Submitted by:

[openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index b2649ed9986cc3297e04a10bdb26ac61f7add5d3..c2d33fef056e8c680bb901dd2d763824510f2f21 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -57,10 +57,10 @@
  */
 
 #include <stdio.h>
-#include "buffer.h"
-#include "rand.h"
-#include "objects.h"
-#include "evp.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
 #include "ssl_locl.h"
 
 #define BREAK break
@@ -101,8 +101,7 @@ static int ssl3_get_server_certificate();
 static int ssl3_check_cert_and_algorithm();
 #endif
 
-static SSL_METHOD *ssl3_get_client_method(ver)
-int ver;
+static SSL_METHOD *ssl3_get_client_method(int ver)
        {
        if (ver == SSL3_VERSION)
                return(SSLv3_client_method());
@@ -110,7 +109,7 @@ int ver;
                return(NULL);
        }
 
-SSL_METHOD *SSLv3_client_method()
+SSL_METHOD *SSLv3_client_method(void)
        {
        static int init=1;
        static SSL_METHOD SSLv3_client_data;
@@ -126,8 +125,7 @@ SSL_METHOD *SSLv3_client_method()
        return(&SSLv3_client_data);
        }
 
-int ssl3_connect(s)
-SSL *s;
+int ssl3_connect(SSL *s)
        {
        BUF_MEM *buf;
        unsigned long Time=time(NULL),l;
@@ -468,8 +466,7 @@ end:
        }
 
 
-static int ssl3_client_hello(s)
-SSL *s;
+static int ssl3_client_hello(SSL *s)
        {
        unsigned char *buf;
        unsigned char *p,*d;
@@ -531,11 +528,11 @@ SSL *s;
                if (s->ctx->comp_methods == NULL)
                        j=0;
                else
-                       j=sk_num(s->ctx->comp_methods);
+                       j=sk_SSL_COMP_num(s->ctx->comp_methods);
                *(p++)=1+j;
                for (i=0; i<j; i++)
                        {
-                       comp=(SSL_COMP *)sk_value(s->ctx->comp_methods,i);
+                       comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
                        *(p++)=comp->id;
                        }
                *(p++)=0; /* Add the NULL method */
@@ -557,10 +554,9 @@ err:
        return(-1);
        }
 
-static int ssl3_get_server_hello(s)
-SSL *s;
+static int ssl3_get_server_hello(SSL *s)
        {
-       STACK *sk;
+       STACK_OF(SSL_CIPHER) *sk;
        SSL_CIPHER *c;
        unsigned char *p,*d;
        int i,al,ok;
@@ -605,9 +601,18 @@ SSL *s;
                        goto f_err;
                        }
                }
-       if ((j != 0) && (j == s->session->session_id_length) &&
-               (memcmp(p,s->session->session_id,j) == 0))
-               s->hit=1;
+       if (j != 0 && j == s->session->session_id_length
+           && memcmp(p,s->session->session_id,j) == 0)
+           {
+           if(s->sid_ctx_length != s->session->sid_ctx_length
+              || memcmp(s->session->sid_ctx,s->sid_ctx,s->sid_ctx_length))
+               {
+               al=SSL_AD_ILLEGAL_PARAMETER;
+               SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
+               goto f_err;
+               }
+           s->hit=1;
+           }
        else    /* a miss or crap from the other end */
                {
                /* If we were trying for session-id reuse, make a new
@@ -636,7 +641,7 @@ SSL *s;
        p+=ssl_put_cipher_by_char(s,NULL,NULL);
 
        sk=ssl_get_ciphers_by_id(s);
-       i=sk_find(sk,(char *)c);
+       i=sk_SSL_CIPHER_find(sk,c);
        if (i < 0)
                {
                /* we did not say we would use this cipher */
@@ -691,14 +696,13 @@ err:
        return(-1);
        }
 
-static int ssl3_get_server_certificate(s)
-SSL *s;
+static int ssl3_get_server_certificate(SSL *s)
        {
        int al,i,ok,ret= -1;
        unsigned long n,nc,llen,l;
        X509 *x=NULL;
        unsigned char *p,*d,*q;
-       STACK *sk=NULL;
+       STACK_OF(X509) *sk=NULL;
        CERT *c;
        EVP_PKEY *pkey=NULL;
 
@@ -729,7 +733,7 @@ SSL *s;
                }
        d=p=(unsigned char *)s->init_buf->data;
 
-       if ((sk=sk_new_null()) == NULL)
+       if ((sk=sk_X509_new_null()) == NULL)
                {
                SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
                goto err;
@@ -766,7 +770,7 @@ SSL *s;
                        SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
                        goto f_err;
                        }
-               if (!sk_push(sk,(char *)x))
+               if (!sk_X509_push(sk,x))
                        {
                        SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,ERR_R_MALLOC_FAILURE);
                        goto err;
@@ -791,7 +795,7 @@ SSL *s;
        s->session->cert=c;
 
        c->cert_chain=sk;
-       x=(X509 *)sk_value(sk,0);
+       x=sk_X509_value(sk,0);
        sk=NULL;
 
        pkey=X509_get_pubkey(x);
@@ -836,12 +840,11 @@ f_err:
 err:
        EVP_PKEY_free(pkey);
        X509_free(x);
-       sk_pop_free(sk,X509_free);
+       sk_X509_pop_free(sk,X509_free);
        return(ret);
        }
 
-static int ssl3_get_key_exchange(s)
-SSL *s;
+static int ssl3_get_key_exchange(SSL *s)
        {
 #ifndef NO_RSA
        unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
@@ -1134,15 +1137,14 @@ err:
        return(-1);
        }
 
-static int ssl3_get_certificate_request(s)
-SSL *s;
+static int ssl3_get_certificate_request(SSL *s)
        {
        int ok,ret=0;
        unsigned long n,nc,l;
        unsigned int llen,ctype_num,i;
        X509_NAME *xn=NULL;
        unsigned char *p,*d,*q;
-       STACK *ca_sk=NULL;
+       STACK_OF(X509_NAME) *ca_sk=NULL;
 
        n=ssl3_get_message(s,
                SSL3_ST_CR_CERT_REQ_A,
@@ -1186,7 +1188,7 @@ SSL *s;
 
        d=p=(unsigned char *)s->init_buf->data;
 
-       if ((ca_sk=sk_new(ca_dn_cmp)) == NULL)
+       if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
                {
                SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
                goto err;
@@ -1251,7 +1253,7 @@ fclose(out);
                        SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,SSL_R_CA_DN_LENGTH_MISMATCH);
                        goto err;
                        }
-               if (!sk_push(ca_sk,(char *)xn))
+               if (!sk_X509_NAME_push(ca_sk,xn))
                        {
                        SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST,ERR_R_MALLOC_FAILURE);
                        goto err;
@@ -1271,24 +1273,22 @@ cont:
        s->s3->tmp.cert_req=1;
        s->s3->tmp.ctype_num=ctype_num;
        if (s->s3->tmp.ca_names != NULL)
-               sk_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
+               sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
        s->s3->tmp.ca_names=ca_sk;
        ca_sk=NULL;
 
        ret=1;
 err:
-       if (ca_sk != NULL) sk_pop_free(ca_sk,X509_NAME_free);
+       if (ca_sk != NULL) sk_X509_NAME_pop_free(ca_sk,X509_NAME_free);
        return(ret);
        }
 
-static int ca_dn_cmp(a,b)
-X509_NAME **a,**b;
+static int ca_dn_cmp(X509_NAME **a, X509_NAME **b)
        {
        return(X509_NAME_cmp(*a,*b));
        }
 
-static int ssl3_get_server_done(s)
-SSL *s;
+static int ssl3_get_server_done(SSL *s)
        {
        int ok,ret=0;
        long n;
@@ -1311,8 +1311,7 @@ SSL *s;
        return(ret);
        }
 
-static int ssl3_send_client_key_exchange(s)
-SSL *s;
+static int ssl3_send_client_key_exchange(SSL *s)
        {
        unsigned char *p,*q,*d;
        int n;
@@ -1462,8 +1461,7 @@ err:
        return(-1);
        }
 
-static int ssl3_send_client_verify(s)
-SSL *s;
+static int ssl3_send_client_verify(SSL *s)
        {
        unsigned char *p,*d;
        unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
@@ -1533,8 +1531,7 @@ err:
        return(-1);
        }
 
-static int ssl3_send_client_certificate(s)
-SSL *s;
+static int ssl3_send_client_certificate(SSL *s)
        {
        X509 *x509=NULL;
        EVP_PKEY *pkey=NULL;
@@ -1613,8 +1610,7 @@ SSL *s;
 
 #define has_bits(i,m)  (((i)&(m)) == (m))
 
-static int ssl3_check_cert_and_algorithm(s)
-SSL *s;
+static int ssl3_check_cert_and_algorithm(SSL *s)
        {
        int i,idx;
        long algs;
@@ -1689,12 +1685,13 @@ SSL *s;
 #endif
 #endif
 
-       if ((algs & SSL_EXP) && !has_bits(i,EVP_PKT_EXP))
+       if (SSL_IS_EXPORT(algs) && !has_bits(i,EVP_PKT_EXP))
                {
 #ifndef NO_RSA
                if (algs & SSL_kRSA)
                        {
-                       if ((rsa == NULL) || (RSA_size(rsa) > 512))
+                       if (rsa == NULL
+                           || RSA_size(rsa) > SSL_EXPORT_PKEYLENGTH(algs))
                                {
                                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                                goto f_err;
@@ -1704,8 +1701,9 @@ SSL *s;
 #endif
 #ifndef NO_DH
                        if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
-                       {
-                       if ((dh == NULL) || (DH_size(dh) > 512))
+                           {
+                           if (dh == NULL
+                               || DH_size(dh) > SSL_EXPORT_PKEYLENGTH(algs))
                                {
                                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                                goto f_err;