1 /* $OpenBSD: t1_enc.c,v 1.107 2017/03/25 13:42:29 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
111 /* ====================================================================
112 * Copyright 2005 Nokia. All rights reserved.
114 * The portions of the attached software ("Contribution") is developed by
115 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
118 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120 * support (see RFC 4279) to OpenSSL.
122 * No patent licenses or other rights except those expressly stated in
123 * the OpenSSL open source license shall be deemed granted or received
124 * expressly, by implication, estoppel, or otherwise.
126 * No assurances are provided by Nokia that the Contribution does not
127 * infringe the patent or other intellectual property rights of any third
128 * party or that the license provides you with all the necessary rights
129 * to make use of the Contribution.
131 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
141 #include "ssl_locl.h"
143 #include <openssl/evp.h>
144 #include <openssl/hmac.h>
145 #include <openssl/md5.h>
147 int tls1_PRF(SSL
*s
, const unsigned char *secret
, size_t secret_len
,
148 const void *seed1
, size_t seed1_len
, const void *seed2
, size_t seed2_len
,
149 const void *seed3
, size_t seed3_len
, const void *seed4
, size_t seed4_len
,
150 const void *seed5
, size_t seed5_len
, unsigned char *out
, size_t out_len
);
153 tls1_cleanup_key_block(SSL
*s
)
155 if (S3I(s
)->tmp
.key_block
!= NULL
) {
156 explicit_bzero(S3I(s
)->tmp
.key_block
,
157 S3I(s
)->tmp
.key_block_length
);
158 free(S3I(s
)->tmp
.key_block
);
159 S3I(s
)->tmp
.key_block
= NULL
;
161 S3I(s
)->tmp
.key_block_length
= 0;
165 tls1_init_finished_mac(SSL
*s
)
167 BIO_free(S3I(s
)->handshake_buffer
);
169 S3I(s
)->handshake_buffer
= BIO_new(BIO_s_mem());
170 if (S3I(s
)->handshake_buffer
== NULL
)
173 (void)BIO_set_close(S3I(s
)->handshake_buffer
, BIO_CLOSE
);
179 tls1_finish_mac(SSL
*s
, const unsigned char *buf
, int len
)
184 if (!tls1_handshake_hash_update(s
, buf
, len
))
187 if (S3I(s
)->handshake_buffer
&&
188 !(s
->s3
->flags
& TLS1_FLAGS_KEEP_HANDSHAKE
)) {
189 BIO_write(S3I(s
)->handshake_buffer
, (void *)buf
, len
);
197 tls1_digest_cached_records(SSL
*s
)
202 hdatalen
= BIO_get_mem_data(S3I(s
)->handshake_buffer
, &hdata
);
204 SSLerror(s
, SSL_R_BAD_HANDSHAKE_LENGTH
);
208 if (!(s
->s3
->flags
& TLS1_FLAGS_KEEP_HANDSHAKE
)) {
209 BIO_free(S3I(s
)->handshake_buffer
);
210 S3I(s
)->handshake_buffer
= NULL
;
220 tls1_record_sequence_increment(unsigned char *seq
)
224 for (i
= SSL3_SEQUENCE_SIZE
- 1; i
>= 0; i
--) {
231 * TLS P_hash() data expansion function - see RFC 5246, section 5.
234 tls1_P_hash(const EVP_MD
*md
, const unsigned char *secret
, size_t secret_len
,
235 const void *seed1
, size_t seed1_len
, const void *seed2
, size_t seed2_len
,
236 const void *seed3
, size_t seed3_len
, const void *seed4
, size_t seed4_len
,
237 const void *seed5
, size_t seed5_len
, unsigned char *out
, size_t out_len
)
239 unsigned char A1
[EVP_MAX_MD_SIZE
], hmac
[EVP_MAX_MD_SIZE
];
240 size_t A1_len
, hmac_len
;
247 chunk
= EVP_MD_size(md
);
248 OPENSSL_assert(chunk
>= 0);
250 EVP_MD_CTX_init(&ctx
);
252 mac_key
= EVP_PKEY_new_mac_key(EVP_PKEY_HMAC
, NULL
, secret
, secret_len
);
255 if (!EVP_DigestSignInit(&ctx
, NULL
, md
, NULL
, mac_key
))
257 if (seed1
&& !EVP_DigestSignUpdate(&ctx
, seed1
, seed1_len
))
259 if (seed2
&& !EVP_DigestSignUpdate(&ctx
, seed2
, seed2_len
))
261 if (seed3
&& !EVP_DigestSignUpdate(&ctx
, seed3
, seed3_len
))
263 if (seed4
&& !EVP_DigestSignUpdate(&ctx
, seed4
, seed4_len
))
265 if (seed5
&& !EVP_DigestSignUpdate(&ctx
, seed5
, seed5_len
))
267 if (!EVP_DigestSignFinal(&ctx
, A1
, &A1_len
))
271 if (!EVP_DigestSignInit(&ctx
, NULL
, md
, NULL
, mac_key
))
273 if (!EVP_DigestSignUpdate(&ctx
, A1
, A1_len
))
275 if (seed1
&& !EVP_DigestSignUpdate(&ctx
, seed1
, seed1_len
))
277 if (seed2
&& !EVP_DigestSignUpdate(&ctx
, seed2
, seed2_len
))
279 if (seed3
&& !EVP_DigestSignUpdate(&ctx
, seed3
, seed3_len
))
281 if (seed4
&& !EVP_DigestSignUpdate(&ctx
, seed4
, seed4_len
))
283 if (seed5
&& !EVP_DigestSignUpdate(&ctx
, seed5
, seed5_len
))
285 if (!EVP_DigestSignFinal(&ctx
, hmac
, &hmac_len
))
288 if (hmac_len
> out_len
)
291 for (i
= 0; i
< hmac_len
; i
++)
300 if (!EVP_DigestSignInit(&ctx
, NULL
, md
, NULL
, mac_key
))
302 if (!EVP_DigestSignUpdate(&ctx
, A1
, A1_len
))
304 if (!EVP_DigestSignFinal(&ctx
, A1
, &A1_len
))
310 EVP_PKEY_free(mac_key
);
311 EVP_MD_CTX_cleanup(&ctx
);
313 explicit_bzero(A1
, sizeof(A1
));
314 explicit_bzero(hmac
, sizeof(hmac
));
320 tls1_PRF(SSL
*s
, const unsigned char *secret
, size_t secret_len
,
321 const void *seed1
, size_t seed1_len
, const void *seed2
, size_t seed2_len
,
322 const void *seed3
, size_t seed3_len
, const void *seed4
, size_t seed4_len
,
323 const void *seed5
, size_t seed5_len
, unsigned char *out
, size_t out_len
)
328 memset(out
, 0, out_len
);
330 if (!ssl_get_handshake_evp_md(s
, &md
))
333 if (md
->type
== NID_md5_sha1
) {
335 * Partition secret between MD5 and SHA1, then XOR result.
