s3_clnt.c 72.6 KB
Newer Older
1
/* ssl/s3_clnt.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */
58
/* ====================================================================
59
 * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
B
Bodo Möller 已提交
111 112 113 114 115 116 117 118 119 120 121 122 123
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
 * Portions of the attached software ("Contribution") are developed by 
 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 *
 * The Contribution is licensed pursuant to the OpenSSL open source
 * license provided above.
 *
 * ECC cipher suite support in OpenSSL originally written by
 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
 *
 */
124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149
/* ====================================================================
 * Copyright 2005 Nokia. All rights reserved.
 *
 * The portions of the attached software ("Contribution") is developed by
 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 * license.
 *
 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 * support (see RFC 4279) to OpenSSL.
 *
 * No patent licenses or other rights except those expressly stated in
 * the OpenSSL open source license shall be deemed granted or received
 * expressly, by implication, estoppel, or otherwise.
 *
 * No assurances are provided by Nokia that the Contribution does not
 * infringe the patent or other intellectual property rights of any third
 * party or that the license provides you with all the necessary rights
 * to make use of the Contribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 * OTHERWISE.
 */
150 151

#include <stdio.h>
152 153
#include "ssl_locl.h"
#include "kssl_lcl.h"
154 155 156 157
#include <openssl/buffer.h>
#include <openssl/rand.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
158
#include <openssl/md5.h>
N
make  
Nils Larsch 已提交
159
#ifndef OPENSSL_NO_DH
160
#include <openssl/dh.h>
N
make  
Nils Larsch 已提交
161
#endif
162
#include <openssl/bn.h>
163 164 165
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif
166

167
static const SSL_METHOD *ssl3_get_client_method(int ver);
168
static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
169 170 171
#ifndef OPENSSL_NO_TLSEXT
static int ssl3_check_finished(SSL *s);
#endif
B
Bodo Möller 已提交
172

173
static const SSL_METHOD *ssl3_get_client_method(int ver)
174
	{
175
	if (ver == SSL3_VERSION)
176 177 178 179 180
		return(SSLv3_client_method());
	else
		return(NULL);
	}

181 182 183 184
IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
			ssl_undefined_function,
			ssl3_connect,
			ssl3_get_client_method)
185

U
Ulf Möller 已提交
186
int ssl3_connect(SSL *s)
187
	{
R
Richard Levitte 已提交
188
	BUF_MEM *buf=NULL;
189
	unsigned long Time=(unsigned long)time(NULL);
190
	long num1;
B
Ben Laurie 已提交
191
	void (*cb)(const SSL *ssl,int type,int val)=NULL;
192 193 194
	int ret= -1;
	int new_state,state,skip=0;;

195
	RAND_add(&Time,sizeof(Time),0);
196
	ERR_clear_error();
197
	clear_sys_error();
198 199 200 201 202 203 204

	if (s->info_callback != NULL)
		cb=s->info_callback;
	else if (s->ctx->info_callback != NULL)
		cb=s->ctx->info_callback;
	
	s->in_handshake++;
205
	if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); 
206 207 208 209 210 211 212 213 214 215

	for (;;)
		{
		state=s->state;

		switch(s->state)
			{
		case SSL_ST_RENEGOTIATE:
			s->new_session=1;
			s->state=SSL_ST_CONNECT;
216
			s->ctx->stats.sess_connect_renegotiate++;
217 218 219 220 221 222
			/* break */
		case SSL_ST_BEFORE:
		case SSL_ST_CONNECT:
		case SSL_ST_BEFORE|SSL_ST_CONNECT:
		case SSL_ST_OK|SSL_ST_CONNECT:

223
			s->server=0;
224 225
			if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);

226
			if ((s->version & 0xff00 ) != 0x0300)
227
				{
B
Bodo Möller 已提交
228
				SSLerr(SSL_F_SSL3_CONNECT, ERR_R_INTERNAL_ERROR);
229 230 231 232
				ret = -1;
				goto end;
				}
				
233
			/* s->version=SSL3_VERSION; */
234 235 236 237 238 239 240 241 242 243 244 245 246 247 248
			s->type=SSL_ST_CONNECT;

			if (s->init_buf == NULL)
				{
				if ((buf=BUF_MEM_new()) == NULL)
					{
					ret= -1;
					goto end;
					}
				if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
					{
					ret= -1;
					goto end;
					}
				s->init_buf=buf;
R
Richard Levitte 已提交
249
				buf=NULL;
250 251 252 253 254
				}

			if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }

			/* setup buffing BIO */
255
			if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
256 257 258 259 260 261

			/* don't push the buffering BIO quite yet */

			ssl3_init_finished_mac(s);

			s->state=SSL3_ST_CW_CLNT_HELLO_A;
262
			s->ctx->stats.sess_connect++;
263 264 265 266 267 268 269 270 271 272 273 274 275
			s->init_num=0;
			break;

		case SSL3_ST_CW_CLNT_HELLO_A:
		case SSL3_ST_CW_CLNT_HELLO_B:

			s->shutdown=0;
			ret=ssl3_client_hello(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CR_SRVR_HELLO_A;
			s->init_num=0;

			/* turn on buffering for the next lot of output */
276 277
			if (s->bbio != s->wbio)
				s->wbio=BIO_push(s->bbio,s->wbio);
278 279 280 281 282 283 284

			break;

		case SSL3_ST_CR_SRVR_HELLO_A:
		case SSL3_ST_CR_SRVR_HELLO_B:
			ret=ssl3_get_server_hello(s);
			if (ret <= 0) goto end;
285

286 287 288 289 290 291 292 293 294
			if (s->hit)
				s->state=SSL3_ST_CR_FINISHED_A;
			else
				s->state=SSL3_ST_CR_CERT_A;
			s->init_num=0;
			break;

		case SSL3_ST_CR_CERT_A:
		case SSL3_ST_CR_CERT_B:
295 296 297 298 299 300
#ifndef OPENSSL_NO_TLSEXT
			ret=ssl3_check_finished(s);
			if (ret <= 0) goto end;
			if (ret == 2)
				{
				s->hit = 1;
D
Dr. Stephen Henson 已提交
301 302 303 304
				if (s->tlsext_ticket_expected)
					s->state=SSL3_ST_CR_SESSION_TICKET_A;
				else
					s->state=SSL3_ST_CR_FINISHED_A;
305 306 307 308
				s->init_num=0;
				break;
				}
#endif
B
Bodo Möller 已提交
309
			/* Check if it is anon DH/ECDH */
310
			/* or PSK */
311 312
			if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
			    !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK))
313 314 315
				{
				ret=ssl3_get_server_certificate(s);
				if (ret <= 0) goto end;
316 317 318 319 320 321 322 323 324 325
#ifndef OPENSSL_NO_TLSEXT
				if (s->tlsext_status_expected)
					s->state=SSL3_ST_CR_CERT_STATUS_A;
				else
					s->state=SSL3_ST_CR_KEY_EXCH_A;
				}
			else
				{
				skip = 1;
				s->state=SSL3_ST_CR_KEY_EXCH_A;
326
				}
327
#else
328
				}
329 330
			else
				skip=1;
331

332
			s->state=SSL3_ST_CR_KEY_EXCH_A;
333
#endif
334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375
			s->init_num=0;
			break;

		case SSL3_ST_CR_KEY_EXCH_A:
		case SSL3_ST_CR_KEY_EXCH_B:
			ret=ssl3_get_key_exchange(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CR_CERT_REQ_A;
			s->init_num=0;

			/* at this point we check that we have the
			 * required stuff from the server */
			if (!ssl3_check_cert_and_algorithm(s))
				{
				ret= -1;
				goto end;
				}
			break;

		case SSL3_ST_CR_CERT_REQ_A:
		case SSL3_ST_CR_CERT_REQ_B:
			ret=ssl3_get_certificate_request(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CR_SRVR_DONE_A;
			s->init_num=0;
			break;

		case SSL3_ST_CR_SRVR_DONE_A:
		case SSL3_ST_CR_SRVR_DONE_B:
			ret=ssl3_get_server_done(s);
			if (ret <= 0) goto end;
			if (s->s3->tmp.cert_req)
				s->state=SSL3_ST_CW_CERT_A;
			else
				s->state=SSL3_ST_CW_KEY_EXCH_A;
			s->init_num=0;

			break;

		case SSL3_ST_CW_CERT_A:
		case SSL3_ST_CW_CERT_B:
		case SSL3_ST_CW_CERT_C:
B
Bodo Möller 已提交
376
		case SSL3_ST_CW_CERT_D:
377 378 379 380 381 382 383 384 385 386 387 388
			ret=ssl3_send_client_certificate(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CW_KEY_EXCH_A;
			s->init_num=0;
			break;

		case SSL3_ST_CW_KEY_EXCH_A:
		case SSL3_ST_CW_KEY_EXCH_B:
			ret=ssl3_send_client_key_exchange(s);
			if (ret <= 0) goto end;
			/* EAY EAY EAY need to check for DH fix cert
			 * sent back */
389 390
			/* For TLS, cert_req is set to 2, so a cert chain
			 * of nothing is sent, but no verify packet is sent */
B
Bodo Möller 已提交
391 392 393 394 395 396 397
			/* XXX: For now, we do not support client 
			 * authentication in ECDH cipher suites with
			 * ECDH (rather than ECDSA) certificates.
			 * We need to skip the certificate verify 
			 * message when client's ECDH public key is sent 
			 * inside the client certificate.
			 */
398
			if (s->s3->tmp.cert_req == 1)
399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428
				{
				s->state=SSL3_ST_CW_CERT_VRFY_A;
				}
			else
				{
				s->state=SSL3_ST_CW_CHANGE_A;
				s->s3->change_cipher_spec=0;
				}

			s->init_num=0;
			break;

		case SSL3_ST_CW_CERT_VRFY_A:
		case SSL3_ST_CW_CERT_VRFY_B:
			ret=ssl3_send_client_verify(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CW_CHANGE_A;
			s->init_num=0;
			s->s3->change_cipher_spec=0;
			break;

		case SSL3_ST_CW_CHANGE_A:
		case SSL3_ST_CW_CHANGE_B:
			ret=ssl3_send_change_cipher_spec(s,
				SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CW_FINISHED_A;
			s->init_num=0;

			s->session->cipher=s->s3->tmp.new_cipher;
429 430 431
#ifdef OPENSSL_NO_COMP
			s->session->compress_meth=0;
#else
432 433 434 435 436
			if (s->s3->tmp.new_compression == NULL)
				s->session->compress_meth=0;
			else
				s->session->compress_meth=
					s->s3->tmp.new_compression->id;
437
#endif
438
			if (!s->method->ssl3_enc->setup_key_block(s))
439 440 441 442 443
				{
				ret= -1;
				goto end;
				}

444
			if (!s->method->ssl3_enc->change_cipher_state(s,
445 446 447 448 449 450 451 452 453 454 455 456
				SSL3_CHANGE_CIPHER_CLIENT_WRITE))
				{
				ret= -1;
				goto end;
				}

			break;

		case SSL3_ST_CW_FINISHED_A:
		case SSL3_ST_CW_FINISHED_B:
			ret=ssl3_send_finished(s,
				SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
457 458
				s->method->ssl3_enc->client_finished_label,
				s->method->ssl3_enc->client_finished_label_len);
459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CW_FLUSH;

			/* clear flags */
			s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
			if (s->hit)
				{
				s->s3->tmp.next_state=SSL_ST_OK;
				if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED)
					{
					s->state=SSL_ST_OK;
					s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
					s->s3->delay_buf_pop_ret=0;
					}
				}
			else
				{
476 477 478 479 480 481 482
#ifndef OPENSSL_NO_TLSEXT
				/* Allow NewSessionTicket if ticket expected */
				if (s->tlsext_ticket_expected)
					s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
				else
#endif
				
