src/ssl/bio.cc

   1 /*
   2  * Copyright (C) 1996-2015 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 83    SSL accelerator support */
  10
  11 #include "squid.h"
  12 #include "ssl/support.h"
  13
  14 /* support.cc says this is needed */
  15 #if USE_OPENSSL
  16
  17 #include "comm.h"
  18 #include "fde.h"
  19 #include "globals.h"
  20 #include "ip/Address.h"
  21 #include "ssl/bio.h"
  22
  23 #if HAVE_OPENSSL_SSL_H
  24 #include <openssl/ssl.h>
  25 #endif
  26
  27 #if _SQUID_WINDOWS_
  28 extern int socket_read_method(int, char *, int);
  29 extern int socket_write_method(int, const char *, int);
  30 #endif
  31
  32 /* BIO callbacks */
  33 static int squid_bio_write(BIO *h, const char *buf, int num);
  34 static int squid_bio_read(BIO *h, char *buf, int size);
  35 static int squid_bio_puts(BIO *h, const char *str);
  36 //static int squid_bio_gets(BIO *h, char *str, int size);
  37 static long squid_bio_ctrl(BIO *h, int cmd, long arg1, void *arg2);
  38 static int squid_bio_create(BIO *h);
  39 static int squid_bio_destroy(BIO *data);
  40 /* SSL callbacks */
  41 static void squid_ssl_info(const SSL *ssl, int where, int ret);
  42
  43 /// Initialization structure for the BIO table with
  44 /// Squid-specific methods and BIO method wrappers.
  45 static BIO_METHOD SquidMethods = {
  46     BIO_TYPE_SOCKET,
  47     "squid",
  48     squid_bio_write,
  49     squid_bio_read,
  50     squid_bio_puts,
  51     NULL, // squid_bio_gets not supported
  52     squid_bio_ctrl,
  53     squid_bio_create,
  54     squid_bio_destroy,
  55     NULL // squid_callback_ctrl not supported
  56 };
  57
  58 BIO *
  59 Ssl::Bio::Create(const int fd, Ssl::Bio::Type type)
  60 {
  61     if (BIO *bio = BIO_new(&SquidMethods)) {
  62         BIO_int_ctrl(bio, BIO_C_SET_FD, type, fd);
  63         return bio;
  64     }
  65     return NULL;
  66 }
  67
  68 void
  69 Ssl::Bio::Link(SSL *ssl, BIO *bio)
  70 {
  71     SSL_set_bio(ssl, bio, bio); // cannot fail
  72     SSL_set_info_callback(ssl, &squid_ssl_info); // does not provide diagnostic
  73 }
  74
  75 Ssl::Bio::Bio(const int anFd): fd_(anFd)
  76 {
  77     debugs(83, 7, "Bio constructed, this=" << this << " FD " << fd_);
  78 }
  79
  80 Ssl::Bio::~Bio()
  81 {
  82     debugs(83, 7, "Bio destructing, this=" << this << " FD " << fd_);
  83 }
  84
  85 int Ssl::Bio::write(const char *buf, int size, BIO *table)
  86 {
  87     errno = 0;
  88 #if _SQUID_WINDOWS_
  89     const int result = socket_write_method(fd_, buf, size);
  90 #else
  91     const int result = default_write_method(fd_, buf, size);
  92 #endif
  93     const int xerrno = errno;
  94     debugs(83, 5, "FD " << fd_ << " wrote " << result << " <= " << size);
  95
  96     BIO_clear_retry_flags(table);
  97     if (result < 0) {
  98         const bool ignoreError = ignoreErrno(xerrno) != 0;
  99         debugs(83, 5, "error: " << xerrno << " ignored: " << ignoreError);
 100         if (ignoreError)
 101             BIO_set_retry_write(table);
 102     }
 103
 104     return result;
 105 }
 106
 107 int
 108 Ssl::Bio::read(char *buf, int size, BIO *table)
 109 {
 110     errno = 0;
 111 #if _SQUID_WINDOWS_
 112     const int result = socket_read_method(fd_, buf, size);
 113 #else
 114     const int result = default_read_method(fd_, buf, size);
 115 #endif
 116     const int xerrno = errno;
 117     debugs(83, 5, "FD " << fd_ << " read " << result << " <= " << size);
 118
 119     BIO_clear_retry_flags(table);
 120     if (result < 0) {
 121         const bool ignoreError = ignoreErrno(xerrno) != 0;
 122         debugs(83, 5, "error: " << xerrno << " ignored: " << ignoreError);
 123         if (ignoreError)
 124             BIO_set_retry_read(table);
 125     }
 126
 127     return result;
 128 }
 129
 130 int
 131 Ssl::Bio::readAndBuffer(char *buf, int size, BIO *table, const char *description)
 132 {
 133     prepReadBuf();
 134
 135     size = min((int)rbuf.potentialSpaceSize(), size);
 136     if (size <= 0) {
 137         debugs(83, DBG_IMPORTANT, "Not enough space to hold " <<
 138                rbuf.contentSize() << "+ byte " << description);
 139         return -1;
 140     }
 141
 142     const int bytes = Ssl::Bio::read(buf, size, table);
 143     debugs(83, 5, "read " << bytes << " out of " << size << " bytes"); // move to Ssl::Bio::read()
 144
 145     if (bytes > 0) {
 146         rbuf.append(buf, bytes);
 147         debugs(83, 5, "recorded " << bytes << " bytes of " << description);
 148     }
 149     return bytes;
 150 }
 151
 152 /// Called whenever the SSL connection state changes, an alert appears, or an
 153 /// error occurs. See SSL_set_info_callback().
 154 void
 155 Ssl::Bio::stateChanged(const SSL *ssl, int where, int ret)
 156 {
 157     // Here we can use (where & STATE) to check the current state.
 158     // Many STATE values are possible, including: SSL_CB_CONNECT_LOOP,
 159     // SSL_CB_ACCEPT_LOOP, SSL_CB_HANDSHAKE_START, and SSL_CB_HANDSHAKE_DONE.
