1/* ssl/s3_clnt.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 112#include <stdio.h> 113#include <openssl/buffer.h> 114#include <openssl/rand.h> 115#include <openssl/objects.h> 116#include <openssl/md5.h> 117#include <openssl/sha.h> 118#include <openssl/evp.h> 119#include "ssl_locl.h" 120#include "cryptlib.h" 121 122static SSL_METHOD *ssl3_get_client_method(int ver); 123static int ssl3_client_hello(SSL *s); 124static int ssl3_get_server_hello(SSL *s); 125static int ssl3_get_certificate_request(SSL *s); 126static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b); 127static int ssl3_get_server_done(SSL *s); 128static int ssl3_send_client_verify(SSL *s); 129static int ssl3_send_client_certificate(SSL *s); 130static int ssl3_send_client_key_exchange(SSL *s); 131static int ssl3_get_key_exchange(SSL *s); 132static int ssl3_get_server_certificate(SSL *s); 133static int ssl3_check_cert_and_algorithm(SSL *s); 134static SSL_METHOD *ssl3_get_client_method(int ver) 135 { 136 if (ver == SSL3_VERSION) 137 return(SSLv3_client_method()); 138 else 139 return(NULL); 140 } 141 142SSL_METHOD *SSLv3_client_method(void) 143 { 144 static int init=1; 145 static SSL_METHOD SSLv3_client_data; 146 147 if (init) 148 { 149 init=0; 150 memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(), 151 sizeof(SSL_METHOD)); 152 SSLv3_client_data.ssl_connect=ssl3_connect; 153 SSLv3_client_data.get_ssl_method=ssl3_get_client_method; 154 } 155 return(&SSLv3_client_data); 156 } 157 158int ssl3_connect(SSL *s) 159 { 160 BUF_MEM *buf; 161 unsigned long Time=time(NULL),l; 162 long num1; 163 void (*cb)()=NULL; 164 int ret= -1; 165 int new_state,state,skip=0;; 166 167 RAND_add(&Time,sizeof(Time),0); 168 ERR_clear_error(); 169 clear_sys_error(); 170 171 if (s->info_callback != NULL) 172 cb=s->info_callback; 173 else if (s->ctx->info_callback != NULL) 174 cb=s->ctx->info_callback; 175 176 s->in_handshake++; 177 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); 178 179 for (;;) 180 { 181 state=s->state; 182 183 switch(s->state) 184 { 185 case SSL_ST_RENEGOTIATE: 186 s->new_session=1; 187 s->state=SSL_ST_CONNECT; 188 s->ctx->stats.sess_connect_renegotiate++; 189 /* break */ 190 case SSL_ST_BEFORE: 191 case SSL_ST_CONNECT: 192 case SSL_ST_BEFORE|SSL_ST_CONNECT: 193 case SSL_ST_OK|SSL_ST_CONNECT: 194 195 s->server=0; 196 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1); 197 198 if ((s->version & 0xff00 ) != 0x0300) 199 { 200 SSLerr(SSL_F_SSL3_CONNECT, SSL_R_INTERNAL_ERROR); 201 ret = -1; 202 goto end; 203 } 204 205 /* s->version=SSL3_VERSION; */ 206 s->type=SSL_ST_CONNECT; 207 208 if (s->init_buf == NULL) 209 { 210 if ((buf=BUF_MEM_new()) == NULL) 211 { 212 ret= -1; 213 goto end; 214 } 215 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH)) 216 { 217 ret= -1; 218 goto end; 219 } 220 s->init_buf=buf; 221 } 222 223 if (!ssl3_setup_buffers(s)) { ret= -1; goto end; } 224 225 /* setup buffing BIO */ 226 if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; } 227 228 /* don't push the buffering BIO quite yet */ 229 230 ssl3_init_finished_mac(s); 231 232 s->state=SSL3_ST_CW_CLNT_HELLO_A; 233 s->ctx->stats.sess_connect++; 234 s->init_num=0; 235 break; 236 237 case SSL3_ST_CW_CLNT_HELLO_A: 238 case SSL3_ST_CW_CLNT_HELLO_B: 239 240 s->shutdown=0; 241 ret=ssl3_client_hello(s); 242 if (ret <= 0) goto end; 243 s->state=SSL3_ST_CR_SRVR_HELLO_A; 244 s->init_num=0; 245 246 /* turn on buffering for the next lot of output */ 247 if (s->bbio != s->wbio) 248 s->wbio=BIO_push(s->bbio,s->wbio); 249 250 break; 251 252 case SSL3_ST_CR_SRVR_HELLO_A: 253 case SSL3_ST_CR_SRVR_HELLO_B: 254 ret=ssl3_get_server_hello(s); 255 if (ret <= 0) goto end; 256 if (s->hit) 257 s->state=SSL3_ST_CR_FINISHED_A; 258 else 259 s->state=SSL3_ST_CR_CERT_A; 260 s->init_num=0; 261 break; 262 263 case SSL3_ST_CR_CERT_A: 264 case SSL3_ST_CR_CERT_B: 265 /* Check if it is anon DH */ 266 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)) 267 { 268 ret=ssl3_get_server_certificate(s); 269 if (ret <= 0) goto end; 270 } 271 else 272 skip=1; 273 s->state=SSL3_ST_CR_KEY_EXCH_A; 274 s->init_num=0; 275 break; 276 277 case SSL3_ST_CR_KEY_EXCH_A: 278 case SSL3_ST_CR_KEY_EXCH_B: 279 ret=ssl3_get_key_exchange(s); 280 if (ret <= 0) goto end; 281 s->state=SSL3_ST_CR_CERT_REQ_A; 282 s->init_num=0; 283 284 /* at this point we check that we have the 285 * required stuff from the server */ 286 if (!ssl3_check_cert_and_algorithm(s)) 287 { 288 ret= -1; 289 goto end; 290 } 291 break; 292 293 case SSL3_ST_CR_CERT_REQ_A: 294 case SSL3_ST_CR_CERT_REQ_B: 295 ret=ssl3_get_certificate_request(s); 296 if (ret <= 0) goto end; 297 s->state=SSL3_ST_CR_SRVR_DONE_A; 298 s->init_num=0; 299 break; 300 301 case SSL3_ST_CR_SRVR_DONE_A: 302 case SSL3_ST_CR_SRVR_DONE_B: 303 ret=ssl3_get_server_done(s); 304 if (ret <= 0) goto end; 305 if (s->s3->tmp.cert_req) 306 s->state=SSL3_ST_CW_CERT_A; 307 else 308 s->state=SSL3_ST_CW_KEY_EXCH_A; 309 s->init_num=0; 310 311 break; 312 313 case SSL3_ST_CW_CERT_A: 314 case SSL3_ST_CW_CERT_B: 315 case SSL3_ST_CW_CERT_C: 316 case SSL3_ST_CW_CERT_D: 317 ret=ssl3_send_client_certificate(s); 318 if (ret <= 0) goto end; 319 s->state=SSL3_ST_CW_KEY_EXCH_A; 320 s->init_num=0; 321 break; 322 323 case SSL3_ST_CW_KEY_EXCH_A: 324 case SSL3_ST_CW_KEY_EXCH_B: 325 ret=ssl3_send_client_key_exchange(s); 326 if (ret <= 0) goto end; 327 l=s->s3->tmp.new_cipher->algorithms; 328 /* EAY EAY EAY need to check for DH fix cert 329 * sent back */ 330 /* For TLS, cert_req is set to 2, so a cert chain 331 * of nothing is sent, but no verify packet is sent */ 332 if (s->s3->tmp.cert_req == 1) 333 { 334 s->state=SSL3_ST_CW_CERT_VRFY_A; 335 } 336 else 337 { 338 s->state=SSL3_ST_CW_CHANGE_A; 339 s->s3->change_cipher_spec=0; 340 } 341 342 s->init_num=0; 343 break; 344 345 case SSL3_ST_CW_CERT_VRFY_A: 346 case SSL3_ST_CW_CERT_VRFY_B: 347 ret=ssl3_send_client_verify(s); 348 if (ret <= 0) goto end; 349 s->state=SSL3_ST_CW_CHANGE_A; 350 s->init_num=0; 351 s->s3->change_cipher_spec=0; 352 break; 353 354 case SSL3_ST_CW_CHANGE_A: 355 case SSL3_ST_CW_CHANGE_B: 356 ret=ssl3_send_change_cipher_spec(s, 357 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B); 358 if (ret <= 0) goto end; 359 s->state=SSL3_ST_CW_FINISHED_A; 360 s->init_num=0; 361 362 s->session->cipher=s->s3->tmp.new_cipher; 363 if (s->s3->tmp.new_compression == NULL) 364 s->session->compress_meth=0; 365 else 366 s->session->compress_meth= 367 s->s3->tmp.new_compression->id; 368 if (!s->method->ssl3_enc->setup_key_block(s)) 369 { 370 ret= -1; 371 goto end; 372 } 373 374 if (!s->method->ssl3_enc->change_cipher_state(s, 375 SSL3_CHANGE_CIPHER_CLIENT_WRITE)) 376 { 377 ret= -1; 378 goto end; 379 } 380 381 break; 382 383 case SSL3_ST_CW_FINISHED_A: 384 case SSL3_ST_CW_FINISHED_B: 385 ret=ssl3_send_finished(s, 386 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B, 387 s->method->ssl3_enc->client_finished_label, 388 s->method->ssl3_enc->client_finished_label_len); 389 if (ret <= 0) goto end; 390 s->state=SSL3_ST_CW_FLUSH; 391 392 /* clear flags */ 393 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; 394 if (s->hit) 395 { 396 s->s3->tmp.next_state=SSL_ST_OK; 397 if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED) 398 { 399 s->state=SSL_ST_OK; 400 s->s3->flags|=SSL3_FLAGS_POP_BUFFER; 401 s->s3->delay_buf_pop_ret=0; 402 } 403 } 404 else 405 { 406 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A; 407 } 408 s->init_num=0; 409 break; 410 411 case SSL3_ST_CR_FINISHED_A: 412 case SSL3_ST_CR_FINISHED_B: 413 414 ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A, 415 SSL3_ST_CR_FINISHED_B); 416 if (ret <= 0) goto end; 417 418 if (s->hit) 419 s->state=SSL3_ST_CW_CHANGE_A; 420 else 421 s->state=SSL_ST_OK; 422 s->init_num=0; 423 break; 424 425 case SSL3_ST_CW_FLUSH: 426 /* number of bytes to be flushed */ 427 num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL); 428 if (num1 > 0) 429 { 430 s->rwstate=SSL_WRITING; 431 num1=BIO_flush(s->wbio); 432 if (num1 <= 0) { ret= -1; goto end; } 433 s->rwstate=SSL_NOTHING; 434 } 435 436 s->state=s->s3->tmp.next_state; 437 break; 438 439 case SSL_ST_OK: 440 /* clean a few things up */ 441 ssl3_cleanup_key_block(s); 442 443 if (s->init_buf != NULL) 444 { 445 BUF_MEM_free(s->init_buf); 446 s->init_buf=NULL; 447 } 448 449 /* If we are not 'joining' the last two packets, 450 * remove the buffering now */ 451 if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER)) 452 ssl_free_wbio_buffer(s); 453 /* else do it later in ssl3_write */ 454 455 s->init_num=0; 456 s->new_session=0; 457 458 ssl_update_cache(s,SSL_SESS_CACHE_CLIENT); 459 if (s->hit) s->ctx->stats.sess_hit++; 460 461 ret=1; 462 /* s->server=0; */ 463 s->handshake_func=ssl3_connect; 464 s->ctx->stats.sess_connect_good++; 465 466 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1); 467 468 goto end; 469 /* break; */ 470 471 default: 472 SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE); 473 ret= -1; 474 goto end; 475 /* break; */ 476 } 477 478 /* did we do anything */ 479 if (!s->s3->tmp.reuse_message && !skip) 480 { 481 if (s->debug) 482 { 483 if ((ret=BIO_flush(s->wbio)) <= 0) 484 goto end; 485 } 486 487 if ((cb != NULL) && (s->state != state)) 488 { 489 new_state=s->state; 490 s->state=state; 491 cb(s,SSL_CB_CONNECT_LOOP,1); 492 s->state=new_state; 493 } 494 } 495 skip=0; 496 } 497end: 498 s->in_handshake--; 499 if (cb != NULL) 500 cb(s,SSL_CB_CONNECT_EXIT,ret); 501 return(ret); 502 } 503 504 505static int ssl3_client_hello(SSL *s) 506 { 507 unsigned char *buf; 508 unsigned char *p,*d; 509 int i,j; 510 unsigned long Time,l; 511 SSL_COMP *comp; 512 513 buf=(unsigned char *)s->init_buf->data; 514 if (s->state == SSL3_ST_CW_CLNT_HELLO_A) 515 { 516 if ((s->session == NULL) || 517 (s->session->ssl_version != s->version) || 518 (s->session->not_resumable)) 519 { 520 if (!ssl_get_new_session(s,0)) 521 goto err; 522 } 523 /* else use the pre-loaded session */ 524 525 p=s->s3->client_random; 526 Time=time(NULL); /* Time */ 527 l2n(Time,p); 528 RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time)); 529 530 /* Do the message type and length last */ 531 d=p= &(buf[4]); 532 533 *(p++)=s->version>>8; 534 *(p++)=s->version&0xff; 535 s->client_version=s->version; 536 537 /* Random stuff */ 538 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE); 539 p+=SSL3_RANDOM_SIZE; 540 541 /* Session ID */ 542 if (s->new_session) 543 i=0; 544 else 545 i=s->session->session_id_length; 546 *(p++)=i; 547 if (i != 0) 548 {
| 1/* ssl/s3_clnt.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 112#include <stdio.h> 113#include <openssl/buffer.h> 114#include <openssl/rand.h> 115#include <openssl/objects.h> 116#include <openssl/md5.h> 117#include <openssl/sha.h> 118#include <openssl/evp.h> 119#include "ssl_locl.h" 120#include "cryptlib.h" 121 122static SSL_METHOD *ssl3_get_client_method(int ver); 123static int ssl3_client_hello(SSL *s); 124static int ssl3_get_server_hello(SSL *s); 125static int ssl3_get_certificate_request(SSL *s); 126static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b); 127static int ssl3_get_server_done(SSL *s); 128static int ssl3_send_client_verify(SSL *s); 129static int ssl3_send_client_certificate(SSL *s); 130static int ssl3_send_client_key_exchange(SSL *s); 131static int ssl3_get_key_exchange(SSL *s); 132static int ssl3_get_server_certificate(SSL *s); 133static int ssl3_check_cert_and_algorithm(SSL *s); 134static SSL_METHOD *ssl3_get_client_method(int ver) 135 { 136 if (ver == SSL3_VERSION) 137 return(SSLv3_client_method()); 138 else 139 return(NULL); 140 } 141 142SSL_METHOD *SSLv3_client_method(void) 143 { 144 static int init=1; 145 static SSL_METHOD SSLv3_client_data; 146 147 if (init) 148 { 149 init=0; 150 memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(), 151 sizeof(SSL_METHOD)); 152 SSLv3_client_data.ssl_connect=ssl3_connect; 153 SSLv3_client_data.get_ssl_method=ssl3_get_client_method; 154 } 155 return(&SSLv3_client_data); 156 } 157 158int ssl3_connect(SSL *s) 159 { 160 BUF_MEM *buf; 161 unsigned long Time=time(NULL),l; 162 long num1; 163 void (*cb)()=NULL; 164 int ret= -1; 165 int new_state,state,skip=0;; 166 167 RAND_add(&Time,sizeof(Time),0); 168 ERR_clear_error(); 169 clear_sys_error(); 170 171 if (s->info_callback != NULL) 172 cb=s->info_callback; 173 else if (s->ctx->info_callback != NULL) 174 cb=s->ctx->info_callback; 175 176 s->in_handshake++; 177 if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); 178 179 for (;;) 180 { 181 state=s->state; 182 183 switch(s->state) 184 { 185 case SSL_ST_RENEGOTIATE: 186 s->new_session=1; 187 s->state=SSL_ST_CONNECT; 188 s->ctx->stats.sess_connect_renegotiate++; 189 /* break */ 190 case SSL_ST_BEFORE: 191 case SSL_ST_CONNECT: 192 case SSL_ST_BEFORE|SSL_ST_CONNECT: 193 case SSL_ST_OK|SSL_ST_CONNECT: 194 195 s->server=0; 196 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1); 197 198 if ((s->version & 0xff00 ) != 0x0300) 199 { 200 SSLerr(SSL_F_SSL3_CONNECT, SSL_R_INTERNAL_ERROR); 201 ret = -1; 202 goto end; 203 } 204 205 /* s->version=SSL3_VERSION; */ 206 s->type=SSL_ST_CONNECT; 207 208 if (s->init_buf == NULL) 209 { 210 if ((buf=BUF_MEM_new()) == NULL) 211 { 212 ret= -1; 213 goto end; 214 } 215 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH)) 216 { 217 ret= -1; 218 goto end; 219 } 220 s->init_buf=buf; 221 } 222 223 if (!ssl3_setup_buffers(s)) { ret= -1; goto end; } 224 225 /* setup buffing BIO */ 226 if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; } 227 228 /* don't push the buffering BIO quite yet */ 229 230 ssl3_init_finished_mac(s); 231 232 s->state=SSL3_ST_CW_CLNT_HELLO_A; 233 s->ctx->stats.sess_connect++; 234 s->init_num=0; 235 break; 236 237 case SSL3_ST_CW_CLNT_HELLO_A: 238 case SSL3_ST_CW_CLNT_HELLO_B: 239 240 s->shutdown=0; 241 ret=ssl3_client_hello(s); 242 if (ret <= 0) goto end; 243 s->state=SSL3_ST_CR_SRVR_HELLO_A; 244 s->init_num=0; 245 246 /* turn on buffering for the next lot of output */ 247 if (s->bbio != s->wbio) 248 s->wbio=BIO_push(s->bbio,s->wbio); 249 250 break; 251 252 case SSL3_ST_CR_SRVR_HELLO_A: 253 case SSL3_ST_CR_SRVR_HELLO_B: 254 ret=ssl3_get_server_hello(s); 255 if (ret <= 0) goto end; 256 if (s->hit) 257 s->state=SSL3_ST_CR_FINISHED_A; 258 else 259 s->state=SSL3_ST_CR_CERT_A; 260 s->init_num=0; 261 break; 262 263 case SSL3_ST_CR_CERT_A: 264 case SSL3_ST_CR_CERT_B: 265 /* Check if it is anon DH */ 266 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)) 267 { 268 ret=ssl3_get_server_certificate(s); 269 if (ret <= 0) goto end; 270 } 271 else 272 skip=1; 273 s->state=SSL3_ST_CR_KEY_EXCH_A; 274 s->init_num=0; 275 break; 276 277 case SSL3_ST_CR_KEY_EXCH_A: 278 case SSL3_ST_CR_KEY_EXCH_B: 279 ret=ssl3_get_key_exchange(s); 280 if (ret <= 0) goto end; 281 s->state=SSL3_ST_CR_CERT_REQ_A; 282 s->init_num=0; 283 284 /* at this point we check that we have the 285 * required stuff from the server */ 286 if (!ssl3_check_cert_and_algorithm(s)) 287 { 288 ret= -1; 289 goto end; 290 } 291 break; 292 293 case SSL3_ST_CR_CERT_REQ_A: 294 case SSL3_ST_CR_CERT_REQ_B: 295 ret=ssl3_get_certificate_request(s); 296 if (ret <= 0) goto end; 297 s->state=SSL3_ST_CR_SRVR_DONE_A; 298 s->init_num=0; 299 break; 300 301 case SSL3_ST_CR_SRVR_DONE_A: 302 case SSL3_ST_CR_SRVR_DONE_B: 303 ret=ssl3_get_server_done(s); 304 if (ret <= 0) goto end; 305 if (s->s3->tmp.cert_req) 306 s->state=SSL3_ST_CW_CERT_A; 307 else 308 s->state=SSL3_ST_CW_KEY_EXCH_A; 309 s->init_num=0; 310 311 break; 312 313 case SSL3_ST_CW_CERT_A: 314 case SSL3_ST_CW_CERT_B: 315 case SSL3_ST_CW_CERT_C: 316 case SSL3_ST_CW_CERT_D: 317 ret=ssl3_send_client_certificate(s); 318 if (ret <= 0) goto end; 319 s->state=SSL3_ST_CW_KEY_EXCH_A; 320 s->init_num=0; 321 break; 322 323 case SSL3_ST_CW_KEY_EXCH_A: 324 case SSL3_ST_CW_KEY_EXCH_B: 325 ret=ssl3_send_client_key_exchange(s); 326 if (ret <= 0) goto end; 327 l=s->s3->tmp.new_cipher->algorithms; 328 /* EAY EAY EAY need to check for DH fix cert 329 * sent back */ 330 /* For TLS, cert_req is set to 2, so a cert chain 331 * of nothing is sent, but no verify packet is sent */ 332 if (s->s3->tmp.cert_req == 1) 333 { 334 s->state=SSL3_ST_CW_CERT_VRFY_A; 335 } 336 else 337 { 338 s->state=SSL3_ST_CW_CHANGE_A; 339 s->s3->change_cipher_spec=0; 340 } 341 342 s->init_num=0; 343 break; 344 345 case SSL3_ST_CW_CERT_VRFY_A: 346 case SSL3_ST_CW_CERT_VRFY_B: 347 ret=ssl3_send_client_verify(s); 348 if (ret <= 0) goto end; 349 s->state=SSL3_ST_CW_CHANGE_A; 350 s->init_num=0; 351 s->s3->change_cipher_spec=0; 352 break; 353 354 case SSL3_ST_CW_CHANGE_A: 355 case SSL3_ST_CW_CHANGE_B: 356 ret=ssl3_send_change_cipher_spec(s, 357 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B); 358 if (ret <= 0) goto end; 359 s->state=SSL3_ST_CW_FINISHED_A; 360 s->init_num=0; 361 362 s->session->cipher=s->s3->tmp.new_cipher; 363 if (s->s3->tmp.new_compression == NULL) 364 s->session->compress_meth=0; 365 else 366 s->session->compress_meth= 367 s->s3->tmp.new_compression->id; 368 if (!s->method->ssl3_enc->setup_key_block(s)) 369 { 370 ret= -1; 371 goto end; 372 } 373 374 if (!s->method->ssl3_enc->change_cipher_state(s, 375 SSL3_CHANGE_CIPHER_CLIENT_WRITE)) 376 { 377 ret= -1; 378 goto end; 379 } 380 381 break; 382 383 case SSL3_ST_CW_FINISHED_A: 384 case SSL3_ST_CW_FINISHED_B: 385 ret=ssl3_send_finished(s, 386 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B, 387 s->method->ssl3_enc->client_finished_label, 388 s->method->ssl3_enc->client_finished_label_len); 389 if (ret <= 0) goto end; 390 s->state=SSL3_ST_CW_FLUSH; 391 392 /* clear flags */ 393 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; 394 if (s->hit) 395 { 396 s->s3->tmp.next_state=SSL_ST_OK; 397 if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED) 398 { 399 s->state=SSL_ST_OK; 400 s->s3->flags|=SSL3_FLAGS_POP_BUFFER; 401 s->s3->delay_buf_pop_ret=0; 402 } 403 } 404 else 405 { 406 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A; 407 } 408 s->init_num=0; 409 break; 410 411 case SSL3_ST_CR_FINISHED_A: 412 case SSL3_ST_CR_FINISHED_B: 413 414 ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A, 415 SSL3_ST_CR_FINISHED_B); 416 if (ret <= 0) goto end; 417 418 if (s->hit) 419 s->state=SSL3_ST_CW_CHANGE_A; 420 else 421 s->state=SSL_ST_OK; 422 s->init_num=0; 423 break; 424 425 case SSL3_ST_CW_FLUSH: 426 /* number of bytes to be flushed */ 427 num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL); 428 if (num1 > 0) 429 { 430 s->rwstate=SSL_WRITING; 431 num1=BIO_flush(s->wbio); 432 if (num1 <= 0) { ret= -1; goto end; } 433 s->rwstate=SSL_NOTHING; 434 } 435 436 s->state=s->s3->tmp.next_state; 437 break; 438 439 case SSL_ST_OK: 440 /* clean a few things up */ 441 ssl3_cleanup_key_block(s); 442 443 if (s->init_buf != NULL) 444 { 445 BUF_MEM_free(s->init_buf); 446 s->init_buf=NULL; 447 } 448 449 /* If we are not 'joining' the last two packets, 450 * remove the buffering now */ 451 if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER)) 452 ssl_free_wbio_buffer(s); 453 /* else do it later in ssl3_write */ 454 455 s->init_num=0; 456 s->new_session=0; 457 458 ssl_update_cache(s,SSL_SESS_CACHE_CLIENT); 459 if (s->hit) s->ctx->stats.sess_hit++; 460 461 ret=1; 462 /* s->server=0; */ 463 s->handshake_func=ssl3_connect; 464 s->ctx->stats.sess_connect_good++; 465 466 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1); 467 468 goto end; 469 /* break; */ 470 471 default: 472 SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE); 473 ret= -1; 474 goto end; 475 /* break; */ 476 } 477 478 /* did we do anything */ 479 if (!s->s3->tmp.reuse_message && !skip) 480 { 481 if (s->debug) 482 { 483 if ((ret=BIO_flush(s->wbio)) <= 0) 484 goto end; 485 } 486 487 if ((cb != NULL) && (s->state != state)) 488 { 489 new_state=s->state; 490 s->state=state; 491 cb(s,SSL_CB_CONNECT_LOOP,1); 492 s->state=new_state; 493 } 494 } 495 skip=0; 496 } 497end: 498 s->in_handshake--; 499 if (cb != NULL) 500 cb(s,SSL_CB_CONNECT_EXIT,ret); 501 return(ret); 502 } 503 504 505static int ssl3_client_hello(SSL *s) 506 { 507 unsigned char *buf; 508 unsigned char *p,*d; 509 int i,j; 510 unsigned long Time,l; 511 SSL_COMP *comp; 512 513 buf=(unsigned char *)s->init_buf->data; 514 if (s->state == SSL3_ST_CW_CLNT_HELLO_A) 515 { 516 if ((s->session == NULL) || 517 (s->session->ssl_version != s->version) || 518 (s->session->not_resumable)) 519 { 520 if (!ssl_get_new_session(s,0)) 521 goto err; 522 } 523 /* else use the pre-loaded session */ 524 525 p=s->s3->client_random; 526 Time=time(NULL); /* Time */ 527 l2n(Time,p); 528 RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time)); 529 530 /* Do the message type and length last */ 531 d=p= &(buf[4]); 532 533 *(p++)=s->version>>8; 534 *(p++)=s->version&0xff; 535 s->client_version=s->version; 536 537 /* Random stuff */ 538 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE); 539 p+=SSL3_RANDOM_SIZE; 540 541 /* Session ID */ 542 if (s->new_session) 543 i=0; 544 else 545 i=s->session->session_id_length; 546 *(p++)=i; 547 if (i != 0) 548 {