483 484 485 486 487
				s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
				}
			s->init_num=0;
			break;

488 489 490 491
#ifndef OPENSSL_NO_TLSEXT
		case SSL3_ST_CR_SESSION_TICKET_A:
		case SSL3_ST_CR_SESSION_TICKET_B:
			ret=ssl3_get_new_session_ticket(s);
492
			if (ret <= 0) goto end;
493 494 495
			s->state=SSL3_ST_CR_FINISHED_A;
			s->init_num=0;
		break;
496 497 498 499 500 501 502 503

		case SSL3_ST_CR_CERT_STATUS_A:
		case SSL3_ST_CR_CERT_STATUS_B:
			ret=ssl3_get_cert_status(s);
			if (ret <= 0) goto end;
			s->state=SSL3_ST_CR_KEY_EXCH_A;
			s->init_num=0;
		break;
504 505
#endif

506 507 508 509
		case SSL3_ST_CR_FINISHED_A:
		case SSL3_ST_CR_FINISHED_B:

			ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
510
				SSL3_ST_CR_FINISHED_B);
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537
			if (ret <= 0) goto end;

			if (s->hit)
				s->state=SSL3_ST_CW_CHANGE_A;
			else
				s->state=SSL_ST_OK;
			s->init_num=0;
			break;

		case SSL3_ST_CW_FLUSH:
			/* number of bytes to be flushed */
			num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
			if (num1 > 0)
				{
				s->rwstate=SSL_WRITING;
				num1=BIO_flush(s->wbio);
				if (num1 <= 0) { ret= -1; goto end; }
				s->rwstate=SSL_NOTHING;
				}

			s->state=s->s3->tmp.next_state;
			break;

		case SSL_ST_OK:
			/* clean a few things up */
			ssl3_cleanup_key_block(s);

538
			if (s->init_buf != NULL)
539
				{
540 541
				BUF_MEM_free(s->init_buf);
				s->init_buf=NULL;
542
				}
543 544 545 546 547 548

			/* If we are not 'joining' the last two packets,
			 * remove the buffering now */
			if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
				ssl_free_wbio_buffer(s);
			/* else do it later in ssl3_write */
549 550 551 552 553

			s->init_num=0;
			s->new_session=0;

			ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
554
			if (s->hit) s->ctx->stats.sess_hit++;
555 556 557 558

			ret=1;
			/* s->server=0; */
			s->handshake_func=ssl3_connect;
559
			s->ctx->stats.sess_connect_good++;
560 561 562 563

			if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);

			goto end;
564
			/* break; */
565 566 567 568 569 570 571 572 573 574 575
			
		default:
			SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE);
			ret= -1;
			goto end;
			/* break; */
			}

		/* did we do anything */
		if (!s->s3->tmp.reuse_message && !skip)
			{
576 577 578 579 580
			if (s->debug)
				{
				if ((ret=BIO_flush(s->wbio)) <= 0)
					goto end;
				}
581 582 583 584 585 586 587 588 589 590 591 592

			if ((cb != NULL) && (s->state != state))
				{
				new_state=s->state;
				s->state=state;
				cb(s,SSL_CB_CONNECT_LOOP,1);
				s->state=new_state;
				}
			}
		skip=0;
		}
end:
593
	s->in_handshake--;
R
Richard Levitte 已提交
594 595
	if (buf != NULL)
		BUF_MEM_free(buf);
596 597 598 599 600 601
	if (cb != NULL)
		cb(s,SSL_CB_CONNECT_EXIT,ret);
	return(ret);
	}


B
Ben Laurie 已提交
602
int ssl3_client_hello(SSL *s)
603 604 605
	{
	unsigned char *buf;
	unsigned char *p,*d;
606
	int i;
607
	unsigned long Time,l;
608 609
#ifndef OPENSSL_NO_COMP
	int j;
610
	SSL_COMP *comp;
611
#endif
612 613 614 615 616

	buf=(unsigned char *)s->init_buf->data;
	if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
		{
		if ((s->session == NULL) ||
617 618
			(s->session->ssl_version != s->version) ||
			(s->session->not_resumable))
619 620 621 622 623 624 625
			{
			if (!ssl_get_new_session(s,0))
				goto err;
			}
		/* else use the pre-loaded session */

		p=s->s3->client_random;
D
Dr. Stephen Henson 已提交
626
		Time=(unsigned long)time(NULL);			/* Time */
627
		l2n(Time,p);
628 629
		if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
			goto err;
630 631 632 633

		/* Do the message type and length last */
		d=p= &(buf[4]);

634 635
		*(p++)=s->version>>8;
		*(p++)=s->version&0xff;
636
		s->client_version=s->version;
637 638 639 640 641 642 643 644 645 646 647 648 649

		/* Random stuff */
		memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
		p+=SSL3_RANDOM_SIZE;

		/* Session ID */
		if (s->new_session)
			i=0;
		else
			i=s->session->session_id_length;
		*(p++)=i;
		if (i != 0)
			{
650
			if (i > (int)sizeof(s->session->session_id))
B
Bodo Möller 已提交
651 652 653 654
				{
				SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
				goto err;
				}
655 656 657 658 659
			memcpy(p,s->session->session_id,i);
			p+=i;
			}
		
		/* Ciphers supported */
660
		i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),0);
661 662 663 664 665 666 667 668
		if (i == 0)
			{
			SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);
			goto err;
			}
		s2n(i,p);
		p+=i;

669
		/* COMPRESSION */
670 671 672
#ifdef OPENSSL_NO_COMP
		*(p++)=1;
#else
673 674 675

		if ((s->options & SSL_OP_NO_COMPRESSION)
					|| !s->ctx->comp_methods)
676 677
			j=0;
		else
B
Ben Laurie 已提交
678
			j=sk_SSL_COMP_num(s->ctx->comp_methods);
679 680 681
		*(p++)=1+j;
		for (i=0; i<j; i++)
			{
B
Ben Laurie 已提交
682
			comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
683 684
			*(p++)=comp->id;
			}
685
#endif
686
		*(p++)=0; /* Add the NULL method */
687

688
#ifndef OPENSSL_NO_TLSEXT
689
		/* TLS extensions*/
690 691 692 693 694
		if (ssl_prepare_clienthello_tlsext(s) <= 0)
			{
			SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
			goto err;
			}
695 696
		if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
			{
697 698
			SSLerr(SSL_F_SSL3_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
			goto err;
699
			}
700
#endif
701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718
		
		l=(p-d);
		d=buf;
		*(d++)=SSL3_MT_CLIENT_HELLO;
		l2n3(l,d);

		s->state=SSL3_ST_CW_CLNT_HELLO_B;
		/* number of bytes to write */
		s->init_num=p-buf;
		s->init_off=0;
		}

	/* SSL3_ST_CW_CLNT_HELLO_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
err:
	return(-1);
	}

B
Ben Laurie 已提交
719
int ssl3_get_server_hello(SSL *s)
720
	{
B
Ben Laurie 已提交
721
	STACK_OF(SSL_CIPHER) *sk;
722 723 724 725 726
	SSL_CIPHER *c;
	unsigned char *p,*d;
	int i,al,ok;
	unsigned int j;
	long n;
727
#ifndef OPENSSL_NO_COMP
728
	SSL_COMP *comp;
729
#endif
730

B
Ben Laurie 已提交
731
	n=s->method->ssl_get_message(s,
732 733
		SSL3_ST_CR_SRVR_HELLO_A,
		SSL3_ST_CR_SRVR_HELLO_B,
B
Ben Laurie 已提交
734
		-1,
735
		20000, /* ?? */
736 737 738
		&ok);

	if (!ok) return((int)n);
B
Ben Laurie 已提交
739 740 741 742 743 744 745 746 747 748 749 750 751

	if ( SSL_version(s) == DTLS1_VERSION)
		{
		if ( s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST)
			{
			if ( s->d1->send_cookie == 0)
				{
				s->s3->tmp.reuse_message = 1;
				return 1;
				}
			else /* already sent a cookie */
				{
				al=SSL_AD_UNEXPECTED_MESSAGE;
752
				SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
B
Ben Laurie 已提交
753 754 755 756 757 758 759 760
				goto f_err;
				}
			}
		}
	
	if ( s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO)
		{
		al=SSL_AD_UNEXPECTED_MESSAGE;
761
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
B
Ben Laurie 已提交
762 763 764
		goto f_err;
		}

765
	d=p=(unsigned char *)s->init_msg;
766

767
	if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
768 769
		{
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_SSL_VERSION);
770 771 772
		s->version=(s->version&0xff00)|p[1];
		al=SSL_AD_PROTOCOL_VERSION;
		goto f_err;
773 774 775 776 777 778 779 780 781 782 783
		}
	p+=2;

	/* load the server hello data */
	/* load the server random */
	memcpy(s->s3->server_random,p,SSL3_RANDOM_SIZE);
	p+=SSL3_RANDOM_SIZE;

	/* get the session-id */
	j= *(p++);

784
	if ((j > sizeof s->session->session_id) || (j > SSL3_SESSION_ID_SIZE))
785
		{
786 787 788
		al=SSL_AD_ILLEGAL_PARAMETER;
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SSL3_SESSION_ID_TOO_LONG);
		goto f_err;
789
		}
790

B
Ben Laurie 已提交
791 792 793 794 795 796
	if (j != 0 && j == s->session->session_id_length
	    && memcmp(p,s->session->session_id,j) == 0)
	    {
	    if(s->sid_ctx_length != s->session->sid_ctx_length
	       || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
		{
797
		/* actually a client application bug */
B
Ben Laurie 已提交
798 799 800 801 802 803
		al=SSL_AD_ILLEGAL_PARAMETER;
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
		goto f_err;
		}
	    s->hit=1;
	    }
804
	else	/* a miss or crap from the other end */
805
		{
806 807
		/* If we were trying for session-id reuse, make a new
		 * SSL_SESSION so we don't stuff up other people */
808
		s->hit=0;
809 810 811 812 813 814 815 816 817 818
		if (s->session->session_id_length > 0)
			{
			if (!ssl_get_new_session(s,0))
				{
				al=SSL_AD_INTERNAL_ERROR;
				goto f_err;
				}
			}
		s->session->session_id_length=j;
		memcpy(s->session->session_id,p,j); /* j could be 0 */
819 820 821 822 823 824
		}
	p+=j;
	c=ssl_get_cipher_by_char(s,p);
	if (c == NULL)
		{
		/* unknown cipher */
825
		al=SSL_AD_ILLEGAL_PARAMETER;
826 827 828 829 830 831
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNKNOWN_CIPHER_RETURNED);
		goto f_err;
		}
	p+=ssl_put_cipher_by_char(s,NULL,NULL);

	sk=ssl_get_ciphers_by_id(s);
B
Ben Laurie 已提交
832
	i=sk_SSL_CIPHER_find(sk,c);
833 834 835
	if (i < 0)
		{
		/* we did not say we would use this cipher */
836
		al=SSL_AD_ILLEGAL_PARAMETER;
837 838 839 840
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED);
		goto f_err;
		}

841 842 843 844 845
	/* Depending on the session caching (internal/external), the cipher
	   and/or cipher_id values may not be set. Make sure that
	   cipher_id is set and use it for comparison. */
	if (s->session->cipher)
		s->session->cipher_id = s->session->cipher->id;
846
	if (s->hit && (s->session->cipher_id != c->id))
847
		{
848
		if (!(s->options &
849 850
			SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
			{
851
			al=SSL_AD_ILLEGAL_PARAMETER;
852 853 854 855 856
			SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
			goto f_err;
			}
		}
	s->s3->tmp.new_cipher=c;
857
	ssl3_digest_cached_records(s);
858 859

