Context Navigation

source: trunk/third/openssl/ssl/s2_srvr.c @ 18446

Visit:

Revision 18446, 31.7 KB checked in by zacheiss, 21 years ago (diff)
Merge with openssl 0.9.7

Line
1	/* ssl/s2_srvr.c */
2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3	* All rights reserved.
4	*
5	* This package is an SSL implementation written
6	* by Eric Young (eay@cryptsoft.com).
7	* The implementation was written so as to conform with Netscapes SSL.
8	*
9	* This library is free for commercial and non-commercial use as long as
10	* the following conditions are aheared to. The following conditions
11	* apply to all code found in this distribution, be it the RC4, RSA,
12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
13	* included with this distribution is covered by the same copyright terms
14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
15	*
16	* Copyright remains Eric Young's, and as such any Copyright notices in
17	* the code are not to be removed.
18	* If this package is used in a product, Eric Young should be given attribution
19	* as the author of the parts of the library used.
20	* This can be in the form of a textual message at program startup or
21	* in documentation (online or textual) provided with the package.
22	*
23	* Redistribution and use in source and binary forms, with or without
24	* modification, are permitted provided that the following conditions
25	* are met:
26	* 1. Redistributions of source code must retain the copyright
27	* notice, this list of conditions and the following disclaimer.
28	* 2. Redistributions in binary form must reproduce the above copyright
29	* notice, this list of conditions and the following disclaimer in the
30	* documentation and/or other materials provided with the distribution.
31	* 3. All advertising materials mentioning features or use of this software
32	* must display the following acknowledgement:
33	* "This product includes cryptographic software written by
34	* Eric Young (eay@cryptsoft.com)"
35	* The word 'cryptographic' can be left out if the rouines from the library
36	* being used are not cryptographic related :-).
37	* 4. If you include any Windows specific code (or a derivative thereof) from
38	* the apps directory (application code) you must include an acknowledgement:
39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40	*
41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51	* SUCH DAMAGE.
52	*
53	* The licence and distribution terms for any publically available version or
54	* derivative of this code cannot be changed. i.e. this code cannot simply be
55	* copied and put under another distribution licence
56	* [including the GNU Public Licence.]
57	*/
58	/* ====================================================================
59	* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
60	*
61	* Redistribution and use in source and binary forms, with or without
62	* modification, are permitted provided that the following conditions
63	* are met:
64	*
65	* 1. Redistributions of source code must retain the above copyright
66	* notice, this list of conditions and the following disclaimer.
67	*
68	* 2. Redistributions in binary form must reproduce the above copyright
69	* notice, this list of conditions and the following disclaimer in
70	* the documentation and/or other materials provided with the
71	* distribution.
72	*
73	* 3. All advertising materials mentioning features or use of this
74	* software must display the following acknowledgment:
75	* "This product includes software developed by the OpenSSL Project
76	* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77	*
78	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79	* endorse or promote products derived from this software without
80	* prior written permission. For written permission, please contact
81	* openssl-core@openssl.org.
82	*
83	* 5. Products derived from this software may not be called "OpenSSL"
84	* nor may "OpenSSL" appear in their names without prior written
85	* permission of the OpenSSL Project.
86	*
87	* 6. Redistributions of any form whatsoever must retain the following
88	* acknowledgment:
89	* "This product includes software developed by the OpenSSL Project
90	* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91	*
92	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103	* OF THE POSSIBILITY OF SUCH DAMAGE.
104	* ====================================================================
105	*
106	* This product includes cryptographic software written by Eric Young
107	* (eay@cryptsoft.com). This product includes software written by Tim
108	* Hudson (tjh@cryptsoft.com).
109	*
110	*/
111
112	#include "ssl_locl.h"
113	#ifndef OPENSSL_NO_SSL2
114	#include <stdio.h>
115	#include <openssl/bio.h>
116	#include <openssl/rand.h>
117	#include <openssl/objects.h>
118	#include <openssl/evp.h>
119	#include "cryptlib.h"
120
121	static SSL_METHOD *ssl2_get_server_method(int ver);
122	static int get_client_master_key(SSL *s);
123	static int get_client_hello(SSL *s);
124	static int server_hello(SSL *s);
125	static int get_client_finished(SSL *s);
126	static int server_verify(SSL *s);
127	static int server_finish(SSL *s);
128	static int request_certificate(SSL *s);
129	static int ssl_rsa_private_decrypt(CERT c, int len, unsigned char from,
130	unsigned char *to,int padding);
131	#define BREAK break
132
133	static SSL_METHOD *ssl2_get_server_method(int ver)
134	{
135	if (ver == SSL2_VERSION)
136	return(SSLv2_server_method());
137	else
138	return(NULL);
139	}
140
141	SSL_METHOD *SSLv2_server_method(void)
142	{
143	static int init=1;
144	static SSL_METHOD SSLv2_server_data;
145
146	if (init)
147	{
148	CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
149
150	if (init)
151	{
152	memcpy((char )&SSLv2_server_data,(char )sslv2_base_method(),
153	sizeof(SSL_METHOD));
154	SSLv2_server_data.ssl_accept=ssl2_accept;
155	SSLv2_server_data.get_ssl_method=ssl2_get_server_method;
156	init=0;
157	}
158
159	CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
160	}
161	return(&SSLv2_server_data);
162	}
163
164	int ssl2_accept(SSL *s)
165	{
166	unsigned long l=time(NULL);
167	BUF_MEM *buf=NULL;
168	int ret= -1;
169	long num1;
170	void (cb)(const SSL ssl,int type,int val)=NULL;
171	int new_state,state;
172
173	RAND_add(&l,sizeof(l),0);
174	ERR_clear_error();
175	clear_sys_error();
176
177	if (s->info_callback != NULL)
178	cb=s->info_callback;
179	else if (s->ctx->info_callback != NULL)
180	cb=s->ctx->info_callback;
181
182	/* init things to blank */
183	s->in_handshake++;
184	if (!SSL_in_init(s) \|\| SSL_in_before(s)) SSL_clear(s);
185
186	if (s->cert == NULL)
187	{
188	SSLerr(SSL_F_SSL2_ACCEPT,SSL_R_NO_CERTIFICATE_SET);
189	return(-1);
190	}
191
192	clear_sys_error();
193	for (;;)
194	{
195	state=s->state;
196
197	switch (s->state)
198	{
199	case SSL_ST_BEFORE:
200	case SSL_ST_ACCEPT:
201	case SSL_ST_BEFORE\|SSL_ST_ACCEPT:
202	case SSL_ST_OK\|SSL_ST_ACCEPT:
203
204	s->server=1;
205	if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
206
207	s->version=SSL2_VERSION;
208	s->type=SSL_ST_ACCEPT;
209
210	buf=s->init_buf;
211	if ((buf == NULL) && ((buf=BUF_MEM_new()) == NULL))
212	{ ret= -1; goto end; }
213	if (!BUF_MEM_grow(buf,(int)
214	SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))
215	{ ret= -1; goto end; }
216	s->init_buf=buf;
217	s->init_num=0;
218	s->ctx->stats.sess_accept++;
219	s->handshake_func=ssl2_accept;
220	s->state=SSL2_ST_GET_CLIENT_HELLO_A;
221	BREAK;
222
223	case SSL2_ST_GET_CLIENT_HELLO_A:
224	case SSL2_ST_GET_CLIENT_HELLO_B:
225	case SSL2_ST_GET_CLIENT_HELLO_C:
226	s->shutdown=0;
227	ret=get_client_hello(s);
228	if (ret <= 0) goto end;
229	s->init_num=0;
230	s->state=SSL2_ST_SEND_SERVER_HELLO_A;
231	BREAK;
232
233	case SSL2_ST_SEND_SERVER_HELLO_A:
234	case SSL2_ST_SEND_SERVER_HELLO_B:
235	ret=server_hello(s);
236	if (ret <= 0) goto end;
237	s->init_num=0;
238	if (!s->hit)
239	{
240	s->state=SSL2_ST_GET_CLIENT_MASTER_KEY_A;
241	BREAK;
242	}
243	else
244	{
245	s->state=SSL2_ST_SERVER_START_ENCRYPTION;
246	BREAK;
247	}
248	case SSL2_ST_GET_CLIENT_MASTER_KEY_A:
249	case SSL2_ST_GET_CLIENT_MASTER_KEY_B:
250	ret=get_client_master_key(s);
251	if (ret <= 0) goto end;
252	s->init_num=0;
253	s->state=SSL2_ST_SERVER_START_ENCRYPTION;
254	BREAK;
255
256	case SSL2_ST_SERVER_START_ENCRYPTION:
257	/* Ok we how have sent all the stuff needed to
258	* start encrypting, the next packet back will
259	* be encrypted. */
260	if (!ssl2_enc_init(s,0))
261	{ ret= -1; goto end; }
262	s->s2->clear_text=0;
263	s->state=SSL2_ST_SEND_SERVER_VERIFY_A;
264	BREAK;
265
266	case SSL2_ST_SEND_SERVER_VERIFY_A:
267	case SSL2_ST_SEND_SERVER_VERIFY_B:
268	ret=server_verify(s);
269	if (ret <= 0) goto end;
270	s->init_num=0;
271	if (s->hit)
272	{
273	/* If we are in here, we have been
274	* buffering the output, so we need to
275	* flush it and remove buffering from
276	* future traffic */
277	s->state=SSL2_ST_SEND_SERVER_VERIFY_C;
278	BREAK;
279	}
280	else
281	{
282	s->state=SSL2_ST_GET_CLIENT_FINISHED_A;