|
550 memcpy(p,s->session->session_id,i); 551 p+=i; 552 } 553 554 /* Ciphers supported */ 555 i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2])); 556 if (i == 0) 557 { 558 SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE); 559 goto err; 560 } 561 s2n(i,p); 562 p+=i; 563 564 /* COMPRESSION */ 565 if (s->ctx->comp_methods == NULL) 566 j=0; 567 else 568 j=sk_SSL_COMP_num(s->ctx->comp_methods); 569 *(p++)=1+j; 570 for (i=0; i<j; i++) 571 { 572 comp=sk_SSL_COMP_value(s->ctx->comp_methods,i); 573 *(p++)=comp->id; 574 } 575 *(p++)=0; /* Add the NULL method */ 576 577 l=(p-d); 578 d=buf; 579 *(d++)=SSL3_MT_CLIENT_HELLO; 580 l2n3(l,d); 581 582 s->state=SSL3_ST_CW_CLNT_HELLO_B; 583 /* number of bytes to write */ 584 s->init_num=p-buf; 585 s->init_off=0; 586 } 587 588 /* SSL3_ST_CW_CLNT_HELLO_B */ 589 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 590err: 591 return(-1); 592 } 593 594static int ssl3_get_server_hello(SSL *s) 595 { 596 STACK_OF(SSL_CIPHER) *sk; 597 SSL_CIPHER *c; 598 unsigned char *p,*d; 599 int i,al,ok; 600 unsigned int j; 601 long n; 602 SSL_COMP *comp; 603 604 n=ssl3_get_message(s, 605 SSL3_ST_CR_SRVR_HELLO_A, 606 SSL3_ST_CR_SRVR_HELLO_B, 607 SSL3_MT_SERVER_HELLO, 608 300, /* ?? */ 609 &ok); 610 611 if (!ok) return((int)n); 612 d=p=(unsigned char *)s->init_buf->data; 613 614 if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff))) 615 { 616 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION); 617 s->version=(s->version&0xff00)|p[1]; 618 al=SSL_AD_PROTOCOL_VERSION; 619 goto f_err; 620 } 621 p+=2; 622 623 /* load the server hello data */ 624 /* load the server random */ 625 memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE); 626 p+=SSL3_RANDOM_SIZE; 627 628 /* get the session-id */ 629 j= *(p++); 630 631 if(j > sizeof s->session->session_id) 632 { 633 al=SSL_AD_ILLEGAL_PARAMETER; 634 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 635 SSL_R_SSL3_SESSION_ID_TOO_LONG); 636 goto f_err; 637 } 638 639 if ((j != 0) && (j != SSL3_SESSION_ID_SIZE)) 640 { 641 /* SSLref returns 16 :-( */ 642 if (j < SSL2_SSL_SESSION_ID_LENGTH) 643 { 644 al=SSL_AD_ILLEGAL_PARAMETER; 645 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_SHORT); 646 goto f_err; 647 } 648 } 649 if (j != 0 && j == s->session->session_id_length 650 && memcmp(p,s->session->session_id,j) == 0) 651 { 652 if(s->sid_ctx_length != s->session->sid_ctx_length 653 || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length)) 654 { 655 al=SSL_AD_ILLEGAL_PARAMETER; 656 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 657 goto f_err; 658 } 659 s->hit=1; 660 } 661 else /* a miss or crap from the other end */ 662 { 663 /* If we were trying for session-id reuse, make a new 664 * SSL_SESSION so we don't stuff up other people */ 665 s->hit=0; 666 if (s->session->session_id_length > 0) 667 { 668 if (!ssl_get_new_session(s,0)) 669 { 670 al=SSL_AD_INTERNAL_ERROR; 671 goto f_err; 672 } 673 } 674 s->session->session_id_length=j; 675 memcpy(s->session->session_id,p,j); /* j could be 0 */ 676 } 677 p+=j; 678 c=ssl_get_cipher_by_char(s,p); 679 if (c == NULL) 680 { 681 /* unknown cipher */ 682 al=SSL_AD_ILLEGAL_PARAMETER; 683 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED); 684 goto f_err; 685 } 686 p+=ssl_put_cipher_by_char(s,NULL,NULL); 687 688 sk=ssl_get_ciphers_by_id(s); 689 i=sk_SSL_CIPHER_find(sk,c); 690 if (i < 0) 691 { 692 /* we did not say we would use this cipher */ 693 al=SSL_AD_ILLEGAL_PARAMETER; 694 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED); 695 goto f_err; 696 } 697 698 if (s->hit && (s->session->cipher != c)) 699 { 700 if (!(s->options & 701 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) 702 { 703 al=SSL_AD_ILLEGAL_PARAMETER; 704 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); 705 goto f_err; 706 } 707 } 708 s->s3->tmp.new_cipher=c; 709 710 /* lets get the compression algorithm */ 711 /* COMPRESSION */ 712 j= *(p++); 713 if (j == 0) 714 comp=NULL; 715 else 716 comp=ssl3_comp_find(s->ctx->comp_methods,j); 717 718 if ((j != 0) && (comp == NULL)) 719 { 720 al=SSL_AD_ILLEGAL_PARAMETER; 721 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 722 goto f_err; 723 } 724 else 725 { 726 s->s3->tmp.new_compression=comp; 727 } 728 729 if (p != (d+n)) 730 { 731 /* wrong packet length */ 732 al=SSL_AD_DECODE_ERROR; 733 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH); 734 goto err; 735 } 736 737 return(1); 738f_err: 739 ssl3_send_alert(s,SSL3_AL_FATAL,al); 740err: 741 return(-1); 742 } 743 744static int ssl3_get_server_certificate(SSL *s) 745 { 746 int al,i,ok,ret= -1; 747 unsigned long n,nc,llen,l; 748 X509 *x=NULL; 749 unsigned char *p,*d,*q; 750 STACK_OF(X509) *sk=NULL; 751 SESS_CERT *sc; 752 EVP_PKEY *pkey=NULL; 753 754 n=ssl3_get_message(s, 755 SSL3_ST_CR_CERT_A, 756 SSL3_ST_CR_CERT_B, 757 -1, 758#if defined(MSDOS) && !defined(WIN32) 759 1024*30, /* 30k max cert list :-) */ 760#else 761 1024*100, /* 100k max cert list :-) */ 762#endif 763 &ok); 764 765 if (!ok) return((int)n); 766 767 if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) 768 { 769 s->s3->tmp.reuse_message=1; 770 return(1); 771 } 772 773 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE) 774 { 775 al=SSL_AD_UNEXPECTED_MESSAGE; 776 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE); 777 goto f_err; 778 } 779 d=p=(unsigned char *)s->init_buf->data; 780 781 if ((sk=sk_X509_new_null()) == NULL) 782 { 783 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE); 784 goto err; 785 } 786 787 n2l3(p,llen); 788 if (llen+3 != n) 789 { 790 al=SSL_AD_DECODE_ERROR; 791 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH); 792 goto f_err; 793 } 794 for (nc=0; nc<llen; ) 795 { 796 n2l3(p,l); 797 if ((l+nc+3) > llen) 798 { 799 al=SSL_AD_DECODE_ERROR; 800 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); 801 goto f_err; 802 } 803 804 q=p; 805 x=d2i_X509(NULL,&q,l); 806 if (x == NULL) 807 { 808 al=SSL_AD_BAD_CERTIFICATE; 809 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB); 810 goto f_err; 811 } 812 if (q != (p+l)) 813 { 814 al=SSL_AD_DECODE_ERROR; 815 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); 816 goto f_err; 817 } 818 if (!sk_X509_push(sk,x)) 819 { 820 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE); 821 goto err; 822 } 823 x=NULL; 824 nc+=l+3; 825 p=q; 826 } 827 828 i=ssl_verify_cert_chain(s,sk); 829 if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)) 830 { 831 al=ssl_verify_alarm_type(s->verify_result); 832 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED); 833 goto f_err; 834 } 835 ERR_clear_error(); /* but we keep s->verify_result */ 836 837 sc=ssl_sess_cert_new(); 838 if (sc == NULL) goto err; 839 840 if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert); 841 s->session->sess_cert=sc; 842 843 sc->cert_chain=sk; 844 /* Inconsistency alert: cert_chain does include the peer's 845 * certificate, which we don't include in s3_srvr.c */ 846 x=sk_X509_value(sk,0); 847 sk=NULL; 848 849 pkey=X509_get_pubkey(x); 850 851 if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)) 852 { 853 x=NULL; 854 al=SSL3_AL_FATAL; 855 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); 856 goto f_err; 857 } 858 859 i=ssl_cert_type(x,pkey); 860 if (i < 0) 861 { 862 x=NULL; 863 al=SSL3_AL_FATAL; 864 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNKNOWN_CERTIFICATE_TYPE); 865 goto f_err; 866 } 867 868 sc->peer_cert_type=i; 869 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 870 if (sc->peer_pkeys[i].x509 != NULL) /* Why would this ever happen? 871 * We just created sc a couple of 872 * lines ago. */ 873 X509_free(sc->peer_pkeys[i].x509); 874 sc->peer_pkeys[i].x509=x; 875 sc->peer_key= &(sc->peer_pkeys[i]); 876 877 if (s->session->peer != NULL) 878 X509_free(s->session->peer); 879 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 880 s->session->peer=x; 881 s->session->verify_result = s->verify_result; 882 883 x=NULL; 884 ret=1; 885 886 if (0) 887 { 888f_err: 889 ssl3_send_alert(s,SSL3_AL_FATAL,al); 890 } 891err: 892 EVP_PKEY_free(pkey); 893 X509_free(x); 894 sk_X509_pop_free(sk,X509_free); 895 return(ret); 896 } 897 898static int ssl3_get_key_exchange(SSL *s) 899 { 900#ifndef NO_RSA 901 unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2]; 902#endif 903 EVP_MD_CTX md_ctx; 904 unsigned char *param,*p; 905 int al,i,j,param_len,ok; 906 long n,alg; 907 EVP_PKEY *pkey=NULL; 908#ifndef NO_RSA 909 RSA *rsa=NULL; 910#endif 911#ifndef NO_DH 912 DH *dh=NULL; 913#endif 914 915 /* use same message size as in ssl3_get_certificate_request() 916 * as ServerKeyExchange message may be skipped */ 917 n=ssl3_get_message(s, 918 SSL3_ST_CR_KEY_EXCH_A, 919 SSL3_ST_CR_KEY_EXCH_B, 920 -1, 921#if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32) 922 1024*30, /* 30k max cert list :-) */ 923#else 924 1024*100, /* 100k max cert list :-) */ 925#endif 926 &ok); 927 928 if (!ok) return((int)n); 929 930 if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE) 931 { 932 s->s3->tmp.reuse_message=1; 933 return(1); 934 } 935 936 param=p=(unsigned char *)s->init_buf->data; 937 938 if (s->session->sess_cert != NULL) 939 { 940#ifndef NO_RSA 941 if (s->session->sess_cert->peer_rsa_tmp != NULL) 942 { 943 RSA_free(s->session->sess_cert->peer_rsa_tmp); 944 s->session->sess_cert->peer_rsa_tmp=NULL; 945 } 946#endif 947#ifndef NO_DH 948 if (s->session->sess_cert->peer_dh_tmp) 949 { 950 DH_free(s->session->sess_cert->peer_dh_tmp); 951 s->session->sess_cert->peer_dh_tmp=NULL; 952 } 953#endif 954 } 955 else 956 { 957 s->session->sess_cert=ssl_sess_cert_new(); 958 } 959 960 param_len=0; 961 alg=s->s3->tmp.new_cipher->algorithms; 962 963#ifndef NO_RSA 964 if (alg & SSL_kRSA) 965 { 966 if ((rsa=RSA_new()) == NULL) 967 { 968 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE); 969 goto err; 970 } 971 n2s(p,i); 972 param_len=i+2; 973 if (param_len > n) 974 { 975 al=SSL_AD_DECODE_ERROR; 976 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH); 977 goto f_err; 978 } 979 if (!