Support TLS extensions (specifically, HostName)

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 71d4f64975761fcb950531c1ea661a29867464d6..afe7162ab71e2cd13c5b7603e60c2f1245792dac 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -125,18 +125,27 @@
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>

+#ifndef OPENSSL_NO_DH

 #include <openssl/dh.h>
 #include <openssl/dh.h>

+#endif

 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 

-OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
+SSL3_ENC_METHOD ssl3_undef_enc_method={

        /* evil casts, but these functions are only called if there's a library bug */
        (int (*)(SSL *,int))ssl_undefined_function,
        (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
        ssl_undefined_function,
        (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
        (int (*)(SSL*, int))ssl_undefined_function,
        /* evil casts, but these functions are only called if there's a library bug */
        (int (*)(SSL *,int))ssl_undefined_function,
        (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
        ssl_undefined_function,
        (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
        (int (*)(SSL*, int))ssl_undefined_function,

-       (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
+       (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function,
+       0,      /* finish_mac_length */
+       (int (*)(SSL *, EVP_MD_CTX *, unsigned char *))ssl_undefined_function,
+       NULL,   /* client_finished_label */
+       0,      /* client_finished_label_len */
+       NULL,   /* server_finished_label */
+       0,      /* server_finished_label_len */
+       (int (*)(int))ssl_undefined_function

        };
 
 int SSL_clear(SSL *s)
        };
 
 int SSL_clear(SSL *s)


@@ -210,7 +219,7 @@ int SSL_clear(SSL *s)
        }
 
 /** Used to change an SSL_CTXs default SSL method type */
        }
 
 /** Used to change an SSL_CTXs default SSL method type */

-int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth)
+int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth)

        {
        STACK_OF(SSL_CIPHER) *sk;
 
        {
        STACK_OF(SSL_CIPHER) *sk;
 


@@ -294,6 +303,7 @@ SSL *SSL_new(SSL_CTX *ctx)
        s->trust = ctx->trust;
 #endif
        s->quiet_shutdown=ctx->quiet_shutdown;
        s->trust = ctx->trust;
 #endif
        s->quiet_shutdown=ctx->quiet_shutdown;

+       s->max_send_fragment = ctx->max_send_fragment;

 
        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
        s->ctx=ctx;
 
        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
        s->ctx=ctx;


@@ -866,7 +876,7 @@ int SSL_peek(SSL *s,void *buf,int num)
        {
        if (s->handshake_func == 0)
                {
        {
        if (s->handshake_func == 0)
                {

-               SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
+               SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED);

                return -1;
                }
 
                return -1;
                }
 


@@ -957,6 +967,18 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
                l=s->max_cert_list;
                s->max_cert_list=larg;
                return(l);
                l=s->max_cert_list;
                s->max_cert_list=larg;
                return(l);

+       case SSL_CTRL_SET_MTU:
+               if (SSL_version(s) == DTLS1_VERSION)
+                       {
+                       s->d1->mtu = larg;
+                       return larg;
+                       }
+               return 0;
+       case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
+               if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
+                       return 0;
+               s->max_send_fragment = larg;
+               return 1;

        default:
                return(s->method->ssl_ctrl(s,cmd,larg,parg));
                }
        default:
                return(s->method->ssl_ctrl(s,cmd,larg,parg));
                }


@@ -1045,6 +1067,11 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg)
                return(ctx->options|=larg);
        case SSL_CTRL_MODE:
                return(ctx->mode|=larg);
                return(ctx->options|=larg);
        case SSL_CTRL_MODE:
                return(ctx->mode|=larg);

+       case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
+               if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
+                       return 0;
+               ctx->max_send_fragment = larg;
+               return 1;

        default:
                return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
                }
        default:
                return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
                }


@@ -1146,8 +1173,21 @@ int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
        
        sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list,
                &ctx->cipher_list_by_id,str);
        
        sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list,
                &ctx->cipher_list_by_id,str);

-/* XXXX */
-       return((sk == NULL)?0:1);
+       /* ssl_create_cipher_list may return an empty stack if it
+        * was unable to find a cipher matching the given rule string
+        * (for example if the rule string specifies a cipher which
+        * has been disabled). This is not an error as far as 
+        * ssl_create_cipher_list is concerned, and hence 
+        * ctx->cipher_list and ctx->cipher_list_by_id has been
+        * updated. */
+       if (sk == NULL)
+               return 0;
+       else if (sk_SSL_CIPHER_num(sk) == 0)
+               {
+               SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
+               return 0;
+               }
+       return 1;

