s3_srvr.c 79.3 KB
Newer Older
1
/* ssl/s3_srvr.c -*- mode:C; c-file-style: "eay" -*- */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */
58
/* ====================================================================
59
 * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
B
Bodo Möller 已提交
111 112 113 114 115 116 117 118 119 120 121 122 123
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
 * Portions of the attached software ("Contribution") are developed by 
 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 *
 * The Contribution is licensed pursuant to the OpenSSL open source
 * license provided above.
 *
 * ECC cipher suite support in OpenSSL originally written by
 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
 *
 */
124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149
/* ====================================================================
 * Copyright 2005 Nokia. All rights reserved.
 *
 * The portions of the attached software ("Contribution") is developed by
 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 * license.
 *
 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 * support (see RFC 4279) to OpenSSL.
 *
 * No patent licenses or other rights except those expressly stated in
 * the OpenSSL open source license shall be deemed granted or received
 * expressly, by implication, estoppel, or otherwise.
 *
 * No assurances are provided by Nokia that the Contribution does not
 * infringe the patent or other intellectual property rights of any third
 * party or that the license provides you with all the necessary rights
 * to make use of the Contribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 * OTHERWISE.
 */
150 151

#define REUSE_CIPHER_BUG
152 153
#define NETSCAPE_HANG_BUG

154
#include <stdio.h>
155 156
#include "ssl_locl.h"
#include "kssl_lcl.h"
157 158 159 160
#include <openssl/buffer.h>
#include <openssl/rand.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
161
#include <openssl/hmac.h>
162
#include <openssl/x509.h>
N
make  
Nils Larsch 已提交
163
#ifndef OPENSSL_NO_DH
164
#include <openssl/dh.h>
N
make  
Nils Larsch 已提交
165
#endif
166
#include <openssl/bn.h>
167
#ifndef OPENSSL_NO_KRB5
168
#include <openssl/krb5_asn.h>
169
#endif
170
#include <openssl/md5.h>
171

172
static const SSL_METHOD *ssl3_get_server_method(int ver);
173

174
static const SSL_METHOD *ssl3_get_server_method(int ver)
175
	{
176
	if (ver == SSL3_VERSION)
177 178 179 180 181
		return(SSLv3_server_method());
	else
		return(NULL);
	}

182 183 184 185
IMPLEMENT_ssl3_meth_func(SSLv3_server_method,
			ssl3_accept,
			ssl_undefined_function,
			ssl3_get_server_method)
186

U
Ulf Möller 已提交
187
int ssl3_accept(SSL *s)
188 189
	{
	BUF_MEM *buf;
190
	unsigned long alg_k,Time=(unsigned long)time(NULL);
B
Ben Laurie 已提交
191
	void (*cb)(const SSL *ssl,int type,int val)=NULL;
192 193 194
	int ret= -1;
	int new_state,state,skip=0;

195
	RAND_add(&Time,sizeof(Time),0);
196
	ERR_clear_error();
197
	clear_sys_error();
198 199 200 201 202 203 204 205

	if (s->info_callback != NULL)
		cb=s->info_callback;
	else if (s->ctx->info_callback != NULL)
		cb=s->ctx->info_callback;

	/* init things to blank */
	s->in_handshake++;
206
	if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
207

208
	if (s->cert == NULL)
209 210
		{
		SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_NO_CERTIFICATE_SET);
211
		return(-1);
212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228
		}

	for (;;)
		{
		state=s->state;

		switch (s->state)
			{
		case SSL_ST_RENEGOTIATE:
			s->new_session=1;
			/* s->state=SSL_ST_ACCEPT; */

		case SSL_ST_BEFORE:
		case SSL_ST_ACCEPT:
		case SSL_ST_BEFORE|SSL_ST_ACCEPT:
		case SSL_ST_OK|SSL_ST_ACCEPT:

229
			s->server=1;
230 231
			if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);

232
			if ((s->version>>8) != 3)
233
				{
B
Bodo Möller 已提交
234
				SSLerr(SSL_F_SSL3_ACCEPT, ERR_R_INTERNAL_ERROR);
235 236
				return -1;
				}
237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263
			s->type=SSL_ST_ACCEPT;

			if (s->init_buf == NULL)
				{
				if ((buf=BUF_MEM_new()) == NULL)
					{
					ret= -1;
					goto end;
					}
				if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
					{
					ret= -1;
					goto end;
					}
				s->init_buf=buf;
				}

			if (!ssl3_setup_buffers(s))
				{
				ret= -1;
				goto end;
				}

			s->init_num=0;

			if (s->state != SSL_ST_RENEGOTIATE)
				{
264 265 266 267 268
				/* Ok, we now need to push on a buffering BIO so that
				 * the output is sent in a way that TCP likes :-)
				 */
				if (!ssl_init_wbio_buffer(s,1)) { ret= -1; goto end; }
				
269
				ssl3_init_finished_mac(s);
270
				s->state=SSL3_ST_SR_CLNT_HELLO_A;
271
				s->ctx->stats.sess_accept++;
272
				}
273 274 275 276 277 278 279 280 281 282 283 284
			else if (!s->s3->send_connection_binding &&
				!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
				{
				/* Server attempting to renegotiate with
				 * client that doesn't support secure
				 * renegotiation.
				 */
				SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
				ret = -1;
				goto end;
				}
285 286
			else
				{
287 288
				/* s->state == SSL_ST_RENEGOTIATE,
				 * we will just send a HelloRequest */
289
				s->ctx->stats.sess_accept_renegotiate++;
290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308
				s->state=SSL3_ST_SW_HELLO_REQ_A;
				}
			break;

		case SSL3_ST_SW_HELLO_REQ_A:
		case SSL3_ST_SW_HELLO_REQ_B:

			s->shutdown=0;
			ret=ssl3_send_hello_request(s);
			if (ret <= 0) goto end;
			s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C;
			s->state=SSL3_ST_SW_FLUSH;
			s->init_num=0;

			ssl3_init_finished_mac(s);
			break;

		case SSL3_ST_SW_HELLO_REQ_C:
			s->state=SSL_ST_OK;
309
			break;
310 311 312 313 314 315 316 317

		case SSL3_ST_SR_CLNT_HELLO_A:
		case SSL3_ST_SR_CLNT_HELLO_B:
		case SSL3_ST_SR_CLNT_HELLO_C:

			s->shutdown=0;
			ret=ssl3_get_client_hello(s);
			if (ret <= 0) goto end;
318
			
319
			s->new_session = 2;
320 321 322 323 324 325 326 327
			s->state=SSL3_ST_SW_SRVR_HELLO_A;
			s->init_num=0;
			break;

		case SSL3_ST_SW_SRVR_HELLO_A:
		case SSL3_ST_SW_SRVR_HELLO_B:
			ret=ssl3_send_server_hello(s);
			if (ret <= 0) goto end;
D
Dr. Stephen Henson 已提交
328
#ifndef OPENSSL_NO_TLSEXT
329
			if (s->hit)
D
Dr. Stephen Henson 已提交
330 331 332 333 334 335 336 337 338 339
				{
				if (s->tlsext_ticket_expected)
					s->state=SSL3_ST_SW_SESSION_TICKET_A;
				else
					s->state=SSL3_ST_SW_CHANGE_A;
				}
#else
			if (s->hit)
					s->state=SSL3_ST_SW_CHANGE_A;
#endif
340 341 342 343 344 345 346
			else
				s->state=SSL3_ST_SW_CERT_A;
			s->init_num=0;
			break;

		case SSL3_ST_SW_CERT_A:
		case SSL3_ST_SW_CERT_B:
347 348
			/* Check if it is anon DH or anon ECDH, */
			/* normal PSK or KRB5 */
349 350 351
			if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
				&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)
				&& !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
352 353 354
				{
				ret=ssl3_send_server_certificate(s);
				if (ret <= 0) goto end;
355 356 357 358 359
#ifndef OPENSSL_NO_TLSEXT
				if (s->tlsext_status_expected)
					s->state=SSL3_ST_SW_CERT_STATUS_A;
				else
					s->state=SSL3_ST_SW_KEY_EXCH_A;
360
				}
361 362 363 364 365 366
			else
				{
				skip = 1;
				s->state=SSL3_ST_SW_KEY_EXCH_A;
				}
#else
367
				}
368 369
			else
				skip=1;
370

371
			s->state=SSL3_ST_SW_KEY_EXCH_A;
372
#endif
373 374 375 376 377
			s->init_num=0;
			break;

		case SSL3_ST_SW_KEY_EXCH_A:
		case SSL3_ST_SW_KEY_EXCH_B:
378
			alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
379 380 381

			/* clear this, it may get reset by
			 * send_server_key_exchange */
382
			if ((s->options & SSL_OP_EPHEMERAL_RSA)
383
#ifndef OPENSSL_NO_KRB5
384
				&& !(alg_k & SSL_kKRB5)
385
#endif /* OPENSSL_NO_KRB5 */
386
				)
B
Bodo Möller 已提交
387 388 389 390
				/* option SSL_OP_EPHEMERAL_RSA sends temporary RSA key
				 * even when forbidden by protocol specs
				 * (handshake may fail as clients are not required to
				 * be able to handle this) */
391 392 393 394
				s->s3->tmp.use_rsa_tmp=1;
			else
				s->s3->tmp.use_rsa_tmp=0;

B
Bodo Möller 已提交
395

396
			/* only send if a DH key exchange, fortezza or
B
Bodo Möller 已提交
397 398
			 * RSA but we have a sign only certificate
			 *
399 400
			 * PSK: may send PSK identity hints
			 *
B
Bodo Möller 已提交
401 402 403
			 * For ECC ciphersuites, we send a serverKeyExchange
			 * message only if the cipher suite is either
			 * ECDH-anon or ECDHE. In other cases, the
404
			 * server certificate contains the server's
B
Bodo Möller 已提交
405 406
			 * public key for key exchange.
			 */
407
			if (s->s3->tmp.use_rsa_tmp
408 409 410
			/* PSK: send ServerKeyExchange if PSK identity
			 * hint if provided */
#ifndef OPENSSL_NO_PSK
411
			    || ((alg_k & SSL_kPSK) && s->ctx->psk_identity_hint)
412
#endif
413 414 415
			    || (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH))
			    || (alg_k & SSL_kEECDH)
			    || ((alg_k & SSL_kRSA)
416
				&& (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
417 418
				    || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
					&& EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
419 420 421
					)
				    )
				)
422 423 424 425 426 427 428 429 430 431 432 433 434 435
			    )
				{
				ret=ssl3_send_server_key_exchange(s);
				if (ret <= 0) goto end;
				}
			else
				skip=1;

			s->state=SSL3_ST_SW_CERT_REQ_A;
			s->init_num=0;
			break;

		case SSL3_ST_SW_CERT_REQ_A:
		case SSL3_ST_SW_CERT_REQ_B:
436 437 438 439
			if (/* don't request cert unless asked for it: */
				!(s->verify_mode & SSL_VERIFY_PEER) ||
				/* if SSL_VERIFY_CLIENT_ONCE is set,
				 * don't request cert during re-negotiation: */
440
				((s->session->peer != NULL) &&
441 442 443 444
				 (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
				/* never request cert in anonymous ciphersuites
				 * (see section "Certificate request" in SSL 3 drafts
				 * and in RFC 2246): */
445
				((s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
446 447
				 /* ... except when the application insists on verification
				  * (against the specs, but s3_clnt.c accepts this for SSL 3) */
448
				 !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
449 450
				 /* never request cert in Kerberos ciphersuites */
				(s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5)
451 452
				/* With normal PSK Certificates and
				 * Certificate Requests are omitted */
453
				|| (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK))
454 455 456
				{
				/* no cert request */
				skip=1;
457
				s->s3->tmp.cert_request=0;
458 459 460 461
				s->state=SSL3_ST_SW_SRVR_DONE_A;
				}
			else
				{
462
				s->s3->tmp.cert_request=1;
463 464
				ret=ssl3_send_certificate_request(s);
				if (ret <= 0) goto end;
465
#ifndef NETSCAPE_HANG_BUG
466
				s->state=SSL3_ST_SW_SRVR_DONE_A;
467 468 469 470
#else
				s->state=SSL3_ST_SW_FLUSH;
				s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
#endif
471 472 473 474 475 476 477 478 479 480 481 482 483 484
				s->init_num=0;
				}
			break;

		case SSL3_ST_SW_SRVR_DONE_A:
		case SSL3_ST_SW_SRVR_DONE_B:
			ret=ssl3_send_server_done(s);
			if (ret <= 0) goto end;
			s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
			s->state=SSL3_ST_SW_FLUSH;
			s->init_num=0;
			break;
		
		case SSL3_ST_SW_FLUSH:
D
Dr. Stephen Henson 已提交
485 486 487 488 489 490 491 492 493

			/* This code originally checked to see if
			 * any data was pending using BIO_CTRL_INFO
			 * and then flushed. This caused problems
			 * as documented in PR#1939. The proposed
			 * fix doesn't completely resolve this issue
			 * as buggy implementations of BIO_CTRL_PENDING
			 * still exist. So instead we just flush
			 * unconditionally.
494 495
			 */

