[331] | 1 | /*
|
---|
| 2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | /* ====================================================================
|
---|
| 11 | * Copyright 2005 Nokia. All rights reserved.
|
---|
| 12 | *
|
---|
| 13 | * The portions of the attached software ("Contribution") is developed by
|
---|
| 14 | * Nokia Corporation and is licensed pursuant to the OpenSSL open source
|
---|
| 15 | * license.
|
---|
| 16 | *
|
---|
| 17 | * The Contribution, originally written by Mika Kousa and Pasi Eronen of
|
---|
| 18 | * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
|
---|
| 19 | * support (see RFC 4279) to OpenSSL.
|
---|
| 20 | *
|
---|
| 21 | * No patent licenses or other rights except those expressly stated in
|
---|
| 22 | * the OpenSSL open source license shall be deemed granted or received
|
---|
| 23 | * expressly, by implication, estoppel, or otherwise.
|
---|
| 24 | *
|
---|
| 25 | * No assurances are provided by Nokia that the Contribution does not
|
---|
| 26 | * infringe the patent or other intellectual property rights of any third
|
---|
| 27 | * party or that the license provides you with all the necessary rights
|
---|
| 28 | * to make use of the Contribution.
|
---|
| 29 | *
|
---|
| 30 | * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
|
---|
| 31 | * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
|
---|
| 32 | * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
|
---|
| 33 | * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
|
---|
| 34 | * OTHERWISE.
|
---|
| 35 | */
|
---|
| 36 |
|
---|
| 37 | #include <stdio.h>
|
---|
| 38 | #include "ssl_locl.h"
|
---|
| 39 | #include <openssl/evp.h>
|
---|
| 40 | #include <openssl/md5.h>
|
---|
| 41 |
|
---|
| 42 | static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
|
---|
| 43 | {
|
---|
| 44 | EVP_MD_CTX *m5;
|
---|
| 45 | EVP_MD_CTX *s1;
|
---|
| 46 | unsigned char buf[16], smd[SHA_DIGEST_LENGTH];
|
---|
| 47 | unsigned char c = 'A';
|
---|
| 48 | unsigned int i, j, k;
|
---|
| 49 | int ret = 0;
|
---|
| 50 |
|
---|
| 51 | #ifdef CHARSET_EBCDIC
|
---|
| 52 | c = os_toascii[c]; /* 'A' in ASCII */
|
---|
| 53 | #endif
|
---|
| 54 | k = 0;
|
---|
| 55 | m5 = EVP_MD_CTX_new();
|
---|
| 56 | s1 = EVP_MD_CTX_new();
|
---|
| 57 | if (m5 == NULL || s1 == NULL) {
|
---|
| 58 | SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
|
---|
| 59 | goto err;
|
---|
| 60 | }
|
---|
| 61 | EVP_MD_CTX_set_flags(m5, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
|
---|
| 62 | for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
|
---|
| 63 | k++;
|
---|
| 64 | if (k > sizeof(buf)) {
|
---|
| 65 | /* bug: 'buf' is too small for this ciphersuite */
|
---|
| 66 | SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
|
---|
| 67 | goto err;
|
---|
| 68 | }
|
---|
| 69 |
|
---|
| 70 | for (j = 0; j < k; j++)
|
---|
| 71 | buf[j] = c;
|
---|
| 72 | c++;
|
---|
| 73 | if (!EVP_DigestInit_ex(s1, EVP_sha1(), NULL)
|
---|
| 74 | || !EVP_DigestUpdate(s1, buf, k)
|
---|
| 75 | || !EVP_DigestUpdate(s1, s->session->master_key,
|
---|
| 76 | s->session->master_key_length)
|
---|
| 77 | || !EVP_DigestUpdate(s1, s->s3->server_random, SSL3_RANDOM_SIZE)
|
---|
| 78 | || !EVP_DigestUpdate(s1, s->s3->client_random, SSL3_RANDOM_SIZE)
|
---|
| 79 | || !EVP_DigestFinal_ex(s1, smd, NULL)
|
---|
| 80 | || !EVP_DigestInit_ex(m5, EVP_md5(), NULL)
|
---|
| 81 | || !EVP_DigestUpdate(m5, s->session->master_key,
|
---|
| 82 | s->session->master_key_length)
|
---|
| 83 | || !EVP_DigestUpdate(m5, smd, SHA_DIGEST_LENGTH))
|
---|
| 84 | goto err;
|
---|
| 85 | if ((int)(i + MD5_DIGEST_LENGTH) > num) {
|
---|
| 86 | if (!EVP_DigestFinal_ex(m5, smd, NULL))
|
---|
| 87 | goto err;
|
---|
| 88 | memcpy(km, smd, (num - i));
|
---|
| 89 | } else {
|
---|
| 90 | if (!EVP_DigestFinal_ex(m5, km, NULL))
|
---|
| 91 | goto err;
|
---|
| 92 | }
|
---|
| 93 |
|
---|
| 94 | km += MD5_DIGEST_LENGTH;
|
---|
| 95 | }
|
---|
| 96 | OPENSSL_cleanse(smd, sizeof(smd));
|
---|
| 97 | ret = 1;
|
---|
| 98 | err:
|
---|
| 99 | EVP_MD_CTX_free(m5);
|
---|
| 100 | EVP_MD_CTX_free(s1);
|
---|
| 101 | return ret;
|
---|
| 102 | }
|
---|
| 103 |
|
---|
| 104 | int ssl3_change_cipher_state(SSL *s, int which)
|
---|
| 105 | {
|
---|
| 106 | unsigned char *p, *mac_secret;
|
---|
| 107 | unsigned char exp_key[EVP_MAX_KEY_LENGTH];
|
---|
| 108 | unsigned char exp_iv[EVP_MAX_IV_LENGTH];
|
---|
| 109 | unsigned char *ms, *key, *iv;
|
---|
| 110 | EVP_CIPHER_CTX *dd;
|
---|
| 111 | const EVP_CIPHER *c;
|
---|
| 112 | #ifndef OPENSSL_NO_COMP
|
---|
| 113 | COMP_METHOD *comp;
|
---|
| 114 | #endif
|
---|
| 115 | const EVP_MD *m;
|
---|
| 116 | int n, i, j, k, cl;
|
---|
| 117 | int reuse_dd = 0;
|
---|
| 118 |
|
---|
| 119 | c = s->s3->tmp.new_sym_enc;
|
---|
| 120 | m = s->s3->tmp.new_hash;
|
---|
| 121 | /* m == NULL will lead to a crash later */
|
---|
| 122 | OPENSSL_assert(m);
|
---|
| 123 | #ifndef OPENSSL_NO_COMP
|
---|
| 124 | if (s->s3->tmp.new_compression == NULL)
|
---|
| 125 | comp = NULL;
|
---|
| 126 | else
|
---|
| 127 | comp = s->s3->tmp.new_compression->method;
|
---|
| 128 | #endif
|
---|
| 129 |
|
---|
| 130 | if (which & SSL3_CC_READ) {
|
---|
| 131 | if (s->enc_read_ctx != NULL)
|
---|
| 132 | reuse_dd = 1;
|
---|
| 133 | else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL)
|
---|
| 134 | goto err;
|
---|
| 135 | else
|
---|
| 136 | /*
|
---|
| 137 | * make sure it's initialised in case we exit later with an error
|
---|
| 138 | */
|
---|
| 139 | EVP_CIPHER_CTX_reset(s->enc_read_ctx);
|
---|
| 140 | dd = s->enc_read_ctx;
|
---|
| 141 |
|
---|
| 142 | if (ssl_replace_hash(&s->read_hash, m) == NULL) {
|
---|
| 143 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
|
---|
| 144 | goto err2;
|
---|
| 145 | }
|
---|
| 146 | #ifndef OPENSSL_NO_COMP
|
---|
| 147 | /* COMPRESS */
|
---|
| 148 | COMP_CTX_free(s->expand);
|
---|
| 149 | s->expand = NULL;
|
---|
| 150 | if (comp != NULL) {
|
---|