        }
 
 /** specify the ciphers to be used by the SSL */
        }
 
 /** specify the ciphers to be used by the SSL */


@@ -1157,8 +1197,15 @@ int SSL_set_cipher_list(SSL *s,const char *str)
        
        sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list,
                &s->cipher_list_by_id,str);
        
        sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list,
                &s->cipher_list_by_id,str);

-/* XXXX */
-       return((sk == NULL)?0:1);
+       /* see comment in SSL_CTX_set_cipher_list */
+       if (sk == NULL)
+               return 0;
+       else if (sk_SSL_CIPHER_num(sk) == 0)
+               {
+               SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
+               return 0;
+               }
+       return 1;

        }
 
 /* works well for SSLv2, not so good for SSLv3 */
        }
 
 /* works well for SSLv2, not so good for SSLv3 */


@@ -1197,7 +1244,8 @@ char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
        return(buf);
        }
 
        return(buf);
        }
 

-int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p)
+int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p,
+                             int (*put_cb)(const SSL_CIPHER *, unsigned char *))

        {
        int i,j=0;
        SSL_CIPHER *c;
        {
        int i,j=0;
        SSL_CIPHER *c;


@@ -1216,7 +1264,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p)
                 if ((c->algorithms & SSL_KRB5) && nokrb5)
                     continue;
 #endif /* OPENSSL_NO_KRB5 */                    
                 if ((c->algorithms & SSL_KRB5) && nokrb5)
                     continue;
 #endif /* OPENSSL_NO_KRB5 */                    

-               j=ssl_put_cipher_by_char(s,c,p);
+
+               j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);

                p+=j;
                }
        return(p-q);
                p+=j;
                }
        return(p-q);


@@ -1266,6 +1315,27 @@ err:
        return(NULL);
        }
 
        return(NULL);
        }
 

+#ifndef OPENSSL_TLSEXT
+/** return a servername extension value if provided in CLIENT HELLO
+ * or NULL. 
+ * For the moment, only hostname types are supported. 
+ */
+
+const char *SSL_get_servername(const SSL *s, const int type) {
+
+       if (type != TLSEXT_TYPE_SERVER_host) 
+               return NULL;
+       return s->session /*&&s->session->tlsext_hostname*/?s->session->tlsext_hostname:s->tlsext_hostname;
+}
+
+int SSL_get_servername_type(const SSL *s) {
+
+       if (s->session &&s->session->tlsext_hostname ?s->session->tlsext_hostname:s->tlsext_hostname) 
+               return TLSEXT_TYPE_SERVER_host;
+       return -1;
+}
+
+#endif

 unsigned long SSL_SESSION_hash(const SSL_SESSION *a)
        {
        unsigned long l;
 unsigned long SSL_SESSION_hash(const SSL_SESSION *a)
        {
        unsigned long l;


@@ -1299,7 +1369,7 @@ int SSL_SESSION_cmp(const SSL_SESSION *a,const SSL_SESSION *b)
 static IMPLEMENT_LHASH_HASH_FN(SSL_SESSION_hash, SSL_SESSION *)
 static IMPLEMENT_LHASH_COMP_FN(SSL_SESSION_cmp, SSL_SESSION *)
 
 static IMPLEMENT_LHASH_HASH_FN(SSL_SESSION_hash, SSL_SESSION *)
 static IMPLEMENT_LHASH_COMP_FN(SSL_SESSION_cmp, SSL_SESSION *)
 

-SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
+SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)

        {
        SSL_CTX *ret=NULL;
        
        {
        SSL_CTX *ret=NULL;
        


@@ -1368,6 +1438,8 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
        ret->default_passwd_callback=0;
        ret->default_passwd_callback_userdata=NULL;
        ret->client_cert_cb=0;
        ret->default_passwd_callback=0;
        ret->default_passwd_callback_userdata=NULL;
        ret->client_cert_cb=0;

+       ret->app_gen_cookie_cb=0;
+       ret->app_verify_cookie_cb=0;

 
        ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
                        LHASH_COMP_FN(SSL_SESSION_cmp));
 
        ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
                        LHASH_COMP_FN(SSL_SESSION_cmp));


@@ -1413,6 +1485,12 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
        ret->extra_certs=NULL;
        ret->comp_methods=SSL_COMP_get_compression_methods();
 
        ret->extra_certs=NULL;
        ret->comp_methods=SSL_COMP_get_compression_methods();
 

+       ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
+
+#ifndef OPENSSL_NO_TLSEXT
+       ret->tlsext_servername_callback = NULL;
+       ret->tlsext_servername_arg = NULL;
+#endif

        return(ret);
 err:
        SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
        return(ret);
 err:
        SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);