(rsa->n=BN_bin2bn(p,i,rsa->n))) 980 { 981 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 982 goto err; 983 } 984 p+=i; 985 986 n2s(p,i); 987 param_len+=i+2; 988 if (param_len > n) 989 { 990 al=SSL_AD_DECODE_ERROR; 991 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH); 992 goto f_err; 993 } 994 if (!(rsa->e=BN_bin2bn(p,i,rsa->e))) 995 { 996 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 997 goto err; 998 } 999 p+=i; 1000 n-=param_len; 1001 1002 /* this should be because we are using an export cipher */ 1003 if (alg & SSL_aRSA) 1004 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1005 else 1006 { 1007 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1008 goto err; 1009 } 1010 s->session->sess_cert->peer_rsa_tmp=rsa; 1011 rsa=NULL; 1012 } 1013#else /* NO_RSA */ 1014 if (0) 1015 ; 1016#endif 1017#ifndef NO_DH 1018 else if (alg & SSL_kEDH) 1019 { 1020 if ((dh=DH_new()) == NULL) 1021 { 1022 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB); 1023 goto err; 1024 } 1025 n2s(p,i); 1026 param_len=i+2; 1027 if (param_len > n) 1028 { 1029 al=SSL_AD_DECODE_ERROR; 1030 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH); 1031 goto f_err; 1032 } 1033 if (!(dh->p=BN_bin2bn(p,i,NULL))) 1034 { 1035 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1036 goto err; 1037 } 1038 p+=i; 1039 1040 n2s(p,i); 1041 param_len+=i+2; 1042 if (param_len > n) 1043 { 1044 al=SSL_AD_DECODE_ERROR; 1045 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH); 1046 goto f_err; 1047 } 1048 if (!(dh->g=BN_bin2bn(p,i,NULL))) 1049 { 1050 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1051 goto err; 1052 } 1053 p+=i; 1054 1055 n2s(p,i); 1056 param_len+=i+2; 1057 if (param_len > n) 1058 { 1059 al=SSL_AD_DECODE_ERROR; 1060 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH); 1061 goto f_err; 1062 } 1063 if (!(dh->pub_key=BN_bin2bn(p,i,NULL))) 1064 { 1065 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1066 goto err; 1067 } 1068 p+=i; 1069 n-=param_len; 1070 1071#ifndef NO_RSA 1072 if (alg & SSL_aRSA) 1073 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1074#else 1075 if (0) 1076 ; 1077#endif 1078#ifndef NO_DSA 1079 else if (alg & SSL_aDSS) 1080 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509); 1081#endif 1082 /* else anonymous DH, so no certificate or pkey. */ 1083 1084 s->session->sess_cert->peer_dh_tmp=dh; 1085 dh=NULL; 1086 } 1087 else if ((alg & SSL_kDHr) || (alg & SSL_kDHd)) 1088 { 1089 al=SSL_AD_ILLEGAL_PARAMETER; 1090 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); 1091 goto f_err; 1092 } 1093#endif /* !NO_DH */ 1094 if (alg & SSL_aFZA) 1095 { 1096 al=SSL_AD_HANDSHAKE_FAILURE; 1097 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); 1098 goto f_err; 1099 } 1100 1101 1102 /* p points to the next byte, there are 'n' bytes left */ 1103 1104 1105 /* if it was signed, check the signature */ 1106 if (pkey != NULL) 1107 { 1108 n2s(p,i); 1109 n-=2; 1110 j=EVP_PKEY_size(pkey); 1111 1112 if ((i != n) || (n > j) || (n <= 0)) 1113 { 1114 /* wrong packet length */ 1115 al=SSL_AD_DECODE_ERROR; 1116 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH); 1117 goto f_err; 1118 } 1119 1120#ifndef NO_RSA 1121 if (pkey->type == EVP_PKEY_RSA) 1122 { 1123 int num; 1124 1125 j=0; 1126 q=md_buf; 1127 for (num=2; num > 0; num--) 1128 { 1129 EVP_DigestInit(&md_ctx,(num == 2) 1130 ?s->ctx->md5:s->ctx->sha1); 1131 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); 1132 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); 1133 EVP_DigestUpdate(&md_ctx,param,param_len); 1134 EVP_DigestFinal(&md_ctx,q,(unsigned int *)&i); 1135 q+=i; 1136 j+=i; 1137 } 1138 i=RSA_verify(NID_md5_sha1, md_buf, j, p, n, 1139 pkey->pkey.rsa); 1140 if (i < 0) 1141 { 1142 al=SSL_AD_DECRYPT_ERROR; 1143 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); 1144 goto f_err; 1145 } 1146 if (i == 0) 1147 { 1148 /* bad signature */ 1149 al=SSL_AD_DECRYPT_ERROR; 1150 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE); 1151 goto f_err; 1152 } 1153 } 1154 else 1155#endif 1156#ifndef NO_DSA 1157 if (pkey->type == EVP_PKEY_DSA) 1158 { 1159 /* lets do DSS */ 1160 EVP_VerifyInit(&md_ctx,EVP_dss1()); 1161 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); 1162 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); 1163 EVP_VerifyUpdate(&md_ctx,param,param_len); 1164 if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) 1165 { 1166 /* bad signature */ 1167 al=SSL_AD_DECRYPT_ERROR; 1168 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE); 1169 goto f_err; 1170 } 1171 } 1172 else 1173#endif 1174 { 1175 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1176 goto err; 1177 } 1178 } 1179 else 1180 { 1181 /* still data left over */ 1182 if (!(alg & SSL_aNULL)) 1183 { 1184 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1185 goto err; 1186 } 1187 if (n != 0) 1188 { 1189 al=SSL_AD_DECODE_ERROR; 1190 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE); 1191 goto f_err; 1192 } 1193 } 1194 EVP_PKEY_free(pkey); 1195 return(1); 1196f_err: 1197 ssl3_send_alert(s,SSL3_AL_FATAL,al); 1198err: 1199 EVP_PKEY_free(pkey); 1200#ifndef NO_RSA 1201 if (rsa != NULL) 1202 RSA_free(rsa); 1203#endif 1204#ifndef NO_DH 1205 if (dh != NULL) 1206 DH_free(dh); 1207#endif 1208 return(-1); 1209 } 1210 1211static int ssl3_get_certificate_request(SSL *s) 1212 { 1213 int ok,ret=0; 1214 unsigned long n,nc,l; 1215 unsigned int llen,ctype_num,i; 1216 X509_NAME *xn=NULL; 1217 unsigned char *p,*d,*q; 1218 STACK_OF(X509_NAME) *ca_sk=NULL; 1219 1220 n=ssl3_get_message(s, 1221 SSL3_ST_CR_CERT_REQ_A, 1222 SSL3_ST_CR_CERT_REQ_B, 1223 -1, 1224#if defined(MSDOS) && !defined(WIN32) 1225 1024*30, /* 30k max cert list :-) */ 1226#else 1227 1024*100, /* 100k max cert list :-) */ 1228#endif 1229 &ok); 1230 1231 if (!ok) return((int)n); 1232 1233 s->s3->tmp.cert_req=0; 1234 1235 if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE) 1236 { 1237 s->s3->tmp.reuse_message=1; 1238 return(1); 1239 } 1240 1241 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST) 1242 { 1243 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); 1244 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE); 1245 goto err; 1246 } 1247 1248 /* TLS does not like anon-DH with client cert */ 1249 if (s->version > SSL3_VERSION) 1250 { 1251 l=s->s3->tmp.new_cipher->algorithms; 1252 if (l & SSL_aNULL) 1253 { 1254 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); 1255 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER); 1256 goto err; 1257 } 1258 } 1259 1260 d=p=(unsigned char *)s->init_buf->data; 1261 1262 if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL) 1263 { 1264 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE); 1265 goto err; 1266 } 1267 1268 /* get the certificate types */ 1269 ctype_num= *(p++); 1270 if (ctype_num > SSL3_CT_NUMBER) 1271 ctype_num=SSL3_CT_NUMBER; 1272 for (i=0; i<ctype_num; i++) 1273 s->s3->tmp.ctype[i]= p[i]; 1274 p+=ctype_num; 1275 1276 /* get the CA RDNs */ 1277 n2s(p,llen); 1278#if 0 1279{ 1280FILE *out; 1281out=fopen("/tmp/vsign.der","w"); 1282fwrite(p,1,llen,out); 1283fclose(out); 1284} 1285#endif 1286 1287 if ((llen+ctype_num+2+1) != n) 1288 { 1289 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1290 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH); 1291 goto err; 1292 } 1293 1294 for (nc=0; nc<llen; ) 1295 { 1296 n2s(p,l); 1297 if ((l+nc+2) > llen) 1298 { 1299 if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG)) 1300 goto cont; /* netscape bugs */ 1301 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1302 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG); 1303 goto err; 1304 } 1305 1306 q=p; 1307 1308 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL) 1309 { 1310 /* If netscape tolerance is on, ignore errors */ 1311 if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG) 1312 goto cont; 1313 else 1314 { 1315 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1316 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB); 1317 goto err; 1318 } 1319 } 1320 1321 if (q != (p+l)) 1322 { 1323 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1324 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH); 1325 goto err; 1326 } 1327 if (!sk_X509_NAME_push(ca_sk,xn)) 1328 { 1329 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE); 1330 goto err; 1331 } 1332 1333 p+=l; 1334 nc+=l+2; 1335 } 1336 1337 if (0) 1338 { 1339cont: 1340 ERR_clear_error(); 1341 } 1342 1343 /* we should setup a certificate to return.... */ 1344 s->s3->tmp.cert_req=1; 1345 s->s3->tmp.ctype_num=ctype_num; 1346 if (s->s3->tmp.ca_names != NULL) 1347 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 1348 s->s3->tmp.ca_names=ca_sk; 1349 ca_sk=NULL; 1350 1351 ret=1; 1352err: 1353 if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free); 1354 return(ret); 1355 } 1356 1357static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b) 1358 { 1359 return(X509_NAME_cmp(*a,*b)); 1360 } 1361 1362static int ssl3_get_server_done(SSL *s) 1363 { 1364 int ok,ret=0; 1365 long n; 1366 1367 n=ssl3_get_message(s, 1368 SSL3_ST_CR_SRVR_DONE_A, 1369 SSL3_ST_CR_SRVR_DONE_B, 1370 SSL3_MT_SERVER_DONE, 1371 30, /* should be very small, like 0 :-) */ 1372 &ok); 1373 1374 if (!ok) return((int)n); 1375 if (n > 0) 1376 { 1377 /* should contain no data */ 1378 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1379 SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH); 1380 return -1; 1381 } 1382 ret=1; 1383 return(ret); 1384 } 1385 1386static int