[thirdparty/openssl.git] / ssl / s3_both.c

/* ssl/s3_both.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <string.h>
#include <stdio.h>
#include <openssl/buffer.h>
#include <openssl/rand.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include "ssl_locl.h"

/* send s->init_buf in records of type 'type' */
int ssl3_do_write(SSL *s, int type)
	{
	int ret;

	ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
	                     s->init_num);
	if (ret < 0) return(-1);
	if (type == SSL3_RT_HANDSHAKE)
		/* should not be done for 'Hello Request's, but in that case
		 * we'll ignore the result anyway */
		ssl3_finish_mac(s,&s->init_buf->data[s->init_off],ret);
	
	if (ret == s->init_num)
		return(1);
	s->init_off+=ret;
	s->init_num-=ret;
	return(0);
	}

int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
	{
	unsigned char *p,*d;
	int i;
	unsigned long l;

	if (s->state == a)
		{
		d=(unsigned char *)s->init_buf->data;
		p= &(d[4]);

		i=s->method->ssl3_enc->final_finish_mac(s,
			&(s->s3->finish_dgst1),
			&(s->s3->finish_dgst2),
			sender,slen,s->s3->tmp.finish_md);
		s->s3->tmp.finish_md_len = i;
		memcpy(p, s->s3->tmp.finish_md, i);
		p+=i;
		l=i;

#ifdef WIN16
		/* MSVC 1.5 does not clear the top bytes of the word unless
		 * I do this.
		 */
		l&=0xffff;
#endif

		*(d++)=SSL3_MT_FINISHED;
		l2n3(l,d);
		s->init_num=(int)l+4;
		s->init_off=0;

		s->state=b;
		}

	/* SSL3_ST_SEND_xxxxxx_HELLO_B */
	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	}

int ssl3_get_finished(SSL *s, int a, int b)
	{
	int al,i,ok;
	long n;
	unsigned char *p;

	/* the mac has already been generated when we received the
	 * change cipher spec message and is in s->s3->tmp.peer_finish_md
	 */ 

	n=ssl3_get_message(s,
		a,
		b,
		SSL3_MT_FINISHED,
		64, /* should actually be 36+4 :-) */
		&ok);

	if (!ok) return((int)n);

	/* If this occurs, we have missed a message */
	if (!s->s3->change_cipher_spec)
		{
		al=SSL_AD_UNEXPECTED_MESSAGE;
		SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_GOT_A_FIN_BEFORE_A_CCS);
		goto f_err;
		}
	s->s3->change_cipher_spec=0;

	p = (unsigned char *)s->init_buf->data;
	i = s->s3->tmp.peer_finish_md_len;

	if (i != n)
		{
		al=SSL_AD_DECODE_ERROR;
		SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_BAD_DIGEST_LENGTH);
		goto f_err;
		}

	if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
		{
		al=SSL_AD_DECRYPT_ERROR;
		SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
		goto f_err;
		}

	return(1);
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
	return(0);
	}

/* for these 2 messages, we need to
 * ssl->enc_read_ctx			re-init
 * ssl->s3->read_sequence		zero
 * ssl->s3->read_mac_secret		re-init
 * ssl->session->read_sym_enc		assign
 * ssl->session->read_compression	assign
 * ssl->session->read_hash		assign
 */
int ssl3_send_change_cipher_spec(SSL *s, int a, int b)
	{ 
	unsigned char *p;

	if (s->state == a)
		{
		p=(unsigned char *)s->init_buf->data;
		*p=SSL3_MT_CCS;
		s->init_num=1;
		s->init_off=0;

		s->state=b;
		}

	/* SSL3_ST_CW_CHANGE_B */
	return(ssl3_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
	}

unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
	{
	unsigned char *p;
	int n,i;
	unsigned long l=7;
	BUF_MEM *buf;
	X509_STORE_CTX xs_ctx;
	X509_OBJECT obj;

	/* TLSv1 sends a chain with nothing in it, instead of an alert */
	buf=s->init_buf;
	if (!BUF_MEM_grow(buf,(int)(10)))
		{
		SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
		return(0);
		}
	if (x != NULL)
		{
		X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL);

		for (;;)
			{
			n=i2d_X509(x,NULL);
			if (!BUF_MEM_grow(buf,(int)(n+l+3)))
				{
				SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
				return(0);
				}
			p=(unsigned char *)&(buf->data[l]);
			l2n3(n,p);
			i2d_X509(x,&p);
			l+=n+3;
			if (X509_NAME_cmp(X509_get_subject_name(x),
				X509_get_issuer_name(x)) == 0) break;

			i=X509_STORE_get_by_subject(&xs_ctx,X509_LU_X509,
				X509_get_issuer_name(x),&obj);
			if (i <= 0) break;
			x=obj.data.x509;
			/* Count is one too high since the X509_STORE_get uped the
			 * ref count */
			X509_free(x);
			}

		X509_STORE_CTX_cleanup(&xs_ctx);
		}

	/* Thawte special :-) */
	if (s->ctx->extra_certs != NULL)
	for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
		{
		x=sk_X509_value(s->ctx->extra_certs,i);
		n=i2d_X509(x,NULL);
		if (!BUF_MEM_grow(buf,(int)(n+l+3)))
			{
			SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
			return(0);
			}
		p=(unsigned char *)&(buf->data[l]);
		l2n3(n,p);
		i2d_X509(x,&p);
		l+=n+3;
		}

	l-=7;
	p=(unsigned char *)&(buf->data[4]);
	l2n3(l,p);
	l+=3;
	p=(unsigned char *)&(buf->data[0]);
	*(p++)=SSL3_MT_CERTIFICATE;
	l2n3(l,p);
	l+=4;
	return(l);
	}

/* Obtain handshake message of message type 'mt' (any if mt == -1),
 * maximum acceptable body length 'max'.
 * The first four bytes (msg_type and length) are read in state 'st1',
 * the body is read in state 'stn'.
 */
long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
	{
	unsigned char *p;
	unsigned long l;
	long n;
	int i,al;

	if (s->s3->tmp.reuse_message)
		{
		s->s3->tmp.reuse_message=0;
		if ((mt >= 0) && (s->s3->tmp.message_type != mt))
			{
			al=SSL_AD_UNEXPECTED_MESSAGE;
			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
			goto f_err;
			}
		*ok=1;
		return((int)s->s3->tmp.message_size);
		}

	p=(unsigned char *)s->init_buf->data;

	if (s->state == st1) /* s->init_num < 4 */
		{
		int skip_message;

		do
			{
			while (s->init_num < 4)
				{
				i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
					4 - s->init_num);
				if (i <= 0)
					{
					s->rwstate=SSL_READING;
					*ok = 0;
					return i;
					}
				s->init_num+=i;
				}
			
			skip_message = 0;
			if (!s->server)
				if (p[0] == SSL3_MT_HELLO_REQUEST)
					/* The server may always send 'Hello Request' messages --
					 * we are doing a handshake anyway now, so ignore them
					 * if their format is correct. Does not count for
					 * 'Finished' MAC. */
					if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
						skip_message = 1;
			}
		while (skip_message);

		/* s->init_num == 4 */

		if ((mt >= 0) && (*p != mt))
			{
			al=SSL_AD_UNEXPECTED_MESSAGE;
			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
			goto f_err;
			}
		if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&
					(st1 == SSL3_ST_SR_CERT_A) &&
					(stn == SSL3_ST_SR_CERT_B))
			{
			/* At this point we have got an MS SGC second client
			 * hello (maybe we should always allow the client to
			 * start a new handshake?). We need to restart the mac.
			 * Don't increment {num,total}_renegotiations because
			 * we have not completed the handshake. */
			ssl3_init_finished_mac(s);
			}

		ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 4);
			
		s->s3->tmp.message_type= *(p++);

		n2l3(p,l);
		if (l > (unsigned long)max)
			{
			al=SSL_AD_ILLEGAL_PARAMETER;
			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
			goto f_err;
			}
		if (l && !BUF_MEM_grow(s->init_buf,(int)l))
			{
			SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);
			goto err;
			}
		s->s3->tmp.message_size=l;
		s->state=stn;

		s->init_num=0;
		}

	/* next state (stn) */
	p=(unsigned char *)s->init_buf->data;
	n=s->s3->tmp.message_size;
	while (n > 0)
		{
		i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n);
		if (i <= 0)
			{
			s->rwstate=SSL_READING;
			*ok = 0;
			return i;
			}
		s->init_num += i;
		n -= i;
		}
	ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);
	*ok=1;
	return s->init_num;
f_err:
	ssl3_send_alert(s,SSL3_AL_FATAL,al);
err:
	*ok=0;
	return(-1);
	}

int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
	{
	EVP_PKEY *pk;
	int ret= -1,i,j;

	if (pkey == NULL)
		pk=X509_get_pubkey(x);
	else
		pk=pkey;
	if (pk == NULL) goto err;

	i=pk->type;
	if (i == EVP_PKEY_RSA)
		{
		ret=SSL_PKEY_RSA_ENC;
		if (x != NULL)
			{
			j=X509_get_ext_count(x);
			/* check to see if this is a signing only certificate */
			/* EAY EAY EAY EAY */
			}
		}
	else if (i == EVP_PKEY_DSA)
		{
		ret=SSL_PKEY_DSA_SIGN;
		}
	else if (i == EVP_PKEY_DH)
		{
		/* if we just have a key, we needs to be guess */

		if (x == NULL)
			ret=SSL_PKEY_DH_DSA;
		else
			{
			j=X509_get_signature_type(x);
			if (j == EVP_PKEY_RSA)
				ret=SSL_PKEY_DH_RSA;
			else if (j== EVP_PKEY_DSA)
				ret=SSL_PKEY_DH_DSA;
			else ret= -1;
			}
		}
	else
		ret= -1;

err:
	if(!pkey) EVP_PKEY_free(pk);
	return(ret);
	}

int ssl_verify_alarm_type(long type)
	{
	int al;

	switch(type)
		{
	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
	case X509_V_ERR_UNABLE_TO_GET_CRL:
		al=SSL_AD_UNKNOWN_CA;
		break;
	case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
	case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
	case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
	case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
	case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
	case X509_V_ERR_CERT_NOT_YET_VALID:
	case X509_V_ERR_CRL_NOT_YET_VALID:
		al=SSL_AD_BAD_CERTIFICATE;
		break;
	case X509_V_ERR_CERT_SIGNATURE_FAILURE:
	case X509_V_ERR_CRL_SIGNATURE_FAILURE:
		al=SSL_AD_DECRYPT_ERROR;
		break;
	case X509_V_ERR_CERT_HAS_EXPIRED:
	case X509_V_ERR_CRL_HAS_EXPIRED:
		al=SSL_AD_CERTIFICATE_EXPIRED;
		break;
	case X509_V_ERR_CERT_REVOKED:
		al=SSL_AD_CERTIFICATE_REVOKED;
		break;
	case X509_V_ERR_OUT_OF_MEM:
		al=SSL_AD_INTERNAL_ERROR;
		break;
	case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
	case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
	case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
	case X509_V_ERR_CERT_CHAIN_TOO_LONG:
		al=SSL_AD_UNKNOWN_CA;
		break;
	case X509_V_ERR_APPLICATION_VERIFICATION:
		al=SSL_AD_HANDSHAKE_FAILURE;
		break;
	default:
		al=SSL_AD_CERTIFICATE_UNKNOWN;
		break;
		}
	return(al);
	}

int ssl3_setup_buffers(SSL *s)
	{
	unsigned char *p;
	unsigned int extra;

	if (s->s3->rbuf.buf == NULL)
		{
		if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
			extra=SSL3_RT_MAX_EXTRA;
		else
			extra=0;
		if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
			== NULL)
			goto err;
		s->s3->rbuf.buf=p;
		}

	if (s->s3->wbuf.buf == NULL)
		{
		if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE))
			== NULL)
			goto err;
		s->s3->wbuf.buf=p;
		}
	s->packet= &(s->s3->rbuf.buf[0]);
	return(1);
err:
	SSLerr(SSL_F_SSL3_SETUP_BUFFERS,ERR_R_MALLOC_FAILURE);
	return(0);
	}
Commit	Line	Data
d02b48c6	1	/* ssl/s3_both.c */
58964a49	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
d02b48c6 RE	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
	8	*
	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
	15	*
	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
	22	*
	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
	37	* 4. If you include any Windows specific code (or a derivative thereof) from
	38	* the apps directory (application code) you must include an acknowledgement:
	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
	40	*
	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
	52	*
	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
	57	*/
	58
f2d9a32c	59	#include <string.h>
d02b48c6	60	#include <stdio.h>
ec577822 BM	61	#include <openssl/buffer.h>
	62	#include <openssl/rand.h>
	63	#include <openssl/objects.h>
	64	#include <openssl/evp.h>
	65	#include <openssl/x509.h>
d02b48c6 RE	66	#include "ssl_locl.h"
d02b48c6 RE	67
e7ecc7d4 BM	68	/* send s->init_buf in records of type 'type' */
	69	int ssl3_do_write(SSL *s, int type)
	70	{
	71	int ret;
	72
	73	ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
	74	s->init_num);
	75	if (ret < 0) return(-1);
	76	if (type == SSL3_RT_HANDSHAKE)
	77	/* should not be done for 'Hello Request's, but in that case
	78	* we'll ignore the result anyway */
	79	ssl3_finish_mac(s,&s->init_buf->data[s->init_off],ret);
	80
	81	if (ret == s->init_num)
	82	return(1);
	83	s->init_off+=ret;
	84	s->init_num-=ret;
	85	return(0);
	86	}
	87
c44f7540	88	int ssl3_send_finished(SSL s, int a, int b, const char sender, int slen)
d02b48c6 RE	89	{
	90	unsigned char p,d;
	91	int i;
	92	unsigned long l;
	93
	94	if (s->state == a)
	95	{
	96	d=(unsigned char *)s->init_buf->data;
	97	p= &(d[4]);
	98
58964a49 RE	99	i=s->method->ssl3_enc->final_finish_mac(s,
	100	&(s->s3->finish_dgst1),
	101	&(s->s3->finish_dgst2),
9fb617e2 BM	102	sender,slen,s->s3->tmp.finish_md);
	103	s->s3->tmp.finish_md_len = i;
	104	memcpy(p, s->s3->tmp.finish_md, i);
d02b48c6 RE	105	p+=i;
d02b48c6 RE	106	l=i;
d02b48c6	107
dfeab068 RE	108	#ifdef WIN16
	109	/* MSVC 1.5 does not clear the top bytes of the word unless
	110	* I do this.
	111	*/
	112	l&=0xffff;
	113	#endif
	114
d02b48c6 RE	115	*(d++)=SSL3_MT_FINISHED;
	116	l2n3(l,d);
	117	s->init_num=(int)l+4;
	118	s->init_off=0;
	119
	120	s->state=b;
	121	}
	122
	123	/* SSL3_ST_SEND_xxxxxx_HELLO_B */
	124	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
	125	}
	126
6b691a5c	127	int ssl3_get_finished(SSL *s, int a, int b)
d02b48c6	128	{
58964a49	129	int al,i,ok;
d02b48c6 RE	130	long n;
	131	unsigned char *p;
	132
	133	/* the mac has already been generated when we received the
9fb617e2	134	* change cipher spec message and is in s->s3->tmp.peer_finish_md
d02b48c6 RE	135	*/
	136
	137	n=ssl3_get_message(s,
	138	a,
	139	b,
	140	SSL3_MT_FINISHED,
	141	64, /* should actually be 36+4 :-) */
	142	&ok);
	143
	144	if (!ok) return((int)n);
	145
b35e9050	146	/* If this occurs, we have missed a message */
d02b48c6 RE	147	if (!s->s3->change_cipher_spec)
d02b48c6 RE	148	{
58964a49	149	al=SSL_AD_UNEXPECTED_MESSAGE;
d02b48c6 RE	150	SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_GOT_A_FIN_BEFORE_A_CCS);
	151	goto f_err;
	152	}
	153	s->s3->change_cipher_spec=0;
	154
9fb617e2 BM	155	p = (unsigned char *)s->init_buf->data;
9fb617e2 BM	156	i = s->s3->tmp.peer_finish_md_len;
d02b48c6	157
58964a49	158	if (i != n)
d02b48c6	159	{
58964a49	160	al=SSL_AD_DECODE_ERROR;
d02b48c6 RE	161	SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_BAD_DIGEST_LENGTH);
	162	goto f_err;
	163	}
	164
9fb617e2	165	if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
d02b48c6	166	{
58964a49	167	al=SSL_AD_DECRYPT_ERROR;
d02b48c6 RE	168	SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
	169	goto f_err;
	170	}
	171
	172	return(1);
	173	f_err:
	174	ssl3_send_alert(s,SSL3_AL_FATAL,al);
	175	return(0);
	176	}
	177
	178	/* for these 2 messages, we need to
	179	* ssl->enc_read_ctx re-init
	180	* ssl->s3->read_sequence zero
	181	* ssl->s3->read_mac_secret re-init
	182	* ssl->session->read_sym_enc assign
	183	* ssl->session->read_compression assign
	184	* ssl->session->read_hash assign
	185	*/
6b691a5c	186	int ssl3_send_change_cipher_spec(SSL *s, int a, int b)
d02b48c6 RE	187	{
	188	unsigned char *p;
	189
	190	if (s->state == a)
	191	{
	192	p=(unsigned char *)s->init_buf->data;
	193	*p=SSL3_MT_CCS;
	194	s->init_num=1;
	195	s->init_off=0;
	196
	197	s->state=b;
	198	}
	199
	200	/* SSL3_ST_CW_CHANGE_B */
	201	return(ssl3_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
	202	}
	203
6b691a5c	204	unsigned long ssl3_output_cert_chain(SSL s, X509 x)
d02b48c6 RE	205	{
	206	unsigned char *p;
	207	int n,i;
	208	unsigned long l=7;
	209	BUF_MEM *buf;
	210	X509_STORE_CTX xs_ctx;
	211	X509_OBJECT obj;
	212
58964a49	213	/* TLSv1 sends a chain with nothing in it, instead of an alert */
d02b48c6	214	buf=s->init_buf;
58964a49	215	if (!BUF_MEM_grow(buf,(int)(10)))
d02b48c6	216	{
58964a49 RE	217	SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
	218	return(0);
	219	}
	220	if (x != NULL)
	221	{
	222	X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL);
	223
	224	for (;;)
d02b48c6	225	{
58964a49 RE	226	n=i2d_X509(x,NULL);
	227	if (!BUF_MEM_grow(buf,(int)(n+l+3)))
	228	{
	229	SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
	230	return(0);
	231	}
	232	p=(unsigned char *)&(buf->data[l]);
	233	l2n3(n,p);
	234	i2d_X509(x,&p);
	235	l+=n+3;
	236	if (X509_NAME_cmp(X509_get_subject_name(x),
	237	X509_get_issuer_name(x)) == 0) break;
	238
	239	i=X509_STORE_get_by_subject(&xs_ctx,X509_LU_X509,
	240	X509_get_issuer_name(x),&obj);
	241	if (i <= 0) break;
	242	x=obj.data.x509;
	243	/* Count is one too high since the X509_STORE_get uped the
	244	* ref count */
	245	X509_free(x);
d02b48c6	246	}
d02b48c6	247
58964a49 RE	248	X509_STORE_CTX_cleanup(&xs_ctx);
58964a49 RE	249	}
d02b48c6	250
651d0aff	251	/* Thawte special :-) */
dfeab068	252	if (s->ctx->extra_certs != NULL)
f73e07cf	253	for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
dfeab068	254	{
f73e07cf	255	x=sk_X509_value(s->ctx->extra_certs,i);
dfeab068 RE	256	n=i2d_X509(x,NULL);
	257	if (!BUF_MEM_grow(buf,(int)(n+l+3)))
	258	{
	259	SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
	260	return(0);
	261	}
	262	p=(unsigned char *)&(buf->data[l]);
	263	l2n3(n,p);
	264	i2d_X509(x,&p);
	265	l+=n+3;
	266	}
	267
d02b48c6 RE	268	l-=7;
	269	p=(unsigned char *)&(buf->data[4]);
	270	l2n3(l,p);
	271	l+=3;
	272	p=(unsigned char *)&(buf->data[0]);
	273	*(p++)=SSL3_MT_CERTIFICATE;
	274	l2n3(l,p);
	275	l+=4;
	276	return(l);
	277	}
	278
52732b38 BM	279	/* Obtain handshake message of message type 'mt' (any if mt == -1),
	280	* maximum acceptable body length 'max'.
	281	* The first four bytes (msg_type and length) are read in state 'st1',
	282	* the body is read in state 'stn'.
	283	*/
6b691a5c	284	long ssl3_get_message(SSL s, int st1, int stn, int mt, long max, int ok)
d02b48c6 RE	285	{
	286	unsigned char *p;
	287	unsigned long l;
	288	long n;
	289	int i,al;
	290
	291	if (s->s3->tmp.reuse_message)
	292	{
	293	s->s3->tmp.reuse_message=0;
	294	if ((mt >= 0) && (s->s3->tmp.message_type != mt))
	295	{
58964a49	296	al=SSL_AD_UNEXPECTED_MESSAGE;
d02b48c6 RE	297	SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
	298	goto f_err;
	299	}
	300	*ok=1;
	301	return((int)s->s3->tmp.message_size);
	302	}
	303
	304	p=(unsigned char *)s->init_buf->data;
	305
b35e9050	306	if (s->state == st1) /* s->init_num < 4 */
d02b48c6	307	{
45206340 BM	308	int skip_message;
	309
	310	do
d02b48c6	311	{
45206340	312	while (s->init_num < 4)
b35e9050	313	{
45206340	314	i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
745c70e5	315	4 - s->init_num);
45206340 BM	316	if (i <= 0)
	317	{
	318	s->rwstate=SSL_READING;
	319	*ok = 0;
	320	return i;
	321	}
	322	s->init_num+=i;
b35e9050	323	}
45206340 BM	324
	325	skip_message = 0;
	326	if (!s->server)
	327	if (p[0] == SSL3_MT_HELLO_REQUEST)
	328	/* The server may always send 'Hello Request' messages --
	329	* we are doing a handshake anyway now, so ignore them
745c70e5 BM	330	* if their format is correct. Does not count for
745c70e5 BM	331	* 'Finished' MAC. */
45206340 BM	332	if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
45206340 BM	333	skip_message = 1;
d02b48c6	334	}
45206340	335	while (skip_message);
d02b48c6	336
745c70e5 BM	337	/* s->init_num == 4 */
745c70e5 BM	338
d02b48c6 RE	339	if ((mt >= 0) && (*p != mt))
d02b48c6 RE	340	{
58964a49	341	al=SSL_AD_UNEXPECTED_MESSAGE;
d02b48c6 RE	342	SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
	343	goto f_err;
	344	}
a2a01589	345	if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&
3d14b9d0 DSH	346	(st1 == SSL3_ST_SR_CERT_A) &&
	347	(stn == SSL3_ST_SR_CERT_B))
	348	{
	349	/* At this point we have got an MS SGC second client
745c70e5 BM	350	* hello (maybe we should always allow the client to
745c70e5 BM	351	* start a new handshake?). We need to restart the mac.
a2a01589 BM	352	* Don't increment {num,total}_renegotiations because
a2a01589 BM	353	* we have not completed the handshake. */
3d14b9d0	354	ssl3_init_finished_mac(s);
3d14b9d0	355	}
745c70e5 BM	356
745c70e5 BM	357	ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 4);
3d14b9d0	358
d02b48c6 RE	359	s->s3->tmp.message_type= *(p++);
	360
	361	n2l3(p,l);
	362	if (l > (unsigned long)max)
	363	{
58964a49	364	al=SSL_AD_ILLEGAL_PARAMETER;
d02b48c6 RE	365	SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
	366	goto f_err;
	367	}
	368	if (l && !BUF_MEM_grow(s->init_buf,(int)l))
	369	{
	370	SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);
	371	goto err;
	372	}
	373	s->s3->tmp.message_size=l;
	374	s->state=stn;
	375
	376	s->init_num=0;
	377	}
	378
	379	/* next state (stn) */
	380	p=(unsigned char *)s->init_buf->data;
	381	n=s->s3->tmp.message_size;
b35e9050	382	while (n > 0)
d02b48c6	383	{
61f5b6f3	384	i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n);
b35e9050	385	if (i <= 0)
d02b48c6	386	{
b35e9050 BM	387	s->rwstate=SSL_READING;
	388	*ok = 0;
	389	return i;
d02b48c6	390	}
b35e9050 BM	391	s->init_num += i;
b35e9050 BM	392	n -= i;
d02b48c6	393	}
745c70e5	394	ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);
d02b48c6	395	*ok=1;
b35e9050	396	return s->init_num;
d02b48c6 RE	397	f_err:
	398	ssl3_send_alert(s,SSL3_AL_FATAL,al);
	399	err:
	400	*ok=0;
	401	return(-1);
	402	}
	403
6b691a5c	404	int ssl_cert_type(X509 x, EVP_PKEY pkey)
d02b48c6 RE	405	{
	406	EVP_PKEY *pk;
	407	int ret= -1,i,j;
	408
	409	if (pkey == NULL)
	410	pk=X509_get_pubkey(x);
	411	else
	412	pk=pkey;
	413	if (pk == NULL) goto err;
	414
	415	i=pk->type;
	416	if (i == EVP_PKEY_RSA)
	417	{
	418	ret=SSL_PKEY_RSA_ENC;
	419	if (x != NULL)
	420	{
	421	j=X509_get_ext_count(x);
	422	/* check to see if this is a signing only certificate */
	423	/* EAY EAY EAY EAY */
	424	}
	425	}
	426	else if (i == EVP_PKEY_DSA)
	427	{
	428	ret=SSL_PKEY_DSA_SIGN;
	429	}
	430	else if (i == EVP_PKEY_DH)
	431	{
	432	/* if we just have a key, we needs to be guess */
	433
	434	if (x == NULL)
	435	ret=SSL_PKEY_DH_DSA;
	436	else
	437	{
	438	j=X509_get_signature_type(x);
	439	if (j == EVP_PKEY_RSA)
	440	ret=SSL_PKEY_DH_RSA;
	441	else if (j== EVP_PKEY_DSA)
	442	ret=SSL_PKEY_DH_DSA;
	443	else ret= -1;
	444	}
	445	}
	446	else
	447	ret= -1;
	448
	449	err:
a8236c8c	450	if(!pkey) EVP_PKEY_free(pk);
d02b48c6 RE	451	return(ret);
	452	}
	453
6b691a5c	454	int ssl_verify_alarm_type(long type)
d02b48c6 RE	455	{
	456	int al;
	457
	458	switch(type)
	459	{
	460	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
58964a49 RE	461	case X509_V_ERR_UNABLE_TO_GET_CRL:
	462	al=SSL_AD_UNKNOWN_CA;
	463	break;
d02b48c6	464	case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
58964a49	465	case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
d02b48c6	466	case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
d02b48c6 RE	467	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
d02b48c6 RE	468	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
58964a49 RE	469	case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
	470	case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
	471	case X509_V_ERR_CERT_NOT_YET_VALID:
	472	case X509_V_ERR_CRL_NOT_YET_VALID:
	473	al=SSL_AD_BAD_CERTIFICATE;
	474	break;
	475	case X509_V_ERR_CERT_SIGNATURE_FAILURE:
	476	case X509_V_ERR_CRL_SIGNATURE_FAILURE:
	477	al=SSL_AD_DECRYPT_ERROR;
	478	break;
	479	case X509_V_ERR_CERT_HAS_EXPIRED:
	480	case X509_V_ERR_CRL_HAS_EXPIRED:
	481	al=SSL_AD_CERTIFICATE_EXPIRED;
	482	break;
	483	case X509_V_ERR_CERT_REVOKED:
	484	al=SSL_AD_CERTIFICATE_REVOKED;
	485	break;
	486	case X509_V_ERR_OUT_OF_MEM:
	487	al=SSL_AD_INTERNAL_ERROR;
	488	break;
d02b48c6 RE	489	case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
	490	case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
	491	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
	492	case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
58964a49 RE	493	case X509_V_ERR_CERT_CHAIN_TOO_LONG:
58964a49 RE	494	al=SSL_AD_UNKNOWN_CA;
d02b48c6	495	break;
58964a49 RE	496	case X509_V_ERR_APPLICATION_VERIFICATION:
58964a49 RE	497	al=SSL_AD_HANDSHAKE_FAILURE;
d02b48c6 RE	498	break;
d02b48c6 RE	499	default:
58964a49	500	al=SSL_AD_CERTIFICATE_UNKNOWN;
d02b48c6 RE	501	break;
	502	}
	503	return(al);
	504	}
	505
6b691a5c	506	int ssl3_setup_buffers(SSL *s)
d02b48c6 RE	507	{
	508	unsigned char *p;
	509	unsigned int extra;
	510
	511	if (s->s3->rbuf.buf == NULL)
	512	{
58964a49	513	if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
d02b48c6 RE	514	extra=SSL3_RT_MAX_EXTRA;
	515	else
	516	extra=0;
b35e9050	517	if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
d02b48c6 RE	518	== NULL)
	519	goto err;
	520	s->s3->rbuf.buf=p;
	521	}
	522
	523	if (s->s3->wbuf.buf == NULL)
	524	{
b35e9050	525	if ((p=Malloc(SSL3_RT_MAX_PACKET_SIZE))
d02b48c6 RE	526	== NULL)
	527	goto err;
	528	s->s3->wbuf.buf=p;
	529	}
	530	s->packet= &(s->s3->rbuf.buf[0]);
	531	return(1);
	532	err:
	533	SSLerr(SSL_F_SSL3_SETUP_BUFFERS,ERR_R_MALLOC_FAILURE);
	534	return(0);
	535	}