Upgrade chrome's OpenSSL to same version Android ships with.

openssl/ssl/d1_clnt.c

 /* ssl/d1_clnt.c */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
  */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer. 
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
@@ skipping 90 matching lines @@
  * SUCH DAMAGE.
  * 
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
 
 #include <stdio.h>
 #include "ssl_locl.h"
+#ifndef OPENSSL_NO_KRB5
 #include "kssl_lcl.h"
+#endif
 #include <openssl/buffer.h>
 #include <openssl/rand.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/md5.h>
+#include <openssl/bn.h>
 #ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
 #endif
 
-static SSL_METHOD *dtls1_get_client_method(int ver);
+static const SSL_METHOD *dtls1_get_client_method(int ver);
 static int dtls1_get_hello_verify(SSL *s);
 
-static SSL_METHOD *dtls1_get_client_method(int ver)
+static const SSL_METHOD *dtls1_get_client_method(int ver)
         {
         if (ver == DTLS1_VERSION || ver == DTLS1_BAD_VER)
                 return(DTLSv1_client_method());
         else
                 return(NULL);
         }
 
 IMPLEMENT_dtls1_meth_func(DTLSv1_client_method,
                         ssl_undefined_function,
                         dtls1_connect,
                         dtls1_get_client_method)
 
 int dtls1_connect(SSL *s)
         {
         BUF_MEM *buf=NULL;
-        unsigned long Time=(unsigned long)time(NULL),l;
+        unsigned long Time=(unsigned long)time(NULL);
         void (*cb)(const SSL *ssl,int type,int val)=NULL;
         int ret= -1;
         int new_state,state,skip=0;;
 
         RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
         if (s->info_callback != NULL)
                 cb=s->info_callback;
@@ skipping 131 matching lines @@
                                 {
                                 s->hit = 1;
                                 if (s->tlsext_ticket_expected)
                                         s->state=SSL3_ST_CR_SESSION_TICKET_A;
                                 else
                                         s->state=SSL3_ST_CR_FINISHED_A;
                                 s->init_num=0;
                                 break;
                                 }
 #endif
-                        /* Check if it is anon DH */
-                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                        /* Check if it is anon DH or PSK */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
+                            !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK))
                                 {
                                 ret=ssl3_get_server_certificate(s);
                                 if (ret <= 0) goto end;
 #ifndef OPENSSL_NO_TLSEXT
                                 if (s->tlsext_status_expected)
                                         s->state=SSL3_ST_CR_CERT_STATUS_A;
                                 else
                                         s->state=SSL3_ST_CR_KEY_EXCH_A;
                                 }
                         else
@@ skipping 56 matching lines @@
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CW_KEY_EXCH_A;
                         s->init_num=0;
                         break;
 
                 case SSL3_ST_CW_KEY_EXCH_A:
                 case SSL3_ST_CW_KEY_EXCH_B:
                         dtls1_start_timer(s);
                         ret=dtls1_send_client_key_exchange(s);
                         if (ret <= 0) goto end;
-                        l=s->s3->tmp.new_cipher->algorithms;
                         /* EAY EAY EAY need to check for DH fix cert
                          * sent back */
                         /* For TLS, cert_req is set to 2, so a cert chain
                          * of nothing is sent, but no verify packet is sent */
                         if (s->s3->tmp.cert_req == 1)
                                 {
                                 s->state=SSL3_ST_CW_CERT_VRFY_A;
                                 }
                         else
                                 {
                                 s->state=SSL3_ST_CW_CHANGE_A;
                                 s->s3->change_cipher_spec=0;
                                 }
 
                         s->init_num=0;
                         break;
 
                 case SSL3_ST_CW_CERT_VRFY_A:
                 case SSL3_ST_CW_CERT_VRFY_B:
                         dtls1_start_timer(s);
                         ret=dtls1_send_client_verify(s);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CW_CHANGE_A;
                         s->init_num=0;
                         s->s3->change_cipher_spec=0;
                         break;
 
                 case SSL3_ST_CW_CHANGE_A:
                 case SSL3_ST_CW_CHANGE_B:
-                        dtls1_start_timer(s);
+                        if (!s->hit)
+                                dtls1_start_timer(s);
                         ret=dtls1_send_change_cipher_spec(s,
                                 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CW_FINISHED_A;
                         s->init_num=0;
 