ssl3_send_client_key_exchange(SSL *s) 1387 { 1388 unsigned char *p,*d; 1389 int n; 1390 unsigned long l; 1391#ifndef NO_RSA 1392 unsigned char *q; 1393 EVP_PKEY *pkey=NULL; 1394#endif 1395 1396 if (s->state == SSL3_ST_CW_KEY_EXCH_A) 1397 { 1398 d=(unsigned char *)s->init_buf->data; 1399 p= &(d[4]); 1400 1401 l=s->s3->tmp.new_cipher->algorithms; 1402 1403#ifndef NO_RSA 1404 if (l & SSL_kRSA) 1405 { 1406 RSA *rsa; 1407 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH]; 1408 1409 if (s->session->sess_cert->peer_rsa_tmp != NULL) 1410 rsa=s->session->sess_cert->peer_rsa_tmp; 1411 else 1412 { 1413 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1414 if ((pkey == NULL) || 1415 (pkey->type != EVP_PKEY_RSA) || 1416 (pkey->pkey.rsa == NULL)) 1417 { 1418 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1419 goto err; 1420 } 1421 rsa=pkey->pkey.rsa; 1422 EVP_PKEY_free(pkey); 1423 } 1424 1425 tmp_buf[0]=s->client_version>>8; 1426 tmp_buf[1]=s->client_version&0xff; 1427 if (RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2) <= 0) 1428 goto err; 1429 1430 s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; 1431 1432 q=p; 1433 /* Fix buf for TLS and beyond */ 1434 if (s->version > SSL3_VERSION) 1435 p+=2; 1436 n=RSA_public_encrypt(SSL_MAX_MASTER_KEY_LENGTH, 1437 tmp_buf,p,rsa,RSA_PKCS1_PADDING); 1438#ifdef PKCS1_CHECK 1439 if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++; 1440 if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70; 1441#endif 1442 if (n <= 0) 1443 { 1444 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT); 1445 goto err; 1446 } 1447 1448 /* Fix buf for TLS and beyond */ 1449 if (s->version > SSL3_VERSION) 1450 { 1451 s2n(n,q); 1452 n+=2; 1453 } 1454 1455 s->session->master_key_length= 1456 s->method->ssl3_enc->generate_master_secret(s, 1457 s->session->master_key, 1458 tmp_buf,SSL_MAX_MASTER_KEY_LENGTH); 1459 memset(tmp_buf,0,SSL_MAX_MASTER_KEY_LENGTH); 1460 } 1461 else 1462#endif 1463#ifndef NO_DH 1464 if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) 1465 { 1466 DH *dh_srvr,*dh_clnt; 1467 1468 if (s->session->sess_cert->peer_dh_tmp != NULL) 1469 dh_srvr=s->session->sess_cert->peer_dh_tmp; 1470 else 1471 { 1472 /* we get them from the cert */ 1473 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1474 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS); 1475 goto err; 1476 } 1477 1478 /* generate a new random key */ 1479 if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL) 1480 { 1481 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); 1482 goto err; 1483 } 1484 if (!DH_generate_key(dh_clnt)) 1485 { 1486 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); 1487 goto err; 1488 } 1489 1490 /* use the 'p' output buffer for the DH key, but 1491 * make sure to clear it out afterwards */ 1492 1493 n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt); 1494 1495 if (n <= 0) 1496 { 1497 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); 1498 goto err; 1499 } 1500 1501 /* generate master key from the result */ 1502 s->session->master_key_length= 1503 s->method->ssl3_enc->generate_master_secret(s, 1504 s->session->master_key,p,n); 1505 /* clean up */ 1506 memset(p,0,n); 1507 1508 /* send off the data */ 1509 n=BN_num_bytes(dh_clnt->pub_key); 1510 s2n(n,p); 1511 BN_bn2bin(dh_clnt->pub_key,p); 1512 n+=2; 1513 1514 DH_free(dh_clnt); 1515 1516 /* perhaps clean things up a bit EAY EAY EAY EAY*/ 1517 } 1518 else 1519#endif 1520 { 1521 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1522 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1523 goto err; 1524 } 1525 1526 *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE; 1527 l2n3(n,d); 1528 1529 s->state=SSL3_ST_CW_KEY_EXCH_B; 1530 /* number of bytes to write */ 1531 s->init_num=n+4; 1532 s->init_off=0; 1533 } 1534 1535 /* SSL3_ST_CW_KEY_EXCH_B */ 1536 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 1537err: 1538 return(-1); 1539 } 1540 1541static int ssl3_send_client_verify(SSL *s) 1542 { 1543 unsigned char *p,*d; 1544 unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH]; 1545 EVP_PKEY *pkey; 1546#ifndef NO_RSA 1547 unsigned u=0; 1548#endif 1549 unsigned long n; 1550#ifndef NO_DSA 1551 int j; 1552#endif 1553 1554 if (s->state == SSL3_ST_CW_CERT_VRFY_A) 1555 { 1556 d=(unsigned char *)s->init_buf->data; 1557 p= &(d[4]); 1558 pkey=s->cert->key->privatekey; 1559 1560 s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2), 1561 &(data[MD5_DIGEST_LENGTH])); 1562 1563#ifndef NO_RSA 1564 if (pkey->type == EVP_PKEY_RSA) 1565 { 1566 s->method->ssl3_enc->cert_verify_mac(s, 1567 &(s->s3->finish_dgst1),&(data[0])); 1568 if (RSA_sign(NID_md5_sha1, data, 1569 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, 1570 &(p[2]), &u, pkey->pkey.rsa) <= 0 ) 1571 { 1572 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB); 1573 goto err; 1574 } 1575 s2n(u,p); 1576 n=u+2; 1577 } 1578 else 1579#endif 1580#ifndef NO_DSA 1581 if (pkey->type == EVP_PKEY_DSA) 1582 { 1583 if (!DSA_sign(pkey->save_type, 1584 &(data[MD5_DIGEST_LENGTH]), 1585 SHA_DIGEST_LENGTH,&(p[2]), 1586 (unsigned int *)&j,pkey->pkey.dsa)) 1587 { 1588 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB); 1589 goto err; 1590 } 1591 s2n(j,p); 1592 n=j+2; 1593 } 1594 else 1595#endif 1596 { 1597 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,SSL_R_INTERNAL_ERROR); 1598 goto err; 1599 } 1600 *(d++)=SSL3_MT_CERTIFICATE_VERIFY; 1601 l2n3(n,d); 1602 1603 s->init_num=(int)n+4; 1604 s->init_off=0; 1605 } 1606 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 1607err: 1608 return(-1); 1609 } 1610 1611static int ssl3_send_client_certificate(SSL *s) 1612 { 1613 X509 *x509=NULL; 1614 EVP_PKEY *pkey=NULL; 1615 int i; 1616 unsigned long l; 1617 1618 if (s->state == SSL3_ST_CW_CERT_A) 1619 { 1620 if ((s->cert == NULL) || 1621 (s->cert->key->x509 == NULL) || 1622 (s->cert->key->privatekey == NULL)) 1623 s->state=SSL3_ST_CW_CERT_B; 1624 else 1625 s->state=SSL3_ST_CW_CERT_C; 1626 } 1627 1628 /* We need to get a client cert */ 1629 if (s->state == SSL3_ST_CW_CERT_B) 1630 { 1631 /* If we get an error, we need to 1632 * ssl->rwstate=SSL_X509_LOOKUP; return(-1); 1633 * We then get retied later */ 1634 i=0; 1635 if (s->ctx->client_cert_cb != NULL) 1636 i=s->ctx->client_cert_cb(s,&(x509),&(pkey)); 1637 if (i < 0) 1638 { 1639 s->rwstate=SSL_X509_LOOKUP; 1640 return(-1); 1641 } 1642 s->rwstate=SSL_NOTHING; 1643 if ((i == 1) && (pkey != NULL) && (x509 != NULL)) 1644 { 1645 s->state=SSL3_ST_CW_CERT_B; 1646 if ( !SSL_use_certificate(s,x509) || 1647 !SSL_use_PrivateKey(s,pkey)) 1648 i=0; 1649 } 1650 else if (i == 1) 1651 { 1652 i=0; 1653 SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); 1654 } 1655 1656 if (x509 != NULL) X509_free(x509); 1657 if (pkey != NULL) EVP_PKEY_free(pkey); 1658 if (i == 0) 1659 { 1660 if (s->version == SSL3_VERSION) 1661 { 1662 s->s3->tmp.cert_req=0; 1663 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE); 1664 return(1); 1665 } 1666 else 1667 { 1668 s->s3->tmp.cert_req=2; 1669 } 1670 } 1671 1672 /* Ok, we have a cert */ 1673 s->state=SSL3_ST_CW_CERT_C; 1674 } 1675 1676 if (s->state == SSL3_ST_CW_CERT_C) 1677 { 1678 s->state=SSL3_ST_CW_CERT_D; 1679 l=ssl3_output_cert_chain(s, 1680 (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509); 1681 s->init_num=(int)l; 1682 s->init_off=0; 1683 } 1684 /* SSL3_ST_CW_CERT_D */ 1685 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 1686 } 1687 1688#define has_bits(i,m) (((i)&(m)) == (m)) 1689 1690static int ssl3_check_cert_and_algorithm(SSL *s) 1691 { 1692 int i,idx; 1693 long algs; 1694 EVP_PKEY *pkey=NULL; 1695 SESS_CERT *sc; 1696#ifndef NO_RSA 1697 RSA *rsa; 1698#endif 1699#ifndef NO_DH 1700 DH *dh; 1701#endif 1702 1703 sc=s->session->sess_cert; 1704 1705 if (sc == NULL) 1706 { 1707 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR); 1708 goto err; 1709 } 1710 1711 algs=s->s3->tmp.new_cipher->algorithms; 1712 1713 /* we don't have a certificate */ 1714 if (algs & (SSL_aDH|SSL_aNULL)) 1715 return(1); 1716 1717#ifndef NO_RSA 1718 rsa=s->session->sess_cert->peer_rsa_tmp; 1719#endif 1720#ifndef NO_DH 1721 dh=s->session->sess_cert->peer_dh_tmp; 1722#endif 1723 1724 /* This is the passed certificate */ 1725 1726 idx=sc->peer_cert_type; 1727 pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509); 1728 i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey); 1729 EVP_PKEY_free(pkey); 1730 1731 1732 /* Check that we have a certificate if we require one */ 1733 if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN)) 1734 { 1735 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT); 1736 goto f_err; 1737 } 1738#ifndef NO_DSA 1739 else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN)) 1740 { 1741 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT); 1742 goto f_err; 1743 } 1744#endif 1745#ifndef NO_RSA 1746 if ((algs & SSL_kRSA) && 1747 !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL))) 1748 { 1749 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT); 1750 goto f_err; 1751 } 1752#endif 1753#ifndef NO_DH 1754 if ((algs & SSL_kEDH) && 1755 !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) 1756 { 1757 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY); 1758 goto f_err; 1759 } 1760 else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA)) 1761 { 1762 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT); 1763 goto f_err; 1764 } 1765#ifndef NO_DSA 1766 else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA)) 1767 { 1768 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT); 1769 goto f_err; 1770 } 1771#endif 1772#endif 1773 1774 if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP)) 1775 { 1776#ifndef NO_RSA 1777 if (algs & SSL_kRSA) 1778 { 1779 if (rsa == NULL 1780 || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) 1781 { 1782 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY); 1783 goto f_err; 1784 } 1785 } 1786 else 1787#endif 1788#ifndef NO_DH 1789 if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) 1790 { 1791 if (dh == NULL 1792 || DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) 1793 { 1794 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY); 1795 goto f_err; 1796 } 1797 } 1798 else 1799#endif 1800 { 1801 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); 1802 goto f_err; 1803 } 1804 } 1805 return(1); 1806f_err: 1807 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1808err: 1809 return(0); 1810 } 1811
| 554 memcpy(p,s->session->session_id,i); 555 p+=i; 556 } 557 558 /* Ciphers supported */ 559 i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2])); 560 if (i == 0) 561 { 562 SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE); 563 goto err; 564 } 565 s2n(i,p); 566 p+=i; 567 568 /* COMPRESSION */ 569 if (s->ctx->comp_methods == NULL) 570 j=0; 571 else 572 j=sk_SSL_COMP_num(s->ctx->comp_methods); 573 *(p++)=1+j; 574 for (i=0; i<j; i++) 575 { 576 comp=sk_SSL_COMP_value(s->ctx->comp_methods,i); 577 *(p++)=comp->id; 578 } 579 *(p++)=0; /* Add the NULL method */ 580 581 l=(p-d); 582 d=buf; 583 *(d++)=SSL3_MT_CLIENT_HELLO; 584 l2n3(l,d); 585 586 s->state=SSL3_ST_CW_CLNT_HELLO_B; 587 /* number of bytes to write */ 588 s->init_num=p-buf; 589 s->init_off=0; 590 } 591 592 /* SSL3_ST_CW_CLNT_HELLO_B */ 593 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 594err: 595 return(-1); 596 } 597 598static int ssl3_get_server_hello(SSL *s) 599 { 600 STACK_OF(SSL_CIPHER) *sk; 601 SSL_CIPHER *c; 602 unsigned char *p,*d; 603 int i,al,ok; 604 unsigned int j; 605 long n; 606 SSL_COMP *comp; 607 608 n=ssl3_get_message(s, 609 SSL3_ST_CR_SRVR_HELLO_A, 610 SSL3_ST_CR_SRVR_HELLO_B, 611 SSL3_MT_SERVER_HELLO, 612 300, /* ?? */ 613 &ok); 614 615 if (!ok) return((int)n); 616 d=p=(unsigned char *)s->init_buf->data; 617 618 if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff))) 619 { 620 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION); 621 s->version=(s->version&0xff00)|p[1]; 622 al=SSL_AD_PROTOCOL_VERSION; 623 goto f_err; 624 } 625 p+=2; 626 627 /* load the server hello data */ 628 /* load the server random */ 629 memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE); 630 p+=SSL3_RANDOM_SIZE; 631 632 /* get the session-id */ 633 j= *(p++); 634 635 if(j > sizeof s->session->session_id) 636 { 637 al=SSL_AD_ILLEGAL_PARAMETER; 638 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 639 SSL_R_SSL3_SESSION_ID_TOO_LONG); 640 goto f_err; 641 } 642 643 if ((j != 0) && (j != SSL3_SESSION_ID_SIZE)) 644 { 645 /* SSLref returns 16 :-( */ 646 if (j < SSL2_SSL_SESSION_ID_LENGTH) 647 { 648 al=SSL_AD_ILLEGAL_PARAMETER; 649 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_SHORT); 650 goto f_err; 651 } 652 } 653 if (j != 0 && j == s->session->session_id_length 654 && memcmp(p,s->session->session_id,j) == 0) 655 { 656 if(s->sid_ctx_length != s->session->sid_ctx_length 657 || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length)) 658 { 659 al=SSL_AD_ILLEGAL_PARAMETER; 660 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 661 goto f_err; 662 } 663 s->hit=1; 664 } 665 else /* a miss or crap from the other end */ 666 { 667 /* If we were trying for session-id reuse, make a new 668 * SSL_SESSION so we don't stuff up other people */ 669 s->hit=0; 670 if (s->session->session_id_length > 0) 671 { 672 if (!ssl_get_new_session(s,0)) 673 { 674 al=SSL_AD_INTERNAL_ERROR; 675 goto f_err; 676 } 677 } 678 s->session->session_id_length=j; 679 memcpy(s->session->session_id,p,j); /* j could be 0 */ 680 } 681 p+=j; 682 c=ssl_get_cipher_by_char(s,p); 683 if (c == NULL) 684 { 685 /* unknown cipher */ 686 al=SSL_AD_ILLEGAL_PARAMETER; 687 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED); 688 goto f_err; 689 } 690 p+=ssl_put_cipher_by_char(s,NULL,NULL); 691 692 sk=ssl_get_ciphers_by_id(s); 693 i=sk_SSL_CIPHER_find(sk,c); 694 if (i < 0) 695 { 696 /* we did not say we would use this cipher */ 697 al=SSL_AD_ILLEGAL_PARAMETER; 698 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED); 699 goto f_err; 700 } 701 702 if (s->hit && (s->session->cipher != c)) 703 { 704 if (!(s->options & 705 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) 706 { 707 al=SSL_AD_ILLEGAL_PARAMETER; 708 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); 709 goto f_err; 710 } 711 } 712 s->s3->tmp.new_cipher=c; 713 714 /* lets get the compression algorithm */ 715 /* COMPRESSION */ 716 j= *(p++); 717 if (j == 0) 718 comp=NULL; 719 else 720 comp=ssl3_comp_find(s->ctx->comp_methods,j); 721 722 if ((j != 0) && (comp == NULL)) 723 { 724 al=SSL_AD_ILLEGAL_PARAMETER; 725 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 726 goto f_err; 727 } 728 else 729 { 730 s->s3->tmp.new_compression=comp; 731 } 732 733 if (p != (d+n)) 734 { 735 /* wrong packet length */ 736 al=SSL_AD_DECODE_ERROR; 737 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH); 738 goto err; 739 } 740 741 return(1); 742f_err: 743 ssl3_send_alert(s,SSL3_AL_FATAL,al); 744err: 745 return(-1); 746 } 747 748static int ssl3_get_server_certificate(SSL *s) 749 { 750 int al,i,ok,ret= -1; 751 unsigned long n,nc,llen,l; 752 X509 *x=NULL; 753 unsigned char *p,*d,*q; 754 STACK_OF(X509) *sk=NULL; 755 SESS_CERT *sc; 756 EVP_PKEY *pkey=NULL; 757 758 n=ssl3_get_message(s, 759 SSL3_ST_CR_CERT_A, 760 SSL3_ST_CR_CERT_B, 761 -1, 762#if defined(MSDOS) && !defined(WIN32) 763 1024*30, /* 30k max cert list :-) */ 764#else 765 1024*100, /* 100k max cert list :-) */ 766#endif 767 &ok); 768 769 if (!ok) return((int)n); 770 771 if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) 772 { 773 s->s3->tmp.reuse_message=1; 774 return(1); 775 } 776 777 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE) 778 { 779 al=SSL_AD_UNEXPECTED_MESSAGE; 780 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE); 781 goto f_err; 782 } 783 d=p=(unsigned char *)s->init_buf->data; 784 785 if ((sk=sk_X509_new_null()) == NULL) 786 { 787 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE); 788 goto err; 789 } 790 791 n2l3(p,llen); 792 if (llen+3 != n) 793 { 794 al=SSL_AD_DECODE_ERROR; 795 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH); 796 goto f_err; 797 } 798 for (nc=0; nc<llen; ) 799 { 800 n2l3(p,l); 801 if ((l+nc+3) > llen) 802 { 803 al=SSL_AD_DECODE_ERROR; 804 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); 805 goto f_err; 806 } 807 808 q=p; 809 x=d2i_X509(NULL,&q,l); 810 if (x == NULL) 811 { 812 al=SSL_AD_BAD_CERTIFICATE; 813 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB); 814 goto f_err; 815 } 816 if (q != (p+l)) 817 { 818 al=SSL_AD_DECODE_ERROR; 819 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH); 820 goto f_err; 821 } 822 if (!sk_X509_push(sk,x)) 823 { 824 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE); 825 goto err; 826 } 827 x=NULL; 828 nc+=l+3; 829 p=q; 830 } 831 832 i=ssl_verify_cert_chain(s,sk); 833 if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)) 834 { 835 al=ssl_verify_alarm_type(s->verify_result); 836 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED); 837 goto f_err; 838 } 839 ERR_clear_error(); /* but we keep s->verify_result */ 840 841 sc=ssl_sess_cert_new(); 842 if (sc == NULL) goto err; 843 844 if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert); 845 s->session->sess_cert=sc; 846 847 sc->cert_chain=sk; 848 /* Inconsistency alert: cert_chain does include the peer's 849 * certificate, which we don't include in s3_srvr.c */ 850 x=sk_X509_value(sk,0); 851 sk=NULL; 852 853 pkey=X509_get_pubkey(x); 854 855 if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)) 856 { 857 x=NULL; 858 al=SSL3_AL_FATAL; 859 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); 860 goto f_err; 861 } 862 863 i=ssl_cert_type(x,pkey); 864 if (i < 0) 865 { 866 x=NULL; 867 al=SSL3_AL_FATAL; 868 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_UNKNOWN_CERTIFICATE_TYPE); 869 goto f_err; 870 } 871 872 sc->peer_cert_type=i; 873 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 874 if (sc->peer_pkeys[i].x509 != NULL) /* Why would this ever happen? 875 * We just created sc a couple of 876 * lines ago. */ 877 X509_free(sc->peer_pkeys[i].x509); 878 sc->peer_pkeys[i].x509=x; 879 sc->peer_key= &(sc->peer_pkeys[i]); 880 881 if (s->session->peer != NULL) 882 X509_free(s->session->peer); 883 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 884 s->session->peer=x; 885 s->session->verify_result = s->verify_result; 886 887 x=NULL; 888 ret=1; 889 890 if (0) 891 { 892f_err: 893 ssl3_send_alert(s,SSL3_AL_FATAL,al); 894 } 895err: 896 EVP_PKEY_free(pkey); 897 X509_free(x); 898 sk_X509_pop_free(sk,X509_free); 899 return(ret); 900 } 901 902static int ssl3_get_key_exchange(SSL *s) 903 { 904#ifndef NO_RSA 905 unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2]; 906#endif 907 EVP_MD_CTX md_ctx; 908 unsigned char *param,*p; 909 int al,i,j,param_len,ok; 910 long n,alg; 911 EVP_PKEY *pkey=NULL; 912#ifndef NO_RSA 913 RSA *rsa=NULL; 914#endif 915#ifndef NO_DH 916 DH *dh=NULL; 917#endif 918 919 /* use same message size as in ssl3_get_certificate_request() 920 * as ServerKeyExchange message may be skipped */ 921 n=ssl3_get_message(s, 922 SSL3_ST_CR_KEY_EXCH_A, 923 SSL3_ST_CR_KEY_EXCH_B, 924 -1, 925#if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32) 926 1024*30, /* 30k max cert list :-) */ 927#else 928 1024*100, /* 100k max cert list :-) */ 929#endif 930 &ok); 931 932 if (!ok) return((int)n); 933 934 if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE) 935 { 936 s->s3->tmp.reuse_message=1; 937 return(1); 938 } 939 940 param=p=(unsigned char *)s->init_buf->data; 941 942 if (s->session->sess_cert != NULL) 943 { 944#ifndef NO_RSA 945 if (s->session->sess_cert->peer_rsa_tmp != NULL) 946 { 947 RSA_free(s->session->sess_cert->peer_rsa_tmp); 948 s->session->sess_cert->peer_rsa_tmp=NULL; 949 } 950#endif 951#ifndef NO_DH 952 if (s->session->sess_cert->peer_dh_tmp) 953 { 954 DH_free(s->session->sess_cert->peer_dh_tmp); 955 s->session->sess_cert->peer_dh_tmp=NULL; 956 } 957#endif 958 } 959 else 960 { 961 s->session->sess_cert=ssl_sess_cert_new(); 962 } 963 964 param_len=0; 965 alg=s->s3->tmp.new_cipher->algorithms; 966 967#ifndef NO_RSA 968 if (alg & SSL_kRSA) 969 { 970 if ((rsa=RSA_new()) == NULL) 971 { 972 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE); 973 goto err; 974 } 975 n2s(p,i); 976 param_len=i+2; 977 if (param_len > n) 978 { 979 al=SSL_AD_DECODE_ERROR; 980 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH); 981 goto f_err; 982 } 983 if (!