1 |
|
|
/* $OpenBSD: ssl_both.c,v 1.11 2017/10/08 16:24:02 jsing Exp $ */ |
2 |
|
|
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
3 |
|
|
* All rights reserved. |
4 |
|
|
* |
5 |
|
|
* This package is an SSL implementation written |
6 |
|
|
* by Eric Young (eay@cryptsoft.com). |
7 |
|
|
* The implementation was written so as to conform with Netscapes SSL. |
8 |
|
|
* |
9 |
|
|
* This library is free for commercial and non-commercial use as long as |
10 |
|
|
* the following conditions are aheared to. The following conditions |
11 |
|
|
* apply to all code found in this distribution, be it the RC4, RSA, |
12 |
|
|
* lhash, DES, etc., code; not just the SSL code. The SSL documentation |
13 |
|
|
* included with this distribution is covered by the same copyright terms |
14 |
|
|
* except that the holder is Tim Hudson (tjh@cryptsoft.com). |
15 |
|
|
* |
16 |
|
|
* Copyright remains Eric Young's, and as such any Copyright notices in |
17 |
|
|
* the code are not to be removed. |
18 |
|
|
* If this package is used in a product, Eric Young should be given attribution |
19 |
|
|
* as the author of the parts of the library used. |
20 |
|
|
* This can be in the form of a textual message at program startup or |
21 |
|
|
* in documentation (online or textual) provided with the package. |
22 |
|
|
* |
23 |
|
|
* Redistribution and use in source and binary forms, with or without |
24 |
|
|
* modification, are permitted provided that the following conditions |
25 |
|
|
* are met: |
26 |
|
|
* 1. Redistributions of source code must retain the copyright |
27 |
|
|
* notice, this list of conditions and the following disclaimer. |
28 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
29 |
|
|
* notice, this list of conditions and the following disclaimer in the |
30 |
|
|
* documentation and/or other materials provided with the distribution. |
31 |
|
|
* 3. All advertising materials mentioning features or use of this software |
32 |
|
|
* must display the following acknowledgement: |
33 |
|
|
* "This product includes cryptographic software written by |
34 |
|
|
* Eric Young (eay@cryptsoft.com)" |
35 |
|
|
* The word 'cryptographic' can be left out if the rouines from the library |
36 |
|
|
* being used are not cryptographic related :-). |
37 |
|
|
* 4. If you include any Windows specific code (or a derivative thereof) from |
38 |
|
|
* the apps directory (application code) you must include an acknowledgement: |
39 |
|
|
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
40 |
|
|
* |
41 |
|
|
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
42 |
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
43 |
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
44 |
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
45 |
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
46 |
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
47 |
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
48 |
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
49 |
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
50 |
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
51 |
|
|
* SUCH DAMAGE. |
52 |
|
|
* |
53 |
|
|
* The licence and distribution terms for any publically available version or |
54 |
|
|
* derivative of this code cannot be changed. i.e. this code cannot simply be |
55 |
|
|
* copied and put under another distribution licence |
56 |
|
|
* [including the GNU Public Licence.] |
57 |
|
|
*/ |
58 |
|
|
/* ==================================================================== |
59 |
|
|
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. |
60 |
|
|
* |
61 |
|
|
* Redistribution and use in source and binary forms, with or without |
62 |
|
|