336 * If the secret length is odd, a one byte overlap is used.
338 half_len
= secret_len
- (secret_len
/ 2);
339 if (!tls1_P_hash(EVP_md5(), secret
, half_len
, seed1
, seed1_len
,
340 seed2
, seed2_len
, seed3
, seed3_len
, seed4
, seed4_len
,
341 seed5
, seed5_len
, out
, out_len
))
344 secret
+= secret_len
- half_len
;
345 if (!tls1_P_hash(EVP_sha1(), secret
, half_len
, seed1
, seed1_len
,
346 seed2
, seed2_len
, seed3
, seed3_len
, seed4
, seed4_len
,
347 seed5
, seed5_len
, out
, out_len
))
353 if (!tls1_P_hash(md
, secret
, secret_len
, seed1
, seed1_len
,
354 seed2
, seed2_len
, seed3
, seed3_len
, seed4
, seed4_len
,
355 seed5
, seed5_len
, out
, out_len
))
362 tls1_generate_key_block(SSL
*s
, unsigned char *km
, int num
)
368 s
->session
->master_key
, s
->session
->master_key_length
,
369 TLS_MD_KEY_EXPANSION_CONST
, TLS_MD_KEY_EXPANSION_CONST_SIZE
,
370 s
->s3
->server_random
, SSL3_RANDOM_SIZE
,
371 s
->s3
->client_random
, SSL3_RANDOM_SIZE
,
372 NULL
, 0, NULL
, 0, km
, num
);
376 * tls1_aead_ctx_init allocates aead_ctx, if needed. It returns 1 on success
380 tls1_aead_ctx_init(SSL_AEAD_CTX
**aead_ctx
)
382 if (*aead_ctx
!= NULL
) {
383 EVP_AEAD_CTX_cleanup(&(*aead_ctx
)->ctx
);
387 *aead_ctx
= malloc(sizeof(SSL_AEAD_CTX
));
388 if (*aead_ctx
== NULL
) {
389 SSLerrorx(ERR_R_MALLOC_FAILURE
);
397 tls1_change_cipher_state_aead(SSL
*s
, char is_read
, const unsigned char *key
,
398 unsigned key_len
, const unsigned char *iv
, unsigned iv_len
)
400 const EVP_AEAD
*aead
= S3I(s
)->tmp
.new_aead
;
401 SSL_AEAD_CTX
*aead_ctx
;
404 if (!tls1_aead_ctx_init(&s
->internal
->aead_read_ctx
))
406 aead_ctx
= s
->internal
->aead_read_ctx
;
408 if (!tls1_aead_ctx_init(&s
->internal
->aead_write_ctx
))
410 aead_ctx
= s
->internal
->aead_write_ctx
;
413 if (!EVP_AEAD_CTX_init(&aead_ctx
->ctx
, aead
, key
, key_len
,
414 EVP_AEAD_DEFAULT_TAG_LENGTH
, NULL
))
416 if (iv_len
> sizeof(aead_ctx
->fixed_nonce
)) {
417 SSLerrorx(ERR_R_INTERNAL_ERROR
);
420 memcpy(aead_ctx
->fixed_nonce
, iv
, iv_len
);
421 aead_ctx
->fixed_nonce_len
= iv_len
;
422 aead_ctx
->variable_nonce_len
= 8; /* always the case, currently. */
423 aead_ctx
->variable_nonce_in_record
=
424 (S3I(s
)->tmp
.new_cipher
->algorithm2
&
425 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD
) != 0;
426 aead_ctx
->xor_fixed_nonce
=
427 S3I(s
)->tmp
.new_cipher
->algorithm_enc
== SSL_CHACHA20POLY1305
;
428 aead_ctx
->tag_len
= EVP_AEAD_max_overhead(aead
);
430 if (aead_ctx
->xor_fixed_nonce
) {
431 if (aead_ctx
->fixed_nonce_len
!= EVP_AEAD_nonce_length(aead
) ||
432 aead_ctx
->variable_nonce_len
> EVP_AEAD_nonce_length(aead
)) {
433 SSLerrorx(ERR_R_INTERNAL_ERROR
);
437 if (aead_ctx
->variable_nonce_len
+ aead_ctx
->fixed_nonce_len
!=
438 EVP_AEAD_nonce_length(aead
)) {
439 SSLerrorx(ERR_R_INTERNAL_ERROR
);
448 * tls1_change_cipher_state_cipher performs the work needed to switch cipher
449 * states when using EVP_CIPHER. The argument is_read is true iff this function
450 * is being called due to reading, as opposed to writing, a ChangeCipherSpec
451 * message. In order to support export ciphersuites, use_client_keys indicates
452 * whether the key material provided is in the "client write" direction.