283	break;
284	}
285
286	case SSL2_ST_SEND_SERVER_VERIFY_C:
287	/* get the number of bytes to write */
288	num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
289	if (num1 != 0)
290	{
291	s->rwstate=SSL_WRITING;
292	num1=BIO_flush(s->wbio);
293	if (num1 <= 0) { ret= -1; goto end; }
294	s->rwstate=SSL_NOTHING;
295	}
296
297	/* flushed and now remove buffering */
298	s->wbio=BIO_pop(s->wbio);
299
300	s->state=SSL2_ST_GET_CLIENT_FINISHED_A;
301	BREAK;
302
303	case SSL2_ST_GET_CLIENT_FINISHED_A:
304	case SSL2_ST_GET_CLIENT_FINISHED_B:
305	ret=get_client_finished(s);
306	if (ret <= 0)
307	goto end;
308	s->init_num=0;
309	s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_A;
310	BREAK;
311
312	case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:
313	case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:
314	case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:
315	case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:
316	/* don't do a 'request certificate' if we
317	* don't want to, or we already have one, and
318	* we only want to do it once. */
319	if (!(s->verify_mode & SSL_VERIFY_PEER) \|\|
320	((s->session->peer != NULL) &&
321	(s->verify_mode & SSL_VERIFY_CLIENT_ONCE)))
322	{
323	s->state=SSL2_ST_SEND_SERVER_FINISHED_A;
324	break;
325	}
326	else
327	{
328	ret=request_certificate(s);
329	if (ret <= 0) goto end;
330	s->init_num=0;
331	s->state=SSL2_ST_SEND_SERVER_FINISHED_A;
332	}
333	BREAK;
334
335	case SSL2_ST_SEND_SERVER_FINISHED_A:
336	case SSL2_ST_SEND_SERVER_FINISHED_B:
337	ret=server_finish(s);
338	if (ret <= 0) goto end;
339	s->init_num=0;
340	s->state=SSL_ST_OK;
341	break;
342
343	case SSL_ST_OK:
344	BUF_MEM_free(s->init_buf);
345	ssl_free_wbio_buffer(s);
346	s->init_buf=NULL;
347	s->init_num=0;
348	/* ERR_clear_error();*/
349
350	ssl_update_cache(s,SSL_SESS_CACHE_SERVER);
351
352	s->ctx->stats.sess_accept_good++;
353	/* s->server=1; */
354	ret=1;
355
356	if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
357
358	goto end;
359	/* BREAK; */
360
361	default:
362	SSLerr(SSL_F_SSL2_ACCEPT,SSL_R_UNKNOWN_STATE);
363	ret= -1;
364	goto end;
365	/* BREAK; */
366	}
367
368	if ((cb != NULL) && (s->state != state))
369	{
370	new_state=s->state;
371	s->state=state;
372	cb(s,SSL_CB_ACCEPT_LOOP,1);
373	s->state=new_state;
374	}
375	}
376	end:
377	s->in_handshake--;
378	if (cb != NULL)
379	cb(s,SSL_CB_ACCEPT_EXIT,ret);
380	return(ret);
381	}
382
383	static int get_client_master_key(SSL *s)
384	{
385	int is_export,i,n,keya,ek;
386	unsigned long len;
387	unsigned char *p;
388	SSL_CIPHER *cp;
389	const EVP_CIPHER *c;
390	const EVP_MD *md;
391
392	p=(unsigned char *)s->init_buf->data;
393	if (s->state == SSL2_ST_GET_CLIENT_MASTER_KEY_A)
394	{
395	i=ssl2_read(s,(char *)&(p[s->init_num]),10-s->init_num);
396
397	if (i < (10-s->init_num))
398	return(ssl2_part_read(s,SSL_F_GET_CLIENT_MASTER_KEY,i));
399	s->init_num = 10;
400
401	if (*(p++) != SSL2_MT_CLIENT_MASTER_KEY)
402	{
403	if (p[-1] != SSL2_MT_ERROR)
404	{
405	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
406	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_READ_WRONG_PACKET_TYPE);
407	}
408	else
409	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_PEER_ERROR);
410	return(-1);
411	}
412
413	cp=ssl2_get_cipher_by_char(p);
414	if (cp == NULL)
415	{
416	ssl2_return_error(s,SSL2_PE_NO_CIPHER);
417	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_CIPHER_MATCH);
418	return(-1);
419	}
420	s->session->cipher= cp;
421
422	p+=3;
423	n2s(p,i); s->s2->tmp.clear=i;
424	n2s(p,i); s->s2->tmp.enc=i;
425	n2s(p,i); s->session->key_arg_length=i;
426	if(s->session->key_arg_length > SSL_MAX_KEY_ARG_LENGTH)
427	{
428	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
429	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_KEY_ARG_TOO_LONG);
430	return -1;
431	}
432	s->state=SSL2_ST_GET_CLIENT_MASTER_KEY_B;
433	}
434
435	/* SSL2_ST_GET_CLIENT_MASTER_KEY_B */
436	p=(unsigned char *)s->init_buf->data;
437	if (s->init_buf->length < SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
438	{
439	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
440	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
441	return -1;
442	}
443	keya=s->session->key_arg_length;
444	len = 10 + (unsigned long)s->s2->tmp.clear + (unsigned long)s->s2->tmp.enc + (unsigned long)keya;
445	if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
446	{
447	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
448	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_MESSAGE_TOO_LONG);
449	return -1;
450	}
451	n = (int)len - s->init_num;
452	i = ssl2_read(s,(char *)&(p[s->init_num]),n);
453	if (i != n) return(ssl2_part_read(s,SSL_F_GET_CLIENT_MASTER_KEY,i));
454	if (s->msg_callback)
455	s->msg_callback(0, s->version, 0, p, (size_t)len, s, s->msg_callback_arg); /* CLIENT-MASTER-KEY */
456	p += 10;
457
458	memcpy(s->session->key_arg,&(p[s->s2->tmp.clear+s->s2->tmp.enc]),
459	(unsigned int)keya);
460
461	if (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL)
462	{
463	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
464	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_NO_PRIVATEKEY);
465	return(-1);
466	}
467	i=ssl_rsa_private_decrypt(s->cert,s->s2->tmp.enc,
468	&(p[s->s2->tmp.clear]),&(p[s->s2->tmp.clear]),
469	(s->s2->ssl2_rollback)?RSA_SSLV23_PADDING:RSA_PKCS1_PADDING);
470
471	is_export=SSL_C_IS_EXPORT(s->session->cipher);
472
473	if (!ssl_cipher_get_evp(s->session,&c,&md,NULL))
474	{
475	ssl2_return_error(s,SSL2_PE_NO_CIPHER);
476	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);
477	return(0);
478	}
479
480	if (s->session->cipher->algorithm2 & SSL2_CF_8_BYTE_ENC)
481	{
482	is_export=1;
483	ek=8;
484	}
485	else
486	ek=5;
487
488	/* bad decrypt */
489	#if 1
490	/* If a bad decrypt, continue with protocol but with a
491	* random master secret (Bleichenbacher attack) */
492	if ((i < 0) \|\|
493	((!is_export && (i != EVP_CIPHER_key_length(c)))
494	\|\| (is_export && ((i != ek) \|\| (s->s2->tmp.clear+(unsigned int)i !=
495	(unsigned int)EVP_CIPHER_key_length(c))))))
496	{
497	ERR_clear_error();
498	if (is_export)
499	i=ek;
500	else
501	i=EVP_CIPHER_key_length(c);
502	RAND_pseudo_bytes(p,i);
503	}
504	#else
505	if (i < 0)
506	{
507	error=1;
508	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_BAD_RSA_DECRYPT);
509	}
510	/* incorrect number of key bytes for non export cipher */
511	else if ((!is_export && (i != EVP_CIPHER_key_length(c)))
512	\|\| (is_export && ((i != ek) \|\| (s->s2->tmp.clear+i !=
513	EVP_CIPHER_key_length(c)))))
514	{
515	error=1;
516	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_WRONG_NUMBER_OF_KEY_BITS);
517	}
518	if (error)
519	{
520	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
521	return(-1);
522	}
523	#endif
524
525	if (is_export) i+=s->s2->tmp.clear;
526
527	if (i > SSL_MAX_MASTER_KEY_LENGTH)
528	{
529	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
530	SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
531	return -1;
532	}
533	s->session->master_key_length=i;
534	memcpy(s->session->master_key,p,(unsigned int)i);
535	return(1);
536	}
537
538	static int get_client_hello(SSL *s)
539	{
540	int i,n;
541	unsigned long len;
542	unsigned char *p;
543	STACK_OF(SSL_CIPHER) cs; / a stack of SSL_CIPHERS */
544	STACK_OF(SSL_CIPHER) cl; / the ones we want to use */
545	STACK_OF(SSL_CIPHER) prio, allow;
546	int z;
547
548	/* This is a bit of a hack to check for the correct packet
549	* type the first time round. */
550	if (s->state == SSL2_ST_GET_CLIENT_HELLO_A)
551	{
552	s->first_packet=1;
553	s->state=SSL2_ST_GET_CLIENT_HELLO_B;
554	}
555
556	p=(unsigned char *)s->init_buf->data;
557	if (s->state == SSL2_ST_GET_CLIENT_HELLO_B)
558	{
559	i=ssl2_read(s,(char *)&(p[s->init_num]),9-s->init_num);
560	if (i < (9-s->init_num))
561	return(ssl2_part_read(s,SSL_F_GET_CLIENT_HELLO,i));
562	s->init_num = 9;
563
564	if (*(p++) != SSL2_MT_CLIENT_HELLO)
565	{
566	if (p[-1] != SSL2_MT_ERROR)
567	{
568	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
569	SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_READ_WRONG_PACKET_TYPE);
570	}
571	else
572	SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_PEER_ERROR);
573	return(-1);
574	}
575	n2s(p,i);
576	if (i < s->version) s->version=i;
577	n2s(p,i); s->s2->tmp.cipher_spec_length=i;
578	n2s(p,i); s->s2->tmp.session_id_length=i;
579	n2s(p,i); s->s2->challenge_length=i;
580	if ( (i < SSL2_MIN_CHALLENGE_LENGTH) \|\|
581	(i > SSL2_MAX_CHALLENGE_LENGTH))
582	{
583	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
584	SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_INVALID_CHALLENGE_LENGTH);
585	return(-1);
586	}
587	s->state=SSL2_ST_GET_CLIENT_HELLO_C;
588	}
589
590	/* SSL2_ST_GET_CLIENT_HELLO_C */
591	p=(unsigned char *)s->init_buf->data;
