2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
112 #include "ssl_locl.h"
113 #ifndef OPENSSL_NO_SSL2
114 #include "../crypto/constant_time_locl.h"
116 # include <openssl/bio.h>
117 # include <openssl/rand.h>
118 # include <openssl/objects.h>
119 # include <openssl/evp.h>
121 static const SSL_METHOD
*ssl2_get_server_method(int ver
);
122 static int get_client_master_key(SSL
*s
);
123 static int get_client_hello(SSL
*s
);
124 static int server_hello(SSL
*s
);
125 static int get_client_finished(SSL
*s
);
126 static int server_verify(SSL
*s
);
127 static int server_finish(SSL
*s
);
128 static int request_certificate(SSL
*s
);
129 static int ssl_rsa_private_decrypt(CERT
*c
, int len
, unsigned char *from
,
130 unsigned char *to
, int padding
);
133 static const SSL_METHOD
*ssl2_get_server_method(int ver
)
135 if (ver
== SSL2_VERSION
)
136 return (SSLv2_server_method());
141 IMPLEMENT_ssl2_meth_func(SSLv2_server_method
,
143 ssl_undefined_function
, ssl2_get_server_method
)
145 int ssl2_accept(SSL
*s
)
147 unsigned long l
= (unsigned long)time(NULL
);
151 void (*cb
) (const SSL
*ssl
, int type
, int val
) = NULL
;
152 int new_state
, state
;
154 RAND_add(&l
, sizeof(l
), 0);
158 if (s
->info_callback
!= NULL
)
159 cb
= s
->info_callback
;
160 else if (s
->ctx
->info_callback
!= NULL
)
161 cb
= s
->ctx
->info_callback
;
163 /* init things to blank */
165 if (!SSL_in_init(s
) || SSL_in_before(s
))
168 if (s
->cert
== NULL
) {
169 SSLerr(SSL_F_SSL2_ACCEPT
, SSL_R_NO_CERTIFICATE_SET
);
180 case SSL_ST_BEFORE
| SSL_ST_ACCEPT
:
181 case SSL_ST_OK
| SSL_ST_ACCEPT
:
185 cb(s
, SSL_CB_HANDSHAKE_START
, 1);
187 s
->version
= SSL2_VERSION
;
188 s
->type
= SSL_ST_ACCEPT
;
190 if (s
->init_buf
== NULL
) {
191 if ((buf
= BUF_MEM_new()) == NULL
) {
196 (buf
, (int)SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
)) {
204 s
->ctx
->stats
.sess_accept
++;
205 s
->handshake_func
= ssl2_accept
;
206 s
->state
= SSL2_ST_GET_CLIENT_HELLO_A
;
209 case SSL2_ST_GET_CLIENT_HELLO_A
:
210 case SSL2_ST_GET_CLIENT_HELLO_B
:
211 case SSL2_ST_GET_CLIENT_HELLO_C
:
213 ret
= get_client_hello(s
);
217 s
->state
= SSL2_ST_SEND_SERVER_HELLO_A
;
220 case SSL2_ST_SEND_SERVER_HELLO_A
:
221 case SSL2_ST_SEND_SERVER_HELLO_B
:
222 ret
= server_hello(s
);
227 s
->state
= SSL2_ST_GET_CLIENT_MASTER_KEY_A
;
230 s
->state
= SSL2_ST_SERVER_START_ENCRYPTION
;
233 case SSL2_ST_GET_CLIENT_MASTER_KEY_A
:
234 case SSL2_ST_GET_CLIENT_MASTER_KEY_B
:
235 ret
= get_client_master_key(s
);
239 s
->state
= SSL2_ST_SERVER_START_ENCRYPTION
;
242 case SSL2_ST_SERVER_START_ENCRYPTION
:
244 * Ok we how have sent all the stuff needed to start encrypting,
245 * the next packet back will be encrypted.
