]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
4333b89f | 2 | * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. |
c80149d9 | 3 | * Copyright 2005 Nokia. All rights reserved. |
82b0bf0b | 4 | * |
2c18d164 | 5 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
6 | * this file except in compliance with the License. You can obtain a copy |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
82b0bf0b | 9 | */ |
846e33c7 | 10 | |
58964a49 | 11 | #include <stdio.h> |
706457b7 DMSP |
12 | #include "ssl_local.h" |
13 | #include "record/record_local.h" | |
50ec7505 BP |
14 | #include "internal/ktls.h" |
15 | #include "internal/cryptlib.h" | |
3c27208f | 16 | #include <openssl/comp.h> |
ec577822 | 17 | #include <openssl/evp.h> |
b7d60e76 | 18 | #include <openssl/kdf.h> |
637f374a | 19 | #include <openssl/rand.h> |
50ec7505 | 20 | #include <openssl/obj_mac.h> |
ce3b1bb4 | 21 | #include <openssl/core_names.h> |
49b26f54 | 22 | #include <openssl/trace.h> |
58964a49 | 23 | |
b7d60e76 | 24 | /* seed1 through seed5 are concatenated */ |
28ba2541 | 25 | static int tls1_PRF(SSL *s, |
6db6bc5a MC |
26 | const void *seed1, size_t seed1_len, |
27 | const void *seed2, size_t seed2_len, | |
28 | const void *seed3, size_t seed3_len, | |
29 | const void *seed4, size_t seed4_len, | |
30 | const void *seed5, size_t seed5_len, | |
31 | const unsigned char *sec, size_t slen, | |
d4d2f3a4 | 32 | unsigned char *out, size_t olen, int fatal) |
0f113f3e | 33 | { |
28ba2541 | 34 | const EVP_MD *md = ssl_prf_md(s); |
ce3b1bb4 | 35 | EVP_KDF *kdf; |
32495464 | 36 | EVP_KDF_CTX *kctx = NULL; |
ce3b1bb4 | 37 | OSSL_PARAM params[8], *p = params; |
7e56c626 | 38 | const char *mdname; |
0f113f3e | 39 | |
28ba2541 | 40 | if (md == NULL) { |
668f6f08 | 41 | /* Should never happen */ |
d4d2f3a4 | 42 | if (fatal) |
c48ffbcc | 43 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
d4d2f3a4 | 44 | else |
6849b73c | 45 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
28ba2541 | 46 | return 0; |
668f6f08 | 47 | } |
ca1bbc1a | 48 | kdf = EVP_KDF_fetch(s->ctx->libctx, OSSL_KDF_NAME_TLS1_PRF, s->ctx->propq); |
ce3b1bb4 P |
49 | if (kdf == NULL) |
50 | goto err; | |
660c5344 | 51 | kctx = EVP_KDF_CTX_new(kdf); |
ce3b1bb4 P |
52 | EVP_KDF_free(kdf); |
53 | if (kctx == NULL) | |
b7d60e76 | 54 | goto err; |
7e56c626 | 55 | mdname = EVP_MD_name(md); |
ce3b1bb4 | 56 | *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, |
8b6ffd40 | 57 | (char *)mdname, 0); |
ce3b1bb4 P |
58 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, |
59 | (unsigned char *)sec, | |
60 | (size_t)slen); | |
61 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
62 | (void *)seed1, (size_t)seed1_len); | |
63 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
64 | (void *)seed2, (size_t)seed2_len); | |
65 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
66 | (void *)seed3, (size_t)seed3_len); | |
67 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
68 | (void *)seed4, (size_t)seed4_len); | |
69 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
70 | (void *)seed5, (size_t)seed5_len); | |
71 | *p = OSSL_PARAM_construct_end(); | |
5cceedb5 | 72 | if (EVP_KDF_derive(kctx, out, olen, params)) { |
660c5344 | 73 | EVP_KDF_CTX_free(kctx); |
ce3b1bb4 | 74 | return 1; |
d4d2f3a4 | 75 | } |
b7d60e76 | 76 | |
a230b26e | 77 | err: |
ce3b1bb4 | 78 | if (fatal) |
c48ffbcc | 79 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
ce3b1bb4 | 80 | else |
6849b73c | 81 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
660c5344 | 82 | EVP_KDF_CTX_free(kctx); |
ce3b1bb4 | 83 | return 0; |
81025661 | 84 | } |
0f113f3e | 85 | |
8c1a5343 | 86 | static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) |
0f113f3e MC |
87 | { |
88 | int ret; | |
d4d2f3a4 MC |
89 | |
90 | /* Calls SSLfatal() as required */ | |
28ba2541 | 91 | ret = tls1_PRF(s, |
0f113f3e | 92 | TLS_MD_KEY_EXPANSION_CONST, |
555cbb32 TS |
93 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random, |
94 | SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE, | |
0f113f3e | 95 | NULL, 0, NULL, 0, s->session->master_key, |
d4d2f3a4 | 96 | s->session->master_key_length, km, num, 1); |
55a9a16f | 97 | |
0f113f3e MC |
98 | return ret; |
99 | } | |
58964a49 | 100 | |
c35e921f BP |
101 | #ifndef OPENSSL_NO_KTLS |
102 | /* | |
103 | * Count the number of records that were not processed yet from record boundary. | |
104 | * | |
105 | * This function assumes that there are only fully formed records read in the | |
106 | * record layer. If read_ahead is enabled, then this might be false and this | |
107 | * function will fail. | |
108 | */ | |
4ffccf6c | 109 | # ifndef OPENSSL_NO_KTLS_RX |
c35e921f BP |
110 | static int count_unprocessed_records(SSL *s) |
111 | { | |
112 | SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); | |
113 | PACKET pkt, subpkt; | |
114 | int count = 0; | |
115 | ||
116 | if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left)) | |
117 | return -1; | |
118 | ||
119 | while (PACKET_remaining(&pkt) > 0) { | |
120 | /* Skip record type and version */ | |
121 | if (!PACKET_forward(&pkt, 3)) | |
122 | return -1; | |
123 | ||
124 | /* Read until next record */ | |
125 | if (PACKET_get_length_prefixed_2(&pkt, &subpkt)) | |
126 | return -1; | |
127 | ||
128 | count += 1; | |
129 | } | |
130 | ||
131 | return count; | |
132 | } | |
4ffccf6c | 133 | # endif |
c35e921f BP |
134 | #endif |
135 | ||
b5588178 MC |
136 | |
137 | int tls_provider_set_tls_params(SSL *s, EVP_CIPHER_CTX *ctx, | |
138 | const EVP_CIPHER *ciph, | |
139 | const EVP_MD *md) | |
140 | { | |
141 | /* | |
142 | * Provided cipher, the TLS padding/MAC removal is performed provider | |
143 | * side so we need to tell the ctx about our TLS version and mac size | |
144 | */ | |
145 | OSSL_PARAM params[3], *pprm = params; | |
146 | size_t macsize = 0; | |
147 | int imacsize = -1; | |
148 | ||
149 | if ((EVP_CIPHER_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0 | |
150 | /* | |
151 | * We look at s->ext.use_etm instead of SSL_READ_ETM() or | |
152 | * SSL_WRITE_ETM() because this test applies to both reading | |
153 | * and writing. | |
154 | */ | |
155 | && !s->ext.use_etm) | |
156 | imacsize = EVP_MD_size(md); | |
157 | if (imacsize >= 0) | |
158 | macsize = (size_t)imacsize; | |
159 | ||
160 | *pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION, | |
161 | &s->version); | |
162 | *pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE, | |
163 | &macsize); | |
164 | *pprm = OSSL_PARAM_construct_end(); | |
165 | ||
166 | if (!EVP_CIPHER_CTX_set_params(ctx, params)) { | |
c48ffbcc | 167 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
b5588178 MC |
168 | return 0; |
169 | } | |
170 | ||
171 | return 1; | |
172 | } | |
173 | ||
62f27ab9 MM |
174 | |
175 | static int tls_iv_length_within_key_block(const EVP_CIPHER *c) | |
176 | { | |
177 | /* If GCM/CCM mode only part of IV comes from PRF */ | |
178 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) | |
179 | return EVP_GCM_TLS_FIXED_IV_LEN; | |
180 | else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) | |
181 | return EVP_CCM_TLS_FIXED_IV_LEN; | |
182 | else | |
183 | return EVP_CIPHER_iv_length(c); | |
184 | } | |
185 | ||
6b691a5c | 186 | int tls1_change_cipher_state(SSL *s, int which) |
0f113f3e | 187 | { |
0f113f3e | 188 | unsigned char *p, *mac_secret; |
0f113f3e | 189 | unsigned char *ms, *key, *iv; |
0f113f3e MC |
190 | EVP_CIPHER_CTX *dd; |
191 | const EVP_CIPHER *c; | |
09b6c2ef | 192 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 193 | const SSL_COMP *comp; |
09b6c2ef | 194 | #endif |
0f113f3e MC |
195 | const EVP_MD *m; |
196 | int mac_type; | |
b43d1cbb | 197 | size_t *mac_secret_size; |
0f113f3e MC |
198 | EVP_MD_CTX *mac_ctx; |
199 | EVP_PKEY *mac_key; | |
b43d1cbb | 200 | size_t n, i, j, k, cl; |
0f113f3e | 201 | int reuse_dd = 0; |
50ec7505 | 202 | #ifndef OPENSSL_NO_KTLS |
c34ca13a | 203 | ktls_crypto_info_t crypto_info; |
4ffccf6c VF |
204 | unsigned char *rec_seq; |
205 | void *rl_sequence; | |
3e582606 | 206 | # ifndef OPENSSL_NO_KTLS_RX |
c35e921f BP |
207 | int count_unprocessed; |
208 | int bit; | |
2111f5c2 AG |
209 | # endif |
210 | BIO *bio; | |
50ec7505 | 211 | #endif |
0f113f3e | 212 | |
555cbb32 TS |
213 | c = s->s3.tmp.new_sym_enc; |
214 | m = s->s3.tmp.new_hash; | |
215 | mac_type = s->s3.tmp.new_mac_pkey_type; | |
09b6c2ef | 216 | #ifndef OPENSSL_NO_COMP |
555cbb32 | 217 | comp = s->s3.tmp.new_compression; |
09b6c2ef | 218 | #endif |
58964a49 | 219 | |
0f113f3e | 220 | if (which & SSL3_CC_READ) { |
28a31a0a | 221 | if (s->ext.use_etm) |
555cbb32 | 222 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; |
28a31a0a | 223 | else |
555cbb32 | 224 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; |
28a31a0a | 225 | |
