]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/t1_enc.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Reject certificates with unhandled critical extensions.
[thirdparty/openssl.git] / ssl / t1_enc.c
CommitLineData
58964a49
RE		 1/* ssl/t1_enc.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
ec577822
BM		 60#include <openssl/comp.h>
61#include <openssl/evp.h>
62#include <openssl/hmac.h>
58964a49 63#include "ssl_locl.h"
dbad1690 64#include <openssl/md5.h>
58964a49 65
61f5b6f3
BL		 66static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
67 int sec_len, unsigned char *seed, int seed_len,
68 unsigned char *out, int olen)
58964a49
RE		 69 {
70 int chunk,n;
71 unsigned int j;
72 HMAC_CTX ctx;
73 HMAC_CTX ctx_tmp;
74 unsigned char A1[HMAC_MAX_MD_CBLOCK];
75 unsigned int A1_len;
76
77 chunk=EVP_MD_size(md);
78
dbad1690
BL		 79 HMAC_CTX_init(&ctx);
80 HMAC_CTX_init(&ctx_tmp);
58964a49 81 HMAC_Init(&ctx,sec,sec_len,md);
323f289c 82 HMAC_Init(&ctx_tmp,sec,sec_len,md);
58964a49
RE		 83 HMAC_Update(&ctx,seed,seed_len);
84 HMAC_Final(&ctx,A1,&A1_len);
85
86 n=0;
87 for (;;)
88 {
89 HMAC_Init(&ctx,NULL,0,NULL); /* re-init */
323f289c 90 HMAC_Init(&ctx_tmp,NULL,0,NULL); /* re-init */
58964a49 91 HMAC_Update(&ctx,A1,A1_len);
323f289c 92 HMAC_Update(&ctx_tmp,A1,A1_len);
58964a49
RE		 93 HMAC_Update(&ctx,seed,seed_len);
94
95 if (olen > chunk)
96 {
97 HMAC_Final(&ctx,out,&j);
98 out+=j;
99 olen-=j;
100 HMAC_Final(&ctx_tmp,A1,&A1_len); /* calc the next A1 value */
101 }
102 else /* last one */
103 {
104 HMAC_Final(&ctx,A1,&A1_len);
105 memcpy(out,A1,olen);
106 break;
107 }
108 }
dbad1690
BL		 109 HMAC_CTX_cleanup(&ctx);
110 HMAC_CTX_cleanup(&ctx_tmp);
58964a49
RE		 111 memset(A1,0,sizeof(A1));
112 }
113
e4aac1cb 114static void tls1_PRF(const EVP_MD *md5, const EVP_MD *sha1,
61f5b6f3
BL		 115 unsigned char *label, int label_len,
116 const unsigned char *sec, int slen, unsigned char *out1,
117 unsigned char *out2, int olen)
58964a49
RE		 118 {
119 int len,i;
61f5b6f3 120 const unsigned char *S1,*S2;
58964a49
RE		 121
122 len=slen/2;
123 S1=sec;
124 S2= &(sec[len]);
125 len+=(slen&1); /* add for odd, make longer */
126
127
128 tls1_P_hash(md5 ,S1,len,label,label_len,out1,olen);
129 tls1_P_hash(sha1,S2,len,label,label_len,out2,olen);
130
131 for (i=0; i<olen; i++)
132 out1[i]^=out2[i];
133 }
134
6b691a5c
UM		 135static void tls1_generate_key_block(SSL *s, unsigned char *km,
136 unsigned char *tmp, int num)
58964a49
RE		 137 {
138 unsigned char *p;
139 unsigned char buf[SSL3_RANDOM_SIZE*2+
140 TLS_MD_MAX_CONST_SIZE];
141 p=buf;
142
143 memcpy(p,TLS_MD_KEY_EXPANSION_CONST,
144 TLS_MD_KEY_EXPANSION_CONST_SIZE);
145 p+=TLS_MD_KEY_EXPANSION_CONST_SIZE;
146 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
147 p+=SSL3_RANDOM_SIZE;
148 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
149 p+=SSL3_RANDOM_SIZE;
150
dfeab068 151 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf),
e4aac1cb
BL		 152 s->session->master_key,s->session->master_key_length,
153 km,tmp,num);
f9b3bff6
RL		 154#ifdef KSSL_DEBUG
155 printf("tls1_generate_key_block() ==> %d byte master_key =\n\t",
156 s->session->master_key_length);
157 {
158 int i;
159 for (i=0; i < s->session->master_key_length; i++)
160 {
161 printf("%02X", s->session->master_key[i]);
162 }
163 printf("\n"); }
164#endif /* KSSL_DEBUG */
58964a49
RE		 165 }
166
6b691a5c 167int tls1_change_cipher_state(SSL *s, int which)
58964a49 168 {
61f5b6f3 169 static const unsigned char empty[]="";
58964a49
RE		 170 unsigned char *p,*key_block,*mac_secret;
171 unsigned char *exp_label,buf[TLS_MD_MAX_CONST_SIZE+
172 SSL3_RANDOM_SIZE*2];
173 unsigned char tmp1[EVP_MAX_KEY_LENGTH];
174 unsigned char tmp2[EVP_MAX_KEY_LENGTH];
175 unsigned char iv1[EVP_MAX_IV_LENGTH*2];
176 unsigned char iv2[EVP_MAX_IV_LENGTH*2];
177 unsigned char *ms,*key,*iv,*er1,*er2;
178 int client_write;
179 EVP_CIPHER_CTX *dd;
e778802f
BL		 180 const EVP_CIPHER *c;
181 const SSL_COMP *comp;
182 const EVP_MD *m;
06ab81f9 183 int _exp,n,i,j,k,exp_label_len,cl;
58964a49 184
06ab81f9 185 _exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
58964a49
RE		 186 c=s->s3->tmp.new_sym_enc;
187 m=s->s3->tmp.new_hash;
188 comp=s->s3->tmp.new_compression;
189 key_block=s->s3->tmp.key_block;
190
f9b3bff6
RL		 191#ifdef KSSL_DEBUG
192 printf("tls1_change_cipher_state(which= %d) w/\n", which);
193 printf("\talg= %ld, comp= %p\n", s->s3->tmp.new_cipher->algorithms,
194 comp);
195 printf("\tevp_cipher == %p ==? &d_cbc_ede_cipher3\n", c);
196 printf("\tevp_cipher: nid, blksz= %d, %d, keylen=%d, ivlen=%d\n",
197 c->nid,c->block_size,c->key_len,c->iv_len);
198 printf("\tkey_block: len= %d, data= ", s->s3->tmp.key_block_length);
199 {
200 int i;
201 for (i=0; i<s->s3->tmp.key_block_length; i++)
202 printf("%02x", key_block[i]); printf("\n");
203 }
204#endif /* KSSL_DEBUG */
205
58964a49
RE		 206 if (which & SSL3_CC_READ)
207 {
208 if ((s->enc_read_ctx == NULL) &&
209 ((s->enc_read_ctx=(EVP_CIPHER_CTX *)
26a3a48d 210 OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
58964a49
RE		 211 goto err;
212 dd= s->enc_read_ctx;
213 s->read_hash=m;
dfeab068
RE		 214 if (s->expand != NULL)
215 {
216 COMP_CTX_free(s->expand);
217 s->expand=NULL;
218 }
219 if (comp != NULL)
220 {
413c4f45 221 s->expand=COMP_CTX_new(comp->method);
dfeab068
RE		 222 if (s->expand == NULL)
223 {
224 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
225 goto err2;
226 }
413c4f45
MC		 227 if (s->s3->rrec.comp == NULL)
228 s->s3->rrec.comp=(unsigned char *)
26a3a48d 229 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
dfeab068
RE		 230 if (s->s3->rrec.comp == NULL)
231 goto err;
232 }
58964a49
RE		 233 memset(&(s->s3->read_sequence[0]),0,8);
234 mac_secret= &(s->s3->read_mac_secret[0]);
235 }
236 else
237 {
238 if ((s->enc_write_ctx == NULL) &&
239 ((s->enc_write_ctx=(EVP_CIPHER_CTX *)
26a3a48d 240 OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
58964a49
RE		 241 goto err;
242 dd= s->enc_write_ctx;
243 s->write_hash=m;
dfeab068