 160     // For example:
 161     // if (where & SSL_CB_HANDSHAKE_START)
 162     //    debugs(83, 9, "Trying to establish the SSL connection");
 163     // else if (where & SSL_CB_HANDSHAKE_DONE)
 164     //    debugs(83, 9, "SSL connection established");
 165
 166     debugs(83, 7, "FD " << fd_ << " now: 0x" << std::hex << where << std::dec << ' ' <<
 167            SSL_state_string(ssl) << " (" << SSL_state_string_long(ssl) << ")");
 168 }
 169
 170 void
 171 Ssl::Bio::prepReadBuf()
 172 {
 173     if (rbuf.isNull())
 174         rbuf.init(4096, 65536);
 175 }
 176
 177 bool
 178 Ssl::ClientBio::isClientHello(int state)
 179 {
 180     return (
 181                state == SSL3_ST_SR_CLNT_HELLO_A ||
 182                state == SSL23_ST_SR_CLNT_HELLO_A ||
 183                state == SSL23_ST_SR_CLNT_HELLO_B ||
 184                state == SSL3_ST_SR_CLNT_HELLO_B ||
 185                state == SSL3_ST_SR_CLNT_HELLO_C
 186            );
 187 }
 188
 189 void
 190 Ssl::ClientBio::stateChanged(const SSL *ssl, int where, int ret)
 191 {
 192     Ssl::Bio::stateChanged(ssl, where, ret);
 193 }
 194
 195 int
 196 Ssl::ClientBio::write(const char *buf, int size, BIO *table)
 197 {
 198     if (holdWrite_) {
 199         BIO_set_retry_write(table);
 200         return 0;
 201     }
 202
 203     return Ssl::Bio::write(buf, size, table);
 204 }
 205
 206 const char *objToString(unsigned char const *bytes, int len)
 207 {
 208     static std::string buf;
 209     buf.clear();
 210     for (int i = 0; i < len; i++ ) {
 211         char tmp[3];
 212         snprintf(tmp, sizeof(tmp), "%.2x", bytes[i]);
 213         buf.append(tmp);
 214     }
 215     return buf.c_str();
 216 }
 217
 218 int
 219 Ssl::ClientBio::read(char *buf, int size, BIO *table)
 220 {
 221     if (helloState < atHelloReceived) {
 222         int bytes = readAndBuffer(buf, size, table, "TLS client Hello");
 223         if (bytes <= 0)
 224             return bytes;
 225     }
 226
 227     if (helloState == atHelloNone) {
 228         helloSize = features.parseMsgHead(rbuf);
 229         if (helloSize == 0) {
 230             // Not enough bytes to get hello message size
 231             BIO_set_retry_read(table);
 232             return -1;
 233         } else if (helloSize < 0) {
 234             wrongProtocol = true;
 235             return -1;
 236         }
 237
 238         helloState = atHelloStarted; //Next state
 239     }
 240
 241     if (helloState == atHelloStarted) {
 242         const unsigned char *head = (const unsigned char *)rbuf.content();
 243         const char *s = objToString(head, rbuf.contentSize());
 244         debugs(83, 7, "SSL Header: " << s);
 245
 246         if (helloSize > rbuf.contentSize()) {
 247             BIO_set_retry_read(table);
 248             return -1;
 249         }
 250         features.get(rbuf);
 251         helloState = atHelloReceived;
 252     }
 253
 254     if (holdRead_) {
 255         debugs(83, 7, "Hold flag is set, retry latter. (Hold " << size << "bytes)");
 256         BIO_set_retry_read(table);
 257         return -1;
 258     }
 259
 260     if (helloState == atHelloReceived) {
 261         if (rbuf.hasContent()) {
 262             int bytes = (size <= rbuf.contentSize() ? size : rbuf.contentSize());
 263             memcpy(buf, rbuf.content(), bytes);
 264             rbuf.consume(bytes);
 265             return bytes;
 266         } else
 267             return Ssl::Bio::read(buf, size, table);
 268     }
 269
 270     return -1;
 271 }
 272
 273 void
 274 Ssl::ServerBio::stateChanged(const SSL *ssl, int where, int ret)
 275 {
 276     Ssl::Bio::stateChanged(ssl, where, ret);
 277 }
 278
 279 void
 280 Ssl::ServerBio::setClientFeatures(const Ssl::Bio::sslFeatures &features)
 281 {
 282     clientFeatures = features;
 283 };
 284
 285 int
 286 Ssl::ServerBio::read(char *buf, int size, BIO *table)
 287 {
 288     return record_ ?
 289            readAndBuffer(buf, size, table, "TLS server Hello") : Ssl::Bio::read(buf, size, table);
 290 }
 291
 292 // This function makes the required checks to examine if the client hello
 293 // message is compatible with the features provided by OpenSSL toolkit.
 294 // If the features are compatible and can be supported it tries to rewrite SSL
 295 // structure members, to replace the hello message created by openSSL, with the
 296 // web client SSL hello message.
 297 // This is mostly possible in the cases where the web client uses openSSL
 298 // library similar with this one used by squid.
 299 static bool
 300 adjustSSL(SSL *ssl, Ssl::Bio::sslFeatures &features)
 301 {
 302 #if SQUID_USE_OPENSSL_HELLO_OVERWRITE_HACK
 303     if (!ssl->s3) {
 304         debugs(83, 5, "No SSLv3 data found!");
 305         return false;
 306     }
 307
 308     // If the client supports compression but our context does not support
 309     // we can not adjust.
