* [including the GNU Public Licence.]
*/
/* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
+ * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* Hudson (tjh@cryptsoft.com).
*
*/
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
#include <limits.h>
#include <string.h>
#include <stdio.h>
+#include "ssl_locl.h"
#include <openssl/buffer.h>
#include <openssl/rand.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
-#include "ssl_locl.h"
/* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
int ssl3_do_write(SSL *s, int type)
p= &(d[4]);
i=s->method->ssl3_enc->final_finish_mac(s,
- &(s->s3->finish_dgst1),
- &(s->s3->finish_dgst2),
sender,slen,s->s3->tmp.finish_md);
s->s3->tmp.finish_md_len = i;
memcpy(p, s->s3->tmp.finish_md, i);
* change cipher spec message and is in s->s3->tmp.peer_finish_md
*/
- n=ssl3_get_message(s,
+ n=s->method->ssl_get_message(s,
a,
b,
SSL3_MT_FINISHED,
X509_STORE_CTX xs_ctx;
X509_OBJECT obj;
+ int no_chain;
+
+ if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || s->ctx->extra_certs)
+ no_chain = 1;
+ else
+ no_chain = 0;
+
/* TLSv1 sends a chain with nothing in it, instead of an alert */
buf=s->init_buf;
- if (!BUF_MEM_grow(buf,(int)(10)))
+ if (!BUF_MEM_grow_clean(buf,10))
{
SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
return(0);
}
if (x != NULL)
{
- if(!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL))
+ if(!no_chain && !X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL))
{
SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
return(0);
for (;;)
{
n=i2d_X509(x,NULL);
- if (!BUF_MEM_grow(buf,(int)(n+l+3)))
+ if (!BUF_MEM_grow_clean(buf,(int)(n+l+3)))
{
SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
return(0);
l2n3(n,p);
i2d_X509(x,&p);
l+=n+3;
+
+ if (no_chain)
+ break;
+
if (X509_NAME_cmp(X509_get_subject_name(x),
X509_get_issuer_name(x)) == 0) break;
* ref count */
X509_free(x);
}
-
- X509_STORE_CTX_cleanup(&xs_ctx);
+ if (!no_chain)
+ X509_STORE_CTX_cleanup(&xs_ctx);
}
/* Thawte special :-) */
{
x=sk_X509_value(s->ctx->extra_certs,i);
n=i2d_X509(x,NULL);
- if (!BUF_MEM_grow(buf,(int)(n+l+3)))
+ if (!BUF_MEM_grow_clean(buf,(int)(n+l+3)))
{
SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
return(0);
{
while (s->init_num < 4)
{
- i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
- 4 - s->init_num, 0);
+ i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+ &p[s->init_num],4 - s->init_num, 0);
if (i <= 0)
{
s->rwstate=SSL_READING;
SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
goto f_err;
}
- if (l && !BUF_MEM_grow(s->init_buf,(int)l+4))
+ if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l+4))
{
SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);
goto err;
n = s->s3->tmp.message_size - s->init_num;
while (n > 0)
{
- i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
+ i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
if (i <= 0)
{
s->rwstate=SSL_READING;
int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
{
EVP_PKEY *pk;
- int ret= -1,i,j;
+ int ret= -1,i;
if (pkey == NULL)
pk=X509_get_pubkey(x);
if (i == EVP_PKEY_RSA)
{
ret=SSL_PKEY_RSA_ENC;
- if (x != NULL)
- {
- j=X509_get_ext_count(x);
- /* check to see if this is a signing only certificate */
- /* EAY EAY EAY EAY */
- }
}
else if (i == EVP_PKEY_DSA)
{
ret=SSL_PKEY_DSA_SIGN;
}
- else if (i == EVP_PKEY_DH)
+#ifndef OPENSSL_NO_EC
+ else if (i == EVP_PKEY_EC)
{
- /* if we just have a key, we needs to be guess */
-
- if (x == NULL)
- ret=SSL_PKEY_DH_DSA;
- else
- {
- j=X509_get_signature_type(x);
- if (j == EVP_PKEY_RSA)
- ret=SSL_PKEY_DH_RSA;
- else if (j== EVP_PKEY_DSA)
- ret=SSL_PKEY_DH_DSA;
- else ret= -1;
- }
+ ret = SSL_PKEY_ECC;
+ }
+#endif
+ else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc)
+ {
+ ret = SSL_PKEY_GOST94;
+ }
+ else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc)
+ {
+ ret = SSL_PKEY_GOST01;
}
- else
- ret= -1;
-
err:
if(!pkey) EVP_PKEY_free(pk);
return(ret);
int ssl3_setup_buffers(SSL *s)
{
unsigned char *p;
- unsigned int extra;
+ size_t len,align=0;
+
+#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
+ align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+#endif
if (s->s3->rbuf.buf == NULL)
{
+ len = SSL3_RT_MAX_PLAIN_LENGTH
+ + SSL3_RT_MAX_ENCRYPTED_OVERHEAD
+ + SSL3_RT_HEADER_LENGTH + align;
if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
- extra=SSL3_RT_MAX_EXTRA;
- else
- extra=0;
- if ((p=OPENSSL_malloc(SSL3_RT_MAX_PACKET_SIZE+extra))
- == NULL)
+ {
+ s->s3->init_extra = 1;
+ len += SSL3_RT_MAX_EXTRA;
+ }
+#ifndef OPENSSL_NO_COMP
+ if (!(s->options & SSL_OP_NO_COMPRESSION))
+ len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+#endif
+ if ((p=OPENSSL_malloc(len)) == NULL)
goto err;
- s->s3->rbuf.buf=p;
+ s->s3->rbuf.buf = p;
+ s->s3->rbuf.len = len;
}
if (s->s3->wbuf.buf == NULL)
{
- if ((p=OPENSSL_malloc(SSL3_RT_MAX_PACKET_SIZE))
- == NULL)
+ len = s->max_send_fragment
+ + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
+ + SSL3_RT_HEADER_LENGTH + align;
+#ifndef OPENSSL_NO_COMP
+ if (!(s->options & SSL_OP_NO_COMPRESSION))
+ len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+#endif
+ if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+ len += SSL3_RT_HEADER_LENGTH + align
+ + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
+ if ((p=OPENSSL_malloc(len)) == NULL)
goto err;
- s->s3->wbuf.buf=p;
+ s->s3->wbuf.buf = p;
+ s->s3->wbuf.len = len;
}
s->packet= &(s->s3->rbuf.buf[0]);
return(1);