1 | /*
|
---|
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
3 | *
|
---|
4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
5 | * this file except in compliance with the License. You can obtain a copy
|
---|
6 | * in the file LICENSE in the source distribution or at
|
---|
7 | * https://www.openssl.org/source/license.html
|
---|
8 | */
|
---|
9 |
|
---|
10 | /* ====================================================================
|
---|
11 | * Copyright 2005 Nokia. All rights reserved.
|
---|
12 | *
|
---|
13 | * The portions of the attached software ("Contribution") is developed by
|
---|
14 | * Nokia Corporation and is licensed pursuant to the OpenSSL open source
|
---|
15 | * license.
|
---|
16 | *
|
---|
17 | * The Contribution, originally written by Mika Kousa and Pasi Eronen of
|
---|
18 | * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
|
---|
19 | * support (see RFC 4279) to OpenSSL.
|
---|
20 | *
|
---|
21 | * No patent licenses or other rights except those expressly stated in
|
---|
22 | * the OpenSSL open source license shall be deemed granted or received
|
---|
23 | * expressly, by implication, estoppel, or otherwise.
|
---|
24 | *
|
---|
25 | * No assurances are provided by Nokia that the Contribution does not
|
---|
26 | * infringe the patent or other intellectual property rights of any third
|
---|
27 | * party or that the license provides you with all the necessary rights
|
---|
28 | * to make use of the Contribution.
|
---|
29 | *
|
---|
30 | * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
|
---|
31 | * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
|
---|
32 | * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
|
---|
33 | * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
|
---|
34 | * OTHERWISE.
|
---|
35 | */
|
---|
36 |
|
---|
37 | #include <stdio.h>
|
---|
38 | #include "ssl_locl.h"
|
---|
39 | #include <openssl/evp.h>
|
---|
40 | #include <openssl/md5.h>
|
---|
41 |
|
---|
42 | static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
|
---|
43 | {
|
---|
44 | EVP_MD_CTX *m5;
|
---|
45 | EVP_MD_CTX *s1;
|
---|
46 | unsigned char buf[16], smd[SHA_DIGEST_LENGTH];
|
---|
47 | unsigned char c = 'A';
|
---|
48 | unsigned int i, j, k;
|
---|
49 | int ret = 0;
|
---|
50 |
|
---|
51 | #ifdef CHARSET_EBCDIC
|
---|
52 | c = os_toascii[c]; /* 'A' in ASCII */
|
---|
53 | #endif
|
---|
54 | k = 0;
|
---|
55 | m5 = EVP_MD_CTX_new();
|
---|
56 | s1 = EVP_MD_CTX_new();
|
---|
57 | if (m5 == NULL || s1 == NULL) {
|
---|
58 | SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
|
---|
59 | goto err;
|
---|
60 | }
|
---|
61 | EVP_MD_CTX_set_flags(m5, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
|
---|
62 | for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
|
---|
63 | k++;
|
---|
64 | if (k > sizeof(buf)) {
|
---|
65 | /* bug: 'buf' is too small for this ciphersuite */
|
---|
66 | SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
|
---|
67 | goto err;
|
---|
68 | }
|
---|
69 |
|
---|
70 | for (j = 0; j < k; j++)
|
---|
71 | buf[j] = c;
|
---|
72 | c++;
|
---|
73 | if (!EVP_DigestInit_ex(s1, EVP_sha1(), NULL)
|
---|
74 | || !EVP_DigestUpdate(s1, buf, k)
|
---|
75 | || !EVP_DigestUpdate(s1, s->session->master_key,
|
---|
76 | s->session->master_key_length)
|
---|
77 | || !EVP_DigestUpdate(s1, s->s3->server_random, SSL3_RANDOM_SIZE)
|
---|
78 | || !EVP_DigestUpdate(s1, s->s3->client_random, SSL3_RANDOM_SIZE)
|
---|
79 | || !EVP_DigestFinal_ex(s1, smd, NULL)
|
---|
80 | || !EVP_DigestInit_ex(m5, EVP_md5(), NULL)
|
---|
81 | || !EVP_DigestUpdate(m5, s->session->master_key,
|
---|
82 | s->session->master_key_length)
|
---|
83 | || !EVP_DigestUpdate(m5, smd, SHA_DIGEST_LENGTH))
|
---|
84 | goto err;
|
---|
85 | if ((int)(i + MD5_DIGEST_LENGTH) > num) {
|
---|
86 | if (!EVP_DigestFinal_ex(m5, smd, NULL))
|
---|
87 | goto err;
|
---|
88 | memcpy(km, smd, (num - i));
|
---|
89 | } else {
|
---|
90 | if (!EVP_DigestFinal_ex(m5, km, NULL))
|
---|
91 | goto err;
|
---|
92 | }
|
---|
93 |
|
---|
94 | km += MD5_DIGEST_LENGTH;
|
---|
95 | }
|
---|
96 | OPENSSL_cleanse(smd, sizeof(smd));
|
---|
97 | ret = 1;
|
---|
98 | err:
|
---|
99 | EVP_MD_CTX_free(m5);
|
---|
100 | EVP_MD_CTX_free(s1);
|
---|
101 | return ret;
|
---|
102 | }
|
---|
103 |
|
---|
104 | int ssl3_change_cipher_state(SSL *s, int which)
|
---|
105 | {
|
---|
106 | unsigned char *p, *mac_secret;
|
---|
107 | unsigned char exp_key[EVP_MAX_KEY_LENGTH];
|
---|
108 | unsigned char exp_iv[EVP_MAX_IV_LENGTH];
|
---|
109 | unsigned char *ms, *key, *iv;
|
---|
110 | EVP_CIPHER_CTX *dd;
|
---|
111 | const EVP_CIPHER *c;
|
---|
112 | #ifndef OPENSSL_NO_COMP
|
---|
113 | COMP_METHOD *comp;
|
---|
114 | #endif
|
---|
115 | const EVP_MD *m;
|
---|
116 | int n, i, j, k, cl;
|
---|
117 | int reuse_dd = 0;
|
---|
118 |
|
---|
119 | c = s->s3->tmp.new_sym_enc;
|
---|
120 | m = s->s3->tmp.new_hash;
|
---|
121 | /* m == NULL will lead to a crash later */
|
---|
122 | OPENSSL_assert(m);
|
---|
123 | #ifndef OPENSSL_NO_COMP
|
---|
124 | if (s->s3->tmp.new_compression == NULL)
|
---|
125 | comp = NULL;
|
---|
126 | else
|
---|
127 | comp = s->s3->tmp.new_compression->method;
|
---|
128 | #endif
|
---|
129 |
|
---|
130 | if (which & SSL3_CC_READ) {
|
---|
131 | if (s->enc_read_ctx != NULL)
|
---|
132 | reuse_dd = 1;
|
---|
133 | else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
|
---|
134 | goto err;
|
---|
135 | else
|
---|
136 | /*
|
---|
137 | * make sure it's initialised in case we exit later with an error
|
---|
138 | */
|
---|
139 | EVP_CIPHER_CTX_reset(s->enc_read_ctx);
|
---|
140 | dd = s->enc_read_ctx;
|
---|
141 |
|
---|
142 | if (ssl_replace_hash(&s->read_hash, m) == NULL) {
|
---|
143 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
|
---|
144 | goto err2;
|
---|
145 | }
|
---|
146 | #ifndef OPENSSL_NO_COMP
|
---|
147 | /* COMPRESS */
|
---|
148 | COMP_CTX_free(s->expand);
|
---|
149 | s->expand = NULL;
|
---|
150 | if (comp != NULL) {
|
---|
151 | s->expand = COMP_CTX_new(comp);
|
---|
152 | if (s->expand == NULL) {
|
---|
153 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
|
---|
154 | SSL_R_COMPRESSION_LIBRARY_ERROR);
|
---|
155 | goto err2;
|
---|
156 | }
|
---|
157 | }
|
---|
158 | #endif
|
---|
159 | RECORD_LAYER_reset_read_sequence(&s->rlayer);
|
---|
160 | mac_secret = &(s->s3->read_mac_secret[0]);
|
---|
161 | } else {
|
---|
