OLD | NEW |
1 /*! \file ssl/ssl_lib.c | 1 /*! \file ssl/ssl_lib.c |
2 * \brief Version independent SSL functions. | 2 * \brief Version independent SSL functions. |
3 */ | 3 */ |
4 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 4 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
5 * All rights reserved. | 5 * All rights reserved. |
6 * | 6 * |
7 * This package is an SSL implementation written | 7 * This package is an SSL implementation written |
8 * by Eric Young (eay@cryptsoft.com). | 8 * by Eric Young (eay@cryptsoft.com). |
9 * The implementation was written so as to conform with Netscapes SSL. | 9 * The implementation was written so as to conform with Netscapes SSL. |
10 * | 10 * |
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | 51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | 52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
53 * SUCH DAMAGE. | 53 * SUCH DAMAGE. |
54 * | 54 * |
55 * The licence and distribution terms for any publically available version or | 55 * The licence and distribution terms for any publically available version or |
56 * derivative of this code cannot be changed. i.e. this code cannot simply be | 56 * derivative of this code cannot be changed. i.e. this code cannot simply be |
57 * copied and put under another distribution licence | 57 * copied and put under another distribution licence |
58 * [including the GNU Public Licence.] | 58 * [including the GNU Public Licence.] |
59 */ | 59 */ |
60 /* ==================================================================== | 60 /* ==================================================================== |
61 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. | 61 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. |
62 * | 62 * |
63 * Redistribution and use in source and binary forms, with or without | 63 * Redistribution and use in source and binary forms, with or without |
64 * modification, are permitted provided that the following conditions | 64 * modification, are permitted provided that the following conditions |
65 * are met: | 65 * are met: |
66 * | 66 * |
67 * 1. Redistributions of source code must retain the above copyright | 67 * 1. Redistributions of source code must retain the above copyright |
68 * notice, this list of conditions and the following disclaimer. | 68 * notice, this list of conditions and the following disclaimer. |
69 * | 69 * |
70 * 2. Redistributions in binary form must reproduce the above copyright | 70 * 2. Redistributions in binary form must reproduce the above copyright |
71 * notice, this list of conditions and the following disclaimer in | 71 * notice, this list of conditions and the following disclaimer in |
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
108 * This product includes cryptographic software written by Eric Young | 108 * This product includes cryptographic software written by Eric Young |
109 * (eay@cryptsoft.com). This product includes software written by Tim | 109 * (eay@cryptsoft.com). This product includes software written by Tim |
110 * Hudson (tjh@cryptsoft.com). | 110 * Hudson (tjh@cryptsoft.com). |
111 * | 111 * |
112 */ | 112 */ |
113 /* ==================================================================== | 113 /* ==================================================================== |
114 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. | 114 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. |
115 * ECC cipher suite support in OpenSSL originally developed by | 115 * ECC cipher suite support in OpenSSL originally developed by |
116 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. | 116 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. |
117 */ | 117 */ |
| 118 /* ==================================================================== |
| 119 * Copyright 2005 Nokia. All rights reserved. |
| 120 * |
| 121 * The portions of the attached software ("Contribution") is developed by |
| 122 * Nokia Corporation and is licensed pursuant to the OpenSSL open source |
| 123 * license. |
| 124 * |
| 125 * The Contribution, originally written by Mika Kousa and Pasi Eronen of |
| 126 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites |
| 127 * support (see RFC 4279) to OpenSSL. |
| 128 * |
| 129 * No patent licenses or other rights except those expressly stated in |
| 130 * the OpenSSL open source license shall be deemed granted or received |
| 131 * expressly, by implication, estoppel, or otherwise. |
| 132 * |
| 133 * No assurances are provided by Nokia that the Contribution does not |
| 134 * infringe the patent or other intellectual property rights of any third |
| 135 * party or that the license provides you with all the necessary rights |
| 136 * to make use of the Contribution. |
| 137 * |
| 138 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN |
| 139 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA |
| 140 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY |
| 141 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR |
| 142 * OTHERWISE. |
| 143 */ |
118 | 144 |
119 #ifdef REF_CHECK | 145 #ifdef REF_CHECK |
120 # include <assert.h> | 146 # include <assert.h> |
121 #endif | 147 #endif |
122 #include <stdio.h> | 148 #include <stdio.h> |
123 #include "ssl_locl.h" | 149 #include "ssl_locl.h" |
124 #include "kssl_lcl.h" | 150 #include "kssl_lcl.h" |
125 #include <openssl/objects.h> | 151 #include <openssl/objects.h> |
126 #include <openssl/lhash.h> | 152 #include <openssl/lhash.h> |
127 #include <openssl/x509v3.h> | 153 #include <openssl/x509v3.h> |
128 #include <openssl/rand.h> | 154 #include <openssl/rand.h> |
129 #include <openssl/ocsp.h> | 155 #include <openssl/ocsp.h> |
130 #ifndef OPENSSL_NO_DH | 156 #ifndef OPENSSL_NO_DH |
131 #include <openssl/dh.h> | 157 #include <openssl/dh.h> |
132 #endif | 158 #endif |
133 #ifndef OPENSSL_NO_ENGINE | 159 #ifndef OPENSSL_NO_ENGINE |
134 #include <openssl/engine.h> | 160 #include <openssl/engine.h> |
135 #endif | 161 #endif |
136 | 162 |
137 const char *SSL_version_str=OPENSSL_VERSION_TEXT; | 163 const char *SSL_version_str=OPENSSL_VERSION_TEXT; |
138 | 164 |
139 SSL3_ENC_METHOD ssl3_undef_enc_method={ | 165 SSL3_ENC_METHOD ssl3_undef_enc_method={ |
140 /* evil casts, but these functions are only called if there's a library
bug */ | 166 /* evil casts, but these functions are only called if there's a library
bug */ |
141 (int (*)(SSL *,int))ssl_undefined_function, | 167 (int (*)(SSL *,int))ssl_undefined_function, |
142 (int (*)(SSL *, unsigned char *, int))ssl_undefined_function, | 168 (int (*)(SSL *, unsigned char *, int))ssl_undefined_function, |
143 ssl_undefined_function, | 169 ssl_undefined_function, |
144 (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_fun
ction, | 170 (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_fun
ction, |
145 (int (*)(SSL*, int))ssl_undefined_function, | 171 (int (*)(SSL*, int))ssl_undefined_function, |
146 » (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned c
har *))ssl_undefined_function, | 172 » (int (*)(SSL *, const char*, int, unsigned char *))ssl_undefined_functi
on, |
147 0, /* finish_mac_length */ | 173 0, /* finish_mac_length */ |
148 » (int (*)(SSL *, EVP_MD_CTX *, unsigned char *))ssl_undefined_function, | 174 » (int (*)(SSL *, int, unsigned char *))ssl_undefined_function, |
149 NULL, /* client_finished_label */ | 175 NULL, /* client_finished_label */ |
150 0, /* client_finished_label_len */ | 176 0, /* client_finished_label_len */ |
151 NULL, /* server_finished_label */ | 177 NULL, /* server_finished_label */ |
152 0, /* server_finished_label_len */ | 178 0, /* server_finished_label_len */ |
153 (int (*)(int))ssl_undefined_function | 179 (int (*)(int))ssl_undefined_function |
154 }; | 180 }; |
155 | 181 |
156 int SSL_clear(SSL *s) | 182 int SSL_clear(SSL *s) |
157 { | 183 { |
158 | 184 |
(...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
197 s->read_ahead=s->ctx->read_ahead; | 223 s->read_ahead=s->ctx->read_ahead; |
198 #endif | 224 #endif |
199 | 225 |
200 if (s->init_buf != NULL) | 226 if (s->init_buf != NULL) |
201 { | 227 { |
202 BUF_MEM_free(s->init_buf); | 228 BUF_MEM_free(s->init_buf); |
203 s->init_buf=NULL; | 229 s->init_buf=NULL; |
204 } | 230 } |
205 | 231 |
206 ssl_clear_cipher_ctx(s); | 232 ssl_clear_cipher_ctx(s); |
| 233 ssl_clear_hash_ctx(&s->read_hash); |
| 234 ssl_clear_hash_ctx(&s->write_hash); |
207 | 235 |
208 s->first_packet=0; | 236 s->first_packet=0; |
209 | 237 |
210 #if 1 | 238 #if 1 |
211 /* Check to see if we were changed into a different method, if | 239 /* Check to see if we were changed into a different method, if |
212 * so, revert back if we are not doing session-id reuse. */ | 240 * so, revert back if we are not doing session-id reuse. */ |
213 if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->me
thod)) | 241 if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->me
thod)) |
214 { | 242 { |
215 s->method->ssl_free(s); | 243 s->method->ssl_free(s); |
216 s->method=s->ctx->method; | 244 s->method=s->ctx->method; |
217 if (!s->method->ssl_new(s)) | 245 if (!s->method->ssl_new(s)) |
218 return(0); | 246 return(0); |
219 } | 247 } |
220 else | 248 else |
221 #endif | 249 #endif |
222 s->method->ssl_clear(s); | 250 s->method->ssl_clear(s); |
223 return(1); | 251 return(1); |
224 } | 252 } |
225 | 253 |
226 /** Used to change an SSL_CTXs default SSL method type */ | 254 /** Used to change an SSL_CTXs default SSL method type */ |
227 int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth) | 255 int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth) |
228 { | 256 { |
229 STACK_OF(SSL_CIPHER) *sk; | 257 STACK_OF(SSL_CIPHER) *sk; |
230 | 258 |
231 ctx->method=meth; | 259 ctx->method=meth; |
232 | 260 |
233 sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list), | 261 sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list), |
234 » » &(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST); | 262 » » &(ctx->cipher_list_by_id), |
| 263 » » meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIS
T); |
235 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) | 264 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) |
236 { | 265 { |
237 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CI
PHERS); | 266 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CI
PHERS); |
238 return(0); | 267 return(0); |
239 } | 268 } |
240 return(1); | 269 return(1); |
241 } | 270 } |
242 | 271 |
243 SSL *SSL_new(SSL_CTX *ctx) | 272 SSL *SSL_new(SSL_CTX *ctx) |
244 { | 273 { |
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
290 s->msg_callback=ctx->msg_callback; | 319 s->msg_callback=ctx->msg_callback; |
291 s->msg_callback_arg=ctx->msg_callback_arg; | 320 s->msg_callback_arg=ctx->msg_callback_arg; |
292 s->verify_mode=ctx->verify_mode; | 321 s->verify_mode=ctx->verify_mode; |
293 #if 0 | 322 #if 0 |
294 s->verify_depth=ctx->verify_depth; | 323 s->verify_depth=ctx->verify_depth; |
295 #endif | 324 #endif |
296 s->sid_ctx_length=ctx->sid_ctx_length; | 325 s->sid_ctx_length=ctx->sid_ctx_length; |
297 OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx); | 326 OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx); |
298 memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx)); | 327 memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx)); |
299 s->verify_callback=ctx->default_verify_callback; | 328 s->verify_callback=ctx->default_verify_callback; |
| 329 s->session_creation_enabled=1; |
300 s->generate_session_id=ctx->generate_session_id; | 330 s->generate_session_id=ctx->generate_session_id; |
301 | 331 |
302 s->param = X509_VERIFY_PARAM_new(); | 332 s->param = X509_VERIFY_PARAM_new(); |
303 if (!s->param) | 333 if (!s->param) |
304 goto err; | 334 goto err; |
305 X509_VERIFY_PARAM_inherit(s->param, ctx->param); | 335 X509_VERIFY_PARAM_inherit(s->param, ctx->param); |
306 #if 0 | 336 #if 0 |
307 s->purpose = ctx->purpose; | 337 s->purpose = ctx->purpose; |
308 s->trust = ctx->trust; | 338 s->trust = ctx->trust; |
309 #endif | 339 #endif |
310 s->quiet_shutdown=ctx->quiet_shutdown; | 340 s->quiet_shutdown=ctx->quiet_shutdown; |
| 341 s->max_send_fragment = ctx->max_send_fragment; |
311 | 342 |
312 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); | 343 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); |
313 s->ctx=ctx; | 344 s->ctx=ctx; |
314 #ifndef OPENSSL_NO_TLSEXT | 345 #ifndef OPENSSL_NO_TLSEXT |
315 s->tlsext_debug_cb = 0; | 346 s->tlsext_debug_cb = 0; |
316 s->tlsext_debug_arg = NULL; | 347 s->tlsext_debug_arg = NULL; |
317 s->tlsext_ticket_expected = 0; | 348 s->tlsext_ticket_expected = 0; |
318 s->tlsext_status_type = -1; | 349 s->tlsext_status_type = -1; |
319 s->tlsext_status_expected = 0; | 350 s->tlsext_status_expected = 0; |
320 s->tlsext_ocsp_ids = NULL; | 351 s->tlsext_ocsp_ids = NULL; |
321 s->tlsext_ocsp_exts = NULL; | 352 s->tlsext_ocsp_exts = NULL; |
322 s->tlsext_ocsp_resp = NULL; | 353 s->tlsext_ocsp_resp = NULL; |
323 s->tlsext_ocsp_resplen = -1; | 354 s->tlsext_ocsp_resplen = -1; |
324 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); | 355 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); |
325 s->initial_ctx=ctx; | 356 s->initial_ctx=ctx; |
| 357 # ifndef OPENSSL_NO_NEXTPROTONEG |
326 s->next_proto_negotiated = NULL; | 358 s->next_proto_negotiated = NULL; |
| 359 # endif |
327 #endif | 360 #endif |
| 361 |
328 s->verify_result=X509_V_OK; | 362 s->verify_result=X509_V_OK; |
329 | 363 |
330 s->method=ctx->method; | 364 s->method=ctx->method; |
331 | 365 |
332 if (!s->method->ssl_new(s)) | 366 if (!s->method->ssl_new(s)) |
333 goto err; | 367 goto err; |