| 151 | s->expand = COMP_CTX_new(comp);
|
---|
| 152 | if (s->expand == NULL) {
|
---|
| 153 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
|
---|
| 154 | SSL_R_COMPRESSION_LIBRARY_ERROR);
|
---|
| 155 | goto err2;
|
---|
| 156 | }
|
---|
| 157 | }
|
---|
| 158 | #endif
|
---|
| 159 | RECORD_LAYER_reset_read_sequence(&s->rlayer);
|
---|
| 160 | mac_secret = &(s->s3->read_mac_secret[0]);
|
---|
| 161 | } else {
|
---|
| 162 | if (s->enc_write_ctx != NULL)
|
---|
| 163 | reuse_dd = 1;
|
---|
| 164 | else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
|
---|
| 165 | goto err;
|
---|
| 166 | else
|
---|
| 167 | /*
|
---|
| 168 | * make sure it's initialised in case we exit later with an error
|
---|
| 169 | */
|
---|
| 170 | EVP_CIPHER_CTX_reset(s->enc_write_ctx);
|
---|
| 171 | dd = s->enc_write_ctx;
|
---|
| 172 | if (ssl_replace_hash(&s->write_hash, m) == NULL) {
|
---|
| 173 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
|
---|
| 174 | goto err2;
|
---|
| 175 | }
|
---|
| 176 | #ifndef OPENSSL_NO_COMP
|
---|
| 177 | /* COMPRESS */
|
---|
| 178 | COMP_CTX_free(s->compress);
|
---|
| 179 | s->compress = NULL;
|
---|
| 180 | if (comp != NULL) {
|
---|
| 181 | s->compress = COMP_CTX_new(comp);
|
---|
| 182 | if (s->compress == NULL) {
|
---|
| 183 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
|
---|
| 184 | SSL_R_COMPRESSION_LIBRARY_ERROR);
|
---|
| 185 | goto err2;
|
---|
| 186 | }
|
---|
| 187 | }
|
---|
| 188 | #endif
|
---|
| 189 | RECORD_LAYER_reset_write_sequence(&s->rlayer);
|
---|
| 190 | mac_secret = &(s->s3->write_mac_secret[0]);
|
---|
| 191 | }
|
---|
| 192 |
|
---|
| 193 | if (reuse_dd)
|
---|
| 194 | EVP_CIPHER_CTX_reset(dd);
|
---|
| 195 |
|
---|
| 196 | p = s->s3->tmp.key_block;
|
---|
| 197 | i = EVP_MD_size(m);
|
---|
| 198 | if (i < 0)
|
---|
| 199 | goto err2;
|
---|
| 200 | cl = EVP_CIPHER_key_length(c);
|
---|
| 201 | j = cl;
|
---|
| 202 | k = EVP_CIPHER_iv_length(c);
|
---|
| 203 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
|
---|
| 204 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
|
---|
| 205 | ms = &(p[0]);
|
---|
| 206 | n = i + i;
|
---|
| 207 | key = &(p[n]);
|
---|
| 208 | n += j + j;
|
---|
| 209 | iv = &(p[n]);
|
---|
| 210 | n += k + k;
|
---|
| 211 | } else {
|
---|
| 212 | n = i;
|
---|
| 213 | ms = &(p[n]);
|
---|
| 214 | n += i + j;
|
---|
| 215 | key = &(p[n]);
|
---|
| 216 | n += j + k;
|
---|
| 217 | iv = &(p[n]);
|
---|
| 218 | n += k;
|
---|
| 219 | }
|
---|
| 220 |
|
---|
| 221 | if (n > s->s3->tmp.key_block_length) {
|
---|
| 222 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
|
---|
| 223 | goto err2;
|
---|
| 224 | }
|
---|
| 225 |
|
---|
| 226 | memcpy(mac_secret, ms, i);
|
---|
| 227 |
|
---|
| 228 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE)))
|
---|
| 229 | goto err2;
|
---|
| 230 |
|
---|
| 231 | #ifdef OPENSSL_SSL_TRACE_CRYPTO
|
---|
| 232 | if (s->msg_callback) {
|
---|
| 233 |
|
---|
| 234 | int wh = which & SSL3_CC_WRITE ?
