Latest update.
This commit is contained in:
+17
-1
@@ -1,6 +1,21 @@
|
||||
LIBS=../libssl
|
||||
|
||||
#Needed for the multiblock code in rec_layer_s3.c
|
||||
IF[{- !$disabled{asm} -}]
|
||||
$AESDEF_x86=AES_ASM
|
||||
$AESDEF_x86_64=AES_ASM
|
||||
|
||||
IF[$AESDEF_{- $target{asm_arch} -}]
|
||||
$AESDEF=$AESDEF_{- $target{asm_arch} -}
|
||||
ENDIF
|
||||
ENDIF
|
||||
|
||||
#TODO: For now we just include the libcrypto packet.c in libssl as well. We
|
||||
# could either continue to do it like this, or export all the WPACKET
|
||||
# symbols so that libssl can use them like any other. Probably would do
|
||||
# this privately so it does not become part of the public API.
|
||||
SOURCE[../libssl]=\
|
||||
pqueue.c packet.c \
|
||||
pqueue.c ../crypto/packet.c \
|
||||
statem/statem_srvr.c statem/statem_clnt.c s3_lib.c s3_enc.c record/rec_layer_s3.c \
|
||||
statem/statem_lib.c statem/extensions.c statem/extensions_srvr.c \
|
||||
statem/extensions_clnt.c statem/extensions_cust.c s3_cbc.c s3_msg.c \
|
||||
@@ -13,3 +28,4 @@ SOURCE[../libssl]=\
|
||||
bio_ssl.c ssl_err.c tls_srp.c t1_trce.c ssl_utst.c \
|
||||
record/ssl3_buffer.c record/ssl3_record.c record/dtls1_bitmap.c \
|
||||
statem/statem.c record/ssl3_record_tls13.c
|
||||
DEFINE[../libssl]=$AESDEF
|
||||
+1
-1
@@ -378,7 +378,7 @@ int dtls1_check_timeout_num(SSL *s)
|
||||
|
||||
if (s->d1->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) {
|
||||
/* fail the connection, enough alerts have been sent */
|
||||
SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_DTLS1_CHECK_TIMEOUT_NUM,
|
||||
SSLfatal(s, SSL_AD_NO_ALERT, 0,
|
||||
SSL_R_READ_TIMEOUT_EXPIRED);
|
||||
return -1;
|
||||
}
|
||||
|
||||
-424
@@ -1,424 +0,0 @@
|
||||
/*
|
||||
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include "internal/cryptlib.h"
|
||||
#include "packet_locl.h"
|
||||
#include <openssl/sslerr.h>
|
||||
|
||||
#define DEFAULT_BUF_SIZE 256
|
||||
|
||||
int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
|
||||
{
|
||||
if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
|
||||
return 0;
|
||||
|
||||
pkt->written += len;
|
||||
pkt->curr += len;
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_sub_allocate_bytes__(WPACKET *pkt, size_t len,
|
||||
unsigned char **allocbytes, size_t lenbytes)
|
||||
{
|
||||
if (!WPACKET_start_sub_packet_len__(pkt, lenbytes)
|
||||
|| !WPACKET_allocate_bytes(pkt, len, allocbytes)
|
||||
|| !WPACKET_close(pkt))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
#define GETBUF(p) (((p)->staticbuf != NULL) \
|
||||
? (p)->staticbuf : (unsigned char *)(p)->buf->data)
|
||||
|
||||
int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
|
||||
{
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(pkt->subs != NULL && len != 0))
|
||||
return 0;
|
||||
|
||||
if (pkt->maxsize - pkt->written < len)
|
||||
return 0;
|
||||
|
||||
if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {
|
||||
size_t newlen;
|
||||
size_t reflen;
|
||||
|
||||
reflen = (len > pkt->buf->length) ? len : pkt->buf->length;
|
||||
|
||||
if (reflen > SIZE_MAX / 2) {
|
||||
newlen = SIZE_MAX;
|
||||
} else {
|
||||
newlen = reflen * 2;
|
||||
if (newlen < DEFAULT_BUF_SIZE)
|
||||
newlen = DEFAULT_BUF_SIZE;
|
||||
}
|
||||
if (BUF_MEM_grow(pkt->buf, newlen) == 0)
|
||||
return 0;
|
||||
}
|
||||
if (allocbytes != NULL)
|
||||
*allocbytes = WPACKET_get_curr(pkt);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_sub_reserve_bytes__(WPACKET *pkt, size_t len,
|
||||
unsigned char **allocbytes, size_t lenbytes)
|
||||
{
|
||||
if (!WPACKET_reserve_bytes(pkt, lenbytes + len, allocbytes))
|
||||
return 0;
|
||||
|
||||
*allocbytes += lenbytes;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static size_t maxmaxsize(size_t lenbytes)
|
||||
{
|
||||
if (lenbytes >= sizeof(size_t) || lenbytes == 0)
|
||||
return SIZE_MAX;
|
||||
|
||||
return ((size_t)1 << (lenbytes * 8)) - 1 + lenbytes;
|
||||
}
|
||||
|
||||
static int wpacket_intern_init_len(WPACKET *pkt, size_t lenbytes)
|
||||
{
|
||||
unsigned char *lenchars;
|
||||
|
||||
pkt->curr = 0;
|
||||
pkt->written = 0;
|
||||
|
||||
if ((pkt->subs = OPENSSL_zalloc(sizeof(*pkt->subs))) == NULL) {
|
||||
SSLerr(SSL_F_WPACKET_INTERN_INIT_LEN, ERR_R_MALLOC_FAILURE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (lenbytes == 0)
|
||||
return 1;
|
||||
|
||||
pkt->subs->pwritten = lenbytes;
|
||||
pkt->subs->lenbytes = lenbytes;
|
||||
|
||||
if (!WPACKET_allocate_bytes(pkt, lenbytes, &lenchars)) {
|
||||
OPENSSL_free(pkt->subs);
|
||||
pkt->subs = NULL;
|
||||
return 0;
|
||||
}
|
||||
pkt->subs->packet_len = lenchars - GETBUF(pkt);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_init_static_len(WPACKET *pkt, unsigned char *buf, size_t len,
|
||||
size_t lenbytes)
|
||||
{
|
||||
size_t max = maxmaxsize(lenbytes);
|
||||
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(buf != NULL && len > 0))
|
||||
return 0;
|
||||
|
||||
pkt->staticbuf = buf;
|
||||
pkt->buf = NULL;
|
||||
pkt->maxsize = (max < len) ? max : len;
|
||||
|
||||
return wpacket_intern_init_len(pkt, lenbytes);
|
||||
}
|
||||
|
||||
int WPACKET_init_len(WPACKET *pkt, BUF_MEM *buf, size_t lenbytes)
|
||||
{
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(buf != NULL))
|
||||
return 0;
|
||||
|
||||
pkt->staticbuf = NULL;
|
||||
pkt->buf = buf;
|
||||
pkt->maxsize = maxmaxsize(lenbytes);
|
||||
|
||||
return wpacket_intern_init_len(pkt, lenbytes);
|
||||
}
|
||||
|
||||
int WPACKET_init(WPACKET *pkt, BUF_MEM *buf)
|
||||
{
|
||||
return WPACKET_init_len(pkt, buf, 0);
|
||||
}
|
||||
|
||||
int WPACKET_set_flags(WPACKET *pkt, unsigned int flags)
|
||||
{
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(pkt->subs != NULL))
|
||||
return 0;
|
||||
|
||||
pkt->subs->flags = flags;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Store the |value| of length |len| at location |data| */
|
||||
static int put_value(unsigned char *data, size_t value, size_t len)
|
||||
{
|
||||
for (data += len - 1; len > 0; len--) {
|
||||
*data = (unsigned char)(value & 0xff);
|
||||
data--;
|
||||
value >>= 8;
|
||||
}
|
||||
|
||||
/* Check whether we could fit the value in the assigned number of bytes */
|
||||
if (value > 0)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Internal helper function used by WPACKET_close(), WPACKET_finish() and
|
||||
* WPACKET_fill_lengths() to close a sub-packet and write out its length if
|
||||
* necessary. If |doclose| is 0 then it goes through the motions of closing
|
||||
* (i.e. it fills in all the lengths), but doesn't actually close anything.
|
||||
*/
|
||||
static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
|
||||
{
|
||||
size_t packlen = pkt->written - sub->pwritten;
|
||||
|
||||
if (packlen == 0
|
||||
&& (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)
|
||||
return 0;
|
||||
|
||||
if (packlen == 0
|
||||
&& sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
|
||||
/* We can't handle this case. Return an error */
|
||||
if (!doclose)
|
||||
return 0;
|
||||
|
||||
/* Deallocate any bytes allocated for the length of the WPACKET */
|
||||
if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
|
||||
pkt->written -= sub->lenbytes;
|
||||
pkt->curr -= sub->lenbytes;
|
||||
}
|
||||
|
||||
/* Don't write out the packet length */
|
||||
sub->packet_len = 0;
|
||||
sub->lenbytes = 0;
|
||||
}
|
||||
|
||||
/* Write out the WPACKET length if needed */
|
||||
if (sub->lenbytes > 0
|
||||
&& !put_value(&GETBUF(pkt)[sub->packet_len], packlen,
|
||||
sub->lenbytes))
|
||||
return 0;
|
||||
|
||||
if (doclose) {
|
||||
pkt->subs = sub->parent;
|
||||
OPENSSL_free(sub);
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_fill_lengths(WPACKET *pkt)
|
||||
{
|
||||
WPACKET_SUB *sub;
|
||||
|
||||
if (!ossl_assert(pkt->subs != NULL))
|
||||
return 0;
|
||||
|
||||
for (sub = pkt->subs; sub != NULL; sub = sub->parent) {
|
||||
if (!wpacket_intern_close(pkt, sub, 0))
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_close(WPACKET *pkt)
|
||||
{
|
||||
/*
|
||||
* Internal API, so should not fail - but we do negative testing of this
|
||||
* so no assert (otherwise the tests fail)
|
||||
*/
|
||||
if (pkt->subs == NULL || pkt->subs->parent == NULL)
|
||||
return 0;
|
||||
|
||||
return wpacket_intern_close(pkt, pkt->subs, 1);
|
||||
}
|
||||
|
||||
int WPACKET_finish(WPACKET *pkt)
|
||||
{
|
||||
int ret;
|
||||
|
||||
/*
|
||||
* Internal API, so should not fail - but we do negative testing of this
|
||||
* so no assert (otherwise the tests fail)
|
||||
*/
|
||||
if (pkt->subs == NULL || pkt->subs->parent != NULL)
|
||||
return 0;
|
||||
|
||||
ret = wpacket_intern_close(pkt, pkt->subs, 1);
|
||||
if (ret) {
|
||||
OPENSSL_free(pkt->subs);
|
||||
pkt->subs = NULL;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
|
||||
{
|
||||
WPACKET_SUB *sub;
|
||||
unsigned char *lenchars;
|
||||
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(pkt->subs != NULL))
|
||||
return 0;
|
||||
|
||||
if ((sub = OPENSSL_zalloc(sizeof(*sub))) == NULL) {
|
||||
SSLerr(SSL_F_WPACKET_START_SUB_PACKET_LEN__, ERR_R_MALLOC_FAILURE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
sub->parent = pkt->subs;
|
||||
pkt->subs = sub;
|
||||
sub->pwritten = pkt->written + lenbytes;
|
||||
sub->lenbytes = lenbytes;
|
||||
|
||||
if (lenbytes == 0) {
|
||||
sub->packet_len = 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (!WPACKET_allocate_bytes(pkt, lenbytes, &lenchars))
|
||||
return 0;
|
||||
/* Convert to an offset in case the underlying BUF_MEM gets realloc'd */
|
||||
sub->packet_len = lenchars - GETBUF(pkt);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_start_sub_packet(WPACKET *pkt)
|
||||
{
|
||||
return WPACKET_start_sub_packet_len__(pkt, 0);
|
||||
}
|
||||
|
||||
int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)
|
||||
{
|
||||
unsigned char *data;
|
||||
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(size <= sizeof(unsigned int))
|
||||
|| !WPACKET_allocate_bytes(pkt, size, &data)
|
||||
|| !put_value(data, val, size))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_set_max_size(WPACKET *pkt, size_t maxsize)
|
||||
{
|
||||
WPACKET_SUB *sub;
|
||||
size_t lenbytes;
|
||||
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(pkt->subs != NULL))
|
||||
return 0;
|
||||
|
||||
/* Find the WPACKET_SUB for the top level */
|
||||
for (sub = pkt->subs; sub->parent != NULL; sub = sub->parent)
|
||||
continue;
|
||||
|
||||
lenbytes = sub->lenbytes;
|
||||
if (lenbytes == 0)
|
||||
lenbytes = sizeof(pkt->maxsize);
|
||||
|
||||
if (maxmaxsize(lenbytes) < maxsize || maxsize < pkt->written)
|
||||
return 0;
|
||||
|
||||
pkt->maxsize = maxsize;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_memset(WPACKET *pkt, int ch, size_t len)
|
||||
{
|
||||
unsigned char *dest;
|
||||
|
||||
if (len == 0)
|
||||
return 1;
|
||||
|
||||
if (!WPACKET_allocate_bytes(pkt, len, &dest))
|
||||
return 0;
|
||||
|
||||
memset(dest, ch, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
|
||||
{
|
||||
unsigned char *dest;
|
||||
|
||||
if (len == 0)
|
||||
return 1;
|
||||
|
||||
if (!WPACKET_allocate_bytes(pkt, len, &dest))
|
||||
return 0;
|
||||
|
||||
memcpy(dest, src, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_sub_memcpy__(WPACKET *pkt, const void *src, size_t len,
|
||||
size_t lenbytes)
|
||||
{
|
||||
if (!WPACKET_start_sub_packet_len__(pkt, lenbytes)
|
||||
|| !WPACKET_memcpy(pkt, src, len)
|
||||
|| !WPACKET_close(pkt))
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_get_total_written(WPACKET *pkt, size_t *written)
|
||||
{
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(written != NULL))
|
||||
return 0;
|
||||
|
||||
*written = pkt->written;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int WPACKET_get_length(WPACKET *pkt, size_t *len)
|
||||
{
|
||||
/* Internal API, so should not fail */
|
||||
if (!ossl_assert(pkt->subs != NULL && len != NULL))
|
||||
return 0;
|
||||
|
||||
*len = pkt->written - pkt->subs->pwritten;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
unsigned char *WPACKET_get_curr(WPACKET *pkt)
|
||||
{
|
||||
return GETBUF(pkt) + pkt->curr;
|
||||
}
|
||||
|
||||
void WPACKET_cleanup(WPACKET *pkt)
|
||||
{
|
||||
WPACKET_SUB *sub, *parent;
|
||||
|
||||
for (sub = pkt->subs; sub != NULL; sub = parent) {
|
||||
parent = sub->parent;
|
||||
OPENSSL_free(sub);
|
||||
}
|
||||
pkt->subs = NULL;
|
||||
}
|
||||
@@ -1,874 +0,0 @@
|
||||
/*
|
||||
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef HEADER_PACKET_LOCL_H
|
||||
# define HEADER_PACKET_LOCL_H
|
||||
|
||||
# include <string.h>
|
||||
# include <openssl/bn.h>
|
||||
# include <openssl/buffer.h>
|
||||
# include <openssl/crypto.h>
|
||||
# include <openssl/e_os2.h>
|
||||
|
||||
# include "internal/numbers.h"
|
||||
|
||||
typedef struct {
|
||||
/* Pointer to where we are currently reading from */
|
||||
const unsigned char *curr;
|
||||
/* Number of bytes remaining */
|
||||
size_t remaining;
|
||||
} PACKET;
|
||||
|
||||
/* Internal unchecked shorthand; don't use outside this file. */
|
||||
static ossl_inline void packet_forward(PACKET *pkt, size_t len)
|
||||
{
|
||||
pkt->curr += len;
|
||||
pkt->remaining -= len;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns the number of bytes remaining to be read in the PACKET
|
||||
*/
|
||||
static ossl_inline size_t PACKET_remaining(const PACKET *pkt)
|
||||
{
|
||||
return pkt->remaining;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns a pointer to the first byte after the packet data.
|
||||
* Useful for integrating with non-PACKET parsing code.
|
||||
* Specifically, we use PACKET_end() to verify that a d2i_... call
|
||||
* has consumed the entire packet contents.
|
||||
*/
|
||||
static ossl_inline const unsigned char *PACKET_end(const PACKET *pkt)
|
||||
{
|
||||
return pkt->curr + pkt->remaining;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns a pointer to the PACKET's current position.
|
||||
* For use in non-PACKETized APIs.
|
||||
*/
|
||||
static ossl_inline const unsigned char *PACKET_data(const PACKET *pkt)
|
||||
{
|
||||
return pkt->curr;
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialise a PACKET with |len| bytes held in |buf|. This does not make a
|
||||
* copy of the data so |buf| must be present for the whole time that the PACKET
|
||||
* is being used.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_buf_init(PACKET *pkt,
|
||||
const unsigned char *buf,
|
||||
size_t len)
|
||||
{
|
||||
/* Sanity check for negative values. */
|
||||
if (len > (size_t)(SIZE_MAX / 2))
|
||||
return 0;
|
||||
|
||||
pkt->curr = buf;
|
||||
pkt->remaining = len;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Initialize a PACKET to hold zero bytes. */
|
||||
static ossl_inline void PACKET_null_init(PACKET *pkt)
|
||||
{
|
||||
pkt->curr = NULL;
|
||||
pkt->remaining = 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns 1 if the packet has length |num| and its contents equal the |num|
|
||||
* bytes read from |ptr|. Returns 0 otherwise (lengths or contents not equal).
|
||||
* If lengths are equal, performs the comparison in constant time.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_equal(const PACKET *pkt, const void *ptr,
|
||||
size_t num)
|
||||
{
|
||||
if (PACKET_remaining(pkt) != num)
|
||||
return 0;
|
||||
return CRYPTO_memcmp(pkt->curr, ptr, num) == 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Peek ahead and initialize |subpkt| with the next |len| bytes read from |pkt|.
|
||||
* Data is not copied: the |subpkt| packet will share its underlying buffer with
|
||||
* the original |pkt|, so data wrapped by |pkt| must outlive the |subpkt|.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_peek_sub_packet(const PACKET *pkt,
|
||||
PACKET *subpkt, size_t len)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < len)
|
||||
return 0;
|
||||
|
||||
return PACKET_buf_init(subpkt, pkt->curr, len);
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize |subpkt| with the next |len| bytes read from |pkt|. Data is not
|
||||
* copied: the |subpkt| packet will share its underlying buffer with the
|
||||
* original |pkt|, so data wrapped by |pkt| must outlive the |subpkt|.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_get_sub_packet(PACKET *pkt,
|
||||
PACKET *subpkt, size_t len)
|
||||
{
|
||||
if (!PACKET_peek_sub_packet(pkt, subpkt, len))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Peek ahead at 2 bytes in network order from |pkt| and store the value in
|
||||
* |*data|
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
|
||||
unsigned int *data)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < 2)
|
||||
return 0;
|
||||
|
||||
*data = ((unsigned int)(*pkt->curr)) << 8;
|
||||
*data |= *(pkt->curr + 1);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Equivalent of n2s */
|
||||
/* Get 2 bytes in network order from |pkt| and store the value in |*data| */
|
||||
__owur static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
|
||||
{
|
||||
if (!PACKET_peek_net_2(pkt, data))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, 2);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Same as PACKET_get_net_2() but for a size_t */
|
||||
__owur static ossl_inline int PACKET_get_net_2_len(PACKET *pkt, size_t *data)
|
||||
{
|
||||
unsigned int i;
|
||||
int ret = PACKET_get_net_2(pkt, &i);
|
||||
|
||||
if (ret)
|
||||
*data = (size_t)i;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Peek ahead at 3 bytes in network order from |pkt| and store the value in
|
||||
* |*data|
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_peek_net_3(const PACKET *pkt,
|
||||
unsigned long *data)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < 3)
|
||||
return 0;
|
||||
|
||||
*data = ((unsigned long)(*pkt->curr)) << 16;
|
||||
*data |= ((unsigned long)(*(pkt->curr + 1))) << 8;
|
||||
*data |= *(pkt->curr + 2);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Equivalent of n2l3 */
|
||||
/* Get 3 bytes in network order from |pkt| and store the value in |*data| */
|
||||
__owur static ossl_inline int PACKET_get_net_3(PACKET *pkt, unsigned long *data)
|
||||
{
|
||||
if (!PACKET_peek_net_3(pkt, data))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, 3);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Same as PACKET_get_net_3() but for a size_t */
|
||||
__owur static ossl_inline int PACKET_get_net_3_len(PACKET *pkt, size_t *data)
|
||||
{
|
||||
unsigned long i;
|
||||
int ret = PACKET_get_net_3(pkt, &i);
|
||||
|
||||
if (ret)
|
||||
*data = (size_t)i;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Peek ahead at 4 bytes in network order from |pkt| and store the value in
|
||||
* |*data|
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_peek_net_4(const PACKET *pkt,
|
||||
unsigned long *data)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < 4)
|
||||
return 0;
|
||||
|
||||
*data = ((unsigned long)(*pkt->curr)) << 24;
|
||||
*data |= ((unsigned long)(*(pkt->curr + 1))) << 16;
|
||||
*data |= ((unsigned long)(*(pkt->curr + 2))) << 8;
|
||||
*data |= *(pkt->curr + 3);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Equivalent of n2l */
|
||||
/* Get 4 bytes in network order from |pkt| and store the value in |*data| */
|
||||
__owur static ossl_inline int PACKET_get_net_4(PACKET *pkt, unsigned long *data)
|
||||
{
|
||||
if (!PACKET_peek_net_4(pkt, data))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, 4);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Same as PACKET_get_net_4() but for a size_t */
|
||||
__owur static ossl_inline int PACKET_get_net_4_len(PACKET *pkt, size_t *data)
|
||||
{
|
||||
unsigned long i;
|
||||
int ret = PACKET_get_net_4(pkt, &i);
|
||||
|
||||
if (ret)
|
||||
*data = (size_t)i;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
|
||||
__owur static ossl_inline int PACKET_peek_1(const PACKET *pkt,
|
||||
unsigned int *data)
|
||||
{
|
||||
if (!PACKET_remaining(pkt))
|
||||
return 0;
|
||||
|
||||
*data = *pkt->curr;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Get 1 byte from |pkt| and store the value in |*data| */
|
||||
__owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
|
||||
{
|
||||
if (!PACKET_peek_1(pkt, data))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, 1);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Same as PACKET_get_1() but for a size_t */
|
||||
__owur static ossl_inline int PACKET_get_1_len(PACKET *pkt, size_t *data)
|
||||
{
|
||||
unsigned int i;
|
||||
int ret = PACKET_get_1(pkt, &i);
|
||||
|
||||
if (ret)
|
||||
*data = (size_t)i;
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Peek ahead at 4 bytes in reverse network order from |pkt| and store the value
|
||||
* in |*data|
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_peek_4(const PACKET *pkt,
|
||||
unsigned long *data)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < 4)
|
||||
return 0;
|
||||
|
||||
*data = *pkt->curr;
|
||||
*data |= ((unsigned long)(*(pkt->curr + 1))) << 8;
|
||||
*data |= ((unsigned long)(*(pkt->curr + 2))) << 16;
|
||||
*data |= ((unsigned long)(*(pkt->curr + 3))) << 24;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Equivalent of c2l */
|
||||
/*
|
||||
* Get 4 bytes in reverse network order from |pkt| and store the value in
|
||||
* |*data|
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_get_4(PACKET *pkt, unsigned long *data)
|
||||
{
|
||||
if (!PACKET_peek_4(pkt, data))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, 4);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Peek ahead at |len| bytes from the |pkt| and store a pointer to them in
|
||||
* |*data|. This just points at the underlying buffer that |pkt| is using. The
|
||||
* caller should not free this data directly (it will be freed when the
|
||||
* underlying buffer gets freed
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_peek_bytes(const PACKET *pkt,
|
||||
const unsigned char **data,
|
||||
size_t len)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < len)
|
||||
return 0;
|
||||
|
||||
*data = pkt->curr;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Read |len| bytes from the |pkt| and store a pointer to them in |*data|. This
|
||||
* just points at the underlying buffer that |pkt| is using. The caller should
|
||||
* not free this data directly (it will be freed when the underlying buffer gets
|
||||
* freed
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_get_bytes(PACKET *pkt,
|
||||
const unsigned char **data,
|
||||
size_t len)
|
||||
{
|
||||
if (!PACKET_peek_bytes(pkt, data, len))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
|
||||
__owur static ossl_inline int PACKET_peek_copy_bytes(const PACKET *pkt,
|
||||
unsigned char *data,
|
||||
size_t len)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < len)
|
||||
return 0;
|
||||
|
||||
memcpy(data, pkt->curr, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Read |len| bytes from |pkt| and copy them to |data|.
|
||||
* The caller is responsible for ensuring that |data| can hold |len| bytes.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_copy_bytes(PACKET *pkt,
|
||||
unsigned char *data, size_t len)
|
||||
{
|
||||
if (!PACKET_peek_copy_bytes(pkt, data, len))
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Copy packet data to |dest|, and set |len| to the number of copied bytes.
|
||||
* If the packet has more than |dest_len| bytes, nothing is copied.
|
||||
* Returns 1 if the packet data fits in |dest_len| bytes, 0 otherwise.
|
||||
* Does not forward PACKET position (because it is typically the last thing
|
||||
* done with a given PACKET).
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_copy_all(const PACKET *pkt,
|
||||
unsigned char *dest,
|
||||
size_t dest_len, size_t *len)
|
||||
{
|
||||
if (PACKET_remaining(pkt) > dest_len) {
|
||||
*len = 0;
|
||||
return 0;
|
||||
}
|
||||
*len = pkt->remaining;
|
||||
memcpy(dest, pkt->curr, pkt->remaining);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Copy |pkt| bytes to a newly allocated buffer and store a pointer to the
|
||||
* result in |*data|, and the length in |len|.
|
||||
* If |*data| is not NULL, the old data is OPENSSL_free'd.
|
||||
* If the packet is empty, or malloc fails, |*data| will be set to NULL.
|
||||
* Returns 1 if the malloc succeeds and 0 otherwise.
|
||||
* Does not forward PACKET position (because it is typically the last thing
|
||||
* done with a given PACKET).
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_memdup(const PACKET *pkt,
|
||||
unsigned char **data, size_t *len)
|
||||
{
|
||||
size_t length;
|
||||
|
||||
OPENSSL_free(*data);
|
||||
*data = NULL;
|
||||
*len = 0;
|
||||
|
||||
length = PACKET_remaining(pkt);
|
||||
|
||||
if (length == 0)
|
||||
return 1;
|
||||
|
||||
*data = OPENSSL_memdup(pkt->curr, length);
|
||||
if (*data == NULL)
|
||||
return 0;
|
||||
|
||||
*len = length;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Read a C string from |pkt| and copy to a newly allocated, NUL-terminated
|
||||
* buffer. Store a pointer to the result in |*data|.
|
||||
* If |*data| is not NULL, the old data is OPENSSL_free'd.
|
||||
* If the data in |pkt| does not contain a NUL-byte, the entire data is
|
||||
* copied and NUL-terminated.
|
||||
* Returns 1 if the malloc succeeds and 0 otherwise.
|
||||
* Does not forward PACKET position (because it is typically the last thing done
|
||||
* with a given PACKET).
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_strndup(const PACKET *pkt, char **data)
|
||||
{
|
||||
OPENSSL_free(*data);
|
||||
|
||||
/* This will succeed on an empty packet, unless pkt->curr == NULL. */
|
||||
*data = OPENSSL_strndup((const char *)pkt->curr, PACKET_remaining(pkt));
|
||||
return (*data != NULL);
|
||||
}
|
||||
|
||||
/* Returns 1 if |pkt| contains at least one 0-byte, 0 otherwise. */
|
||||
static ossl_inline int PACKET_contains_zero_byte(const PACKET *pkt)
|
||||
{
|
||||
return memchr(pkt->curr, 0, pkt->remaining) != NULL;
|
||||
}
|
||||
|
||||
/* Move the current reading position forward |len| bytes */
|
||||
__owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
|
||||
{
|
||||
if (PACKET_remaining(pkt) < len)
|
||||
return 0;
|
||||
|
||||
packet_forward(pkt, len);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Reads a variable-length vector prefixed with a one-byte length, and stores
|
||||
* the contents in |subpkt|. |pkt| can equal |subpkt|.
|
||||
* Data is not copied: the |subpkt| packet will share its underlying buffer with
|
||||
* the original |pkt|, so data wrapped by |pkt| must outlive the |subpkt|.
|
||||
* Upon failure, the original |pkt| and |subpkt| are not modified.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_get_length_prefixed_1(PACKET *pkt,
|
||||
PACKET *subpkt)
|
||||
{
|
||||
unsigned int length;
|
||||
const unsigned char *data;
|
||||
PACKET tmp = *pkt;
|
||||
if (!PACKET_get_1(&tmp, &length) ||
|
||||
!PACKET_get_bytes(&tmp, &data, (size_t)length)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pkt = tmp;
|
||||
subpkt->curr = data;
|
||||
subpkt->remaining = length;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Like PACKET_get_length_prefixed_1, but additionally, fails when there are
|
||||
* leftover bytes in |pkt|.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_as_length_prefixed_1(PACKET *pkt,
|
||||
PACKET *subpkt)
|
||||
{
|
||||
unsigned int length;
|
||||
const unsigned char *data;
|
||||
PACKET tmp = *pkt;
|
||||
if (!PACKET_get_1(&tmp, &length) ||
|
||||
!PACKET_get_bytes(&tmp, &data, (size_t)length) ||
|
||||
PACKET_remaining(&tmp) != 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pkt = tmp;
|
||||
subpkt->curr = data;
|
||||
subpkt->remaining = length;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Reads a variable-length vector prefixed with a two-byte length, and stores
|
||||
* the contents in |subpkt|. |pkt| can equal |subpkt|.
|
||||
* Data is not copied: the |subpkt| packet will share its underlying buffer with
|
||||
* the original |pkt|, so data wrapped by |pkt| must outlive the |subpkt|.
|
||||
* Upon failure, the original |pkt| and |subpkt| are not modified.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_get_length_prefixed_2(PACKET *pkt,
|
||||
PACKET *subpkt)
|
||||
{
|
||||
unsigned int length;
|
||||
const unsigned char *data;
|
||||
PACKET tmp = *pkt;
|
||||
|
||||
if (!PACKET_get_net_2(&tmp, &length) ||
|
||||
!PACKET_get_bytes(&tmp, &data, (size_t)length)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pkt = tmp;
|
||||
subpkt->curr = data;
|
||||
subpkt->remaining = length;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Like PACKET_get_length_prefixed_2, but additionally, fails when there are
|
||||
* leftover bytes in |pkt|.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_as_length_prefixed_2(PACKET *pkt,
|
||||
PACKET *subpkt)
|
||||
{
|
||||
unsigned int length;
|
||||
const unsigned char *data;
|
||||
PACKET tmp = *pkt;
|
||||
|
||||
if (!PACKET_get_net_2(&tmp, &length) ||
|
||||
!PACKET_get_bytes(&tmp, &data, (size_t)length) ||
|
||||
PACKET_remaining(&tmp) != 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pkt = tmp;
|
||||
subpkt->curr = data;
|
||||
subpkt->remaining = length;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Reads a variable-length vector prefixed with a three-byte length, and stores
|
||||
* the contents in |subpkt|. |pkt| can equal |subpkt|.
|
||||
* Data is not copied: the |subpkt| packet will share its underlying buffer with
|
||||
* the original |pkt|, so data wrapped by |pkt| must outlive the |subpkt|.
|
||||
* Upon failure, the original |pkt| and |subpkt| are not modified.
|
||||
*/
|
||||
__owur static ossl_inline int PACKET_get_length_prefixed_3(PACKET *pkt,
|
||||
PACKET *subpkt)
|
||||
{
|
||||
unsigned long length;
|
||||
const unsigned char *data;
|
||||
PACKET tmp = *pkt;
|
||||
if (!PACKET_get_net_3(&tmp, &length) ||
|
||||
!PACKET_get_bytes(&tmp, &data, (size_t)length)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pkt = tmp;
|
||||
subpkt->curr = data;
|
||||
subpkt->remaining = length;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Writeable packets */
|
||||
|
||||
typedef struct wpacket_sub WPACKET_SUB;
|
||||
struct wpacket_sub {
|
||||
/* The parent WPACKET_SUB if we have one or NULL otherwise */
|
||||
WPACKET_SUB *parent;
|
||||
|
||||
/*
|
||||
* Offset into the buffer where the length of this WPACKET goes. We use an
|
||||
* offset in case the buffer grows and gets reallocated.
|
||||
*/
|
||||
size_t packet_len;
|
||||
|
||||
/* Number of bytes in the packet_len or 0 if we don't write the length */
|
||||
size_t lenbytes;
|
||||
|
||||
/* Number of bytes written to the buf prior to this packet starting */
|
||||
size_t pwritten;
|
||||
|
||||
/* Flags for this sub-packet */
|
||||
unsigned int flags;
|
||||
};
|
||||
|
||||
typedef struct wpacket_st WPACKET;
|
||||
struct wpacket_st {
|
||||
/* The buffer where we store the output data */
|
||||
BUF_MEM *buf;
|
||||
|
||||
/* Fixed sized buffer which can be used as an alternative to buf */
|
||||
unsigned char *staticbuf;
|
||||
|
||||
/*
|
||||
* Offset into the buffer where we are currently writing. We use an offset
|
||||
* in case the buffer grows and gets reallocated.
|
||||
*/
|
||||
size_t curr;
|
||||
|
||||
/* Number of bytes written so far */
|
||||
size_t written;
|
||||
|
||||
/* Maximum number of bytes we will allow to be written to this WPACKET */
|
||||
size_t maxsize;
|
||||
|
||||
/* Our sub-packets (always at least one if not finished) */
|
||||
WPACKET_SUB *subs;
|
||||
};
|
||||
|
||||
/* Flags */
|
||||
|
||||
/* Default */
|
||||
#define WPACKET_FLAGS_NONE 0
|
||||
|
||||
/* Error on WPACKET_close() if no data written to the WPACKET */
|
||||
#define WPACKET_FLAGS_NON_ZERO_LENGTH 1
|
||||
|
||||
/*
|
||||
* Abandon all changes on WPACKET_close() if no data written to the WPACKET,
|
||||
* i.e. this does not write out a zero packet length
|
||||
*/
|
||||
#define WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH 2
|
||||
|
||||
|
||||
/*
|
||||
* Initialise a WPACKET with the buffer in |buf|. The buffer must exist
|
||||
* for the whole time that the WPACKET is being used. Additionally |lenbytes| of
|
||||
* data is preallocated at the start of the buffer to store the length of the
|
||||
* WPACKET once we know it.
|
||||
*/
|
||||
int WPACKET_init_len(WPACKET *pkt, BUF_MEM *buf, size_t lenbytes);
|
||||
|
||||
/*
|
||||
* Same as WPACKET_init_len except there is no preallocation of the WPACKET
|
||||
* length.
|
||||
*/
|
||||
int WPACKET_init(WPACKET *pkt, BUF_MEM *buf);
|
||||
|
||||
/*
|
||||
* Same as WPACKET_init_len except we do not use a growable BUF_MEM structure.
|
||||
* A fixed buffer of memory |buf| of size |len| is used instead. A failure will
|
||||
* occur if you attempt to write beyond the end of the buffer
|
||||
*/
|
||||
int WPACKET_init_static_len(WPACKET *pkt, unsigned char *buf, size_t len,
|
||||
size_t lenbytes);
|
||||
/*
|
||||
* Set the flags to be applied to the current sub-packet
|
||||
*/
|
||||
int WPACKET_set_flags(WPACKET *pkt, unsigned int flags);
|
||||
|
||||
/*
|
||||
* Closes the most recent sub-packet. It also writes out the length of the
|
||||
* packet to the required location (normally the start of the WPACKET) if
|
||||
* appropriate. The top level WPACKET should be closed using WPACKET_finish()
|
||||
* instead of this function.
|
||||
*/
|
||||
int WPACKET_close(WPACKET *pkt);
|
||||
|
||||
/*
|
||||
* The same as WPACKET_close() but only for the top most WPACKET. Additionally
|
||||
* frees memory resources for this WPACKET.
|
||||
*/
|
||||
int WPACKET_finish(WPACKET *pkt);
|
||||
|
||||
/*
|
||||
* Iterate through all the sub-packets and write out their lengths as if they
|
||||
* were being closed. The lengths will be overwritten with the final lengths
|
||||
* when the sub-packets are eventually closed (which may be different if more
|
||||
* data is added to the WPACKET). This function fails if a sub-packet is of 0
|
||||
* length and WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH is set.
|
||||
*/
|
||||
int WPACKET_fill_lengths(WPACKET *pkt);
|
||||
|
||||
/*
|
||||
* Initialise a new sub-packet. Additionally |lenbytes| of data is preallocated
|
||||
* at the start of the sub-packet to store its length once we know it. Don't
|
||||
* call this directly. Use the convenience macros below instead.
|
||||
*/
|
||||
int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes);
|
||||
|
||||
/*
|
||||
* Convenience macros for calling WPACKET_start_sub_packet_len with different
|
||||
* lengths
|
||||
*/
|
||||
#define WPACKET_start_sub_packet_u8(pkt) \
|
||||
WPACKET_start_sub_packet_len__((pkt), 1)
|
||||
#define WPACKET_start_sub_packet_u16(pkt) \
|
||||
WPACKET_start_sub_packet_len__((pkt), 2)
|
||||
#define WPACKET_start_sub_packet_u24(pkt) \
|
||||
WPACKET_start_sub_packet_len__((pkt), 3)
|
||||
#define WPACKET_start_sub_packet_u32(pkt) \
|
||||
WPACKET_start_sub_packet_len__((pkt), 4)
|
||||
|
||||
/*
|
||||
* Same as WPACKET_start_sub_packet_len__() except no bytes are pre-allocated
|
||||
* for the sub-packet length.
|
||||
*/
|
||||
int WPACKET_start_sub_packet(WPACKET *pkt);
|
||||
|
||||
/*
|
||||
* Allocate bytes in the WPACKET for the output. This reserves the bytes
|
||||
* and counts them as "written", but doesn't actually do the writing. A pointer
|
||||
* to the allocated bytes is stored in |*allocbytes|. |allocbytes| may be NULL.
|
||||
* WARNING: the allocated bytes must be filled in immediately, without further
|
||||
* WPACKET_* calls. If not then the underlying buffer may be realloc'd and
|
||||
* change its location.
|
||||
*/
|
||||
int WPACKET_allocate_bytes(WPACKET *pkt, size_t len,
|
||||
unsigned char **allocbytes);
|
||||
|
||||
/*
|
||||
* The same as WPACKET_allocate_bytes() except additionally a new sub-packet is
|
||||
* started for the allocated bytes, and then closed immediately afterwards. The
|
||||
* number of length bytes for the sub-packet is in |lenbytes|. Don't call this
|
||||
* directly. Use the convenience macros below instead.
|
||||
*/
|
||||
int WPACKET_sub_allocate_bytes__(WPACKET *pkt, size_t len,
|
||||
unsigned char **allocbytes, size_t lenbytes);
|
||||
|
||||
/*
|
||||
* Convenience macros for calling WPACKET_sub_allocate_bytes with different
|
||||
* lengths
|
||||
*/
|
||||
#define WPACKET_sub_allocate_bytes_u8(pkt, len, bytes) \
|
||||
WPACKET_sub_allocate_bytes__((pkt), (len), (bytes), 1)
|
||||
#define WPACKET_sub_allocate_bytes_u16(pkt, len, bytes) \
|
||||
WPACKET_sub_allocate_bytes__((pkt), (len), (bytes), 2)
|
||||
#define WPACKET_sub_allocate_bytes_u24(pkt, len, bytes) \
|
||||
WPACKET_sub_allocate_bytes__((pkt), (len), (bytes), 3)
|
||||
#define WPACKET_sub_allocate_bytes_u32(pkt, len, bytes) \
|
||||
WPACKET_sub_allocate_bytes__((pkt), (len), (bytes), 4)
|
||||
|
||||
/*
|
||||
* The same as WPACKET_allocate_bytes() except the reserved bytes are not
|
||||
* actually counted as written. Typically this will be for when we don't know
|
||||
* how big arbitrary data is going to be up front, but we do know what the
|
||||
* maximum size will be. If this function is used, then it should be immediately
|
||||
* followed by a WPACKET_allocate_bytes() call before any other WPACKET
|
||||
* functions are called (unless the write to the allocated bytes is abandoned).
|
||||
*
|
||||
* For example: If we are generating a signature, then the size of that
|
||||
* signature may not be known in advance. We can use WPACKET_reserve_bytes() to
|
||||
* handle this:
|
||||
*
|
||||
* if (!WPACKET_sub_reserve_bytes_u16(&pkt, EVP_PKEY_size(pkey), &sigbytes1)
|
||||
* || EVP_SignFinal(md_ctx, sigbytes1, &siglen, pkey) <= 0
|
||||
* || !WPACKET_sub_allocate_bytes_u16(&pkt, siglen, &sigbytes2)
|
||||
* || sigbytes1 != sigbytes2)
|
||||
* goto err;
|
||||
*/
|
||||
int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes);
|
||||
|
||||
/*
|
||||
* The "reserve_bytes" equivalent of WPACKET_sub_allocate_bytes__()
|
||||
*/
|
||||
int WPACKET_sub_reserve_bytes__(WPACKET *pkt, size_t len,
|
||||
unsigned char **allocbytes, size_t lenbytes);
|
||||
|
||||
/*
|
||||
* Convenience macros for WPACKET_sub_reserve_bytes with different lengths
|
||||
*/
|
||||
#define WPACKET_sub_reserve_bytes_u8(pkt, len, bytes) \
|
||||
WPACKET_reserve_bytes__((pkt), (len), (bytes), 1)
|
||||
#define WPACKET_sub_reserve_bytes_u16(pkt, len, bytes) \
|
||||
WPACKET_sub_reserve_bytes__((pkt), (len), (bytes), 2)
|
||||
#define WPACKET_sub_reserve_bytes_u24(pkt, len, bytes) \
|
||||
WPACKET_sub_reserve_bytes__((pkt), (len), (bytes), 3)
|
||||
#define WPACKET_sub_reserve_bytes_u32(pkt, len, bytes) \
|
||||
WPACKET_sub_reserve_bytes__((pkt), (len), (bytes), 4)
|
||||
|
||||
/*
|
||||
* Write the value stored in |val| into the WPACKET. The value will consume
|
||||
* |bytes| amount of storage. An error will occur if |val| cannot be
|
||||
* accommodated in |bytes| storage, e.g. attempting to write the value 256 into
|
||||
* 1 byte will fail. Don't call this directly. Use the convenience macros below
|
||||
* instead.
|
||||
*/
|
||||
int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t bytes);
|
||||
|
||||
/*
|
||||
* Convenience macros for calling WPACKET_put_bytes with different
|
||||
* lengths
|
||||
*/
|
||||
#define WPACKET_put_bytes_u8(pkt, val) \
|
||||
WPACKET_put_bytes__((pkt), (val), 1)
|
||||
#define WPACKET_put_bytes_u16(pkt, val) \
|
||||
WPACKET_put_bytes__((pkt), (val), 2)
|
||||
#define WPACKET_put_bytes_u24(pkt, val) \
|
||||
WPACKET_put_bytes__((pkt), (val), 3)
|
||||
#define WPACKET_put_bytes_u32(pkt, val) \
|
||||
WPACKET_put_bytes__((pkt), (val), 4)
|
||||
|
||||
/* Set a maximum size that we will not allow the WPACKET to grow beyond */
|
||||
int WPACKET_set_max_size(WPACKET *pkt, size_t maxsize);
|
||||
|
||||
/* Copy |len| bytes of data from |*src| into the WPACKET. */
|
||||
int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len);
|
||||
|
||||
/* Set |len| bytes of data to |ch| into the WPACKET. */
|
||||
int WPACKET_memset(WPACKET *pkt, int ch, size_t len);
|
||||
|
||||
/*
|
||||
* Copy |len| bytes of data from |*src| into the WPACKET and prefix with its
|
||||
* length (consuming |lenbytes| of data for the length). Don't call this
|
||||
* directly. Use the convenience macros below instead.
|
||||
*/
|
||||
int WPACKET_sub_memcpy__(WPACKET *pkt, const void *src, size_t len,
|
||||
size_t lenbytes);
|
||||
|
||||
/* Convenience macros for calling WPACKET_sub_memcpy with different lengths */
|
||||
#define WPACKET_sub_memcpy_u8(pkt, src, len) \
|
||||
WPACKET_sub_memcpy__((pkt), (src), (len), 1)
|
||||
#define WPACKET_sub_memcpy_u16(pkt, src, len) \
|
||||
WPACKET_sub_memcpy__((pkt), (src), (len), 2)
|
||||
#define WPACKET_sub_memcpy_u24(pkt, src, len) \
|
||||
WPACKET_sub_memcpy__((pkt), (src), (len), 3)
|
||||
#define WPACKET_sub_memcpy_u32(pkt, src, len) \
|
||||
WPACKET_sub_memcpy__((pkt), (src), (len), 4)
|
||||
|
||||
/*
|
||||
* Return the total number of bytes written so far to the underlying buffer
|
||||
* including any storage allocated for length bytes
|
||||
*/
|
||||
int WPACKET_get_total_written(WPACKET *pkt, size_t *written);
|
||||
|
||||
/*
|
||||
* Returns the length of the current sub-packet. This excludes any bytes
|
||||
* allocated for the length itself.
|
||||
*/
|
||||
int WPACKET_get_length(WPACKET *pkt, size_t *len);
|
||||
|
||||
/*
|
||||
* Returns a pointer to the current write location, but does not allocate any
|
||||
* bytes.
|
||||
*/
|
||||
unsigned char *WPACKET_get_curr(WPACKET *pkt);
|
||||
|
||||
/* Release resources in a WPACKET if a failure has occurred. */
|
||||
void WPACKET_cleanup(WPACKET *pkt);
|
||||
|
||||
#endif /* HEADER_PACKET_LOCL_H */
|
||||
@@ -13,7 +13,7 @@
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/buffer.h>
|
||||
#include "record_locl.h"
|
||||
#include "../packet_locl.h"
|
||||
#include "internal/packet.h"
|
||||
#include "internal/cryptlib.h"
|
||||
|
||||
int DTLS_RECORD_LAYER_new(RECORD_LAYER *rl)
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
#include <openssl/buffer.h>
|
||||
#include <openssl/rand.h>
|
||||
#include "record_locl.h"
|
||||
#include "../packet_locl.h"
|
||||
#include "internal/packet.h"
|
||||
|
||||
#if defined(OPENSSL_SMALL_FOOTPRINT) || \
|
||||
!( defined(AES_ASM) && ( \
|
||||
@@ -639,8 +639,9 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, size_t len,
|
||||
*/
|
||||
s->s3.empty_fragment_done = 0;
|
||||
|
||||
if ((i == (int)n) && s->mode & SSL_MODE_RELEASE_BUFFERS &&
|
||||
!SSL_IS_DTLS(s))
|
||||
if (tmpwrit == n
|
||||
&& (s->mode & SSL_MODE_RELEASE_BUFFERS) != 0
|
||||
&& !SSL_IS_DTLS(s))
|
||||
ssl3_release_write_buffer(s);
|
||||
|
||||
*written = tot + tmpwrit;
|
||||
|
||||
@@ -1703,7 +1703,7 @@ int dtls1_process_record(SSL *s, DTLS1_BITMAP *bitmap)
|
||||
return 0;
|
||||
}
|
||||
OSSL_TRACE_BEGIN(TLS) {
|
||||
BIO_printf(trc_out, "dec %ld\n", rr->length);
|
||||
BIO_printf(trc_out, "dec %zd\n", rr->length);
|
||||
BIO_dump_indent(trc_out, rr->data, rr->length, 4);
|
||||
} OSSL_TRACE_END(TLS);
|
||||
|
||||
|
||||
+6
-5
@@ -3606,6 +3606,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
|
||||
|
||||
case SSL_CTRL_GET_CHAIN_CERTS:
|
||||
*(STACK_OF(X509) **)parg = s->cert->key->chain;
|
||||
ret = 1;
|
||||
break;
|
||||
|
||||
case SSL_CTRL_SELECT_CURRENT_CERT:
|
||||
@@ -3670,13 +3671,13 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
|
||||
{
|
||||
uint16_t id = tls1_shared_group(s, larg);
|
||||
|
||||
if (larg != -1) {
|
||||
const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(id);
|
||||
|
||||
return ginf == NULL ? 0 : ginf->nid;
|
||||
}
|
||||
if (larg != -1)
|
||||
return tls1_group_id2nid(id);
|
||||
return id;
|
||||
}
|
||||
case SSL_CTRL_GET_NEGOTIATED_GROUP:
|
||||
ret = tls1_group_id2nid(s->s3.group_id);
|
||||
break;
|
||||
#endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */
|
||||
|
||||
case SSL_CTRL_SET_SIGALGS:
|
||||
|
||||
+3
-2
@@ -766,8 +766,9 @@ int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
|
||||
}
|
||||
|
||||
if (errno) {
|
||||
SYSerr(SYS_F_OPENDIR, get_last_sys_error());
|
||||
ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
|
||||
ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
|
||||
"calling OPENSSL_dir_read(%s)",
|
||||
dir);
|
||||
SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
|
||||
goto err;
|
||||
}
|
||||
|
||||
+7
-6
@@ -1442,24 +1442,25 @@ int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str)
|
||||
{
|
||||
int ret = set_ciphersuites(&(ctx->tls13_ciphersuites), str);
|
||||
|
||||
if (ret && ctx->cipher_list != NULL) {
|
||||
/* We already have a cipher_list, so we need to update it */
|
||||
if (ret && ctx->cipher_list != NULL)
|
||||
return update_cipher_list(&ctx->cipher_list->ciphers, &ctx->cipher_list_by_id,
|
||||
ctx->tls13_ciphersuites);
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int SSL_set_ciphersuites(SSL *s, const char *str)
|
||||
{
|
||||
STACK_OF(SSL_CIPHER) *cipher_list;
|
||||
int ret = set_ciphersuites(&(s->tls13_ciphersuites), str);
|
||||
|
||||
if (ret && s->cipher_list != NULL) {
|
||||
/* We already have a cipher_list, so we need to update it */
|
||||
if (s->cipher_list == NULL) {
|
||||
if ((cipher_list = SSL_get_ciphers(s)) != NULL)
|
||||
s->cipher_list->ciphers = sk_SSL_CIPHER_dup(cipher_list);
|
||||
}
|
||||
if (ret && s->cipher_list != NULL)
|
||||
return update_cipher_list(&s->cipher_list->ciphers, &s->cipher_list_by_id,
|
||||
s->tls13_ciphersuites);
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
+1
-715
@@ -13,718 +13,6 @@
|
||||
|
||||
#ifndef OPENSSL_NO_ERR
|
||||
|
||||
static const ERR_STRING_DATA SSL_str_functs[] = {
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_ADD_CLIENT_KEY_SHARE_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_ADD_KEY_SHARE, 0), "add_key_share"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_BYTES_TO_CIPHER_LIST, 0),
|
||||
"bytes_to_cipher_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CHECK_SUITEB_CIPHER_LIST, 0),
|
||||
"check_suiteb_cipher_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CIPHERSUITE_CB, 0), "ciphersuite_cb"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CONSTRUCT_CA_NAMES, 0), "construct_ca_names"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CONSTRUCT_KEY_EXCHANGE_TBS, 0),
|
||||
"construct_key_exchange_tbs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CONSTRUCT_STATEFUL_TICKET, 0),
|
||||
"construct_stateful_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CONSTRUCT_STATELESS_TICKET, 0),
|
||||
"construct_stateless_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CREATE_SYNTHETIC_MESSAGE_HASH, 0),
|
||||
"create_synthetic_message_hash"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CREATE_TICKET_PREQUEL, 0),
|
||||
"create_ticket_prequel"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CT_MOVE_SCTS, 0), "ct_move_scts"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CT_STRICT, 0), "ct_strict"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CUSTOM_EXT_ADD, 0), "custom_ext_add"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_CUSTOM_EXT_PARSE, 0), "custom_ext_parse"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_D2I_SSL_SESSION, 0), "d2i_SSL_SESSION"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DANE_CTX_ENABLE, 0), "dane_ctx_enable"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DANE_MTYPE_SET, 0), "dane_mtype_set"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DANE_TLSA_ADD, 0), "dane_tlsa_add"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DERIVE_SECRET_KEY_AND_IV, 0),
|
||||
"derive_secret_key_and_iv"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DO_DTLS1_WRITE, 0), "do_dtls1_write"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DO_SSL3_WRITE, 0), "do_ssl3_write"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_BUFFER_RECORD, 0),
|
||||
"dtls1_buffer_record"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_CHECK_TIMEOUT_NUM, 0),
|
||||
"dtls1_check_timeout_num"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_HM_FRAGMENT_NEW, 0),
|
||||
"dtls1_hm_fragment_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_PREPROCESS_FRAGMENT, 0),
|
||||
"dtls1_preprocess_fragment"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_PROCESS_BUFFERED_RECORDS, 0),
|
||||
"dtls1_process_buffered_records"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_PROCESS_RECORD, 0),
|
||||
"dtls1_process_record"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_READ_BYTES, 0), "dtls1_read_bytes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_READ_FAILED, 0), "dtls1_read_failed"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_RETRANSMIT_MESSAGE, 0),
|
||||
"dtls1_retransmit_message"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_WRITE_APP_DATA_BYTES, 0),
|
||||
"dtls1_write_app_data_bytes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS1_WRITE_BYTES, 0), "dtls1_write_bytes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLSV1_LISTEN, 0), "DTLSv1_listen"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC, 0),
|
||||
"dtls_construct_change_cipher_spec"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST, 0),
|
||||
"dtls_construct_hello_verify_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, 0),
|
||||
"dtls_get_reassembled_message"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS_PROCESS_HELLO_VERIFY, 0),
|
||||
"dtls_process_hello_verify"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS_RECORD_LAYER_NEW, 0),
|
||||
"DTLS_RECORD_LAYER_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_DTLS_WAIT_FOR_DRY, 0), "dtls_wait_for_dry"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_EARLY_DATA_COUNT_OK, 0),
|
||||
"early_data_count_ok"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_EARLY_DATA, 0), "final_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_EC_PT_FORMATS, 0),
|
||||
"final_ec_pt_formats"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_EMS, 0), "final_ems"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_KEY_SHARE, 0), "final_key_share"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_MAXFRAGMENTLEN, 0),
|
||||
"final_maxfragmentlen"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_RENEGOTIATE, 0), "final_renegotiate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_SERVER_NAME, 0), "final_server_name"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_FINAL_SIG_ALGS, 0), "final_sig_algs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_GET_CERT_VERIFY_TBS_DATA, 0),
|
||||
"get_cert_verify_tbs_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_NSS_KEYLOG_INT, 0), "nss_keylog_int"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OPENSSL_INIT_SSL, 0), "OPENSSL_init_ssl"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT13_READ_TRANSITION, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION, 0),
|
||||
"ossl_statem_client13_write_transition"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT_CONSTRUCT_MESSAGE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT_POST_PROCESS_MESSAGE, 0),
|
||||
"ossl_statem_client_post_process_message"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT_PROCESS_MESSAGE, 0),
|
||||
"ossl_statem_client_process_message"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT_READ_TRANSITION, 0),
|
||||
"ossl_statem_client_read_transition"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_CLIENT_WRITE_TRANSITION, 0),
|
||||
"ossl_statem_client_write_transition"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER13_READ_TRANSITION, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER13_WRITE_TRANSITION, 0),
|
||||
"ossl_statem_server13_write_transition"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER_CONSTRUCT_MESSAGE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER_POST_PROCESS_MESSAGE, 0),
|
||||
"ossl_statem_server_post_process_message"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER_POST_WORK, 0),
|
||||
"ossl_statem_server_post_work"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER_PROCESS_MESSAGE, 0),
|
||||
"ossl_statem_server_process_message"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION, 0),
|
||||
"ossl_statem_server_read_transition"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_OSSL_STATEM_SERVER_WRITE_TRANSITION, 0),
|
||||
"ossl_statem_server_write_transition"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_PARSE_CA_NAMES, 0), "parse_ca_names"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_PITEM_NEW, 0), "pitem_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_PQUEUE_NEW, 0), "pqueue_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_PROCESS_KEY_SHARE_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_READ_STATE_MACHINE, 0), "read_state_machine"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SET_CLIENT_CIPHERSUITE, 0),
|
||||
"set_client_ciphersuite"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, 0),
|
||||
"srp_generate_client_master_secret"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SRP_GENERATE_SERVER_MASTER_SECRET, 0),
|
||||
"srp_generate_server_master_secret"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SRP_VERIFY_SERVER_PARAM, 0),
|
||||
"srp_verify_server_param"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_CHANGE_CIPHER_STATE, 0),
|
||||
"ssl3_change_cipher_state"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 0),
|
||||
"ssl3_check_cert_and_algorithm"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_CTRL, 0), "ssl3_ctrl"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_CTX_CTRL, 0), "ssl3_ctx_ctrl"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_DIGEST_CACHED_RECORDS, 0),
|
||||
"ssl3_digest_cached_records"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, 0),
|
||||
"ssl3_do_change_cipher_spec"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_ENC, 0), "ssl3_enc"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_FINAL_FINISH_MAC, 0),
|
||||
"ssl3_final_finish_mac"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_FINISH_MAC, 0), "ssl3_finish_mac"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_GENERATE_KEY_BLOCK, 0),
|
||||
"ssl3_generate_key_block"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_GENERATE_MASTER_SECRET, 0),
|
||||
"ssl3_generate_master_secret"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_GET_RECORD, 0), "ssl3_get_record"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_INIT_FINISHED_MAC, 0),
|
||||
"ssl3_init_finished_mac"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_OUTPUT_CERT_CHAIN, 0),
|
||||
"ssl3_output_cert_chain"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_READ_BYTES, 0), "ssl3_read_bytes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_READ_N, 0), "ssl3_read_n"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_SETUP_KEY_BLOCK, 0),
|
||||
"ssl3_setup_key_block"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_SETUP_READ_BUFFER, 0),
|
||||
"ssl3_setup_read_buffer"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_SETUP_WRITE_BUFFER, 0),
|
||||
"ssl3_setup_write_buffer"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_WRITE_BYTES, 0), "ssl3_write_bytes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_WRITE_PENDING, 0), "ssl3_write_pending"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_CHAIN, 0), "ssl_add_cert_chain"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_TO_BUF, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_TO_WPACKET, 0),
|
||||
"ssl_add_cert_to_wpacket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, 0),
|
||||
"SSL_add_dir_cert_subjects_to_stack"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK, 0),
|
||||
"SSL_add_file_cert_subjects_to_stack"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_BAD_METHOD, 0), "ssl_bad_method"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_BUILD_CERT_CHAIN, 0),
|
||||
"ssl_build_cert_chain"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_BYTES_TO_CIPHER_LIST, 0),
|
||||
"SSL_bytes_to_cipher_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CACHE_CIPHERLIST, 0),
|
||||
"ssl_cache_cipherlist"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CERT_ADD0_CHAIN_CERT, 0),
|
||||
"ssl_cert_add0_chain_cert"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CERT_DUP, 0), "ssl_cert_dup"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CERT_NEW, 0), "ssl_cert_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CERT_SET0_CHAIN, 0),
|
||||
"ssl_cert_set0_chain"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CHECK_PRIVATE_KEY, 0),
|
||||
"SSL_check_private_key"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CHECK_SRP_EXT_CLIENTHELLO, 0),
|
||||
"ssl_check_srp_ext_ClientHello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, 0),
|
||||
"ssl_check_srvr_ecc_cert_and_alg"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CHOOSE_CLIENT_VERSION, 0),
|
||||
"ssl_choose_client_version"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CIPHER_DESCRIPTION, 0),
|
||||
"SSL_CIPHER_description"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CIPHER_LIST_TO_BYTES, 0),
|
||||
"ssl_cipher_list_to_bytes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CIPHER_PROCESS_RULESTR, 0),
|
||||
"ssl_cipher_process_rulestr"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CIPHER_STRENGTH_SORT, 0),
|
||||
"ssl_cipher_strength_sort"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CLEAR, 0), "SSL_clear"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT, 0),
|
||||
"SSL_client_hello_get1_extensions_present"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, 0),
|
||||
"SSL_COMP_add_compression_method"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CONF_CMD, 0), "SSL_CONF_cmd"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CREATE_CIPHER_LIST, 0),
|
||||
"ssl_create_cipher_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTRL, 0), "SSL_ctrl"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, 0),
|
||||
"SSL_CTX_check_private_key"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_ENABLE_CT, 0), "SSL_CTX_enable_ct"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_MAKE_PROFILES, 0),
|
||||
"ssl_ctx_make_profiles"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_NEW, 0), "SSL_CTX_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_ALPN_PROTOS, 0),
|
||||
"SSL_CTX_set_alpn_protos"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_CIPHER_LIST, 0),
|
||||
"SSL_CTX_set_cipher_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, 0),
|
||||
"SSL_CTX_set_client_cert_engine"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_CT_VALIDATION_CALLBACK, 0),
|
||||
"SSL_CTX_set_ct_validation_callback"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT, 0),
|
||||
"SSL_CTX_set_session_id_context"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_SSL_VERSION, 0),
|
||||
"SSL_CTX_set_ssl_version"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_SET_TLSEXT_MAX_FRAGMENT_LENGTH, 0),
|
||||
"SSL_CTX_set_tlsext_max_fragment_length"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_CERTIFICATE, 0),
|
||||
"SSL_CTX_use_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, 0),
|
||||
"SSL_CTX_use_certificate_ASN1"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, 0),
|
||||
"SSL_CTX_use_certificate_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_PRIVATEKEY, 0),
|
||||
"SSL_CTX_use_PrivateKey"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, 0),
|
||||
"SSL_CTX_use_PrivateKey_ASN1"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, 0),
|
||||
"SSL_CTX_use_PrivateKey_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, 0),
|
||||
"SSL_CTX_use_psk_identity_hint"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, 0),
|
||||
"SSL_CTX_use_RSAPrivateKey"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, 0),
|
||||
"SSL_CTX_use_RSAPrivateKey_ASN1"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, 0),
|
||||
"SSL_CTX_use_RSAPrivateKey_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_SERVERINFO, 0),
|
||||
"SSL_CTX_use_serverinfo"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_SERVERINFO_EX, 0),
|
||||
"SSL_CTX_use_serverinfo_ex"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_CTX_USE_SERVERINFO_FILE, 0),
|
||||
"SSL_CTX_use_serverinfo_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_DANE_DUP, 0), "ssl_dane_dup"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_DANE_ENABLE, 0), "SSL_dane_enable"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_DERIVE, 0), "ssl_derive"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_DO_CONFIG, 0), "ssl_do_config"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_DO_HANDSHAKE, 0), "SSL_do_handshake"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_DUP_CA_LIST, 0), "SSL_dup_CA_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ENABLE_CT, 0), "SSL_enable_ct"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_GENERATE_PKEY_GROUP, 0),
|
||||
"ssl_generate_pkey_group"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_GENERATE_SESSION_ID, 0),
|
||||
"ssl_generate_session_id"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_GET_NEW_SESSION, 0),
|
||||
"ssl_get_new_session"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_GET_PREV_SESSION, 0),
|
||||
"ssl_get_prev_session"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_GET_SERVER_CERT_INDEX, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_GET_SIGN_PKEY, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_HANDSHAKE_HASH, 0), "ssl_handshake_hash"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_INIT_WBIO_BUFFER, 0),
|
||||
"ssl_init_wbio_buffer"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_KEY_UPDATE, 0), "SSL_key_update"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_LOAD_CLIENT_CA_FILE, 0),
|
||||
"SSL_load_client_CA_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_LOG_MASTER_SECRET, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, 0),
|
||||
"ssl_log_rsa_client_key_exchange"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_MODULE_INIT, 0), "ssl_module_init"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_NEW, 0), "SSL_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_NEXT_PROTO_VALIDATE, 0),
|
||||
"ssl_next_proto_validate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PEEK, 0), "SSL_peek"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PEEK_EX, 0), "SSL_peek_ex"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_PEEK_INTERNAL, 0), "ssl_peek_internal"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_READ, 0), "SSL_read"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_READ_EARLY_DATA, 0),
|
||||
"SSL_read_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_READ_EX, 0), "SSL_read_ex"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_READ_INTERNAL, 0), "ssl_read_internal"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_RENEGOTIATE, 0), "SSL_renegotiate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_RENEGOTIATE_ABBREVIATED, 0),
|
||||
"SSL_renegotiate_abbreviated"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SENDFILE, 0), "SSL_sendfile"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_DUP, 0), "ssl_session_dup"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_NEW, 0), "SSL_SESSION_new"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_PRINT_FP, 0),
|
||||
"SSL_SESSION_print_fp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_SET1_ID, 0),
|
||||
"SSL_SESSION_set1_id"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_SET1_ID_CONTEXT, 0),
|
||||
"SSL_SESSION_set1_id_context"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_ALPN_PROTOS, 0),
|
||||
"SSL_set_alpn_protos"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CERT, 0), "ssl_set_cert"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CERT_AND_KEY, 0),
|
||||
"ssl_set_cert_and_key"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CIPHER_LIST, 0),
|
||||
"SSL_set_cipher_list"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_CT_VALIDATION_CALLBACK, 0),
|
||||
"SSL_set_ct_validation_callback"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_FD, 0), "SSL_set_fd"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_PKEY, 0), "ssl_set_pkey"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_RFD, 0), "SSL_set_rfd"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_SESSION, 0), "SSL_set_session"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_SESSION_ID_CONTEXT, 0),
|
||||
"SSL_set_session_id_context"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_SESSION_TICKET_EXT, 0),
|
||||
"SSL_set_session_ticket_ext"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_TLSEXT_MAX_FRAGMENT_LENGTH, 0),
|
||||
"SSL_set_tlsext_max_fragment_length"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SET_WFD, 0), "SSL_set_wfd"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SHUTDOWN, 0), "SSL_shutdown"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SRP_CTX_INIT, 0), "SSL_SRP_CTX_init"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_START_ASYNC_JOB, 0),
|
||||
"ssl_start_async_job"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_UNDEFINED_FUNCTION, 0),
|
||||
"ssl_undefined_function"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_UNDEFINED_VOID_FUNCTION, 0),
|
||||
"ssl_undefined_void_function"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_CERTIFICATE, 0),
|
||||
"SSL_use_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_CERTIFICATE_ASN1, 0),
|
||||
"SSL_use_certificate_ASN1"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_CERTIFICATE_FILE, 0),
|
||||
"SSL_use_certificate_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_PRIVATEKEY, 0), "SSL_use_PrivateKey"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_PRIVATEKEY_ASN1, 0),
|
||||
"SSL_use_PrivateKey_ASN1"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_PRIVATEKEY_FILE, 0),
|
||||
"SSL_use_PrivateKey_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_PSK_IDENTITY_HINT, 0),
|
||||
"SSL_use_psk_identity_hint"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_RSAPRIVATEKEY, 0),
|
||||
"SSL_use_RSAPrivateKey"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, 0),
|
||||
"SSL_use_RSAPrivateKey_ASN1"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, 0),
|
||||
"SSL_use_RSAPrivateKey_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_VALIDATE_CT, 0), "ssl_validate_ct"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_VERIFY_CERT_CHAIN, 0),
|
||||
"ssl_verify_cert_chain"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, 0),
|
||||
"SSL_verify_client_post_handshake"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_WRITE, 0), "SSL_write"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_WRITE_EARLY_DATA, 0),
|
||||
"SSL_write_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_WRITE_EARLY_FINISH, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_WRITE_EX, 0), "SSL_write_ex"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_WRITE_INTERNAL, 0), "ssl_write_internal"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_STATE_MACHINE, 0), "state_machine"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS12_CHECK_PEER_SIGALG, 0),
|
||||
"tls12_check_peer_sigalg"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS12_COPY_SIGALGS, 0), "tls12_copy_sigalgs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_CHANGE_CIPHER_STATE, 0),
|
||||
"tls13_change_cipher_state"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_ENC, 0), "tls13_enc"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_FINAL_FINISH_MAC, 0),
|
||||
"tls13_final_finish_mac"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_GENERATE_SECRET, 0),
|
||||
"tls13_generate_secret"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_HKDF_EXPAND, 0), "tls13_hkdf_expand"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_RESTORE_HANDSHAKE_DIGEST_FOR_PHA, 0),
|
||||
"tls13_restore_handshake_digest_for_pha"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_SAVE_HANDSHAKE_DIGEST_FOR_PHA, 0),
|
||||
"tls13_save_handshake_digest_for_pha"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS13_SETUP_KEY_BLOCK, 0),
|
||||
"tls13_setup_key_block"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_CHANGE_CIPHER_STATE, 0),
|
||||
"tls1_change_cipher_state"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_CHECK_DUPLICATE_EXTENSIONS, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_ENC, 0), "tls1_enc"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_EXPORT_KEYING_MATERIAL, 0),
|
||||
"tls1_export_keying_material"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_GET_CURVELIST, 0), "tls1_get_curvelist"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_PRF, 0), "tls1_PRF"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SAVE_U16, 0), "tls1_save_u16"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SETUP_KEY_BLOCK, 0),
|
||||
"tls1_setup_key_block"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SET_GROUPS, 0), "tls1_set_groups"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SET_RAW_SIGALGS, 0),
|
||||
"tls1_set_raw_sigalgs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SET_SERVER_SIGALGS, 0),
|
||||
"tls1_set_server_sigalgs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SET_SHARED_SIGALGS, 0),
|
||||
"tls1_set_shared_sigalgs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS1_SET_SIGALGS, 0), "tls1_set_sigalgs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CHOOSE_SIGALG, 0), "tls_choose_sigalg"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, 0),
|
||||
"tls_client_key_exchange_post_work"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_COLLECT_EXTENSIONS, 0),
|
||||
"tls_collect_extensions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES, 0),
|
||||
"tls_construct_certificate_authorities"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, 0),
|
||||
"tls_construct_certificate_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CERT_STATUS, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CERT_STATUS_BODY, 0),
|
||||
"tls_construct_cert_status_body"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CERT_VERIFY, 0),
|
||||
"tls_construct_cert_verify"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CHANGE_CIPHER_SPEC, 0),
|
||||
"tls_construct_change_cipher_spec"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CKE_DHE, 0),
|
||||
"tls_construct_cke_dhe"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, 0),
|
||||
"tls_construct_cke_ecdhe"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CKE_GOST, 0),
|
||||
"tls_construct_cke_gost"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 0),
|
||||
"tls_construct_cke_psk_preamble"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CKE_RSA, 0),
|
||||
"tls_construct_cke_rsa"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CKE_SRP, 0),
|
||||
"tls_construct_cke_srp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, 0),
|
||||
"tls_construct_client_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 0),
|
||||
"tls_construct_client_hello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CLIENT_KEY_EXCHANGE, 0),
|
||||
"tls_construct_client_key_exchange"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, 0),
|
||||
"tls_construct_ctos_alpn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_CERTIFICATE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, 0),
|
||||
"tls_construct_ctos_cookie"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 0),
|
||||
"tls_construct_ctos_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, 0),
|
||||
"tls_construct_ctos_ec_pt_formats"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_EMS, 0),
|
||||
"tls_construct_ctos_ems"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_ETM, 0),
|
||||
"tls_construct_ctos_etm"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_HELLO, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_KEY_EXCHANGE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 0),
|
||||
"tls_construct_ctos_key_share"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, 0),
|
||||
"tls_construct_ctos_maxfragmentlen"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_NPN, 0),
|
||||
"tls_construct_ctos_npn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 0),
|
||||
"tls_construct_ctos_padding"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, 0),
|
||||
"tls_construct_ctos_post_handshake_auth"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 0),
|
||||
"tls_construct_ctos_psk"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, 0),
|
||||
"tls_construct_ctos_psk_kex_modes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, 0),
|
||||
"tls_construct_ctos_renegotiate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SCT, 0),
|
||||
"tls_construct_ctos_sct"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, 0),
|
||||
"tls_construct_ctos_server_name"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, 0),
|
||||
"tls_construct_ctos_session_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, 0),
|
||||
"tls_construct_ctos_sig_algs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SRP, 0),
|
||||
"tls_construct_ctos_srp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 0),
|
||||
"tls_construct_ctos_status_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 0),
|
||||
"tls_construct_ctos_supported_groups"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 0),
|
||||
"tls_construct_ctos_supported_versions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 0),
|
||||
"tls_construct_ctos_use_srtp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_CTOS_VERIFY, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_ENCRYPTED_EXTENSIONS, 0),
|
||||
"tls_construct_encrypted_extensions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_END_OF_EARLY_DATA, 0),
|
||||
"tls_construct_end_of_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_EXTENSIONS, 0),
|
||||
"tls_construct_extensions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_FINISHED, 0),
|
||||
"tls_construct_finished"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_HELLO_REQUEST, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_HELLO_RETRY_REQUEST, 0),
|
||||
"tls_construct_hello_retry_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_KEY_UPDATE, 0),
|
||||
"tls_construct_key_update"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, 0),
|
||||
"tls_construct_new_session_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_NEXT_PROTO, 0),
|
||||
"tls_construct_next_proto"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, 0),
|
||||
"tls_construct_server_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_SERVER_HELLO, 0),
|
||||
"tls_construct_server_hello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 0),
|
||||
"tls_construct_server_key_exchange"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_ALPN, 0),
|
||||
"tls_construct_stoc_alpn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_CERTIFICATE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_COOKIE, 0),
|
||||
"tls_construct_stoc_cookie"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG, 0),
|
||||
"tls_construct_stoc_cryptopro_bug"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_DONE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA, 0),
|
||||
"tls_construct_stoc_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA_INFO, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS, 0),
|
||||
"tls_construct_stoc_ec_pt_formats"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_EMS, 0),
|
||||
"tls_construct_stoc_ems"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_ETM, 0),
|
||||
"tls_construct_stoc_etm"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_HELLO, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_KEY_EXCHANGE, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, 0),
|
||||
"tls_construct_stoc_key_share"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_MAXFRAGMENTLEN, 0),
|
||||
"tls_construct_stoc_maxfragmentlen"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG, 0),
|
||||
"tls_construct_stoc_next_proto_neg"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_PSK, 0),
|
||||
"tls_construct_stoc_psk"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE, 0),
|
||||
"tls_construct_stoc_renegotiate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME, 0),
|
||||
"tls_construct_stoc_server_name"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET, 0),
|
||||
"tls_construct_stoc_session_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, 0),
|
||||
"tls_construct_stoc_status_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, 0),
|
||||
"tls_construct_stoc_supported_groups"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS, 0),
|
||||
"tls_construct_stoc_supported_versions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP, 0),
|
||||
"tls_construct_stoc_use_srtp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, 0),
|
||||
"tls_early_post_process_client_hello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_FINISH_HANDSHAKE, 0),
|
||||
"tls_finish_handshake"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_GET_MESSAGE_BODY, 0),
|
||||
"tls_get_message_body"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_GET_MESSAGE_HEADER, 0),
|
||||
"tls_get_message_header"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_HANDLE_ALPN, 0), "tls_handle_alpn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_HANDLE_STATUS_REQUEST, 0),
|
||||
"tls_handle_status_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CERTIFICATE_AUTHORITIES, 0),
|
||||
"tls_parse_certificate_authorities"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CLIENTHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_ALPN, 0),
|
||||
"tls_parse_ctos_alpn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_COOKIE, 0),
|
||||
"tls_parse_ctos_cookie"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_EARLY_DATA, 0),
|
||||
"tls_parse_ctos_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS, 0),
|
||||
"tls_parse_ctos_ec_pt_formats"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_EMS, 0), "tls_parse_ctos_ems"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_KEY_SHARE, 0),
|
||||
"tls_parse_ctos_key_share"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN, 0),
|
||||
"tls_parse_ctos_maxfragmentlen"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_POST_HANDSHAKE_AUTH, 0),
|
||||
"tls_parse_ctos_post_handshake_auth"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_PSK, 0), "tls_parse_ctos_psk"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_PSK_KEX_MODES, 0),
|
||||
"tls_parse_ctos_psk_kex_modes"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE, 0),
|
||||
"tls_parse_ctos_renegotiate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_SERVER_NAME, 0),
|
||||
"tls_parse_ctos_server_name"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_SESSION_TICKET, 0),
|
||||
"tls_parse_ctos_session_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_SIG_ALGS, 0),
|
||||
"tls_parse_ctos_sig_algs"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT, 0),
|
||||
"tls_parse_ctos_sig_algs_cert"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_SRP, 0), "tls_parse_ctos_srp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, 0),
|
||||
"tls_parse_ctos_status_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS, 0),
|
||||
"tls_parse_ctos_supported_groups"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_CTOS_USE_SRTP, 0),
|
||||
"tls_parse_ctos_use_srtp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_ALPN, 0),
|
||||
"tls_parse_stoc_alpn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_COOKIE, 0),
|
||||
"tls_parse_stoc_cookie"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 0),
|
||||
"tls_parse_stoc_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_EARLY_DATA_INFO, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, 0),
|
||||
"tls_parse_stoc_ec_pt_formats"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 0),
|
||||
"tls_parse_stoc_key_share"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 0),
|
||||
"tls_parse_stoc_maxfragmentlen"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_NPN, 0), "tls_parse_stoc_npn"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_PSK, 0), "tls_parse_stoc_psk"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 0),
|
||||
"tls_parse_stoc_renegotiate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_SCT, 0), "tls_parse_stoc_sct"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 0),
|
||||
"tls_parse_stoc_server_name"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_SESSION_TICKET, 0),
|
||||
"tls_parse_stoc_session_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, 0),
|
||||
"tls_parse_stoc_status_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 0),
|
||||
"tls_parse_stoc_supported_versions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PARSE_STOC_USE_SRTP, 0),
|
||||
"tls_parse_stoc_use_srtp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 0),
|
||||
"tls_post_process_client_hello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE, 0),
|
||||
"tls_post_process_client_key_exchange"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, 0),
|
||||
"tls_prepare_client_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_AS_HELLO_RETRY_REQUEST, 0),
|
||||
"tls_process_as_hello_retry_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 0),
|
||||
"tls_process_certificate_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CERT_STATUS, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, 0),
|
||||
"tls_process_cert_status_body"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CERT_VERIFY, 0),
|
||||
"tls_process_cert_verify"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC, 0),
|
||||
"tls_process_change_cipher_spec"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CKE_DHE, 0),
|
||||
"tls_process_cke_dhe"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CKE_ECDHE, 0),
|
||||
"tls_process_cke_ecdhe"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CKE_GOST, 0),
|
||||
"tls_process_cke_gost"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, 0),
|
||||
"tls_process_cke_psk_preamble"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CKE_RSA, 0),
|
||||
"tls_process_cke_rsa"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CKE_SRP, 0),
|
||||
"tls_process_cke_srp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 0),
|
||||
"tls_process_client_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CLIENT_HELLO, 0),
|
||||
"tls_process_client_hello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, 0),
|
||||
"tls_process_client_key_exchange"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS, 0),
|
||||
"tls_process_encrypted_extensions"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_END_OF_EARLY_DATA, 0),
|
||||
"tls_process_end_of_early_data"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_FINISHED, 0),
|
||||
"tls_process_finished"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_HELLO_REQ, 0),
|
||||
"tls_process_hello_req"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_HELLO_RETRY_REQUEST, 0),
|
||||
"tls_process_hello_retry_request"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT, 0),
|
||||
"tls_process_initial_server_flight"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 0),
|
||||
"tls_process_key_exchange"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_KEY_UPDATE, 0),
|
||||
"tls_process_key_update"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 0),
|
||||
"tls_process_new_session_ticket"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_NEXT_PROTO, 0),
|
||||
"tls_process_next_proto"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 0),
|
||||
"tls_process_server_certificate"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SERVER_DONE, 0),
|
||||
"tls_process_server_done"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SERVER_HELLO, 0),
|
||||
"tls_process_server_hello"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SKE_DHE, 0),
|
||||
"tls_process_ske_dhe"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SKE_ECDHE, 0),
|
||||
"tls_process_ske_ecdhe"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, 0),
|
||||
"tls_process_ske_psk_preamble"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PROCESS_SKE_SRP, 0),
|
||||
"tls_process_ske_srp"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_PSK_DO_BINDER, 0), "tls_psk_do_binder"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_SCAN_CLIENTHELLO_TLSEXT, 0), ""},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_SETUP_HANDSHAKE, 0),
|
||||
"tls_setup_handshake"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_USE_CERTIFICATE_CHAIN_FILE, 0),
|
||||
"use_certificate_chain_file"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_WPACKET_INTERN_INIT_LEN, 0),
|
||||
"wpacket_intern_init_len"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_WPACKET_START_SUB_PACKET_LEN__, 0),
|
||||
"WPACKET_start_sub_packet_len__"},
|
||||
{ERR_PACK(ERR_LIB_SSL, SSL_F_WRITE_STATE_MACHINE, 0),
|
||||
"write_state_machine"},
|
||||
{0, NULL}
|
||||
};
|
||||
|
||||
static const ERR_STRING_DATA SSL_str_reasons[] = {
|
||||
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY),
|
||||
"application data after close notify"},
|
||||
@@ -1271,10 +559,8 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
|
||||
int ERR_load_SSL_strings(void)
|
||||
{
|
||||
#ifndef OPENSSL_NO_ERR
|
||||
if (ERR_func_error_string(SSL_str_functs[0].error) == NULL) {
|
||||
ERR_load_strings_const(SSL_str_functs);
|
||||
if (ERR_reason_error_string(SSL_str_reasons[0].error) == NULL)
|
||||
ERR_load_strings_const(SSL_str_reasons);
|
||||
}
|
||||
#endif
|
||||
return 1;
|
||||
}
|
||||
+1
-2
@@ -181,8 +181,7 @@ int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS * settings)
|
||||
}
|
||||
|
||||
opts |= OPENSSL_INIT_ADD_ALL_CIPHERS
|
||||
| OPENSSL_INIT_ADD_ALL_DIGESTS
|
||||
| OPENSSL_INIT_ADD_ALL_MACS;
|
||||
| OPENSSL_INIT_ADD_ALL_DIGESTS;
|
||||
#ifndef OPENSSL_NO_AUTOLOAD_CONFIG
|
||||
if ((opts & OPENSSL_INIT_NO_LOAD_CONFIG) == 0)
|
||||
opts |= OPENSSL_INIT_LOAD_CONFIG;
|
||||
|
||||
+3
-2
@@ -877,7 +877,7 @@ int SSL_up_ref(SSL *s)
|
||||
int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
|
||||
unsigned int sid_ctx_len)
|
||||
{
|
||||
if (sid_ctx_len > sizeof(ctx->sid_ctx)) {
|
||||
if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
|
||||
SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,
|
||||
SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
|
||||
return 0;
|
||||
@@ -2141,7 +2141,8 @@ ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
|
||||
else
|
||||
#endif
|
||||
#ifdef OPENSSL_NO_KTLS
|
||||
SYSerr(SYS_F_SENDFILE, get_last_sys_error());
|
||||
ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
|
||||
"calling sendfile()");
|
||||
#else
|
||||
SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
|
||||
#endif
|
||||
|
||||
+2
-2
@@ -30,7 +30,7 @@
|
||||
# include <openssl/ct.h>
|
||||
# include "record/record.h"
|
||||
# include "statem/statem.h"
|
||||
# include "packet_locl.h"
|
||||
# include "internal/packet.h"
|
||||
# include "internal/dane.h"
|
||||
# include "internal/refcount.h"
|
||||
# include "internal/tsan_assist.h"
|
||||
@@ -1684,7 +1684,6 @@ struct ssl_st {
|
||||
size_t block_padding;
|
||||
|
||||
CRYPTO_RWLOCK *lock;
|
||||
RAND_DRBG *drbg;
|
||||
|
||||
/* The number of TLS1.3 tickets to automatically send */
|
||||
size_t num_tickets;
|
||||
@@ -2577,6 +2576,7 @@ __owur int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s);
|
||||
SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
|
||||
|
||||
__owur const TLS_GROUP_INFO *tls1_group_id_lookup(uint16_t curve_id);
|
||||
__owur int tls1_group_id2nid(uint16_t group_id);
|
