X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=ssl%2Fs3_enc.c;h=15d4af6dfbae633d8a12638e58ca919e24476388;hb=673b102c5b265bd6c517ac40ab76e1606a243c08;hp=bbd9b637c5c731fc4b063d1f36cd0edb726e066a;hpb=7dfb0b774e6592dcbfe47015168a0ac8b44e2a17;p=openssl.git diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index bbd9b637c5..15d4af6dfb 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -57,7 +57,9 @@ */ #include -#include "evp.h" +#include +#include +#include #include "ssl_locl.h" static unsigned char ssl3_pad_1[48]={ @@ -83,10 +85,7 @@ static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx, static int ssl3_handshake_mac(); #endif -static void ssl3_generate_key_block(s,km,num) -SSL *s; -unsigned char *km; -int num; +static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num) { MD5_CTX m5; SHA_CTX s1; @@ -94,6 +93,9 @@ int num; unsigned char c='A'; int i,j,k; +#ifdef CHARSET_EBCDIC + c = os_toascii[c]; /*'A' in ASCII */ +#endif k=0; for (i=0; is3->tmp.new_cipher->algorithms & SSL_EXPORT)?1:0; + exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); c=s->s3->tmp.new_sym_enc; m=s->s3->tmp.new_hash; - comp=s->s3->tmp.new_compression; + if (s->s3->tmp.new_compression == NULL) + comp=NULL; + else + comp=s->s3->tmp.new_compression->method; key_block=s->s3->tmp.key_block; if (which & SSL3_CC_READ) @@ -155,7 +158,26 @@ int which; goto err; dd= s->enc_read_ctx; s->read_hash=m; - s->read_compression=comp; + /* COMPRESS */ + if (s->expand != NULL) + { + COMP_CTX_free(s->expand); + s->expand=NULL; + } + if (comp != NULL) + { + s->expand=COMP_CTX_new(comp); + if (s->expand == NULL) + { + SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR); + goto err2; + } + if (s->s3->rrec.comp == NULL) + s->s3->rrec.comp=(unsigned char *) + Malloc(SSL3_RT_MAX_PLAIN_LENGTH); + if (s->s3->rrec.comp == NULL) + goto err; + } memset(&(s->s3->read_sequence[0]),0,8); mac_secret= &(s->s3->read_mac_secret[0]); } @@ -167,7 +189,21 @@ int which; goto err; dd= s->enc_write_ctx; s->write_hash=m; - s->write_compression=comp; + /* COMPRESS */ + if (s->compress != NULL) + { + COMP_CTX_free(s->compress); + s->compress=NULL; + } + if (comp != NULL) + { + s->compress=COMP_CTX_new(comp); + if (s->compress == NULL) + { + SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR); + goto err2; + } + } memset(&(s->s3->write_sequence[0]),0,8); mac_secret= &(s->s3->write_mac_secret[0]); } @@ -176,7 +212,10 @@ int which; p=s->s3->tmp.key_block; i=EVP_MD_size(m); - j=(exp)?5:EVP_CIPHER_key_length(c); + cl=EVP_CIPHER_key_length(c); + j=exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ? + cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl; + /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ k=EVP_CIPHER_iv_length(c); if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || (which == SSL3_CHANGE_CIPHER_SERVER_READ)) @@ -239,18 +278,18 @@ err2: return(0); } -int ssl3_setup_key_block(s) -SSL *s; +int ssl3_setup_key_block(SSL *s) { unsigned char *p; - EVP_CIPHER *c; - EVP_MD *hash; - int num,exp; + const EVP_CIPHER *c; + const EVP_MD *hash; + int num; + SSL_COMP *comp; if (s->s3->tmp.key_block_length != 0) return(1); - if (!ssl_cipher_get_evp(s->session->cipher,&c,&hash)) + if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp)) { SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE); return(0); @@ -258,8 +297,7 @@ SSL *s; s->s3->tmp.new_sym_enc=c; s->s3->tmp.new_hash=hash; - - exp=(s->session->cipher->algorithms & SSL_EXPORT)?1:0; + s->s3->tmp.new_compression=comp; num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c); num*=2; @@ -280,8 +318,7 @@ err: return(0); } -void ssl3_cleanup_key_block(s) -SSL *s; +void ssl3_cleanup_key_block(SSL *s) { if (s->s3->tmp.key_block != NULL) { @@ -293,44 +330,35 @@ SSL *s; s->s3->tmp.key_block_length=0; } -int ssl3_enc(s,send) -SSL *s; -int send; +int ssl3_enc(SSL *s, int send) { SSL3_RECORD *rec; EVP_CIPHER_CTX *ds; unsigned long l; int bs,i; - EVP_CIPHER *enc; - SSL_COMPRESSION *comp; + const EVP_CIPHER *enc; if (send) { ds=s->enc_write_ctx; rec= &(s->s3->wrec); if (s->enc_write_ctx == NULL) - { enc=NULL; comp=NULL; } + enc=NULL; else - { enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx); - comp=s->write_compression; - } } else { ds=s->enc_read_ctx; rec= &(s->s3->rrec); if (s->enc_read_ctx == NULL) - { enc=NULL; comp=NULL; } + enc=NULL; else - { enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx); - comp=s->read_compression; - } } if ((s->session == NULL) || (ds == NULL) || - ((enc == NULL) && (comp == NULL))) + (enc == NULL)) { memcpy(rec->data,rec->input,rec->length); rec->input=rec->data; @@ -340,6 +368,8 @@ int send; l=rec->length; bs=EVP_CIPHER_block_size(ds->cipher); + /* COMPRESS */ + /* This should be using (bs-1) and bs instead of 7 and 8 */ if ((bs != 1) && send) { @@ -368,36 +398,25 @@ int send; return(1); } -void ssl3_init_finished_mac(s) -SSL *s; +void ssl3_init_finished_mac(SSL *s) { EVP_DigestInit(&(s->s3->finish_dgst1),s->ctx->md5); EVP_DigestInit(&(s->s3->finish_dgst2),s->ctx->sha1); } -void ssl3_finish_mac(s,buf,len) -SSL *s; -unsigned char *buf; -int len; +void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len) { EVP_DigestUpdate(&(s->s3->finish_dgst1),buf,len); EVP_DigestUpdate(&(s->s3->finish_dgst2),buf,len); } -int ssl3_cert_verify_mac(s,ctx,p) -SSL *s; -EVP_MD_CTX *ctx; -unsigned char *p; +int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *ctx, unsigned char *p) { return(ssl3_handshake_mac(s,ctx,NULL,0,p)); } -int ssl3_final_finish_mac(s,ctx1,ctx2,sender,len,p) -SSL *s; -EVP_MD_CTX *ctx1,*ctx2; -unsigned char *sender; -int len; -unsigned char *p; +int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2, + unsigned char *sender, int len, unsigned char *p) { int ret; @@ -407,12 +426,8 @@ unsigned char *p; return(ret); } -static int ssl3_handshake_mac(s,in_ctx,sender,len,p) -SSL *s; -EVP_MD_CTX *in_ctx; -unsigned char *sender; -int len; -unsigned char *p; +static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx, + unsigned char *sender, int len, unsigned char *p) { unsigned int ret; int npad,n; @@ -420,7 +435,7 @@ unsigned char *p; unsigned char md_buf[EVP_MAX_MD_SIZE]; EVP_MD_CTX ctx; - memcpy(&ctx,in_ctx,sizeof(EVP_MD_CTX)); + EVP_MD_CTX_copy(&ctx,in_ctx); n=EVP_MD_CTX_size(&ctx); npad=(48/n)*n; @@ -444,15 +459,12 @@ unsigned char *p; return((int)ret); } -int ssl3_mac(ssl,md,send) -SSL *ssl; -unsigned char *md; -int send; +int ssl3_mac(SSL *ssl, unsigned char *md, int send) { SSL3_RECORD *rec; unsigned char *mac_sec,*seq; EVP_MD_CTX md_ctx; - EVP_MD *hash; + const EVP_MD *hash; unsigned char *p,rec_char; unsigned int md_size; int npad,i; @@ -501,16 +513,19 @@ int send; return(md_size); } -int ssl3_generate_master_secret(s,out,p,len) -SSL *s; -unsigned char *out; -unsigned char *p; -int len; +int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, + int len) { - static unsigned char *salt[3]={ - (unsigned char *)"A", - (unsigned char *)"BB", - (unsigned char *)"CCC", + static const unsigned char *salt[3]={ +#ifndef CHARSET_EBCDIC + (const unsigned char *)"A", + (const unsigned char *)"BB", + (const unsigned char *)"CCC", +#else + (const unsigned char *)"\x41", + (const unsigned char *)"\x42\x42", + (const unsigned char *)"\x43\x43\x43", +#endif }; unsigned char buf[EVP_MAX_MD_SIZE]; EVP_MD_CTX ctx; @@ -520,7 +535,7 @@ int len; for (i=0; i<3; i++) { EVP_DigestInit(&ctx,s->ctx->sha1); - EVP_DigestUpdate(&ctx,salt[i],strlen((char *)salt[i])); + EVP_DigestUpdate(&ctx,salt[i],strlen((const char *)salt[i])); EVP_DigestUpdate(&ctx,p,len); EVP_DigestUpdate(&ctx,&(s->s3->client_random[0]), SSL3_RANDOM_SIZE); @@ -538,8 +553,7 @@ int len; return(ret); } -int ssl3_alert_code(code) -int code; +int ssl3_alert_code(int code) { switch (code) {