* modification, are permitted provided that the following conditions |
63 |
|
|
* are met: |
64 |
|
|
* |
65 |
|
|
* 1. Redistributions of source code must retain the above copyright |
66 |
|
|
* notice, this list of conditions and the following disclaimer. |
67 |
|
|
* |
68 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
69 |
|
|
* notice, this list of conditions and the following disclaimer in |
70 |
|
|
* the documentation and/or other materials provided with the |
71 |
|
|
* distribution. |
72 |
|
|
* |
73 |
|
|
* 3. All advertising materials mentioning features or use of this |
74 |
|
|
* software must display the following acknowledgment: |
75 |
|
|
* "This product includes software developed by the OpenSSL Project |
76 |
|
|
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
77 |
|
|
* |
78 |
|
|
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
79 |
|
|
* endorse or promote products derived from this software without |
80 |
|
|
* prior written permission. For written permission, please contact |
81 |
|
|
* openssl-core@openssl.org. |
82 |
|
|
* |
83 |
|
|
* 5. Products derived from this software may not be called "OpenSSL" |
84 |
|
|
* nor may "OpenSSL" appear in their names without prior written |
85 |
|
|
* permission of the OpenSSL Project. |
86 |
|
|
* |
87 |
|
|
* 6. Redistributions of any form whatsoever must retain the following |
88 |
|
|
* acknowledgment: |
89 |
|
|
* "This product includes software developed by the OpenSSL Project |
90 |
|
|
* for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
91 |
|
|
* |
92 |
|
|
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
93 |
|
|
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
94 |
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
95 |
|
|
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
96 |
|
|
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
97 |
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
98 |
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
99 |
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
100 |
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
101 |
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
102 |
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
103 |
|
|
* OF THE POSSIBILITY OF SUCH DAMAGE. |
104 |
|
|
* ==================================================================== |
105 |
|
|
* |
106 |
|
|
* This product includes cryptographic software written by Eric Young |
107 |
|
|
* (eay@cryptsoft.com). This product includes software written by Tim |
108 |
|
|
* Hudson (tjh@cryptsoft.com). |
109 |
|
|
* |
110 |
|
|
*/ |
111 |
|
|
/* ==================================================================== |
112 |
|
|
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. |
113 |
|
|
* ECC cipher suite support in OpenSSL originally developed by |
114 |
|
|
* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. |
115 |
|
|
*/ |
116 |
|
|
|
117 |
|
|
#include <limits.h> |
118 |
|
|
#include <stdio.h> |
119 |
|
|
#include <string.h> |
120 |
|
|
|
121 |
|
|
#include "ssl_locl.h" |
122 |
|
|
|
123 |
|
|
#include <openssl/buffer.h> |
124 |
|
|
#include <openssl/evp.h> |
125 |
|
|
#include <openssl/objects.h> |
126 |
|
|
#include <openssl/x509.h> |
127 |
|
|
|
128 |
|
|
#include "bytestring.h" |
129 |
|
|
|
130 |
|
|
/* |
131 |
|
|
* Send s->internal->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or |
132 |
|
|
* SSL3_RT_CHANGE_CIPHER_SPEC). |
133 |
|
|
*/ |
134 |
|
|
int |
135 |
|
|
ssl3_do_write(SSL *s, int type) |
136 |
|
|
{ |
137 |
|
|
int ret; |
138 |
|
|
|
139 |
|
149691 |
ret = ssl3_write_bytes(s, type, &s->internal->init_buf->data[s->internal->init_off], |
140 |
|
49897 |
s->internal->init_num); |
141 |