247 if (!ssl2_enc_init(s
, 0)) {
251 s
->s2
->clear_text
= 0;
252 s
->state
= SSL2_ST_SEND_SERVER_VERIFY_A
;
255 case SSL2_ST_SEND_SERVER_VERIFY_A
:
256 case SSL2_ST_SEND_SERVER_VERIFY_B
:
257 ret
= server_verify(s
);
263 * If we are in here, we have been buffering the output, so
264 * we need to flush it and remove buffering from future
267 s
->state
= SSL2_ST_SEND_SERVER_VERIFY_C
;
270 s
->state
= SSL2_ST_GET_CLIENT_FINISHED_A
;
274 case SSL2_ST_SEND_SERVER_VERIFY_C
:
275 /* get the number of bytes to write */
276 num1
= BIO_ctrl(s
->wbio
, BIO_CTRL_INFO
, 0, NULL
);
278 s
->rwstate
= SSL_WRITING
;
279 num1
= BIO_flush(s
->wbio
);
284 s
->rwstate
= SSL_NOTHING
;
287 /* flushed and now remove buffering */
288 s
->wbio
= BIO_pop(s
->wbio
);
290 s
->state
= SSL2_ST_GET_CLIENT_FINISHED_A
;
293 case SSL2_ST_GET_CLIENT_FINISHED_A
:
294 case SSL2_ST_GET_CLIENT_FINISHED_B
:
295 ret
= get_client_finished(s
);
299 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_A
;
302 case SSL2_ST_SEND_REQUEST_CERTIFICATE_A
:
303 case SSL2_ST_SEND_REQUEST_CERTIFICATE_B
:
304 case SSL2_ST_SEND_REQUEST_CERTIFICATE_C
:
305 case SSL2_ST_SEND_REQUEST_CERTIFICATE_D
:
307 * don't do a 'request certificate' if we don't want to, or we
308 * already have one, and we only want to do it once.
310 if (!(s
->verify_mode
& SSL_VERIFY_PEER
) ||
311 ((s
->session
->peer
!= NULL
) &&
312 (s
->verify_mode
& SSL_VERIFY_CLIENT_ONCE
))) {
313 s
->state
= SSL2_ST_SEND_SERVER_FINISHED_A
;
316 ret
= request_certificate(s
);
320 s
->state
= SSL2_ST_SEND_SERVER_FINISHED_A
;
324 case SSL2_ST_SEND_SERVER_FINISHED_A
:
325 case SSL2_ST_SEND_SERVER_FINISHED_B
:
326 ret
= server_finish(s
);
330 s
->state
= SSL_ST_OK
;
334 BUF_MEM_free(s
->init_buf
);
335 ssl_free_wbio_buffer(s
);
338 /* ERR_clear_error(); */
340 ssl_update_cache(s
, SSL_SESS_CACHE_SERVER
);
342 s
->ctx
->stats
.sess_accept_good
++;
347 cb(s
, SSL_CB_HANDSHAKE_DONE
, 1);
353 SSLerr(SSL_F_SSL2_ACCEPT
, SSL_R_UNKNOWN_STATE
);
359 if ((cb
!= NULL
) && (s
->state
!= state
)) {
360 new_state
= s
->state
;
362 cb(s
, SSL_CB_ACCEPT_LOOP
, 1);
363 s
->state
= new_state
;
369 cb(s
, SSL_CB_ACCEPT_EXIT
, ret
);
373 static int get_client_master_key(SSL
*s
)
375 int is_export
, i
, n
, keya
;
376 unsigned int num_encrypted_key_bytes
, key_length
;
379 const SSL_CIPHER
*cp
;
382 unsigned char rand_premaster_secret
[SSL_MAX_MASTER_KEY_LENGTH
];
383 unsigned char decrypt_good
;
386 p
= (unsigned char *)s
->init_buf
->data
;
387 if (s
->state
== SSL2_ST_GET_CLIENT_MASTER_KEY_A
) {
388 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 10 - s
->init_num
);
390 if (i
< (10 - s
->init_num
))
391 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_MASTER_KEY
, i
));
394 if (*(p
++) != SSL2_MT_CLIENT_MASTER_KEY
) {
395 if (p
[-1] != SSL2_MT_ERROR
) {
396 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
397 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,
398 SSL_R_READ_WRONG_PACKET_TYPE
);
400 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_PEER_ERROR
);
404 cp
= ssl2_get_cipher_by_char(p
);
405 if (cp
== NULL
|| sk_SSL_CIPHER_find(s
->session
->ciphers
, cp
) < 0) {
406 ssl2_return_error(s
, SSL2_PE_NO_CIPHER
);
407 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_NO_CIPHER_MATCH
);
410 s
->session
->cipher
= cp
;
414 s
->s2
->tmp
.clear
= i
;
418 if (i
> SSL_MAX_KEY_ARG_LENGTH
) {
419 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
420 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_KEY_ARG_TOO_LONG
);
423 s
->session
->key_arg_length
= i
;
424 s
->state
= SSL2_ST_GET_CLIENT_MASTER_KEY_B
;
427 /* SSL2_ST_GET_CLIENT_MASTER_KEY_B */
428 p
= (unsigned char *)s
->init_buf
->data
;
429 if (s
->init_buf
->length
< SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
430 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
431 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, ERR_R_INTERNAL_ERROR
);
434 keya
= s
->session
->key_arg_length
;
436 10 + (unsigned long)s
->s2
->tmp
.clear
+ (unsigned long)s
->s2
->tmp
.enc
+
438 if (len
> SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
439 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
440 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_MESSAGE_TOO_LONG
);
443 n
= (int)len
- s
->init_num
;
444 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), n
);
446 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_MASTER_KEY
, i
));
447 if (s
->msg_callback
) {
448 /* CLIENT-MASTER-KEY */
449 s
->msg_callback(0, s
->version
, 0, p
, (size_t)len
, s
,
450 s
->msg_callback_arg
);
454 memcpy(s
->session
->key_arg
, &(p
[s
->s2
->tmp
.clear
+ s
->s2
->tmp
.enc
]),
457 if (s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
== NULL
) {
458 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
459 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_NO_PRIVATEKEY
);
463 is_export
= SSL_C_IS_EXPORT(s
->session
->cipher
);
465 if (!ssl_cipher_get_evp(s
->session
, &c
, &md
, NULL
, NULL
, NULL
)) {
466 ssl2_return_error(s
, SSL2_PE_NO_CIPHER
);
467 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,
468 SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS
);
473 * The format of the CLIENT-MASTER-KEY message is
474 * 1 byte message type
476 * 2-byte clear key length (stored in s->s2->tmp.clear)
477 * 2-byte encrypted key length (stored in s->s2->tmp.enc)
478 * 2-byte key args length (IV etc)
483 * If the cipher is an export cipher, then the encrypted key bytes
484 * are a fixed portion of the total key (5 or 8 bytes). The size of
485 * this portion is in |num_encrypted_key_bytes|. If the cipher is not an
486 * export cipher, then the entire key material is encrypted (i.e., clear
487 * key length must be zero).
489 key_length
= (unsigned int)EVP_CIPHER_key_length(c
);
490 if (key_length
> SSL_MAX_MASTER_KEY_LENGTH
) {
491 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
492 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, ERR_R_INTERNAL_ERROR
);
496 if (s
->session
->cipher
->algorithm2
& SSL2_CF_8_BYTE_ENC
) {
498 num_encrypted_key_bytes
= 8;
499 } else if (is_export
) {
500 num_encrypted_key_bytes
= 5;
502 num_encrypted_key_bytes
= key_length
;
505 if (s
->s2
->tmp
.clear
+ num_encrypted_key_bytes
!= key_length
) {
506 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
507 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,SSL_R_BAD_LENGTH
);
511 * The encrypted blob must decrypt to the encrypted portion of the key.
512 * Decryption can't be expanding, so if we don't have enough encrypted
513 * bytes to fit the key in the buffer, stop now.
515 if (s
->s2
->tmp
.enc
< num_encrypted_key_bytes
) {
516 ssl2_return_error(s
,SSL2_PE_UNDEFINED_ERROR
);
517 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,SSL_R_LENGTH_TOO_SHORT
);
522 * We must not leak whether a decryption failure occurs because of
523 * Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246,
524 * section 7.4.7.1). The code follows that advice of the TLS RFC and
525 * generates a random premaster secret for the case that the decrypt
526 * fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1
530 * should be RAND_bytes, but we cannot work around a failure.
532 if (RAND_pseudo_bytes(rand_premaster_secret
,
533 (int)num_encrypted_key_bytes
) <= 0)
536 i
= ssl_rsa_private_decrypt(s
->cert
, s
->s2
->tmp
.enc
,
537 &(p
[s
->s2
->tmp
.clear
]),
538 &(p
[s
->s2
->tmp
.clear
]),
539 (s
->s2
->ssl2_rollback
) ? RSA_SSLV23_PADDING
:
543 * If a bad decrypt, continue with protocol but with a random master
544 * secret (Bleichenbacher attack)
546 decrypt_good
= constant_time_eq_int_8(i
, (int)num_encrypted_key_bytes
);
547 for (j
= 0; j
< num_encrypted_key_bytes
; j
++) {
548 p
[s
->s2
->tmp
.clear
+ j
] =
549 constant_time_select_8(decrypt_good
, p
[s
->s2
->tmp
.clear
+ j
],
550 rand_premaster_secret
[j
]);
553 s
->session
->master_key_length
= (int)key_length
;
554 memcpy(s
->session
->master_key
, p
, key_length
);
555 OPENSSL_cleanse(p
, key_length
);
560 static int get_client_hello(SSL
*s
)
565 STACK_OF(SSL_CIPHER
) *cs
; /* a stack of SSL_CIPHERS */
566 STACK_OF(SSL_CIPHER
) *cl
; /* the ones we want to use */
567 STACK_OF(SSL_CIPHER
) *prio
, *allow
;
571 * This is a bit of a hack to check for the correct packet type the first
574 if (s
->state
== SSL2_ST_GET_CLIENT_HELLO_A
) {
576 s
->state
= SSL2_ST_GET_CLIENT_HELLO_B
;
579 p
= (unsigned char *)s
->init_buf
->data
;
580 if (s
->state
== SSL2_ST_GET_CLIENT_HELLO_B
) {
581 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 9 - s
->init_num
);
582 if (i
< (9 - s
->init_num
))
583 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_HELLO
, i
));
586 if (*(p
++) != SSL2_MT_CLIENT_HELLO
) {
587 if (p
[-1] != SSL2_MT_ERROR
) {
588 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
589 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_READ_WRONG_PACKET_TYPE
);
591 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_PEER_ERROR
);
598 s
->s2
->tmp
.cipher_spec_length
= i
;
600 s
->s2
->tmp
.session_id_length
= i
;
601 if ((i
< 0) || (i
> SSL_MAX_SSL_SESSION_ID_LENGTH
)) {
602 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
603 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_LENGTH_MISMATCH
);
607 s
->s2
->challenge_length
= i
;
608 if ((i
< SSL2_MIN_CHALLENGE_LENGTH
) ||
609 (i
> SSL2_MAX_CHALLENGE_LENGTH
)) {
610 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
611 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_INVALID_CHALLENGE_LENGTH
);
614 s
->state
= SSL2_ST_GET_CLIENT_HELLO_C
;
617 /* SSL2_ST_GET_CLIENT_HELLO_C */
618 p
= (unsigned char *)s
->init_buf
->data
;
620 9 + (unsigned long)s
->s2
->tmp
.cipher_spec_length
+
621 (unsigned long)s
->s2
->challenge_length
+
622 (unsigned long)s
->s2
->tmp
.session_id_length
;
623 if (len
> SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
624 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
625 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_MESSAGE_TOO_LONG
);
628 n
= (int)len
- s
->init_num
;
629 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), n
);
631 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_HELLO
, i
));
632 if (s
->msg_callback
) {
634 s
->msg_callback(0, s
->version
, 0, p
, (size_t)len
, s
,
635 s
->msg_callback_arg
);
640 * get session-id before cipher stuff so we can get out session structure
644 if ((s
->s2
->tmp
.session_id_length
!= 0) &&
645 (s
->s2
->tmp
.session_id_length
!= SSL2_SSL_SESSION_ID_LENGTH
)) {
646 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