162 | if (s->enc_write_ctx != NULL)
|
---|
163 | reuse_dd = 1;
|
---|
164 | else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
|
---|
165 | goto err;
|
---|
166 | else
|
---|
167 | /*
|
---|
168 | * make sure it's initialised in case we exit later with an error
|
---|
169 | */
|
---|
170 | EVP_CIPHER_CTX_reset(s->enc_write_ctx);
|
---|
171 | dd = s->enc_write_ctx;
|
---|
172 | if (ssl_replace_hash(&s->write_hash, m) == NULL) {
|
---|
173 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
|
---|
174 | goto err2;
|
---|
175 | }
|
---|
176 | #ifndef OPENSSL_NO_COMP
|
---|
177 | /* COMPRESS */
|
---|
178 | COMP_CTX_free(s->compress);
|
---|
179 | s->compress = NULL;
|
---|
180 | if (comp != NULL) {
|
---|
181 | s->compress = COMP_CTX_new(comp);
|
---|
182 | if (s->compress == NULL) {
|
---|
183 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
|
---|
184 | SSL_R_COMPRESSION_LIBRARY_ERROR);
|
---|
185 | goto err2;
|
---|
186 | }
|
---|
187 | }
|
---|
188 | #endif
|
---|
189 | RECORD_LAYER_reset_write_sequence(&s->rlayer);
|
---|
190 | mac_secret = &(s->s3->write_mac_secret[0]);
|
---|
191 | }
|
---|
192 |
|
---|
193 | if (reuse_dd)
|
---|
194 | EVP_CIPHER_CTX_reset(dd);
|
---|
195 |
|
---|
196 | p = s->s3->tmp.key_block;
|
---|
197 | i = EVP_MD_size(m);
|
---|
198 | if (i < 0)
|
---|
199 | goto err2;
|
---|
200 | cl = EVP_CIPHER_key_length(c);
|
---|
201 | j = cl;
|
---|
202 | k = EVP_CIPHER_iv_length(c);
|
---|
203 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
|
---|
204 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
|
---|
205 | ms = &(p[0]);
|
---|
206 | n = i + i;
|
---|
207 | key = &(p[n]);
|
---|
208 | n += j + j;
|
---|
209 | iv = &(p[n]);
|
---|
210 | n += k + k;
|
---|
211 | } else {
|
---|
212 | n = i;
|
---|
213 | ms = &(p[n]);
|
---|
214 | n += i + j;
|
---|
215 | key = &(p[n]);
|
---|
216 | n += j + k;
|
---|
217 | iv = &(p[n]);
|
---|
218 | n += k;
|
---|
219 | }
|
---|
220 |
|
---|
221 | if (n > s->s3->tmp.key_block_length) {
|
---|
222 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
|
---|
223 | goto err2;
|
---|
224 | }
|
---|
225 |
|
---|
226 | memcpy(mac_secret, ms, i);
|
---|
227 |
|
---|
228 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE)))
|
---|
229 | goto err2;
|
---|
230 |
|
---|
231 | #ifdef OPENSSL_SSL_TRACE_CRYPTO
|
---|
232 | if (s->msg_callback) {
|
---|
233 |
|
---|
234 | int wh = which & SSL3_CC_WRITE ?
|
---|
235 | TLS1_RT_CRYPTO_WRITE : TLS1_RT_CRYPTO_READ;
|
---|
236 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,
|
---|
237 | mac_secret, EVP_MD_size(m), s, s->msg_callback_arg);
|
---|
238 | if (c->key_len)
|
---|
239 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,
|
---|
240 | key, c->key_len, s, s->msg_callback_arg);
|
---|
241 | if (k) {
|
---|
242 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_IV,
|
---|
243 | iv, k, s, s->msg_callback_arg);
|
---|
244 | }
|
---|
245 | }
|
---|
246 | #endif
|
---|
247 |
|
---|
248 | OPENSSL_cleanse(exp_key, sizeof(exp_key));
|
---|
249 | OPENSSL_cleanse(exp_iv, sizeof(exp_iv));
|
---|
250 | return (1);
|
---|
251 | err:
|
---|
252 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
|
---|
253 | err2:
|
---|