334 | 368 |
335 s->references=1; | 369 s->references=1; |
336 s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1; | 370 s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1; |
337 | 371 |
338 SSL_clear(s); | 372 SSL_clear(s); |
339 | 373 |
340 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); | 374 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); |
341 | 375 |
| 376 #ifndef OPENSSL_NO_PSK |
| 377 s->psk_client_callback=ctx->psk_client_callback; |
| 378 s->psk_server_callback=ctx->psk_server_callback; |
| 379 #endif |
| 380 |
342 return(s); | 381 return(s); |
343 err: | 382 err: |
344 if (s != NULL) | 383 if (s != NULL) |
345 { | 384 { |
346 if (s->cert != NULL) | 385 if (s->cert != NULL) |
347 ssl_cert_free(s->cert); | 386 ssl_cert_free(s->cert); |
348 if (s->ctx != NULL) | 387 if (s->ctx != NULL) |
349 SSL_CTX_free(s->ctx); /* decrement reference count */ | 388 SSL_CTX_free(s->ctx); /* decrement reference count */ |
350 OPENSSL_free(s); | 389 OPENSSL_free(s); |
351 } | 390 } |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
419 * converted to when the callback has finished choosing it. */ | 458 * converted to when the callback has finished choosing it. */ |
420 if((r.ssl_version == SSL2_VERSION) && | 459 if((r.ssl_version == SSL2_VERSION) && |
421 (id_len < SSL2_SSL_SESSION_ID_LENGTH)) | 460 (id_len < SSL2_SSL_SESSION_ID_LENGTH)) |
422 { | 461 { |
423 memset(r.session_id + id_len, 0, | 462 memset(r.session_id + id_len, 0, |
424 SSL2_SSL_SESSION_ID_LENGTH - id_len); | 463 SSL2_SSL_SESSION_ID_LENGTH - id_len); |
425 r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH; | 464 r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH; |
426 } | 465 } |
427 | 466 |
428 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); | 467 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); |
429 » p = (SSL_SESSION *)lh_retrieve(ssl->ctx->sessions, &r); | 468 » p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r); |
430 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); | 469 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); |
431 return (p != NULL); | 470 return (p != NULL); |
432 } | 471 } |
433 | 472 |
434 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) | 473 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) |
435 { | 474 { |
436 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); | 475 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); |
437 } | 476 } |
438 | 477 |
439 int SSL_set_purpose(SSL *s, int purpose) | 478 int SSL_set_purpose(SSL *s, int purpose) |
440 { | 479 { |
441 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); | 480 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); |
442 } | 481 } |
443 | 482 |
444 int SSL_CTX_set_trust(SSL_CTX *s, int trust) | 483 int SSL_CTX_set_trust(SSL_CTX *s, int trust) |
445 { | 484 { |
446 return X509_VERIFY_PARAM_set_trust(s->param, trust); | 485 return X509_VERIFY_PARAM_set_trust(s->param, trust); |
447 } | 486 } |
448 | 487 |
449 int SSL_set_trust(SSL *s, int trust) | 488 int SSL_set_trust(SSL *s, int trust) |
450 { | 489 { |
451 return X509_VERIFY_PARAM_set_trust(s->param, trust); | 490 return X509_VERIFY_PARAM_set_trust(s->param, trust); |
452 } | 491 } |
453 | 492 |
| 493 int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) |
| 494 { |
| 495 return X509_VERIFY_PARAM_set1(ctx->param, vpm); |
| 496 } |
| 497 |
| 498 int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) |
| 499 { |
| 500 return X509_VERIFY_PARAM_set1(ssl->param, vpm); |
| 501 } |
| 502 |
454 void SSL_free(SSL *s) | 503 void SSL_free(SSL *s) |
455 { | 504 { |
456 int i; | 505 int i; |
457 | 506 |
458 if(s == NULL) | 507 if(s == NULL) |
459 return; | 508 return; |
460 | 509 |
461 i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL); | 510 i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL); |
462 #ifdef REF_PRINT | 511 #ifdef REF_PRINT |
463 REF_PRINT("SSL",s); | 512 REF_PRINT("SSL",s); |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
498 if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_i
d); | 547 if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_i
d); |
499 | 548 |
500 /* Make the next call work :-) */ | 549 /* Make the next call work :-) */ |
501 if (s->session != NULL) | 550 if (s->session != NULL) |
502 { | 551 { |
503 ssl_clear_bad_session(s); | 552 ssl_clear_bad_session(s); |
504 SSL_SESSION_free(s->session); | 553 SSL_SESSION_free(s->session); |
505 } | 554 } |
506 | 555 |
507 ssl_clear_cipher_ctx(s); | 556 ssl_clear_cipher_ctx(s); |
| 557 ssl_clear_hash_ctx(&s->read_hash); |
| 558 ssl_clear_hash_ctx(&s->write_hash); |
508 | 559 |
509 if (s->cert != NULL) ssl_cert_free(s->cert); | 560 if (s->cert != NULL) ssl_cert_free(s->cert); |
510 /* Free up if allocated */ | 561 /* Free up if allocated */ |
511 | 562 |
512 #ifndef OPENSSL_NO_TLSEXT | 563 #ifndef OPENSSL_NO_TLSEXT |
513 if (s->tlsext_hostname) | 564 if (s->tlsext_hostname) |
514 OPENSSL_free(s->tlsext_hostname); | 565 OPENSSL_free(s->tlsext_hostname); |
515 if (s->initial_ctx) SSL_CTX_free(s->initial_ctx); | 566 if (s->initial_ctx) SSL_CTX_free(s->initial_ctx); |
| 567 #ifndef OPENSSL_NO_EC |
| 568 if (s->tlsext_ecpointformatlist) OPENSSL_free(s->tlsext_ecpointformatlis
t); |
| 569 if (s->tlsext_ellipticcurvelist) OPENSSL_free(s->tlsext_ellipticcurvelis
t); |
| 570 #endif /* OPENSSL_NO_EC */ |
| 571 if (s->tlsext_opaque_prf_input) OPENSSL_free(s->tlsext_opaque_prf_input)
; |
516 if (s->tlsext_ocsp_exts) | 572 if (s->tlsext_ocsp_exts) |
517 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, | 573 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, |
518 X509_EXTENSION_free); | 574 X509_EXTENSION_free); |
519 if (s->tlsext_ocsp_ids) | 575 if (s->tlsext_ocsp_ids) |
520 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free); | 576 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free); |
521 if (s->tlsext_ocsp_resp) | 577 if (s->tlsext_ocsp_resp) |
522 OPENSSL_free(s->tlsext_ocsp_resp); | 578 OPENSSL_free(s->tlsext_ocsp_resp); |
523 #endif | 579 #endif |
| 580 |
524 if (s->client_CA != NULL) | 581 if (s->client_CA != NULL) |
525 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free); | 582 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free); |
526 | 583 |
527 if (s->method != NULL) s->method->ssl_free(s); | 584 if (s->method != NULL) s->method->ssl_free(s); |
528 | 585 |
529 if (s->ctx) SSL_CTX_free(s->ctx); | 586 if (s->ctx) SSL_CTX_free(s->ctx); |
530 | 587 |
531 #ifndef OPENSSL_NO_KRB5 | 588 #ifndef OPENSSL_NO_KRB5 |
532 if (s->kssl_ctx != NULL) | 589 if (s->kssl_ctx != NULL) |
533 kssl_ctx_free(s->kssl_ctx); | 590 kssl_ctx_free(s->kssl_ctx); |
534 #endif /* OPENSSL_NO_KRB5 */ | 591 #endif /* OPENSSL_NO_KRB5 */ |
535 | 592 |
536 #ifndef OPENSSL_NO_TLSEXT | 593 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG) |
537 if (s->next_proto_negotiated) | 594 if (s->next_proto_negotiated) |
538 OPENSSL_free(s->next_proto_negotiated); | 595 OPENSSL_free(s->next_proto_negotiated); |
539 #endif | 596 #endif |
540 | 597 |
541 OPENSSL_free(s); | 598 OPENSSL_free(s); |
542 } | 599 } |
543 | 600 |
544 void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio) | 601 void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio) |
545 { | 602 { |
546 /* If the output buffering BIO is still in place, remove it | 603 /* If the output buffering BIO is still in place, remove it |
(...skipping 296 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
843 /* Fix this function so that it takes an optional type parameter */ | 900 /* Fix this function so that it takes an optional type parameter */ |
844 int SSL_check_private_key(const SSL *ssl) | 901 int SSL_check_private_key(const SSL *ssl) |
845 { | 902 { |
846 if (ssl == NULL) | 903 if (ssl == NULL) |
847 { | 904 { |
848 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER); | 905 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER); |
849 return(0); | 906 return(0); |
850 } | 907 } |
851 if (ssl->cert == NULL) | 908 if (ssl->cert == NULL) |
852 { | 909 { |
853 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED
); | 910 » » SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED
); |
854 return 0; | 911 return 0; |
855 } | 912 } |
856 if (ssl->cert->key->x509 == NULL) | 913 if (ssl->cert->key->x509 == NULL) |
857 { | 914 { |
858 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED
); | 915 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED
); |
859 return(0); | 916 return(0); |
860 } | 917 } |
861 if (ssl->cert->key->privatekey == NULL) | 918 if (ssl->cert->key->privatekey == NULL) |
862 { | 919 { |
863 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED
); | 920 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED
); |
(...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
999 return(s->mode|=larg); | 1056 return(s->mode|=larg); |
1000 case SSL_CTRL_CLEAR_MODE: | 1057 case SSL_CTRL_CLEAR_MODE: |
1001 return(s->mode &=~larg); | 1058 return(s->mode &=~larg); |
1002 case SSL_CTRL_GET_MAX_CERT_LIST: | 1059 case SSL_CTRL_GET_MAX_CERT_LIST: |
1003 return(s->max_cert_list); | 1060 return(s->max_cert_list); |
1004 case SSL_CTRL_SET_MAX_CERT_LIST: | 1061 case SSL_CTRL_SET_MAX_CERT_LIST: |
1005 l=s->max_cert_list; | 1062 l=s->max_cert_list; |
1006 s->max_cert_list=larg; | 1063 s->max_cert_list=larg; |
1007 return(l); | 1064 return(l); |
1008 case SSL_CTRL_SET_MTU: | 1065 case SSL_CTRL_SET_MTU: |
| 1066 #ifndef OPENSSL_NO_DTLS1 |
| 1067 if (larg < (long)dtls1_min_mtu()) |
| 1068 return 0; |
| 1069 #endif |
| 1070 |
1009 if (SSL_version(s) == DTLS1_VERSION || | 1071 if (SSL_version(s) == DTLS1_VERSION || |
1010 SSL_version(s) == DTLS1_BAD_VER) | 1072 SSL_version(s) == DTLS1_BAD_VER) |
1011 { | 1073 { |
1012 s->d1->mtu = larg; | 1074 s->d1->mtu = larg; |
1013 return larg; | 1075 return larg; |
1014 } | 1076 } |
1015 return 0; | 1077 return 0; |
| 1078 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: |
| 1079 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) |
| 1080 return 0; |
| 1081 s->max_send_fragment = larg; |
| 1082 return 1; |
1016 case SSL_CTRL_GET_RI_SUPPORT: | 1083 case SSL_CTRL_GET_RI_SUPPORT: |
1017 if (s->s3) | 1084 if (s->s3) |
1018 return s->s3->send_connection_binding; | 1085 return s->s3->send_connection_binding; |
1019 else return 0; | 1086 else return 0; |
1020 default: | 1087 default: |
1021 return(s->method->ssl_ctrl(s,cmd,larg,parg)); | 1088 return(s->method->ssl_ctrl(s,cmd,larg,parg)); |
1022 } | 1089 } |
1023 } | 1090 } |
1024 | 1091 |
1025 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) | 1092 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) |
1026 { | 1093 { |
1027 switch(cmd) | 1094 switch(cmd) |
1028 { | 1095 { |
1029 case SSL_CTRL_SET_MSG_CALLBACK: | 1096 case SSL_CTRL_SET_MSG_CALLBACK: |
1030 s->msg_callback = (void (*)(int write_p, int version, int conten
t_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); | 1097 s->msg_callback = (void (*)(int write_p, int version, int conten
t_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); |
1031 return 1; | 1098 return 1; |
1032 | 1099 |
1033 default: | 1100 default: |
1034 return(s->method->ssl_callback_ctrl(s,cmd,fp)); | 1101 return(s->method->ssl_callback_ctrl(s,cmd,fp)); |
1035 } | 1102 } |
1036 } | 1103 } |
1037 | 1104 |
1038 struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx) | 1105 LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx) |
1039 { | 1106 { |
1040 return ctx->sessions; | 1107 return ctx->sessions; |
1041 } | 1108 } |
1042 | 1109 |
1043 long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg) | 1110 long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg) |
1044 { | 1111 { |
1045 long l; | 1112 long l; |
1046 | 1113 |
1047 switch (cmd) | 1114 switch (cmd) |
1048 { | 1115 { |
(...skipping 22 matching lines...) Expand all Loading... |
1071 case SSL_CTRL_GET_SESS_CACHE_SIZE: | 1138 case SSL_CTRL_GET_SESS_CACHE_SIZE: |
1072 return(ctx->session_cache_size); | 1139 return(ctx->session_cache_size); |
1073 case SSL_CTRL_SET_SESS_CACHE_MODE: | 1140 case SSL_CTRL_SET_SESS_CACHE_MODE: |
1074 l=ctx->session_cache_mode; | 1141 l=ctx->session_cache_mode; |
1075 ctx->session_cache_mode=larg; | 1142 ctx->session_cache_mode=larg; |
1076 return(l); | 1143 return(l); |
1077 case SSL_CTRL_GET_SESS_CACHE_MODE: | 1144 case SSL_CTRL_GET_SESS_CACHE_MODE: |
1078 return(ctx->session_cache_mode); | 1145 return(ctx->session_cache_mode); |
1079 | 1146 |
1080 case SSL_CTRL_SESS_NUMBER: | 1147 case SSL_CTRL_SESS_NUMBER: |
1081 » » return(ctx->sessions->num_items); | 1148 » » return(lh_SSL_SESSION_num_items(ctx->sessions)); |
1082 case SSL_CTRL_SESS_CONNECT: | 1149 case SSL_CTRL_SESS_CONNECT: |
1083 return(ctx->stats.sess_connect); | 1150 return(ctx->stats.sess_connect); |
1084 case SSL_CTRL_SESS_CONNECT_GOOD: | 1151 case SSL_CTRL_SESS_CONNECT_GOOD: |
1085 return(ctx->stats.sess_connect_good); | 1152 return(ctx->stats.sess_connect_good); |
1086 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: | 1153 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: |
1087 return(ctx->stats.sess_connect_renegotiate); | 1154 return(ctx->stats.sess_connect_renegotiate); |
1088 case SSL_CTRL_SESS_ACCEPT: | 1155 case SSL_CTRL_SESS_ACCEPT: |
1089 return(ctx->stats.sess_accept); | 1156 return(ctx->stats.sess_accept); |
1090 case SSL_CTRL_SESS_ACCEPT_GOOD: | 1157 case SSL_CTRL_SESS_ACCEPT_GOOD: |
1091 return(ctx->stats.sess_accept_good); | 1158 return(ctx->stats.sess_accept_good); |
(...skipping 10 matching lines...) Expand all Loading... |
1102 case SSL_CTRL_SESS_CACHE_FULL: | 1169 case SSL_CTRL_SESS_CACHE_FULL: |