|
---|
| 235 | TLS1_RT_CRYPTO_WRITE : TLS1_RT_CRYPTO_READ;
|
---|
| 236 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,
|
---|
| 237 | mac_secret, EVP_MD_size(m), s, s->msg_callback_arg);
|
---|
| 238 | if (c->key_len)
|
---|
| 239 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,
|
---|
| 240 | key, c->key_len, s, s->msg_callback_arg);
|
---|
| 241 | if (k) {
|
---|
| 242 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_IV,
|
---|
| 243 | iv, k, s, s->msg_callback_arg);
|
---|
| 244 | }
|
---|
| 245 | }
|
---|
| 246 | #endif
|
---|
| 247 |
|
---|
| 248 | OPENSSL_cleanse(exp_key, sizeof(exp_key));
|
---|
| 249 | OPENSSL_cleanse(exp_iv, sizeof(exp_iv));
|
---|
| 250 | return (1);
|
---|
| 251 | err:
|
---|
| 252 | SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
|
---|
| 253 | err2:
|
---|
| 254 | OPENSSL_cleanse(exp_key, sizeof(exp_key));
|
---|
| 255 | OPENSSL_cleanse(exp_iv, sizeof(exp_iv));
|
---|
| 256 | return (0);
|
---|
| 257 | }
|
---|
| 258 |
|
---|
| 259 | int ssl3_setup_key_block(SSL *s)
|
---|
| 260 | {
|
---|
| 261 | unsigned char *p;
|
---|
| 262 | const EVP_CIPHER *c;
|
---|
| 263 | const EVP_MD *hash;
|
---|
| 264 | int num;
|
---|
| 265 | int ret = 0;
|
---|
| 266 | SSL_COMP *comp;
|
---|
| 267 |
|
---|
| 268 | if (s->s3->tmp.key_block_length != 0)
|
---|
| 269 | return (1);
|
---|
| 270 |
|
---|
| 271 | if (!ssl_cipher_get_evp(s->session, &c, &hash, NULL, NULL, &comp, 0)) {
|
---|
| 272 | SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
|
---|
| 273 | return (0);
|
---|
| 274 | }
|
---|
| 275 |
|
---|
| 276 | s->s3->tmp.new_sym_enc = c;
|
---|
| 277 | s->s3->tmp.new_hash = hash;
|
---|
| 278 | #ifdef OPENSSL_NO_COMP
|
---|
| 279 | s->s3->tmp.new_compression = NULL;
|
---|
| 280 | #else
|
---|
| 281 | s->s3->tmp.new_compression = comp;
|
---|
| 282 | #endif
|
---|
| 283 |
|
---|
| 284 | num = EVP_MD_size(hash);
|
---|
| 285 | if (num < 0)
|
---|
| 286 | return 0;
|
---|
| 287 |
|
---|
| 288 | num = EVP_CIPHER_key_length(c) + num + EVP_CIPHER_iv_length(c);
|
---|
| 289 | num *= 2;
|
---|
| 290 |
|
---|
| 291 | ssl3_cleanup_key_block(s);
|
---|
| 292 |
|
---|
| 293 | if ((p = OPENSSL_malloc(num)) == NULL)
|
---|
| 294 | goto err;
|
---|
| 295 |
|
---|
| 296 | s->s3->tmp.key_block_length = num;
|
---|
| 297 | s->s3->tmp.key_block = p;
|
---|
| 298 |
|
---|
| 299 | ret = ssl3_generate_key_block(s, p, num);
|
---|
| 300 |
|
---|
| 301 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) {
|
---|
| 302 | /*
|
---|
| 303 | * enable vulnerability countermeasure for CBC ciphers with known-IV
|
---|
| 304 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
|
---|
| 305 | */
|
---|
| 306 | s->s3->need_empty_fragments = 1;
|
---|
| 307 |
|
---|
| 308 | if (s->session->cipher != NULL) {
|
---|
| 309 | if (s->session->cipher->algorithm_enc == SSL_eNULL)
|
---|
| 310 | s->s3->need_empty_fragments = 0;