@@ -1520,7 +1598,10 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
        int rsa_enc_export,dh_rsa_export,dh_dsa_export;
        int rsa_tmp_export,dh_tmp_export,kl;
        unsigned long mask,emask;
        int rsa_enc_export,dh_rsa_export,dh_dsa_export;
        int rsa_tmp_export,dh_tmp_export,kl;
        unsigned long mask,emask;

-       int have_ecc_cert, have_ecdh_tmp, ecdh_ok, ecdsa_ok, ecc_pkey_size;
+       int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size;
+#ifndef OPENSSL_NO_ECDH
+       int have_ecdh_tmp;
+#endif

        X509 *x = NULL;
        EVP_PKEY *ecc_pkey = NULL;
        int signature_nid = 0;
        X509 *x = NULL;
        EVP_PKEY *ecc_pkey = NULL;
        int signature_nid = 0;


@@ -1858,17 +1939,17 @@ void ssl_update_cache(SSL *s,int mode)
                        ?s->ctx->stats.sess_connect_good
                        :s->ctx->stats.sess_accept_good) & 0xff) == 0xff)
                        {
                        ?s->ctx->stats.sess_connect_good
                        :s->ctx->stats.sess_accept_good) & 0xff) == 0xff)
                        {

-                       SSL_CTX_flush_sessions(s->ctx,time(NULL));
+                       SSL_CTX_flush_sessions(s->ctx,(unsigned long)time(NULL));

                        }
                }
        }
 
                        }
                }
        }
 

-SSL_METHOD *SSL_get_ssl_method(SSL *s)
+const SSL_METHOD *SSL_get_ssl_method(SSL *s)

        {
        return(s->method);
        }
 
        {
        return(s->method);
        }
 

-int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth)
+int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)

        {
        int conn= -1;
        int ret=1;
        {
        int conn= -1;
        int ret=1;


@@ -2203,6 +2284,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                OPENSSL_free(s->enc_write_ctx);
                s->enc_write_ctx=NULL;
                }
                OPENSSL_free(s->enc_write_ctx);
                s->enc_write_ctx=NULL;
                }

+#ifndef OPENSSL_NO_COMP

        if (s->expand != NULL)
                {
                COMP_CTX_free(s->expand);
        if (s->expand != NULL)
                {
                COMP_CTX_free(s->expand);


@@ -2213,6 +2295,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                COMP_CTX_free(s->compress);
                s->compress=NULL;
                }
                COMP_CTX_free(s->compress);
                s->compress=NULL;
                }

+#endif

        }
 
 /* Fix this function so that it takes an optional type parameter */
        }
 
 /* Fix this function so that it takes an optional type parameter */


@@ -2239,6 +2322,16 @@ SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
                return(s->session->cipher);
        return(NULL);
        }
                return(s->session->cipher);
        return(NULL);
        }

+#ifdef OPENSSL_NO_COMP
+const void *SSL_get_current_compression(SSL *s)
+       {
+       return NULL;
+       }
+const void *SSL_get_current_expansion(SSL *s)
+       {
+       return NULL;
+       }
+#else

 
 const COMP_METHOD *SSL_get_current_compression(SSL *s)
        {
 
 const COMP_METHOD *SSL_get_current_compression(SSL *s)
        {


@@ -2253,6 +2346,7 @@ const COMP_METHOD *SSL_get_current_expansion(SSL *s)
                return(s->expand->meth);
        return(NULL);
        }
                return(s->expand->meth);
        return(NULL);
        }

+#endif

 
 int ssl_init_wbio_buffer(SSL *s,int push)
        {
 
 int ssl_init_wbio_buffer(SSL *s,int push)
        {


@@ -2346,6 +2440,19 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
        return(ssl->ctx);
        }
 
        return(ssl->ctx);
        }
 

+SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
+       {
+
+       if (ssl->cert != NULL)
+               ssl_cert_free(ssl->cert);
+       ssl->cert = ssl_cert_dup(ctx->cert);
+       CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+       if (ssl->ctx != NULL)
+               SSL_CTX_free(ssl->ctx); /* decrement reference count */
+       ssl->ctx = ctx;
+       return(ssl->ctx);
+       }
+

 #ifndef OPENSSL_NO_STDIO
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
        {
 #ifndef OPENSSL_NO_STDIO
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
        {


@@ -2365,7 +2472,9 @@ void SSL_set_info_callback(SSL *ssl,
        ssl->info_callback=cb;
        }
 
        ssl->info_callback=cb;
        }
 

-void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val)
+/* One compiler (Diab DCC) doesn't like argument names in returned
+   function pointer.  */
+void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/)

        {
        return ssl->info_callback;
        }
        {
        return ssl->info_callback;
        }