Fix SSL handshake functions and SSL_clear() such that SSL_clear()

[openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 413e2e65515eb8a28c458679ad584680e38049fe..52dda37f6d63d0c95af402ff9e57a5a52755dba2 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -62,10 +62,8 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include "ssl_locl.h"
-
-#ifndef OPENSSL_NO_KRB5
 #include "kssl_lcl.h"
-#endif
+#include <openssl/md5.h>
 
 static SSL_METHOD *ssl3_get_client_method(int ver);
 static int ssl3_client_hello(SSL *s);
@@ -121,8 +119,8 @@ int ssl3_connect(SSL *s)
        else if (s->ctx->info_callback != NULL)
                cb=s->ctx->info_callback;
        
-       if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); 
        s->in_handshake++;
+       if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s); 
 
        for (;;)
                {
@@ -556,7 +554,7 @@ static int ssl3_get_server_hello(SSL *s)
                &ok);
 
        if (!ok) return((int)n);
-       d=p=(unsigned char *)s->init_buf->data;
+       d=p=(unsigned char *)s->init_msg;
 
        if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
                {
@@ -695,11 +693,7 @@ static int ssl3_get_server_certificate(SSL *s)
                SSL3_ST_CR_CERT_A,
                SSL3_ST_CR_CERT_B,
                -1,
-#if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32)
-               1024*30, /* 30k max cert list :-) */
-#else
-               1024*100, /* 100k max cert list :-) */
-#endif
+               s->max_cert_list,
                &ok);
 
        if (!ok) return((int)n);
@@ -716,7 +710,7 @@ static int ssl3_get_server_certificate(SSL *s)
                SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
                goto f_err;
                }
-       d=p=(unsigned char *)s->init_buf->data;
+       d=p=(unsigned char *)s->init_msg;
 
        if ((sk=sk_X509_new_null()) == NULL)
                {
@@ -884,11 +878,13 @@ static int ssl3_get_key_exchange(SSL *s)
        DH *dh=NULL;
 #endif
 
+       /* use same message size as in ssl3_get_certificate_request()
+        * as ServerKeyExchange message may be skipped */
        n=ssl3_get_message(s,
                SSL3_ST_CR_KEY_EXCH_A,
                SSL3_ST_CR_KEY_EXCH_B,
                -1,
-               1024*8, /* ?? */
+               s->max_cert_list,
                &ok);
 
        if (!ok) return((int)n);
@@ -899,7 +895,7 @@ static int ssl3_get_key_exchange(SSL *s)
                return(1);
                }
 
-       param=p=(unsigned char *)s->init_buf->data;
+       param=p=(unsigned char *)s->init_msg;
 
        if (s->session->sess_cert != NULL)
                {
@@ -925,6 +921,7 @@ static int ssl3_get_key_exchange(SSL *s)
 
        param_len=0;
        alg=s->s3->tmp.new_cipher->algorithms;
+       EVP_MD_CTX_init(&md_ctx);
 
 #ifndef OPENSSL_NO_RSA
        if (alg & SSL_kRSA)
@@ -1092,12 +1089,12 @@ static int ssl3_get_key_exchange(SSL *s)
                        q=md_buf;
                        for (num=2; num > 0; num--)
                                {
-                               EVP_DigestInit(&md_ctx,(num == 2)
-                                       ?s->ctx->md5:s->ctx->sha1);
+                               EVP_DigestInit_ex(&md_ctx,(num == 2)
+                                       ?s->ctx->md5:s->ctx->sha1, NULL);
                                EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                                EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
                                EVP_DigestUpdate(&md_ctx,param,param_len);
-                               EVP_DigestFinal(&md_ctx,q,(unsigned int *)&i);
+                               EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i);
                                q+=i;
                                j+=i;
                                }
@@ -1123,7 +1120,7 @@ static int ssl3_get_key_exchange(SSL *s)
                        if (pkey->type == EVP_PKEY_DSA)
                        {
                        /* lets do DSS */
-                       EVP_VerifyInit(&md_ctx,EVP_dss1());
+                       EVP_VerifyInit_ex(&md_ctx,EVP_dss1(), NULL);
                        EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                        EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
                        EVP_VerifyUpdate(&md_ctx,param,param_len);
@@ -1158,6 +1155,7 @@ static int ssl3_get_key_exchange(SSL *s)
                        }
                }
        EVP_PKEY_free(pkey);
+       EVP_MD_CTX_cleanup(&md_ctx);
        return(1);
 f_err:
        ssl3_send_alert(s,SSL3_AL_FATAL,al);
@@ -1171,6 +1169,7 @@ err:
        if (dh != NULL)
                DH_free(dh);
 #endif
+       EVP_MD_CTX_cleanup(&md_ctx);
        return(-1);
        }
 
@@ -1187,11 +1186,7 @@ static int ssl3_get_certificate_request(SSL *s)
                SSL3_ST_CR_CERT_REQ_A,
                SSL3_ST_CR_CERT_REQ_B,
                -1,
-#if defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_WIN32)
-               1024*30,  /* 30k max cert list :-) */
-#else
-               1024*100, /* 100k max cert list :-) */
-#endif
+               s->max_cert_list,
                &ok);
 
        if (!ok) return((int)n);
@@ -1223,7 +1218,7 @@ static int ssl3_get_certificate_request(SSL *s)
                        }
                }
 
-       d=p=(unsigned char *)s->init_buf->data;
+       d=p=(unsigned char *)s->init_msg;
 
        if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
                {
@@ -1458,6 +1453,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
                                &kssl_err);
                        enc = kssl_map_enc(kssl_ctx->enctype);
+                        if (enc == NULL)
+                            goto err;
 #ifdef KSSL_DEBUG
                         {
                         printf("kssl_cget_tkt rtn %d\n", krb5rc);
@@ -1522,17 +1519,18 @@ static int ssl3_send_client_key_exchange(SSL *s)
                            goto err;
 
                        /*  20010420 VRS.  Tried it this way; failed.
-                       **      EVP_EncryptInit(&ciph_ctx,enc, NULL,NULL);
+                       **      EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
                        **      EVP_CIPHER_CTX_set_key_length(&ciph_ctx,
                        **                              kssl_ctx->length);
-                       **      EVP_EncryptInit(&ciph_ctx,NULL, key,iv);
+                       **      EVP_EncryptInit_ex(&ciph_ctx,NULL, key,iv);
                        */
 
                        memset(iv, 0, EVP_MAX_IV_LENGTH);  /* per RFC 1510 */
-                       EVP_EncryptInit(&ciph_ctx,enc, kssl_ctx->key,iv);
+                       EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,
+                               kssl_ctx->key,iv);
                        EVP_EncryptUpdate(&ciph_ctx,epms,&outl,tmp_buf,
-                                               SSL_MAX_MASTER_KEY_LENGTH);
-                       EVP_EncryptFinal(&ciph_ctx,&(epms[outl]),&padl);
+                               SSL_MAX_MASTER_KEY_LENGTH);
+                       EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
                        outl += padl;
                        EVP_CIPHER_CTX_cleanup(&ciph_ctx);