1103 return(ctx->stats.sess_cache_full); | 1170 return(ctx->stats.sess_cache_full); |
1104 case SSL_CTRL_OPTIONS: | 1171 case SSL_CTRL_OPTIONS: |
1105 return(ctx->options|=larg); | 1172 return(ctx->options|=larg); |
1106 case SSL_CTRL_CLEAR_OPTIONS: | 1173 case SSL_CTRL_CLEAR_OPTIONS: |
1107 return(ctx->options&=~larg); | 1174 return(ctx->options&=~larg); |
1108 case SSL_CTRL_MODE: | 1175 case SSL_CTRL_MODE: |
1109 return(ctx->mode|=larg); | 1176 return(ctx->mode|=larg); |
1110 case SSL_CTRL_CLEAR_MODE: | 1177 case SSL_CTRL_CLEAR_MODE: |
1111 return(ctx->mode&=~larg); | 1178 return(ctx->mode&=~larg); |
| 1179 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: |
| 1180 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) |
| 1181 return 0; |
| 1182 ctx->max_send_fragment = larg; |
| 1183 return 1; |
1112 default: | 1184 default: |
1113 return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg)); | 1185 return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg)); |
1114 } | 1186 } |
1115 } | 1187 } |
1116 | 1188 |
1117 long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) | 1189 long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) |
1118 { | 1190 { |
1119 switch(cmd) | 1191 switch(cmd) |
1120 { | 1192 { |
1121 case SSL_CTRL_SET_MSG_CALLBACK: | 1193 case SSL_CTRL_SET_MSG_CALLBACK: |
(...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1206 /** specify the ciphers to be used by default by the SSL_CTX */ | 1278 /** specify the ciphers to be used by default by the SSL_CTX */ |
1207 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) | 1279 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) |
1208 { | 1280 { |
1209 STACK_OF(SSL_CIPHER) *sk; | 1281 STACK_OF(SSL_CIPHER) *sk; |
1210 | 1282 |
1211 sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list, | 1283 sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list, |
1212 &ctx->cipher_list_by_id,str); | 1284 &ctx->cipher_list_by_id,str); |
1213 /* ssl_create_cipher_list may return an empty stack if it | 1285 /* ssl_create_cipher_list may return an empty stack if it |
1214 * was unable to find a cipher matching the given rule string | 1286 * was unable to find a cipher matching the given rule string |
1215 * (for example if the rule string specifies a cipher which | 1287 * (for example if the rule string specifies a cipher which |
1216 » * has been disabled). This is not an error as far as | 1288 » * has been disabled). This is not an error as far as |
1217 » * ssl_create_cipher_list is concerned, and hence | 1289 » * ssl_create_cipher_list is concerned, and hence |
1218 * ctx->cipher_list and ctx->cipher_list_by_id has been | 1290 * ctx->cipher_list and ctx->cipher_list_by_id has been |
1219 * updated. */ | 1291 * updated. */ |
1220 if (sk == NULL) | 1292 if (sk == NULL) |
1221 return 0; | 1293 return 0; |
1222 else if (sk_SSL_CIPHER_num(sk) == 0) | 1294 else if (sk_SSL_CIPHER_num(sk) == 0) |
1223 { | 1295 { |
1224 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); | 1296 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); |
1225 return 0; | 1297 return 0; |
1226 } | 1298 } |
1227 return 1; | 1299 return 1; |
(...skipping 10 matching lines...) Expand all Loading... |
1238 if (sk == NULL) | 1310 if (sk == NULL) |
1239 return 0; | 1311 return 0; |
1240 else if (sk_SSL_CIPHER_num(sk) == 0) | 1312 else if (sk_SSL_CIPHER_num(sk) == 0) |
1241 { | 1313 { |
1242 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); | 1314 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); |
1243 return 0; | 1315 return 0; |
1244 } | 1316 } |
1245 return 1; | 1317 return 1; |
1246 } | 1318 } |
1247 | 1319 |
| 1320 /** specify the ciphers to be used by the SSL */ |
| 1321 int SSL_set_cipher_lists(SSL *s,STACK_OF(SSL_CIPHER) *sk) |
| 1322 { |
| 1323 STACK_OF(SSL_CIPHER) *tmp_cipher_list; |
| 1324 |
| 1325 if (sk == NULL) |
| 1326 return 0; |
| 1327 |
| 1328 /* Based on end of ssl_create_cipher_list */ |
| 1329 tmp_cipher_list = sk_SSL_CIPHER_dup(sk); |
| 1330 if (tmp_cipher_list == NULL) |
| 1331 { |
| 1332 return 0; |
| 1333 } |
| 1334 if (s->cipher_list != NULL) |
| 1335 sk_SSL_CIPHER_free(s->cipher_list); |
| 1336 s->cipher_list = sk; |
| 1337 if (s->cipher_list_by_id != NULL) |
| 1338 sk_SSL_CIPHER_free(s->cipher_list_by_id); |
| 1339 s->cipher_list_by_id = tmp_cipher_list; |
| 1340 (void)sk_SSL_CIPHER_set_cmp_func(s->cipher_list_by_id,ssl_cipher_ptr_id_
cmp); |
| 1341 |
| 1342 sk_SSL_CIPHER_sort(s->cipher_list_by_id); |
| 1343 return 1; |
| 1344 } |
| 1345 |
1248 /* works well for SSLv2, not so good for SSLv3 */ | 1346 /* works well for SSLv2, not so good for SSLv3 */ |
1249 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len) | 1347 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len) |
1250 { | 1348 { |
1251 char *p; | 1349 char *p; |
1252 STACK_OF(SSL_CIPHER) *sk; | 1350 STACK_OF(SSL_CIPHER) *sk; |
1253 SSL_CIPHER *c; | 1351 SSL_CIPHER *c; |
1254 int i; | 1352 int i; |
1255 | 1353 |
1256 if ((s->session == NULL) || (s->session->ciphers == NULL) || | 1354 if ((s->session == NULL) || (s->session->ciphers == NULL) || |
1257 (len < 2)) | 1355 (len < 2)) |
(...skipping 17 matching lines...) Expand all Loading... |
1275 strcpy(p,c->name); | 1373 strcpy(p,c->name); |
1276 p+=n; | 1374 p+=n; |
1277 *(p++)=':'; | 1375 *(p++)=':'; |
1278 len-=n+1; | 1376 len-=n+1; |
1279 } | 1377 } |
1280 p[-1]='\0'; | 1378 p[-1]='\0'; |
1281 return(buf); | 1379 return(buf); |
1282 } | 1380 } |
1283 | 1381 |
1284 int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p, | 1382 int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p, |
1285 int (*put_cb)(const SSL_CIPHER *, unsigned char *)) | 1383 » » » int (*put_cb)(const SSL_CIPHER *, unsigned char *)) |
1286 { | 1384 { |
1287 int i,j=0; | 1385 int i,j=0; |
1288 SSL_CIPHER *c; | 1386 SSL_CIPHER *c; |
1289 unsigned char *q; | 1387 unsigned char *q; |
1290 #ifndef OPENSSL_NO_KRB5 | 1388 #ifndef OPENSSL_NO_KRB5 |
1291 int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx); | 1389 » int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx); |
1292 #endif /* OPENSSL_NO_KRB5 */ | 1390 #endif /* OPENSSL_NO_KRB5 */ |
1293 | 1391 |
1294 if (sk == NULL) return(0); | 1392 if (sk == NULL) return(0); |
1295 q=p; | 1393 q=p; |
1296 | 1394 |
1297 for (i=0; i<sk_SSL_CIPHER_num(sk); i++) | 1395 for (i=0; i<sk_SSL_CIPHER_num(sk); i++) |
1298 { | 1396 { |
1299 c=sk_SSL_CIPHER_value(sk,i); | 1397 c=sk_SSL_CIPHER_value(sk,i); |
1300 #ifndef OPENSSL_NO_KRB5 | 1398 #ifndef OPENSSL_NO_KRB5 |
1301 if ((c->algorithms & SSL_KRB5) && nokrb5) | 1399 » » if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL
_aKRB5)) && |
1302 continue; | 1400 » » nokrb5) |
1303 #endif /* OPENSSL_NO_KRB5 */ | 1401 » » continue; |
1304 | 1402 #endif /* OPENSSL_NO_KRB5 */ |
| 1403 #ifndef OPENSSL_NO_PSK |
| 1404 » » /* with PSK there must be client callback set */ |
| 1405 » » if (((c->algorithm_mkey & SSL_kPSK) || (c->algorithm_auth & SSL_
aPSK)) && |
| 1406 » » s->psk_client_callback == NULL) |
| 1407 » » » continue; |
| 1408 #endif /* OPENSSL_NO_PSK */ |
1305 j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); | 1409 j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); |
1306 p+=j; | 1410 p+=j; |
1307 } | 1411 } |
1308 /* If p == q, no ciphers and caller indicates an error. Otherwise | 1412 /* If p == q, no ciphers and caller indicates an error. Otherwise |
1309 * add SCSV if not renegotiating. | 1413 * add SCSV if not renegotiating. |
1310 */ | 1414 */ |
1311 if (p != q && !s->new_session) | 1415 if (p != q && !s->new_session) |
1312 { | 1416 { |
1313 static SSL_CIPHER scsv = | 1417 static SSL_CIPHER scsv = |
1314 { | 1418 { |
1315 » » » 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, | 1419 » » » 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 |
1316 }; | 1420 }; |
1317 j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p)
; | 1421 j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p)
; |
1318 p+=j; | 1422 p+=j; |
1319 #ifdef OPENSSL_RI_DEBUG | 1423 #ifdef OPENSSL_RI_DEBUG |
1320 fprintf(stderr, "SCSV sent by client\n"); | 1424 fprintf(stderr, "SCSV sent by client\n"); |
1321 #endif | 1425 #endif |
1322 } | 1426 } |
1323 | 1427 |
1324 return(p-q); | 1428 return(p-q); |
1325 } | 1429 } |
1326 | 1430 |
1327 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num, | 1431 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num, |
1328 STACK_OF(SSL_CIPHER) **skp) | 1432 STACK_OF(SSL_CIPHER) **skp) |
1329 { | 1433 { |
1330 » SSL_CIPHER *c; | 1434 » const SSL_CIPHER *c; |
1331 STACK_OF(SSL_CIPHER) *sk; | 1435 STACK_OF(SSL_CIPHER) *sk; |
1332 int i,n; | 1436 int i,n; |
1333 if (s->s3) | 1437 if (s->s3) |
1334 s->s3->send_connection_binding = 0; | 1438 s->s3->send_connection_binding = 0; |
1335 | 1439 |
1336 n=ssl_put_cipher_by_char(s,NULL,NULL); | 1440 n=ssl_put_cipher_by_char(s,NULL,NULL); |
1337 if ((num%n) != 0) | 1441 if ((num%n) != 0) |
1338 { | 1442 { |
1339 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CI
PHER_LIST); | 1443 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CI
PHER_LIST); |
1340 return(NULL); | 1444 return(NULL); |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1383 | 1487 |
1384 if (skp != NULL) | 1488 if (skp != NULL) |
1385 *skp=sk; | 1489 *skp=sk; |
1386 return(sk); | 1490 return(sk); |
1387 err: | 1491 err: |
1388 if ((skp == NULL) || (*skp == NULL)) | 1492 if ((skp == NULL) || (*skp == NULL)) |
1389 sk_SSL_CIPHER_free(sk); | 1493 sk_SSL_CIPHER_free(sk); |
1390 return(NULL); | 1494 return(NULL); |
1391 } | 1495 } |
1392 | 1496 |
| 1497 |
1393 #ifndef OPENSSL_NO_TLSEXT | 1498 #ifndef OPENSSL_NO_TLSEXT |
1394 /** return a servername extension value if provided in Client Hello, or NULL. | 1499 /** return a servername extension value if provided in Client Hello, or NULL. |
1395 * So far, only host_name types are defined (RFC 3546). | 1500 * So far, only host_name types are defined (RFC 3546). |
1396 */ | 1501 */ |
1397 | 1502 |
1398 const char *SSL_get_servername(const SSL *s, const int type) | 1503 const char *SSL_get_servername(const SSL *s, const int type) |
1399 { | 1504 { |
1400 if (type != TLSEXT_NAMETYPE_host_name) | 1505 if (type != TLSEXT_NAMETYPE_host_name) |
1401 return NULL; | 1506 return NULL; |
1402 | 1507 |
1403 return s->session && !s->tlsext_hostname ? | 1508 return s->session && !s->tlsext_hostname ? |
1404 s->session->tlsext_hostname : | 1509 s->session->tlsext_hostname : |
1405 s->tlsext_hostname; | 1510 s->tlsext_hostname; |
1406 } | 1511 } |
1407 | 1512 |
1408 int SSL_get_servername_type(const SSL *s) | 1513 int SSL_get_servername_type(const SSL *s) |
1409 { | 1514 { |
1410 if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s
->tlsext_hostname)) | 1515 if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s
->tlsext_hostname)) |
1411 return TLSEXT_NAMETYPE_host_name; | 1516 return TLSEXT_NAMETYPE_host_name; |
1412 return -1; | 1517 return -1; |
1413 } | 1518 } |
| 1519 |
| 1520 # ifndef OPENSSL_NO_NEXTPROTONEG |
| 1521 /* SSL_select_next_proto implements the standard protocol selection. It is |
| 1522 * expected that this function is called from the callback set by |
| 1523 * SSL_CTX_set_next_proto_select_cb. |
| 1524 * |
| 1525 * The protocol data is assumed to be a vector of 8-bit, length prefixed byte |
| 1526 * strings. The length byte itself is not included in the length. A byte |
| 1527 * string of length 0 is invalid. No byte string may be truncated. |
| 1528 * |
| 1529 * The current, but experimental algorithm for selecting the protocol is: |
| 1530 * |
| 1531 * 1) If the server doesn't support NPN then this is indicated to the |
| 1532 * callback. In this case, the client application has to abort the connection |
| 1533 * or have a default application level protocol. |
| 1534 * |
| 1535 * 2) If the server supports NPN, but advertises an empty list then the |
| 1536 * client selects the first protcol in its list, but indicates via the |
| 1537 * API that this fallback case was enacted. |
| 1538 * |
| 1539 * 3) Otherwise, the client finds the first protocol in the server's list |
| 1540 * that it supports and selects this protocol. This is because it's |
| 1541 * assumed that the server has better information about which protocol |
| 1542 * a client should use. |
| 1543 * |
| 1544 * 4) If the client doesn't support any of the server's advertised |
| 1545 * protocols, then this is treated the same as case 2. |
| 1546 * |
| 1547 * It returns either |
| 1548 * OPENSSL_NPN_NEGOTIATED if a common protocol was found, or |
| 1549 * OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. |
| 1550 */ |
| 1551 int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsi
gned char *server, unsigned int server_len, const unsigned char *client, unsigne
d int client_len) |
| 1552 { |
| 1553 unsigned int i, j; |
| 1554 const unsigned char *result; |
| 1555 int status = OPENSSL_NPN_UNSUPPORTED; |
| 1556 |
| 1557 /* For each protocol in server preference order, see if we support it. *
/ |
| 1558 for (i = 0; i < server_len; ) |
| 1559 { |
| 1560 for (j = 0; j < client_len; ) |
| 1561 { |
| 1562 if (server[i] == client[j] && |
| 1563 memcmp(&server[i+1], &client[j+1], server[i]) == 0) |
| 1564 { |
| 1565 /* We found a match */ |
| 1566 result = &server[i]; |
| 1567 status = OPENSSL_NPN_NEGOTIATED; |
| 1568 goto found; |
| 1569 } |
| 1570 j += client[j]; |
| 1571 j++; |
| 1572 } |
| 1573 i += server[i]; |
| 1574 i++; |
| 1575 } |
| 1576 |
| 1577 /* There's no overlap between our protocols and the server's list. */ |
| 1578 result = client; |
| 1579 status = OPENSSL_NPN_NO_OVERLAP; |
| 1580 |
