- {
- unsigned char *p,*key_block,*mac_secret;
- unsigned char exp_key[EVP_MAX_KEY_LENGTH];
- unsigned char exp_iv[EVP_MAX_KEY_LENGTH];
- unsigned char *ms,*key,*iv,*er1,*er2;
- EVP_CIPHER_CTX *dd;
- const EVP_CIPHER *c;
- COMP_METHOD *comp;
- const EVP_MD *m;
- MD5_CTX md;
- int exp,n,i,j,k,cl;
-
- exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
- c=s->s3->tmp.new_sym_enc;
- m=s->s3->tmp.new_hash;
- if (s->s3->tmp.new_compression == NULL)
- comp=NULL;
- else
- comp=s->s3->tmp.new_compression->method;
- key_block=s->s3->tmp.key_block;
-
- if (which & SSL3_CC_READ)
- {
- if ((s->enc_read_ctx == NULL) &&
- ((s->enc_read_ctx=(EVP_CIPHER_CTX *)
- Malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
- goto err;
- dd= s->enc_read_ctx;
- s->read_hash=m;
- /* COMPRESS */
- if (s->expand != NULL)
- {
- COMP_CTX_free(s->expand);
- s->expand=NULL;
- }
- if (comp != NULL)
- {
- s->expand=COMP_CTX_new(comp);
- if (s->expand == NULL)
- {
- SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
- goto err2;
- }
- if (s->s3->rrec.comp == NULL)
- s->s3->rrec.comp=(unsigned char *)
- Malloc(SSL3_RT_MAX_PLAIN_LENGTH);
- if (s->s3->rrec.comp == NULL)
- goto err;
- }
- memset(&(s->s3->read_sequence[0]),0,8);
- mac_secret= &(s->s3->read_mac_secret[0]);
- }
- else
- {
- if ((s->enc_write_ctx == NULL) &&
- ((s->enc_write_ctx=(EVP_CIPHER_CTX *)
- Malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
- goto err;
- dd= s->enc_write_ctx;
- s->write_hash=m;
- /* COMPRESS */
- if (s->compress != NULL)
- {
- COMP_CTX_free(s->compress);
- s->compress=NULL;
- }
- if (comp != NULL)
- {
- s->compress=COMP_CTX_new(comp);
- if (s->compress == NULL)
- {
- SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
- goto err2;
- }
- }
- memset(&(s->s3->write_sequence[0]),0,8);
- mac_secret= &(s->s3->write_mac_secret[0]);
- }
-
- EVP_CIPHER_CTX_init(dd);
-
- p=s->s3->tmp.key_block;
- i=EVP_MD_size(m);
- cl=EVP_CIPHER_key_length(c);
- j=exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
- cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
- /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
- k=EVP_CIPHER_iv_length(c);
- if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
- (which == SSL3_CHANGE_CIPHER_SERVER_READ))
- {
- ms= &(p[ 0]); n=i+i;
- key= &(p[ n]); n+=j+j;
- iv= &(p[ n]); n+=k+k;
- er1= &(s->s3->client_random[0]);
- er2= &(s->s3->server_random[0]);
- }
- else
- {
- n=i;
- ms= &(p[ n]); n+=i+j;
- key= &(p[ n]); n+=j+k;
- iv= &(p[ n]); n+=k;
- er1= &(s->s3->server_random[0]);
- er2= &(s->s3->client_random[0]);
- }
-
- if (n > s->s3->tmp.key_block_length)
- {
- SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_INTERNAL_ERROR);
- goto err2;
- }
-
- memcpy(mac_secret,ms,i);
- if (exp)
- {
- /* In here I set both the read and write key/iv to the
- * same value since only the correct one will be used :-).
- */
- MD5_Init(&md);
- MD5_Update(&md,key,j);
- MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
- MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
- MD5_Final(&(exp_key[0]),&md);
- key= &(exp_key[0]);
-
- if (k > 0)
- {
- MD5_Init(&md);
- MD5_Update(&md,er1,SSL3_RANDOM_SIZE);
- MD5_Update(&md,er2,SSL3_RANDOM_SIZE);
- MD5_Final(&(exp_iv[0]),&md);
- iv= &(exp_iv[0]);
- }
- }
-
- s->session->key_arg_length=0;
-
- EVP_CipherInit(dd,c,key,iv,(which & SSL3_CC_WRITE));
-
- memset(&(exp_key[0]),0,sizeof(exp_key));
- memset(&(exp_iv[0]),0,sizeof(exp_iv));
- return(1);
-err:
- SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
-err2:
- return(0);
- }
+{
+ unsigned char *p, *mac_secret;
+ unsigned char exp_key[EVP_MAX_KEY_LENGTH];
+ unsigned char exp_iv[EVP_MAX_IV_LENGTH];
+ unsigned char *ms, *key, *iv, *er1, *er2;
+ EVP_CIPHER_CTX *dd;
+ const EVP_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
+ COMP_METHOD *comp;
+#endif
+ const EVP_MD *m;
+ EVP_MD_CTX md;
+ int is_exp, n, i, j, k, cl;
+ int reuse_dd = 0;
+
+ is_exp = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
+ c = s->s3->tmp.new_sym_enc;
+ m = s->s3->tmp.new_hash;
+ /* m == NULL will lead to a crash later */
+ OPENSSL_assert(m);
+#ifndef OPENSSL_NO_COMP
+ if (s->s3->tmp.new_compression == NULL)
+ comp = NULL;
+ else
+ comp = s->s3->tmp.new_compression->method;
+#endif
