1999-02-28 12:41:50 +00:00
|
|
|
/*! \file ssl/ssl_lib.c
|
|
|
|
* \brief Version independent SSL functions.
|
|
|
|
*/
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
1998-12-21 10:52:47 +00:00
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* This package is an SSL implementation written
|
|
|
|
* by Eric Young (eay@cryptsoft.com).
|
|
|
|
* The implementation was written so as to conform with Netscapes SSL.
|
|
|
|
*
|
|
|
|
* This library is free for commercial and non-commercial use as long as
|
|
|
|
* the following conditions are aheared to. The following conditions
|
|
|
|
* apply to all code found in this distribution, be it the RC4, RSA,
|
|
|
|
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
|
|
|
|
* included with this distribution is covered by the same copyright terms
|
|
|
|
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
|
|
|
|
*
|
|
|
|
* Copyright remains Eric Young's, and as such any Copyright notices in
|
|
|
|
* the code are not to be removed.
|
|
|
|
* If this package is used in a product, Eric Young should be given attribution
|
|
|
|
* as the author of the parts of the library used.
|
|
|
|
* This can be in the form of a textual message at program startup or
|
|
|
|
* in documentation (online or textual) provided with the package.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
|
|
* must display the following acknowledgement:
|
|
|
|
* "This product includes cryptographic software written by
|
|
|
|
* Eric Young (eay@cryptsoft.com)"
|
|
|
|
* The word 'cryptographic' can be left out if the rouines from the library
|
|
|
|
* being used are not cryptographic related :-).
|
|
|
|
* 4. If you include any Windows specific code (or a derivative thereof) from
|
|
|
|
* the apps directory (application code) you must include an acknowledgement:
|
|
|
|
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* The licence and distribution terms for any publically available version or
|
|
|
|
* derivative of this code cannot be changed. i.e. this code cannot simply be
|
|
|
|
* copied and put under another distribution licence
|
|
|
|
* [including the GNU Public Licence.]
|
|
|
|
*/
|
2001-10-16 13:09:24 +00:00
|
|
|
/* ====================================================================
|
|
|
|
* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
*
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
*
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in
|
|
|
|
* the documentation and/or other materials provided with the
|
|
|
|
* distribution.
|
|
|
|
*
|
|
|
|
* 3. All advertising materials mentioning features or use of this
|
|
|
|
* software must display the following acknowledgment:
|
|
|
|
* "This product includes software developed by the OpenSSL Project
|
|
|
|
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
|
|
|
*
|
|
|
|
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
|
|
* endorse or promote products derived from this software without
|
|
|
|
* prior written permission. For written permission, please contact
|
|
|
|
* openssl-core@openssl.org.
|
|
|
|
*
|
|
|
|
* 5. Products derived from this software may not be called "OpenSSL"
|
|
|
|
* nor may "OpenSSL" appear in their names without prior written
|
|
|
|
* permission of the OpenSSL Project.
|
|
|
|
*
|
|
|
|
* 6. Redistributions of any form whatsoever must retain the following
|
|
|
|
* acknowledgment:
|
|
|
|
* "This product includes software developed by the OpenSSL Project
|
|
|
|
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
|
|
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
|
|
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
|
|
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
|
|
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
* ====================================================================
|
|
|
|
*
|
|
|
|
* This product includes cryptographic software written by Eric Young
|
|
|
|
* (eay@cryptsoft.com). This product includes software written by Tim
|
|
|
|
* Hudson (tjh@cryptsoft.com).
|
|
|
|
*
|
|
|
|
*/
|
2002-08-09 08:56:08 +00:00
|
|
|
/* ====================================================================
|
|
|
|
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
|
|
|
* ECC cipher suite support in OpenSSL originally developed by
|
|
|
|
* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
|
|
|
|
*/
|
2000-09-04 15:34:43 +00:00
|
|
|
|
2001-04-08 13:47:51 +00:00
|
|
|
#ifdef REF_CHECK
|
|
|
|
# include <assert.h>
|
|
|
|
#endif
|
1998-12-21 10:52:47 +00:00
|
|
|
#include <stdio.h>
|
2002-07-10 07:01:54 +00:00
|
|
|
#include "ssl_locl.h"
|
|
|
|
#include "kssl_lcl.h"
|
1999-04-23 22:13:45 +00:00
|
|
|
#include <openssl/objects.h>
|
|
|
|
#include <openssl/lhash.h>
|
1999-11-29 22:35:00 +00:00
|
|
|
#include <openssl/x509v3.h>
|
2002-11-13 15:43:43 +00:00
|
|
|
#include "cryptlib.h"
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2000-01-30 22:20:28 +00:00
|
|
|
const char *SSL_version_str=OPENSSL_VERSION_TEXT;
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1999-05-15 14:23:29 +00:00
|
|
|
OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
|
2000-01-23 23:41:49 +00:00
|
|
|
/* evil casts, but these functions are only called if there's a library bug */
|
2000-01-05 23:31:47 +00:00
|
|
|
(int (*)(SSL *,int))ssl_undefined_function,
|
|
|
|
(int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
|
1998-12-21 10:56:39 +00:00
|
|
|
ssl_undefined_function,
|
2000-01-05 23:31:47 +00:00
|
|
|
(int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
|
|
|
|
(int (*)(SSL*, int))ssl_undefined_function,
|
|
|
|
(int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
|
1998-12-21 10:56:39 +00:00
|
|
|
};
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_clear(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
if (s->method == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED);
|
|
|
|
return(0);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2002-02-27 11:23:05 +00:00
|
|
|
if (ssl_clear_bad_session(s))
|
|
|
|
{
|
|
|
|
SSL_SESSION_free(s->session);
|
|
|
|
s->session=NULL;
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
s->error=0;
|
|
|
|
s->hit=0;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->shutdown=0;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2000-02-21 17:09:54 +00:00
|
|
|
#if 0 /* Disabled since version 1.10 of this file (early return not
|
|
|
|
* needed because SSL_clear is not called when doing renegotiation) */
|
1998-12-21 10:52:47 +00:00
|
|
|
/* This is set if we are doing dynamic renegotiation so keep
|
|
|
|
* the old cipher. It is sort of a SSL_clear_lite :-) */
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
if (s->new_session) return(1);
|
2000-02-21 17:09:54 +00:00
|
|
|
#else
|
|
|
|
if (s->new_session)
|
|
|
|
{
|
2001-03-07 01:19:07 +00:00
|
|
|
SSLerr(SSL_F_SSL_CLEAR,ERR_R_INTERNAL_ERROR);
|
2000-02-21 17:09:54 +00:00
|
|
|
return 0;
|
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
#endif
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
s->type=0;
|
|
|
|
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
s->version=s->method->version;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->client_version=s->version;
|
1998-12-21 10:52:47 +00:00
|
|
|
s->rwstate=SSL_NOTHING;
|
|
|
|
s->rstate=SSL_ST_READ_HEADER;
|
2000-09-26 11:30:59 +00:00
|
|
|
#if 0
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->read_ahead=s->ctx->read_ahead;
|
2000-09-26 11:30:59 +00:00
|
|
|
#endif
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
if (s->init_buf != NULL)
|
|
|
|
{
|
|
|
|
BUF_MEM_free(s->init_buf);
|
|
|
|
s->init_buf=NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
ssl_clear_cipher_ctx(s);
|
|
|
|
|
|
|
|
s->first_packet=0;
|
|
|
|
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
#if 1
|
|
|
|
/* Check to see if we were changed into a different method, if
|
|
|
|
* so, revert back if we are not doing session-id reuse. */
|
2001-10-24 19:03:22 +00:00
|
|
|
if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->method))
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
{
|
|
|
|
s->method->ssl_free(s);
|
|
|
|
s->method=s->ctx->method;
|
|
|
|
if (!s->method->ssl_new(s))
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
#endif
|
|
|
|
s->method->ssl_clear(s);
|
|
|
|
return(1);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** Used to change an SSL_CTXs default SSL method type */
|
|
|
|
int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
ctx->method=meth;
|
|
|
|
|
|
|
|
sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),
|
|
|
|
&(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST);
|
1999-04-12 17:23:57 +00:00
|
|
|
if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
return(1);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL *SSL_new(SSL_CTX *ctx)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSL *s;
|
|
|
|
|
|
|
|
if (ctx == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
if (ctx->method == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
2000-06-01 22:19:21 +00:00
|
|
|
s=(SSL *)OPENSSL_malloc(sizeof(SSL));
|
1998-12-21 10:52:47 +00:00
|
|
|
if (s == NULL) goto err;
|
|
|
|
memset(s,0,sizeof(SSL));
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_KRB5
|
2000-11-30 22:53:34 +00:00
|
|
|
s->kssl_ctx = kssl_ctx_new();
|
2001-02-20 08:13:47 +00:00
|
|
|
#endif /* OPENSSL_NO_KRB5 */
|
2000-11-30 22:53:34 +00:00
|
|
|
|
2001-10-16 13:09:24 +00:00
|
|
|
s->options=ctx->options;
|
|
|
|
s->mode=ctx->mode;
|
|
|
|
s->max_cert_list=ctx->max_cert_list;
|
|
|
|
|
1999-05-09 20:12:44 +00:00
|
|
|
if (ctx->cert != NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-09 20:12:44 +00:00
|
|
|
/* Earlier library versions used to copy the pointer to
|
|
|
|
* the CERT, not its contents; only when setting new
|
|
|
|
* parameters for the per-SSL copy, ssl_cert_new would be
|
|
|
|
* called (and the direct reference to the per-SSL_CTX
|
|
|
|
* settings would be lost, but those still were indirectly
|
|
|
|
* accessed for various purposes, and for that reason they
|
|
|
|
* used to be known as s->ctx->default_cert).
|
|
|
|
* Now we don't look at the SSL_CTX's CERT after having
|
|
|
|
* duplicated it once. */
|
|
|
|
|
|
|
|
s->cert = ssl_cert_dup(ctx->cert);
|
|
|
|
if (s->cert == NULL)
|
|
|
|
goto err;
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
else
|
1999-05-09 20:12:44 +00:00
|
|
|
s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */
|
2001-10-16 13:09:24 +00:00
|
|
|
|
|
|
|
s->read_ahead=ctx->read_ahead;
|
|
|
|
s->msg_callback=ctx->msg_callback;
|
|
|
|
s->msg_callback_arg=ctx->msg_callback_arg;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->verify_mode=ctx->verify_mode;
|
1999-05-01 03:20:40 +00:00
|
|
|
s->verify_depth=ctx->verify_depth;
|
2001-10-16 13:09:24 +00:00
|
|
|
s->sid_ctx_length=ctx->sid_ctx_length;
|
2002-11-13 15:43:43 +00:00
|
|
|
OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
|
2001-10-16 13:09:24 +00:00
|
|
|
memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
|
1998-12-21 10:52:47 +00:00
|
|
|
s->verify_callback=ctx->default_verify_callback;
|
2001-02-21 18:06:26 +00:00
|
|
|
s->generate_session_id=ctx->generate_session_id;
|
1999-11-29 01:09:25 +00:00
|
|
|
s->purpose = ctx->purpose;
|
|
|
|
s->trust = ctx->trust;
|
2001-10-16 13:09:24 +00:00
|
|
|
s->quiet_shutdown=ctx->quiet_shutdown;
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
|
|
|
|
s->ctx=ctx;
|
|
|
|
|
|
|
|
s->verify_result=X509_V_OK;
|
|
|
|
|
|
|
|
s->method=ctx->method;
|
|
|
|
|
|
|
|
if (!s->method->ssl_new(s))
|
|
|
|
goto err;
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
s->references=1;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
|
2001-10-16 13:09:24 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
SSL_clear(s);
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2001-09-01 20:02:13 +00:00
|
|
|
CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
return(s);
|
|
|
|
err:
|
1999-05-09 20:12:44 +00:00
|
|
|
if (s != NULL)
|
|
|
|
{
|
|
|
|
if (s->cert != NULL)
|
|
|
|
ssl_cert_free(s->cert);
|
|
|
|
if (s->ctx != NULL)
|
|
|
|
SSL_CTX_free(s->ctx); /* decrement reference count */
|
2000-06-01 22:19:21 +00:00
|
|
|
OPENSSL_free(s);
|
1999-05-09 20:12:44 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
1999-04-30 17:15:56 +00:00
|
|
|
int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
|
|
|
|
unsigned int sid_ctx_len)
|
|
|
|
{
|
2002-11-13 15:43:43 +00:00
|
|
|
if(sid_ctx_len > sizeof ctx->sid_ctx)
|
1999-04-30 17:15:56 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
ctx->sid_ctx_length=sid_ctx_len;
|
|
|
|
memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
1999-03-22 12:22:14 +00:00
|
|
|
int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
|
|
|
|
unsigned int sid_ctx_len)
|
|
|
|
{
|
|
|
|
if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
ssl->sid_ctx_length=sid_ctx_len;
|
|
|
|
memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2001-02-21 18:06:26 +00:00
|
|
|
int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
|
|
|
|
{
|
|
|
|
CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
|
|
|
|
ctx->generate_session_id = cb;
|
|
|
|
CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
|
|
|
|
{
|
|
|
|
CRYPTO_w_lock(CRYPTO_LOCK_SSL);
|
|
|
|
ssl->generate_session_id = cb;
|
|
|
|
CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2001-02-23 00:02:56 +00:00
|
|
|
int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
|
2001-02-21 18:06:26 +00:00
|
|
|
unsigned int id_len)
|
|
|
|
{
|
|
|
|
/* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
|
|
|
|
* we can "construct" a session to give us the desired check - ie. to
|
|
|
|
* find if there's a session in the hash table that would conflict with
|
|
|
|
* any new session built out of this id/id_len and the ssl_version in
|
2001-02-23 00:02:56 +00:00
|
|
|
* use by this SSL. */
|
2001-02-21 18:06:26 +00:00
|
|
|
SSL_SESSION r, *p;
|
2002-11-13 15:43:43 +00:00
|
|
|
|
|
|
|
if(id_len > sizeof r.session_id)
|
|
|
|
return 0;
|
|
|
|
|
2001-02-23 00:02:56 +00:00
|
|
|
r.ssl_version = ssl->version;
|
2001-02-21 18:06:26 +00:00
|
|
|
r.session_id_length = id_len;
|
|
|
|
memcpy(r.session_id, id, id_len);
|
2001-02-21 21:38:32 +00:00
|
|
|
/* NB: SSLv2 always uses a fixed 16-byte session ID, so even if a
|
|
|
|
* callback is calling us to check the uniqueness of a shorter ID, it
|
|
|
|
* must be compared as a padded-out ID because that is what it will be
|
|
|
|
* converted to when the callback has finished choosing it. */
|
|
|
|
if((r.ssl_version == SSL2_VERSION) &&
|
|
|
|
(id_len < SSL2_SSL_SESSION_ID_LENGTH))
|
|
|
|
{
|
|
|
|
memset(r.session_id + id_len, 0,
|
|
|
|
SSL2_SSL_SESSION_ID_LENGTH - id_len);
|
|
|
|
r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH;
|
|
|
|
}
|
2001-02-21 18:06:26 +00:00
|
|
|
|
|
|
|
CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
|
2001-02-23 00:02:56 +00:00
|
|
|
p = (SSL_SESSION *)lh_retrieve(ssl->ctx->sessions, &r);
|
2001-02-21 18:06:26 +00:00
|
|
|
CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
|
|
|
|
return (p != NULL);
|
|
|
|
}
|
|
|
|
|
1999-11-29 22:35:00 +00:00
|
|
|
int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
|
2001-10-16 13:09:24 +00:00
|
|
|
{
|
2001-05-10 00:13:59 +00:00
|
|
|
return X509_PURPOSE_set(&s->purpose, purpose);
|
2001-10-16 13:09:24 +00:00
|
|
|
}
|
1999-11-29 22:35:00 +00:00
|
|
|
|
|
|
|
int SSL_set_purpose(SSL *s, int purpose)
|
2001-10-16 13:09:24 +00:00
|
|
|
{
|
2001-05-10 00:13:59 +00:00
|
|
|
return X509_PURPOSE_set(&s->purpose, purpose);
|
2001-10-16 13:09:24 +00:00
|
|
|
}
|
2001-05-10 00:13:59 +00:00
|
|
|
|
1999-11-29 22:35:00 +00:00
|
|
|
int SSL_CTX_set_trust(SSL_CTX *s, int trust)
|
2001-10-16 13:09:24 +00:00
|
|
|
{
|
2001-05-10 00:13:59 +00:00
|
|
|
return X509_TRUST_set(&s->trust, trust);
|
2001-10-16 13:09:24 +00:00
|
|
|
}
|
1999-11-29 22:35:00 +00:00
|
|
|
|
|
|
|
int SSL_set_trust(SSL *s, int trust)
|
2001-10-16 13:09:24 +00:00
|
|
|
{
|
2001-05-10 00:13:59 +00:00
|
|
|
return X509_TRUST_set(&s->trust, trust);
|
2001-10-16 13:09:24 +00:00
|
|
|
}
|
1999-11-29 22:35:00 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_free(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
int i;
|
|
|
|
|
1999-01-07 19:15:59 +00:00
|
|
|
if(s == NULL)
|
|
|
|
return;
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);
|
|
|
|
#ifdef REF_PRINT
|
|
|
|
REF_PRINT("SSL",s);
|
|
|
|
#endif
|
|
|
|
if (i > 0) return;
|
|
|
|
#ifdef REF_CHECK
|
|
|
|
if (i < 0)
|
|
|
|
{
|
|
|
|
fprintf(stderr,"SSL_free, bad reference count\n");
|
|
|
|
abort(); /* ok */
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2001-09-01 20:02:13 +00:00
|
|
|
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (s->bbio != NULL)
|
|
|
|
{
|
|
|
|
/* If the buffering BIO is in place, pop it off */
|
|
|
|
if (s->bbio == s->wbio)
|
|
|
|
{
|
|
|
|
s->wbio=BIO_pop(s->wbio);
|
|
|
|
}
|
|
|
|
BIO_free(s->bbio);
|
1998-12-21 10:56:39 +00:00
|
|
|
s->bbio=NULL;
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
if (s->rbio != NULL)
|
|
|
|
BIO_free_all(s->rbio);
|
|
|
|
if ((s->wbio != NULL) && (s->wbio != s->rbio))
|
|
|
|
BIO_free_all(s->wbio);
|
|
|
|
|
|
|
|
if (s->init_buf != NULL) BUF_MEM_free(s->init_buf);
|
|
|
|
|
|
|
|
/* add extra stuff */
|
1999-04-12 17:23:57 +00:00
|
|
|
if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);
|
|
|
|
if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
/* Make the next call work :-) */
|
|
|
|
if (s->session != NULL)
|
|
|
|
{
|
|
|
|
ssl_clear_bad_session(s);
|
|
|
|
SSL_SESSION_free(s->session);
|
|
|
|
}
|
|
|
|
|
|
|
|
ssl_clear_cipher_ctx(s);
|
|
|
|
|
|
|
|
if (s->cert != NULL) ssl_cert_free(s->cert);
|
|
|
|
/* Free up if allocated */
|
|
|
|
|
|
|
|
if (s->ctx) SSL_CTX_free(s->ctx);
|
|
|
|
|
|
|
|
if (s->client_CA != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
if (s->method != NULL) s->method->ssl_free(s);
|
|
|
|
|
2000-06-01 22:19:21 +00:00
|
|
|
OPENSSL_free(s);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
/* If the output buffering BIO is still in place, remove it
|
|
|
|
*/
|
|
|
|
if (s->bbio != NULL)
|
|
|
|
{
|
|
|
|
if (s->wbio == s->bbio)
|
|
|
|
{
|
|
|
|
s->wbio=s->wbio->next_bio;
|
|
|
|
s->bbio->next_bio=NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ((s->rbio != NULL) && (s->rbio != rbio))
|
|
|
|
BIO_free_all(s->rbio);
|
|
|
|
if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio))
|
|
|
|
BIO_free_all(s->wbio);
|
|
|
|
s->rbio=rbio;
|
|
|
|
s->wbio=wbio;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
BIO *SSL_get_rbio(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{ return(s->rbio); }
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
BIO *SSL_get_wbio(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{ return(s->wbio); }
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_get_fd(SSL *s)
|
2001-07-15 20:11:57 +00:00
|
|
|
{
|
2001-07-16 10:50:29 +00:00
|
|
|
return(SSL_get_rfd(s));
|
2001-07-15 20:11:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_get_rfd(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int ret= -1;
|
|
|
|
BIO *b,*r;
|
|
|
|
|
|
|
|
b=SSL_get_rbio(s);
|
|
|
|
r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR);
|
|
|
|
if (r != NULL)
|
|
|
|
BIO_get_fd(r,&ret);
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
|
2001-07-15 20:11:57 +00:00
|
|
|
int SSL_get_wfd(SSL *s)
|
|
|
|
{
|
|
|
|
int ret= -1;
|
|
|
|
BIO *b,*r;
|
|
|
|
|
|
|
|
b=SSL_get_wbio(s);
|
|
|
|
r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR);
|
|
|
|
if (r != NULL)
|
|
|
|
BIO_get_fd(r,&ret);
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_SOCK
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_set_fd(SSL *s,int fd)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int ret=0;
|
|
|
|
BIO *bio=NULL;
|
|
|
|
|
|
|
|
bio=BIO_new(BIO_s_socket());
|
|
|
|
|
|
|
|
if (bio == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
BIO_set_fd(bio,fd,BIO_NOCLOSE);
|
|
|
|
SSL_set_bio(s,bio,bio);
|
|
|
|
ret=1;
|
|
|
|
err:
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_set_wfd(SSL *s,int fd)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int ret=0;
|
|
|
|
BIO *bio=NULL;
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET)
|
|
|
|
|| ((int)BIO_get_fd(s->rbio,NULL) != fd))
|
|
|
|
{
|
|
|
|
bio=BIO_new(BIO_s_socket());
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
if (bio == NULL)
|
|
|
|
{ SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; }
|
|
|
|
BIO_set_fd(bio,fd,BIO_NOCLOSE);
|
|
|
|
SSL_set_bio(s,SSL_get_rbio(s),bio);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s));
|
1998-12-21 10:52:47 +00:00
|
|
|
ret=1;
|
|
|
|
err:
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_set_rfd(SSL *s,int fd)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int ret=0;
|
|
|
|
BIO *bio=NULL;
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET)
|
|
|
|
|| ((int)BIO_get_fd(s->wbio,NULL) != fd))
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
bio=BIO_new(BIO_s_socket());
|
|
|
|
|
|
|
|
if (bio == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
BIO_set_fd(bio,fd,BIO_NOCLOSE);
|
|
|
|
SSL_set_bio(s,bio,SSL_get_wbio(s));
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
else
|
|
|
|
SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s));
|
1998-12-21 10:52:47 +00:00
|
|
|
ret=1;
|
|
|
|
err:
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2000-01-06 01:19:17 +00:00
|
|
|
|
|
|
|
/* return length of latest Finished message we sent, copy to 'buf' */
|
|
|
|
size_t SSL_get_finished(SSL *s, void *buf, size_t count)
|
|
|
|
{
|
|
|
|
size_t ret = 0;
|
|
|
|
|
|
|
|
if (s->s3 != NULL)
|
|
|
|
{
|
|
|
|
ret = s->s3->tmp.finish_md_len;
|
|
|
|
if (count > ret)
|
|
|
|
count = ret;
|
|
|
|
memcpy(buf, s->s3->tmp.finish_md, count);
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* return length of latest Finished message we expected, copy to 'buf' */
|
|
|
|
size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count)
|
|
|
|
{
|
|
|
|
size_t ret = 0;
|
|
|
|
|
|
|
|
if (s->s3 != NULL)
|
|
|
|
{
|
|
|
|
ret = s->s3->tmp.peer_finish_md_len;
|
|
|
|
if (count > ret)
|
|
|
|
count = ret;
|
|
|
|
memcpy(buf, s->s3->tmp.peer_finish_md, count);
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_get_verify_mode(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
return(s->verify_mode);
|
|
|
|
}
|
|
|
|
|
1999-05-01 03:20:40 +00:00
|
|
|
int SSL_get_verify_depth(SSL *s)
|
|
|
|
{
|
|
|
|
return(s->verify_depth);
|
|
|
|
}
|
|
|
|
|
1999-03-04 07:54:01 +00:00
|
|
|
int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
return(s->verify_callback);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_CTX_get_verify_mode(SSL_CTX *ctx)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
return(ctx->verify_mode);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-05-01 03:20:40 +00:00
|
|
|
int SSL_CTX_get_verify_depth(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return(ctx->verify_depth);
|
|
|
|
}
|
|
|
|
|
1999-03-04 07:54:01 +00:00
|
|
|
int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
return(ctx->default_verify_callback);
|
|
|
|
}
|
|
|
|
|
1999-02-28 14:39:18 +00:00
|
|
|
void SSL_set_verify(SSL *s,int mode,
|
|
|
|
int (*callback)(int ok,X509_STORE_CTX *ctx))
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
s->verify_mode=mode;
|
|
|
|
if (callback != NULL)
|
|
|
|
s->verify_callback=callback;
|
|
|
|
}
|
|
|
|
|
1999-05-01 03:20:40 +00:00
|
|
|
void SSL_set_verify_depth(SSL *s,int depth)
|
|
|
|
{
|
|
|
|
s->verify_depth=depth;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_read_ahead(SSL *s,int yes)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
s->read_ahead=yes;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_get_read_ahead(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
return(s->read_ahead);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_pending(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2000-11-28 06:58:22 +00:00
|
|
|
/* SSL_pending cannot work properly if read-ahead is enabled
|
|
|
|
* (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)),
|
|
|
|
* and it is impossible to fix since SSL_pending cannot report
|
|
|
|
* errors that may be observed while scanning the new data.
|
|
|
|
* (Note that SSL_pending() is often used as a boolean value,
|
|
|
|
* so we'd better not return -1.)
|
|
|
|
*/
|
1998-12-21 10:52:47 +00:00
|
|
|
return(s->method->ssl_pending(s));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
X509 *SSL_get_peer_certificate(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
X509 *r;
|
|
|
|
|
|
|
|
if ((s == NULL) || (s->session == NULL))
|
|
|
|
r=NULL;
|
|
|
|
else
|
|
|
|
r=s->session->peer;
|
|
|
|
|
|
|
|
if (r == NULL) return(r);
|
|
|
|
|
|
|
|
CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509);
|
|
|
|
|
|
|
|
return(r);
|
|
|
|
}
|
|
|
|
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(X509) *r;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-05-09 21:22:45 +00:00
|
|
|
if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL))
|
1998-12-21 10:52:47 +00:00
|
|
|
r=NULL;
|
|
|
|
else
|
1999-05-09 21:22:45 +00:00
|
|
|
r=s->session->sess_cert->cert_chain;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2000-03-27 18:07:45 +00:00
|
|
|
/* If we are a client, cert_chain includes the peer's own
|
|
|
|
* certificate; if we are a server, it does not. */
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
return(r);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Now in theory, since the calling process own 't' it should be safe to
|
|
|
|
* modify. We need to be able to read f without being hassled */
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_copy_session_id(SSL *t,SSL *f)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
CERT *tmp;
|
|
|
|
|
|
|
|
/* Do we need to to SSL locking? */
|
|
|
|
SSL_set_session(t,SSL_get_session(f));
|
|
|
|
|
|
|
|
/* what if we are setup as SSLv2 but want to talk SSLv3 or
|
|
|
|
* vice-versa */
|
|
|
|
if (t->method != f->method)
|
|
|
|
{
|
|
|
|
t->method->ssl_free(t); /* cleanup current */
|
|
|
|
t->method=f->method; /* change method */
|
|
|
|
t->method->ssl_new(t); /* setup new */
|
|
|
|
}
|
|
|
|
|
|
|
|
tmp=t->cert;
|
|
|
|
if (f->cert != NULL)
|
|
|
|
{
|
|
|
|
CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT);
|
|
|
|
t->cert=f->cert;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
t->cert=NULL;
|
|
|
|
if (tmp != NULL) ssl_cert_free(tmp);
|
1999-03-22 12:22:14 +00:00
|
|
|
SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Fix this so it checks all the valid key/cert options */
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_CTX_check_private_key(SSL_CTX *ctx)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
if ( (ctx == NULL) ||
|
1999-05-09 20:12:44 +00:00
|
|
|
(ctx->cert == NULL) ||
|
|
|
|
(ctx->cert->key->x509 == NULL))
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
|
|
|
|
return(0);
|
|
|
|
}
|
1999-05-09 20:12:44 +00:00
|
|
|
if (ctx->cert->key->privatekey == NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
|
|
|
|
return(0);
|
|
|
|
}
|
1999-05-09 20:12:44 +00:00
|
|
|
return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Fix this function so that it takes an optional type parameter */
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_check_private_key(SSL *ssl)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
if (ssl == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER);
|
|
|
|
return(0);
|
|
|
|
}
|
1999-08-02 20:09:23 +00:00
|
|
|
if (ssl->cert == NULL)
|
1999-08-02 21:41:46 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
|
1999-08-02 20:09:23 +00:00
|
|
|
return 0;
|
1999-08-02 21:41:46 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
if (ssl->cert->key->x509 == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
if (ssl->cert->key->privatekey == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
return(X509_check_private_key(ssl->cert->key->x509,
|
|
|
|
ssl->cert->key->privatekey));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_accept(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-11 07:43:16 +00:00
|
|
|
if (s->handshake_func == 0)
|
|
|
|
/* Not properly initialized yet */
|
|
|
|
SSL_set_accept_state(s);
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
return(s->method->ssl_accept(s));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_connect(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-11 07:43:16 +00:00
|
|
|
if (s->handshake_func == 0)
|
|
|
|
/* Not properly initialized yet */
|
|
|
|
SSL_set_connect_state(s);
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
return(s->method->ssl_connect(s));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
long SSL_get_default_timeout(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
return(s->method->get_timeout());
|
|
|
|
}
|
|
|
|
|
2001-03-09 10:09:20 +00:00
|
|
|
int SSL_read(SSL *s,void *buf,int num)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-11 07:43:16 +00:00
|
|
|
if (s->handshake_func == 0)
|
|
|
|
{
|
1999-05-11 07:54:38 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
|
1999-05-11 07:43:16 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
|
|
|
|
{
|
|
|
|
s->rwstate=SSL_NOTHING;
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
return(s->method->ssl_read(s,buf,num));
|
|
|
|
}
|
|
|
|
|
2001-03-09 10:09:20 +00:00
|
|
|
int SSL_peek(SSL *s,void *buf,int num)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2001-03-08 21:54:02 +00:00
|
|
|
if (s->handshake_func == 0)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
|
|
|
|
{
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
return(s->method->ssl_peek(s,buf,num));
|
|
|
|
}
|
|
|
|
|
2001-03-09 10:09:20 +00:00
|
|
|
int SSL_write(SSL *s,const void *buf,int num)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-11 07:43:16 +00:00
|
|
|
if (s->handshake_func == 0)
|
|
|
|
{
|
1999-05-11 07:54:38 +00:00
|
|
|
SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED);
|
1999-05-11 07:43:16 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (s->shutdown & SSL_SENT_SHUTDOWN)
|
|
|
|
{
|
|
|
|
s->rwstate=SSL_NOTHING;
|
|
|
|
SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN);
|
|
|
|
return(-1);
|
|
|
|
}
|
|
|
|
return(s->method->ssl_write(s,buf,num));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_shutdown(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-15 10:40:02 +00:00
|
|
|
/* Note that this function behaves differently from what one might
|
1999-05-15 00:00:28 +00:00
|
|
|
* expect. Return values are 0 for no success (yet),
|
|
|
|
* 1 for success; but calling it once is usually not enough,
|
|
|
|
* even if blocking I/O is used (see ssl3_shutdown).
|
|
|
|
*/
|
|
|
|
|
1999-05-11 07:43:16 +00:00
|
|
|
if (s->handshake_func == 0)
|
|
|
|
{
|
1999-05-11 07:54:38 +00:00
|
|
|
SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
|
1999-05-11 07:43:16 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if ((s != NULL) && !SSL_in_init(s))
|
|
|
|
return(s->method->ssl_shutdown(s));
|
|
|
|
else
|
|
|
|
return(1);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_renegotiate(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2002-01-14 23:40:26 +00:00
|
|
|
if (s->new_session == 0)
|
|
|
|
{
|
|
|
|
s->new_session=1;
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
return(s->method->ssl_renegotiate(s));
|
|
|
|
}
|
|
|
|
|
2001-09-20 22:54:09 +00:00
|
|
|
int SSL_renegotiate_pending(SSL *s)
|
|
|
|
{
|
|
|
|
/* becomes true when negotiation is requested;
|
|
|
|
* false again once a handshake has finished */
|
|
|
|
return (s->new_session != 0);
|
|
|
|
}
|
|
|
|
|
2001-10-20 17:56:36 +00:00
|
|
|
long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
long l;
|
|
|
|
|
|
|
|
switch (cmd)
|
|
|
|
{
|
|
|
|
case SSL_CTRL_GET_READ_AHEAD:
|
|
|
|
return(s->read_ahead);
|
|
|
|
case SSL_CTRL_SET_READ_AHEAD:
|
|
|
|
l=s->read_ahead;
|
|
|
|
s->read_ahead=larg;
|
|
|
|
return(l);
|
2001-10-16 13:09:24 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
|
|
|
|
s->msg_callback_arg = parg;
|
|
|
|
return 1;
|
|
|
|
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
case SSL_CTRL_OPTIONS:
|
|
|
|
return(s->options|=larg);
|
1999-07-02 13:55:32 +00:00
|
|
|
case SSL_CTRL_MODE:
|
|
|
|
return(s->mode|=larg);
|
2001-09-11 13:08:51 +00:00
|
|
|
case SSL_CTRL_GET_MAX_CERT_LIST:
|
|
|
|
return(s->max_cert_list);
|
|
|
|
case SSL_CTRL_SET_MAX_CERT_LIST:
|
|
|
|
l=s->max_cert_list;
|
|
|
|
s->max_cert_list=larg;
|
|
|
|
return(l);
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
default:
|
|
|
|
return(s->method->ssl_ctrl(s,cmd,larg,parg));
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
2000-02-20 23:43:02 +00:00
|
|
|
long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)())
|
|
|
|
{
|
|
|
|
switch(cmd)
|
|
|
|
{
|
2001-10-16 13:09:24 +00:00
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK:
|
2001-10-20 17:56:36 +00:00
|
|
|
s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
|
2001-10-16 13:09:24 +00:00
|
|
|
return 1;
|
|
|
|
|
2000-02-20 23:43:02 +00:00
|
|
|
default:
|
|
|
|
return(s->method->ssl_callback_ctrl(s,cmd,fp));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2000-02-25 22:50:28 +00:00
|
|
|
struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->sessions;
|
|
|
|
}
|
|
|
|
|
2001-10-20 17:56:36 +00:00
|
|
|
long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
long l;
|
|
|
|
|
|
|
|
switch (cmd)
|
|
|
|
{
|
|
|
|
case SSL_CTRL_GET_READ_AHEAD:
|
|
|
|
return(ctx->read_ahead);
|
|
|
|
case SSL_CTRL_SET_READ_AHEAD:
|
|
|
|
l=ctx->read_ahead;
|
|
|
|
ctx->read_ahead=larg;
|
|
|
|
return(l);
|
2001-10-16 13:09:24 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
|
|
|
|
ctx->msg_callback_arg = parg;
|
|
|
|
return 1;
|
|
|
|
|
2001-09-11 13:08:51 +00:00
|
|
|
case SSL_CTRL_GET_MAX_CERT_LIST:
|
|
|
|
return(ctx->max_cert_list);
|
|
|
|
case SSL_CTRL_SET_MAX_CERT_LIST:
|
|
|
|
l=ctx->max_cert_list;
|
|
|
|
ctx->max_cert_list=larg;
|
|
|
|
return(l);
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SET_SESS_CACHE_SIZE:
|
|
|
|
l=ctx->session_cache_size;
|
|
|
|
ctx->session_cache_size=larg;
|
|
|
|
return(l);
|
|
|
|
case SSL_CTRL_GET_SESS_CACHE_SIZE:
|
|
|
|
return(ctx->session_cache_size);
|
|
|
|
case SSL_CTRL_SET_SESS_CACHE_MODE:
|
|
|
|
l=ctx->session_cache_mode;
|
|
|
|
ctx->session_cache_mode=larg;
|
|
|
|
return(l);
|
|
|
|
case SSL_CTRL_GET_SESS_CACHE_MODE:
|
|
|
|
return(ctx->session_cache_mode);
|
|
|
|
|
|
|
|
case SSL_CTRL_SESS_NUMBER:
|
|
|
|
return(ctx->sessions->num_items);
|
|
|
|
case SSL_CTRL_SESS_CONNECT:
|
|
|
|
return(ctx->stats.sess_connect);
|
|
|
|
case SSL_CTRL_SESS_CONNECT_GOOD:
|
|
|
|
return(ctx->stats.sess_connect_good);
|
|
|
|
case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
|
|
|
|
return(ctx->stats.sess_connect_renegotiate);
|
|
|
|
case SSL_CTRL_SESS_ACCEPT:
|
|
|
|
return(ctx->stats.sess_accept);
|
|
|
|
case SSL_CTRL_SESS_ACCEPT_GOOD:
|
|
|
|
return(ctx->stats.sess_accept_good);
|
|
|
|
case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
|
|
|
|
return(ctx->stats.sess_accept_renegotiate);
|
|
|
|
case SSL_CTRL_SESS_HIT:
|
|
|
|
return(ctx->stats.sess_hit);
|
|
|
|
case SSL_CTRL_SESS_CB_HIT:
|
|
|
|
return(ctx->stats.sess_cb_hit);
|
|
|
|
case SSL_CTRL_SESS_MISSES:
|
|
|
|
return(ctx->stats.sess_miss);
|
|
|
|
case SSL_CTRL_SESS_TIMEOUTS:
|
|
|
|
return(ctx->stats.sess_timeout);
|
|
|
|
case SSL_CTRL_SESS_CACHE_FULL:
|
|
|
|
return(ctx->stats.sess_cache_full);
|
|
|
|
case SSL_CTRL_OPTIONS:
|
|
|
|
return(ctx->options|=larg);
|
1999-07-02 13:55:32 +00:00
|
|
|
case SSL_CTRL_MODE:
|
|
|
|
return(ctx->mode|=larg);
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
default:
|
|
|
|
return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
2000-02-20 23:43:02 +00:00
|
|
|
long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
|
|
|
|
{
|
|
|
|
switch(cmd)
|
|
|
|
{
|
2001-10-16 13:09:24 +00:00
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK:
|
2001-10-20 17:56:36 +00:00
|
|
|
ctx->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
|
2001-10-16 13:09:24 +00:00
|
|
|
return 1;
|
|
|
|
|
2000-02-20 23:43:02 +00:00
|
|
|
default:
|
|
|
|
return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2000-06-01 02:36:58 +00:00
|
|
|
int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
long l;
|
|
|
|
|
|
|
|
l=a->id-b->id;
|
|
|
|
if (l == 0L)
|
|
|
|
return(0);
|
|
|
|
else
|
|
|
|
return((l > 0)?1:-1);
|
|
|
|
}
|
|
|
|
|
2000-06-01 02:36:58 +00:00
|
|
|
int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
|
|
|
|
const SSL_CIPHER * const *bp)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
long l;
|
|
|
|
|
|
|
|
l=(*ap)->id-(*bp)->id;
|
|
|
|
if (l == 0L)
|
|
|
|
return(0);
|
|
|
|
else
|
|
|
|
return((l > 0)?1:-1);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** return a STACK of the ciphers available for the SSL and in order of
|
1998-12-21 10:52:47 +00:00
|
|
|
* preference */
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2003-01-16 06:00:55 +00:00
|
|
|
if (s != NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2003-01-16 06:00:55 +00:00
|
|
|
if (s->cipher_list != NULL)
|
|
|
|
{
|
|
|
|
return(s->cipher_list);
|
|
|
|
}
|
|
|
|
else if ((s->ctx != NULL) &&
|
|
|
|
(s->ctx->cipher_list != NULL))
|
|
|
|
{
|
|
|
|
return(s->ctx->cipher_list);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** return a STACK of the ciphers available for the SSL and in order of
|
1998-12-21 10:52:47 +00:00
|
|
|
* algorithm id */
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2003-01-16 06:00:55 +00:00
|
|
|
if (s != NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
2003-01-16 06:00:55 +00:00
|
|
|
if (s->cipher_list_by_id != NULL)
|
|
|
|
{
|
|
|
|
return(s->cipher_list_by_id);
|
|
|
|
}
|
|
|
|
else if ((s->ctx != NULL) &&
|
|
|
|
(s->ctx->cipher_list_by_id != NULL))
|
|
|
|
{
|
|
|
|
return(s->ctx->cipher_list_by_id);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** The old interface to get the same thing as SSL_get_ciphers() */
|
1999-04-17 21:25:43 +00:00
|
|
|
const char *SSL_get_cipher_list(SSL *s,int n)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSL_CIPHER *c;
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
if (s == NULL) return(NULL);
|
|
|
|
sk=SSL_get_ciphers(s);
|
1999-04-12 17:23:57 +00:00
|
|
|
if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
|
1998-12-21 10:52:47 +00:00
|
|
|
return(NULL);
|
1999-04-12 17:23:57 +00:00
|
|
|
c=sk_SSL_CIPHER_value(sk,n);
|
1998-12-21 10:52:47 +00:00
|
|
|
if (c == NULL) return(NULL);
|
|
|
|
return(c->name);
|
|
|
|
}
|
|
|
|
|
2000-01-09 14:21:40 +00:00
|
|
|
/** specify the ciphers to be used by default by the SSL_CTX */
|
2000-01-22 03:17:06 +00:00
|
|
|
int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list,
|
|
|
|
&ctx->cipher_list_by_id,str);
|
|
|
|
/* XXXX */
|
|
|
|
return((sk == NULL)?0:1);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** specify the ciphers to be used by the SSL */
|
2000-01-22 03:17:06 +00:00
|
|
|
int SSL_set_cipher_list(SSL *s,const char *str)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list,
|
|
|
|
&s->cipher_list_by_id,str);
|
|
|
|
/* XXXX */
|
|
|
|
return((sk == NULL)?0:1);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* works well for SSLv2, not so good for SSLv3 */
|
1999-02-28 12:41:50 +00:00
|
|
|
char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-17 21:25:43 +00:00
|
|
|
char *p;
|
|
|
|
const char *cp;
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
SSL_CIPHER *c;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if ((s->session == NULL) || (s->session->ciphers == NULL) ||
|
|
|
|
(len < 2))
|
|
|
|
return(NULL);
|
|
|
|
|
|
|
|
p=buf;
|
|
|
|
sk=s->session->ciphers;
|
1999-04-12 17:23:57 +00:00
|
|
|
for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Decrement for either the ':' or a '\0' */
|
|
|
|
len--;
|
1999-04-12 17:23:57 +00:00
|
|
|
c=sk_SSL_CIPHER_value(sk,i);
|
1998-12-21 10:52:47 +00:00
|
|
|
for (cp=c->name; *cp; )
|
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
if (len-- == 0)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
*p='\0';
|
|
|
|
return(buf);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
*(p++)= *(cp++);
|
|
|
|
}
|
|
|
|
*(p++)=':';
|
|
|
|
}
|
|
|
|
p[-1]='\0';
|
|
|
|
return(buf);
|
|
|
|
}
|
|
|
|
|
1999-04-12 17:23:57 +00:00
|
|
|
int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int i,j=0;
|
|
|
|
SSL_CIPHER *c;
|
|
|
|
unsigned char *q;
|
2001-07-11 19:03:58 +00:00
|
|
|
#ifndef OPENSSL_NO_KRB5
|
|
|
|
int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx);
|
|
|
|
#endif /* OPENSSL_NO_KRB5 */
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
if (sk == NULL) return(0);
|
|
|
|
q=p;
|
|
|
|
|
1999-04-12 17:23:57 +00:00
|
|
|
for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
c=sk_SSL_CIPHER_value(sk,i);
|
2001-07-11 19:03:58 +00:00
|
|
|
#ifndef OPENSSL_NO_KRB5
|
|
|
|
if ((c->algorithms & SSL_KRB5) && nokrb5)
|
|
|
|
continue;
|
|
|
|
#endif /* OPENSSL_NO_KRB5 */
|
1998-12-21 10:52:47 +00:00
|
|
|
j=ssl_put_cipher_by_char(s,c,p);
|
|
|
|
p+=j;
|
|
|
|
}
|
|
|
|
return(p-q);
|
|
|
|
}
|
|
|
|
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
|
|
|
|
STACK_OF(SSL_CIPHER) **skp)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSL_CIPHER *c;
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
int i,n;
|
|
|
|
|
|
|
|
n=ssl_put_cipher_by_char(s,NULL,NULL);
|
|
|
|
if ((num%n) != 0)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
if ((skp == NULL) || (*skp == NULL))
|
2000-09-17 18:21:27 +00:00
|
|
|
sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
|
1998-12-21 10:52:47 +00:00
|
|
|
else
|
|
|
|
{
|
|
|
|
sk= *skp;
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_SSL_CIPHER_zero(sk);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for (i=0; i<num; i+=n)
|
|
|
|
{
|
|
|
|
c=ssl_get_cipher_by_char(s,p);
|
|
|
|
p+=n;
|
|
|
|
if (c != NULL)
|
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
if (!sk_SSL_CIPHER_push(sk,c))
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (skp != NULL)
|
|
|
|
*skp=sk;
|
|
|
|
return(sk);
|
|
|
|
err:
|
|
|
|
if ((skp == NULL) || (*skp == NULL))
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_SSL_CIPHER_free(sk);
|
1998-12-21 10:52:47 +00:00
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
unsigned long SSL_SESSION_hash(SSL_SESSION *a)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
unsigned long l;
|
|
|
|
|
1998-12-21 11:00:56 +00:00
|
|
|
l=(unsigned long)
|
|
|
|
((unsigned int) a->session_id[0] )|
|
|
|
|
((unsigned int) a->session_id[1]<< 8L)|
|
|
|
|
((unsigned long)a->session_id[2]<<16L)|
|
|
|
|
((unsigned long)a->session_id[3]<<24L);
|
1998-12-21 10:52:47 +00:00
|
|
|
return(l);
|
|
|
|
}
|
|
|
|
|
2001-02-21 18:06:26 +00:00
|
|
|
/* NB: If this function (or indeed the hash function which uses a sort of
|
|
|
|
* coarser function than this one) is changed, ensure
|
|
|
|
* SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being
|
|
|
|
* able to construct an SSL_SESSION that will collide with any existing session
|
|
|
|
* with a matching session ID. */
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_SESSION_cmp(SSL_SESSION *a,SSL_SESSION *b)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
if (a->ssl_version != b->ssl_version)
|
|
|
|
return(1);
|
|
|
|
if (a->session_id_length != b->session_id_length)
|
|
|
|
return(1);
|
|
|
|
return(memcmp(a->session_id,b->session_id,a->session_id_length));
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
2000-12-08 20:02:01 +00:00
|
|
|
/* These wrapper functions should remain rather than redeclaring
|
|
|
|
* SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
|
|
|
|
* variable. The reason is that the functions aren't static, they're exposed via
|
|
|
|
* ssl.h. */
|
2000-12-04 03:02:44 +00:00
|
|
|
static IMPLEMENT_LHASH_HASH_FN(SSL_SESSION_hash, SSL_SESSION *)
|
|
|
|
static IMPLEMENT_LHASH_COMP_FN(SSL_SESSION_cmp, SSL_SESSION *)
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 11:00:56 +00:00
|
|
|
SSL_CTX *ret=NULL;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
if (meth == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED);
|
|
|
|
return(NULL);
|
|
|
|
}
|
1998-12-21 11:00:56 +00:00
|
|
|
|
|
|
|
if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
|
|
|
|
goto err;
|
|
|
|
}
|
2000-06-01 22:19:21 +00:00
|
|
|
ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX));
|
1998-12-21 10:52:47 +00:00
|
|
|
if (ret == NULL)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
memset(ret,0,sizeof(SSL_CTX));
|
|
|
|
|
|
|
|
ret->method=meth;
|
|
|
|
|
|
|
|
ret->cert_store=NULL;
|
|
|
|
ret->session_cache_mode=SSL_SESS_CACHE_SERVER;
|
1998-12-21 10:56:39 +00:00
|
|
|
ret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
|
|
|
|
ret->session_cache_head=NULL;
|
|
|
|
ret->session_cache_tail=NULL;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
/* We take the system default */
|
|
|
|
ret->session_timeout=meth->get_timeout();
|
|
|
|
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->new_session_cb=0;
|
|
|
|
ret->remove_session_cb=0;
|
|
|
|
ret->get_session_cb=0;
|
|
|
|
ret->generate_session_id=0;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
memset((char *)&ret->stats,0,sizeof(ret->stats));
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
ret->references=1;
|
|
|
|
ret->quiet_shutdown=0;
|
|
|
|
|
|
|
|
/* ret->cipher=NULL;*/
|
|
|
|
/* ret->s2->challenge=NULL;
|
|
|
|
ret->master_key=NULL;
|
|
|
|
ret->key_arg=NULL;
|
|
|
|
ret->s2->conn_id=NULL; */
|
|
|
|
|
2002-01-12 15:56:13 +00:00
|
|
|
ret->info_callback=NULL;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->app_verify_callback=0;
|
1998-12-21 10:52:47 +00:00
|
|
|
ret->app_verify_arg=NULL;
|
|
|
|
|
2001-09-11 13:08:51 +00:00
|
|
|
ret->max_cert_list=SSL_MAX_CERT_LIST_DEFAULT;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
ret->read_ahead=0;
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->msg_callback=0;
|
|
|
|
ret->msg_callback_arg=NULL;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
ret->verify_mode=SSL_VERIFY_NONE;
|
1999-05-01 03:20:40 +00:00
|
|
|
ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->sid_ctx_length=0;
|
1998-12-21 10:52:47 +00:00
|
|
|
ret->default_verify_callback=NULL;
|
1999-05-09 20:12:44 +00:00
|
|
|
if ((ret->cert=ssl_cert_new()) == NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
goto err;
|
|
|
|
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->default_passwd_callback=0;
|
1999-07-21 20:57:16 +00:00
|
|
|
ret->default_passwd_callback_userdata=NULL;
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->client_cert_cb=0;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2000-12-04 03:02:44 +00:00
|
|
|
ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
|
|
|
|
LHASH_COMP_FN(SSL_SESSION_cmp));
|
1998-12-21 10:52:47 +00:00
|
|
|
if (ret->sessions == NULL) goto err;
|
|
|
|
ret->cert_store=X509_STORE_new();
|
|
|
|
if (ret->cert_store == NULL) goto err;
|
|
|
|
|
|
|
|
ssl_create_cipher_list(ret->method,
|
|
|
|
&ret->cipher_list,&ret->cipher_list_by_id,
|
|
|
|
SSL_DEFAULT_CIPHER_LIST);
|
1999-04-12 17:23:57 +00:00
|
|
|
if (ret->cipher_list == NULL
|
|
|
|
|| sk_SSL_CIPHER_num(ret->cipher_list) <= 0)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
if ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
if ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL)
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
|
1999-04-12 17:23:57 +00:00
|
|
|
if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
goto err;
|
|
|
|
|
2001-09-01 20:02:13 +00:00
|
|
|
CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1998-12-21 11:00:56 +00:00
|
|
|
ret->extra_certs=NULL;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
ret->comp_methods=SSL_COMP_get_compression_methods();
|
1998-12-21 11:00:56 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
return(ret);
|
|
|
|
err:
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
|
|
|
|
err2:
|
|
|
|
if (ret != NULL) SSL_CTX_free(ret);
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
2000-12-02 07:20:47 +00:00
|
|
|
#if 0
|
1999-04-12 17:23:57 +00:00
|
|
|
static void SSL_COMP_free(SSL_COMP *comp)
|
2000-06-01 22:19:21 +00:00
|
|
|
{ OPENSSL_free(comp); }
|
2000-12-02 07:20:47 +00:00
|
|
|
#endif
|
1999-04-12 17:23:57 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_CTX_free(SSL_CTX *a)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (a == NULL) return;
|
|
|
|
|
|
|
|
i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX);
|
1998-12-21 10:56:39 +00:00
|
|
|
#ifdef REF_PRINT
|
|
|
|
REF_PRINT("SSL_CTX",a);
|
|
|
|
#endif
|
1998-12-21 10:52:47 +00:00
|
|
|
if (i > 0) return;
|
|
|
|
#ifdef REF_CHECK
|
|
|
|
if (i < 0)
|
|
|
|
{
|
|
|
|
fprintf(stderr,"SSL_CTX_free, bad reference count\n");
|
|
|
|
abort(); /* ok */
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2002-08-16 17:04:04 +00:00
|
|
|
/*
|
|
|
|
* Free internal session cache. However: the remove_cb() may reference
|
|
|
|
* the ex_data of SSL_CTX, thus the ex_data store can only be removed
|
|
|
|
* after the sessions were flushed.
|
|
|
|
* As the ex_data handling routines might also touch the session cache,
|
|
|
|
* the most secure solution seems to be: empty (flush) the cache, then
|
|
|
|
* free ex_data, then finally free the cache.
|
|
|
|
* (See ticket [openssl.org #212].)
|
|
|
|
*/
|
1998-12-21 10:52:47 +00:00
|
|
|
if (a->sessions != NULL)
|
|
|
|
SSL_CTX_flush_sessions(a,0);
|
2002-08-16 17:04:04 +00:00
|
|
|
|
|
|
|
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
|
|
|
|
|
|
|
|
if (a->sessions != NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
lh_free(a->sessions);
|
2002-08-16 17:04:04 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (a->cert_store != NULL)
|
|
|
|
X509_STORE_free(a->cert_store);
|
|
|
|
if (a->cipher_list != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_SSL_CIPHER_free(a->cipher_list);
|
1998-12-21 10:52:47 +00:00
|
|
|
if (a->cipher_list_by_id != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_SSL_CIPHER_free(a->cipher_list_by_id);
|
1999-05-09 20:12:44 +00:00
|
|
|
if (a->cert != NULL)
|
|
|
|
ssl_cert_free(a->cert);
|
1998-12-21 10:52:47 +00:00
|
|
|
if (a->client_CA != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free);
|
1998-12-21 11:00:56 +00:00
|
|
|
if (a->extra_certs != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_X509_pop_free(a->extra_certs,X509_free);
|
2000-11-30 12:21:33 +00:00
|
|
|
#if 0 /* This should never be done, since it removes a global database */
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
if (a->comp_methods != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);
|
2000-11-30 12:21:33 +00:00
|
|
|
#else
|
|
|
|
a->comp_methods = NULL;
|
|
|
|
#endif
|
2000-06-01 22:19:21 +00:00
|
|
|
OPENSSL_free(a);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-05-14 11:52:49 +00:00
|
|
|
void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
ctx->default_passwd_callback=cb;
|
|
|
|
}
|
|
|
|
|
1999-07-21 20:57:16 +00:00
|
|
|
void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u)
|
|
|
|
{
|
|
|
|
ctx->default_passwd_callback_userdata=u;
|
|
|
|
}
|
|
|
|
|
2002-02-28 10:52:56 +00:00
|
|
|
void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *,void *), void *arg)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
ctx->app_verify_callback=cb;
|
2002-02-28 10:52:56 +00:00
|
|
|
ctx->app_verify_arg=arg;
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *))
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
ctx->verify_mode=mode;
|
1998-12-21 10:52:47 +00:00
|
|
|
ctx->default_verify_callback=cb;
|
|
|
|
}
|
|
|
|
|
1999-05-01 03:20:40 +00:00
|
|
|
void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth)
|
|
|
|
{
|
|
|
|
ctx->verify_depth=depth;
|
|
|
|
}
|
|
|
|
|
1999-05-09 20:12:44 +00:00
|
|
|
void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
CERT_PKEY *cpk;
|
|
|
|
int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign;
|
|
|
|
int rsa_enc_export,dh_rsa_export,dh_dsa_export;
|
1999-02-21 21:58:59 +00:00
|
|
|
int rsa_tmp_export,dh_tmp_export,kl;
|
1998-12-21 10:52:47 +00:00
|
|
|
unsigned long mask,emask;
|
2002-08-09 08:56:08 +00:00
|
|
|
int have_ecc_cert, have_ecdh_tmp, ecdh_ok, ecdsa_ok, ecc_pkey_size;
|
|
|
|
X509 *x = NULL;
|
|
|
|
EVP_PKEY *ecc_pkey = NULL;
|
|
|
|
int signature_nid = 0;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-03-06 14:09:36 +00:00
|
|
|
if (c == NULL) return;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-21 21:58:59 +00:00
|
|
|
kl=SSL_C_EXPORT_PKEYLENGTH(cipher);
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_RSA
|
1999-05-09 20:12:44 +00:00
|
|
|
rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL);
|
|
|
|
rsa_tmp_export=(c->rsa_tmp_cb != NULL ||
|
1999-02-21 21:58:59 +00:00
|
|
|
(rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl));
|
1998-12-21 10:52:47 +00:00
|
|
|
#else
|
|
|
|
rsa_tmp=rsa_tmp_export=0;
|
|
|
|
#endif
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_DH
|
1999-05-09 20:12:44 +00:00
|
|
|
dh_tmp=(c->dh_tmp != NULL || c->dh_tmp_cb != NULL);
|
|
|
|
dh_tmp_export=(c->dh_tmp_cb != NULL ||
|
1999-02-21 21:58:59 +00:00
|
|
|
(dh_tmp && DH_size(c->dh_tmp)*8 <= kl));
|
1998-12-21 10:52:47 +00:00
|
|
|
#else
|
|
|
|
dh_tmp=dh_tmp_export=0;
|
|
|
|
#endif
|
|
|
|
|
2002-08-09 08:56:08 +00:00
|
|
|
#ifndef OPENSSL_NO_ECDH
|
|
|
|
have_ecdh_tmp=(c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL);
|
|
|
|
#endif
|
1998-12-21 10:52:47 +00:00
|
|
|
cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]);
|
1999-02-21 21:58:59 +00:00
|
|
|
rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL);
|
|
|
|
rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
|
1998-12-21 10:52:47 +00:00
|
|
|
cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]);
|
1999-02-21 21:58:59 +00:00
|
|
|
rsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL);
|
1998-12-21 10:52:47 +00:00
|
|
|
cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]);
|
1999-02-21 21:58:59 +00:00
|
|
|
dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL);
|
1998-12-21 10:52:47 +00:00
|
|
|
cpk= &(c->pkeys[SSL_PKEY_DH_RSA]);
|
1999-02-21 21:58:59 +00:00
|
|
|
dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL);
|
|
|
|
dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
|
1998-12-21 10:52:47 +00:00
|
|
|
cpk= &(c->pkeys[SSL_PKEY_DH_DSA]);
|
|
|
|
/* FIX THIS EAY EAY EAY */
|
1999-02-21 21:58:59 +00:00
|
|
|
dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL);
|
|
|
|
dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
|
2002-08-09 08:56:08 +00:00
|
|
|
cpk= &(c->pkeys[SSL_PKEY_ECC]);
|
|
|
|
have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL);
|
1998-12-21 10:52:47 +00:00
|
|
|
mask=0;
|
|
|
|
emask=0;
|
|
|
|
|
|
|
|
#ifdef CIPHER_DEBUG
|
1999-03-06 14:09:36 +00:00
|
|
|
printf("rt=%d rte=%d dht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
|
|
|
|
rsa_tmp,rsa_tmp_export,dh_tmp,
|
|
|
|
rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa);
|
1998-12-21 10:52:47 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
if (rsa_enc || (rsa_tmp && rsa_sign))
|
|
|
|
mask|=SSL_kRSA;
|
1999-03-06 14:09:36 +00:00
|
|
|
if (rsa_enc_export || (rsa_tmp_export && (rsa_sign || rsa_enc)))
|
1998-12-21 10:52:47 +00:00
|
|
|
emask|=SSL_kRSA;
|
|
|
|
|
|
|
|
#if 0
|
|
|
|
/* The match needs to be both kEDH and aRSA or aDSA, so don't worry */
|
|
|
|
if ( (dh_tmp || dh_rsa || dh_dsa) &&
|
|
|
|
(rsa_enc || rsa_sign || dsa_sign))
|
|
|
|
mask|=SSL_kEDH;
|
|
|
|
if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) &&
|
|
|
|
(rsa_enc || rsa_sign || dsa_sign))
|
|
|
|
emask|=SSL_kEDH;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
if (dh_tmp_export)
|
|
|
|
emask|=SSL_kEDH;
|
|
|
|
|
|
|
|
if (dh_tmp)
|
|
|
|
mask|=SSL_kEDH;
|
|
|
|
|
|
|
|
if (dh_rsa) mask|=SSL_kDHr;
|
|
|
|
if (dh_rsa_export) emask|=SSL_kDHr;
|
|
|
|
|
|
|
|
if (dh_dsa) mask|=SSL_kDHd;
|
|
|
|
if (dh_dsa_export) emask|=SSL_kDHd;
|
|
|
|
|
|
|
|
if (rsa_enc || rsa_sign)
|
|
|
|
{
|
|
|
|
mask|=SSL_aRSA;
|
2002-08-09 08:56:08 +00:00
|
|
|
mask|=SSL_aRSA;
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (dsa_sign)
|
|
|
|
{
|
|
|
|
mask|=SSL_aDSS;
|
|
|
|
emask|=SSL_aDSS;
|
|
|
|
}
|
|
|
|
|
|
|
|
mask|=SSL_aNULL;
|
|
|
|
emask|=SSL_aNULL;
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_KRB5
|
2000-11-30 22:53:34 +00:00
|
|
|
mask|=SSL_kKRB5|SSL_aKRB5;
|
|
|
|
emask|=SSL_kKRB5|SSL_aKRB5;
|
|
|
|
#endif
|
|
|
|
|
2002-08-09 08:56:08 +00:00
|
|
|
/* An ECC certificate may be usable for ECDH and/or
|
|
|
|
* ECDSA cipher suites depending on the key usage extension.
|
|
|
|
*/
|
|
|
|
if (have_ecc_cert)
|
|
|
|
{
|
|
|
|
/* This call populates extension flags (ex_flags) */
|
|
|
|
x = (c->pkeys[SSL_PKEY_ECC]).x509;
|
|
|
|
X509_check_purpose(x, -1, 0);
|
|
|
|
ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
|
|
|
|
(x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1;
|
|
|
|
ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
|
|
|
|
(x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1;
|
|
|
|
ecc_pkey = X509_get_pubkey(x);
|
|
|
|
ecc_pkey_size = (ecc_pkey != NULL) ?
|
|
|
|
EVP_PKEY_bits(ecc_pkey) : 0;
|
|
|
|
EVP_PKEY_free(ecc_pkey);
|
|
|
|
if ((x->sig_alg) && (x->sig_alg->algorithm))
|
|
|
|
signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
|
|
|
|
#ifndef OPENSSL_NO_ECDH
|
|
|
|
if (ecdh_ok)
|
|
|
|
{
|
|
|
|
if ((signature_nid == NID_md5WithRSAEncryption) ||
|
|
|
|
(signature_nid == NID_md4WithRSAEncryption) ||
|
|
|
|
(signature_nid == NID_md2WithRSAEncryption))
|
|
|
|
{
|
|
|
|
mask|=SSL_kECDH|SSL_aRSA;
|
|
|
|
if (ecc_pkey_size <= 163)
|
|
|
|
emask|=SSL_kECDH|SSL_aRSA;
|
|
|
|
}
|
|
|
|
if (signature_nid == NID_ecdsa_with_SHA1)
|
|
|
|
{
|
|
|
|
mask|=SSL_kECDH|SSL_aECDSA;
|
|
|
|
if (ecc_pkey_size <= 163)
|
|
|
|
emask|=SSL_kECDH|SSL_aECDSA;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#ifndef OPENSSL_NO_ECDSA
|
|
|
|
if (ecdsa_ok)
|
|
|
|
{
|
|
|
|
mask|=SSL_aECDSA;
|
|
|
|
emask|=SSL_aECDSA;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifndef OPENSSL_NO_ECDH
|
|
|
|
if (have_ecdh_tmp)
|
|
|
|
{
|
|
|
|
mask|=SSL_kECDHE;
|
|
|
|
emask|=SSL_kECDHE;
|
|
|
|
}
|
|
|
|
#endif
|
1998-12-21 10:52:47 +00:00
|
|
|
c->mask=mask;
|
|
|
|
c->export_mask=emask;
|
|
|
|
c->valid=1;
|
|
|
|
}
|
|
|
|
|
2002-08-09 08:56:08 +00:00
|
|
|
/* This handy macro borrowed from crypto/x509v3/v3_purp.c */
|
|
|
|
#define ku_reject(x, usage) \
|
|
|
|
(((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
|
|
|
|
|
|
|
|
int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
|
|
|
|
{
|
|
|
|
unsigned long alg = cs->algorithms;
|
|
|
|
EVP_PKEY *pkey = NULL;
|
|
|
|
int keysize = 0;
|
|
|
|
int signature_nid = 0;
|
|
|
|
|
|
|
|
if (SSL_C_IS_EXPORT(cs))
|
|
|
|
{
|
|
|
|
/* ECDH key length in export ciphers must be <= 163 bits */
|
|
|
|
pkey = X509_get_pubkey(x);
|
|
|
|
if (pkey == NULL) return 0;
|
|
|
|
keysize = EVP_PKEY_bits(pkey);
|
|
|
|
EVP_PKEY_free(pkey);
|
|
|
|
if (keysize > 163) return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* This call populates the ex_flags field correctly */
|
|
|
|
X509_check_purpose(x, -1, 0);
|
|
|
|
if ((x->sig_alg) && (x->sig_alg->algorithm))
|
|
|
|
signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
|
|
|
|
if (alg & SSL_kECDH)
|
|
|
|
{
|
|
|
|
/* key usage, if present, must allow key agreement */
|
|
|
|
if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (alg & SSL_aECDSA)
|
|
|
|
{
|
|
|
|
/* signature alg must be ECDSA */
|
|
|
|
if (signature_nid != NID_ecdsa_with_SHA1)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (alg & SSL_aRSA)
|
|
|
|
{
|
|
|
|
/* signature alg must be RSA */
|
|
|
|
if ((signature_nid != NID_md5WithRSAEncryption) &&
|
|
|
|
(signature_nid != NID_md4WithRSAEncryption) &&
|
|
|
|
(signature_nid != NID_md2WithRSAEncryption))
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else if (alg & SSL_aECDSA)
|
|
|
|
{
|
|
|
|
/* key usage, if present, must allow signing */
|
|
|
|
if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1; /* all checks are ok */
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
/* THIS NEEDS CLEANING UP */
|
1999-02-28 12:41:50 +00:00
|
|
|
X509 *ssl_get_server_send_cert(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
unsigned long alg,mask,kalg;
|
|
|
|
CERT *c;
|
1999-06-09 16:33:18 +00:00
|
|
|
int i,is_export;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
c=s->cert;
|
1999-05-09 20:12:44 +00:00
|
|
|
ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
|
1998-12-21 10:52:47 +00:00
|
|
|
alg=s->s3->tmp.new_cipher->algorithms;
|
2000-01-22 03:17:06 +00:00
|
|
|
is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
|
1999-06-09 16:33:18 +00:00
|
|
|
mask=is_export?c->export_mask:c->mask;
|
1998-12-21 10:52:47 +00:00
|
|
|
kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
|
|
|
|
|
2002-08-09 08:56:08 +00:00
|
|
|
if (kalg & SSL_kECDH)
|
|
|
|
{
|
|
|
|
/* we don't need to look at SSL_kECDHE
|
|
|
|
* since no certificate is needed for
|
|
|
|
* anon ECDH and for authenticated
|
|
|
|
* ECDHE, the check for the auth
|
|
|
|
* algorithm will set i correctly
|
|
|
|
* NOTE: For ECDH-RSA, we need an ECC
|
|
|
|
* not an RSA cert but for ECDHE-RSA
|
|
|
|
* we need an RSA cert. Placing the
|
|
|
|
* checks for SSL_kECDH before RSA
|
|
|
|
* checks ensures the correct cert is chosen.
|
|
|
|
*/
|
|
|
|
i=SSL_PKEY_ECC;
|
|
|
|
}
|
|
|
|
else if (kalg & SSL_aECDSA)
|
|
|
|
{
|
|
|
|
i=SSL_PKEY_ECC;
|
|
|
|
}
|
|
|
|
else if (kalg & SSL_kDHr)
|
1998-12-21 10:52:47 +00:00
|
|
|
i=SSL_PKEY_DH_RSA;
|
|
|
|
else if (kalg & SSL_kDHd)
|
|
|
|
i=SSL_PKEY_DH_DSA;
|
|
|
|
else if (kalg & SSL_aDSS)
|
|
|
|
i=SSL_PKEY_DSA_SIGN;
|
|
|
|
else if (kalg & SSL_aRSA)
|
|
|
|
{
|
|
|
|
if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL)
|
|
|
|
i=SSL_PKEY_RSA_SIGN;
|
|
|
|
else
|
|
|
|
i=SSL_PKEY_RSA_ENC;
|
|
|
|
}
|
2000-11-30 22:53:34 +00:00
|
|
|
else if (kalg & SSL_aKRB5)
|
|
|
|
{
|
|
|
|
/* VRS something else here? */
|
|
|
|
return(NULL);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
else /* if (kalg & SSL_aNULL) */
|
|
|
|
{
|
2001-03-07 01:19:07 +00:00
|
|
|
SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,ERR_R_INTERNAL_ERROR);
|
1998-12-21 10:52:47 +00:00
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
if (c->pkeys[i].x509 == NULL) return(NULL);
|
2002-08-09 08:56:08 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
return(c->pkeys[i].x509);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
unsigned long alg;
|
|
|
|
CERT *c;
|
|
|
|
|
|
|
|
alg=cipher->algorithms;
|
|
|
|
c=s->cert;
|
|
|
|
|
|
|
|
if ((alg & SSL_aDSS) &&
|
|
|
|
(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL))
|
|
|
|
return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey);
|
|
|
|
else if (alg & SSL_aRSA)
|
|
|
|
{
|
|
|
|
if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL)
|
|
|
|
return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey);
|
|
|
|
else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL)
|
|
|
|
return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey);
|
|
|
|
else
|
|
|
|
return(NULL);
|
|
|
|
}
|
2002-08-09 08:56:08 +00:00
|
|
|
else if ((alg & SSL_aECDSA) &&
|
|
|
|
(c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
|
|
|
|
return(c->pkeys[SSL_PKEY_ECC].privatekey);
|
1998-12-21 10:52:47 +00:00
|
|
|
else /* if (alg & SSL_aNULL) */
|
|
|
|
{
|
2001-03-07 01:19:07 +00:00
|
|
|
SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR);
|
1998-12-21 10:52:47 +00:00
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void ssl_update_cache(SSL *s,int mode)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
int i;
|
|
|
|
|
|
|
|
/* If the session_id_length is 0, we are not supposed to cache it,
|
|
|
|
* and it would be rather hard to do anyway :-) */
|
|
|
|
if (s->session->session_id_length == 0) return;
|
|
|
|
|
2002-02-08 15:15:04 +00:00
|
|
|
i=s->ctx->session_cache_mode;
|
|
|
|
if ((i & mode) && (!s->hit)
|
2002-10-29 00:33:04 +00:00
|
|
|
&& ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
|
2002-02-08 15:15:04 +00:00
|
|
|
|| SSL_CTX_add_session(s->ctx,s->session))
|
1998-12-21 10:52:47 +00:00
|
|
|
&& (s->ctx->new_session_cb != NULL))
|
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION);
|
1998-12-21 10:52:47 +00:00
|
|
|
if (!s->ctx->new_session_cb(s,s->session))
|
|
|
|
SSL_SESSION_free(s->session);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* auto flush every 255 connections */
|
1998-12-21 10:56:39 +00:00
|
|
|
if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) &&
|
|
|
|
((i & mode) == mode))
|
|
|
|
{
|
|
|
|
if ( (((mode & SSL_SESS_CACHE_CLIENT)
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
?s->ctx->stats.sess_connect_good
|
|
|
|
:s->ctx->stats.sess_accept_good) & 0xff) == 0xff)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
SSL_CTX_flush_sessions(s->ctx,time(NULL));
|
|
|
|
}
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL_METHOD *SSL_get_ssl_method(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
return(s->method);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int conn= -1;
|
|
|
|
int ret=1;
|
|
|
|
|
|
|
|
if (s->method != meth)
|
|
|
|
{
|
|
|
|
if (s->handshake_func != NULL)
|
|
|
|
conn=(s->handshake_func == s->method->ssl_connect);
|
|
|
|
|
|
|
|
if (s->method->version == meth->version)
|
|
|
|
s->method=meth;
|
|
|
|
else
|
|
|
|
{
|
|
|
|
s->method->ssl_free(s);
|
|
|
|
s->method=meth;
|
|
|
|
ret=s->method->ssl_new(s);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (conn == 1)
|
|
|
|
s->handshake_func=meth->ssl_connect;
|
|
|
|
else if (conn == 0)
|
|
|
|
s->handshake_func=meth->ssl_accept;
|
|
|
|
}
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_get_error(SSL *s,int i)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
int reason;
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
unsigned long l;
|
1998-12-21 10:52:47 +00:00
|
|
|
BIO *bio;
|
|
|
|
|
|
|
|
if (i > 0) return(SSL_ERROR_NONE);
|
|
|
|
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
/* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake
|
|
|
|
* etc, where we do encode the error */
|
|
|
|
if ((l=ERR_peek_error()) != 0)
|
|
|
|
{
|
|
|
|
if (ERR_GET_LIB(l) == ERR_LIB_SYS)
|
|
|
|
return(SSL_ERROR_SYSCALL);
|
|
|
|
else
|
|
|
|
return(SSL_ERROR_SSL);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
if ((i < 0) && SSL_want_read(s))
|
|
|
|
{
|
|
|
|
bio=SSL_get_rbio(s);
|
|
|
|
if (BIO_should_read(bio))
|
|
|
|
return(SSL_ERROR_WANT_READ);
|
|
|
|
else if (BIO_should_write(bio))
|
1999-06-07 12:49:47 +00:00
|
|
|
/* This one doesn't make too much sense ... We never try
|
|
|
|
* to write to the rbio, and an application program where
|
|
|
|
* rbio and wbio are separate couldn't even know what it
|
|
|
|
* should wait for.
|
|
|
|
* However if we ever set s->rwstate incorrectly
|
|
|
|
* (so that we have SSL_want_read(s) instead of
|
|
|
|
* SSL_want_write(s)) and rbio and wbio *are* the same,
|
|
|
|
* this test works around that bug; so it might be safer
|
|
|
|
* to keep it. */
|
1998-12-21 10:52:47 +00:00
|
|
|
return(SSL_ERROR_WANT_WRITE);
|
|
|
|
else if (BIO_should_io_special(bio))
|
|
|
|
{
|
|
|
|
reason=BIO_get_retry_reason(bio);
|
|
|
|
if (reason == BIO_RR_CONNECT)
|
|
|
|
return(SSL_ERROR_WANT_CONNECT);
|
2000-10-12 01:50:33 +00:00
|
|
|
else if (reason == BIO_RR_ACCEPT)
|
|
|
|
return(SSL_ERROR_WANT_ACCEPT);
|
1998-12-21 10:52:47 +00:00
|
|
|
else
|
|
|
|
return(SSL_ERROR_SYSCALL); /* unknown */
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((i < 0) && SSL_want_write(s))
|
|
|
|
{
|
|
|
|
bio=SSL_get_wbio(s);
|
|
|
|
if (BIO_should_write(bio))
|
|
|
|
return(SSL_ERROR_WANT_WRITE);
|
|
|
|
else if (BIO_should_read(bio))
|
1999-06-07 12:49:47 +00:00
|
|
|
/* See above (SSL_want_read(s) with BIO_should_write(bio)) */
|
1998-12-21 10:52:47 +00:00
|
|
|
return(SSL_ERROR_WANT_READ);
|
|
|
|
else if (BIO_should_io_special(bio))
|
|
|
|
{
|
|
|
|
reason=BIO_get_retry_reason(bio);
|
|
|
|
if (reason == BIO_RR_CONNECT)
|
|
|
|
return(SSL_ERROR_WANT_CONNECT);
|
2000-10-12 01:50:33 +00:00
|
|
|
else if (reason == BIO_RR_ACCEPT)
|
|
|
|
return(SSL_ERROR_WANT_ACCEPT);
|
1998-12-21 10:52:47 +00:00
|
|
|
else
|
|
|
|
return(SSL_ERROR_SYSCALL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ((i < 0) && SSL_want_x509_lookup(s))
|
|
|
|
{
|
|
|
|
return(SSL_ERROR_WANT_X509_LOOKUP);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (i == 0)
|
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
if (s->version == SSL2_VERSION)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
/* assume it is the socket being closed */
|
|
|
|
return(SSL_ERROR_ZERO_RETURN);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
|
1998-12-21 10:56:39 +00:00
|
|
|
(s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
|
1998-12-21 10:52:47 +00:00
|
|
|
return(SSL_ERROR_ZERO_RETURN);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return(SSL_ERROR_SYSCALL);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_do_handshake(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
int ret=1;
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (s->handshake_func == NULL)
|
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
SSLerr(SSL_F_SSL_DO_HANDSHAKE,SSL_R_CONNECTION_TYPE_NOT_SET);
|
1998-12-21 10:52:47 +00:00
|
|
|
return(-1);
|
|
|
|
}
|
1998-12-21 11:00:56 +00:00
|
|
|
|
|
|
|
s->method->ssl_renegotiate_check(s);
|
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
if (SSL_in_init(s) || SSL_in_before(s))
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
ret=s->handshake_func(s);
|
|
|
|
}
|
|
|
|
return(ret);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* For the next 2 functions, SSL_clear() sets shutdown and so
|
|
|
|
* one of these calls will reset it */
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_accept_state(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->server=1;
|
1998-12-21 10:52:47 +00:00
|
|
|
s->shutdown=0;
|
|
|
|
s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE;
|
|
|
|
s->handshake_func=s->method->ssl_accept;
|
|
|
|
/* clear the current cipher */
|
|
|
|
ssl_clear_cipher_ctx(s);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_connect_state(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
s->server=0;
|
1998-12-21 10:52:47 +00:00
|
|
|
s->shutdown=0;
|
|
|
|
s->state=SSL_ST_CONNECT|SSL_ST_BEFORE;
|
|
|
|
s->handshake_func=s->method->ssl_connect;
|
|
|
|
/* clear the current cipher */
|
|
|
|
ssl_clear_cipher_ctx(s);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int ssl_undefined_function(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL_METHOD *ssl_bad_method(int ver)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
2000-01-30 22:20:28 +00:00
|
|
|
const char *SSL_get_version(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
if (s->version == TLS1_VERSION)
|
|
|
|
return("TLSv1");
|
|
|
|
else if (s->version == SSL3_VERSION)
|
1998-12-21 10:52:47 +00:00
|
|
|
return("SSLv3");
|
1998-12-21 10:56:39 +00:00
|
|
|
else if (s->version == SSL2_VERSION)
|
1998-12-21 10:52:47 +00:00
|
|
|
return("SSLv2");
|
|
|
|
else
|
|
|
|
return("unknown");
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL *SSL_dup(SSL *s)
|
1999-05-13 10:32:04 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(X509_NAME) *sk;
|
1998-12-21 10:52:47 +00:00
|
|
|
X509_NAME *xn;
|
1999-06-07 20:26:51 +00:00
|
|
|
SSL *ret;
|
1998-12-21 10:52:47 +00:00
|
|
|
int i;
|
|
|
|
|
1999-03-22 12:22:14 +00:00
|
|
|
if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL)
|
|
|
|
return(NULL);
|
2001-10-16 13:09:24 +00:00
|
|
|
|
|
|
|
ret->version = s->version;
|
|
|
|
ret->type = s->type;
|
|
|
|
ret->method = s->method;
|
|
|
|
|
1999-05-13 10:32:04 +00:00
|
|
|
if (s->session != NULL)
|
|
|
|
{
|
|
|
|
/* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */
|
|
|
|
SSL_copy_session_id(ret,s);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* No session has been established yet, so we have to expect
|
|
|
|
* that s->cert or ret->cert will be changed later --
|
|
|
|
* they should not both point to the same object,
|
|
|
|
* and thus we can't use SSL_copy_session_id. */
|
|
|
|
|
2003-01-30 11:00:34 +00:00
|
|
|
ret->method->ssl_free(ret);
|
1999-05-13 10:32:04 +00:00
|
|
|
ret->method = s->method;
|
|
|
|
ret->method->ssl_new(ret);
|
|
|
|
|
|
|
|
if (s->cert != NULL)
|
|
|
|
{
|
2000-12-12 08:08:53 +00:00
|
|
|
if (ret->cert != NULL)
|
|
|
|
{
|
|
|
|
ssl_cert_free(ret->cert);
|
|
|
|
}
|
1999-05-13 10:32:04 +00:00
|
|
|
ret->cert = ssl_cert_dup(s->cert);
|
|
|
|
if (ret->cert == NULL)
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
|
|
|
SSL_set_session_id_context(ret,
|
|
|
|
s->sid_ctx, s->sid_ctx_length);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->options=s->options;
|
|
|
|
ret->mode=s->mode;
|
2001-09-11 13:08:51 +00:00
|
|
|
SSL_set_max_cert_list(ret,SSL_get_max_cert_list(s));
|
1998-12-21 10:52:47 +00:00
|
|
|
SSL_set_read_ahead(ret,SSL_get_read_ahead(s));
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->msg_callback = s->msg_callback;
|
|
|
|
ret->msg_callback_arg = s->msg_callback_arg;
|
1998-12-21 10:52:47 +00:00
|
|
|
SSL_set_verify(ret,SSL_get_verify_mode(s),
|
|
|
|
SSL_get_verify_callback(s));
|
1999-05-01 03:20:40 +00:00
|
|
|
SSL_set_verify_depth(ret,SSL_get_verify_depth(s));
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->generate_session_id = s->generate_session_id;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
SSL_set_info_callback(ret,SSL_get_info_callback(s));
|
|
|
|
|
|
|
|
ret->debug=s->debug;
|
|
|
|
|
|
|
|
/* copy app data, a little dangerous perhaps */
|
2001-09-01 20:02:13 +00:00
|
|
|
if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
|
1998-12-21 10:56:39 +00:00
|
|
|
goto err;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
/* setup rbio, and wbio */
|
|
|
|
if (s->rbio != NULL)
|
|
|
|
{
|
|
|
|
if (!BIO_dup_state(s->rbio,(char *)&ret->rbio))
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
if (s->wbio != NULL)
|
|
|
|
{
|
|
|
|
if (s->wbio != s->rbio)
|
|
|
|
{
|
1998-12-21 10:56:39 +00:00
|
|
|
if (!BIO_dup_state(s->wbio,(char *)&ret->wbio))
|
1998-12-21 10:52:47 +00:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
ret->wbio=ret->rbio;
|
|
|
|
}
|
2001-10-16 13:09:24 +00:00
|
|
|
ret->rwstate = s->rwstate;
|
|
|
|
ret->in_handshake = s->in_handshake;
|
|
|
|
ret->handshake_func = s->handshake_func;
|
|
|
|
ret->server = s->server;
|
|
|
|
ret->new_session = s->new_session;
|
|
|
|
ret->quiet_shutdown = s->quiet_shutdown;
|
|
|
|
ret->shutdown=s->shutdown;
|
|
|
|
ret->state=s->state; /* SSL_dup does not really work at any state, though */
|
|
|
|
ret->rstate=s->rstate;
|
|
|
|
ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */
|
|
|
|
ret->hit=s->hit;
|
|
|
|
ret->purpose=s->purpose;
|
|
|
|
ret->trust=s->trust;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
|
|
|
/* dup the cipher_list and cipher_list_by_id stacks */
|
|
|
|
if (s->cipher_list != NULL)
|
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
if ((ret->cipher_list=sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
if (s->cipher_list_by_id != NULL)
|
1999-04-12 17:23:57 +00:00
|
|
|
if ((ret->cipher_list_by_id=sk_SSL_CIPHER_dup(s->cipher_list_by_id))
|
1998-12-21 10:52:47 +00:00
|
|
|
== NULL)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
/* Dup the client_CA list */
|
|
|
|
if (s->client_CA != NULL)
|
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
if ((sk=sk_X509_NAME_dup(s->client_CA)) == NULL) goto err;
|
1998-12-21 10:52:47 +00:00
|
|
|
ret->client_CA=sk;
|
1999-04-12 17:23:57 +00:00
|
|
|
for (i=0; i<sk_X509_NAME_num(sk); i++)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-04-12 17:23:57 +00:00
|
|
|
xn=sk_X509_NAME_value(sk,i);
|
|
|
|
if (sk_X509_NAME_set(sk,i,X509_NAME_dup(xn)) == NULL)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
X509_NAME_free(xn);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (0)
|
|
|
|
{
|
|
|
|
err:
|
|
|
|
if (ret != NULL) SSL_free(ret);
|
|
|
|
ret=NULL;
|
|
|
|
}
|
|
|
|
return(ret);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void ssl_clear_cipher_ctx(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-05-13 10:32:04 +00:00
|
|
|
if (s->enc_read_ctx != NULL)
|
|
|
|
{
|
|
|
|
EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
|
2000-06-01 22:19:21 +00:00
|
|
|
OPENSSL_free(s->enc_read_ctx);
|
1999-05-13 10:32:04 +00:00
|
|
|
s->enc_read_ctx=NULL;
|
|
|
|
}
|
|
|
|
if (s->enc_write_ctx != NULL)
|
|
|
|
{
|
|
|
|
EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
|
2000-06-01 22:19:21 +00:00
|
|
|
OPENSSL_free(s->enc_write_ctx);
|
1999-05-13 10:32:04 +00:00
|
|
|
s->enc_write_ctx=NULL;
|
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
if (s->expand != NULL)
|
|
|
|
{
|
|
|
|
COMP_CTX_free(s->expand);
|
|
|
|
s->expand=NULL;
|
|
|
|
}
|
|
|
|
if (s->compress != NULL)
|
|
|
|
{
|
|
|
|
COMP_CTX_free(s->compress);
|
|
|
|
s->compress=NULL;
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Fix this function so that it takes an optional type parameter */
|
1999-02-28 12:41:50 +00:00
|
|
|
X509 *SSL_get_certificate(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
