summaryrefslogtreecommitdiffstats
path: root/ssl
diff options
context:
space:
mode:
Diffstat (limited to 'ssl')
-rw-r--r--ssl/KEYS28
-rw-r--r--ssl/f52
-rw-r--r--ssl/f.mak0
-rw-r--r--ssl/s23_clnt.c4
-rw-r--r--ssl/s23_lib.c3
-rw-r--r--ssl/s23_srvr.c20
-rw-r--r--ssl/s2_clnt.c7
-rw-r--r--ssl/s2_lib.c13
-rw-r--r--ssl/s3_both.c24
-rw-r--r--ssl/s3_clnt.c39
-rw-r--r--ssl/s3_enc.c58
-rw-r--r--ssl/s3_lib.c54
-rw-r--r--ssl/s3_pkt.c48
-rw-r--r--ssl/s3_srvr.c2
-rw-r--r--ssl/ssl.err272
-rw-r--r--ssl/ssl.h327
-rw-r--r--ssl/ssl3.h14
-rw-r--r--ssl/ssl_algs.c6
-rw-r--r--ssl/ssl_cert.c25
-rw-r--r--ssl/ssl_ciph.c2
-rw-r--r--ssl/ssl_comp.c580
-rw-r--r--ssl/ssl_err.c20
-rw-r--r--ssl/ssl_lib.c40
-rw-r--r--ssl/ssl_locl.h48
-rw-r--r--ssl/ssl_rsa.c18
-rw-r--r--ssl/ssl_sess.c2
-rw-r--r--ssl/ssltest.c1
-rw-r--r--ssl/t1_enc.c63
-rw-r--r--ssl/t1_lib.c3
29 files changed, 1346 insertions, 427 deletions
diff --git a/ssl/KEYS b/ssl/KEYS
new file mode 100644
index 0000000000..710d102324
--- /dev/null
+++ b/ssl/KEYS
@@ -0,0 +1,28 @@
+EVP_PKEY_DSA
+EVP_PKEY_DSA2
+EVP_PKEY_DSA3
+EVP_PKEY_DSA4
+
+EVP_PKEY_RSA
+EVP_PKEY_RSA2
+
+valid DSA pkey types
+ NID_dsa
+ NID_dsaWithSHA
+ NID_dsaWithSHA1
+ NID_dsaWithSHA1_2
+
+valid RSA pkey types
+ NID_rsaEncryption
+ NID_rsa
+
+NID_dsaWithSHA NID_dsaWithSHA DSA SHA
+NID_dsa NID_dsaWithSHA1 DSA SHA1
+NID_md2 NID_md2WithRSAEncryption RSA-pkcs1 MD2
+NID_md5 NID_md5WithRSAEncryption RSA-pkcs1 MD5
+NID_mdc2 NID_mdc2WithRSA RSA-none MDC2
+NID_ripemd160 NID_ripemd160WithRSA RSA-pkcs1 RIPEMD160
+NID_sha NID_shaWithRSAEncryption RSA-pkcs1 SHA
+NID_sha1 NID_sha1WithRSAEncryption RSA-pkcs1 SHA1
+:w
+
diff --git a/ssl/f b/ssl/f
index 8730ef535d..9f4bfe8471 100644
--- a/ssl/f
+++ b/ssl/f
@@ -1,40 +1,12 @@
-/* return the actual cipher being used */
-char *SSL_CIPHER_get_name(c)
-SSL_CIPHER *c;
- {
- if (c != NULL)
- return(c->name);
- return("UNKNOWN");
- }
-
-/* number of bits for symetric cipher */
-int SSL_CIPHER_get_bits(c,alg_bits)
-SSL_CIPHER *c;
-int *alg_bits;
- {
- int ret=0,a=0;
- EVP_CIPHER *enc;
-
- if (c != NULL)
- {
- if (!ssl_cipher_get_evp(c,&enc,NULL))
- return(0);
-
- a=EVP_CIPHER_key_length(enc)*8;
-
- if (s->session->cipher->algorithms & SSL_EXP)
- {
- if (c->algorithm2 & SSL2_CF_8_BYTE_ENC)
- ret=64;
- else
- ret=40;
- }
- else
- ret=a;
- }
-
- if (alg_bits != NULL) *alg_bits=a;
-
- return(ret);
- }
-
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_DECRYPTION_FAILED);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_RECORD_OVERFLOW
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_UNKNOWN_CA);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_ACCESS_DENIED);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_DECODE_ERROR);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_DECRYPT_ERROR);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_EXPORT_RESTRICION);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_PROTOCOL_VERSION);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_INTERNAL_ERROR);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_USER_CANCLED);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_NO_RENEGOTIATION);
diff --git a/ssl/f.mak b/ssl/f.mak
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/ssl/f.mak
diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index a4661ebb68..597cc8772e 100644
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -179,7 +179,7 @@ SSL *s;
ret=ssl23_get_server_hello(s);
if (ret >= 0) cb=NULL;
goto end;
- break;
+ /* break; */
default:
SSLerr(SSL_F_SSL23_CONNECT,SSL_R_UNKNOWN_STATE);
@@ -443,7 +443,7 @@ SSL *s;
}
s->rwstate=SSL_NOTHING;
- SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,1000+p[6]);
+ SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_AD_REASON_OFFSET+p[6]);
goto err;
}
else
diff --git a/ssl/s23_lib.c b/ssl/s23_lib.c
index e16f641101..1eb2b3a331 100644
--- a/ssl/s23_lib.c
+++ b/ssl/s23_lib.c
@@ -78,7 +78,7 @@ static int ssl23_put_cipher_by_char();
static SSL_CIPHER *ssl23_get_cipher_by_char();
#endif
-char *SSL23_version_str="SSLv2/3 compatablity part of SSLeay 0.7.0 30-Jan-1997";
+char *SSL23_version_str="SSLv2/3 compatablity part of SSLeay 0.9.1a 06-Jul-1998";
static SSL_METHOD SSLv23_data= {
TLS1_VERSION,
@@ -92,6 +92,7 @@ static SSL_METHOD SSLv23_data= {
ssl23_write,
ssl_undefined_function,
ssl_undefined_function,
+ ssl_ok,
ssl3_ctrl,
ssl3_ctx_ctrl,
ssl23_get_cipher_by_char,
diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
index c7b9ecbcf2..888ffaca06 100644
--- a/ssl/s23_srvr.c
+++ b/ssl/s23_srvr.c
@@ -166,7 +166,7 @@ SSL *s;
ret=ssl23_get_client_hello(s);
if (ret >= 0) cb=NULL;
goto end;
- break;
+ /* break; */
default:
SSLerr(SSL_F_SSL23_ACCEPT,SSL_R_UNKNOWN_STATE);
@@ -237,9 +237,15 @@ SSL *s;
{
s->state=SSL23_ST_SR_CLNT_HELLO_B;
}
+ else if (!(s->options & SSL_OP_NO_SSLv2))
+ {
+ type=1;
+ }
}
else if (!(s->options & SSL_OP_NO_SSLv3))
s->state=SSL23_ST_SR_CLNT_HELLO_B;
+ else if (!(s->options & SSL_OP_NO_SSLv2))
+ type=1;
if (s->options & SSL_OP_NON_EXPORT_FIRST)
{
@@ -313,15 +319,15 @@ SSL *s;
else if (!(s->options & SSL_OP_NO_SSLv3))
type=3;
}
- else if ((strncmp("GET ", p,4) == 0) ||
- (strncmp("POST ",p,5) == 0) ||
- (strncmp("HEAD ",p,5) == 0) ||
- (strncmp("PUT ", p,4) == 0))
+ else if ((strncmp("GET ", (char *)p,4) == 0) ||
+ (strncmp("POST ",(char *)p,5) == 0) ||
+ (strncmp("HEAD ",(char *)p,5) == 0) ||
+ (strncmp("PUT ", (char *)p,4) == 0))
{
SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_HTTP_REQUEST);
goto err;
}
- else if (strncmp("CONNECT",p,7) == 0)
+ else if (strncmp("CONNECT",(char *)p,7) == 0)
{
SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_HTTPS_PROXY_REQUEST);
goto err;
@@ -387,7 +393,7 @@ next_bit:
}
s2n(j,dd);
- /* compression */
+ /* COMPRESSION */
*(d++)=1;
*(d++)=0;
diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index 16df9ec565..2170e29289 100644
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -268,7 +268,7 @@ SSL *s;
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
goto end;
- break;
+ /* break; */
default:
SSLerr(SSL_F_SSL2_CONNECT,SSL_R_UNKNOWN_STATE);
return(-1);
@@ -587,6 +587,11 @@ SSL *s;
SSLerr(SSL_F_CLIENT_MASTER_KEY,SSL_R_PUBLIC_KEY_ENCRYPT_ERROR);
return(-1);
}
+#ifdef PKCS1_CHECK
+ if (s->options & SSL_OP_PKCS1_CHECK_1) d[1]++;
+ if (s->options & SSL_OP_PKCS1_CHECK_2)
+ sess->master_key[clear]++;
+#endif
s2n(enc,p);
d+=enc;
karg=sess->key_arg_length;
diff --git a/ssl/s2_lib.c b/ssl/s2_lib.c
index 275eb52f13..172fc361cf 100644
--- a/ssl/s2_lib.c
+++ b/ssl/s2_lib.c
@@ -62,14 +62,12 @@
#include "ssl_locl.h"
#ifndef NOPROTO
-static int ssl2_ok(SSL *s);
static long ssl2_default_timeout(void );
#else
-static int ssl2_ok();
static long ssl2_default_timeout();
#endif
-char *ssl2_version_str="SSLv2 part of SSLeay 0.9.0b 29-Jun-1998";
+char *ssl2_version_str="SSLv2 part of SSLeay 0.9.1a 06-Jul-1998";
#define SSL2_NUM_CIPHERS (sizeof(ssl2_ciphers)/sizeof(SSL_CIPHER))
@@ -184,7 +182,8 @@ static SSL_METHOD SSLv2_data= {
ssl2_peek,
ssl2_write,
ssl2_shutdown,
- ssl2_ok,
+ ssl_ok, /* NULL - renegotiate */
+ ssl_ok, /* NULL - check renegotiate */
ssl2_ctrl, /* local */
ssl2_ctx_ctrl, /* local */
ssl2_get_cipher_by_char,
@@ -429,12 +428,6 @@ SSL *s;
s->error=0; */
}
-static int ssl2_ok(s)
-SSL *s;
- {
- return(1);
- }
-
int ssl2_shutdown(s)
SSL *s;
{
diff --git a/ssl/s3_both.c b/ssl/s3_both.c
index 6de62e1591..251bcedd7d 100644
--- a/ssl/s3_both.c
+++ b/ssl/s3_both.c
@@ -92,6 +92,13 @@ int slen;
p+=i;
l=i;
+#ifdef WIN16
+ /* MSVC 1.5 does not clear the top bytes of the word unless
+ * I do this.