D
Dr. Stephen Henson 已提交
496 497
			s->rwstate=SSL_WRITING;
			if (BIO_flush(s->wbio) <= 0)
498
				{
D
Dr. Stephen Henson 已提交
499 500
				ret= -1;
				goto end;
501
				}
D
Dr. Stephen Henson 已提交
502
			s->rwstate=SSL_NOTHING;
503 504 505 506 507 508

			s->state=s->s3->tmp.next_state;
			break;

		case SSL3_ST_SR_CERT_A:
		case SSL3_ST_SR_CERT_B:
509
			/* Check for second client hello (MS SGC) */
510
			ret = ssl3_check_client_hello(s);
511 512 513 514
			if (ret <= 0)
				goto end;
			if (ret == 2)
				s->state = SSL3_ST_SR_CLNT_HELLO_C;
515
			else {
516 517 518 519 520
				if (s->s3->tmp.cert_request)
					{
					ret=ssl3_get_client_certificate(s);
					if (ret <= 0) goto end;
					}
521 522 523
				s->init_num=0;
				s->state=SSL3_ST_SR_KEY_EXCH_A;
			}
524 525 526 527 528
			break;

		case SSL3_ST_SR_KEY_EXCH_A:
		case SSL3_ST_SR_KEY_EXCH_B:
			ret=ssl3_get_client_key_exchange(s);
529
			if (ret <= 0)
B
Bodo Möller 已提交
530 531 532 533 534 535 536
				goto end;
			if (ret == 2)
				{
				/* For the ECDH ciphersuites when
				 * the client sends its ECDH pub key in
				 * a certificate, the CertificateVerify
				 * message is not sent.
537 538 539
				 * Also for GOST ciphersuites when
				 * the client uses its key from the certificate
				 * for key exchange.
B
Bodo Möller 已提交
540 541 542 543
				 */
				s->state=SSL3_ST_SR_FINISHED_A;
				s->init_num = 0;
				}
544
			else
B
Bodo Möller 已提交
545
				{
546 547
				int offset=0;
				int dgst_num;
548

B
Bodo Möller 已提交
549 550
				s->state=SSL3_ST_SR_CERT_VRFY_A;
				s->init_num=0;
551

B
Bodo Möller 已提交
552 553
				/* We need to get hashes here so if there is
				 * a client cert, it can be verified
554 555
				 * FIXME - digest processing for CertificateVerify
				 * should be generalized. But it is next step
556
				 */
557
				if (s->s3->handshake_buffer)
558 559
					if (!ssl3_digest_cached_records(s))
						return -1;
560 561 562
				for (dgst_num=0; dgst_num<SSL_MAX_DIGEST;dgst_num++)	
					if (s->s3->handshake_dgst[dgst_num]) 
						{
563 564
						int dgst_size;

565
						s->method->ssl3_enc->cert_verify_mac(s,EVP_MD_CTX_type(s->s3->handshake_dgst[dgst_num]),&(s->s3->tmp.cert_verify_md[offset]));
566 567 568 569 570 571 572
						dgst_size=EVP_MD_CTX_size(s->s3->handshake_dgst[dgst_num]);
						if (dgst_size < 0)
							{
							ret = -1;
							goto end;
							}
						offset+=dgst_size;
573
						}		
B
Bodo Möller 已提交
574
				}
575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590
			break;

		case SSL3_ST_SR_CERT_VRFY_A:
		case SSL3_ST_SR_CERT_VRFY_B:

			/* we should decide if we expected this one */
			ret=ssl3_get_cert_verify(s);
			if (ret <= 0) goto end;

			s->state=SSL3_ST_SR_FINISHED_A;
			s->init_num=0;
			break;

		case SSL3_ST_SR_FINISHED_A:
		case SSL3_ST_SR_FINISHED_B:
			ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
591
				SSL3_ST_SR_FINISHED_B);
592
			if (ret <= 0) goto end;
593
#ifndef OPENSSL_NO_TLSEXT
D
Dr. Stephen Henson 已提交
594
			if (s->tlsext_ticket_expected)
595
				s->state=SSL3_ST_SW_SESSION_TICKET_A;
D
Dr. Stephen Henson 已提交
596 597 598 599 600
			else if (s->hit)
				s->state=SSL_ST_OK;
#else
			if (s->hit)
				s->state=SSL_ST_OK;
601
#endif
602 603 604 605 606
			else
				s->state=SSL3_ST_SW_CHANGE_A;
			s->init_num=0;
			break;

607 608 609 610 611 612 613 614 615
#ifndef OPENSSL_NO_TLSEXT
		case SSL3_ST_SW_SESSION_TICKET_A:
		case SSL3_ST_SW_SESSION_TICKET_B:
			ret=ssl3_send_newsession_ticket(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_SW_CHANGE_A;
			s->init_num=0;
			break;

616 617 618 619 620 621 622 623
		case SSL3_ST_SW_CERT_STATUS_A:
		case SSL3_ST_SW_CERT_STATUS_B:
			ret=ssl3_send_cert_status(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_SW_KEY_EXCH_A;
			s->init_num=0;
			break;

624 625
#endif

626 627 628 629
		case SSL3_ST_SW_CHANGE_A:
		case SSL3_ST_SW_CHANGE_B:

			s->session->cipher=s->s3->tmp.new_cipher;
630 631
			if (!s->method->ssl3_enc->setup_key_block(s))
				{ ret= -1; goto end; }
632 633 634 635 636 637 638 639

			ret=ssl3_send_change_cipher_spec(s,
				SSL3_ST_SW_CHANGE_A,SSL3_ST_SW_CHANGE_B);

			if (ret <= 0) goto end;
			s->state=SSL3_ST_SW_FINISHED_A;
			s->init_num=0;

640
			if (!s->method->ssl3_enc->change_cipher_state(s,
641 642 643 644 645 646 647 648 649 650 651 652
				SSL3_CHANGE_CIPHER_SERVER_WRITE))
				{
				ret= -1;
				goto end;
				}

			break;

		case SSL3_ST_SW_FINISHED_A:
		case SSL3_ST_SW_FINISHED_B:
			ret=ssl3_send_finished(s,
				SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B,
653 654
				s->method->ssl3_enc->server_finished_label,
				s->method->ssl3_enc->server_finished_label_len);
655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671
			if (ret <= 0) goto end;
			s->state=SSL3_ST_SW_FLUSH;
			if (s->hit)
				s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
			else
				s->s3->tmp.next_state=SSL_ST_OK;
			s->init_num=0;
			break;

		case SSL_ST_OK:
			/* clean a few things up */
			ssl3_cleanup_key_block(s);

			BUF_MEM_free(s->init_buf);
			s->init_buf=NULL;

			/* remove buffering on output */
672
			ssl_free_wbio_buffer(s);
673 674 675

			s->init_num=0;

676
			if (s->new_session == 2) /* skipped if we just sent a HelloRequest */
677 678 679 680 681 682 683 684 685 686 687
				{
				/* actually not necessarily a 'new' session unless
				 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */
				
				s->new_session=0;
				
				ssl_update_cache(s,SSL_SESS_CACHE_SERVER);
				
				s->ctx->stats.sess_accept_good++;
				/* s->server=1; */
				s->handshake_func=ssl3_accept;
688

689 690 691
				if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
				}
			
692
			ret = 1;
693
			goto end;
694
			/* break; */
695 696 697 698 699

		default:
			SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_UNKNOWN_STATE);
			ret= -1;
			goto end;
700
			/* break; */
701 702 703 704
			}
		
		if (!s->s3->tmp.reuse_message && !skip)
			{
705 706 707 708 709 710
			if (s->debug)
				{
				if ((ret=BIO_flush(s->wbio)) <= 0)
					goto end;
				}

711 712 713 714 715 716 717 718 719 720 721 722 723 724

			if ((cb != NULL) && (s->state != state))
				{
				new_state=s->state;
				s->state=state;
				cb(s,SSL_CB_ACCEPT_LOOP,1);
				s->state=new_state;
				}
			}
		skip=0;
		}
end:
	/* BIO_flush(s->wbio); */

725
	s->in_handshake--;
726 727 728 729 730
	if (cb != NULL)
		cb(s,SSL_CB_ACCEPT_EXIT,ret);
	return(ret);
	}

B
Ben Laurie 已提交
731
int ssl3_send_hello_request(SSL *s)
732 733 734 735 736 737
	{
	unsigned char *p;

	if (s->state == SSL3_ST_SW_HELLO_REQ_A)
		{
		p=(unsigned char *)s->init_buf->data;
738
		*(p++)=SSL3_MT_HELLO_REQUEST;
739 740 741 742 743 744 745 746 747 748 749 750 751 752
		*(p++)=0;
		*(p++)=0;
		*(p++)=0;

		s->state=SSL3_ST_SW_HELLO_REQ_B;
		/* number of bytes to write */
		s->init_num=4;
		s->init_off=0;
		}

	/* SSL3_ST_SW_HELLO_REQ_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}

B
Ben Laurie 已提交
753
int ssl3_check_client_hello(SSL *s)
754 755 756 757
	{
	int ok;
	long n;

B
Bodo Möller 已提交
758 759
	/* this function is called when we really expect a Certificate message,
	 * so permit appropriate message length */
B
Ben Laurie 已提交
760
	n=s->method->ssl_get_message(s,
761 762 763
		SSL3_ST_SR_CERT_A,
		SSL3_ST_SR_CERT_B,
		-1,
764
		s->max_cert_list,
765 766 767
		&ok);
	if (!ok) return((int)n);
	s->s3->tmp.reuse_message = 1;
B
Bodo Möller 已提交
768 769 770 771 772 773
	if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
		{
		/* Throw away what we have done so far in the current handshake,
		 * which will now be aborted. (A full SSL_clear would be too much.)
		 * I hope that tmp.dh is the only thing that may need to be cleared
		 * when a handshake is not completed ... */
774
#ifndef OPENSSL_NO_DH
B
Bodo Möller 已提交
775 776 777 778 779 780 781 782
		if (s->s3->tmp.dh != NULL)
			{
			DH_free(s->s3->tmp.dh);
			s->s3->tmp.dh = NULL;
			}
#endif
		return 2;
		}
783 784 785
	return 1;
}

B
Ben Laurie 已提交
786
int ssl3_get_client_hello(SSL *s)
787 788
	{
	int i,j,ok,al,ret= -1;
789
	unsigned int cookie_len;
790 791
	long n;
	unsigned long id;
792
	unsigned char *p,*d,*q;
793
	SSL_CIPHER *c;
794
#ifndef OPENSSL_NO_COMP
795
	SSL_COMP *comp=NULL;
796
#endif
B
Ben Laurie 已提交
797
	STACK_OF(SSL_CIPHER) *ciphers=NULL;
798

799 800 801 802 803 804
	/* We do this so that we will respond with our native type.
	 * If we are TLSv1 and we get SSLv3, we will respond with TLSv1,
	 * This down switching should be handled by a different method.
	 * If we are SSLv3, we will respond with SSLv3, even if prompted with
	 * TLSv1.
	 */
805 806 807 808
	if (s->state == SSL3_ST_SR_CLNT_HELLO_A)
		{
		s->state=SSL3_ST_SR_CLNT_HELLO_B;
		}
809
	s->first_packet=1;
B
Ben Laurie 已提交
810
	n=s->method->ssl_get_message(s,
811 812 813 814 815 816 817
		SSL3_ST_SR_CLNT_HELLO_B,
		SSL3_ST_SR_CLNT_HELLO_C,
		SSL3_MT_CLIENT_HELLO,
		SSL3_RT_MAX_PLAIN_LENGTH,
		&ok);

	if (!ok) return((int)n);
818
	s->first_packet=0;
819
	d=p=(unsigned char *)s->init_msg;
820

821 822 823
	/* use version from inside client hello, not from record header
	 * (may differ: see RFC 2246, Appendix E, second paragraph) */
	s->client_version=(((int)p[0])<<8)|(int)p[1];
824 825
	p+=2;

826 827
	if ((s->version == DTLS1_VERSION && s->client_version > s->version) ||
	    (s->version != DTLS1_VERSION && s->client_version < s->version))
828 829
		{
		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
830
		if ((s->client_version>>8) == SSL3_VERSION_MAJOR)
831 832 833 834 835 836 837 838
			{
			/* similar to ssl3_get_record, send alert using remote version number */
			s->version = s->client_version;
			}
		al = SSL_AD_PROTOCOL_VERSION;
		goto f_err;
		}

D
Dr. Stephen Henson 已提交
839 840 841 842 843 844 845 846 847 848 849
	/* If we require cookies and this ClientHello doesn't
	 * contain one, just return since we do not want to
	 * allocate any memory yet. So check cookie length...
	 */
	if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE)
		{
		unsigned int session_length, cookie_length;
		
		session_length = *(p + SSL3_RANDOM_SIZE);
		cookie_length = *(p + SSL3_RANDOM_SIZE + session_length + 1);

D
Dr. Stephen Henson 已提交
850
		if (cookie_length == 0)
D
Dr. Stephen Henson 已提交
851 852 853
			return 1;
		}

854 855 856 857 858 859 860 861
	/* load the client random */
	memcpy(s->s3->client_random,p,SSL3_RANDOM_SIZE);
	p+=SSL3_RANDOM_SIZE;

