X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Ft1_trce.c;h=173268c72735d2ed1275d5d4bfd5c38bbda583c0;hp=459827b76d62dfca77696b32d81b979bf449d96d;hb=818b625d6c906ef40bfaf4403c278db8ba7bfa09;hpb=29fac541b0af22fa1874c5594fabeff754c7dafe diff --git a/ssl/t1_trce.c b/ssl/t1_trce.c index 459827b76d..173268c727 100644 --- a/ssl/t1_trce.c +++ b/ssl/t1_trce.c @@ -1,5 +1,5 @@ /* - * Copyright 2012-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2012-2017 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -25,7 +25,8 @@ typedef struct { do_ssl_trace_list(bio, indent, msg, msglen, value, \ table, OSSL_NELEM(table)) -static const char *do_ssl_trace_str(int val, ssl_trace_tbl *tbl, size_t ntbl) +static const char *do_ssl_trace_str(int val, const ssl_trace_tbl *tbl, + size_t ntbl) { size_t i; @@ -38,7 +39,7 @@ static const char *do_ssl_trace_str(int val, ssl_trace_tbl *tbl, size_t ntbl) static int do_ssl_trace_list(BIO *bio, int indent, const unsigned char *msg, size_t msglen, - size_t vlen, ssl_trace_tbl *tbl, size_t ntbl) + size_t vlen, const ssl_trace_tbl *tbl, size_t ntbl) { int val; @@ -58,7 +59,7 @@ static int do_ssl_trace_list(BIO *bio, int indent, /* Version number */ -static ssl_trace_tbl ssl_version_tbl[] = { +static const ssl_trace_tbl ssl_version_tbl[] = { {SSL3_VERSION, "SSL 3.0"}, {TLS1_VERSION, "TLS 1.0"}, {TLS1_1_VERSION, "TLS 1.1"}, @@ -71,7 +72,7 @@ static ssl_trace_tbl ssl_version_tbl[] = { {DTLS1_BAD_VER, "DTLS 1.0 (bad)"} }; -static ssl_trace_tbl ssl_content_tbl[] = { +static const ssl_trace_tbl ssl_content_tbl[] = { {SSL3_RT_CHANGE_CIPHER_SPEC, "ChangeCipherSpec"}, {SSL3_RT_ALERT, "Alert"}, {SSL3_RT_HANDSHAKE, "Handshake"}, @@ -79,13 +80,13 @@ static ssl_trace_tbl ssl_content_tbl[] = { }; /* Handshake types */ -static ssl_trace_tbl ssl_handshake_tbl[] = { +static const ssl_trace_tbl ssl_handshake_tbl[] = { {SSL3_MT_HELLO_REQUEST, "HelloRequest"}, {SSL3_MT_CLIENT_HELLO, "ClientHello"}, {SSL3_MT_SERVER_HELLO, "ServerHello"}, {DTLS1_MT_HELLO_VERIFY_REQUEST, "HelloVerifyRequest"}, {SSL3_MT_NEWSESSION_TICKET, "NewSessionTicket"}, - {SSL3_MT_HELLO_RETRY_REQUEST, "HelloRetryRequest"}, + {SSL3_MT_END_OF_EARLY_DATA, "EndOfEarlyData"}, {SSL3_MT_ENCRYPTED_EXTENSIONS, "EncryptedExtensions"}, {SSL3_MT_CERTIFICATE, "Certificate"}, {SSL3_MT_SERVER_KEY_EXCHANGE, "ServerKeyExchange"}, @@ -97,39 +98,43 @@ static ssl_trace_tbl ssl_handshake_tbl[] = { {SSL3_MT_CLIENT_KEY_EXCHANGE, "ClientKeyExchange"}, {SSL3_MT_FINISHED, "Finished"}, {SSL3_MT_CERTIFICATE_STATUS, "CertificateStatus"}, - {SSL3_MT_KEY_UPDATE, "KeyUpdate"} + {SSL3_MT_KEY_UPDATE, "KeyUpdate"}, +# ifndef OPENSSL_NO_NEXTPROTONEG + {SSL3_MT_NEXT_PROTO, "NextProto"}, +# endif + {SSL3_MT_MESSAGE_HASH, "MessageHash"} }; /* Cipher suites */ -static ssl_trace_tbl ssl_ciphers_tbl[] = { - {0x0000, "SSL_NULL_WITH_NULL_NULL"}, - {0x0001, "SSL_RSA_WITH_NULL_MD5"}, - {0x0002, "SSL_RSA_WITH_NULL_SHA"}, - {0x0003, "SSL_RSA_EXPORT_WITH_RC4_40_MD5"}, - {0x0004, "SSL_RSA_WITH_RC4_128_MD5"}, - {0x0005, "SSL_RSA_WITH_RC4_128_SHA"}, - {0x0006, "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5"}, - {0x0007, "SSL_RSA_WITH_IDEA_CBC_SHA"}, - {0x0008, "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"}, - {0x0009, "SSL_RSA_WITH_DES_CBC_SHA"}, - {0x000A, "SSL_RSA_WITH_3DES_EDE_CBC_SHA"}, - {0x000B, "