For VMS, implement the possibility to choose 64-bit pointers with

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 73a573ee29f31216d02207fd03db76192461509a..f3d230b7e6e2d728b29dce516958700cfa9146f5 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2012,6 +2012,152 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 #endif /* OPENSSL_NO_ECDH */
 
+#ifndef OPENSSL_NO_SRP
+       /* Cipher C01A */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+       TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+       SSL_kSRP,
+       SSL_aNULL,
+       SSL_3DES,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       168,
+       168,
+       },
+
+       /* Cipher C01B */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+       TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+       SSL_kSRP,
+       SSL_aRSA,
+       SSL_3DES,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       168,
+       168,
+       },
+
+       /* Cipher C01C */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+       TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+       SSL_kSRP,
+       SSL_aDSS,
+       SSL_3DES,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       168,
+       168,
+       },
+
+       /* Cipher C01D */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
+       TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
+       SSL_kSRP,
+       SSL_aNULL,
+       SSL_AES128,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher C01E */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+       TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+       SSL_kSRP,
+       SSL_aRSA,
+       SSL_AES128,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher C01F */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+       TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+       SSL_kSRP,
+       SSL_aDSS,
+       SSL_AES128,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher C020 */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
+       TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
+       SSL_kSRP,
+       SSL_aNULL,
+       SSL_AES256,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       256,
+       256,
+       },
+
+       /* Cipher C021 */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+       TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+       SSL_kSRP,
+       SSL_aRSA,
+       SSL_AES256,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       256,
+       256,
+       },
+
+       /* Cipher C022 */
+       {
+       1,
+       TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+       TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+       SSL_kSRP,
+       SSL_aDSS,
+       SSL_AES256,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       256,
+       256,
+       },
+#endif  /* OPENSSL_NO_SRP */
+
 #ifdef TEMP_GOST_TLS
 /* Cipher FF00 */
        {
@@ -2128,6 +2274,9 @@ int ssl3_new(SSL *s)
 
        s->s3=s3;
 
+#ifndef OPENSSL_NO_SRP
+       SSL_SRP_CTX_init(s);
+#endif
        s->method->ssl_clear(s);
        return(1);
 err:
@@ -2168,6 +2317,9 @@ void ssl3_free(SSL *s)
                BIO_free(s->s3->handshake_buffer);
        }
        if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
+#ifndef OPENSSL_NO_SRP
+       SSL_SRP_CTX_free(s);
+#endif
        OPENSSL_cleanse(s->s3,sizeof *s->s3);
        OPENSSL_free(s->s3);
        s->s3=NULL;
@@ -2211,6 +2363,7 @@ void ssl3_clear(SSL *s)
        wlen = s->s3->wbuf.len;
        if (s->s3->handshake_buffer) {
                BIO_free(s->s3->handshake_buffer);
+               s->s3->handshake_buffer = NULL;
        }
        if (s->s3->handshake_dgst) {
                ssl3_free_digest_list(s);
@@ -2229,8 +2382,24 @@ void ssl3_clear(SSL *s)
        s->s3->num_renegotiations=0;
        s->s3->in_read_app_data=0;
        s->version=SSL3_VERSION;
+
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+       if (s->next_proto_negotiated)
+               {
+               OPENSSL_free(s->next_proto_negotiated);
+               s->next_proto_negotiated = NULL;
+               s->next_proto_negotiated_len = 0;
+               }
+#endif
        }
 
+#ifndef OPENSSL_NO_SRP
+static char * MS_CALLBACK srp_password_from_info_cb(SSL *s, void *arg)
+       {
+       return BUF_strdup(s->srp_ctx.info) ;
+       }
+#endif
+
 long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
        {
        int ret=0;
@@ -2534,6 +2703,11 @@ long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
                                        unsigned char *, int, void *))fp;
                break;
 #endif
+       case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
+               {
+               s->not_resumable_session_cb = (int (*)(SSL *, int))fp;
+               }
+               break;
        default:
                break;
                }
@@ -2708,6 +2882,38 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                return 1;
                break;
 