| 1581 found: |
| 1582 *out = (unsigned char *) result + 1; |
| 1583 *outlen = result[0]; |
| 1584 return status; |
| 1585 } |
| 1586 |
| 1587 /* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's |
| 1588 * requested protocol for this connection and returns 0. If the client didn't |
| 1589 * request any protocol, then *data is set to NULL. |
| 1590 * |
| 1591 * Note that the client can request any protocol it chooses. The value returned |
| 1592 * from this function need not be a member of the list of supported protocols |
| 1593 * provided by the callback. |
| 1594 */ |
| 1595 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, un
signed *len) |
| 1596 { |
| 1597 *data = s->next_proto_negotiated; |
| 1598 if (!*data) { |
| 1599 *len = 0; |
| 1600 } else { |
| 1601 *len = s->next_proto_negotiated_len; |
| 1602 } |
| 1603 } |
| 1604 |
| 1605 /* SSL_CTX_set_next_protos_advertised_cb sets a callback that is called when a |
| 1606 * TLS server needs a list of supported protocols for Next Protocol |
| 1607 * Negotiation. The returned list must be in wire format. The list is returned |
| 1608 * by setting |out| to point to it and |outlen| to its length. This memory will |
| 1609 * not be modified, but one should assume that the SSL* keeps a reference to |
| 1610 * it. |
| 1611 * |
| 1612 * The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise. Other
wise, no |
| 1613 * such extension will be included in the ServerHello. */ |
| 1614 void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, co
nst unsigned char **out, unsigned int *outlen, void *arg), void *arg) |
| 1615 { |
| 1616 ctx->next_protos_advertised_cb = cb; |
| 1617 ctx->next_protos_advertised_cb_arg = arg; |
| 1618 } |
| 1619 |
| 1620 /* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a |
| 1621 * client needs to select a protocol from the server's provided list. |out| |
| 1622 * must be set to point to the selected protocol (which may be within |in|). |
| 1623 * The length of the protocol name must be written into |outlen|. The server's |
| 1624 * advertised protocols are provided in |in| and |inlen|. The callback can |
| 1625 * assume that |in| is syntactically valid. |
| 1626 * |
| 1627 * The client must select a protocol. It is fatal to the connection if this |
| 1628 * callback returns a value other than SSL_TLSEXT_ERR_OK. |
| 1629 */ |
| 1630 void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned
char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen,
void *arg), void *arg) |
| 1631 { |
| 1632 ctx->next_proto_select_cb = cb; |
| 1633 ctx->next_proto_select_cb_arg = arg; |
| 1634 } |
| 1635 |
| 1636 # endif |
1414 #endif | 1637 #endif |
1415 | 1638 |
1416 unsigned long SSL_SESSION_hash(const SSL_SESSION *a) | 1639 static unsigned long ssl_session_hash(const SSL_SESSION *a) |
1417 { | 1640 { |
1418 unsigned long l; | 1641 unsigned long l; |
1419 | 1642 |
1420 l=(unsigned long) | 1643 l=(unsigned long) |
1421 ((unsigned int) a->session_id[0] )| | 1644 ((unsigned int) a->session_id[0] )| |
1422 ((unsigned int) a->session_id[1]<< 8L)| | 1645 ((unsigned int) a->session_id[1]<< 8L)| |
1423 ((unsigned long)a->session_id[2]<<16L)| | 1646 ((unsigned long)a->session_id[2]<<16L)| |
1424 ((unsigned long)a->session_id[3]<<24L); | 1647 ((unsigned long)a->session_id[3]<<24L); |
1425 return(l); | 1648 return(l); |
1426 } | 1649 } |
1427 | 1650 |
1428 /* NB: If this function (or indeed the hash function which uses a sort of | 1651 /* NB: If this function (or indeed the hash function which uses a sort of |
1429 * coarser function than this one) is changed, ensure | 1652 * coarser function than this one) is changed, ensure |
1430 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being | 1653 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being |
1431 * able to construct an SSL_SESSION that will collide with any existing session | 1654 * able to construct an SSL_SESSION that will collide with any existing session |
1432 * with a matching session ID. */ | 1655 * with a matching session ID. */ |
1433 int SSL_SESSION_cmp(const SSL_SESSION *a,const SSL_SESSION *b) | 1656 static int ssl_session_cmp(const SSL_SESSION *a,const SSL_SESSION *b) |
1434 { | 1657 { |
1435 if (a->ssl_version != b->ssl_version) | 1658 if (a->ssl_version != b->ssl_version) |
1436 return(1); | 1659 return(1); |
1437 if (a->session_id_length != b->session_id_length) | 1660 if (a->session_id_length != b->session_id_length) |
1438 return(1); | 1661 return(1); |
1439 return(memcmp(a->session_id,b->session_id,a->session_id_length)); | 1662 return(memcmp(a->session_id,b->session_id,a->session_id_length)); |
1440 } | 1663 } |
1441 | 1664 |
1442 /* These wrapper functions should remain rather than redeclaring | 1665 /* These wrapper functions should remain rather than redeclaring |
1443 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each | 1666 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each |
1444 * variable. The reason is that the functions aren't static, they're exposed via | 1667 * variable. The reason is that the functions aren't static, they're exposed via |
1445 * ssl.h. */ | 1668 * ssl.h. */ |
1446 static IMPLEMENT_LHASH_HASH_FN(SSL_SESSION_hash, SSL_SESSION *) | 1669 static IMPLEMENT_LHASH_HASH_FN(ssl_session, SSL_SESSION) |
1447 static IMPLEMENT_LHASH_COMP_FN(SSL_SESSION_cmp, SSL_SESSION *) | 1670 static IMPLEMENT_LHASH_COMP_FN(ssl_session, SSL_SESSION) |
1448 | 1671 |
1449 SSL_CTX *SSL_CTX_new(SSL_METHOD *meth) | 1672 SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) |
1450 { | 1673 { |
1451 SSL_CTX *ret=NULL; | 1674 SSL_CTX *ret=NULL; |
1452 » | 1675 |
1453 if (meth == NULL) | 1676 if (meth == NULL) |
1454 { | 1677 { |
1455 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED); | 1678 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED); |
1456 return(NULL); | 1679 return(NULL); |
1457 } | 1680 } |
1458 | 1681 |
1459 #ifdef OPENSSL_FIPS | |
1460 if (FIPS_mode() && (meth->version < TLS1_VERSION)) | |
1461 { | |
1462 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); | |
1463 return NULL; | |
1464 } | |
1465 #endif | |
1466 | |
1467 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) | 1682 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) |
1468 { | 1683 { |
1469 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS)
; | 1684 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS)
; |
1470 goto err; | 1685 goto err; |
1471 } | 1686 } |
1472 ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX)); | 1687 ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX)); |
1473 if (ret == NULL) | 1688 if (ret == NULL) |
1474 goto err; | 1689 goto err; |
1475 | 1690 |
1476 memset(ret,0,sizeof(SSL_CTX)); | 1691 memset(ret,0,sizeof(SSL_CTX)); |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1519 ret->default_verify_callback=NULL; | 1734 ret->default_verify_callback=NULL; |
1520 if ((ret->cert=ssl_cert_new()) == NULL) | 1735 if ((ret->cert=ssl_cert_new()) == NULL) |
1521 goto err; | 1736 goto err; |
1522 | 1737 |
1523 ret->default_passwd_callback=0; | 1738 ret->default_passwd_callback=0; |
1524 ret->default_passwd_callback_userdata=NULL; | 1739 ret->default_passwd_callback_userdata=NULL; |
1525 ret->client_cert_cb=0; | 1740 ret->client_cert_cb=0; |
1526 ret->app_gen_cookie_cb=0; | 1741 ret->app_gen_cookie_cb=0; |
1527 ret->app_verify_cookie_cb=0; | 1742 ret->app_verify_cookie_cb=0; |
1528 | 1743 |
1529 » ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash), | 1744 » ret->sessions=lh_SSL_SESSION_new(); |
1530 » » » LHASH_COMP_FN(SSL_SESSION_cmp)); | |
1531 if (ret->sessions == NULL) goto err; | 1745 if (ret->sessions == NULL) goto err; |
1532 ret->cert_store=X509_STORE_new(); | 1746 ret->cert_store=X509_STORE_new(); |
1533 if (ret->cert_store == NULL) goto err; | 1747 if (ret->cert_store == NULL) goto err; |
1534 | 1748 |
1535 ssl_create_cipher_list(ret->method, | 1749 ssl_create_cipher_list(ret->method, |
1536 &ret->cipher_list,&ret->cipher_list_by_id, | 1750 &ret->cipher_list,&ret->cipher_list_by_id, |
1537 » » SSL_DEFAULT_CIPHER_LIST); | 1751 » » meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIS
T); |
1538 if (ret->cipher_list == NULL | 1752 if (ret->cipher_list == NULL |
1539 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) | 1753 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) |
1540 { | 1754 { |
1541 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS); | 1755 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS); |
1542 goto err2; | 1756 goto err2; |
1543 } | 1757 } |
1544 | 1758 |
1545 ret->param = X509_VERIFY_PARAM_new(); | 1759 ret->param = X509_VERIFY_PARAM_new(); |
1546 if (!ret->param) | 1760 if (!ret->param) |
1547 goto err; | 1761 goto err; |
(...skipping 15 matching lines...) Expand all Loading... |
1563 } | 1777 } |
1564 | 1778 |
1565 if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL) | 1779 if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL) |
1566 goto err; | 1780 goto err; |
1567 | 1781 |
1568 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data); | 1782 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data); |
1569 | 1783 |
1570 ret->extra_certs=NULL; | 1784 ret->extra_certs=NULL; |
1571 ret->comp_methods=SSL_COMP_get_compression_methods(); | 1785 ret->comp_methods=SSL_COMP_get_compression_methods(); |
1572 | 1786 |
| 1787 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; |
| 1788 |
1573 #ifndef OPENSSL_NO_TLSEXT | 1789 #ifndef OPENSSL_NO_TLSEXT |
1574 ret->tlsext_servername_callback = 0; | 1790 ret->tlsext_servername_callback = 0; |
1575 ret->tlsext_servername_arg = NULL; | 1791 ret->tlsext_servername_arg = NULL; |
1576 /* Setup RFC4507 ticket keys */ | 1792 /* Setup RFC4507 ticket keys */ |
1577 if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0) | 1793 if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0) |
1578 || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0) | 1794 || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0) |
1579 || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0)) | 1795 || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0)) |
1580 ret->options |= SSL_OP_NO_TICKET; | 1796 ret->options |= SSL_OP_NO_TICKET; |
1581 | 1797 |
1582 ret->tlsext_status_cb = 0; | 1798 ret->tlsext_status_cb = 0; |
1583 ret->tlsext_status_arg = NULL; | 1799 ret->tlsext_status_arg = NULL; |
1584 | 1800 |
| 1801 # ifndef OPENSSL_NO_NEXTPROTONEG |
1585 ret->next_protos_advertised_cb = 0; | 1802 ret->next_protos_advertised_cb = 0; |
1586 ret->next_proto_select_cb = 0; | 1803 ret->next_proto_select_cb = 0; |
| 1804 # endif |
1587 #endif | 1805 #endif |
1588 | 1806 #ifndef OPENSSL_NO_PSK |
| 1807 » ret->psk_identity_hint=NULL; |
| 1808 » ret->psk_client_callback=NULL; |
| 1809 » ret->psk_server_callback=NULL; |
| 1810 #endif |
| 1811 #ifndef OPENSSL_NO_BUF_FREELISTS |
| 1812 » ret->freelist_max_len = SSL_MAX_BUF_FREELIST_LEN_DEFAULT; |
| 1813 » ret->rbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST)); |
| 1814 » if (!ret->rbuf_freelist) |
| 1815 » » goto err; |
| 1816 » ret->rbuf_freelist->chunklen = 0; |
| 1817 » ret->rbuf_freelist->len = 0; |
| 1818 » ret->rbuf_freelist->head = NULL; |
| 1819 » ret->wbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST)); |
| 1820 » if (!ret->wbuf_freelist) |
| 1821 » » { |
| 1822 » » OPENSSL_free(ret->rbuf_freelist); |
| 1823 » » goto err; |
| 1824 » » } |
| 1825 » ret->wbuf_freelist->chunklen = 0; |
| 1826 » ret->wbuf_freelist->len = 0; |
| 1827 » ret->wbuf_freelist->head = NULL; |
| 1828 #endif |
1589 #ifndef OPENSSL_NO_ENGINE | 1829 #ifndef OPENSSL_NO_ENGINE |
1590 ret->client_cert_engine = NULL; | 1830 ret->client_cert_engine = NULL; |
1591 #ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO | 1831 #ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO |
1592 #define eng_strx(x) #x | 1832 #define eng_strx(x) #x |
1593 #define eng_str(x) eng_strx(x) | 1833 #define eng_str(x) eng_strx(x) |
1594 /* Use specific client engine automatically... ignore errors */ | 1834 /* Use specific client engine automatically... ignore errors */ |
1595 { | 1835 { |
1596 ENGINE *eng; | 1836 ENGINE *eng; |
1597 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); | 1837 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); |
1598 if (!eng) | 1838 if (!eng) |
(...skipping 18 matching lines...) Expand all Loading... |
1617 err2: | 1857 err2: |
1618 if (ret != NULL) SSL_CTX_free(ret); | 1858 if (ret != NULL) SSL_CTX_free(ret); |
1619 return(NULL); | 1859 return(NULL); |
1620 } | 1860 } |
1621 | 1861 |
1622 #if 0 | 1862 #if 0 |
1623 static void SSL_COMP_free(SSL_COMP *comp) | 1863 static void SSL_COMP_free(SSL_COMP *comp) |
1624 { OPENSSL_free(comp); } | 1864 { OPENSSL_free(comp); } |
1625 #endif | 1865 #endif |
1626 | 1866 |
| 1867 #ifndef OPENSSL_NO_BUF_FREELISTS |
| 1868 static void |
| 1869 ssl_buf_freelist_free(SSL3_BUF_FREELIST *list) |
| 1870 { |
| 1871 SSL3_BUF_FREELIST_ENTRY *ent, *next; |
| 1872 for (ent = list->head; ent; ent = next) |
| 1873 { |
| 1874 next = ent->next; |
| 1875 OPENSSL_free(ent); |
| 1876 } |
| 1877 OPENSSL_free(list); |
| 1878 } |
| 1879 #endif |
| 1880 |
1627 void SSL_CTX_free(SSL_CTX *a) | 1881 void SSL_CTX_free(SSL_CTX *a) |
1628 { | 1882 { |
1629 int i; | 1883 int i; |
1630 | 1884 |
1631 if (a == NULL) return; | 1885 if (a == NULL) return; |
1632 | 1886 |
1633 i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX); | 1887 i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX); |
1634 #ifdef REF_PRINT | 1888 #ifdef REF_PRINT |
1635 REF_PRINT("SSL_CTX",a); | 1889 REF_PRINT("SSL_CTX",a); |