455 tls1_change_cipher_state_cipher(SSL
*s
, char is_read
, char use_client_keys
,
456 const unsigned char *mac_secret
, unsigned int mac_secret_size
,
457 const unsigned char *key
, unsigned int key_len
, const unsigned char *iv
,
460 EVP_CIPHER_CTX
*cipher_ctx
;
461 const EVP_CIPHER
*cipher
;
466 cipher
= S3I(s
)->tmp
.new_sym_enc
;
467 mac
= S3I(s
)->tmp
.new_hash
;
468 mac_type
= S3I(s
)->tmp
.new_mac_pkey_type
;
471 if (S3I(s
)->tmp
.new_cipher
->algorithm2
& TLS1_STREAM_MAC
)
472 s
->internal
->mac_flags
|= SSL_MAC_FLAG_READ_MAC_STREAM
;
474 s
->internal
->mac_flags
&= ~SSL_MAC_FLAG_READ_MAC_STREAM
;
476 EVP_CIPHER_CTX_free(s
->enc_read_ctx
);
477 s
->enc_read_ctx
= NULL
;
478 EVP_MD_CTX_destroy(s
->read_hash
);
481 if ((cipher_ctx
= EVP_CIPHER_CTX_new()) == NULL
)
483 s
->enc_read_ctx
= cipher_ctx
;
484 if ((mac_ctx
= EVP_MD_CTX_create()) == NULL
)
486 s
->read_hash
= mac_ctx
;
488 if (S3I(s
)->tmp
.new_cipher
->algorithm2
& TLS1_STREAM_MAC
)
489 s
->internal
->mac_flags
|= SSL_MAC_FLAG_WRITE_MAC_STREAM
;
491 s
->internal
->mac_flags
&= ~SSL_MAC_FLAG_WRITE_MAC_STREAM
;
494 * DTLS fragments retain a pointer to the compression, cipher
495 * and hash contexts, so that it can restore state in order
496 * to perform retransmissions. As such, we cannot free write
497 * contexts that are used for DTLS - these are instead freed
498 * by DTLS when its frees a ChangeCipherSpec fragment.
500 if (!SSL_IS_DTLS(s
)) {
501 EVP_CIPHER_CTX_free(s
->internal
->enc_write_ctx
);
502 s
->internal
->enc_write_ctx
= NULL
;
503 EVP_MD_CTX_destroy(s
->internal
->write_hash
);
504 s
->internal
->write_hash
= NULL
;
506 if ((cipher_ctx
= EVP_CIPHER_CTX_new()) == NULL
)
508 s
->internal
->enc_write_ctx
= cipher_ctx
;
509 if ((mac_ctx
= EVP_MD_CTX_create()) == NULL
)
511 s
->internal
->write_hash
= mac_ctx
;
514 if (EVP_CIPHER_mode(cipher
) == EVP_CIPH_GCM_MODE
) {
515 EVP_CipherInit_ex(cipher_ctx
, cipher
, NULL
, key
, NULL
,
517 EVP_CIPHER_CTX_ctrl(cipher_ctx
, EVP_CTRL_GCM_SET_IV_FIXED
,
518 iv_len
, (unsigned char *)iv
);
520 EVP_CipherInit_ex(cipher_ctx
, cipher
, NULL
, key
, iv
, !is_read
);
522 if (!(EVP_CIPHER_flags(cipher
) & EVP_CIPH_FLAG_AEAD_CIPHER
)) {
523 EVP_PKEY
*mac_key
= EVP_PKEY_new_mac_key(mac_type
, NULL
,
524 mac_secret
, mac_secret_size
);
527 EVP_DigestSignInit(mac_ctx
, NULL
, mac
, NULL
, mac_key
);
528 EVP_PKEY_free(mac_key
);
529 } else if (mac_secret_size
> 0) {
530 /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
531 EVP_CIPHER_CTX_ctrl(cipher_ctx
, EVP_CTRL_AEAD_SET_MAC_KEY
,
532 mac_secret_size
, (unsigned char *)mac_secret
);
535 if (S3I(s
)->tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT
) {
537 if (S3I(s
)->tmp
.new_cipher
->algorithm2
& SSL_HANDSHAKE_MAC_GOST94
)
538 nid
= NID_id_Gost28147_89_CryptoPro_A_ParamSet
;
540 nid
= NID_id_tc26_gost_28147_param_Z
;
542 EVP_CIPHER_CTX_ctrl(cipher_ctx
, EVP_CTRL_GOST_SET_SBOX
, nid
, 0);
543 if (S3I(s
)->tmp
.new_cipher
->algorithm_mac
== SSL_GOST89MAC
)
544 EVP_MD_CTX_ctrl(mac_ctx
, EVP_MD_CTRL_GOST_SET_SBOX
, nid
, 0);
550 SSLerrorx(ERR_R_MALLOC_FAILURE
);
555 tls1_change_cipher_state(SSL
*s
, int which
)
557 const unsigned char *client_write_mac_secret
, *server_write_mac_secret
;
558 const unsigned char *client_write_key
, *server_write_key
;
559 const unsigned char *client_write_iv
, *server_write_iv
;
560 const unsigned char *mac_secret
, *key
, *iv
;
561 int mac_secret_size
, key_len
, iv_len
;
562 unsigned char *key_block
, *seq
;
563 const EVP_CIPHER
*cipher
;
564 const EVP_AEAD
*aead
;
565 char is_read
, use_client_keys
;
568 cipher
= S3I(s
)->tmp
.new_sym_enc
;
569 aead
= S3I(s
)->tmp
.new_aead
;
572 * is_read is true if we have just read a ChangeCipherSpec message,
573 * that is we need to update the read cipherspec. Otherwise we have
576 is_read
= (which
& SSL3_CC_READ
) != 0;
579 * use_client_keys is true if we wish to use the keys for the "client
580 * write" direction. This is the case if we're a client sending a
581 * ChangeCipherSpec, or a server reading a client's ChangeCipherSpec.
