#include <config.h>
-#include <assert.h>
#ifdef STDC_HEADERS
# include <string.h>
if (sizeofdata == 0)
return 0;
if (state->gnutls_internals.valid_connection == VALID_FALSE) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_INVALID_SESSION;
}
if (Write(cd, &gcipher->type, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, &gcipher->version.major, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, &gcipher->version.minor, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
#ifdef HARD_DEBUG
if (Write(cd, &length, sizeof(uint16)) != sizeof(uint16)) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, gcipher->fragment, gcipher->length) != gcipher->length) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
state->connection_state.write_sequence_number++;
if (Write(cd, &gcipher->type, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, &gcipher->version.major, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, &gcipher->version.minor, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, &length, sizeof(uint16)) != sizeof(uint16)) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
if (Write(cd, gcipher->fragment, gcipher->length) != gcipher->length) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNABLE_SEND_DATA;
}
state->connection_state.write_sequence_number++;
}
if (state->gnutls_internals.valid_connection == VALID_FALSE) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_INVALID_SESSION;
}
if (Read(cd, &gcipher.type, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
if (Read(cd, &gcipher.version.major, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
if (Read(cd, &gcipher.version.minor, 1) != 1) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
#endif
_gnutls_send_alert(cd, state, GNUTLS_FATAL, GNUTLS_PROTOCOL_VERSION);
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
}
if (Read(cd, &gcipher.length, 2) != 2) {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
#ifndef WORDS_BIGENDIAN
_gnutls_send_alert(cd, state, GNUTLS_FATAL, GNUTLS_RECORD_OVERFLOW);
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
gcipher.fragment = gnutls_malloc(gcipher.length);
gnutls_free(gcipher.fragment);
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
case GNUTLS_CHANGE_CIPHER_SPEC:
if (type != GNUTLS_CHANGE_CIPHER_SPEC) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET;
}
if (((ChangeCipherSpecType)
} else {
state->gnutls_internals.valid_connection = VALID_FALSE;
state->gnutls_internals.resumable = RESUME_FALSE;
- assert(0);
+ gnutls_assert();
ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
state->connection_state.read_sequence_number++;
return ret;
default:
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_ERROR;
}
}
gnutls_free(tmpdata);
} else {
if (gcipher.type != type) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_RECEIVED_BAD_MESSAGE;
}
/* this is an error because we have messages of fixed
static gnutls_cipher_entry algorithms[] = {
GNUTLS_CIPHER_ENTRY(GNUTLS_3DES, 8, 24, 1, 8, -1),
- GNUTLS_CIPHER_ENTRY(GNUTLS_ARCFOUR, 1, 16, 0, 0, -1),
+ GNUTLS_CIPHER_ENTRY(GNUTLS_ARCFOUR, 1, 16, 0, 0, -2),
GNUTLS_CIPHER_ENTRY(GNUTLS_NULL, 1, 0, 0, 0, -1),
{0}
};
static gnutls_kx_algo_entry kx_algorithms[] = {
GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_ANON_DH, 0, 1, 0, 0, 1, -1),
- GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_RSA, 1, 0, 1, 1, 0, -1),
+ GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_RSA, 1, 0, 1, 1, 0, -2),
GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_DSS, 1, 1, 1, 0, 0, -1),
- GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_RSA, 1, 1, 1, 0, 0, -1),
- GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_DSS, 1, 0, 1, 0, 0, -1),
- GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_RSA, 1, 0, 1, 0, 0, -1),
+ GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_RSA, 1, 1, 1, 0, 0, -2),
+ GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_DSS, 1, 0, 1, 0, 0, -2),
+ GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_RSA, 1, 0, 1, 0, 0, -2),
{0}
};
void _gnutls_mac_set_priority(MACAlgorithm algorithm, int prio)
{
- GNUTLS_HASH_ALG_LOOP(p->priority=prio);
+ GNUTLS_HASH_ALG_LOOP( if (p->priority >= -1) p->priority=prio);
}
int _gnutls_mac_priority(MACAlgorithm algorithm) /* actually returns the priority */
void _gnutls_cipher_set_priority(BulkCipherAlgorithm algorithm, int prio)
{
- GNUTLS_ALG_LOOP(p->priority=prio);
+ GNUTLS_ALG_LOOP(if (p->priority >= -1) p->priority=prio);
}
/* returns the priority */
void _gnutls_kx_set_priority(KXAlgorithm algorithm, int prio)
{
- GNUTLS_KX_ALG_LOOP(p->priority=prio);
+ GNUTLS_KX_ALG_LOOP(if (p->priority >= -1) p->priority=prio);
}
size_t left;
ssize_t i=0;
char *ptr = iptr;
+#ifdef DEBUG
+ int j,x, sum=0;
+#endif
+
left = sizeOfPtr;
while (left > 0) {
}
+#ifdef DEBUG
+ fprintf(stderr, "read %d bytes from %d\n", (sizeOfPtr-left), fd);
+ for (x=0;x<((sizeOfPtr-left)/16)+1;x++) {
+ fprintf(stderr, "%.4x - ",x);
+ for (j=0;j<16;j++) {
+ if (sum<(sizeOfPtr-left)) {
+ fprintf(stderr, "%.2x ", ((unsigned char*)ptr)[sum++]);
+ }
+ }
+ fprintf(stderr, "\n");
+
+ }
+#endif
+
+
return (sizeOfPtr - left);
}
ssize_t Write(int fd, const void *iptr, size_t n)
{
size_t left;
+#ifdef DEBUG
+ int j,x, sum=0;
+#endif
ssize_t i = 0;
const char *ptr = iptr;
+#ifdef DEBUG
+ fprintf(stderr, "wrote %d bytes to %d\n", n, fd);
+ for (x=0;x<(n/16)+1;x++) {
+ fprintf(stderr, "%.4x - ",x);
+ for (j=0;j<16;j++) {
+ if (sum<n) {
+ fprintf(stderr, "%.2x ", ((unsigned char*)ptr)[sum++]);
+ }
+ }
+ fprintf(stderr, "\n");
+
+ }
+#endif
left = n;
while (left > 0) {
i = write(fd, &ptr[i], left);
{
if (_gnutls_cipher_is_ok(algo) == 0) {
- if (_gnutls_cipher_priority(algo) < 0) return GNUTLS_E_UNWANTED_ALGORITHM;
+ if (_gnutls_cipher_priority(algo) < 0) {
+ gnutls_assert();
+ return GNUTLS_E_UNWANTED_ALGORITHM;
+ }
state->security_parameters.bulk_cipher_algorithm = algo;
if (_gnutls_cipher_is_block(algo) == 1) {
state->security_parameters.IV_size =
_gnutls_cipher_get_iv_size(algo);
} else {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER;
}
break;
default:
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
}
return 0;
if (_gnutls_mac_is_ok(algo) == 0) {
state->security_parameters.mac_algorithm = algo;
} else {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
}
- if (_gnutls_mac_priority(algo) < 0) return GNUTLS_E_UNWANTED_ALGORITHM;
+ if (_gnutls_mac_priority(algo) < 0) {
+ gnutls_assert();
+ return GNUTLS_E_UNWANTED_ALGORITHM;
+ }
state->security_parameters.hash_size = _gnutls_mac_get_digest_size(algo);
return 0;
state->connection_state.write_compression_state = NULL;
break;
default:
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
}
state->connection_state.write_mac_secret = gnutls_malloc(mac_size);
}
