Fix error codes for memory-saving patch.
[openssl.git] / ssl / s3_both.c
index a17b87273a8b9a22e085b7010c6527a0d5fdca8a..06e761b4b276294a5b8a5b885b08081f99097854 100644 (file)
@@ -160,8 +160,6 @@ int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
                p= &(d[4]);
 
                i=s->method->ssl3_enc->final_finish_mac(s,
-                       &(s->s3->finish_dgst1),
-                       &(s->s3->finish_dgst2),
                        sender,slen,s->s3->tmp.finish_md);
                s->s3->tmp.finish_md_len = i;
                memcpy(p, s->s3->tmp.finish_md, i);
@@ -197,7 +195,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
         * change cipher spec message and is in s->s3->tmp.peer_finish_md
         */ 
 
-       n=ssl3_get_message(s,
+       n=s->method->ssl_get_message(s,
                a,
                b,
                SSL3_MT_FINISHED,
@@ -273,6 +271,13 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
        X509_STORE_CTX xs_ctx;
        X509_OBJECT obj;
 
+       int no_chain;
+
+       if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || s->ctx->extra_certs)
+               no_chain = 1;
+       else
+               no_chain = 0;
+
        /* TLSv1 sends a chain with nothing in it, instead of an alert */
        buf=s->init_buf;
        if (!BUF_MEM_grow_clean(buf,10))
@@ -282,7 +287,7 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
                }
        if (x != NULL)
                {
-               if(!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL))
+               if(!no_chain && !X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL))
                        {
                        SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
                        return(0);
@@ -300,6 +305,10 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
                        l2n3(n,p);
                        i2d_X509(x,&p);
                        l+=n+3;
+
+                       if (no_chain)
+                               break;
+
                        if (X509_NAME_cmp(X509_get_subject_name(x),
                                X509_get_issuer_name(x)) == 0) break;
 
@@ -311,8 +320,8 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
                         * ref count */
                        X509_free(x);
                        }
-
-               X509_STORE_CTX_cleanup(&xs_ctx);
+               if (!no_chain)
+                       X509_STORE_CTX_cleanup(&xs_ctx);
                }
 
        /* Thawte special :-) */
@@ -380,8 +389,8 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                        {
                        while (s->init_num < 4)
                                {
-                               i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
-                                       4 - s->init_num, 0);
+                               i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                                       &p[s->init_num],4 - s->init_num, 0);
                                if (i <= 0)
                                        {
                                        s->rwstate=SSL_READING;
@@ -461,7 +470,7 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
        n = s->s3->tmp.message_size - s->init_num;
        while (n > 0)
                {
-               i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
+               i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
                if (i <= 0)
                        {
                        s->rwstate=SSL_READING;
@@ -486,7 +495,7 @@ err:
 int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
        {
        EVP_PKEY *pk;
-       int ret= -1,i,j;
+       int ret= -1,i;
 
        if (pkey == NULL)
                pk=X509_get_pubkey(x);
@@ -498,42 +507,25 @@ int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
        if (i == EVP_PKEY_RSA)
                {
                ret=SSL_PKEY_RSA_ENC;
-               if (x != NULL)
-                       {
-                       j=X509_get_ext_count(x);
-                       /* check to see if this is a signing only certificate */
-                       /* EAY EAY EAY EAY */
-                       }
                }
        else if (i == EVP_PKEY_DSA)
                {
                ret=SSL_PKEY_DSA_SIGN;
                }
-       else if (i == EVP_PKEY_DH)
-               {
-               /* if we just have a key, we needs to be guess */
-
-               if (x == NULL)
-                       ret=SSL_PKEY_DH_DSA;
-               else
-                       {
-                       j=X509_get_signature_type(x);
-                       if (j == EVP_PKEY_RSA)
-                               ret=SSL_PKEY_DH_RSA;
-                       else if (j== EVP_PKEY_DSA)
-                               ret=SSL_PKEY_DH_DSA;
-                       else ret= -1;
-                       }
-               }
 #ifndef OPENSSL_NO_EC
        else if (i == EVP_PKEY_EC)
                {
                ret = SSL_PKEY_ECC;
-               }
+               }       
 #endif
-       else
-               ret= -1;
-
+       else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc) 
+               {
+               ret = SSL_PKEY_GOST94;
+               }
+       else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc) 
+               {
+               ret = SSL_PKEY_GOST01;
+               }
 err:
        if(!pkey) EVP_PKEY_free(pk);
        return(ret);
@@ -599,37 +591,179 @@ int ssl_verify_alarm_type(long type)
        return(al);
        }
 
