projects
/
openssl.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Clarify CMS_decrypt behaviour.
[openssl.git]
/
ssl
/
t1_enc.c
diff --git
a/ssl/t1_enc.c
b/ssl/t1_enc.c
index acc5f213636ef92d00a852111be528655fc5c464..a98f6fe882d7362d76e2fe273a7e4ccefd16b748 100644
(file)
--- a/
ssl/t1_enc.c
+++ b/
ssl/t1_enc.c
@@
-160,7
+160,7
@@
static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
{
int chunk;
size_t j;
{
int chunk;
size_t j;
- EVP_MD_CTX ctx, ctx_tmp;
+ EVP_MD_CTX ctx, ctx_tmp
, ctx_init
;
EVP_PKEY *mac_key;
unsigned char A1[EVP_MAX_MD_SIZE];
size_t A1_len;
EVP_PKEY *mac_key;
unsigned char A1[EVP_MAX_MD_SIZE];
size_t A1_len;
@@
-171,14
+171,14
@@
static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
EVP_MD_CTX_init(&ctx);
EVP_MD_CTX_init(&ctx_tmp);
EVP_MD_CTX_init(&ctx);
EVP_MD_CTX_init(&ctx_tmp);
- EVP_MD_CTX_
set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
);
- EVP_MD_CTX_set_flags(&ctx_
tmp
, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+ EVP_MD_CTX_
init(&ctx_init
);
+ EVP_MD_CTX_set_flags(&ctx_
init
, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
if (!mac_key)
goto err;
mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
if (!mac_key)
goto err;
- if (!EVP_DigestSignInit(&ctx,NULL,md, NULL, mac_key))
+ if (!EVP_DigestSignInit(&ctx
_init
,NULL,md, NULL, mac_key))
goto err;
goto err;
- if (!EVP_
DigestSignInit(&ctx_tmp,NULL,md, NULL, mac_key
))
+ if (!EVP_
MD_CTX_copy_ex(&ctx,&ctx_init
))
goto err;
if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len))
goto err;
goto err;
if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len))
goto err;
@@
-196,13
+196,11
@@
static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
for (;;)
{
/* Reinit mac contexts */
for (;;)
{
/* Reinit mac contexts */
- if (!EVP_DigestSignInit(&ctx,NULL,md, NULL, mac_key))
- goto err;
- if (!EVP_DigestSignInit(&ctx_tmp,NULL,md, NULL, mac_key))
+ if (!EVP_MD_CTX_copy_ex(&ctx,&ctx_init))
goto err;
if (!EVP_DigestSignUpdate(&ctx,A1,A1_len))
goto err;
goto err;
if (!EVP_DigestSignUpdate(&ctx,A1,A1_len))
goto err;
- if (
!EVP_DigestSignUpdate(&ctx_tmp,A1,A1_len
))
+ if (
olen>chunk && !EVP_MD_CTX_copy_ex(&ctx_tmp,&ctx
))
goto err;
if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len))
goto err;
goto err;
if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len))
goto err;
@@
-238,6
+236,7
@@
err:
EVP_PKEY_free(mac_key);
EVP_MD_CTX_cleanup(&ctx);
EVP_MD_CTX_cleanup(&ctx_tmp);
EVP_PKEY_free(mac_key);
EVP_MD_CTX_cleanup(&ctx);
EVP_MD_CTX_cleanup(&ctx_tmp);
+ EVP_MD_CTX_cleanup(&ctx_init);
OPENSSL_cleanse(A1,sizeof(A1));
return ret;
}
OPENSSL_cleanse(A1,sizeof(A1));
return ret;
}
@@
-414,15
+413,20
@@
int tls1_change_cipher_state(SSL *s, int which)
s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
else
s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
else
s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
- if (s->enc_write_ctx != NULL)
+ if (s->enc_write_ctx != NULL
&& !SSL_IS_DTLS(s)
)
reuse_dd = 1;
reuse_dd = 1;
- else if ((s->enc_write_ctx=
OPENSSL_malloc(sizeof(EVP_CIPHER_CTX)
)) == NULL)
+ else if ((s->enc_write_ctx=
EVP_CIPHER_CTX_new(
)) == NULL)
goto err;
goto err;
- else
- /* make sure it's intialized in case we exit later with an error */
- EVP_CIPHER_CTX_init(s->enc_write_ctx);
dd= s->enc_write_ctx;
dd= s->enc_write_ctx;
- mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
+ if (SSL_IS_DTLS(s))
+ {
+ mac_ctx = EVP_MD_CTX_create();
+ if (!mac_ctx)
+ goto err;
+ s->write_hash = mac_ctx;
+ }
+ else
+ mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
#ifndef OPENSSL_NO_COMP
if (s->compress != NULL)
{
#ifndef OPENSSL_NO_COMP
if (s->compress != NULL)
{
@@
-1005,7
+1009,8
@@
int tls1_mac(SSL *ssl, unsigned char *md, int send)
}
else
{
}
else
{
- EVP_MD_CTX_copy(&hmac,hash);
+ if (!EVP_MD_CTX_copy(&hmac,hash))
+ return -1;
mac_ctx = &hmac;
}
mac_ctx = &hmac;
}