                         s->session->cipher=s->s3->tmp.new_cipher;
 #ifdef OPENSSL_NO_COMP
                         s->session->compress_meth=0;
 #else
@@ skipping 14 matching lines @@
                                 {
                                 ret= -1;
                                 goto end;
                                 }
                         
                         dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
                         break;
 
                 case SSL3_ST_CW_FINISHED_A:
                 case SSL3_ST_CW_FINISHED_B:
-                        dtls1_start_timer(s);
+                        if (!s->hit)
+                                dtls1_start_timer(s);
                         ret=dtls1_send_finished(s,
                                 SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
                                 s->method->ssl3_enc->client_finished_label,
                                 s->method->ssl3_enc->client_finished_label_len);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CW_FLUSH;
 
                         /* clear flags */
                         s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
                         if (s->hit)
@@ skipping 11 matching lines @@
 #ifndef OPENSSL_NO_TLSEXT
                                 /* Allow NewSessionTicket if ticket expected */
                                 if (s->tlsext_ticket_expected)
                                         s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
                                 else
 #endif
                                 
                                 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
                                 }
                         s->init_num=0;
-
                         break;
 
 #ifndef OPENSSL_NO_TLSEXT
                 case SSL3_ST_CR_SESSION_TICKET_A:
                 case SSL3_ST_CR_SESSION_TICKET_B:
                         ret=ssl3_get_new_session_ticket(s);
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_CR_FINISHED_A;
                         s->init_num=0;
                 break;
@@ skipping 119 matching lines @@
                 SSL_SESSION *sess = s->session;
                 if ((s->session == NULL) ||
                         (s->session->ssl_version != s->version) ||
 #ifdef OPENSSL_NO_TLSEXT
                         !sess->session_id_length ||
 #else
                         (!sess->session_id_length && !sess->tlsext_tick) ||
 #endif
                         (s->session->not_resumable))
                         {
+                        if (!s->session_creation_enabled)
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+                                SSLerr(SSL_F_DTLS1_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+                                goto err;
+                                }
                         if (!ssl_get_new_session(s,0))
                                 goto err;
                         }
                 /* else use the pre-loaded session */
 
                 p=s->s3->client_random;
+
                 /* if client_random is initialized, reuse it, we are
                  * required to use same upon reply to HelloVerify */
                 for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++) ;
                 if (i==sizeof(s->s3->client_random))
                         {
                         Time=(unsigned long)time(NULL); /* Time */
                         l2n(Time,p);
-                        RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4);
+                        RAND_pseudo_bytes(p,sizeof(s->s3->client_random)-4);
                         }
 
                 /* Do the message type and length last */
                 d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
 
                 *(p++)=s->version>>8;
                 *(p++)=s->version&0xff;
                 s->client_version=s->version;
 
                 /* Random stuff */
@@ skipping 126 matching lines @@
 
 f_err:
         ssl3_send_alert(s, SSL3_AL_FATAL, al);
         return -1;
         }
 
 int dtls1_send_client_key_exchange(SSL *s)
         {
         unsigned char *p,*d;
         int n;
-        unsigned long l;
+        unsigned long alg_k;
 #ifndef OPENSSL_NO_RSA
         unsigned char *q;
         EVP_PKEY *pkey=NULL;
 #endif
 #ifndef OPENSSL_NO_KRB5
         KSSL_ERR kssl_err;
 #endif /* OPENSSL_NO_KRB5 */
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *clnt_ecdh = NULL;
+        const EC_POINT *srvr_ecpoint = NULL;
+        EVP_PKEY *srvr_pub_pkey = NULL;
+        unsigned char *encodedPoint = NULL;
+        int encoded_pt_len = 0;
+        BN_CTX * bn_ctx = NULL;
+#endif
 
         if (s->state == SSL3_ST_CW_KEY_EXCH_A)
                 {
                 d=(unsigned char *)s->init_buf->data;
                 p= &(d[DTLS1_HM_HEADER_LENGTH]);
-
-                l=s->s3->tmp.new_cipher->algorithms;
+                
+                alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
 