1636 #endif | 1890 #endif |
(...skipping 17 matching lines...) Expand all Loading... |
1654 * the most secure solution seems to be: empty (flush) the cache, then | 1908 * the most secure solution seems to be: empty (flush) the cache, then |
1655 * free ex_data, then finally free the cache. | 1909 * free ex_data, then finally free the cache. |
1656 * (See ticket [openssl.org #212].) | 1910 * (See ticket [openssl.org #212].) |
1657 */ | 1911 */ |
1658 if (a->sessions != NULL) | 1912 if (a->sessions != NULL) |
1659 SSL_CTX_flush_sessions(a,0); | 1913 SSL_CTX_flush_sessions(a,0); |
1660 | 1914 |
1661 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); | 1915 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); |
1662 | 1916 |
1663 if (a->sessions != NULL) | 1917 if (a->sessions != NULL) |
1664 » » lh_free(a->sessions); | 1918 » » lh_SSL_SESSION_free(a->sessions); |
1665 | 1919 |
1666 if (a->cert_store != NULL) | 1920 if (a->cert_store != NULL) |
1667 X509_STORE_free(a->cert_store); | 1921 X509_STORE_free(a->cert_store); |
1668 if (a->cipher_list != NULL) | 1922 if (a->cipher_list != NULL) |
1669 sk_SSL_CIPHER_free(a->cipher_list); | 1923 sk_SSL_CIPHER_free(a->cipher_list); |
1670 if (a->cipher_list_by_id != NULL) | 1924 if (a->cipher_list_by_id != NULL) |
1671 sk_SSL_CIPHER_free(a->cipher_list_by_id); | 1925 sk_SSL_CIPHER_free(a->cipher_list_by_id); |
1672 if (a->cert != NULL) | 1926 if (a->cert != NULL) |
1673 ssl_cert_free(a->cert); | 1927 ssl_cert_free(a->cert); |
1674 if (a->client_CA != NULL) | 1928 if (a->client_CA != NULL) |
1675 sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free); | 1929 sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free); |
1676 if (a->extra_certs != NULL) | 1930 if (a->extra_certs != NULL) |
1677 sk_X509_pop_free(a->extra_certs,X509_free); | 1931 sk_X509_pop_free(a->extra_certs,X509_free); |
1678 #if 0 /* This should never be done, since it removes a global database */ | 1932 #if 0 /* This should never be done, since it removes a global database */ |
1679 if (a->comp_methods != NULL) | 1933 if (a->comp_methods != NULL) |
1680 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free); | 1934 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free); |
1681 #else | 1935 #else |
1682 a->comp_methods = NULL; | 1936 a->comp_methods = NULL; |
1683 #endif | 1937 #endif |
| 1938 |
| 1939 #ifndef OPENSSL_NO_PSK |
| 1940 if (a->psk_identity_hint) |
| 1941 OPENSSL_free(a->psk_identity_hint); |
| 1942 #endif |
1684 #ifndef OPENSSL_NO_ENGINE | 1943 #ifndef OPENSSL_NO_ENGINE |
1685 if (a->client_cert_engine) | 1944 if (a->client_cert_engine) |
1686 ENGINE_finish(a->client_cert_engine); | 1945 ENGINE_finish(a->client_cert_engine); |
1687 #endif | 1946 #endif |
1688 | 1947 |
| 1948 #ifndef OPENSSL_NO_BUF_FREELISTS |
| 1949 if (a->wbuf_freelist) |
| 1950 ssl_buf_freelist_free(a->wbuf_freelist); |
| 1951 if (a->rbuf_freelist) |
| 1952 ssl_buf_freelist_free(a->rbuf_freelist); |
| 1953 #endif |
| 1954 |
1689 OPENSSL_free(a); | 1955 OPENSSL_free(a); |
1690 } | 1956 } |
1691 | 1957 |
1692 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) | 1958 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) |
1693 { | 1959 { |
1694 ctx->default_passwd_callback=cb; | 1960 ctx->default_passwd_callback=cb; |
1695 } | 1961 } |
1696 | 1962 |
1697 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u) | 1963 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u) |
1698 { | 1964 { |
(...skipping 10 matching lines...) Expand all Loading... |
1709 { | 1975 { |
1710 ctx->verify_mode=mode; | 1976 ctx->verify_mode=mode; |
1711 ctx->default_verify_callback=cb; | 1977 ctx->default_verify_callback=cb; |
1712 } | 1978 } |
1713 | 1979 |
1714 void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth) | 1980 void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth) |
1715 { | 1981 { |
1716 X509_VERIFY_PARAM_set_depth(ctx->param, depth); | 1982 X509_VERIFY_PARAM_set_depth(ctx->param, depth); |
1717 } | 1983 } |
1718 | 1984 |
1719 void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher) | 1985 void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) |
1720 { | 1986 { |
1721 CERT_PKEY *cpk; | 1987 CERT_PKEY *cpk; |
1722 int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign; | 1988 int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign; |
1723 int rsa_enc_export,dh_rsa_export,dh_dsa_export; | 1989 int rsa_enc_export,dh_rsa_export,dh_dsa_export; |
1724 int rsa_tmp_export,dh_tmp_export,kl; | 1990 int rsa_tmp_export,dh_tmp_export,kl; |
1725 » unsigned long mask,emask; | 1991 » unsigned long mask_k,mask_a,emask_k,emask_a; |
1726 int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size; | 1992 int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size; |
1727 #ifndef OPENSSL_NO_ECDH | 1993 #ifndef OPENSSL_NO_ECDH |
1728 int have_ecdh_tmp; | 1994 int have_ecdh_tmp; |
1729 #endif | 1995 #endif |
1730 X509 *x = NULL; | 1996 X509 *x = NULL; |
1731 EVP_PKEY *ecc_pkey = NULL; | 1997 EVP_PKEY *ecc_pkey = NULL; |
1732 » int signature_nid = 0; | 1998 » int signature_nid = 0, pk_nid = 0, md_nid = 0; |
1733 | 1999 |
1734 if (c == NULL) return; | 2000 if (c == NULL) return; |
1735 | 2001 |
1736 kl=SSL_C_EXPORT_PKEYLENGTH(cipher); | 2002 kl=SSL_C_EXPORT_PKEYLENGTH(cipher); |
1737 | 2003 |
1738 #ifndef OPENSSL_NO_RSA | 2004 #ifndef OPENSSL_NO_RSA |
1739 rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL); | 2005 rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL); |
1740 rsa_tmp_export=(c->rsa_tmp_cb != NULL || | 2006 rsa_tmp_export=(c->rsa_tmp_cb != NULL || |
1741 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl)); | 2007 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl)); |
1742 #else | 2008 #else |
(...skipping 19 matching lines...) Expand all Loading... |
1762 dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); | 2028 dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); |
1763 cpk= &(c->pkeys[SSL_PKEY_DH_RSA]); | 2029 cpk= &(c->pkeys[SSL_PKEY_DH_RSA]); |
1764 dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL); | 2030 dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL); |
1765 dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); | 2031 dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); |
1766 cpk= &(c->pkeys[SSL_PKEY_DH_DSA]); | 2032 cpk= &(c->pkeys[SSL_PKEY_DH_DSA]); |
1767 /* FIX THIS EAY EAY EAY */ | 2033 /* FIX THIS EAY EAY EAY */ |
1768 dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL); | 2034 dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL); |
1769 dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); | 2035 dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); |
1770 cpk= &(c->pkeys[SSL_PKEY_ECC]); | 2036 cpk= &(c->pkeys[SSL_PKEY_ECC]); |
1771 have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL); | 2037 have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL); |
1772 » mask=0; | 2038 » mask_k=0; |
1773 » emask=0; | 2039 » mask_a=0; |
| 2040 » emask_k=0; |
| 2041 » emask_a=0; |
| 2042 |
| 2043 » |
1774 | 2044 |
1775 #ifdef CIPHER_DEBUG | 2045 #ifdef CIPHER_DEBUG |
1776 » printf("rt=%d rte=%d dht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n", | 2046 » printf("rt=%d rte=%d dht=%d ecdht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd
=%d\n", |
1777 » » rsa_tmp,rsa_tmp_export,dh_tmp, | 2047 » rsa_tmp,rsa_tmp_export,dh_tmp,have_ecdh_tmp, |
1778 rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa); | 2048 rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa); |
1779 #endif | 2049 #endif |
| 2050 |
| 2051 cpk = &(c->pkeys[SSL_PKEY_GOST01]); |
| 2052 if (cpk->x509 != NULL && cpk->privatekey !=NULL) { |
| 2053 mask_k |= SSL_kGOST; |
| 2054 mask_a |= SSL_aGOST01; |
| 2055 } |
| 2056 cpk = &(c->pkeys[SSL_PKEY_GOST94]); |
| 2057 if (cpk->x509 != NULL && cpk->privatekey !=NULL) { |
| 2058 mask_k |= SSL_kGOST; |
| 2059 mask_a |= SSL_aGOST94; |
| 2060 } |
1780 | 2061 |
1781 if (rsa_enc || (rsa_tmp && rsa_sign)) | 2062 if (rsa_enc || (rsa_tmp && rsa_sign)) |
1782 » » mask|=SSL_kRSA; | 2063 » » mask_k|=SSL_kRSA; |
1783 if (rsa_enc_export || (rsa_tmp_export && (rsa_sign || rsa_enc))) | 2064 if (rsa_enc_export || (rsa_tmp_export && (rsa_sign || rsa_enc))) |
1784 » » emask|=SSL_kRSA; | 2065 » » emask_k|=SSL_kRSA; |
1785 | 2066 |
1786 #if 0 | 2067 #if 0 |
1787 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */ | 2068 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */ |
1788 » if (» (dh_tmp || dh_rsa || dh_dsa) && | 2069 » if (» (dh_tmp || dh_rsa || dh_dsa) && |
1789 (rsa_enc || rsa_sign || dsa_sign)) | 2070 (rsa_enc || rsa_sign || dsa_sign)) |
1790 » » mask|=SSL_kEDH; | 2071 » » mask_k|=SSL_kEDH; |
1791 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) && | 2072 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) && |
1792 (rsa_enc || rsa_sign || dsa_sign)) | 2073 (rsa_enc || rsa_sign || dsa_sign)) |
1793 » » emask|=SSL_kEDH; | 2074 » » emask_k|=SSL_kEDH; |
1794 #endif | 2075 #endif |
1795 | 2076 |
1796 » if (dh_tmp_export) | 2077 » if (dh_tmp_export) |
1797 » » emask|=SSL_kEDH; | 2078 » » emask_k|=SSL_kEDH; |
1798 | 2079 |
1799 if (dh_tmp) | 2080 if (dh_tmp) |
1800 » » mask|=SSL_kEDH; | 2081 » » mask_k|=SSL_kEDH; |
1801 | 2082 |
1802 » if (dh_rsa) mask|=SSL_kDHr; | 2083 » if (dh_rsa) mask_k|=SSL_kDHr; |
1803 » if (dh_rsa_export) emask|=SSL_kDHr; | 2084 » if (dh_rsa_export) emask_k|=SSL_kDHr; |
1804 | 2085 |
1805 » if (dh_dsa) mask|=SSL_kDHd; | 2086 » if (dh_dsa) mask_k|=SSL_kDHd; |
1806 » if (dh_dsa_export) emask|=SSL_kDHd; | 2087 » if (dh_dsa_export) emask_k|=SSL_kDHd; |
1807 | 2088 |
1808 if (rsa_enc || rsa_sign) | 2089 if (rsa_enc || rsa_sign) |
1809 { | 2090 { |
1810 » » mask|=SSL_aRSA; | 2091 » » mask_a|=SSL_aRSA; |
1811 » » emask|=SSL_aRSA; | 2092 » » emask_a|=SSL_aRSA; |
1812 } | 2093 } |
1813 | 2094 |
1814 if (dsa_sign) | 2095 if (dsa_sign) |
1815 { | 2096 { |
1816 » » mask|=SSL_aDSS; | 2097 » » mask_a|=SSL_aDSS; |
1817 » » emask|=SSL_aDSS; | 2098 » » emask_a|=SSL_aDSS; |
1818 } | 2099 } |
1819 | 2100 |
1820 » mask|=SSL_aNULL; | 2101 » mask_a|=SSL_aNULL; |
1821 » emask|=SSL_aNULL; | 2102 » emask_a|=SSL_aNULL; |
1822 | 2103 |
1823 #ifndef OPENSSL_NO_KRB5 | 2104 #ifndef OPENSSL_NO_KRB5 |
1824 » mask|=SSL_kKRB5|SSL_aKRB5; | 2105 » mask_k|=SSL_kKRB5; |
1825 » emask|=SSL_kKRB5|SSL_aKRB5; | 2106 » mask_a|=SSL_aKRB5; |
| 2107 » emask_k|=SSL_kKRB5; |
| 2108 » emask_a|=SSL_aKRB5; |
1826 #endif | 2109 #endif |
1827 | 2110 |
1828 /* An ECC certificate may be usable for ECDH and/or | 2111 /* An ECC certificate may be usable for ECDH and/or |
1829 * ECDSA cipher suites depending on the key usage extension. | 2112 * ECDSA cipher suites depending on the key usage extension. |
1830 */ | 2113 */ |
1831 if (have_ecc_cert) | 2114 if (have_ecc_cert) |
1832 { | 2115 { |
1833 /* This call populates extension flags (ex_flags) */ | 2116 » » /* This call populates extension flags (ex_flags) */ |
1834 x = (c->pkeys[SSL_PKEY_ECC]).x509; | 2117 x = (c->pkeys[SSL_PKEY_ECC]).x509; |
1835 X509_check_purpose(x, -1, 0); | 2118 X509_check_purpose(x, -1, 0); |
1836 ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ? | 2119 ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ? |
1837 (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1; | 2120 (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1; |
1838 ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ? | 2121 ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ? |
1839 (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1; | 2122 (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1; |
1840 ecc_pkey = X509_get_pubkey(x); | 2123 ecc_pkey = X509_get_pubkey(x); |
1841 » » ecc_pkey_size = (ecc_pkey != NULL) ? | 2124 » » ecc_pkey_size = (ecc_pkey != NULL) ? |
1842 EVP_PKEY_bits(ecc_pkey) : 0; | 2125 EVP_PKEY_bits(ecc_pkey) : 0; |
1843 EVP_PKEY_free(ecc_pkey); | 2126 EVP_PKEY_free(ecc_pkey); |
1844 if ((x->sig_alg) && (x->sig_alg->algorithm)) | 2127 if ((x->sig_alg) && (x->sig_alg->algorithm)) |
| 2128 { |
1845 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); | 2129 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); |
| 2130 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid); |
| 2131 } |
1846 #ifndef OPENSSL_NO_ECDH | 2132 #ifndef OPENSSL_NO_ECDH |
1847 if (ecdh_ok) | 2133 if (ecdh_ok) |
1848 { | 2134 { |
1849 » » » if ((signature_nid == NID_md5WithRSAEncryption) || | 2135 |
1850 » » » (signature_nid == NID_md4WithRSAEncryption) || | 2136 » » » if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa) |
1851 » » » (signature_nid == NID_md2WithRSAEncryption)) | |
1852 { | 2137 { |
1853 » » » » mask|=SSL_kECDH|SSL_aRSA; | 2138 » » » » mask_k|=SSL_kECDHr; |
| 2139 » » » » mask_a|=SSL_aECDH; |
1854 if (ecc_pkey_size <= 163) | 2140 if (ecc_pkey_size <= 163) |
1855 » » » » » emask|=SSL_kECDH|SSL_aRSA; | 2141 » » » » » { |
| 2142 » » » » » emask_k|=SSL_kECDHr; |
| 2143 » » » » » emask_a|=SSL_aECDH; |
| 2144 » » » » » } |
1856 } | 2145 } |
1857 » » » if (signature_nid == NID_ecdsa_with_SHA1) | 2146 |
| 2147 » » » if (pk_nid == NID_X9_62_id_ecPublicKey) |
1858 { | 2148 { |
1859 » » » » mask|=SSL_kECDH|SSL_aECDSA; | 2149 » » » » mask_k|=SSL_kECDHe; |
| 2150 » » » » mask_a|=SSL_aECDH; |
1860 if (ecc_pkey_size <= 163) | 2151 if (ecc_pkey_size <= 163) |
1861 » » » » » emask|=SSL_kECDH|SSL_aECDSA; | 2152 » » » » » { |
| 2153 » » » » » emask_k|=SSL_kECDHe; |
| 2154 » » » » » emask_a|=SSL_aECDH; |
| 2155 » » » » » } |
1862 } | 2156 } |
1863 } | 2157 } |
1864 #endif | 2158 #endif |
1865 #ifndef OPENSSL_NO_ECDSA | 2159 #ifndef OPENSSL_NO_ECDSA |
1866 if (ecdsa_ok) | 2160 if (ecdsa_ok) |
1867 { | 2161 { |