✗✓ |
49897 |
if (ret < 0) |
142 |
|
|
return (-1); |
143 |
|
|
|
144 |
✓✓ |
49897 |
if (type == SSL3_RT_HANDSHAKE) |
145 |
|
|
/* |
146 |
|
|
* Should not be done for 'Hello Request's, but in that case |
147 |
|
|
* we'll ignore the result anyway. |
148 |
|
|
*/ |
149 |
|
33906 |
tls1_finish_mac(s, |
150 |
|
33906 |
(unsigned char *)&s->internal->init_buf->data[s->internal->init_off], ret); |
151 |
|
|
|
152 |
✓✗ |
49897 |
if (ret == s->internal->init_num) { |
153 |
✗✓ |
49897 |
if (s->internal->msg_callback) |
154 |
|
|
s->internal->msg_callback(1, s->version, type, s->internal->init_buf->data, |
155 |
|
|
(size_t)(s->internal->init_off + s->internal->init_num), s, |
156 |
|
|
s->internal->msg_callback_arg); |
157 |
|
49897 |
return (1); |
158 |
|
|
} |
159 |
|
|
|
160 |
|
|
s->internal->init_off += ret; |
161 |
|
|
s->internal->init_num -= ret; |
162 |
|
|
|
163 |
|
|
return (0); |
164 |
|
49897 |
} |
165 |
|
|
|
166 |
|
|
int |
167 |
|
|
ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen) |
168 |
|
|
{ |
169 |
|
32126 |
CBB cbb, finished; |
170 |
|
|
int md_len; |
171 |
|
|
|
172 |
|
16063 |
memset(&cbb, 0, sizeof(cbb)); |
173 |
|
|
|
174 |
✓✗ |
16063 |
if (S3I(s)->hs.state == a) { |
175 |
|
|
md_len = TLS1_FINISH_MAC_LENGTH; |
176 |
✗✓ |
16063 |
OPENSSL_assert(md_len <= EVP_MAX_MD_SIZE); |
177 |
|
|
|
178 |
✗✓ |
32126 |
if (tls1_final_finish_mac(s, sender, slen, |
179 |
|
32126 |
S3I(s)->tmp.finish_md) != md_len) |
180 |
|
|
return (0); |
181 |
|
16063 |
S3I(s)->tmp.finish_md_len = md_len; |
182 |
|
|
|
183 |
|
|
/* Copy finished so we can use it for renegotiation checks. */ |
184 |
✓✓ |
16063 |
if (s->internal->type == SSL_ST_CONNECT) { |
185 |
|
31742 |
memcpy(S3I(s)->previous_client_finished, |
186 |
|
15871 |
S3I(s)->tmp.finish_md, md_len); |
187 |
|
15871 |
S3I(s)->previous_client_finished_len = md_len; |
188 |
|
15871 |
} else { |
189 |
|
384 |
memcpy(S3I(s)->previous_server_finished, |
190 |
|
192 |
S3I(s)->tmp.finish_md, md_len); |
191 |
|
192 |
S3I(s)->previous_server_finished_len = md_len; |
192 |
|
|
} |
193 |
|
|
|
194 |
✓✗ |
16063 |
if (!ssl3_handshake_msg_start_cbb(s, &cbb, &finished, |
195 |
|
|
SSL3_MT_FINISHED)) |
196 |
|
|
goto err; |
197 |
✓✗ |
16063 |
if (!CBB_add_bytes(&finished, S3I(s)->tmp.finish_md, md_len)) |
198 |
|
|
goto err; |
199 |
✓✗ |
16063 |
if (!ssl3_handshake_msg_finish_cbb(s, &cbb)) |
200 |
|
|
goto err; |
201 |
|
|
|
202 |
|
16063 |
S3I(s)->hs.state = b; |
203 |
|
16063 |
} |
204 |
|
|
|
205 |
|
16063 |
return (ssl3_handshake_write(s)); |
206 |
|
|
|
207 |
|
|
err: |
208 |
|
|
CBB_cleanup(&cbb); |
209 |
|
|
|
210 |
|
|
return (-1); |
211 |
|
16063 |
} |
212 |
|
|
|
213 |
|
|
/* |
214 |
|
|
* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen |
215 |
|
|
* so far. |
216 |
|
|
*/ |
217 |
|
|
static void |
218 |
|
|
ssl3_take_mac(SSL *s) |
219 |
|
|
{ |
220 |
|
|
const char *sender; |
221 |
|
|
int slen; |
222 |
|
|
|
223 |
|
|
/* |
224 |
|
|
* If no new cipher setup return immediately: other functions will |
225 |
|
|
* set the appropriate error. |
226 |
|
|
*/ |
227 |
✗✓ |
31982 |
if (S3I(s)->hs.new_cipher == NULL) |
228 |
|
|
return; |
229 |
|
|
|
230 |
✓✓ |
15991 |
if (S3I(s)->hs.state & SSL_ST_CONNECT) { |
231 |
|
|
sender = TLS_MD_SERVER_FINISH_CONST; |
232 |
|
|
slen = TLS_MD_SERVER_FINISH_CONST_SIZE; |
233 |
|
15835 |
} else { |
234 |
|
|
sender = TLS_MD_CLIENT_FINISH_CONST; |
235 |
|
|
slen = TLS_MD_CLIENT_FINISH_CONST_SIZE; |
236 |
|
|
} |
237 |
|
|
|
238 |
|
15991 |
S3I(s)->tmp.peer_finish_md_len = |
239 |
|
15991 |
tls1_final_finish_mac(s, sender, slen, |
240 |
|
15991 |
S3I(s)->tmp.peer_finish_md); |
241 |
|
31982 |
} |
242 |
|
|
|
243 |
|
|
int |
244 |
|
|
ssl3_get_finished(SSL *s, int a, int b) |
