aboutsummaryrefslogtreecommitdiffstats
path: root/ssl
diff options
context:
space:
mode:
Diffstat (limited to 'ssl')
-rw-r--r--ssl/Makefile.ssl64
-rw-r--r--ssl/bio_ssl.c16
-rw-r--r--ssl/s3_clnt.c2
-rw-r--r--ssl/s3_lib.c61
-rw-r--r--ssl/s3_pkt.c2
-rw-r--r--ssl/s3_srvr.c23
-rw-r--r--ssl/ssl.h26
-rw-r--r--ssl/ssl_cert.c176
-rw-r--r--ssl/ssl_ciph.c82
-rw-r--r--ssl/ssl_err.c4
-rw-r--r--ssl/ssl_lib.c3
-rw-r--r--ssl/ssl_txt.c54
-rw-r--r--ssl/ssltest.c367
-rw-r--r--ssl/tls1.h11
14 files changed, 328 insertions, 563 deletions
diff --git a/ssl/Makefile.ssl b/ssl/Makefile.ssl
index d7345ae7236..04ed4b3b814 100644
--- a/ssl/Makefile.ssl
+++ b/ssl/Makefile.ssl
@@ -541,22 +541,22 @@ ssl_cert.o: ../include/openssl/comp.h ../include/openssl/conf.h
ssl_cert.o: ../include/openssl/crypto.h ../include/openssl/des.h
ssl_cert.o: ../include/openssl/dh.h ../include/openssl/dsa.h
ssl_cert.o: ../include/openssl/e_os.h ../include/openssl/e_os.h
-ssl_cert.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
-ssl_cert.o: ../include/openssl/err.h ../include/openssl/evp.h
-ssl_cert.o: ../include/openssl/idea.h ../include/openssl/lhash.h
-ssl_cert.o: ../include/openssl/md2.h ../include/openssl/md5.h
-ssl_cert.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
-ssl_cert.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
-ssl_cert.o: ../include/openssl/pem.h ../include/openssl/pem2.h
-ssl_cert.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
-ssl_cert.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
-ssl_cert.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
-ssl_cert.o: ../include/openssl/safestack.h ../include/openssl/sha.h
-ssl_cert.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
-ssl_cert.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
-ssl_cert.o: ../include/openssl/stack.h ../include/openssl/tls1.h
-ssl_cert.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
-ssl_cert.o: ../include/openssl/x509v3.h ssl_locl.h
+ssl_cert.o: ../include/openssl/e_os2.h ../include/openssl/err.h
+ssl_cert.o: ../include/openssl/evp.h ../include/openssl/idea.h
+ssl_cert.o: ../include/openssl/lhash.h ../include/openssl/md2.h
+ssl_cert.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
+ssl_cert.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
+ssl_cert.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
+ssl_cert.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+ssl_cert.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
+ssl_cert.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
+ssl_cert.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+ssl_cert.o: ../include/openssl/sha.h ../include/openssl/ssl.h
+ssl_cert.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
+ssl_cert.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
+ssl_cert.o: ../include/openssl/tls1.h ../include/openssl/x509.h
+ssl_cert.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h
+ssl_cert.o: ssl_locl.h
ssl_ciph.o: ../include/openssl/asn1.h ../include/openssl/bio.h
ssl_ciph.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
ssl_ciph.o: ../include/openssl/buffer.h ../include/openssl/cast.h
@@ -624,22 +624,22 @@ ssl_lib.o: ../include/openssl/buffer.h ../include/openssl/cast.h
ssl_lib.o: ../include/openssl/comp.h ../include/openssl/conf.h
ssl_lib.o: ../include/openssl/crypto.h ../include/openssl/des.h
ssl_lib.o: ../include/openssl/dh.h ../include/openssl/dsa.h
-ssl_lib.o: ../include/openssl/e_os.h ../include/openssl/e_os.h
-ssl_lib.o: ../include/openssl/e_os2.h ../include/openssl/err.h
-ssl_lib.o: ../include/openssl/evp.h ../include/openssl/idea.h
-ssl_lib.o: ../include/openssl/lhash.h ../include/openssl/md2.h
-ssl_lib.o: ../include/openssl/md5.h ../include/openssl/mdc2.h
-ssl_lib.o: ../include/openssl/objects.h ../include/openssl/opensslconf.h
-ssl_lib.o: ../include/openssl/opensslv.h ../include/openssl/pem.h
-ssl_lib.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
-ssl_lib.o: ../include/openssl/rc2.h ../include/openssl/rc4.h
-ssl_lib.o: ../include/openssl/rc5.h ../include/openssl/ripemd.h
-ssl_lib.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
-ssl_lib.o: ../include/openssl/sha.h ../include/openssl/ssl.h
-ssl_lib.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
-ssl_lib.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
-ssl_lib.o: ../include/openssl/tls1.h ../include/openssl/x509.h
-ssl_lib.o: ../include/openssl/x509_vfy.h ../include/openssl/x509v3.h ssl_locl.h
+ssl_lib.o: ../include/openssl/e_os.h ../include/openssl/e_os2.h
+ssl_lib.o: ../include/openssl/err.h ../include/openssl/evp.h
+ssl_lib.o: ../include/openssl/idea.h ../include/openssl/lhash.h
+ssl_lib.o: ../include/openssl/md2.h ../include/openssl/md5.h
+ssl_lib.o: ../include/openssl/mdc2.h ../include/openssl/objects.h
+ssl_lib.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+ssl_lib.o: ../include/openssl/pem.h ../include/openssl/pem2.h
+ssl_lib.o: ../include/openssl/pkcs7.h ../include/openssl/rc2.h
+ssl_lib.o: ../include/openssl/rc4.h ../include/openssl/rc5.h
+ssl_lib.o: ../include/openssl/ripemd.h ../include/openssl/rsa.h
+ssl_lib.o: ../include/openssl/safestack.h ../include/openssl/sha.h
+ssl_lib.o: ../include/openssl/ssl.h ../include/openssl/ssl2.h
+ssl_lib.o: ../include/openssl/ssl23.h ../include/openssl/ssl3.h
+ssl_lib.o: ../include/openssl/stack.h ../include/openssl/tls1.h
+ssl_lib.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h
+ssl_lib.o: ../include/openssl/x509v3.h ssl_locl.h
ssl_rsa.o: ../include/openssl/asn1.h ../include/openssl/bio.h
ssl_rsa.o: ../include/openssl/blowfish.h ../include/openssl/bn.h
ssl_rsa.o: ../include/openssl/buffer.h ../include/openssl/cast.h
diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index ae99a6aceb0..d73c41adcdc 100644
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -65,13 +65,13 @@
#include <openssl/err.h>
#include <openssl/ssl.h>
-static int ssl_write(BIO *h, const char *buf, int num);
-static int ssl_read(BIO *h, char *buf, int size);
-static int ssl_puts(BIO *h, const char *str);
-static long ssl_ctrl(BIO *h, int cmd, long arg1, void *arg2);
+static int ssl_write(BIO *h,char *buf,int num);
+static int ssl_read(BIO *h,char *buf,int size);
+static int ssl_puts(BIO *h,char *str);
+static long ssl_ctrl(BIO *h,int cmd,long arg1,char *arg2);
static int ssl_new(BIO *h);
static int ssl_free(BIO *data);
-static long ssl_callback_ctrl(BIO *h, int cmd, void (*fp)());
+static long ssl_callback_ctrl(BIO *h,int cmd,void (*fp)());
typedef struct bio_ssl_st
{
SSL *ssl; /* The ssl handle :-) */
@@ -221,7 +221,7 @@ static int ssl_read(BIO *b, char *out, int outl)
return(ret);
}
-static int ssl_write(BIO *b, const char *out, int outl)
+static int ssl_write(BIO *b, char *out, int outl)
{
int ret,r=0;
int retry_reason=0;
@@ -289,7 +289,7 @@ static int ssl_write(BIO *b, const char *out, int outl)
return(ret);
}
-static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
+static long ssl_ctrl(BIO *b, int cmd, long num, char *ptr)
{
SSL **sslp,*ssl;
BIO_SSL *bs;
@@ -492,7 +492,7 @@ static long ssl_callback_ctrl(BIO *b, int cmd, void (*fp)())
return(ret);
}
-static int ssl_puts(BIO *bp, const char *str)
+static int ssl_puts(BIO *bp, char *str)
{
int n,ret;
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 0c8f551f736..279d2c01983 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -772,8 +772,6 @@ static int ssl3_get_server_certificate(SSL *s)
s->session->sess_cert=sc;
sc->cert_chain=sk;
- /* Inconsistency alert: cert_chain does include the peer's
- * certificate, which we don't include in s3_srvr.c */
x=sk_X509_value(sk,0);
sk=NULL;
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 7ada26cbb69..c4b49aaedf4 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -771,16 +771,14 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
case SSL_CTRL_SET_TMP_RSA:
{
RSA *rsa = (RSA *)parg;
- if (rsa == NULL)
- {
+ if (rsa == NULL) {
SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
return(ret);
- }
- if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
- {
+ }
+ if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) {
SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB);
return(ret);
- }
+ }
if (s->cert->rsa_tmp != NULL)
RSA_free(s->cert->rsa_tmp);
s->cert->rsa_tmp = rsa;
@@ -798,25 +796,19 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg)
case SSL_CTRL_SET_TMP_DH:
{
DH *dh = (DH *)parg;
- if (dh == NULL)
- {
+ if (dh == NULL) {
SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
return(ret);
- }
- if ((dh = DHparams_dup(dh)) == NULL)
- {
+ }
+ if ((dh = DHparams_dup(dh)) == NULL) {
+ SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
+ return(ret);
+ }
+ if (!DH_generate_key(dh)) {
+ DH_free(dh);
SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
return(ret);
- }
- if (!(s->options & SSL_OP_SINGLE_DH_USE))
- {
- if (!DH_generate_key(dh))
- {
- DH_free(dh);
- SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
- return(ret);
- }
- }
+ }
if (s->cert->dh_tmp != NULL)
DH_free(s->cert->dh_tmp);
s->cert->dh_tmp = dh;
@@ -851,8 +843,8 @@ long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
0)
{
if (!ssl_cert_inst(&s->cert))
- {
- SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE);
+ {
+ SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
return(0);
}
}
@@ -937,26 +929,23 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg)
case SSL_CTRL_SET_TMP_DH:
{
DH *new=NULL,*dh;
+ int rret=0;
dh=(DH *)parg;
- if ((new=DHparams_dup(dh)) == NULL)
+ if ( ((new=DHparams_dup(dh)) == NULL) ||
+ (!DH_generate_key(new)))
{
SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
- return 0;
+ if (new != NULL) DH_free(new);
}
- if (!(ctx->options & SSL_OP_SINGLE_DH_USE))
+ else
{
- if (!DH_generate_key(new))
- {
- SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
- DH_free(new);
- return 0;
- }
+ if (cert->dh_tmp != NULL)
+ DH_free(cert->dh_tmp);
+ cert->dh_tmp=new;
+ rret=1;
}
- if (cert->dh_tmp != NULL)
- DH_free(cert->dh_tmp);
- cert->dh_tmp=new;
- return 1;
+ return(rret);
}
/*break; */
case SSL_CTRL_SET_TMP_DH_CB:
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index e3d02e6007d..eb965310d9b 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -954,7 +954,7 @@ start:
s->rwstate=SSL_NOTHING;
s->s3->fatal_alert = alert_descr;
SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
- BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr);
+ sprintf(tmp,"%d",alert_descr);
ERR_add_error_data(2,"SSL alert number ",tmp);
s->shutdown|=SSL_RECEIVED_SHUTDOWN;
SSL_CTX_remove_session(s->ctx,s->session);
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index c1895dda88a..90806e2d99b 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -982,7 +982,7 @@ static int ssl3_send_server_key_exchange(SSL *s)
dhp=cert->dh_tmp;
if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
dhp=s->cert->dh_tmp_cb(s,
- SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
+ !SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
if (dhp == NULL)
{
@@ -1326,22 +1326,11 @@ static int ssl3_get_client_key_exchange(SSL *s)
goto f_err;
}
- if (!((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff))))
+ if ((p[0] != (s->client_version>>8)) || (p[1] != (s->client_version & 0xff)))
{
- /* The premaster secret must contain the same version number as the
- * ClientHello to detect version rollback attacks (strangely, the
- * protocol does not offer such protection for DH ciphersuites).