555cbb32 | 226 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
0f113f3e MC |
227 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; |
228 | else | |
229 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
230 | ||
5a5530a2 DB |
231 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) |
232 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_TLSTREE; | |
233 | else | |
234 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_TLSTREE; | |
235 | ||
f63a17d6 | 236 | if (s->enc_read_ctx != NULL) { |
0f113f3e | 237 | reuse_dd = 1; |
f63a17d6 | 238 | } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
c48ffbcc | 239 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e | 240 | goto err; |
f63a17d6 | 241 | } else { |
0f113f3e | 242 | /* |
f430ba31 | 243 | * make sure it's initialised in case we exit later with an error |
0f113f3e | 244 | */ |
846ec07d | 245 | EVP_CIPHER_CTX_reset(s->enc_read_ctx); |
f63a17d6 | 246 | } |
0f113f3e MC |
247 | dd = s->enc_read_ctx; |
248 | mac_ctx = ssl_replace_hash(&s->read_hash, NULL); | |
157af9be | 249 | if (mac_ctx == NULL) { |
c48ffbcc | 250 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
5f3d93e4 | 251 | goto err; |
157af9be | 252 | } |
09b6c2ef | 253 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
254 | COMP_CTX_free(s->expand); |
255 | s->expand = NULL; | |
0f113f3e MC |
256 | if (comp != NULL) { |
257 | s->expand = COMP_CTX_new(comp->method); | |
258 | if (s->expand == NULL) { | |
f63a17d6 | 259 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
f63a17d6 MC |
260 | SSL_R_COMPRESSION_LIBRARY_ERROR); |
261 | goto err; | |
0f113f3e | 262 | } |
0f113f3e | 263 | } |
09b6c2ef | 264 | #endif |
0f113f3e | 265 | /* |
d5d0a1cb | 266 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 267 | */ |
d5d0a1cb | 268 | if (!SSL_IS_DTLS(s)) |
de07f311 | 269 | RECORD_LAYER_reset_read_sequence(&s->rlayer); |
555cbb32 TS |
270 | mac_secret = &(s->s3.read_mac_secret[0]); |
271 | mac_secret_size = &(s->s3.read_mac_secret_size); | |
0f113f3e | 272 | } else { |
7426cd34 | 273 | s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; |
28a31a0a | 274 | if (s->ext.use_etm) |
555cbb32 | 275 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
28a31a0a | 276 | else |
555cbb32 | 277 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
28a31a0a | 278 | |
555cbb32 | 279 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
0f113f3e MC |
280 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; |
281 | else | |
282 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
5a5530a2 DB |
283 | |
284 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) | |
285 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_TLSTREE; | |
286 | else | |
287 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_TLSTREE; | |
f63a17d6 | 288 | if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) { |
0f113f3e | 289 | reuse_dd = 1; |
f63a17d6 | 290 | } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
c48ffbcc | 291 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e | 292 | goto err; |
f63a17d6 | 293 | } |
0f113f3e MC |
294 | dd = s->enc_write_ctx; |
295 | if (SSL_IS_DTLS(s)) { | |
bfb0641f | 296 | mac_ctx = EVP_MD_CTX_new(); |
f63a17d6 | 297 | if (mac_ctx == NULL) { |
c48ffbcc | 298 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e | 299 | goto err; |
f63a17d6 | 300 | } |
0f113f3e | 301 | s->write_hash = mac_ctx; |
5f3d93e4 | 302 | } else { |
0f113f3e | 303 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); |
f63a17d6 | 304 | if (mac_ctx == NULL) { |
c48ffbcc | 305 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
5f3d93e4 | 306 | goto err; |
f63a17d6 | 307 | } |
5f3d93e4 | 308 | } |
09b6c2ef | 309 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
310 | COMP_CTX_free(s->compress); |
311 | s->compress = NULL; | |
0f113f3e MC |
312 | if (comp != NULL) { |
313 | s->compress = COMP_CTX_new(comp->method); | |
314 | if (s->compress == NULL) { | |
f63a17d6 | 315 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
c48ffbcc | 316 | SSL_R_COMPRESSION_LIBRARY_ERROR); |
f63a17d6 | 317 | goto err; |
0f113f3e MC |
318 | } |
319 | } | |
09b6c2ef | 320 | #endif |
0f113f3e | 321 | /* |
d5d0a1cb | 322 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 323 | */ |
d5d0a1cb | 324 | if (!SSL_IS_DTLS(s)) |
de07f311 | 325 | RECORD_LAYER_reset_write_sequence(&s->rlayer); |
555cbb32 TS |