RE		 244 if (s->compress != NULL)
245 {
246 COMP_CTX_free(s->compress);
247 s->compress=NULL;
248 }
249 if (comp != NULL)
250 {
413c4f45 251 s->compress=COMP_CTX_new(comp->method);
dfeab068
RE		 252 if (s->compress == NULL)
253 {
254 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
255 goto err2;
256 }
257 }
58964a49
RE		 258 memset(&(s->s3->write_sequence[0]),0,8);
259 mac_secret= &(s->s3->write_mac_secret[0]);
260 }
261
262 EVP_CIPHER_CTX_init(dd);
263
264 p=s->s3->tmp.key_block;
265 i=EVP_MD_size(m);
436d318c 266 cl=EVP_CIPHER_key_length(c);
06ab81f9
BL		 267 j=_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
268 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
436d318c 269 /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
58964a49
RE		 270 k=EVP_CIPHER_iv_length(c);
271 er1= &(s->s3->client_random[0]);
272 er2= &(s->s3->server_random[0]);
273 if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
274 (which == SSL3_CHANGE_CIPHER_SERVER_READ))
275 {
276 ms= &(p[ 0]); n=i+i;
277 key= &(p[ n]); n+=j+j;
278 iv= &(p[ n]); n+=k+k;
279 exp_label=(unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST;
280 exp_label_len=TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE;
281 client_write=1;
282 }
283 else
284 {
285 n=i;
286 ms= &(p[ n]); n+=i+j;
287 key= &(p[ n]); n+=j+k;
288 iv= &(p[ n]); n+=k;
289 exp_label=(unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST;
290 exp_label_len=TLS_MD_SERVER_WRITE_KEY_CONST_SIZE;
291 client_write=0;
292 }
293
294 if (n > s->s3->tmp.key_block_length)
295 {
5277d7cb 296 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
58964a49
RE		 297 goto err2;
298 }
299
300 memcpy(mac_secret,ms,i);
301#ifdef TLS_DEBUG
302printf("which = %04X\nmac key=",which);
303{ int z; for (z=0; z<i; z++) printf("%02X%c",ms[z],((z+1)%16)?' ':'\n'); }
304#endif
06ab81f9 305 if (_exp)
58964a49
RE		 306 {
307 /* In here I set both the read and write key/iv to the
308 * same value since only the correct one will be used :-).
309 */
310 p=buf;
311 memcpy(p,exp_label,exp_label_len);
312 p+=exp_label_len;
313 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
314 p+=SSL3_RANDOM_SIZE;
315 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
316 p+=SSL3_RANDOM_SIZE;
dfeab068 317 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(p-buf),key,j,
06ab81f9 318 tmp1,tmp2,EVP_CIPHER_key_length(c));
58964a49
RE		 319 key=tmp1;
320
321 if (k > 0)
322 {
323 p=buf;
324 memcpy(p,TLS_MD_IV_BLOCK_CONST,
325 TLS_MD_IV_BLOCK_CONST_SIZE);
326 p+=TLS_MD_IV_BLOCK_CONST_SIZE;
327 memcpy(p,s->s3->client_random,SSL3_RANDOM_SIZE);
328 p+=SSL3_RANDOM_SIZE;
329 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
330 p+=SSL3_RANDOM_SIZE;
61f5b6f3
BL		 331 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,p-buf,empty,0,
332 iv1,iv2,k*2);
58964a49
RE		 333 if (client_write)
334 iv=iv1;
335 else
336 iv= &(iv1[k]);
337 }
338 }
339
340 s->session->key_arg_length=0;
f9b3bff6
RL		 341#ifdef KSSL_DEBUG
342 {
343 int i;
581f1c84 344 printf("EVP_CipherInit_ex(dd,c,key=,iv=,which)\n");
f9b3bff6
RL		 345 printf("\tkey= "); for (i=0; i<c->key_len; i++) printf("%02x", key[i]);
346 printf("\n");
347 printf("\t iv= "); for (i=0; i<c->iv_len; i++) printf("%02x", iv[i]);
348 printf("\n");
349 }
350#endif /* KSSL_DEBUG */
58964a49 351
581f1c84 352 EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE));
58964a49
RE		 353#ifdef TLS_DEBUG
354printf("which = %04X\nkey=",which);
355{ int z; for (z=0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c",key[z],((z+1)%16)?' ':'\n'); }
356printf("\niv=");
357{ int z; for (z=0; z<k; z++) printf("%02X%c",iv[z],((z+1)%16)?' ':'\n'); }
358printf("\n");
359#endif
360
361 memset(tmp1,0,sizeof(tmp1));
362 memset(tmp2,0,sizeof(tmp1));
363 memset(iv1,0,sizeof(iv1));
364 memset(iv2,0,sizeof(iv2));
365 return(1);
366err:
367 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
368err2:
369 return(0);
370 }
371
6b691a5c 372int tls1_setup_key_block(SSL *s)
58964a49
RE		 373 {
374 unsigned char *p1,*p2;
e778802f
BL		 375 const EVP_CIPHER *c;
376 const EVP_MD *hash;
06ab81f9 377 int num;
413c4f45 378 SSL_COMP *comp;
58964a49 379
f9b3bff6
RL		 380#ifdef KSSL_DEBUG
381 printf ("tls1_setup_key_block()\n");
382#endif /* KSSL_DEBUG */
383
58964a49
RE		 384 if (s->s3->tmp.key_block_length != 0)
385 return(1);
386
413c4f45 387 if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp))
58964a49
RE		 388 {
389 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
390 return(0);
391 }
392
393 s->s3->tmp.new_sym_enc=c;
394 s->s3->tmp.new_hash=hash;
395
58964a49
RE		 396 num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
397 num*=2;
398
399 ssl3_cleanup_key_block(s);
400
26a3a48d 401 if ((p1=(unsigned char *)OPENSSL_malloc(num)) == NULL)
58964a49 402 goto err;
26a3a48d 403 if ((p2=(unsigned char *)OPENSSL_malloc(num)) == NULL)
58964a49
RE		 404 goto err;
405
406 s->s3->tmp.key_block_length=num;
407 s->s3->tmp.key_block=p1;
408
409
410#ifdef TLS_DEBUG
411printf("client random\n");
412{ int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->client_random[z],((z+1)%16)?' ':'\n'); }
413printf("server random\n");
414{ int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->server_random[z],((z+1)%16)?' ':'\n'); }
415printf("pre-master\n");
416{ int z; for (z=0; z<s->session->master_key_length; z++) printf("%02X%c",s->session->master_key[z],((z+1)%16)?' ':'\n'); }
417#endif
418 tls1_generate_key_block(s,p1,p2,num);
419 memset(p2,0,num);
26a3a48d 420 OPENSSL_free(p2);
58964a49
RE		 421#ifdef TLS_DEBUG
422printf("\nkey block\n");
423{ int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }
424#endif
425
426 return(1);
427err:
428 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
429 return(0);
430 }
431
6b691a5c 432int tls1_enc(SSL *s, int send)
58964a49
RE		 433 {
434 SSL3_RECORD *rec;
435 EVP_CIPHER_CTX *ds;
436 unsigned long l;
437 int bs,i,ii,j,k,n=0;
e778802f 438 const EVP_CIPHER *enc;
58964a49
RE		 439
440 if (send)
441 {
442 if (s->write_hash != NULL)
443 n=EVP_MD_size(s->write_hash);
444 ds=s->enc_write_ctx;
445 rec= &(s->s3->wrec);
446 if (s->enc_write_ctx == NULL)
dfeab068 447 enc=NULL;
58964a49 448 else
58964a49 449 enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
58964a49
RE		 450 }
451 else
452 {
453 if (s->read_hash != NULL)
454 n=EVP_MD_size(s->read_hash);
455 ds=s->enc_read_ctx;
456 rec= &(s->s3->rrec);
457 if (s->enc_read_ctx == NULL)
dfeab068 458 enc=NULL;
58964a49 459 else
58964a49 460 enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
58964a49
RE		 461 }
462
f9b3bff6
RL		 463#ifdef KSSL_DEBUG
464 printf("tls1_enc(%d)\n", send);
465#endif /* KSSL_DEBUG */
466
58964a49 467 if ((s->session == NULL) || (ds == NULL) ||
dfeab068 468 (enc == NULL))
58964a49 469 {
44e48abc 470 memmove(rec->data,rec->input,rec->length);
58964a49
RE		 471 rec->input=rec->data;
472 }
473 else
474 {
475 l=rec->length;
476 bs=EVP_CIPHER_block_size(ds->cipher);
477
478 if ((bs != 1) && send)
479 {
480 i=bs-((int)l%bs);
481
482 /* Add weird padding of upto 256 bytes */
483
484 /* we need to add 'i' padding bytes of value j */
485 j=i-1;
486 if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)
487 {
488 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
489 j++;
490 }
491 for (k=(int)l; k<(int)(l+i); k++)
492 rec->input[k]=j;
493 l+=i;
494 rec->length+=i;
495 }
496
f9b3bff6
RL		 497#ifdef KSSL_DEBUG
498 {
45442167 499 unsigned long ui;
f9b3bff6
RL		 500 printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
501 ds,rec->data,rec->input,l);
502 printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
503 ds->buf_len, ds->cipher->key_len,
504 DES_KEY_SZ, DES_SCHEDULE_SZ,
505 ds->cipher->iv_len);
506 printf("\t\tIV: ");
507 for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
508 printf("\n");
509 printf("\trec->input=");
45442167 510 for (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]);
f9b3bff6
RL		 511 printf("\n");
512 }
513#endif /* KSSL_DEBUG */
514
285b4275
BM		 515 if (!send)
516 {
517 if (l == 0 || l%bs != 0)
518 {
519 SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
ee60d9fb
BM		 520 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
521 return 0;
285b4275
BM		 522 }
523 }
524
58964a49
RE		 525 EVP_Cipher(ds,rec->data,rec->input,l);
526
f9b3bff6
RL		 527#ifdef KSSL_DEBUG
528 {
529 unsigned long i;
530 printf("\trec->data=");
531 for (i=0; i<l; i++)
532 printf(" %02x", rec->data[i]); printf("\n");
533 }
534#endif /* KSSL_DEBUG */
535
58964a49
RE		 536 if ((bs != 1) && !send)
537 {
285b4275 538 ii=i=rec->data[l-1]; /* padding_length */
58964a49
RE		 539 i++;
540 if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
541 {
542 /* First packet is even in size, so check */
543 if ((memcmp(s->s3->read_sequence,
544 "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
545 s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
546 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
547 i--;
548 }
285b4275
BM		 549 /* TLS 1.0 does not bound the number of padding bytes by the block size.
550 * All of them must have value 'padding_length'. */
58964a49
RE		 551 if (i > (int)rec->length)
552 {
ee60d9fb
BM		 553 /* Incorrect padding. SSLerr() and ssl3_alert are done
554 * by caller: we don't want to reveal whether this is
965b6dad
BM		 555 * a decryption error or a MAC verification failure
556 * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
ee60d9fb 557 return -1;
58964a49
RE		 558 }
559 for (j=(int)(l-i); j<(int)l; j++)
560 {
561 if (rec->data[j] != ii)
562 {
ee60d9fb
BM		 563 /* Incorrect padding */
564 return -1;
58964a49
RE		 565 }
566 }
567 rec->length-=i;
568 }
569 }
570 return(1);
571 }
572
6b691a5c 573int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out)
58964a49
RE		 574 {
575 unsigned int ret;
576 EVP_MD_CTX ctx;
577
dbad1690 578 EVP_MD_CTX_init(&ctx);
20d2186c
DSH		 579 EVP_MD_CTX_copy_ex(&ctx,in_ctx);
580 EVP_DigestFinal_ex(&ctx,out,&ret);
dbad1690 581 EVP_MD_CTX_cleanup(&ctx);
58964a49
RE		 582 return((int)ret);
583 }
584
6b691a5c 585int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx,
245206ea 586 const char *str, int slen, unsigned char *out)
58964a49
RE		 587 {
588 unsigned int i;
589 EVP_MD_CTX ctx;
590 unsigned char buf[TLS_MD_MAX_CONST_SIZE+MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
591 unsigned char *q,buf2[12];
592
593 q=buf;
594 memcpy(q,str,slen);
595 q+=slen;
596
dbad1690 597 EVP_MD_CTX_init(&ctx);
20d2186c
DSH		 598 EVP_MD_CTX_copy_ex(&ctx,in1_ctx);
599 EVP_DigestFinal_ex(&ctx,q,&i);
58964a49 600 q+=i;
20d2186c
DSH		 601 EVP_MD_CTX_copy_ex(&ctx,in2_ctx);
602 EVP_DigestFinal_ex(&ctx,q,&i);
58964a49
RE		 603 q+=i;
604
dfeab068 605 tls1_PRF(s->ctx->md5,s->ctx->sha1,buf,(int)(q-buf),
58964a49
RE		 606 s->session->master_key,s->session->master_key_length,
607 out,buf2,12);
dbad1690 608 EVP_MD_CTX_cleanup(&ctx);
58964a49
RE		 609
610 return((int)12);
611 }
612
6b691a5c 613int tls1_mac(SSL *ssl, unsigned char *md, int send)
58964a49
RE		 614 {
615 SSL3_RECORD *rec;
616 unsigned char *mac_sec,*seq;
e778802f 617 const EVP_MD *hash;
58964a49
RE		 618 unsigned int md_size;
619 int i;
620 HMAC_CTX hmac;
621 unsigned char buf[5];
622
623 if (send)
624 {
625 rec= &(ssl->s3->wrec);
626 mac_sec= &(ssl->s3->write_mac_secret[0]);
627 seq= &(ssl->s3->write_sequence[0]);
628 hash=ssl->write_hash;
629 }
630 else
631 {
632 rec= &(ssl->s3->rrec);
633 mac_sec= &(ssl->s3->read_mac_secret[0]);
634 seq= &(ssl->s3->read_sequence[0]);
635 hash=ssl->read_hash;
636 }
637
638 md_size=EVP_MD_size(hash);
639
640 buf[0]=rec->type;
641 buf[1]=TLS1_VERSION_MAJOR;
642 buf[2]=TLS1_VERSION_MINOR;
643 buf[3]=rec->length>>8;
644 buf[4]=rec->length&0xff;
645
646 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
dbad1690 647 HMAC_CTX_init(&hmac);
58964a49
RE		 648 HMAC_Init(&hmac,mac_sec,EVP_MD_size(hash),hash);
649 HMAC_Update(&hmac,seq,8);
650 HMAC_Update(&hmac,buf,5);
651 HMAC_Update(&hmac,rec->input,rec->length);
652 HMAC_Final(&hmac,md,&md_size);
dbad1690 653 HMAC_CTX_cleanup(&hmac);
58964a49
RE		 654
655#ifdef TLS_DEBUG
656printf("sec=");
dfeab068 657{unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); }
58964a49
RE		 658printf("seq=");
659{int z; for (z=0; z<8; z++) printf("%02X ",seq[z]); printf("\n"); }
660printf("buf=");
661{int z; for (z=0; z<5; z++) printf("%02X ",buf[z]); printf("\n"); }
662printf("rec=");
dfeab068 663{unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
58964a49
RE		 664#endif
665
666 for (i=7; i>=0; i--)
1876cc32
BM		 667 {
668 ++seq[i];
669 if (seq[i] != 0) break;
670 }
58964a49
RE		 671
672#ifdef TLS_DEBUG
dfeab068 673{unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",md[z]); printf("\n"); }
58964a49
RE		 674#endif
675 return(md_size);
676 }
677
6b691a5c
UM		 678int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
679 int len)
58964a49
RE		 680 {
681 unsigned char buf[SSL3_RANDOM_SIZE*2+TLS_MD_MASTER_SECRET_CONST_SIZE];
682 unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH];
683
f9b3bff6
RL		 684#ifdef KSSL_DEBUG
685 printf ("tls1_generate_master_secret(%p,%p, %p, %d)\n", s,out, p,len);
686#endif /* KSSL_DEBUG */
687
58964a49
RE		 688 /* Setup the stuff to munge */
689 memcpy(buf,TLS_MD_MASTER_SECRET_CONST,
690 TLS_MD_MASTER_SECRET_CONST_SIZE);
691 memcpy(&(buf[TLS_MD_MASTER_SECRET_CONST_SIZE]),
692 s->s3->client_random,SSL3_RANDOM_SIZE);
693 memcpy(&(buf[SSL3_RANDOM_SIZE+TLS_MD_MASTER_SECRET_CONST_SIZE]),
694 s->s3->server_random,SSL3_RANDOM_SIZE);
695 tls1_PRF(s->ctx->md5,s->ctx->sha1,
696 buf,TLS_MD_MASTER_SECRET_CONST_SIZE+SSL3_RANDOM_SIZE*2,p,len,
697 s->session->master_key,buff,SSL3_MASTER_SECRET_SIZE);
f9b3bff6
RL		 698#ifdef KSSL_DEBUG
699 printf ("tls1_generate_master_secret() complete\n");
700#endif /* KSSL_DEBUG */
58964a49
RE		 701 return(SSL3_MASTER_SECRET_SIZE);
702 }
703
6b691a5c 704int tls1_alert_code(int code)
58964a49
RE		 705 {
706 switch (code)
707 {
708 case SSL_AD_CLOSE_NOTIFY: return(SSL3_AD_CLOSE_NOTIFY);
709 case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE);
710 case SSL_AD_BAD_RECORD_MAC: return(SSL3_AD_BAD_RECORD_MAC);
711 case SSL_AD_DECRYPTION_FAILED: return(TLS1_AD_DECRYPTION_FAILED);
712 case SSL_AD_RECORD_OVERFLOW: return(TLS1_AD_RECORD_OVERFLOW);
713 case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE);
714 case SSL_AD_HANDSHAKE_FAILURE: return(SSL3_AD_HANDSHAKE_FAILURE);
715 case SSL_AD_NO_CERTIFICATE: return(-1);
716 case SSL_AD_BAD_CERTIFICATE: return(SSL3_AD_BAD_CERTIFICATE);
717 case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE);
718 case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED);
719 case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED);
720 case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN);
721 case SSL_AD_ILLEGAL_PARAMETER: return(SSL3_AD_ILLEGAL_PARAMETER);
722 case SSL_AD_UNKNOWN_CA: return(TLS1_AD_UNKNOWN_CA);
723 case SSL_AD_ACCESS_DENIED: return(TLS1_AD_ACCESS_DENIED);
724 case SSL_AD_DECODE_ERROR: return(TLS1_AD_DECODE_ERROR);
725 case SSL_AD_DECRYPT_ERROR: return(TLS1_AD_DECRYPT_ERROR);
657e60fa 726 case SSL_AD_EXPORT_RESTRICTION: return(TLS1_AD_EXPORT_RESTRICTION);
58964a49
RE		 727 case SSL_AD_PROTOCOL_VERSION: return(TLS1_AD_PROTOCOL_VERSION);
728 case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY);
729 case SSL_AD_INTERNAL_ERROR: return(TLS1_AD_INTERNAL_ERROR);
657e60fa 730 case SSL_AD_USER_CANCELLED: return(TLS1_AD_USER_CANCELLED);
58964a49
RE		 731 case SSL_AD_NO_RENEGOTIATION: return(TLS1_AD_NO_RENEGOTIATION);
732 default: return(-1);
733 }
734 }
735
A mirror of the official openssl repository