Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2019-05-23 12:02:56 +09:00
parent a7bf77581f
commit 64d458de91
185 changed files with 5859 additions and 2853 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssl/ssl_lib.c
+112 -54
View File
@@ -11,6 +11,7 @@
#include <stdio.h>
#include "ssl_locl.h"
#include "e_os.h"
#include <openssl/objects.h>
#include <openssl/x509v3.h>
#include <openssl/rand.h>
@@ -1487,12 +1488,10 @@ size_t SSL_get_finished(const SSL *s, void *buf, size_t count)
{
size_t ret = 0;
if (s->s3 != NULL) {
ret = s->s3->tmp.finish_md_len;
if (count > ret)
count = ret;
memcpy(buf, s->s3->tmp.finish_md, count);
}
ret = s->s3.tmp.finish_md_len;
if (count > ret)
count = ret;
memcpy(buf, s->s3.tmp.finish_md, count);
return ret;
}
@@ -1501,12 +1500,10 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
{
size_t ret = 0;
if (s->s3 != NULL) {
ret = s->s3->tmp.peer_finish_md_len;
if (count > ret)
count = ret;
memcpy(buf, s->s3->tmp.peer_finish_md, count);
}
ret = s->s3.tmp.peer_finish_md_len;
if (count > ret)
count = ret;
memcpy(buf, s->s3.tmp.peer_finish_md, count);
return ret;
}
@@ -2078,6 +2075,72 @@ int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
}
}
ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
{
ossl_ssize_t ret;
if (s->handshake_func == NULL) {
SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
return -1;
}
if (s->shutdown & SSL_SENT_SHUTDOWN) {
s->rwstate = SSL_NOTHING;
SSLerr(SSL_F_SSL_SENDFILE, SSL_R_PROTOCOL_IS_SHUTDOWN);
return -1;
}
if (!BIO_get_ktls_send(s->wbio)) {
SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
return -1;
}
/* If we have an alert to send, lets send it */
if (s->s3.alert_dispatch) {
ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
if (ret <= 0) {
/* SSLfatal() already called if appropriate */
return ret;
}
/* if it went, fall through and send more stuff */
}
s->rwstate = SSL_WRITING;
if (BIO_flush(s->wbio) <= 0) {
if (!BIO_should_retry(s->wbio)) {
s->rwstate = SSL_NOTHING;
} else {
#ifdef EAGAIN
set_sys_error(EAGAIN);
#endif
}
return -1;
}
#ifndef OPENSSL_NO_KTLS
ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
#else
ret = -1;
#endif
if (ret < 0) {
#if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
if ((get_last_sys_error() == EAGAIN) ||
(get_last_sys_error() == EINTR) ||
(get_last_sys_error() == EBUSY))
BIO_set_retry_write(s->wbio);
else
#endif
#ifdef OPENSSL_NO_KTLS
SYSerr(SYS_F_SENDFILE, get_last_sys_error());
#else
SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
#endif
return ret;
}
s->rwstate = SSL_NOTHING;
return ret;
}
int SSL_write(SSL *s, const void *buf, int num)
{
int ret;
@@ -2343,10 +2406,7 @@ long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
return 1;
case SSL_CTRL_GET_RI_SUPPORT:
if (s->s3)
return s->s3->send_connection_binding;
else
return 0;
return s->s3.send_connection_binding;
case SSL_CTRL_CERT_FLAGS:
return (s->cert->cert_flags |= larg);
case SSL_CTRL_CLEAR_CERT_FLAGS:
@@ -2354,10 +2414,10 @@ long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
case SSL_CTRL_GET_RAW_CIPHERLIST:
if (parg) {
if (s->s3->tmp.ciphers_raw == NULL)
if (s->s3.tmp.ciphers_raw == NULL)
return 0;
*(unsigned char **)parg = s->s3->tmp.ciphers_raw;
return (int)s->s3->tmp.ciphers_rawlen;
*(unsigned char **)parg = s->s3.tmp.ciphers_raw;
return (int)s->s3.tmp.ciphers_rawlen;
} else {
return TLS_CIPHER_LEN;
}
@@ -2950,13 +3010,11 @@ void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
unsigned int *len)
{
*data = NULL;
if (ssl->s3)
*data = ssl->s3->alpn_selected;
*data = ssl->s3.alpn_selected;
if (*data == NULL)
*len = 0;
else
*len = (unsigned int)ssl->s3->alpn_selected_len;
*len = (unsigned int)ssl->s3.alpn_selected_len;
}
int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
@@ -3365,7 +3423,7 @@ void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg)
void ssl_set_masks(SSL *s)
{
CERT *c = s->cert;
uint32_t *pvalid = s->s3->tmp.valid_flags;
uint32_t *pvalid = s->s3.tmp.valid_flags;
int rsa_enc, rsa_sign, dh_tmp, dsa_sign;
unsigned long mask_k, mask_a;
#ifndef OPENSSL_NO_EC
@@ -3471,15 +3529,15 @@ void ssl_set_masks(SSL *s)
mask_k |= SSL_kECDHEPSK;
#endif
s->s3->tmp.mask_k = mask_k;
s->s3->tmp.mask_a = mask_a;
s->s3.tmp.mask_k = mask_k;
s->s3.tmp.mask_a = mask_a;
}
#ifndef OPENSSL_NO_EC
int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
{
if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