- * However, buggy clients exist that send the negotiated protocol
- * version instead if the server does not support the requested
- * protocol version.
- * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */
- if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) &&
- (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff))))
- {
- al=SSL_AD_DECODE_ERROR;
- SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
- goto f_err;
- }
+ al=SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
+ goto f_err;
}
s->session->master_key_length=
@@ -1709,8 +1698,6 @@ static int ssl3_get_client_certificate(SSL *s)
if (s->session->sess_cert->cert_chain != NULL)
sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
s->session->sess_cert->cert_chain=sk;
- /* Inconsistency alert: cert_chain does *not* include the
- * peer's own certificate, while we do include it in s3_clnt.c */
sk=NULL;
diff --git a/ssl/ssl.h b/ssl/ssl.h
index f7c91b80e08..f29f7753474 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -59,12 +59,12 @@
#ifndef HEADER_SSL_H
#define HEADER_SSL_H
-#include <openssl/safestack.h>
-
#ifdef __cplusplus
extern "C" {
#endif
+#include <openssl/safestack.h>
+
/* SSLeay version number for ASN.1 encoding of the session information */
/* Version 0 - initial version
* Version 1 - added the optional peer certificate
@@ -140,10 +140,6 @@ extern "C" {
#define SSL_SENT_SHUTDOWN 1
#define SSL_RECEIVED_SHUTDOWN 2
-#ifdef __cplusplus
-}
-#endif
-
#include <openssl/crypto.h>
#include <openssl/lhash.h>
#include <openssl/buffer.h>
@@ -151,10 +147,6 @@ extern "C" {
#include <openssl/pem.h>
#include <openssl/x509.h>
-#ifdef __cplusplus
-extern "C" {
-#endif
-
#if (defined(NO_RSA) || defined(NO_MD5)) && !defined(NO_SSL2)
#define NO_SSL2
#endif
@@ -399,8 +391,9 @@ struct ssl_ctx_st
* SSL_SESSION_free() when it has finished using it. Otherwise,
* on 0, it means the callback has finished with it.
* If remove_session_cb is not null, it will be called when
- * a session-id is removed from the cache. After the call,
- * OpenSSL will SSL_SESSION_free() it. */
+ * a session-id is removed from the cache. Again, a return
+ * of 0 mens that SSLeay should not SSL_SESSION_free() since
+ * the application is doing something with it. */
int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess);
void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess);
SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl,
@@ -663,19 +656,11 @@ struct ssl_st
* SSLv3/TLS rollback check */
};
-#ifdef __cplusplus
-}
-#endif
-
#include <openssl/ssl2.h>
#include <openssl/ssl3.h>
#include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */
#include <openssl/ssl23.h>
-#ifdef __cplusplus
-extern "C" {
-#endif
-
/* compatibility */
#define SSL_set_app_data(s,arg) (SSL_set_ex_data(s,0,(char *)arg))
#define SSL_get_app_data(s) (SSL_get_ex_data(s,0))
@@ -1230,7 +1215,6 @@ int SSL_COMP_add_compression_method(int id,char *cm);
#define SSL_F_SSL2_SET_CERTIFICATE 126
#define SSL_F_SSL2_WRITE 127
#define SSL_F_SSL3_ACCEPT 128
-#define SSL_F_SSL3_CALLBACK_CTRL 233
#define SSL_F_SSL3_CHANGE_CIPHER_STATE 129
#define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130
#define SSL_F_SSL3_CLIENT_HELLO 131
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index e134e6f3e0e..48f247ceaca 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -191,33 +191,16 @@ CERT *ssl_cert_dup(CERT *cert)
#ifndef NO_DH
if (cert->dh_tmp != NULL)
{
- /* DH parameters don't have a reference count */
+ /* DH parameters don't have a reference count (and cannot
+ * reasonably be shared anyway, as the secret exponent may
+ * be created just when it is needed -- earlier library
+ * versions did not pay attention to this) */
ret->dh_tmp = DHparams_dup(cert->dh_tmp);
if (ret->dh_tmp == NULL)
{
- SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB);
+ SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_DH_LIB);
goto err;
}
- if (cert->dh_tmp->priv_key)
- {
- BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
- if (!b)
- {
- SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
- goto err;
- }
- ret->dh_tmp->priv_key = b;
- }
- if (cert->dh_tmp->pub_key)
- {
- BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
- if (!b)
- {
- SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
- goto err;
- }
- ret->dh_tmp->pub_key = b;
- }
}
ret->dh_tmp_cb = cert->dh_tmp_cb;
#endif
@@ -644,53 +627,53 @@ err:
int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
const char *file)
+ {
+ BIO *in;
+ X509 *x=NULL;
+ X509_NAME *xn=NULL;
+ int ret=1;
+ int (*oldcmp)(X509_NAME **a, X509_NAME **b);
+
+ oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp);
+
+ in=BIO_new(BIO_s_file_internal());
+
+ if (in == NULL)
{
- BIO *in;
- X509 *x=NULL;
- X509_NAME *xn=NULL;
- int ret=1;
- int (*oldcmp)(X509_NAME **a, X509_NAME **b);
-
- oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp);
-
- in=BIO_new(BIO_s_file_internal());
-
- if (in == NULL)
- {
- SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE);
- goto err;
- }
-
- if (!BIO_read_filename(in,file))
- goto err;
+ SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
- for (;;)
- {
- if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
- break;
- if ((xn=X509_get_subject_name(x)) == NULL) goto err;
- xn=X509_NAME_dup(xn);
- if (xn == NULL) goto err;
- if (sk_X509_NAME_find(stack,xn) >= 0)
- X509_NAME_free(xn);
- else
- sk_X509_NAME_push(stack,xn);
- }
+ if (!BIO_read_filename(in,file))
+ goto err;
- if (0)
- {
-err:
- ret=0;
- }
- if(in != NULL)
- BIO_free(in);
- if(x != NULL)
- X509_free(x);
-
- sk_X509_NAME_set_cmp_func(stack,oldcmp);
+ for (;;)
+ {
+ if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
+ break;
+ if ((xn=X509_get_subject_name(x)) == NULL) goto err;
+ xn=X509_NAME_dup(xn);
+ if (xn == NULL) goto err;
+ if (sk_X509_NAME_find(stack,xn) >= 0)
+ X509_NAME_free(xn);
+ else
+ sk_X509_NAME_push(stack,xn);
+ }
- return ret;
+ if (0)
+ {
+err:
+ ret=0;
}
+ if(in != NULL)
+ BIO_free(in);
+ if(x != NULL)
+ X509_free(x);
+
+ sk_X509_NAME_set_cmp_func(stack,oldcmp);
+
+ return ret;
+ }
/*!
* Add a directory of certs to a stack.
@@ -709,46 +692,43 @@ err:
int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
const char *dir)
+ {
+ DIR *d;
+ struct dirent *dstruct;
+ int ret = 0;
+
+ CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
+ d = opendir(dir);
+
+ /* Note that a side effect is that the CAs will be sorted by name */
+ if(!d)
{
- DIR *d;
- struct dirent *dstruct;
- int ret = 0;
+ SYSerr(SYS_F_OPENDIR, get_last_sys_error());
+ ERR_add_error_data(3, "opendir('", dir, "')");
+ SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
+ goto err;
+ }
- CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
- d = opendir(dir);
+ while((dstruct=readdir(d)))
+ {
+ char buf[1024];
- /* Note that a side effect is that the CAs will be sorted by name */
- if(!d)
- {
- SYSerr(SYS_F_OPENDIR, get_last_sys_error());
- ERR_add_error_data(3, "opendir('", dir, "')");
- SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
- goto err;
- }
+ if(strlen(dir)+strlen(dstruct->d_name)+2 > sizeof buf)
+ {
+ SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
+ goto err;
+ }
- while((dstruct=readdir(d)))
- {
- char buf[1024];
- int r;
-
- if(strlen(dir)+strlen(dstruct->d_name)+2 > sizeof buf)
- {
- SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
- goto err;
- }
-
- r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,dstruct->d_name);
- if (r <= 0 || r >= sizeof buf)
- goto err;
- if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
- goto err;
- }
- ret = 1;
+ sprintf(buf,"%s/%s",dir,dstruct->d_name);
+ if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
+ goto err;
+ }
+ ret = 1;
err:
- CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
- return ret;
- }
+ CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
+ return ret;
+ }
#endif
#endif
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index a5b2b970567..1cbc2886e92 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -607,7 +607,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
if (buflen == 0)
{
/*
- * We hit something we cannot deal with,
+ * We hit something, we cannot deal with,
* it is no command or separator nor
* alphanumeric, so we call this an error.
*/
@@ -620,7 +620,6 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
if (rule == CIPHER_SPECIAL)
{
- found = 0; /* unused -- avoid compiler warning */
break; /* special treatment */
}
@@ -634,12 +633,12 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
multi=0;
/*
- * Now search for the cipher alias in the ca_list. Be careful
+ * Now search for the name in the ca_list. Be careful
* with the strncmp, because the "buflen" limitation
* will make the rule "ADH:SOME" and the cipher
* "ADH-MY-CIPHER" look like a match for buflen=3.
- * So additionally check whether the cipher name found
- * has the correct length. We can save a strlen() call:
+ * So additionally check, whether the cipher name found
+ * has the correct length. We can save a strlen() call,
* just checking for the '\0' at the right place is
* sufficient, we have to strncmp() anyway.
*/
@@ -666,42 +665,42 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
if (!multi) break;
}
- /*
- * Ok, we have the rule, now apply it
- */
- if (rule == CIPHER_SPECIAL)
- { /* special command */
- ok = 0;
- if ((buflen == 8) &&
- !strncmp(buf, "STRENGTH", 8))
- ok = ssl_cipher_strength_sort(list,
- head_p, tail_p);
- else
- SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
- SSL_R_INVALID_COMMAND);
- if (ok == 0)
- retval = 0;
/*
- * We do not support any "multi" options
- * together with "@", so throw away the
- * rest of the command, if any left, until
- * end or ':' is found.
+ * Ok, we have the rule, now apply it
*/
- while ((*l != '\0') && ITEM_SEP(*l))
- l++;
- }
- else if (found)
- {
- ssl_cipher_apply_rule(algorithms, mask,
- algo_strength, mask_strength, rule, -1,
- list, head_p, tail_p);
- }
- else
- {
- while ((*l != '\0') && ITEM_SEP(*l))
- l++;
- }
- if (*l == '\0') break; /* done */
+ if (rule == CIPHER_SPECIAL)
+ { /* special command */
+ ok = 0;
+ if ((buflen == 8) &&
+ !strncmp(buf, "STRENGTH", 8))
+ ok = ssl_cipher_strength_sort(list,
+ head_p, tail_p);
+ else
+ SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
+ SSL_R_INVALID_COMMAND);
+ if (ok == 0)
+ retval = 0;
+ /*
+ * We do not support any "multi" options
+ * together with "@", so throw away the
+ * rest of the command, if any left, until
+ * end or ':' is found.
+ */
+ while ((*l != '\0') && ITEM_SEP(*l))
+ l++;
+ }
+ else if (found)
+ {
+ ssl_cipher_apply_rule(algorithms, mask,
+ algo_strength, mask_strength, rule, -1,
+ list, head_p, tail_p);
+ }
+ else
+ {
+ while ((*l != '\0') && ITEM_SEP(*l))
+ l++;
+ }
+ if (*l == '\0') break; /* done */
}
return(retval);
@@ -975,14 +974,13 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
if (buf == NULL)
{
- len=128;
- buf=Malloc(len);
+ buf=Malloc(128);
if (buf == NULL) return("Malloc Error");
}
else if (len < 128)
return("Buffer too small");
- BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp);
+ sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp);
return(buf);
}
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index 642c3f93e7b..5618e34a308 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -54,8 +54,7 @@
*/
/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
+ * made to it will be overwritten when the script next updates this file.
*/
#include <stdio.h>
@@ -95,7 +94,6 @@ static ERR_STRING_DATA SSL_str_functs[]=
{ERR_PACK(0,SSL_F_SSL2_SET_CERTIFICATE,0), "SSL2_SET_CERTIFICATE"},
{ERR_PACK(0,SSL_F_SSL2_WRITE,0), "SSL2_WRITE"},
{ERR_PACK(0,SSL_F_SSL3_ACCEPT,0), "SSL3_ACCEPT"},
-{ERR_PACK(0,SSL_F_SSL3_CALLBACK_CTRL,0), "SSL3_CALLBACK_CTRL"},
{ERR_PACK(0,SSL_F_SSL3_CHANGE_CIPHER_STATE,0), "SSL3_CHANGE_CIPHER_STATE"},
{ERR_PACK(0,SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,0), "SSL3_CHECK_CERT_AND_ALGORITHM"},
{ERR_PACK(0,SSL_F_SSL3_CLIENT_HELLO,0), "SSL3_CLIENT_HELLO"},
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index c515c41b4e7..3109708480b 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -599,9 +599,6 @@ STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s)
else
r=s->session->sess_cert->cert_chain;
- /* If we are a client, cert_chain includes the peer's own
- * certificate; if we are a server, it does not. */
-
return(r);
}
diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
index 6e33eec3e4f..7e27857bcfc 100644
--- a/ssl/ssl_txt.c
+++ b/ssl/ssl_txt.c
@@ -81,7 +81,7 @@ int SSL_SESSION_print_fp(FILE *fp, SSL_SESSION *x)
int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
{
unsigned int i;
- char *s;
+ char str[128],*s;
if (x == NULL) goto err;
if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err;
@@ -93,41 +93,36 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
s="TLSv1";
else
s="unknown";
- if (BIO_printf(bp," Protocol : %s\n",s) <= 0) goto err;
+ sprintf(str," Protocol : %s\n",s);
+ if (BIO_puts(bp,str) <= 0) goto err;
if (x->cipher == NULL)
{
if (((x->cipher_id) & 0xff000000) == 0x02000000)
- {
- if (BIO_printf(bp," Cipher : %06lX\n",x->cipher_id&0xffffff) <= 0)
- goto err;
- }
+ sprintf(str," Cipher : %06lX\n",x->cipher_id&0xffffff);
else
- {
- if (BIO_printf(bp," Cipher : %04lX\n",x->cipher_id&0xffff) <= 0)
- goto err;
- }
+ sprintf(str," Cipher : %04lX\n",x->cipher_id&0xffff);
}
else
- {
- if (BIO_printf(bp," Cipher : %s\n",((x->cipher == NULL)?"unknown":x->cipher->name)) <= 0)
- goto err;
- }
+ sprintf(str," Cipher : %s\n",(x->cipher == NULL)?"unknown":x->cipher->name);
+ if (BIO_puts(bp,str) <= 0) goto err;
if (BIO_puts(bp," Session-ID: ") <= 0) goto err;
for (i=0; i<x->session_id_length; i++)
{
- if (BIO_printf(bp,"%02X",x->session_id[i]) <= 0) goto err;
+ sprintf(str,"%02X",x->session_id[i]);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
if (BIO_puts(bp,"\n Session-ID-ctx: ") <= 0) goto err;
for (i=0; i<x->sid_ctx_length; i++)
{
- if (BIO_printf(bp,"%02X",x->sid_ctx[i]) <= 0)
- goto err;
+ sprintf(str,"%02X",x->sid_ctx[i]);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
if (BIO_puts(bp,"\n Master-Key: ") <= 0) goto err;
for (i=0; i<(unsigned int)x->master_key_length; i++)
{
- if (BIO_printf(bp,"%02X",x->master_key[i]) <= 0) goto err;
+ sprintf(str,"%02X",x->master_key[i]);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
if (BIO_puts(bp,"\n Key-Arg : ") <= 0) goto err;
if (x->key_arg_length == 0)
@@ -137,7 +132,8 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
else
for (i=0; i<x->key_arg_length; i++)
{
- if (BIO_printf(bp,"%02X",x->key_arg[i]) <= 0) goto err;
+ sprintf(str,"%02X",x->key_arg[i]);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
if (x->compress_meth != 0)
{
@@ -146,26 +142,32 @@ int SSL_SESSION_print(BIO *bp, SSL_SESSION *x)
ssl_cipher_get_evp(x,NULL,NULL,&comp);
if (comp == NULL)
{
- if (BIO_printf(bp,"\n Compression: %d",x->compress_meth) <= 0) goto err;
+ sprintf(str,"\n Compression: %d",x->compress_meth);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
else
{
- if (BIO_printf(bp,"\n Compression: %d (%s)", comp->id,comp->method->name) <= 0) goto err;
+ sprintf(str,"\n Compression: %d (%s)",
+ comp->id,comp->method->name);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
}
if (x->time != 0L)
{
- if (BIO_printf(bp, "\n Start Time: %ld",x->time) <= 0) goto err;
+ sprintf(str,"\n Start Time: %ld",x->time);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
if (x->timeout != 0L)
{
- if (BIO_printf(bp, "\n Timeout : %ld (sec)",x->timeout) <= 0) goto err;
+ sprintf(str,"\n Timeout : %ld (sec)",x->timeout);
+ if (BIO_puts(bp,str) <= 0) goto err;
}
if (BIO_puts(bp,"\n") <= 0) goto err;
- if (BIO_puts(bp, " Verify return code: ") <= 0) goto err;
- if (BIO_printf(bp, "%ld (%s)\n", x->verify_result,
- X509_verify_cert_error_string(x->verify_result)) <= 0) goto err;
+ if (BIO_puts(bp, " Verify return code ") <= 0) goto err;
+ sprintf(str, "%ld (%s)\n", x->verify_result,
+ X509_verify_cert_error_string(x->verify_result));
+ if (BIO_puts(bp,str) <= 0) goto err;
return(1);
err:
diff --git a/ssl/ssltest.c b/ssl/ssltest.c
index caf5876e5a2..d655bbbd841 100644
--- a/ssl/ssltest.c
+++ b/ssl/ssltest.c
@@ -62,13 +62,11 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
-#include <time.h>
#include "openssl/e_os.h"
#include <openssl/bio.h>
#include <openssl/crypto.h>
-#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
@@ -88,12 +86,12 @@
static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
#ifndef NO_RSA
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
-static void free_tmp_rsa(void);
#endif
#ifndef NO_DH
static DH *get_dh512(void);
-static DH *get_dh1024(void);
-static DH *get_dh1024dsa(void);
+#endif
+#ifndef NO_DSA
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
#endif
static BIO *bio_err=NULL;
@@ -111,7 +109,7 @@ static int s_nbio=0;
static const char rnd_seed[] = "string to make the random number generator think it has entropy";
-int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
+int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes);
int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
static void sv_usage(void)
{
@@ -124,9 +122,10 @@ static void sv_usage(void)
fprintf(stderr," -reuse - use session-id reuse\n");
fprintf(stderr," -num <val> - number of connections to perform\n");
fprintf(stderr," -bytes <val> - number of bytes to swap between client/server\n");
-#ifndef NO_DH
- fprintf(stderr," -dhe1024 - use 1024 bit key (safe prime) for DHE\n");
- fprintf(stderr," -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n");
+#if !defined NO_DH && !defined NO_DSA
+ fprintf(stderr," -dhe1024 - generate 1024 bit key for DHE\n");
+#endif
+#if !defined NO_DH
fprintf(stderr," -no_dhe - disable DHE\n");
#endif
#ifndef NO_SSL2
@@ -140,58 +139,12 @@ static void sv_usage(void)
#endif
fprintf(stderr," -CApath arg - PEM format directory of CA's\n");
fprintf(stderr," -CAfile arg - PEM format file of CA's\n");
- fprintf(stderr," -cert arg - Server certificate file\n");
- fprintf(stderr," -key arg - Server key file (default: same as -cert)\n");
- fprintf(stderr," -c_cert arg - Client certificate file\n");
- fprintf(stderr," -c_key arg - Client key file (default: same as -c_cert)\n");
+ fprintf(stderr," -cert arg - Certificate file\n");
+ fprintf(stderr," -s_cert arg - Just the server certificate file\n");
+ fprintf(stderr," -c_cert arg - Just the client certificate file\n");
fprintf(stderr," -cipher arg - The cipher list\n");
fprintf(stderr," -bio_pair - Use BIO pairs\n");
fprintf(stderr," -f - Test even cases that can't work\n");
- fprintf(stderr," -time - measure processor time used by client and server\n");
- }
-
-static void print_details(SSL *c_ssl, const char *prefix)
- {
- SSL_CIPHER *ciph;
- X509 *cert;
-
- ciph=SSL_get_current_cipher(c_ssl);
- BIO_printf(bio_stdout,"%s%s, cipher %s %s",
- prefix,
- SSL_get_version(c_ssl),
- SSL_CIPHER_get_version(ciph),
- SSL_CIPHER_get_name(ciph));
- cert=SSL_get_peer_certificate(c_ssl);
- if (cert != NULL)
- {
- EVP_PKEY *pkey = X509_get_pubkey(cert);
- if (pkey != NULL)
- {
- if (0)
- ;
-#ifndef NO_RSA
- else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
- && pkey->pkey.rsa->n != NULL)
- {
- BIO_printf(bio_stdout, ", %d bit RSA",
- BN_num_bits(pkey->pkey.rsa->n));
- }
-#endif
-#ifndef NO_DSA
- else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
- && pkey->pkey.dsa->p != NULL)
- {
- BIO_printf(bio_stdout, ", %d bit DSA",
- BN_num_bits(pkey->pkey.dsa->p));
- }
-#endif
- EVP_PKEY_free(pkey);
- }
- X509_free(cert);
- }
- /* The SSL API does not allow us to look at temporary RSA/DH keys,
- * otherwise we should print their lengths too */
- BIO_printf(bio_stdout,"\n");
}
int main(int argc, char *argv[])
@@ -204,23 +157,18 @@ int main(int argc, char *argv[])
int client_auth=0;
int server_auth=0,i;
char *server_cert=TEST_SERVER_CERT;
- char *server_key=NULL;
char *client_cert=TEST_CLIENT_CERT;
- char *client_key=NULL;
SSL_CTX *s_ctx=NULL;
SSL_CTX *c_ctx=NULL;
SSL_METHOD *meth=NULL;
SSL *c_ssl,*s_ssl;
int number=1,reuse=0;
long bytes=1L;
+ SSL_CIPHER *ciph;
+ int dhe1024 = 0, no_dhe = 0;
#ifndef NO_DH
DH *dh;
- int dhe1024 = 0, dhe1024dsa = 0;
#endif
- int no_dhe = 0;
- int print_time = 0;
- clock_t s_time = 0, c_time = 0;
-
verbose = 0;
debug = 0;
cipher = 0;
@@ -247,12 +195,8 @@ int main(int argc, char *argv[])
debug=1;
else if (strcmp(*argv,"-reuse") == 0)
reuse=1;
-#ifndef NO_DH
else if (strcmp(*argv,"-dhe1024") == 0)
dhe1024=1;
- else if (strcmp(*argv,"-dhe1024dsa") == 0)
- dhe1024dsa=1;
-#endif
else if (strcmp(*argv,"-no_dhe") == 0)
no_dhe=1;
else if (strcmp(*argv,"-ssl2") == 0)
@@ -286,26 +230,11 @@ int main(int argc, char *argv[])
if (--argc < 1) goto bad;
server_cert= *(++argv);
}
- else if (strcmp(*argv,"-key") == 0)
- {
- if (--argc < 1) goto bad;
- server_key= *(++argv);
- }
- else if (strcmp(*argv,"-s_key") == 0)
- {
- if (--argc < 1) goto bad;
- server_key= *(++argv);
- }
else if (strcmp(*argv,"-c_cert") == 0)
{
if (--argc < 1) goto bad;
client_cert= *(++argv);
}
- else if (strcmp(*argv,"-c_key") == 0)
- {
- if (--argc < 1) goto bad;
- client_key= *(++argv);
- }
else if (strcmp(*argv,"-cipher") == 0)
{
if (--argc < 1) goto bad;
@@ -329,10 +258,6 @@ int main(int argc, char *argv[])
{
force = 1;
}
- else if (strcmp(*argv,"-time") == 0)
- {
- print_time = 1;
- }
else
{
fprintf(stderr,"unknown option %s\n",*argv);
@@ -351,24 +276,15 @@ bad:
if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
{
- fprintf(stderr, "This case cannot work. Use -f to perform "
- "the test anyway (and\n-d to see what happens), "
- "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
- "to avoid protocol mismatch.\n");
+ fprintf(stderr, "This case cannot work. Use -f switch to perform "
+ "the test anyway\n"
+ "(and -d to see what happens, "
+ "and -bio_pair to really make it happen :-)\n"
+ "or add one of -ssl2, -ssl3, -tls1, -reuse to "
+ "avoid protocol mismatch.\n");
exit(1);
}
- if (print_time)
- {
- if (!bio_pair)
- {
- fprintf(stderr, "Using BIO pair (-bio_pair)\n");
- bio_pair = 1;
- }
- if (number < 50 && !force)
- fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
- }
-
/* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
SSL_library_init();
@@ -410,21 +326,34 @@ bad:
#ifndef NO_DH
if (!no_dhe)
{
- if (dhe1024dsa)
+# ifndef NO_DSA
+ if (dhe1024)
{
- /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
+ DSA *dsa;
+ unsigned char seed[20];
+
+ if (verbose)
+ {
+ BIO_printf(bio_err, "Creating 1024 bit DHE parameters\n");
+ BIO_flush(bio_err);
+ }
+
+ memcpy(seed, "Random String no. 12", 20);
+ dsa = DSA_generate_parameters(1024, seed, 20, NULL, NULL, dsa_cb, bio_err);
+ dh = DSA_dup_DH(dsa);
+ DSA_free(dsa);
+ /* important: SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
- dh=get_dh1024dsa();
+
+ if (verbose)
+ fprintf(stdout, " done\n");
}
- else if (dhe1024)
- dh=get_dh1024();
else
+# endif
dh=get_dh512();
SSL_CTX_set_tmp_dh(s_ctx,dh);
DH_free(dh);
}
-#else
- (void)no_dhe;
#endif
#ifndef NO_RSA
@@ -435,8 +364,8 @@ bad:
{
ERR_print_errors(bio_err);
}
- else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
- (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
+ else if (!SSL_CTX_use_PrivateKey_file(s_ctx,server_cert,
+ SSL_FILETYPE_PEM))
{
ERR_print_errors(bio_err);
goto end;
@@ -446,8 +375,7 @@ bad:
{
SSL_CTX_use_certificate_file(c_ctx,client_cert,
SSL_FILETYPE_PEM);
- SSL_CTX_use_PrivateKey_file(c_ctx,
- (client_key?client_key:client_cert),
+ SSL_CTX_use_PrivateKey_file(c_ctx,client_cert,
SSL_FILETYPE_PEM);
}
@@ -487,38 +415,21 @@ bad:
{
if (!reuse) SSL_set_session(c_ssl,NULL);
if (bio_pair)
- ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
+ ret=doit_biopair(s_ssl,c_ssl,bytes);
else
ret=doit(s_ssl,c_ssl,bytes);
}
if (!verbose)
{
- print_details(c_ssl, "");
+ ciph=SSL_get_current_cipher(c_ssl);
+ BIO_printf(bio_stdout,"Protocol %s, cipher %s, %s\n",
+ SSL_get_version(c_ssl),
+ SSL_CIPHER_get_version(ciph),
+ SSL_CIPHER_get_name(ciph));
}
if ((number > 1) || (bytes > 1L))
BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
- if (print_time)
- {
-#ifdef CLOCKS_PER_SEC
- /* "To determine the time in seconds, the value returned
- * by the clock function should be divided by the value
- * of the macro CLOCKS_PER_SEC."
- * -- ISO/IEC 9899 */
- BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
- "Approximate total client time: %6.2f s\n",
- (double)s_time/CLOCKS_PER_SEC,
- (double)c_time/CLOCKS_PER_SEC);
-#else
- /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
- * -- cc on NeXTstep/OpenStep */
- BIO_printf(bio_stdout,
- "Approximate total server time: %6.2f units\n"
- "Approximate total client time: %6.2f units\n",
- (double)s_time,
- (double)c_time);
-#endif
- }
SSL_free(s_ssl);
SSL_free(c_ssl);
@@ -529,9 +440,6 @@ end:
if (bio_stdout != NULL) BIO_free(bio_stdout);
-#ifndef NO_RSA
- free_tmp_rsa();
-#endif
ERR_free_strings();
ERR_remove_state(0);
EVP_cleanup();
@@ -540,12 +448,12 @@ end:
EXIT(ret);
}
-int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
- clock_t *s_time, clock_t *c_time)
+int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count)
{
long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
+ SSL_CIPHER *ciph;
int ret = 1;
size_t bufsiz = 256; /* small buffer for testing */
@@ -618,7 +526,6 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
MS_STATIC char cbuf[1024*8];
int i, r;
- clock_t c_clock = clock();
if (debug)
if (SSL_in_init(c_ssl))
@@ -685,16 +592,6 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
cr_num -= r;
}
}
-
- /* c_time and s_time increments will typically be very small
- * (depending on machine speed and clock tick intervals),
- * but sampling over a large number of connections should
- * result in fairly accurate figures. We cannot guarantee
- * a lot, however -- if each connection lasts for exactly
- * one clock tick, it will be counted only for the client
- * or only for the server or even not at all.
- */
- *c_time += (clock() - c_clock);
}
{
@@ -702,7 +599,6 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
MS_STATIC char sbuf[1024*8];
int i, r;
- clock_t s_clock = clock();
if (debug)
if (SSL_in_init(s_ssl))
@@ -766,8 +662,6 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
sr_num -= r;
}
}
-
- *s_time += (clock() - s_clock);
}
{
@@ -893,9 +787,13 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
}
while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
+ ciph = SSL_get_current_cipher(c_ssl);
if (verbose)
- print_details(c_ssl, "DONE via BIO pair: ");
-end:
+ fprintf(stdout,"DONE via BIO pair, protocol %s, cipher %s, %s\n",
+ SSL_get_version(c_ssl),
+ SSL_CIPHER_get_version(ciph),
+ SSL_CIPHER_get_name(ciph));
+ end:
ret = 0;
err:
@@ -939,6 +837,7 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count)
int done=0;
int c_write,s_write;
int do_server=0,do_client=0;
+ SSL_CIPHER *ciph;
c_to_s=BIO_new(BIO_s_mem());
s_to_c=BIO_new(BIO_s_mem());
@@ -1188,8 +1087,12 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count)
if ((done & S_DONE) && (done & C_DONE)) break;
}
+ ciph=SSL_get_current_cipher(c_ssl);
if (verbose)
- print_details(c_ssl, "DONE: ");
+ fprintf(stdout,"DONE, protocol %s, cipher %s, %s\n",
+ SSL_get_version(c_ssl),
+ SSL_CIPHER_get_version(ciph),
+ SSL_CIPHER_get_name(ciph));
ret=0;
err:
/* We have to set the BIO's to NULL otherwise they will be
@@ -1245,11 +1148,37 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
return(ok);
}
-#ifndef NO_RSA
-static RSA *rsa_tmp=NULL;
+#ifndef NO_DH
+static unsigned char dh512_p[]={
+ 0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75,
+ 0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F,
+ 0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3,
+ 0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12,
+ 0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C,
+ 0x47,0x74,0xE8,0x33,
+ };
+static unsigned char dh512_g[]={
+ 0x02,
+ };
+static DH *get_dh512(void)
+ {
+ DH *dh=NULL;
+
+ if ((dh=DH_new()) == NULL) return(NULL);
+ dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
+ dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
+ if ((dh->p == NULL) || (dh->g == NULL))
+ return(NULL);
+ return(dh);
+ }
+#endif
+
+#ifndef NO_RSA
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
{
+ static RSA *rsa_tmp=NULL;
+
if (rsa_tmp == NULL)
{
BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
@@ -1260,111 +1189,25 @@ static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
}
return(rsa_tmp);
}
-
-static void free_tmp_rsa(void)
- {
- if (rsa_tmp != NULL)
- {
- RSA_free(rsa_tmp);
- rsa_tmp = NULL;
- }
- }
#endif
-#ifndef NO_DH
-/* These DH parameters have been generated as follows:
- * $ openssl dhparam -C -noout 512
- * $ openssl dhparam -C -noout 1024
- * $ openssl dhparam -C -noout -dsaparam 1024
- * (The third function has been renamed to avoid name conflicts.)
- */
-DH *get_dh512()
+#ifndef NO_DSA
+static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
{
- static unsigned char dh512_p[]={
- 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
- 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
- 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
- 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
- 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
- 0x02,0xC5,0xAE,0x23,
- };
- static unsigned char dh512_g[]={
- 0x02,
- };
- DH *dh;
-
- if ((dh=DH_new()) == NULL) return(NULL);
- dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
- dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
- if ((dh->p == NULL) || (dh->g == NULL))
- { DH_free(dh); return(NULL); }
- return(dh);
- }
+ char c='*';
+ static int ok=0,num=0;
-DH *get_dh1024()
- {
- static unsigned char dh1024_p[]={
- 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
- 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
- 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
- 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
- 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
- 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
- 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
- 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
- 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
- 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
- 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
- };
- static unsigned char dh1024_g[]={
- 0x02,
- };
- DH *dh;
+ if (p == 0) { c='.'; num++; };
+ if (p == 1) c='+';
+ if (p == 2) { c='*'; ok++; }
+ if (p == 3) c='\n';
+ BIO_write(arg,&c,1);
+ (void)BIO_flush(arg);
- if ((dh=DH_new()) == NULL) return(NULL);
- dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
- dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
- if ((dh->p == NULL) || (dh->g == NULL))
- { DH_free(dh); return(NULL); }
- return(dh);
- }
-
-DH *get_dh1024dsa()
- {
- static unsigned char dh1024_p[]={
- 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
- 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
- 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
- 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
- 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
- 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
- 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
- 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
- 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
- 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
- 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
- };
- static unsigned char dh1024_g[]={
- 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
- 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
- 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
- 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
- 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
- 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
- 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
- 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
- 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
- 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
- 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
- };
- DH *dh;
-
- if ((dh=DH_new()) == NULL) return(NULL);
- dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
- dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
- if ((dh->p == NULL) || (dh->g == NULL))
- { DH_free(dh); return(NULL); }
- dh->length = 160;
- return(dh);
+ if (!ok && (p == 0) && (num > 1))
+ {
+ BIO_printf((BIO *)arg,"error in dsatest\n");
+ exit(1);
+ }
}
#endif
diff --git a/ssl/tls1.h b/ssl/tls1.h
index cf92ae034f0..6e2b06d34f7 100644
--- a/ssl/tls1.h
+++ b/ssl/tls1.h
@@ -84,10 +84,6 @@ extern "C" {
#define TLS1_AD_USER_CANCELLED 90
#define TLS1_AD_NO_RENEGOTIATION 100
-/* Additional TLS ciphersuites from draft-ietf-tls-56-bit-ciphersuites-00.txt
- * (available if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is defined, see
- * s3_lib.c). We actually treat them like SSL 3.0 ciphers, which we probably
- * shouldn't. */
#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 0x03000060
#define TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 0x03000061
#define TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x03000062
@@ -96,13 +92,6 @@ extern "C" {
#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065
#define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066
-/* XXX
- * Inconsistency alert:
- * The OpenSSL names of ciphers with ephemeral DH here include the string
- * "DHE", while elsewhere it has always been "EDH".
- * (The alias for the list of all such ciphers also is "EDH".)
- * The specifications speak of "EDH"; maybe we should allow both forms
- * for everything. */
#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 "EXP1024-RC4-MD5"
#define TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 "EXP1024-RC2-CBC-MD5"
#define TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DES-CBC-SHA"
generated by cgit (git 2.51.2) at 2026-10-25 13:59:29 +0100