||||
__owur int tls1_check_group_id(SSL *s, uint16_t group_id, int check_own_curves);
|
||||
__owur uint16_t tls1_shared_group(SSL *s, int nmatch);
|
||||
__owur int tls1_set_groups(uint16_t **pext, size_t *pextlen,
|
||||
|
||||
+1
-1
@@ -9,7 +9,7 @@
|
||||
|
||||
#include <stdio.h>
|
||||
#include "ssl_locl.h"
|
||||
#include "packet_locl.h"
|
||||
#include "internal/packet.h"
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
@@ -629,7 +629,7 @@ int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
|
||||
&& !((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0
|
||||
&& type == TLSEXT_TYPE_cryptopro_bug)
|
||||
#endif
|
||||
) {
|
||||
) {
|
||||
SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION,
|
||||
SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_UNSOLICITED_EXTENSION);
|
||||
goto err;
|
||||
@@ -1445,8 +1445,13 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
|
||||
unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE];
|
||||
unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE];
|
||||
unsigned char *early_secret;
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char resumption_label[] = { 0x72, 0x65, 0x64, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 };
|
||||
static const unsigned char external_label[] = { 0x65, 0x78, 0x74, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 };
|
||||
#else
|
||||
static const unsigned char resumption_label[] = "res binder";
|
||||
static const unsigned char external_label[] = "ext binder";
|
||||
#endif
|
||||
const unsigned char *label;
|
||||
size_t bindersize, labelsize, hashsize;
|
||||
int hashsizei = EVP_MD_size(md);
|
||||
@@ -1645,9 +1650,9 @@ static int final_early_data(SSL *s, unsigned int context, int sent)
|
||||
|| s->early_data_state != SSL_EARLY_DATA_ACCEPTING
|
||||
|| !s->ext.early_data_ok
|
||||
|| s->hello_retry_request != SSL_HRR_NONE
|
||||
|| (s->ctx->allow_early_data_cb != NULL
|
||||
&& !s->ctx->allow_early_data_cb(s,
|
||||
s->ctx->allow_early_data_cb_data))) {
|
||||
|| (s->allow_early_data_cb != NULL
|
||||
&& !s->allow_early_data_cb(s,
|
||||
s->allow_early_data_cb_data))) {
|
||||
s->ext.early_data = SSL_EARLY_DATA_REJECTED;
|
||||
} else {
|
||||
s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
|
||||
|
||||
@@ -1900,8 +1900,8 @@ int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
||||
return 0;
|
||||
}
|
||||
|
||||
skey = ssl_generate_pkey(ckey);
|
||||
if (skey == NULL) {
|
||||
skey = EVP_PKEY_new();
|
||||
if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) {
|
||||
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE,
|
||||
ERR_R_MALLOC_FAILURE);
|
||||
return 0;
|
||||
|
||||
@@ -1491,6 +1491,10 @@ EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
|
||||
unsigned int context, X509 *x,
|
||||
size_t chainidx)
|
||||
{
|
||||
/* We don't currently support this extension inside a CertificateRequest */
|
||||
if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
|
||||
return EXT_RETURN_NOT_SENT;
|
||||
|
||||
if (!s->ext.status_expected)
|
||||
return EXT_RETURN_NOT_SENT;
|
||||
|
||||
|
||||
+2
-1
@@ -118,7 +118,8 @@ void ossl_statem_set_renegotiate(SSL *s)
|
||||
void ossl_statem_fatal(SSL *s, int al, int func, int reason, const char *file,
|
||||
int line)
|
||||
{
|
||||
ERR_put_error(ERR_LIB_SSL, func, reason, file, line);
|
||||
ERR_raise(ERR_LIB_SSL, reason);
|
||||
ERR_set_debug(file, line, NULL); /* Override what ERR_raise set */
|
||||
/* We shouldn't call SSLfatal() twice. Once is enough */
|
||||
if (s->statem.in_init && s->statem.state == MSG_FLOW_ERROR)
|
||||
return;
|
||||
|
||||
+2
-2
@@ -136,10 +136,10 @@ void ossl_statem_fatal(SSL *s, int al, int func, int reason, const char *file,
|
||||
int line);
|
||||
# define SSL_AD_NO_ALERT -1
|
||||
# ifndef OPENSSL_NO_ERR
|
||||
# define SSLfatal(s, al, f, r) ossl_statem_fatal((s), (al), (f), (r), \
|
||||
# define SSLfatal(s, al, f, r) ossl_statem_fatal((s), (al), (0), (r), \
|
||||
OPENSSL_FILE, OPENSSL_LINE)
|
||||
# else
|
||||
# define SSLfatal(s, al, f, r) ossl_statem_fatal((s), (al), (f), (r), NULL, 0)
|
||||
# define SSLfatal(s, al, f, r) ossl_statem_fatal((s), (al), (0), (r), NULL, 0)
|
||||
# endif
|
||||
|
||||
int ossl_statem_in_error(const SSL *s);
|
||||
|
||||
+11
-1
@@ -169,9 +169,19 @@ int tls_setup_handshake(SSL *s)
|
||||
static int get_cert_verify_tbs_data(SSL *s, unsigned char *tls13tbs,
|
||||
void **hdata, size_t *hdatalen)
|
||||
{
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const char *servercontext = { 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e,
|
||||
0x33, 0x2c, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x65,
|
||||
0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72,
|
||||
0x69, 0x66, 0x79, 0x00 };
|
||||
static const char *clientcontext = { 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e,
|
||||
0x33, 0x2c, 0x20, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x20, 0x43, 0x65,
|
||||
0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72,
|
||||
0x69, 0x66, 0x79, 0x00 };
|
||||
#else
|
||||
static const char *servercontext = "TLS 1.3, server CertificateVerify";
|
||||
static const char *clientcontext = "TLS 1.3, client CertificateVerify";
|
||||
|
||||
#endif
|
||||
if (SSL_IS_TLS13(s)) {
|
||||
size_t hashlen;
|
||||
|
||||
|
||||
+37
-25
@@ -18,6 +18,7 @@
|
||||
#include <openssl/kdf.h>
|
||||
#include <openssl/rand.h>
|
||||
#include <openssl/obj_mac.h>
|
||||
#include <openssl/core_names.h>
|
||||
#include <openssl/trace.h>
|
||||
|
||||
/* seed1 through seed5 are concatenated */
|
||||
@@ -31,8 +32,10 @@ static int tls1_PRF(SSL *s,
|
||||
unsigned char *out, size_t olen, int fatal)
|
||||
{
|
||||
const EVP_MD *md = ssl_prf_md(s);
|
||||
EVP_KDF *kdf;
|
||||
EVP_KDF_CTX *kctx = NULL;
|
||||
int ret = 0;
|
||||
OSSL_PARAM params[8], *p = params;
|
||||
const char *mdname;
|
||||
|
||||
if (md == NULL) {
|
||||
/* Should never happen */
|
||||
@@ -43,35 +46,44 @@ static int tls1_PRF(SSL *s,
|
||||
SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR);
|
||||
return 0;
|
||||
}
|
||||
kctx = EVP_KDF_CTX_new_id(EVP_PKEY_TLS1_PRF);
|
||||
if (kctx == NULL
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, md) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_TLS_SECRET,
|
||||
sec, (size_t)slen) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED,
|
||||
seed1, (size_t)seed1_len) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED,
|
||||
seed2, (size_t)seed2_len) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED,
|
||||
seed3, (size_t)seed3_len) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED,
|
||||
seed4, (size_t)seed4_len) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED,
|
||||
seed5, (size_t)seed5_len) <= 0
|
||||
|| EVP_KDF_derive(kctx, out, olen) <= 0) {
|
||||
if (fatal)
|
||||
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF,
|
||||
ERR_R_INTERNAL_ERROR);
|
||||
else
|
||||
SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR);
|
||||
kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_TLS1_PRF, NULL);
|
||||
if (kdf == NULL)
|
||||
goto err;
|
||||
kctx = EVP_KDF_CTX_new(kdf);
|
||||
EVP_KDF_free(kdf);
|
||||
if (kctx == NULL)
|
||||
goto err;
|
||||
mdname = EVP_MD_name(md);
|
||||
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
|
||||
(char *)mdname, strlen(mdname) + 1);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
|
||||
(unsigned char *)sec,
|
||||
(size_t)slen);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
|
||||
(void *)seed1, (size_t)seed1_len);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
|
||||
(void *)seed2, (size_t)seed2_len);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
|
||||
(void *)seed3, (size_t)seed3_len);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
|
||||
(void *)seed4, (size_t)seed4_len);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
|
||||
(void *)seed5, (size_t)seed5_len);
|
||||
*p = OSSL_PARAM_construct_end();
|
||||
if (EVP_KDF_CTX_set_params(kctx, params)
|
||||
&& EVP_KDF_derive(kctx, out, olen)) {
|
||||
EVP_KDF_CTX_free(kctx);
|
||||
return 1;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
if (fatal)
|
||||
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF,
|
||||
ERR_R_INTERNAL_ERROR);
|
||||
else
|
||||
SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR);
|
||||
EVP_KDF_CTX_free(kctx);
|
||||
return ret;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num)
|
||||
|
||||
+173
-87
@@ -21,6 +21,8 @@
|
||||
#include "ssl_locl.h"
|
||||
#include <openssl/ct.h>
|
||||
|
||||
static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey);
|
||||
|
||||
SSL3_ENC_METHOD const TLSv1_enc_data = {
|
||||
tls1_enc,
|
||||
tls1_mac,
|
||||
@@ -226,6 +228,13 @@ const TLS_GROUP_INFO *tls1_group_id_lookup(uint16_t group_id)
|
||||
}
|
||||
|
||||
#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
|
||||
int tls1_group_id2nid(uint16_t group_id)
|
||||
{
|
||||
const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(group_id);
|
||||
|
||||
return ginf == NULL ? NID_undef : ginf->nid;
|
||||
}
|
||||
|
||||
static uint16_t tls1_nid2group_id(int nid)
|
||||
{
|
||||
size_t i;
|
||||
@@ -1721,8 +1730,8 @@ void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op)
|
||||
continue;
|
||||
|
||||
clu = ssl_cert_lookup_by_idx(lu->sig_idx);
|
||||
if (clu == NULL)
|
||||
continue;
|
||||
if (clu == NULL)
|
||||
continue;
|
||||
|
||||
/* If algorithm is disabled see if we can enable it */
|
||||
if ((clu->amask & disabled_mask) != 0
|
||||
@@ -2144,16 +2153,34 @@ int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
|
||||
|
||||
static int tls1_check_sig_alg(SSL *s, X509 *x, int default_nid)
|
||||
{
|
||||
int sig_nid;
|
||||
int sig_nid, use_pc_sigalgs = 0;
|
||||
size_t i;
|
||||
const SIGALG_LOOKUP *sigalg;
|
||||
size_t sigalgslen;
|
||||
if (default_nid == -1)
|
||||
return 1;
|
||||
sig_nid = X509_get_signature_nid(x);
|
||||
if (default_nid)
|
||||
return sig_nid == default_nid ? 1 : 0;
|
||||
for (i = 0; i < s->shared_sigalgslen; i++)
|
||||
if (sig_nid == s->shared_sigalgs[i]->sigandhash)
|
||||
|
||||
if (SSL_IS_TLS13(s) && s->s3.tmp.peer_cert_sigalgs != NULL) {
|
||||
/*
|
||||
* If we're in TLSv1.3 then we only get here if we're checking the
|
||||
* chain. If the peer has specified peer_cert_sigalgs then we use them
|
||||
* otherwise we default to normal sigalgs.
|
||||
*/
|
||||
sigalgslen = s->s3.tmp.peer_cert_sigalgslen;
|
||||
use_pc_sigalgs = 1;
|
||||
} else {
|
||||
sigalgslen = s->shared_sigalgslen;
|
||||
}
|
||||
for (i = 0; i < sigalgslen; i++) {
|
||||
sigalg = use_pc_sigalgs
|
||||
? tls1_lookup_sigalg(s->s3.tmp.peer_cert_sigalgs[i])
|
||||
: s->shared_sigalgs[i];
|
||||
if (sig_nid == sigalg->sigandhash)
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -2310,7 +2337,14 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
|
||||
}
|
||||
}
|
||||
/* Check signature algorithm of each cert in chain */
|
||||
if (!tls1_check_sig_alg(s, x, default_nid)) {
|
||||
if (SSL_IS_TLS13(s)) {
|
||||
/*
|
||||
* We only get here if the application has called SSL_check_chain(),
|
||||
* so check_flags is always set.
|
||||
*/
|
||||
if (find_sig_alg(s, x, pk) != NULL)
|
||||
rv |= CERT_PKEY_EE_SIGNATURE;
|
||||
} else if (!tls1_check_sig_alg(s, x, default_nid)) {
|
||||
if (!check_flags)
|
||||
goto end;
|
||||
} else
|
||||
@@ -2597,6 +2631,60 @@ static int tls12_get_cert_sigalg_idx(const SSL *s, const SIGALG_LOOKUP *lu)
|
||||
return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_VALID ? sig_idx : -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Checks the given cert against signature_algorithm_cert restrictions sent by
|
||||
* the peer (if any) as well as whether the hash from the sigalg is usable with
|
||||
* the key.
|
||||
* Returns true if the cert is usable and false otherwise.
|
||||
*/
|
||||
static int check_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x,
|
||||
EVP_PKEY *pkey)
|
||||
{
|
||||
const SIGALG_LOOKUP *lu;
|
||||
int mdnid, pknid, supported;
|
||||
size_t i;
|
||||
|
||||
/*
|
||||
* If the given EVP_PKEY cannot supporting signing with this sigalg,
|
||||
* the answer is simply 'no'.
|
||||
*/
|
||||
ERR_set_mark();
|
||||
supported = EVP_PKEY_supports_digest_nid(pkey, sig->hash);
|
||||
ERR_pop_to_mark();
|
||||
if (supported == 0)
|
||||
return 0;
|
||||
|
||||
/*
|
||||
* The TLS 1.3 signature_algorithms_cert extension places restrictions
|
||||
* on the sigalg with which the certificate was signed (by its issuer).
|
||||
*/
|
||||
if (s->s3.tmp.peer_cert_sigalgs != NULL) {
|
||||
if (!X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL))
|
||||
return 0;
|
||||
for (i = 0; i < s->s3.tmp.peer_cert_sigalgslen; i++) {
|
||||
lu = tls1_lookup_sigalg(s->s3.tmp.peer_cert_sigalgs[i]);
|
||||
if (lu == NULL)
|
||||
continue;
|
||||
|
||||
/*
|
||||
* TODO this does not differentiate between the
|
||||
* rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
|
||||
* have a chain here that lets us look at the key OID in the
|
||||
* signing certificate.
|
||||
*/
|
||||
if (mdnid == lu->hash && pknid == lu->sig)
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Without signat_algorithms_cert, any certificate for which we have
|
||||
* a viable public key is permitted.
|
||||
*/
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns true if |s| has a usable certificate configured for use
|
||||
* with signature scheme |sig|.
|
||||
@@ -2606,54 +2694,92 @@ static int tls12_get_cert_sigalg_idx(const SSL *s, const SIGALG_LOOKUP *lu)
|
||||
*/
|
||||
static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
|
||||
{
|
||||
const SIGALG_LOOKUP *lu;
|
||||
int mdnid, pknid, supported;
|
||||
size_t i;
|
||||
|
||||
/* TLS 1.2 callers can override lu->sig_idx, but not TLS 1.3 callers. */
|
||||
/* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */
|
||||
if (idx == -1)
|
||||
idx = sig->sig_idx;
|
||||
if (!ssl_has_cert(s, idx))
|
||||
return 0;
|
||||
if (s->s3.tmp.peer_cert_sigalgs != NULL) {
|
||||
for (i = 0; i < s->s3.tmp.peer_cert_sigalgslen; i++) {
|
||||
lu = tls1_lookup_sigalg(s->s3.tmp.peer_cert_sigalgs[i]);
|
||||
if (lu == NULL
|
||||
|| !X509_get_signature_info(s->cert->pkeys[idx].x509, &mdnid,
|
||||
&pknid, NULL, NULL)
|
||||
/*
|
||||
* TODO this does not differentiate between the
|
||||
* rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
|
||||
* have a chain here that lets us look at the key OID in the
|
||||
* signing certificate.
|
||||
*/
|
||||
|| mdnid != lu->hash
|
||||
|| pknid != lu->sig)
|
||||
continue;
|
||||
|
||||
ERR_set_mark();
|
||||
supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
|
||||
mdnid);
|
||||
if (supported == 0)
|
||||
continue;
|
||||
else if (supported < 0)
|
||||
{
|
||||
/* If it didn't report a mandatory NID, for whatever reasons,
|
||||
* just clear the error and allow all hashes to be used. */
|
||||
ERR_pop_to_mark();
|
||||
return check_cert_usable(s, sig, s->cert->pkeys[idx].x509,
|
||||
s->cert->pkeys[idx].privatekey);
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns true if the supplied cert |x| and key |pkey| is usable with the
|
||||
* specified signature scheme |sig|, or false otherwise.
|
||||
*/
|
||||
static int is_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x,
|
||||
EVP_PKEY *pkey)
|
||||
{
|
||||
size_t idx;
|
||||
|
||||
if (ssl_cert_lookup_by_pkey(pkey, &idx) == NULL)
|
||||
return 0;
|
||||
|
||||
/* Check the key is consistent with the sig alg */
|
||||
if ((int)idx != sig->sig_idx)
|
||||
return 0;
|
||||
|
||||
return check_cert_usable(s, sig, x, pkey);
|
||||
}
|
||||
|
||||
/*
|
||||
* Find a signature scheme that works with the supplied certificate |x| and key
|
||||
* |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our
|
||||
* available certs/keys to find one that works.
|
||||
*/
|
||||
static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey)
|
||||
{
|
||||
const SIGALG_LOOKUP *lu = NULL;
|
||||
size_t i;
|
||||
#ifndef OPENSSL_NO_EC
|
||||
int curve = -1;
|
||||
#endif
|
||||
EVP_PKEY *tmppkey;
|
||||
|
||||
/* Look for a shared sigalgs matching possible certificates */
|
||||
for (i = 0; i < s->shared_sigalgslen; i++) {
|
||||
lu = s->shared_sigalgs[i];
|
||||
|
||||
/* Skip SHA1, SHA224, DSA and RSA if not PSS */
|
||||
if (lu->hash == NID_sha1
|
||||
|| lu->hash == NID_sha224
|
||||
|| lu->sig == EVP_PKEY_DSA
|
||||
|| lu->sig == EVP_PKEY_RSA)
|
||||
continue;
|
||||
/* Check that we have a cert, and signature_algorithms_cert */
|
||||
if (!tls1_lookup_md(lu, NULL))
|
||||
continue;
|
||||
if ((pkey == NULL && !has_usable_cert(s, lu, -1))
|
||||
|| (pkey != NULL && !is_cert_usable(s, lu, x, pkey)))
|
||||
continue;
|
||||
|
||||
tmppkey = (pkey != NULL) ? pkey
|
||||
: s->cert->pkeys[lu->sig_idx].privatekey;
|
||||
|
||||
if (lu->sig == EVP_PKEY_EC) {
|
||||
#ifndef OPENSSL_NO_EC
|
||||
if (curve == -1) {
|
||||
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(tmppkey);
|
||||
curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
|
||||
}
|
||||
return 1;
|
||||
if (lu->curve != NID_undef && curve != lu->curve)
|
||||
continue;
|
||||
#else
|
||||
continue;
|
||||
#endif
|
||||
} else if (lu->sig == EVP_PKEY_RSA_PSS) {
|
||||
/* validate that key is large enough for the signature algorithm */
|
||||
if (!rsa_pss_check_min_key_size(EVP_PKEY_get0(tmppkey), lu))
|
||||
continue;
|
||||
}
|
||||
return 0;
|
||||
break;
|
||||
}
|
||||
supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
|
||||
sig->hash);
|
||||
if (supported == 0)
|
||||
return 0;
|
||||
else if (supported < 0)
|
||||
ERR_clear_error();
|
||||
|
||||
return 1;
|
||||
if (i == s->shared_sigalgslen)
|
||||
return NULL;
|
||||
|
||||
return lu;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -2676,48 +2802,8 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
|
||||
s->s3.tmp.sigalg = NULL;
|
||||
|
||||
if (SSL_IS_TLS13(s)) {
|
||||
size_t i;
|
||||
#ifndef OPENSSL_NO_EC
|
||||
int curve = -1;
|
||||
#endif
|
||||
|
||||
/* Look for a certificate matching shared sigalgs */
|
||||
for (i = 0; i < s->shared_sigalgslen; i++) {
|
||||
lu = s->shared_sigalgs[i];
|
||||
sig_idx = -1;
|
||||
|
||||
/* Skip SHA1, SHA224, DSA and RSA if not PSS */
|
||||
if (lu->hash == NID_sha1
|
||||
|| lu->hash == NID_sha224
|
||||
|| lu->sig == EVP_PKEY_DSA
|
||||
|| lu->sig == EVP_PKEY_RSA)
|
||||
continue;
|
||||
/* Check that we have a cert, and signature_algorithms_cert */
|
||||
if (!tls1_lookup_md(lu, NULL) || !has_usable_cert(s, lu, -1))
|
||||
continue;
|
||||
if (lu->sig == EVP_PKEY_EC) {
|
||||
#ifndef OPENSSL_NO_EC
|
||||
if (curve == -1) {
|
||||
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
|
||||
|
||||
curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
|
||||
}
|
||||
if (lu->curve != NID_undef && curve != lu->curve)
|
||||
continue;
|
||||
#else
|
||||
continue;
|
||||
#endif
|
||||
} else if (lu->sig == EVP_PKEY_RSA_PSS) {
|
||||
/* validate that key is large enough for the signature algorithm */
|
||||
EVP_PKEY *pkey;
|
||||
|
||||
pkey = s->cert->pkeys[lu->sig_idx].privatekey;
|
||||
if (!rsa_pss_check_min_key_size(EVP_PKEY_get0(pkey), lu))
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
}
|
||||
if (i == s->shared_sigalgslen) {
|
||||
lu = find_sig_alg(s, NULL, NULL);
|
||||
if (lu == NULL) {
|
||||
if (!fatalerrs)
|
||||
return 1;
|
||||
SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CHOOSE_SIGALG,
|
||||
|
||||
+86
-19
@@ -12,6 +12,7 @@
|
||||
#include "internal/cryptlib.h"
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/kdf.h>
|
||||
#include <openssl/core_names.h>
|
||||
|
||||
#define TLS13_MAX_LABEL_LEN 249
|
||||
|
||||
@@ -30,8 +31,16 @@ int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
const unsigned char *data, size_t datalen,
|
||||
unsigned char *out, size_t outlen, int fatal)
|
||||
{
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char label_prefix[] = { 0x74, 0x6C, 0x73, 0x31, 0x33, 0x20, 0x00 };
|
||||
#else
|
||||
static const unsigned char label_prefix[] = "tls13 ";
|
||||
EVP_KDF_CTX *kctx = EVP_KDF_CTX_new_id(EVP_PKEY_HKDF);
|
||||
#endif
|
||||
EVP_KDF *kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_HKDF, NULL);
|
||||
EVP_KDF_CTX *kctx;
|
||||
OSSL_PARAM params[5], *p = params;
|
||||
int mode = EVP_PKEY_HKDEF_MODE_EXPAND_ONLY;
|
||||
const char *mdname = EVP_MD_name(md);
|
||||
int ret;
|
||||
size_t hkdflabellen;
|
||||
size_t hashlen;
|
||||
@@ -45,6 +54,8 @@ int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
+ 1 + EVP_MAX_MD_SIZE];
|
||||
WPACKET pkt;
|
||||
|
||||
kctx = EVP_KDF_CTX_new(kdf);
|
||||
EVP_KDF_free(kdf);
|
||||
if (kctx == NULL)
|
||||
return 0;
|
||||
|
||||
@@ -84,12 +95,16 @@ int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
return 0;
|
||||
}
|
||||
|
||||
ret = EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_HKDF_MODE,
|
||||
EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, md) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, secret, hashlen) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_HKDF_INFO,
|
||||
hkdflabel, hkdflabellen) <= 0
|
||||
*p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode);
|
||||
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
|
||||
(char *)mdname, strlen(mdname) + 1);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
|
||||
(unsigned char *)secret, hashlen);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
|
||||
hkdflabel, hkdflabellen);
|
||||
*p++ = OSSL_PARAM_construct_end();
|
||||
|
||||
ret = EVP_KDF_CTX_set_params(kctx, params) <= 0
|
||||
|| EVP_KDF_derive(kctx, out, outlen) <= 0;
|
||||
|
||||
EVP_KDF_CTX_free(kctx);
|
||||
@@ -112,7 +127,11 @@ int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
int tls13_derive_key(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
unsigned char *key, size_t keylen)
|
||||
{
|
||||
static const unsigned char keylabel[] = "key";
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char keylabel[] ={ 0x6B, 0x65, 0x79, 0x00 };
|
||||
#else
|
||||
static const unsigned char keylabel[] = "key";
|
||||
#endif
|
||||
|
||||
return tls13_hkdf_expand(s, md, secret, keylabel, sizeof(keylabel) - 1,
|
||||
NULL, 0, key, keylen, 1);
|
||||
@@ -125,7 +144,11 @@ int tls13_derive_key(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
int tls13_derive_iv(SSL *s, const EVP_MD *md, const unsigned char *secret,
|
||||
unsigned char *iv, size_t ivlen)
|
||||
{
|
||||
static const unsigned char ivlabel[] = "iv";
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char ivlabel[] = { 0x69, 0x76, 0x00 };
|
||||
#else
|
||||
static const unsigned char ivlabel[] = "iv";
|
||||
#endif
|
||||
|
||||
return tls13_hkdf_expand(s, md, secret, ivlabel, sizeof(ivlabel) - 1,
|
||||
NULL, 0, iv, ivlen, 1);
|
||||
@@ -135,7 +158,11 @@ int tls13_derive_finishedkey(SSL *s, const EVP_MD *md,
|
||||
const unsigned char *secret,
|
||||
unsigned char *fin, size_t finlen)
|
||||
{
|
||||
static const unsigned char finishedlabel[] = "finished";
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char finishedlabel[] = { 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64, 0x00 };
|
||||
#else
|
||||
static const unsigned char finishedlabel[] = "finished";
|
||||
#endif
|
||||
|
||||
return tls13_hkdf_expand(s, md, secret, finishedlabel,
|
||||
sizeof(finishedlabel) - 1, NULL, 0, fin, finlen, 1);
|
||||
@@ -155,10 +182,21 @@ int tls13_generate_secret(SSL *s, const EVP_MD *md,
|
||||
size_t mdlen, prevsecretlen;
|
||||
int mdleni;
|
||||
int ret;
|
||||
EVP_KDF_CTX *kctx = EVP_KDF_CTX_new_id(EVP_PKEY_HKDF);
|
||||
EVP_KDF *kdf;
|
||||
EVP_KDF_CTX *kctx;
|
||||
OSSL_PARAM params[5], *p = params;
|
||||
int mode = EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY;
|
||||
const char *mdname = EVP_MD_name(md);
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const char derived_secret_label[] = { 0x64, 0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x00 };
|
||||
#else
|
||||
static const char derived_secret_label[] = "derived";
|
||||
#endif
|
||||
unsigned char preextractsec[EVP_MAX_MD_SIZE];
|
||||
|
||||
kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_HKDF, NULL);
|
||||
kctx = EVP_KDF_CTX_new(kdf);
|
||||
EVP_KDF_free(kdf);
|
||||
if (kctx == NULL) {
|
||||
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_GENERATE_SECRET,
|
||||
ERR_R_INTERNAL_ERROR);
|
||||
@@ -212,12 +250,18 @@ int tls13_generate_secret(SSL *s, const EVP_MD *md,
|
||||
prevsecretlen = mdlen;
|
||||
}
|
||||
|
||||
ret = EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_HKDF_MODE,
|
||||
EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, md) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_KEY, insecret, insecretlen) <= 0
|
||||
|| EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_SALT,
|
||||
prevsecret, prevsecretlen) <= 0
|
||||
*p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode);
|
||||
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
|
||||
(char *)mdname, strlen(mdname) + 1);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
|
||||
(unsigned char *)insecret,
|
||||
insecretlen);
|
||||
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
|
||||
(unsigned char *)prevsecret,
|
||||
prevsecretlen);
|
||||
*p++ = OSSL_PARAM_construct_end();
|
||||
|
||||
ret = EVP_KDF_CTX_set_params(kctx, params) <= 0
|
||||
|| EVP_KDF_derive(kctx, outsecret, mdlen) <= 0;
|
||||
|
||||
if (ret != 0)
|
||||
@@ -408,6 +452,16 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
|
||||
|
||||
int tls13_change_cipher_state(SSL *s, int which)
|
||||
{
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char client_early_traffic[] = {0x63, 0x20, 0x65, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
|
||||
static const unsigned char client_handshake_traffic[] = {0x63, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
|
||||
static const unsigned char client_application_traffic[] = {0x63, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
|
||||
static const unsigned char server_handshake_traffic[] = {0x73, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
|
||||
static const unsigned char server_application_traffic[] = {0x73, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
|
||||
static const unsigned char exporter_master_secret[] = {0x65, 0x78, 0x70, 0x20, /* master*/ 0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
|
||||
static const unsigned char resumption_master_secret[] = {0x72, 0x65, 0x73, 0x20, /* master*/ 0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
|
||||
static const unsigned char early_exporter_master_secret[] = {0x65, 0x20, 0x65, 0x78, 0x70, 0x20, /* master*/ 0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
|
||||
#else
|
||||
static const unsigned char client_early_traffic[] = "c e traffic";
|
||||
static const unsigned char client_handshake_traffic[] = "c hs traffic";
|
||||
static const unsigned char client_application_traffic[] = "c ap traffic";
|
||||
@@ -416,6 +470,7 @@ int tls13_change_cipher_state(SSL *s, int which)
|
||||
static const unsigned char exporter_master_secret[] = "exp master";
|
||||
static const unsigned char resumption_master_secret[] = "res master";
|
||||
static const unsigned char early_exporter_master_secret[] = "e exp master";
|
||||
#endif
|
||||
unsigned char *iv;
|
||||
unsigned char secret[EVP_MAX_MD_SIZE];
|
||||
unsigned char hashval[EVP_MAX_MD_SIZE];
|
||||
@@ -683,7 +738,11 @@ int tls13_change_cipher_state(SSL *s, int which)
|
||||
|
||||
int tls13_update_key(SSL *s, int sending)
|
||||
{
|
||||
static const unsigned char application_traffic[] = "traffic upd";
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char application_traffic[] = { 0x74, 0x72 ,0x61 ,0x66 ,0x66 ,0x69 ,0x63 ,0x20 ,0x75 ,0x70 ,0x64, 0x00};
|
||||
#else
|
||||
static const unsigned char application_traffic[] = "traffic upd";
|
||||
#endif
|
||||
const EVP_MD *md = ssl_handshake_md(s);
|
||||
size_t hashlen = EVP_MD_size(md);
|
||||
unsigned char *insecret, *iv;
|
||||
@@ -740,7 +799,11 @@ int tls13_export_keying_material(SSL *s, unsigned char *out, size_t olen,
|
||||
size_t contextlen, int use_context)
|
||||
{
|
||||
unsigned char exportsecret[EVP_MAX_MD_SIZE];
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00};
|
||||
#else
|
||||
static const unsigned char exporterlabel[] = "exporter";
|
||||
#endif
|
||||
unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
|
||||
const EVP_MD *md = ssl_handshake_md(s);
|
||||
EVP_MD_CTX *ctx = EVP_MD_CTX_new();
|
||||
@@ -777,7 +840,11 @@ int tls13_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
|
||||
const unsigned char *context,
|
||||
size_t contextlen)
|
||||
{
|
||||
static const unsigned char exporterlabel[] = "exporter";
|
||||
#ifdef CHARSET_EBCDIC
|
||||
static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00};
|
||||
#else
|
||||
static const unsigned char exporterlabel[] = "exporter";
|
||||
#endif
|
||||
unsigned char exportsecret[EVP_MAX_MD_SIZE];
|
||||
unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
|
||||
const EVP_MD *md;
|
||||
|
||||
Reference in New Issue
Block a user