	/* lets get the compression algorithm */
860
	/* COMPRESSION */
861 862 863 864 865 866 867 868
#ifdef OPENSSL_NO_COMP
	if (*(p++) != 0)
		{
		al=SSL_AD_ILLEGAL_PARAMETER;
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
		goto f_err;
		}
#else
869
	j= *(p++);
870
	if ((j == 0) || (s->options & SSL_OP_NO_COMPRESSION))
871 872 873 874 875
		comp=NULL;
	else
		comp=ssl3_comp_find(s->ctx->comp_methods,j);
	
	if ((j != 0) && (comp == NULL))
876
		{
877
		al=SSL_AD_ILLEGAL_PARAMETER;
878 879 880
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
		goto f_err;
		}
881 882 883 884
	else
		{
		s->s3->tmp.new_compression=comp;
		}
885
#endif
886

887 888 889
#ifndef OPENSSL_NO_TLSEXT
	/* TLS extensions*/
	if (s->version > SSL3_VERSION)
890 891 892 893
		{
		if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))
			{
			/* 'al' set by ssl_parse_serverhello_tlsext */
894
			SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_PARSE_TLSEXT);
895
			goto f_err; 
896
			}
897
		if (ssl_check_serverhello_tlsext(s) <= 0)
898
			{
B
Bodo Möller 已提交
899
			SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);
900 901
				goto err;
			}
902 903
		}
#endif
904 905 906 907

	if (p != (d+n))
		{
		/* wrong packet length */
908
		al=SSL_AD_DECODE_ERROR;
909 910 911 912 913 914 915 916 917 918 919
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH);
		goto err;
		}

	return(1);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
err:
	return(-1);
	}

B
Ben Laurie 已提交
920
int ssl3_get_server_certificate(SSL *s)
921 922 923 924
	{
	int al,i,ok,ret= -1;
	unsigned long n,nc,llen,l;
	X509 *x=NULL;
925 926
	const unsigned char *q,*p;
	unsigned char *d;
B
Ben Laurie 已提交
927
	STACK_OF(X509) *sk=NULL;
928
	SESS_CERT *sc;
929
	EVP_PKEY *pkey=NULL;
930
	int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
931

B
Ben Laurie 已提交
932
	n=s->method->ssl_get_message(s,
933 934 935
		SSL3_ST_CR_CERT_A,
		SSL3_ST_CR_CERT_B,
		-1,
936
		s->max_cert_list,
937 938 939 940 941 942 943 944 945 946 947 948
		&ok);

	if (!ok) return((int)n);

	if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
		{
		s->s3->tmp.reuse_message=1;
		return(1);
		}

	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
		{
949
		al=SSL_AD_UNEXPECTED_MESSAGE;
950 951 952
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
		goto f_err;
		}
953
	p=d=(unsigned char *)s->init_msg;
954

B
Ben Laurie 已提交
955
	if ((sk=sk_X509_new_null()) == NULL)
956 957 958 959 960 961 962 963
		{
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
		goto err;
		}

	n2l3(p,llen);
	if (llen+3 != n)
		{
964
		al=SSL_AD_DECODE_ERROR;
965 966 967 968 969 970 971 972
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	for (nc=0; nc<llen; )
		{
		n2l3(p,l);
		if ((l+nc+3) > llen)
			{
973
			al=SSL_AD_DECODE_ERROR;
974 975 976 977 978 979 980 981
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}

		q=p;
		x=d2i_X509(NULL,&q,l);
		if (x == NULL)
			{
982
			al=SSL_AD_BAD_CERTIFICATE;
983 984 985 986 987
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_ASN1_LIB);
			goto f_err;
			}
		if (q != (p+l))
			{
988
			al=SSL_AD_DECODE_ERROR;
989 990 991
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
			goto f_err;
			}
B
Ben Laurie 已提交
992
		if (!sk_X509_push(sk,x))
993 994 995 996 997 998 999 1000 1001 1002
			{
			SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
			goto err;
			}
		x=NULL;
		nc+=l+3;
		p=q;
		}

	i=ssl_verify_cert_chain(s,sk);
1003 1004
	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
#ifndef OPENSSL_NO_KRB5
1005 1006
	    && !((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&
		 (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
1007
#endif /* OPENSSL_NO_KRB5 */
1008
		)
1009 1010 1011 1012 1013
		{
		al=ssl_verify_alarm_type(s->verify_result);
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
		goto f_err; 
		}
1014
	ERR_clear_error(); /* but we keep s->verify_result */
1015

1016 1017
	sc=ssl_sess_cert_new();
	if (sc == NULL) goto err;
1018

1019 1020
	if (s->session->sess_cert) ssl_sess_cert_free(s->session->sess_cert);
	s->session->sess_cert=sc;
1021

1022
	sc->cert_chain=sk;
1023 1024
	/* Inconsistency alert: cert_chain does include the peer's
	 * certificate, which we don't include in s3_srvr.c */
B
Ben Laurie 已提交
1025
	x=sk_X509_value(sk,0);
1026
	sk=NULL;
1027
 	/* VRS 19990621: possible memory leak; sk=null ==> !sk_pop_free() @end*/
1028 1029 1030

	pkey=X509_get_pubkey(x);

1031
	/* VRS: allow null cert if auth == KRB5 */
1032 1033 1034
	need_cert = ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&
	            (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
	            ? 0 : 1;
1035 1036 1037 1038

#ifdef KSSL_DEBUG
	printf("pkey,x = %p, %p\n", pkey,x);
	printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
1039 1040
	printf("cipher, alg, nc = %s, %lx, %lx, %d\n", s->s3->tmp.new_cipher->name,
		s->s3->tmp.new_cipher->algorithm_mkey, s->s3->tmp.new_cipher->algorithm_auth, need_cert);
1041 1042
#endif    /* KSSL_DEBUG */

1043
	if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
1044 1045 1046
		{
		x=NULL;
		al=SSL3_AL_FATAL;
1047 1048
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
			SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
1049 1050 1051 1052
		goto f_err;
		}

	i=ssl_cert_type(x,pkey);
1053
	if (need_cert && i < 0)
1054 1055 1056
		{
		x=NULL;
		al=SSL3_AL_FATAL;
1057 1058
		SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
			SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1059 1060 1061
		goto f_err;
		}

1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086
	if (need_cert)
		{
		sc->peer_cert_type=i;
		CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
		/* Why would the following ever happen?
		 * We just created sc a couple of lines ago. */
		if (sc->peer_pkeys[i].x509 != NULL)
			X509_free(sc->peer_pkeys[i].x509);
		sc->peer_pkeys[i].x509=x;
		sc->peer_key= &(sc->peer_pkeys[i]);

		if (s->session->peer != NULL)
			X509_free(s->session->peer);
		CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
		s->session->peer=x;
		}
	else
		{
		sc->peer_cert_type=i;
		sc->peer_key= NULL;

		if (s->session->peer != NULL)
			X509_free(s->session->peer);
		s->session->peer=NULL;
		}
1087
	s->session->verify_result = s->verify_result;
1088 1089 1090 1091 1092 1093 1094 1095 1096 1097

	x=NULL;
	ret=1;

	if (0)
		{
f_err:
		ssl3_send_alert(s,SSL3_AL_FATAL,al);
		}
err:
1098 1099
	EVP_PKEY_free(pkey);
	X509_free(x);
B
Ben Laurie 已提交
1100
	sk_X509_pop_free(sk,X509_free);
1101 1102 1103
	return(ret);
	}

B
Ben Laurie 已提交
1104
int ssl3_get_key_exchange(SSL *s)
1105
	{
1106
#ifndef OPENSSL_NO_RSA
1107 1108 1109 1110 1111
	unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
#endif
	EVP_MD_CTX md_ctx;
	unsigned char *param,*p;
	int al,i,j,param_len,ok;
1112
	long n,alg_k,alg_a;
1113
	EVP_PKEY *pkey=NULL;
1114
#ifndef OPENSSL_NO_RSA
1115
	RSA *rsa=NULL;
1116
#endif
1117
#ifndef OPENSSL_NO_DH
1118
	DH *dh=NULL;
1119
#endif
B
Bodo Möller 已提交
1120 1121 1122 1123 1124 1125 1126
#ifndef OPENSSL_NO_ECDH
	EC_KEY *ecdh = NULL;
	BN_CTX *bn_ctx = NULL;
	EC_POINT *srvr_ecpoint = NULL;
	int curve_nid = 0;
	int encoded_pt_len = 0;
#endif
1127

1128 1129
	/* use same message size as in ssl3_get_certificate_request()
	 * as ServerKeyExchange message may be skipped */
B
Ben Laurie 已提交
1130
	n=s->method->ssl_get_message(s,
1131 1132 1133
		SSL3_ST_CR_KEY_EXCH_A,
		SSL3_ST_CR_KEY_EXCH_B,
		-1,
1134
		s->max_cert_list,
1135 1136 1137 1138 1139
		&ok);
	if (!ok) return((int)n);

	if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
		{
1140 1141 1142 1143 1144
#ifndef OPENSSL_NO_PSK
		/* In plain PSK ciphersuite, ServerKeyExchange can be
		   omitted if no identity hint is sent. Set
		   session->sess_cert anyway to avoid problems
		   later.*/
1145
		if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)
1146 1147 1148 1149 1150 1151 1152
			{
			s->session->sess_cert=ssl_sess_cert_new();
			if (s->ctx->psk_identity_hint)
				OPENSSL_free(s->ctx->psk_identity_hint);
			s->ctx->psk_identity_hint = NULL;
			}
#endif
1153 1154 1155 1156
		s->s3->tmp.reuse_message=1;
		return(1);
		}

1157
	param=p=(unsigned char *)s->init_msg;
1158
	if (s->session->sess_cert != NULL)
1159
		{
1160
#ifndef OPENSSL_NO_RSA
1161
		if (s->session->sess_cert->peer_rsa_tmp != NULL)
1162
			{
1163 1164
			RSA_free(s->session->sess_cert->peer_rsa_tmp);
			s->session->sess_cert->peer_rsa_tmp=NULL;
1165 1166
			}
#endif
1167
#ifndef OPENSSL_NO_DH
1168
		if (s->session->sess_cert->peer_dh_tmp)
1169
			{
1170 1171
			DH_free(s->session->sess_cert->peer_dh_tmp);
			s->session->sess_cert->peer_dh_tmp=NULL;
1172
			}
B
Bodo Möller 已提交
1173 1174 1175 1176 1177 1178 1179
#endif
#ifndef OPENSSL_NO_ECDH
		if (s->session->sess_cert->peer_ecdh_tmp)
			{
			EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
			s->session->sess_cert->peer_ecdh_tmp=NULL;
			}
1180 1181 1182 1183
#endif
		}
	else
		{
1184
		s->session->sess_cert=ssl_sess_cert_new();
1185 1186 1187
		}

	param_len=0;
1188 1189
	alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
	alg_a=s->s3->tmp.new_cipher->algorithm_auth;
1190
	EVP_MD_CTX_init(&md_ctx);
1191

