|
1 /* ssl/s3_enc.c */ |
|
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
|
3 * All rights reserved. |
|
4 * |
|
5 * This package is an SSL implementation written |
|
6 * by Eric Young (eay@cryptsoft.com). |
|
7 * The implementation was written so as to conform with Netscapes SSL. |
|
8 * |
|
9 * This library is free for commercial and non-commercial use as long as |
|
10 * the following conditions are aheared to. The following conditions |
|
11 * apply to all code found in this distribution, be it the RC4, RSA, |
|
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
|
13 * included with this distribution is covered by the same copyright terms |
|
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
|
15 * |
|
16 * Copyright remains Eric Young's, and as such any Copyright notices in |
|
17 * the code are not to be removed. |
|
18 * If this package is used in a product, Eric Young should be given attribution |
|
19 * as the author of the parts of the library used. |
|
20 * This can be in the form of a textual message at program startup or |
|
21 * in documentation (online or textual) provided with the package. |
|
22 * |
|
23 * Redistribution and use in source and binary forms, with or without |
|
24 * modification, are permitted provided that the following conditions |
|
25 * are met: |
|
26 * 1. Redistributions of source code must retain the copyright |
|
27 * notice, this list of conditions and the following disclaimer. |
|
28 * 2. Redistributions in binary form must reproduce the above copyright |
|
29 * notice, this list of conditions and the following disclaimer in the |
|
30 * documentation and/or other materials provided with the distribution. |
|
31 * 3. All advertising materials mentioning features or use of this software |
|
32 * must display the following acknowledgement: |
|
33 * "This product includes cryptographic software written by |
|
34 * Eric Young (eay@cryptsoft.com)" |
|
35 * The word 'cryptographic' can be left out if the rouines from the library |
|
36 * being used are not cryptographic related :-). |
|
37 * 4. If you include any Windows specific code (or a derivative thereof) from |
|
38 * the apps directory (application code) you must include an acknowledgement: |
|
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
|
40 * |
|
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
|
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
|
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
|
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
|
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
|
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
|
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
|
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
|
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
|
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
|
51 * SUCH DAMAGE. |
|
52 * |
|
53 * The licence and distribution terms for any publically available version or |
|
54 * derivative of this code cannot be changed. i.e. this code cannot simply be |
|
55 * copied and put under another distribution licence |
|
56 * [including the GNU Public Licence.] |
|
57 */ |
|
58 /* ==================================================================== |
|
59 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. |
|
60 * |
|
61 * Redistribution and use in source and binary forms, with or without |
|
62 * modification, are permitted provided that the following conditions |
|
63 * are met: |
|
64 * |
|
65 * 1. Redistributions of source code must retain the above copyright |
|
66 * notice, this list of conditions and the following disclaimer. |
|
67 * |
|
68 * 2. Redistributions in binary form must reproduce the above copyright |
|
69 * notice, this list of conditions and the following disclaimer in |
|
70 * the documentation and/or other materials provided with the |
|
71 * distribution. |
|
72 * |
|
73 * 3. All advertising materials mentioning features or use of this |
|
74 * software must display the following acknowledgment: |
|
75 * "This product includes software developed by the OpenSSL Project |
|
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
|
77 * |
|
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
|
79 * endorse or promote products derived from this software without |
|
80 * prior written permission. For written permission, please contact |
|
81 * openssl-core@openssl.org. |
|
82 * |
|
83 * 5. Products derived from this software may not be called "OpenSSL" |
|
84 * nor may "OpenSSL" appear in their names without prior written |
|
85 * permission of the OpenSSL Project. |
|
86 * |
|
87 * 6. Redistributions of any form whatsoever must retain the following |
|
88 * acknowledgment: |
|
89 * "This product includes software developed by the OpenSSL Project |
|
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
|
91 * |
|
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
|
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
|
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
|
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
|
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
|
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
|
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
|
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
|
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
|
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
|
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
|
103 * OF THE POSSIBILITY OF SUCH DAMAGE. |
|
104 * ==================================================================== |
|
105 * |
|
106 * This product includes cryptographic software written by Eric Young |
|
107 * (eay@cryptsoft.com). This product includes software written by Tim |
|
108 * Hudson (tjh@cryptsoft.com). |
|
109 * |
|
110 */ |
|
111 /* |
|
112 © Portions copyright (c) 2006 Nokia Corporation. All rights reserved. |
|
113 */ |
|
114 |
|
115 #include <stdio.h> |
|
116 #include "ssl_locl.h" |
|
117 #include <openssl/evp.h> |
|
118 #include <openssl/md5.h> |
|
119 |
|
120 #ifndef EMULATOR |
|
121 static unsigned char ssl3_pad_1[48]={ |
|
122 #else |
|
123 static const unsigned char ssl3_pad_1[48]={ |
|
124 #endif |
|
125 0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36, |
|
126 0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36, |
|
127 0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36, |
|
128 0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36, |
|
129 0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36, |
|
130 0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36 }; |
|
131 |
|
132 #ifndef EMULATOR |
|
133 static unsigned char ssl3_pad_2[48]={ |
|
134 #else |
|
135 static const unsigned char ssl3_pad_2[48]={ |
|
136 #endif |
|
137 0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c, |
|
138 0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c, |
|
139 0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c, |
|
140 0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c, |
|
141 0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c, |
|
142 0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c }; |
|
143 |
|
144 static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx, |
|
145 const char *sender, int len, unsigned char *p); |
|
146 |
|
147 static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num) |
|
148 { |
|
149 EVP_MD_CTX m5; |
|
150 EVP_MD_CTX s1; |
|
151 unsigned char buf[16],smd[SHA_DIGEST_LENGTH]; |
|
152 unsigned char c='A'; |
|
153 unsigned int i,j,k; |
|
154 |
|
155 #ifdef CHARSET_EBCDIC |
|
156 c = os_toascii[c]; /*'A' in ASCII */ |
|
157 #endif |
|
158 k=0; |
|
159 EVP_MD_CTX_init(&m5); |
|
160 EVP_MD_CTX_init(&s1); |
|
161 for (i=0; (int)i<num; i+=MD5_DIGEST_LENGTH) |
|
162 { |
|
163 k++; |
|
164 if (k > sizeof buf) |
|
165 { |
|
166 /* bug: 'buf' is too small for this ciphersuite */ |
|
167 SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR); |
|
168 return 0; |
|
169 } |
|
170 |
|
171 for (j=0; j<k; j++) |
|
172 buf[j]=c; |
|
173 c++; |
|
174 EVP_DigestInit_ex(&s1,EVP_sha1(), NULL); |
|
175 EVP_DigestUpdate(&s1,buf,k); |
|
176 EVP_DigestUpdate(&s1,s->session->master_key, |
|
177 s->session->master_key_length); |
|
178 EVP_DigestUpdate(&s1,s->s3->server_random,SSL3_RANDOM_SIZE); |
|
179 EVP_DigestUpdate(&s1,s->s3->client_random,SSL3_RANDOM_SIZE); |
|
180 EVP_DigestFinal_ex(&s1,smd,NULL); |
|
181 |
|
182 EVP_DigestInit_ex(&m5,EVP_md5(), NULL); |
|
183 EVP_DigestUpdate(&m5,s->session->master_key, |
|
184 s->session->master_key_length); |
|
185 EVP_DigestUpdate(&m5,smd,SHA_DIGEST_LENGTH); |
|
186 if ((int)(i+MD5_DIGEST_LENGTH) > num) |
|
187 { |
|
188 EVP_DigestFinal_ex(&m5,smd,NULL); |
|
189 memcpy(km,smd,(num-i)); |
|
190 } |
|
191 else |
|
192 EVP_DigestFinal_ex(&m5,km,NULL); |
|
193 |
|
194 km+=MD5_DIGEST_LENGTH; |
|
195 } |
|
196 OPENSSL_cleanse(smd,SHA_DIGEST_LENGTH); |
|
197 EVP_MD_CTX_cleanup(&m5); |
|
198 EVP_MD_CTX_cleanup(&s1); |
|
199 return 1; |
|
200 } |
|
201 |
|
202 int ssl3_change_cipher_state(SSL *s, int which) |
|
203 { |
|
204 unsigned char *p,*key_block,*mac_secret; |
|
205 unsigned char exp_key[EVP_MAX_KEY_LENGTH]; |
|
206 unsigned char exp_iv[EVP_MAX_IV_LENGTH]; |
|
207 unsigned char *ms,*key,*iv,*er1,*er2; |
|
208 EVP_CIPHER_CTX *dd; |
|
209 const EVP_CIPHER *c; |
|
210 #ifndef OPENSSL_NO_COMP |
|
211 COMP_METHOD *comp; |
|
212 #endif |
|
213 const EVP_MD *m; |
|
214 EVP_MD_CTX md; |
|
215 int is_exp,n,i,j,k,cl; |
|
216 int reuse_dd = 0; |
|
217 |
|
218 is_exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); |
|
219 c=s->s3->tmp.new_sym_enc; |
|
220 m=s->s3->tmp.new_hash; |
|
221 #ifndef OPENSSL_NO_COMP |
|
222 if (s->s3->tmp.new_compression == NULL) |
|
223 comp=NULL; |
|
224 else |
|
225 comp=s->s3->tmp.new_compression->method; |
|
226 #endif |
|
227 key_block=s->s3->tmp.key_block; |
|
228 |
|
229 if (which & SSL3_CC_READ) |
|
230 { |
|
231 if (s->enc_read_ctx != NULL) |
|
232 reuse_dd = 1; |
|
233 else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) |
|
234 goto err; |
|
235 else |
|
236 /* make sure it's intialized in case we exit later with an error */ |
|
237 EVP_CIPHER_CTX_init(s->enc_read_ctx); |
|
238 dd= s->enc_read_ctx; |
|
239 s->read_hash=m; |
|
240 #ifndef OPENSSL_NO_COMP |
|
241 /* COMPRESS */ |
|
242 if (s->expand != NULL) |
|
243 { |
|
244 COMP_CTX_free(s->expand); |
|
245 s->expand=NULL; |
|
246 } |
|
247 if (comp != NULL) |
|
248 { |
|
249 s->expand=COMP_CTX_new(comp); |
|
250 if (s->expand == NULL) |
|
251 { |
|
252 SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR); |
|
253 goto err2; |
|
254 } |
|
255 if (s->s3->rrec.comp == NULL) |
|
256 s->s3->rrec.comp=(unsigned char *) |
|
257 OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH); |
|
258 if (s->s3->rrec.comp == NULL) |
|
259 goto err; |
|
260 } |
|
261 #endif |
|
262 memset(&(s->s3->read_sequence[0]),0,8); |
|
263 mac_secret= &(s->s3->read_mac_secret[0]); |
|
264 } |
|
265 else |
|
266 { |
|
267 if (s->enc_write_ctx != NULL) |
|
268 reuse_dd = 1; |
|
269 else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) |
|
270 goto err; |
|
271 else |
|
272 /* make sure it's intialized in case we exit later with an error */ |
|
273 EVP_CIPHER_CTX_init(s->enc_write_ctx); |
|
274 dd= s->enc_write_ctx; |
|
275 |
|
276 |
|
277 s->write_hash=m; |
|
278 #ifndef OPENSSL_NO_COMP |
|
279 /* COMPRESS */ |
|
280 if (s->compress != NULL) |
|
281 { |
|
282 COMP_CTX_free(s->compress); |
|
283 s->compress=NULL; |
|
284 } |
|
285 if (comp != NULL) |
|
286 { |
|
287 s->compress=COMP_CTX_new(comp); |
|
288 if (s->compress == NULL) |
|
289 { |
|
290 SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR); |
|
291 goto err2; |
|
292 } |
|
293 } |
|
294 #endif |
|
295 memset(&(s->s3->write_sequence[0]),0,8); |
|
296 mac_secret= &(s->s3->write_mac_secret[0]); |
|
297 } |
|
298 |
|
299 if (reuse_dd) |
|
300 EVP_CIPHER_CTX_cleanup(dd); |
|
301 |
|
302 p=s->s3->tmp.key_block; |
|
303 i=EVP_MD_size(m); |
|
304 cl=EVP_CIPHER_key_length(c); |
|
305 j=is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ? |
|
306 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl; |
|
307 /* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */ |
|
308 k=EVP_CIPHER_iv_length(c); |
|
309 if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || |
|
310 (which == SSL3_CHANGE_CIPHER_SERVER_READ)) |
|
311 { |
|
312 ms= &(p[ 0]); n=i+i; |
|
313 key= &(p[ n]); n+=j+j; |
|
314 iv= &(p[ n]); n+=k+k; |
|
315 er1= &(s->s3->client_random[0]); |
|
316 er2= &(s->s3->server_random[0]); |
|
317 } |
|
318 else |
|
319 { |
|
320 n=i; |
|
321 ms= &(p[ n]); n+=i+j; |
|
322 key= &(p[ n]); n+=j+k; |
|
323 iv= &(p[ n]); n+=k; |
|
324 er1= &(s->s3->server_random[0]); |
|
325 er2= &(s->s3->client_random[0]); |
|
326 } |
|
327 |
|
328 if (n > s->s3->tmp.key_block_length) |
|
329 { |
|
330 SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR); |
|
331 goto err2; |
|
332 } |
|
333 |
|
334 EVP_MD_CTX_init(&md); |
|
335 memcpy(mac_secret,ms,i); |
|
336 if (is_exp) |
|
337 { |
|
338 /* In here I set both the read and write key/iv to the |
|
339 * same value since only the correct one will be used :-). |
|
340 */ |
|
341 EVP_DigestInit_ex(&md,EVP_md5(), NULL); |
|
342 EVP_DigestUpdate(&md,key,j); |
|
343 EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE); |
|
344 EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE); |
|
345 EVP_DigestFinal_ex(&md,&(exp_key[0]),NULL); |
|
346 key= &(exp_key[0]); |
|
347 |
|
348 if (k > 0) |
|
349 { |
|
350 EVP_DigestInit_ex(&md,EVP_md5(), NULL); |
|
351 EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE); |
|
352 EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE); |
|
353 EVP_DigestFinal_ex(&md,&(exp_iv[0]),NULL); |
|
354 iv= &(exp_iv[0]); |
|
355 } |
|
356 } |
|
357 |
|
358 s->session->key_arg_length=0; |
|
359 |
|
360 EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE)); |
|
361 |
|
362 OPENSSL_cleanse(&(exp_key[0]),sizeof(exp_key)); |
|
363 OPENSSL_cleanse(&(exp_iv[0]),sizeof(exp_iv)); |
|
364 EVP_MD_CTX_cleanup(&md); |
|
365 return(1); |
|
366 err: |
|
367 SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE); |
|
368 err2: |
|
369 return(0); |
|
370 } |
|
371 |
|
372 int ssl3_setup_key_block(SSL *s) |
|
373 { |
|
374 unsigned char *p; |
|
375 const EVP_CIPHER *c; |
|
376 const EVP_MD *hash; |
|
377 int num; |
|
378 int ret = 0; |
|
379 SSL_COMP *comp; |
|
380 |
|
381 if (s->s3->tmp.key_block_length != 0) |
|
382 return(1); |
|
383 |
|
384 if (!ssl_cipher_get_evp(s->session,&c,&hash,&comp)) |
|
385 { |
|
386 SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE); |
|
387 return(0); |
|
388 } |
|
389 |
|
390 s->s3->tmp.new_sym_enc=c; |
|
391 s->s3->tmp.new_hash=hash; |
|
392 #ifdef OPENSSL_NO_COMP |
|
393 s->s3->tmp.new_compression=NULL; |
|
394 #else |
|
395 s->s3->tmp.new_compression=comp; |
|
396 #endif |
|
397 |
|
398 num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c); |
|
399 num*=2; |
|
400 |
|
401 ssl3_cleanup_key_block(s); |
|
402 |
|
403 if ((p=OPENSSL_malloc(num)) == NULL) |
|
404 goto err; |
|
405 |
|
406 s->s3->tmp.key_block_length=num; |
|
407 s->s3->tmp.key_block=p; |
|
408 |
|
409 ret = ssl3_generate_key_block(s,p,num); |
|
410 |
|
411 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) |
|
412 { |
|
413 /* enable vulnerability countermeasure for CBC ciphers with |
|
414 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) |
|
415 */ |
|
416 s->s3->need_empty_fragments = 1; |
|
417 |
|
418 if (s->session->cipher != NULL) |
|
419 { |
|
420 if ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_eNULL) |
|
421 s->s3->need_empty_fragments = 0; |
|
422 |
|
423 #ifndef OPENSSL_NO_RC4 |
|
424 if ((s->session->cipher->algorithms & SSL_ENC_MASK) == SSL_RC4) |
|
425 s->s3->need_empty_fragments = 0; |
|
426 #endif |
|
427 } |
|
428 } |
|
429 |
|
430 return ret; |
|
431 |
|
432 err: |
|
433 SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE); |
|
434 return(0); |
|
435 } |
|
436 |
|
437 void ssl3_cleanup_key_block(SSL *s) |
|
438 { |
|
439 if (s->s3->tmp.key_block != NULL) |
|
440 { |
|
441 OPENSSL_cleanse(s->s3->tmp.key_block, |
|
442 s->s3->tmp.key_block_length); |
|
443 OPENSSL_free(s->s3->tmp.key_block); |
|
444 s->s3->tmp.key_block=NULL; |
|
445 } |
|
446 s->s3->tmp.key_block_length=0; |
|
447 } |
|
448 |
|
449 int ssl3_enc(SSL *s, int send) |
|
450 { |
|
451 SSL3_RECORD *rec; |
|
452 EVP_CIPHER_CTX *ds; |
|
453 unsigned long l; |
|
454 int bs,i; |
|
455 const EVP_CIPHER *enc; |
|
456 |
|
457 if (send) |
|
458 { |
|
459 ds=s->enc_write_ctx; |
|
460 rec= &(s->s3->wrec); |
|
461 if (s->enc_write_ctx == NULL) |
|
462 enc=NULL; |
|
463 else |
|
464 enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx); |
|
465 } |
|
466 else |
|
467 { |
|
468 ds=s->enc_read_ctx; |
|
469 rec= &(s->s3->rrec); |
|
470 if (s->enc_read_ctx == NULL) |
|
471 enc=NULL; |
|
472 else |
|
473 enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx); |
|
474 } |
|
475 |
|
476 if ((s->session == NULL) || (ds == NULL) || |
|
477 (enc == NULL)) |
|
478 { |
|
479 memmove(rec->data,rec->input,rec->length); |
|
480 rec->input=rec->data; |
|
481 } |
|
482 else |
|
483 { |
|
484 l=rec->length; |
|
485 bs=EVP_CIPHER_block_size(ds->cipher); |
|
486 |
|
487 /* COMPRESS */ |
|
488 |
|
489 if ((bs != 1) && send) |
|
490 { |
|
491 i=bs-((int)l%bs); |
|
492 |
|
493 /* we need to add 'i-1' padding bytes */ |
|
494 l+=i; |
|
495 rec->length+=i; |
|
496 rec->input[l-1]=(i-1); |
|
497 } |
|
498 |
|
499 if (!send) |
|
500 { |
|
501 if (l == 0 || l%bs != 0) |
|
502 { |
|
503 SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG); |
|
504 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED); |
|
505 return 0; |
|
506 } |
|
507 /* otherwise, rec->length >= bs */ |
|
508 } |
|
509 |
|
510 EVP_Cipher(ds,rec->data,rec->input,l); |
|
511 |
|
512 if ((bs != 1) && !send) |
|
513 { |
|
514 i=rec->data[l-1]+1; |
|
515 /* SSL 3.0 bounds the number of padding bytes by the block size; |
|
516 * padding bytes (except the last one) are arbitrary */ |
|
517 if (i > bs) |
|
518 { |
|
519 /* Incorrect padding. SSLerr() and ssl3_alert are done |
|
520 * by caller: we don't want to reveal whether this is |
|
521 * a decryption error or a MAC verification failure |
|
522 * (see http://www.openssl.org/~bodo/tls-cbc.txt) */ |
|
523 return -1; |
|
524 } |
|
525 /* now i <= bs <= rec->length */ |
|
526 rec->length-=i; |
|
527 } |
|
528 } |
|
529 return(1); |
|
530 } |
|
531 |
|
532 void ssl3_init_finished_mac(SSL *s) |
|
533 { |
|
534 EVP_DigestInit_ex(&(s->s3->finish_dgst1),s->ctx->md5, NULL); |
|
535 EVP_DigestInit_ex(&(s->s3->finish_dgst2),s->ctx->sha1, NULL); |
|
536 } |
|
537 |
|
538 void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len) |
|
539 { |
|
540 EVP_DigestUpdate(&(s->s3->finish_dgst1),buf,len); |
|
541 EVP_DigestUpdate(&(s->s3->finish_dgst2),buf,len); |
|
542 } |
|
543 |
|
544 int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *ctx, unsigned char *p) |
|
545 { |
|
546 return(ssl3_handshake_mac(s,ctx,NULL,0,p)); |
|
547 } |
|
548 |
|
549 int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1, EVP_MD_CTX *ctx2, |
|
550 const char *sender, int len, unsigned char *p) |
|
551 { |
|
552 int ret; |
|
553 |
|
554 ret=ssl3_handshake_mac(s,ctx1,sender,len,p); |
|
555 p+=ret; |
|
556 ret+=ssl3_handshake_mac(s,ctx2,sender,len,p); |
|
557 return(ret); |
|
558 } |
|
559 |
|
560 static int ssl3_handshake_mac(SSL *s, EVP_MD_CTX *in_ctx, |
|
561 const char *sender, int len, unsigned char *p) |
|
562 { |
|
563 unsigned int ret; |
|
564 int npad,n; |
|
565 unsigned int i; |
|
566 unsigned char md_buf[EVP_MAX_MD_SIZE]; |
|
567 EVP_MD_CTX ctx; |
|
568 |
|
569 EVP_MD_CTX_init(&ctx); |
|
570 EVP_MD_CTX_copy_ex(&ctx,in_ctx); |
|
571 |
|
572 n=EVP_MD_CTX_size(&ctx); |
|
573 npad=(48/n)*n; |
|
574 |
|
575 if (sender != NULL) |
|
576 EVP_DigestUpdate(&ctx,sender,len); |
|
577 EVP_DigestUpdate(&ctx,s->session->master_key, |
|
578 s->session->master_key_length); |
|
579 EVP_DigestUpdate(&ctx,ssl3_pad_1,npad); |
|
580 EVP_DigestFinal_ex(&ctx,md_buf,&i); |
|
581 |
|
582 EVP_DigestInit_ex(&ctx,EVP_MD_CTX_md(&ctx), NULL); |
|
583 EVP_DigestUpdate(&ctx,s->session->master_key, |
|
584 s->session->master_key_length); |
|
585 EVP_DigestUpdate(&ctx,ssl3_pad_2,npad); |
|
586 EVP_DigestUpdate(&ctx,md_buf,i); |
|
587 EVP_DigestFinal_ex(&ctx,p,&ret); |
|
588 |
|
589 EVP_MD_CTX_cleanup(&ctx); |
|
590 |
|
591 return((int)ret); |
|
592 } |
|
593 |
|
594 int ssl3_mac(SSL *ssl, unsigned char *md, int send) |
|
595 { |
|
596 SSL3_RECORD *rec; |
|
597 unsigned char *mac_sec,*seq; |
|
598 EVP_MD_CTX md_ctx; |
|
599 const EVP_MD *hash; |
|
600 unsigned char *p,rec_char; |
|
601 unsigned int md_size; |
|
602 int npad; |
|
603 |
|
604 if (send) |
|
605 { |
|
606 rec= &(ssl->s3->wrec); |
|
607 mac_sec= &(ssl->s3->write_mac_secret[0]); |
|
608 seq= &(ssl->s3->write_sequence[0]); |
|
609 hash=ssl->write_hash; |
|
610 } |
|
611 else |
|
612 { |
|
613 rec= &(ssl->s3->rrec); |
|
614 mac_sec= &(ssl->s3->read_mac_secret[0]); |
|
615 seq= &(ssl->s3->read_sequence[0]); |
|
616 hash=ssl->read_hash; |
|
617 } |
|
618 |
|
619 md_size=EVP_MD_size(hash); |
|
620 npad=(48/md_size)*md_size; |
|
621 |
|
622 /* Chop the digest off the end :-) */ |
|
623 EVP_MD_CTX_init(&md_ctx); |
|
624 |
|
625 EVP_DigestInit_ex( &md_ctx,hash, NULL); |
|
626 EVP_DigestUpdate(&md_ctx,mac_sec,md_size); |
|
627 EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad); |
|
628 EVP_DigestUpdate(&md_ctx,seq,8); |
|
629 rec_char=rec->type; |
|
630 EVP_DigestUpdate(&md_ctx,&rec_char,1); |
|
631 p=md; |
|
632 s2n(rec->length,p); |
|
633 EVP_DigestUpdate(&md_ctx,md,2); |
|
634 EVP_DigestUpdate(&md_ctx,rec->input,rec->length); |
|
635 EVP_DigestFinal_ex( &md_ctx,md,NULL); |
|
636 |
|
637 EVP_DigestInit_ex( &md_ctx,hash, NULL); |
|
638 EVP_DigestUpdate(&md_ctx,mac_sec,md_size); |
|
639 EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad); |
|
640 EVP_DigestUpdate(&md_ctx,md,md_size); |
|
641 EVP_DigestFinal_ex( &md_ctx,md,&md_size); |
|
642 |
|
643 EVP_MD_CTX_cleanup(&md_ctx); |
|
644 |
|
645 ssl3_record_sequence_update(seq); |
|
646 return(md_size); |
|
647 } |
|
648 |
|
649 void ssl3_record_sequence_update(unsigned char *seq) |
|
650 { |
|
651 int i; |
|
652 |
|
653 for (i=7; i>=0; i--) |
|
654 { |
|
655 ++seq[i]; |
|
656 if (seq[i] != 0) break; |
|
657 } |
|
658 } |
|
659 |
|
660 int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, |
|
661 int len) |
|
662 { |
|
663 #ifndef EMULATOR |
|