1868 » » » mask|=SSL_aECDSA; | 2162 » » » mask_a|=SSL_aECDSA; |
1869 » » » emask|=SSL_aECDSA; | 2163 » » » emask_a|=SSL_aECDSA; |
1870 } | 2164 } |
1871 #endif | 2165 #endif |
1872 } | 2166 } |
1873 | 2167 |
1874 #ifndef OPENSSL_NO_ECDH | 2168 #ifndef OPENSSL_NO_ECDH |
1875 if (have_ecdh_tmp) | 2169 if (have_ecdh_tmp) |
1876 { | 2170 { |
1877 » » mask|=SSL_kECDHE; | 2171 » » mask_k|=SSL_kEECDH; |
1878 » » emask|=SSL_kECDHE; | 2172 » » emask_k|=SSL_kEECDH; |
1879 } | 2173 } |
1880 #endif | 2174 #endif |
1881 » c->mask=mask; | 2175 |
1882 » c->export_mask=emask; | 2176 #ifndef OPENSSL_NO_PSK |
| 2177 » mask_k |= SSL_kPSK; |
| 2178 » mask_a |= SSL_aPSK; |
| 2179 » emask_k |= SSL_kPSK; |
| 2180 » emask_a |= SSL_aPSK; |
| 2181 #endif |
| 2182 |
| 2183 » c->mask_k=mask_k; |
| 2184 » c->mask_a=mask_a; |
| 2185 » c->export_mask_k=emask_k; |
| 2186 » c->export_mask_a=emask_a; |
1883 c->valid=1; | 2187 c->valid=1; |
1884 } | 2188 } |
1885 | 2189 |
1886 /* This handy macro borrowed from crypto/x509v3/v3_purp.c */ | 2190 /* This handy macro borrowed from crypto/x509v3/v3_purp.c */ |
1887 #define ku_reject(x, usage) \ | 2191 #define ku_reject(x, usage) \ |
1888 (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage))) | 2192 (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage))) |
1889 | 2193 |
1890 int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs) | 2194 #ifndef OPENSSL_NO_EC |
| 2195 |
| 2196 int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs) |
1891 { | 2197 { |
1892 » unsigned long alg = cs->algorithms; | 2198 » unsigned long alg_k, alg_a; |
1893 EVP_PKEY *pkey = NULL; | 2199 EVP_PKEY *pkey = NULL; |
1894 int keysize = 0; | 2200 int keysize = 0; |
1895 » int signature_nid = 0; | 2201 » int signature_nid = 0, md_nid = 0, pk_nid = 0; |
| 2202 |
| 2203 » alg_k = cs->algorithm_mkey; |
| 2204 » alg_a = cs->algorithm_auth; |
1896 | 2205 |
1897 if (SSL_C_IS_EXPORT(cs)) | 2206 if (SSL_C_IS_EXPORT(cs)) |
1898 { | 2207 { |
1899 /* ECDH key length in export ciphers must be <= 163 bits */ | 2208 /* ECDH key length in export ciphers must be <= 163 bits */ |
1900 pkey = X509_get_pubkey(x); | 2209 pkey = X509_get_pubkey(x); |
1901 if (pkey == NULL) return 0; | 2210 if (pkey == NULL) return 0; |
1902 keysize = EVP_PKEY_bits(pkey); | 2211 keysize = EVP_PKEY_bits(pkey); |
1903 EVP_PKEY_free(pkey); | 2212 EVP_PKEY_free(pkey); |
1904 if (keysize > 163) return 0; | 2213 if (keysize > 163) return 0; |
1905 } | 2214 } |
1906 | 2215 |
1907 /* This call populates the ex_flags field correctly */ | 2216 /* This call populates the ex_flags field correctly */ |
1908 X509_check_purpose(x, -1, 0); | 2217 X509_check_purpose(x, -1, 0); |
1909 if ((x->sig_alg) && (x->sig_alg->algorithm)) | 2218 if ((x->sig_alg) && (x->sig_alg->algorithm)) |
| 2219 { |
1910 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); | 2220 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); |
1911 » if (alg & SSL_kECDH) | 2221 » » OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid); |
| 2222 » » } |
| 2223 » if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr) |
1912 { | 2224 { |
1913 /* key usage, if present, must allow key agreement */ | 2225 /* key usage, if present, must allow key agreement */ |
1914 if (ku_reject(x, X509v3_KU_KEY_AGREEMENT)) | 2226 if (ku_reject(x, X509v3_KU_KEY_AGREEMENT)) |
1915 { | 2227 { |
| 2228 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_
CERT_NOT_FOR_KEY_AGREEMENT); |
1916 return 0; | 2229 return 0; |
1917 } | 2230 } |
1918 » » if (alg & SSL_aECDSA) | 2231 » » if (alg_k & SSL_kECDHe) |
1919 { | 2232 { |
1920 /* signature alg must be ECDSA */ | 2233 /* signature alg must be ECDSA */ |
1921 » » » if (signature_nid != NID_ecdsa_with_SHA1) | 2234 » » » if (pk_nid != NID_X9_62_id_ecPublicKey) |
1922 { | 2235 { |
| 2236 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SS
L_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE); |
1923 return 0; | 2237 return 0; |
1924 } | 2238 } |
1925 } | 2239 } |
1926 » » if (alg & SSL_aRSA) | 2240 » » if (alg_k & SSL_kECDHr) |
1927 { | 2241 { |
1928 /* signature alg must be RSA */ | 2242 /* signature alg must be RSA */ |
1929 » » » if ((signature_nid != NID_md5WithRSAEncryption) && | 2243 |
1930 » » » (signature_nid != NID_md4WithRSAEncryption) && | 2244 » » » if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa) |
1931 » » » (signature_nid != NID_md2WithRSAEncryption)) | |
1932 { | 2245 { |
| 2246 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SS
L_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE); |
1933 return 0; | 2247 return 0; |
1934 } | 2248 } |
1935 } | 2249 } |
1936 » » } | 2250 » » } |
1937 » else if (alg & SSL_aECDSA) | 2251 » if (alg_a & SSL_aECDSA) |
1938 { | 2252 { |
1939 /* key usage, if present, must allow signing */ | 2253 /* key usage, if present, must allow signing */ |
1940 if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) | 2254 if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) |
1941 { | 2255 { |
| 2256 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_
CERT_NOT_FOR_SIGNING); |
1942 return 0; | 2257 return 0; |
1943 } | 2258 } |
1944 } | 2259 } |
1945 | 2260 |
1946 return 1; /* all checks are ok */ | 2261 return 1; /* all checks are ok */ |
1947 } | 2262 } |
1948 | 2263 |
| 2264 #endif |
| 2265 |
1949 /* THIS NEEDS CLEANING UP */ | 2266 /* THIS NEEDS CLEANING UP */ |
1950 X509 *ssl_get_server_send_cert(SSL *s) | 2267 X509 *ssl_get_server_send_cert(SSL *s) |
1951 { | 2268 { |
1952 » unsigned long alg,mask,kalg; | 2269 » unsigned long alg_k,alg_a; |
1953 CERT *c; | 2270 CERT *c; |
1954 » int i,is_export; | 2271 » int i; |
1955 | 2272 |
1956 c=s->cert; | 2273 c=s->cert; |
1957 ssl_set_cert_masks(c, s->s3->tmp.new_cipher); | 2274 ssl_set_cert_masks(c, s->s3->tmp.new_cipher); |
1958 » alg=s->s3->tmp.new_cipher->algorithms; | 2275 » |
1959 » is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); | 2276 » alg_k = s->s3->tmp.new_cipher->algorithm_mkey; |
1960 » mask=is_export?c->export_mask:c->mask; | 2277 » alg_a = s->s3->tmp.new_cipher->algorithm_auth; |
1961 » kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK); | |
1962 | 2278 |
1963 » if (kalg & SSL_kECDH) | 2279 » if (alg_k & (SSL_kECDHr|SSL_kECDHe)) |
1964 { | 2280 { |
1965 » » /* we don't need to look at SSL_kECDHE | 2281 » » /* we don't need to look at SSL_kEECDH |
1966 * since no certificate is needed for | 2282 * since no certificate is needed for |
1967 * anon ECDH and for authenticated | 2283 * anon ECDH and for authenticated |
1968 » » * ECDHE, the check for the auth | 2284 » » * EECDH, the check for the auth |
1969 * algorithm will set i correctly | 2285 * algorithm will set i correctly |
1970 * NOTE: For ECDH-RSA, we need an ECC | 2286 * NOTE: For ECDH-RSA, we need an ECC |
1971 » » * not an RSA cert but for ECDHE-RSA | 2287 » » * not an RSA cert but for EECDH-RSA |
1972 * we need an RSA cert. Placing the | 2288 * we need an RSA cert. Placing the |
1973 * checks for SSL_kECDH before RSA | 2289 * checks for SSL_kECDH before RSA |
1974 * checks ensures the correct cert is chosen. | 2290 * checks ensures the correct cert is chosen. |
1975 */ | 2291 */ |
1976 i=SSL_PKEY_ECC; | 2292 i=SSL_PKEY_ECC; |
1977 } | 2293 } |
1978 » else if (kalg & SSL_aECDSA) | 2294 » else if (alg_a & SSL_aECDSA) |
1979 { | 2295 { |
1980 i=SSL_PKEY_ECC; | 2296 i=SSL_PKEY_ECC; |
1981 } | 2297 } |
1982 » else if (kalg & SSL_kDHr) | 2298 » else if (alg_k & SSL_kDHr) |
1983 i=SSL_PKEY_DH_RSA; | 2299 i=SSL_PKEY_DH_RSA; |
1984 » else if (kalg & SSL_kDHd) | 2300 » else if (alg_k & SSL_kDHd) |
1985 i=SSL_PKEY_DH_DSA; | 2301 i=SSL_PKEY_DH_DSA; |
1986 » else if (kalg & SSL_aDSS) | 2302 » else if (alg_a & SSL_aDSS) |
1987 i=SSL_PKEY_DSA_SIGN; | 2303 i=SSL_PKEY_DSA_SIGN; |
1988 » else if (kalg & SSL_aRSA) | 2304 » else if (alg_a & SSL_aRSA) |
1989 { | 2305 { |
1990 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL) | 2306 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL) |
1991 i=SSL_PKEY_RSA_SIGN; | 2307 i=SSL_PKEY_RSA_SIGN; |
1992 else | 2308 else |
1993 i=SSL_PKEY_RSA_ENC; | 2309 i=SSL_PKEY_RSA_ENC; |
1994 } | 2310 } |
1995 » else if (kalg & SSL_aKRB5) | 2311 » else if (alg_a & SSL_aKRB5) |
1996 { | 2312 { |
1997 /* VRS something else here? */ | 2313 /* VRS something else here? */ |
1998 return(NULL); | 2314 return(NULL); |
1999 } | 2315 } |
2000 » else /* if (kalg & SSL_aNULL) */ | 2316 » else if (alg_a & SSL_aGOST94) |
| 2317 » » i=SSL_PKEY_GOST94; |
| 2318 » else if (alg_a & SSL_aGOST01) |
| 2319 » » i=SSL_PKEY_GOST01; |
| 2320 » else /* if (alg_a & SSL_aNULL) */ |
2001 { | 2321 { |
2002 SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,ERR_R_INTERNAL_ERROR); | 2322 SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,ERR_R_INTERNAL_ERROR); |
2003 return(NULL); | 2323 return(NULL); |
2004 } | 2324 } |
2005 if (c->pkeys[i].x509 == NULL) return(NULL); | 2325 if (c->pkeys[i].x509 == NULL) return(NULL); |
2006 | 2326 |
2007 return(c->pkeys[i].x509); | 2327 return(c->pkeys[i].x509); |
2008 } | 2328 } |
2009 | 2329 |
2010 EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher) | 2330 EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher) |
2011 { | 2331 { |
2012 » unsigned long alg; | 2332 » unsigned long alg_a; |
2013 CERT *c; | 2333 CERT *c; |
2014 | 2334 |
2015 » alg=cipher->algorithms; | 2335 » alg_a = cipher->algorithm_auth; |
2016 c=s->cert; | 2336 c=s->cert; |
2017 | 2337 |
2018 » if ((alg & SSL_aDSS) && | 2338 » if ((alg_a & SSL_aDSS) && |
2019 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL)) | 2339 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL)) |
2020 return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey); | 2340 return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey); |
2021 » else if (alg & SSL_aRSA) | 2341 » else if (alg_a & SSL_aRSA) |
2022 { | 2342 { |
2023 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL) | 2343 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL) |
2024 return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey); | 2344 return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey); |
2025 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL) | 2345 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL) |
2026 return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey); | 2346 return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey); |
2027 else | 2347 else |
2028 return(NULL); | 2348 return(NULL); |
2029 } | 2349 } |
2030 » else if ((alg & SSL_aECDSA) && | 2350 » else if ((alg_a & SSL_aECDSA) && |
2031 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL)) | 2351 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL)) |
2032 return(c->pkeys[SSL_PKEY_ECC].privatekey); | 2352 return(c->pkeys[SSL_PKEY_ECC].privatekey); |
2033 » else /* if (alg & SSL_aNULL) */ | 2353 » else /* if (alg_a & SSL_aNULL) */ |
2034 { | 2354 { |
2035 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR); | 2355 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR); |
2036 return(NULL); | 2356 return(NULL); |
2037 } | 2357 } |
2038 } | 2358 } |
2039 | 2359 |
2040 void ssl_update_cache(SSL *s,int mode) | 2360 void ssl_update_cache(SSL *s,int mode) |
2041 { | 2361 { |
2042 int i; | 2362 int i; |
2043 | 2363 |
2044 /* If the session_id_length is 0, we are not supposed to cache it, | 2364 /* If the session_id_length is 0, we are not supposed to cache it, |
2045 * and it would be rather hard to do anyway :-) */ | 2365 * and it would be rather hard to do anyway :-) */ |
2046 if (s->session->session_id_length == 0) return; | 2366 if (s->session->session_id_length == 0) return; |
2047 | 2367 |
2048 » i=s->ctx->session_cache_mode; | 2368 » i=s->session_ctx->session_cache_mode; |
2049 if ((i & mode) && (!s->hit) | 2369 if ((i & mode) && (!s->hit) |
2050 && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) | 2370 && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) |
2051 » » || SSL_CTX_add_session(s->ctx,s->session)) | 2371 » » || SSL_CTX_add_session(s->session_ctx,s->session)) |
2052 » » && (s->ctx->new_session_cb != NULL)) | 2372 » » && (s->session_ctx->new_session_cb != NULL)) |
2053 { | 2373 { |
2054 CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION); | 2374 CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION); |
2055 » » if (!s->ctx->new_session_cb(s,s->session)) | 2375 » » if (!s->session_ctx->new_session_cb(s,s->session)) |
2056 SSL_SESSION_free(s->session); | 2376 SSL_SESSION_free(s->session); |
2057 } | 2377 } |
2058 | 2378 |
2059 /* auto flush every 255 connections */ | 2379 /* auto flush every 255 connections */ |
2060 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && | 2380 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && |
2061 ((i & mode) == mode)) | 2381 ((i & mode) == mode)) |
2062 { | 2382 { |
2063 if ( (((mode & SSL_SESS_CACHE_CLIENT) | 2383 if ( (((mode & SSL_SESS_CACHE_CLIENT) |
2064 » » » ?s->ctx->stats.sess_connect_good | 2384 » » » ?s->session_ctx->stats.sess_connect_good |
2065 » » » :s->ctx->stats.sess_accept_good) & 0xff) == 0xff) | 2385 » » » :s->session_ctx->stats.sess_accept_good) & 0xff) == 0xff
) |
2066 { | 2386 { |
2067 » » » SSL_CTX_flush_sessions(s->ctx,(unsigned long)time(NULL))
; | 2387 » » » SSL_CTX_flush_sessions(s->session_ctx,(unsigned long)tim
e(NULL)); |
2068 } | 2388 } |
2069 } | 2389 } |
2070 } | 2390 } |
2071 | 2391 |
2072 SSL_METHOD *SSL_get_ssl_method(SSL *s) | 2392 const SSL_METHOD *SSL_get_ssl_method(SSL *s) |
2073 { | 2393 { |
2074 return(s->method); | 2394 return(s->method); |
2075 } | 2395 } |
2076 | 2396 |
2077 int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth) | 2397 int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth) |
2078 { | 2398 { |
2079 int conn= -1; | 2399 int conn= -1; |
2080 int ret=1; | 2400 int ret=1; |
2081 | 2401 |
2082 if (s->method != meth) | 2402 if (s->method != meth) |
2083 { | 2403 { |
2084 if (s->handshake_func != NULL) | 2404 if (s->handshake_func != NULL) |
2085 conn=(s->handshake_func == s->method->ssl_connect); | 2405 conn=(s->handshake_func == s->method->ssl_connect); |
2086 | 2406 |
2087 if (s->method->version == meth->version) | 2407 if (s->method->version == meth->version) |
(...skipping 24 matching lines...) Expand all Loading... |
2112 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake | 2432 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake |
2113 * etc, where we do encode the error */ | 2433 * etc, where we do encode the error */ |
2114 if ((l=ERR_peek_error()) != 0) | 2434 if ((l=ERR_peek_error()) != 0) |
2115 { | 2435 { |
2116 if (ERR_GET_LIB(l) == ERR_LIB_SYS) | 2436 if (ERR_GET_LIB(l) == ERR_LIB_SYS) |
2117 return(SSL_ERROR_SYSCALL); | 2437 return(SSL_ERROR_SYSCALL); |
2118 else | 2438 else |
2119 return(SSL_ERROR_SSL); | 2439 return(SSL_ERROR_SSL); |
2120 } | 2440 } |
2121 | 2441 |
2122 if ((i < 0) && SSL_want_server_random_validation(s)) | |
2123 return(SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING); | |
2124 | |
2125 if ((i < 0) && SSL_want_read(s)) | 2442 if ((i < 0) && SSL_want_read(s)) |
2126 { | 2443 { |
2127 bio=SSL_get_rbio(s); | 2444 bio=SSL_get_rbio(s); |
2128 if (BIO_should_read(bio)) | 2445 if (BIO_should_read(bio)) |
2129 return(SSL_ERROR_WANT_READ); | 2446 return(SSL_ERROR_WANT_READ); |
2130 else if (BIO_should_write(bio)) | 2447 else if (BIO_should_write(bio)) |
2131 /* This one doesn't make too much sense ... We never try | 2448 /* This one doesn't make too much sense ... We never try |
2132 * to write to the rbio, and an application program wher
e | 2449 * to write to the rbio, and an application program wher
e |
2133 * rbio and wbio are separate couldn't even know what it | 2450 * rbio and wbio are separate couldn't even know what it |
2134 * should wait for. | 2451 * should wait for. |
(...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2213 /* For the next 2 functions, SSL_clear() sets shutdown and so | 2530 /* For the next 2 functions, SSL_clear() sets shutdown and so |
2214 * one of these calls will reset it */ | 2531 * one of these calls will reset it */ |
2215 void SSL_set_accept_state(SSL *s) | 2532 void SSL_set_accept_state(SSL *s) |
2216 { | 2533 { |
2217 s->server=1; | 2534 s->server=1; |
2218 s->shutdown=0; | 2535 s->shutdown=0; |
2219 s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE; | 2536 s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE; |
2220 s->handshake_func=s->method->ssl_accept; | 2537 s->handshake_func=s->method->ssl_accept; |
2221 /* clear the current cipher */ | 2538 /* clear the current cipher */ |
2222 ssl_clear_cipher_ctx(s); | 2539 ssl_clear_cipher_ctx(s); |
| 2540 ssl_clear_hash_ctx(&s->read_hash); |
| 2541 ssl_clear_hash_ctx(&s->write_hash); |
2223 } | 2542 } |
2224 | 2543 |
2225 void SSL_set_connect_state(SSL *s) | 2544 void SSL_set_connect_state(SSL *s) |
2226 { | 2545 { |
2227 s->server=0; | 2546 s->server=0; |
2228 s->shutdown=0; | 2547 s->shutdown=0; |
2229 s->state=SSL_ST_CONNECT|SSL_ST_BEFORE; | 2548 s->state=SSL_ST_CONNECT|SSL_ST_BEFORE; |
2230 s->handshake_func=s->method->ssl_connect; | 2549 s->handshake_func=s->method->ssl_connect; |
2231 /* clear the current cipher */ | 2550 /* clear the current cipher */ |
2232 ssl_clear_cipher_ctx(s); | 2551 ssl_clear_cipher_ctx(s); |
| 2552 ssl_clear_hash_ctx(&s->read_hash); |
| 2553 ssl_clear_hash_ctx(&s->write_hash); |
2233 } | 2554 } |
2234 | 2555 |
2235 int ssl_undefined_function(SSL *s) | 2556 int ssl_undefined_function(SSL *s) |
2236 { | 2557 { |
2237 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | 2558 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
2238 return(0); | 2559 return(0); |
2239 } | 2560 } |
2240 | 2561 |
2241 int ssl_undefined_void_function(void) | 2562 int ssl_undefined_void_function(void) |
2242 { | 2563 { |
2243 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALL
ED); | 2564 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALL
ED); |
2244 return(0); | 2565 return(0); |
2245 } | 2566 } |
2246 | 2567 |
2247 int ssl_undefined_const_function(const SSL *s) | 2568 int ssl_undefined_const_function(const SSL *s) |
2248 { | 2569 { |
2249 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CAL
LED); | 2570 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CAL
LED); |
2250 return(0); | 2571 return(0); |
2251 } | 2572 } |
2252 | 2573 |
2253 SSL_METHOD *ssl_bad_method(int ver) | 2574 SSL_METHOD *ssl_bad_method(int ver) |
2254 { | 2575 { |
2255 SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); | 2576 SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
2256 return(NULL); | 2577 return(NULL); |
2257 } | 2578 } |
2258 | 2579 |
| 2580 static const char *ssl_get_version(int version) |
| 2581 { |
| 2582 if (version == TLS1_VERSION) |
| 2583 return("TLSv1"); |
| 2584 else if (version == SSL3_VERSION) |
| 2585 return("SSLv3"); |
| 2586 else if (version == SSL2_VERSION) |
| 2587 return("SSLv2"); |
| 2588 else |
| 2589 return("unknown"); |
| 2590 } |
| 2591 |
2259 const char *SSL_get_version(const SSL *s) | 2592 const char *SSL_get_version(const SSL *s) |
2260 { | 2593 { |
2261 » if (s->version == TLS1_VERSION) | 2594 » » return ssl_get_version(s->version); |
2262 » » return("TLSv1"); | 2595 » } |
2263 » else if (s->version == SSL3_VERSION) | 2596 |
2264 » » return("SSLv3"); | 2597 const char *SSL_SESSION_get_version(const SSL_SESSION *s) |
2265 » else if (s->version == SSL2_VERSION) | 2598 » { |
2266 » » return("SSLv2"); | 2599 » » return ssl_get_version(s->ssl_version); |
2267 » else | 2600 » } |
2268 » » return("unknown"); | 2601 |
| 2602 const char* SSL_authentication_method(const SSL* ssl) |
| 2603 » { |
| 2604 » if (ssl->cert != NULL && ssl->cert->rsa_tmp != NULL) |
| 2605 » » return SSL_TXT_RSA "_" SSL_TXT_EXPORT; |
| 2606 » switch (ssl->version) |
| 2607 » » { |
| 2608 » case SSL2_VERSION: |
| 2609 » » return SSL_TXT_RSA; |
| 2610 » case SSL3_VERSION: |
| 2611 » case TLS1_VERSION: |
| 2612 » case DTLS1_VERSION: |
| 2613 » » return SSL_CIPHER_authentication_method(ssl->s3->tmp.new_cipher)
; |
| 2614 » default: |
| 2615 » » return "UNKNOWN"; |
| 2616 » » } |
2269 } | 2617 } |
2270 | 2618 |
2271 SSL *SSL_dup(SSL *s) | 2619 SSL *SSL_dup(SSL *s) |
2272 { | 2620 { |
2273 STACK_OF(X509_NAME) *sk; | 2621 STACK_OF(X509_NAME) *sk; |
2274 X509_NAME *xn; | 2622 X509_NAME *xn; |
2275 SSL *ret; | 2623 SSL *ret; |
2276 int i; | 2624 int i; |
2277 » » | 2625 » |
2278 if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL) | 2626 if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL) |
2279 return(NULL); | 2627 return(NULL); |
2280 | 2628 |
2281 ret->version = s->version; | 2629 ret->version = s->version; |
2282 ret->type = s->type; | 2630 ret->type = s->type; |
2283 ret->method = s->method; | 2631 ret->method = s->method; |
2284 | 2632 |
2285 if (s->session != NULL) | 2633 if (s->session != NULL) |
2286 { | 2634 { |
2287 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */ | 2635 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */ |
(...skipping 149 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2437 | 2785 |
2438 /* Fix this function so that it takes an optional type parameter */ | 2786 /* Fix this function so that it takes an optional type parameter */ |
2439 EVP_PKEY *SSL_get_privatekey(SSL *s) | 2787 EVP_PKEY *SSL_get_privatekey(SSL *s) |
2440 { | 2788 { |
2441 if (s->cert != NULL) | 2789 if (s->cert != NULL) |
2442 return(s->cert->key->privatekey); | 2790 return(s->cert->key->privatekey); |
2443 else | 2791 else |
2444 return(NULL); | 2792 return(NULL); |
2445 } | 2793 } |
2446 | 2794 |
2447 SSL_CIPHER *SSL_get_current_cipher(const SSL *s) | 2795 const SSL_CIPHER *SSL_get_current_cipher(const SSL *s) |
2448 { | 2796 { |
2449 if ((s->session != NULL) && (s->session->cipher != NULL)) | 2797 if ((s->session != NULL) && (s->session->cipher != NULL)) |
2450 return(s->session->cipher); | 2798 return(s->session->cipher); |
2451 return(NULL); | 2799 return(NULL); |
2452 } | 2800 } |
2453 #ifdef OPENSSL_NO_COMP | 2801 #ifdef OPENSSL_NO_COMP |
2454 const void *SSL_get_current_compression(SSL *s) | 2802 const void *SSL_get_current_compression(SSL *s) |
2455 { | 2803 { |
2456 return NULL; | 2804 return NULL; |
2457 } | 2805 } |
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2515 void ssl_free_wbio_buffer(SSL *s) | 2863 void ssl_free_wbio_buffer(SSL *s) |
2516 { | 2864 { |
2517 if (s->bbio == NULL) return; | 2865 if (s->bbio == NULL) return; |
2518 | 2866 |
2519 if (s->bbio == s->wbio) | 2867 if (s->bbio == s->wbio) |
2520 { | 2868 { |
2521 /* remove buffering */ | 2869 /* remove buffering */ |
2522 s->wbio=BIO_pop(s->wbio); | 2870 s->wbio=BIO_pop(s->wbio); |
2523 #ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more pre
processor symbol */ | 2871 #ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more pre
processor symbol */ |
2524 assert(s->wbio != NULL); | 2872 assert(s->wbio != NULL); |
2525 #endif» | 2873 #endif |
2526 } | 2874 } |
2527 BIO_free(s->bbio); | 2875 BIO_free(s->bbio); |
2528 s->bbio=NULL; | 2876 s->bbio=NULL; |
2529 } | 2877 } |
2530 | 2878 |
2531 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode) | 2879 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode) |
2532 { | 2880 { |
2533 ctx->quiet_shutdown=mode; | 2881 ctx->quiet_shutdown=mode; |
2534 } | 2882 } |
2535 | 2883 |
(...skipping 64 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2600 #endif | 2948 #endif |
2601 | 2949 |
2602 void SSL_set_info_callback(SSL *ssl, | 2950 void SSL_set_info_callback(SSL *ssl, |
2603 void (*cb)(const SSL *ssl,int type,int val)) | 2951 void (*cb)(const SSL *ssl,int type,int val)) |
2604 { | 2952 { |
2605 ssl->info_callback=cb; | 2953 ssl->info_callback=cb; |
2606 } | 2954 } |
2607 | 2955 |
2608 /* One compiler (Diab DCC) doesn't like argument names in returned | 2956 /* One compiler (Diab DCC) doesn't like argument names in returned |
2609 function pointer. */ | 2957 function pointer. */ |
2610 void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,i
nt /*val*/) | 2958 void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,i
nt /*val*/) |
2611 { | 2959 { |
2612 return ssl->info_callback; | 2960 return ssl->info_callback; |
2613 } | 2961 } |
2614 | 2962 |
2615 int SSL_state(const SSL *ssl) | 2963 int SSL_state(const SSL *ssl) |
2616 { | 2964 { |
2617 return(ssl->state); | 2965 return(ssl->state); |
2618 } | 2966 } |
2619 | 2967 |
2620 void SSL_set_verify_result(SSL *ssl,long arg) | 2968 void SSL_set_verify_result(SSL *ssl,long arg) |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2721 #endif | 3069 #endif |
2722 | 3070 |
2723 /*! | 3071 /*! |
2724 * \brief Set the callback for generating temporary DH keys. | 3072 * \brief Set the callback for generating temporary DH keys. |
2725 * \param ctx the SSL context. | 3073 * \param ctx the SSL context. |
2726 * \param dh the callback | 3074 * \param dh the callback |
2727 */ | 3075 */ |
2728 | 3076 |
2729 #ifndef OPENSSL_NO_DH | 3077 #ifndef OPENSSL_NO_DH |
2730 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export, | 3078 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export, |
2731 » » » » » » » int keylength)) | 3079 int keylength)) |
2732 { | 3080 { |
2733 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); | 3081 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); |
2734 } | 3082 } |
2735 | 3083 |
2736 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export, | 3084 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export, |
2737 » » » » » » int keylength)) | 3085 int keylength)) |
2738 { | 3086 { |
2739 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); | 3087 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); |
2740 } | 3088 } |
2741 #endif | 3089 #endif |
2742 | 3090 |
2743 #ifndef OPENSSL_NO_ECDH | 3091 #ifndef OPENSSL_NO_ECDH |
2744 void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_
export, | 3092 void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_
export, |
2745 » » » » » » » int keylength)) | 3093 int keylength)) |
2746 { | 3094 { |
2747 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh)
; | 3095 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh)
; |
2748 } | 3096 } |
2749 | 3097 |
2750 void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export, | 3098 void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export, |
2751 » » » » » » int keylength)) | 3099 int keylength)) |
2752 { | 3100 { |
2753 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh); | 3101 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh); |
2754 } | 3102 } |
2755 #endif | 3103 #endif |
2756 | 3104 |
| 3105 #ifndef OPENSSL_NO_PSK |
| 3106 int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) |
| 3107 { |
| 3108 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LE
N) |
| 3109 { |
| 3110 SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TO
O_LONG); |
| 3111 return 0; |
| 3112 } |
| 3113 if (ctx->psk_identity_hint != NULL) |
| 3114 OPENSSL_free(ctx->psk_identity_hint); |
| 3115 if (identity_hint != NULL) |
| 3116 { |
| 3117 ctx->psk_identity_hint = BUF_strdup(identity_hint); |
| 3118 if (ctx->psk_identity_hint == NULL) |
| 3119 return 0; |
| 3120 } |
| 3121 else |
| 3122 ctx->psk_identity_hint = NULL; |
| 3123 return 1; |
| 3124 } |