	/* get the session-id */
	j= *(p++);

	s->hit=0;
862 863 864 865 866 867 868 869
	/* Versions before 0.9.7 always allow session reuse during renegotiation
	 * (i.e. when s->new_session is true), option
	 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is new with 0.9.7.
	 * Maybe this optional behaviour should always have been the default,
	 * but we cannot safely change the default behaviour (or new applications
	 * might be written that become totally unsecure when compiled with
	 * an earlier library version)
	 */
870
	if ((s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
871 872 873 874 875 876
		{
		if (!ssl_get_new_session(s,1))
			goto err;
		}
	else
		{
877
		i=ssl_get_prev_session(s, p, j, d + n);
878 879 880 881
		if (i == 1)
			{ /* previous session */
			s->hit=1;
			}
882 883 884
		else if (i == -1)
			goto err;
		else /* i == 0 */
885 886 887 888 889 890 891
			{
			if (!ssl_get_new_session(s,1))
				goto err;
			}
		}

	p+=j;
B
Ben Laurie 已提交
892

D
Dr. Stephen Henson 已提交
893
	if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
B
Ben Laurie 已提交
894 895 896 897
		{
		/* cookie stuff */
		cookie_len = *(p++);

B
Bodo Möller 已提交
898 899 900 901 902
		/* 
		 * The ClientHello may contain a cookie even if the
		 * HelloVerify message has not been sent--make sure that it
		 * does not cause an overflow.
		 */
B
Ben Laurie 已提交
903 904 905
		if ( cookie_len > sizeof(s->d1->rcvd_cookie))
			{
			/* too much data */
B
Bodo Möller 已提交
906
			al = SSL_AD_DECODE_ERROR;
B
Ben Laurie 已提交
907 908 909 910
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
			goto f_err;
			}

B
Bodo Möller 已提交
911
		/* verify the cookie if appropriate option is set. */
D
Dr. Stephen Henson 已提交
912
		if ((SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) &&
B
Bodo Möller 已提交
913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936
			cookie_len > 0)
			{
			memcpy(s->d1->rcvd_cookie, p, cookie_len);

			if ( s->ctx->app_verify_cookie_cb != NULL)
				{
				if ( s->ctx->app_verify_cookie_cb(s, s->d1->rcvd_cookie,
					cookie_len) == 0)
					{
					al=SSL_AD_HANDSHAKE_FAILURE;
					SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 
						SSL_R_COOKIE_MISMATCH);
					goto f_err;
					}
				/* else cookie verification succeeded */
				}
			else if ( memcmp(s->d1->rcvd_cookie, s->d1->cookie, 
						  s->d1->cookie_len) != 0) /* default verification */
				{
					al=SSL_AD_HANDSHAKE_FAILURE;
					SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 
						SSL_R_COOKIE_MISMATCH);
					goto f_err;
				}
D
Dr. Stephen Henson 已提交
937 938

			ret = 2;
B
Bodo Möller 已提交
939 940 941
			}

		p += cookie_len;
B
Ben Laurie 已提交
942 943
		}

944 945 946 947
	n2s(p,i);
	if ((i == 0) && (j != 0))
		{
		/* we need a cipher if we are not resuming a session */
948
		al=SSL_AD_ILLEGAL_PARAMETER;
949 950 951
		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_SPECIFIED);
		goto f_err;
		}
952
	if ((p+i) >= (d+n))
953 954
		{
		/* not enough data */
955
		al=SSL_AD_DECODE_ERROR;
956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971
		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	if ((i > 0) && (ssl_bytes_to_cipher_list(s,p,i,&(ciphers))
		== NULL))
		{
		goto err;
		}
	p+=i;

	/* If it is a hit, check that the cipher is in the list */
	if ((s->hit) && (i > 0))
		{
		j=0;
		id=s->session->cipher->id;

972 973 974
#ifdef CIPHER_DEBUG
		printf("client sent %d ciphers\n",sk_num(ciphers));
#endif
B
Ben Laurie 已提交
975
		for (i=0; i<sk_SSL_CIPHER_num(ciphers); i++)
976
			{
B
Ben Laurie 已提交
977
			c=sk_SSL_CIPHER_value(ciphers,i);
978 979 980 981
#ifdef CIPHER_DEBUG
			printf("client [%2d of %2d]:%s\n",
				i,sk_num(ciphers),SSL_CIPHER_get_name(c));
#endif
982 983 984 985 986 987
			if (c->id == id)
				{
				j=1;
				break;
				}
			}
988
		if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
989
			{
990 991 992 993 994 995 996
			/* Special case as client bug workaround: the previously used cipher may
			 * not be in the current list, the client instead might be trying to
			 * continue using a cipher that before wasn't chosen due to server
			 * preferences.  We'll have to reject the connection if the cipher is not
			 * enabled, though. */
			c = sk_SSL_CIPHER_value(ciphers, 0);
			if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0)
997
				{
998 999
				s->session->cipher = c;
				j = 1;
1000 1001
				}
			}
1002 1003 1004 1005 1006 1007 1008 1009
		if (j == 0)
			{
			/* we need to have the cipher in the cipher
			 * list if we are asked to reuse it */
			al=SSL_AD_ILLEGAL_PARAMETER;
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
			goto f_err;
			}
1010 1011 1012 1013
		}

	/* compression */
	i= *(p++);
1014 1015 1016 1017 1018 1019 1020
	if ((p+i) > (d+n))
		{
		/* not enough data */
		al=SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
1021
	q=p;
1022
	for (j=0; j<i; j++)
1023
		{
1024
		if (p[j] == 0) break;
1025
		}
1026 1027 1028 1029 1030

	p+=i;
	if (j >= i)
		{
		/* no compress */
1031
		al=SSL_AD_DECODE_ERROR;
1032 1033 1034 1035
		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_COMPRESSION_SPECIFIED);
		goto f_err;
		}

1036 1037
#ifndef OPENSSL_NO_TLSEXT
	/* TLS extensions*/
1038
	if (s->version >= SSL3_VERSION)
1039 1040 1041 1042
		{
		if (!ssl_parse_clienthello_tlsext(s,&p,d,n, &al))
			{
			/* 'al' set by ssl_parse_clienthello_tlsext */
1043
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_PARSE_TLSEXT);
1044 1045 1046
			goto f_err;
			}
		}
1047
		if (ssl_check_clienthello_tlsext(s) <= 0) {
B
Bodo Möller 已提交
1048
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
1049 1050
			goto err;
		}
D
Dr. Stephen Henson 已提交
1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103

	/* Check if we want to use external pre-shared secret for this
	 * handshake for not reused session only. We need to generate
	 * server_random before calling tls_session_secret_cb in order to allow
	 * SessionTicket processing to use it in key derivation. */
	{
		unsigned long Time;
		unsigned char *pos;
		Time=(unsigned long)time(NULL);			/* Time */
		pos=s->s3->server_random;
		l2n(Time,pos);
		if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)
			{
			al=SSL_AD_INTERNAL_ERROR;
			goto f_err;
			}
	}

	if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb)
		{
		SSL_CIPHER *pref_cipher=NULL;

		s->session->master_key_length=sizeof(s->session->master_key);
		if(s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length,
			ciphers, &pref_cipher, s->tls_session_secret_cb_arg))
			{
			s->hit=1;
			s->session->ciphers=ciphers;
			s->session->verify_result=X509_V_OK;

			ciphers=NULL;

			/* check if some cipher was preferred by call back */
			pref_cipher=pref_cipher ? pref_cipher : ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s));
			if (pref_cipher == NULL)
				{
				al=SSL_AD_HANDSHAKE_FAILURE;
				SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER);
				goto f_err;
				}

			s->session->cipher=pref_cipher;

			if (s->cipher_list)
				sk_SSL_CIPHER_free(s->cipher_list);

			if (s->cipher_list_by_id)
				sk_SSL_CIPHER_free(s->cipher_list_by_id);

			s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
			s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers);
			}
		}
1104 1105
#endif

1106 1107 1108 1109
	/* Worst case, we will use the NULL compression, but if we have other
	 * options, we will now look for them.  We have i-1 compression
	 * algorithms from the client, starting at q. */
	s->s3->tmp.new_compression=NULL;
1110
#ifndef OPENSSL_NO_COMP
1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154
	/* This only happens if we have a cache hit */
	if (s->session->compress_meth != 0)
		{
		int m, comp_id = s->session->compress_meth;
		/* Perform sanity checks on resumed compression algorithm */
		/* Can't disable compression */
		if (s->options & SSL_OP_NO_COMPRESSION)
			{
			al=SSL_AD_INTERNAL_ERROR;
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INCONSISTENT_COMPRESSION);
			goto f_err;
			}
		/* Look for resumed compression method */
		for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++)
			{
			comp=sk_SSL_COMP_value(s->ctx->comp_methods,m);
			if (comp_id == comp->id)
				{
				s->s3->tmp.new_compression=comp;
				break;
				}
			}
		if (s->s3->tmp.new_compression == NULL)
			{
			al=SSL_AD_INTERNAL_ERROR;
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INVALID_COMPRESSION_ALGORITHM);
			goto f_err;
			}
		/* Look for resumed method in compression list */
		for (m = 0; m < i; m++)
			{
			if (q[m] == comp_id)
				break;
			}
		if (m >= i)
			{
			al=SSL_AD_ILLEGAL_PARAMETER;
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING);
			goto f_err;
			}
		}
	else if (s->hit)
		comp = NULL;
	else if (!(s->options & SSL_OP_NO_COMPRESSION) && s->ctx->comp_methods)
1155 1156 1157
		{ /* See if we have a match */
		int m,nn,o,v,done=0;

B
Ben Laurie 已提交
1158
		nn=sk_SSL_COMP_num(s->ctx->comp_methods);
1159 1160
		for (m=0; m<nn; m++)
			{
B
Ben Laurie 已提交
1161
			comp=sk_SSL_COMP_value(s->ctx->comp_methods,m);
1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177
			v=comp->id;
			for (o=0; o<i; o++)
				{
				if (v == q[o])
					{
					done=1;
					break;
					}
				}
			if (done) break;
			}
		if (done)
			s->s3->tmp.new_compression=comp;
		else
			comp=NULL;
		}
1178 1179 1180 1181
#else
	/* If compression is disabled we'd better not try to resume a session
	 * using compression.
	 */
1182
	if (s->session->compress_meth != 0)
1183 1184 1185 1186 1187
		{
		al=SSL_AD_INTERNAL_ERROR;
		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INCONSISTENT_COMPRESSION);
		goto f_err;
		}
1188
#endif
1189

1190
	/* Given s->session->ciphers and SSL_get_ciphers, we must
1191 1192 1193 1194
	 * pick a cipher */

	if (!s->hit)
		{
1195 1196 1197
#ifdef OPENSSL_NO_COMP
		s->session->compress_meth=0;
#else
1198
		s->session->compress_meth=(comp == NULL)?0:comp->id;
1199
#endif
1200
		if (s->session->ciphers != NULL)
B
Ben Laurie 已提交
1201
			sk_SSL_CIPHER_free(s->session->ciphers);
1202 1203 1204
		s->session->ciphers=ciphers;
		if (ciphers == NULL)
			{
1205
			al=SSL_AD_ILLEGAL_PARAMETER;
1206 1207 1208 1209 1210
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_PASSED);
			goto f_err;
			}
		ciphers=NULL;
		c=ssl3_choose_cipher(s,s->session->ciphers,
1211
				     SSL_get_ciphers(s));
1212 1213 1214

		if (c == NULL)
			{
1215
			al=SSL_AD_HANDSHAKE_FAILURE;
1216 1217 1218 1219 1220 1221 1222 1223 1224
			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER);
			goto f_err;
			}
		s->s3->tmp.new_cipher=c;
		}
	else
		{
		/* Session-id reuse */
#ifdef REUSE_CIPHER_BUG
B
Ben Laurie 已提交
1225
		STACK_OF(SSL_CIPHER) *sk;
1226 1227 1228
		SSL_CIPHER *nc=NULL;
		SSL_CIPHER *ec=NULL;

1229
		if (s->options & SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG)
1230 1231
			{
			sk=s->session->ciphers;
B
Ben Laurie 已提交
1232
			for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
1233
				{
B
Ben Laurie 已提交
1234
				c=sk_SSL_CIPHER_value(sk,i);
1235
				if (c->algorithm_enc & SSL_eNULL)
1236
					nc=c;
1237
				if (SSL_C_IS_EXPORT(c))
1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250
					ec=c;
				}
			if (nc != NULL)
				s->s3->tmp.new_cipher=nc;
			else if (ec != NULL)
				s->s3->tmp.new_cipher=ec;
			else
				s->s3->tmp.new_cipher=s->session->cipher;
			}
		else
#endif
		s->s3->tmp.new_cipher=s->session->cipher;
		}
1251

1252 1253
	if (!ssl3_digest_cached_records(s))
		goto f_err;
1254 1255 1256 1257 1258 1259 1260 1261
	
	/* we now have the following setup. 
	 * client_random
	 * cipher_list 		- our prefered list of ciphers
	 * ciphers 		- the clients prefered list of ciphers
	 * compression		- basically ignored right now
	 * ssl version is set	- sslv3
	 * s->session		- The ssl session has been setup.
U
Ulf Möller 已提交
1262
	 * s->hit		- session reuse flag
1263 1264 1265
	 * s->tmp.new_cipher	- the new cipher to use.
	 */