583 use_client_keys
= ((which
== SSL3_CHANGE_CIPHER_CLIENT_WRITE
) ||
584 (which
== SSL3_CHANGE_CIPHER_SERVER_READ
));
588 * Reset sequence number to zero - for DTLS this is handled in
589 * dtls1_reset_seq_numbers().
591 if (!SSL_IS_DTLS(s
)) {
592 seq
= is_read
? S3I(s
)->read_sequence
: S3I(s
)->write_sequence
;
593 memset(seq
, 0, SSL3_SEQUENCE_SIZE
);
597 key_len
= EVP_AEAD_key_length(aead
);
598 iv_len
= SSL_CIPHER_AEAD_FIXED_NONCE_LEN(S3I(s
)->tmp
.new_cipher
);
600 key_len
= EVP_CIPHER_key_length(cipher
);
601 iv_len
= EVP_CIPHER_iv_length(cipher
);
603 /* If GCM mode only part of IV comes from PRF. */
604 if (EVP_CIPHER_mode(cipher
) == EVP_CIPH_GCM_MODE
)
605 iv_len
= EVP_GCM_TLS_FIXED_IV_LEN
;
608 mac_secret_size
= s
->s3
->tmp
.new_mac_secret_size
;
610 key_block
= S3I(s
)->tmp
.key_block
;
611 client_write_mac_secret
= key_block
;
612 key_block
+= mac_secret_size
;
613 server_write_mac_secret
= key_block
;
614 key_block
+= mac_secret_size
;
615 client_write_key
= key_block
;
616 key_block
+= key_len
;
617 server_write_key
= key_block
;
618 key_block
+= key_len
;
619 client_write_iv
= key_block
;
621 server_write_iv
= key_block
;
624 if (use_client_keys
) {
625 mac_secret
= client_write_mac_secret
;
626 key
= client_write_key
;
627 iv
= client_write_iv
;
629 mac_secret
= server_write_mac_secret
;
630 key
= server_write_key
;
631 iv
= server_write_iv
;
634 if (key_block
- S3I(s
)->tmp
.key_block
!= S3I(s
)->tmp
.key_block_length
) {
635 SSLerror(s
, ERR_R_INTERNAL_ERROR
);
640 memcpy(S3I(s
)->read_mac_secret
, mac_secret
, mac_secret_size
);
641 S3I(s
)->read_mac_secret_size
= mac_secret_size
;
643 memcpy(S3I(s
)->write_mac_secret
, mac_secret
, mac_secret_size
);
644 S3I(s
)->write_mac_secret_size
= mac_secret_size
;
648 return tls1_change_cipher_state_aead(s
, is_read
, key
, key_len
,
652 return tls1_change_cipher_state_cipher(s
, is_read
, use_client_keys
,
653 mac_secret
, mac_secret_size
, key
, key_len
, iv
, iv_len
);
660 tls1_setup_key_block(SSL
*s
)
662 unsigned char *key_block
;
663 int mac_type
= NID_undef
, mac_secret_size
= 0;
664 int key_block_len
, key_len
, iv_len
;
665 const EVP_CIPHER
*cipher
= NULL
;
666 const EVP_AEAD
*aead
= NULL
;
667 const EVP_MD
*mac
= NULL
;
670 if (S3I(s
)->tmp
.key_block_length
!= 0)
673 if (s
->session
->cipher
&&
674 (s
->session
->cipher
->algorithm2
& SSL_CIPHER_ALGORITHM2_AEAD
)) {
675 if (!ssl_cipher_get_evp_aead(s
->session
, &aead
)) {
676 SSLerror(s
, SSL_R_CIPHER_OR_HASH_UNAVAILABLE
);
679 key_len
= EVP_AEAD_key_length(aead
);
680 iv_len
= SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s
->session
->cipher
);
682 if (!ssl_cipher_get_evp(s
->session
, &cipher
, &mac
, &mac_type
,
684 SSLerror(s
, SSL_R_CIPHER_OR_HASH_UNAVAILABLE
);
687 key_len
= EVP_CIPHER_key_length(cipher
);
688 iv_len
= EVP_CIPHER_iv_length(cipher
);
690 /* If GCM mode only part of IV comes from PRF. */
691 if (EVP_CIPHER_mode(cipher
) == EVP_CIPH_GCM_MODE
)
692 iv_len
= EVP_GCM_TLS_FIXED_IV_LEN
;
695 S3I(s
)->tmp
.new_aead
= aead
;
696 S3I(s
)->tmp
.new_sym_enc
= cipher
;
697 S3I(s
)->tmp
.new_hash
= mac
;
698 S3I(s
)->tmp
.new_mac_pkey_type
= mac_type
;
699 s
->s3
->tmp
.new_mac_secret_size
= mac_secret_size
;
701 tls1_cleanup_key_block(s
);
703 if ((key_block
= reallocarray(NULL
, mac_secret_size
+ key_len
+ iv_len
,
705 SSLerror(s
, ERR_R_MALLOC_FAILURE
);
708 key_block_len
= (mac_secret_size
+ key_len
+ iv_len
) * 2;
710 S3I(s
)->tmp
.key_block_length
= key_block_len
;
711 S3I(s
)->tmp
.key_block
= key_block
;
713 if (!tls1_generate_key_block(s
, key_block
, key_block_len
))
716 if (!(s
->internal
->options
& SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
) &&
717 s
->method
->internal
->version
<= TLS1_VERSION
) {
719 * Enable vulnerability countermeasure for CBC ciphers with
720 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
722 S3I(s
)->need_empty_fragments
= 1;
724 if (s
->session
->cipher
!= NULL
) {
725 if (s
->session
->cipher
->algorithm_enc
== SSL_eNULL
)
726 S3I(s
)->need_empty_fragments
= 0;
728 #ifndef OPENSSL_NO_RC4
729 if (s
->session
->cipher
->algorithm_enc
== SSL_RC4
)
730 S3I(s
)->need_empty_fragments
= 0;
741 /* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
744 * 0: (in non-constant time) if the record is publically invalid (i.e. too
746 * 1: if the record's padding is valid / the encryption was successful.