326 | mac_secret = &(s->s3.write_mac_secret[0]); |
327 | mac_secret_size = &(s->s3.write_mac_secret_size); | |
0f113f3e MC |
328 | } |
329 | ||
330 | if (reuse_dd) | |
846ec07d | 331 | EVP_CIPHER_CTX_reset(dd); |
0f113f3e | 332 | |
555cbb32 TS |
333 | p = s->s3.tmp.key_block; |
334 | i = *mac_secret_size = s->s3.tmp.new_mac_secret_size; | |
0f113f3e | 335 | |
b43d1cbb | 336 | /* TODO(size_t): convert me */ |
0f113f3e | 337 | cl = EVP_CIPHER_key_length(c); |
361a1191 | 338 | j = cl; |
62f27ab9 | 339 | k = tls_iv_length_within_key_block(c); |
0f113f3e MC |
340 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || |
341 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
342 | ms = &(p[0]); | |
343 | n = i + i; | |
344 | key = &(p[n]); | |
345 | n += j + j; | |
346 | iv = &(p[n]); | |
347 | n += k + k; | |
0f113f3e MC |
348 | } else { |
349 | n = i; | |
350 | ms = &(p[n]); | |
351 | n += i + j; | |
352 | key = &(p[n]); | |
353 | n += j + k; | |
354 | iv = &(p[n]); | |
355 | n += k; | |
0f113f3e MC |
356 | } |
357 | ||
555cbb32 | 358 | if (n > s->s3.tmp.key_block_length) { |
c48ffbcc | 359 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 360 | goto err; |
0f113f3e MC |
361 | } |
362 | ||
363 | memcpy(mac_secret, ms, i); | |
364 | ||
365 | if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { | |
6f0bd6ca | 366 | if (mac_type == EVP_PKEY_HMAC) { |
d8652be0 MC |
367 | mac_key = EVP_PKEY_new_raw_private_key_ex(s->ctx->libctx, "HMAC", |
368 | s->ctx->propq, mac_secret, | |
369 | *mac_secret_size); | |
6f0bd6ca MC |
370 | } else { |
371 | /* | |
372 | * If its not HMAC then the only other types of MAC we support are | |
373 | * the GOST MACs, so we need to use the old style way of creating | |
374 | * a MAC key. | |
375 | */ | |
376 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, | |
377 | (int)*mac_secret_size); | |
378 | } | |
5f3d93e4 | 379 | if (mac_key == NULL |
d8652be0 | 380 | || EVP_DigestSignInit_ex(mac_ctx, NULL, EVP_MD_name(m), |
d38b6ae9 P |
381 | s->ctx->libctx, s->ctx->propq, mac_key, |
382 | NULL) <= 0) { | |
5f3d93e4 | 383 | EVP_PKEY_free(mac_key); |
c48ffbcc | 384 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 385 | goto err; |
5f3d93e4 | 386 | } |
0f113f3e MC |
387 | EVP_PKEY_free(mac_key); |
388 | } | |
49b26f54 RL |
389 | |
390 | OSSL_TRACE_BEGIN(TLS) { | |
391 | BIO_printf(trc_out, "which = %04X, mac key:\n", which); | |
392 | BIO_dump_indent(trc_out, ms, i, 4); | |
393 | } OSSL_TRACE_END(TLS); | |
0f113f3e MC |
394 | |
395 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { | |
eadf70d2 | 396 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) |
348240c6 MC |
397 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, |
398 | iv)) { | |
c48ffbcc | 399 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 400 | goto err; |
eadf70d2 | 401 | } |
e75c5a79 | 402 | } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { |
3d3701ea | 403 | int taglen; |
555cbb32 | 404 | if (s->s3.tmp. |
a230b26e | 405 | new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) |
ec07b1d8 | 406 | taglen = EVP_CCM8_TLS_TAG_LEN; |
3d3701ea | 407 | else |
ec07b1d8 | 408 | taglen = EVP_CCM_TLS_TAG_LEN; |
e75c5a79 DSH |
409 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) |
410 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) | |
411 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) | |
348240c6 | 412 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) |
e75c5a79 | 413 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { |
c48ffbcc | 414 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 415 | goto err; |
e75c5a79 | 416 | } |
eadf70d2 MC |
417 | } else { |
418 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
c48ffbcc | 419 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 420 | goto err; |
eadf70d2 MC |
421 | } |
422 | } | |
0f113f3e | 423 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ |
eadf70d2 MC |
424 | if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size |
425 | && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, | |
348240c6 | 426 | (int)*mac_secret_size, mac_secret)) { |
c48ffbcc | 427 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 428 | goto err; |
eadf70d2 | 429 | } |
b5588178 MC |
430 | if (EVP_CIPHER_provider(c) != NULL |
431 | && !tls_provider_set_tls_params(s, dd, c, m)) { | |
432 | /* SSLfatal already called */ | |
433 | goto err; | |
524cb684 | 434 | } |
b5588178 | 435 | |
50ec7505 BP |
436 | #ifndef OPENSSL_NO_KTLS |
437 | if (s->compress) | |
438 | goto skip_ktls; | |
439 | ||
c35e921f BP |
440 | if (((which & SSL3_CC_READ) && (s->mode & SSL_MODE_NO_KTLS_RX)) |
441 | || ((which & SSL3_CC_WRITE) && (s->mode & SSL_MODE_NO_KTLS_TX))) | |
50ec7505 BP |
442 | goto skip_ktls; |
443 | ||
444 | /* ktls supports only the maximum fragment size */ | |
445 | if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH) | |
446 | goto skip_ktls; | |
447 | ||
4ffccf6c | 448 | /* check that cipher is supported */ |
3e582606 | 449 | if (!ktls_check_supported_cipher(s, c, dd)) |
50ec7505 BP |
450 | goto skip_ktls; |
451 | ||
c35e921f BP |
452 | if (which & SSL3_CC_WRITE) |
453 | bio = s->wbio; | |
454 | else | |
455 | bio = s->rbio; | |
456 | ||
457 | if (!ossl_assert(bio != NULL)) { | |
c48ffbcc | 458 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
50ec7505 BP |
459 | goto err; |
460 | } | |
461 | ||
462 | /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */ | |
c35e921f BP |
463 | if (which & SSL3_CC_WRITE) { |
464 | if (BIO_flush(bio) <= 0) | |
465 | goto skip_ktls; | |
466 | } | |
50ec7505 BP |
467 | |
468 | /* ktls doesn't support renegotiation */ | |
c35e921f BP |
469 | if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) || |
470 | (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) { | |
c48ffbcc | 471 | SSLfatal(s, SSL_AD_NO_RENEGOTIATION, ERR_R_INTERNAL_ERROR); |
50ec7505 BP |
472 | goto err; |
473 | } | |
474 | ||
c35e921f | 475 | if (which & SSL3_CC_WRITE) |
4ffccf6c | 476 | rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer); |
c35e921f | 477 | else |
4ffccf6c VF |
478 | rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer); |
479 | ||
3e582606 JB |
480 | if (!ktls_configure_crypto(s, c, dd, rl_sequence, &crypto_info, &rec_seq, |
481 | iv, key, ms, *mac_secret_size)) | |
4ffccf6c | 482 | goto skip_ktls; |
c35e921f BP |
483 | |
484 | if (which & SSL3_CC_READ) { | |
3e582606 | 485 | # ifndef OPENSSL_NO_KTLS_RX |
c35e921f BP |
486 | count_unprocessed = count_unprocessed_records(s); |
487 | if (count_unprocessed < 0) | |
488 | goto skip_ktls; | |
489 | ||
490 | /* increment the crypto_info record sequence */ | |
491 | while (count_unprocessed) { | |
492 | for (bit = 7; bit >= 0; bit--) { /* increment */ | |
4ffccf6c VF |
493 | ++rec_seq[bit]; |
494 | if (rec_seq[bit] != 0) | |
c35e921f BP |
495 | break; |
496 | } | |
497 | count_unprocessed--; | |
498 | } | |
3e582606 | 499 | # else |
4ffccf6c | 500 | goto skip_ktls; |
3e582606 | 501 | # endif |
c35e921f | 502 | } |
50ec7505 BP |
503 | |
504 | /* ktls works with user provided buffers directly */ | |
c35e921f BP |
505 | if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) { |
506 | if (which & SSL3_CC_WRITE) | |
507 | ssl3_release_write_buffer(s); | |
50ec7505 BP |
508 | SSL_set_options(s, SSL_OP_NO_RENEGOTIATION); |
509 | } | |
510 | ||
511 | skip_ktls: | |
512 | #endif /* OPENSSL_NO_KTLS */ | |
7426cd34 | 513 | s->statem.enc_write_state = ENC_WRITE_STATE_VALID; |
1cf218bc | 514 | |
49b26f54 RL |
515 | OSSL_TRACE_BEGIN(TLS) { |
516 | BIO_printf(trc_out, "which = %04X, key:\n", which); | |
517 | BIO_dump_indent(trc_out, key, EVP_CIPHER_key_length(c), 4); | |
518 | BIO_printf(trc_out, "iv:\n"); | |
519 | BIO_dump_indent(trc_out, iv, k, 4); | |
520 | } OSSL_TRACE_END(TLS); | |
58964a49 | 521 | |
208fb891 | 522 | return 1; |
0f113f3e | 523 | err: |
26a7d938 | 524 | return 0; |
0f113f3e | 525 | } |
58964a49 | 526 | |
6b691a5c | 527 | int tls1_setup_key_block(SSL *s) |
0f113f3e | 528 | { |
b7d60e76 | 529 | unsigned char *p; |
0f113f3e MC |
530 | const EVP_CIPHER *c; |
531 | const EVP_MD *hash; | |
0f113f3e | 532 | SSL_COMP *comp; |
8c1a5343 MC |
533 | int mac_type = NID_undef; |
534 | size_t num, mac_secret_size = 0; | |
0f113f3e | 535 | int ret = 0; |
58964a49 | 536 | |
555cbb32 | 537 | if (s->s3.tmp.key_block_length != 0) |
208fb891 | 538 | return 1; |
0f113f3e | 539 | |
c8f6c28a MC |
540 | if (!ssl_cipher_get_evp(s->ctx, s->session, &c, &hash, &mac_type, |
541 | &mac_secret_size, &comp, s->ext.use_etm)) { | |
5a2d0ef3 RL |
542 | /* Error is already recorded */ |
543 | SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); | |
26a7d938 | 544 | return 0; |
0f113f3e MC |
545 | } |
546 | ||
c8f6c28a | 547 | ssl_evp_cipher_free(s->s3.tmp.new_sym_enc); |
555cbb32 | 548 | s->s3.tmp.new_sym_enc = c; |
