }
2226
2227 if (!EC_KEY_set_group(clnt_ecdh, srvr_group))
2228 {
2229 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
2230 goto err;
2231 }
2232 if (ecdh_clnt_cert)
2233 {
2234 /* Reuse key info from our certificate
2235 * We only need our private key to perform
2236 * the ECDH computation.
2237 */
2238 const BIGNUM *priv_key;
2239 tkey = s->cert->key->privatekey->pkey.ec;
2240 priv_key = EC_KEY_get0_private_key(tkey);
2241 if (priv_key == NULL)
2242 {
2243 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
2244 goto err;
2245 }
2246 if (!EC_KEY_set_private_key(clnt_ecdh, priv_key))
2247 {
2248 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
2249 goto err;
2250 }
2251 }
2252 else
2253 {
2254 /* Generate a new ECDH key pair */
2255 if (!(EC_KEY_generate_key(clnt_ecdh)))
2256 {
2257 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
2258 goto err;
2259 }
2260 }
2261
2262 /* use the 'p' output buffer for the ECDH key, but
2263 * make sure to clear it out afterwards
2264 */
2265
2266 field_size = EC_GROUP_get_degree(srvr_group);
2267 if (field_size <= 0)
2268 {
2269 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2270 ERR_R_ECDH_LIB);
2271 goto err;
2272 }
2273 n=ECDH_compute_key(p, (field_size+7)/8, srvr_ecpoint, clnt_ecdh, NULL);
2274 if (n <= 0)
2275 {
2276 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2277 ERR_R_ECDH_LIB);
2278 goto err;
2279 }
2280
2281 /* generate master key from the result */
2282 s->session->master_key_length = s->method->ssl3_enc \
2283 -> generate_master_secret(s,
2284 s->session->master_key,
2285 p, n);
2286
2287 memset(p, 0, n); /* clean up */
2288
2289 if (ecdh_clnt_cert)
2290 {
2291 /* Send empty client key exch message */
2292 n = 0;
2293 }
2294 else
2295 {
2296 /* First check the size of encoding and
2297 * allocate memory accordingly.
2298 */
2299 encoded_pt_len =
2300 EC_POINT_point2oct(srvr_group,
2301 EC_KEY_get0_public_key(clnt_ecdh),
2302 POINT_CONVERSION_UNCOMPRESSED,
2303 NULL, 0, NULL);
2304
2305 encodedPoint = (unsigned char *)
2306 OPENSSL_malloc(encoded_pt_len *
2307 sizeof(unsigned char));
2308 bn_ctx = BN_CTX_new();
2309 if ((encodedPoint == NULL) ||
2310 (bn_ctx == NULL))
2311 {
2312 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
2313 goto err;
2314 }
2315
2316 /* Encode the public key */
2317 n = EC_POINT_point2oct(srvr_group,
2318 EC_KEY_get0_public_key(clnt_ecdh),
2319 POINT_CONVERSION_UNCOMPRESSED,
2320 encodedPoint, encoded_pt_len, bn_ctx);
2321
2322 *p = n; /* length of encoded point */
2323 /* Encoded point will be copied here */
2324 p += 1;
2325 /* copy the point */
2326 memcpy((unsigned char *)p, encodedPoint, n);
2327 /* increment n to account for length field */
2328 n += 1;
2329 }
2330
2331 /* Free allocated memory */
2332 BN_CTX_free(bn_ctx);
2333 if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
2334 if (clnt_ecdh != NULL)
2335 EC_KEY_free(clnt_ecdh);
2336 EVP_PKEY_free(srvr_pub_pkey);
2337 }
2338#endif /* !OPENSSL_NO_ECDH */
2339 else
2340 {
2341 ssl3_send_alert(s, SSL3_AL_FATAL,
2342 SSL_AD_HANDSHAKE_FAILURE);
2343 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2344 ERR_R_INTERNAL_ERROR);
2345 goto err;
2346 }
2347
2348 *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE;
2349 l2n3(n,d);
2350
2351 s->state=SSL3_ST_CW_KEY_EXCH_B;
2352 /* number of bytes to write */
2353 s->init_num=n+4;
2354 s->init_off=0;
2355 }
2356
2357 /* SSL3_ST_CW_KEY_EXCH_B */
2358 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2359err:
2360#ifndef OPENSSL_NO_ECDH
2361 BN_CTX_free(bn_ctx);
2362 if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
2363 if (clnt_ecdh != NULL)
2364 EC_KEY_free(clnt_ecdh);
2365 EVP_PKEY_free(srvr_pub_pkey);
2366#endif
2367 return(-1);
2368 }
2369
2370int ssl3_send_client_verify(SSL *s)
2371 {
2372 unsigned char *p,*d;
2373 unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
2374 EVP_PKEY *pkey;
2375#ifndef OPENSSL_NO_RSA
2376 unsigned u=0;
2377#endif
2378 unsigned long n;
2379#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
2380 int j;
2381#endif
2382
2383 if (s->state == SSL3_ST_CW_CERT_VRFY_A)
2384 {
2385 d=(unsigned char *)s->init_buf->data;
2386 p= &(d[4]);
2387 pkey=s->cert->key->privatekey;
2388
2389 s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2),
2390 &(data[MD5_DIGEST_LENGTH]));
2391
2392#ifndef OPENSSL_NO_RSA
2393 if (pkey->type == EVP_PKEY_RSA)
2394 {
2395 s->method->ssl3_enc->cert_verify_mac(s,
2396 &(s->s3->finish_dgst1),&(data[0]));
2397 if (RSA_sign(NID_md5_sha1, data,
2398 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
2399 &(p[2]), &u, pkey->pkey.rsa) <= 0 )
2400 {
2401 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
2402 goto err;
2403 }
2404 s2n(u,p);
2405 n=u+2;
2406 }
2407 else
2408#endif
2409#ifndef OPENSSL_NO_DSA
2410 if (pkey->type == EVP_PKEY_DSA)
2411 {
2412 if (!DSA_sign(pkey->save_type,
2413 &(data[MD5_DIGEST_LENGTH]),
2414 SHA_DIGEST_LENGTH,&(p[2]),
2415 (unsigned int *)&j,pkey->pkey.dsa))
2416 {
2417 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB);
2418 goto err;
2419 }
2420 s2n(j,p);
2421 n=j+2;
2422 }
2423 else
2424#endif
2425#ifndef OPENSSL_NO_ECDSA
2426 if (pkey->type == EVP_PKEY_EC)
2427 {
2428 if (!ECDSA_sign(pkey->save_type,
2429 &(data[MD5_DIGEST_LENGTH]),
2430 SHA_DIGEST_LENGTH,&(p[2]),
2431 (unsigned int *)&j,pkey->pkey.ec))
2432 {
2433 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
2434 ERR_R_ECDSA_LIB);
2435 goto err;
2436 }
2437 s2n(j,p);
2438 n=j+2;
2439 }
2440 else
2441#endif
2442 {
2443 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
2444 goto err;
2445 }
2446 *(d++)=SSL3_MT_CERTIFICATE_VERIFY;
2447 l2n3(n,d);
2448
2449 s->state=SSL3_ST_CW_CERT_VRFY_B;
2450 s->init_num=(int)n+4;
2451 s->init_off=0;
2452 }
2453 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2454err:
2455 return(-1);
2456 }
2457
2458int ssl3_send_client_certificate(SSL *s)
2459 {
2460 X509 *x509=NULL;
2461 EVP_PKEY *pkey=NULL;
2462 int i;
2463 unsigned long l;
2464
2465 if (s->state == SSL3_ST_CW_CERT_A)
2466 {
2467 if ((s->cert == NULL) ||
2468 (s->cert->key->x509 == NULL) ||
2469 (s->cert->key->privatekey == NULL))
2470 s->state=SSL3_ST_CW_CERT_B;
2471 else
2472 s->state=SSL3_ST_CW_CERT_C;
2473 }
2474
2475 /* We need to get a client cert */
2476 if (s->state == SSL3_ST_CW_CERT_B)
2477 {
2478 /* If we get an error, we need to
2479 * ssl->rwstate=SSL_X509_LOOKUP; return(-1);
2480 * We then get retied later */
2481 i=0;
2482 i = ssl_do_client_cert_cb(s, &x509, &pkey);
2483 if (i < 0)
2484 {
2485 s->rwstate=SSL_X509_LOOKUP;
2486 return(-1);
2487 }
2488 s->rwstate=SSL_NOTHING;
2489 if ((i == 1) && (pkey != NULL) && (x509 != NULL))
2490 {
2491 s->state=SSL3_ST_CW_CERT_B;
2492 if ( !SSL_use_certificate(s,x509) ||
2493 !SSL_use_PrivateKey(s,pkey))
2494 i=0;
2495 }
2496 else if (i == 1)
2497 {
2498 i=0;
2499 SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
2500 }
2501
2502 if (x509 != NULL) X509_free(x509);
2503 if (pkey != NULL) EVP_PKEY_free(pkey);
2504 if (i == 0)
2505 {