|
---|
| 311 |
|
---|
| 312 | #ifndef OPENSSL_NO_RC4
|
---|
| 313 | if (s->session->cipher->algorithm_enc == SSL_RC4)
|
---|
| 314 | s->s3->need_empty_fragments = 0;
|
---|
| 315 | #endif
|
---|
| 316 | }
|
---|
| 317 | }
|
---|
| 318 |
|
---|
| 319 | return ret;
|
---|
| 320 |
|
---|
| 321 | err:
|
---|
| 322 | SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
|
---|
| 323 | return (0);
|
---|
| 324 | }
|
---|
| 325 |
|
---|
| 326 | void ssl3_cleanup_key_block(SSL *s)
|
---|
| 327 | {
|
---|
| 328 | OPENSSL_clear_free(s->s3->tmp.key_block, s->s3->tmp.key_block_length);
|
---|
| 329 | s->s3->tmp.key_block = NULL;
|
---|
| 330 | s->s3->tmp.key_block_length = 0;
|
---|
| 331 | }
|
---|
| 332 |
|
---|
| 333 | int ssl3_init_finished_mac(SSL *s)
|
---|
| 334 | {
|
---|
| 335 | BIO *buf = BIO_new(BIO_s_mem());
|
---|
| 336 |
|
---|
| 337 | if (buf == NULL) {
|
---|
| 338 | SSLerr(SSL_F_SSL3_INIT_FINISHED_MAC, ERR_R_MALLOC_FAILURE);
|
---|
| 339 | return 0;
|
---|
| 340 | }
|
---|
| 341 | ssl3_free_digest_list(s);
|
---|
| 342 | s->s3->handshake_buffer = buf;
|
---|
| 343 | (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
|
---|
| 344 | return 1;
|
---|
| 345 | }
|
---|
| 346 |
|
---|
| 347 | /*
|
---|
| 348 | * Free digest list. Also frees handshake buffer since they are always freed
|
---|
| 349 | * together.
|
---|
| 350 | */
|
---|
| 351 |
|
---|
| 352 | void ssl3_free_digest_list(SSL *s)
|
---|
| 353 | {
|
---|
| 354 | BIO_free(s->s3->handshake_buffer);
|
---|
| 355 | s->s3->handshake_buffer = NULL;
|
---|
| 356 | EVP_MD_CTX_free(s->s3->handshake_dgst);
|
---|
| 357 | s->s3->handshake_dgst = NULL;
|
---|
| 358 | }
|
---|
| 359 |
|
---|
| 360 | int ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
|
---|
| 361 | {
|
---|
| 362 | if (s->s3->handshake_dgst == NULL)
|
---|
| 363 | /* Note: this writes to a memory BIO so a failure is a fatal error */
|
---|
| 364 | return BIO_write(s->s3->handshake_buffer, (void *)buf, len) == len;
|
---|
| 365 | else
|
---|
| 366 | return EVP_DigestUpdate(s->s3->handshake_dgst, buf, len);
|
---|
| 367 | }
|
---|
| 368 |
|
---|
| 369 | int ssl3_digest_cached_records(SSL *s, int keep)
|
---|
| 370 | {
|
---|
| 371 | const EVP_MD *md;
|
---|
| 372 | long hdatalen;
|
---|
| 373 | void *hdata;
|
---|
| 374 |
|
---|
| 375 | if (s->s3->handshake_dgst == NULL) {
|
---|
| 376 | hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
|
---|
| 377 | if (hdatalen <= 0) {
|
---|
| 378 | SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS,
|
---|
| 379 | SSL_R_BAD_HANDSHAKE_LENGTH);
|
---|
| 380 | return 0;
|
---|
| 381 | }
|
---|
| 382 |
|
---|
| 383 | s->s3->handshake_dgst = EVP_MD_CTX_new();
|
---|
| 384 | if (s->s3->handshake_dgst == NULL) {
|
---|
| 385 | SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_MALLOC_FAILURE);
|
---|
| 386 | return 0;
|
---|
| 387 | }
|
---|
| 388 |
|
---|
| 389 | md = ssl_handshake_md(s);
|
---|
| 390 | if (md == NULL || !EVP_DigestInit_ex(s->s3->handshake_dgst, md, NULL)
|
---|
| 391 | || !EVP_DigestUpdate(s->s3->handshake_dgst, hdata, hdatalen)) {
|
---|
| 392 | SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_INTERNAL_ERROR);
|
---|
| 393 | return 0;
|
---|
| 394 | }
|
---|
| 395 | }
|
---|
| 396 | if (keep == 0) {
|
---|
| 397 | BIO_free(s->s3->handshake_buffer);
|
---|
| 398 | s->s3->handshake_buffer = NULL;
|
---|
| 399 | }
|
---|
| 400 |
|
---|
| 401 | return 1;
|
---|
| 402 | }
|
---|
| 403 |
|
---|
| 404 | int ssl3_final_finish_mac(SSL *s, const char *sender, int len, unsigned char *p)
|
---|
| 405 | {
|
---|
| 406 | int ret;
|
---|
| 407 | EVP_MD_CTX *ctx = NULL;
|
---|
| 408 |
|
---|
| 409 | if (!ssl3_digest_cached_records(s, 0))
|
---|
| 410 | return 0;
|
---|
| 411 |
|
---|
| 412 | if (EVP_MD_CTX_type(s->s3->handshake_dgst) != NID_md5_sha1) {
|
---|
| 413 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, SSL_R_NO_REQUIRED_DIGEST);
|
---|
| 414 | return 0;
|
---|
| 415 | }
|
---|
| 416 |
|
---|
| 417 | ctx = EVP_MD_CTX_new();
|
---|
| 418 | if (ctx == NULL) {
|
---|
| 419 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, ERR_R_MALLOC_FAILURE);
|
---|
| 420 | return 0;
|
---|
| 421 | }
|
---|
| 422 | if (!EVP_MD_CTX_copy_ex(ctx, s->s3->handshake_dgst)) {
|
---|
| 423 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, ERR_R_INTERNAL_ERROR);
|
---|
| 424 | return 0;
|
---|
| 425 | }
|
---|
| 426 |
|
---|
| 427 | ret = EVP_MD_CTX_size(ctx);
|
---|
| 428 | if (ret < 0) {
|
---|
| 429 | EVP_MD_CTX_reset(ctx);
|
---|
| 430 | return 0;
|
---|
| 431 | }
|
---|
| 432 |
|
---|
| 433 | if ((sender != NULL && EVP_DigestUpdate(ctx, sender, len) <= 0)
|
---|
| 434 | || EVP_MD_CTX_ctrl(ctx, EVP_CTRL_SSL3_MASTER_SECRET,
|
---|
| 435 | s->session->master_key_length,
|
---|
| 436 | s->session->master_key) <= 0
|
---|
| 437 | || EVP_DigestFinal_ex(ctx, p, NULL) <= 0) {
|
---|
| 438 | SSLerr(SSL_F_SSL3_FINAL_FINISH_MAC, ERR_R_INTERNAL_ERROR);
|
---|
| 439 | ret = 0;
|
---|
| 440 | }
|
---|
| 441 |
|
---|
| 442 | EVP_MD_CTX_free(ctx);
|
---|
| 443 |
|
---|
| 444 | return ret;
|
---|
| 445 | }
|
---|
| 446 |
|
---|
| 447 | int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
|
---|
| 448 | int len)
|
---|
| 449 | {
|
---|
| 450 | static const unsigned char *salt[3] = {
|
---|
| 451 | #ifndef CHARSET_EBCDIC
|
---|
| 452 | (const unsigned char *)"A",
|
---|
| 453 | (const unsigned char *)"BB",
|
---|
| 454 | (const unsigned char *)"CCC",
|
---|
| 455 | #else
|
---|
| 456 | (const unsigned char *)"\x41",
|
---|
| 457 | (const unsigned char *)"\x42\x42",
|
---|
| 458 | (const unsigned char *)"\x43\x43\x43",
|
---|
| 459 | #endif
|
---|
| 460 | };
|
---|
| 461 | unsigned char buf[EVP_MAX_MD_SIZE];
|
---|
| 462 | EVP_MD_CTX *ctx = EVP_MD_CTX_new();
|
---|