                 /* Fool emacs indentation */
                 if (0) {}
 #ifndef OPENSSL_NO_RSA
-                else if (l & SSL_kRSA)
+                else if (alg_k & SSL_kRSA)
                         {
                         RSA *rsa;
                         unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
 
                         if (s->session->sess_cert->peer_rsa_tmp != NULL)
                                 rsa=s->session->sess_cert->peer_rsa_tmp;
                         else
                                 {
                                 pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
                                 if ((pkey == NULL) ||
@@ skipping 38 matching lines @@
                                 }
 
                         s->session->master_key_length=
                                 s->method->ssl3_enc->generate_master_secret(s,
                                         s->session->master_key,
                                         tmp_buf,sizeof tmp_buf);
                         OPENSSL_cleanse(tmp_buf,sizeof tmp_buf);
                         }
 #endif
 #ifndef OPENSSL_NO_KRB5
-                else if (l & SSL_kKRB5)
+                else if (alg_k & SSL_kKRB5)
                         {
                         krb5_error_code krb5rc;
                         KSSL_CTX        *kssl_ctx = s->kssl_ctx;
                         /*  krb5_data   krb5_ap_req;  */
                         krb5_data       *enc_ticket;
                         krb5_data       authenticator, *authp = NULL;
                         EVP_CIPHER_CTX  ciph_ctx;
-                        EVP_CIPHER      *enc = NULL;
+                        const EVP_CIPHER *enc = NULL;
                         unsigned char   iv[EVP_MAX_IV_LENGTH];
                         unsigned char   tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
                         unsigned char   epms[SSL_MAX_MASTER_KEY_LENGTH 
                                                 + EVP_MAX_IV_LENGTH];
                         int             padl, outl = sizeof(epms);
 
                         EVP_CIPHER_CTX_init(&ciph_ctx);
 
 #ifdef KSSL_DEBUG
                         printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
-                                l, SSL_kKRB5);
+                                alg_k, SSL_kKRB5);
 #endif  /* KSSL_DEBUG */
 
                         authp = NULL;
 #ifdef KRB5SENDAUTH
                         if (KRB5SENDAUTH)  authp = &authenticator;
 #endif  /* KRB5SENDAUTH */
 
                         krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
                                 &kssl_err);
                         enc = kssl_map_enc(kssl_ctx->enctype);
@@ skipping 69 matching lines @@
                         **      EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
                         */
 
                         memset(iv, 0, sizeof iv);  /* per RFC 1510 */
                         EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
                                 kssl_ctx->key,iv);
                         EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
                                 sizeof tmp_buf);
                         EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
                         outl += padl;
-                        if (outl > sizeof epms)
+                        if (outl > (int)sizeof epms)
                                 {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
                                 goto err;
                                 }
                         EVP_CIPHER_CTX_cleanup(&ciph_ctx);
 
                         /*  KerberosWrapper.EncryptedPreMasterSecret    */
                         s2n(outl,p);
                         memcpy(p, epms, outl);
                         p+=outl;
                         n+=outl + 2;
 
                         s->session->master_key_length=
                                 s->method->ssl3_enc->generate_master_secret(s,
                                         s->session->master_key,
                                         tmp_buf, sizeof tmp_buf);
 
                         OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
                         OPENSSL_cleanse(epms, outl);
                         }
 #endif
 #ifndef OPENSSL_NO_DH
-                else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
+                else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                         {
                         DH *dh_srvr,*dh_clnt;
 
                         if (s->session->sess_cert->peer_dh_tmp != NULL)
                                 dh_srvr=s->session->sess_cert->peer_dh_tmp;
                         else
                                 {
                                 /* we get them from the cert */
                                 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
@@ skipping 34 matching lines @@
                         n=BN_num_bytes(dh_clnt->pub_key);
                         s2n(n,p);
                         BN_bn2bin(dh_clnt->pub_key,p);
                         n+=2;
 
                         DH_free(dh_clnt);
 