664 static const unsigned char *salt[3]={ |
|
665 #else |
|
666 static const unsigned char *const salt[3]={ |
|
667 #endif |
|
668 |
|
669 #ifndef CHARSET_EBCDIC |
|
670 (const unsigned char *)"A", |
|
671 (const unsigned char *)"BB", |
|
672 (const unsigned char *)"CCC", |
|
673 #else |
|
674 (const unsigned char *)"\x41", |
|
675 (const unsigned char *)"\x42\x42", |
|
676 (const unsigned char *)"\x43\x43\x43", |
|
677 #endif |
|
678 }; |
|
679 unsigned char buf[EVP_MAX_MD_SIZE]; |
|
680 EVP_MD_CTX ctx; |
|
681 int i,ret=0; |
|
682 unsigned int n; |
|
683 |
|
684 EVP_MD_CTX_init(&ctx); |
|
685 for (i=0; i<3; i++) |
|
686 { |
|
687 EVP_DigestInit_ex(&ctx,s->ctx->sha1, NULL); |
|
688 EVP_DigestUpdate(&ctx,salt[i],strlen((const char *)salt[i])); |
|
689 EVP_DigestUpdate(&ctx,p,len); |
|
690 EVP_DigestUpdate(&ctx,&(s->s3->client_random[0]), |
|
691 SSL3_RANDOM_SIZE); |
|
692 EVP_DigestUpdate(&ctx,&(s->s3->server_random[0]), |
|
693 SSL3_RANDOM_SIZE); |
|
694 EVP_DigestFinal_ex(&ctx,buf,&n); |
|
695 |
|
696 EVP_DigestInit_ex(&ctx,s->ctx->md5, NULL); |
|
697 EVP_DigestUpdate(&ctx,p,len); |
|
698 EVP_DigestUpdate(&ctx,buf,n); |
|
699 EVP_DigestFinal_ex(&ctx,out,&n); |
|
700 out+=n; |
|
701 ret+=n; |
|
702 } |
|
703 EVP_MD_CTX_cleanup(&ctx); |
|
704 return(ret); |
|
705 } |
|
706 |
|
707 int ssl3_alert_code(int code) |
|
708 { |
|
709 switch (code) |
|
710 { |
|
711 case SSL_AD_CLOSE_NOTIFY: return(SSL3_AD_CLOSE_NOTIFY); |
|
712 case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE); |
|
713 case SSL_AD_BAD_RECORD_MAC: return(SSL3_AD_BAD_RECORD_MAC); |
|
714 case SSL_AD_DECRYPTION_FAILED: return(SSL3_AD_BAD_RECORD_MAC); |
|
715 case SSL_AD_RECORD_OVERFLOW: return(SSL3_AD_BAD_RECORD_MAC); |
|
716 case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE); |
|
717 case SSL_AD_HANDSHAKE_FAILURE: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
718 case SSL_AD_NO_CERTIFICATE: return(SSL3_AD_NO_CERTIFICATE); |
|
719 case SSL_AD_BAD_CERTIFICATE: return(SSL3_AD_BAD_CERTIFICATE); |
|
720 case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE); |
|
721 case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED); |
|
722 case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED); |
|
723 case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN); |
|
724 case SSL_AD_ILLEGAL_PARAMETER: return(SSL3_AD_ILLEGAL_PARAMETER); |
|
725 case SSL_AD_UNKNOWN_CA: return(SSL3_AD_BAD_CERTIFICATE); |
|
726 case SSL_AD_ACCESS_DENIED: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
727 case SSL_AD_DECODE_ERROR: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
728 case SSL_AD_DECRYPT_ERROR: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
729 case SSL_AD_EXPORT_RESTRICTION: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
730 case SSL_AD_PROTOCOL_VERSION: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
731 case SSL_AD_INSUFFICIENT_SECURITY:return(SSL3_AD_HANDSHAKE_FAILURE); |
|
732 case SSL_AD_INTERNAL_ERROR: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
733 case SSL_AD_USER_CANCELLED: return(SSL3_AD_HANDSHAKE_FAILURE); |
|
734 case SSL_AD_NO_RENEGOTIATION: return(-1); /* Don't send it :-) */ |
|
735 default: return(-1); |
|
736 } |
|
737 } |
|
738 |