747 * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
748 * an internal error occured.
751 tls1_enc(SSL
*s
, int send
)
753 const SSL_AEAD_CTX
*aead
;
754 const EVP_CIPHER
*enc
;
759 int bs
, i
, j
, k
, pad
= 0, ret
, mac_size
= 0;
762 aead
= s
->internal
->aead_write_ctx
;
764 seq
= S3I(s
)->write_sequence
;
766 aead
= s
->internal
->aead_read_ctx
;
768 seq
= S3I(s
)->read_sequence
;
772 unsigned char ad
[13], *in
, *out
, nonce
[16];
773 size_t out_len
, pad_len
= 0;
774 unsigned int nonce_used
;
776 if (SSL_IS_DTLS(s
)) {
777 dtls1_build_sequence_number(ad
, seq
,
778 send
? D1I(s
)->w_epoch
: D1I(s
)->r_epoch
);
780 memcpy(ad
, seq
, SSL3_SEQUENCE_SIZE
);
781 tls1_record_sequence_increment(seq
);
785 ad
[9] = (unsigned char)(s
->version
>> 8);
786 ad
[10] = (unsigned char)(s
->version
);
788 if (aead
->variable_nonce_len
> 8 ||
789 aead
->variable_nonce_len
> sizeof(nonce
))
792 if (aead
->xor_fixed_nonce
) {
793 if (aead
->fixed_nonce_len
> sizeof(nonce
) ||
794 aead
->variable_nonce_len
> aead
->fixed_nonce_len
)
795 return -1; /* Should never happen. */
796 pad_len
= aead
->fixed_nonce_len
- aead
->variable_nonce_len
;
798 if (aead
->fixed_nonce_len
+
799 aead
->variable_nonce_len
> sizeof(nonce
))
800 return -1; /* Should never happen. */
804 size_t len
= rec
->length
;
809 if (aead
->xor_fixed_nonce
) {
811 * The sequence number is left zero
812 * padded, then xored with the fixed
815 memset(nonce
, 0, pad_len
);
816 memcpy(nonce
+ pad_len
, ad
,
817 aead
->variable_nonce_len
);
818 for (i
= 0; i
< aead
->fixed_nonce_len
; i
++)
819 nonce
[i
] ^= aead
->fixed_nonce
[i
];
820 nonce_used
= aead
->fixed_nonce_len
;
823 * When sending we use the sequence number as
824 * the variable part of the nonce.