647 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_BAD_SSL_SESSION_ID_LENGTH
);
651 if (s
->s2
->tmp
.session_id_length
== 0) {
652 if (!ssl_get_new_session(s
, 1)) {
653 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
657 i
= ssl_get_prev_session(s
, &(p
[s
->s2
->tmp
.cipher_spec_length
]),
658 s
->s2
->tmp
.session_id_length
, NULL
);
659 if (i
== 1) { /* previous session */
661 } else if (i
== -1) {
662 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
665 if (s
->cert
== NULL
) {
666 ssl2_return_error(s
, SSL2_PE_NO_CERTIFICATE
);
667 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_NO_CERTIFICATE_SET
);
671 if (!ssl_get_new_session(s
, 1)) {
672 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
679 cs
= ssl_bytes_to_cipher_list(s
, p
, s
->s2
->tmp
.cipher_spec_length
,
680 &s
->session
->ciphers
);
684 cl
= SSL_get_ciphers(s
);
686 if (s
->options
& SSL_OP_CIPHER_SERVER_PREFERENCE
) {
687 prio
= sk_SSL_CIPHER_dup(cl
);
696 /* Generate list of SSLv2 ciphers shared between client and server */
697 for (z
= 0; z
< sk_SSL_CIPHER_num(prio
); z
++) {
698 const SSL_CIPHER
*cp
= sk_SSL_CIPHER_value(prio
, z
);
699 if ((cp
->algorithm_ssl
& SSL_SSLV2
) == 0 ||
700 sk_SSL_CIPHER_find(allow
, cp
) < 0) {
701 (void)sk_SSL_CIPHER_delete(prio
, z
);
705 if (s
->options
& SSL_OP_CIPHER_SERVER_PREFERENCE
) {
706 sk_SSL_CIPHER_free(s
->session
->ciphers
);
707 s
->session
->ciphers
= prio
;
710 /* Make sure we have at least one cipher in common */
711 if (sk_SSL_CIPHER_num(s
->session
->ciphers
) == 0) {
712 ssl2_return_error(s
, SSL2_PE_NO_CIPHER
);
713 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_NO_CIPHER_MATCH
);
717 * s->session->ciphers should now have a list of ciphers that are on
718 * both the client and server. This list is ordered by the order the
719 * client sent the ciphers or in the order of the server's preference
720 * if SSL_OP_CIPHER_SERVER_PREFERENCE was set.
723 p
+= s
->s2
->tmp
.cipher_spec_length
;
724 /* done cipher selection */
726 /* session id extracted already */
727 p
+= s
->s2
->tmp
.session_id_length
;
730 if (s
->s2
->challenge_length
> sizeof s
->s2
->challenge
) {
731 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
732 SSLerr(SSL_F_GET_CLIENT_HELLO
, ERR_R_INTERNAL_ERROR
);
735 memcpy(s
->s2
->challenge
, p
, (unsigned int)s
->s2
->challenge_length
);
738 SSLerr(SSL_F_GET_CLIENT_HELLO
, ERR_R_MALLOC_FAILURE
);
742 static int server_hello(SSL
*s
)
744 unsigned char *p
, *d
;
747 p
= (unsigned char *)s
->init_buf
->data
;
748 if (s
->state
== SSL2_ST_SEND_SERVER_HELLO_A
) {
750 *(p
++) = SSL2_MT_SERVER_HELLO
; /* type */
752 *(p
++) = (unsigned char)hit
;
755 if (s
->session
->sess_cert
!= NULL
)
757 * This can't really happen because get_client_hello has
758 * called ssl_get_new_session, which does not set sess_cert.
760 ssl_sess_cert_free(s
->session
->sess_cert
);
761 s
->session
->sess_cert
= ssl_sess_cert_new();
762 if (s
->session
->sess_cert
== NULL
) {
763 SSLerr(SSL_F_SERVER_HELLO
, ERR_R_MALLOC_FAILURE
);
768 * If 'hit' is set, then s->sess_cert may be non-NULL or NULL,
769 * depending on whether it survived in the internal cache or was
770 * retrieved from an external cache. If it is NULL, we cannot put any
771 * useful data in it anyway, so we don't touch it.
774 # else /* That's what used to be done when cert_st
775 * and sess_cert_st were * the same. */
776 if (!hit
) { /* else add cert to session */
777 CRYPTO_add(&s
->cert
->references
, 1, CRYPTO_LOCK_SSL_CERT
);
778 if (s
->session
->sess_cert
!= NULL
)
779 ssl_cert_free(s
->session
->sess_cert
);
780 s
->session
->sess_cert
= s
->cert
;
781 } else { /* We have a session id-cache hit, if the *
782 * session-id has no certificate listed
783 * against * the 'cert' structure, grab the
784 * 'old' one * listed against the SSL
786 if (s
->session
->sess_cert
== NULL
) {
787 CRYPTO_add(&s
->cert
->references
, 1, CRYPTO_LOCK_SSL_CERT
);
788 s
->session
->sess_cert
= s
->cert
;
793 if (s
->cert
== NULL
) {
794 ssl2_return_error(s
, SSL2_PE_NO_CERTIFICATE
);
795 SSLerr(SSL_F_SERVER_HELLO
, SSL_R_NO_CERTIFICATE_SPECIFIED
);
800 *(p
++) = 0; /* no certificate type */
801 s2n(s
->version
, p
); /* version */
802 s2n(0, p
); /* cert len */
803 s2n(0, p
); /* ciphers len */
806 /* put certificate type */
807 *(p
++) = SSL2_CT_X509_CERTIFICATE
;
808 s2n(s
->version
, p
); /* version */
809 n
= i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, NULL
);
810 s2n(n
, p
); /* certificate length */
811 i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, &d
);
815 * lets send out the ciphers we like in the prefered order
817 n
= ssl_cipher_list_to_bytes(s
, s
->session
->ciphers
, d
, 0);
819 s2n(n
, p
); /* add cipher length */
822 /* make and send conn_id */
823 s2n(SSL2_CONNECTION_ID_LENGTH
, p
); /* add conn_id length */
824 s
->s2
->conn_id_length
= SSL2_CONNECTION_ID_LENGTH
;
825 if (RAND_pseudo_bytes(s
->s2
->conn_id
, (int)s
->s2
->conn_id_length
) <=
828 memcpy(d
, s
->s2
->conn_id
, SSL2_CONNECTION_ID_LENGTH
);
829 d
+= SSL2_CONNECTION_ID_LENGTH
;
831 s
->state
= SSL2_ST_SEND_SERVER_HELLO_B
;
832 s
->init_num
= d
- (unsigned char *)s
->init_buf
->data
;
835 /* SSL2_ST_SEND_SERVER_HELLO_B */
837 * If we are using TCP/IP, the performance is bad if we do 2 writes
838 * without a read between them. This occurs when Session-id reuse is
839 * used, so I will put in a buffering module
842 if (!ssl_init_wbio_buffer(s
, 1))
846 return (ssl2_do_write(s
));
849 static int get_client_finished(SSL
*s
)
855 p
= (unsigned char *)s
->init_buf
->data
;
856 if (s
->state
== SSL2_ST_GET_CLIENT_FINISHED_A
) {
857 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 1 - s
->init_num
);
858 if (i
< 1 - s
->init_num
)
859 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_FINISHED
, i
));
862 if (*p
!= SSL2_MT_CLIENT_FINISHED
) {
863 if (*p
!= SSL2_MT_ERROR
) {
864 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
865 SSLerr(SSL_F_GET_CLIENT_FINISHED
,
866 SSL_R_READ_WRONG_PACKET_TYPE
);
868 SSLerr(SSL_F_GET_CLIENT_FINISHED
, SSL_R_PEER_ERROR
);
869 /* try to read the error message */
870 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 3 - s
->init_num
);
871 return ssl2_part_read(s
, SSL_F_GET_SERVER_VERIFY
, i
);
875 s
->state
= SSL2_ST_GET_CLIENT_FINISHED_B
;
878 /* SSL2_ST_GET_CLIENT_FINISHED_B */
879 if (s
->s2
->conn_id_length
> sizeof s
->s2
->conn_id
) {
880 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
881 SSLerr(SSL_F_GET_CLIENT_FINISHED
, ERR_R_INTERNAL_ERROR
);
884 len
= 1 + (unsigned long)s
->s2
->conn_id_length
;
885 n
= (int)len
- s
->init_num
;
886 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), n
);
888 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_FINISHED
, i
));
890 if (s
->msg_callback
) {
891 /* CLIENT-FINISHED */
892 s
->msg_callback(0, s
->version
, 0, p
, len
, s
, s
->msg_callback_arg
);
895 if (memcmp(p
, s
->s2
->conn_id
, s
->s2
->conn_id_length
) != 0) {
896 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
897 SSLerr(SSL_F_GET_CLIENT_FINISHED
, SSL_R_CONNECTION_ID_IS_DIFFERENT
);
903 static int server_verify(SSL
*s
)
907 if (s
->state
== SSL2_ST_SEND_SERVER_VERIFY_A
) {
908 p
= (unsigned char *)s
->init_buf
->data
;
909 *(p
++) = SSL2_MT_SERVER_VERIFY
;
910 if (s
->s2
->challenge_length
> sizeof s
->s2
->challenge
) {
911 SSLerr(SSL_F_SERVER_VERIFY
, ERR_R_INTERNAL_ERROR
);
914 memcpy(p
, s
->s2
->challenge
, (unsigned int)s
->s2
->challenge_length
);
915 /* p+=s->s2->challenge_length; */
917 s
->state
= SSL2_ST_SEND_SERVER_VERIFY_B
;
918 s
->init_num
= s
->s2
->challenge_length
+ 1;
921 return (ssl2_do_write(s
));
924 static int server_finish(SSL
*s
)
928 if (s
->state
== SSL2_ST_SEND_SERVER_FINISHED_A
) {
929 p
= (unsigned char *)s
->init_buf
->data
;
930 *(p
++) = SSL2_MT_SERVER_FINISHED
;
932 if (s
->session
->session_id_length
> sizeof s
->session
->session_id
) {
933 SSLerr(SSL_F_SERVER_FINISH
, ERR_R_INTERNAL_ERROR
);
936 memcpy(p
, s
->session
->session_id
,
937 (unsigned int)s
->session
->session_id_length
);
938 /* p+=s->session->session_id_length; */
940 s
->state
= SSL2_ST_SEND_SERVER_FINISHED_B
;
941 s
->init_num
= s
->session
->session_id_length
+ 1;
945 /* SSL2_ST_SEND_SERVER_FINISHED_B */
946 return (ssl2_do_write(s
));
949 /* send the request and check the response */
950 static int request_certificate(SSL
*s
)
952 const unsigned char *cp
;
953 unsigned char *p
, *p2
, *buf2
;
955 int i
, j
, ctype
, ret
= -1;
958 STACK_OF(X509
) *sk
= NULL
;
960 ccd
= s
->s2
->tmp
.ccl
;
961 if (s
->state
== SSL2_ST_SEND_REQUEST_CERTIFICATE_A
) {
962 p
= (unsigned char *)s
->init_buf
->data
;
963 *(p
++) = SSL2_MT_REQUEST_CERTIFICATE
;
964 *(p
++) = SSL2_AT_MD5_WITH_RSA_ENCRYPTION
;
965 if (RAND_pseudo_bytes(ccd
, SSL2_MIN_CERT_CHALLENGE_LENGTH
) <= 0)
967 memcpy(p
, ccd
, SSL2_MIN_CERT_CHALLENGE_LENGTH
);
969 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_B
;
970 s
->init_num
= SSL2_MIN_CERT_CHALLENGE_LENGTH
+ 2;
974 if (s
->state
== SSL2_ST_SEND_REQUEST_CERTIFICATE_B
) {
975 i
= ssl2_do_write(s
);
982 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_C
;
985 if (s
->state
== SSL2_ST_SEND_REQUEST_CERTIFICATE_C
) {
986 p
= (unsigned char *)s
->init_buf
->data
;
987 /* try to read 6 octets ... */
988 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 6 - s
->init_num
);
990 * ... but don't call ssl2_part_read now if we got at least 3
991 * (probably NO-CERTIFICATE-ERROR)
993 if (i
< 3 - s
->init_num
) {
994 ret
= ssl2_part_read(s
, SSL_F_REQUEST_CERTIFICATE
, i
);
999 if ((s
->init_num
>= 3) && (p
[0] == SSL2_MT_ERROR
)) {
1001 if (i
!= SSL2_PE_NO_CERTIFICATE
) {
1003 * not the error message we expected -- let ssl2_part_read
1007 ret
= ssl2_part_read(s
, SSL_F_REQUEST_CERTIFICATE
, 3);
1011 if (s
->msg_callback
) {
1013 s
->msg_callback(0, s
->version
, 0, p
, 3, s
,
1014 s
->msg_callback_arg
);
1018 * this is the one place where we can recover from an SSL 2.0
1022 if (s
->verify_mode
& SSL_VERIFY_FAIL_IF_NO_PEER_CERT
) {
1023 ssl2_return_error(s
, SSL2_PE_BAD_CERTIFICATE
);
1024 SSLerr(SSL_F_REQUEST_CERTIFICATE
,
1025 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE
);
1031 if ((*(p
++) != SSL2_MT_CLIENT_CERTIFICATE
) || (s
->init_num
< 6)) {
1032 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
1033 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_SHORT_READ
);