} else {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
}
state->cipher_specs.server_write_IV,
state->security_parameters.IV_size);
if (state->connection_state.write_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER;
}
state->cipher_specs.client_write_IV,
state->security_parameters.IV_size);
if (state->connection_state.read_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER;
}
state->cipher_specs.server_write_IV,
state->security_parameters.IV_size);
if (state->connection_state.read_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER;
}
state->cipher_specs.client_write_IV,
state->security_parameters.IV_size);
if (state->connection_state.write_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER;
}
break;
default:
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_ERROR;
}
if (td == GNUTLS_MAC_FAILED && state->security_parameters.mac_algorithm!=GNUTLS_MAC_NULL) {
gnutls_free(*cipher);
gnutls_free(content);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
}
default:
gnutls_free(*cipher);
gnutls_free(content);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
}
if (td==GNUTLS_MAC_FAILED && state->security_parameters.mac_algorithm!=GNUTLS_MAC_NULL) {
gnutls_free(*compress);
gnutls_free(content);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
}
state->connection_state.mac_secret_size - pad -
1;
- if (pad > ciphertext->length - state->connection_state.mac_secret_size)
+ if (pad > ciphertext->length - state->connection_state.mac_secret_size) {
+ gnutls_assert();
return GNUTLS_E_RECEIVED_BAD_MESSAGE;
+ }
data = gnutls_malloc(length);
memmove(data, content, length);
default:
gnutls_free(*compress);
gnutls_free(content);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
}
#ifdef DEBUG
fprintf(stderr, "MAC FAILED\n");
#endif
+ gnutls_assert();
return GNUTLS_E_MAC_FAILED;
}
free( ret);
}
+
+char* gnutls_strerror(int error)
+{
+ char *ret = NULL;
+ char *pointerTo_;
+
+ /* avoid prefix */
+ GNUTLS_ERROR_ALG_LOOP(ret =
+ strdup(p->name + sizeof("GNUTLS_E_") - 1));
+
+
+ if (ret != NULL) {
+ tolow(ret, strlen(ret));
+ pointerTo_ = strchr(ret, '_');
+
+ while (pointerTo_ != NULL) {
+ *pointerTo_ = ' ';
+ pointerTo_ = strchr(ret, '_');
+ }
+ }
+
+ return ret;
+}
+#include "gnutls_int.h"
+
#define GNUTLS_E_MAC_FAILED -1
#define GNUTLS_E_UNKNOWN_CIPHER -2
#define GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM -3
#define GNUTLS_E_UNIMPLEMENTED_FEATURE -50
+#ifdef DEBUG
+# ifdef __FILE__
+# ifdef __LINE__
+# define gnutls_assert() fprintf(stderr, "GNUTLS_ASSERT: %s:%d\n", __FILE__,__LINE__);
+# else
+# define gnutls_assert() 1
+# endif
+# else /* __FILE__ defined */
+# define gnutls_assert() 1
+# endif
+#else /* no debug */
+# define gnutls_assert() 1
+#endif
-
+char* gnutls_strerror(int error);
void gnutls_perror(int error);
int gnutls_is_fatal_error( int error);
return ret;
}
if (vrfysize != 12) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_ERROR_IN_FINISHED_PACKET;
}
}
if (memcmp(vrfy, data, 12) != 0) {
- assert(0);
+ gnutls_assert();
ret = GNUTLS_E_ERROR_IN_FINISHED_PACKET;
}
}
-
+/* This selects the best supported ciphersuite from the ones provided */
int SelectSuite(opaque ret[2], char *data, int datalen)
{
int x, i, j;
gnutls_free(ciphers);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
}
+/* This selects the best supported compression method from the ones provided */
int SelectCompMethod(CompressionMethod * ret, char *data, int datalen)
{
int x, i, j;
x = _gnutls_supported_compression_methods(&ciphers);
memset(ret, '\0', sizeof(CompressionMethod));
-
+fprintf(stderr, "datalen: %d\n",datalen);
for (j = 0; j < datalen; j++) {
for (i = 0; i < x; i++) {
+ fprintf(stderr, "cipher[%d] = %u\n", i, ciphers[i]);
+ fprintf(stderr, "data[%d] = %u\n", j, data[j]);
if (memcmp(&ciphers[i], &data[j], 1) == 0) {
memmove(ret, &ciphers[i], 1);
gnutls_free(ciphers);
gnutls_free(ciphers);
+ gnutls_assert();
return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
}
ret = _gnutls_Recv_int(cd, state, GNUTLS_HANDSHAKE, dataptr, 4);
if (ret < 0) return ret;
if (ret!=4) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
#endif
if (dataptr[0]!=type) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
}
if (state->security_parameters.entity == GNUTLS_CLIENT) {
datalen = 2 + 4 + (session_id_len + 1) + 28 + 3;
+ /* 2 for version, 4 for unix time, 28 for random bytes 2 for cipher suite's
+ * size and 1 for compression method's size
+ */
data = gnutls_malloc(datalen);
data[pos++] = state->connection_state.version.major;
}
pos += session_id_len;
- x = _gnutls_supported_ciphersuites(&cipher_suites);
-
+ x = _gnutls_supported_ciphersuites(&cipher_suites)*sizeof(uint16);
#ifdef WORDS_BIGENDIAN
memmove(&data[pos], &x, sizeof(uint16));
#else
pos += 2;
}
- z =
- _gnutls_supported_compression_methods
+ z = _gnutls_supported_compression_methods
(&compression_methods);
- memmove(&data[pos++], &z, sizeof(uint8));
- datalen += z;
+ memmove(&data[pos++], &z, 1); /* put the number of compression methods */
+ datalen += z;
data = gnutls_realloc(data, datalen);
-
for (i = 0; i < z; i++) {
- memmove(&data[pos], &compression_methods[i], 1);
- pos++;
+ memmove(&data[pos++], &compression_methods[i], 1);
}
gcry_free(rand);
if (state->security_parameters.entity == GNUTLS_CLIENT) {
if (datalen < 38) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
memmove(&session_id_len, &data[pos++], 1);
if (datalen < 38 + session_id_len) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
}
#ifdef HARD_DEBUG
} else { /* Server side reading a client hello */
if (datalen < 35) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
#endif
if ( _gnutls_valid_version( state, data[pos], data[pos+1]) != 0) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
}
pos+=2;
#endif
ret = SelectSuite(state->gnutls_internals.
current_cipher_suite.CipherSuite, &data[pos],
- sizeOfSuites);
+ sizeOfSuites); /* *2 because it's 2 bytes each */
if (ret<0) return ret;
pos += sizeOfSuites;
- memmove(&z, &data[pos++], 1);
+ memmove(&z, &data[pos++], 1); /* z is the number of compression methods */
ret = SelectCompMethod(&state->
gnutls_internals.compression_method,
&data[pos], z);
+ pos+=z;
+
if (ret<0) return ret;
}
if (state->security_parameters.entity == GNUTLS_CLIENT) {
if (datalen < 2) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
sizeOfCert=byteswap32(sizeOfCert);
#endif
if (sizeOfCert > MAX24) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
certificate_list = gnutls_malloc(sizeOfCert);
} else { /* Server side reading a client certificate */
/* actually this is not complete */
if (datalen < 1) {
- assert(0);
+ gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
+#ifndef GNUTLS_INT_H
+
#include <gcrypt.h>
-#undef NDEBUG
+#define GNUTLS_INT_H
+
#define HARD_DEBUG
#define DEBUG
ssize_t gnutls_send_int(int cd, GNUTLS_STATE state, ContentType type, char* data, size_t sizeofdata);
ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char* data, size_t sizeofdata);
int _gnutls_send_change_cipher_spec(int cd, GNUTLS_STATE state);
+
+#endif /* GNUTLS_INT_H */
GNUTLS_MPI x, X, g, p;
int n_X, n_g, n_p;
uint16 _n_X, _n_g, _n_p;
- uint8 *data=NULL;
+ uint8 *data = NULL;
uint8 *data_p;
uint8 *data_g;
uint8 *data_X;
- int ret=0;
+ int ret = 0;
#ifdef HARD_DEBUG
fprintf(stderr, "Sending server KX message\n");
/* Do key exchange only if the algorithm permits it */
if (_gnutls_kx_server_key_exchange(algorithm) != 0) {
-
- if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
+ switch (_gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite)) {
+ case GNUTLS_KX_ANON_DH:
+ case GNUTLS_KX_DHE_DSS:
+ case GNUTLS_KX_DHE_RSA:
X = gnutls_calc_dh_secret(&x);
-
state->gnutls_internals.dh_secret = x;
-
g = gnutls_get_dh_params(&p);
-
- gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
- &n_g, g);
- gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
- &n_p, p);
- gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
- &n_X, X);
- data = gnutls_malloc( n_g+n_p+n_X+6);
-
+ gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_g, g);
+ gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_p, p);
+ gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_X, X);
+ data = gnutls_malloc(n_g + n_p + n_X + 6);
data_p = &data[0];
gcry_mpi_print(GCRYMPI_FMT_STD, &data_p[2],
&n_p, p);
gnutls_mpi_release(p);
-
_n_p = n_p;
-
#ifndef WORDS_BIGENDIAN
_n_p = byteswap16(_n_p);
memmove(data_p, &_n_p, 2);
#else
memmove(data_p, &_n_p, 2);
#endif
-
- data_g = &data_p[2+n_p];
+ data_g = &data_p[2 + n_p];
gcry_mpi_print(GCRYMPI_FMT_STD, &data_g[2],
&n_g, g);
gnutls_mpi_release(g);
_n_g = n_g;
#ifndef WORDS_BIGENDIAN
-
_n_g = byteswap16(_n_g);
memmove(data_g, &_n_g, 2);
#else
memmove(data_g, &_n_g, 2);
#endif
-
- data_X = &data_g[2+n_g];
+ data_X = &data_g[2 + n_g];
gcry_mpi_print(GCRYMPI_FMT_STD, &data_X[2],
&n_X, X);
gnutls_mpi_release(X);
-
_n_X = n_X;
#ifndef WORDS_BIGENDIAN
_n_X = byteswap16(_n_X);
#else
memmove(data_X, &_n_X, 2);
#endif
-
ret =
_gnutls_send_handshake(cd, state, data,
n_p + n_g + n_X + 6,
GNUTLS_SERVER_KEY_EXCHANGE);
gnutls_free(data);
- } else {
+ break;
+ default:
+ gnutls_assert();
ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
}
}
return ret;
-
}
/* This is the function for the client to send the key
int n_X;
uint16 _n_X;
uint8 *data;
- int ret=0;
- uint8 *premaster=NULL;
- int premaster_size=0;
- svoid* master;
- char* random = gnutls_malloc(64);
-
+ int ret = 0;
+ uint8 *premaster = NULL;
+ int premaster_size = 0;
+ svoid *master;
+ char *random = gnutls_malloc(64);
#ifdef HARD_DEBUG
fprintf(stderr, "Sending client KX message\n");
#endif
- memmove( random, state->security_parameters.client_random, 32);
- memmove( &random[32], state->security_parameters.server_random, 32);
-
+ memmove(random, state->security_parameters.client_random, 32);
+ memmove(&random[32], state->security_parameters.server_random, 32);
algorithm =
- _gnutls_cipher_suite_get_kx_algo(state->
- gnutls_internals.current_cipher_suite);
-
- if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
-
-
- X = _gnutls_calc_dh_secret(&x, state->gnutls_internals.client_g, state->gnutls_internals.client_p);
-
- gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