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"}, - {0x000C, "SSL_DH_DSS_WITH_DES_CBC_SHA"}, - {0x000D, "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA"}, - {0x000E, "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"}, - {0x000F, "SSL_DH_RSA_WITH_DES_CBC_SHA"}, - {0x0010, "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA"}, - {0x0011, "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"}, - {0x0012, "SSL_DHE_DSS_WITH_DES_CBC_SHA"}, - {0x0013, "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"}, - {0x0014, "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"}, - {0x0015, "SSL_DHE_RSA_WITH_DES_CBC_SHA"}, - {0x0016, "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"}, - {0x0017, "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5"}, - {0x0018, "SSL_DH_anon_WITH_RC4_128_MD5"}, - {0x0019, "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"}, - {0x001A, "SSL_DH_anon_WITH_DES_CBC_SHA"}, - {0x001B, "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA"}, +static const ssl_trace_tbl ssl_ciphers_tbl[] = { + {0x0000, "TLS_NULL_WITH_NULL_NULL"}, + {0x0001, "TLS_RSA_WITH_NULL_MD5"}, + {0x0002, "TLS_RSA_WITH_NULL_SHA"}, + {0x0003, "TLS_RSA_EXPORT_WITH_RC4_40_MD5"}, + {0x0004, "TLS_RSA_WITH_RC4_128_MD5"}, + {0x0005, "TLS_RSA_WITH_RC4_128_SHA"}, + {0x0006, "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"}, + {0x0007, "TLS_RSA_WITH_IDEA_CBC_SHA"}, + {0x0008, "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA"}, + {0x0009, "TLS_RSA_WITH_DES_CBC_SHA"}, + {0x000A, "TLS_RSA_WITH_3DES_EDE_CBC_SHA"}, + {0x000B, "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"}, + {0x000C, "TLS_DH_DSS_WITH_DES_CBC_SHA"}, + {0x000D, "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"}, + {0x000E, "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"}, + {0x000F, "TLS_DH_RSA_WITH_DES_CBC_SHA"}, + {0x0010, "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"}, + {0x0011, "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"}, + {0x0012, "TLS_DHE_DSS_WITH_DES_CBC_SHA"}, + {0x0013, "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"}, + {0x0014, "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"}, + {0x0015, "TLS_DHE_RSA_WITH_DES_CBC_SHA"}, + {0x0016, "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"}, + {0x0017, "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5"}, + {0x0018, "TLS_DH_anon_WITH_RC4_128_MD5"}, + {0x0019, "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA"}, + {0x001A, "TLS_DH_anon_WITH_DES_CBC_SHA"}, + {0x001B, "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"}, {0x001D, "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA"}, {0x001E, "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA"}, {0x001F, "TLS_KRB5_WITH_3DES_EDE_CBC_SHA"}, @@ -422,13 +427,13 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = { {0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM"}, {0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"}, {0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"}, - {0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"}, - {0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"}, - {0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305"}, - {0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305"}, - {0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305"}, - {0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305"}, - {0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305"}, + {0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"}, + {0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"}, + {0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"}, + {0xCCAB, "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256"}, + {0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256"}, + {0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256"}, + {0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256"}, {0x1301, "TLS_AES_128_GCM_SHA256"}, {0x1302, "TLS_AES_256_GCM_SHA384"}, {0x1303, "TLS_CHACHA20_POLY1305_SHA256"}, @@ -439,13 +444,13 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = { }; /* Compression methods */ -static ssl_trace_tbl ssl_comp_tbl[] = { +static const ssl_trace_tbl ssl_comp_tbl[] = { {0x0000, "No Compression"}, {0x0001, "Zlib Compression"} }; /* Extensions */ -static ssl_trace_tbl ssl_exts_tbl[] = { +static const ssl_trace_tbl ssl_exts_tbl[] = { {TLSEXT_TYPE_server_name, "server_name"}, {TLSEXT_TYPE_max_fragment_length, "max_fragment_length"}, {TLSEXT_TYPE_client_certificate_url, "client_certificate_url"}, @@ -476,10 +481,10 @@ static ssl_trace_tbl ssl_exts_tbl[] = { {TLSEXT_TYPE_padding, "padding"}, {TLSEXT_TYPE_encrypt_then_mac, "encrypt_then_mac"}, {TLSEXT_TYPE_extended_master_secret, "extended_master_secret"}, - {TLSEXT_TYPE_early_data_info, "ticket_early_data_info"} + {TLSEXT_TYPE_early_data, "early_data"} }; -static ssl_trace_tbl ssl_groups_tbl[] = { +static const ssl_trace_tbl ssl_groups_tbl[] = { {1, "sect163k1 (K-163)"}, {2, "sect163r1"}, {3, "sect163r2 (B-163)"}, @@ -518,16 +523,26 @@ static ssl_trace_tbl ssl_groups_tbl[] = { {0xFF02, "arbitrary_explicit_char2_curves"} }; -static ssl_trace_tbl ssl_point_tbl[] = { +static const ssl_trace_tbl ssl_point_tbl[] = { {0, "uncompressed"}, {1, "ansiX962_compressed_prime"}, {2, "ansiX962_compressed_char2"} }; -static ssl_trace_tbl ssl_sigalg_tbl[] = { +static const ssl_trace_tbl ssl_mfl_tbl[] = { + {0, "disabled"}, + {1, "max_fragment_length := 2^9 (512 bytes)"}, + {2, "max_fragment_length := 2^10 (1024 bytes)"}, + {3, "max_fragment_length := 2^11 (2048 bytes)"}, + {4, "max_fragment_length := 2^12 (4096 bytes)"} +}; + +static const ssl_trace_tbl ssl_sigalg_tbl[] = { {TLSEXT_SIGALG_ecdsa_secp256r1_sha256, "ecdsa_secp256r1_sha256"}, {TLSEXT_SIGALG_ecdsa_secp384r1_sha384, "ecdsa_secp384r1_sha384"}, {TLSEXT_SIGALG_ecdsa_secp521r1_sha512, "ecdsa_secp521r1_sha512"}, + {TLSEXT_SIGALG_ecdsa_sha224, "ecdsa_sha224"}, + {TLSEXT_SIGALG_ed25519, "ed25519"}, {TLSEXT_SIGALG_ecdsa_sha1, "ecdsa_sha1"}, {TLSEXT_SIGALG_rsa_pss_sha256, "rsa_pss_sha256"}, {TLSEXT_SIGALG_rsa_pss_sha384, "rsa_pss_sha384"}, @@ -535,17 +550,19 @@ static ssl_trace_tbl ssl_sigalg_tbl[] = { {TLSEXT_SIGALG_rsa_pkcs1_sha256, "rsa_pkcs1_sha256"}, {TLSEXT_SIGALG_rsa_pkcs1_sha384, "rsa_pkcs1_sha384"}, {TLSEXT_SIGALG_rsa_pkcs1_sha512, "rsa_pkcs1_sha512"}, + {TLSEXT_SIGALG_rsa_pkcs1_sha224, "rsa_pkcs1_sha224"}, {TLSEXT_SIGALG_rsa_pkcs1_sha1, "rsa_pkcs1_sha1"}, {TLSEXT_SIGALG_dsa_sha256, "dsa_sha256"}, {TLSEXT_SIGALG_dsa_sha384, "dsa_sha384"}, {TLSEXT_SIGALG_dsa_sha512, "dsa_sha512"}, + {TLSEXT_SIGALG_dsa_sha224, "dsa_sha224"}, {TLSEXT_SIGALG_dsa_sha1, "dsa_sha1"}, {TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256, "gost2012_256"}, {TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512, "gost2012_512"}, {TLSEXT_SIGALG_gostr34102001_gostr3411, "gost2001_gost94"}, }; -static ssl_trace_tbl ssl_ctype_tbl[] = { +static const ssl_trace_tbl ssl_ctype_tbl[] = { {1, "rsa_sign"}, {2, "dss_sign"}, {3, "rsa_fixed_dh"}, @@ -558,27 +575,12 @@ static ssl_trace_tbl ssl_ctype_tbl[] = { {66, "ecdsa_fixed_ecdh"} }; -static ssl_trace_tbl ssl_psk_kex_modes_tbl[] = { +static const ssl_trace_tbl ssl_psk_kex_modes_tbl[] = { {TLSEXT_KEX_MODE_KE, "psk_ke"}, {TLSEXT_KEX_MODE_KE_DHE, "psk_dhe_ke"} }; -static ssl_trace_tbl ssl_crypto_tbl[] = { - {TLS1_RT_CRYPTO_PREMASTER, "Premaster Secret"}, - {TLS1_RT_CRYPTO_CLIENT_RANDOM, "Client Random"}, - {TLS1_RT_CRYPTO_SERVER_RANDOM, "Server Random"}, - {TLS1_RT_CRYPTO_MASTER, "Master Secret"}, - {TLS1_RT_CRYPTO_MAC | TLS1_RT_CRYPTO_WRITE, "Write Mac Secret"}, - {TLS1_RT_CRYPTO_MAC | TLS1_RT_CRYPTO_READ, "Read Mac Secret"}, - {TLS1_RT_CRYPTO_KEY | TLS1_RT_CRYPTO_WRITE, "Write Key"}, - {TLS1_RT_CRYPTO_KEY | TLS1_RT_CRYPTO_READ, "Read Key"}, - {TLS1_RT_CRYPTO_IV | TLS1_RT_CRYPTO_WRITE, "Write IV"}, - {TLS1_RT_CRYPTO_IV | TLS1_RT_CRYPTO_READ, "Read IV"}, - {TLS1_RT_CRYPTO_FIXED_IV | TLS1_RT_CRYPTO_WRITE, "Write IV (fixed part)"}, - {TLS1_RT_CRYPTO_FIXED_IV | TLS1_RT_CRYPTO_READ, "Read IV (fixed part)"} -}; - -static ssl_trace_tbl ssl_key_update_tbl[] = { +static const ssl_trace_tbl ssl_key_update_tbl[] = { {SSL_KEY_UPDATE_NOT_REQUESTED, "update_not_requested"}, {SSL_KEY_UPDATE_REQUESTED, "update_requested"} }; @@ -595,8 +597,7 @@ static void ssl_print_hex(BIO *bio, int indent, const char *name, BIO_puts(bio, "\n"); } -static int ssl_print_hexbuf(BIO *bio, int indent, - const char *name, size_t nlen, +static int ssl_print_hexbuf(BIO *bio, int indent, const char *name, size_t nlen, const unsigned char **pmsg, size_t *pmsglen) { size_t blen; @@ -657,12 +658,12 @@ static int ssl_print_random(BIO *bio, int indent, return 1; } -static int ssl_print_signature(BIO *bio, int indent, SSL *s, +static int ssl_print_signature(BIO *bio, int indent, const SSL *ssl, const unsigned char **pmsg, size_t *pmsglen) { if (*pmsglen < 2) return 0; - if (SSL_USE_SIGALGS(s)) { + if (SSL_USE_SIGALGS(ssl)) { const unsigned char *p = *pmsg; unsigned int sigalg = (p[0] << 8) | p[1]; @@ -687,6 +688,12 @@ static int ssl_print_extension(BIO *bio, int indent, int server, BIO_printf(bio, "extension_type=%s(%d), length=%d\n", ssl_trace_str(extype, ssl_exts_tbl), extype, (int)extlen); switch (extype) { + case TLSEXT_TYPE_max_fragment_length: + if (extlen < 1) + return 0; + xlen = extlen; + return ssl_trace_list(bio, indent + 2, ext, xlen, 1, ssl_mfl_tbl); + case TLSEXT_TYPE_ec_point_formats: if (extlen < 1) return 0; @@ -775,11 +782,10 @@ static int ssl_print_extension(BIO *bio, int indent, int server, break; case TLSEXT_TYPE_key_share: - if (mt == SSL3_MT_HELLO_RETRY_REQUEST) { + if (server && extlen == 2) { int group_id; - if (extlen != 2) - return 0; + /* We assume this is an HRR, otherwise this is an invalid key_share */ group_id = (ext[0] << 8) | ext[1]; BIO_indent(bio, indent + 4, 80); BIO_printf(bio, "NamedGroup: %s (%d)\n", @@ -815,6 +821,17 @@ static int ssl_print_extension(BIO *bio, int indent, int server, break; case TLSEXT_TYPE_supported_versions: + if (server) { + int version; + + if (extlen != 2) + return 0; + version = (ext[0] << 8) | ext[1]; + BIO_indent(bio, indent + 4, 80); + BIO_printf(bio, "%s (%d)\n", + ssl_trace_str(version, ssl_version_tbl), version); + break; + } if (extlen < 1) return 0; xlen = ext[0]; @@ -832,7 +849,9 @@ static int ssl_print_extension(BIO *bio, int indent, int server, return ssl_trace_list(bio, indent + 2, ext + 1, xlen, 1, ssl_psk_kex_modes_tbl); - case TLSEXT_TYPE_early_data_info: + case TLSEXT_TYPE_early_data: + if (mt != SSL3_MT_NEWSESSION_TICKET) + break; if (extlen != 4) return 0; max_early_data = (ext[0] << 24) | (ext[1] << 16) | (ext[2] << 8) @@ -872,8 +891,12 @@ static int ssl_print_extensions(BIO *bio, int indent, int server, return 0; extype = (msg[0] << 8) | msg[1]; extlen = (msg[2] << 8) | msg[3]; - if (msglen < extlen + 4) + if (msglen < extlen + 4) { + BIO_printf(bio, "extensions, extype = %d, extlen = %d\n", extype, + (int)extlen); + BIO_dump_indent(bio, (const char *)msg, msglen, indent + 2); return 0; + } msg += 4; if (!ssl_print_extension(bio, indent + 2, server, mt, extype, msg, extlen)) @@ -887,7 +910,7 @@ static int ssl_print_extensions(BIO *bio, int indent, int server, return 1; } -static int ssl_print_client_hello(BIO *bio, SSL *ssl, int indent, +static int ssl_print_client_hello(BIO *bio, const SSL *ssl, int indent, const unsigned char *msg, size_t msglen) { size_t len; @@ -990,7 +1013,7 @@ static int ssl_print_server_hello(BIO *bio, int indent, return 1; } -static int ssl_get_keyex(const char **pname, SSL *ssl) +static int ssl_get_keyex(const char **pname, const SSL *ssl) { unsigned long alg_k = ssl->s3->tmp.new_cipher->algorithm_mkey; @@ -1034,7 +1057,7 @@ static int ssl_get_keyex(const char **pname, SSL *ssl) return 0; } -static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl, +static int ssl_print_client_keyex(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { const char *algname; @@ -1078,7 +1101,7 @@ static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl, return !msglen; } -static int ssl_print_server_keyex(BIO *bio, int indent, SSL *ssl, +static int ssl_print_server_keyex(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { const char *algname; @@ -1183,12 +1206,13 @@ static int ssl_print_certificate(BIO *bio, int indent, return 1; } -static int ssl_print_certificates(BIO *bio, SSL *s, int server, int indent, - const unsigned char *msg, size_t msglen) +static int ssl_print_certificates(BIO *bio, const SSL *ssl, int server, + int indent, const unsigned char *msg, + size_t msglen) { size_t clen; - if (SSL_IS_TLS13(s) + if (SSL_IS_TLS13(ssl) && !ssl_print_hexbuf(bio, indent, "context", 1, &msg, &msglen)) return 0; @@ -1211,15 +1235,19 @@ static int ssl_print_certificates(BIO *bio, SSL *s, int server, int indent, return 1; } -static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, +static int ssl_print_cert_request(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { size_t xlen; unsigned int sigalg; - if (SSL_IS_TLS13(s)) { + if (SSL_IS_TLS13(ssl)) { if (!ssl_print_hexbuf(bio, indent, "request_context", 1, &msg, &msglen)) return 0; + if (!ssl_print_extensions(bio, indent, 1, + SSL3_MT_CERTIFICATE_REQUEST, &msg, &msglen)) + return 0; + return 1; } else { if (msglen < 1) return 0; @@ -1234,7 +1262,7 @@ static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, msg += xlen; msglen -= xlen + 1; } - if (SSL_USE_SIGALGS(s)) { + if (SSL_USE_SIGALGS(ssl)) { if (msglen < 2) return 0; xlen = (msg[0] << 8) | msg[1]; @@ -1286,15 +1314,15 @@ static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, xlen -= dlen + 2; msg += dlen; } - if (SSL_IS_TLS13(s)) { - if (!ssl_print_hexbuf(bio, indent, "request_extensions", 2, - &msg, &msglen)) - return 0; + if (SSL_IS_TLS13(ssl)) { + if (!ssl_print_hexbuf(bio, indent, "request_extensions", 2, + &msg, &msglen)) + return 0; } return msglen == 0; } -static int ssl_print_ticket(BIO *bio, int indent, SSL *s, +static int ssl_print_ticket(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { unsigned int tick_life; @@ -1311,7 +1339,7 @@ static int ssl_print_ticket(BIO *bio, int indent, SSL *s, msg += 4; BIO_indent(bio, indent + 2, 80); BIO_printf(bio, "ticket_lifetime_hint=%u\n", tick_life); - if (SSL_IS_TLS13(s)) { + if (SSL_IS_TLS13(ssl)) { unsigned int ticket_age_add; if (msglen < 4) @@ -1322,19 +1350,22 @@ static int ssl_print_ticket(BIO *bio, int indent, SSL *s, msg += 4; BIO_indent(bio, indent + 2, 80); BIO_printf(bio, "ticket_age_add=%u\n", ticket_age_add); + if (!ssl_print_hexbuf(bio, indent + 2, "ticket_nonce", 1, &msg, + &msglen)) + return 0; } if (!ssl_print_hexbuf(bio, indent + 2, "ticket", 2, &msg, &msglen)) return 0; - if (SSL_IS_TLS13(s) && !ssl_print_extensions(bio, indent + 2, 0, - SSL3_MT_NEWSESSION_TICKET, - &msg, &msglen)) + if (SSL_IS_TLS13(ssl) + && !ssl_print_extensions(bio, indent + 2, 0, + SSL3_MT_NEWSESSION_TICKET, &msg, &msglen)) return 0; if (msglen) return 0; return 1; } -static int ssl_print_handshake(BIO *bio, SSL *ssl, int server, +static int ssl_print_handshake(BIO *bio, const SSL *ssl, int server, const unsigned char *msg, size_t msglen, int indent) { @@ -1419,15 +1450,6 @@ static int ssl_print_handshake(BIO *bio, SSL *ssl, int server, return 0; break; - case SSL3_MT_HELLO_RETRY_REQUEST: - if (!ssl_print_version(bio, indent + 2, "server_version", &msg, &msglen, - NULL) - || !ssl_print_extensions(bio, indent + 2, 1, - SSL3_MT_HELLO_RETRY_REQUEST, &msg, - &msglen)) - return 0; - break; - case SSL3_MT_ENCRYPTED_EXTENSIONS: if (!ssl_print_extensions(bio, indent + 2, 1, SSL3_MT_ENCRYPTED_EXTENSIONS, &msg, &msglen)) @@ -1452,23 +1474,12 @@ static int ssl_print_handshake(BIO *bio, SSL *ssl, int server, return 1; } -const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c) -{ - return ssl_trace_str(c->id & 0xFFFF, ssl_ciphers_tbl); -} - void SSL_trace(int write_p, int version, int content_type, const void *buf, size_t msglen, SSL *ssl, void *arg) { const unsigned char *msg = buf; BIO *bio = arg; - if (write_p == 2) { - BIO_puts(bio, "Session "); - ssl_print_hex(bio, 0, - ssl_trace_str(content_type, ssl_crypto_tbl), msg, msglen); - return; - } switch (content_type) { case SSL3_RT_HEADER: { @@ -1489,6 +1500,12 @@ void SSL_trace(int write_p, int version, int content_type, msg[msglen - 2] << 8 | msg[msglen - 1]); } break; + + case SSL3_RT_INNER_CONTENT_TYPE: + BIO_printf(bio, " Inner Content Type = %s (%d)", + ssl_trace_str(msg[0], ssl_content_tbl), msg[0]); + break; + case SSL3_RT_HANDSHAKE: if (!ssl_print_handshake(bio, ssl, ssl->server ? write_p : !write_p, msg, msglen, 4))