c8f6c28a | 549 | ssl_evp_md_free(s->s3.tmp.new_hash); |
555cbb32 TS |
550 | s->s3.tmp.new_hash = hash; |
551 | s->s3.tmp.new_mac_pkey_type = mac_type; | |
552 | s->s3.tmp.new_mac_secret_size = mac_secret_size; | |
62f27ab9 | 553 | num = mac_secret_size + EVP_CIPHER_key_length(c) + tls_iv_length_within_key_block(c); |
0f113f3e MC |
554 | num *= 2; |
555 | ||
556 | ssl3_cleanup_key_block(s); | |
557 | ||
b7d60e76 | 558 | if ((p = OPENSSL_malloc(num)) == NULL) { |
c48ffbcc | 559 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
560 | goto err; |
561 | } | |
562 | ||
555cbb32 TS |
563 | s->s3.tmp.key_block_length = num; |
564 | s->s3.tmp.key_block = p; | |
0f113f3e | 565 | |
49b26f54 | 566 | OSSL_TRACE_BEGIN(TLS) { |
62f27ab9 | 567 | BIO_printf(trc_out, "key block length: %ld\n", num); |
49b26f54 | 568 | BIO_printf(trc_out, "client random\n"); |
555cbb32 | 569 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 | 570 | BIO_printf(trc_out, "server random\n"); |
555cbb32 | 571 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 RL |
572 | BIO_printf(trc_out, "master key\n"); |
573 | BIO_dump_indent(trc_out, | |
574 | s->session->master_key, | |
575 | s->session->master_key_length, 4); | |
576 | } OSSL_TRACE_END(TLS); | |
577 | ||
d4d2f3a4 MC |
578 | if (!tls1_generate_key_block(s, p, num)) { |
579 | /* SSLfatal() already called */ | |
0f113f3e | 580 | goto err; |
d4d2f3a4 | 581 | } |
49b26f54 RL |
582 | |
583 | OSSL_TRACE_BEGIN(TLS) { | |
584 | BIO_printf(trc_out, "key block\n"); | |
585 | BIO_dump_indent(trc_out, p, num, 4); | |
586 | } OSSL_TRACE_END(TLS); | |
58964a49 | 587 | |
0f113f3e MC |
588 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
589 | && s->method->version <= TLS1_VERSION) { | |
590 | /* | |
591 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
592 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
593 | */ | |
555cbb32 | 594 | s->s3.need_empty_fragments = 1; |
0f113f3e MC |
595 | |
596 | if (s->session->cipher != NULL) { | |
597 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
555cbb32 | 598 | s->s3.need_empty_fragments = 0; |
0f113f3e | 599 | |
0f113f3e | 600 | if (s->session->cipher->algorithm_enc == SSL_RC4) |
555cbb32 | 601 | s->s3.need_empty_fragments = 0; |
0f113f3e MC |
602 | } |
603 | } | |
604 | ||
605 | ret = 1; | |
606 | err: | |
26a7d938 | 607 | return ret; |
0f113f3e | 608 | } |
58964a49 | 609 | |
6db6bc5a MC |
610 | size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, |
611 | unsigned char *out) | |
0f113f3e | 612 | { |
8c1a5343 | 613 | size_t hashlen; |
28ba2541 | 614 | unsigned char hash[EVP_MAX_MD_SIZE]; |
5a5530a2 DB |
615 | size_t finished_size = TLS1_FINISH_MAC_LENGTH; |
616 | ||
617 | if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kGOST18) | |
618 | finished_size = 32; | |
0f113f3e | 619 | |
d4d2f3a4 MC |
620 | if (!ssl3_digest_cached_records(s, 0)) { |
621 | /* SSLfatal() already called */ | |
124037fd | 622 | return 0; |
d4d2f3a4 | 623 | } |
0f113f3e | 624 | |
d4d2f3a4 MC |
625 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
626 | /* SSLfatal() already called */ | |
48fbcbac | 627 | return 0; |
d4d2f3a4 | 628 | } |
0f113f3e | 629 | |
b7d60e76 | 630 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
0f113f3e | 631 | s->session->master_key, s->session->master_key_length, |
5a5530a2 | 632 | out, finished_size, 1)) { |
d4d2f3a4 | 633 | /* SSLfatal() already called */ |
0f113f3e | 634 | return 0; |
d4d2f3a4 | 635 | } |
c9dd49a7 | 636 | OPENSSL_cleanse(hash, hashlen); |
5a5530a2 | 637 | return finished_size; |
0f113f3e | 638 | } |
58964a49 | 639 | |
6b691a5c | 640 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, |
8c1a5343 | 641 | size_t len, size_t *secret_size) |
0f113f3e | 642 | { |
329114f9 | 643 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
0cfb0e75 | 644 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
8c1a5343 | 645 | size_t hashlen; |
a230b26e | 646 | /* |
79c44b4e | 647 | * Digest cached records keeping record buffer (if present): this won't |
a230b26e EK |
648 | * affect client auth because we're freezing the buffer at the same |
649 | * point (after client key exchange and before certificate verify) | |
124037fd | 650 | */ |
f63a17d6 MC |
651 | if (!ssl3_digest_cached_records(s, 1) |
652 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { | |
653 | /* SSLfatal() already called */ | |
8c1a5343 | 654 | return 0; |
f63a17d6 | 655 | } |
49b26f54 RL |
656 | OSSL_TRACE_BEGIN(TLS) { |
657 | BIO_printf(trc_out, "Handshake hashes:\n"); | |
658 | BIO_dump(trc_out, (char *)hash, hashlen); | |
659 | } OSSL_TRACE_END(TLS); | |
d4d2f3a4 MC |
660 | if (!tls1_PRF(s, |
661 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
662 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
663 | hash, hashlen, | |
664 | NULL, 0, | |
665 | NULL, 0, | |
666 | NULL, 0, p, len, out, | |
667 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
668 | /* SSLfatal() already called */ | |
669 | return 0; | |
670 | } | |
0cfb0e75 DSH |
671 | OPENSSL_cleanse(hash, hashlen); |
672 | } else { | |
d4d2f3a4 MC |
673 | if (!tls1_PRF(s, |
674 | TLS_MD_MASTER_SECRET_CONST, | |
675 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
555cbb32 | 676 | s->s3.client_random, SSL3_RANDOM_SIZE, |
d4d2f3a4 | 677 | NULL, 0, |
555cbb32 | 678 | s->s3.server_random, SSL3_RANDOM_SIZE, |
d4d2f3a4 MC |
679 | NULL, 0, p, len, out, |
680 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
681 | /* SSLfatal() already called */ | |
682 | return 0; | |
683 | } | |
0cfb0e75 | 684 | } |
49b26f54 RL |
685 | |
686 | OSSL_TRACE_BEGIN(TLS) { | |
687 | BIO_printf(trc_out, "Premaster Secret:\n"); | |
688 | BIO_dump_indent(trc_out, p, len, 4); | |
689 | BIO_printf(trc_out, "Client Random:\n"); | |
555cbb32 | 690 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 | 691 | BIO_printf(trc_out, "Server Random:\n"); |
555cbb32 | 692 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 RL |
693 | BIO_printf(trc_out, "Master Secret:\n"); |
694 | BIO_dump_indent(trc_out, | |
695 | s->session->master_key, | |
696 | SSL3_MASTER_SECRET_SIZE, 4); | |
697 | } OSSL_TRACE_END(TLS); | |
761772d7 | 698 | |
8c1a5343 MC |
699 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
700 | return 1; | |
0f113f3e | 701 | } |
58964a49 | 702 | |
74b4b494 | 703 | int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, |
0f113f3e MC |
704 | const char *label, size_t llen, |
705 | const unsigned char *context, | |
706 | size_t contextlen, int use_context) | |
707 | { | |
0f113f3e | 708 | unsigned char *val = NULL; |
1c8a527c | 709 | size_t vallen = 0, currentvalpos; |
0f113f3e | 710 | int rv; |
e0af0405 | 711 | |
0f113f3e MC |
712 | /* |
713 | * construct PRF arguments we construct the PRF argument ourself rather | |
714 | * than passing separate values into the TLS PRF to ensure that the | |
715 | * concatenation of values does not create a prohibited label. | |
716 | */ | |
717 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
718 | if (use_context) { | |
719 | vallen += 2 + contextlen; | |
720 | } | |
721 | ||
722 | val = OPENSSL_malloc(vallen); | |
723 | if (val == NULL) | |
724 | goto err2; | |
725 | currentvalpos = 0; | |
726 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
727 | currentvalpos += llen; | |
555cbb32 | 728 | memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE); |
0f113f3e | 729 | currentvalpos += SSL3_RANDOM_SIZE; |
555cbb32 | 730 | memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE); |
0f113f3e MC |
731 | currentvalpos += SSL3_RANDOM_SIZE; |
732 | ||
733 | if (use_context) { | |
734 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
735 | currentvalpos++; | |
736 | val[currentvalpos] = contextlen & 0xff; | |
737 | currentvalpos++; | |
738 | if ((contextlen > 0) || (context != NULL)) { | |
739 | memcpy(val + currentvalpos, context, contextlen); | |
740 | } | |
741 | } | |
742 | ||
743 | /* | |
744 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
745 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
746 | * the comparisons won't have buffer overflow | |
747 | */ | |
748 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
749 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
750 | goto err1; | |
751 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
752 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
753 | goto err1; | |
754 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
755 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
756 | goto err1; | |
0cfb0e75 DSH |
757 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
758 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
759 | goto err1; | |
0f113f3e MC |
760 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
761 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
762 | goto err1; | |