- &n_X, X);
- data = gnutls_malloc(n_X+3);
-
- gcry_mpi_print(GCRYMPI_FMT_STD, &data[3],
- &n_X, X);
-
- data[0] = 1; /* extern */
-
- gnutls_mpi_release(X);
-
- _n_X = n_X;
+ _gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite);
+
+ switch (_gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite)) {
+ case GNUTLS_KX_ANON_DH:
+ case GNUTLS_KX_DHE_DSS:
+ case GNUTLS_KX_DHE_RSA:
+ X =
+ _gnutls_calc_dh_secret(&x,
+ state->
+ gnutls_internals.client_g,
+ state->
+ gnutls_internals.client_p);
+ gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_X, X);
+ data = gnutls_malloc(n_X + 3);
+ gcry_mpi_print(GCRYMPI_FMT_STD, &data[3], &n_X, X);
+ data[0] = 1; /* extern */
+ gnutls_mpi_release(X);
+ _n_X = n_X;
#ifndef WORDS_BIGENDIAN
- _n_X = byteswap16(_n_X);
- memmove(&data[1], &_n_X, 2);
+ _n_X = byteswap16(_n_X);
+ memmove(&data[1], &_n_X, 2);
#else
- memmove(&data[1], &_n_X, 2);
+ memmove(&data[1], &_n_X, 2);
#endif
-
- ret =
- _gnutls_send_handshake(cd, state, data,
- n_X + 3,
- GNUTLS_CLIENT_KEY_EXCHANGE);
- gnutls_free(data);
-
- /* calculate the key after sending the message */
- state->gnutls_internals.KEY = _gnutls_calc_dh_key( state->gnutls_internals.client_Y, x, state->gnutls_internals.client_p);
- gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
- &premaster_size, state->gnutls_internals.KEY);
-
- premaster = secure_malloc( premaster_size);
- gcry_mpi_print(GCRYMPI_FMT_STD, premaster,
- &premaster_size, state->gnutls_internals.KEY);
-
- /* THIS SHOULD BE DISCARDED */
- gnutls_mpi_release(state->gnutls_internals.KEY);
- gnutls_mpi_release(state->gnutls_internals.client_Y);
- gnutls_mpi_release(state->gnutls_internals.client_p);
- gnutls_mpi_release(state->gnutls_internals.client_g);
- state->gnutls_internals.KEY=NULL;
- state->gnutls_internals.client_Y=NULL;
- state->gnutls_internals.client_p=NULL;
- state->gnutls_internals.client_g=NULL;
- } else {
- ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
+ ret =
+ _gnutls_send_handshake(cd, state, data,
+ n_X + 3,
+ GNUTLS_CLIENT_KEY_EXCHANGE);
+ gnutls_free(data);
+ /* calculate the key after sending the message */
+ state->gnutls_internals.KEY =
+ _gnutls_calc_dh_key(state->gnutls_internals.client_Y,
+ x,
+ state->gnutls_internals.client_p);
+ gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &premaster_size,
+ state->gnutls_internals.KEY);
+ premaster = secure_malloc(premaster_size);
+ gcry_mpi_print(GCRYMPI_FMT_STD, premaster,
+ &premaster_size,
+ state->gnutls_internals.KEY);
+ /* THIS SHOULD BE DISCARDED */
+ gnutls_mpi_release(state->gnutls_internals.KEY);
+ gnutls_mpi_release(state->gnutls_internals.client_Y);
+ gnutls_mpi_release(state->gnutls_internals.client_p);
+ gnutls_mpi_release(state->gnutls_internals.client_g);
+ state->gnutls_internals.KEY = NULL;
+ state->gnutls_internals.client_Y = NULL;
+ state->gnutls_internals.client_p = NULL;
+ state->gnutls_internals.client_g = NULL;
+ break;
+ default:
+ gnutls_assert();
+ ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
}
- master = gnutls_PRF( premaster, premaster_size, MASTER_SECRET, strlen(MASTER_SECRET),
- random, 64 ,48);
+ master =
+ gnutls_PRF(premaster, premaster_size,
+ MASTER_SECRET, strlen(MASTER_SECRET), random, 64,
+ 48);
secure_free(premaster);
-
#ifdef HARD_DEBUG
fprintf(stderr, "master secret: %s\n", bin2hex(master, 48));
#endif
- memmove( state->security_parameters.master_secret, master, 48);