(rsa->n=BN_bin2bn(p,i,rsa->n))) 984 { 985 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 986 goto err; 987 } 988 p+=i; 989 990 n2s(p,i); 991 param_len+=i+2; 992 if (param_len > n) 993 { 994 al=SSL_AD_DECODE_ERROR; 995 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH); 996 goto f_err; 997 } 998 if (!(rsa->e=BN_bin2bn(p,i,rsa->e))) 999 { 1000 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1001 goto err; 1002 } 1003 p+=i; 1004 n-=param_len; 1005 1006 /* this should be because we are using an export cipher */ 1007 if (alg & SSL_aRSA) 1008 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1009 else 1010 { 1011 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1012 goto err; 1013 } 1014 s->session->sess_cert->peer_rsa_tmp=rsa; 1015 rsa=NULL; 1016 } 1017#else /* NO_RSA */ 1018 if (0) 1019 ; 1020#endif 1021#ifndef NO_DH 1022 else if (alg & SSL_kEDH) 1023 { 1024 if ((dh=DH_new()) == NULL) 1025 { 1026 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB); 1027 goto err; 1028 } 1029 n2s(p,i); 1030 param_len=i+2; 1031 if (param_len > n) 1032 { 1033 al=SSL_AD_DECODE_ERROR; 1034 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH); 1035 goto f_err; 1036 } 1037 if (!(dh->p=BN_bin2bn(p,i,NULL))) 1038 { 1039 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1040 goto err; 1041 } 1042 p+=i; 1043 1044 n2s(p,i); 1045 param_len+=i+2; 1046 if (param_len > n) 1047 { 1048 al=SSL_AD_DECODE_ERROR; 1049 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH); 1050 goto f_err; 1051 } 1052 if (!(dh->g=BN_bin2bn(p,i,NULL))) 1053 { 1054 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1055 goto err; 1056 } 1057 p+=i; 1058 1059 n2s(p,i); 1060 param_len+=i+2; 1061 if (param_len > n) 1062 { 1063 al=SSL_AD_DECODE_ERROR; 1064 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH); 1065 goto f_err; 1066 } 1067 if (!(dh->pub_key=BN_bin2bn(p,i,NULL))) 1068 { 1069 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB); 1070 goto err; 1071 } 1072 p+=i; 1073 n-=param_len; 1074 1075#ifndef NO_RSA 1076 if (alg & SSL_aRSA) 1077 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1078#else 1079 if (0) 1080 ; 1081#endif 1082#ifndef NO_DSA 1083 else if (alg & SSL_aDSS) 1084 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509); 1085#endif 1086 /* else anonymous DH, so no certificate or pkey. */ 1087 1088 s->session->sess_cert->peer_dh_tmp=dh; 1089 dh=NULL; 1090 } 1091 else if ((alg & SSL_kDHr) || (alg & SSL_kDHd)) 1092 { 1093 al=SSL_AD_ILLEGAL_PARAMETER; 1094 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); 1095 goto f_err; 1096 } 1097#endif /* !NO_DH */ 1098 if (alg & SSL_aFZA) 1099 { 1100 al=SSL_AD_HANDSHAKE_FAILURE; 1101 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); 1102 goto f_err; 1103 } 1104 1105 1106 /* p points to the next byte, there are 'n' bytes left */ 1107 1108 1109 /* if it was signed, check the signature */ 1110 if (pkey != NULL) 1111 { 1112 n2s(p,i); 1113 n-=2; 1114 j=EVP_PKEY_size(pkey); 1115 1116 if ((i != n) || (n > j) || (n <= 0)) 1117 { 1118 /* wrong packet length */ 1119 al=SSL_AD_DECODE_ERROR; 1120 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH); 1121 goto f_err; 1122 } 1123 1124#ifndef NO_RSA 1125 if (pkey->type == EVP_PKEY_RSA) 1126 { 1127 int num; 1128 1129 j=0; 1130 q=md_buf; 1131 for (num=2; num > 0; num--) 1132 { 1133 EVP_DigestInit(&md_ctx,(num == 2) 1134 ?s->ctx->md5:s->ctx->sha1); 1135 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); 1136 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); 1137 EVP_DigestUpdate(&md_ctx,param,param_len); 1138 EVP_DigestFinal(&md_ctx,q,(unsigned int *)&i); 1139 q+=i; 1140 j+=i; 1141 } 1142 i=RSA_verify(NID_md5_sha1, md_buf, j, p, n, 1143 pkey->pkey.rsa); 1144 if (i < 0) 1145 { 1146 al=SSL_AD_DECRYPT_ERROR; 1147 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); 1148 goto f_err; 1149 } 1150 if (i == 0) 1151 { 1152 /* bad signature */ 1153 al=SSL_AD_DECRYPT_ERROR; 1154 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE); 1155 goto f_err; 1156 } 1157 } 1158 else 1159#endif 1160#ifndef NO_DSA 1161 if (pkey->type == EVP_PKEY_DSA) 1162 { 1163 /* lets do DSS */ 1164 EVP_VerifyInit(&md_ctx,EVP_dss1()); 1165 EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE); 1166 EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE); 1167 EVP_VerifyUpdate(&md_ctx,param,param_len); 1168 if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey)) 1169 { 1170 /* bad signature */ 1171 al=SSL_AD_DECRYPT_ERROR; 1172 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE); 1173 goto f_err; 1174 } 1175 } 1176 else 1177#endif 1178 { 1179 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1180 goto err; 1181 } 1182 } 1183 else 1184 { 1185 /* still data left over */ 1186 if (!(alg & SSL_aNULL)) 1187 { 1188 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1189 goto err; 1190 } 1191 if (n != 0) 1192 { 1193 al=SSL_AD_DECODE_ERROR; 1194 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE); 1195 goto f_err; 1196 } 1197 } 1198 EVP_PKEY_free(pkey); 1199 return(1); 1200f_err: 1201 ssl3_send_alert(s,SSL3_AL_FATAL,al); 1202err: 1203 EVP_PKEY_free(pkey); 1204#ifndef NO_RSA 1205 if (rsa != NULL) 1206 RSA_free(rsa); 1207#endif 1208#ifndef NO_DH 1209 if (dh != NULL) 1210 DH_free(dh); 1211#endif 1212 return(-1); 1213 } 1214 1215static int ssl3_get_certificate_request(SSL *s) 1216 { 1217 int ok,ret=0; 1218 unsigned long n,nc,l; 1219 unsigned int llen,ctype_num,i; 1220 X509_NAME *xn=NULL; 1221 unsigned char *p,*d,*q; 1222 STACK_OF(X509_NAME) *ca_sk=NULL; 1223 1224 n=ssl3_get_message(s, 1225 SSL3_ST_CR_CERT_REQ_A, 1226 SSL3_ST_CR_CERT_REQ_B, 1227 -1, 1228#if defined(MSDOS) && !defined(WIN32) 1229 1024*30, /* 30k max cert list :-) */ 1230#else 1231 1024*100, /* 100k max cert list :-) */ 1232#endif 1233 &ok); 1234 1235 if (!ok) return((int)n); 1236 1237 s->s3->tmp.cert_req=0; 1238 1239 if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE) 1240 { 1241 s->s3->tmp.reuse_message=1; 1242 return(1); 1243 } 1244 1245 if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST) 1246 { 1247 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); 1248 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE); 1249 goto err; 1250 } 1251 1252 /* TLS does not like anon-DH with client cert */ 1253 if (s->version > SSL3_VERSION) 1254 { 1255 l=s->s3->tmp.new_cipher->algorithms; 1256 if (l & SSL_aNULL) 1257 { 1258 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); 1259 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER); 1260 goto err; 1261 } 1262 } 1263 1264 d=p=(unsigned char *)s->init_buf->data; 1265 1266 if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL) 1267 { 1268 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE); 1269 goto err; 1270 } 1271 1272 /* get the certificate types */ 1273 ctype_num= *(p++); 1274 if (ctype_num > SSL3_CT_NUMBER) 1275 ctype_num=SSL3_CT_NUMBER; 1276 for (i=0; i<ctype_num; i++) 1277 s->s3->tmp.ctype[i]= p[i]; 1278 p+=ctype_num; 1279 1280 /* get the CA RDNs */ 1281 n2s(p,llen); 1282#if 0 1283{ 1284FILE *out; 1285out=fopen("/tmp/vsign.der","w"); 1286fwrite(p,1,llen,out); 1287fclose(out); 1288} 1289#endif 1290 1291 if ((llen+ctype_num+2+1) != n) 1292 { 1293 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1294 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH); 1295 goto err; 1296 } 1297 1298 for (nc=0; nc<llen; ) 1299 { 1300 n2s(p,l); 1301 if ((l+nc+2) > llen) 1302 { 1303 if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG)) 1304 goto cont; /* netscape bugs */ 1305 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1306 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG); 1307 goto err; 1308 } 1309 1310 q=p; 1311 1312 if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL) 1313 { 1314 /* If netscape tolerance is on, ignore errors */ 1315 if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG) 1316 goto cont; 1317 else 1318 { 1319 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1320 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB); 1321 goto err; 1322 } 1323 } 1324 1325 if (q != (p+l)) 1326 { 1327 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1328 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH); 1329 goto err; 1330 } 1331 if (!sk_X509_NAME_push(ca_sk,xn)) 1332 { 1333 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE); 1334 goto err; 1335 } 1336 1337 p+=l; 1338 nc+=l+2; 1339 } 1340 1341 if (0) 1342 { 1343cont: 1344 ERR_clear_error(); 1345 } 1346 1347 /* we should setup a certificate to return.... */ 1348 s->s3->tmp.cert_req=1; 1349 s->s3->tmp.ctype_num=ctype_num; 1350 if (s->s3->tmp.ca_names != NULL) 1351 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 1352 s->s3->tmp.ca_names=ca_sk; 1353 ca_sk=NULL; 1354 1355 ret=1; 1356err: 1357 if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free); 1358 return(ret); 1359 } 1360 1361static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b) 1362 { 1363 return(X509_NAME_cmp(*a,*b)); 1364 } 1365 1366static int ssl3_get_server_done(SSL *s) 1367 { 1368 int ok,ret=0; 1369 long n; 1370 1371 n=ssl3_get_message(s, 1372 SSL3_ST_CR_SRVR_DONE_A, 1373 SSL3_ST_CR_SRVR_DONE_B, 1374 SSL3_MT_SERVER_DONE, 1375 30, /* should be very small, like 0 :-) */ 1376 &ok); 1377 1378 if (!ok) return((int)n); 1379 if (n > 0) 1380 { 1381 /* should contain no data */ 1382 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR); 1383 SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH); 1384 return -1; 1385 } 1386 ret=1; 1387 return(ret); 1388 } 1389 1390static int ssl3_send_client_key_exchange(SSL *s) 1391 { 1392 unsigned char *p,*d; 1393 int n; 1394 unsigned long l; 1395#ifndef NO_RSA 1396 unsigned char *q; 1397 EVP_PKEY *pkey=NULL; 1398#endif 1399 1400 if (s->state == SSL3_ST_CW_KEY_EXCH_A) 1401 { 1402 d=(unsigned char *)s->init_buf->data; 1403 p= &(d[4]); 1404 1405 l=s->s3->tmp.new_cipher->algorithms; 1406 1407#ifndef NO_RSA 1408 if (l & SSL_kRSA) 1409 { 1410 RSA *rsa; 1411 unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH]; 1412 1413 if (s->session->sess_cert->peer_rsa_tmp != NULL) 1414 rsa=s->session->sess_cert->peer_rsa_tmp; 1415 else 1416 { 1417 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1418 if ((pkey == NULL) || 1419 (pkey->type != EVP_PKEY_RSA) || 1420 (pkey->pkey.rsa == NULL)) 1421 { 1422 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1423 goto err; 1424 } 1425 rsa=pkey->pkey.rsa; 1426 EVP_PKEY_free(pkey); 1427 } 1428 1429 tmp_buf[0]=s->client_version>>8; 1430 tmp_buf[1]=s->client_version&0xff; 1431 if (RAND_bytes(&(tmp_buf[2]),SSL_MAX_MASTER_KEY_LENGTH-2) <= 0) 1432 goto err; 1433 1434 s->session->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; 1435 1436 q=p; 1437 /* Fix buf for TLS and beyond */ 1438 if (s->version > SSL3_VERSION) 1439 p+=2; 1440 n=RSA_public_encrypt(SSL_MAX_MASTER_KEY_LENGTH, 1441 tmp_buf,p,rsa,RSA_PKCS1_PADDING); 1442#ifdef PKCS1_CHECK 1443 if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++; 1444 if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70; 1445#endif 1446 if (n <= 0) 1447 { 1448 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT); 1449 goto err; 1450 } 1451 1452 /* Fix buf for TLS and beyond */ 1453 if (s->version > SSL3_VERSION) 1454 { 1455 s2n(n,q); 1456 n+=2; 1457 } 1458 1459 s->session->master_key_length= 1460 s->method->ssl3_enc->generate_master_secret(s, 1461 s->session->master_key, 1462 tmp_buf,SSL_MAX_MASTER_KEY_LENGTH); 1463 memset(tmp_buf,0,SSL_MAX_MASTER_KEY_LENGTH); 1464 } 1465 else 1466#endif 1467#ifndef NO_DH 1468 if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) 1469 { 1470 DH *dh_srvr,*dh_clnt; 1471 1472 if (s->session->sess_cert->peer_dh_tmp != NULL) 1473 dh_srvr=s->session->sess_cert->peer_dh_tmp; 1474 else 1475 { 1476 /* we get them from the cert */ 1477 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1478 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS); 1479 goto err; 1480 } 1481 1482 /* generate a new random key */ 1483 if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL) 1484 { 1485 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); 1486 goto err; 1487 } 1488 if (!DH_generate_key(dh_clnt)) 1489 { 1490 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); 1491 goto err; 1492 } 1493 1494 /* use the 'p' output buffer for the DH key, but 1495 * make sure to clear it out afterwards */ 1496 1497 n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt); 1498 1499 if (n <= 0) 1500 { 1501 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB); 1502 goto err; 1503 } 1504 1505 /* generate master key from the result */ 1506 s->session->master_key_length= 1507 s->method->ssl3_enc->generate_master_secret(s, 1508 s->session->master_key,p,n); 1509 /* clean up */ 1510 memset(p,0,n); 1511 1512 /* send off the data */ 1513 n=BN_num_bytes(dh_clnt->pub_key); 1514 s2n(n,p); 1515 BN_bn2bin(dh_clnt->pub_key,p); 1516 n+=2; 1517 1518 DH_free(dh_clnt); 1519 1520 /* perhaps clean things up a bit EAY EAY EAY EAY*/ 1521 } 1522 else 1523#endif 1524 { 1525 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1526 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_INTERNAL_ERROR); 1527 goto err; 1528 } 1529 1530 *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE; 1531 l2n3(n,d); 1532 1533 s->state=SSL3_ST_CW_KEY_EXCH_B; 1534 /* number of bytes to write */ 1535 s->init_num=n+4; 1536 s->init_off=0; 1537 } 1538 1539 /* SSL3_ST_CW_KEY_EXCH_B */ 1540 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 1541err: 1542 return(-1); 1543 } 1544 1545static int ssl3_send_client_verify(SSL *s) 1546 { 1547 unsigned char *p,*d; 1548 unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH]; 1549 EVP_PKEY *pkey; 1550#ifndef NO_RSA 1551 unsigned u=0; 1552#endif 1553 unsigned long n; 1554#ifndef NO_DSA 1555 int j; 1556#endif 1557 1558 if (s->state == SSL3_ST_CW_CERT_VRFY_A) 1559 { 1560 d=(unsigned char *)s->init_buf->data; 1561 p= &(d[4]); 1562 pkey=s->cert->key->privatekey; 1563 1564 s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2), 1565 &(data[MD5_DIGEST_LENGTH])); 1566 1567#ifndef NO_RSA 1568 if (pkey->type == EVP_PKEY_RSA) 1569 { 1570 s->method->ssl3_enc->cert_verify_mac(s, 1571 &(s->s3->finish_dgst1),&(data[0])); 1572 if (RSA_sign(NID_md5_sha1, data, 1573 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, 1574 &(p[2]), &u, pkey->pkey.rsa) <= 0 ) 1575 { 1576 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB); 1577 goto err; 1578 } 1579 s2n(u,p); 1580 n=u+2; 1581 } 1582 else 1583#endif 1584#ifndef NO_DSA 1585 if (pkey->type == EVP_PKEY_DSA) 1586 { 1587 if (!DSA_sign(pkey->save_type, 1588 &(data[MD5_DIGEST_LENGTH]), 1589 SHA_DIGEST_LENGTH,&(p[2]), 1590 (unsigned int *)&j,pkey->pkey.dsa)) 1591 { 1592 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB); 1593 goto err; 1594 } 1595 s2n(j,p); 1596 n=j+2; 1597 } 1598 else 1599#endif 1600 { 1601 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,SSL_R_INTERNAL_ERROR); 1602 goto err; 1603 } 1604 *(d++)=SSL3_MT_CERTIFICATE_VERIFY; 1605 l2n3(n,d); 1606 1607 s->init_num=(int)n+4; 1608 s->init_off=0; 1609 } 1610 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 1611err: 1612 return(-1); 1613 } 1614 1615static int ssl3_send_client_certificate(SSL *s) 1616 { 1617 X509 *x509=NULL; 1618 EVP_PKEY *pkey=NULL; 1619 int i; 1620 unsigned long l; 1621 1622 if (s->state == SSL3_ST_CW_CERT_A) 1623 { 1624 if ((s->cert == NULL) || 1625 (s->cert->key->x509 == NULL) || 1626 (s->cert->key->privatekey == NULL)) 1627 s->state=SSL3_ST_CW_CERT_B; 1628 else 1629 s->state=SSL3_ST_CW_CERT_C; 1630 } 1631 1632 /* We need to get a client cert */ 1633 if (s->state == SSL3_ST_CW_CERT_B) 1634 { 1635 /* If we get an error, we need to 1636 * ssl->rwstate=SSL_X509_LOOKUP; return(-1); 1637 * We then get retied later */ 1638 i=0; 1639 if (s->ctx->client_cert_cb != NULL) 1640 i=s->ctx->client_cert_cb(s,&(x509),&(pkey)); 1641 if (i < 0) 1642 { 1643 s->rwstate=SSL_X509_LOOKUP; 1644 return(-1); 1645 } 1646 s->rwstate=SSL_NOTHING; 1647 if ((i == 1) && (pkey != NULL) && (x509 != NULL)) 1648 { 1649 s->state=SSL3_ST_CW_CERT_B; 1650 if ( !SSL_use_certificate(s,x509) || 1651 !SSL_use_PrivateKey(s,pkey)) 1652 i=0; 1653 } 1654 else if (i == 1) 1655 { 1656 i=0; 1657 SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); 1658 } 1659 1660 if (x509 != NULL) X509_free(x509); 1661 if (pkey != NULL) EVP_PKEY_free(pkey); 1662 if (i == 0) 1663 { 1664 if (s->version == SSL3_VERSION) 1665 { 1666 s->s3->tmp.cert_req=0; 1667 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE); 1668 return(1); 1669 } 1670 else 1671 { 1672 s->s3->tmp.cert_req=2; 1673 } 1674 } 1675 1676 /* Ok, we have a cert */ 1677 s->state=SSL3_ST_CW_CERT_C; 1678 } 1679 1680 if (s->state == SSL3_ST_CW_CERT_C) 1681 { 1682 s->state=SSL3_ST_CW_CERT_D; 1683 l=ssl3_output_cert_chain(s, 1684 (s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509); 1685 s->init_num=(int)l; 1686 s->init_off=0; 1687 } 1688 /* SSL3_ST_CW_CERT_D */ 1689 return(ssl3_do_write(s,SSL3_RT_HANDSHAKE)); 1690 } 1691 1692#define has_bits(i,m) (((i)&(m)) == (m)) 1693 1694static int ssl3_check_cert_and_algorithm(SSL *s) 1695 { 1696 int i,idx; 1697 long algs; 1698 EVP_PKEY *pkey=NULL; 1699 SESS_CERT *sc; 1700#ifndef NO_RSA 1701 RSA *rsa; 1702#endif 1703#ifndef NO_DH 1704 DH *dh; 1705#endif 1706 1707 sc=s->session->sess_cert; 1708 1709 if (sc == NULL) 1710 { 1711 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_INTERNAL_ERROR); 1712 goto err; 1713 } 1714 1715 algs=s->s3->tmp.new_cipher->algorithms; 1716 1717 /* we don't have a certificate */ 1718 if (algs & (SSL_aDH|SSL_aNULL)) 1719 return(1); 1720 1721#ifndef NO_RSA 1722 rsa=s->session->sess_cert->peer_rsa_tmp; 1723#endif 1724#ifndef NO_DH 1725 dh=s->session->sess_cert->peer_dh_tmp; 1726#endif 1727 1728 /* This is the passed certificate */ 1729 1730 idx=sc->peer_cert_type; 1731 pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509); 1732 i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey); 1733 EVP_PKEY_free(pkey); 1734 1735 1736 /* Check that we have a certificate if we require one */ 1737 if ((algs & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN)) 1738 { 1739 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT); 1740 goto f_err; 1741 } 1742#ifndef NO_DSA 1743 else if ((algs & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN)) 1744 { 1745 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT); 1746 goto f_err; 1747 } 1748#endif 1749#ifndef NO_RSA 1750 if ((algs & SSL_kRSA) && 1751 !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL))) 1752 { 1753 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT); 1754 goto f_err; 1755 } 1756#endif 1757#ifndef NO_DH 1758 if ((algs & SSL_kEDH) && 1759 !(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) 1760 { 1761 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY); 1762 goto f_err; 1763 } 1764 else if ((algs & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA)) 1765 { 1766 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT); 1767 goto f_err; 1768 } 1769#ifndef NO_DSA 1770 else if ((algs & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA)) 1771 { 1772 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT); 1773 goto f_err; 1774 } 1775#endif 1776#endif 1777 1778 if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP)) 1779 { 1780#ifndef NO_RSA 1781 if (algs & SSL_kRSA) 1782 { 1783 if (rsa == NULL 1784 || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) 1785 { 1786 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY); 1787 goto f_err; 1788 } 1789 } 1790 else 1791#endif 1792#ifndef NO_DH 1793 if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) 1794 { 1795 if (dh == NULL 1796 || DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)) 1797 { 1798 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY); 1799 goto f_err; 1800 } 1801 } 1802 else 1803#endif 1804 { 1805 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); 1806 goto f_err; 1807 } 1808 } 1809 return(1); 1810f_err: 1811 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1812err: 1813 return(0); 1814 } 1815
|