D
Dr. Stephen Henson 已提交
1266
	if (ret < 0) ret=1;
1267 1268 1269 1270 1271 1272
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
err:
B
Ben Laurie 已提交
1273
	if (ciphers != NULL) sk_SSL_CIPHER_free(ciphers);
1274 1275 1276
	return(ret);
	}

B
Ben Laurie 已提交
1277
int ssl3_send_server_hello(SSL *s)
1278 1279 1280 1281
	{
	unsigned char *buf;
	unsigned char *p,*d;
	int i,sl;
D
Dr. Stephen Henson 已提交
1282 1283 1284 1285
	unsigned long l;
#ifdef OPENSSL_NO_TLSEXT
	unsigned long Time;
#endif
1286 1287 1288 1289

	if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
		{
		buf=(unsigned char *)s->init_buf->data;
D
Dr. Stephen Henson 已提交
1290
#ifdef OPENSSL_NO_TLSEXT
1291
		p=s->s3->server_random;
D
Dr. Stephen Henson 已提交
1292
		/* Generate server_random if it was not needed previously */
D
Dr. Stephen Henson 已提交
1293
		Time=(unsigned long)time(NULL);			/* Time */
1294
		l2n(Time,p);
1295 1296
		if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
			return -1;
D
Dr. Stephen Henson 已提交
1297
#endif
1298 1299 1300
		/* Do the message type and length last */
		d=p= &(buf[4]);

1301 1302
		*(p++)=s->version>>8;
		*(p++)=s->version&0xff;
1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313

		/* Random stuff */
		memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
		p+=SSL3_RANDOM_SIZE;

		/* now in theory we have 3 options to sending back the
		 * session id.  If it is a re-use, we send back the
		 * old session-id, if it is a new session, we send
		 * back the new session-id or we send back a 0 length
		 * session-id if we want it to be single use.
		 * Currently I will not implement the '0' length session-id
1314
		 * 12-Jan-98 - I'll now support the '0' length stuff.
1315 1316 1317 1318 1319 1320 1321
		 *
		 * We also have an additional case where stateless session
		 * resumption is successful: we always send back the old
		 * session id. In this case s->hit is non zero: this can
		 * only happen if stateless session resumption is succesful
		 * if session caching is disabled so existing functionality
		 * is unaffected.
1322
		 */
1323 1324
		if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
			&& !s->hit)
1325
			s->session->session_id_length=0;
1326 1327

		sl=s->session->session_id_length;
1328
		if (sl > (int)sizeof(s->session->session_id))
B
Bodo Möller 已提交
1329 1330 1331 1332
			{
			SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
			return -1;
			}
1333 1334 1335 1336 1337 1338 1339 1340 1341
		*(p++)=sl;
		memcpy(p,s->session->session_id,sl);
		p+=sl;

		/* put the cipher */
		i=ssl3_put_cipher_by_char(s->s3->tmp.new_cipher,p);
		p+=i;

		/* put the compression method */
1342 1343 1344
#ifdef OPENSSL_NO_COMP
			*(p++)=0;
#else
1345 1346 1347 1348
		if (s->s3->tmp.new_compression == NULL)
			*(p++)=0;
		else
			*(p++)=s->s3->tmp.new_compression->id;
1349
#endif
1350
#ifndef OPENSSL_NO_TLSEXT
1351 1352 1353 1354 1355
		if (ssl_prepare_serverhello_tlsext(s) <= 0)
			{
			SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);
			return -1;
			}
1356 1357
		if ((p = ssl_add_serverhello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
			{
1358 1359
			SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO,ERR_R_INTERNAL_ERROR);
			return -1;
1360
			}
1361
#endif
1362 1363 1364 1365 1366 1367
		/* do the header */
		l=(p-d);
		d=buf;
		*(d++)=SSL3_MT_SERVER_HELLO;
		l2n3(l,d);

B
oops  
Bodo Möller 已提交
1368
		s->state=SSL3_ST_SW_SRVR_HELLO_B;
1369 1370 1371 1372 1373
		/* number of bytes to write */
		s->init_num=p-buf;
		s->init_off=0;
		}

B
oops  
Bodo Möller 已提交
1374
	/* SSL3_ST_SW_SRVR_HELLO_B */
1375 1376 1377
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}

B
Ben Laurie 已提交
1378
int ssl3_send_server_done(SSL *s)
1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397
	{
	unsigned char *p;

	if (s->state == SSL3_ST_SW_SRVR_DONE_A)
		{
		p=(unsigned char *)s->init_buf->data;

		/* do the header */
		*(p++)=SSL3_MT_SERVER_DONE;
		*(p++)=0;
		*(p++)=0;
		*(p++)=0;

		s->state=SSL3_ST_SW_SRVR_DONE_B;
		/* number of bytes to write */
		s->init_num=4;
		s->init_off=0;
		}

B
Bodo Möller 已提交
1398
	/* SSL3_ST_SW_SRVR_DONE_B */
1399 1400 1401
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}

B
Ben Laurie 已提交
1402
int ssl3_send_server_key_exchange(SSL *s)
1403
	{
1404
#ifndef OPENSSL_NO_RSA
1405 1406 1407 1408
	unsigned char *q;
	int j,num;
	RSA *rsa;
	unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
B
Ben Laurie 已提交
1409
	unsigned int u;
1410
#endif
1411
#ifndef OPENSSL_NO_DH
1412
	DH *dh=NULL,*dhp;
B
Bodo Möller 已提交
1413 1414 1415 1416 1417 1418 1419
#endif
#ifndef OPENSSL_NO_ECDH
	EC_KEY *ecdh=NULL, *ecdhp;
	unsigned char *encodedPoint = NULL;
	int encodedlen = 0;
	int curve_id = 0;
	BN_CTX *bn_ctx = NULL; 
1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431
#endif
	EVP_PKEY *pkey;
	unsigned char *p,*d;
	int al,i;
	unsigned long type;
	int n;
	CERT *cert;
	BIGNUM *r[4];
	int nr[4],kn;
	BUF_MEM *buf;
	EVP_MD_CTX md_ctx;

1432
	EVP_MD_CTX_init(&md_ctx);
1433 1434
	if (s->state == SSL3_ST_SW_KEY_EXCH_A)
		{
1435
		type=s->s3->tmp.new_cipher->algorithm_mkey;
1436
		cert=s->cert;
1437 1438 1439 1440 1441

		buf=s->init_buf;

		r[0]=r[1]=r[2]=r[3]=NULL;
		n=0;
1442
#ifndef OPENSSL_NO_RSA
1443 1444 1445
		if (type & SSL_kRSA)
			{
			rsa=cert->rsa_tmp;
1446
			if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL))
1447
				{
1448
				rsa=s->cert->rsa_tmp_cb(s,
B
Ben Laurie 已提交
1449
				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1450
				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
1451 1452 1453 1454 1455 1456
				if(rsa == NULL)
				{
					al=SSL_AD_HANDSHAKE_FAILURE;
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
					goto f_err;
				}
1457
				RSA_up_ref(rsa);
1458 1459 1460 1461
				cert->rsa_tmp=rsa;
				}
			if (rsa == NULL)
				{
1462
				al=SSL_AD_HANDSHAKE_FAILURE;
1463 1464 1465 1466 1467 1468 1469 1470 1471
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY);
				goto f_err;
				}
			r[0]=rsa->n;
			r[1]=rsa->e;
			s->s3->tmp.use_rsa_tmp=1;
			}
		else
#endif
1472
#ifndef OPENSSL_NO_DH
1473 1474 1475
			if (type & SSL_kEDH)
			{
			dhp=cert->dh_tmp;
1476 1477
			if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
				dhp=s->cert->dh_tmp_cb(s,
1478
				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1479
				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
1480 1481
			if (dhp == NULL)
				{
1482
				al=SSL_AD_HANDSHAKE_FAILURE;
1483 1484 1485
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
				goto f_err;
				}
1486 1487 1488 1489

			if (s->s3->tmp.dh != NULL)
				{
				DH_free(dh);
B
Bodo Möller 已提交
1490
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
1491 1492 1493
				goto err;
				}

1494 1495 1496 1497 1498 1499 1500
			if ((dh=DHparams_dup(dhp)) == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
				goto err;
				}

			s->s3->tmp.dh=dh;
B
Ben Laurie 已提交
1501 1502 1503
			if ((dhp->pub_key == NULL ||
			     dhp->priv_key == NULL ||
			     (s->options & SSL_OP_SINGLE_DH_USE)))
1504
				{
B
Ben Laurie 已提交
1505 1506 1507 1508 1509 1510
				if(!DH_generate_key(dh))
				    {
				    SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
					   ERR_R_DH_LIB);
				    goto err;
				    }
1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528
				}
			else
				{
				dh->pub_key=BN_dup(dhp->pub_key);
				dh->priv_key=BN_dup(dhp->priv_key);
				if ((dh->pub_key == NULL) ||
					(dh->priv_key == NULL))
					{
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
					goto err;
					}
				}
			r[0]=dh->p;
			r[1]=dh->g;
			r[2]=dh->pub_key;
			}
		else 
#endif
B
Bodo Möller 已提交
1529
#ifndef OPENSSL_NO_ECDH
1530
			if (type & SSL_kEECDH)
B
Bodo Möller 已提交
1531
			{
N
Nils Larsch 已提交
1532 1533
			const EC_GROUP *group;

B
Bodo Möller 已提交
1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562
			ecdhp=cert->ecdh_tmp;
			if ((ecdhp == NULL) && (s->cert->ecdh_tmp_cb != NULL))
				{
				ecdhp=s->cert->ecdh_tmp_cb(s,
				      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
				      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
				}
			if (ecdhp == NULL)
				{
				al=SSL_AD_HANDSHAKE_FAILURE;
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_ECDH_KEY);
				goto f_err;
				}

			if (s->s3->tmp.ecdh != NULL)
				{
				EC_KEY_free(s->s3->tmp.ecdh); 
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
				goto err;
				}

			/* Duplicate the ECDH structure. */
			if (ecdhp == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
				goto err;
				}
			if (!EC_KEY_up_ref(ecdhp))
				{
1563
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
B
Bodo Möller 已提交
1564 1565 1566 1567 1568
				goto err;
				}
			ecdh = ecdhp;

			s->s3->tmp.ecdh=ecdh;
N
Nils Larsch 已提交
1569 1570
			if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
			    (EC_KEY_get0_private_key(ecdh) == NULL) ||
B
Bodo Möller 已提交
1571 1572 1573 1574 1575 1576 1577 1578 1579
			    (s->options & SSL_OP_SINGLE_ECDH_USE))
				{
				if(!EC_KEY_generate_key(ecdh))
				    {
				    SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
				    goto err;
				    }
				}

N
Nils Larsch 已提交
1580 1581 1582
			if (((group = EC_KEY_get0_group(ecdh)) == NULL) ||
			    (EC_KEY_get0_public_key(ecdh)  == NULL) ||
			    (EC_KEY_get0_private_key(ecdh) == NULL))
B
Bodo Möller 已提交
1583 1584 1585 1586 1587 1588
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
				goto err;
				}

			if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
N
Nils Larsch 已提交
1589
			    (EC_GROUP_get_degree(group) > 163)) 
B
Bodo Möller 已提交
1590 1591 1592 1593 1594 1595 1596 1597 1598 1599
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
				goto err;
				}

			/* XXX: For now, we only support ephemeral ECDH
			 * keys over named (not generic) curves. For 
			 * supported named curves, curve_id is non-zero.
			 */
			if ((curve_id = 
1600
			    tls1_ec_nid2curve_id(EC_GROUP_get_curve_name(group)))
B
Bodo Möller 已提交
1601 1602 1603 1604 1605 1606 1607 1608 1609 1610
			    == 0)
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
				goto err;
				}

			/* Encode the public key.
			 * First check the size of encoding and
			 * allocate memory accordingly.
			 */
N
Nils Larsch 已提交
1611 1612
			encodedlen = EC_POINT_point2oct(group, 
			    EC_KEY_get0_public_key(ecdh),
B
Bodo Möller 已提交
1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625
			    POINT_CONVERSION_UNCOMPRESSED, 
			    NULL, 0, NULL);

			encodedPoint = (unsigned char *) 
			    OPENSSL_malloc(encodedlen*sizeof(unsigned char)); 
			bn_ctx = BN_CTX_new();
			if ((encodedPoint == NULL) || (bn_ctx == NULL))
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
				goto err;
				}


N
Nils Larsch 已提交
1626 1627
			encodedlen = EC_POINT_point2oct(group, 
			    EC_KEY_get0_public_key(ecdh), 
B
Bodo Möller 已提交
1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640
			    POINT_CONVERSION_UNCOMPRESSED, 
			    encodedPoint, encodedlen, bn_ctx);

			if (encodedlen == 0) 
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
				goto err;
				}

			BN_CTX_free(bn_ctx);  bn_ctx=NULL;

			/* XXX: For now, we only support named (not 
			 * generic) curves in ECDH ephemeral key exchanges.
B
Bodo Möller 已提交
1641
			 * In this situation, we need four additional bytes
B
Bodo Möller 已提交
1642 1643 1644
			 * to encode the entire ServerECDHParams
			 * structure. 
			 */
B
Bodo Möller 已提交
1645
			n = 4 + encodedlen;
B
Bodo Möller 已提交
1646 1647 1648 1649 1650 1651 1652

			/* We'll generate the serverKeyExchange message
			 * explicitly so we can set these to NULLs
			 */
			r[0]=NULL;
			r[1]=NULL;
			r[2]=NULL;
B
Bodo Möller 已提交
1653
			r[3]=NULL;
B
Bodo Möller 已提交
1654 1655 1656
			}
		else 
#endif /* !OPENSSL_NO_ECDH */
1657 1658 1659 1660 1661 1662 1663 1664
#ifndef OPENSSL_NO_PSK
			if (type & SSL_kPSK)
				{
				/* reserve size for record length and PSK identity hint*/
				n+=2+strlen(s->ctx->psk_identity_hint);
				}
			else
#endif /* !OPENSSL_NO_PSK */
1665
			{
1666
			al=SSL_AD_HANDSHAKE_FAILURE;
1667 1668 1669 1670 1671 1672 1673 1674 1675
			SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
			goto f_err;
			}
		for (i=0; r[i] != NULL; i++)
			{
			nr[i]=BN_num_bytes(r[i]);
			n+=2+nr[i];
			}

1676 1677
		if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
			&& !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK))
1678 1679 1680 1681
			{
			if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))
				== NULL)
				{
1682
				al=SSL_AD_DECODE_ERROR;
1683 1684 1685 1686 1687 1688 1689 1690 1691 1692
				goto f_err;
				}
			kn=EVP_PKEY_size(pkey);
			}
		else
			{
			pkey=NULL;
			kn=0;
			}

1693
		if (!BUF_MEM_grow_clean(buf,n+4+kn))
1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707
			{
			SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF);
			goto err;
			}
		d=(unsigned char *)s->init_buf->data;
		p= &(d[4]);

		for (i=0; r[i] != NULL; i++)
			{
			s2n(nr[i],p);
			BN_bn2bin(r[i],p);
			p+=nr[i];
			}

B
Bodo Möller 已提交
1708
#ifndef OPENSSL_NO_ECDH
1709
		if (type & SSL_kEECDH) 
B
Bodo Möller 已提交
1710 1711 1712
			{
			/* XXX: For now, we only support named (not generic) curves.
			 * In this situation, the serverKeyExchange message has:
B
Bodo Möller 已提交
1713
			 * [1 byte CurveType], [2 byte CurveName]
B
Bodo Möller 已提交
1714 1715 1716 1717 1718
			 * [1 byte length of encoded point], followed by
			 * the actual encoded point itself
			 */
			*p = NAMED_CURVE_TYPE;
			p += 1;
B
Bodo Möller 已提交
1719 1720
			*p = 0;
			p += 1;
B
Bodo Möller 已提交
1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732
			*p = curve_id;
			p += 1;
			*p = encodedlen;
			p += 1;
			memcpy((unsigned char*)p, 
			    (unsigned char *)encodedPoint, 
			    encodedlen);
			OPENSSL_free(encodedPoint);
			p += encodedlen;
			}
#endif

1733 1734 1735 1736 1737
#ifndef OPENSSL_NO_PSK
		if (type & SSL_kPSK)
			{
			/* copy PSK identity hint */
			s2n(strlen(s->ctx->psk_identity_hint), p); 
1738
			strncpy((char *)p, s->ctx->psk_identity_hint, strlen(s->ctx->psk_identity_hint));
1739 1740 1741 1742
			p+=strlen(s->ctx->psk_identity_hint);
			}
#endif

1743 1744 1745 1746 1747
		/* not anonymous */
		if (pkey != NULL)
			{
			/* n is the length of the params, they start at &(d[4])
			 * and p points to the space at the end. */
1748
#ifndef OPENSSL_NO_RSA
1749 1750 1751 1752 1753 1754
			if (pkey->type == EVP_PKEY_RSA)
				{
				q=md_buf;
				j=0;
				for (num=2; num > 0; num--)
					{
1755 1756 1757 1758 1759 1760 1761
					EVP_DigestInit_ex(&md_ctx,(num == 2)
						?s->ctx->md5:s->ctx->sha1, NULL);
					EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
					EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
					EVP_DigestUpdate(&md_ctx,&(d[4]),n);
					EVP_DigestFinal_ex(&md_ctx,q,
						(unsigned int *)&i);
1762 1763 1764
					q+=i;
					j+=i;
					}
1765
				if (RSA_sign(NID_md5_sha1, md_buf, j,
B
Ben Laurie 已提交
1766
					&(p[2]), &u, pkey->pkey.rsa) <= 0)
1767 1768 1769 1770
					{
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
					goto err;
					}
B
Ben Laurie 已提交
1771 1772
				s2n(u,p);
				n+=u+2;
1773 1774 1775
				}
			else
#endif
1776
#if !defined(OPENSSL_NO_DSA)
1777 1778 1779
				if (pkey->type == EVP_PKEY_DSA)
				{
				/* lets do DSS */
1780 1781 1782 1783 1784
				EVP_SignInit_ex(&md_ctx,EVP_dss1(), NULL);
				EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
				EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
				EVP_SignUpdate(&md_ctx,&(d[4]),n);
				if (!EVP_SignFinal(&md_ctx,&(p[2]),
1785 1786
					(unsigned int *)&i,pkey))
					{
1787
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA);
1788 1789 1790 1791 1792 1793
					goto err;
					}
				s2n(i,p);
				n+=i+2;
				}
			else
B
Bodo Möller 已提交
1794 1795
#endif
#if !defined(OPENSSL_NO_ECDSA)
1796
				if (pkey->type == EVP_PKEY_EC)
B
Bodo Möller 已提交
1797 1798
				{
				/* let's do ECDSA */
1799 1800 1801 1802 1803 1804
				EVP_SignInit_ex(&md_ctx,EVP_ecdsa(), NULL);
				EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
				EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
				EVP_SignUpdate(&md_ctx,&(d[4]),n);
				if (!EVP_SignFinal(&md_ctx,&(p[2]),
					(unsigned int *)&i,pkey))
B
Bodo Möller 已提交
1805
					{
1806
					SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_ECDSA);
B
Bodo Möller 已提交
1807 1808 1809 1810 1811 1812
					goto err;
					}
				s2n(i,p);
				n+=i+2;
				}
			else
1813 1814 1815
#endif
				{
				/* Is this error check actually needed? */
1816
				al=SSL_AD_HANDSHAKE_FAILURE;
1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830
				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE);
				goto f_err;
				}
			}

		*(d++)=SSL3_MT_SERVER_KEY_EXCHANGE;
		l2n3(n,d);

		/* we should now have things packed up, so lets send
		 * it off */
		s->init_num=n+4;
		s->init_off=0;
		}

1831
	s->state = SSL3_ST_SW_KEY_EXCH_B;
1832
	EVP_MD_CTX_cleanup(&md_ctx);
1833 1834 1835 1836
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
err:
B
Bodo Möller 已提交
1837 1838 1839 1840
#ifndef OPENSSL_NO_ECDH
	if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
	BN_CTX_free(bn_ctx);
#endif
1841
	EVP_MD_CTX_cleanup(&md_ctx);
1842 1843 1844
	return(-1);
	}

B
Ben Laurie 已提交
1845
int ssl3_send_certificate_request(SSL *s)
1846 1847 1848
	{
	unsigned char *p,*d;
	int i,j,nl,off,n;
B
Ben Laurie 已提交
1849
	STACK_OF(X509_NAME) *sk=NULL;
1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873
	X509_NAME *name;
	BUF_MEM *buf;

	if (s->state == SSL3_ST_SW_CERT_REQ_A)
		{
		buf=s->init_buf;

		d=p=(unsigned char *)&(buf->data[4]);

		/* get the list of acceptable cert types */
		p++;
		n=ssl3_get_req_cert_type(s,p);
		d[0]=n;
		p+=n;
		n++;

		off=n;
		p+=2;
		n+=2;

		sk=SSL_get_client_CA_list(s);
		nl=0;
		if (sk != NULL)
			{
B
Ben Laurie 已提交
1874
			for (i=0; i<sk_X509_NAME_num(sk); i++)
1875
				{
B
Ben Laurie 已提交
1876
				name=sk_X509_NAME_value(sk,i);
1877
				j=i2d_X509_NAME(name,NULL);
1878
				if (!BUF_MEM_grow_clean(buf,4+n+j+2))
1879 1880 1881 1882 1883
					{
					SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
					goto err;
					}
				p=(unsigned char *)&(buf->data[4+n]);
1884
				if (!(s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913
					{
					s2n(j,p);
					i2d_X509_NAME(name,&p);
					n+=2+j;
					nl+=2+j;
					}
				else
					{
					d=p;
					i2d_X509_NAME(name,&p);
					j-=2; s2n(j,d); j+=2;
					n+=j;
					nl+=j;
					}
				}
			}
		/* else no CA names */
		p=(unsigned char *)&(buf->data[4+off]);
		s2n(nl,p);

		d=(unsigned char *)buf->data;
		*(d++)=SSL3_MT_CERTIFICATE_REQUEST;
		l2n3(n,d);

		/* we should now have things packed up, so lets send
		 * it off */

		s->init_num=n+4;
		s->init_off=0;
1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924
#ifdef NETSCAPE_HANG_BUG
		p=(unsigned char *)s->init_buf->data + s->init_num;

		/* do the header */
		*(p++)=SSL3_MT_SERVER_DONE;
		*(p++)=0;
		*(p++)=0;
		*(p++)=0;
		s->init_num += 4;
#endif

1925
		s->state = SSL3_ST_SW_CERT_REQ_B;
1926 1927 1928 1929 1930 1931 1932 1933
		}

	/* SSL3_ST_SW_CERT_REQ_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
err:
	return(-1);
	}

B
Ben Laurie 已提交
1934
int ssl3_get_client_key_exchange(SSL *s)
1935 1936 1937
	{
	int i,al,ok;
	long n;
1938
	unsigned long alg_k;
1939
	unsigned char *p;
1940
#ifndef OPENSSL_NO_RSA
1941 1942
	RSA *rsa=NULL;
	EVP_PKEY *pkey=NULL;
1943
#endif
1944
#ifndef OPENSSL_NO_DH
1945
	BIGNUM *pub=NULL;
1946
	DH *dh_srvr;
1947
#endif
1948
#ifndef OPENSSL_NO_KRB5
1949
	KSSL_ERR kssl_err;
1950
#endif /* OPENSSL_NO_KRB5 */
1951

B
Bodo Möller 已提交
1952 1953 1954 1955 1956 1957 1958
#ifndef OPENSSL_NO_ECDH
	EC_KEY *srvr_ecdh = NULL;
	EVP_PKEY *clnt_pub_pkey = NULL;
	EC_POINT *clnt_ecpoint = NULL;
	BN_CTX *bn_ctx = NULL; 
#endif

B
Ben Laurie 已提交
1959
	n=s->method->ssl_get_message(s,
1960 1961 1962
		SSL3_ST_SR_KEY_EXCH_A,
		SSL3_ST_SR_KEY_EXCH_B,
		SSL3_MT_CLIENT_KEY_EXCHANGE,
1963
		2048, /* ??? */
1964 1965 1966
		&ok);

	if (!ok) return((int)n);
1967
	p=(unsigned char *)s->init_msg;
1968

1969
	alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
1970

1971
#ifndef OPENSSL_NO_RSA
1972
	if (alg_k & SSL_kRSA)
1973 1974 1975 1976
		{
		/* FIX THIS UP EAY EAY EAY EAY */
		if (s->s3->tmp.use_rsa_tmp)
			{
1977
			if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL))
1978
				rsa=s->cert->rsa_tmp;
1979 1980 1981 1982
			/* Don't do a callback because rsa_tmp should
			 * be sent already */
			if (rsa == NULL)
				{
1983
				al=SSL_AD_HANDSHAKE_FAILURE;
1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_PKEY);
				goto f_err;

				}
			}
		else
			{
			pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
			if (	(pkey == NULL) ||
				(pkey->type != EVP_PKEY_RSA) ||
				(pkey->pkey.rsa == NULL))
				{
1996
				al=SSL_AD_HANDSHAKE_FAILURE;
1997 1998 1999 2000 2001 2002
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_RSA_CERTIFICATE);
				goto f_err;
				}
			rsa=pkey->pkey.rsa;
			}

2003
		/* TLS and [incidentally] DTLS{0xFEFF} */
2004
		if (s->version > SSL3_VERSION && s->version != DTLS1_BAD_VER)
2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020
			{
			n2s(p,i);
			if (n != i+2)
				{
				if (!(s->options & SSL_OP_TLS_D5_BUG))
					{
					SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
					goto err;
					}
				else
					p-=2;
				}
			else
				n=i;
			}

2021
		i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
2022

2023 2024
		al = -1;
		
2025 2026 2027
		if (i != SSL_MAX_MASTER_KEY_LENGTH)
			{
			al=SSL_AD_DECODE_ERROR;
2028
			/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
2029 2030
			}

2031
		if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff))))
2032
			{
2033 2034 2035 2036
			/* The premaster secret must contain the same version number as the
			 * ClientHello to detect version rollback attacks (strangely, the
			 * protocol does not offer such protection for DH ciphersuites).
			 * However, buggy clients exist that send the negotiated protocol
B
typo  
Bodo Möller 已提交
2037
			 * version instead if the server does not support the requested
2038 2039 2040 2041 2042 2043
			 * protocol version.
			 * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */
			if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) &&
				(p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff))))
				{
				al=SSL_AD_DECODE_ERROR;
2044 2045 2046 2047 2048 2049 2050 2051 2052
				/* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */

				/* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack
				 * (http://eprint.iacr.org/2003/052/) exploits the version
				 * number check as a "bad version oracle" -- an alert would
				 * reveal that the plaintext corresponding to some ciphertext
				 * made up by the adversary is properly formatted except
				 * that the version number is wrong.  To avoid such attacks,
				 * we should treat this just like any other decryption error. */
2053
				}
2054 2055
			}

2056 2057 2058 2059
		if (al != -1)
			{
			/* Some decryption failure -- use random value instead as countermeasure
			 * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
2060
			 * (see RFC 2246, section 7.4.7.1). */
2061 2062 2063 2064
			ERR_clear_error();
			i = SSL_MAX_MASTER_KEY_LENGTH;
			p[0] = s->client_version >> 8;
			p[1] = s->client_version & 0xff;
2065 2066
			if (RAND_pseudo_bytes(p+2, i-2) <= 0) /* should be RAND_bytes, but we cannot work around a failure */
				goto err;
2067 2068
			}
	
2069
		s->session->master_key_length=
2070
			s->method->ssl3_enc->generate_master_secret(s,
2071 2072
				s->session->master_key,
				p,i);
2073
		OPENSSL_cleanse(p,i);
2074 2075
		}
	else
U
Ulf Möller 已提交
2076
#endif
2077
#ifndef OPENSSL_NO_DH
2078
		if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2079 2080 2081 2082
		{
		n2s(p,i);
		if (n != i+2)
			{
2083
			if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))
2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
				goto err;
				}
			else
				{
				p-=2;
				i=(int)n;
				}
			}

		if (n == 0L) /* the parameters are in the cert */
			{
2097
			al=SSL_AD_HANDSHAKE_FAILURE;
2098 2099 2100 2101 2102 2103 2104
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_DECODE_DH_CERTS);
			goto f_err;
			}
		else
			{
			if (s->s3->tmp.dh == NULL)
				{
2105
				al=SSL_AD_HANDSHAKE_FAILURE;
2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
				goto f_err;
				}
			else
				dh_srvr=s->s3->tmp.dh;
			}

		pub=BN_bin2bn(p,i,NULL);
		if (pub == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);
			goto err;
			}
2119

2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133
		i=DH_compute_key(p,pub,dh_srvr);

		if (i <= 0)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
			goto err;
			}

		DH_free(s->s3->tmp.dh);
		s->s3->tmp.dh=NULL;

		BN_clear_free(pub);
		pub=NULL;
		s->session->master_key_length=
2134
			s->method->ssl3_enc->generate_master_secret(s,
2135
				s->session->master_key,p,i);
2136
		OPENSSL_cleanse(p,i);
2137 2138 2139
		}
	else
#endif
2140
#ifndef OPENSSL_NO_KRB5
2141 2142 2143
	if (alg_k & SSL_kKRB5)
		{
		krb5_error_code		krb5rc;
2144 2145 2146
		krb5_data		enc_ticket;
		krb5_data		authenticator;
		krb5_data		enc_pms;
2147
		KSSL_CTX		*kssl_ctx = s->kssl_ctx;
2148
		EVP_CIPHER_CTX		ciph_ctx;
2149
		const EVP_CIPHER	*enc = NULL;
2150
		unsigned char		iv[EVP_MAX_IV_LENGTH];
2151
		unsigned char		pms[SSL_MAX_MASTER_KEY_LENGTH
2152 2153
					       + EVP_MAX_BLOCK_LENGTH];
		int		     padl, outl;
2154 2155
		krb5_timestamp		authtime = 0;
		krb5_ticket_times	ttimes;
2156

D
 
Dr. Stephen Henson 已提交
2157 2158
		EVP_CIPHER_CTX_init(&ciph_ctx);

2159
		if (!kssl_ctx)  kssl_ctx = kssl_ctx_new();
2160 2161 2162

		n2s(p,i);
		enc_ticket.length = i;
2163

2164
		if (n < (long)(enc_ticket.length + 6))
2165 2166 2167 2168 2169 2170
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DATA_LENGTH_TOO_LONG);
			goto err;
			}

D
 
Dr. Stephen Henson 已提交
2171
		enc_ticket.data = (char *)p;
2172 2173 2174 2175
		p+=enc_ticket.length;

		n2s(p,i);
		authenticator.length = i;
2176

2177
		if (n < (long)(enc_ticket.length + authenticator.length + 6))
2178 2179 2180 2181 2182 2183
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DATA_LENGTH_TOO_LONG);
			goto err;
			}

D
 
Dr. Stephen Henson 已提交
2184
		authenticator.data = (char *)p;
2185 2186 2187 2188
		p+=authenticator.length;

		n2s(p,i);
		enc_pms.length = i;
D
 
Dr. Stephen Henson 已提交
2189
		enc_pms.data = (char *)p;
2190 2191
		p+=enc_pms.length;

2192 2193 2194
		/* Note that the length is checked again below,
		** after decryption
		*/
L
Typo.  
Lutz Jänicke 已提交
2195
		if(enc_pms.length > sizeof pms)
2196 2197 2198 2199 2200 2201
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
			       SSL_R_DATA_LENGTH_TOO_LONG);
			goto err;
			}

2202 2203
		if (n != (long)(enc_ticket.length + authenticator.length +
						enc_pms.length + 6))
2204 2205 2206 2207 2208 2209
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DATA_LENGTH_TOO_LONG);
			goto err;
			}

2210
		if ((krb5rc = kssl_sget_tkt(kssl_ctx, &enc_ticket, &ttimes,
2211
					&kssl_err)) != 0)
2212
			{
2213
#ifdef KSSL_DEBUG
2214 2215 2216 2217
			printf("kssl_sget_tkt rtn %d [%d]\n",
				krb5rc, kssl_err.reason);
			if (kssl_err.text)
				printf("kssl_err text= %s\n", kssl_err.text);
2218
#endif	/* KSSL_DEBUG */
2219 2220 2221 2222
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				kssl_err.reason);
			goto err;
			}
2223

2224 2225 2226 2227 2228 2229 2230
		/*  Note: no authenticator is not considered an error,
		**  but will return authtime == 0.
		*/
		if ((krb5rc = kssl_check_authent(kssl_ctx, &authenticator,
					&authtime, &kssl_err)) != 0)
			{
#ifdef KSSL_DEBUG
2231 2232 2233 2234
			printf("kssl_check_authent rtn %d [%d]\n",
				krb5rc, kssl_err.reason);
			if (kssl_err.text)
				printf("kssl_err text= %s\n", kssl_err.text);
2235
#endif	/* KSSL_DEBUG */
2236 2237 2238
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				kssl_err.reason);
			goto err;
2239 2240 2241 2242
			}

		if ((krb5rc = kssl_validate_times(authtime, &ttimes)) != 0)
			{
2243
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, krb5rc);
2244
			goto err;
2245 2246
			}

2247
#ifdef KSSL_DEBUG
2248
		kssl_ctx_show(kssl_ctx);
2249 2250
#endif	/* KSSL_DEBUG */

2251
		enc = kssl_map_enc(kssl_ctx->enctype);
2252 2253
		if (enc == NULL)
		    goto err;
2254

2255
		memset(iv, 0, sizeof iv);	/* per RFC 1510 */
2256

R
Richard Levitte 已提交
2257
		if (!EVP_DecryptInit_ex(&ciph_ctx,enc,NULL,kssl_ctx->key,iv))
2258 2259 2260 2261 2262 2263
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DECRYPTION_FAILED);
			goto err;
			}
		if (!EVP_DecryptUpdate(&ciph_ctx, pms,&outl,
D
 
Dr. Stephen Henson 已提交
2264
					(unsigned char *)enc_pms.data, enc_pms.length))
2265 2266 2267 2268 2269
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DECRYPTION_FAILED);
			goto err;
			}
2270 2271 2272 2273 2274 2275
		if (outl > SSL_MAX_MASTER_KEY_LENGTH)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DATA_LENGTH_TOO_LONG);
			goto err;
			}
2276
		if (!EVP_DecryptFinal_ex(&ciph_ctx,&(pms[outl]),&padl))
2277 2278 2279 2280 2281
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DECRYPTION_FAILED);
			goto err;
			}
2282 2283 2284 2285 2286 2287 2288
		outl += padl;
		if (outl > SSL_MAX_MASTER_KEY_LENGTH)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_DATA_LENGTH_TOO_LONG);
			goto err;
			}
2289
		if (!((pms[0] == (s->client_version>>8)) && (pms[1] == (s->client_version & 0xff))))
2290 2291 2292 2293 2294 2295 2296 2297 2298
		    {
		    /* The premaster secret must contain the same version number as the
		     * ClientHello to detect version rollback attacks (strangely, the
		     * protocol does not offer such protection for DH ciphersuites).
		     * However, buggy clients exist that send random bytes instead of
		     * the protocol version.
		     * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. 
		     * (Perhaps we should have a separate BUG value for the Kerberos cipher)
		     */
2299
		    if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG))
2300
			{
2301 2302 2303 2304 2305 2306
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
			       SSL_AD_DECODE_ERROR);
			goto err;
			}
		    }

2307 2308
		EVP_CIPHER_CTX_cleanup(&ciph_ctx);

2309 2310 2311
		s->session->master_key_length=
			s->method->ssl3_enc->generate_master_secret(s,
				s->session->master_key, pms, outl);
2312

2313 2314 2315 2316 2317 2318 2319 2320 2321
		if (kssl_ctx->client_princ)
			{
			size_t len = strlen(kssl_ctx->client_princ);
			if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) 
				{
				s->session->krb5_client_princ_len = len;
				memcpy(s->session->krb5_client_princ,kssl_ctx->client_princ,len);
				}
			}
2322 2323


2324
		/*  Was doing kssl_ctx_free() here,
2325
		**  but it caused problems for apache.
2326 2327 2328 2329
		**  kssl_ctx = kssl_ctx_free(kssl_ctx);
		**  if (s->kssl_ctx)  s->kssl_ctx = NULL;
		*/
		}
2330
	else
2331
#endif	/* OPENSSL_NO_KRB5 */
B
Bodo Möller 已提交
2332 2333

#ifndef OPENSSL_NO_ECDH
2334
		if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
B
Bodo Möller 已提交
2335 2336
		{
		int ret = 1;
2337
		int field_size = 0;
N
Nils Larsch 已提交
2338 2339 2340
		const EC_KEY   *tkey;
		const EC_GROUP *group;
		const BIGNUM *priv_key;
B
Bodo Möller 已提交
2341

2342
		/* initialize structures for server's ECDH key pair */
B
Bodo Möller 已提交
2343 2344
		if ((srvr_ecdh = EC_KEY_new()) == NULL) 
			{
2345
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
B
Bodo Möller 已提交
2346
			    ERR_R_MALLOC_FAILURE);
2347
			goto err;
B
Bodo Möller 已提交
2348 2349 2350
			}

		/* Let's get server private key and group information */
2351
		if (alg_k & (SSL_kECDHr|SSL_kECDHe))
B
Bodo Möller 已提交
2352
			{ 
2353
			/* use the certificate */
N
Nils Larsch 已提交
2354
			tkey = s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec;
B
Bodo Möller 已提交
2355 2356 2357 2358 2359 2360
			}
		else
			{
			/* use the ephermeral values we saved when
			 * generating the ServerKeyExchange msg.
			 */
N
Nils Larsch 已提交
2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372
			tkey = s->s3->tmp.ecdh;
			}

		group    = EC_KEY_get0_group(tkey);
		priv_key = EC_KEY_get0_private_key(tkey);

		if (!EC_KEY_set_group(srvr_ecdh, group) ||
		    !EC_KEY_set_private_key(srvr_ecdh, priv_key))
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
			       ERR_R_EC_LIB);
			goto err;
B
Bodo Möller 已提交
2373 2374 2375
			}

		/* Let's get client's public key */
N
Nils Larsch 已提交
2376
		if ((clnt_ecpoint = EC_POINT_new(group)) == NULL)
B
Bodo Möller 已提交
2377 2378 2379 2380 2381 2382
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
			    ERR_R_MALLOC_FAILURE);
			goto err;
			}

2383 2384
		if (n == 0L) 
			{
B
Bodo Möller 已提交
2385 2386
			/* Client Publickey was in Client Certificate */

2387
			 if (alg_k & SSL_kEECDH)
B
Bodo Möller 已提交
2388 2389 2390 2391 2392
				 {
				 al=SSL_AD_HANDSHAKE_FAILURE;
				 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_ECDH_KEY);
				 goto f_err;
				 }
2393
			if (((clnt_pub_pkey=X509_get_pubkey(s->session->peer))
B
Bodo Möller 已提交
2394
			    == NULL) || 
2395
			    (clnt_pub_pkey->type != EVP_PKEY_EC))
2396
				{
B
Bodo Möller 已提交
2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407
				/* XXX: For now, we do not support client
				 * authentication using ECDH certificates
				 * so this branch (n == 0L) of the code is
				 * never executed. When that support is
				 * added, we ought to ensure the key 
				 * received in the certificate is 
				 * authorized for key agreement.
				 * ECDH_compute_key implicitly checks that
				 * the two ECDH shares are for the same
				 * group.
				 */
2408 2409
			   	al=SSL_AD_HANDSHAKE_FAILURE;
			   	SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
B
Bodo Möller 已提交
2410
				    SSL_R_UNABLE_TO_DECODE_ECDH_CERTS);
2411 2412
			   	goto f_err;
			   	}
B
Bodo Möller 已提交
2413

N
Nils Larsch 已提交
2414 2415 2416 2417 2418 2419 2420
			if (EC_POINT_copy(clnt_ecpoint,
			    EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec)) == 0)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
					ERR_R_EC_LIB);
				goto err;
				}
2421 2422 2423 2424
			ret = 2; /* Skip certificate verify processing */
			}
		else
			{
B
Bodo Möller 已提交
2425 2426 2427 2428 2429 2430 2431 2432 2433 2434
			/* Get client's public key from encoded point
			 * in the ClientKeyExchange message.
			 */
			if ((bn_ctx = BN_CTX_new()) == NULL)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				    ERR_R_MALLOC_FAILURE);
				goto err;
				}

2435 2436
			/* Get encoded point length */
			i = *p; 
B
Bodo Möller 已提交
2437
			p += 1;
2438
			if (EC_POINT_oct2point(group, 
B
Bodo Möller 已提交
2439 2440 2441 2442 2443 2444
			    clnt_ecpoint, p, i, bn_ctx) == 0)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				    ERR_R_EC_LIB);
				goto err;
				}
2445 2446 2447 2448 2449
			/* p is pointing to somewhere in the buffer
			 * currently, so set it to the start 
			 */ 
			p=(unsigned char *)s->init_buf->data;
			}
B
Bodo Möller 已提交
2450 2451

		/* Compute the shared pre-master secret */
N
Nils Larsch 已提交
2452
		field_size = EC_GROUP_get_degree(group);
2453 2454 2455 2456 2457 2458
		if (field_size <= 0)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 
			       ERR_R_ECDH_LIB);
			goto err;
			}
B
Bodo Möller 已提交
2459
		i = ECDH_compute_key(p, (field_size+7)/8, clnt_ecpoint, srvr_ecdh, NULL);
2460 2461 2462
		if (i <= 0)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
B
Bodo Möller 已提交
2463
			    ERR_R_ECDH_LIB);
2464 2465
			goto err;
			}
B
Bodo Möller 已提交
2466 2467 2468

		EVP_PKEY_free(clnt_pub_pkey);
		EC_POINT_free(clnt_ecpoint);
2469
		EC_KEY_free(srvr_ecdh);
B
Bodo Möller 已提交
2470
		BN_CTX_free(bn_ctx);
D
Dr. Stephen Henson 已提交
2471 2472
		EC_KEY_free(s->s3->tmp.ecdh);
		s->s3->tmp.ecdh = NULL; 
B
Bodo Möller 已提交
2473 2474

		/* Compute the master secret */
2475
		s->session->master_key_length = s->method->ssl3_enc-> \
B
Bodo Möller 已提交
2476 2477
		    generate_master_secret(s, s->session->master_key, p, i);
		
2478 2479
		OPENSSL_cleanse(p, i);
		return (ret);
B
Bodo Möller 已提交
2480 2481
		}
	else
2482 2483
#endif
#ifndef OPENSSL_NO_PSK
2484
		if (alg_k & SSL_kPSK)
2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547
			{
			unsigned char *t = NULL;
			unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4];
			unsigned int pre_ms_len = 0, psk_len = 0;
			int psk_err = 1;
			char tmp_id[PSK_MAX_IDENTITY_LEN+1];

			al=SSL_AD_HANDSHAKE_FAILURE;

			n2s(p,i);
			if (n != i+2)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
					SSL_R_LENGTH_MISMATCH);
				goto psk_err;
				}
			if (i > PSK_MAX_IDENTITY_LEN)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
					SSL_R_DATA_LENGTH_TOO_LONG);
				goto psk_err;
				}
			if (s->psk_server_callback == NULL)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				       SSL_R_PSK_NO_SERVER_CB);
				goto psk_err;
				}

			/* Create guaranteed NULL-terminated identity
			 * string for the callback */
			memcpy(tmp_id, p, i);
			memset(tmp_id+i, 0, PSK_MAX_IDENTITY_LEN+1-i);
			psk_len = s->psk_server_callback(s, tmp_id,
				psk_or_pre_ms, sizeof(psk_or_pre_ms));
			OPENSSL_cleanse(tmp_id, PSK_MAX_IDENTITY_LEN+1);

			if (psk_len > PSK_MAX_PSK_LEN)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
					ERR_R_INTERNAL_ERROR);
				goto psk_err;
				}
			else if (psk_len == 0)
				{
				/* PSK related to the given identity not found */
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				       SSL_R_PSK_IDENTITY_NOT_FOUND);
				al=SSL_AD_UNKNOWN_PSK_IDENTITY;
				goto psk_err;
				}

			/* create PSK pre_master_secret */
			pre_ms_len=2+psk_len+2+psk_len;
			t = psk_or_pre_ms;
			memmove(psk_or_pre_ms+psk_len+4, psk_or_pre_ms, psk_len);
			s2n(psk_len, t);
			memset(t, 0, psk_len);
			t+=psk_len;
			s2n(psk_len, t);

			if (s->session->psk_identity != NULL)
				OPENSSL_free(s->session->psk_identity);
2548
			s->session->psk_identity = BUF_strdup((char *)p);
2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572
			if (s->session->psk_identity == NULL)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
					ERR_R_MALLOC_FAILURE);
				goto psk_err;
				}

			if (s->session->psk_identity_hint != NULL)
				OPENSSL_free(s->session->psk_identity_hint);
			s->session->psk_identity_hint = BUF_strdup(s->ctx->psk_identity_hint);
			if (s->ctx->psk_identity_hint != NULL &&
				s->session->psk_identity_hint == NULL)
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
					ERR_R_MALLOC_FAILURE);
				goto psk_err;
				}

			s->session->master_key_length=
				s->method->ssl3_enc->generate_master_secret(s,
					s->session->master_key, psk_or_pre_ms, pre_ms_len);
			psk_err = 0;
		psk_err:
			OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
2573 2574
			if (psk_err != 0)
				goto f_err;
2575 2576
			}
		else
B
Bodo Möller 已提交
2577
#endif
2578
		if (alg_k & SSL_kGOST) 
2579 2580
			{
			int ret = 0;
2581
			EVP_PKEY_CTX *pkey_ctx;
2582 2583
			EVP_PKEY *client_pub_pkey = NULL;
			unsigned char premaster_secret[32], *start;
D
Dr. Stephen Henson 已提交
2584
			size_t outlen=32, inlen;			
2585

2586
			/* Get our certificate private key*/
2587 2588
			pkey_ctx = EVP_PKEY_CTX_new(s->cert->key->privatekey,NULL);	
			EVP_PKEY_decrypt_init(pkey_ctx);
2589 2590 2591 2592 2593 2594 2595 2596 2597 2598
			/* If client certificate is present and is of the same type, maybe
			 * use it for key exchange.  Don't mind errors from
			 * EVP_PKEY_derive_set_peer, because it is completely valid to use
			 * a client certificate for authorization only. */
			client_pub_pkey = X509_get_pubkey(s->session->peer);
			if (client_pub_pkey)
				{
				if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)
					ERR_clear_error();
				}
2599
			/* Decrypt session key */
2600
			if ((*p!=( V_ASN1_SEQUENCE| V_ASN1_CONSTRUCTED))) 
2601 2602
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DECRYPTION_FAILED);
2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620
				goto gerr;
				}
			if (p[1] == 0x81)
				{
				start = p+3;
				inlen = p[2];
				}
			else if (p[1] < 0x80)
				{
				start = p+2;
				inlen = p[1];
				}
			else
				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DECRYPTION_FAILED);
				goto gerr;
				}
			if (EVP_PKEY_decrypt(pkey_ctx,premaster_secret,&outlen,start,inlen) <=0) 
2621 2622 2623

				{
				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DECRYPTION_FAILED);
2624
				goto gerr;
2625 2626 2627 2628 2629
				}
			/* Generate master secret */
			s->session->master_key_length=
				s->method->ssl3_enc->generate_master_secret(s,
					s->session->master_key,premaster_secret,32);
2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642
			/* Check if pubkey from client certificate was used */
			if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)
				ret = 2;
			else
				ret = 1;
		gerr:
			EVP_PKEY_free(client_pub_pkey);
			EVP_PKEY_CTX_free(pkey_ctx);
			if (ret)
				return ret;
			else
				goto err;
			}
2643
		else
2644
		{
2645
		al=SSL_AD_HANDSHAKE_FAILURE;
2646 2647
		SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
				SSL_R_UNKNOWN_CIPHER_TYPE);
2648 2649 2650 2651 2652 2653
		goto f_err;
		}

	return(1);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
B
Bodo Möller 已提交
2654
#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
2655
err:
B
Bodo Möller 已提交
2656
#endif
2657
#ifndef OPENSSL_NO_ECDH
B
Bodo Möller 已提交
2658 2659 2660 2661 2662
	EVP_PKEY_free(clnt_pub_pkey);
	EC_POINT_free(clnt_ecpoint);
	if (srvr_ecdh != NULL) 
		EC_KEY_free(srvr_ecdh);
	BN_CTX_free(bn_ctx);
2663
#endif
2664 2665 2666
	return(-1);
	}

B
Ben Laurie 已提交
2667
int ssl3_get_cert_verify(SSL *s)
2668 2669 2670 2671 2672 2673 2674 2675
	{
	EVP_PKEY *pkey=NULL;
	unsigned char *p;
	int al,ok,ret=0;
	long n;
	int type=0,i,j;
	X509 *peer;

B
Ben Laurie 已提交
2676
	n=s->method->ssl_get_message(s,
2677 2678 2679
		SSL3_ST_SR_CERT_VRFY_A,
		SSL3_ST_SR_CERT_VRFY_B,
		-1,
2680
		514, /* 514? */
2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701
		&ok);

	if (!ok) return((int)n);

	if (s->session->peer != NULL)
		{
		peer=s->session->peer;
		pkey=X509_get_pubkey(peer);
		type=X509_certificate_type(peer,pkey);
		}
	else
		{
		peer=NULL;
		pkey=NULL;
		}

	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
		{
		s->s3->tmp.reuse_message=1;
		if ((peer != NULL) && (type | EVP_PKT_SIGN))
			{
2702
			al=SSL_AD_UNEXPECTED_MESSAGE;
2703 2704 2705 2706 2707 2708 2709 2710 2711 2712
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
			goto f_err;
			}
		ret=1;
		goto end;
		}

	if (peer == NULL)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
2713
		al=SSL_AD_UNEXPECTED_MESSAGE;
2714 2715 2716 2717 2718 2719
		goto f_err;
		}

	if (!(type & EVP_PKT_SIGN))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
2720
		al=SSL_AD_ILLEGAL_PARAMETER;
2721 2722 2723 2724 2725 2726
		goto f_err;
		}

	if (s->s3->change_cipher_spec)
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
2727
		al=SSL_AD_UNEXPECTED_MESSAGE;
2728 2729 2730 2731
		goto f_err;
		}

	/* we now have a signature that we need to verify */
2732
	p=(unsigned char *)s->init_msg;
2733 2734 2735 2736 2737
	/* Check for broken implementations of GOST ciphersuites */
	/* If key is GOST and n is exactly 64, it is bare
	 * signature without length field */
	if (n==64 && (pkey->type==NID_id_GostR3410_94 ||
		pkey->type == NID_id_GostR3410_2001) )
2738
		{
2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751
		i=64;
		} 
	else 
		{	
		n2s(p,i);
		n-=2;
		if (i > n)
			{
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
			al=SSL_AD_DECODE_ERROR;
			goto f_err;
			}
    	}
2752 2753 2754 2755
	j=EVP_PKEY_size(pkey);
	if ((i > j) || (n > j) || (n <= 0))
		{
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
2756
		al=SSL_AD_DECODE_ERROR;
2757 2758 2759
		goto f_err;
		}

2760
#ifndef OPENSSL_NO_RSA 
2761 2762
	if (pkey->type == EVP_PKEY_RSA)
		{
2763
		i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
2764 2765
			MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i, 
							pkey->pkey.rsa);
2766 2767
		if (i < 0)
			{
2768
			al=SSL_AD_DECRYPT_ERROR;
2769 2770 2771
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
			goto f_err;
			}
2772
		if (i == 0)
2773
			{
2774
			al=SSL_AD_DECRYPT_ERROR;
2775 2776 2777 2778 2779 2780
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
			goto f_err;
			}
		}
	else
#endif
2781
#ifndef OPENSSL_NO_DSA
2782 2783
		if (pkey->type == EVP_PKEY_DSA)
		{
2784
		j=DSA_verify(pkey->save_type,
2785
			&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
2786 2787 2788 2789
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
		if (j <= 0)
			{
			/* bad signature */
2790
			al=SSL_AD_DECRYPT_ERROR;
2791 2792 2793 2794 2795
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
			goto f_err;
			}
		}
	else
B
Bodo Möller 已提交
2796 2797
#endif
#ifndef OPENSSL_NO_ECDSA
2798
		if (pkey->type == EVP_PKEY_EC)
B
Bodo Möller 已提交
2799 2800 2801
		{
		j=ECDSA_verify(pkey->save_type,
			&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
N
Nils Larsch 已提交
2802
			SHA_DIGEST_LENGTH,p,i,pkey->pkey.ec);
B
Bodo Möller 已提交
2803 2804 2805 2806 2807 2808 2809 2810 2811 2812
		if (j <= 0)
			{
			/* bad signature */
			al=SSL_AD_DECRYPT_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
			    SSL_R_BAD_ECDSA_SIGNATURE);
			goto f_err;
			}
		}
	else
2813
#endif
2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835
	if (pkey->type == NID_id_GostR3410_94 || pkey->type == NID_id_GostR3410_2001)
		{   unsigned char signature[64];
			int idx;
			EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new(pkey,NULL);
			EVP_PKEY_verify_init(pctx);
			if (i!=64) {
				fprintf(stderr,"GOST signature length is %d",i);
			}	
			for (idx=0;idx<64;idx++) {
				signature[63-idx]=p[idx];
			}	
			j=EVP_PKEY_verify(pctx,signature,64,s->s3->tmp.cert_verify_md,32);
			EVP_PKEY_CTX_free(pctx);
			if (j<=0) 
				{
				al=SSL_AD_DECRYPT_ERROR;
				SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
					SSL_R_BAD_ECDSA_SIGNATURE);
				goto f_err;
				}	
		}
	else	
2836
		{
B
Bodo Möller 已提交
2837
		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,ERR_R_INTERNAL_ERROR);
2838
		al=SSL_AD_UNSUPPORTED_CERTIFICATE;
2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849
		goto f_err;
		}


	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
end:
2850
	EVP_PKEY_free(pkey);
2851 2852 2853
	return(ret);
	}

B
Ben Laurie 已提交
2854
int ssl3_get_client_certificate(SSL *s)
2855 2856 2857 2858
	{
	int i,ok,al,ret= -1;
	X509 *x=NULL;
	unsigned long l,nc,llen,n;
2859 2860
	const unsigned char *p,*q;
	unsigned char *d;
B
Ben Laurie 已提交
2861
	STACK_OF(X509) *sk=NULL;
2862

B
Ben Laurie 已提交
2863
	n=s->method->ssl_get_message(s,
2864 2865 2866
		SSL3_ST_SR_CERT_A,
		SSL3_ST_SR_CERT_B,
		-1,
2867
		s->max_cert_list,
2868 2869 2870 2871 2872 2873 2874 2875 2876 2877
		&ok);

	if (!ok) return((int)n);

	if	(s->s3->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE)
		{
		if (	(s->verify_mode & SSL_VERIFY_PEER) &&
			(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
2878 2879 2880
			al=SSL_AD_HANDSHAKE_FAILURE;
			goto f_err;
			}
2881
		/* If tls asked for a client cert, the client must return a 0 list */
2882 2883 2884 2885
		if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST);
			al=SSL_AD_UNEXPECTED_MESSAGE;
2886 2887 2888 2889 2890 2891 2892 2893
			goto f_err;
			}
		s->s3->tmp.reuse_message=1;
		return(1);
		}

	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
		{
2894
		al=SSL_AD_UNEXPECTED_MESSAGE;
2895 2896 2897
		SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_WRONG_MESSAGE_TYPE);
		goto f_err;
		}
2898
	p=d=(unsigned char *)s->init_msg;
2899

B
Ben Laurie 已提交
2900
	if ((sk=sk_X509_new_null()) == NULL)
2901 2902 2903 2904 2905 2906 2907 2908
		{
		SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE);
		goto err;
		}

	n2l3(p,llen);
	if (llen+3 != n)
		{
2909
		al=SSL_AD_DECODE_ERROR;
2910 2911 2912 2913 2914 2915 2916 2917
		SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	for (nc=0; nc<llen; )
		{
		n2l3(p,l);
		if ((l+nc+3) > llen)
			{
2918
			al=SSL_AD_DECODE_ERROR;
2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}

		q=p;
		x=d2i_X509(NULL,&p,l);
		if (x == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_ASN1_LIB);
			goto err;
			}
		if (p != (q+l))
			{
2932
			al=SSL_AD_DECODE_ERROR;
2933 2934 2935
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}
B
Ben Laurie 已提交
2936
		if (!sk_X509_push(sk,x))
2937 2938 2939 2940 2941 2942 2943 2944
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE);
			goto err;
			}
		x=NULL;
		nc+=l+3;
		}

B
Ben Laurie 已提交
2945
	if (sk_X509_num(sk) <= 0)
2946
		{
2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961
		/* TLS does not mind 0 certs returned */
		if (s->version == SSL3_VERSION)
			{
			al=SSL_AD_HANDSHAKE_FAILURE;
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATES_RETURNED);
			goto f_err;
			}
		/* Fail for TLS only if we required a certificate */
		else if ((s->verify_mode & SSL_VERIFY_PEER) &&
			 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
			al=SSL_AD_HANDSHAKE_FAILURE;
			goto f_err;
			}
2962
		}
2963
	else
2964
		{
2965
		i=ssl_verify_cert_chain(s,sk);
D
Dr. Stephen Henson 已提交
2966
		if (i <= 0)
2967 2968 2969 2970 2971
			{
			al=ssl_verify_alarm_type(s->verify_result);
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
			goto f_err;
			}
2972 2973
		}

2974
	if (s->session->peer != NULL) /* This should not be needed */
2975
		X509_free(s->session->peer);
B
Ben Laurie 已提交
2976
	s->session->peer=sk_X509_shift(sk);
2977
	s->session->verify_result = s->verify_result;
B
Bodo Möller 已提交
2978

2979 2980 2981 2982 2983 2984 2985 2986 2987 2988 2989 2990 2991
	/* With the current implementation, sess_cert will always be NULL
	 * when we arrive here. */
	if (s->session->sess_cert == NULL)
		{
		s->session->sess_cert = ssl_sess_cert_new();
		if (s->session->sess_cert == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
			goto err;
			}
		}
	if (s->session->sess_cert->cert_chain != NULL)
		sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
2992
	s->session->sess_cert->cert_chain=sk;
2993 2994
	/* Inconsistency alert: cert_chain does *not* include the
	 * peer's own certificate, while we do include it in s3_clnt.c */
B
Bodo Möller 已提交
2995

B
Ben Laurie 已提交
2996
	sk=NULL;
2997 2998 2999 3000 3001 3002 3003 3004 3005

	ret=1;
	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
err:
	if (x != NULL) X509_free(x);
B
Ben Laurie 已提交
3006
	if (sk != NULL) sk_X509_pop_free(sk,X509_free);
3007 3008 3009
	return(ret);
	}

U
Ulf Möller 已提交
3010
int ssl3_send_server_certificate(SSL *s)
3011 3012 3013 3014 3015 3016 3017
	{
	unsigned long l;
	X509 *x;

	if (s->state == SSL3_ST_SW_CERT_A)
		{
		x=ssl_get_server_send_cert(s);
3018 3019 3020 3021 3022 3023 3024 3025 3026
		if (x == NULL)
			{
			/* VRS: allow null cert if auth == KRB5 */
			if ((s->s3->tmp.new_cipher->algorithm_auth != SSL_aKRB5) ||
			    (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5))
				{
				SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,ERR_R_INTERNAL_ERROR);
				return(0);
				}
3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037
			}

		l=ssl3_output_cert_chain(s,x);
		s->state=SSL3_ST_SW_CERT_B;
		s->init_num=(int)l;
		s->init_off=0;
		}

	/* SSL3_ST_SW_CERT_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}
3038
#ifndef OPENSSL_NO_TLSEXT
3039 3040 3041 3042 3043
int ssl3_send_newsession_ticket(SSL *s)
	{
	if (s->state == SSL3_ST_SW_SESSION_TICKET_A)
		{
		unsigned char *p, *senc, *macstart;
3044
		int len, slen;
3045 3046 3047
		unsigned int hlen;
		EVP_CIPHER_CTX ctx;
		HMAC_CTX hctx;
3048
		SSL_CTX *tctx = s->initial_ctx;
D
Dr. Stephen Henson 已提交
3049 3050
		unsigned char iv[EVP_MAX_IV_LENGTH];
		unsigned char key_name[16];
3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080

		/* get session encoding length */
		slen = i2d_SSL_SESSION(s->session, NULL);
		/* Some length values are 16 bits, so forget it if session is
 		 * too long
 		 */
		if (slen > 0xFF00)
			return -1;
		/* Grow buffer if need be: the length calculation is as
 		 * follows 1 (size of message name) + 3 (message length
 		 * bytes) + 4 (ticket lifetime hint) + 2 (ticket length) +
 		 * 16 (key name) + max_iv_len (iv length) +
 		 * session_length + max_enc_block_size (max encrypted session
 		 * length) + max_md_size (HMAC).
 		 */
		if (!BUF_MEM_grow(s->init_buf,
			26 + EVP_MAX_IV_LENGTH + EVP_MAX_BLOCK_LENGTH +
			EVP_MAX_MD_SIZE + slen))
			return -1;
		senc = OPENSSL_malloc(slen);
		if (!senc)
			return -1;
		p = senc;
		i2d_SSL_SESSION(s->session, &p);

		p=(unsigned char *)s->init_buf->data;
		/* do the header */
		*(p++)=SSL3_MT_NEWSESSION_TICKET;
		/* Skip message length for now */
		p += 3;
D
Dr. Stephen Henson 已提交
3081 3082 3083 3084 3085 3086
		EVP_CIPHER_CTX_init(&ctx);
		HMAC_CTX_init(&hctx);
		/* Initialize HMAC and cipher contexts. If callback present
		 * it does all the work otherwise use generated values
		 * from parent ctx.
		 */
3087
		if (tctx->tlsext_ticket_key_cb)
D
Dr. Stephen Henson 已提交
3088
			{
3089
			if (tctx->tlsext_ticket_key_cb(s, key_name, iv, &ctx,
D
Dr. Stephen Henson 已提交
3090 3091 3092 3093 3094 3095 3096 3097 3098 3099
							 &hctx, 1) < 0)
				{
				OPENSSL_free(senc);
				return -1;
				}
			}
		else
			{
			RAND_pseudo_bytes(iv, 16);
			EVP_EncryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3100 3101
					tctx->tlsext_tick_aes_key, iv);
			HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
D
Dr. Stephen Henson 已提交
3102
					tlsext_tick_md(), NULL);
3103
			memcpy(key_name, tctx->tlsext_tick_key_name, 16);
D
Dr. Stephen Henson 已提交
3104
			}
3105 3106 3107 3108 3109
		l2n(s->session->tlsext_tick_lifetime_hint, p);
		/* Skip ticket length for now */
		p += 2;
		/* Output key name */
		macstart = p;
D
Dr. Stephen Henson 已提交
3110
		memcpy(p, key_name, 16);
3111
		p += 16;
D
Dr. Stephen Henson 已提交
3112 3113 3114
		/* output IV */
		memcpy(p, iv, EVP_CIPHER_CTX_iv_length(&ctx));
		p += EVP_CIPHER_CTX_iv_length(&ctx);
3115
		/* Encrypt session data */
3116
		EVP_EncryptUpdate(&ctx, p, &len, senc, slen);
3117
		p += len;
3118
		EVP_EncryptFinal(&ctx, p, &len);
3119
		p += len;
D
Dr. Stephen Henson 已提交
3120
		EVP_CIPHER_CTX_cleanup(&ctx);
3121 3122 3123

		HMAC_Update(&hctx, macstart, p - macstart);
		HMAC_Final(&hctx, p, &hlen);
3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144
		HMAC_CTX_cleanup(&hctx);

		p += hlen;
		/* Now write out lengths: p points to end of data written */
		/* Total length */
		len = p - (unsigned char *)s->init_buf->data;
		p=(unsigned char *)s->init_buf->data + 1;
		l2n3(len - 4, p); /* Message length */
		p += 4;
		s2n(len - 10, p);  /* Ticket length */

		/* number of bytes to write */
		s->init_num= len;
		s->state=SSL3_ST_SW_SESSION_TICKET_B;
		s->init_off=0;
		OPENSSL_free(senc);
		}

	/* SSL3_ST_SW_SESSION_TICKET_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}
3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179

int ssl3_send_cert_status(SSL *s)
	{
	if (s->state == SSL3_ST_SW_CERT_STATUS_A)
		{
		unsigned char *p;
		/* Grow buffer if need be: the length calculation is as
 		 * follows 1 (message type) + 3 (message length) +
 		 * 1 (ocsp response type) + 3 (ocsp response length)
 		 * + (ocsp response)
 		 */
		if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen))
			return -1;

		p=(unsigned char *)s->init_buf->data;

		/* do the header */
		*(p++)=SSL3_MT_CERTIFICATE_STATUS;
		/* message length */
		l2n3(s->tlsext_ocsp_resplen + 4, p);
		/* status type */
		*(p++)= s->tlsext_status_type;
		/* length of OCSP response */
		l2n3(s->tlsext_ocsp_resplen, p);
		/* actual response */
		memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
		/* number of bytes to write */
		s->init_num = 8 + s->tlsext_ocsp_resplen;
		s->state=SSL3_ST_SW_CERT_STATUS_B;
		s->init_off = 0;
		}

	/* SSL3_ST_SW_CERT_STATUS_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}
3180
#endif