+ */
+ l&=0xffff;
+#endif
+
*(d++)=SSL3_MT_FINISHED;
l2n3(l,d);
s->init_num=(int)l+4;
@@ -236,6 +243,23 @@ X509 *x;
X509_STORE_CTX_cleanup(&xs_ctx);
}
+ /* Thwate special :-) */
+ if (s->ctx->extra_certs != NULL)
+ for (i=0; i<sk_num(s->ctx->extra_certs); i++)
+ {
+ x=(X509 *)sk_value(s->ctx->extra_certs,i);
+ n=i2d_X509(x,NULL);
+ if (!BUF_MEM_grow(buf,(int)(n+l+3)))
+ {
+ SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
+ return(0);
+ }
+ p=(unsigned char *)&(buf->data[l]);
+ l2n3(n,p);
+ i2d_X509(x,&p);
+ l+=n+3;
+ }
+
l-=7;
p=(unsigned char *)&(buf->data[4]);
l2n3(l,p);
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 940c6a458f..d4ff1d99c8 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -430,7 +430,7 @@ SSL *s;
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
goto end;
- break;
+ /* break; */
default:
SSLerr(SSL_F_SSL3_CONNECT,SSL_R_UNKNOWN_STATE);
@@ -478,7 +478,8 @@ SSL *s;
if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
{
if ((s->session == NULL) ||
- (s->session->ssl_version != s->version))
+ (s->session->ssl_version != s->version) ||
+ (s->session->not_resumable))
{
if (!ssl_get_new_session(s,0))
goto err;
@@ -488,7 +489,7 @@ SSL *s;
p=s->s3->client_random;
Time=time(NULL); /* Time */
l2n(Time,p);
- RAND_bytes(&(p[4]),SSL3_RANDOM_SIZE-sizeof(Time));
+ RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
/* Do the message type and length last */
d=p= &(buf[4]);
@@ -523,6 +524,7 @@ SSL *s;
p+=i;
/* hardwire in the NULL compression algorithm. */
+ /* COMPRESSION */
*(p++)=1;
*(p++)=0;
@@ -643,6 +645,7 @@ SSL *s;
s->s3->tmp.new_cipher=c;
/* lets get the compression algorithm */
+ /* COMPRESSION */
j= *(p++);
if (j != 0)
{
@@ -771,7 +774,7 @@ SSL *s;
pkey=X509_get_pubkey(x);
- if (EVP_PKEY_missing_parameters(pkey))
+ if ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey))
{
x=NULL;
al=SSL3_AL_FATAL;
@@ -998,6 +1001,13 @@ SSL *s;
goto f_err;
}
#endif
+ if (alg & SSL_aFZA)
+ {
+ al=SSL_AD_HANDSHAKE_FAILURE;
+ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
+ goto f_err;
+ }
+
/* p points to the next byte, there are 'n' bytes left */
@@ -1014,7 +1024,7 @@ SSL *s;
/* wrong packet length */
al=SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_WRONG_SIGNATURE_LENGTH);
- goto err;
+ goto f_err;
}
#ifndef NO_RSA
@@ -1167,6 +1177,15 @@ SSL *s;
/* get the CA RDNs */
n2s(p,llen);
+#if 0
+{
+FILE *out;
+out=fopen("/tmp/vsign.der","w");
+fwrite(p,1,llen,out);
+fclose(out);
+}
+#endif
+
if ((llen+ctype_num+2+1) != n)
{
ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECODE_ERROR);
@@ -1286,7 +1305,7 @@ SSL *s;
if (l & SSL_kRSA)
{
RSA *rsa;
- unsigned char tmp_buf[48];
+ unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
if (s->session->cert->rsa_tmp != NULL)
rsa=s->session->cert->rsa_tmp;
@@ -1315,6 +1334,10 @@ SSL *s;
p+=2;
n=RSA_public_encrypt(SSL_MAX_MASTER_KEY_LENGTH,
tmp_buf,p,rsa,RSA_PKCS1_PADDING);
+#ifdef PKCS1_CHECK
+ if (s->options & SSL_OP_PKCS1_CHECK_1) p[1]++;
+ if (s->options & SSL_OP_PKCS1_CHECK_2) tmp_buf[0]=0x70;
+#endif
if (n <= 0)
{
SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_ENCRYPT);
@@ -1331,8 +1354,8 @@ SSL *s;
s->session->master_key_length=
s->method->ssl3_enc->generate_master_secret(s,
s->session->master_key,
- tmp_buf,48);
- memset(tmp_buf,0,48);
+ tmp_buf,SSL_MAX_MASTER_KEY_LENGTH);
+ memset(tmp_buf,0,SSL_MAX_MASTER_KEY_LENGTH);
}
else
#endif
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index bbd9b637c5..116b096155 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -136,7 +136,7 @@ int which;
unsigned char *ms,*key,*iv,*er1,*er2;
EVP_CIPHER_CTX *dd;
EVP_CIPHER *c;
- SSL_COMPRESSION *comp;
+ COMP_METHOD *comp;
EVP_MD *m;
MD5_CTX md;
int exp,n,i,j,k;
@@ -155,7 +155,25 @@ int which;
goto err;
dd= s->enc_read_ctx;
s->read_hash=m;
- s->read_compression=comp;
+ /* COMPRESS */
+ if (s->expand != NULL)
+ {
+ COMP_CTX_free(s->expand);
+ s->expand=NULL;
+ }
+ if (comp != NULL)
+ {
+ s->expand=COMP_CTX_new(comp);
+ if (s->expand == NULL)
+ {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
+ goto err2;
+ }
+ s->s3->rrec.comp=(unsigned char *)
+ Malloc(SSL3_RT_MAX_PLAIN_LENGTH);
+ if (s->s3->rrec.comp == NULL)
+ goto err;
+ }
memset(&(s->s3->read_sequence[0]),0,8);
mac_secret= &(s->s3->read_mac_secret[0]);
}
@@ -167,7 +185,21 @@ int which;
goto err;
dd= s->enc_write_ctx;
s->write_hash=m;
- s->write_compression=comp;
+ /* COMPRESS */
+ if (s->compress != NULL)
+ {
+ COMP_CTX_free(s->compress);
+ s->compress=NULL;
+ }
+ if (comp != NULL)
+ {
+ s->compress=COMP_CTX_new(comp);
+ if (s->compress == NULL)
+ {
+ SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
+ goto err2;
+ }
+ }
memset(&(s->s3->write_sequence[0]),0,8);
mac_secret= &(s->s3->write_mac_secret[0]);
}
@@ -258,6 +290,11 @@ SSL *s;
s->s3->tmp.new_sym_enc=c;
s->s3->tmp.new_hash=hash;
+#ifdef ZLIB
+ s->s3->tmp.new_compression=COMP_zlib();
+#endif
+/* s->s3->tmp.new_compression=COMP_rle(); */
+/* s->session->compress_meth= xxxxx */
exp=(s->session->cipher->algorithms & SSL_EXPORT)?1:0;
@@ -302,35 +339,28 @@ int send;
unsigned long l;
int bs,i;
EVP_CIPHER *enc;
- SSL_COMPRESSION *comp;
if (send)
{
ds=s->enc_write_ctx;
rec= &(s->s3->wrec);
if (s->enc_write_ctx == NULL)
- { enc=NULL; comp=NULL; }
+ enc=NULL;
else
- {
enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
- comp=s->write_compression;
- }
}
else
{
ds=s->enc_read_ctx;
rec= &(s->s3->rrec);
if (s->enc_read_ctx == NULL)
- { enc=NULL; comp=NULL; }
+ enc=NULL;
else
- {
enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
- comp=s->read_compression;
- }
}
if ((s->session == NULL) || (ds == NULL) ||
- ((enc == NULL) && (comp == NULL)))
+ (enc == NULL))
{
memcpy(rec->data,rec->input,rec->length);
rec->input=rec->data;
@@ -340,6 +370,8 @@ int send;
l=rec->length;
bs=EVP_CIPHER_block_size(ds->cipher);
+ /* COMPRESS */
+
/* This should be using (bs-1) and bs instead of 7 and 8 */
if ((bs != 1) && send)
{
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 0fd945025d..41b1814070 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -60,7 +60,7 @@
#include "objects.h"
#include "ssl_locl.h"
-char *ssl3_version_str="SSLv3 part of SSLeay 0.9.0b 29-Jun-1998";
+char *ssl3_version_str="SSLv3 part of SSLeay 0.9.1a 06-Jul-1998";
#define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
@@ -384,6 +384,7 @@ static SSL_METHOD SSLv3_data= {
ssl3_write,
ssl3_shutdown,
ssl3_renegotiate,
+ ssl3_renegotiate_check,
ssl3_ctrl,
ssl3_ctx_ctrl,
ssl3_get_cipher_by_char,
@@ -460,6 +461,8 @@ SSL *s;
Free(s->s3->rbuf.buf);
if (s->s3->wbuf.buf != NULL)
Free(s->s3->wbuf.buf);
+ if (s->s3->rrec.comp != NULL)
+ Free(s->s3->rrec.comp);
#ifndef NO_DH
if (s->s3->tmp.dh != NULL)
DH_free(s->s3->tmp.dh);
@@ -486,6 +489,13 @@ SSL *s;
memset(s->s3,0,sizeof(SSL3_CTX));
if (rp != NULL) s->s3->rbuf.buf=rp;
if (wp != NULL) s->s3->wbuf.buf=wp;
+
+ if (s->s3->rrec.comp != NULL)
+ {
+ Free(s->s3->rrec.comp);
+ s->s3->rrec.comp=NULL;
+ }
+
s->packet_length=0;
s->s3->renegotiate=0;
s->s3->total_renegotiations=0;
@@ -519,6 +529,9 @@ char *parg;
case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
ret=s->s3->total_renegotiations;
break;
+ case SSL_CTRL_GET_FLAGS:
+ ret=s->s3->flags;
+ break;
default:
break;
}
@@ -546,7 +559,7 @@ char *parg;
return(1);
else
return(0);
- break;
+ /* break; */
case SSL_CTRL_SET_TMP_RSA:
{
RSA *rsa;
@@ -574,7 +587,7 @@ char *parg;
return(1);
}
}
- break;
+ /* break; */
case SSL_CTRL_SET_TMP_RSA_CB:
cert->rsa_tmp_cb=(RSA *(*)())parg;
break;
@@ -583,6 +596,7 @@ char *parg;
case SSL_CTRL_SET_TMP_DH:
{
DH *new=NULL,*dh;
+ int rret=0;
dh=(DH *)parg;
if ( ((new=DHparams_dup(dh)) == NULL) ||
@@ -590,21 +604,31 @@ char *parg;
{
SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
if (new != NULL) DH_free(new);
- return(0);
}
else
{
if (cert->dh_tmp != NULL)
DH_free(cert->dh_tmp);
cert->dh_tmp=new;
- return(1);
+ rret=1;
}
+ return(rret);
}
- break;
+ /*break; */
case SSL_CTRL_SET_TMP_DH_CB:
cert->dh_tmp_cb=(DH *(*)())parg;
break;
#endif
+ /* A Thwate special :-) */
+ case SSL_CTRL_EXTRA_CHAIN_CERT:
+ if (ctx->extra_certs == NULL)
+ {
+ if ((ctx->extra_certs=sk_new_null()) == NULL)
+ return(0);
+ }
+ sk_push(ctx->extra_certs,(char *)parg);
+ break;
+
default:
return(0);
}
@@ -743,28 +767,30 @@ unsigned char *p;
#ifndef NO_DH
if (alg & (SSL_kDHr|SSL_kEDH))
{
-#ifndef NO_RSA
+# ifndef NO_RSA
p[ret++]=SSL3_CT_RSA_FIXED_DH;
-#endif
-#ifndef NO_DSA
+# endif
+# ifndef NO_DSA
p[ret++]=SSL3_CT_DSS_FIXED_DH;
-#endif
+# endif
}
if ((s->version == SSL3_VERSION) &&
(alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr)))
{
-#ifndef NO_RSA
+# ifndef NO_RSA
p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
-#endif
-#ifndef NO_DSA
+# endif
+# ifndef NO_DSA
p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
-#endif
+# endif
}
#endif /* !NO_DH */
#ifndef NO_RSA
p[ret++]=SSL3_CT_RSA_SIGN;
#endif
+#ifndef NO_DSA
p[ret++]=SSL3_CT_DSS_SIGN;
+#endif
return(ret);
}
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 2385080347..444263b709 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -79,6 +79,18 @@
* SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED);
* SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN);
* SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_DECRYPTION_FAILED);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_RECORD_OVERFLOW);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_UNKNOWN_CA);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_ACCESS_DENIED);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_DECODE_ERROR);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_DECRYPT_ERROR);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_EXPORT_RESTRICION);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_PROTOCOL_VERSION);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_INTERNAL_ERROR);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_USER_CANCLED);
+ * SSLerr(SSL_F_GET_SERVER_HELLO,SSL_R_TLSV1_ALERT_NO_RENEGOTIATION);
*/
#ifndef NOPROTO
@@ -213,7 +225,6 @@ int extend;
static int ssl3_get_record(s)
SSL *s;
{
- char tmp_buf[512];
int ssl_major,ssl_minor,al;
int n,i,ret= -1;
SSL3_BUFFER *rb;
@@ -331,7 +342,6 @@ again:
/* decrypt in place in 'rr->input' */
rr->data=rr->input;
- memcpy(tmp_buf,rr->input,(rr->length > 512)?512:rr->length);
if (!s->method->ssl3_enc->enc(s,0))
{
@@ -340,7 +350,7 @@ again:
}
#ifdef TLS_DEBUG
printf("dec %d\n",rr->length);
-{ int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
+{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
printf("\n");
#endif
/* r->length is now the compressed data plus mac */
@@ -378,7 +388,7 @@ printf("\n");
}
/* r->length is now just compressed */
- if ((sess != NULL) && (sess->read_compression != NULL))
+ if (s->expand != NULL)
{
if (rr->length >
(unsigned int)SSL3_RT_MAX_COMPRESSED_LENGTH+extra)
@@ -427,12 +437,37 @@ err:
static int do_uncompress(ssl)
SSL *ssl;
{
+ int i;
+ SSL3_RECORD *rr;
+
+ rr= &(ssl->s3->rrec);
+ i=COMP_expand_block(ssl->expand,rr->comp,
+ SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length);
+ if (i < 0)
+ return(0);
+ else
+ rr->length=i;
+ rr->data=rr->comp;
+
return(1);
}
static int do_compress(ssl)
SSL *ssl;
{
+ int i;
+ SSL3_RECORD *wr;
+
+ wr= &(ssl->s3->wrec);
+ i=COMP_compress_block(ssl->compress,wr->data,
+ SSL3_RT_MAX_COMPRESSED_LENGTH,
+ wr->input,(int)wr->length);
+ if (i < 0)
+ return(0);
+ else
+ wr->length=i;
+
+ wr->input=wr->data;
return(1);
}
@@ -552,7 +587,7 @@ unsigned int len;
* wr->data */
/* first we compress */
- if ((sess != NULL) && (sess->write_compression != NULL))
+ if (s->compress != NULL)
{
if (!do_compress(s))
{
@@ -786,7 +821,8 @@ start:
s->rwstate=SSL_NOTHING;
s->s3->fatal_alert=n;
- SSLerr(SSL_F_SSL3_READ_BYTES,1000+n);
+ SSLerr(SSL_F_SSL3_READ_BYTES,
+ SSL_AD_REASON_OFFSET+n);
sprintf(tmp,"%d",n);
ERR_add_error_data(2,"SSL alert number ",tmp);
s->shutdown|=SSL_RECEIVED_SHUTDOWN;
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 64903af151..743f8ea235 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1259,7 +1259,7 @@ SSL *s;
i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
#if 1
- /* If a bad decrypt, use a dud master key */
+ /* If a bad decrypt, use a random master key */
if ((i != SSL_MAX_MASTER_KEY_LENGTH) ||
((p[0] != (s->version>>8)) ||
(p[1] != (s->version & 0xff))))
diff --git a/ssl/ssl.err b/ssl/ssl.err
index c54326c624..10ca9c5342 100644
--- a/ssl/ssl.err
+++ b/ssl/ssl.err
@@ -105,11 +105,12 @@
#define SSL_F_SSL_USE_RSAPRIVATEKEY 201
#define SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1 202
#define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 203
-#define SSL_F_SSL_WRITE 204
-#define SSL_F_TLS1_CHANGE_CIPHER_STATE 205
-#define SSL_F_TLS1_ENC 206
-#define SSL_F_TLS1_SETUP_KEY_BLOCK 207
-#define SSL_F_WRITE_PENDING 208
+#define SSL_F_SSL_VERIFY_CERT_CHAIN 204
+#define SSL_F_SSL_WRITE 205
+#define SSL_F_TLS1_CHANGE_CIPHER_STATE 206
+#define SSL_F_TLS1_ENC 207
+#define SSL_F_TLS1_SETUP_KEY_BLOCK 208
+#define SSL_F_WRITE_PENDING 209
/* Reason codes. */
#define SSL_R_APP_DATA_IN_HANDSHAKE 100
@@ -154,83 +155,85 @@
#define SSL_R_CIPHER_TABLE_SRC_ERROR 139
#define SSL_R_COMPRESSED_LENGTH_TOO_LONG 140
#define SSL_R_COMPRESSION_FAILURE 141
-#define SSL_R_CONNECTION_ID_IS_DIFFERENT 142
-#define SSL_R_CONNECTION_TYPE_NOT_SET 143
-#define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED 144
-#define SSL_R_DATA_LENGTH_TOO_LONG 145
-#define SSL_R_DECRYPTION_FAILED 146
-#define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG 147
-#define SSL_R_DIGEST_CHECK_FAILED 148
-#define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 149
-#define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 150
-#define SSL_R_EXCESSIVE_MESSAGE_SIZE 151
-#define SSL_R_EXTRA_DATA_IN_MESSAGE 152
-#define SSL_R_GOT_A_FIN_BEFORE_A_CCS 153
-#define SSL_R_HTTPS_PROXY_REQUEST 154
-#define SSL_R_HTTP_REQUEST 155
-#define SSL_R_INTERNAL_ERROR 156
-#define SSL_R_INVALID_CHALLENGE_LENGTH 157
-#define SSL_R_LENGTH_MISMATCH 158
-#define SSL_R_LENGTH_TOO_SHORT 159
-#define SSL_R_LIBRARY_HAS_NO_CIPHERS 160
-#define SSL_R_MISSING_DH_DSA_CERT 161
-#define SSL_R_MISSING_DH_KEY 162
-#define SSL_R_MISSING_DH_RSA_CERT 163
-#define SSL_R_MISSING_DSA_SIGNING_CERT 164
-#define SSL_R_MISSING_EXPORT_TMP_DH_KEY 165
-#define SSL_R_MISSING_EXPORT_TMP_RSA_KEY 166
-#define SSL_R_MISSING_RSA_CERTIFICATE 167
-#define SSL_R_MISSING_RSA_ENCRYPTING_CERT 168
-#define SSL_R_MISSING_RSA_SIGNING_CERT 169
-#define SSL_R_MISSING_TMP_DH_KEY 170
-#define SSL_R_MISSING_TMP_RSA_KEY 171
-#define SSL_R_MISSING_TMP_RSA_PKEY 172
-#define SSL_R_MISSING_VERIFY_MESSAGE 173
-#define SSL_R_NON_SSLV2_INITIAL_PACKET 174
-#define SSL_R_NO_CERTIFICATES_RETURNED 175
-#define SSL_R_NO_CERTIFICATE_ASSIGNED 176
-#define SSL_R_NO_CERTIFICATE_RETURNED 177
-#define SSL_R_NO_CERTIFICATE_SET 178
-#define SSL_R_NO_CERTIFICATE_SPECIFIED 179
-#define SSL_R_NO_CIPHERS_AVAILABLE 180
-#define SSL_R_NO_CIPHERS_PASSED 181
-#define SSL_R_NO_CIPHERS_SPECIFIED 182
-#define SSL_R_NO_CIPHER_LIST 183
-#define SSL_R_NO_CIPHER_MATCH 184
-#define SSL_R_NO_CLIENT_CERT_RECEIVED 185
-#define SSL_R_NO_COMPRESSION_SPECIFIED 186
-#define SSL_R_NO_PRIVATEKEY 187
-#define SSL_R_NO_PRIVATE_KEY_ASSIGNED 188
-#define SSL_R_NO_PROTOCOLS_AVAILABLE 189
-#define SSL_R_NO_PUBLICKEY 190
-#define SSL_R_NO_SHARED_CIPHER 191
-#define SSL_R_NULL_SSL_CTX 192
-#define SSL_R_NULL_SSL_METHOD_PASSED 193
-#define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED 194
-#define SSL_R_PACKET_LENGTH_TOO_LONG 195
-#define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE 196
-#define SSL_R_PEER_ERROR 197
-#define SSL_R_PEER_ERROR_CERTIFI