826 memcpy(nonce
, aead
->fixed_nonce
,
827 aead
->fixed_nonce_len
);
828 nonce_used
= aead
->fixed_nonce_len
;
829 memcpy(nonce
+ nonce_used
, ad
,
830 aead
->variable_nonce_len
);
831 nonce_used
+= aead
->variable_nonce_len
;
835 * In do_ssl3_write, rec->input is moved forward by
836 * variable_nonce_len in order to leave space for the
837 * variable nonce. Thus we can copy the sequence number
838 * bytes into place without overwriting any of the
841 if (aead
->variable_nonce_in_record
) {
842 memcpy(out
, ad
, aead
->variable_nonce_len
);
843 len
-= aead
->variable_nonce_len
;
844 eivlen
= aead
->variable_nonce_len
;
850 if (!EVP_AEAD_CTX_seal(&aead
->ctx
,
851 out
+ eivlen
, &out_len
, len
+ aead
->tag_len
, nonce
,
852 nonce_used
, in
+ eivlen
, len
, ad
, sizeof(ad
)))
854 if (aead
->variable_nonce_in_record
)
855 out_len
+= aead
->variable_nonce_len
;
858 size_t len
= rec
->length
;
860 if (rec
->data
!= rec
->input
)
861 return -1; /* internal error - should never happen. */
862 out
= in
= rec
->input
;
864 if (len
< aead
->variable_nonce_len
)
867 if (aead
->xor_fixed_nonce
) {
869 * The sequence number is left zero
870 * padded, then xored with the fixed
873 memset(nonce
, 0, pad_len
);
874 memcpy(nonce
+ pad_len
, ad
,
875 aead
->variable_nonce_len
);
876 for (i
= 0; i
< aead
->fixed_nonce_len
; i
++)
877 nonce
[i
] ^= aead
->fixed_nonce
[i
];
878 nonce_used
= aead
->fixed_nonce_len
;
880 memcpy(nonce
, aead
->fixed_nonce
,
881 aead
->fixed_nonce_len
);
882 nonce_used
= aead
->fixed_nonce_len
;
884 memcpy(nonce
+ nonce_used
,
885 aead
->variable_nonce_in_record
? in
: ad
,
886 aead
->variable_nonce_len
);
887 nonce_used
+= aead
->variable_nonce_len
;
890 if (aead
->variable_nonce_in_record
) {
891 in
+= aead
->variable_nonce_len
;
892 len
-= aead
->variable_nonce_len
;
893 out
+= aead
->variable_nonce_len
;
896 if (len
< aead
->tag_len
)
898 len
-= aead
->tag_len
;
903 if (!EVP_AEAD_CTX_open(&aead
->ctx
, out
, &out_len
, len
,
904 nonce
, nonce_used
, in
, len
+ aead
->tag_len
, ad
,
908 rec
->data
= rec
->input
= out
;
911 rec
->length
= out_len
;
917 if (EVP_MD_CTX_md(s
->internal
->write_hash
)) {
918 int n
= EVP_MD_CTX_size(s
->internal
->write_hash
);
919 OPENSSL_assert(n
>= 0);
921 ds
= s
->internal
->enc_write_ctx
;
922 if (s
->internal
->enc_write_ctx
== NULL
)
926 enc
= EVP_CIPHER_CTX_cipher(s
->internal
->enc_write_ctx
);
927 if (SSL_USE_EXPLICIT_IV(s
) &&
928 EVP_CIPHER_mode(enc
) == EVP_CIPH_CBC_MODE
)
929 ivlen
= EVP_CIPHER_iv_length(enc
);
931 if (rec
->data
!= rec
->input
) {
933 /* we can't write into the input stream:
934 * Can this ever happen?? (steve)
937 "%s:%d: rec->data != rec->input\n",
941 arc4random_buf(rec
->input
, ivlen
);
945 if (EVP_MD_CTX_md(s
->read_hash
)) {
946 int n
= EVP_MD_CTX_size(s
->read_hash
);
947 OPENSSL_assert(n
>= 0);
949 ds
= s
->enc_read_ctx
;
950 if (s
->enc_read_ctx
== NULL
)
953 enc
= EVP_CIPHER_CTX_cipher(s
->enc_read_ctx
);
956 if ((s
->session
== NULL
) || (ds
== NULL
) || (enc
== NULL
)) {
957 memmove(rec
->data
, rec
->input
, rec
->length
);
958 rec
->input
= rec
->data
;
962 bs
= EVP_CIPHER_block_size(ds
->cipher
);
964 if (EVP_CIPHER_flags(ds
->cipher
) & EVP_CIPH_FLAG_AEAD_CIPHER
) {
965 unsigned char buf
[13];
967 if (SSL_IS_DTLS(s
)) {
968 dtls1_build_sequence_number(buf
, seq
,
969 send
? D1I(s
)->w_epoch
: D1I(s
)->r_epoch
);
971 memcpy(buf
, seq
, SSL3_SEQUENCE_SIZE
);
972 tls1_record_sequence_increment(seq
);
976 buf
[9] = (unsigned char)(s
->version
>> 8);
977 buf
[10] = (unsigned char)(s
->version
);
978 buf
[11] = rec
->length
>> 8;
979 buf
[12] = rec
->length
& 0xff;
980 pad
= EVP_CIPHER_CTX_ctrl(ds
, EVP_CTRL_AEAD_TLS1_AAD
, 13, buf
);
985 } else if ((bs
!= 1) && send
) {
986 i
= bs
- ((int)l
% bs
);
988 /* Add weird padding of upto 256 bytes */
990 /* we need to add 'i' padding bytes of value j */
992 for (k
= (int)l
; k
< (int)(l
+ i
); k
++)
999 if (l
== 0 || l
% bs
!= 0)
1003 i
= EVP_Cipher(ds
, rec
->data
, rec
->input
, l
);
1004 if ((EVP_CIPHER_flags(ds
->cipher
) &
1005 EVP_CIPH_FLAG_CUSTOM_CIPHER
) ? (i
< 0) : (i
== 0))
1006 return -1; /* AEAD can fail to verify MAC */
1007 if (EVP_CIPHER_mode(enc
) == EVP_CIPH_GCM_MODE
&& !send
) {
1008 rec
->data
+= EVP_GCM_TLS_EXPLICIT_IV_LEN
;
1009 rec
->input
+= EVP_GCM_TLS_EXPLICIT_IV_LEN
;
1010 rec
->length
-= EVP_GCM_TLS_EXPLICIT_IV_LEN
;
1014 if (EVP_MD_CTX_md(s
->read_hash
) != NULL
)
1015 mac_size
= EVP_MD_CTX_size(s
->read_hash
);
1016 if ((bs
!= 1) && !send
)
1017 ret
= tls1_cbc_remove_padding(s
, rec
, bs
, mac_size
);
1025 tls1_final_finish_mac(SSL
*s
, const char *str
, int str_len
, unsigned char *out
)
1027 unsigned char buf
[EVP_MAX_MD_SIZE
];
1033 if (!tls1_handshake_hash_value(s
, buf
, sizeof(buf
), &hash_len
))
1036 if (!tls1_PRF(s
, s
->session
->master_key
, s
->session
->master_key_length
,
1037 str
, str_len
, buf
, hash_len
, NULL
, 0, NULL
, 0, NULL
, 0,
1038 out
, TLS1_FINISH_MAC_LENGTH
))
1041 return TLS1_FINISH_MAC_LENGTH
;
1045 tls1_mac(SSL
*ssl
, unsigned char *md
, int send
)
1050 size_t md_size
, orig_len
;
1051 EVP_MD_CTX hmac
, *mac_ctx
;
1052 unsigned char header
[13];
1053 int stream_mac
= (send
?