1192
#ifndef OPENSSL_NO_PSK
1193 1194
	if (alg_k & SSL_kPSK)
		{
1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229
		char tmp_id_hint[PSK_MAX_IDENTITY_LEN+1];

		al=SSL_AD_HANDSHAKE_FAILURE;
		n2s(p,i);
		param_len=i+2;
		/* Store PSK identity hint for later use, hint is used
		 * in ssl3_send_client_key_exchange.  Assume that the
		 * maximum length of a PSK identity hint can be as
		 * long as the maximum length of a PSK identity. */
		if (i > PSK_MAX_IDENTITY_LEN)
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
				SSL_R_DATA_LENGTH_TOO_LONG);
			goto f_err;
			}
		if (param_len > n)
			{
			al=SSL_AD_DECODE_ERROR;
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
				SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH);
			goto f_err;
			}
		/* If received PSK identity hint contains NULL
		 * characters, the hint is truncated from the first
		 * NULL. p may not be ending with NULL, so create a
		 * NULL-terminated string. */
		memcpy(tmp_id_hint, p, i);
		memset(tmp_id_hint+i, 0, PSK_MAX_IDENTITY_LEN+1-i);
		if (s->ctx->psk_identity_hint != NULL)
			OPENSSL_free(s->ctx->psk_identity_hint);
		s->ctx->psk_identity_hint = BUF_strdup(tmp_id_hint);
		if (s->ctx->psk_identity_hint == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
			goto f_err;
1230
			}	   
1231 1232 1233 1234 1235 1236

		p+=i;
		n-=param_len;
		}
	else
#endif /* !OPENSSL_NO_PSK */
1237
#ifndef OPENSSL_NO_RSA
1238
	if (alg_k & SSL_kRSA)
1239 1240 1241 1242 1243 1244 1245 1246 1247 1248
		{
		if ((rsa=RSA_new()) == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
			goto err;
			}
		n2s(p,i);
		param_len=i+2;
		if (param_len > n)
			{
1249
			al=SSL_AD_DECODE_ERROR;
1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_MODULUS_LENGTH);
			goto f_err;
			}
		if (!(rsa->n=BN_bin2bn(p,i,rsa->n)))
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
			goto err;
			}
		p+=i;

		n2s(p,i);
		param_len+=i+2;
		if (param_len > n)
			{
1264
			al=SSL_AD_DECODE_ERROR;
1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_E_LENGTH);
			goto f_err;
			}
		if (!(rsa->e=BN_bin2bn(p,i,rsa->e)))
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
			goto err;
			}
		p+=i;
		n-=param_len;

		/* this should be because we are using an export cipher */
1277
		if (alg_a & SSL_aRSA)
1278
			pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1279 1280
		else
			{
B
Bodo Möller 已提交
1281
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1282 1283
			goto err;
			}
1284
		s->session->sess_cert->peer_rsa_tmp=rsa;
1285
		rsa=NULL;
1286
		}
1287
#else /* OPENSSL_NO_RSA */
1288 1289
	if (0)
		;
1290
#endif
1291
#ifndef OPENSSL_NO_DH
1292
	else if (alg_k & SSL_kEDH)
1293 1294 1295 1296 1297 1298 1299 1300 1301 1302
		{
		if ((dh=DH_new()) == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_DH_LIB);
			goto err;
			}
		n2s(p,i);
		param_len=i+2;
		if (param_len > n)
			{
1303
			al=SSL_AD_DECODE_ERROR;
1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_P_LENGTH);
			goto f_err;
			}
		if (!(dh->p=BN_bin2bn(p,i,NULL)))
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
			goto err;
			}
		p+=i;

		n2s(p,i);
		param_len+=i+2;
		if (param_len > n)
			{
1318
			al=SSL_AD_DECODE_ERROR;
1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_G_LENGTH);
			goto f_err;
			}
		if (!(dh->g=BN_bin2bn(p,i,NULL)))
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
			goto err;
			}
		p+=i;

		n2s(p,i);
		param_len+=i+2;
		if (param_len > n)
			{
1333
			al=SSL_AD_DECODE_ERROR;
1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_DH_PUB_KEY_LENGTH);
			goto f_err;
			}
		if (!(dh->pub_key=BN_bin2bn(p,i,NULL)))
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_BN_LIB);
			goto err;
			}
		p+=i;
		n-=param_len;

1345
#ifndef OPENSSL_NO_RSA
1346
		if (alg_a & SSL_aRSA)
1347
			pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1348 1349 1350
#else
		if (0)
			;
1351
#endif
1352
#ifndef OPENSSL_NO_DSA
1353
		else if (alg_a & SSL_aDSS)
1354
			pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509);
1355 1356 1357
#endif
		/* else anonymous DH, so no certificate or pkey. */

1358
		s->session->sess_cert->peer_dh_tmp=dh;
1359
		dh=NULL;
1360
		}
1361
	else if ((alg_k & SSL_kDHr) || (alg_k & SSL_kDHd))
1362
		{
1363
		al=SSL_AD_ILLEGAL_PARAMETER;
1364 1365 1366
		SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
		goto f_err;
		}
1367
#endif /* !OPENSSL_NO_DH */
B
Bodo Möller 已提交
1368 1369

#ifndef OPENSSL_NO_ECDH
1370
	else if (alg_k & SSL_kEECDH)
B
Bodo Möller 已提交
1371
		{
N
Nils Larsch 已提交
1372 1373 1374
		EC_GROUP *ngroup;
		const EC_GROUP *group;

B
Bodo Möller 已提交
1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387
		if ((ecdh=EC_KEY_new()) == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
			goto err;
			}

		/* Extract elliptic curve parameters and the
		 * server's ephemeral ECDH public key.
		 * Keep accumulating lengths of various components in
		 * param_len and make sure it never exceeds n.
		 */

		/* XXX: For now we only support named (not generic) curves
B
Bodo Möller 已提交
1388
		 * and the ECParameters in this case is just three bytes.
B
Bodo Möller 已提交
1389
		 */
B
Bodo Möller 已提交
1390
		param_len=3;
B
Bodo Möller 已提交
1391 1392
		if ((param_len > n) ||
		    (*p != NAMED_CURVE_TYPE) || 
1393
		    ((curve_nid = tls1_ec_curve_id2nid(*(p + 2))) == 0)) 
B
Bodo Möller 已提交
1394 1395 1396 1397 1398 1399
			{
			al=SSL_AD_INTERNAL_ERROR;
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
			goto f_err;
			}

N
Nils Larsch 已提交
1400 1401 1402 1403 1404 1405 1406
		ngroup = EC_GROUP_new_by_curve_name(curve_nid);
		if (ngroup == NULL)
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
			goto err;
			}
		if (EC_KEY_set_group(ecdh, ngroup) == 0)
B
Bodo Möller 已提交
1407 1408 1409 1410
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
			goto err;
			}
N
Nils Larsch 已提交
1411 1412 1413
		EC_GROUP_free(ngroup);

		group = EC_KEY_get0_group(ecdh);
B
Bodo Möller 已提交
1414 1415

		if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
N
Nils Larsch 已提交
1416
		    (EC_GROUP_get_degree(group) > 163))
B
Bodo Möller 已提交
1417 1418 1419 1420 1421 1422
			{
			al=SSL_AD_EXPORT_RESTRICTION;
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
			goto f_err;
			}

B
Bodo Möller 已提交
1423
		p+=3;
B
Bodo Möller 已提交
1424 1425

		/* Next, get the encoded ECPoint */
N
Nils Larsch 已提交
1426
		if (((srvr_ecpoint = EC_POINT_new(group)) == NULL) ||
B
Bodo Möller 已提交
1427 1428 1429 1430 1431 1432 1433 1434 1435 1436
		    ((bn_ctx = BN_CTX_new()) == NULL))
			{
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
			goto err;
			}

		encoded_pt_len = *p;  /* length of encoded point */
		p+=1;
		param_len += (1 + encoded_pt_len);
		if ((param_len > n) ||
N
Nils Larsch 已提交
1437
		    (EC_POINT_oct2point(group, srvr_ecpoint, 
B
Bodo Möller 已提交
1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
			p, encoded_pt_len, bn_ctx) == 0))
			{
			al=SSL_AD_DECODE_ERROR;
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT);
			goto f_err;
			}

		n-=param_len;
		p+=encoded_pt_len;

		/* The ECC/TLS specification does not mention
		 * the use of DSA to sign ECParameters in the server
		 * key exchange message. We do support RSA and ECDSA.
		 */
		if (0) ;
#ifndef OPENSSL_NO_RSA
1454
		else if (alg_a & SSL_aRSA)
B
Bodo Möller 已提交
1455 1456 1457
			pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
#endif
#ifndef OPENSSL_NO_ECDSA
1458
		else if (alg_a & SSL_aECDSA)
B
Bodo Möller 已提交
1459 1460 1461
			pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
#endif
		/* else anonymous ECDH, so no certificate or pkey. */
N
Nils Larsch 已提交
1462
		EC_KEY_set_public_key(ecdh, srvr_ecpoint);
B
Bodo Möller 已提交
1463 1464 1465
		s->session->sess_cert->peer_ecdh_tmp=ecdh;
		ecdh=NULL;
		BN_CTX_free(bn_ctx);
N
Nils Larsch 已提交
1466
		EC_POINT_free(srvr_ecpoint);
B
Bodo Möller 已提交
1467 1468
		srvr_ecpoint = NULL;
		}
1469
	else if (alg_k)
B
Bodo Möller 已提交
1470 1471 1472 1473 1474 1475
		{
		al=SSL_AD_UNEXPECTED_MESSAGE;
		SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
		goto f_err;
		}
#endif /* !OPENSSL_NO_ECDH */
1476

1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489

	/* p points to the next byte, there are 'n' bytes left */

	/* if it was signed, check the signature */
	if (pkey != NULL)
		{
		n2s(p,i);
		n-=2;
		j=EVP_PKEY_size(pkey);

		if ((i != n) || (n > j) || (n <= 0))
			{
			/* wrong packet length */
1490
			al=SSL_AD_DECODE_ERROR;
1491
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH);
1492
			goto f_err;
1493 1494
			}

1495
#ifndef OPENSSL_NO_RSA
1496 1497 1498 1499 1500 1501 1502 1503
		if (pkey->type == EVP_PKEY_RSA)
			{
			int num;

			j=0;
			q=md_buf;
			for (num=2; num > 0; num--)
				{
D
 
Dr. Stephen Henson 已提交
1504 1505
				EVP_DigestInit_ex(&md_ctx,(num == 2)
					?s->ctx->md5:s->ctx->sha1, NULL);
1506 1507 1508
				EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
				EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
				EVP_DigestUpdate(&md_ctx,param,param_len);
D
 
Dr. Stephen Henson 已提交
1509
				EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i);
1510 1511 1512
				q+=i;
				j+=i;
				}
1513 1514 1515
			i=RSA_verify(NID_md5_sha1, md_buf, j, p, n,
								pkey->pkey.rsa);
			if (i < 0)
1516
				{
1517
				al=SSL_AD_DECRYPT_ERROR;
1518 1519 1520
				SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
				goto f_err;
				}
1521
			if (i == 0)
1522 1523
				{
				/* bad signature */
1524
				al=SSL_AD_DECRYPT_ERROR;
1525 1526 1527 1528 1529 1530
				SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
				goto f_err;
				}
			}
		else
#endif
1531
#ifndef OPENSSL_NO_DSA
1532 1533 1534
			if (pkey->type == EVP_PKEY_DSA)
			{
			/* lets do DSS */
D
 