245 |
|
|
{ |
246 |
|
32402 |
int al, ok, md_len; |
247 |
|
|
long n; |
248 |
|
16201 |
CBS cbs; |
249 |
|
|
|
250 |
|
|
/* should actually be 36+4 :-) */ |
251 |
|
16201 |
n = s->method->internal->ssl_get_message(s, a, b, SSL3_MT_FINISHED, 64, &ok); |
252 |
✓✓ |
16201 |
if (!ok) |
253 |
|
138 |
return ((int)n); |
254 |
|
|
|
255 |
|
|
/* If this occurs, we have missed a message */ |
256 |
✗✓ |
16063 |
if (!S3I(s)->change_cipher_spec) { |
257 |
|
|
al = SSL_AD_UNEXPECTED_MESSAGE; |
258 |
|
|
SSLerror(s, SSL_R_GOT_A_FIN_BEFORE_A_CCS); |
259 |
|
|
goto f_err; |
260 |
|
|
} |
261 |
|
16063 |
S3I(s)->change_cipher_spec = 0; |
262 |
|
|
|
263 |
|
|
md_len = TLS1_FINISH_MAC_LENGTH; |
264 |
|
|
|
265 |
✗✓ |
16063 |
if (n < 0) { |
266 |
|
|
al = SSL_AD_DECODE_ERROR; |
267 |
|
|
SSLerror(s, SSL_R_BAD_DIGEST_LENGTH); |
268 |
|
|
goto f_err; |
269 |
|
|
} |
270 |
|
|
|
271 |
|
16063 |
CBS_init(&cbs, s->internal->init_msg, n); |
272 |
|
|
|
273 |
✓✗✗✓
|
32126 |
if (S3I(s)->tmp.peer_finish_md_len != md_len || |
274 |
|
16063 |
CBS_len(&cbs) != md_len) { |
275 |
|
|
al = SSL_AD_DECODE_ERROR; |
276 |
|
|
SSLerror(s, SSL_R_BAD_DIGEST_LENGTH); |
277 |
|
|
goto f_err; |
278 |
|
|
} |
279 |
|
|
|
280 |
✗✓ |
16063 |
if (!CBS_mem_equal(&cbs, S3I(s)->tmp.peer_finish_md, CBS_len(&cbs))) { |
281 |
|
|
al = SSL_AD_DECRYPT_ERROR; |
282 |
|
|
SSLerror(s, SSL_R_DIGEST_CHECK_FAILED); |
283 |
|
|
goto f_err; |
284 |
|
|
} |
285 |
|
|
|
286 |
|
|
/* Copy finished so we can use it for renegotiation checks. */ |
287 |
✗✓ |
16063 |
OPENSSL_assert(md_len <= EVP_MAX_MD_SIZE); |
288 |
✓✓ |
16063 |
if (s->internal->type == SSL_ST_ACCEPT) { |
289 |
|
384 |
memcpy(S3I(s)->previous_client_finished, |
290 |
|
192 |
S3I(s)->tmp.peer_finish_md, md_len); |
291 |
|
192 |
S3I(s)->previous_client_finished_len = md_len; |
292 |
|
192 |
} else { |
293 |
|
31742 |
memcpy(S3I(s)->previous_server_finished, |
294 |
|
15871 |
S3I(s)->tmp.peer_finish_md, md_len); |
295 |
|
15871 |
S3I(s)->previous_server_finished_len = md_len; |
296 |
|
|
} |
297 |
|
|
|
298 |
|
16063 |
return (1); |
299 |
|
|
f_err: |
300 |
|
|
ssl3_send_alert(s, SSL3_AL_FATAL, al); |
301 |
|
|
return (0); |
302 |
|
16201 |
} |
303 |
|
|
|
304 |
|
|
/* for these 2 messages, we need to |
305 |
|
|
* ssl->enc_read_ctx re-init |
306 |
|
|
* ssl->s3->internal->read_sequence zero |
307 |
|
|
* ssl->s3->internal->read_mac_secret re-init |
308 |
|
|
* ssl->session->read_sym_enc assign |
309 |
|
|
* ssl->session->read_hash assign |
310 |
|
|
*/ |
311 |
|
|
int |
312 |
|
|
ssl3_send_change_cipher_spec(SSL *s, int a, int b) |
313 |
|
|
{ |
314 |
|
32126 |
size_t outlen; |
315 |
|
16063 |
CBB cbb; |
316 |
|
|
|
317 |
|
16063 |
memset(&cbb, 0, sizeof(cbb)); |
318 |
|
|
|
319 |
✓✗ |
16063 |
if (S3I(s)->hs.state == a) { |
320 |
✓✗ |
32126 |
if (!CBB_init_fixed(&cbb, s->internal->init_buf->data, |
321 |
|
16063 |
s->internal->init_buf->length)) |
322 |
|
|
goto err; |
323 |
✓✗ |
16063 |
if (!CBB_add_u8(&cbb, SSL3_MT_CCS)) |
324 |
|
|
goto err; |
325 |
✓✗ |
32126 |
if (!CBB_finish(&cbb, NULL, &outlen)) |
326 |
|
|
goto err; |
327 |
|
|
|
328 |
|
16063 |
if (outlen > INT_MAX) |
329 |
|
|
goto err; |
330 |
|
|
|
331 |
|
16063 |
s->internal->init_num = (int)outlen; |
332 |
|
16063 |
s->internal->init_off = 0; |
333 |
|
|
|
334 |
✓✓ |
16063 |
if (SSL_IS_DTLS(s)) { |
335 |
|
72 |
D1I(s)->handshake_write_seq = |
336 |
|
72 |
D1I(s)->next_handshake_write_seq; |
337 |
|
72 |
dtls1_set_message_header_int(s, SSL3_MT_CCS, 0, |
338 |
|
72 |
D1I(s)->handshake_write_seq, 0, 0); |
339 |
|
72 |
dtls1_buffer_message(s, 1); |
340 |
|
72 |
} |
341 |
|
|
|
342 |
|
16063 |
S3I(s)->hs.state = b; |
343 |
|
16063 |
} |
344 |
|
|
|
345 |
|
|
/* SSL3_ST_CW_CHANGE_B */ |
346 |
|
16063 |
return ssl3_record_write(s, SSL3_RT_CHANGE_CIPHER_SPEC); |
347 |
|
|
|
348 |
|
|
err: |
349 |
|
|
CBB_cleanup(&cbb); |
350 |
|
|
|
351 |
|
|
return -1; |
352 |
|
16063 |
} |
353 |
|
|
|
354 |
|
|
static int |
355 |
|
|
ssl3_add_cert(CBB *cbb, X509 *x) |
356 |
|
|
{ |
357 |
|
582 |
unsigned char *data; |
358 |
|
|
int cert_len; |
359 |
|
|
int ret = 0; |
360 |
|
291 |
CBB cert; |
361 |
|
|
|
362 |
✓✗ |
291 |
if ((cert_len = i2d_X509(x, NULL)) < 0) |
363 |
|
|
goto err; |
364 |
|
|
|
365 |
✓✗ |
291 |
if (!CBB_add_u24_length_prefixed(cbb, &cert)) |
366 |
|
|
goto err; |
367 |
✓✗ |
291 |
if (!CBB_add_space(&cert, &data, cert_len)) |
368 |
|
|
goto err; |
369 |
✓✗ |
291 |
if (i2d_X509(x, &data) < 0) |
370 |
|
|
goto err; |
371 |
✓✗ |
291 |
if (!CBB_flush(cbb)) |
372 |
|
|
goto err; |
373 |
|
|
|
374 |
|
291 |
ret = 1; |
375 |
|
|
|
376 |
|
|
err: |
377 |
|
291 |
return (ret); |
378 |
|
291 |
} |
379 |
|
|
|
380 |
|
|
int |
381 |
|
|
ssl3_output_cert_chain(SSL *s, CBB *cbb, X509 *x) |
382 |
|
|
{ |
383 |
|
|
int no_chain = 0; |
384 |
|
378 |
CBB cert_list; |
385 |
|
|
int ret = 0; |
386 |
|
|
int i; |
387 |
|
|
|
388 |
✓✗ |
189 |
if (!CBB_add_u24_length_prefixed(cbb, &cert_list)) |
389 |
|
|
goto err; |
390 |
|
|
|
391 |
✓✗✗✓
|
378 |
if ((s->internal->mode & SSL_MODE_NO_AUTO_CHAIN) || s->ctx->extra_certs) |
392 |
|
|
no_chain = 1; |
393 |
|
|
|
394 |
|
|
/* TLSv1 sends a chain with nothing in it, instead of an alert. */ |
395 |
✓✗ |
189 |
if (x != NULL) { |
396 |
✗✓ |
189 |
if (no_chain) { |
397 |
|
|
if (!ssl3_add_cert(&cert_list, x)) |
398 |
|
|
goto err; |
399 |
|
|
} else { |
400 |
|
189 |
X509_STORE_CTX xs_ctx; |
401 |
|
|
|
402 |
✗✓ |
189 |
if (!X509_STORE_CTX_init(&xs_ctx, s->ctx->cert_store, |
403 |
|
|
x, NULL)) { |
404 |
|
|
SSLerror(s, ERR_R_X509_LIB); |
405 |
|
|
goto err; |
406 |
|
|
} |
407 |
|
189 |
X509_verify_cert(&xs_ctx); |
408 |
|
|
|
409 |
|
|
/* Don't leave errors in the queue. */ |
410 |
|
189 |
ERR_clear_error(); |
411 |
✓✓ |
960 |
for (i = 0; i < sk_X509_num(xs_ctx.chain); i++) { |
412 |
|
291 |
x = sk_X509_value(xs_ctx.chain, i); |
413 |
✗✓ |
291 |
if (!ssl3_add_cert(&cert_list, x)) { |
414 |
|
|
X509_STORE_CTX_cleanup(&xs_ctx); |
415 |
|
|
goto err; |
416 |
|
|
} |
417 |
|
|
} |
418 |
|
189 |
X509_STORE_CTX_cleanup(&xs_ctx); |
419 |
✓✓✓ |
756 |
} |
420 |
|
|
} |
421 |
|
|
|
422 |
|
|
/* Thawte special :-) */ |
423 |
✗✓ |
378 |
for (i = 0; i < sk_X509_num(s->ctx->extra_certs); i++) { |
424 |
|
|
x = sk_X509_value(s->ctx->extra_certs, i); |
425 |
|
|
if (!ssl3_add_cert(&cert_list, x)) |
426 |
|
|
goto err; |
427 |
|
|
} |
428 |
|
|
|
429 |
✓✗ |
189 |
if (!CBB_flush(cbb)) |
430 |
|
|
goto err; |
431 |
|
|
|
432 |
|
189 |
ret = 1; |
433 |
|
|
|
434 |
|
|
err: |
435 |
|
189 |
return (ret); |
436 |
|
189 |
} |
437 |
|
|
|
438 |
|
|
/* |
439 |
|
|
* Obtain handshake message of message type 'mt' (any if mt == -1), |
440 |
|
|
* maximum acceptable body length 'max'. |
441 |
|
|
* The first four bytes (msg_type and length) are read in state 'st1', |
442 |
|
|
* the body is read in state 'stn'. |
443 |
|
|
*/ |
444 |
|
|
long |
445 |
|
|
ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) |
446 |
|
|
{ |
447 |
|
|
unsigned char *p; |
448 |
|
118520 |
uint32_t l; |
449 |
|
|
long n; |
450 |
|
|
int i, al; |
451 |
|
59260 |
CBS cbs; |
452 |
|
59260 |
uint8_t u8; |
453 |
|
|
|
454 |
✓✓ |
59260 |
if (S3I(s)->tmp.reuse_message) { |
455 |
|
15982 |
S3I(s)->tmp.reuse_message = 0; |
456 |
✓✓✗✓
|
31943 |
if ((mt >= 0) && (S3I(s)->tmp.message_type != mt)) { |
457 |
|
|
al = SSL_AD_UNEXPECTED_MESSAGE; |
458 |
|
|
SSLerror(s, SSL_R_UNEXPECTED_MESSAGE); |
459 |
|
|
goto f_err; |
460 |
|
|
} |
461 |
|
15982 |
*ok = 1; |
462 |
|