592	len = 9 + (unsigned long)s->s2->tmp.cipher_spec_length + (unsigned long)s->s2->challenge_length + (unsigned long)s->s2->tmp.session_id_length;
593	if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
594	{
595	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
596	SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_MESSAGE_TOO_LONG);
597	return -1;
598	}
599	n = (int)len - s->init_num;
600	i = ssl2_read(s,(char *)&(p[s->init_num]),n);
601	if (i != n) return(ssl2_part_read(s,SSL_F_GET_CLIENT_HELLO,i));
602	if (s->msg_callback)
603	s->msg_callback(0, s->version, 0, p, (size_t)len, s, s->msg_callback_arg); /* CLIENT-HELLO */
604	p += 9;
605
606	/* get session-id before cipher stuff so we can get out session
607	* structure if it is cached */
608	/* session-id */
609	if ((s->s2->tmp.session_id_length != 0) &&
610	(s->s2->tmp.session_id_length != SSL2_SSL_SESSION_ID_LENGTH))
611	{
612	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
613	SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_BAD_SSL_SESSION_ID_LENGTH);
614	return(-1);
615	}
616
617	if (s->s2->tmp.session_id_length == 0)
618	{
619	if (!ssl_get_new_session(s,1))
620	{
621	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
622	return(-1);
623	}
624	}
625	else
626	{
627	i=ssl_get_prev_session(s,&(p[s->s2->tmp.cipher_spec_length]),
628	s->s2->tmp.session_id_length);
629	if (i == 1)
630	{ /* previous session */
631	s->hit=1;
632	}
633	else if (i == -1)
634	{
635	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
636	return(-1);
637	}
638	else
639	{
640	if (s->cert == NULL)
641	{
642	ssl2_return_error(s,SSL2_PE_NO_CERTIFICATE);
643	SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_NO_CERTIFICATE_SET);
644	return(-1);
645	}
646
647	if (!ssl_get_new_session(s,1))
648	{
649	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
650	return(-1);
651	}
652	}
653	}
654
655	if (!s->hit)
656	{
657	cs=ssl_bytes_to_cipher_list(s,p,s->s2->tmp.cipher_spec_length,
658	&s->session->ciphers);
659	if (cs == NULL) goto mem_err;
660
661	cl=SSL_get_ciphers(s);
662
663	if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
664	{
665	prio=sk_SSL_CIPHER_dup(cl);
666	if (prio == NULL) goto mem_err;
667	allow = cs;
668	}
669	else
670	{
671	prio = cs;
672	allow = cl;
673	}
674	for (z=0; z<sk_SSL_CIPHER_num(prio); z++)
675	{
676	if (sk_SSL_CIPHER_find(allow,sk_SSL_CIPHER_value(prio,z)) < 0)
677	{
678	sk_SSL_CIPHER_delete(prio,z);
679	z--;
680	}
681	}
682	if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
683	{
684	sk_SSL_CIPHER_free(s->session->ciphers);
685	s->session->ciphers = prio;
686	}
687	/* s->session->ciphers should now have a list of
688	* ciphers that are on both the client and server.
689	* This list is ordered by the order the client sent
690	* the ciphers or in the order of the server's preference
691	* if SSL_OP_CIPHER_SERVER_PREFERENCE was set.
692	*/
693	}
694	p+=s->s2->tmp.cipher_spec_length;
695	/* done cipher selection */
696
697	/* session id extracted already */
698	p+=s->s2->tmp.session_id_length;
699
700	/* challenge */
701	if (s->s2->challenge_length > sizeof s->s2->challenge)
702	{
703	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
704	SSLerr(SSL_F_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
705	return -1;
706	}
707	memcpy(s->s2->challenge,p,(unsigned int)s->s2->challenge_length);
708	return(1);
709	mem_err:
710	SSLerr(SSL_F_GET_CLIENT_HELLO,ERR_R_MALLOC_FAILURE);
711	return(0);
712	}
713
714	static int server_hello(SSL *s)
715	{
716	unsigned char p,d;
717	int n,hit;
718	STACK_OF(SSL_CIPHER) *sk;
719
720	p=(unsigned char *)s->init_buf->data;
721	if (s->state == SSL2_ST_SEND_SERVER_HELLO_A)
722	{
723	d=p+11;
724	(p++)=SSL2_MT_SERVER_HELLO; / type */
725	hit=s->hit;
726	*(p++)=(unsigned char)hit;
727	#if 1
728	if (!hit)
729	{
730	if (s->session->sess_cert != NULL)
731	/* This can't really happen because get_client_hello
732	* has called ssl_get_new_session, which does not set
733	* sess_cert. */
734	ssl_sess_cert_free(s->session->sess_cert);
735	s->session->sess_cert = ssl_sess_cert_new();
736	if (s->session->sess_cert == NULL)
737	{
738	SSLerr(SSL_F_SERVER_HELLO, ERR_R_MALLOC_FAILURE);
739	return(-1);
740	}
741	}
742	/* If 'hit' is set, then s->sess_cert may be non-NULL or NULL,
743	* depending on whether it survived in the internal cache
744	* or was retrieved from an external cache.
745	* If it is NULL, we cannot put any useful data in it anyway,
746	* so we don't touch it.
747	*/
748
749	#else /* That's what used to be done when cert_st and sess_cert_st were
750	* the same. */
751	if (!hit)
752	{ /* else add cert to session */
753	CRYPTO_add(&s->cert->references,1,CRYPTO_LOCK_SSL_CERT);
754	if (s->session->sess_cert != NULL)
755	ssl_cert_free(s->session->sess_cert);
756	s->session->sess_cert=s->cert;
757	}
758	else /* We have a session id-cache hit, if the
759	* session-id has no certificate listed against
760	* the 'cert' structure, grab the 'old' one
761	* listed against the SSL connection */
762	{
763	if (s->session->sess_cert == NULL)
764	{
765	CRYPTO_add(&s->cert->references,1,
766	CRYPTO_LOCK_SSL_CERT);
767	s->session->sess_cert=s->cert;
768	}
769	}
770	#endif
771
772	if (s->cert == NULL)
773	{
774	ssl2_return_error(s,SSL2_PE_NO_CERTIFICATE);
775	SSLerr(SSL_F_SERVER_HELLO,SSL_R_NO_CERTIFICATE_SPECIFIED);
776	return(-1);
777	}
778
779	if (hit)
780	{
781	(p++)=0; / no certificate type */
782	s2n(s->version,p); /* version */
783	s2n(0,p); /* cert len */
784	s2n(0,p); /* ciphers len */
785	}
786	else
787	{
788	/* EAY EAY */
789	/* put certificate type */
790	*(p++)=SSL2_CT_X509_CERTIFICATE;
791	s2n(s->version,p); /* version */
792	n=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
793	s2n(n,p); /* certificate length */
794	i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&d);
795	n=0;
796
797	/* lets send out the ciphers we like in the
798	* prefered order */
799	sk= s->session->ciphers;
800	n=ssl_cipher_list_to_bytes(s,s->session->ciphers,d);
801	d+=n;
802	s2n(n,p); /* add cipher length */
803	}
804
805	/* make and send conn_id */
806	s2n(SSL2_CONNECTION_ID_LENGTH,p); /* add conn_id length */
807	s->s2->conn_id_length=SSL2_CONNECTION_ID_LENGTH;
808	RAND_pseudo_bytes(s->s2->conn_id,(int)s->s2->conn_id_length);
809	memcpy(d,s->s2->conn_id,SSL2_CONNECTION_ID_LENGTH);
810	d+=SSL2_CONNECTION_ID_LENGTH;
811
812	s->state=SSL2_ST_SEND_SERVER_HELLO_B;
813	s->init_num=d-(unsigned char *)s->init_buf->data;
814	s->init_off=0;
815	}
816	/* SSL2_ST_SEND_SERVER_HELLO_B */
817	/* If we are using TCP/IP, the performance is bad if we do 2
818	* writes without a read between them. This occurs when
819	* Session-id reuse is used, so I will put in a buffering module
820	*/
821	if (s->hit)
822	{
823	if (!ssl_init_wbio_buffer(s,1)) return(-1);
824	}
825
826	return(ssl2_do_write(s));
827	}
828
829	static int get_client_finished(SSL *s)
830	{
831	unsigned char *p;
832	int i, n;
833	unsigned long len;
834
835	p=(unsigned char *)s->init_buf->data;
836	if (s->state == SSL2_ST_GET_CLIENT_FINISHED_A)
837	{
838	i=ssl2_read(s,(char *)&(p[s->init_num]),1-s->init_num);
839	if (i < 1-s->init_num)
840	return(ssl2_part_read(s,SSL_F_GET_CLIENT_FINISHED,i));
841	s->init_num += i;
842
843	if (*p != SSL2_MT_CLIENT_FINISHED)
844	{
845	if (*p != SSL2_MT_ERROR)
846	{
847	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
848	SSLerr(SSL_F_GET_CLIENT_FINISHED,SSL_R_READ_WRONG_PACKET_TYPE);
849	}
850	else
851	{
852	SSLerr(SSL_F_GET_CLIENT_FINISHED,SSL_R_PEER_ERROR);
853	/* try to read the error message */
854	i=ssl2_read(s,(char *)&(p[s->init_num]),3-s->init_num);
855	return ssl2_part_read(s,SSL_F_GET_SERVER_VERIFY,i);
856	}
857	return(-1);
858	}
859	s->state=SSL2_ST_GET_CLIENT_FINISHED_B;
860	}
861
862	/* SSL2_ST_GET_CLIENT_FINISHED_B */
863	if (s->s2->conn_id_length > sizeof s->s2->conn_id)
864	{
865	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
866	SSLerr(SSL_F_GET_CLIENT_FINISHED, ERR_R_INTERNAL_ERROR);
867	return -1;
868	}
869	len = 1 + (unsigned long)s->s2->conn_id_length;
870	n = (int)len - s->init_num;
871	i = ssl2_read(s,(char *)&(p[s->init_num]),n);
872	if (i < n)
873	{
874	return(ssl2_part_read(s,SSL_F_GET_CLIENT_FINISHED,i));
875	}
876	if (s->msg_callback)
877	s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* CLIENT-FINISHED */
878	p += 1;
879	if (memcmp(p,s->s2->conn_id,s->s2->conn_id_length) != 0)
880	{
881	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
882	SSLerr(SSL_F_GET_CLIENT_FINISHED,SSL_R_CONNECTION_ID_IS_DIFFERENT);
883	return(-1);
884	}
885	return(1);
886	}
887
888	static int server_verify(SSL *s)
889	{
890	unsigned char *p;
891
892	if (s->state == SSL2_ST_SEND_SERVER_VERIFY_A)
893	{
894	p=(unsigned char *)s->init_buf->data;
895	*(p++)=SSL2_MT_SERVER_VERIFY;
896	if (s->s2->challenge_length > sizeof s->s2->challenge)
897	{
898	SSLerr(SSL_F_SERVER_VERIFY, ERR_R_INTERNAL_ERROR);
899	return -1;
900	}
901	memcpy(p,s->s2->challenge,(unsigned int)s->s2->challenge_length);
902	/* p+=s->s2->challenge_length; */
903
904	s->state=SSL2_ST_SEND_SERVER_VERIFY_B;
905	s->init_num=s->s2->challenge_length+1;
906	s->init_off=0;
907	}
908	return(ssl2_do_write(s));
909	}
910
911	static int server_finish(SSL *s)
912	{
913	unsigned char *p;
914
915	if (s->state == SSL2_ST_SEND_SERVER_FINISHED_A)
916	{
917	p=(unsigned char *)s->init_buf->data;
918	*(p++)=SSL2_MT_SERVER_FINISHED;
919
920	if (s->session->session_id_length > sizeof s->session->session_id)
921	{
922	SSLerr(SSL_F_SERVER_FINISH, ERR_R_INTERNAL_ERROR);
923	return -1;
924	}
925	memcpy(p,s->session->session_id, (unsigned int)s->session->session_id_length);
926	/* p+=s->session->session_id_length; */
927
928	s->state=SSL2_ST_SEND_SERVER_FINISHED_B;
929	s->init_num=s->session->session_id_length+1;
930	s->init_off=0;
931	}
932
933	/* SSL2_ST_SEND_SERVER_FINISHED_B */
934	return(ssl2_do_write(s));
935	}
936
937	/* send the request and check the response */
938	static int request_certificate(SSL *s)
939	{
940	unsigned char p,p2,*buf2;
941	unsigned char *ccd;
942	int i,j,ctype,ret= -1;
943	unsigned long len;
944	X509 *x509=NULL;
945	STACK_OF(X509) *sk=NULL;
946
947	ccd=s->s2->tmp.ccl;
948	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)
949	{
950	p=(unsigned char *)s->init_buf->data;
951	*(p++)=SSL2_MT_REQUEST_CERTIFICATE;
952	*(p++)=SSL2_AT_MD5_WITH_RSA_ENCRYPTION;
953	RAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
954	memcpy(p,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
955
956	s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_B;
957	s->init_num=SSL2_MIN_CERT_CHALLENGE_LENGTH+2;
958	s->init_off=0;
959	}
960
961	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B)
962	{
963	i=ssl2_do_write(s);
964	if (i <= 0)
965	{
966	ret=i;
967	goto end;
968	}
969
970	s->init_num=0;
971	s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_C;
972	}
973
974	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)
975	{
976	p=(unsigned char *)s->init_buf->data;
977	i=ssl2_read(s,(char )&(p[s->init_num]),6-s->init_num); / try to read 6 octets ... */
978	if (i < 3-s->init_num) /* ... but don't call ssl2_part_read now if we got at least 3
979	* (probably NO-CERTIFICATE-ERROR) */
980	{
981	ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);
982	goto end;
983	}
984	s->init_num += i;
985
986	if ((s->init_num >= 3) && (p[0] == SSL2_MT_ERROR))
987	{
988	n2s(p,i);
989	if (i != SSL2_PE_NO_CERTIFICATE)
990	{
991	/* not the error message we expected -- let ssl2_part_read handle it */
992	s->init_num -= 3;
993	ret = ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE, 3);
994	goto end;
995	}
996
997	if (s->msg_callback)
998	s->msg_callback(0, s->version, 0, p, 3, s, s->msg_callback_arg); /* ERROR */
999
1000	/* this is the one place where we can recover from an SSL 2.0 error */
1001
1002	if (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
1003	{
1004	ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);
1005	SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
1006	goto end;
1007	}
1008	ret=1;
1009	goto end;
1010	}
1011	if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) \|\| (s->init_num < 6))
1012	{
1013	ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
1014	SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_SHORT_READ);
1015	goto end;
1016	}
1017	if (s->init_num != 6)
1018	{
1019	SSLerr(SSL_F_REQUEST_CERTIFICATE, ERR_R_INTERNAL_ERROR);
1020	goto end;
1021	}
1022
1023	/* ok we have a response */
