2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
112 #include "ssl_locl.h"
113 #ifndef OPENSSL_NO_SSL2
115 # include <openssl/bio.h>
116 # include <openssl/rand.h>
117 # include <openssl/objects.h>
118 # include <openssl/evp.h>
120 static const SSL_METHOD
*ssl2_get_server_method(int ver
);
121 static int get_client_master_key(SSL
*s
);
122 static int get_client_hello(SSL
*s
);
123 static int server_hello(SSL
*s
);
124 static int get_client_finished(SSL
*s
);
125 static int server_verify(SSL
*s
);
126 static int server_finish(SSL
*s
);
127 static int request_certificate(SSL
*s
);
128 static int ssl_rsa_private_decrypt(CERT
*c
, int len
, unsigned char *from
,
129 unsigned char *to
, int padding
);
132 static const SSL_METHOD
*ssl2_get_server_method(int ver
)
134 if (ver
== SSL2_VERSION
)
135 return (SSLv2_server_method());
140 IMPLEMENT_ssl2_meth_func(SSLv2_server_method
,
142 ssl_undefined_function
, ssl2_get_server_method
)
144 int ssl2_accept(SSL
*s
)
146 unsigned long l
= (unsigned long)time(NULL
);
150 void (*cb
) (const SSL
*ssl
, int type
, int val
) = NULL
;
151 int new_state
, state
;
153 RAND_add(&l
, sizeof(l
), 0);
157 if (s
->info_callback
!= NULL
)
158 cb
= s
->info_callback
;
159 else if (s
->ctx
->info_callback
!= NULL
)
160 cb
= s
->ctx
->info_callback
;
162 /* init things to blank */
164 if (!SSL_in_init(s
) || SSL_in_before(s
))
167 if (s
->cert
== NULL
) {
168 SSLerr(SSL_F_SSL2_ACCEPT
, SSL_R_NO_CERTIFICATE_SET
);
179 case SSL_ST_BEFORE
| SSL_ST_ACCEPT
:
180 case SSL_ST_OK
| SSL_ST_ACCEPT
:
184 cb(s
, SSL_CB_HANDSHAKE_START
, 1);
186 s
->version
= SSL2_VERSION
;
187 s
->type
= SSL_ST_ACCEPT
;
189 if (s
->init_buf
== NULL
) {
190 if ((buf
= BUF_MEM_new()) == NULL
) {
195 (buf
, (int)SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
)) {
203 s
->ctx
->stats
.sess_accept
++;
204 s
->handshake_func
= ssl2_accept
;
205 s
->state
= SSL2_ST_GET_CLIENT_HELLO_A
;
208 case SSL2_ST_GET_CLIENT_HELLO_A
:
209 case SSL2_ST_GET_CLIENT_HELLO_B
:
210 case SSL2_ST_GET_CLIENT_HELLO_C
:
212 ret
= get_client_hello(s
);
216 s
->state
= SSL2_ST_SEND_SERVER_HELLO_A
;
219 case SSL2_ST_SEND_SERVER_HELLO_A
:
220 case SSL2_ST_SEND_SERVER_HELLO_B
:
221 ret
= server_hello(s
);
226 s
->state
= SSL2_ST_GET_CLIENT_MASTER_KEY_A
;
229 s
->state
= SSL2_ST_SERVER_START_ENCRYPTION
;
232 case SSL2_ST_GET_CLIENT_MASTER_KEY_A
:
233 case SSL2_ST_GET_CLIENT_MASTER_KEY_B
:
234 ret
= get_client_master_key(s
);
238 s
->state
= SSL2_ST_SERVER_START_ENCRYPTION
;
241 case SSL2_ST_SERVER_START_ENCRYPTION
:
243 * Ok we how have sent all the stuff needed to start encrypting,
244 * the next packet back will be encrypted.
246 if (!ssl2_enc_init(s
, 0)) {
250 s
->s2
->clear_text
= 0;
251 s
->state
= SSL2_ST_SEND_SERVER_VERIFY_A
;
254 case SSL2_ST_SEND_SERVER_VERIFY_A
:
255 case SSL2_ST_SEND_SERVER_VERIFY_B
:
256 ret
= server_verify(s
);
262 * If we are in here, we have been buffering the output, so
263 * we need to flush it and remove buffering from future
266 s
->state
= SSL2_ST_SEND_SERVER_VERIFY_C
;
269 s
->state
= SSL2_ST_GET_CLIENT_FINISHED_A
;
273 case SSL2_ST_SEND_SERVER_VERIFY_C
:
274 /* get the number of bytes to write */
275 num1
= BIO_ctrl(s
->wbio
, BIO_CTRL_INFO
, 0, NULL
);
277 s
->rwstate
= SSL_WRITING
;
278 num1
= BIO_flush(s
->wbio
);
283 s
->rwstate
= SSL_NOTHING
;
286 /* flushed and now remove buffering */
287 s
->wbio
= BIO_pop(s
->wbio
);
289 s
->state
= SSL2_ST_GET_CLIENT_FINISHED_A
;
292 case SSL2_ST_GET_CLIENT_FINISHED_A
:
293 case SSL2_ST_GET_CLIENT_FINISHED_B
:
294 ret
= get_client_finished(s
);
298 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_A
;
301 case SSL2_ST_SEND_REQUEST_CERTIFICATE_A
:
302 case SSL2_ST_SEND_REQUEST_CERTIFICATE_B
:
303 case SSL2_ST_SEND_REQUEST_CERTIFICATE_C
:
304 case SSL2_ST_SEND_REQUEST_CERTIFICATE_D
:
306 * don't do a 'request certificate' if we don't want to, or we
307 * already have one, and we only want to do it once.
309 if (!(s
->verify_mode
& SSL_VERIFY_PEER
) ||
310 ((s
->session
->peer
!= NULL
) &&
311 (s
->verify_mode
& SSL_VERIFY_CLIENT_ONCE
))) {
312 s
->state
= SSL2_ST_SEND_SERVER_FINISHED_A
;
315 ret
= request_certificate(s
);
319 s
->state
= SSL2_ST_SEND_SERVER_FINISHED_A
;
323 case SSL2_ST_SEND_SERVER_FINISHED_A
:
324 case SSL2_ST_SEND_SERVER_FINISHED_B
:
325 ret
= server_finish(s
);
329 s
->state
= SSL_ST_OK
;
333 BUF_MEM_free(s
->init_buf
);
334 ssl_free_wbio_buffer(s
);
337 /* ERR_clear_error(); */
339 ssl_update_cache(s
, SSL_SESS_CACHE_SERVER
);
341 s
->ctx
->stats
.sess_accept_good
++;
346 cb(s
, SSL_CB_HANDSHAKE_DONE
, 1);
352 SSLerr(SSL_F_SSL2_ACCEPT
, SSL_R_UNKNOWN_STATE
);
358 if ((cb
!= NULL
) && (s
->state
!= state
)) {
359 new_state
= s
->state
;
361 cb(s
, SSL_CB_ACCEPT_LOOP
, 1);
362 s
->state
= new_state
;
368 cb(s
, SSL_CB_ACCEPT_EXIT
, ret
);
372 static int get_client_master_key(SSL
*s
)
374 int is_export
, i
, n
, keya
;
378 const SSL_CIPHER
*cp
;
382 p
= (unsigned char *)s
->init_buf
->data
;
383 if (s
->state
== SSL2_ST_GET_CLIENT_MASTER_KEY_A
) {
384 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 10 - s
->init_num
);
386 if (i
< (10 - s
->init_num
))
387 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_MASTER_KEY
, i
));
390 if (*(p
++) != SSL2_MT_CLIENT_MASTER_KEY
) {
391 if (p
[-1] != SSL2_MT_ERROR
) {
392 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
393 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,
394 SSL_R_READ_WRONG_PACKET_TYPE
);
396 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_PEER_ERROR
);
400 cp
= ssl2_get_cipher_by_char(p
);
402 ssl2_return_error(s
, SSL2_PE_NO_CIPHER
);
403 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_NO_CIPHER_MATCH
);
406 s
->session
->cipher
= cp
;
410 s
->s2
->tmp
.clear
= i
;
414 if (i
> SSL_MAX_KEY_ARG_LENGTH
) {
415 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
416 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_KEY_ARG_TOO_LONG
);
419 s
->session
->key_arg_length
= i
;
420 s
->state
= SSL2_ST_GET_CLIENT_MASTER_KEY_B
;
423 /* SSL2_ST_GET_CLIENT_MASTER_KEY_B */
424 p
= (unsigned char *)s
->init_buf
->data
;
425 if (s
->init_buf
->length
< SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
426 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
427 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, ERR_R_INTERNAL_ERROR
);
430 keya
= s
->session
->key_arg_length
;
432 10 + (unsigned long)s
->s2
->tmp
.clear
+ (unsigned long)s
->s2
->tmp
.enc
+
434 if (len
> SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
435 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
436 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_MESSAGE_TOO_LONG
);
439 n
= (int)len
- s
->init_num
;
440 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), n
);
442 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_MASTER_KEY
, i
));
443 if (s
->msg_callback
) {
444 /* CLIENT-MASTER-KEY */
445 s
->msg_callback(0, s
->version
, 0, p
, (size_t)len
, s
,
446 s
->msg_callback_arg
);
450 memcpy(s
->session
->key_arg
, &(p
[s
->s2
->tmp
.clear
+ s
->s2
->tmp
.enc
]),
453 if (s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
== NULL
) {
454 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
455 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_NO_PRIVATEKEY
);
459 is_export
= SSL_C_IS_EXPORT(s
->session
->cipher
);
461 if (!ssl_cipher_get_evp(s
->session
, &c
, &md
, NULL
, NULL
, NULL
)) {
462 ssl2_return_error(s
, SSL2_PE_NO_CIPHER
);
463 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,
464 SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS
);
468 if (s
->session
->cipher
->algorithm2
& SSL2_CF_8_BYTE_ENC
) {
475 * The format of the CLIENT-MASTER-KEY message is
476 * 1 byte message type
478 * 2-byte clear key length (stored in s->s2->tmp.clear)
479 * 2-byte encrypted key length (stored in s->s2->tmp.enc)
480 * 2-byte key args length (IV etc)
485 * If the cipher is an export cipher, then the encrypted key bytes
486 * are a fixed portion of the total key (5 or 8 bytes). The size of
487 * this portion is in |ek|. If the cipher is not an export cipher,
488 * then the entire key material is encrypted (i.e., clear key length
491 if ((!is_export
&& s
->s2
->tmp
.clear
!= 0) ||
492 (is_export
&& s
->s2
->tmp
.clear
+ ek
!= (unsigned int)EVP_CIPHER_key_length(c
))) {
493 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
494 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,SSL_R_BAD_LENGTH
);
498 * The encrypted blob must decrypt to the encrypted portion of the key.
499 * Decryption can't be expanding, so if we don't have enough encrypted
500 * bytes to fit the key in the buffer, stop now.
502 if ((is_export
&& s
->s2
->tmp
.enc
< ek
) ||
503 (!is_export
&& s
->s2
->tmp
.enc
< (unsigned int)EVP_CIPHER_key_length(c
))) {
504 ssl2_return_error(s
,SSL2_PE_UNDEFINED_ERROR
);
505 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
,SSL_R_LENGTH_TOO_SHORT
);
509 i
= ssl_rsa_private_decrypt(s
->cert
, s
->s2
->tmp
.enc
,
510 &(p
[s
->s2
->tmp
.clear
]),
511 &(p
[s
->s2
->tmp
.clear
]),
512 (s
->s2
->ssl2_rollback
) ? RSA_SSLV23_PADDING
:
518 * If a bad decrypt, continue with protocol but with a random master
519 * secret (Bleichenbacher attack)
521 if ((i
< 0) || ((!is_export
&& i
!= EVP_CIPHER_key_length(c
))
522 || (is_export
&& i
!= (int)ek
))) {
527 i
= EVP_CIPHER_key_length(c
);
528 if (RAND_pseudo_bytes(&p
[s
->s2
->tmp
.clear
], i
) <= 0)
534 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_BAD_RSA_DECRYPT
);
536 /* incorrect number of key bytes for non export cipher */
537 else if ((!is_export
&& (i
!= EVP_CIPHER_key_length(c
)))
538 || (is_export
&& ((i
!= ek
) || (s
->s2
->tmp
.clear
+ i
!=
539 EVP_CIPHER_key_length(c
))))) {
541 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, SSL_R_WRONG_NUMBER_OF_KEY_BITS
);
544 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
550 i
= EVP_CIPHER_key_length(c
);
552 if (i
> SSL_MAX_MASTER_KEY_LENGTH
) {
553 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
554 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY
, ERR_R_INTERNAL_ERROR
);
557 s
->session
->master_key_length
= i
;
558 memcpy(s
->session
->master_key
, p
, (unsigned int)i
);
562 static int get_client_hello(SSL
*s
)
567 STACK_OF(SSL_CIPHER
) *cs
; /* a stack of SSL_CIPHERS */
568 STACK_OF(SSL_CIPHER
) *cl
; /* the ones we want to use */
569 STACK_OF(SSL_CIPHER
) *prio
, *allow
;
573 * This is a bit of a hack to check for the correct packet type the first
576 if (s
->state
== SSL2_ST_GET_CLIENT_HELLO_A
) {
578 s
->state
= SSL2_ST_GET_CLIENT_HELLO_B
;
581 p
= (unsigned char *)s
->init_buf
->data
;
582 if (s
->state
== SSL2_ST_GET_CLIENT_HELLO_B
) {
583 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 9 - s
->init_num
);
584 if (i
< (9 - s
->init_num
))
585 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_HELLO
, i
));
588 if (*(p
++) != SSL2_MT_CLIENT_HELLO
) {
589 if (p
[-1] != SSL2_MT_ERROR
) {
590 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
591 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_READ_WRONG_PACKET_TYPE
);
593 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_PEER_ERROR
);
600 s
->s2
->tmp
.cipher_spec_length
= i
;
602 s
->s2
->tmp
.session_id_length
= i
;
604 s
->s2
->challenge_length
= i
;
605 if ((i
< SSL2_MIN_CHALLENGE_LENGTH
) ||
606 (i
> SSL2_MAX_CHALLENGE_LENGTH
)) {
607 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
608 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_INVALID_CHALLENGE_LENGTH
);
611 s
->state
= SSL2_ST_GET_CLIENT_HELLO_C
;
614 /* SSL2_ST_GET_CLIENT_HELLO_C */
615 p
= (unsigned char *)s
->init_buf
->data
;
617 9 + (unsigned long)s
->s2
->tmp
.cipher_spec_length
+
618 (unsigned long)s
->s2
->challenge_length
+
619 (unsigned long)s
->s2
->tmp
.session_id_length
;
620 if (len
> SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
621 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
622 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_MESSAGE_TOO_LONG
);
625 n
= (int)len
- s
->init_num
;
626 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), n
);
628 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_HELLO
, i
));
629 if (s
->msg_callback
) {
631 s
->msg_callback(0, s
->version
, 0, p
, (size_t)len
, s
,
632 s
->msg_callback_arg
);
637 * get session-id before cipher stuff so we can get out session structure
641 if ((s
->s2
->tmp
.session_id_length
!= 0) &&
642 (s
->s2
->tmp
.session_id_length
!= SSL2_SSL_SESSION_ID_LENGTH
)) {
643 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
644 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_BAD_SSL_SESSION_ID_LENGTH
);
648 if (s
->s2
->tmp
.session_id_length
== 0) {
649 if (!ssl_get_new_session(s
, 1)) {
650 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
654 i
= ssl_get_prev_session(s
, &(p
[s
->s2
->tmp
.cipher_spec_length
]),
655 s
->s2
->tmp
.session_id_length
, NULL
);
656 if (i
== 1) { /* previous session */
658 } else if (i
== -1) {
659 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
662 if (s
->cert
== NULL
) {
663 ssl2_return_error(s
, SSL2_PE_NO_CERTIFICATE
);
664 SSLerr(SSL_F_GET_CLIENT_HELLO
, SSL_R_NO_CERTIFICATE_SET
);
668 if (!ssl_get_new_session(s
, 1)) {
669 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
676 cs
= ssl_bytes_to_cipher_list(s
, p
, s
->s2
->tmp
.cipher_spec_length
,
677 &s
->session
->ciphers
);
681 cl
= SSL_get_ciphers(s
);
683 if (s
->options
& SSL_OP_CIPHER_SERVER_PREFERENCE
) {
684 prio
= sk_SSL_CIPHER_dup(cl
);
692 for (z
= 0; z
< sk_SSL_CIPHER_num(prio
); z
++) {
693 if (sk_SSL_CIPHER_find(allow
, sk_SSL_CIPHER_value(prio
, z
)) < 0) {
694 (void)sk_SSL_CIPHER_delete(prio
, z
);
698 if (s
->options
& SSL_OP_CIPHER_SERVER_PREFERENCE
) {
699 sk_SSL_CIPHER_free(s
->session
->ciphers
);
700 s
->session
->ciphers
= prio
;
703 * s->session->ciphers should now have a list of ciphers that are on
704 * both the client and server. This list is ordered by the order the
705 * client sent the ciphers or in the order of the server's preference
706 * if SSL_OP_CIPHER_SERVER_PREFERENCE was set.
709 p
+= s
->s2
->tmp
.cipher_spec_length
;
710 /* done cipher selection */
712 /* session id extracted already */
713 p
+= s
->s2
->tmp
.session_id_length
;
716 if (s
->s2
->challenge_length
> sizeof s
->s2
->challenge
) {
717 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
718 SSLerr(SSL_F_GET_CLIENT_HELLO
, ERR_R_INTERNAL_ERROR
);
721 memcpy(s
->s2
->challenge
, p
, (unsigned int)s
->s2
->challenge_length
);
724 SSLerr(SSL_F_GET_CLIENT_HELLO
, ERR_R_MALLOC_FAILURE
);
728 static int server_hello(SSL
*s
)
730 unsigned char *p
, *d
;
733 p
= (unsigned char *)s
->init_buf
->data
;
734 if (s
->state
== SSL2_ST_SEND_SERVER_HELLO_A
) {
736 *(p
++) = SSL2_MT_SERVER_HELLO
; /* type */
738 *(p
++) = (unsigned char)hit
;
741 if (s
->session
->sess_cert
!= NULL
)
743 * This can't really happen because get_client_hello has
744 * called ssl_get_new_session, which does not set sess_cert.
746 ssl_sess_cert_free(s
->session
->sess_cert
);
747 s
->session
->sess_cert
= ssl_sess_cert_new();
748 if (s
->session
->sess_cert
== NULL
) {
749 SSLerr(SSL_F_SERVER_HELLO
, ERR_R_MALLOC_FAILURE
);
754 * If 'hit' is set, then s->sess_cert may be non-NULL or NULL,
755 * depending on whether it survived in the internal cache or was
756 * retrieved from an external cache. If it is NULL, we cannot put any
757 * useful data in it anyway, so we don't touch it.
760 # else /* That's what used to be done when cert_st
761 * and sess_cert_st were * the same. */
762 if (!hit
) { /* else add cert to session */
763 CRYPTO_add(&s
->cert
->references
, 1, CRYPTO_LOCK_SSL_CERT
);
764 if (s
->session
->sess_cert
!= NULL
)
765 ssl_cert_free(s
->session
->sess_cert
);
766 s
->session
->sess_cert
= s
->cert
;
767 } else { /* We have a session id-cache hit, if the *
768 * session-id has no certificate listed
769 * against * the 'cert' structure, grab the
770 * 'old' one * listed against the SSL
772 if (s
->session
->sess_cert
== NULL
) {
773 CRYPTO_add(&s
->cert
->references
, 1, CRYPTO_LOCK_SSL_CERT
);
774 s
->session
->sess_cert
= s
->cert
;
779 if (s
->cert
== NULL
) {
780 ssl2_return_error(s
, SSL2_PE_NO_CERTIFICATE
);
781 SSLerr(SSL_F_SERVER_HELLO
, SSL_R_NO_CERTIFICATE_SPECIFIED
);
786 *(p
++) = 0; /* no certificate type */
787 s2n(s
->version
, p
); /* version */
788 s2n(0, p
); /* cert len */
789 s2n(0, p
); /* ciphers len */
792 /* put certificate type */
793 *(p
++) = SSL2_CT_X509_CERTIFICATE
;
794 s2n(s
->version
, p
); /* version */
795 n
= i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, NULL
);
796 s2n(n
, p
); /* certificate length */
797 i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, &d
);
801 * lets send out the ciphers we like in the prefered order
803 n
= ssl_cipher_list_to_bytes(s
, s
->session
->ciphers
, d
, 0);
805 s2n(n
, p
); /* add cipher length */
808 /* make and send conn_id */
809 s2n(SSL2_CONNECTION_ID_LENGTH
, p
); /* add conn_id length */
810 s
->s2
->conn_id_length
= SSL2_CONNECTION_ID_LENGTH
;
811 if (RAND_pseudo_bytes(s
->s2
->conn_id
, (int)s
->s2
->conn_id_length
) <=
814 memcpy(d
, s
->s2
->conn_id
, SSL2_CONNECTION_ID_LENGTH
);
815 d
+= SSL2_CONNECTION_ID_LENGTH
;
817 s
->state
= SSL2_ST_SEND_SERVER_HELLO_B
;
818 s
->init_num
= d
- (unsigned char *)s
->init_buf
->data
;
821 /* SSL2_ST_SEND_SERVER_HELLO_B */
823 * If we are using TCP/IP, the performance is bad if we do 2 writes
824 * without a read between them. This occurs when Session-id reuse is
825 * used, so I will put in a buffering module
828 if (!ssl_init_wbio_buffer(s
, 1))
832 return (ssl2_do_write(s
));
835 static int get_client_finished(SSL
*s
)
841 p
= (unsigned char *)s
->init_buf
->data
;
842 if (s
->state
== SSL2_ST_GET_CLIENT_FINISHED_A
) {
843 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 1 - s
->init_num
);
844 if (i
< 1 - s
->init_num
)
845 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_FINISHED
, i
));
848 if (*p
!= SSL2_MT_CLIENT_FINISHED
) {
849 if (*p
!= SSL2_MT_ERROR
) {
850 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
851 SSLerr(SSL_F_GET_CLIENT_FINISHED
,
852 SSL_R_READ_WRONG_PACKET_TYPE
);
854 SSLerr(SSL_F_GET_CLIENT_FINISHED
, SSL_R_PEER_ERROR
);
855 /* try to read the error message */
856 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 3 - s
->init_num
);
857 return ssl2_part_read(s
, SSL_F_GET_SERVER_VERIFY
, i
);
861 s
->state
= SSL2_ST_GET_CLIENT_FINISHED_B
;
864 /* SSL2_ST_GET_CLIENT_FINISHED_B */
865 if (s
->s2
->conn_id_length
> sizeof s
->s2
->conn_id
) {
866 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
867 SSLerr(SSL_F_GET_CLIENT_FINISHED
, ERR_R_INTERNAL_ERROR
);
870 len
= 1 + (unsigned long)s
->s2
->conn_id_length
;
871 n
= (int)len
- s
->init_num
;
872 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), n
);
874 return (ssl2_part_read(s
, SSL_F_GET_CLIENT_FINISHED
, i
));
876 if (s
->msg_callback
) {
877 /* CLIENT-FINISHED */
878 s
->msg_callback(0, s
->version
, 0, p
, len
, s
, s
->msg_callback_arg
);
881 if (memcmp(p
, s
->s2
->conn_id
, s
->s2
->conn_id_length
) != 0) {
882 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
883 SSLerr(SSL_F_GET_CLIENT_FINISHED
, SSL_R_CONNECTION_ID_IS_DIFFERENT
);
889 static int server_verify(SSL
*s
)
893 if (s
->state
== SSL2_ST_SEND_SERVER_VERIFY_A
) {
894 p
= (unsigned char *)s
->init_buf
->data
;
895 *(p
++) = SSL2_MT_SERVER_VERIFY
;
896 if (s
->s2
->challenge_length
> sizeof s
->s2
->challenge
) {
897 SSLerr(SSL_F_SERVER_VERIFY
, ERR_R_INTERNAL_ERROR
);
900 memcpy(p
, s
->s2
->challenge
, (unsigned int)s
->s2
->challenge_length
);
901 /* p+=s->s2->challenge_length; */
903 s
->state
= SSL2_ST_SEND_SERVER_VERIFY_B
;
904 s
->init_num
= s
->s2
->challenge_length
+ 1;
907 return (ssl2_do_write(s
));
910 static int server_finish(SSL
*s
)
914 if (s
->state
== SSL2_ST_SEND_SERVER_FINISHED_A
) {
915 p
= (unsigned char *)s
->init_buf
->data
;
916 *(p
++) = SSL2_MT_SERVER_FINISHED
;
918 if (s
->session
->session_id_length
> sizeof s
->session
->session_id
) {
919 SSLerr(SSL_F_SERVER_FINISH
, ERR_R_INTERNAL_ERROR
);
922 memcpy(p
, s
->session
->session_id
,
923 (unsigned int)s
->session
->session_id_length
);
924 /* p+=s->session->session_id_length; */
926 s
->state
= SSL2_ST_SEND_SERVER_FINISHED_B
;
927 s
->init_num
= s
->session
->session_id_length
+ 1;
931 /* SSL2_ST_SEND_SERVER_FINISHED_B */
932 return (ssl2_do_write(s
));
935 /* send the request and check the response */
936 static int request_certificate(SSL
*s
)
938 const unsigned char *cp
;
939 unsigned char *p
, *p2
, *buf2
;
941 int i
, j
, ctype
, ret
= -1;
944 STACK_OF(X509
) *sk
= NULL
;
946 ccd
= s
->s2
->tmp
.ccl
;
947 if (s
->state
== SSL2_ST_SEND_REQUEST_CERTIFICATE_A
) {
948 p
= (unsigned char *)s
->init_buf
->data
;
949 *(p
++) = SSL2_MT_REQUEST_CERTIFICATE
;
950 *(p
++) = SSL2_AT_MD5_WITH_RSA_ENCRYPTION
;
951 if (RAND_pseudo_bytes(ccd
, SSL2_MIN_CERT_CHALLENGE_LENGTH
) <= 0)
953 memcpy(p
, ccd
, SSL2_MIN_CERT_CHALLENGE_LENGTH
);
955 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_B
;
956 s
->init_num
= SSL2_MIN_CERT_CHALLENGE_LENGTH
+ 2;
960 if (s
->state
== SSL2_ST_SEND_REQUEST_CERTIFICATE_B
) {
961 i
= ssl2_do_write(s
);
968 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_C
;
971 if (s
->state
== SSL2_ST_SEND_REQUEST_CERTIFICATE_C
) {
972 p
= (unsigned char *)s
->init_buf
->data
;
973 /* try to read 6 octets ... */
974 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), 6 - s
->init_num
);
976 * ... but don't call ssl2_part_read now if we got at least 3
977 * (probably NO-CERTIFICATE-ERROR)
979 if (i
< 3 - s
->init_num
) {
980 ret
= ssl2_part_read(s
, SSL_F_REQUEST_CERTIFICATE
, i
);
985 if ((s
->init_num
>= 3) && (p
[0] == SSL2_MT_ERROR
)) {
987 if (i
!= SSL2_PE_NO_CERTIFICATE
) {
989 * not the error message we expected -- let ssl2_part_read
993 ret
= ssl2_part_read(s
, SSL_F_REQUEST_CERTIFICATE
, 3);
997 if (s
->msg_callback
) {
999 s
->msg_callback(0, s
->version
, 0, p
, 3, s
,
1000 s
->msg_callback_arg
);
1004 * this is the one place where we can recover from an SSL 2.0
1008 if (s
->verify_mode
& SSL_VERIFY_FAIL_IF_NO_PEER_CERT
) {
1009 ssl2_return_error(s
, SSL2_PE_BAD_CERTIFICATE
);
1010 SSLerr(SSL_F_REQUEST_CERTIFICATE
,
1011 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE
);
1017 if ((*(p
++) != SSL2_MT_CLIENT_CERTIFICATE
) || (s
->init_num
< 6)) {
1018 ssl2_return_error(s
, SSL2_PE_UNDEFINED_ERROR
);
1019 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_SHORT_READ
);
1022 if (s
->init_num
!= 6) {
1023 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_INTERNAL_ERROR
);
1027 /* ok we have a response */
1028 /* certificate type, there is only one right now. */
1030 if (ctype
!= SSL2_AT_MD5_WITH_RSA_ENCRYPTION
) {
1031 ssl2_return_error(s
, SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE
);
1032 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_BAD_RESPONSE_ARGUMENT
);
1036 s
->s2
->tmp
.clen
= i
;
1038 s
->s2
->tmp
.rlen
= i
;
1039 s
->state
= SSL2_ST_SEND_REQUEST_CERTIFICATE_D
;
1042 /* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
1043 p
= (unsigned char *)s
->init_buf
->data
;
1044 len
= 6 + (unsigned long)s
->s2
->tmp
.clen
+ (unsigned long)s
->s2
->tmp
.rlen
;
1045 if (len
> SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER
) {
1046 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_MESSAGE_TOO_LONG
);
1049 j
= (int)len
- s
->init_num
;
1050 i
= ssl2_read(s
, (char *)&(p
[s
->init_num
]), j
);
1052 ret
= ssl2_part_read(s
, SSL_F_REQUEST_CERTIFICATE
, i
);
1055 if (s
->msg_callback
) {
1056 /* CLIENT-CERTIFICATE */
1057 s
->msg_callback(0, s
->version
, 0, p
, len
, s
, s
->msg_callback_arg
);
1062 x509
= (X509
*)d2i_X509(NULL
, &cp
, (long)s
->s2
->tmp
.clen
);
1064 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_X509_LIB
);
1068 if (((sk
= sk_X509_new_null()) == NULL
) || (!sk_X509_push(sk
, x509
))) {
1069 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_MALLOC_FAILURE
);
1073 i
= ssl_verify_cert_chain(s
, sk
);
1075 if (i
> 0) { /* we like the packet, now check the chksum */
1077 EVP_PKEY
*pkey
= NULL
;
1079 EVP_MD_CTX_init(&ctx
);
1080 if (!EVP_VerifyInit_ex(&ctx
, s
->ctx
->rsa_md5
, NULL
)
1081 || !EVP_VerifyUpdate(&ctx
, s
->s2
->key_material
,
1082 s
->s2
->key_material_length
)
1083 || !EVP_VerifyUpdate(&ctx
, ccd
, SSL2_MIN_CERT_CHALLENGE_LENGTH
))
1086 i
= i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, NULL
);
1087 buf2
= OPENSSL_malloc((unsigned int)i
);
1089 SSLerr(SSL_F_REQUEST_CERTIFICATE
, ERR_R_MALLOC_FAILURE
);
1093 i
= i2d_X509(s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].x509
, &p2
);
1094 if (!EVP_VerifyUpdate(&ctx
, buf2
, (unsigned int)i
)) {
1100 pkey
= X509_get_pubkey(x509
);
1103 i
= EVP_VerifyFinal(&ctx
, cp
, s
->s2
->tmp
.rlen
, pkey
);
1104 EVP_PKEY_free(pkey
);
1105 EVP_MD_CTX_cleanup(&ctx
);
1108 if (s
->session
->peer
!= NULL
)
1109 X509_free(s
->session
->peer
);
1110 s
->session
->peer
= x509
;
1111 CRYPTO_add(&x509
->references
, 1, CRYPTO_LOCK_X509
);
1112 s
->session
->verify_result
= s
->verify_result
;
1116 SSLerr(SSL_F_REQUEST_CERTIFICATE
, SSL_R_BAD_CHECKSUM
);
1121 ssl2_return_error(s
, SSL2_PE_BAD_CERTIFICATE
);
1129 static int ssl_rsa_private_decrypt(CERT
*c
, int len
, unsigned char *from
,
1130 unsigned char *to
, int padding
)
1135 if ((c
== NULL
) || (c
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
== NULL
)) {
1136 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT
, SSL_R_NO_PRIVATEKEY
);
1139 if (c
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
->type
!= EVP_PKEY_RSA
) {
1140 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT
, SSL_R_PUBLIC_KEY_IS_NOT_RSA
);
1143 rsa
= c
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
->pkey
.rsa
;
1145 /* we have the public key */
1146 i
= RSA_private_decrypt(len
, from
, to
, rsa
, padding
);
1148 SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT
, ERR_R_RSA_LIB
);
1151 #else /* !OPENSSL_NO_SSL2 */
1154 static void *dummy
= &dummy
;