| 3125 |
| 3126 int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) |
| 3127 { |
| 3128 if (s == NULL) |
| 3129 return 0; |
| 3130 |
| 3131 if (s->session == NULL) |
| 3132 return 1; /* session not created yet, ignored */ |
| 3133 |
| 3134 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LE
N) |
| 3135 { |
| 3136 SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LO
NG); |
| 3137 return 0; |
| 3138 } |
| 3139 if (s->session->psk_identity_hint != NULL) |
| 3140 OPENSSL_free(s->session->psk_identity_hint); |
| 3141 if (identity_hint != NULL) |
| 3142 { |
| 3143 s->session->psk_identity_hint = BUF_strdup(identity_hint); |
| 3144 if (s->session->psk_identity_hint == NULL) |
| 3145 return 0; |
| 3146 } |
| 3147 else |
| 3148 s->session->psk_identity_hint = NULL; |
| 3149 return 1; |
| 3150 } |
| 3151 |
| 3152 const char *SSL_get_psk_identity_hint(const SSL *s) |
| 3153 { |
| 3154 if (s == NULL || s->session == NULL) |
| 3155 return NULL; |
| 3156 return(s->session->psk_identity_hint); |
| 3157 } |
| 3158 |
| 3159 const char *SSL_get_psk_identity(const SSL *s) |
| 3160 { |
| 3161 if (s == NULL || s->session == NULL) |
| 3162 return NULL; |
| 3163 return(s->session->psk_identity); |
| 3164 } |
| 3165 |
| 3166 void SSL_set_psk_client_callback(SSL *s, |
| 3167 unsigned int (*cb)(SSL *ssl, const char *hint, |
| 3168 char *identity, unsigned int max_identity_len, unsigned c
har *psk, |
| 3169 unsigned int max_psk_len)) |
| 3170 { |
| 3171 s->psk_client_callback = cb; |
| 3172 } |
| 3173 |
| 3174 void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, |
| 3175 unsigned int (*cb)(SSL *ssl, const char *hint, |
| 3176 char *identity, unsigned int max_identity_len, unsigned c
har *psk, |
| 3177 unsigned int max_psk_len)) |
| 3178 { |
| 3179 ctx->psk_client_callback = cb; |
| 3180 } |
| 3181 |
| 3182 void SSL_set_psk_server_callback(SSL *s, |
| 3183 unsigned int (*cb)(SSL *ssl, const char *identity, |
| 3184 unsigned char *psk, unsigned int max_psk_len)) |
| 3185 { |
| 3186 s->psk_server_callback = cb; |
| 3187 } |
| 3188 |
| 3189 void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, |
| 3190 unsigned int (*cb)(SSL *ssl, const char *identity, |
| 3191 unsigned char *psk, unsigned int max_psk_len)) |
| 3192 { |
| 3193 ctx->psk_server_callback = cb; |
| 3194 } |
| 3195 #endif |
2757 | 3196 |
2758 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version,
int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) | 3197 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version,
int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) |
2759 { | 3198 { |
2760 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb
); | 3199 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb
); |
2761 } | 3200 } |
2762 void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int con
tent_type, const void *buf, size_t len, SSL *ssl, void *arg)) | 3201 void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int con
tent_type, const void *buf, size_t len, SSL *ssl, void *arg)) |
2763 { | 3202 { |
2764 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); | 3203 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); |
2765 } | 3204 } |
2766 | 3205 |
2767 #ifndef OPENSSL_NO_TLSEXT | |
2768 /* SSL_select_next_proto implements the standard protocol selection. It is | |
2769 * expected that this function is called from the callback set by | |
2770 * SSL_CTX_set_next_proto_select_cb. | |
2771 * | |
2772 * The protocol data is assumed to be a vector of 8-bit, length prefixed byte | |
2773 * strings. The length byte itself is not included in the length. A byte | |
2774 * string of length 0 is invalid. No byte string may be truncated. | |
2775 * | |
2776 * The current, but experimental algorithm for selecting the protocol is: | |
2777 * | |
2778 * 1) If the server doesn't support NPN then this is indicated to the | |
2779 * callback. In this case, the client application has to abort the connection | |
2780 * or have a default application level protocol. | |
2781 * | |
2782 * 2) If the server supports NPN, but advertises an empty list then the | |
2783 * client selects the first protcol in its list, but indicates via the | |
2784 * API that this fallback case was enacted. | |
2785 * | |
2786 * 3) Otherwise, the client finds the first protocol in the server's list | |
2787 * that it supports and selects this protocol. This is because it's | |
2788 * assumed that the server has better information about which protocol | |
2789 * a client should use. | |
2790 * | |
2791 * 4) If the client doesn't support any of the server's advertised | |
2792 * protocols, then this is treated the same as case 2. | |
2793 * | |
2794 * It returns either | |
2795 * OPENSSL_NPN_NEGOTIATED if a common protocol was found, or | |
2796 * OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. | |
2797 */ | |
2798 int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsi
gned char *server, unsigned int server_len, const unsigned char *client, unsigne
d int client_len) | |
2799 { | |
2800 unsigned int i, j; | |
2801 const unsigned char *result; | |
2802 int status = OPENSSL_NPN_UNSUPPORTED; | |
2803 | |
2804 /* For each protocol in server preference order, see if we support it. *
/ | |
2805 for (i = 0; i < server_len; ) | |
2806 { | |
2807 for (j = 0; j < client_len; ) | |
2808 { | |
2809 if (server[i] == client[j] && | |
2810 memcmp(&server[i+1], &client[j+1], server[i]) == 0) | |
2811 { | |
2812 /* We found a match */ | |
2813 result = &server[i]; | |
2814 status = OPENSSL_NPN_NEGOTIATED; | |
2815 goto found; | |
2816 } | |
2817 j += client[j]; | |
2818 j++; | |
2819 } | |
2820 i += server[i]; | |
2821 i++; | |
2822 } | |
2823 | |
2824 /* There's no overlap between our protocols and the server's list. */ | |
2825 result = client; | |
2826 status = OPENSSL_NPN_NO_OVERLAP; | |
2827 | |
2828 found: | |
2829 *out = (unsigned char *) result + 1; | |
2830 *outlen = result[0]; | |
2831 return status; | |
2832 } | |
2833 | |
2834 /* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's | |
2835 * requested protocol for this connection and returns 0. If the client didn't | |
2836 * request any protocol, then *data is set to NULL. | |
2837 * | |
2838 * Note that the client can request any protocol it chooses. The value returned | |
2839 * from this function need not be a member of the list of supported protocols | |
2840 * provided by the callback. | |
2841 */ | |
2842 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, un
signed *len) | |
2843 { | |
2844 *data = s->next_proto_negotiated; | |
2845 if (!*data) { | |
2846 *len = 0; | |
2847 } else { | |
2848 *len = s->next_proto_negotiated_len; | |
2849 } | |
2850 } | |
2851 | |
2852 /* SSL_CTX_set_next_protos_advertised_cb sets a callback that is called when a | |
2853 * TLS server needs a list of supported protocols for Next Protocol | |
2854 * Negotiation. The returned list must be in wire format. The list is returned | |
2855 * by setting |out| to point to it and |outlen| to its length. This memory will | |
2856 * not be modified, but one should assume that the SSL* keeps a reference to | |
2857 * it. | |
2858 * | |
2859 * The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise. Other
wise, no | |
2860 * such extension will be included in the ServerHello. */ | |
2861 void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, co
nst unsigned char **out, unsigned int *outlen, void *arg), void *arg) | |
2862 { | |
2863 ctx->next_protos_advertised_cb = cb; | |
2864 ctx->next_protos_advertised_cb_arg = arg; | |
2865 } | |
2866 | |
2867 /* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a | |
2868 * client needs to select a protocol from the server's provided list. |out| | |
2869 * must be set to point to the selected protocol (which may be within |in|). | |
2870 * The length of the protocol name must be written into |outlen|. The server's | |
2871 * advertised protocols are provided in |in| and |inlen|. The callback can | |
2872 * assume that |in| is syntactically valid. | |
2873 * | |
2874 * The client must select a protocol. It is fatal to the connection if this | |
2875 * callback returns a value other than SSL_TLSEXT_ERR_OK. | |
2876 */ | |
2877 void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned
char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen,
void *arg), void *arg) | |
2878 { | |
2879 ctx->next_proto_select_cb = cb; | |
2880 ctx->next_proto_select_cb_arg = arg; | |
2881 } | |
2882 | |
2883 /* SSL_CTX_set_snap_start_orbit sets the orbit value which will be echoed back | |
2884 * to the client and enables Snap Start for this context. | |
2885 * | |
2886 * An orbit value can be used to spatially partition the state needed to support | |
2887 * Snap Start. See the comments above SSL_set_suggested_server_random_validity | |
2888 * (below). */ | |
2889 void SSL_CTX_set_snap_start_orbit(SSL_CTX *ctx, const unsigned char orbit[8]) | |
2890 { | |
2891 memcpy(ctx->snap_start_orbit, orbit, sizeof(ctx->snap_start_orbit)); | |
2892 ctx->snap_start_orbit_valid = 1; | |
2893 } | |
2894 | |
2895 /* Once SSL_accept has returned with SSL_SERVER_RANDOM_VALIDATE, then one can | |
2896 * call this function in order to get the client's suggested server random | |
2897 * value. */ | |
2898 void SSL_get0_suggested_server_random(const SSL* s, const unsigned char **data,
unsigned *length) | |
2899 { | |
2900 if (!s->s3->snap_start_requested) | |
2901 { | |
2902 *data = NULL; | |
2903 *length = 0; | |
2904 return; | |
2905 } | |
2906 *length = 32; | |
2907 *data = s->s3->server_random; | |
2908 } | |
2909 | |
2910 /* SSL_set_suggested_server_random_validity passes judgement on a | |
2911 * client-suggested random value (obtained from | |
2912 * SSL_get0_suggested_server_random). Rejecting the value triggers a recovery, | |
2913 * while accepting the value /may/ result in a successful Snap Start, as long | |
2914 * as the client predicted the handshake correctly. | |
2915 * | |
2916 * In order to accept a random value the user must ensure that it has NEVER | |
2917 * been used before by this server, or any server configured with any of the | |
2918 * same certificates. It may reject more if necessary. | |
2919 * | |
2920 * The first four bytes of the random value contain a timestamp (UNIX seconds | |
2921 * since the epoch) which can be used to manage a time window. Additionally, | |
2922 * the following eight bytes contain the orbit which which can also bound the | |
2923 * state required if geographically separate servers share certificates. | |
2924 * | |
2925 * It's recommended that the time window have a maximum size, independent of | |
2926 * the resources available, in order to prevent an attacker from arbitrarily | |
2927 * delaying a Snap Start handshake. | |
2928 */ | |
2929 void SSL_set_suggested_server_random_validity(SSL *s, char is_valid) | |
2930 { | |
2931 if (is_valid) | |
2932 s->s3->server_random_suggestion_valid = 1; | |
2933 else | |
2934 ssl3_snap_start_reset_for_recovery(s); | |
2935 } | |
2936 | |
2937 #endif | |
2938 | |
2939 int SSL_cutthrough_complete(const SSL *s) | 3206 int SSL_cutthrough_complete(const SSL *s) |
2940 { | 3207 { |
2941 return (!s->server && /* cutthrough only applies to clie
nts */ | 3208 return (!s->server && /* cutthrough only applies to clie
nts */ |
2942 !s->hit && /* full-handshake */ | 3209 !s->hit && /* full-handshake */ |
2943 s->version >= SSL3_VERSION && | 3210 s->version >= SSL3_VERSION && |
2944 s->s3->in_read_app_data == 0 && /* cutthrough only applies to
write() */ | 3211 s->s3->in_read_app_data == 0 && /* cutthrough only applies to
write() */ |
2945 (SSL_get_mode((SSL*)s) & SSL_MODE_HANDSHAKE_CUTTHROUGH) && /* c
utthrough enabled */ | 3212 (SSL_get_mode((SSL*)s) & SSL_MODE_HANDSHAKE_CUTTHROUGH) && /* c
utthrough enabled */ |
2946 SSL_get_cipher_bits(s, NULL) >= 128 && /* s
trong cipher choosen */ | 3213 SSL_get_cipher_bits(s, NULL) >= 128 && /* s
trong cipher choosen */ |
2947 s->s3->previous_server_finished_len == 0 && /* n
ot a renegotiation handshake */ | 3214 s->s3->previous_server_finished_len == 0 && /* n
ot a renegotiation handshake */ |
2948 (s->state == SSL3_ST_CR_SESSION_TICKET_A || /* r
eady to write app-data*/ | 3215 (s->state == SSL3_ST_CR_SESSION_TICKET_A || /* r
eady to write app-data*/ |
2949 s->state == SSL3_ST_CR_FINISHED_A)); | 3216 s->state == SSL3_ST_CR_FINISHED_A)); |
2950 } | 3217 } |
2951 | 3218 |
| 3219 /* Allocates new EVP_MD_CTX and sets pointer to it into given pointer |
| 3220 * vairable, freeing EVP_MD_CTX previously stored in that variable, if |
| 3221 * any. If EVP_MD pointer is passed, initializes ctx with this md |
| 3222 * Returns newly allocated ctx; |
| 3223 */ |
| 3224 |
| 3225 EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) |
| 3226 { |
| 3227 ssl_clear_hash_ctx(hash); |
| 3228 *hash = EVP_MD_CTX_create(); |
| 3229 if (md) EVP_DigestInit_ex(*hash,md,NULL); |
| 3230 return *hash; |
| 3231 } |
| 3232 void ssl_clear_hash_ctx(EVP_MD_CTX **hash) |
| 3233 { |
| 3234 |
| 3235 if (*hash) EVP_MD_CTX_destroy(*hash); |
| 3236 *hash=NULL; |
| 3237 } |
| 3238 |
2952 #if defined(_WINDLL) && defined(OPENSSL_SYS_WIN16) | 3239 #if defined(_WINDLL) && defined(OPENSSL_SYS_WIN16) |
2953 #include "../crypto/bio/bss_file.c" | 3240 #include "../crypto/bio/bss_file.c" |
2954 #endif | 3241 #endif |
2955 | 3242 |
2956 IMPLEMENT_STACK_OF(SSL_CIPHER) | 3243 IMPLEMENT_STACK_OF(SSL_CIPHER) |
2957 IMPLEMENT_STACK_OF(SSL_COMP) | 3244 IMPLEMENT_STACK_OF(SSL_COMP) |
| 3245 IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, |
| 3246 ssl_cipher_id); |
| 3247 |
OLD | NEW |