2506 if (s->version == SSL3_VERSION)
2507 {
2508 s->s3->tmp.cert_req=0;
2509 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE);
2510 return(1);
2511 }
2512 else
2513 {
2514 s->s3->tmp.cert_req=2;
2515 }
2516 }
2517
2518 /* Ok, we have a cert */
2519 s->state=SSL3_ST_CW_CERT_C;
2520 }
2521
2522 if (s->state == SSL3_ST_CW_CERT_C)
2523 {
2524 s->state=SSL3_ST_CW_CERT_D;
2525 l=ssl3_output_cert_chain(s,
2526 (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509);
2527 s->init_num=(int)l;
2528 s->init_off=0;
2529 }
2530 /* SSL3_ST_CW_CERT_D */
2531 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
2532 }
2533
2534#define has_bits(i,m) (((i)&(m)) == (m))
2535
2536int ssl3_check_cert_and_algorithm(SSL *s)
2537 {
2538 int i,idx;
2539 long algs;
2540 EVP_PKEY *pkey=NULL;
2541 SESS_CERT *sc;
2542#ifndef OPENSSL_NO_RSA
2543 RSA *rsa;
2544#endif
2545#ifndef OPENSSL_NO_DH
2546 DH *dh;
2547#endif
2548
2549 sc=s->session->sess_cert;
2550
2551 algs=s->s3->tmp.new_cipher->algorithms;
2552
2553 /* we don't have a certificate */
2554 if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
2555 return(1);
2556
2557 if (sc == NULL)
2558 {
2559 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
2560 goto err;
2561 }
2562
2563#ifndef OPENSSL_NO_RSA
2564 rsa=s->session->sess_cert->peer_rsa_tmp;
2565#endif
2566#ifndef OPENSSL_NO_DH
2567 dh=s->session->sess_cert->peer_dh_tmp;
2568#endif
2569
2570 /* This is the passed certificate */
2571
2572 idx=sc->peer_cert_type;
2573#ifndef OPENSSL_NO_ECDH
2574 if (idx == SSL_PKEY_ECC)
2575 {
2576 if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
2577 s->s3->tmp.new_cipher) == 0)
2578 { /* check failed */
2579 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
2580 goto f_err;
2581 }
2582 else
2583 {
2584 return 1;
2585 }
2586 }
2587#endif
2588 pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
2589 i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2590 EVP_PKEY_free(pkey);
2591
2592
2593 /* Check that we have a certificate if we require one */
2594 if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
2595 {
2596 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
2597 goto f_err;
2598 }
2599#ifndef OPENSSL_NO_DSA
2600 else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
2601 {
2602 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
2603 goto f_err;
2604 }
2605#endif
2606#ifndef OPENSSL_NO_RSA
2607 if ((algs & SSL_kRSA) &&
2608 !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
2609 {
2610 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
2611 goto f_err;
2612 }
2613#endif
2614#ifndef OPENSSL_NO_DH
2615 if ((algs & SSL_kEDH) &&
2616 !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
2617 {
2618 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
2619 goto f_err;
2620 }
2621 else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
2622 {
2623 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
2624 goto f_err;
2625 }
2626#ifndef OPENSSL_NO_DSA
2627 else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
2628 {
2629 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
2630 goto f_err;
2631 }
2632#endif
2633#endif
2634
2635 if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
2636 {
2637#ifndef OPENSSL_NO_RSA
2638 if (algs & SSL_kRSA)
2639 {
2640 if (rsa == NULL
2641 || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2642 {
2643 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
2644 goto f_err;
2645 }
2646 }
2647 else
2648#endif
2649#ifndef OPENSSL_NO_DH
2650 if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2651 {
2652 if (dh == NULL
2653 || DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2654 {
2655 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
2656 goto f_err;
2657 }
2658 }
2659 else
2660#endif
2661 {
2662 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
2663 goto f_err;
2664 }
2665 }
2666 return(1);
2667f_err:
2668 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
2669err:
2670 return(0);
2671 }
2672
2673
2674#ifndef OPENSSL_NO_ECDH
2675/* This is the complement of nid2curve_id in s3_srvr.c. */
2676static int curve_id2nid(int curve_id)
2677{
2678 /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
2679 * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
2680 static int nid_list[26] =
2681 {
2682 0,
2683 NID_sect163k1, /* sect163k1 (1) */
2684 NID_sect163r1, /* sect163r1 (2) */
2685 NID_sect163r2, /* sect163r2 (3) */
2686 NID_sect193r1, /* sect193r1 (4) */
2687 NID_sect193r2, /* sect193r2 (5) */
2688 NID_sect233k1, /* sect233k1 (6) */
2689 NID_sect233r1, /* sect233r1 (7) */
2690 NID_sect239k1, /* sect239k1 (8) */
2691 NID_sect283k1, /* sect283k1 (9) */
2692 NID_sect283r1, /* sect283r1 (10) */
2693 NID_sect409k1, /* sect409k1 (11) */
2694 NID_sect409r1, /* sect409r1 (12) */
2695 NID_sect571k1, /* sect571k1 (13) */
2696 NID_sect571r1, /* sect571r1 (14) */
2697 NID_secp160k1, /* secp160k1 (15) */
2698 NID_secp160r1, /* secp160r1 (16) */
2699 NID_secp160r2, /* secp160r2 (17) */
2700 NID_secp192k1, /* secp192k1 (18) */
2701 NID_X9_62_prime192v1, /* secp192r1 (19) */
2702 NID_secp224k1, /* secp224k1 (20) */
2703 NID_secp224r1, /* secp224r1 (21) */
2704 NID_secp256k1, /* secp256k1 (22) */
2705 NID_X9_62_prime256v1, /* secp256r1 (23) */
2706 NID_secp384r1, /* secp384r1 (24) */
2707 NID_secp521r1 /* secp521r1 (25) */
2708 };
2709
2710 if ((curve_id < 1) || (curve_id > 25)) return 0;
2711
2712 return nid_list[curve_id];
2713}
2714#endif
2715
2716/* Check to see if handshake is full or resumed. Usually this is just a
2717 * case of checking to see if a cache hit has occurred. In the case of
2718 * session tickets we have to check the next message to be sure.
2719 */
2720
2721#ifndef OPENSSL_NO_TLSEXT
2722int ssl3_check_finished(SSL *s)
2723 {
2724 int ok;
2725 long n;
2726 /* If we have no ticket or session ID is non-zero length (a match of
2727 * a non-zero session length would never reach here) it cannot be a
2728 * resumed session.
2729 */
2730 if (!s->session->tlsext_tick || s->session->session_id_length)
2731 return 1;
2732 /* this function is called when we really expect a Certificate
2733 * message, so permit appropriate message length */
2734 n=s->method->ssl_get_message(s,
2735 SSL3_ST_CR_CERT_A,
2736 SSL3_ST_CR_CERT_B,
2737 -1,
2738 s->max_cert_list,
2739 &ok);
2740 if (!ok) return((int)n);
2741 s->s3->tmp.reuse_message = 1;
2742 if ((s->s3->tmp.message_type == SSL3_MT_FINISHED)
2743 || (s->s3->tmp.message_type == SSL3_MT_NEWSESSION_TICKET))
2744 return 2;
2745
2746 return 1;
2747 }
2748#endif
2749
2750int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey)
2751 {
2752 int i = 0;
2753#ifndef OPENSSL_NO_ENGINE
2754 if (s->ctx->client_cert_engine)
2755 {
2756 i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s,
2757 SSL_get_client_CA_list(s),
2758 px509, ppkey, NULL, NULL, NULL);
2759 if (i != 0)
2760 return i;
2761 }
2762#endif
2763 if (s->ctx->client_cert_cb)
2764 i = s->ctx->client_cert_cb(s,px509,ppkey);
2765 return i;
2766 }
|