| 463 | int i, ret = 0;
|
---|
| 464 | unsigned int n;
|
---|
| 465 | #ifdef OPENSSL_SSL_TRACE_CRYPTO
|
---|
| 466 | unsigned char *tmpout = out;
|
---|
| 467 | #endif
|
---|
| 468 |
|
---|
| 469 | if (ctx == NULL) {
|
---|
| 470 | SSLerr(SSL_F_SSL3_GENERATE_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
|
---|
| 471 | return 0;
|
---|
| 472 | }
|
---|
| 473 | for (i = 0; i < 3; i++) {
|
---|
| 474 | if (EVP_DigestInit_ex(ctx, s->ctx->sha1, NULL) <= 0
|
---|
| 475 | || EVP_DigestUpdate(ctx, salt[i],
|
---|
| 476 | strlen((const char *)salt[i])) <= 0
|
---|
| 477 | || EVP_DigestUpdate(ctx, p, len) <= 0
|
---|
| 478 | || EVP_DigestUpdate(ctx, &(s->s3->client_random[0]),
|
---|
| 479 | SSL3_RANDOM_SIZE) <= 0
|
---|
| 480 | || EVP_DigestUpdate(ctx, &(s->s3->server_random[0]),
|
---|
| 481 | SSL3_RANDOM_SIZE) <= 0
|
---|
| 482 | || EVP_DigestFinal_ex(ctx, buf, &n) <= 0
|
---|
| 483 | || EVP_DigestInit_ex(ctx, s->ctx->md5, NULL) <= 0
|
---|
| 484 | || EVP_DigestUpdate(ctx, p, len) <= 0
|
---|
| 485 | || EVP_DigestUpdate(ctx, buf, n) <= 0
|
---|
| 486 | || EVP_DigestFinal_ex(ctx, out, &n) <= 0) {
|
---|
| 487 | SSLerr(SSL_F_SSL3_GENERATE_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
|
---|
| 488 | ret = 0;
|
---|
| 489 | break;
|
---|
| 490 | }
|
---|
| 491 | out += n;
|
---|
| 492 | ret += n;
|
---|
| 493 | }
|
---|
| 494 | EVP_MD_CTX_free(ctx);
|
---|
| 495 |
|
---|
| 496 | #ifdef OPENSSL_SSL_TRACE_CRYPTO
|
---|
| 497 | if (ret > 0 && s->msg_callback) {
|
---|
| 498 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_PREMASTER,
|
---|
| 499 | p, len, s, s->msg_callback_arg);
|
---|
| 500 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_CLIENT_RANDOM,
|
---|
| 501 | s->s3->client_random, SSL3_RANDOM_SIZE,
|
---|
| 502 | s, s->msg_callback_arg);
|
---|
| 503 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_SERVER_RANDOM,
|
---|
| 504 | s->s3->server_random, SSL3_RANDOM_SIZE,
|
---|
| 505 | s, s->msg_callback_arg);
|
---|
| 506 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_MASTER,
|
---|
| 507 | tmpout, SSL3_MASTER_SECRET_SIZE,
|
---|
| 508 | s, s->msg_callback_arg);
|
---|
| 509 | }
|
---|
| 510 | #endif
|
---|
| 511 | OPENSSL_cleanse(buf, sizeof(buf));
|
---|
| 512 | return (ret);
|
---|
| 513 | }
|
---|
| 514 |
|
---|
| 515 | int ssl3_alert_code(int code)
|
---|
| 516 | {
|
---|
| 517 | switch (code) {
|
---|
| 518 | case SSL_AD_CLOSE_NOTIFY:
|
---|
| 519 | return (SSL3_AD_CLOSE_NOTIFY);
|
---|
| 520 | case SSL_AD_UNEXPECTED_MESSAGE:
|
---|
| 521 | return (SSL3_AD_UNEXPECTED_MESSAGE);
|
---|
| 522 | case SSL_AD_BAD_RECORD_MAC:
|
---|
| 523 | return (SSL3_AD_BAD_RECORD_MAC);
|
---|
| 524 | case SSL_AD_DECRYPTION_FAILED:
|
---|
| 525 | return (SSL3_AD_BAD_RECORD_MAC);
|
---|
| 526 | case SSL_AD_RECORD_OVERFLOW:
|
---|
| 527 | return (SSL3_AD_BAD_RECORD_MAC);
|
---|
| 528 | case SSL_AD_DECOMPRESSION_FAILURE:
|
---|
| 529 | return (SSL3_AD_DECOMPRESSION_FAILURE);
|
---|
| 530 | case SSL_AD_HANDSHAKE_FAILURE:
|
---|
| 531 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 532 | case SSL_AD_NO_CERTIFICATE:
|
---|
| 533 | return (SSL3_AD_NO_CERTIFICATE);
|
---|
| 534 | case SSL_AD_BAD_CERTIFICATE:
|
---|
| 535 | return (SSL3_AD_BAD_CERTIFICATE);
|
---|
| 536 | case SSL_AD_UNSUPPORTED_CERTIFICATE:
|
---|
| 537 | return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
|
---|
| 538 | case SSL_AD_CERTIFICATE_REVOKED:
|
---|
| 539 | return (SSL3_AD_CERTIFICATE_REVOKED);
|
---|
| 540 | case SSL_AD_CERTIFICATE_EXPIRED:
|
---|
| 541 | return (SSL3_AD_CERTIFICATE_EXPIRED);
|
---|
| 542 | case SSL_AD_CERTIFICATE_UNKNOWN:
|
---|
| 543 | return (SSL3_AD_CERTIFICATE_UNKNOWN);
|
---|
| 544 | case SSL_AD_ILLEGAL_PARAMETER:
|
---|
| 545 | return (SSL3_AD_ILLEGAL_PARAMETER);
|
---|
| 546 | case SSL_AD_UNKNOWN_CA:
|
---|
| 547 | return (SSL3_AD_BAD_CERTIFICATE);
|
---|
| 548 | case SSL_AD_ACCESS_DENIED:
|
---|
| 549 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 550 | case SSL_AD_DECODE_ERROR:
|
---|
| 551 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 552 | case SSL_AD_DECRYPT_ERROR:
|
---|
| 553 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 554 | case SSL_AD_EXPORT_RESTRICTION:
|
---|
| 555 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 556 | case SSL_AD_PROTOCOL_VERSION:
|
---|
| 557 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 558 | case SSL_AD_INSUFFICIENT_SECURITY:
|
---|
| 559 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 560 | case SSL_AD_INTERNAL_ERROR:
|
---|
| 561 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 562 | case SSL_AD_USER_CANCELLED:
|
---|
| 563 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 564 | case SSL_AD_NO_RENEGOTIATION:
|
---|
| 565 | return (-1); /* Don't send it :-) */
|
---|
| 566 | case SSL_AD_UNSUPPORTED_EXTENSION:
|
---|
| 567 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 568 | case SSL_AD_CERTIFICATE_UNOBTAINABLE:
|
---|
| 569 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 570 | case SSL_AD_UNRECOGNIZED_NAME:
|
---|
| 571 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 572 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
|
---|
| 573 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 574 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
|
---|
| 575 | return (SSL3_AD_HANDSHAKE_FAILURE);
|
---|
| 576 | case SSL_AD_UNKNOWN_PSK_IDENTITY:
|
---|
| 577 | return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
|
---|
| 578 | case SSL_AD_INAPPROPRIATE_FALLBACK:
|
---|
| 579 | return (TLS1_AD_INAPPROPRIATE_FALLBACK);
|
---|
| 580 | case SSL_AD_NO_APPLICATION_PROTOCOL:
|
---|
| 581 | return (TLS1_AD_NO_APPLICATION_PROTOCOL);
|
---|
| 582 | default:
|
---|
| 583 | return (-1);
|
---|
| 584 | }
|
---|
| 585 | }
|
---|