1024	/* certificate type, there is only one right now. */
1025	ctype= *(p++);
1026	if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)
1027	{
1028	ssl2_return_error(s,SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);
1029	SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_RESPONSE_ARGUMENT);
1030	goto end;
1031	}
1032	n2s(p,i); s->s2->tmp.clen=i;
1033	n2s(p,i); s->s2->tmp.rlen=i;
1034	s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
1035	}
1036
1037	/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
1038	p=(unsigned char *)s->init_buf->data;
1039	len = 6 + (unsigned long)s->s2->tmp.clen + (unsigned long)s->s2->tmp.rlen;
1040	if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
1041	{
1042	SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_MESSAGE_TOO_LONG);
1043	goto end;
1044	}
1045	j = (int)len - s->init_num;
1046	i = ssl2_read(s,(char *)&(p[s->init_num]),j);
1047	if (i < j)
1048	{
1049	ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);
1050	goto end;
1051	}
1052	if (s->msg_callback)
1053	s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* CLIENT-CERTIFICATE */
1054	p += 6;
1055
1056	x509=(X509 *)d2i_X509(NULL,&p,(long)s->s2->tmp.clen);
1057	if (x509 == NULL)
1058	{
1059	SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_X509_LIB);
1060	goto msg_end;
1061	}
1062
1063	if (((sk=sk_X509_new_null()) == NULL) \|\| (!sk_X509_push(sk,x509)))
1064	{
1065	SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);
1066	goto msg_end;
1067	}
1068
1069	i=ssl_verify_cert_chain(s,sk);
1070
1071	if (i) /* we like the packet, now check the chksum */
1072	{
1073	EVP_MD_CTX ctx;
1074	EVP_PKEY *pkey=NULL;
1075
1076	EVP_MD_CTX_init(&ctx);
1077	EVP_VerifyInit_ex(&ctx,s->ctx->rsa_md5, NULL);
1078	EVP_VerifyUpdate(&ctx,s->s2->key_material,
1079	s->s2->key_material_length);
1080	EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
1081
1082	i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
1083	buf2=OPENSSL_malloc((unsigned int)i);
1084	if (buf2 == NULL)
1085	{
1086	SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);
1087	goto msg_end;
1088	}
1089	p2=buf2;
1090	i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
1091	EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);
1092	OPENSSL_free(buf2);
1093
1094	pkey=X509_get_pubkey(x509);
1095	if (pkey == NULL) goto end;
1096	i=EVP_VerifyFinal(&ctx,p,s->s2->tmp.rlen,pkey);
1097	EVP_PKEY_free(pkey);
1098	EVP_MD_CTX_cleanup(&ctx);
1099
1100	if (i)
1101	{
1102	if (s->session->peer != NULL)
1103	X509_free(s->session->peer);
1104	s->session->peer=x509;
1105	CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);
1106	s->session->verify_result = s->verify_result;
1107	ret=1;
1108	goto end;
1109	}
1110	else
1111	{
1112	SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_CHECKSUM);
1113	goto msg_end;
1114	}
1115	}
1116	else
1117	{
1118	msg_end:
1119	ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);
1120	}
1121	end:
1122	sk_X509_free(sk);
1123	X509_free(x509);
1124	return(ret);
1125	}
1126
1127	static int ssl_rsa_private_decrypt(CERT c, int len, unsigned char from,
1128	unsigned char *to, int padding)
1129	{
1130	RSA *rsa;
1131	int i;
1132
1133	if ((c == NULL) \|\| (c->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL))
1134	{
1135	SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT,SSL_R_NO_PRIVATEKEY);
1136	return(-1);
1137	}
1138	if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey->type != EVP_PKEY_RSA)
1139	{
1140	SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT,SSL_R_PUBLIC_KEY_IS_NOT_RSA);
1141	return(-1);
1142	}
1143	rsa=c->pkeys[SSL_PKEY_RSA_ENC].privatekey->pkey.rsa;
1144
1145	/* we have the public key */
1146	i=RSA_private_decrypt(len,from,to,rsa,padding);
1147	if (i < 0)
1148	SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT,ERR_R_RSA_LIB);
1149	return(i);
1150	}
1151	#else /* !OPENSSL_NO_SSL2 */
1152
1153	# if PEDANTIC
1154	static void *dummy=&dummy;
1155	# endif
1156
1157	#endif

Note: See TracBrowser for help on using the repository browser.

Download in other formats: