]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/tls13_enc.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
coverity 1462566 Resource leak
[thirdparty/openssl.git] / ssl / tls13_enc.c
CommitLineData
34574f19 1/*
33388b44 2 * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
34574f19 3 *
2c18d164 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
34574f19
MC		 5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10#include <stdlib.h>
706457b7 11#include "ssl_local.h"
08717544 12#include "internal/cryptlib.h"
34574f19
MC		 13#include <openssl/evp.h>
14#include <openssl/kdf.h>
ce3b1bb4 15#include <openssl/core_names.h>
34574f19 16
0fb2815b 17#define TLS13_MAX_LABEL_LEN 249
34574f19
MC		 18
19/* Always filled with zeros */
20static const unsigned char default_zeros[EVP_MAX_MD_SIZE];
21
34574f19 22/*
a19ae67d
MC		 23 * Given a |secret|; a |label| of length |labellen|; and |data| of length
24 * |datalen| (e.g. typically a hash of the handshake messages), derive a new
25 * secret |outlen| bytes long and store it in the location pointed to be |out|.
0fb2815b
MC		 26 * The |data| value may be zero length. Any errors will be treated as fatal if
27 * |fatal| is set. Returns 1 on success 0 on failure.
34574f19 28 */
ec15acb6 29int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
34574f19 30 const unsigned char *label, size_t labellen,
a19ae67d 31 const unsigned char *data, size_t datalen,
0fb2815b 32 unsigned char *out, size_t outlen, int fatal)
34574f19 33{
48102247 34#ifdef CHARSET_EBCDIC
35 static const unsigned char label_prefix[] = { 0x74, 0x6C, 0x73, 0x31, 0x33, 0x20, 0x00 };
36#else
0fb2815b 37 static const unsigned char label_prefix[] = "tls13 ";
48102247 38#endif
c8f6c28a
MC		 39 EVP_KDF *kdf = EVP_KDF_fetch(s->ctx->libctx, OSSL_KDF_NAME_HKDF,
40 s->ctx->propq);
ce3b1bb4
P		 41 EVP_KDF_CTX *kctx;
42 OSSL_PARAM params[5], *p = params;
43 int mode = EVP_PKEY_HKDEF_MODE_EXPAND_ONLY;
44 const char *mdname = EVP_MD_name(md);
34574f19
MC		 45 int ret;
46 size_t hkdflabellen;
47 size_t hashlen;
48 /*
0fb2815b
MC		 49 * 2 bytes for length of derived secret + 1 byte for length of combined
50 * prefix and label + bytes for the label itself + 1 byte length of hash
51 * + bytes for the hash itself
34574f19 52 */
2de5a5fb 53 unsigned char hkdflabel[sizeof(uint16_t) + sizeof(uint8_t)
0b4233f5 54 + (sizeof(label_prefix) - 1) + TLS13_MAX_LABEL_LEN
0fb2815b 55 + 1 + EVP_MAX_MD_SIZE];
34574f19
MC		 56 WPACKET pkt;
57
ce3b1bb4
P		 58 kctx = EVP_KDF_CTX_new(kdf);
59 EVP_KDF_free(kdf);
32495464 60 if (kctx == NULL)
34574f19
MC		 61 return 0;
62
0fb2815b
MC		 63 if (labellen > TLS13_MAX_LABEL_LEN) {
64 if (fatal) {
65 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_HKDF_EXPAND,
66 ERR_R_INTERNAL_ERROR);
67 } else {
68 /*
69 * Probably we have been called from SSL_export_keying_material(),
70 * or SSL_export_keying_material_early().
71 */
72 SSLerr(SSL_F_TLS13_HKDF_EXPAND, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL);
73 }
32495464 74 EVP_KDF_CTX_free(kctx);
0fb2815b
MC		 75 return 0;
76 }
77
34574f19
MC		 78 hashlen = EVP_MD_size(md);
79
80 if (!WPACKET_init_static_len(&pkt, hkdflabel, sizeof(hkdflabel), 0)
81 || !WPACKET_put_bytes_u16(&pkt, outlen)
82 || !WPACKET_start_sub_packet_u8(&pkt)
83 || !WPACKET_memcpy(&pkt, label_prefix, sizeof(label_prefix) - 1)
84 || !WPACKET_memcpy(&pkt, label, labellen)
85 || !WPACKET_close(&pkt)
a19ae67d 86 || !WPACKET_sub_memcpy_u8(&pkt, data, (data == NULL) ? 0 : datalen)
34574f19
MC		 87 || !WPACKET_get_total_written(&pkt, &hkdflabellen)
88 || !WPACKET_finish(&pkt)) {
32495464 89 EVP_KDF_CTX_free(kctx);
34574f19 90 WPACKET_cleanup(&pkt);
0fb2815b
MC		 91 if (fatal)
92 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_HKDF_EXPAND,
93 ERR_R_INTERNAL_ERROR);
94 else
95 SSLerr(SSL_F_TLS13_HKDF_EXPAND, ERR_R_INTERNAL_ERROR);
34574f19
MC		 96 return 0;
97 }
98
ce3b1bb4
P		 99 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode);
100 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
8b6ffd40 101 (char *)mdname, 0);
ce3b1bb4
P		 102 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
103 (unsigned char *)secret, hashlen);
104 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
105 hkdflabel, hkdflabellen);
106 *p++ = OSSL_PARAM_construct_end();
107
108 ret = EVP_KDF_CTX_set_params(kctx, params) <= 0
32495464 109 || EVP_KDF_derive(kctx, out, outlen) <= 0;
34574f19 110
32495464 111 EVP_KDF_CTX_free(kctx);
34574f19 112
0fb2815b
MC		 113 if (ret != 0) {
114 if (fatal)
115 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_HKDF_EXPAND,
116 ERR_R_INTERNAL_ERROR);
117 else
118 SSLerr(SSL_F_TLS13_HKDF_EXPAND, ERR_R_INTERNAL_ERROR);
119 }
f63a17d6 120
34574f19
MC		 121 return ret == 0;
122}
123
34574f19 124/*
f5ca0b04
MC		 125 * Given a |secret| generate a |key| of length |keylen| bytes. Returns 1 on
126 * success 0 on failure.
34574f19 127 */
d49e23ec
MC		 128int tls13_derive_key(SSL *s, const EVP_MD *md, const unsigned char *secret,
129 unsigned char *key, size_t keylen)
34574f19 130{
48102247 131#ifdef CHARSET_EBCDIC
132 static const unsigned char keylabel[] ={ 0x6B, 0x65, 0x79, 0x00 };
133#else
134 static const unsigned char keylabel[] = "key";
135#endif
f5ca0b04 136
d49e23ec 137 return tls13_hkdf_expand(s, md, secret, keylabel, sizeof(keylabel) - 1,
0fb2815b 138 NULL, 0, key, keylen, 1);
34574f19
MC		 139}
140
141/*
f5ca0b04
MC		 142 * Given a |secret| generate an |iv| of length |ivlen| bytes. Returns 1 on
143 * success 0 on failure.
34574f19 144 */
d49e23ec
MC		 145int tls13_derive_iv(SSL *s, const EVP_MD *md, const unsigned char *secret,
146 unsigned char *iv, size_t ivlen)
34574f19 147{
48102247 148#ifdef CHARSET_EBCDIC
149 static const unsigned char ivlabel[] = { 0x69, 0x76, 0x00 };
150#else
151 static const unsigned char ivlabel[] = "iv";
152#endif
f5ca0b04 153
d49e23ec 154 return tls13_hkdf_expand(s, md, secret, ivlabel, sizeof(ivlabel) - 1,
0fb2815b 155 NULL, 0, iv, ivlen, 1);
34574f19
MC		 156}
157
ec15acb6
MC		 158int tls13_derive_finishedkey(SSL *s, const EVP_MD *md,
159 const unsigned char *secret,
160 unsigned char *fin, size_t finlen)
6484776f 161{
48102247 162#ifdef CHARSET_EBCDIC
163 static const unsigned char finishedlabel[] = { 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64, 0x00 };
164#else
165 static const unsigned char finishedlabel[] = "finished";
166#endif
f5ca0b04 167
ec15acb6 168 return tls13_hkdf_expand(s, md, secret, finishedlabel,
0fb2815b 169 sizeof(finishedlabel) - 1, NULL, 0, fin, finlen, 1);
6484776f
MC		 170}
171
34574f19
MC		 172/*
173 * Given the previous secret |prevsecret| and a new input secret |insecret| of
174 * length |insecretlen|, generate a new secret and store it in the location
f5ca0b04 175 * pointed to by |outsecret|. Returns 1 on success 0 on failure.
34574f19 176 */
ec15acb6
MC		 177int tls13_generate_secret(SSL *s, const EVP_MD *md,
178 const unsigned char *prevsecret,
179 const unsigned char *insecret,
180 size_t insecretlen,
181 unsigned char *outsecret)
34574f19 182{
34574f19 183 size_t mdlen, prevsecretlen;
bceae201 184 int mdleni;
34574f19 185 int ret;
ce3b1bb4
P		 186 EVP_KDF *kdf;
187 EVP_KDF_CTX *kctx;
188 OSSL_PARAM params[5], *p = params;
189 int mode = EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY;
190 const char *mdname = EVP_MD_name(md);
48102247 191#ifdef CHARSET_EBCDIC
192 static const char derived_secret_label[] = { 0x64, 0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x00 };
193#else
17aa119e 194 static const char derived_secret_label[] = "derived";
48102247 195#endif
3e0458fb 196 unsigned char preextractsec[EVP_MAX_MD_SIZE];
34574f19 197
c8f6c28a 198 kdf = EVP_KDF_fetch(s->ctx->libctx, OSSL_KDF_NAME_HKDF, s->ctx->propq);
ce3b1bb4
P		 199 kctx = EVP_KDF_CTX_new(kdf);
200 EVP_KDF_free(kdf);
32495464 201 if (kctx == NULL) {
f63a17d6
MC		 202 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_GENERATE_SECRET,
203 ERR_R_INTERNAL_ERROR);
34574f19 204 return 0;
f63a17d6 205 }
34574f19 206
bceae201
MC		 207 mdleni = EVP_MD_size(md);
208 /* Ensure cast to size_t is safe */
209 if (!ossl_assert(mdleni >= 0)) {
210 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_GENERATE_SECRET,
211 ERR_R_INTERNAL_ERROR);
ad14e8e5 212 EVP_KDF_CTX_free(kctx);
bceae201
MC		 213 return 0;
214 }
215 mdlen = (size_t)mdleni;
34574f19
MC		 216
217 if (insecret == NULL) {
218 insecret = default_zeros;
219 insecretlen = mdlen;
220 }
221 if (prevsecret == NULL) {
222 prevsecret = default_zeros;
223 prevsecretlen = 0;
224 } else {
3e0458fb
MC		 225 EVP_MD_CTX *mctx = EVP_MD_CTX_new();
226 unsigned char hash[EVP_MAX_MD_SIZE];
227
228 /* The pre-extract derive step uses a hash of no messages */
229 if (mctx == NULL
230 || EVP_DigestInit_ex(mctx, md, NULL) <= 0
231 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
f63a17d6
MC		 232 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_GENERATE_SECRET,
233 ERR_R_INTERNAL_ERROR);
3e0458fb 234 EVP_MD_CTX_free(mctx);
32495464 235 EVP_KDF_CTX_free(kctx);
3e0458fb
MC		 236 return 0;
237 }
238 EVP_MD_CTX_free(mctx);
239
240 /* Generate the pre-extract secret */
241 if (!tls13_hkdf_expand(s, md, prevsecret,
242 (unsigned char *)derived_secret_label,
a19ae67d 243 sizeof(derived_secret_label) - 1, hash, mdlen,
0fb2815b 244 preextractsec, mdlen, 1)) {
f63a17d6 245 /* SSLfatal() already called */
32495464 246 EVP_KDF_CTX_free(kctx);
3e0458fb 247 return 0;
71d8c138 248 }
3e0458fb
MC		 249
250 prevsecret = preextractsec;
34574f19
MC		 251 prevsecretlen = mdlen;
252 }
253
ce3b1bb4
P		 254 *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode);
255 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
8b6ffd40 256 (char *)mdname, 0);
ce3b1bb4
P		 257 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
258 (unsigned char *)insecret,
259 insecretlen);
260 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
261 (unsigned char *)prevsecret,
262 prevsecretlen);
263 *p++ = OSSL_PARAM_construct_end();
264
265 ret = EVP_KDF_CTX_set_params(kctx, params) <= 0
32495464 266 || EVP_KDF_derive(kctx, outsecret, mdlen) <= 0;
34574f19 267
f63a17d6
MC		 268 if (ret != 0)
269 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_GENERATE_SECRET,
270 ERR_R_INTERNAL_ERROR);
271
32495464 272 EVP_KDF_CTX_free(kctx);
3e0458fb
MC		 273 if (prevsecret == preextractsec)
274 OPENSSL_cleanse(preextractsec, mdlen);
34574f19
MC		 275 return ret == 0;
276}
277
34574f19
MC		 278/*
279 * Given an input secret |insecret| of length |insecretlen| generate the
280 * handshake secret. This requires the early secret to already have been
f5ca0b04 281 * generated. Returns 1 on success 0 on failure.
34574f19
MC		 282 */
283int tls13_generate_handshake_secret(SSL *s, const unsigned char *insecret,
284 size_t insecretlen)
285{
f63a17d6 286 /* Calls SSLfatal() if required */
ec15acb6
MC		 287 return tls13_generate_secret(s, ssl_handshake_md(s), s->early_secret,
288 insecret, insecretlen,
34574f19
MC		 289 (unsigned char *)&s->handshake_secret);
290}
291
292/*
293 * Given the handshake secret |prev| of length |prevlen| generate the master
f5ca0b04
MC		 294 * secret and store its length in |*secret_size|. Returns 1 on success 0 on
295 * failure.
34574f19
MC		 296 */
297int tls13_generate_master_secret(SSL *s, unsigned char *out,
298 unsigned char *prev, size_t prevlen,
299 size_t *secret_size)
300{
ec15acb6
MC		 301 const EVP_MD *md = ssl_handshake_md(s);
302
303 *secret_size = EVP_MD_size(md);
f63a17d6 304 /* Calls SSLfatal() if required */
ec15acb6 305 return tls13_generate_secret(s, md, prev, NULL, 0, out);
34574f19
MC		 306}
307
92760c21 308/*
f5ca0b04
MC		 309 * Generates the mac for the Finished message. Returns the length of the MAC or
310 * 0 on error.
92760c21
MC		 311 */
312size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
313 unsigned char *out)
314{
c8f6c28a
MC		 315 const char *mdname = EVP_MD_name(ssl_handshake_md(s));
316 EVP_MAC *hmac = EVP_MAC_fetch(s->ctx->libctx, "HMAC", s->ctx->propq);
6484776f 317 unsigned char hash[EVP_MAX_MD_SIZE];
c8f6c28a 318 unsigned char finsecret[EVP_MAX_MD_SIZE];
6484776f 319 size_t hashlen, ret = 0;
c8f6c28a
MC		 320 EVP_MAC_CTX *ctx = NULL;
321 OSSL_PARAM params[4], *p = params;
322
323 if (hmac == NULL) {
324 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_FINAL_FINISH_MAC,
325 ERR_R_INTERNAL_ERROR);
326 goto err;
327 }
328
329 /* Safe to cast away const here since we're not "getting" any data */
330 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
331 (char *)mdname, 0);
332 if (s->ctx->propq != NULL)
333 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_PROPERTIES,
334 (char *)s->ctx->propq,
335 0);
92760c21 336
d4d2f3a4
MC		 337 if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) {
338 /* SSLfatal() already called */
6484776f 339 goto err;
d4d2f3a4 340 }
6484776f 341
de9f5b35 342 if (str == s->method->ssl3_enc->server_finished_label) {
c8f6c28a
MC		 343 *p++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
344 s->server_finished_secret,
345 hashlen);
de9f5b35 346 } else if (SSL_IS_FIRST_HANDSHAKE(s)) {
c8f6c28a
MC		 347 *p++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
348 s->client_finished_secret,
349 hashlen);
de9f5b35 350 } else {
de9f5b35
MC		 351 if (!tls13_derive_finishedkey(s, ssl_handshake_md(s),
352 s->client_app_traffic_secret,
353 finsecret, hashlen))
354 goto err;
355
c8f6c28a
MC		 356 *p++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, finsecret,
357 hashlen);
de9f5b35 358 }
c8f6c28a 359 *p++ = OSSL_PARAM_construct_end();
6484776f 360
c8f6c28a
MC		 361 ctx = EVP_MAC_CTX_new(hmac);
362 if (ctx == NULL
363 || !EVP_MAC_CTX_set_params(ctx, params)
364 || !EVP_MAC_init(ctx)
365 || !EVP_MAC_update(ctx, hash, hashlen)
366 /* outsize as per sizeof(peer_finish_md) */
367 || !EVP_MAC_final(ctx, out, &hashlen, EVP_MAX_MD_SIZE * 2)) {
d4d2f3a4
MC		 368 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_FINAL_FINISH_MAC,
369 ERR_R_INTERNAL_ERROR);
6484776f 370 goto err;
d4d2f3a4 371 }
92760c21 372
6484776f
MC		 373 ret = hashlen;
374 err:
c8f6c28a
MC		 375 OPENSSL_cleanse(finsecret, sizeof(finsecret));
376 EVP_MAC_CTX_free(ctx);
377 EVP_MAC_free(hmac);
6484776f 378 return ret;
92760c21
MC		 379}
380
381/*
382 * There isn't really a key block in TLSv1.3, but we still need this function
f5ca0b04 383 * for initialising the cipher and hash. Returns 1 on success or 0 on failure.
92760c21
MC		 384 */
385int tls13_setup_key_block(SSL *s)
386{
387 const EVP_CIPHER *c;
388 const EVP_MD *hash;
92760c21 389
555cbb32 390 s->session->cipher = s->s3.tmp.new_cipher;
c8f6c28a
MC		 391 if (!ssl_cipher_get_evp(s->ctx, s->session, &c, &hash, NULL, NULL, NULL,
392 0)) {
f63a17d6
MC		 393 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_SETUP_KEY_BLOCK,
394 SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
92760c21
MC		 395 return 0;
396 }
397
c8f6c28a 398 ssl_evp_cipher_free(s->s3.tmp.new_sym_enc);
555cbb32 399 s->s3.tmp.new_sym_enc = c;
c8f6c28a 400 ssl_evp_md_free(s->s3.tmp.new_hash);
555cbb32 401 s->s3.tmp.new_hash = hash;
92760c21
MC		 402
403 return 1;
404}
405
d1186c30 406static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
d49e23ec 407 const EVP_CIPHER *ciph,
57389a32
MC		 408 const unsigned char *insecret,
409 const unsigned char *hash,
410 const unsigned char *label,
411 size_t labellen, unsigned char *secret,
412 unsigned char *iv, EVP_CIPHER_CTX *ciph_ctx)
413{
414 unsigned char key[EVP_MAX_KEY_LENGTH];
415 size_t ivlen, keylen, taglen;
bceae201
MC		 416 int hashleni = EVP_MD_size(md);
417 size_t hashlen;
418
419 /* Ensure cast to size_t is safe */
420 if (!ossl_assert(hashleni >= 0)) {
421 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
422 ERR_R_EVP_LIB);
423 goto err;
424 }
425 hashlen = (size_t)hashleni;
57389a32 426
a19ae67d 427 if (!tls13_hkdf_expand(s, md, insecret, label, labellen, hash, hashlen,
0fb2815b 428 secret, hashlen, 1)) {
f63a17d6 429 /* SSLfatal() already called */
57389a32
MC		 430 goto err;
431 }
432
433 /* TODO(size_t): convert me */
434 keylen = EVP_CIPHER_key_length(ciph);
435 if (EVP_CIPHER_mode(ciph) == EVP_CIPH_CCM_MODE) {
c117af67
MC		 436 uint32_t algenc;
437
57389a32 438 ivlen = EVP_CCM_TLS_IV_LEN;
555cbb32 439 if (s->s3.tmp.new_cipher == NULL) {
c117af67
MC		 440 /* We've not selected a cipher yet - we must be doing early data */
441 algenc = s->session->cipher->algorithm_enc;
442 } else {
555cbb32 443 algenc = s->s3.tmp.new_cipher->algorithm_enc;
c117af67
MC		 444 }
445 if (algenc & (SSL_AES128CCM8 | SSL_AES256CCM8))
57389a32
MC		 446 taglen = EVP_CCM8_TLS_TAG_LEN;
447 else
448 taglen = EVP_CCM_TLS_TAG_LEN;
449 } else {
450 ivlen = EVP_CIPHER_iv_length(ciph);
451 taglen = 0;
452 }
453
d49e23ec
MC		 454 if (!tls13_derive_key(s, md, secret, key, keylen)
455 || !tls13_derive_iv(s, md, secret, iv, ivlen)) {
f63a17d6 456 /* SSLfatal() already called */
57389a32
MC		 457 goto err;
458 }
459
d1186c30 460 if (EVP_CipherInit_ex(ciph_ctx, ciph, NULL, NULL, NULL, sending) <= 0
57389a32
MC		 461 || !EVP_CIPHER_CTX_ctrl(ciph_ctx, EVP_CTRL_AEAD_SET_IVLEN, ivlen, NULL)
462 || (taglen != 0 && !EVP_CIPHER_CTX_ctrl(ciph_ctx, EVP_CTRL_AEAD_SET_TAG,
463 taglen, NULL))
464 || EVP_CipherInit_ex(ciph_ctx, NULL, NULL, key, NULL, -1) <= 0) {
f63a17d6
MC		 465 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
466 ERR_R_EVP_LIB);
57389a32
MC		 467 goto err;
468 }
469
57389a32
MC		 470 return 1;
471 err:
472 OPENSSL_cleanse(key, sizeof(key));
473 return 0;
474}
475
0d9824c1
MC		 476int tls13_change_cipher_state(SSL *s, int which)
477{
48102247 478#ifdef CHARSET_EBCDIC
479 static const unsigned char client_early_traffic[] = {0x63, 0x20, 0x65, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
480 static const unsigned char client_handshake_traffic[] = {0x63, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
481 static const unsigned char client_application_traffic[] = {0x63, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
482 static const unsigned char server_handshake_traffic[] = {0x73, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
483 static const unsigned char server_application_traffic[] = {0x73, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
484 static const unsigned char exporter_master_secret[] = {0x65, 0x78, 0x70, 0x20, /* master*/ 0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
485 static const unsigned char resumption_master_secret[] = {0x72, 0x65, 0x73, 0x20, /* master*/ 0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
486 static const unsigned char early_exporter_master_secret[] = {0x65, 0x20, 0x65, 0x78, 0x70, 0x20, /* master*/ 0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
487#else
17aa119e
MC		 488 static const unsigned char client_early_traffic[] = "c e traffic";
489 static const unsigned char client_handshake_traffic[] = "c hs traffic";
490 static const unsigned char client_application_traffic[] = "c ap traffic";
491 static const unsigned char server_handshake_traffic[] = "s hs traffic";
492 static const unsigned char server_application_traffic[] = "s ap traffic";
0ca8d1ec 493 static const unsigned char exporter_master_secret[] = "exp master";
17aa119e 494 static const unsigned char resumption_master_secret[] = "res master";
b38ede80 495 static const unsigned char early_exporter_master_secret[] = "e exp master";
48102247 496#endif
bebc0c7d 497 unsigned char *iv;
0d9824c1 498 unsigned char secret[EVP_MAX_MD_SIZE];
ace081c1
MC		 499 unsigned char hashval[EVP_MAX_MD_SIZE];
500 unsigned char *hash = hashval;
0d9824c1 501 unsigned char *insecret;
6484776f 502 unsigned char *finsecret = NULL;
2c7bd692 503 const char *log_label = NULL;
0d9824c1 504 EVP_CIPHER_CTX *ciph_ctx;
57389a32 505 size_t finsecretlen = 0;
0d9824c1 506 const unsigned char *label;
ace081c1 507 size_t labellen, hashlen = 0;
6530c490 508 int ret = 0;
42f50fdf
MC		 509 const EVP_MD *md = NULL;
510 const EVP_CIPHER *cipher = NULL;
0d9824c1
MC		 511
512 if (which & SSL3_CC_READ) {
513 if (s->enc_read_ctx != NULL) {
514 EVP_CIPHER_CTX_reset(s->enc_read_ctx);
515 } else {
516 s->enc_read_ctx = EVP_CIPHER_CTX_new();
517 if (s->enc_read_ctx == NULL) {
f63a17d6
MC		 518 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
519 SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
0d9824c1
MC		 520 goto err;
521 }
522 }
523 ciph_ctx = s->enc_read_ctx;
bebc0c7d 524 iv = s->read_iv;
0d9824c1
MC		 525
526 RECORD_LAYER_reset_read_sequence(&s->rlayer);
527 } else {
7426cd34 528 s->statem.enc_write_state = ENC_WRITE_STATE_INVALID;
0d9824c1
MC		 529 if (s->enc_write_ctx != NULL) {
530 EVP_CIPHER_CTX_reset(s->enc_write_ctx);
531 } else {
532 s->enc_write_ctx = EVP_CIPHER_CTX_new();
533 if (s->enc_write_ctx == NULL) {
f63a17d6
MC		 534 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
535 SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
0d9824c1
MC		 536 goto err;
537 }
538 }
539 ciph_ctx = s->enc_write_ctx;
bebc0c7d 540 iv = s->write_iv;
0d9824c1
MC		 541
542 RECORD_LAYER_reset_write_sequence(&s->rlayer);
543 }
544
545 if (((which & SSL3_CC_CLIENT) && (which & SSL3_CC_WRITE))
546 || ((which & SSL3_CC_SERVER) && (which & SSL3_CC_READ))) {
d49e23ec
MC		 547 if (which & SSL3_CC_EARLY) {
548 EVP_MD_CTX *mdctx = NULL;
549 long handlen;
550 void *hdata;
551 unsigned int hashlenui;
552 const SSL_CIPHER *sslcipher = SSL_SESSION_get0_cipher(s->session);
553
554 insecret = s->early_secret;
555 label = client_early_traffic;
556 labellen = sizeof(client_early_traffic) - 1;
557 log_label = CLIENT_EARLY_LABEL;
558
555cbb32 559 handlen = BIO_get_mem_data(s->s3.handshake_buffer, &hdata);
d49e23ec 560 if (handlen <= 0) {
f63a17d6
MC		 561 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
562 SSL_F_TLS13_CHANGE_CIPHER_STATE,
563 SSL_R_BAD_HANDSHAKE_LENGTH);
d49e23ec
MC		 564 goto err;
565 }
add8d0e9 566
08717544
MC		 567 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
568 && s->max_early_data > 0
569 && s->session->ext.max_early_data == 0) {
570 /*
571 * If we are attempting to send early data, and we've decided to
572 * actually do it but max_early_data in s->session is 0 then we
573 * must be using an external PSK.
574 */
575 if (!ossl_assert(s->psksession != NULL
576 && s->max_early_data ==
577 s->psksession->ext.max_early_data)) {
f63a17d6
MC		 578 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
579 SSL_F_TLS13_CHANGE_CIPHER_STATE,
580 ERR_R_INTERNAL_ERROR);
08717544
MC		 581 goto err;
582 }
add8d0e9 583 sslcipher = SSL_SESSION_get0_cipher(s->psksession);
08717544 584 }
d49e23ec 585 if (sslcipher == NULL) {
f63a17d6
MC		 586 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
587 SSL_F_TLS13_CHANGE_CIPHER_STATE, SSL_R_BAD_PSK);
d49e23ec
MC		 588 goto err;
589 }
590
591 /*
592 * We need to calculate the handshake digest using the digest from
593 * the session. We haven't yet selected our ciphersuite so we can't
594 * use ssl_handshake_md().
595 */
596 mdctx = EVP_MD_CTX_new();
597 if (mdctx == NULL) {
f63a17d6
MC		 598 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
599 SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
d49e23ec
MC		 600 goto err;
601 }
9727f4e7
MC		 602
603 /*
604 * This ups the ref count on cipher so we better make sure we free
605 * it again
606 */
607 if (!ssl_cipher_get_evp_cipher(s->ctx, sslcipher, &cipher)) {
608 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
609 SSL_F_TLS13_CHANGE_CIPHER_STATE,
610 SSL_R_ALGORITHM_FETCH_FAILED);
611 goto err;
612 }
613
c8f6c28a 614 md = ssl_md(s->ctx, sslcipher->algorithm2);
d49e23ec
MC		 615 if (md == NULL || !EVP_DigestInit_ex(mdctx, md, NULL)
616 || !EVP_DigestUpdate(mdctx, hdata, handlen)
617 || !EVP_DigestFinal_ex(mdctx, hashval, &hashlenui)) {
f63a17d6
MC		 618 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
619 SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
d49e23ec
MC		 620 EVP_MD_CTX_free(mdctx);
621 goto err;
622 }
623 hashlen = hashlenui;
624 EVP_MD_CTX_free(mdctx);
b38ede80
TT		 625
626 if (!tls13_hkdf_expand(s, md, insecret,
627 early_exporter_master_secret,
628 sizeof(early_exporter_master_secret) - 1,
629 hashval, hashlen,
0fb2815b
MC		 630 s->early_exporter_master_secret, hashlen,
631 1)) {
b38ede80
TT		 632 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
633 SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
634 goto err;
635 }
01a2a654
PW		 636
637 if (!ssl_log_secret(s, EARLY_EXPORTER_SECRET_LABEL,
638 s->early_exporter_master_secret, hashlen)) {
639 /* SSLfatal() already called */
640 goto err;
641 }
d49e23ec 642 } else if (which & SSL3_CC_HANDSHAKE) {
0d9824c1 643 insecret = s->handshake_secret;
6484776f 644 finsecret = s->client_finished_secret;
6612d87b 645 finsecretlen = EVP_MD_size(ssl_handshake_md(s));
0d9824c1
MC		 646 label = client_handshake_traffic;
647 labellen = sizeof(client_handshake_traffic) - 1;
2c7bd692 648 log_label = CLIENT_HANDSHAKE_LABEL;
fe5e20fd 649 /*
69687aa8 650 * The handshake hash used for the server read/client write handshake
f7e393be
MC		 651 * traffic secret is the same as the hash for the server
652 * write/client read handshake traffic secret. However, if we
653 * processed early data then we delay changing the server
654 * read/client write cipher state until later, and the handshake
655 * hashes have moved on. Therefore we use the value saved earlier
656 * when we did the server write/client read change cipher state.
fe5e20fd 657 */
f7e393be 658 hash = s->handshake_traffic_hash;
0d9824c1 659 } else {
ec15acb6 660 insecret = s->master_secret;
0d9824c1
MC		 661 label = client_application_traffic;
662 labellen = sizeof(client_application_traffic) - 1;
2c7bd692 663 log_label = CLIENT_APPLICATION_LABEL;
ace081c1
MC		 664 /*
665 * For this we only use the handshake hashes up until the server
666 * Finished hash. We do not include the client's Finished, which is
667 * what ssl_handshake_hash() would give us. Instead we use the
668 * previously saved value.
669 */
670 hash = s->server_finished_hash;
0d9824c1
MC		 671 }
672 } else {
d49e23ec 673 /* Early data never applies to client-read/server-write */
0d9824c1
MC		 674 if (which & SSL3_CC_HANDSHAKE) {
675 insecret = s->handshake_secret;
6484776f 676 finsecret = s->server_finished_secret;
6612d87b 677 finsecretlen = EVP_MD_size(ssl_handshake_md(s));
0d9824c1
MC		 678 label = server_handshake_traffic;
679 labellen = sizeof(server_handshake_traffic) - 1;
2c7bd692 680 log_label = SERVER_HANDSHAKE_LABEL;
0d9824c1 681 } else {
ec15acb6 682 insecret = s->master_secret;
0d9824c1
MC		 683 label = server_application_traffic;
684 labellen = sizeof(server_application_traffic) - 1;
2c7bd692 685 log_label = SERVER_APPLICATION_LABEL;
0d9824c1
MC		 686 }
687 }
688
d49e23ec
MC		 689 if (!(which & SSL3_CC_EARLY)) {
690 md = ssl_handshake_md(s);
555cbb32 691 cipher = s->s3.tmp.new_sym_enc;
d49e23ec
MC		 692 if (!ssl3_digest_cached_records(s, 1)
693 || !ssl_handshake_hash(s, hashval, sizeof(hashval), &hashlen)) {
f63a17d6 694 /* SSLfatal() already called */;
d49e23ec
MC		 695 goto err;
696 }
ace081c1
MC		 697 }
698
ec15acb6
MC		 699 /*
700 * Save the hash of handshakes up to now for use when we calculate the
701 * client application traffic secret
702 */
703 if (label == server_application_traffic)
704 memcpy(s->server_finished_hash, hashval, hashlen);
705
f7e393be 706 if (label == server_handshake_traffic)
fe5e20fd
MC		 707 memcpy(s->handshake_traffic_hash, hashval, hashlen);
708
ec15acb6
MC		 709 if (label == client_application_traffic) {
710 /*
711 * We also create the resumption master secret, but this time use the
712 * hash for the whole handshake including the Client Finished
713 */
714 if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
715 resumption_master_secret,
716 sizeof(resumption_master_secret) - 1,
4ff1a526 717 hashval, hashlen, s->resumption_master_secret,
0fb2815b 718 hashlen, 1)) {
f63a17d6 719 /* SSLfatal() already called */
ec15acb6
MC		 720 goto err;
721 }
ec15acb6
MC		 722 }
723
d49e23ec
MC		 724 if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
725 insecret, hash, label, labellen, secret, iv,
726 ciph_ctx)) {
f63a17d6 727 /* SSLfatal() already called */
57389a32 728 goto err;
ec07b1d8 729 }
0d9824c1 730
2221ec10 731 if (label == server_application_traffic) {
57389a32 732 memcpy(s->server_app_traffic_secret, secret, hashlen);
2221ec10
TT		 733 /* Now we create the exporter master secret */
734 if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
735 exporter_master_secret,
736 sizeof(exporter_master_secret) - 1,
737 hash, hashlen, s->exporter_master_secret,
0fb2815b 738 hashlen, 1)) {
2221ec10
TT		 739 /* SSLfatal() already called */
740 goto err;
741 }
6329ce8f
PW		 742
743 if (!ssl_log_secret(s, EXPORTER_SECRET_LABEL, s->exporter_master_secret,
744 hashlen)) {
745 /* SSLfatal() already called */
746 goto err;
747 }
2221ec10 748 } else if (label == client_application_traffic)
57389a32
MC		 749 memcpy(s->client_app_traffic_secret, secret, hashlen);
750
2c7bd692 751 if (!ssl_log_secret(s, log_label, secret, hashlen)) {
f63a17d6 752 /* SSLfatal() already called */
2c7bd692
CB		 753 goto err;
754 }
755
57389a32
MC		 756 if (finsecret != NULL
757 && !tls13_derive_finishedkey(s, ssl_handshake_md(s), secret,
758 finsecret, finsecretlen)) {
f63a17d6 759 /* SSLfatal() already called */
0d9824c1
MC		 760 goto err;
761 }
762
7426cd34
MC		 763 if (!s->server && label == client_early_traffic)
764 s->statem.enc_write_state = ENC_WRITE_STATE_WRITE_PLAIN_ALERTS;
765 else
766 s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
57389a32
MC		 767 ret = 1;
768 err:
9727f4e7
MC		 769 if ((which & SSL3_CC_EARLY) != 0) {
770 /* We up-refed this so now we need to down ref */
771 ssl_evp_cipher_free(cipher);
772 }
57389a32
MC		 773 OPENSSL_cleanse(secret, sizeof(secret));
774 return ret;
775}
0d9824c1 776
d1186c30 777int tls13_update_key(SSL *s, int sending)
57389a32 778{
48102247 779#ifdef CHARSET_EBCDIC
780 static const unsigned char application_traffic[] = { 0x74, 0x72 ,0x61 ,0x66 ,0x66 ,0x69 ,0x63 ,0x20 ,0x75 ,0x70 ,0x64, 0x00};
781#else
782 static const unsigned char application_traffic[] = "traffic upd";
783#endif
57389a32
MC		 784 const EVP_MD *md = ssl_handshake_md(s);
785 size_t hashlen = EVP_MD_size(md);
786 unsigned char *insecret, *iv;
787 unsigned char secret[EVP_MAX_MD_SIZE];
788 EVP_CIPHER_CTX *ciph_ctx;
789 int ret = 0;
0d9824c1 790
d1186c30 791 if (s->server == sending)
57389a32
MC		 792 insecret = s->server_app_traffic_secret;
793 else
794 insecret = s->client_app_traffic_secret;
bebc0c7d 795
d1186c30 796 if (sending) {
7426cd34 797 s->statem.enc_write_state = ENC_WRITE_STATE_INVALID;
57389a32
MC		 798 iv = s->write_iv;
799 ciph_ctx = s->enc_write_ctx;
800 RECORD_LAYER_reset_write_sequence(&s->rlayer);
801 } else {
802 iv = s->read_iv;
803 ciph_ctx = s->enc_read_ctx;
804 RECORD_LAYER_reset_read_sequence(&s->rlayer);
0d9824c1 805 }
57389a32 806
d1186c30 807 if (!derive_secret_key_and_iv(s, sending, ssl_handshake_md(s),
555cbb32 808 s->s3.tmp.new_sym_enc, insecret, NULL,
d49e23ec 809 application_traffic,
57389a32 810 sizeof(application_traffic) - 1, secret, iv,
f63a17d6
MC		 811 ciph_ctx)) {
812 /* SSLfatal() already called */
57389a32 813 goto err;
f63a17d6 814 }
57389a32
MC		 815
816 memcpy(insecret, secret, hashlen);
0d9824c1 817
7426cd34 818 s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
6530c490 819 ret = 1;
0d9824c1
MC		 820 err:
821 OPENSSL_cleanse(secret, sizeof(secret));
6530c490 822 return ret;
0d9824c1 823}
04904312
MC		 824
825int tls13_alert_code(int code)
826{
43a0f273
MC		 827 /* There are 2 additional alerts in TLSv1.3 compared to TLSv1.2 */
828 if (code == SSL_AD_MISSING_EXTENSION || code == SSL_AD_CERTIFICATE_REQUIRED)
04904312
MC		 829 return code;
830
831 return tls1_alert_code(code);
832}
0ca8d1ec
MC		 833
834int tls13_export_keying_material(SSL *s, unsigned char *out, size_t olen,
835 const char *label, size_t llen,
836 const unsigned char *context,
837 size_t contextlen, int use_context)
838{
839 unsigned char exportsecret[EVP_MAX_MD_SIZE];
48102247 840#ifdef CHARSET_EBCDIC
841 static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00};
842#else
0ca8d1ec 843 static const unsigned char exporterlabel[] = "exporter";
48102247 844#endif
c8b93876 845 unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
0ca8d1ec
MC		 846 const EVP_MD *md = ssl_handshake_md(s);
847 EVP_MD_CTX *ctx = EVP_MD_CTX_new();
c8b93876 848 unsigned int hashsize, datalen;
0ca8d1ec
MC		 849 int ret = 0;
850
1f5878b8 851 if (ctx == NULL || !ossl_statem_export_allowed(s))
0ca8d1ec
MC		 852 goto err;
853
854 if (!use_context)
855 contextlen = 0;
856
857 if (EVP_DigestInit_ex(ctx, md, NULL) <= 0
858 || EVP_DigestUpdate(ctx, context, contextlen) <= 0
859 || EVP_DigestFinal_ex(ctx, hash, &hashsize) <= 0
c8b93876
TT		 860 || EVP_DigestInit_ex(ctx, md, NULL) <= 0
861 || EVP_DigestFinal_ex(ctx, data, &datalen) <= 0
0ca8d1ec 862 || !tls13_hkdf_expand(s, md, s->exporter_master_secret,
c8b93876 863 (const unsigned char *)label, llen,
0fb2815b 864 data, datalen, exportsecret, hashsize, 0)
0ca8d1ec 865 || !tls13_hkdf_expand(s, md, exportsecret, exporterlabel,
a19ae67d 866 sizeof(exporterlabel) - 1, hash, hashsize,
0fb2815b 867 out, olen, 0))
0ca8d1ec
MC		 868 goto err;
869
870 ret = 1;
871 err:
872 EVP_MD_CTX_free(ctx);
873 return ret;
874}
b38ede80
TT		 875
876int tls13_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
877 const char *label, size_t llen,
878 const unsigned char *context,
879 size_t contextlen)
880{
48102247 881#ifdef CHARSET_EBCDIC
882 static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00};
883#else
884 static const unsigned char exporterlabel[] = "exporter";
885#endif
b38ede80
TT		 886 unsigned char exportsecret[EVP_MAX_MD_SIZE];
887 unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
888 const EVP_MD *md;
889 EVP_MD_CTX *ctx = EVP_MD_CTX_new();
890 unsigned int hashsize, datalen;
891 int ret = 0;
892 const SSL_CIPHER *sslcipher;
893
894 if (ctx == NULL || !ossl_statem_export_early_allowed(s))
895 goto err;
896
897 if (!s->server && s->max_early_data > 0
898 && s->session->ext.max_early_data == 0)
899 sslcipher = SSL_SESSION_get0_cipher(s->psksession);
900 else
901 sslcipher = SSL_SESSION_get0_cipher(s->session);
902
c8f6c28a 903 md = ssl_md(s->ctx, sslcipher->algorithm2);
b38ede80
TT		 904
905 /*
906 * Calculate the hash value and store it in |data|. The reason why
907 * the empty string is used is that the definition of TLS-Exporter
908 * is like so:
909 *
910 * TLS-Exporter(label, context_value, key_length) =
911 * HKDF-Expand-Label(Derive-Secret(Secret, label, ""),
912 * "exporter", Hash(context_value), key_length)
913 *
914 * Derive-Secret(Secret, Label, Messages) =
915 * HKDF-Expand-Label(Secret, Label,
916 * Transcript-Hash(Messages), Hash.length)
917 *
918 * Here Transcript-Hash is the cipher suite hash algorithm.
919 */
920 if (EVP_DigestInit_ex(ctx, md, NULL) <= 0
921 || EVP_DigestUpdate(ctx, context, contextlen) <= 0
922 || EVP_DigestFinal_ex(ctx, hash, &hashsize) <= 0
923 || EVP_DigestInit_ex(ctx, md, NULL) <= 0
924 || EVP_DigestFinal_ex(ctx, data, &datalen) <= 0
925 || !tls13_hkdf_expand(s, md, s->early_exporter_master_secret,
926 (const unsigned char *)label, llen,
0fb2815b 927 data, datalen, exportsecret, hashsize, 0)
b38ede80
TT		 928 || !tls13_hkdf_expand(s, md, exportsecret, exporterlabel,
929 sizeof(exporterlabel) - 1, hash, hashsize,
0fb2815b 930 out, olen, 0))
b38ede80
TT		 931 goto err;
932
933 ret = 1;
934 err:
935 EVP_MD_CTX_free(ctx);
936 return ret;
937}
A mirror of the official openssl repository