                         /* perhaps clean things up a bit EAY EAY EAY EAY*/
                         }
 #endif
+#ifndef OPENSSL_NO_ECDH 
+                else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
+                        {
+                        const EC_GROUP *srvr_group = NULL;
+                        EC_KEY *tkey;
+                        int ecdh_clnt_cert = 0;
+                        int field_size = 0;
+
+                        /* Did we send out the client's
+                         * ECDH share for use in premaster
+                         * computation as part of client certificate?
+                         * If so, set ecdh_clnt_cert to 1.
+                         */
+                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->cert != NULL)) 
+                                {
+                                /* XXX: For now, we do not support client
+                                 * authentication using ECDH certificates.
+                                 * To add such support, one needs to add
+                                 * code that checks for appropriate 
+                                 * conditions and sets ecdh_clnt_cert to 1.
+                                 * For example, the cert have an ECC
+                                 * key on the same curve as the server's
+                                 * and the key should be authorized for
+                                 * key agreement.
+                                 *
+                                 * One also needs to add code in ssl3_connect
+                                 * to skip sending the certificate verify
+                                 * message.
+                                 *
+                                 * if ((s->cert->key->privatekey != NULL) &&
+                                 *     (s->cert->key->privatekey->type ==
+                                 *      EVP_PKEY_EC) && ...)
+                                 * ecdh_clnt_cert = 1;
+                                 */
+                                }
+
+                        if (s->session->sess_cert->peer_ecdh_tmp != NULL)
+                                {
+                                tkey = s->session->sess_cert->peer_ecdh_tmp;
+                                }
+                        else
+                                {
+                                /* Get the Server Public Key from Cert */
+                                srvr_pub_pkey = X509_get_pubkey(s->session-> \
+                                    sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+                                if ((srvr_pub_pkey == NULL) ||
+                                    (srvr_pub_pkey->type != EVP_PKEY_EC) ||
+                                    (srvr_pub_pkey->pkey.ec == NULL))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_INTERNAL_ERROR);
+                                        goto err;
+                                        }
+
+                                tkey = srvr_pub_pkey->pkey.ec;
+                                }
+
+                        srvr_group   = EC_KEY_get0_group(tkey);
+                        srvr_ecpoint = EC_KEY_get0_public_key(tkey);
+
+                        if ((srvr_group == NULL) || (srvr_ecpoint == NULL))
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        if ((clnt_ecdh=EC_KEY_new()) == NULL) 
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+                        if (!EC_KEY_set_group(clnt_ecdh, srvr_group))
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        if (ecdh_clnt_cert) 
+                                { 
+                                /* Reuse key info from our certificate
+                                 * We only need our private key to perform
+                                 * the ECDH computation.
+                                 */
+                                const BIGNUM *priv_key;
+                                tkey = s->cert->key->privatekey->pkey.ec;
+                                priv_key = EC_KEY_get0_private_key(tkey);
+                                if (priv_key == NULL)
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                if (!EC_KEY_set_private_key(clnt_ecdh, priv_key))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
+                                        goto err;
+                                        }
+                                }
+                        else 
+                                {
+                                /* Generate a new ECDH key pair */
+                                if (!(EC_KEY_generate_key(clnt_ecdh)))
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
+                                        goto err;
+                                        }
+                                }
+
+                        /* use the 'p' output buffer for the ECDH key, but
+                         * make sure to clear it out afterwards
+                         */
+
+                        field_size = EC_GROUP_get_degree(srvr_group);
+                        if (field_size <= 0)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, 
+                                       ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        n=ECDH_compute_key(p, (field_size+7)/8, srvr_ecpoint, clnt_ecdh, NULL);
+                        if (n <= 0)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, 
+                                       ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        /* generate master key from the result */
+                        s->session->master_key_length = s->method->ssl3_enc \
+                            -> generate_master_secret(s, 
+                                s->session->master_key,
+                                p, n);
+
+                        memset(p, 0, n); /* clean up */
+
+                        if (ecdh_clnt_cert) 
+                                {
+                                /* Send empty client key exch message */
+                                n = 0;
+                                }
+                        else 
+                                {