if (s->cert != NULL)
|
|
|
|
return(s->cert->key->x509);
|
|
|
|
else
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Fix this function so that it takes an optional type parameter */
|
1999-02-28 12:41:50 +00:00
|
|
|
EVP_PKEY *SSL_get_privatekey(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
|
|
|
if (s->cert != NULL)
|
|
|
|
return(s->cert->key->privatekey);
|
|
|
|
else
|
|
|
|
return(NULL);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL_CIPHER *SSL_get_current_cipher(SSL *s)
|
1998-12-21 10:52:47 +00:00
|
|
|
{
|
1999-06-07 20:26:51 +00:00
|
|
|
if ((s->session != NULL) && (s->session->cipher != NULL))
|
|
|
|
return(s->session->cipher);
|
|
|
|
return(NULL);
|
1998-12-21 10:52:47 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int ssl_init_wbio_buffer(SSL *s,int push)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
BIO *bbio;
|
|
|
|
|
|
|
|
if (s->bbio == NULL)
|
|
|
|
{
|
|
|
|
bbio=BIO_new(BIO_f_buffer());
|
|
|
|
if (bbio == NULL) return(0);
|
|
|
|
s->bbio=bbio;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
bbio=s->bbio;
|
|
|
|
if (s->bbio == s->wbio)
|
|
|
|
s->wbio=BIO_pop(s->wbio);
|
|
|
|
}
|
1999-06-10 16:29:32 +00:00
|
|
|
(void)BIO_reset(bbio);
|
1998-12-21 10:56:39 +00:00
|
|
|
/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */
|
|
|
|
if (!BIO_set_read_buffer_size(bbio,1))
|
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER,ERR_R_BUF_LIB);
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
if (push)
|
|
|
|
{
|
|
|
|
if (s->wbio != bbio)
|
|
|
|
s->wbio=BIO_push(bbio,s->wbio);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
if (s->wbio == bbio)
|
|
|
|
s->wbio=BIO_pop(bbio);
|
|
|
|
}
|
|
|
|
return(1);
|
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void ssl_free_wbio_buffer(SSL *s)
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
{
|
|
|
|
if (s->bbio == NULL) return;
|
|
|
|
|
|
|
|
if (s->bbio == s->wbio)
|
|
|
|
{
|
|
|
|
/* remove buffering */
|
2000-09-04 15:34:43 +00:00
|
|
|
s->wbio=BIO_pop(s->wbio);
|
|
|
|
#ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */
|
|
|
|
assert(s->wbio != NULL);
|
|
|
|
#endif
|
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
BIO_free(s->bbio);
|
|
|
|
s->bbio=NULL;
|
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
ctx->quiet_shutdown=mode;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_CTX_get_quiet_shutdown(SSL_CTX *ctx)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(ctx->quiet_shutdown);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_quiet_shutdown(SSL *s,int mode)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
s->quiet_shutdown=mode;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_get_quiet_shutdown(SSL *s)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(s->quiet_shutdown);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_shutdown(SSL *s,int mode)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
s->shutdown=mode;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_get_shutdown(SSL *s)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(s->shutdown);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_version(SSL *s)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(s->version);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL_CTX *SSL_get_SSL_CTX(SSL *ssl)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(ssl->ctx);
|
|
|
|
}
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_STDIO
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(X509_STORE_set_default_paths(ctx->cert_store));
|
|
|
|
}
|
|
|
|
|
1999-05-09 10:12:10 +00:00
|
|
|
int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
|
|
|
|
const char *CApath)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath));
|
|
|
|
}
|
1998-12-21 11:00:56 +00:00
|
|
|
#endif
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2002-01-12 15:56:13 +00:00
|
|
|
void SSL_set_info_callback(SSL *ssl,
|
|
|
|
void (*cb)(const SSL *ssl,int type,int val))
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
ssl->info_callback=cb;
|
|
|
|
}
|
|
|
|
|
2002-01-12 15:56:13 +00:00
|
|
|
void (*SSL_get_info_callback(SSL *ssl))(const SSL *ssl,int type,int val)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
2002-01-12 15:56:13 +00:00
|
|
|
return ssl->info_callback;
|
1998-12-21 10:56:39 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_state(SSL *ssl)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(ssl->state);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_verify_result(SSL *ssl,long arg)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
ssl->verify_result=arg;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
long SSL_get_verify_result(SSL *ssl)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(ssl->verify_result);
|
|
|
|
}
|
|
|
|
|
2000-01-23 23:41:49 +00:00
|
|
|
int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
|
|
|
|
CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
|
1999-06-07 20:26:51 +00:00
|
|
|
{
|
2001-09-01 20:02:13 +00:00
|
|
|
return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, argl, argp,
|
|
|
|
new_func, dup_func, free_func);
|
1999-06-07 20:26:51 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_set_ex_data(SSL *s,int idx,void *arg)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void *SSL_get_ex_data(SSL *s,int idx)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(CRYPTO_get_ex_data(&s->ex_data,idx));
|
|
|
|
}
|
|
|
|
|
2000-01-23 23:41:49 +00:00
|
|
|
int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
|
|
|
|
CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
|
1999-06-07 20:26:51 +00:00
|
|
|
{
|
2001-09-01 20:02:13 +00:00
|
|
|
return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, argl, argp,
|
|
|
|
new_func, dup_func, free_func);
|
1999-06-07 20:26:51 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_CTX_set_ex_data(SSL_CTX *s,int idx,void *arg)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void *SSL_CTX_get_ex_data(SSL_CTX *s,int idx)
|
1998-12-21 10:56:39 +00:00
|
|
|
{
|
|
|
|
return(CRYPTO_get_ex_data(&s->ex_data,idx));
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int ssl_ok(SSL *s)
|
1998-12-21 11:00:56 +00:00
|
|
|
{
|
|
|
|
return(1);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *ctx)
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
{
|
|
|
|
return(ctx->cert_store);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_CTX_set_cert_store(SSL_CTX *ctx,X509_STORE *store)
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
{
|
|
|
|
if (ctx->cert_store != NULL)
|
|
|
|
X509_STORE_free(ctx->cert_store);
|
|
|
|
ctx->cert_store=store;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_want(SSL *s)
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
{
|
|
|
|
return(s->rwstate);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/*!
|
|
|
|
* \brief Set the callback for generating temporary RSA keys.
|
|
|
|
* \param ctx the SSL context.
|
|
|
|
* \param cb the callback
|
|
|
|
*/
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_RSA
|
1999-06-09 16:33:18 +00:00
|
|
|
void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
|
|
|
|
int is_export,
|
1999-02-21 21:58:59 +00:00
|
|
|
int keylength))
|
2000-01-18 09:30:51 +00:00
|
|
|
{
|
2000-02-20 23:43:02 +00:00
|
|
|
SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
|
2000-01-18 09:30:51 +00:00
|
|
|
}
|
1999-04-27 03:19:12 +00:00
|
|
|
|
2000-02-20 23:43:02 +00:00
|
|
|
void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
|
|
|
|
int is_export,
|
|
|
|
int keylength))
|
2000-01-18 09:30:51 +00:00
|
|
|
{
|
2000-02-20 23:43:02 +00:00
|
|
|
SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
|
2000-01-18 09:30:51 +00:00
|
|
|
}
|
1999-04-27 03:19:12 +00:00
|
|
|
#endif
|
1999-01-06 22:53:34 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
#ifdef DOXYGEN
|
|
|
|
/*!
|
|
|
|
* \brief The RSA temporary key callback function.
|
|
|
|
* \param ssl the SSL session.
|
1999-06-09 16:33:18 +00:00
|
|
|
* \param is_export \c TRUE if the temp RSA key is for an export ciphersuite.
|
|
|
|
* \param keylength if \c is_export is \c TRUE, then \c keylength is the size
|
|
|
|
* of the required key in bits.
|
1999-02-28 12:41:50 +00:00
|
|
|
* \return the temporary RSA key.
|
|
|
|
* \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback
|
|
|
|
*/
|
|
|
|
|
1999-06-09 16:33:18 +00:00
|
|
|
RSA *cb(SSL *ssl,int is_export,int keylength)
|
1999-02-28 12:41:50 +00:00
|
|
|
{}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*!
|
|
|
|
* \brief Set the callback for generating temporary DH keys.
|
|
|
|
* \param ctx the SSL context.
|
|
|
|
* \param dh the callback
|
|
|
|
*/
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_DH
|
1999-06-09 16:33:18 +00:00
|
|
|
void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
|
1999-02-21 21:58:59 +00:00
|
|
|
int keylength))
|
2001-10-20 17:56:36 +00:00
|
|
|
{
|
|
|
|
SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
|
|
|
|
}
|
1999-01-06 22:53:34 +00:00
|
|
|
|
1999-06-09 16:33:18 +00:00
|
|
|
void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
|
2000-02-20 23:43:02 +00:00
|
|
|
int keylength))
|
2001-10-20 17:56:36 +00:00
|
|
|
{
|
|
|
|
SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
|
|
|
|
}
|
1999-04-27 03:19:12 +00:00
|
|
|
#endif
|
1999-02-25 14:40:29 +00:00
|
|
|
|
2002-08-09 08:56:08 +00:00
|
|
|
#ifndef OPENSSL_NO_ECDH
|
|
|
|
void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_export,
|
|
|
|
int keylength))
|
|
|
|
{
|
|
|
|
SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)())ecdh);
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export,
|
|
|
|
int keylength))
|
|
|
|
{
|
|
|
|
SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)())ecdh);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2001-10-20 17:56:36 +00:00
|
|
|
|
|
|
|
void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
|
|
|
|
{
|
|
|
|
SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)())cb);
|
|
|
|
}
|
|
|
|
void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
|
|
|
|
{
|
|
|
|
SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)())cb);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#if defined(_WINDLL) && defined(OPENSSL_SYS_WIN16)
|
1998-12-21 10:56:39 +00:00
|
|
|
#include "../crypto/bio/bss_file.c"
|
|
|
|
#endif
|
1999-04-12 17:23:57 +00:00
|
|
|
|
|
|
|
IMPLEMENT_STACK_OF(SSL_CIPHER)
|
|
|
|
IMPLEMENT_STACK_OF(SSL_COMP)
|