763 | ||
28ba2541 | 764 | rv = tls1_PRF(s, |
0f113f3e MC |
765 | val, vallen, |
766 | NULL, 0, | |
767 | NULL, 0, | |
768 | NULL, 0, | |
769 | NULL, 0, | |
770 | s->session->master_key, s->session->master_key_length, | |
d4d2f3a4 | 771 | out, olen, 0); |
e0af0405 | 772 | |
0f113f3e MC |
773 | goto ret; |
774 | err1: | |
6849b73c | 775 | ERR_raise(ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
0f113f3e MC |
776 | rv = 0; |
777 | goto ret; | |
778 | err2: | |
6849b73c | 779 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
780 | rv = 0; |
781 | ret: | |
05c7b163 | 782 | OPENSSL_clear_free(val, vallen); |
26a7d938 | 783 | return rv; |
0f113f3e | 784 | } |
e0af0405 | 785 | |
6b691a5c | 786 | int tls1_alert_code(int code) |
0f113f3e MC |
787 | { |
788 | switch (code) { | |
789 | case SSL_AD_CLOSE_NOTIFY: | |
26a7d938 | 790 | return SSL3_AD_CLOSE_NOTIFY; |
0f113f3e | 791 | case SSL_AD_UNEXPECTED_MESSAGE: |
26a7d938 | 792 | return SSL3_AD_UNEXPECTED_MESSAGE; |
0f113f3e | 793 | case SSL_AD_BAD_RECORD_MAC: |
26a7d938 | 794 | return SSL3_AD_BAD_RECORD_MAC; |
0f113f3e | 795 | case SSL_AD_DECRYPTION_FAILED: |
26a7d938 | 796 | return TLS1_AD_DECRYPTION_FAILED; |
0f113f3e | 797 | case SSL_AD_RECORD_OVERFLOW: |
26a7d938 | 798 | return TLS1_AD_RECORD_OVERFLOW; |
0f113f3e | 799 | case SSL_AD_DECOMPRESSION_FAILURE: |
26a7d938 | 800 | return SSL3_AD_DECOMPRESSION_FAILURE; |
0f113f3e | 801 | case SSL_AD_HANDSHAKE_FAILURE: |
26a7d938 | 802 | return SSL3_AD_HANDSHAKE_FAILURE; |
0f113f3e | 803 | case SSL_AD_NO_CERTIFICATE: |
26a7d938 | 804 | return -1; |
0f113f3e | 805 | case SSL_AD_BAD_CERTIFICATE: |
26a7d938 | 806 | return SSL3_AD_BAD_CERTIFICATE; |
0f113f3e | 807 | case SSL_AD_UNSUPPORTED_CERTIFICATE: |
26a7d938 | 808 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; |
0f113f3e | 809 | case SSL_AD_CERTIFICATE_REVOKED: |
26a7d938 | 810 | return SSL3_AD_CERTIFICATE_REVOKED; |
0f113f3e | 811 | case SSL_AD_CERTIFICATE_EXPIRED: |
26a7d938 | 812 | return SSL3_AD_CERTIFICATE_EXPIRED; |
0f113f3e | 813 | case SSL_AD_CERTIFICATE_UNKNOWN: |
26a7d938 | 814 | return SSL3_AD_CERTIFICATE_UNKNOWN; |
0f113f3e | 815 | case SSL_AD_ILLEGAL_PARAMETER: |
26a7d938 | 816 | return SSL3_AD_ILLEGAL_PARAMETER; |
0f113f3e | 817 | case SSL_AD_UNKNOWN_CA: |
26a7d938 | 818 | return TLS1_AD_UNKNOWN_CA; |
0f113f3e | 819 | case SSL_AD_ACCESS_DENIED: |
26a7d938 | 820 | return TLS1_AD_ACCESS_DENIED; |
0f113f3e | 821 | case SSL_AD_DECODE_ERROR: |
26a7d938 | 822 | return TLS1_AD_DECODE_ERROR; |
0f113f3e | 823 | case SSL_AD_DECRYPT_ERROR: |
26a7d938 | 824 | return TLS1_AD_DECRYPT_ERROR; |
0f113f3e | 825 | case SSL_AD_EXPORT_RESTRICTION: |
26a7d938 | 826 | return TLS1_AD_EXPORT_RESTRICTION; |
0f113f3e | 827 | case SSL_AD_PROTOCOL_VERSION: |
26a7d938 | 828 | return TLS1_AD_PROTOCOL_VERSION; |
0f113f3e | 829 | case SSL_AD_INSUFFICIENT_SECURITY: |
26a7d938 | 830 | return TLS1_AD_INSUFFICIENT_SECURITY; |
0f113f3e | 831 | case SSL_AD_INTERNAL_ERROR: |
26a7d938 | 832 | return TLS1_AD_INTERNAL_ERROR; |
0f113f3e | 833 | case SSL_AD_USER_CANCELLED: |
26a7d938 | 834 | return TLS1_AD_USER_CANCELLED; |
0f113f3e | 835 | case SSL_AD_NO_RENEGOTIATION: |
26a7d938 | 836 | return TLS1_AD_NO_RENEGOTIATION; |
0f113f3e | 837 | case SSL_AD_UNSUPPORTED_EXTENSION: |
26a7d938 | 838 | return TLS1_AD_UNSUPPORTED_EXTENSION; |
0f113f3e | 839 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: |
26a7d938 | 840 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; |
0f113f3e | 841 | case SSL_AD_UNRECOGNIZED_NAME: |
26a7d938 | 842 | return TLS1_AD_UNRECOGNIZED_NAME; |
0f113f3e | 843 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: |
26a7d938 | 844 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; |
0f113f3e | 845 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: |
26a7d938 | 846 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; |
0f113f3e | 847 | case SSL_AD_UNKNOWN_PSK_IDENTITY: |
26a7d938 | 848 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; |
0f113f3e | 849 | case SSL_AD_INAPPROPRIATE_FALLBACK: |
26a7d938 | 850 | return TLS1_AD_INAPPROPRIATE_FALLBACK; |
06217867 | 851 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
26a7d938 | 852 | return TLS1_AD_NO_APPLICATION_PROTOCOL; |
42c28b63 MC |
853 | case SSL_AD_CERTIFICATE_REQUIRED: |
854 | return SSL_AD_HANDSHAKE_FAILURE; | |
0f113f3e | 855 | default: |
26a7d938 | 856 | return -1; |
0f113f3e MC |
857 | } |
858 | } |