+
+ if (which & SSL3_CC_READ) {
+ if (s->enc_read_ctx != NULL)
+ reuse_dd = 1;
+ else if ((s->enc_read_ctx =
+ OPENSSL_malloc(sizeof(*s->enc_read_ctx))) == NULL)
+ goto err;
+ else
+ /*
+ * make sure it's intialized in case we exit later with an error
+ */
+ EVP_CIPHER_CTX_init(s->enc_read_ctx);
+ dd = s->enc_read_ctx;
+
+ if (!ssl_replace_hash(&s->read_hash, m)) {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+ goto err2;
+ }
+#ifndef OPENSSL_NO_COMP
+ /* COMPRESS */
+ COMP_CTX_free(s->expand);
+ s->expand = NULL;
+ if (comp != NULL) {
+ s->expand = COMP_CTX_new(comp);
+ if (s->expand == NULL) {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
+ SSL_R_COMPRESSION_LIBRARY_ERROR);
+ goto err2;
+ }
+ if (!RECORD_LAYER_setup_comp_buffer(&s->rlayer))
+ goto err;
+ }
+#endif
+ RECORD_LAYER_reset_read_sequence(&s->rlayer);
+ mac_secret = &(s->s3->read_mac_secret[0]);
+ } else {
+ if (s->enc_write_ctx != NULL)
+ reuse_dd = 1;
+ else if ((s->enc_write_ctx =
+ OPENSSL_malloc(sizeof(*s->enc_write_ctx))) == NULL)
+ goto err;
+ else
+ /*
+ * make sure it's intialized in case we exit later with an error
+ */
+ EVP_CIPHER_CTX_init(s->enc_write_ctx);
+ dd = s->enc_write_ctx;
+ if (!ssl_replace_hash(&s->write_hash, m)) {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+ goto err2;
+ }
+#ifndef OPENSSL_NO_COMP
+ /* COMPRESS */
+ COMP_CTX_free(s->compress);
+ s->compress = NULL;
+ if (comp != NULL) {
+ s->compress = COMP_CTX_new(comp);
+ if (s->compress == NULL) {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
+ SSL_R_COMPRESSION_LIBRARY_ERROR);
+ goto err2;
+ }
+ }
+#endif
+ RECORD_LAYER_reset_write_sequence(&s->rlayer);
+ mac_secret = &(s->s3->write_mac_secret[0]);
+ }
+
+ if (reuse_dd)
+ EVP_CIPHER_CTX_cleanup(dd);
+
+ p = s->s3->tmp.key_block;
+ i = EVP_MD_size(m);
+ if (i < 0)
+ goto err2;
+ cl = EVP_CIPHER_key_length(c);
+ j = is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
+ cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
+ /* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */
+ k = EVP_CIPHER_iv_length(c);
+ if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
+ (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
+ ms = &(p[0]);
+ n = i + i;
+ key = &(p[n]);
+ n += j + j;
+ iv = &(p[n]);
+ n += k + k;
+ er1 = &(s->s3->client_random[0]);
+ er2 = &(s->s3->server_random[0]);
+ } else {
+ n = i;
+ ms = &(p[n]);
+ n += i + j;
+ key = &(p[n]);
+ n += j + k;
+ iv = &(p[n]);
+ n += k;
+ er1 = &(s->s3->server_random[0]);
+ er2 = &(s->s3->client_random[0]);
+ }
+
+ if (n > s->s3->tmp.key_block_length) {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+ goto err2;
+ }
+
+ EVP_MD_CTX_init(&md);
+ memcpy(mac_secret, ms, i);
+ if (is_exp) {
+ /*
+ * In here I set both the read and write key/iv to the same value
+ * since only the correct one will be used :-).
+ */
+ EVP_DigestInit_ex(&md, EVP_md5(), NULL);
+ EVP_DigestUpdate(&md, key, j);
+ EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
+ EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
+ EVP_DigestFinal_ex(&md, &(exp_key[0]), NULL);
+ key = &(exp_key[0]);
+
+ if (k > 0) {
+ EVP_DigestInit_ex(&md, EVP_md5(), NULL);
+ EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
+ EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
+ EVP_DigestFinal_ex(&md, &(exp_iv[0]), NULL);
+ iv = &(exp_iv[0]);
+ }
+ }
+
+ EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE));
+
+#ifdef OPENSSL_SSL_TRACE_CRYPTO
+ if (s->msg_callback) {
+
+ int wh = which & SSL3_CC_WRITE ?
+ TLS1_RT_CRYPTO_WRITE : TLS1_RT_CRYPTO_READ;
+ s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,
+ mac_secret, EVP_MD_size(m), s, s->msg_callback_arg);
+ if (c->key_len)
+ s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,
+ key, c->key_len, s, s->msg_callback_arg);
+ if (k) {
+ s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_IV,
+ iv, k, s, s->msg_callback_arg);
+ }
+ }
+#endif
+
+ OPENSSL_cleanse(exp_key, sizeof(exp_key));
+ OPENSSL_cleanse(exp_iv, sizeof(exp_iv));
+ EVP_MD_CTX_cleanup(&md);
+ return (1);
+ err:
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
+ err2:
+ OPENSSL_cleanse(exp_key, sizeof(exp_key));
+ OPENSSL_cleanse(exp_iv, sizeof(exp_iv));
+ return (0);
+}