+                                /* First check the size of encoding and
+                                 * allocate memory accordingly.
+                                 */
+                                encoded_pt_len = 
+                                    EC_POINT_point2oct(srvr_group, 
+                                        EC_KEY_get0_public_key(clnt_ecdh), 
+                                        POINT_CONVERSION_UNCOMPRESSED, 
+                                        NULL, 0, NULL);
+
+                                encodedPoint = (unsigned char *) 
+                                    OPENSSL_malloc(encoded_pt_len * 
+                                        sizeof(unsigned char)); 
+                                bn_ctx = BN_CTX_new();
+                                if ((encodedPoint == NULL) || 
+                                    (bn_ctx == NULL)) 
+                                        {
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+
+                                /* Encode the public key */
+                                n = EC_POINT_point2oct(srvr_group, 
+                                    EC_KEY_get0_public_key(clnt_ecdh), 
+                                    POINT_CONVERSION_UNCOMPRESSED, 
+                                    encodedPoint, encoded_pt_len, bn_ctx);
+
+                                *p = n; /* length of encoded point */
+                                /* Encoded point will be copied here */
+                                p += 1; 
+                                /* copy the point */
+                                memcpy((unsigned char *)p, encodedPoint, n);
+                                /* increment n to account for length field */
+                                n += 1; 
+                                }
+
+                        /* Free allocated memory */
+                        BN_CTX_free(bn_ctx);
+                        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+                        if (clnt_ecdh != NULL) 
+                                 EC_KEY_free(clnt_ecdh);
+                        EVP_PKEY_free(srvr_pub_pkey);
+                        }
+#endif /* !OPENSSL_NO_ECDH */
+
+#ifndef OPENSSL_NO_PSK
+                else if (alg_k & SSL_kPSK)
+                        {
+                        char identity[PSK_MAX_IDENTITY_LEN];
+                        unsigned char *t = NULL;
+                        unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4];
+                        unsigned int pre_ms_len = 0, psk_len = 0;
+                        int psk_err = 1;
+
+                        n = 0;
+                        if (s->psk_client_callback == NULL)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                        SSL_R_PSK_NO_CLIENT_CB);
+                                goto err;
+                                }
+
+                        psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint,
+                                identity, PSK_MAX_IDENTITY_LEN,
+                                psk_or_pre_ms, sizeof(psk_or_pre_ms));
+                        if (psk_len > PSK_MAX_PSK_LEN)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                        ERR_R_INTERNAL_ERROR);
+                                goto psk_err;
+                                }
+                        else if (psk_len == 0)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                        SSL_R_PSK_IDENTITY_NOT_FOUND);
+                                goto psk_err;
+                                }
+
+                        /* create PSK pre_master_secret */
+                        pre_ms_len = 2+psk_len+2+psk_len;
+                        t = psk_or_pre_ms;
+                        memmove(psk_or_pre_ms+psk_len+4, psk_or_pre_ms, psk_len);
+                        s2n(psk_len, t);
+                        memset(t, 0, psk_len);
+                        t+=psk_len;
+                        s2n(psk_len, t);
+
+                        if (s->session->psk_identity_hint != NULL)
+                                OPENSSL_free(s->session->psk_identity_hint);
+                        s->session->psk_identity_hint = BUF_strdup(s->ctx->psk_identity_hint);
+                        if (s->ctx->psk_identity_hint != NULL &&
+                                s->session->psk_identity_hint == NULL)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                        ERR_R_MALLOC_FAILURE);
+                                goto psk_err;
+                                }
+
+                        if (s->session->psk_identity != NULL)
+                                OPENSSL_free(s->session->psk_identity);
+                        s->session->psk_identity = BUF_strdup(identity);
+                        if (s->session->psk_identity == NULL)
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                        ERR_R_MALLOC_FAILURE);
+                                goto psk_err;
+                                }
+
+                        s->session->master_key_length =
+                                s->method->ssl3_enc->generate_master_secret(s,
+                                        s->session->master_key,
+                                        psk_or_pre_ms, pre_ms_len); 
+                        n = strlen(identity);
+                        s2n(n, p);
+                        memcpy(p, identity, n);
+                        n+=2;
+                        psk_err = 0;
+                psk_err:
+                        OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN);
+                        OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
+                        if (psk_err != 0)
+                                {
+                                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+                                goto err;
+                                }
+                        }
+#endif
                 else
                         {
                         ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
                         SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
                 
                 d = dtls1_set_message_header(s, d,
                 SSL3_MT_CLIENT_KEY_EXCHANGE, n, 0, n);
                 /*
                  *(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE;
                  l2n3(n,d);
                  l2n(s->d1->handshake_write_seq,d);
                  s->d1->handshake_write_seq++;
                 */
                 
                 s->state=SSL3_ST_CW_KEY_EXCH_B;
                 /* number of bytes to write */
                 s->init_num=n+DTLS1_HM_HEADER_LENGTH;
                 s->init_off=0;
 
                 /* buffer the message to handle re-xmits */
                 dtls1_buffer_message(s, 0);
                 }
         
         /* SSL3_ST_CW_KEY_EXCH_B */
         return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
 err:
+#ifndef OPENSSL_NO_ECDH
+        BN_CTX_free(bn_ctx);
+        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+        if (clnt_ecdh != NULL) 
+                EC_KEY_free(clnt_ecdh);
+        EVP_PKEY_free(srvr_pub_pkey);
+#endif
         return(-1);
         }
 
 int dtls1_send_client_verify(SSL *s)
         {
         unsigned char *p,*d;
         unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
         EVP_PKEY *pkey;
 #ifndef OPENSSL_NO_RSA
         unsigned u=0;
 #endif
         unsigned long n;
-#ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         int j;
 #endif
 
         if (s->state == SSL3_ST_CW_CERT_VRFY_A)
                 {
                 d=(unsigned char *)s->init_buf->data;
                 p= &(d[DTLS1_HM_HEADER_LENGTH]);
                 pkey=s->cert->key->privatekey;
 
-                s->method->ssl3_enc->cert_verify_mac(s,&(s->s3->finish_dgst2),
+                s->method->ssl3_enc->cert_verify_mac(s,
+                NID_sha1,
                         &(data[MD5_DIGEST_LENGTH]));
 
 #ifndef OPENSSL_NO_RSA
                 if (pkey->type == EVP_PKEY_RSA)
                         {
                         s->method->ssl3_enc->cert_verify_mac(s,
-                                &(s->s3->finish_dgst1),&(data[0]));
+                                NID_md5,
+                                &(data[0]));
                         if (RSA_sign(NID_md5_sha1, data,
                                          MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
                                         &(p[2]), &u, pkey->pkey.rsa) <= 0 )
                                 {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
                                 goto err;
                                 }
                         s2n(u,p);
                         n=u+2;
                         }
                 else
 #endif
 #ifndef OPENSSL_NO_DSA
                         if (pkey->type == EVP_PKEY_DSA)
                         {
                         if (!DSA_sign(pkey->save_type,
                                 &(data[MD5_DIGEST_LENGTH]),
                                 SHA_DIGEST_LENGTH,&(p[2]),
                                 (unsigned int *)&j,pkey->pkey.dsa))
                                 {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB);
                                 goto err;
                                 }
                         s2n(j,p);
                         n=j+2;
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (pkey->type == EVP_PKEY_EC)
+                        {
+                        if (!ECDSA_sign(pkey->save_type,
+                                &(data[MD5_DIGEST_LENGTH]),
+                                SHA_DIGEST_LENGTH,&(p[2]),
+                                (unsigned int *)&j,pkey->pkey.ec))
+                                {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                                    ERR_R_ECDSA_LIB);
+                                goto err;
+                                }
+                        s2n(j,p);
+                        n=j+2;
+                        }
+                else
+#endif
                         {
                         SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
 
                 d = dtls1_set_message_header(s, d,
                         SSL3_MT_CERTIFICATE_VERIFY, n, 0, n) ;
 
                 s->init_num=(int)n+DTLS1_HM_HEADER_LENGTH;
                 s->init_off=0;
@@ skipping 85 matching lines @@
                 /* set header called by dtls1_output_cert_chain() */
 
                 /* buffer the message to handle re-xmits */
                 dtls1_buffer_message(s, 0);
                 }
         /* SSL3_ST_CW_CERT_D */
         return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
         }