Add support for automatic ECDH temporary key parameter selection. When

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 906fcd44117e018774f7a88c2258c5e85339eba3..679894cb3db15328c03b0d89a2cae9bbc652b32a 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -178,9 +178,9 @@ SSL3_ENC_METHOD ssl3_undef_enc_method={
        NULL,   /* server_finished_label */
        0,      /* server_finished_label_len */
        (int (*)(int))ssl_undefined_function,
-       (int (*)(SSL *, unsigned char *, unsigned int, const char *,
-                unsigned int, const unsigned char *, unsigned int,
-                int use_context))ssl_undefined_function,
+       (int (*)(SSL *, unsigned char *, size_t, const char *,
+                size_t, const unsigned char *, size_t,
+                int use_context)) ssl_undefined_function,
        };
 
 int SSL_clear(SSL *s)
@@ -358,6 +358,28 @@ SSL *SSL_new(SSL_CTX *ctx)
        s->tlsext_ocsp_resplen = -1;
        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
        s->initial_ctx=ctx;
+#ifndef OPENSSL_NO_EC
+       if (ctx->tlsext_ecpointformatlist)
+               {
+               s->tlsext_ecpointformatlist =
+                       BUF_memdup(ctx->tlsext_ecpointformatlist,
+                                       ctx->tlsext_ecpointformatlist_length);
+               if (!s->tlsext_ecpointformatlist)
+                       goto err;
+               s->tlsext_ecpointformatlist_length =
+                                       ctx->tlsext_ecpointformatlist_length;
+               }
+       if (ctx->tlsext_ellipticcurvelist)
+               {
+               s->tlsext_ellipticcurvelist =
+                       BUF_memdup(ctx->tlsext_ellipticcurvelist,
+                                       ctx->tlsext_ellipticcurvelist_length);
+               if (!s->tlsext_ellipticcurvelist)
+                       goto err;
+               s->tlsext_ellipticcurvelist_length = 
+                                       ctx->tlsext_ellipticcurvelist_length;
+               }
+#endif
 # ifndef OPENSSL_NO_NEXTPROTONEG
        s->next_proto_negotiated = NULL;
 # endif
@@ -1632,8 +1654,9 @@ void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned
 # endif
 #endif
 
-int SSL_export_keying_material(SSL *s, unsigned char *out, int olen, 
-        char *label, int llen, unsigned char *p, int plen, int use_context)
+int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
+       const char *label, size_t llen, const unsigned char *p, size_t plen,
+       int use_context)
        {
        if (s->version < TLS1_VERSION)
                return -1;
@@ -1974,6 +1997,14 @@ void SSL_CTX_free(SSL_CTX *a)
                ssl_buf_freelist_free(a->wbuf_freelist);
        if (a->rbuf_freelist)
                ssl_buf_freelist_free(a->rbuf_freelist);
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+# ifndef OPENSSL_NO_EC
+       if (a->tlsext_ecpointformatlist)
+               OPENSSL_free(a->tlsext_ecpointformatlist);
+       if (a->tlsext_ellipticcurvelist)
+               OPENSSL_free(a->tlsext_ellipticcurvelist);
+# endif /* OPENSSL_NO_EC */
 #endif
 
        OPENSSL_free(a);
@@ -2041,7 +2072,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
 #endif
 
 #ifndef OPENSSL_NO_ECDH
-       have_ecdh_tmp=(c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL);
+       have_ecdh_tmp=(c->ecdh_tmp || c->ecdh_tmp_cb || c->ecdh_tmp_auto);
 #endif
        cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]);
        rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL);
@@ -2110,6 +2141,9 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
        if (dh_dsa) mask_k|=SSL_kDHd;
        if (dh_dsa_export) emask_k|=SSL_kDHd;
 
+       if (emask_k & (SSL_kDHr|SSL_kDHd))
+               mask_a |= SSL_aDH;
+
        if (rsa_enc || rsa_sign)
                {
                mask_a|=SSL_aRSA;
@@ -2289,7 +2323,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
 #endif
 
 /* THIS NEEDS CLEANING UP */
-X509 *ssl_get_server_send_cert(SSL *s)
+CERT_PKEY *ssl_get_server_send_pkey(SSL *s)
        {
        unsigned long alg_k,alg_a;
        CERT *c;
@@ -2344,12 +2378,12 @@ X509 *ssl_get_server_send_cert(SSL *s)
                i=SSL_PKEY_GOST01;
        else /* if (alg_a & SSL_aNULL) */
                {
-               SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,ERR_R_INTERNAL_ERROR);
+               SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY,ERR_R_INTERNAL_ERROR);
                return(NULL);
                }
        if (c->pkeys[i].x509 == NULL) return(NULL);
 
-       return(c->pkeys[i].x509);
+       return(&c->pkeys[i]);
        }
 
 EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd)