Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-04-15 18:45:34 +09:00
parent be29e7bcc6
commit 2015c00c43
573 changed files with 22943 additions and 6714 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssl/record/rec_layer_s3.c
+1
View File
@@ -771,6 +771,7 @@ int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
*/
SSL3_BUFFER_set_buf(&s->rlayer.wbuf[0], (unsigned char *)buf);
SSL3_BUFFER_set_offset(&s->rlayer.wbuf[0], 0);
SSL3_BUFFER_set_app_buffer(&s->rlayer.wbuf[0], 1);
goto wpacket_init_complete;
}
ssl/record/record.h
+2
View File
@@ -25,6 +25,8 @@ typedef struct ssl3_buffer_st {
size_t offset;
/* how many bytes left */
size_t left;
/* 'buf' is from application for KTLS */
int app_buffer;
} SSL3_BUFFER;
#define SEQ_NUM_SIZE 8
ssl/record/record_local.h
+2
View File
@@ -65,6 +65,8 @@ void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap);
#define SSL3_BUFFER_add_offset(b, o) ((b)->offset += (o))
#define SSL3_BUFFER_is_initialised(b) ((b)->buf != NULL)
#define SSL3_BUFFER_set_default_len(b, l) ((b)->default_len = (l))
#define SSL3_BUFFER_set_app_buffer(b, l) ((b)->app_buffer = (l))
#define SSL3_BUFFER_is_app_buffer(b) ((b)->app_buffer)
void SSL3_BUFFER_clear(SSL3_BUFFER *b);
void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, size_t n);
ssl/record/ssl3_buffer.c
+3 -1
View File
@@ -164,7 +164,9 @@ int ssl3_release_write_buffer(SSL *s)
while (pipes > 0) {
wb = &RECORD_LAYER_get_wbuf(&s->rlayer)[pipes - 1];
if (s->wbio == NULL || !BIO_get_ktls_send(s->wbio))
if (SSL3_BUFFER_is_app_buffer(wb))
SSL3_BUFFER_set_app_buffer(wb, 0);
else
OPENSSL_free(wb->buf);
wb->buf = NULL;
pipes--;
ssl/s3_lib.c
+52 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
* Copyright 2005 Nokia. All rights reserved.
*
@@ -17,6 +17,7 @@
#include <openssl/dh.h>
#include <openssl/rand.h>
#include <openssl/trace.h>
#include <openssl/x509v3.h>
#include "internal/cryptlib.h"
#define TLS13_NUM_CIPHERS OSSL_NELEM(tls13_ciphers)
@@ -2690,7 +2691,23 @@ static SSL_CIPHER ssl3_ciphers[] = {
},
{
1,
"GOST2012-GOST8912-GOST8912",
"IANA-GOST2012-GOST8912-GOST8912",
NULL,
0x0300c102,
SSL_kGOST,
SSL_aGOST12 | SSL_aGOST01,
SSL_eGOST2814789CNT12,
SSL_GOST89MAC12,
TLS1_VERSION, TLS1_2_VERSION,
0, 0,
SSL_HIGH,
SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
256,
256,
},
{
1,
"LEGACY-GOST2012-GOST8912-GOST8912",
NULL,
0x0300ff85,
SSL_kGOST,
@@ -3998,6 +4015,10 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
return 0;
}
}
if (!X509v3_cache_extensions((X509 *)parg, ctx->libctx, ctx->propq)) {
SSLerr(0, ERR_LIB_X509);
return 0;
}
if (!sk_X509_push(ctx->extra_certs, (X509 *)parg)) {
SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);
return 0;
@@ -4695,7 +4716,7 @@ int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
OPENSSL_clear_free(s->s3.tmp.psk, psklen);
s->s3.tmp.psk = NULL;
if (!s->method->ssl3_enc->generate_master_secret(s,
s->session->master_key,pskpms, pskpmslen,
s->session->master_key, pskpms, pskpmslen,
&s->session->master_key_length)) {
OPENSSL_clear_free(pskpms, pskpmslen);
/* SSLfatal() already called */
@@ -4776,19 +4797,33 @@ EVP_PKEY *ssl_generate_pkey_group(SSL *s, uint16_t id)
*/
# ifndef OPENSSL_NO_DH
if (gtype == TLS_GROUP_FFDHE)
# if 0
pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, "DH", s->ctx->propq);
# else
pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_DH, NULL);
# endif
# ifndef OPENSSL_NO_EC
else
# endif
# endif
# endif /* OPENSSL_NO_EC */
# endif /* OPENSSL_NO_DH */
# ifndef OPENSSL_NO_EC
{
/*
* TODO(3.0): When provider based EC key gen is present we can enable
* this code.
*/
if (gtype == TLS_GROUP_CURVE_CUSTOM)
pctx = EVP_PKEY_CTX_new_id(ginf->nid, NULL);
else
# if 0
pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, "EC",
s->ctx->propq);
# else
pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
# endif
}
# endif
# endif /* OPENSSL_NO_EC */
if (pctx == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
ERR_R_MALLOC_FAILURE);
@@ -4854,7 +4889,11 @@ EVP_PKEY *ssl_generate_param_group(SSL *s, uint16_t id)
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY *pkey = NULL;
const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(id);
#if 0
const char *pkey_ctx_name;
#else
int pkey_ctx_id;
#endif
if (ginf == NULL)
goto err;
@@ -4872,9 +4911,16 @@ EVP_PKEY *ssl_generate_param_group(SSL *s, uint16_t id)
* s->ctx->libctx and s->ctx->propq when paramgen has been updated to be
* provider aware.
*/
#if 0
pkey_ctx_name = (ginf->flags & TLS_GROUP_FFDHE) != 0 ? "DH" : "EC";
pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, pkey_ctx_name,
s->ctx->propq);
#else
pkey_ctx_id = (ginf->flags & TLS_GROUP_FFDHE)
? EVP_PKEY_DH : EVP_PKEY_EC;
pctx = EVP_PKEY_CTX_new_id(pkey_ctx_id, NULL);
#endif
if (pctx == NULL)
goto err;
if (EVP_PKEY_paramgen_init(pctx) <= 0)
ssl/ssl_cert.c
+13 -4
View File
@@ -253,11 +253,20 @@ void ssl_cert_free(CERT *c)
int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain)
{
int i, r;
CERT_PKEY *cpk = s ? s->cert->key : ctx->cert->key;
CERT_PKEY *cpk = s != NULL ? s->cert->key : ctx->cert->key;
SSL_CTX *realctx = s != NULL ? s->ctx : ctx;
if (!cpk)
return 0;
for (i = 0; i < sk_X509_num(chain); i++) {
r = ssl_security_cert(s, ctx, sk_X509_value(chain, i), 0, 0);
X509 *x = sk_X509_value(chain, i);
if (!X509v3_cache_extensions(x, realctx->libctx, realctx->propq)) {
SSLerr(0, ERR_LIB_X509);
return 0;
}
r = ssl_security_cert(s, ctx, x, 0, 0);
if (r != 1) {
SSLerr(SSL_F_SSL_CERT_SET0_CHAIN, r);
return 0;
@@ -377,7 +386,7 @@ int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
else
verify_store = s->ctx->cert_store;
ctx = X509_STORE_CTX_new();
ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);
if (ctx == NULL) {
SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_MALLOC_FAILURE);
return 0;
@@ -860,7 +869,7 @@ int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags)
untrusted = cpk->chain;
}
xs_ctx = X509_STORE_CTX_new();
xs_ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);
if (xs_ctx == NULL) {
SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, ERR_R_MALLOC_FAILURE);
goto err;
ssl/ssl_ciph.c
+3 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
* Copyright 2005 Nokia. All rights reserved.
*
@@ -281,6 +281,8 @@ static const SSL_CIPHER cipher_aliases[] = {
{0, SSL_TXT_CHACHA20, NULL, 0, 0, 0, SSL_CHACHA20},
{0, SSL_TXT_CHACHA20_D, NULL, 0, 0, 0, SSL_CHACHA20POLY1305_D},
{0, SSL_TXT_GOST2012_GOST8912_GOST8912, NULL, 0, 0, 0, SSL_eGOST2814789CNT12},
{0, SSL_TXT_ARIA, NULL, 0, 0, 0, SSL_ARIA},
{0, SSL_TXT_ARIA_GCM, NULL, 0, 0, 0, SSL_ARIA128GCM | SSL_ARIA256GCM},
{0, SSL_TXT_ARIA128, NULL, 0, 0, 0, SSL_ARIA128GCM},
ssl/ssl_err.c
+2
View File
@@ -14,6 +14,8 @@
#ifndef OPENSSL_NO_ERR
static const ERR_STRING_DATA SSL_str_reasons[] = {
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_ALGORITHM_FETCH_FAILED),
"algorithm fetch failed"},
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY),
"application data after close notify"},
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_APP_DATA_IN_HANDSHAKE),
ssl/ssl_lib.c
+2 -2
View File
@@ -3200,7 +3200,7 @@ SSL_CTX *SSL_CTX_new_with_libctx(OPENSSL_CTX *libctx, const char *propq,
if (ret->cert_store == NULL)
goto err;
#ifndef OPENSSL_NO_CT
ret->ctlog_store = CTLOG_STORE_new();
ret->ctlog_store = CTLOG_STORE_new_with_libctx(libctx, propq);
if (ret->ctlog_store == NULL)
goto err;
#endif
@@ -5196,7 +5196,7 @@ int ssl_validate_ct(SSL *s)
}
}
ctx = CT_POLICY_EVAL_CTX_new();
ctx = CT_POLICY_EVAL_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);
if (ctx == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_VALIDATE_CT,
ERR_R_MALLOC_FAILURE);
ssl/ssl_rsa.c
+16 -1
View File
@@ -14,6 +14,7 @@
#include <openssl/objects.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/pem.h>
static int ssl_set_cert(CERT *c, X509 *x509);
@@ -31,6 +32,10 @@ int SSL_use_certificate(SSL *ssl, X509 *x)
SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
if (!X509v3_cache_extensions(x, ssl->ctx->libctx, ssl->ctx->propq)) {
SSLerr(0, ERR_LIB_X509);
return 0;
}
rv = ssl_security_cert(ssl, NULL, x, 0, 1);
if (rv != 1) {
SSLerr(SSL_F_SSL_USE_CERTIFICATE, rv);
@@ -305,6 +310,10 @@ int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
if (!X509v3_cache_extensions(x, ctx->libctx, ctx->propq)) {
SSLerr(0, ERR_LIB_X509);
return 0;
}
rv = ssl_security_cert(NULL, ctx, x, 0, 1);
if (rv != 1) {
SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, rv);
@@ -329,7 +338,7 @@ static int ssl_set_cert(CERT *c, X509 *x)
return 0;
}
#ifndef OPENSSL_NO_EC
if (i == SSL_PKEY_ECC && !EC_KEY_can_sign(EVP_PKEY_get0_EC_KEY(pkey))) {
if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) {
SSLerr(SSL_F_SSL_SET_CERT, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
return 0;
}
@@ -1046,9 +1055,15 @@ static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *pr
int j;
int rv;
CERT *c = ssl != NULL ? ssl->cert : ctx->cert;
SSL_CTX *actualctx = ssl == NULL ? ctx : ssl->ctx;
STACK_OF(X509) *dup_chain = NULL;
EVP_PKEY *pubkey = NULL;
if (!X509v3_cache_extensions(x509, actualctx->libctx, actualctx->propq)) {
SSLerr(0, ERR_R_X509_LIB);
goto out;
}
/* Do all security checks before anything else */
rv = ssl_security_cert(ssl, ctx, x509, 0, 1);
if (rv != 1) {
ssl/statem/extensions.c
+2 -1
View File
@@ -1595,7 +1595,8 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
binderout = tmpbinder;
bindersize = hashsize;
if (EVP_DigestSignInit(mctx, NULL, md, NULL, mackey) <= 0
if (EVP_DigestSignInit_ex(mctx, NULL, EVP_MD_name(md), s->ctx->propq,
mackey, s->ctx->libctx) <= 0
|| EVP_DigestSignUpdate(mctx, hash, hashsize) <= 0
|| EVP_DigestSignFinal(mctx, binderout, &bindersize) <= 0
|| bindersize != hashsize) {
ssl/statem/extensions_clnt.c
+32
View File
@@ -644,6 +644,21 @@ static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id)
/* SSLfatal() already called */
return 0;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(key_share_key);
if (EVP_PKEY_id(key_share_key) == EVP_PKEY_NONE) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE,
ERR_R_EC_LIB);
goto err;
}
}
/* Encode the public key. */
@@ -1906,6 +1921,23 @@ int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
ERR_R_MALLOC_FAILURE);
return 0;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(skey);
if (EVP_PKEY_id(skey) == EVP_PKEY_NONE) {
EVP_PKEY_free(skey);
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE,
ERR_R_INTERNAL_ERROR);
return 0;
}
if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt),
PACKET_remaining(&encoded_pt))) {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE,
ssl/statem/extensions_srvr.c
+34 -2
View File
@@ -711,6 +711,21 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
return 0;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(s->s3.peer_tmp);
if (EVP_PKEY_id(s->s3.peer_tmp) == EVP_PKEY_NONE) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
ERR_R_INTERNAL_ERROR);
return 0;
}
s->s3.group_id = group_id;
if (!EVP_PKEY_set1_tls_encodedpoint(s->s3.peer_tmp,
@@ -780,7 +795,8 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
}
hmaclen = SHA256_DIGEST_LENGTH;
if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", s->ctx->propq, pkey,
s->ctx->libctx) <= 0
|| EVP_DigestSign(hctx, hmac, &hmaclen, data,
rawlen - SHA256_DIGEST_LENGTH) <= 0
|| hmaclen != SHA256_DIGEST_LENGTH) {
@@ -1734,6 +1750,21 @@ EXT_RETURN tls_construct_stoc_key_share(SSL *s, WPACKET *pkt,
return EXT_RETURN_FAIL;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(skey);
if (EVP_PKEY_id(skey) == EVP_PKEY_NONE) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
ERR_R_INTERNAL_ERROR);
return EXT_RETURN_FAIL;
}
/* Generate encoding of server key */
encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(skey, &encodedPoint);
if (encoded_pt_len == 0) {
@@ -1863,7 +1894,8 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context,
goto err;
}
if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", s->ctx->propq, pkey,
s->ctx->libctx) <= 0
|| EVP_DigestSign(hctx, hmac, &hmaclen, cookie,
totcookielen) <= 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
ssl/statem/statem_clnt.c
+50 -6
View File
@@ -2152,9 +2152,10 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey)
ERR_R_EVP_LIB);
goto err;
}
dh = NULL;
if (!ssl_security(s, SSL_SECOP_TMP_DH, EVP_PKEY_security_bits(peer_tmp),
0, dh)) {
0, EVP_PKEY_get0_DH(peer_tmp))) {
SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SKE_DHE,
SSL_R_DH_KEY_TOO_SMALL);
goto err;
@@ -2226,6 +2227,21 @@ static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey)
return 0;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(s->s3.peer_tmp);
if (EVP_PKEY_id(s->s3.peer_tmp) == EVP_PKEY_NONE) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE,
ERR_R_INTERNAL_ERROR);
return 0;
}
if (!EVP_PKEY_set1_tls_encodedpoint(s->s3.peer_tmp,
PACKET_data(&encoded_pt),
PACKET_remaining(&encoded_pt))) {
@@ -2361,7 +2377,9 @@ MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt)
goto err;
}
if (EVP_DigestVerifyInit(md_ctx, &pctx, md, NULL, pkey) <= 0) {
if (EVP_DigestVerifyInit_ex(md_ctx, &pctx,
md == NULL ? NULL : EVP_MD_name(md),
s->ctx->propq, pkey, s->ctx->libctx) <= 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE,
ERR_R_EVP_LIB);
goto err;
@@ -2560,6 +2578,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
unsigned int sess_len;
RAW_EXTENSION *exts = NULL;
PACKET nonce;
EVP_MD *sha256 = NULL;
PACKET_null_init(&nonce);
@@ -2675,20 +2694,28 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
* other way is to set zero length session ID when the ticket is
* presented and rely on the handshake to determine session resumption.
* We choose the former approach because this fits in with assumptions
* elsewhere in OpenSSL. The session ID is set to the SHA256 (or SHA1 is
* SHA256 is disabled) hash of the ticket.
* elsewhere in OpenSSL. The session ID is set to the SHA256 hash of the
* ticket.
*/
sha256 = EVP_MD_fetch(s->ctx->libctx, "SHA2-256", s->ctx->propq);
if (sha256 == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET,
SSL_R_ALGORITHM_FETCH_FAILED);
goto err;
}
/*
* TODO(size_t): we use sess_len here because EVP_Digest expects an int
* but s->session->session_id_length is a size_t
*/
if (!EVP_Digest(s->session->ext.tick, ticklen,
s->session->session_id, &sess_len,
EVP_sha256(), NULL)) {
sha256, NULL)) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET,
ERR_R_EVP_LIB);
goto err;
}
EVP_MD_free(sha256);
sha256 = NULL;
s->session->session_id_length = sess_len;
s->session->not_resumable = 0;
@@ -2727,6 +2754,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
return MSG_PROCESS_CONTINUE_READING;
err:
EVP_MD_free(sha256);
OPENSSL_free(exts);
return MSG_PROCESS_ERROR;
}
@@ -2990,7 +3018,8 @@ static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)
ERR_R_INTERNAL_ERROR);
goto err;
}
pctx = EVP_PKEY_CTX_new(pkey, NULL);
pctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, pkey, s->ctx->propq);
if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
|| EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
@@ -3115,6 +3144,21 @@ static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt)
goto err;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(ckey);
if (EVP_PKEY_id(skey) == EVP_PKEY_NONE) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE,
ERR_R_INTERNAL_ERROR);
goto err;
}
if (ssl_derive(s, ckey, skey, 0) == 0) {
/* SSLfatal() already called */
goto err;
ssl/statem/statem_lib.c
+14 -9
View File
@@ -14,6 +14,7 @@
#include "../ssl_local.h"
#include "statem_local.h"
#include "internal/cryptlib.h"
#include "internal/evp.h"
#include <openssl/buffer.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
@@ -272,7 +273,9 @@ int tls_construct_cert_verify(SSL *s, WPACKET *pkt)
goto err;
}
if (EVP_DigestSignInit(mctx, &pctx, md, NULL, pkey) <= 0) {
if (EVP_DigestSignInit_ex(mctx, &pctx,
md == NULL ? NULL : EVP_MD_name(md),
s->ctx->propq, pkey, s->ctx->libctx) <= 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
ERR_R_EVP_LIB);
goto err;
@@ -465,7 +468,9 @@ MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
OSSL_TRACE1(TLS, "Using client verify alg %s\n",
md == NULL ? "n/a" : EVP_MD_name(md));
if (EVP_DigestVerifyInit(mctx, &pctx, md, NULL, pkey) <= 0) {
if (EVP_DigestVerifyInit_ex(mctx, &pctx,
md == NULL ? NULL : EVP_MD_name(md),
s->ctx->propq, pkey, s->ctx->libctx) <= 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
ERR_R_EVP_LIB);
goto err;
@@ -860,9 +865,11 @@ MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt)
return MSG_PROCESS_ERROR;
}
} else {
/* TLS 1.3 gets the secret size from the handshake md */
size_t dummy;
if (!s->method->ssl3_enc->generate_master_secret(s,
s->master_secret, s->handshake_secret, 0,
&s->session->master_key_length)) {
&dummy)) {
/* SSLfatal() already called */
return MSG_PROCESS_ERROR;
}
@@ -951,7 +958,8 @@ static int ssl_add_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
chain_store = s->ctx->cert_store;
if (chain_store != NULL) {
X509_STORE_CTX *xs_ctx = X509_STORE_CTX_new();
X509_STORE_CTX *xs_ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx,
s->ctx->propq);
if (xs_ctx == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_CHAIN,
@@ -1525,7 +1533,6 @@ static int is_tls13_capable(const SSL *s)
int i;
#ifndef OPENSSL_NO_EC
int curve;
EC_KEY *eckey;
#endif
#ifndef OPENSSL_NO_PSK
@@ -1557,10 +1564,8 @@ static int is_tls13_capable(const SSL *s)
* more restrictive so check that our sig algs are consistent with this
* EC cert. See section 4.2.3 of RFC8446.
*/
eckey = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
if (eckey == NULL)
continue;
curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey));
curve = evp_pkey_get_EC_KEY_curve_nid(s->cert->pkeys[SSL_PKEY_ECC]
.privatekey);
if (tls_check_sigalg_curve(s, curve))
return 1;
#else
ssl/statem/statem_srvr.c
+53 -4
View File
@@ -744,7 +744,15 @@ WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst)
case TLS_ST_SW_CHANGE:
if (SSL_IS_TLS13(s))
break;
s->session->cipher = s->s3.tmp.new_cipher;
/* Writes to s->session are only safe for initial handshakes */
if (s->session->cipher == NULL) {
s->session->cipher = s->s3.tmp.new_cipher;
} else if (s->session->cipher != s->s3.tmp.new_cipher) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_OSSL_STATEM_SERVER_PRE_WORK,
ERR_R_INTERNAL_ERROR);
return WORK_ERROR;
}
if (!s->method->ssl3_enc->setup_key_block(s)) {
/* SSLfatal() already called */
return WORK_ERROR;
@@ -948,9 +956,11 @@ WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst)
}
#endif
if (SSL_IS_TLS13(s)) {
/* TLS 1.3 gets the secret size from the handshake md */
size_t dummy;
if (!s->method->ssl3_enc->generate_master_secret(s,
s->master_secret, s->handshake_secret, 0,
&s->session->master_key_length)
&dummy)
|| !s->method->ssl3_enc->change_cipher_state(s,
SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_SERVER_WRITE))
/* SSLfatal() already called */
@@ -2615,6 +2625,18 @@ int tls_construct_server_key_exchange(SSL *s, WPACKET *pkt)
goto err;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(s->s3.tmp.pkey);
if (EVP_PKEY_id(s->s3.tmp.pkey) == EVP_PKEY_NONE)
goto err;
/* Encode the public key. */
encodedlen = EVP_PKEY_get1_tls_encodedpoint(s->s3.tmp.pkey,
&encodedPoint);
@@ -2786,7 +2808,9 @@ int tls_construct_server_key_exchange(SSL *s, WPACKET *pkt)
goto err;
}
if (EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey) <= 0) {
if (EVP_DigestSignInit_ex(md_ctx, &pctx,
md == NULL ? NULL : EVP_MD_name(md),
s->ctx->propq, pkey, s->ctx->libctx) <= 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
ERR_R_INTERNAL_ERROR);
@@ -3196,6 +3220,22 @@ static int tls_process_cke_ecdhe(SSL *s, PACKET *pkt)
ERR_R_EVP_LIB);
goto err;
}
/*
* TODO(3.0) Remove this when EVP_PKEY_get1_tls_encodedpoint()
* knows how to get a key from an encoded point with the help of
* a OSSL_SERIALIZER deserializer. We know that EVP_PKEY_get0()
* downgrades an EVP_PKEY to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(ckey);
if (EVP_PKEY_id(ckey) == EVP_PKEY_NONE) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
ERR_R_INTERNAL_ERROR);
goto err;
}
if (EVP_PKEY_set1_tls_encodedpoint(ckey, data, i) == 0) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
ERR_R_EC_LIB);
@@ -3897,7 +3937,14 @@ static int construct_stateless_ticket(SSL *s, WPACKET *pkt, uint32_t age_add,
}
iv_len = EVP_CIPHER_CTX_iv_length(ctx);
} else {
const EVP_CIPHER *cipher = EVP_aes_256_cbc();
EVP_CIPHER *cipher = EVP_CIPHER_fetch(s->ctx->libctx, "AES-256-CBC",
s->ctx->propq);
if (cipher == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
SSL_R_ALGORITHM_FETCH_FAILED);
goto err;
}
iv_len = EVP_CIPHER_iv_length(cipher);
if (RAND_bytes_ex(s->ctx->libctx, iv, iv_len) <= 0
@@ -3906,10 +3953,12 @@ static int construct_stateless_ticket(SSL *s, WPACKET *pkt, uint32_t age_add,
|| !ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key,
sizeof(tctx->ext.secure->tick_hmac_key),
"SHA256")) {
EVP_CIPHER_free(cipher);
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
ERR_R_INTERNAL_ERROR);
goto err;
}
EVP_CIPHER_free(cipher);
memcpy(key_name, tctx->ext.tick_key_name,
sizeof(tctx->ext.tick_key_name));
}
ssl/t1_enc.c
+4 -2
View File
@@ -46,7 +46,7 @@ static int tls1_PRF(SSL *s,
SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR);
return 0;
}
kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_TLS1_PRF, NULL);
kdf = EVP_KDF_fetch(s->ctx->libctx, OSSL_KDF_NAME_TLS1_PRF, s->ctx->propq);
if (kdf == NULL)
goto err;
kctx = EVP_KDF_CTX_new(kdf);
@@ -326,7 +326,9 @@ int tls1_change_cipher_state(SSL *s, int which)
mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret,
(int)*mac_secret_size);
if (mac_key == NULL
|| EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) {
|| EVP_DigestSignInit_ex(mac_ctx, NULL,
EVP_MD_name(m), s->ctx->propq,
mac_key, s->ctx->libctx) <= 0) {
EVP_PKEY_free(mac_key);
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE,
ERR_R_INTERNAL_ERROR);
ssl/t1_lib.c
+47 -36
View File
@@ -22,6 +22,7 @@
#include <openssl/dh.h>
#include <openssl/bn.h>
#include "internal/nelem.h"
#include "internal/evp.h"
#include "ssl_local.h"
#include <openssl/ct.h>
@@ -583,7 +584,7 @@ static int tls1_check_pkey_comp(SSL *s, EVP_PKEY *pkey)
size_t i;
/* If not an EC key nothing to check */
if (EVP_PKEY_id(pkey) != EVP_PKEY_EC)
if (!EVP_PKEY_is_a(pkey, "EC"))
return 1;
ec = EVP_PKEY_get0_EC_KEY(pkey);
grp = EC_KEY_get0_group(ec);
@@ -624,13 +625,11 @@ static int tls1_check_pkey_comp(SSL *s, EVP_PKEY *pkey)
/* Return group id of a key */
static uint16_t tls1_get_group_id(EVP_PKEY *pkey)
{
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
const EC_GROUP *grp;
int curve_nid = evp_pkey_get_EC_KEY_curve_nid(pkey);
if (ec == NULL)
if (curve_nid == NID_undef)
return 0;
grp = EC_KEY_get0_group(ec);
return tls1_nid2group_id(EC_GROUP_get_curve_name(grp));
return tls1_nid2group_id(curve_nid);
}
/*
@@ -645,7 +644,7 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int check_ee_md)
if (pkey == NULL)
return 0;
/* If not EC nothing to do */
if (EVP_PKEY_id(pkey) != EVP_PKEY_EC)
if (!EVP_PKEY_is_a(pkey, "EC"))
return 1;
/* Check compression */
if (!tls1_check_pkey_comp(s, pkey))
@@ -1085,9 +1084,21 @@ int tls12_check_peer_sigalg(SSL *s, uint16_t sig, EVP_PKEY *pkey)
const EVP_MD *md = NULL;
char sigalgstr[2];
size_t sent_sigslen, i, cidx;
int pkeyid = EVP_PKEY_id(pkey);
int pkeyid = -1;
const SIGALG_LOOKUP *lu;
/*
* TODO(3.0) Remove this when we adapted this function for provider
* side keys. We know that EVP_PKEY_get0() downgrades an EVP_PKEY
* to contain a legacy key.
*
* THIS IS TEMPORARY
*/
EVP_PKEY_get0(pkey);
if (EVP_PKEY_id(pkey) == EVP_PKEY_NONE)
return 0;
pkeyid = EVP_PKEY_id(pkey);
/* Should never happen */
if (pkeyid == -1)
return -1;
@@ -1136,8 +1147,7 @@ int tls12_check_peer_sigalg(SSL *s, uint16_t sig, EVP_PKEY *pkey)
/* For TLS 1.3 or Suite B check curve matches signature algorithm */
if (SSL_IS_TLS13(s) || tls1_suiteb(s)) {
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
int curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
int curve = evp_pkey_get_EC_KEY_curve_nid(pkey);
if (lu->curve != NID_undef && curve != lu->curve) {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
@@ -1494,21 +1504,29 @@ SSL_TICKET_STATUS tls_decrypt_ticket(SSL *s, const unsigned char *etick,
if (rv == 2)
renew_ticket = 1;
} else {
EVP_CIPHER *aes256cbc = NULL;
/* Check key name matches */
if (memcmp(etick, tctx->ext.tick_key_name,
TLSEXT_KEYNAME_LENGTH) != 0) {
ret = SSL_TICKET_NO_DECRYPT;
goto end;
}
if (ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key,
sizeof(tctx->ext.secure->tick_hmac_key),
"SHA256") <= 0
|| EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL,
aes256cbc = EVP_CIPHER_fetch(s->ctx->libctx, "AES-256-CBC",
s->ctx->propq);
if (aes256cbc == NULL
|| ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key,
sizeof(tctx->ext.secure->tick_hmac_key),
"SHA256") <= 0
|| EVP_DecryptInit_ex(ctx, aes256cbc, NULL,
tctx->ext.secure->tick_aes_key,
etick + TLSEXT_KEYNAME_LENGTH) <= 0) {
EVP_CIPHER_free(aes256cbc);
ret = SSL_TICKET_FATAL_ERR_OTHER;
goto end;
}
EVP_CIPHER_free(aes256cbc);
if (SSL_IS_TLS13(s))
renew_ticket = 1;
}
@@ -2216,7 +2234,7 @@ static int tls1_check_sig_alg(SSL *s, X509 *x, int default_nid)
/* Check to see if a certificate issuer name matches list of CA names */
static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
{
X509_NAME *nm;
const X509_NAME *nm;
int i;
nm = X509_get_issuer_name(x);
for (i = 0; i < sk_X509_NAME_num(names); i++) {
@@ -2417,17 +2435,14 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
if (!s->server && strict_mode) {
STACK_OF(X509_NAME) *ca_dn;
int check_type = 0;
switch (EVP_PKEY_id(pk)) {
case EVP_PKEY_RSA:
if (EVP_PKEY_is_a(pk, "RSA"))
check_type = TLS_CT_RSA_SIGN;
break;
case EVP_PKEY_DSA:
else if (EVP_PKEY_is_a(pk, "DSA"))
check_type = TLS_CT_DSS_SIGN;
break;
case EVP_PKEY_EC:
else if (EVP_PKEY_is_a(pk, "EC"))
check_type = TLS_CT_ECDSA_SIGN;
break;
}
if (check_type) {
const uint8_t *ctypes = s->s3.tmp.ctype;
size_t j;
@@ -2788,10 +2803,8 @@ static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey)
if (lu->sig == EVP_PKEY_EC) {
#ifndef OPENSSL_NO_EC
if (curve == -1) {
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(tmppkey);
curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
}
if (curve == -1)
curve = evp_pkey_get_EC_KEY_curve_nid(tmppkey);
if (lu->curve != NID_undef && curve != lu->curve)
continue;
#else
@@ -2850,15 +2863,13 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
size_t i;
if (s->s3.tmp.peer_sigalgs != NULL) {
#ifndef OPENSSL_NO_EC
int curve;
int curve = -1;
/* For Suite B need to match signature algorithm to curve */
if (tls1_suiteb(s)) {
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
} else {
curve = -1;
}
if (tls1_suiteb(s))
curve =
evp_pkey_get_EC_KEY_curve_nid(s->cert->pkeys[SSL_PKEY_ECC]
.privatekey);
#endif
/*
@@ -2932,7 +2943,7 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
if (!fatalerrs)
return 1;
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CHOOSE_SIGALG,
ERR_R_INTERNAL_ERROR);
SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
return 0;
}
@@ -2957,7 +2968,7 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
if (!fatalerrs)
return 1;
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CHOOSE_SIGALG,
ERR_R_INTERNAL_ERROR);
SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
return 0;
}
}
ssl/t1_trce.c
+3 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -427,6 +427,7 @@ static const ssl_trace_tbl ssl_ciphers_tbl[] = {
{0xC0AD, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM"},
{0xC0AE, "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"},
{0xC0AF, "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"},
{0xC102, "IANA-GOST2012-GOST8912-GOST8912"},
{0xCCA8, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"},
{0xCCA9, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"},
{0xCCAA, "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"},
@@ -441,7 +442,7 @@ static const ssl_trace_tbl ssl_ciphers_tbl[] = {
{0x1305, "TLS_AES_128_CCM_8_SHA256"},
{0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
{0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"},
{0xFF85, "GOST2012-GOST8912-GOST8912"},
{0xFF85, "LEGACY-GOST2012-GOST8912-GOST8912"},
{0xFF87, "GOST2012-NULL-GOST12"},
};
ssl/tls_srp.c
+18 -12
View File
@@ -157,7 +157,7 @@ int SSL_srp_server_param_with_username(SSL *s, int *ad)
(s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL))
return SSL3_AL_FATAL;
if (RAND_priv_bytes(b, sizeof(b)) <= 0)
if (RAND_priv_bytes_ex(s->ctx->libctx, b, sizeof(b)) <= 0)
return SSL3_AL_FATAL;
s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
OPENSSL_cleanse(b, sizeof(b));
@@ -165,8 +165,8 @@ int SSL_srp_server_param_with_username(SSL *s, int *ad)
/* Calculate: B = (kv + g^b) % N */
return ((s->srp_ctx.B =
SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
s->srp_ctx.v)) !=
SRP_Calc_B_ex(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
s->srp_ctx.v, s->ctx->libctx, s->ctx->propq)) !=
NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
}
@@ -186,8 +186,9 @@ int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,
s->srp_ctx.v = NULL;
BN_clear_free(s->srp_ctx.s);
s->srp_ctx.s = NULL;
if (!SRP_create_verifier_BN
(user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g))
if (!SRP_create_verifier_BN_ex(user, pass, &s->srp_ctx.s, &s->srp_ctx.v,
GN->N, GN->g, s->ctx->libctx,
s->ctx->propq))
return -1;
return 1;
@@ -254,7 +255,8 @@ int srp_generate_server_master_secret(SSL *s)
if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
goto err;
if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
if ((u = SRP_Calc_u_ex(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N,
s->ctx->libctx, s->ctx->propq)) == NULL)
goto err;
if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
s->srp_ctx.N)) == NULL)
@@ -287,7 +289,8 @@ int srp_generate_client_master_secret(SSL *s)
* Checks if b % n == 0
*/
if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0
|| (u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N))
|| (u = SRP_Calc_u_ex(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N,
s->ctx->libctx, s->ctx->propq))
== NULL
|| s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
@@ -302,10 +305,13 @@ int srp_generate_client_master_secret(SSL *s)
SSL_R_CALLBACK_FAILED);
goto err;
}
if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL
|| (K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B,
s->srp_ctx.g, x,
s->srp_ctx.a, u)) == NULL) {
if ((x = SRP_Calc_x_ex(s->srp_ctx.s, s->srp_ctx.login, passwd,
s->ctx->libctx, s->ctx->propq)) == NULL
|| (K = SRP_Calc_client_key_ex(s->srp_ctx.N, s->srp_ctx.B,
s->srp_ctx.g, x,
s->srp_ctx.a, u,
s->ctx->libctx,
s->ctx->propq)) == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
goto err;
@@ -369,7 +375,7 @@ int SRP_Calc_A_param(SSL *s)
{
unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
if (RAND_priv_bytes(rnd, sizeof(rnd)) <= 0)
if (RAND_priv_bytes_ex(s->ctx->libctx, rnd, sizeof(rnd)) <= 0)
return 0;
s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
OPENSSL_cleanse(rnd, sizeof(rnd));