s3_enc.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623
  1. /*
  2. * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright 2005 Nokia. All rights reserved.
  4. *
  5. * Licensed under the Apache License 2.0 (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. */
  10. #include <stdio.h>
  11. #include "ssl_local.h"
  12. #include <openssl/evp.h>
  13. #include <openssl/md5.h>
  14. #include <openssl/core_names.h>
  15. #include "internal/cryptlib.h"
  16. static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
  17. {
  18. const EVP_MD *md5 = NULL, *sha1 = NULL;
  19. EVP_MD_CTX *m5;
  20. EVP_MD_CTX *s1;
  21. unsigned char buf[16], smd[SHA_DIGEST_LENGTH];
  22. unsigned char c = 'A';
  23. unsigned int i, j, k;
  24. int ret = 0;
  25. #ifdef CHARSET_EBCDIC
  26. c = os_toascii[c]; /* 'A' in ASCII */
  27. #endif
  28. k = 0;
  29. md5 = ssl_evp_md_fetch(s->ctx->libctx, NID_md5, s->ctx->propq);
  30. sha1 = ssl_evp_md_fetch(s->ctx->libctx, NID_sha1, s->ctx->propq);
  31. m5 = EVP_MD_CTX_new();
  32. s1 = EVP_MD_CTX_new();
  33. if (md5 == NULL || sha1 == NULL || m5 == NULL || s1 == NULL) {
  34. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_GENERATE_KEY_BLOCK,
  35. ERR_R_MALLOC_FAILURE);
  36. goto err;
  37. }
  38. for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
  39. k++;
  40. if (k > sizeof(buf)) {
  41. /* bug: 'buf' is too small for this ciphersuite */
  42. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_GENERATE_KEY_BLOCK,
  43. ERR_R_INTERNAL_ERROR);
  44. goto err;
  45. }
  46. for (j = 0; j < k; j++)
  47. buf[j] = c;
  48. c++;
  49. if (!EVP_DigestInit_ex(s1, sha1, NULL)
  50. || !EVP_DigestUpdate(s1, buf, k)
  51. || !EVP_DigestUpdate(s1, s->session->master_key,
  52. s->session->master_key_length)
  53. || !EVP_DigestUpdate(s1, s->s3.server_random, SSL3_RANDOM_SIZE)
  54. || !EVP_DigestUpdate(s1, s->s3.client_random, SSL3_RANDOM_SIZE)
  55. || !EVP_DigestFinal_ex(s1, smd, NULL)
  56. || !EVP_DigestInit_ex(m5, md5, NULL)
  57. || !EVP_DigestUpdate(m5, s->session->master_key,
  58. s->session->master_key_length)
  59. || !EVP_DigestUpdate(m5, smd, SHA_DIGEST_LENGTH)) {
  60. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_GENERATE_KEY_BLOCK,
  61. ERR_R_INTERNAL_ERROR);
  62. goto err;
  63. }
  64. if ((int)(i + MD5_DIGEST_LENGTH) > num) {
  65. if (!EVP_DigestFinal_ex(m5, smd, NULL)) {
  66. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  67. SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
  68. goto err;
  69. }
  70. memcpy(km, smd, (num - i));
  71. } else {
  72. if (!EVP_DigestFinal_ex(m5, km, NULL)) {
  73. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  74. SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
  75. goto err;
  76. }
  77. }
  78. km += MD5_DIGEST_LENGTH;
  79. }
  80. OPENSSL_cleanse(smd, sizeof(smd));
  81. ret = 1;
  82. err:
  83. EVP_MD_CTX_free(m5);
  84. EVP_MD_CTX_free(s1);
  85. ssl_evp_md_free(md5);
  86. ssl_evp_md_free(sha1);
  87. return ret;
  88. }
  89. int ssl3_change_cipher_state(SSL *s, int which)
  90. {
  91. unsigned char *p, *mac_secret;
  92. unsigned char *ms, *key, *iv;
  93. EVP_CIPHER_CTX *dd;
  94. const EVP_CIPHER *c;
  95. #ifndef OPENSSL_NO_COMP
  96. COMP_METHOD *comp;
  97. #endif
  98. const EVP_MD *m;
  99. int mdi;
  100. size_t n, i, j, k, cl;
  101. int reuse_dd = 0;
  102. c = s->s3.tmp.new_sym_enc;
  103. m = s->s3.tmp.new_hash;
  104. /* m == NULL will lead to a crash later */
  105. if (!ossl_assert(m != NULL)) {
  106. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  107. ERR_R_INTERNAL_ERROR);
  108. goto err;
  109. }
  110. #ifndef OPENSSL_NO_COMP
  111. if (s->s3.tmp.new_compression == NULL)
  112. comp = NULL;
  113. else
  114. comp = s->s3.tmp.new_compression->method;
  115. #endif
  116. if (which & SSL3_CC_READ) {
  117. if (s->enc_read_ctx != NULL) {
  118. reuse_dd = 1;
  119. } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) {
  120. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  121. ERR_R_MALLOC_FAILURE);
  122. goto err;
  123. } else {
  124. /*
  125. * make sure it's initialised in case we exit later with an error
  126. */
  127. EVP_CIPHER_CTX_reset(s->enc_read_ctx);
  128. }
  129. dd = s->enc_read_ctx;
  130. if (ssl_replace_hash(&s->read_hash, m) == NULL) {
  131. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  132. ERR_R_INTERNAL_ERROR);
  133. goto err;
  134. }
  135. #ifndef OPENSSL_NO_COMP
  136. /* COMPRESS */
  137. COMP_CTX_free(s->expand);
  138. s->expand = NULL;
  139. if (comp != NULL) {
  140. s->expand = COMP_CTX_new(comp);
  141. if (s->expand == NULL) {
  142. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  143. SSL_F_SSL3_CHANGE_CIPHER_STATE,
  144. SSL_R_COMPRESSION_LIBRARY_ERROR);
  145. goto err;
  146. }
  147. }
  148. #endif
  149. RECORD_LAYER_reset_read_sequence(&s->rlayer);
  150. mac_secret = &(s->s3.read_mac_secret[0]);
  151. } else {
  152. s->statem.enc_write_state = ENC_WRITE_STATE_INVALID;
  153. if (s->enc_write_ctx != NULL) {
  154. reuse_dd = 1;
  155. } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) {
  156. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  157. ERR_R_MALLOC_FAILURE);
  158. goto err;
  159. } else {
  160. /*
  161. * make sure it's initialised in case we exit later with an error
  162. */
  163. EVP_CIPHER_CTX_reset(s->enc_write_ctx);
  164. }
  165. dd = s->enc_write_ctx;
  166. if (ssl_replace_hash(&s->write_hash, m) == NULL) {
  167. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  168. ERR_R_MALLOC_FAILURE);
  169. goto err;
  170. }
  171. #ifndef OPENSSL_NO_COMP
  172. /* COMPRESS */
  173. COMP_CTX_free(s->compress);
  174. s->compress = NULL;
  175. if (comp != NULL) {
  176. s->compress = COMP_CTX_new(comp);
  177. if (s->compress == NULL) {
  178. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  179. SSL_F_SSL3_CHANGE_CIPHER_STATE,
  180. SSL_R_COMPRESSION_LIBRARY_ERROR);
  181. goto err;
  182. }
  183. }
  184. #endif
  185. RECORD_LAYER_reset_write_sequence(&s->rlayer);
  186. mac_secret = &(s->s3.write_mac_secret[0]);
  187. }
  188. if (reuse_dd)
  189. EVP_CIPHER_CTX_reset(dd);
  190. p = s->s3.tmp.key_block;
  191. mdi = EVP_MD_size(m);
  192. if (mdi < 0) {
  193. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  194. ERR_R_INTERNAL_ERROR);
  195. goto err;
  196. }
  197. i = mdi;
  198. cl = EVP_CIPHER_key_length(c);
  199. j = cl;
  200. k = EVP_CIPHER_iv_length(c);
  201. if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
  202. (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
  203. ms = &(p[0]);
  204. n = i + i;
  205. key = &(p[n]);
  206. n += j + j;
  207. iv = &(p[n]);
  208. n += k + k;
  209. } else {
  210. n = i;
  211. ms = &(p[n]);
  212. n += i + j;
  213. key = &(p[n]);
  214. n += j + k;
  215. iv = &(p[n]);
  216. n += k;
  217. }
  218. if (n > s->s3.tmp.key_block_length) {
  219. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  220. ERR_R_INTERNAL_ERROR);
  221. goto err;
  222. }
  223. memcpy(mac_secret, ms, i);
  224. if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
  225. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHANGE_CIPHER_STATE,
  226. ERR_R_INTERNAL_ERROR);
  227. goto err;
  228. }
  229. if (EVP_CIPHER_provider(c) != NULL
  230. && !tls_provider_set_tls_params(s, dd, c, m)) {
  231. /* SSLfatal already called */
  232. goto err;
  233. }
  234. s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
  235. return 1;
  236. err:
  237. return 0;
  238. }
  239. int ssl3_setup_key_block(SSL *s)
  240. {
  241. unsigned char *p;
  242. const EVP_CIPHER *c;
  243. const EVP_MD *hash;
  244. int num;
  245. int ret = 0;
  246. SSL_COMP *comp;
  247. if (s->s3.tmp.key_block_length != 0)
  248. return 1;
  249. if (!ssl_cipher_get_evp(s->ctx, s->session, &c, &hash, NULL, NULL, &comp,
  250. 0)) {
  251. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_SETUP_KEY_BLOCK,
  252. SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
  253. return 0;
  254. }
  255. ssl_evp_cipher_free(s->s3.tmp.new_sym_enc);
  256. s->s3.tmp.new_sym_enc = c;
  257. ssl_evp_md_free(s->s3.tmp.new_hash);
  258. s->s3.tmp.new_hash = hash;
  259. #ifdef OPENSSL_NO_COMP
  260. s->s3.tmp.new_compression = NULL;
  261. #else
  262. s->s3.tmp.new_compression = comp;
  263. #endif
  264. num = EVP_MD_size(hash);
  265. if (num < 0)
  266. return 0;
  267. num = EVP_CIPHER_key_length(c) + num + EVP_CIPHER_iv_length(c);
  268. num *= 2;
  269. ssl3_cleanup_key_block(s);
  270. if ((p = OPENSSL_malloc(num)) == NULL) {
  271. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_SETUP_KEY_BLOCK,
  272. ERR_R_MALLOC_FAILURE);
  273. return 0;
  274. }
  275. s->s3.tmp.key_block_length = num;
  276. s->s3.tmp.key_block = p;
  277. /* Calls SSLfatal() as required */
  278. ret = ssl3_generate_key_block(s, p, num);
  279. if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) {
  280. /*
  281. * enable vulnerability countermeasure for CBC ciphers with known-IV
  282. * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
  283. */
  284. s->s3.need_empty_fragments = 1;
  285. if (s->session->cipher != NULL) {
  286. if (s->session->cipher->algorithm_enc == SSL_eNULL)
  287. s->s3.need_empty_fragments = 0;
  288. #ifndef OPENSSL_NO_RC4
  289. if (s->session->cipher->algorithm_enc == SSL_RC4)
  290. s->s3.need_empty_fragments = 0;
  291. #endif
  292. }
  293. }
  294. return ret;
  295. }
  296. void ssl3_cleanup_key_block(SSL *s)
  297. {
  298. OPENSSL_clear_free(s->s3.tmp.key_block, s->s3.tmp.key_block_length);
  299. s->s3.tmp.key_block = NULL;
  300. s->s3.tmp.key_block_length = 0;
  301. }
  302. int ssl3_init_finished_mac(SSL *s)
  303. {
  304. BIO *buf = BIO_new(BIO_s_mem());
  305. if (buf == NULL) {
  306. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_INIT_FINISHED_MAC,
  307. ERR_R_MALLOC_FAILURE);
  308. return 0;
  309. }
  310. ssl3_free_digest_list(s);
  311. s->s3.handshake_buffer = buf;
  312. (void)BIO_set_close(s->s3.handshake_buffer, BIO_CLOSE);
  313. return 1;
  314. }
  315. /*
  316. * Free digest list. Also frees handshake buffer since they are always freed
  317. * together.
  318. */
  319. void ssl3_free_digest_list(SSL *s)
  320. {
  321. BIO_free(s->s3.handshake_buffer);
  322. s->s3.handshake_buffer = NULL;
  323. EVP_MD_CTX_free(s->s3.handshake_dgst);
  324. s->s3.handshake_dgst = NULL;
  325. }
  326. int ssl3_finish_mac(SSL *s, const unsigned char *buf, size_t len)
  327. {
  328. int ret;
  329. if (s->s3.handshake_dgst == NULL) {
  330. /* Note: this writes to a memory BIO so a failure is a fatal error */
  331. if (len > INT_MAX) {
  332. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINISH_MAC,
  333. SSL_R_OVERFLOW_ERROR);
  334. return 0;
  335. }
  336. ret = BIO_write(s->s3.handshake_buffer, (void *)buf, (int)len);
  337. if (ret <= 0 || ret != (int)len) {
  338. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINISH_MAC,
  339. ERR_R_INTERNAL_ERROR);
  340. return 0;
  341. }
  342. } else {
  343. ret = EVP_DigestUpdate(s->s3.handshake_dgst, buf, len);
  344. if (!ret) {
  345. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINISH_MAC,
  346. ERR_R_INTERNAL_ERROR);
  347. return 0;
  348. }
  349. }
  350. return 1;
  351. }
  352. int ssl3_digest_cached_records(SSL *s, int keep)
  353. {
  354. const EVP_MD *md;
  355. long hdatalen;
  356. void *hdata;
  357. if (s->s3.handshake_dgst == NULL) {
  358. hdatalen = BIO_get_mem_data(s->s3.handshake_buffer, &hdata);
  359. if (hdatalen <= 0) {
  360. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_DIGEST_CACHED_RECORDS,
  361. SSL_R_BAD_HANDSHAKE_LENGTH);
  362. return 0;
  363. }
  364. s->s3.handshake_dgst = EVP_MD_CTX_new();
  365. if (s->s3.handshake_dgst == NULL) {
  366. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_DIGEST_CACHED_RECORDS,
  367. ERR_R_MALLOC_FAILURE);
  368. return 0;
  369. }
  370. md = ssl_handshake_md(s);
  371. if (md == NULL || !EVP_DigestInit_ex(s->s3.handshake_dgst, md, NULL)
  372. || !EVP_DigestUpdate(s->s3.handshake_dgst, hdata, hdatalen)) {
  373. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_DIGEST_CACHED_RECORDS,
  374. ERR_R_INTERNAL_ERROR);
  375. return 0;
  376. }
  377. }
  378. if (keep == 0) {
  379. BIO_free(s->s3.handshake_buffer);
  380. s->s3.handshake_buffer = NULL;
  381. }
  382. return 1;
  383. }
  384. void ssl3_digest_master_key_set_params(const SSL_SESSION *session,
  385. OSSL_PARAM params[])
  386. {
  387. int n = 0;
  388. params[n++] = OSSL_PARAM_construct_octet_string(OSSL_DIGEST_PARAM_SSL3_MS,
  389. (void *)session->master_key,
  390. session->master_key_length);
  391. params[n++] = OSSL_PARAM_construct_end();
  392. }
  393. size_t ssl3_final_finish_mac(SSL *s, const char *sender, size_t len,
  394. unsigned char *p)
  395. {
  396. int ret;
  397. EVP_MD_CTX *ctx = NULL;
  398. if (!ssl3_digest_cached_records(s, 0)) {
  399. /* SSLfatal() already called */
  400. return 0;
  401. }
  402. if (EVP_MD_CTX_type(s->s3.handshake_dgst) != NID_md5_sha1) {
  403. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINAL_FINISH_MAC,
  404. SSL_R_NO_REQUIRED_DIGEST);
  405. return 0;
  406. }
  407. ctx = EVP_MD_CTX_new();
  408. if (ctx == NULL) {
  409. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINAL_FINISH_MAC,
  410. ERR_R_MALLOC_FAILURE);
  411. return 0;
  412. }
  413. if (!EVP_MD_CTX_copy_ex(ctx, s->s3.handshake_dgst)) {
  414. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINAL_FINISH_MAC,
  415. ERR_R_INTERNAL_ERROR);
  416. ret = 0;
  417. goto err;
  418. }
  419. ret = EVP_MD_CTX_size(ctx);
  420. if (ret < 0) {
  421. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINAL_FINISH_MAC,
  422. ERR_R_INTERNAL_ERROR);
  423. ret = 0;
  424. goto err;
  425. }
  426. if (sender != NULL) {
  427. OSSL_PARAM digest_cmd_params[3];
  428. ssl3_digest_master_key_set_params(s->session, digest_cmd_params);
  429. if (EVP_DigestUpdate(ctx, sender, len) <= 0
  430. || EVP_MD_CTX_set_params(ctx, digest_cmd_params) <= 0
  431. || EVP_DigestFinal_ex(ctx, p, NULL) <= 0) {
  432. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_FINAL_FINISH_MAC,
  433. ERR_R_INTERNAL_ERROR);
  434. ret = 0;
  435. }
  436. }
  437. err:
  438. EVP_MD_CTX_free(ctx);
  439. return ret;
  440. }
  441. int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
  442. size_t len, size_t *secret_size)
  443. {
  444. static const unsigned char *salt[3] = {
  445. #ifndef CHARSET_EBCDIC
  446. (const unsigned char *)"A",
  447. (const unsigned char *)"BB",
  448. (const unsigned char *)"CCC",
  449. #else
  450. (const unsigned char *)"\x41",
  451. (const unsigned char *)"\x42\x42",
  452. (const unsigned char *)"\x43\x43\x43",
  453. #endif
  454. };
  455. unsigned char buf[EVP_MAX_MD_SIZE];
  456. EVP_MD_CTX *ctx = EVP_MD_CTX_new();
  457. int i, ret = 1;
  458. unsigned int n;
  459. size_t ret_secret_size = 0;
  460. if (ctx == NULL) {
  461. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_GENERATE_MASTER_SECRET,
  462. ERR_R_MALLOC_FAILURE);
  463. return 0;
  464. }
  465. for (i = 0; i < 3; i++) {
  466. if (EVP_DigestInit_ex(ctx, s->ctx->sha1, NULL) <= 0
  467. || EVP_DigestUpdate(ctx, salt[i],
  468. strlen((const char *)salt[i])) <= 0
  469. || EVP_DigestUpdate(ctx, p, len) <= 0
  470. || EVP_DigestUpdate(ctx, &(s->s3.client_random[0]),
  471. SSL3_RANDOM_SIZE) <= 0
  472. || EVP_DigestUpdate(ctx, &(s->s3.server_random[0]),
  473. SSL3_RANDOM_SIZE) <= 0
  474. /* TODO(size_t) : convert me */
  475. || EVP_DigestFinal_ex(ctx, buf, &n) <= 0
  476. || EVP_DigestInit_ex(ctx, s->ctx->md5, NULL) <= 0
  477. || EVP_DigestUpdate(ctx, p, len) <= 0
  478. || EVP_DigestUpdate(ctx, buf, n) <= 0
  479. || EVP_DigestFinal_ex(ctx, out, &n) <= 0) {
  480. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  481. SSL_F_SSL3_GENERATE_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
  482. ret = 0;
  483. break;
  484. }
  485. out += n;
  486. ret_secret_size += n;
  487. }
  488. EVP_MD_CTX_free(ctx);
  489. OPENSSL_cleanse(buf, sizeof(buf));
  490. if (ret)
  491. *secret_size = ret_secret_size;
  492. return ret;
  493. }
  494. int ssl3_alert_code(int code)
  495. {
  496. switch (code) {
  497. case SSL_AD_CLOSE_NOTIFY:
  498. return SSL3_AD_CLOSE_NOTIFY;
  499. case SSL_AD_UNEXPECTED_MESSAGE:
  500. return SSL3_AD_UNEXPECTED_MESSAGE;
  501. case SSL_AD_BAD_RECORD_MAC:
  502. return SSL3_AD_BAD_RECORD_MAC;
  503. case SSL_AD_DECRYPTION_FAILED:
  504. return SSL3_AD_BAD_RECORD_MAC;
  505. case SSL_AD_RECORD_OVERFLOW:
  506. return SSL3_AD_BAD_RECORD_MAC;
  507. case SSL_AD_DECOMPRESSION_FAILURE:
  508. return SSL3_AD_DECOMPRESSION_FAILURE;
  509. case SSL_AD_HANDSHAKE_FAILURE:
  510. return SSL3_AD_HANDSHAKE_FAILURE;
  511. case SSL_AD_NO_CERTIFICATE:
  512. return SSL3_AD_NO_CERTIFICATE;
  513. case SSL_AD_BAD_CERTIFICATE:
  514. return SSL3_AD_BAD_CERTIFICATE;
  515. case SSL_AD_UNSUPPORTED_CERTIFICATE:
  516. return SSL3_AD_UNSUPPORTED_CERTIFICATE;
  517. case SSL_AD_CERTIFICATE_REVOKED:
  518. return SSL3_AD_CERTIFICATE_REVOKED;
  519. case SSL_AD_CERTIFICATE_EXPIRED:
  520. return SSL3_AD_CERTIFICATE_EXPIRED;
  521. case SSL_AD_CERTIFICATE_UNKNOWN:
  522. return SSL3_AD_CERTIFICATE_UNKNOWN;
  523. case SSL_AD_ILLEGAL_PARAMETER:
  524. return SSL3_AD_ILLEGAL_PARAMETER;
  525. case SSL_AD_UNKNOWN_CA:
  526. return SSL3_AD_BAD_CERTIFICATE;
  527. case SSL_AD_ACCESS_DENIED:
  528. return SSL3_AD_HANDSHAKE_FAILURE;
  529. case SSL_AD_DECODE_ERROR:
  530. return SSL3_AD_HANDSHAKE_FAILURE;
  531. case SSL_AD_DECRYPT_ERROR:
  532. return SSL3_AD_HANDSHAKE_FAILURE;
  533. case SSL_AD_EXPORT_RESTRICTION:
  534. return SSL3_AD_HANDSHAKE_FAILURE;
  535. case SSL_AD_PROTOCOL_VERSION:
  536. return SSL3_AD_HANDSHAKE_FAILURE;
  537. case SSL_AD_INSUFFICIENT_SECURITY:
  538. return SSL3_AD_HANDSHAKE_FAILURE;
  539. case SSL_AD_INTERNAL_ERROR:
  540. return SSL3_AD_HANDSHAKE_FAILURE;
  541. case SSL_AD_USER_CANCELLED:
  542. return SSL3_AD_HANDSHAKE_FAILURE;
  543. case SSL_AD_NO_RENEGOTIATION:
  544. return -1; /* Don't send it :-) */
  545. case SSL_AD_UNSUPPORTED_EXTENSION:
  546. return SSL3_AD_HANDSHAKE_FAILURE;
  547. case SSL_AD_CERTIFICATE_UNOBTAINABLE:
  548. return SSL3_AD_HANDSHAKE_FAILURE;
  549. case SSL_AD_UNRECOGNIZED_NAME:
  550. return SSL3_AD_HANDSHAKE_FAILURE;
  551. case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
  552. return SSL3_AD_HANDSHAKE_FAILURE;
  553. case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
  554. return SSL3_AD_HANDSHAKE_FAILURE;
  555. case SSL_AD_UNKNOWN_PSK_IDENTITY:
  556. return TLS1_AD_UNKNOWN_PSK_IDENTITY;
  557. case SSL_AD_INAPPROPRIATE_FALLBACK:
  558. return TLS1_AD_INAPPROPRIATE_FALLBACK;
  559. case SSL_AD_NO_APPLICATION_PROTOCOL:
  560. return TLS1_AD_NO_APPLICATION_PROTOCOL;
  561. case SSL_AD_CERTIFICATE_REQUIRED:
  562. return SSL_AD_HANDSHAKE_FAILURE;
  563. default:
  564. return -1;
  565. }
  566. }