+#ifndef OPENSSL_NO_SRP
+       case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME:
+               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
+               if (ctx->srp_ctx.login != NULL)
+                       OPENSSL_free(ctx->srp_ctx.login);
+               ctx->srp_ctx.login = NULL;
+               if (parg == NULL)
+                       break;
+               if (strlen((char *)parg) > 254)
+                       {
+                       SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);
+                       return 0;
+                       } 
+               if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL)
+                       {
+                       SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);
+                       return 0;
+                       }
+               break;
+       case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:
+               ctx->srp_ctx.SRP_give_srp_client_pwd_callback=srp_password_from_info_cb;
+               ctx->srp_ctx.info=parg;
+               break;
+       case SSL_CTRL_SET_SRP_ARG:
+               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
+               ctx->srp_ctx.SRP_cb_arg=parg;
+               break;
+
+       case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:
+               ctx->srp_ctx.strength=larg;
+               break;
+#endif
 #endif /* !OPENSSL_NO_TLSEXT */
 
        /* A Thawte special :-) */
@@ -2777,7 +2983,30 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
                                                HMAC_CTX *, int))fp;
                break;
 
+#ifndef OPENSSL_NO_SRP
+       case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB:
+               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
+               ctx->srp_ctx.SRP_verify_param_callback=(int (*)(SSL *,void *))fp;
+               break;
+       case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB:
+               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
+               ctx->srp_ctx.TLS_ext_srp_username_callback=(int (*)(SSL *,int *,void *))fp;
+               break;
+       case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB:
+               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
+               ctx->srp_ctx.SRP_give_srp_client_pwd_callback=(char *(*)(SSL *,void *))fp;
+               break;
+       case SSL_CTRL_SET_TLS_EXT_SRP_MISSING_CLIENT_USERNAME_CB:
+               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
+               ctx->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback=(char *(*)(SSL *,void *))fp;
+               break;
 #endif
+#endif
+       case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
+               {
+               ctx->not_resumable_session_cb = (int (*)(SSL *, int))fp;
+               }
+               break;
        default:
                return(0);
                }
@@ -2821,13 +3050,11 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
        SSL_CIPHER *c,*ret=NULL;
        STACK_OF(SSL_CIPHER) *prio, *allow;
        int i,ii,ok;
-#ifndef OPENSSL_NO_TLSEXT
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_EC)
        unsigned int j;
-#ifndef OPENSSL_NO_EC
        int ec_ok, ec_nid;
        unsigned char ec_search1 = 0, ec_search2 = 0;
-#endif /* OPENSSL_NO_EC */
-#endif /* OPENSSL_NO_TLSEXT */
+#endif
        CERT *cert;
        unsigned long alg_k,alg_a,mask_k,mask_a,emask_k,emask_a;
 
@@ -2879,6 +3106,10 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                mask_a = cert->mask_a;
                emask_k = cert->export_mask_k;
                emask_a = cert->export_mask_a;
+#ifndef OPENSSL_NO_SRP
+               mask_k=cert->mask_k | s->srp_ctx.srp_Mask;
+               emask_k=cert->export_mask_k | s->srp_ctx.srp_Mask;
+#endif
                        
 #ifdef KSSL_DEBUG
 /*             printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/
@@ -3089,6 +3320,18 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
 
        alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 
+#ifndef OPENSSL_NO_GOST
+       if (s->version >= TLS1_VERSION)
+               {
+               if (alg_k & SSL_kGOST)
+                       {
+                       p[ret++]=TLS_CT_GOST94_SIGN;
+                       p[ret++]=TLS_CT_GOST01_SIGN;
+                       return(ret);
+                       }
+               }
+#endif
+
 #ifndef OPENSSL_NO_DH
        if (alg_k & (SSL_kDHr|SSL_kEDH))
                {
@@ -3315,4 +3558,3 @@ need to go to SSL_ST_ACCEPT.
                }
        return(ret);
        }
-