254 | OPENSSL_cleanse(exp_key, sizeof(exp_key));
|
---|
255 | OPENSSL_cleanse(exp_iv, sizeof(exp_iv));
|
---|
256 | return (0);
|
---|
257 | }
|
---|
258 |
|
---|
259 | int ssl3_setup_key_block(SSL *s)
|
---|
260 | {
|
---|
261 | unsigned char *p;
|
---|
262 | const EVP_CIPHER *c;
|
---|
263 | const EVP_MD *hash;
|
---|
264 | int num;
|
---|
265 | int ret = 0;
|
---|
266 | SSL_COMP *comp;
|
---|
267 |
|
---|
268 | if (s->s3->tmp.key_block_length != 0)
|
---|
269 | return (1);
|
---|
270 |
|
---|
271 | if (!ssl_cipher_get_evp(s->session, &c, &hash, NULL, NULL, &comp, 0)) {
|
---|
272 | SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
|
---|
273 | return (0);
|
---|
274 | }
|
---|
275 |
|
---|
276 | s->s3->tmp.new_sym_enc = c;
|
---|
277 | s->s3->tmp.new_hash = hash;
|
---|
278 | #ifdef OPENSSL_NO_COMP
|
---|
279 | s->s3->tmp.new_compression = NULL;
|
---|
280 | #else
|
---|
281 | s->s3->tmp.new_compression = comp;
|
---|
282 | #endif
|
---|
283 |
|
---|
284 | num = EVP_MD_size(hash);
|
---|
285 | if (num < 0)
|
---|
286 | return 0;
|
---|
287 |
|
---|
288 | num = EVP_CIPHER_key_length(c) + num + EVP_CIPHER_iv_length(c);
|
---|
289 | num *= 2;
|
---|
290 |
|
---|
291 | ssl3_cleanup_key_block(s);
|
---|
292 |
|
---|
293 | if ((p = OPENSSL_malloc(num)) == NULL)
|
---|
294 | goto err;
|
---|
295 |
|
---|
296 | s->s3->tmp.key_block_length = num;
|
---|
297 | s->s3->tmp.key_block = p;
|
---|
298 |
|
---|
299 | ret = ssl3_generate_key_block(s, p, num);
|
---|
300 |
|
---|
301 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) {
|
---|
302 | /*
|
---|
303 | * enable vulnerability countermeasure for CBC ciphers with known-IV
|
---|
304 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
|
---|
305 | */
|
---|
306 | s->s3->need_empty_fragments = 1;
|
---|
307 |
|
---|
308 | if (s->session->cipher != NULL) {
|
---|
309 | if (s->session->cipher->algorithm_enc == SSL_eNULL)
|
---|
310 | s->s3->need_empty_fragments = 0;
|
---|
311 |
|
---|
312 | #ifndef OPENSSL_NO_RC4
|
---|
313 | if (s->session->cipher->algorithm_enc == SSL_RC4)
|
---|
314 | s->s3->need_empty_fragments = 0;
|
---|
315 | #endif
|
---|
316 | }
|
---|
317 | }
|
---|
318 |
|
---|
319 | return ret;
|
---|
320 |
|
---|
321 | err:
|
---|
322 | SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
|
---|
323 | return (0);
|
---|
324 | }
|
---|
325 |
|
---|
326 | void ssl3_cleanup_key_block(SSL *s)
|
---|
327 | {
|
---|
328 | OPENSSL_clear_free(s->s3->tmp.key_block, s->s3->tmp.key_block_length);
|
---|
329 | s->s3->tmp.key_block = NULL;
|
---|
330 | s->s3->tmp.key_block_length = 0;
|
---|
331 | }
|
---|
332 |
|
---|
333 | int ssl3_init_finished_mac(SSL *s)
|
---|
334 | {
|
---|
335 | BIO *buf = BIO_new(BIO_s_mem());
|
---|
336 |
|
---|
337 | if (buf == NULL) {
|
---|
338 | SSLerr(SSL_F_SSL3_INIT_FINISHED_MAC, ERR_R_MALLOC_FAILURE);
|
---|
339 | return 0;
|
---|
340 | }
|
---|
341 | ssl3_free_digest_list(s);
|
---|
342 | s->s3->handshake_buffer = buf;
|
---|
343 | (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
|
---|
344 | return 1;
|
---|
345 | }
|
---|
346 |
|
---|
347 | /*
|
---|
348 | * Free digest list. Also frees handshake buffer since they are always freed
|
---|
349 | * together.
|
---|
350 | */
|
---|
351 |
|
---|
352 | void ssl3_free_digest_list(SSL *s)
|
---|
353 | {
|
---|
354 | BIO_free(s->s3->handshake_buffer);
|
---|
355 | s->s3->handshake_buffer = NULL;
|
---|
356 | EVP_MD_CTX_free(s->s3->handshake_dgst);
|
---|
357 | s->s3->handshake_dgst = NULL;
|
---|
358 | }
|
---|
359 |
|
---|
360 | int ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
|
---|
361 | {
|
---|
362 | if (s->s3->handshake_dgst == NULL)
|
---|
363 | /* Note: this writes to a memory BIO so a failure is a fatal error */
|
---|
364 | return BIO_write(s->s3->handshake_buffer, (void *)buf, len) == len;
|
---|
365 | else
|
---|
366 | return EVP_DigestUpdate(s->s3->handshake_dgst, buf, len);
|
---|
367 | }
|
---|
368 |
|
---|
369 | int ssl3_digest_cached_records(SSL *s, int keep)
|
---|
370 | {
|
---|
371 | const EVP_MD *md;
|
---|
372 | long hdatalen;
|
---|
373 | void *hdata;
|
---|
374 |
|
---|
375 | if (s->s3->handshake_dgst == NULL) {
|
---|
376 | hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
|
---|
377 | if (hdatalen <= 0) {
|
---|
378 | SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS,
|
---|
379 | SSL_R_BAD_HANDSHAKE_LENGTH);
|
---|
380 | return 0;
|
---|
381 | }
|
---|
382 |
|
---|
383 | s->s3->handshake_dgst = EVP_MD_CTX_new();
|
---|
384 | if (s->s3->handshake_dgst == NULL) {
|
---|
385 | SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_MALLOC_FAILURE);
|
---|
386 | return 0;
|
---|
387 | }
|
---|
388 |
|
---|
389 | md = ssl_handshake_md(s);
|
---|
390 | if (md == NULL || !EVP_DigestInit_ex(s->s3->handshake_dgst, md, NULL)
|
---|
391 | || !EVP_DigestUpdate(s->s3->handshake_dgst, hdata, hdatalen)) {
|
---|
392 | SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_INTERNAL_ERROR);
|
---|
393 | return 0;
|
---|
394 | }
|
---|
395 | }
|
---|
396 | if (keep == 0) {
|
---|
397 | BIO_free(s->s3->handshake_buffer);
|
---|
398 | s->s3->handshake_buffer = NULL;
|
---|
399 | }
|
---|
400 |
|
---|
401 | return 1;
|
---|
402 | }
|
---|
403 |
|
---|
404 | int ssl3_final_finish_mac(SSL *s, const char *sender, int len, unsigned char *p)
|
---|
405 | {
|
---|
406 | int ret;
|
---|
407 | EVP_MD_CTX *ctx = NULL;
|
---|
408 |
|
---|
409 | if (!ssl3_digest_cached_records(s, 0))
|
---|
410 | return 0;
|
---|
411 |
|
---|
412 | if (EVP_MD_CTX_type(s->s3->handshake_dgst) != NID_md5_sha1) {
|
---|
413 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, SSL_R_NO_REQUIRED_DIGEST);
|
---|
414 | return 0;
|
---|
415 | }
|
---|
416 |
|
---|
417 | ctx = EVP_MD_CTX_new();
|
---|
418 | if (ctx == NULL) {
|
---|
419 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, ERR_R_MALLOC_FAILURE);
|
---|
420 | return 0;
|
---|
421 | }
|
---|
422 | if (!EVP_MD_CTX_copy_ex(ctx, s->s3->handshake_dgst)) {
|
---|
423 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, ERR_R_INTERNAL_ERROR);
|
---|
424 | return 0;
|
---|
425 | }
|
---|
426 |
|
---|
427 | ret = EVP_MD_CTX_size(ctx);
|
---|
428 | if (ret < 0) {
|
---|
429 | EVP_MD_CTX_reset(ctx);
|
---|
430 | return 0;
|
---|
431 | }
|
---|
432 |
|
---|
433 | if ((sender != NULL && EVP_DigestUpdate(ctx, sender, len) <= 0)
|
---|
434 | || EVP_MD_CTX_ctrl(ctx, EVP_CTRL_SSL3_MASTER_SECRET,
|
---|
435 | s->session->master_key_length,
|
---|
436 | s->session->master_key) <= 0
|
---|
437 | || EVP_DigestFinal_ex(ctx, p, NULL) <= 0) {
|
---|
438 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, ERR_R_INTERNAL_ERROR);
|
---|
439 | ret = 0;
|
---|
440 | }
|
---|
441 |
|
---|
442 | EVP_MD_CTX_free(ctx);
|
---|
443 |
|
---|
444 | return ret;
|
---|
445 | }
|
---|
446 |
|
---|
447 | int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
|
---|
448 | int len)
|
---|
449 | {
|
---|
450 | static const unsigned char *salt[3] = {
|
---|
451 | #ifndef CHARSET_EBCDIC
|
---|
452 | (const unsigned char *)"A",
|
---|
453 | (const unsigned char *)"BB",
|
---|
454 | (const unsigned char *)"CCC",
|
---|
455 | #else
|
---|
456 | (const unsigned char *)"\x41",
|
---|
457 | (const unsigned char *)"\x42\x42",
|
---|
458 | (const unsigned char *)"\x43\x43\x43",
|
---|
459 | #endif
|
---|
460 | };
|
---|
461 | unsigned char buf[EVP_MAX_MD_SIZE];
|
---|
462 | EVP_MD_CTX *ctx = EVP_MD_CTX_new();
|
---|
463 | int i, ret = 0;
|
---|
464 | unsigned int n;
|
---|
465 | #ifdef OPENSSL_SSL_TRACE_CRYPTO
|
---|
466 | unsigned char *tmpout = out;
|
---|
467 | #endif
|
---|
468 |
|
---|
469 | if (ctx == NULL) {
|
---|
470 | SSLerr(SSL_F_SSL3_GENERATE_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
|
---|
471 | return 0;
|
---|
472 | }
|
---|
473 | for (i = 0; i < 3; i++) {
|
---|
474 | if (EVP_DigestInit_ex(ctx, s->ctx->sha1, NULL) <= 0
|
---|
475 | || EVP_DigestUpdate(ctx, salt[i],
|
---|
476 | strlen((const char *)salt[i])) <= 0
|
---|
477 | || EVP_DigestUpdate(ctx, p, len) <= 0
|
---|
478 | || EVP_DigestUpdate(ctx, &(s->s3->client_random[0]),
|
---|
479 | SSL3_RANDOM_SIZE) <= 0
|
---|
480 | || EVP_DigestUpdate(ctx, &(s->s3->server_random[0]),
|
---|
481 | SSL3_RANDOM_SIZE) <= 0
|
---|
482 | || EVP_DigestFinal_ex(ctx, buf, &n) <= 0
|
---|
483 | || EVP_DigestInit_ex(ctx, s->ctx->md5, NULL) <= 0
|
---|
484 | || EVP_DigestUpdate(ctx, p, len) <= 0
|
---|
485 | || EVP_DigestUpdate(ctx, buf, n) <= 0
|
---|
486 | || EVP_DigestFinal_ex(ctx, out, &n) <= 0) {
|
---|
487 | SSLerr(SSL_F_SSL3_GENERATE_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
|
---|
488 | ret = 0;
|
---|
489 | break;
|
---|
490 | }
|
---|
491 | out += n;
|
---|
492 | ret += n;
|
---|
493 | }
|
---|
494 | EVP_MD_CTX_free(ctx);
|
---|
495 |
|
---|
496 | #ifdef OPENSSL_SSL_TRACE_CRYPTO
|
---|
497 | if (ret > 0 && s->msg_callback) {
|
---|
498 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_PREMASTER,
|
---|
499 | p, len, s, s->msg_callback_arg);
|
---|
500 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_CLIENT_RANDOM,
|
---|
501 | s->s3->client_random, SSL3_RANDOM_SIZE,
|
---|
502 | s, s->msg_callback_arg);
|
---|
503 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_SERVER_RANDOM,
|
---|
504 | s->s3->server_random, SSL3_RANDOM_SIZE,
|
---|
505 | s, s->msg_callback_arg);
|
---|
506 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_MASTER,
|
---|
507 | tmpout, SSL3_MASTER_SECRET_SIZE,
|
---|
508 | s, s->msg_callback_arg);
|
---|
509 | }
|
---|
510 | #endif
|
---|
511 | OPENSSL_cleanse(buf, sizeof(buf));
|
---|
512 | return (ret);
|
---|
513 | }
|
---|
514 |
|
---|
515 | int ssl3_alert_code(int code)
|
---|
516 | {
|
---|
517 | switch (code) {
|
---|
518 | case SSL_AD_CLOSE_NOTIFY:
|
---|
519 | return (SSL3_AD_CLOSE_NOTIFY);
|
---|
520 | case SSL_AD_UNEXPECTED_MESSAGE:
|
---|
521 | return (SSL3_AD_UNEXPECTED_MESSAGE);
|
---|
522 | case SSL_AD_BAD_RECORD_MAC:
|
---|
523 | return (SSL3_AD_BAD_RECORD_MAC);
|
---|
524 | case SSL_AD_DECRYPTION_FAILED:
|
---|
525 | return (SSL3_AD_BAD_RECORD_MAC);
|
---|
526 | case SSL_AD_RECORD_OVERFLOW:
|
---|
527 | return (SSL3_AD_BAD_RECORD_MAC);
|
---|
528 | case SSL_AD_DECOMPRESSION_FAILURE:
|
---|
529 | return (SSL3_AD_DECOMPRESSION_FAILURE);
|
---|
530 | case SSL_AD_HANDSHAKE_FAILURE:
|
---|
531 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
532 | case SSL_AD_NO_CERTIFICATE:
|
---|
533 | return (SSL3_AD_NO_CERTIFICATE);
|
---|
534 | case SSL_AD_BAD_CERTIFICATE:
|
---|
535 | return (SSL3_AD_BAD_CERTIFICATE);
|
---|
536 | case SSL_AD_UNSUPPORTED_CERTIFICATE:
|
---|
537 | return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
|
---|
538 | case SSL_AD_CERTIFICATE_REVOKED:
|
---|
539 | return (SSL3_AD_CERTIFICATE_REVOKED);
|
---|
540 | case SSL_AD_CERTIFICATE_EXPIRED:
|
---|
541 | return (SSL3_AD_CERTIFICATE_EXPIRED);
|
---|
542 | case SSL_AD_CERTIFICATE_UNKNOWN:
|
---|
543 | return (SSL3_AD_CERTIFICATE_UNKNOWN);
|
---|
544 | case SSL_AD_ILLEGAL_PARAMETER:
|
---|
545 | return (SSL3_AD_ILLEGAL_PARAMETER);
|
---|
546 | case SSL_AD_UNKNOWN_CA:
|
---|
547 | return (SSL3_AD_BAD_CERTIFICATE);
|
---|
548 | case SSL_AD_ACCESS_DENIED:
|
---|
549 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
550 | case SSL_AD_DECODE_ERROR:
|
---|
551 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
552 | case SSL_AD_DECRYPT_ERROR:
|
---|
553 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
554 | case SSL_AD_EXPORT_RESTRICTION:
|
---|
555 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
556 | case SSL_AD_PROTOCOL_VERSION:
|
---|
557 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
558 | case SSL_AD_INSUFFICIENT_SECURITY:
|
---|
559 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
560 | case SSL_AD_INTERNAL_ERROR:
|
---|
561 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
562 | case SSL_AD_USER_CANCELLED:
|
---|
563 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
564 | case SSL_AD_NO_RENEGOTIATION:
|
---|
565 | return (-1); /* Don't send it :-) */
|
---|
566 | case SSL_AD_UNSUPPORTED_EXTENSION:
|
---|
567 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
568 | case SSL_AD_CERTIFICATE_UNOBTAINABLE:
|
---|
569 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
570 | case SSL_AD_UNRECOGNIZED_NAME:
|
---|
571 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
572 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
|
---|
573 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
574 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
|
---|
575 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
576 | case SSL_AD_UNKNOWN_PSK_IDENTITY:
|
---|
577 | return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
|
---|
578 | case SSL_AD_INAPPROPRIATE_FALLBACK:
|
---|
579 | return (TLS1_AD_INAPPROPRIATE_FALLBACK);
|
---|
580 | case SSL_AD_NO_APPLICATION_PROTOCOL:
|
---|
581 | return (TLS1_AD_NO_APPLICATION_PROTOCOL);
|
---|
582 | default:
|
---|
583 | return (-1);
|
---|
584 | }
|
---|
585 | }
|
---|