-
+ memmove(state->security_parameters.master_secret, master, 48);
secure_free(master);
gnutls_free(random);
-
return ret;
-
}
-/* We have this as an upper limit, since the record layer defines this
- * as a maximum packet length */
int _gnutls_recv_server_kx_message(int cd, GNUTLS_STATE state)
{
uint8 *data_p;
uint8 *data_g;
uint8 *data_Y;
- int ret=0, i;
-
+ int ret = 0, i;
#ifdef HARD_DEBUG
fprintf(stderr, "Receiving Server KX message\n");
#endif
algorithm =
- _gnutls_cipher_suite_get_kx_algo(state->
- gnutls_internals.current_cipher_suite);
-
+ _gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite);
/* Do key exchange only if the algorithm permits it */
if (_gnutls_kx_server_key_exchange(algorithm) != 0) {
- if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
-
- ret = _gnutls_recv_handshake(cd, state, &data, &datasize, GNUTLS_SERVER_KEY_EXCHANGE);
-
- if (ret < 0) return ret;
-
- i=0;
- memmove( &n_p, &data[i], 2);
- i+=2;
-
+ switch (_gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite)) {
+ case GNUTLS_KX_ANON_DH:
+ case GNUTLS_KX_DHE_DSS:
+ case GNUTLS_KX_DHE_RSA:
+ ret =
+ _gnutls_recv_handshake(cd, state, &data,
+ &datasize,
+ GNUTLS_SERVER_KEY_EXCHANGE);
+ if (ret < 0)
+ return ret;
+ i = 0;
+ memmove(&n_p, &data[i], 2);
+ i += 2;
#ifndef WORDS_BIGENDIAN
n_p = byteswap16(n_p);
#endif
data_p = &data[i];
- i+=n_p;
- if (i>datasize) return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-
- memmove( &n_g, &data[i], 2);
+ i += n_p;
+ if (i > datasize) {
+ gnutls_assert();
+ return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+ }
+ memmove(&n_g, &data[i], 2);
#ifndef WORDS_BIGENDIAN
n_g = byteswap16(n_g);
#endif
- i+=2;
+ i += 2;
data_g = &data[i];
- i+=n_g;
- if (i>datasize) return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-
- memmove( &n_Y, &data[i], 2);
- i+=2;
+ i += n_g;
+ if (i > datasize) {
+ gnutls_assert();
+ return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+ }
+ memmove(&n_Y, &data[i], 2);
+ i += 2;
#ifndef WORDS_BIGENDIAN
n_Y = byteswap16(n_Y);
#endif
data_Y = &data[i];
- i+=n_Y;
- if (i>datasize) return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-
+ i += n_Y;
+ if (i > datasize) {
+ gnutls_assert();
+ return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+ }
_n_Y = n_Y;
_n_g = n_g;
_n_p = n_p;
-
- gcry_mpi_scan( &state->gnutls_internals.client_Y, GCRYMPI_FMT_STD, data_Y, &_n_Y);
- gcry_mpi_scan( &state->gnutls_internals.client_g, GCRYMPI_FMT_STD, data_g, &_n_g);
- gcry_mpi_scan( &state->gnutls_internals.client_p, GCRYMPI_FMT_STD, data_p, &_n_p);
+ gcry_mpi_scan(&state->gnutls_internals.client_Y,
+ GCRYMPI_FMT_STD, data_Y, &_n_Y);
+ gcry_mpi_scan(&state->gnutls_internals.client_g,
+ GCRYMPI_FMT_STD, data_g, &_n_g);
+ gcry_mpi_scan(&state->gnutls_internals.client_p,
+ GCRYMPI_FMT_STD, data_p, &_n_p);
gnutls_free(data);
- } else {
+ break;
+ default:
+ gnutls_assert();
ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
}
}
return ret;
-
}
int _gnutls_recv_client_kx_message(int cd, GNUTLS_STATE state)
int _n_Y;
uint8 *data;
int datasize;
- int ret=0;
- uint8 *premaster=NULL;
- int premaster_size=0;
- svoid* master;
- uint8* random = gnutls_malloc(64);
-
+ int ret = 0;
+ uint8 *premaster = NULL;
+ int premaster_size = 0;
+ svoid *master;
+ uint8 *random = gnutls_malloc(64);
#ifdef HARD_DEBUG
fprintf(stderr, "Receiving client KX message\n");
-#endif
- memmove( random, state->security_parameters.client_random, 32);
- memmove( &random[32], state->security_parameters.server_random, 32);
-
+#endif
+ memmove(random, state->security_parameters.client_random, 32);
+ memmove(&random[32], state->security_parameters.server_random, 32);
algorithm =
- _gnutls_cipher_suite_get_kx_algo(state->
- gnutls_internals.current_cipher_suite);
-
+ _gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite);
/* Do key exchange only if the algorithm permits it */
if (_gnutls_kx_server_key_exchange(algorithm) != 0) {
- if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
-
- ret = _gnutls_recv_handshake(cd, state, &data, &datasize, GNUTLS_CLIENT_KEY_EXCHANGE);
- if (ret < 0) return ret;
-
- if ( data[0] != 1) return GNUTLS_E_UNIMPLEMENTED_FEATURE;
-
- memmove( &n_Y, &data[1], 2);
+ switch (_gnutls_cipher_suite_get_kx_algo
+ (state->gnutls_internals.current_cipher_suite)) {
+ case GNUTLS_KX_ANON_DH:
+ case GNUTLS_KX_DHE_DSS:
+ case GNUTLS_KX_DHE_RSA:
+ ret =
+ _gnutls_recv_handshake(cd, state, &data,
+ &datasize,
+ GNUTLS_CLIENT_KEY_EXCHANGE);
+ if (ret < 0)
+ return ret;
+ if (data[0] != 1) {
+ gnutls_assert();
+ return GNUTLS_E_UNIMPLEMENTED_FEATURE;
+ }
+ memmove(&n_Y, &data[1], 2);
#ifndef WORDS_BIGENDIAN
n_Y = byteswap16(n_Y);
#endif
-
_n_Y = n_Y;
-
- gcry_mpi_scan( &state->gnutls_internals.client_Y, GCRYMPI_FMT_STD, &data[3], &_n_Y);
- state->gnutls_internals.KEY = gnutls_calc_dh_key( state->gnutls_internals.client_Y, state->gnutls_internals.dh_secret);
-
+ gcry_mpi_scan(&state->gnutls_internals.client_Y,
+ GCRYMPI_FMT_STD, &data[3], &_n_Y);
+ state->gnutls_internals.KEY =
+ gnutls_calc_dh_key(state->
+ gnutls_internals.client_Y,
+ state->
+ gnutls_internals.dh_secret);
gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
- &premaster_size, state->gnutls_internals.KEY);
-
+ &premaster_size,
+ state->gnutls_internals.KEY);
premaster = secure_malloc(premaster_size);
gcry_mpi_print(GCRYMPI_FMT_STD, premaster,
- &premaster_size, state->gnutls_internals.KEY);
-
+ &premaster_size,
+ state->gnutls_internals.KEY);
/* THESE SHOULD BE DISCARDED */
gnutls_mpi_release(state->gnutls_internals.KEY);
- gnutls_mpi_release(state->gnutls_internals.client_Y);
- gnutls_mpi_release(state->gnutls_internals.dh_secret);
- state->gnutls_internals.KEY=NULL;
- state->gnutls_internals.client_Y=NULL;
- state->gnutls_internals.dh_secret=NULL;
+ gnutls_mpi_release(state->
+ gnutls_internals.client_Y);
+ gnutls_mpi_release(state->
+ gnutls_internals.dh_secret);
+ state->gnutls_internals.KEY = NULL;
+ state->gnutls_internals.client_Y = NULL;
+ state->gnutls_internals.dh_secret = NULL;
gnutls_free(data);
- } else {
+ break;
+ default:
+ gnutls_assert();
ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
}
}
- master = gnutls_PRF( premaster, premaster_size, MASTER_SECRET, strlen(MASTER_SECRET),
- random, 64 ,48);
- secure_free(premaster);
-
+ master =
+ gnutls_PRF(premaster, premaster_size,
+ MASTER_SECRET, strlen(MASTER_SECRET),
+ random, 64, 48); secure_free(premaster);
#ifdef HARD_DEBUG
fprintf(stderr, "master secret: %s\n", bin2hex(master, 48));
#endif
- memmove( state->security_parameters.master_secret, master, 48);
-
+ memmove(state->security_parameters.master_secret, master, 48);
secure_free(master);
gnutls_free(random);
-
return ret;
-
}
-
-
projects / thirdparty / gnutls.git / commitdiff