1054 (ssl
->internal
->mac_flags
& SSL_MAC_FLAG_WRITE_MAC_STREAM
) :
1055 (ssl
->internal
->mac_flags
& SSL_MAC_FLAG_READ_MAC_STREAM
));
1059 rec
= &(ssl
->s3
->internal
->wrec
);
1060 seq
= &(ssl
->s3
->internal
->write_sequence
[0]);
1061 hash
= ssl
->internal
->write_hash
;
1063 rec
= &(ssl
->s3
->internal
->rrec
);
1064 seq
= &(ssl
->s3
->internal
->read_sequence
[0]);
1065 hash
= ssl
->read_hash
;
1068 t
= EVP_MD_CTX_size(hash
);
1069 OPENSSL_assert(t
>= 0);
1072 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
1076 if (!EVP_MD_CTX_copy(&hmac
, hash
))
1081 if (SSL_IS_DTLS(ssl
))
1082 dtls1_build_sequence_number(header
, seq
,
1083 send
? D1I(ssl
)->w_epoch
: D1I(ssl
)->r_epoch
);
1085 memcpy(header
, seq
, SSL3_SEQUENCE_SIZE
);
1087 /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
1088 orig_len
= rec
->length
+ md_size
+ ((unsigned int)rec
->type
>> 8);
1091 header
[8] = rec
->type
;
1092 header
[9] = (unsigned char)(ssl
->version
>> 8);
1093 header
[10] = (unsigned char)(ssl
->version
);
1094 header
[11] = (rec
->length
) >> 8;
1095 header
[12] = (rec
->length
) & 0xff;
1098 EVP_CIPHER_CTX_mode(ssl
->enc_read_ctx
) == EVP_CIPH_CBC_MODE
&&
1099 ssl3_cbc_record_digest_supported(mac_ctx
)) {
1100 /* This is a CBC-encrypted record. We must avoid leaking any
1101 * timing-side channel information about how many blocks of
1102 * data we are hashing because that gives an attacker a
1104 if (!ssl3_cbc_digest_record(mac_ctx
,
1105 md
, &md_size
, header
, rec
->input
,
1106 rec
->length
+ md_size
, orig_len
,
1107 ssl
->s3
->internal
->read_mac_secret
,
1108 ssl
->s3
->internal
->read_mac_secret_size
))
1111 EVP_DigestSignUpdate(mac_ctx
, header
, sizeof(header
));
1112 EVP_DigestSignUpdate(mac_ctx
, rec
->input
, rec
->length
);
1113 t
= EVP_DigestSignFinal(mac_ctx
, md
, &md_size
);
1114 OPENSSL_assert(t
> 0);
1118 EVP_MD_CTX_cleanup(&hmac
);
1120 if (!SSL_IS_DTLS(ssl
))
1121 tls1_record_sequence_increment(seq
);
1127 tls1_generate_master_secret(SSL
*s
, unsigned char *out
, unsigned char *p
,
1133 if (!tls1_PRF(s
, p
, len
,
1134 TLS_MD_MASTER_SECRET_CONST
, TLS_MD_MASTER_SECRET_CONST_SIZE
,
1135 s
->s3
->client_random
, SSL3_RANDOM_SIZE
, NULL
, 0,
1136 s
->s3
->server_random
, SSL3_RANDOM_SIZE
, NULL
, 0,
1137 s
->session
->master_key
, SSL_MAX_MASTER_KEY_LENGTH
))
1140 return (SSL_MAX_MASTER_KEY_LENGTH
);
1144 tls1_export_keying_material(SSL
*s
, unsigned char *out
, size_t olen
,
1145 const char *label
, size_t llen
, const unsigned char *context
,
1146 size_t contextlen
, int use_context
)
1148 unsigned char *val
= NULL
;
1149 size_t vallen
, currentvalpos
;
1152 /* construct PRF arguments
1153 * we construct the PRF argument ourself rather than passing separate
1154 * values into the TLS PRF to ensure that the concatenation of values
1155 * does not create a prohibited label.