Dr. Stephen Henson 已提交
1535
			EVP_VerifyInit_ex(&md_ctx,EVP_dss1(), NULL);
1536 1537 1538 1539 1540 1541
			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,param,param_len);
			if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
				{
				/* bad signature */
1542
				al=SSL_AD_DECRYPT_ERROR;
1543 1544 1545 1546 1547
				SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
				goto f_err;
				}
			}
		else
B
Bodo Möller 已提交
1548 1549
#endif
#ifndef OPENSSL_NO_ECDSA
1550
			if (pkey->type == EVP_PKEY_EC)
B
Bodo Möller 已提交
1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565
			{
			/* let's do ECDSA */
			EVP_VerifyInit_ex(&md_ctx,EVP_ecdsa(), NULL);
			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,param,param_len);
			if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
				{
				/* bad signature */
				al=SSL_AD_DECRYPT_ERROR;
				SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
				goto f_err;
				}
			}
		else
1566 1567
#endif
			{
B
Bodo Möller 已提交
1568
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1569 1570 1571 1572 1573
			goto err;
			}
		}
	else
		{
1574
		if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK))
1575
			/* aNULL or kPSK do not need public keys */
1576
			{
B
Bodo Möller 已提交
1577
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1578 1579
			goto err;
			}
1580
		/* still data left over */
1581 1582
		if (n != 0)
			{
1583
			al=SSL_AD_DECODE_ERROR;
1584 1585 1586 1587
			SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_EXTRA_DATA_IN_MESSAGE);
			goto f_err;
			}
		}
1588
	EVP_PKEY_free(pkey);
1589
	EVP_MD_CTX_cleanup(&md_ctx);
1590 1591 1592 1593
	return(1);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
err:
1594
	EVP_PKEY_free(pkey);
1595
#ifndef OPENSSL_NO_RSA
1596 1597 1598
	if (rsa != NULL)
		RSA_free(rsa);
#endif
1599
#ifndef OPENSSL_NO_DH
1600 1601
	if (dh != NULL)
		DH_free(dh);
B
Bodo Möller 已提交
1602 1603 1604 1605 1606 1607
#endif
#ifndef OPENSSL_NO_ECDH
	BN_CTX_free(bn_ctx);
	EC_POINT_free(srvr_ecpoint);
	if (ecdh != NULL)
		EC_KEY_free(ecdh);
1608
#endif
1609
	EVP_MD_CTX_cleanup(&md_ctx);
1610 1611 1612
	return(-1);
	}

B
Ben Laurie 已提交
1613
int ssl3_get_certificate_request(SSL *s)
1614 1615
	{
	int ok,ret=0;
1616 1617
	unsigned long n,nc,l;
	unsigned int llen,ctype_num,i;
1618
	X509_NAME *xn=NULL;
1619 1620
	const unsigned char *p,*q;
	unsigned char *d;
B
Ben Laurie 已提交
1621
	STACK_OF(X509_NAME) *ca_sk=NULL;
1622

B
Ben Laurie 已提交
1623
	n=s->method->ssl_get_message(s,
1624 1625 1626
		SSL3_ST_CR_CERT_REQ_A,
		SSL3_ST_CR_CERT_REQ_B,
		-1,
1627
		s->max_cert_list,
1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641
		&ok);

	if (!ok) return((int)n);

	s->s3->tmp.cert_req=0;

	if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)
		{
		s->s3->tmp.reuse_message=1;
		return(1);
		}

	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST)
		{
1642
		ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
1643 1644 1645 1646
		SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_WRONG_MESSAGE_TYPE);
		goto err;
		}

1647 1648 1649
	/* TLS does not like anon-DH with client cert */
	if (s->version > SSL3_VERSION)
		{
1650
		if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
1651 1652 1653 1654 1655 1656 1657
			{
			ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
			SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER);
			goto err;
			}
		}

1658
	p=d=(unsigned char *)s->init_msg;
1659

B
Ben Laurie 已提交
1660
	if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675
		{
		SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
		goto err;
		}

	/* get the certificate types */
	ctype_num= *(p++);
	if (ctype_num > SSL3_CT_NUMBER)
		ctype_num=SSL3_CT_NUMBER;
	for (i=0; i<ctype_num; i++)
		s->s3->tmp.ctype[i]= p[i];
	p+=ctype_num;

	/* get the CA RDNs */
	n2s(p,llen);
1676 1677 1678 1679 1680 1681 1682 1683 1684
#if 0
{
FILE *out;
out=fopen("/tmp/vsign.der","w");
fwrite(p,1,llen,out);
fclose(out);
}
#endif

1685 1686
	if ((llen+ctype_num+2+1) != n)
		{
1687
		ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1688 1689 1690 1691 1692 1693 1694 1695 1696
		SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_LENGTH_MISMATCH);
		goto err;
		}

	for (nc=0; nc<llen; )
		{
		n2s(p,l);
		if ((l+nc+2) > llen)
			{
1697
			if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1698
				goto cont; /* netscape bugs */
1699
			ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1700 1701 1702 1703 1704 1705 1706 1707
			SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_TOO_LONG);
			goto err;
			}

		q=p;

		if ((xn=d2i_X509_NAME(NULL,&q,l)) == NULL)
			{
U
Ulf Möller 已提交
1708
			/* If netscape tolerance is on, ignore errors */
1709
			if (s->options & SSL_OP_NETSCAPE_CA_DN_BUG)
1710 1711 1712
				goto cont;
			else
				{
1713
				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1714 1715 1716 1717 1718 1719 1720
				SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_ASN1_LIB);
				goto err;
				}
			}

		if (q != (p+l))
			{
1721
			ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1722 1723 1724
			SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH);
			goto err;
			}
B
Ben Laurie 已提交
1725
		if (!sk_X509_NAME_push(ca_sk,xn))
1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740
			{
			SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
			goto err;
			}

		p+=l;
		nc+=l+2;
		}

	if (0)
		{
cont:
		ERR_clear_error();
		}

U
Ulf Möller 已提交
1741
	/* we should setup a certificate to return.... */
1742 1743 1744
	s->s3->tmp.cert_req=1;
	s->s3->tmp.ctype_num=ctype_num;
	if (s->s3->tmp.ca_names != NULL)
B
Ben Laurie 已提交
1745
		sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
1746 1747 1748 1749 1750
	s->s3->tmp.ca_names=ca_sk;
	ca_sk=NULL;

	ret=1;
err:
B
Ben Laurie 已提交
1751
	if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free);
1752 1753 1754
	return(ret);
	}

1755
static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
1756 1757 1758
	{
	return(X509_NAME_cmp(*a,*b));
	}
1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801
#ifndef OPENSSL_NO_TLSEXT
int ssl3_get_new_session_ticket(SSL *s)
	{
	int ok,al,ret=0, ticklen;
	long n;
	const unsigned char *p;
	unsigned char *d;

	n=s->method->ssl_get_message(s,
		SSL3_ST_CR_SESSION_TICKET_A,
		SSL3_ST_CR_SESSION_TICKET_B,
		-1,
		16384,
		&ok);

	if (!ok)
		return((int)n);

	if (s->s3->tmp.message_type == SSL3_MT_FINISHED)
		{
		s->s3->tmp.reuse_message=1;
		return(1);
		}
	if (s->s3->tmp.message_type != SSL3_MT_NEWSESSION_TICKET)
		{
		al=SSL_AD_UNEXPECTED_MESSAGE;
		SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_BAD_MESSAGE_TYPE);
		goto f_err;
		}
	if (n < 6)
		{
		/* need at least ticket_lifetime_hint + ticket length */
		al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	p=d=(unsigned char *)s->init_msg;
	n2l(p, s->session->tlsext_tick_lifetime_hint);
	n2s(p, ticklen);
	/* ticket_lifetime_hint + ticket_length + ticket */
	if (ticklen + 6 != n)
		{
		al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
1802
		SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
1803 1804 1805 1806 1807 1808 1809 1810 1811 1812
		goto f_err;
		}
	if (s->session->tlsext_tick)
		{
		OPENSSL_free(s->session->tlsext_tick);
		s->session->tlsext_ticklen = 0;
		}
	s->session->tlsext_tick = OPENSSL_malloc(ticklen);
	if (!s->session->tlsext_tick)
		{
1813
		SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,ERR_R_MALLOC_FAILURE);
1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825
		goto err;
		}
	memcpy(s->session->tlsext_tick, p, ticklen);
	s->session->tlsext_ticklen = ticklen;
	
	ret=1;
	return(ret);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
err:
	return(-1);
	}
1826 1827 1828 1829

int ssl3_get_cert_status(SSL *s)
	{
	int ok, al;
1830
	unsigned long resplen,n;
1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893
	const unsigned char *p;

	n=s->method->ssl_get_message(s,
		SSL3_ST_CR_CERT_STATUS_A,
		SSL3_ST_CR_CERT_STATUS_B,
		SSL3_MT_CERTIFICATE_STATUS,
		16384,
		&ok);

	if (!ok) return((int)n);
	if (n < 4)
		{
		/* need at least status type + length */
		al = SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	p = (unsigned char *)s->init_msg;
	if (*p++ != TLSEXT_STATUSTYPE_ocsp)
		{
		al = SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_UNSUPPORTED_STATUS_TYPE);
		goto f_err;
		}
	n2l3(p, resplen);
	if (resplen + 4 != n)
		{
		al = SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
		goto f_err;
		}
	if (s->tlsext_ocsp_resp)
		OPENSSL_free(s->tlsext_ocsp_resp);
	s->tlsext_ocsp_resp = BUF_memdup(p, resplen);
	if (!s->tlsext_ocsp_resp)
		{
		al = SSL_AD_INTERNAL_ERROR;
		SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
		goto f_err;
		}
	s->tlsext_ocsp_resplen = resplen;
	if (s->ctx->tlsext_status_cb)
		{
		int ret;
		ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
		if (ret == 0)
			{
			al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
			SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_INVALID_STATUS_RESPONSE);
			goto f_err;
			}
		if (ret < 0)
			{
			al = SSL_AD_INTERNAL_ERROR;
			SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
			goto f_err;
			}
		}
	return 1;
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
	return(-1);
	}
1894
#endif
1895

B
Ben Laurie 已提交
1896
int ssl3_get_server_done(SSL *s)
1897 1898 1899 1900
	{
	int ok,ret=0;
	long n;

B
Ben Laurie 已提交
1901
	n=s->method->ssl_get_message(s,
1902 1903 1904 1905 1906 1907 1908 1909 1910 1911
		SSL3_ST_CR_SRVR_DONE_A,
		SSL3_ST_CR_SRVR_DONE_B,
		SSL3_MT_SERVER_DONE,
		30, /* should be very small, like 0 :-) */
		&ok);

	if (!ok) return((int)n);
	if (n > 0)
		{
		/* should contain no data */
1912
		ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
1913
		SSLerr(SSL_F_SSL3_GET_SERVER_DONE,SSL_R_LENGTH_MISMATCH);
1914
		return -1;
1915 1916 1917 1918 1919
		}
	ret=1;
	return(ret);
	}

1920

B
Ben Laurie 已提交
1921
int ssl3_send_client_key_exchange(SSL *s)
1922
	{
1923
	unsigned char *p,*d;
1924
	int n;
1925
	unsigned long alg_k;
1926
#ifndef OPENSSL_NO_RSA
1927
	unsigned char *q;
1928
	EVP_PKEY *pkey=NULL;
1929
#endif
1930
#ifndef OPENSSL_NO_KRB5
1931
	KSSL_ERR kssl_err;
1932
#endif /* OPENSSL_NO_KRB5 */
B
Bodo Möller 已提交
1933 1934
#ifndef OPENSSL_NO_ECDH
	EC_KEY *clnt_ecdh = NULL;
N
Nils Larsch 已提交
1935
	const EC_POINT *srvr_ecpoint = NULL;
B
Bodo Möller 已提交
1936 1937 1938 1939 1940
	EVP_PKEY *srvr_pub_pkey = NULL;
	unsigned char *encodedPoint = NULL;
	int encoded_pt_len = 0;
	BN_CTX * bn_ctx = NULL;
#endif
1941 1942 1943 1944 1945 1946

	if (s->state == SSL3_ST_CW_KEY_EXCH_A)
		{
		d=(unsigned char *)s->init_buf->data;
		p= &(d[4]);

1947
		alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
1948

1949 1950
		/* Fool emacs indentation */
		if (0) {}
1951
#ifndef OPENSSL_NO_RSA
1952
		else if (alg_k & SSL_kRSA)
1953 1954
			{
			RSA *rsa;
1955
			unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
1956

1957 1958
			if (s->session->sess_cert->peer_rsa_tmp != NULL)
				rsa=s->session->sess_cert->peer_rsa_tmp;
1959 1960
			else
				{
1961
				pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1962 1963 1964 1965
				if ((pkey == NULL) ||
					(pkey->type != EVP_PKEY_RSA) ||
					(pkey->pkey.rsa == NULL))
					{
B
Bodo Möller 已提交
1966
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
1967 1968 1969
					goto err;
					}
				rsa=pkey->pkey.rsa;
B
Bodo Möller 已提交
1970
				EVP_PKEY_free(pkey);
1971 1972
				}
				
1973 1974
			tmp_buf[0]=s->client_version>>8;
			tmp_buf[1]=s->client_version&0xff;
1975
			if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
1976
					goto err;
1977

1978
			s->session->master_key_length=sizeof tmp_buf;
1979

1980 1981 1982 1983
			q=p;
			/* Fix buf for TLS and beyond */
			if (s->version > SSL3_VERSION)
				p+=2;
1984
			n=RSA_public_encrypt(sizeof tmp_buf,
1985
				tmp_buf,p,rsa,RSA_PKCS1_PADDING);
1986 1987 1988 1989
#ifdef PKCS1_CHECK
			if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
			if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70;
#endif
1990 1991 1992 1993 1994 1995
			if (n <= 0)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT);
				goto err;
				}

1996 1997 1998 1999 2000 2001 2002
			/* Fix buf for TLS and beyond */
			if (s->version > SSL3_VERSION)
				{
				s2n(n,q);
				n+=2;
				}

2003
			s->session->master_key_length=
2004
				s->method->ssl3_enc->generate_master_secret(s,
2005
					s->session->master_key,
2006
					tmp_buf,sizeof tmp_buf);
2007
			OPENSSL_cleanse(tmp_buf,sizeof tmp_buf);
2008
			}
2009
#endif
2010
#ifndef OPENSSL_NO_KRB5
2011
		else if (alg_k & SSL_kKRB5)
2012 2013 2014 2015 2016 2017
			{
			krb5_error_code	krb5rc;
			KSSL_CTX	*kssl_ctx = s->kssl_ctx;
			/*  krb5_data	krb5_ap_req;  */
			krb5_data	*enc_ticket;
			krb5_data	authenticator, *authp = NULL;
2018 2019 2020 2021 2022 2023 2024
			EVP_CIPHER_CTX	ciph_ctx;
			EVP_CIPHER	*enc = NULL;
			unsigned char	iv[EVP_MAX_IV_LENGTH];
			unsigned char	tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
			unsigned char	epms[SSL_MAX_MASTER_KEY_LENGTH 
						+ EVP_MAX_IV_LENGTH];
			int 		padl, outl = sizeof(epms);
2025

D
 
Dr. Stephen Henson 已提交
2026 2027
			EVP_CIPHER_CTX_init(&ciph_ctx);

2028
#ifdef KSSL_DEBUG
2029
			printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
2030
				alg_k, SSL_kKRB5);
2031 2032
#endif	/* KSSL_DEBUG */

2033 2034 2035 2036 2037
			authp = NULL;
#ifdef KRB5SENDAUTH
			if (KRB5SENDAUTH)  authp = &authenticator;
#endif	/* KRB5SENDAUTH */

2038
			krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
2039 2040
				&kssl_err);
			enc = kssl_map_enc(kssl_ctx->enctype);
2041 2042
			if (enc == NULL)
			    goto err;
2043
#ifdef KSSL_DEBUG
2044 2045 2046
			{
			printf("kssl_cget_tkt rtn %d\n", krb5rc);
			if (krb5rc && kssl_err.text)
2047
			  printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
2048
			}
2049 2050
#endif	/* KSSL_DEBUG */

2051 2052 2053
			if (krb5rc)
				{
				ssl3_send_alert(s,SSL3_AL_FATAL,
2054
						SSL_AD_HANDSHAKE_FAILURE);
2055
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
2056
						kssl_err.reason);
2057 2058
				goto err;
				}
2059

2060 2061 2062
			/*  20010406 VRS - Earlier versions used KRB5 AP_REQ
			**  in place of RFC 2712 KerberosWrapper, as in:
			**
2063 2064 2065 2066 2067 2068
			**  Send ticket (copy to *p, set n = length)
			**  n = krb5_ap_req.length;
			**  memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
			**  if (krb5_ap_req.data)  
			**    kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
			**
2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102
			**  Now using real RFC 2712 KerberosWrapper
			**  (Thanks to Simon Wilkinson <sxw@sxw.org.uk>)
			**  Note: 2712 "opaque" types are here replaced
			**  with a 2-byte length followed by the value.
			**  Example:
			**  KerberosWrapper= xx xx asn1ticket 0 0 xx xx encpms
			**  Where "xx xx" = length bytes.  Shown here with
			**  optional authenticator omitted.
			*/

			/*  KerberosWrapper.Ticket		*/
			s2n(enc_ticket->length,p);
			memcpy(p, enc_ticket->data, enc_ticket->length);
			p+= enc_ticket->length;
			n = enc_ticket->length + 2;

			/*  KerberosWrapper.Authenticator	*/
			if (authp  &&  authp->length)  
				{
				s2n(authp->length,p);
				memcpy(p, authp->data, authp->length);
				p+= authp->length;
				n+= authp->length + 2;
				
				free(authp->data);
				authp->data = NULL;
				authp->length = 0;
				}
			else
				{
				s2n(0,p);/*  null authenticator length	*/
				n+=2;
				}
 
2103 2104 2105 2106
			    tmp_buf[0]=s->client_version>>8;
			    tmp_buf[1]=s->client_version&0xff;
			    if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
				goto err;
2107 2108

			/*  20010420 VRS.  Tried it this way; failed.
2109
			**	EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
2110 2111
			**	EVP_CIPHER_CTX_set_key_length(&ciph_ctx,
			**				kssl_ctx->length);
2112
			**	EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
2113 2114
			*/

2115
			memset(iv, 0, sizeof iv);  /* per RFC 1510 */
2116 2117
			EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
				kssl_ctx->key,iv);
2118
			EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
2119
				sizeof tmp_buf);
2120
			EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
2121
			outl += padl;
B
Bodo Möller 已提交
2122 2123 2124 2125 2126
			if (outl > sizeof epms)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
				goto err;
				}
2127 2128 2129 2130 2131 2132 2133 2134
			EVP_CIPHER_CTX_cleanup(&ciph_ctx);

			/*  KerberosWrapper.EncryptedPreMasterSecret	*/
			s2n(outl,p);
			memcpy(p, epms, outl);
			p+=outl;
			n+=outl + 2;

2135
			s->session->master_key_length=
2136
				s->method->ssl3_enc->generate_master_secret(s,
2137
					s->session->master_key,
2138
					tmp_buf, sizeof tmp_buf);
2139

2140 2141
			OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
			OPENSSL_cleanse(epms, outl);
2142
			}
2143
#endif
2144
#ifndef OPENSSL_NO_DH
2145
		else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2146 2147 2148
			{
			DH *dh_srvr,*dh_clnt;

B
Bodo Möller 已提交
2149 2150 2151 2152 2153 2154 2155
			if (s->session->sess_cert == NULL) 
				{
				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
				goto err;
				}

2156 2157
			if (s->session->sess_cert->peer_dh_tmp != NULL)
				dh_srvr=s->session->sess_cert->peer_dh_tmp;
2158 2159 2160
			else
				{
				/* we get them from the cert */
2161
				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
				goto err;
				}
			
			/* generate a new random key */
			if ((dh_clnt=DHparams_dup(dh_srvr)) == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
				goto err;
				}
			if (!DH_generate_key(dh_clnt))
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
				goto err;
				}

			/* use the 'p' output buffer for the DH key, but
			 * make sure to clear it out afterwards */
2180

2181
			n=DH_compute_key(p,dh_srvr->pub_key,dh_clnt);
2182

2183 2184 2185 2186 2187 2188 2189 2190
			if (n <= 0)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
				goto err;
				}

			/* generate master key from the result */
			s->session->master_key_length=
2191
				s->method->ssl3_enc->generate_master_secret(s,
2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206
					s->session->master_key,p,n);
			/* clean up */
			memset(p,0,n);

			/* send off the data */
			n=BN_num_bytes(dh_clnt->pub_key);
			s2n(n,p);
			BN_bn2bin(dh_clnt->pub_key,p);
			n+=2;

			DH_free(dh_clnt);

			/* perhaps clean things up a bit EAY EAY EAY EAY*/
			}
#endif
B
Bodo Möller 已提交
2207 2208

#ifndef OPENSSL_NO_ECDH 
2209
		else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe))
B
Bodo Möller 已提交
2210
			{
N
Nils Larsch 已提交
2211 2212
			const EC_GROUP *srvr_group = NULL;
			EC_KEY *tkey;
B
Bodo Möller 已提交
2213
			int ecdh_clnt_cert = 0;
2214
			int field_size = 0;
B
Bodo Möller 已提交
2215 2216 2217 2218 2219 2220

			/* Did we send out the client's
			 * ECDH share for use in premaster
			 * computation as part of client certificate?
			 * If so, set ecdh_clnt_cert to 1.
			 */
2221
			if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->cert != NULL)) 
B
Bodo Möller 已提交
2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238
				{
				/* XXX: For now, we do not support client
				 * authentication using ECDH certificates.
				 * To add such support, one needs to add
				 * code that checks for appropriate 
				 * conditions and sets ecdh_clnt_cert to 1.
				 * For example, the cert have an ECC
				 * key on the same curve as the server's
				 * and the key should be authorized for
				 * key agreement.
				 *
				 * One also needs to add code in ssl3_connect
				 * to skip sending the certificate verify
				 * message.
				 *
				 * if ((s->cert->key->privatekey != NULL) &&
				 *     (s->cert->key->privatekey->type ==
B
Bodo Möller 已提交
2239
				 *      EVP_PKEY_EC) && ...)
B
Bodo Möller 已提交
2240 2241 2242 2243 2244 2245
				 * ecdh_clnt_cert = 1;
				 */
				}

			if (s->session->sess_cert->peer_ecdh_tmp != NULL)
				{
N
Nils Larsch 已提交
2246
				tkey = s->session->sess_cert->peer_ecdh_tmp;
B
Bodo Möller 已提交
2247 2248 2249 2250 2251 2252 2253
				}
			else
				{
				/* Get the Server Public Key from Cert */
				srvr_pub_pkey = X509_get_pubkey(s->session-> \
				    sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
				if ((srvr_pub_pkey == NULL) ||
2254
				    (srvr_pub_pkey->type != EVP_PKEY_EC) ||
N
Nils Larsch 已提交
2255
				    (srvr_pub_pkey->pkey.ec == NULL))
B
Bodo Möller 已提交
2256 2257 2258 2259 2260 2261
					{
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					    ERR_R_INTERNAL_ERROR);
					goto err;
					}

N
Nils Larsch 已提交
2262
				tkey = srvr_pub_pkey->pkey.ec;
B
Bodo Möller 已提交
2263 2264
				}

N
Nils Larsch 已提交
2265 2266 2267
			srvr_group   = EC_KEY_get0_group(tkey);
			srvr_ecpoint = EC_KEY_get0_public_key(tkey);

B
Bodo Möller 已提交
2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280
			if ((srvr_group == NULL) || (srvr_ecpoint == NULL))
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
				    ERR_R_INTERNAL_ERROR);
				goto err;
				}

			if ((clnt_ecdh=EC_KEY_new()) == NULL) 
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
				goto err;
				}

N
Nils Larsch 已提交
2281 2282 2283 2284 2285
			if (!EC_KEY_set_group(clnt_ecdh, srvr_group))
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
				goto err;
				}
B
Bodo Möller 已提交
2286 2287
			if (ecdh_clnt_cert) 
				{ 
2288
				/* Reuse key info from our certificate
B
Bodo Möller 已提交
2289 2290 2291
				 * We only need our private key to perform
				 * the ECDH computation.
				 */
N
Nils Larsch 已提交
2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304
				const BIGNUM *priv_key;
				tkey = s->cert->key->privatekey->pkey.ec;
				priv_key = EC_KEY_get0_private_key(tkey);
				if (priv_key == NULL)
					{
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
					goto err;
					}
				if (!EC_KEY_set_private_key(clnt_ecdh, priv_key))
					{
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
					goto err;
					}
B
Bodo Möller 已提交
2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315
				}
			else 
				{
				/* Generate a new ECDH key pair */
				if (!(EC_KEY_generate_key(clnt_ecdh)))
					{
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
					goto err;
					}
				}

2316 2317
			/* use the 'p' output buffer for the ECDH key, but
			 * make sure to clear it out afterwards
B
Bodo Möller 已提交
2318 2319
			 */

N
Nils Larsch 已提交
2320
			field_size = EC_GROUP_get_degree(srvr_group);
2321 2322 2323 2324 2325 2326
			if (field_size <= 0)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 
				       ERR_R_ECDH_LIB);
				goto err;
				}
B
Bodo Möller 已提交
2327
			n=ECDH_compute_key(p, (field_size+7)/8, srvr_ecpoint, clnt_ecdh, NULL);
B
Bodo Möller 已提交
2328
			if (n <= 0)
2329 2330
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 
B
Bodo Möller 已提交
2331
				       ERR_R_ECDH_LIB);
2332
				goto err;
B
Bodo Möller 已提交
2333 2334
				}

2335 2336
			/* generate master key from the result */
			s->session->master_key_length = s->method->ssl3_enc \
B
Bodo Möller 已提交
2337 2338 2339 2340
			    -> generate_master_secret(s, 
				s->session->master_key,
				p, n);

2341
			memset(p, 0, n); /* clean up */
B
Bodo Möller 已提交
2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353

			if (ecdh_clnt_cert) 
				{
				/* Send empty client key exch message */
				n = 0;
				}
			else 
				{
				/* First check the size of encoding and
				 * allocate memory accordingly.
				 */
				encoded_pt_len = 
N
Nils Larsch 已提交
2354 2355
				    EC_POINT_point2oct(srvr_group, 
					EC_KEY_get0_public_key(clnt_ecdh), 
B
Bodo Möller 已提交
2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370
					POINT_CONVERSION_UNCOMPRESSED, 
					NULL, 0, NULL);

				encodedPoint = (unsigned char *) 
				    OPENSSL_malloc(encoded_pt_len * 
					sizeof(unsigned char)); 
				bn_ctx = BN_CTX_new();
				if ((encodedPoint == NULL) || 
				    (bn_ctx == NULL)) 
					{
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
					goto err;
					}

				/* Encode the public key */
N
Nils Larsch 已提交
2371 2372
				n = EC_POINT_point2oct(srvr_group, 
				    EC_KEY_get0_public_key(clnt_ecdh), 
B
Bodo Möller 已提交
2373 2374 2375 2376
				    POINT_CONVERSION_UNCOMPRESSED, 
				    encodedPoint, encoded_pt_len, bn_ctx);

				*p = n; /* length of encoded point */
2377
				/* Encoded point will be copied here */
B
Bodo Möller 已提交
2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392
				p += 1; 
				/* copy the point */
				memcpy((unsigned char *)p, encodedPoint, n);
				/* increment n to account for length field */
				n += 1; 
				}

			/* Free allocated memory */
			BN_CTX_free(bn_ctx);
			if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
			if (clnt_ecdh != NULL) 
				 EC_KEY_free(clnt_ecdh);
			EVP_PKEY_free(srvr_pub_pkey);
			}
#endif /* !OPENSSL_NO_ECDH */
2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470
		else if (alg_k & SSL_kGOST) 
			{
			/* GOST key exchange message creation */
			EVP_PKEY_CTX *pkey_ctx;
			X509 *peer_cert; 
			size_t msglen;
			unsigned int md_len;
			int keytype;
			unsigned char premaster_secret[32],shared_ukm[32];
			EVP_MD_CTX *ukm_hash;
			EVP_PKEY *pub_key;

			/* Get server sertificate PKEY and create ctx from it */
			peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST01)].x509;
			if (!peer_cert) 
				peer_cert=s->session->sess_cert->peer_pkeys[(keytype=SSL_PKEY_GOST94)].x509;
			if (!peer_cert)		{
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
					goto err;
				}	
				
			pkey_ctx=EVP_PKEY_CTX_new(pub_key=X509_get_pubkey(peer_cert),NULL);
			/* If we have send a certificate, and certificate key

			 * parameters match those of server certificate, use
			 * certificate key for key exchange
			 */

			 /* Otherwise, generate ephemeral key pair */
					
			EVP_PKEY_encrypt_init(pkey_ctx);
			  /* Generate session key */	
		    RAND_bytes(premaster_secret,32);
			/* If we have client certificate, use its secret as peer key */
			if (s->cert->key->privatekey) {
				if (EVP_PKEY_derive_set_peer(pkey_ctx,s->cert->key->privatekey) <0) {
					/* If there was an error - just ignore it. Ephemeral key
					* would be used
					*/
					ERR_clear_error();
				} else {
					/* Set flag "client cert key is used for key
					 * exchange"*/
				}	
			}			
			/* Compute shared IV and store it in algorithm-specific
			 * context data */
			ukm_hash = EVP_MD_CTX_create();
			EVP_DigestInit(ukm_hash,EVP_get_digestbynid(NID_id_GostR3411_94));
			EVP_DigestUpdate(ukm_hash,s->s3->client_random,SSL3_RANDOM_SIZE);
			EVP_DigestUpdate(ukm_hash,s->s3->server_random,SSL3_RANDOM_SIZE);
			EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len);
			EVP_MD_CTX_destroy(ukm_hash);
			if (EVP_PKEY_CTX_ctrl(pkey_ctx,-1,EVP_PKEY_OP_ENCRYPT,EVP_PKEY_CTRL_SET_IV,
				8,shared_ukm)<0) {
					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
						SSL_R_LIBRARY_BUG);
					goto err;
				}	
			/* Make GOST keytransport blob message */
			/*Encapsulate it into sequence */
			*(p++)=V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED;
			*(p++)=0x81;
			msglen=256;
			if (EVP_PKEY_encrypt(pkey_ctx,(unsigned char *)p+1,&msglen,premaster_secret,32)<0) {
			SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					SSL_R_LIBRARY_BUG);
				goto err;
			}	
			*(p++)= msglen & 0xff;
			n=msglen+3;
			EVP_PKEY_CTX_free(pkey_ctx);
			s->session->master_key_length=
				s->method->ssl3_enc->generate_master_secret(s,
					s->session->master_key,premaster_secret,32);
			EVP_PKEY_free(pub_key);

			}
2471
#ifndef OPENSSL_NO_PSK
2472
		else if (alg_k & SSL_kPSK)
2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544
			{
			char identity[PSK_MAX_IDENTITY_LEN];
			unsigned char *t = NULL;
			unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4];
			unsigned int pre_ms_len = 0, psk_len = 0;
			int psk_err = 1;

			n = 0;
			if (s->psk_client_callback == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					SSL_R_PSK_NO_CLIENT_CB);
				goto err;
				}

			psk_len = s->psk_client_callback(s, s->ctx->psk_identity_hint,
				identity, PSK_MAX_IDENTITY_LEN,
				psk_or_pre_ms, sizeof(psk_or_pre_ms));
			if (psk_len > PSK_MAX_PSK_LEN)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					ERR_R_INTERNAL_ERROR);
				goto psk_err;
				}
			else if (psk_len == 0)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					SSL_R_PSK_IDENTITY_NOT_FOUND);
				goto psk_err;
				}

			/* create PSK pre_master_secret */
			pre_ms_len = 2+psk_len+2+psk_len;
			t = psk_or_pre_ms;
			memmove(psk_or_pre_ms+psk_len+4, psk_or_pre_ms, psk_len);
			s2n(psk_len, t);
			memset(t, 0, psk_len);
			t+=psk_len;
			s2n(psk_len, t);

			if (s->session->psk_identity_hint != NULL)
				OPENSSL_free(s->session->psk_identity_hint);
			s->session->psk_identity_hint = BUF_strdup(s->ctx->psk_identity_hint);
			if (s->ctx->psk_identity_hint != NULL &&
				s->session->psk_identity_hint == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					ERR_R_MALLOC_FAILURE);
				goto psk_err;
				}

			if (s->session->psk_identity != NULL)
				OPENSSL_free(s->session->psk_identity);
			s->session->psk_identity = BUF_strdup(identity);
			if (s->session->psk_identity == NULL)
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
					ERR_R_MALLOC_FAILURE);
				goto psk_err;
				}

			s->session->master_key_length =
				s->method->ssl3_enc->generate_master_secret(s,
					s->session->master_key,
					psk_or_pre_ms, pre_ms_len); 
			n = strlen(identity);
			s2n(n, p);
			memcpy(p, identity, n);
			n+=2;
			psk_err = 0;
		psk_err:
			OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN);
2545
			OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
2546 2547 2548 2549 2550 2551 2552
			if (psk_err != 0)
				{
				ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
				goto err;
				}
			}
#endif
2553
		else
2554
			{
B
Bodo Möller 已提交
2555 2556 2557 2558
			ssl3_send_alert(s, SSL3_AL_FATAL,
			    SSL_AD_HANDSHAKE_FAILURE);
			SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
			    ERR_R_INTERNAL_ERROR);
2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573
			goto err;
			}
		
		*(d++)=SSL3_MT_CLIENT_KEY_EXCHANGE;
		l2n3(n,d);

		s->state=SSL3_ST_CW_KEY_EXCH_B;
		/* number of bytes to write */
		s->init_num=n+4;
		s->init_off=0;
		}

	/* SSL3_ST_CW_KEY_EXCH_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
err:
B
Bodo Möller 已提交
2574 2575 2576 2577 2578
#ifndef OPENSSL_NO_ECDH
	BN_CTX_free(bn_ctx);
	if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
	if (clnt_ecdh != NULL) 
		EC_KEY_free(clnt_ecdh);
2579
	EVP_PKEY_free(srvr_pub_pkey);
B
Bodo Möller 已提交
2580
#endif
2581 2582 2583
	return(-1);
	}

B
Ben Laurie 已提交
2584
int ssl3_send_client_verify(SSL *s)
2585 2586 2587 2588
	{
	unsigned char *p,*d;
	unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
	EVP_PKEY *pkey;
2589
	EVP_PKEY_CTX *pctx=NULL;
2590
#ifndef OPENSSL_NO_RSA
B
Ben Laurie 已提交
2591
	unsigned u=0;
2592
#endif
2593
	unsigned long n;
N
make  
Nils Larsch 已提交
2594
#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
2595 2596
	int j;
#endif
2597 2598 2599 2600 2601 2602

	if (s->state == SSL3_ST_CW_CERT_VRFY_A)
		{
		d=(unsigned char *)s->init_buf->data;
		p= &(d[4]);
		pkey=s->cert->key->privatekey;
2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615
/* Create context from key and test if sha1 is allowed as digest */
		pctx = EVP_PKEY_CTX_new(pkey,NULL);
		EVP_PKEY_sign_init(pctx);
		if (EVP_PKEY_CTX_set_signature_md(pctx, EVP_sha1())>0)
			{
			s->method->ssl3_enc->cert_verify_mac(s,
						NID_sha1,
						&(data[MD5_DIGEST_LENGTH]));
			}
		else
			{
			ERR_clear_error();
			}
2616
#ifndef OPENSSL_NO_RSA
2617 2618
		if (pkey->type == EVP_PKEY_RSA)
			{
2619
			s->method->ssl3_enc->cert_verify_mac(s,
2620 2621
				NID_md5,
			 	&(data[0]));
2622 2623
			if (RSA_sign(NID_md5_sha1, data,
					 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
B
Ben Laurie 已提交
2624
					&(p[2]), &u, pkey->pkey.rsa) <= 0 )
2625 2626 2627 2628
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
				goto err;
				}
B
Ben Laurie 已提交
2629 2630
			s2n(u,p);
			n=u+2;
2631 2632 2633
			}
		else
#endif
2634
#ifndef OPENSSL_NO_DSA
2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648
			if (pkey->type == EVP_PKEY_DSA)
			{
			if (!DSA_sign(pkey->save_type,
				&(data[MD5_DIGEST_LENGTH]),
				SHA_DIGEST_LENGTH,&(p[2]),
				(unsigned int *)&j,pkey->pkey.dsa))
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_DSA_LIB);
				goto err;
				}
			s2n(j,p);
			n=j+2;
			}
		else
B
Bodo Möller 已提交
2649 2650
#endif
#ifndef OPENSSL_NO_ECDSA
2651
			if (pkey->type == EVP_PKEY_EC)
B
Bodo Möller 已提交
2652 2653 2654 2655
			{
			if (!ECDSA_sign(pkey->save_type,
				&(data[MD5_DIGEST_LENGTH]),
				SHA_DIGEST_LENGTH,&(p[2]),
N
Nils Larsch 已提交
2656
				(unsigned int *)&j,pkey->pkey.ec))
B
Bodo Möller 已提交
2657 2658 2659 2660 2661 2662 2663 2664 2665
				{
				SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
				    ERR_R_ECDSA_LIB);
				goto err;
				}
			s2n(j,p);
			n=j+2;
			}
		else
2666
#endif
2667 2668 2669 2670
		if (pkey->type == NID_id_GostR3410_94 || pkey->type == NID_id_GostR3410_2001) 
		{
		unsigned char signbuf[64];
		int i;
D
Dr. Stephen Henson 已提交
2671
		size_t sigsize=64;
2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687
		s->method->ssl3_enc->cert_verify_mac(s,
			NID_id_GostR3411_94,
			data);
		if (!EVP_PKEY_sign(pctx,signbuf,&sigsize,data,32)) {
			SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
			ERR_R_INTERNAL_ERROR);
			goto err;
		}
		for (i=63,j=0; i>=0; j++, i--) {
			p[2+j]=signbuf[i];
		}	
		s2n(j,p);
		n=j+2;
		}
		else
		{
B
Bodo Möller 已提交
2688
			SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
2689
			goto err;
2690
		}
2691 2692 2693
		*(d++)=SSL3_MT_CERTIFICATE_VERIFY;
		l2n3(n,d);

2694
		s->state=SSL3_ST_CW_CERT_VRFY_B;
2695 2696 2697
		s->init_num=(int)n+4;
		s->init_off=0;
		}
2698
	EVP_PKEY_CTX_free(pctx);
2699 2700
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
err:
2701
	EVP_PKEY_CTX_free(pctx);
2702 2703 2704
	return(-1);
	}

B
Ben Laurie 已提交
2705
int ssl3_send_client_certificate(SSL *s)
2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728
	{
	X509 *x509=NULL;
	EVP_PKEY *pkey=NULL;
	int i;
	unsigned long l;

	if (s->state ==	SSL3_ST_CW_CERT_A)
		{
		if ((s->cert == NULL) ||
			(s->cert->key->x509 == NULL) ||
			(s->cert->key->privatekey == NULL))
			s->state=SSL3_ST_CW_CERT_B;
		else
			s->state=SSL3_ST_CW_CERT_C;
		}

	/* We need to get a client cert */
	if (s->state == SSL3_ST_CW_CERT_B)
		{
		/* If we get an error, we need to
		 * ssl->rwstate=SSL_X509_LOOKUP; return(-1);
		 * We then get retied later */
		i=0;
2729
		i = ssl_do_client_cert_cb(s, &x509, &pkey);
2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752
		if (i < 0)
			{
			s->rwstate=SSL_X509_LOOKUP;
			return(-1);
			}
		s->rwstate=SSL_NOTHING;
		if ((i == 1) && (pkey != NULL) && (x509 != NULL))
			{
			s->state=SSL3_ST_CW_CERT_B;
			if (	!SSL_use_certificate(s,x509) ||
				!SSL_use_PrivateKey(s,pkey))
				i=0;
			}
		else if (i == 1)
			{
			i=0;
			SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE,SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
			}

		if (x509 != NULL) X509_free(x509);
		if (pkey != NULL) EVP_PKEY_free(pkey);
		if (i == 0)
			{
2753 2754 2755 2756 2757 2758 2759 2760 2761 2762
			if (s->version == SSL3_VERSION)
				{
				s->s3->tmp.cert_req=0;
				ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_NO_CERTIFICATE);
				return(1);
				}
			else
				{
				s->s3->tmp.cert_req=2;
				}
2763 2764 2765 2766 2767 2768 2769 2770 2771
			}

		/* Ok, we have a cert */
		s->state=SSL3_ST_CW_CERT_C;
		}

	if (s->state == SSL3_ST_CW_CERT_C)
		{
		s->state=SSL3_ST_CW_CERT_D;
2772 2773
		l=ssl3_output_cert_chain(s,
			(s->s3->tmp.cert_req == 2)?NULL:s->cert->key->x509);
2774 2775 2776 2777 2778 2779 2780 2781 2782
		s->init_num=(int)l;
		s->init_off=0;
		}
	/* SSL3_ST_CW_CERT_D */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}

#define has_bits(i,m)	(((i)&(m)) == (m))

B
Ben Laurie 已提交
2783
int ssl3_check_cert_and_algorithm(SSL *s)
2784 2785
	{
	int i,idx;
2786
	long alg_k,alg_a;
2787
	EVP_PKEY *pkey=NULL;
2788
	SESS_CERT *sc;
2789
#ifndef OPENSSL_NO_RSA
2790
	RSA *rsa;
2791
#endif
2792
#ifndef OPENSSL_NO_DH
2793
	DH *dh;
2794
#endif
2795

2796 2797
	sc=s->session->sess_cert;
	if (sc == NULL)
2798
		{
B
Bodo Möller 已提交
2799
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
2800 2801 2802
		goto err;
		}

2803 2804
	alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
	alg_a=s->s3->tmp.new_cipher->algorithm_auth;
2805 2806

	/* we don't have a certificate */
2807
	if ((alg_a & (SSL_aDH|SSL_aNULL|SSL_aKRB5)) || (alg_k & SSL_kPSK))
2808 2809
		return(1);

2810
#ifndef OPENSSL_NO_RSA
2811
	rsa=s->session->sess_cert->peer_rsa_tmp;
2812
#endif
2813
#ifndef OPENSSL_NO_DH
2814
	dh=s->session->sess_cert->peer_dh_tmp;
2815
#endif
2816 2817 2818

	/* This is the passed certificate */

2819
	idx=sc->peer_cert_type;
B
Bodo Möller 已提交
2820 2821 2822
#ifndef OPENSSL_NO_ECDH
	if (idx == SSL_PKEY_ECC)
		{
2823
		if (ssl_check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
B
Bodo Möller 已提交
2824 2825 2826
		    s->s3->tmp.new_cipher) == 0) 
			{ /* check failed */
			SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
2827
			goto f_err;
B
Bodo Möller 已提交
2828 2829 2830 2831 2832 2833 2834
			}
		else 
			{
			return 1;
			}
		}
#endif
2835 2836
	pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
	i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
2837
	EVP_PKEY_free(pkey);
2838 2839 2840

	
	/* Check that we have a certificate if we require one */
2841
	if ((alg_a & SSL_aRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_SIGN))
2842 2843 2844 2845
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_SIGNING_CERT);
		goto f_err;
		}
2846
#ifndef OPENSSL_NO_DSA
2847
	else if ((alg_a & SSL_aDSS) && !has_bits(i,EVP_PK_DSA|EVP_PKT_SIGN))
2848 2849 2850 2851 2852
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DSA_SIGNING_CERT);
		goto f_err;
		}
#endif
2853
#ifndef OPENSSL_NO_RSA
2854
	if ((alg_k & SSL_kRSA) &&
2855 2856 2857 2858 2859
		!(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
		goto f_err;
		}
2860
#endif
2861
#ifndef OPENSSL_NO_DH
2862
	if ((alg_k & SSL_kEDH) &&
2863 2864 2865 2866 2867
		!(has_bits(i,EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL)))
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
		goto f_err;
		}
2868
	else if ((alg_k & SSL_kDHr) && !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
2869 2870 2871 2872
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
		goto f_err;
		}
2873
#ifndef OPENSSL_NO_DSA
2874
	else if ((alg_k & SSL_kDHd) && !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
2875 2876 2877 2878 2879 2880 2881
		{
		SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);
		goto f_err;
		}
#endif
#endif

2882
	if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
2883
		{
2884
#ifndef OPENSSL_NO_RSA
2885
		if (alg_k & SSL_kRSA)
2886
			{
2887
			if (rsa == NULL
2888
			    || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2889 2890 2891 2892 2893 2894 2895
				{
				SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
				goto f_err;
				}
			}
		else
#endif
2896
#ifndef OPENSSL_NO_DH
2897
			if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
2898 2899
			    {
			    if (dh == NULL
2900
				|| DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914
				{
				SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
				goto f_err;
				}
			}
		else
#endif
			{
			SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
			goto f_err;
			}
		}
	return(1);
f_err:
2915
	ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
2916 2917 2918
err:
	return(0);
	}
2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929

/* Check to see if handshake is full or resumed. Usually this is just a
 * case of checking to see if a cache hit has occurred. In the case of
 * session tickets we have to check the next message to be sure.
 */

#ifndef OPENSSL_NO_TLSEXT
static int ssl3_check_finished(SSL *s)
	{
	int ok;
	long n;
D
Dr. Stephen Henson 已提交
2930 2931 2932 2933 2934
	/* If we have no ticket or session ID is non-zero length (a match of
	 * a non-zero session length would never reach here) it cannot be a
	 * resumed session.
	 */
	if (!s->session->tlsext_tick || s->session->session_id_length)
2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952
		return 1;
	/* this function is called when we really expect a Certificate
	 * message, so permit appropriate message length */
	n=s->method->ssl_get_message(s,
		SSL3_ST_CR_CERT_A,
		SSL3_ST_CR_CERT_B,
		-1,
		s->max_cert_list,
		&ok);
	if (!ok) return((int)n);
	s->s3->tmp.reuse_message = 1;
	if ((s->s3->tmp.message_type == SSL3_MT_FINISHED)
		|| (s->s3->tmp.message_type == SSL3_MT_NEWSESSION_TICKET))
		return 2;

	return 1;
	}
#endif
2953 2954 2955 2956 2957 2958 2959 2960 2961

int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey)
	{
	int i = 0;
#ifndef OPENSSL_NO_ENGINE
	if (s->ctx->client_cert_engine)
		{
		i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s,
						SSL_get_client_CA_list(s),
2962
						px509, ppkey, NULL, NULL, NULL);
2963 2964 2965 2966 2967 2968 2969 2970
		if (i != 0)
			return i;
		}
#endif
	if (s->ctx->client_cert_cb)
		i = s->ctx->client_cert_cb(s,px509,ppkey);
	return i;
	}