/* key usage, if present, must allow signing */
if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) {
SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG,
@@ -3495,7 +3553,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
size_t *serverinfo_length)
{
CERT_PKEY *cpk = s->s3->tmp.cert;
CERT_PKEY *cpk = s->s3.tmp.cert;
*serverinfo_length = 0;
if (cpk == NULL || cpk->serverinfo == NULL)
@@ -3687,7 +3745,7 @@ int SSL_get_error(const SSL *s, int i)
return SSL_ERROR_WANT_CLIENT_HELLO_CB;
if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
(s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
(s->s3.warn_alert == SSL_AD_CLOSE_NOTIFY))
return SSL_ERROR_ZERO_RETURN;
return SSL_ERROR_SYSCALL;
@@ -4019,7 +4077,7 @@ const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s)
{
return s->s3->tmp.new_cipher;
return s->s3.tmp.new_cipher;
}
const COMP_METHOD *SSL_get_current_compression(const SSL *s)
@@ -4237,20 +4295,20 @@ long SSL_get_verify_result(const SSL *ssl)
size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen)
{
if (outlen == 0)
return sizeof(ssl->s3->client_random);
if (outlen > sizeof(ssl->s3->client_random))
outlen = sizeof(ssl->s3->client_random);
memcpy(out, ssl->s3->client_random, outlen);
return sizeof(ssl->s3.client_random);
if (outlen > sizeof(ssl->s3.client_random))
outlen = sizeof(ssl->s3.client_random);
memcpy(out, ssl->s3.client_random, outlen);
return outlen;
}
size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen)
{
if (outlen == 0)
return sizeof(ssl->s3->server_random);
if (outlen > sizeof(ssl->s3->server_random))
outlen = sizeof(ssl->s3->server_random);
memcpy(out, ssl->s3->server_random, outlen);
return sizeof(ssl->s3.server_random);
if (outlen > sizeof(ssl->s3.server_random))
outlen = sizeof(ssl->s3.server_random);
memcpy(out, ssl->s3.server_random, outlen);
return outlen;
}
@@ -4580,7 +4638,7 @@ int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
size_t *hashlen)
{
EVP_MD_CTX *ctx = NULL;
EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
EVP_MD_CTX *hdgst = s->s3.handshake_dgst;
int hashleni = EVP_MD_CTX_size(hdgst);
int ret = 0;
@@ -4609,7 +4667,7 @@ int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
return ret;
}
int SSL_session_reused(SSL *s)
int SSL_session_reused(const SSL *s)
{
return s->hit;
}
@@ -5356,7 +5414,7 @@ int ssl_log_secret(SSL *ssl,
{
return nss_keylog_int(label,
ssl,
ssl->s3->client_random,
ssl->s3.client_random,
SSL3_RANDOM_SIZE,
secret,
secret_len);
@@ -5382,9 +5440,9 @@ int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
return 0;
}
OPENSSL_free(s->s3->tmp.ciphers_raw);
s->s3->tmp.ciphers_raw = NULL;
s->s3->tmp.ciphers_rawlen = 0;
OPENSSL_free(s->s3.tmp.ciphers_raw);
s->s3.tmp.ciphers_raw = NULL;
s->s3.tmp.ciphers_rawlen = 0;
if (sslv2format) {
size_t numciphers = PACKET_remaining(cipher_suites) / n;
@@ -5400,13 +5458,13 @@ int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
* problem.
*/
raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
s->s3->tmp.ciphers_raw = raw;
s->s3.tmp.ciphers_raw = raw;
if (raw == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
ERR_R_MALLOC_FAILURE);
return 0;
}
for (s->s3->tmp.ciphers_rawlen = 0;
for (s->s3.tmp.ciphers_rawlen = 0;
PACKET_remaining(&sslv2ciphers) > 0;
raw += TLS_CIPHER_LEN) {
if (!PACKET_get_1(&sslv2ciphers, &leadbyte)
@@ -5417,16 +5475,16 @@ int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
&& !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
SSL_R_BAD_PACKET);
OPENSSL_free(s->s3->tmp.ciphers_raw);
s->s3->tmp.ciphers_raw = NULL;
s->s3->tmp.ciphers_rawlen = 0;
OPENSSL_free(s->s3.tmp.ciphers_raw);
s->s3.tmp.ciphers_raw = NULL;
s->s3.tmp.ciphers_rawlen = 0;
return 0;
}
if (leadbyte == 0)
s->s3->tmp.ciphers_rawlen += TLS_CIPHER_LEN;
s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN;
}
} else if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw,
&s->s3->tmp.ciphers_rawlen)) {
} else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw,
&s->s3.tmp.ciphers_rawlen)) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
ERR_R_INTERNAL_ERROR);
return 0;
@@ -5619,9 +5677,9 @@ int SSL_stateless(SSL *s)
ERR_clear_error();
s->s3->flags |= TLS1_FLAGS_STATELESS;
s->s3.flags |= TLS1_FLAGS_STATELESS;
ret = SSL_accept(s);
s->s3->flags &= ~TLS1_FLAGS_STATELESS;
s->s3.flags &= ~TLS1_FLAGS_STATELESS;
if (ret > 0 && s->ext.cookieok)
return 1;