1157 vallen
= llen
+ SSL3_RANDOM_SIZE
* 2;
1159 vallen
+= 2 + contextlen
;
1162 val
= malloc(vallen
);
1166 memcpy(val
+ currentvalpos
, (unsigned char *) label
, llen
);
1167 currentvalpos
+= llen
;
1168 memcpy(val
+ currentvalpos
, s
->s3
->client_random
, SSL3_RANDOM_SIZE
);
1169 currentvalpos
+= SSL3_RANDOM_SIZE
;
1170 memcpy(val
+ currentvalpos
, s
->s3
->server_random
, SSL3_RANDOM_SIZE
);
1171 currentvalpos
+= SSL3_RANDOM_SIZE
;
1174 val
[currentvalpos
] = (contextlen
>> 8) & 0xff;
1176 val
[currentvalpos
] = contextlen
& 0xff;
1178 if ((contextlen
> 0) || (context
!= NULL
)) {
1179 memcpy(val
+ currentvalpos
, context
, contextlen
);
1183 /* disallow prohibited labels
1184 * note that SSL3_RANDOM_SIZE > max(prohibited label len) =
1185 * 15, so size of val > max(prohibited label len) = 15 and the
1186 * comparisons won't have buffer overflow
1188 if (memcmp(val
, TLS_MD_CLIENT_FINISH_CONST
,
1189 TLS_MD_CLIENT_FINISH_CONST_SIZE
) == 0)
1191 if (memcmp(val
, TLS_MD_SERVER_FINISH_CONST
,
1192 TLS_MD_SERVER_FINISH_CONST_SIZE
) == 0)
1194 if (memcmp(val
, TLS_MD_MASTER_SECRET_CONST
,
1195 TLS_MD_MASTER_SECRET_CONST_SIZE
) == 0)
1197 if (memcmp(val
, TLS_MD_KEY_EXPANSION_CONST
,
1198 TLS_MD_KEY_EXPANSION_CONST_SIZE
) == 0)
1201 rv
= tls1_PRF(s
, s
->session
->master_key
, s
->session
->master_key_length
,
1202 val
, vallen
, NULL
, 0, NULL
, 0, NULL
, 0, NULL
, 0, out
, olen
);
1206 SSLerror(s
, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL
);
1210 SSLerror(s
, ERR_R_MALLOC_FAILURE
);
1219 tls1_alert_code(int code
)
1222 case SSL_AD_CLOSE_NOTIFY
:
1223 return (SSL3_AD_CLOSE_NOTIFY
);
1224 case SSL_AD_UNEXPECTED_MESSAGE
:
1225 return (SSL3_AD_UNEXPECTED_MESSAGE
);
1226 case SSL_AD_BAD_RECORD_MAC
:
1227 return (SSL3_AD_BAD_RECORD_MAC
);
1228 case SSL_AD_DECRYPTION_FAILED
:
1229 return (TLS1_AD_DECRYPTION_FAILED
);
1230 case SSL_AD_RECORD_OVERFLOW
:
1231 return (TLS1_AD_RECORD_OVERFLOW
);
1232 case SSL_AD_DECOMPRESSION_FAILURE
:
1233 return (SSL3_AD_DECOMPRESSION_FAILURE
);
1234 case SSL_AD_HANDSHAKE_FAILURE
:
1235 return (SSL3_AD_HANDSHAKE_FAILURE
);
1236 case SSL_AD_NO_CERTIFICATE
:
1238 case SSL_AD_BAD_CERTIFICATE
:
1239 return (SSL3_AD_BAD_CERTIFICATE
);
1240 case SSL_AD_UNSUPPORTED_CERTIFICATE
:
1241 return (SSL3_AD_UNSUPPORTED_CERTIFICATE
);
1242 case SSL_AD_CERTIFICATE_REVOKED
:
1243 return (SSL3_AD_CERTIFICATE_REVOKED
);
1244 case SSL_AD_CERTIFICATE_EXPIRED
:
1245 return (SSL3_AD_CERTIFICATE_EXPIRED
);
1246 case SSL_AD_CERTIFICATE_UNKNOWN
:
1247 return (SSL3_AD_CERTIFICATE_UNKNOWN
);
1248 case SSL_AD_ILLEGAL_PARAMETER
:
1249 return (SSL3_AD_ILLEGAL_PARAMETER
);
1250 case SSL_AD_UNKNOWN_CA
:
1251 return (TLS1_AD_UNKNOWN_CA
);
1252 case SSL_AD_ACCESS_DENIED
:
1253 return (TLS1_AD_ACCESS_DENIED
);
1254 case SSL_AD_DECODE_ERROR
:
1255 return (TLS1_AD_DECODE_ERROR
);
1256 case SSL_AD_DECRYPT_ERROR
:
1257 return (TLS1_AD_DECRYPT_ERROR
);
1258 case SSL_AD_EXPORT_RESTRICTION
:
1259 return (TLS1_AD_EXPORT_RESTRICTION
);
1260 case SSL_AD_PROTOCOL_VERSION
:
1261 return (TLS1_AD_PROTOCOL_VERSION
);
1262 case SSL_AD_INSUFFICIENT_SECURITY
:
1263 return (TLS1_AD_INSUFFICIENT_SECURITY
);
1264 case SSL_AD_INTERNAL_ERROR
:
1265 return (TLS1_AD_INTERNAL_ERROR
);
1266 case SSL_AD_INAPPROPRIATE_FALLBACK
:
1267 return(TLS1_AD_INAPPROPRIATE_FALLBACK
);
1268 case SSL_AD_USER_CANCELLED
:
1269 return (TLS1_AD_USER_CANCELLED
);
1270 case SSL_AD_NO_RENEGOTIATION
:
1271 return (TLS1_AD_NO_RENEGOTIATION
);
1272 case SSL_AD_UNSUPPORTED_EXTENSION
:
1273 return (TLS1_AD_UNSUPPORTED_EXTENSION
);
1274 case SSL_AD_CERTIFICATE_UNOBTAINABLE
:
1275 return (TLS1_AD_CERTIFICATE_UNOBTAINABLE
);
1276 case SSL_AD_UNRECOGNIZED_NAME
:
1277 return (TLS1_AD_UNRECOGNIZED_NAME
);
1278 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE
:
1279 return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
);
1280 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE
:
1281 return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
);
1282 case SSL_AD_UNKNOWN_PSK_IDENTITY
:
1283 return (TLS1_AD_UNKNOWN_PSK_IDENTITY
);