 310 #if !defined(OPENSSL_NO_COMP)
 311     const bool requireCompression = (features.compressMethod && ssl->ctx->comp_methods == NULL);
 312 #else
 313     const bool requireCompression = features.compressMethod;
 314 #endif
 315     if (requireCompression) {
 316         debugs(83, 5, "Client Hello Data supports compression, but we do not!");
 317         return false;
 318     }
 319
 320     // Check ciphers list
 321     size_t token = 0;
 322     size_t end = 0;
 323     while (token != std::string::npos) {
 324         end = features.clientRequestedCiphers.find(':',token);
 325         std::string cipher;
 326         cipher.assign(features.clientRequestedCiphers, token, end - token);
 327         token = (end != std::string::npos ? end + 1 : std::string::npos);
 328         bool found = false;
 329         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(ssl);
 330         for (int i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++) {
 331             SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 332             const char *cname = SSL_CIPHER_get_name(c);
 333             if (cipher.compare(cname)) {
 334                 found = true;
 335                 break;
 336             }
 337         }
 338         if (!found) {
 339             debugs(83, 5, "Client Hello Data supports cipher '"<< cipher <<"' but we do not support it!");
 340             return false;
 341         }
 342     }
 343
 344 #if !defined(SSL_TLSEXT_HB_ENABLED)
 345     if (features.doHeartBeats) {
 346         debugs(83, 5, "Client Hello Data supports HeartBeats but we do not support!");
 347         return false;
 348     }
 349 #endif
 350
 351     for (std::list<int>::iterator it = features.extensions.begin(); it != features.extensions.end(); ++it) {
 352         static int supportedExtensions[] = {
 353 #if defined(TLSEXT_TYPE_server_name)
 354             TLSEXT_TYPE_server_name,
 355 #endif
 356 #if defined(TLSEXT_TYPE_opaque_prf_input)
 357             TLSEXT_TYPE_opaque_prf_input,
 358 #endif
 359 #if defined(TLSEXT_TYPE_heartbeat)
 360             TLSEXT_TYPE_heartbeat,
 361 #endif
 362 #if defined(TLSEXT_TYPE_renegotiate)
 363             TLSEXT_TYPE_renegotiate,
 364 #endif
 365 #if defined(TLSEXT_TYPE_ec_point_formats)
 366             TLSEXT_TYPE_ec_point_formats,
 367 #endif
 368 #if defined(TLSEXT_TYPE_elliptic_curves)
 369             TLSEXT_TYPE_elliptic_curves,
 370 #endif
 371 #if defined(TLSEXT_TYPE_session_ticket)
 372             TLSEXT_TYPE_session_ticket,
 373 #endif
 374 #if defined(TLSEXT_TYPE_status_request)
 375             TLSEXT_TYPE_status_request,
 376 #endif
 377 #if defined(TLSEXT_TYPE_use_srtp)
 378             TLSEXT_TYPE_use_srtp,
 379 #endif
 380 #if 0 //Allow 13172 Firefox supported extension for testing purposes
 381             13172,
 382 #endif
 383             -1
 384         };
 385         bool found = false;
 386         for (int i = 0; supportedExtensions[i] != -1; i++) {
 387             if (*it == supportedExtensions[i]) {
 388                 found = true;
 389                 break;
 390             }
 391         }
 392         if (!found) {
 393             debugs(83, 5, "Extension " << *it <<  " does not supported!");
 394             return false;
 395         }
 396     }
 397
 398     SSL3_BUFFER *wb=&(ssl->s3->wbuf);
 399     if (wb->len < (size_t)features.helloMessage.length())
 400         return false;
 401
 402     debugs(83, 5, "OpenSSL SSL struct will be adjusted to mimic client hello data!");
 403
 404     //Adjust ssl structure data.
 405     // We need to fix the random in SSL struct:
 406     memcpy(ssl->s3->client_random, features.client_random, SSL3_RANDOM_SIZE);
 407     memcpy(wb->buf, features.helloMessage.rawContent(), features.helloMessage.length());
 408     wb->left = features.helloMessage.length();
 409
 410     size_t mainHelloSize = features.helloMessage.length() - 5;
 411     const char *mainHello = features.helloMessage.rawContent() + 5;
 412     assert((size_t)ssl->init_buf->max > mainHelloSize);
 413     memcpy(ssl->init_buf->data, mainHello, mainHelloSize);
 414     debugs(83, 5, "Hello Data init and adjustd sizes :" << ssl->init_num << " = "<< mainHelloSize);
 415     ssl->init_num = mainHelloSize;
 416     ssl->s3->wpend_ret = mainHelloSize;
 417     ssl->s3->wpend_tot = mainHelloSize;
 418     return true;
 419 #else
 420     return false;
 421 #endif
 422 }
 423
 424 int
 425 Ssl::ServerBio::write(const char *buf, int size, BIO *table)
 426 {
 427
 428     if (holdWrite_) {
 429         debugs(83, 7,  "Hold write, for SSL connection on " << fd_ << "will not write bytes of size " << size);
 430         BIO_set_retry_write(table);
 431         return -1;
 432     }
 433
 434     if (!helloBuild && (bumpMode_ == Ssl::bumpPeek || bumpMode_ == Ssl::bumpStare)) {
 435         if (
 436             buf[1] >= 3  //it is an SSL Version3 message
 437             && buf[0] == 0x16 // and it is a Handshake/Hello message
 438         ) {
 439
 440             //Hello message is the first message we write to server
 441             assert(helloMsg.isEmpty());
 442
 443             SSL *ssl = fd_table[fd_].ssl;
 444             if (clientFeatures.initialized_ && ssl) {
 445                 if (bumpMode_ == Ssl::bumpPeek) {
 446                     if (adjustSSL(ssl, clientFeatures))
 447                         allowBump = true;
 448                     allowSplice = true;
 449                     helloMsg.append(clientFeatures.helloMessage);
 450                     debugs(83, 7,  "SSL HELLO message for FD " << fd_ << ": Random number is adjusted for peek mode");
 451                 } else { /*Ssl::bumpStare*/
 452                     allowBump = true;
 453                     if (adjustSSL(ssl, clientFeatures)) {
 454                         allowSplice = true;
 455                         helloMsg.append(clientFeatures.helloMessage);
 456                         debugs(83, 7,  "SSL HELLO message for FD " << fd_ << ": Random number is adjusted for stare mode");
 457                     }
 458                 }
 459             }
 460         }
 461         // If we do not build any hello message, copy the current
 462         if (helloMsg.isEmpty())
 463             helloMsg.append(buf, size);
 464
 465         helloBuild = true;
 466         helloMsgSize = helloMsg.length();
 467         //allowBump = true;
 468
 469         if (allowSplice) {
 470             // Do not write yet.....
 471             BIO_set_retry_write(table);
 472             return -1;
 473         }
 474     }
 475
 476     if (!helloMsg.isEmpty()) {
 477         debugs(83, 7,  "buffered write for FD " << fd_);
 478         int ret = Ssl::Bio::write(helloMsg.rawContent(), helloMsg.length(), table);
 479         helloMsg.consume(ret);
 480         if (!helloMsg.isEmpty()) {
 481             // We need to retry sendind data.
 482             // Say to openSSL to retry sending hello message
 483             BIO_set_retry_write(table);
 484             return -1;
 485         }
 486
 487         // Sending hello message complete. Do not send more data for now...
 488         holdWrite_ = true;
 489
 490         // spoof openSSL that we write what it ask us to write
 491         return size;
 492     } else
 493         return Ssl::Bio::write(buf, size, table);
 494 }
 495
 496 void
 497 Ssl::ServerBio::flush(BIO *table)
 498 {
 499     if (!helloMsg.isEmpty()) {
 500         int ret = Ssl::Bio::write(helloMsg.rawContent(), helloMsg.length(), table);
 501         helloMsg.consume(ret);
 502     }
 503 }
 504
 505 bool
 506 Ssl::ServerBio::resumingSession()
 507 {
 508     if (!serverFeatures.initialized_)
 509         serverFeatures.get(rbuf, false);
 510
 511     if (!clientFeatures.sessionId.isEmpty() && !serverFeatures.sessionId.isEmpty())
 512         return clientFeatures.sessionId == serverFeatures.sessionId;
 513
 514     // is this a session resuming attempt using TLS tickets?
 515     if (clientFeatures.hasTlsTicket &&
 516             serverFeatures.tlsTicketsExtension &&
 517             serverFeatures.hasCcsOrNst)
 518         return true;
 519
 520     return false;
 521 }
 522
 523 /// initializes BIO table after allocation
 524 static int
 525 squid_bio_create(BIO *bi)
 526 {
 527     bi->init = 0; // set when we store Bio object and socket fd (BIO_C_SET_FD)
 528     bi->num = 0;
 529     bi->ptr = NULL;
 530     bi->flags = 0;
 531     return 1;
 532 }
 533
 534 /// cleans BIO table before deallocation
 535 static int
 536 squid_bio_destroy(BIO *table)
 537 {
 538     delete static_cast<Ssl::Bio*>(table->ptr);
 539     table->ptr = NULL;
 540     return 1;
 541 }
 542
 543 /// wrapper for Bio::write()
 544 static int
 545 squid_bio_write(BIO *table, const char *buf, int size)
 546 {
 547     Ssl::Bio *bio = static_cast<Ssl::Bio*>(table->ptr);
 548     assert(bio);
 549     return bio->write(buf, size, table);
 550 }
 551
 552 /// wrapper for Bio::read()
 553 static int
 554 squid_bio_read(BIO *table, char *buf, int size)
 555 {
 556     Ssl::Bio *bio = static_cast<Ssl::Bio*>(table->ptr);
 557     assert(bio);
 558     return bio->read(buf, size, table);
 559 }
 560
 561 /// implements puts() via write()
 562 static int
 563 squid_bio_puts(BIO *table, const char *str)
 564 {
 565     assert(str);
 566     return squid_bio_write(table, str, strlen(str));
 567 }
 568
 569 /// other BIO manipulations (those without dedicated callbacks in BIO table)
 570 static long
 571 squid_bio_ctrl(BIO *table, int cmd, long arg1, void *arg2)
 572 {
 573     debugs(83, 5, table << ' ' << cmd << '(' << arg1 << ", " << arg2 << ')');
 574
 575     switch (cmd) {
 576     case BIO_C_SET_FD: {
 577         assert(arg2);
 578         const int fd = *static_cast<int*>(arg2);
 579         Ssl::Bio *bio;
 580         if (arg1 == Ssl::Bio::BIO_TO_SERVER)
 581             bio = new Ssl::ServerBio(fd);
 582         else
 583             bio = new Ssl::ClientBio(fd);
 584         assert(!table->ptr);
 585         table->ptr = bio;
 586         table->init = 1;
 587         return 0;
 588     }
 589
 590     case BIO_C_GET_FD:
 591         if (table->init) {
 592             Ssl::Bio *bio = static_cast<Ssl::Bio*>(table->ptr);
 593             assert(bio);
 594             if (arg2)
 595                 *static_cast<int*>(arg2) = bio->fd();
 596             return bio->fd();
 597         }
 598         return -1;
 599
 600     case BIO_CTRL_DUP:
 601         // Should implemented if the SSL_dup openSSL API function
 602         // used anywhere in squid.
 603         return 0;
 604
 605     case BIO_CTRL_FLUSH:
 606         if (table->init) {
 607             Ssl::Bio *bio = static_cast<Ssl::Bio*>(table->ptr);
 608             assert(bio);
 609             bio->flush(table);
 610             return 1;
 611         }
 612         return 0;
 613
 614     /*  we may also need to implement these:
 615         case BIO_CTRL_RESET:
 616         case BIO_C_FILE_SEEK:
 617         case BIO_C_FILE_TELL:
 618         case BIO_CTRL_INFO:
 619         case BIO_CTRL_GET_CLOSE:
 620         case BIO_CTRL_SET_CLOSE:
 621         case BIO_CTRL_PENDING:
 622         case BIO_CTRL_WPENDING:
 623     */
 624     default:
 625         return 0;
 626
 627     }
 628
 629     return 0; /* NOTREACHED */
 630 }
 631
 632 /// wrapper for Bio::stateChanged()
 633 static void
 634 squid_ssl_info(const SSL *ssl, int where, int ret)
 635 {
 636     if (BIO *table = SSL_get_rbio(ssl)) {
 637         if (Ssl::Bio *bio = static_cast<Ssl::Bio*>(table->ptr))
 638             bio->stateChanged(ssl, where, ret);
 639     }
 640 }
 641
 642 Ssl::Bio::sslFeatures::sslFeatures(): sslVersion(-1), compressMethod(-1), helloMsgSize(0), unknownCiphers(false), doHeartBeats(true), tlsTicketsExtension(false), hasTlsTicket(false), tlsStatusRequest(false), hasCcsOrNst(false), initialized_(false)
 643 {
 644     memset(client_random, 0, SSL3_RANDOM_SIZE);
 645 }
 646
 647 int Ssl::Bio::sslFeatures::toSquidSSLVersion() const
 648 {
 649     if (sslVersion == SSL2_VERSION)
 650         return 2;
 651     else if (sslVersion == SSL3_VERSION)
 652         return 3;
 653     else if (sslVersion == TLS1_VERSION)
 654         return 4;
 655 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
 656     else if (sslVersion == TLS1_1_VERSION)
 657         return 5;
 658     else if (sslVersion == TLS1_2_VERSION)
 659         return 6;
 660 #endif
 661     else
 662         return 1;
 663 }
 664
 665 bool
 666 Ssl::Bio::sslFeatures::get(const SSL *ssl)
 667 {
 668     sslVersion = SSL_version(ssl);
 669     debugs(83, 7, "SSL version: " << SSL_get_version(ssl) << " (" << sslVersion << ")");
 670
 671 #if defined(TLSEXT_NAMETYPE_host_name)
 672     if (const char *server = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))
 673         serverName = server;
 674     debugs(83, 7, "SNI server name: " << serverName);
 675 #endif
 676
 677 #if !defined(OPENSSL_NO_COMP)
 678     if (ssl->session->compress_meth)
 679         compressMethod = ssl->session->compress_meth;
 680     else if (sslVersion >= 3) //if it is 3 or newer version then compression is disabled
 681 #endif
 682         compressMethod = 0;
 683     debugs(83, 7, "SSL compression: " << compressMethod);
 684
 685     STACK_OF(SSL_CIPHER) * ciphers = NULL;
 686     if (ssl->server)
 687         ciphers = ssl->session->ciphers;
 688     else
 689         ciphers = ssl->cipher_list;
 690     if (ciphers) {
 691         for (int i = 0; i < sk_SSL_CIPHER_num(ciphers); ++i) {
 692             SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
 693             if (c != NULL) {
 694                 if (!clientRequestedCiphers.empty())
 695                     clientRequestedCiphers.append(":");
 696                 clientRequestedCiphers.append(c->name);
 697             }
 698         }
 699     }
 700     debugs(83, 7, "Ciphers requested by client: " << clientRequestedCiphers);
 701
 702     if (sslVersion >=3 && ssl->s3 && ssl->s3->client_random[0]) {
 703         memcpy(client_random, ssl->s3->client_random, SSL3_RANDOM_SIZE);
 704     }
 705
 706 #if 0 /* XXX: OpenSSL 0.9.8k lacks at least some of these tlsext_* fields */
 707     //The following extracted for logging purpuses:
 708     // TLSEXT_TYPE_ec_point_formats
 709     unsigned char *p;
 710     int len;
 711     if (ssl->server) {
 712         p = ssl->session->tlsext_ecpointformatlist;
 713         len = ssl->session->tlsext_ecpointformatlist_length;
 714     } else {
 715         p = ssl->tlsext_ecpointformatlist;
 716         len = ssl->tlsext_ecpointformatlist_length;
 717     }
 718     if (p) {
 719         ecPointFormatList = objToString(p, len);
 720         debugs(83, 7, "tlsExtension ecPointFormatList of length " << len << " :" << ecPointFormatList);
 721     }
 722
 723     // TLSEXT_TYPE_elliptic_curves
 724     if (ssl->server) {
 725         p = ssl->session->tlsext_ellipticcurvelist;
 726         len = ssl->session->tlsext_ellipticcurvelist_length;
 727     } else {
 728         p = ssl->tlsext_ellipticcurvelist;
 729         len = ssl->tlsext_ellipticcurvelist_length;
 730     }
 731     if (p) {
 732         ellipticCurves = objToString(p, len);
 733         debugs(83, 7, "tlsExtension ellipticCurveList of length " <<  len <<" :" << ellipticCurves);
 734     }
 735     // TLSEXT_TYPE_opaque_prf_input
 736     p = NULL;
 737     if (ssl->server) {
 738         if (ssl->s3 &&  ssl->s3->client_opaque_prf_input) {
 739             p = (unsigned char *)ssl->s3->client_opaque_prf_input;
 740             len = ssl->s3->client_opaque_prf_input_len;
 741         }
 742     } else {
 743         p = (unsigned char *)ssl->tlsext_opaque_prf_input;
 744         len = ssl->tlsext_opaque_prf_input_len;
 745     }
 746     if (p) {
 747         debugs(83, 7, "tlsExtension client-opaque-prf-input of length " << len);
 748         opaquePrf = objToString(p, len);
 749     }
 750 #endif
 751     initialized_ = true;
 752     return true;
 753 }
 754
 755 int
 756 Ssl::Bio::sslFeatures::parseMsgHead(const MemBuf &buf)
 757 {
 758     const unsigned char *head = (const unsigned char *)buf.content();
 759     const char *s = objToString(head, buf.contentSize());
 760     debugs(83, 7, "SSL Header: " << s);
 761     if (buf.contentSize() < 5)
 762         return 0;
 763
 764     if (helloMsgSize > 0)
 765         return helloMsgSize;
 766
 767     // Check for SSLPlaintext/TLSPlaintext record
 768     // RFC6101 section 5.2.1
 769     // RFC5246 section 6.2.1
 770     if (head[0] == 0x16) {
 771         debugs(83, 7, "SSL version 3 handshake message");
 772         // The SSL version exist in the 2nd and 3rd bytes
 773         sslVersion = (head[1] << 8) | head[2];
 774         debugs(83, 7, "SSL Version :" << std::hex << std::setw(8) << std::setfill('0') << sslVersion);
 775         // The hello message size exist in 4th and 5th bytes
 776         helloMsgSize = (head[3] << 8) + head[4];
 777         debugs(83, 7, "SSL Header Size: " << helloMsgSize);
 778         helloMsgSize +=5;
 779     } else if ((head[0] & 0x80) && head[2] == 0x01 && head[3] == 0x03) {
 780         debugs(83, 7, "SSL version 2 handshake message with v3 support");
 781         sslVersion = (head[3] << 8) | head[4];
 782         debugs(83, 7, "SSL Version :" << std::hex << std::setw(8) << std::setfill('0') << sslVersion);
 783         // The hello message size exist in 2nd byte
 784         helloMsgSize = head[1];
 785         helloMsgSize +=2;
 786     } else {
 787         debugs(83, 7, "Not an SSL acceptable handshake message (SSLv2 message?)");
 788         return (helloMsgSize = -1);
 789     }
 790
 791     // Set object as initialized. Even if we did not full parsing yet
 792     // The basic features, like the SSL version is set
 793     initialized_ = true;
 794     return helloMsgSize;
 795 }
 796
 797 bool
 798 Ssl::Bio::sslFeatures::checkForCcsOrNst(const unsigned char *msg, size_t size)
 799 {
 800     while (size > 5) {
 801         const int msgType = msg[0];
 802         const int msgSslVersion = (msg[1] << 8) | msg[2];
 803         debugs(83, 7, "SSL Message Version :" << std::hex << std::setw(8) << std::setfill('0') << msgSslVersion);
 804         // Check for Change Cipher Spec message
 805         // RFC5246 section 6.2.1
 806         if (msgType == 0x14) {// Change Cipher Spec message found
 807             debugs(83, 7, "SSL  Change Cipher Spec message found");
 808             return true;
 809         }
 810         // Check for New Session Ticket message
 811         // RFC5077 section 3.3
 812         if (msgType == 0x04) {// New Session Ticket message found
 813             debugs(83, 7, "TLS  New Session Ticket message found");
 814             return true;
 815         }
 816         // The hello message size exist in 4th and 5th bytes
 817         size_t msgLength = (msg[3] << 8) + msg[4];
 818         debugs(83, 7, "SSL Message Size: " << msgLength);
 819         msgLength += 5;
 820
 821         if (msgLength <= size) {
 822             msg += msgLength;
 823             size -= msgLength;
 824         } else
 825             size = 0;
 826     }
 827     return false;
 828 }
 829
 830 bool
 831 Ssl::Bio::sslFeatures::get(const MemBuf &buf, bool record)
 832 {
 833     int msgSize;
 834     if ((msgSize = parseMsgHead(buf)) <= 0) {
 835         debugs(83, 7, "Not a known SSL handshake message");
 836         return false;
 837     }
 838
 839     if (msgSize > buf.contentSize()) {
 840         debugs(83, 2, "Partial SSL handshake message, can not parse!");
 841         return false;
 842     }
 843
 844     if (record) {
 845         helloMessage.clear();
 846         helloMessage.append(buf.content(), buf.contentSize());
 847     }
 848
 849     const unsigned char *msg = (const unsigned char *)buf.content();
 850     if (msg[0] & 0x80)
 851         return parseV23Hello(msg, (size_t)msgSize);
 852     else {
 853         // Hello messages require 5 bytes header + 1 byte Msg type + 3 bytes for Msg size
 854         if (buf.contentSize() < 9)
 855             return false;
 856
 857         // Check for the Handshake/Message type
 858         // The type 2 is a ServerHello, the type 1 is a ClientHello
 859         // RFC5246 section 7.4
 860         if (msg[5] == 0x2) { // ServerHello message
 861             if (parseV3ServerHello(msg, (size_t)msgSize)) {
 862                 hasCcsOrNst = checkForCcsOrNst(msg + msgSize,  buf.contentSize() - msgSize);
 863                 return true;
 864             }
 865         } else if (msg[5] == 0x1) // ClientHello message,
 866             return parseV3Hello(msg, (size_t)msgSize);
 867     }
 868
 869     return false;
 870 }
 871
 872 bool
 873 Ssl::Bio::sslFeatures::parseV3ServerHello(const unsigned char *messageContainer, size_t messageContainerSize)
 874 {
 875     // Parse a ServerHello Handshake message
 876     // RFC5246 section 7.4, 7.4.1.3
 877     // The ServerHello starts at messageContainer + 5
 878     const unsigned char *serverHello = messageContainer + 5;
 879
 880     // The Length field (bytes 1-3) plus 4 bytes of the serverHello message header (1 handshake type + 3 hello length)
 881     const size_t helloSize = ((serverHello[1] << 16) | (serverHello[2] << 8) | serverHello[3]) + 4;
 882     debugs(83, 7, "ServerHello message size: " << helloSize);
 883     if (helloSize > messageContainerSize) {
 884         debugs(83, 2, "ServerHello parse error");
 885         return false;
 886     }
 887
 888     // helloSize should be at least 38 bytes long:
 889     // (SSL Version + Random + SessionId Length + Cipher Suite + Compression Method)
 890     if (helloSize < 38) {
 891         debugs(83, 2, "Too short ServerHello message");
 892         return false;
 893     }
 894
 895     debugs(83, 7, "Get fake features from v3 ServerHello message.");
 896     // Get the correct version of the sub-hello message
 897     sslVersion = (serverHello[4] << 8) | serverHello[5];
 898     // At the position 38 (HelloHeader (6bytes) + SSL3_RANDOM_SIZE (32bytes))
 899     const size_t sessIdLen = static_cast<size_t>(serverHello[38]);
 900     debugs(83, 7, "Session ID Length: " <<  sessIdLen);
 901
 902     // The size should be enough to hold at least the following
 903     // 4 (hello header)
 904     // + 2 (SSL Version) + 32 (random) + 1 (sessionId length)
 905     // + sessIdLength + 2 (cipher suite) + 1 (compression method)
 906     // = 42 + sessIdLength
 907     if (42 + sessIdLen > helloSize) {
 908         debugs(83, 2, "ciphers length parse error");
 909         return false;
 910     }
 911
 912     // The sessionID stored at 39 position, after sessionID length field
 913     sessionId.assign(reinterpret_cast<const char *>(serverHello + 39), sessIdLen);
 914
 915     // Check if there are extensions in hello message
 916     // RFC5246 section 7.4.1.4
 917     if (helloSize > 42 + sessIdLen + 2) {
 918         // 42 + sessIdLen
 919         const unsigned char *pToExtensions = serverHello + 42 + sessIdLen;
 920         const size_t extensionsLen = (pToExtensions[0] << 8) | pToExtensions[1];
 921         // Check if the hello size can hold extensions
 922         if (42 + 2 + sessIdLen + extensionsLen > helloSize ) {
 923             debugs(83, 2, "Extensions length parse error");
 924             return false;
 925         }
 926
 927         pToExtensions += 2;
 928         const unsigned char *ext = pToExtensions;
 929         while (ext + 4 <= pToExtensions + extensionsLen) {
 930             const size_t extType = (ext[0] << 8) | ext[1];
 931             ext += 2;
 932             const size_t extLen = (ext[0] << 8) | ext[1];
 933             ext += 2;
 934             debugs(83, 7, "TLS Extension: " << std::hex << extType << " of size:" << extLen);
 935             // SessionTicket TLS Extension, RFC5077 section 3.2
 936             if (extType == 0x23) {
 937                 tlsTicketsExtension = true;
 938             }
 939             ext += extLen;
 940         }
 941     }
 942     return true;
 943 }
 944
 945 bool
 946 Ssl::Bio::sslFeatures::parseV3Hello(const unsigned char *messageContainer, size_t messageContainerSize)
 947 {
 948     // Parse a ClientHello Handshake message
 949     // RFC5246 section 7.4, 7.4.1.2
 950     // The ClientHello starts at messageContainer + 5
 951     const unsigned char * clientHello = messageContainer + 5;
 952
 953     debugs(83, 7, "Get fake features from v3 ClientHello message.");
 954     // The Length field (bytes 1-3) plus 4 bytes of the clientHello message header (1 handshake type + 3 hello length)
 955     const size_t helloSize = ((clientHello[1] << 16) | (clientHello[2] << 8) | clientHello[3]) + 4;
 956     debugs(83, 7, "ClientHello message size: " << helloSize);
 957     if (helloSize > messageContainerSize) {
 958         debugs(83, 2, "ClientHello parse error");
 959         return false;
 960     }
 961
 962     // helloSize should be at least 38 bytes long:
 963     // (SSL Version(2) + Random(32) + SessionId Length(1) + Cipher Suite Length(2) + Compression Method Length(1))
 964     if (helloSize < 38) {
 965         debugs(83, 2, "Too short ClientHello message");
 966         return false;
 967     }
 968
 969     //For SSLv3 or TLSv1.* protocols we can get some more informations
 970     if (messageContainer[1] != 0x3 || clientHello[0] != 0x1 /*HELLO A message*/) {
 971         debugs(83, 2, "Not an SSLv3/TLSv1.x client hello message, stop parsing here");
 972         return true;
 973     }
 974
 975     // Get the correct version of the sub-hello message
 976     sslVersion = (clientHello[4] << 8) | clientHello[5];
 977     //Get Client Random number. It starts on the position 6 of clientHello message
 978     memcpy(client_random, clientHello + 6, SSL3_RANDOM_SIZE);
 979     debugs(83, 7, "Client random: " <<  objToString(client_random, SSL3_RANDOM_SIZE));
 980
 981     // At the position 38 (6+SSL3_RANDOM_SIZE)
 982     const size_t sessIDLen = static_cast<size_t>(clientHello[38]);
 983     debugs(83, 7, "Session ID Length: " <<  sessIDLen);
 984
 985     // The helloSize should be enough to hold at least the following
 986     // 1 handshake type + 3 hello Length
 987     // + 2 (SSL Version) + 32 (random) + 1 (sessionId length)
 988     // + sessIdLength + 2 (cipher suite length) + 1 (compression method length)
 989     // = 42 + sessIdLength
 990     if (42 + sessIDLen > helloSize) {
 991         debugs(83, 2, "Session ID length parse error");
 992         return false;
 993     }
 994
 995     // The sessionID stored art 39 position, after sessionID length field
 996     sessionId.assign(reinterpret_cast<const char *>(clientHello + 39), sessIDLen);
 997
 998     //Ciphers list. It is stored after the Session ID.
 999     // It is a variable-length vector(RFC5246 section 4.3)
1000     const unsigned char *ciphers = clientHello + 39 + sessIDLen;
1001     const size_t ciphersLen = (ciphers[0] << 8) | ciphers[1];
1002     if (42 + sessIDLen + ciphersLen > helloSize) {
1003         debugs(83, 2, "ciphers length parse error");
1004         return false;
1005     }
1006
1007     ciphers += 2;
1008     if (ciphersLen) {
1009 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
1010         const SSL_METHOD *method = TLS_method();
1011 #else
1012         const SSL_METHOD *method = SSLv23_method();
1013 #endif
1014         for (size_t i = 0; i < ciphersLen; i += 2) {
1015             // each cipher in v3/tls  HELLO message is of size 2
1016             const SSL_CIPHER *c = method->get_cipher_by_char((ciphers + i));
1017             if (c != NULL) {
1018                 if (!clientRequestedCiphers.empty())
1019                     clientRequestedCiphers.append(":");
1020                 clientRequestedCiphers.append(c->name);
1021             } else
1022                 unknownCiphers = true;
1023         }
1024     }
1025     debugs(83, 7, "Ciphers requested by client: " << clientRequestedCiphers);
1026
1027     // Compression field: 1 bytes the number of compression methods and
1028     // 1 byte for each compression method
1029     const unsigned char *compression = ciphers + ciphersLen;
1030     if (compression[0] > 1)
1031         compressMethod = 1;
1032     else
1033         compressMethod = 0;
1034     debugs(83, 7, "SSL compression methods number: " << static_cast<int>(compression[0]));
1035
1036     // Parse Extensions, RFC5246 section 7.4.1.4
1037     const unsigned char *pToExtensions = compression + 1 + static_cast<int>(compression[0]);
1038     if ((size_t)((pToExtensions - clientHello) + 2) < helloSize) {
1039         const size_t extensionsLen = (pToExtensions[0] << 8) | pToExtensions[1];
1040         if ((pToExtensions - clientHello) + 2 + extensionsLen > helloSize) {
1041             debugs(83, 2, "Extensions length parse error");
1042             return false;
1043         }
1044
1045         pToExtensions += 2;
1046         const unsigned char *ext = pToExtensions;
1047         while (ext + 4 <= pToExtensions + extensionsLen) {
1048             const size_t extType = (ext[0] << 8) | ext[1];
1049             ext += 2;
1050             const size_t extLen = (ext[0] << 8) | ext[1];
1051             ext += 2;
1052             debugs(83, 7, "TLS Extension: " << std::hex << extType << " of size:" << extLen);
1053
1054             if (ext + extLen > pToExtensions + extensionsLen) {
1055                 debugs(83, 2, "Extension " << std::hex << extType << " length parser error");
1056                 return false;
1057             }
1058
1059             //The SNI extension has the type 0 (extType == 0)
1060             // RFC6066 sections 3, 10.2
1061             // The two first bytes indicates the length of the SNI data (should be extLen-2)
1062             // The next byte is the hostname type, it should be '0' for normal hostname (ext[2] == 0)
1063             // The 3rd and 4th bytes are the length of the hostname
1064             if (extType == 0 && ext[2] == 0) {
1065                 const size_t hostLen = (ext[3] << 8) | ext[4];
1066                 if (hostLen < extLen)
1067                     serverName.assign(reinterpret_cast<const char *>(ext+5), hostLen);
1068                 debugs(83, 7, "Found server name: " << serverName);
1069             } else if (extType == 15 && ext[0] != 0) {
1070                 // The heartBeats are the type 15, RFC6520
1071                 doHeartBeats = true;
1072             } else if (extType == 0x23) {
1073                 //SessionTicket TLS Extension RFC5077
1074                 tlsTicketsExtension = true;
1075                 if (extLen != 0)
1076                     hasTlsTicket = true;
1077             } else if (extType == 0x05) {
1078                 // RFC6066 sections 8, 10.2
1079                 tlsStatusRequest = true;
1080             } else if (extType == 0x3374) {
1081                 // detected TLS next protocol negotiate extension
1082             } else if (extType == 0x10) {
1083                 // Application-Layer Protocol Negotiation Extension, RFC7301
1084                 const size_t listLen = (ext[0] << 8) | ext[1];
1085                 if (listLen < extLen)
1086                     tlsAppLayerProtoNeg.assign(reinterpret_cast<const char *>(ext+5), listLen);
1087             } else
1088                 extensions.push_back(extType);
1089
1090             ext += extLen;
1091         }
1092     }
1093     return true;
1094 }
1095
1096 bool
1097 Ssl::Bio::sslFeatures::parseV23Hello(const unsigned char *hello, size_t size)
1098 {
1099     debugs(83, 7, "Get fake features from v23 ClientHello message.");
1100     if (size < 7)
1101         return false;
1102     //Ciphers list. It is stored after the Session ID.
1103     const unsigned int ciphersLen = (hello[5] << 8) | hello[6];
1104     const unsigned char *ciphers = hello + 11;
1105
1106     if (size < ciphersLen + 11)
1107         return false;
1108
1109     if (ciphersLen) {
1110 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
1111         const SSL_METHOD *method = TLS_method();
1112 #else
1113         const SSL_METHOD *method = SSLv23_method();
1114 #endif
1115         for (unsigned int i = 0; i < ciphersLen; i += 3) {
1116             // The v2 hello messages cipher has 3 bytes.
1117             // The v2 cipher has the first byte not null
1118             // Because we are going to sent only v3 message we
1119             // are ignoring these ciphers
1120             if (ciphers[i] != 0)
1121                 continue;
1122             const SSL_CIPHER *c = method->get_cipher_by_char((ciphers + i + 1));
1123             if (c != NULL) {
1124                 if (!clientRequestedCiphers.empty())
1125                     clientRequestedCiphers.append(":");
1126                 clientRequestedCiphers.append(c->name);
1127             }
1128         }
1129     }
1130     debugs(83, 7, "Ciphers requested by client: " << clientRequestedCiphers);
1131
1132     const unsigned int sessionIdLength = (hello[7] << 8) | hello[8];
1133     debugs(83, 7, "SessionID length: " << sessionIdLength);
1134     // SessionID starts at: hello+11+ciphersLen
1135     if (sessionIdLength)
1136         sessionId.assign((const char *)(hello + 11 + ciphersLen), sessionIdLength);
1137
1138     const unsigned int challengeLength = (hello[5] << 9) | hello[10];
1139     debugs(83, 7, "Challenge Length: " << challengeLength);
1140     //challenge starts at: hello+11+ciphersLen+sessionIdLength
1141
1142     compressMethod = 0;
1143     return true;
1144 }
1145
1146 void
1147 Ssl::Bio::sslFeatures::applyToSSL(SSL *ssl, Ssl::BumpMode bumpMode) const
1148 {
1149     // To increase the possibility for bumping after peek mode selection or
1150     // splicing after stare mode selection it is good to set the
1151     // SSL protocol version.
1152     // The SSL_set_ssl_method is not the correct method because it will strict
1153     // SSL version which can be used to the SSL version used for client hello message.
1154     // For example will prevent comunnicating with a tls1.0 server if the
1155     // client sent and tlsv1.2 Hello message.
1156 #if defined(TLSEXT_NAMETYPE_host_name)
1157     if (!serverName.isEmpty()) {
1158         SSL_set_tlsext_host_name(ssl, serverName.c_str());
1159     }
1160 #endif
1161     if (!clientRequestedCiphers.empty())
1162         SSL_set_cipher_list(ssl, clientRequestedCiphers.c_str());
1163 #if defined(SSL_OP_NO_COMPRESSION) /* XXX: OpenSSL 0.9.8k lacks SSL_OP_NO_COMPRESSION */
1164     if (compressMethod == 0)
1165         SSL_set_options(ssl, SSL_OP_NO_COMPRESSION);
1166 #endif
1167
1168 #if defined(TLSEXT_STATUSTYPE_ocsp)
1169     if (tlsStatusRequest)
1170         SSL_set_tlsext_status_type(ssl, TLSEXT_STATUSTYPE_ocsp);
1171 #endif
1172
1173 #if defined(TLSEXT_TYPE_application_layer_protocol_negotiation)
1174     if (!tlsAppLayerProtoNeg.isEmpty()) {
1175         if (bumpMode == Ssl::bumpPeek)
1176             SSL_set_alpn_protos(ssl, (const unsigned char*)tlsAppLayerProtoNeg.rawContent(), tlsAppLayerProtoNeg.length());
1177         else {
1178             static const unsigned char supported_protos[] = {8, 'h','t','t', 'p', '/', '1', '.', '1'};
1179             SSL_set_alpn_protos(ssl, supported_protos, sizeof(supported_protos));
1180         }
1181     }
1182 #endif
1183 }
1184
1185 std::ostream &
1186 Ssl::Bio::sslFeatures::print(std::ostream &os) const
1187 {
1188     static std::string buf;
1189     // TODO: Also print missing features like the HeartBeats and AppLayerProtoNeg
1190     return os << "v" << sslVersion <<
1191            " SNI:" << (serverName.isEmpty() ? SBuf("-") : serverName) <<
1192            " comp:" << compressMethod <<
1193            " Ciphers:" << clientRequestedCiphers <<
1194            " Random:" << objToString(client_random, SSL3_RANDOM_SIZE) <<
1195            " ecPointFormats:" << ecPointFormatList <<
1196            " ec:" << ellipticCurves <<
1197            " opaquePrf:" << opaquePrf;
1198 }
1199
1200 #endif /* USE_SSL */
1201