15982 |
s->internal->init_msg = s->internal->init_buf->data + 4; |
463 |
|
15982 |
s->internal->init_num = (int)S3I(s)->tmp.message_size; |
464 |
|
15982 |
return s->internal->init_num; |
465 |
|
|
} |
466 |
|
|
|
467 |
|
43278 |
p = (unsigned char *)s->internal->init_buf->data; |
468 |
|
|
|
469 |
|
|
/* s->internal->init_num < 4 */ |
470 |
✓✗ |
43278 |
if (S3I(s)->hs.state == st1) { |
471 |
|
|
int skip_message; |
472 |
|
|
|
473 |
|
43278 |
do { |
474 |
✓✓ |
160920 |
while (s->internal->init_num < 4) { |
475 |
|
86556 |
i = s->method->internal->ssl_read_bytes(s, |
476 |
|
43278 |
SSL3_RT_HANDSHAKE, &p[s->internal->init_num], |
477 |
|
43278 |
4 - s->internal->init_num, 0); |
478 |
✓✓ |
43278 |
if (i <= 0) { |
479 |
|
6096 |
s->internal->rwstate = SSL_READING; |
480 |
|
6096 |
*ok = 0; |
481 |
|
6096 |
return i; |
482 |
|
|
} |
483 |
|
37182 |
s->internal->init_num += i; |
484 |
|
|
} |
485 |
|
|
|
486 |
|
|
skip_message = 0; |
487 |
✓✓✗✓
|
73860 |
if (!s->server && p[0] == SSL3_MT_HELLO_REQUEST) { |
488 |
|
|
/* |
489 |
|
|
* The server may always send 'Hello Request' |
490 |
|
|
* messages -- we are doing a handshake anyway |
491 |
|
|
* now, so ignore them if their format is |
492 |
|
|
* correct. Does not count for 'Finished' MAC. |
493 |
|
|
*/ |
494 |
|
|
if (p[1] == 0 && p[2] == 0 &&p[3] == 0) { |
495 |
|
|
s->internal->init_num = 0; |
496 |
|
|
skip_message = 1; |
497 |
|
|
|
498 |
|
|
if (s->internal->msg_callback) |
499 |
|
|
s->internal->msg_callback(0, s->version, |
500 |
|
|
SSL3_RT_HANDSHAKE, p, 4, s, |
501 |
|
|
s->internal->msg_callback_arg); |
502 |
|
|
} |
503 |
|
|
} |
504 |
✗✓ |
37182 |
} while (skip_message); |
505 |
|
|
|
506 |
|
|
/* s->internal->init_num == 4 */ |
507 |
|
|
|
508 |
✓✓✗✓
|
38794 |
if ((mt >= 0) && (*p != mt)) { |
509 |
|
|
al = SSL_AD_UNEXPECTED_MESSAGE; |
510 |
|
|
SSLerror(s, SSL_R_UNEXPECTED_MESSAGE); |
511 |
|
|
goto f_err; |
512 |
|
|
} |
513 |
|
|
|
514 |
|
37182 |
CBS_init(&cbs, p, 4); |
515 |
✓✗✗✓
|
74364 |
if (!CBS_get_u8(&cbs, &u8) || |
516 |
|
37182 |
!CBS_get_u24(&cbs, &l)) { |
517 |
|
|
SSLerror(s, ERR_R_BUF_LIB); |
518 |
|
|
goto err; |
519 |
|
|
} |
520 |
|
37182 |
S3I(s)->tmp.message_type = u8; |
521 |
|
|
|
522 |
✗✓ |
37182 |
if (l > (unsigned long)max) { |
523 |
|
|
al = SSL_AD_ILLEGAL_PARAMETER; |
524 |
|
|
SSLerror(s, SSL_R_EXCESSIVE_MESSAGE_SIZE); |
525 |
|
|
goto f_err; |
526 |
|
|
} |
527 |
✓✓✗✓
|
73100 |
if (l && !BUF_MEM_grow_clean(s->internal->init_buf, l + 4)) { |
528 |
|
|
SSLerror(s, ERR_R_BUF_LIB); |
529 |
|
|
goto err; |
530 |
|
|
} |
531 |
|
37182 |
S3I(s)->tmp.message_size = l; |
532 |
|
37182 |
S3I(s)->hs.state = stn; |
533 |
|
|
|
534 |
|
37182 |
s->internal->init_msg = s->internal->init_buf->data + 4; |
535 |
|
37182 |
s->internal->init_num = 0; |
536 |
✓✗✗✓
|
37182 |
} |
537 |
|
|
|
538 |
|
|
/* next state (stn) */ |
539 |
|
37182 |
p = s->internal->init_msg; |
540 |
|
37182 |
n = S3I(s)->tmp.message_size - s->internal->init_num; |
541 |
✓✓ |
146200 |
while (n > 0) { |
542 |
|
71836 |
i = s->method->internal->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, |
543 |
|
35918 |
&p[s->internal->init_num], n, 0); |
544 |
✗✓ |
35918 |
if (i <= 0) { |
545 |
|
|
s->internal->rwstate = SSL_READING; |
546 |
|
|
*ok = 0; |
547 |
|
|
return i; |
548 |
|
|
} |
549 |
|
35918 |
s->internal->init_num += i; |
550 |
|
35918 |
n -= i; |
551 |
|
|
} |
552 |
|
|
|
553 |
|
|
/* If receiving Finished, record MAC of prior handshake messages for |
554 |
|
|
* Finished verification. */ |
555 |
✓✓ |
37182 |
if (*s->internal->init_buf->data == SSL3_MT_FINISHED) |
556 |
|
15991 |
ssl3_take_mac(s); |
557 |
|
|
|
558 |
|
|
/* Feed this message into MAC computation. */ |
559 |
✓✓ |
37182 |
if (s->internal->mac_packet) { |
560 |
|
74352 |
tls1_finish_mac(s, (unsigned char *)s->internal->init_buf->data, |
561 |
|
37176 |
s->internal->init_num + 4); |
562 |
|
|
|
563 |
✗✓ |
37176 |
if (s->internal->msg_callback) |
564 |
|
|
s->internal->msg_callback(0, s->version, |
565 |
|
|
SSL3_RT_HANDSHAKE, s->internal->init_buf->data, |
566 |
|
|
(size_t)s->internal->init_num + 4, s, |
567 |
|
|
s->internal->msg_callback_arg); |
568 |
|
|
} |
569 |
|
|
|
570 |
|
37182 |
*ok = 1; |
571 |
|
37182 |
return (s->internal->init_num); |
572 |
|
|
|
573 |
|
|
f_err: |
574 |
|
|
ssl3_send_alert(s, SSL3_AL_FATAL, al); |
575 |
|
|
err: |
576 |
|
|
*ok = 0; |
577 |
|
|
return (-1); |
578 |
|
59260 |
} |
579 |
|
|
|
580 |
|
|
int |
581 |
|
|
ssl_cert_type(X509 *x, EVP_PKEY *pkey) |
582 |
|
|
{ |
583 |
|
|
EVP_PKEY *pk; |
584 |
|
|
int ret = -1, i; |
585 |
|
|
|
586 |
✗✓ |
3716 |
if (pkey == NULL) |
587 |
|
|
pk = X509_get_pubkey(x); |
588 |
|
|
else |
589 |
|
|
pk = pkey; |
590 |
✓✗ |
1858 |
if (pk == NULL) |
591 |
|
|
goto err; |
592 |
|
|
|
593 |
|
1858 |
i = pk->type; |
594 |
✓✗ |
1858 |
if (i == EVP_PKEY_RSA) { |
595 |
|
|
ret = SSL_PKEY_RSA_ENC; |
596 |
✗✗ |
1858 |
} else if (i == EVP_PKEY_EC) { |
597 |
|
|
ret = SSL_PKEY_ECC; |
598 |
|
|
} else if (i == NID_id_GostR3410_2001 || |
599 |
|
|
i == NID_id_GostR3410_2001_cc) { |
600 |
|
|
ret = SSL_PKEY_GOST01; |
601 |
|
|
} |
602 |
|
|
|
603 |
|
|
err: |
604 |
✗✓ |
1858 |
if (!pkey) |
605 |
|
|
EVP_PKEY_free(pk); |
606 |
|
1858 |
return (ret); |
607 |
|
|
} |
608 |
|
|
|
609 |
|
|
int |
610 |
|
|
ssl_verify_alarm_type(long type) |
611 |
|
|
{ |
612 |
|
|
int al; |
613 |
|
|
|
614 |
|
|
switch (type) { |
615 |
|
|
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: |
616 |
|
|
case X509_V_ERR_UNABLE_TO_GET_CRL: |
617 |
|
|
case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER: |
618 |
|
|
al = SSL_AD_UNKNOWN_CA; |
619 |
|
|
break; |
620 |
|
|
case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: |
621 |
|
|
case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: |
622 |
|
|
case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: |
623 |
|
|
case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: |
624 |
|
|
case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: |
625 |
|
|
case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: |
626 |
|
|
case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: |
627 |
|
|
case X509_V_ERR_CERT_NOT_YET_VALID: |
628 |
|
|
case X509_V_ERR_CRL_NOT_YET_VALID: |
629 |
|
|
case X509_V_ERR_CERT_UNTRUSTED: |
630 |
|
|
case X509_V_ERR_CERT_REJECTED: |
631 |
|
|
al = SSL_AD_BAD_CERTIFICATE; |
632 |
|
|
break; |
633 |
|
|
case X509_V_ERR_CERT_SIGNATURE_FAILURE: |
634 |
|
|
case X509_V_ERR_CRL_SIGNATURE_FAILURE: |
635 |
|
|
al = SSL_AD_DECRYPT_ERROR; |
636 |
|
|
break; |
637 |
|
|
case X509_V_ERR_CERT_HAS_EXPIRED: |
638 |
|
|
case X509_V_ERR_CRL_HAS_EXPIRED: |
639 |
|
|
al = SSL_AD_CERTIFICATE_EXPIRED; |
640 |
|
|
break; |
641 |
|
|
case X509_V_ERR_CERT_REVOKED: |
642 |
|
|
al = SSL_AD_CERTIFICATE_REVOKED; |
643 |
|
|
break; |
644 |
|
|
case X509_V_ERR_OUT_OF_MEM: |
645 |
|
|
al = SSL_AD_INTERNAL_ERROR; |
646 |
|
|
break; |
647 |
|
|
case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: |
648 |
|
|
case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: |
649 |
|
|
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: |
650 |
|
|
case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: |
651 |
|
|
case X509_V_ERR_CERT_CHAIN_TOO_LONG: |
652 |
|
|
case X509_V_ERR_PATH_LENGTH_EXCEEDED: |
653 |
|
|
case X509_V_ERR_INVALID_CA: |
654 |
|
|
al = SSL_AD_UNKNOWN_CA; |
655 |
|
|
break; |
656 |
|
|
case X509_V_ERR_APPLICATION_VERIFICATION: |
657 |
|
|
al = SSL_AD_HANDSHAKE_FAILURE; |
658 |
|
|
break; |
659 |
|
|
case X509_V_ERR_INVALID_PURPOSE: |
660 |
|
|
al = SSL_AD_UNSUPPORTED_CERTIFICATE; |
661 |
|
|
break; |
662 |
|
|
default: |
663 |
|
|
al = SSL_AD_CERTIFICATE_UNKNOWN; |
664 |
|
|
break; |
665 |
|
|
} |
666 |
|
|
return (al); |
667 |
|
|
} |
668 |
|
|
|
669 |
|
|
int |
670 |
|
|
ssl3_setup_init_buffer(SSL *s) |
671 |
|
|
{ |
672 |
|
|
BUF_MEM *buf = NULL; |
673 |
|
|
|
674 |
✗✓ |
32204 |
if (s->internal->init_buf != NULL) |
675 |
|
|
return (1); |
676 |
|
|
|
677 |
✓✗ |
16102 |
if ((buf = BUF_MEM_new()) == NULL) |
678 |
|
|
goto err; |
679 |
✓✗ |
16102 |
if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) |
680 |
|
|
goto err; |
681 |
|
|
|
682 |
|
16102 |
s->internal->init_buf = buf; |
683 |
|
16102 |
return (1); |
684 |
|
|
|
685 |
|
|
err: |
686 |
|
|
BUF_MEM_free(buf); |
687 |
|
|
return (0); |
688 |
|
16102 |
} |
689 |
|
|
|
690 |
|
|
int |
691 |
|
|
ssl3_setup_read_buffer(SSL *s) |
692 |
|
|
{ |
693 |
|
|
unsigned char *p; |
694 |
|
|
size_t len, align, headerlen; |
695 |
|
|
|
696 |
✓✓ |
32420 |
if (SSL_IS_DTLS(s)) |
697 |
|
111 |
headerlen = DTLS1_RT_HEADER_LENGTH; |
698 |
|
|
else |
699 |
|
|
headerlen = SSL3_RT_HEADER_LENGTH; |
700 |
|
|
|
701 |
|
|
align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1); |
702 |
|
|
|
703 |
✓✓ |
16210 |
if (s->s3->rbuf.buf == NULL) { |
704 |
|
|
len = SSL3_RT_MAX_PLAIN_LENGTH + |
705 |
|
1477 |
SSL3_RT_MAX_ENCRYPTED_OVERHEAD + headerlen + align; |
706 |
✓✗ |
1477 |
if ((p = malloc(len)) == NULL) |
707 |
|
|
goto err; |
708 |
|
1477 |
s->s3->rbuf.buf = p; |
709 |
|
1477 |
s->s3->rbuf.len = len; |
710 |
|
1477 |
} |
711 |
|
|
|
712 |
|
16210 |
s->internal->packet = &(s->s3->rbuf.buf[0]); |
713 |
|
16210 |
return 1; |
714 |
|
|
|
715 |
|
|
err: |
716 |
|
|
SSLerror(s, ERR_R_MALLOC_FAILURE); |
717 |
|
|
return 0; |
718 |
|
16210 |
} |
719 |
|
|
|
720 |
|
|
int |
721 |
|
|
ssl3_setup_write_buffer(SSL *s) |
722 |
|
|
{ |
723 |
|
|
unsigned char *p; |
724 |
|
|
size_t len, align, headerlen; |
725 |
|
|
|
726 |
✓✓ |
32276 |
if (SSL_IS_DTLS(s)) |
727 |
|
111 |
headerlen = DTLS1_RT_HEADER_LENGTH + 1; |
728 |
|
|
else |
729 |
|
|
headerlen = SSL3_RT_HEADER_LENGTH; |
730 |
|
|
|
731 |
|
|
align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1); |
732 |
|
|
|
733 |
✓✓ |
16138 |
if (s->s3->wbuf.buf == NULL) { |
734 |
|
1477 |
len = s->max_send_fragment + |
735 |
|
1477 |
SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align; |
736 |
✓✗ |
1477 |
if (!(s->internal->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) |
737 |
|
1477 |
len += headerlen + align + |
738 |
|
|
SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD; |
739 |
|
|
|
740 |
✓✗ |
1477 |
if ((p = malloc(len)) == NULL) |
741 |
|
|
goto err; |
742 |
|
1477 |
s->s3->wbuf.buf = p; |
743 |
|
1477 |
s->s3->wbuf.len = len; |
744 |
|
1477 |
} |
745 |
|
|
|
746 |
|
16138 |
return 1; |
747 |
|
|
|
748 |
|
|
err: |
749 |
|
|
SSLerror(s, ERR_R_MALLOC_FAILURE); |
750 |
|
|
return 0; |
751 |
|
16138 |
} |
752 |
|
|
|
753 |
|
|
int |
754 |
|
|
ssl3_setup_buffers(SSL *s) |
755 |
|
|
{ |
756 |
✗✓ |
32276 |
if (!ssl3_setup_read_buffer(s)) |
757 |
|
|
return 0; |
758 |
✗✓ |
16138 |
if (!ssl3_setup_write_buffer(s)) |
759 |
|
|
return 0; |
760 |
|
16138 |
return 1; |
761 |
|
16138 |
} |
762 |
|
|
|
763 |
|
|
int |
764 |
|
|
ssl3_release_write_buffer(SSL *s) |
765 |
|
|
{ |
766 |
|
3390 |
free(s->s3->wbuf.buf); |
767 |
|
1695 |
s->s3->wbuf.buf = NULL; |
768 |
|
1695 |
return 1; |
769 |
|
|
} |
770 |
|
|
|
771 |
|
|
int |
772 |
|
|
ssl3_release_read_buffer(SSL *s) |
773 |
|
|
{ |
774 |
|
3390 |
free(s->s3->rbuf.buf); |
775 |
|
1695 |
s->s3->rbuf.buf = NULL; |
776 |
|
1695 |
return 1; |
777 |
|
|
} |