-int ssl3_setup_buffers(SSL *s)
+#ifndef OPENSSL_NO_BUF_FREELISTS
+/* On some platforms, malloc() performance is bad enough that you can't just
+ * free() and malloc() buffers all the time, so we need to use freelists from
+ * unused buffers.  Currently, each freelist holds memory chunks of only a
+ * given size (list->chunklen); other sized chunks are freed and malloced.
+ * This doesn't help much if you're using many different SSL option settings
+ * with a given context.  (The options affecting buffer size are
+ * max_send_fragment, read buffer vs write buffer,
+ * SSL_OP_MICROSOFT_BIG_WRITE_BUFFER, SSL_OP_NO_COMPRESSION, and
+ * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.)  Using a separate freelist for every
+ * possible size is not an option, since max_send_fragment can take on many
+ * different values.
+ *
+ * If you are on a platform with a slow malloc(), and you're using SSL
+ * connections with many different settings for these options, and you need to
+ * use the SSL_MOD_RELEASE_BUFFERS feature, you have a few options:
+ *    - Link against a faster malloc implementation.
+ *    - Use a separate SSL_CTX for each option set.
+ *    - Improve this code.
+ */
+static void *
+freelist_extract(SSL_CTX *ctx, int for_read, int sz)
+       {
+       SSL3_BUF_FREELIST *list;
+       SSL3_BUF_FREELIST_ENTRY *ent = NULL;
+       void *result = NULL;
+
+       CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+       list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
+       if (list != NULL && sz == list->chunklen)
+               ent = list->head;
+       if (ent != NULL)
+               {
+               list->head = ent->next;
+               result = ent;
+               if (--list->len == 0)
+                       list->chunklen = 0;
+               }
+       CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+       if (!result)
+               result = OPENSSL_malloc(sz);
+       return result;
+}
+
+static void
+freelist_insert(SSL_CTX *ctx, int for_read, size_t sz, void *mem)
+       {
+       SSL3_BUF_FREELIST *list;
+       SSL3_BUF_FREELIST_ENTRY *ent;
+
+       CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+       list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
+       if (list != NULL &&
+           (sz == list->chunklen || list->chunklen == 0) &&
+           list->len < ctx->freelist_max_len &&
+           sz >= sizeof(*ent))
+               {
+               list->chunklen = sz;
+               ent = mem;
+               ent->next = list->head;
+               list->head = ent;
+               ++list->len;
+               mem = NULL;
+               }
+
+       CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+       if (mem)
+               OPENSSL_free(mem);
+       }
+#else
+#define freelist_extract(c,fr,sz) OPENSSL_malloc(sz)
+#define freelist_insert(c,fr,sz,m) OPENSSL_free(m)
+#endif
+
+int ssl3_setup_read_buffer(SSL *s)
        {
        unsigned char *p;
-       unsigned int extra;
-       size_t len;
+       size_t len,align=0;
+
+#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
+       align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+#endif
 
        if (s->s3->rbuf.buf == NULL)
                {
+               len = SSL3_RT_MAX_PLAIN_LENGTH
+                       + SSL3_RT_MAX_ENCRYPTED_OVERHEAD
+                       + SSL3_RT_HEADER_LENGTH + align;
                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
-                       extra=SSL3_RT_MAX_EXTRA;
-               else
-                       extra=0;
-               len = SSL3_RT_MAX_PACKET_SIZE + extra;
-               if ((p=OPENSSL_malloc(len)) == NULL)
+                       {
+                       s->s3->init_extra = 1;
+                       len += SSL3_RT_MAX_EXTRA;
+                       }
+#ifndef OPENSSL_NO_COMP
+               if (!(s->options & SSL_OP_NO_COMPRESSION))
+                       len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+#endif
+               if ((p=freelist_extract(s->ctx, 1, len)) == NULL)
                        goto err;
                s->s3->rbuf.buf = p;
                s->s3->rbuf.len = len;
                }
 
+       s->packet= &(s->s3->rbuf.buf[0]);
+       return 1;
+
+err:
+       SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER,ERR_R_MALLOC_FAILURE);
+       return 0;
+       }
+
+int ssl3_setup_write_buffer(SSL *s)
+       {
+       unsigned char *p;
+       size_t len,align=0;
+
+#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
+       align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+#endif
+
        if (s->s3->wbuf.buf == NULL)
                {
-               len = SSL3_RT_MAX_PACKET_SIZE;
-               len += SSL3_RT_HEADER_LENGTH + 256; /* extra space for empty fragment */
-               if ((p=OPENSSL_malloc(len)) == NULL)
+               len = s->max_send_fragment
+                       + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
+                       + SSL3_RT_HEADER_LENGTH + align;
+#ifndef OPENSSL_NO_COMP
+               if (!(s->options & SSL_OP_NO_COMPRESSION))
+                       len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+#endif
+               if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+                       len += SSL3_RT_HEADER_LENGTH + align
+                               + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
+
+               if ((p=freelist_extract(s->ctx, 0, len)) == NULL)
                        goto err;
                s->s3->wbuf.buf = p;
                s->s3->wbuf.len = len;
                }
-       s->packet= &(s->s3->rbuf.buf[0]);
-       return(1);
+
+       return 1;
+
 err:
-       SSLerr(SSL_F_SSL3_SETUP_BUFFERS,ERR_R_MALLOC_FAILURE);
-       return(0);
+       SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER,ERR_R_MALLOC_FAILURE);
+       return 0;
        }
+
+
+int ssl3_setup_buffers(SSL *s)
+       {
+       if (!ssl3_setup_read_buffer(s))
+               return 0;
+       if (!ssl3_setup_write_buffer(s))
+               return 0;
+       return 1;
+       }
+
+int ssl3_release_write_buffer(SSL *s)
+       {
+       if (s->s3->wbuf.buf != NULL)
+               {
+               freelist_insert(s->ctx, 0, s->s3->wbuf.len, s->s3->wbuf.buf);
+               s->s3->wbuf.buf = NULL;
+               }
+       return 1;
+       }
+
+int ssl3_release_read_buffer(SSL *s)
+       {
+       if (s->s3->rbuf.buf != NULL)
+               {
+               freelist_insert(s->ctx, 1, s->s3->rbuf.len, s->s3->rbuf.buf);
+               s->s3->rbuf.buf = NULL;
+               }
+       return 1;
+       }
+