[thirdparty/openssl.git] / ssl / s3_enc.c

/* ssl/s3_enc.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include <openssl/md5.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
#include "ssl_locl.h"

static unsigned char ssl3_pad_1[48]={
	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36 };

static unsigned char ssl3_pad_2[48]={
	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c };

static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx,
	const char *sender, int len, unsigned char *p);

static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
	{
	MD5_CTX m5;
	SHA_CTX s1;
	unsigned char buf[16],smd[SHA_DIGEST_LENGTH];
	unsigned char c='A';
	int i,j,k;

#ifdef CHARSET_EBCDIC
	c = os_toascii[c]; /*'A' in ASCII */
#endif
	k=0;
	for (i=0; i<num; i+=MD5_DIGEST_LENGTH)
		{
		k++;
		if (k > sizeof buf)
			{
			/* bug: 'buf' is too small for this ciphersuite */
			SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
			return 0;
			}
		
		for (j=0; j<k; j++)
			buf[j]=c;
		c++;
		SHA1_Init(  &s1);
		SHA1_Update(&s1,buf,k);
		SHA1_Update(&s1,s->session->master_key,
			s->session->master_key_length);
		SHA1_Update(&s1,s->s3->server_random,SSL3_RANDOM_SIZE);
		SHA1_Update(&s1,s->s3->client_random,SSL3_RANDOM_SIZE);
		SHA1_Final( smd,&s1);

		MD5_Init(  &m5);
		MD5_Update(&m5,s->session->master_key,
			s->session->master_key_length);
		MD5_Update(&m5,smd,SHA_DIGEST_LENGTH);
		if ((i+MD5_DIGEST_LENGTH) > num)
			{
			MD5_Final(smd,&m5);
			memcpy(km,smd,(num-i));
			}
		else
			MD5_Final(km,&m5);

		km+=MD5_DIGEST_LENGTH;
		}
	memset(smd,0,SHA_DIGEST_LENGTH);
	return 1;
	}

int ssl3_change_cipher_state(SSL *s, int which)
	{
	unsigned char *p,*key_block,*mac_secret;
	unsigned char exp_key[EVP_MAX_KEY_LENGTH];
	unsigned char exp_iv[EVP_MAX_KEY_LENGTH];
	unsigned char *ms,*key,*iv,*er1,*er2;
	EVP_CIPHER_CTX *dd;
	const EVP_CIPHER *c;
	COMP_METHOD *comp;
	const EVP_MD *m;
	MD5_CTX md;
	int exp,n,i,j,k,cl;

	exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
	c=s->s3->tmp.new_sym_enc;
	m=s->s3->tmp.new_hash;
	if (s->s3->tmp.new_compression == NULL)
		comp=NULL;
	else
		comp=s->s3->tmp.new_compression->method;
	key_block=s->s3->tmp.key_block;

	if (which & SSL3_CC_READ)
		{
		if ((s->enc_read_ctx == NULL) &&
			((s->enc_read_ctx=(EVP_CIPHER_CTX *)
			OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
			goto err;
		dd= s->enc_read_ctx;
		s->read_hash=m;
		/* COMPRESS */
		if (s->expand != NULL)
			{
			COMP_CTX_free(s->expand);
			s->expand=NULL;
			}
		if (comp != NULL)
			{
			s->expand=COMP_CTX_new(comp);
			if (s->expand == NULL)
				{
				SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
				goto err2;
				}
			if (s->s3->rrec.comp == NULL)
				s->s3->rrec.comp=(unsigned char *)
					OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH);
			if (s->s3->rrec.comp == NULL)
				goto err;
			}
		memset(&(s->s3->read_sequence[0]),0,8);
		mac_secret= &(s->s3->read_mac_secret[0]);
		}
	else
		{
		if ((s->enc_write_ctx == NULL) &&
			((s->enc_write_ctx=(EVP_CIPHER_CTX *)
			OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
			goto err;
		dd= s->enc_write_ctx;
		s->write_hash=m;
		/* COMPRESS */
		if (s->compress != NULL)
			{
			COMP_CTX_free(s->compress);
			s->compress=NULL;
			}
		if (comp != NULL)
			{
			s->compress=COMP_CTX_new(comp);
			if (s->compress == NULL)
				{
				SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
				goto err2;
				}
			}
		memset(&(s->s3->write_sequence[0]),0,8);
		mac_secret= &(s->s3->write_mac_secret[0]);
		}

	EVP_CIPHER_CTX_init(dd);

	p=s->s3->tmp.key_block;
	i=EVP_MD_size(m);
	cl=EVP_CIPHER_key_length(c);
	j=exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
		 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
	/* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
	k=EVP_CIPHER_iv_length(c);
	if (	(which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
		(which == SSL3_CHANGE_CIPHER_SERVER_READ))
		{
		ms=  &(p[ 0]); n=i+i;
		key= &(p[ n]); n+=j+j;
		iv=  &(p[ n]); n+=k+k;
		er1= &(s->s3->client_random[0]);
		er2= &(s->s3->server_random[0]);
		}
	else
		{
		n=i;
		ms=  &(p[ n]); n+=i+j;
		key= &(p[ n]); n+=j+k;
		iv=  &(p[ n]); n+=k;
		er1= &(s->s3->server_random[0]);
		er2= &(s->s3->client_random[0]);
		}

	if (n > s->s3->tmp.key_block_length)
		{
		SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
		goto err2;
		}

	memcpy(mac_secret,ms,i);
	if (exp)
		{
		/* In here I set both the read and write key/iv to the
		 * same value since only the correct one will be used :-).
		 */
		MD5_Init(&md);
		MD5_Update(&md,key,j);
		MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
		MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
		MD5_Final(&(exp_key[0]),&md);
		key= &(exp_key[0]);

		if (k > 0)
			{
			MD5_Init(&md);
			MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
			MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
			MD5_Final(&(exp_iv[0]),&md);
			iv= &(exp_iv[0]);
			}
		}

	s->session->key_arg_length=0;

	EVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE));

	memset(&(exp_key[0]),0,sizeof(exp_key));
	memset(&(exp_iv[0]),0,sizeof(exp_iv));
	return(1);
err:
	SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
err2:
	return(0);
	}

int ssl3_setup_key_block(SSL *s)
	{
	unsigned char *p;
	const EVP_CIPHER *c;
	const EVP_MD *hash;
	int num;
	SSL_COMP *comp;

	if (s->s3->tmp.key_block_length != 0)
		return(1);

	if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp))
		{
		SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
		return(0);
		}

	s->s3->tmp.new_sym_enc=c;
	s->s3->tmp.new_hash=hash;
	s->s3->tmp.new_compression=comp;

	num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
	num*=2;

	ssl3_cleanup_key_block(s);

	if ((p=OPENSSL_malloc(num)) == NULL)
		goto err;

	s->s3->tmp.key_block_length=num;
	s->s3->tmp.key_block=p;

	return ssl3_generate_key_block(s,p,num);

err:
	SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
	return(0);
	}

void ssl3_cleanup_key_block(SSL *s)
	{
	if (s->s3->tmp.key_block != NULL)
		{
		memset(s->s3->tmp.key_block,0,
			s->s3->tmp.key_block_length);
		OPENSSL_free(s->s3->tmp.key_block);
		s->s3->tmp.key_block=NULL;
		}
	s->s3->tmp.key_block_length=0;
	}

int ssl3_enc(SSL *s, int send)
	{
	SSL3_RECORD *rec;
	EVP_CIPHER_CTX *ds;
	unsigned long l;
	int bs,i;
	const EVP_CIPHER *enc;

	if (send)
		{
		ds=s->enc_write_ctx;
		rec= &(s->s3->wrec);
		if (s->enc_write_ctx == NULL)
			enc=NULL;
		else
			enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
		}
	else
		{
		ds=s->enc_read_ctx;
		rec= &(s->s3->rrec);
		if (s->enc_read_ctx == NULL)
			enc=NULL;
		else
			enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
		}

	if ((s->session == NULL) || (ds == NULL) ||
		(enc == NULL))
		{
		memmove(rec->data,rec->input,rec->length);
		rec->input=rec->data;
		}
	else
		{
		l=rec->length;
		bs=EVP_CIPHER_block_size(ds->cipher);

		/* COMPRESS */

		if ((bs != 1) && send)
			{
			i=bs-((int)l%bs);

			/* we need to add 'i-1' padding bytes */
			l+=i;
			rec->length+=i;
			rec->input[l-1]=(i-1);
			}
		
		if (!send)
			{
			if (l == 0 || l%bs != 0)
				{
				SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR);
				return(0);
				}
			}
		
		EVP_Cipher(ds,rec->data,rec->input,l);

		if ((bs != 1) && !send)
			{
			i=rec->data[l-1]+1;
			/* SSL 3.0 bounds the number of padding bytes by the block size;
			 * padding bytes (except that last) are arbitrary */
			if (i > bs)
				{
				SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR);
				return(0);
				}
			rec->length-=i;
			}
		}
	return(1);
	}

void ssl3_init_finished_mac(SSL *s)
	{
	EVP_DigestInit(&(s->s3->finish_dgst1),s->ctx->md5);
	EVP_DigestInit(&(s->s3->finish_dgst2),s->ctx->sha1);
	}

void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
	{
	EVP_DigestUpdate(&(s->s3->finish_dgst1),buf,len);
	EVP_DigestUpdate(&(s->s3->finish_dgst2),buf,len);
	}

int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *ctx, unsigned char *p)
	{
	return(ssl3_handshake_mac(s,ctx,NULL,0,p));
	}

int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2,
	     const char *sender, int len, unsigned char *p)
	{
	int ret;

	ret=ssl3_handshake_mac(s,ctx1,sender,len,p);
	p+=ret;
	ret+=ssl3_handshake_mac(s,ctx2,sender,len,p);
	return(ret);
	}

static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx,
	     const char *sender, int len, unsigned char *p)
	{
	unsigned int ret;
	int npad,n;
	unsigned int i;
	unsigned char md_buf[EVP_MAX_MD_SIZE];
	EVP_MD_CTX ctx;

	EVP_MD_CTX_copy(&ctx,in_ctx);

	n=EVP_MD_CTX_size(&ctx);
	npad=(48/n)*n;

	if (sender != NULL)
		EVP_DigestUpdate(&ctx,sender,len);
	EVP_DigestUpdate(&ctx,s->session->master_key,
		s->session->master_key_length);
	EVP_DigestUpdate(&ctx,ssl3_pad_1,npad);
	EVP_DigestFinal(&ctx,md_buf,&i);

	EVP_DigestInit(&ctx,EVP_MD_CTX_md(&ctx));
	EVP_DigestUpdate(&ctx,s->session->master_key,
		s->session->master_key_length);
	EVP_DigestUpdate(&ctx,ssl3_pad_2,npad);
	EVP_DigestUpdate(&ctx,md_buf,i);
	EVP_DigestFinal(&ctx,p,&ret);

	memset(&ctx,0,sizeof(EVP_MD_CTX));

	return((int)ret);
	}

int ssl3_mac(SSL *ssl, unsigned char *md, int send)
	{
	SSL3_RECORD *rec;
	unsigned char *mac_sec,*seq;
	EVP_MD_CTX md_ctx;
	const EVP_MD *hash;
	unsigned char *p,rec_char;
	unsigned int md_size;
	int npad,i;

	if (send)
		{
		rec= &(ssl->s3->wrec);
		mac_sec= &(ssl->s3->write_mac_secret[0]);
		seq= &(ssl->s3->write_sequence[0]);
		hash=ssl->write_hash;
		}
	else
		{
		rec= &(ssl->s3->rrec);
		mac_sec= &(ssl->s3->read_mac_secret[0]);
		seq= &(ssl->s3->read_sequence[0]);
		hash=ssl->read_hash;
		}

	md_size=EVP_MD_size(hash);
	npad=(48/md_size)*md_size;

	/* Chop the digest off the end :-) */

	EVP_DigestInit(  &md_ctx,hash);
	EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
	EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
	EVP_DigestUpdate(&md_ctx,seq,8);
	rec_char=rec->type;
	EVP_DigestUpdate(&md_ctx,&rec_char,1);
	p=md;
	s2n(rec->length,p);
	EVP_DigestUpdate(&md_ctx,md,2);
	EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
	EVP_DigestFinal( &md_ctx,md,NULL);

	EVP_DigestInit(  &md_ctx,hash);
	EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
	EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
	EVP_DigestUpdate(&md_ctx,md,md_size);
	EVP_DigestFinal( &md_ctx,md,&md_size);

	for (i=7; i>=0; i--)
		{
		++seq[i];
		if (seq[i] != 0) break; 
		}

	return(md_size);
	}

int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
	     int len)
	{
	static const unsigned char *salt[3]={
#ifndef CHARSET_EBCDIC
		(const unsigned char *)"A",
		(const unsigned char *)"BB",
		(const unsigned char *)"CCC",
#else
		(const unsigned char *)"\x41",
		(const unsigned char *)"\x42\x42",
		(const unsigned char *)"\x43\x43\x43",
#endif
		};
	unsigned char buf[EVP_MAX_MD_SIZE];
	EVP_MD_CTX ctx;
	int i,ret=0;
	unsigned int n;

	for (i=0; i<3; i++)
		{
		EVP_DigestInit(&ctx,s->ctx->sha1);
		EVP_DigestUpdate(&ctx,salt[i],strlen((const char *)salt[i]));
		EVP_DigestUpdate(&ctx,p,len);
		EVP_DigestUpdate(&ctx,&(s->s3->client_random[0]),
			SSL3_RANDOM_SIZE);
		EVP_DigestUpdate(&ctx,&(s->s3->server_random[0]),
			SSL3_RANDOM_SIZE);
		EVP_DigestFinal(&ctx,buf,&n);

		EVP_DigestInit(&ctx,s->ctx->md5);
		EVP_DigestUpdate(&ctx,p,len);
		EVP_DigestUpdate(&ctx,buf,n);
		EVP_DigestFinal(&ctx,out,&n);
		out+=n;
		ret+=n;
		}
	return(ret);
	}

int ssl3_alert_code(int code)
	{
	switch (code)
		{
	case SSL_AD_CLOSE_NOTIFY:	return(SSL3_AD_CLOSE_NOTIFY);
	case SSL_AD_UNEXPECTED_MESSAGE:	return(SSL3_AD_UNEXPECTED_MESSAGE);
	case SSL_AD_BAD_RECORD_MAC:	return(SSL3_AD_BAD_RECORD_MAC);
	case SSL_AD_DECRYPTION_FAILED:	return(SSL3_AD_BAD_RECORD_MAC);
	case SSL_AD_RECORD_OVERFLOW:	return(SSL3_AD_BAD_RECORD_MAC);
	case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE);
	case SSL_AD_HANDSHAKE_FAILURE:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_NO_CERTIFICATE:	return(SSL3_AD_NO_CERTIFICATE);
	case SSL_AD_BAD_CERTIFICATE:	return(SSL3_AD_BAD_CERTIFICATE);
	case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE);
	case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED);
	case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED);
	case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN);
	case SSL_AD_ILLEGAL_PARAMETER:	return(SSL3_AD_ILLEGAL_PARAMETER);
	case SSL_AD_UNKNOWN_CA:		return(SSL3_AD_BAD_CERTIFICATE);
	case SSL_AD_ACCESS_DENIED:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_DECODE_ERROR:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_DECRYPT_ERROR:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_EXPORT_RESTRICTION:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_PROTOCOL_VERSION:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_INSUFFICIENT_SECURITY:return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_INTERNAL_ERROR:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_USER_CANCELLED:	return(SSL3_AD_HANDSHAKE_FAILURE);
	case SSL_AD_NO_RENEGOTIATION:	return(-1); /* Don't send it :-) */
	default:			return(-1);
		}
	}
Commit	Line	Data
d02b48c6	1	/* ssl/s3_enc.c */
58964a49	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
d02b48c6 RE	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
	8	*
	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
	15	*
	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
	22	*
	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
	37	* 4. If you include any Windows specific code (or a derivative thereof) from
	38	* the apps directory (application code) you must include an acknowledgement:
	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
	40	*
	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
	52	*
	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
	57	*/
	58
	59	#include <stdio.h>
d02f751c UM	60	#include <openssl/md5.h>
d02f751c UM	61	#include <openssl/sha.h>
ec577822	62	#include <openssl/evp.h>
d02b48c6 RE	63	#include "ssl_locl.h"
	64
	65	static unsigned char ssl3_pad_1[48]={
	66	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	67	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	68	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	69	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	70	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
	71	0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36 };
	72
	73	static unsigned char ssl3_pad_2[48]={
	74	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	75	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	76	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	77	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	78	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
	79	0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c };
	80
58964a49	81	static int ssl3_handshake_mac(SSL s, EVP_MD_CTX in_ctx,
f2d9a32c	82	const char sender, int len, unsigned char p);
58964a49	83
027e257b	84	static int ssl3_generate_key_block(SSL s, unsigned char km, int num)
58964a49 RE	85	{
	86	MD5_CTX m5;
	87	SHA_CTX s1;
42748c08	88	unsigned char buf[16],smd[SHA_DIGEST_LENGTH];
58964a49 RE	89	unsigned char c='A';
	90	int i,j,k;
	91
ca570cfd UM	92	#ifdef CHARSET_EBCDIC
	93	c = os_toascii[c]; /'A' in ASCII /
	94	#endif
58964a49 RE	95	k=0;
	96	for (i=0; i<num; i+=MD5_DIGEST_LENGTH)
	97	{
	98	k++;
027e257b BM	99	if (k > sizeof buf)
	100	{
	101	/* bug: 'buf' is too small for this ciphersuite */
	102	SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
	103	return 0;
	104	}
	105
58964a49 RE	106	for (j=0; j<k; j++)
	107	buf[j]=c;
	108	c++;
	109	SHA1_Init( &s1);
	110	SHA1_Update(&s1,buf,k);
	111	SHA1_Update(&s1,s->session->master_key,
	112	s->session->master_key_length);
	113	SHA1_Update(&s1,s->s3->server_random,SSL3_RANDOM_SIZE);
	114	SHA1_Update(&s1,s->s3->client_random,SSL3_RANDOM_SIZE);
	115	SHA1_Final( smd,&s1);
	116
	117	MD5_Init( &m5);
	118	MD5_Update(&m5,s->session->master_key,
	119	s->session->master_key_length);
	120	MD5_Update(&m5,smd,SHA_DIGEST_LENGTH);
	121	if ((i+MD5_DIGEST_LENGTH) > num)
	122	{
	123	MD5_Final(smd,&m5);
	124	memcpy(km,smd,(num-i));
	125	}
	126	else
	127	MD5_Final(km,&m5);
	128
	129	km+=MD5_DIGEST_LENGTH;
	130	}
	131	memset(smd,0,SHA_DIGEST_LENGTH);
027e257b	132	return 1;
58964a49 RE	133	}
58964a49 RE	134
6b691a5c	135	int ssl3_change_cipher_state(SSL *s, int which)
d02b48c6 RE	136	{
	137	unsigned char p,key_block,*mac_secret;
	138	unsigned char exp_key[EVP_MAX_KEY_LENGTH];
	139	unsigned char exp_iv[EVP_MAX_KEY_LENGTH];
	140	unsigned char ms,key,iv,er1,*er2;
	141	EVP_CIPHER_CTX *dd;
e778802f	142	const EVP_CIPHER *c;
dfeab068	143	COMP_METHOD *comp;
e778802f	144	const EVP_MD *m;
d02b48c6	145	MD5_CTX md;
436d318c	146	int exp,n,i,j,k,cl;
d02b48c6	147
06ab81f9	148	exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
d02b48c6 RE	149	c=s->s3->tmp.new_sym_enc;
d02b48c6 RE	150	m=s->s3->tmp.new_hash;
413c4f45 MC	151	if (s->s3->tmp.new_compression == NULL)
	152	comp=NULL;
	153	else
	154	comp=s->s3->tmp.new_compression->method;
d02b48c6 RE	155	key_block=s->s3->tmp.key_block;
	156
	157	if (which & SSL3_CC_READ)
	158	{
	159	if ((s->enc_read_ctx == NULL) &&
	160	((s->enc_read_ctx=(EVP_CIPHER_CTX *)
26a3a48d	161	OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
d02b48c6 RE	162	goto err;
	163	dd= s->enc_read_ctx;
	164	s->read_hash=m;
dfeab068 RE	165	/* COMPRESS */
	166	if (s->expand != NULL)
	167	{
	168	COMP_CTX_free(s->expand);
	169	s->expand=NULL;
	170	}
	171	if (comp != NULL)
	172	{
	173	s->expand=COMP_CTX_new(comp);
	174	if (s->expand == NULL)
	175	{
	176	SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
	177	goto err2;
	178	}
413c4f45 MC	179	if (s->s3->rrec.comp == NULL)
413c4f45 MC	180	s->s3->rrec.comp=(unsigned char *)
26a3a48d	181	OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH);
dfeab068 RE	182	if (s->s3->rrec.comp == NULL)
	183	goto err;
	184	}
d02b48c6 RE	185	memset(&(s->s3->read_sequence[0]),0,8);
	186	mac_secret= &(s->s3->read_mac_secret[0]);
	187	}
	188	else
	189	{
	190	if ((s->enc_write_ctx == NULL) &&
	191	((s->enc_write_ctx=(EVP_CIPHER_CTX *)
26a3a48d	192	OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
d02b48c6 RE	193	goto err;
	194	dd= s->enc_write_ctx;
	195	s->write_hash=m;
dfeab068 RE	196	/* COMPRESS */
	197	if (s->compress != NULL)
	198	{
	199	COMP_CTX_free(s->compress);
	200	s->compress=NULL;
	201	}
	202	if (comp != NULL)
	203	{
	204	s->compress=COMP_CTX_new(comp);
	205	if (s->compress == NULL)
	206	{
	207	SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
	208	goto err2;
	209	}
	210	}
d02b48c6 RE	211	memset(&(s->s3->write_sequence[0]),0,8);
	212	mac_secret= &(s->s3->write_mac_secret[0]);
	213	}
	214
58964a49 RE	215	EVP_CIPHER_CTX_init(dd);
58964a49 RE	216
d02b48c6 RE	217	p=s->s3->tmp.key_block;
d02b48c6 RE	218	i=EVP_MD_size(m);
436d318c	219	cl=EVP_CIPHER_key_length(c);
06ab81f9 BL	220	j=exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
06ab81f9 BL	221	cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
436d318c	222	/* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
d02b48c6 RE	223	k=EVP_CIPHER_iv_length(c);
	224	if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) \|\|
	225	(which == SSL3_CHANGE_CIPHER_SERVER_READ))
	226	{
	227	ms= &(p[ 0]); n=i+i;
	228	key= &(p[ n]); n+=j+j;
	229	iv= &(p[ n]); n+=k+k;
	230	er1= &(s->s3->client_random[0]);
	231	er2= &(s->s3->server_random[0]);
	232	}
	233	else
	234	{
	235	n=i;
	236	ms= &(p[ n]); n+=i+j;
	237	key= &(p[ n]); n+=j+k;
	238	iv= &(p[ n]); n+=k;
	239	er1= &(s->s3->server_random[0]);
	240	er2= &(s->s3->client_random[0]);
	241	}
	242
	243	if (n > s->s3->tmp.key_block_length)
	244	{
5277d7cb	245	SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
d02b48c6 RE	246	goto err2;
	247	}
	248
	249	memcpy(mac_secret,ms,i);
	250	if (exp)
	251	{
	252	/* In here I set both the read and write key/iv to the
	253	* same value since only the correct one will be used :-).
	254	*/
	255	MD5_Init(&md);
	256	MD5_Update(&md,key,j);
	257	MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
	258	MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
	259	MD5_Final(&(exp_key[0]),&md);
	260	key= &(exp_key[0]);
	261
58964a49 RE	262	if (k > 0)
	263	{
	264	MD5_Init(&md);
	265	MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
	266	MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
	267	MD5_Final(&(exp_iv[0]),&md);
	268	iv= &(exp_iv[0]);
	269	}
d02b48c6 RE	270	}
d02b48c6 RE	271
58964a49	272	s->session->key_arg_length=0;
d02b48c6 RE	273
d02b48c6 RE	274	EVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE));
58964a49	275
d02b48c6 RE	276	memset(&(exp_key[0]),0,sizeof(exp_key));
	277	memset(&(exp_iv[0]),0,sizeof(exp_iv));
	278	return(1);
	279	err:
	280	SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
	281	err2:
	282	return(0);
	283	}
	284
6b691a5c	285	int ssl3_setup_key_block(SSL *s)
d02b48c6 RE	286	{
d02b48c6 RE	287	unsigned char *p;
e778802f BL	288	const EVP_CIPHER *c;
e778802f BL	289	const EVP_MD *hash;
06ab81f9	290	int num;
413c4f45	291	SSL_COMP *comp;
d02b48c6 RE	292
	293	if (s->s3->tmp.key_block_length != 0)
	294	return(1);
	295
413c4f45	296	if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp))
d02b48c6 RE	297	{
	298	SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
	299	return(0);
	300	}
	301
	302	s->s3->tmp.new_sym_enc=c;
	303	s->s3->tmp.new_hash=hash;
413c4f45	304	s->s3->tmp.new_compression=comp;
d02b48c6	305
d02b48c6 RE	306	num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
	307	num*=2;
	308
	309	ssl3_cleanup_key_block(s);
	310
26a3a48d	311	if ((p=OPENSSL_malloc(num)) == NULL)
d02b48c6 RE	312	goto err;
	313
	314	s->s3->tmp.key_block_length=num;
	315	s->s3->tmp.key_block=p;
	316
027e257b	317	return ssl3_generate_key_block(s,p,num);
d02b48c6	318
d02b48c6 RE	319	err:
	320	SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
	321	return(0);
	322	}
	323
6b691a5c	324	void ssl3_cleanup_key_block(SSL *s)
d02b48c6 RE	325	{
	326	if (s->s3->tmp.key_block != NULL)
	327	{
	328	memset(s->s3->tmp.key_block,0,
	329	s->s3->tmp.key_block_length);
26a3a48d	330	OPENSSL_free(s->s3->tmp.key_block);
d02b48c6 RE	331	s->s3->tmp.key_block=NULL;
	332	}
	333	s->s3->tmp.key_block_length=0;
	334	}
	335
6b691a5c	336	int ssl3_enc(SSL *s, int send)
d02b48c6 RE	337	{
	338	SSL3_RECORD *rec;
	339	EVP_CIPHER_CTX *ds;
	340	unsigned long l;
	341	int bs,i;
e778802f	342	const EVP_CIPHER *enc;
d02b48c6 RE	343
	344	if (send)
	345	{
	346	ds=s->enc_write_ctx;
	347	rec= &(s->s3->wrec);
	348	if (s->enc_write_ctx == NULL)
dfeab068	349	enc=NULL;
d02b48c6	350	else
d02b48c6	351	enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
d02b48c6 RE	352	}
	353	else
	354	{
	355	ds=s->enc_read_ctx;
	356	rec= &(s->s3->rrec);
	357	if (s->enc_read_ctx == NULL)
dfeab068	358	enc=NULL;
d02b48c6	359	else
d02b48c6	360	enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
d02b48c6 RE	361	}
	362
	363	if ((s->session == NULL) \|\| (ds == NULL) \|\|
dfeab068	364	(enc == NULL))
d02b48c6	365	{
44e48abc	366	memmove(rec->data,rec->input,rec->length);
d02b48c6 RE	367	rec->input=rec->data;
	368	}
	369	else
	370	{
	371	l=rec->length;
	372	bs=EVP_CIPHER_block_size(ds->cipher);
	373
dfeab068 RE	374	/* COMPRESS */
dfeab068 RE	375
d02b48c6 RE	376	if ((bs != 1) && send)
	377	{
	378	i=bs-((int)l%bs);
	379
	380	/* we need to add 'i-1' padding bytes */
	381	l+=i;
	382	rec->length+=i;
	383	rec->input[l-1]=(i-1);
	384	}
285b4275 BM	385
	386	if (!send)
	387	{
	388	if (l == 0 \|\| l%bs != 0)
	389	{
	390	SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
	391	ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR);
	392	return(0);
	393	}
	394	}
	395
d02b48c6 RE	396	EVP_Cipher(ds,rec->data,rec->input,l);
	397
	398	if ((bs != 1) && !send)
	399	{
	400	i=rec->data[l-1]+1;
285b4275 BM	401	/* SSL 3.0 bounds the number of padding bytes by the block size;
285b4275 BM	402	* padding bytes (except that last) are arbitrary */
d02b48c6 RE	403	if (i > bs)
	404	{
	405	SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
58964a49	406	ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPT_ERROR);
d02b48c6 RE	407	return(0);
	408	}
	409	rec->length-=i;
	410	}
	411	}
	412	return(1);
	413	}
	414
6b691a5c	415	void ssl3_init_finished_mac(SSL *s)
d02b48c6	416	{
58964a49 RE	417	EVP_DigestInit(&(s->s3->finish_dgst1),s->ctx->md5);
58964a49 RE	418	EVP_DigestInit(&(s->s3->finish_dgst2),s->ctx->sha1);
d02b48c6 RE	419	}
d02b48c6 RE	420
6b691a5c	421	void ssl3_finish_mac(SSL s, const unsigned char buf, int len)
d02b48c6 RE	422	{
	423	EVP_DigestUpdate(&(s->s3->finish_dgst1),buf,len);
	424	EVP_DigestUpdate(&(s->s3->finish_dgst2),buf,len);
	425	}
	426
6b691a5c	427	int ssl3_cert_verify_mac(SSL s, EVP_MD_CTX ctx, unsigned char *p)
58964a49 RE	428	{
	429	return(ssl3_handshake_mac(s,ctx,NULL,0,p));
	430	}
	431
6b691a5c	432	int ssl3_final_finish_mac(SSL s, EVP_MD_CTX ctx1, EVP_MD_CTX *ctx2,
245206ea	433	const char sender, int len, unsigned char p)
58964a49 RE	434	{
	435	int ret;
	436
	437	ret=ssl3_handshake_mac(s,ctx1,sender,len,p);
	438	p+=ret;
	439	ret+=ssl3_handshake_mac(s,ctx2,sender,len,p);
	440	return(ret);
	441	}
	442
6b691a5c	443	static int ssl3_handshake_mac(SSL s, EVP_MD_CTX in_ctx,
f2d9a32c	444	const char sender, int len, unsigned char p)
d02b48c6 RE	445	{
	446	unsigned int ret;
	447	int npad,n;
	448	unsigned int i;
	449	unsigned char md_buf[EVP_MAX_MD_SIZE];
	450	EVP_MD_CTX ctx;
	451
413c4f45	452	EVP_MD_CTX_copy(&ctx,in_ctx);
d02b48c6 RE	453
	454	n=EVP_MD_CTX_size(&ctx);
	455	npad=(48/n)*n;
	456
	457	if (sender != NULL)
58964a49	458	EVP_DigestUpdate(&ctx,sender,len);
d02b48c6 RE	459	EVP_DigestUpdate(&ctx,s->session->master_key,
	460	s->session->master_key_length);
	461	EVP_DigestUpdate(&ctx,ssl3_pad_1,npad);
	462	EVP_DigestFinal(&ctx,md_buf,&i);
	463
72b60351	464	EVP_DigestInit(&ctx,EVP_MD_CTX_md(&ctx));
d02b48c6 RE	465	EVP_DigestUpdate(&ctx,s->session->master_key,
	466	s->session->master_key_length);
	467	EVP_DigestUpdate(&ctx,ssl3_pad_2,npad);
	468	EVP_DigestUpdate(&ctx,md_buf,i);
	469	EVP_DigestFinal(&ctx,p,&ret);
	470
	471	memset(&ctx,0,sizeof(EVP_MD_CTX));
	472
	473	return((int)ret);
	474	}
	475
6b691a5c	476	int ssl3_mac(SSL ssl, unsigned char md, int send)
d02b48c6 RE	477	{
	478	SSL3_RECORD *rec;
	479	unsigned char mac_sec,seq;
	480	EVP_MD_CTX md_ctx;
e778802f	481	const EVP_MD *hash;
d02b48c6 RE	482	unsigned char *p,rec_char;
	483	unsigned int md_size;
	484	int npad,i;
	485
	486	if (send)
	487	{
	488	rec= &(ssl->s3->wrec);
	489	mac_sec= &(ssl->s3->write_mac_secret[0]);
	490	seq= &(ssl->s3->write_sequence[0]);
	491	hash=ssl->write_hash;
	492	}
	493	else
	494	{
	495	rec= &(ssl->s3->rrec);
	496	mac_sec= &(ssl->s3->read_mac_secret[0]);
	497	seq= &(ssl->s3->read_sequence[0]);
	498	hash=ssl->read_hash;
	499	}
	500
	501	md_size=EVP_MD_size(hash);
	502	npad=(48/md_size)*md_size;
	503
d02b48c6 RE	504	/* Chop the digest off the end :-) */
	505
	506	EVP_DigestInit( &md_ctx,hash);
	507	EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
	508	EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
	509	EVP_DigestUpdate(&md_ctx,seq,8);
	510	rec_char=rec->type;
	511	EVP_DigestUpdate(&md_ctx,&rec_char,1);
	512	p=md;
	513	s2n(rec->length,p);
	514	EVP_DigestUpdate(&md_ctx,md,2);
	515	EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
	516	EVP_DigestFinal( &md_ctx,md,NULL);
	517
	518	EVP_DigestInit( &md_ctx,hash);
	519	EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
	520	EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
	521	EVP_DigestUpdate(&md_ctx,md,md_size);
	522	EVP_DigestFinal( &md_ctx,md,&md_size);
	523
	524	for (i=7; i>=0; i--)
1876cc32 BM	525	{
	526	++seq[i];
	527	if (seq[i] != 0) break;
	528	}
d02b48c6	529
d02b48c6 RE	530	return(md_size);
	531	}
	532
6b691a5c UM	533	int ssl3_generate_master_secret(SSL s, unsigned char out, unsigned char *p,
6b691a5c UM	534	int len)
d02b48c6	535	{
e778802f	536	static const unsigned char *salt[3]={
ca570cfd	537	#ifndef CHARSET_EBCDIC
e778802f BL	538	(const unsigned char *)"A",
	539	(const unsigned char *)"BB",
	540	(const unsigned char *)"CCC",
ca570cfd UM	541	#else
	542	(const unsigned char *)"\x41",
	543	(const unsigned char *)"\x42\x42",
	544	(const unsigned char *)"\x43\x43\x43",
	545	#endif
d02b48c6 RE	546	};
	547	unsigned char buf[EVP_MAX_MD_SIZE];
	548	EVP_MD_CTX ctx;
	549	int i,ret=0;
	550	unsigned int n;
	551
	552	for (i=0; i<3; i++)
	553	{
58964a49	554	EVP_DigestInit(&ctx,s->ctx->sha1);
e778802f	555	EVP_DigestUpdate(&ctx,salt[i],strlen((const char *)salt[i]));
d02b48c6 RE	556	EVP_DigestUpdate(&ctx,p,len);
	557	EVP_DigestUpdate(&ctx,&(s->s3->client_random[0]),
	558	SSL3_RANDOM_SIZE);
	559	EVP_DigestUpdate(&ctx,&(s->s3->server_random[0]),
	560	SSL3_RANDOM_SIZE);
	561	EVP_DigestFinal(&ctx,buf,&n);
	562
58964a49	563	EVP_DigestInit(&ctx,s->ctx->md5);
d02b48c6 RE	564	EVP_DigestUpdate(&ctx,p,len);
	565	EVP_DigestUpdate(&ctx,buf,n);
	566	EVP_DigestFinal(&ctx,out,&n);
	567	out+=n;
	568	ret+=n;
	569	}
	570	return(ret);
	571	}
	572
6b691a5c	573	int ssl3_alert_code(int code)
58964a49 RE	574	{
	575	switch (code)
	576	{
	577	case SSL_AD_CLOSE_NOTIFY: return(SSL3_AD_CLOSE_NOTIFY);
	578	case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE);
	579	case SSL_AD_BAD_RECORD_MAC: return(SSL3_AD_BAD_RECORD_MAC);
	580	case SSL_AD_DECRYPTION_FAILED: return(SSL3_AD_BAD_RECORD_MAC);
	581	case SSL_AD_RECORD_OVERFLOW: return(SSL3_AD_BAD_RECORD_MAC);
	582	case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE);
	583	case SSL_AD_HANDSHAKE_FAILURE: return(SSL3_AD_HANDSHAKE_FAILURE);
	584	case SSL_AD_NO_CERTIFICATE: return(SSL3_AD_NO_CERTIFICATE);
	585	case SSL_AD_BAD_CERTIFICATE: return(SSL3_AD_BAD_CERTIFICATE);
	586	case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE);
	587	case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED);
	588	case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED);
	589	case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN);
	590	case SSL_AD_ILLEGAL_PARAMETER: return(SSL3_AD_ILLEGAL_PARAMETER);
	591	case SSL_AD_UNKNOWN_CA: return(SSL3_AD_BAD_CERTIFICATE);
	592	case SSL_AD_ACCESS_DENIED: return(SSL3_AD_HANDSHAKE_FAILURE);
	593	case SSL_AD_DECODE_ERROR: return(SSL3_AD_HANDSHAKE_FAILURE);
	594	case SSL_AD_DECRYPT_ERROR: return(SSL3_AD_HANDSHAKE_FAILURE);
657e60fa	595	case SSL_AD_EXPORT_RESTRICTION: return(SSL3_AD_HANDSHAKE_FAILURE);
58964a49 RE	596	case SSL_AD_PROTOCOL_VERSION: return(SSL3_AD_HANDSHAKE_FAILURE);
	597	case SSL_AD_INSUFFICIENT_SECURITY:return(SSL3_AD_HANDSHAKE_FAILURE);
	598	case SSL_AD_INTERNAL_ERROR: return(SSL3_AD_HANDSHAKE_FAILURE);
657e60fa	599	case SSL_AD_USER_CANCELLED: return(SSL3_AD_HANDSHAKE_FAILURE);
58964a49 RE	600	case SSL_AD_NO_RENEGOTIATION: return(-1); /* Don't send it :-) */
	601	default: return(-1);
	602	}
	603	}
	604