1036 if (s
->init_num
!= 6) {
1037 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_INTERNAL_ERROR
);
1041 /* ok we have a response */
1042 /* certificate type, there is only one right now. */
1044 if (ctype
!= SSL2_AT_MD5_WITH_RSA_ENCRYPTION
) {
1045 ssl2_return_error(s
, SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE
);
1046 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_BAD_RESPONSE_ARGUMENT
);
1050 s
->s2
->tmp
.clen
= i
;
1052 s
->s2
->tmp
.rlen
= i
;
1053 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_D
;
1056 /* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
1057 p
= (unsigned char *)s
->init_buf
->data
;
1058 len
= 6 + (unsigned long)s
->s2
->tmp
.clen
+ (unsigned long)s
->s2
->tmp
.rlen
;
1059 if (len
> SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
1060 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_MESSAGE_TOO_LONG
);
1063 j
= (int)len
- s
->init_num
;
1064 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), j
);
1066 ret
= ssl2_part_read(s
, SSL_F_REQUEST_CERTIFICATE
, i
);
1069 if (s
->msg_callback
) {
1070 /* CLIENT-CERTIFICATE */
1071 s
->msg_callback(0, s
->version
, 0, p
, len
, s
, s
->msg_callback_arg
);
1076 x509
= (X509
*)d2i_X509(NULL
, &cp
, (long)s
->s2
->tmp
.clen
);
1078 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_X509_LIB
);
1082 if (((sk
= sk_X509_new_null()) == NULL
) || (!sk_X509_push(sk
, x509
))) {
1083 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_MALLOC_FAILURE
);
1087 i
= ssl_verify_cert_chain(s
, sk
);
1089 if (i
> 0) { /* we like the packet, now check the chksum */
1091 EVP_PKEY
*pkey
= NULL
;
1093 EVP_MD_CTX_init(&ctx
);
1094 if (!EVP_VerifyInit_ex(&ctx
, s
->ctx
->rsa_md5
, NULL
)
1095 || !EVP_VerifyUpdate(&ctx
, s
->s2
->key_material
,
1096 s
->s2
->key_material_length
)
1097 || !EVP_VerifyUpdate(&ctx
, ccd
, SSL2_MIN_CERT_CHALLENGE_LENGTH
))
1100 i
= i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, NULL
);
1101 buf2
= OPENSSL_malloc((unsigned int)i
);
1103 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_MALLOC_FAILURE
);
1107 i
= i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, &p2
);
1108 if (!EVP_VerifyUpdate(&ctx
, buf2
, (unsigned int)i
)) {
1114 pkey
= X509_get_pubkey(x509
);
1117 i
= EVP_VerifyFinal(&ctx
, cp
, s
->s2
->tmp
.rlen
, pkey
);
1118 EVP_PKEY_free(pkey
);
1119 EVP_MD_CTX_cleanup(&ctx
);
1122 if (s
->session
->peer
!= NULL
)
1123 X509_free(s
->session
->peer
);
1124 s
->session
->peer
= x509
;
1125 CRYPTO_add(&x509
->references
, 1, CRYPTO_LOCK_X509
);
1126 s
->session
->verify_result
= s
->verify_result
;
1130 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_BAD_CHECKSUM
);
1135 ssl2_return_error(s
, SSL2_PE_BAD_CERTIFICATE
);
1143 static int ssl_rsa_private_decrypt(CERT
*c
, int len
, unsigned char *from
,
1144 unsigned char *to
, int padding
)
1149 if ((c
== NULL
) || (c
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
== NULL
)) {
1150 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT
, SSL_R_NO_PRIVATEKEY
);
1153 if (c
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
->type
!= EVP_PKEY_RSA
) {
1154 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT
, SSL_R_PUBLIC_KEY_IS_NOT_RSA
);
1157 rsa
= c
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
->pkey
.rsa
;
1159 /* we have the public key */
1160 i
= RSA_private_decrypt(len
, from
, to
, rsa
, padding
);
1162 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT
, ERR_R_RSA_LIB
);
1165 #else /* !OPENSSL_NO_SSL2 */
1168 static void *dummy
= &dummy
;