src/third_party/boringssl/src/ssl/t1_enc.c

   1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   2  * All rights reserved.
   3  *
   4  * This package is an SSL implementation written
   5  * by Eric Young (eay@cryptsoft.com).
   6  * The implementation was written so as to conform with Netscapes SSL.
   7  *
   8  * This library is free for commercial and non-commercial use as long as
   9  * the following conditions are aheared to.  The following conditions
  10  * apply to all code found in this distribution, be it the RC4, RSA,
  11  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  12  * included with this distribution is covered by the same copyright terms
  13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  14  *
  15  * Copyright remains Eric Young's, and as such any Copyright notices in
  16  * the code are not to be removed.
  17  * If this package is used in a product, Eric Young should be given attribution
  18  * as the author of the parts of the library used.
  19  * This can be in the form of a textual message at program startup or
  20  * in documentation (online or textual) provided with the package.
  21  *
  22  * Redistribution and use in source and binary forms, with or without
  23  * modification, are permitted provided that the following conditions
  24  * are met:
  25  * 1. Redistributions of source code must retain the copyright
  26  *    notice, this list of conditions and the following disclaimer.
  27  * 2. Redistributions in binary form must reproduce the above copyright
  28  *    notice, this list of conditions and the following disclaimer in the
  29  *    documentation and/or other materials provided with the distribution.
  30  * 3. All advertising materials mentioning features or use of this software
  31  *    must display the following acknowledgement:
  32  *    "This product includes cryptographic software written by
  33  *     Eric Young (eay@cryptsoft.com)"
  34  *    The word 'cryptographic' can be left out if the rouines from the library
  35  *    being used are not cryptographic related :-).
  36  * 4. If you include any Windows specific code (or a derivative thereof) from
  37  *    the apps directory (application code) you must include an acknowledgement:
  38  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  39  *
  40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  43  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  50  * SUCH DAMAGE.
  51  *
  52  * The licence and distribution terms for any publically available version or
  53  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  54  * copied and put under another distribution licence
  55  * [including the GNU Public Licence.]
  56  */
  57 /* ====================================================================
  58  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  59  *
  60  * Redistribution and use in source and binary forms, with or without
  61  * modification, are permitted provided that the following conditions
  62  * are met:
  63  *
  64  * 1. Redistributions of source code must retain the above copyright
  65  *    notice, this list of conditions and the following disclaimer.
  66  *
  67  * 2. Redistributions in binary form must reproduce the above copyright
  68  *    notice, this list of conditions and the following disclaimer in
  69  *    the documentation and/or other materials provided with the
  70  *    distribution.
  71  *
  72  * 3. All advertising materials mentioning features or use of this
  73  *    software must display the following acknowledgment:
  74  *    "This product includes software developed by the OpenSSL Project
  75  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  76  *
  77  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  78  *    endorse or promote products derived from this software without
  79  *    prior written permission. For written permission, please contact
  80  *    openssl-core@openssl.org.
  81  *
  82  * 5. Products derived from this software may not be called "OpenSSL"
  83  *    nor may "OpenSSL" appear in their names without prior written
  84  *    permission of the OpenSSL Project.
  85  *
  86  * 6. Redistributions of any form whatsoever must retain the following
  87  *    acknowledgment:
  88  *    "This product includes software developed by the OpenSSL Project
  89  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  90  *
  91  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  92  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  93  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  94  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  95  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  96  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  97  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  98  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  99  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 100  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 101  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 102  * OF THE POSSIBILITY OF SUCH DAMAGE.
 103  * ====================================================================
 104  *
 105  * This product includes cryptographic software written by Eric Young
 106  * (eay@cryptsoft.com).  This product includes software written by Tim
 107  * Hudson (tjh@cryptsoft.com).
 108  *
 109  */
 110 /* ====================================================================
 111  * Copyright 2005 Nokia. All rights reserved.
 112  *
 113  * The portions of the attached software ("Contribution") is developed by
 114  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 115  * license.
 116  *
 117  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 118  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 119  * support (see RFC 4279) to OpenSSL.
 120  *
 121  * No patent licenses or other rights except those expressly stated in
 122  * the OpenSSL open source license shall be deemed granted or received
 123  * expressly, by implication, estoppel, or otherwise.
 124  *
 125  * No assurances are provided by Nokia that the Contribution does not
 126  * infringe the patent or other intellectual property rights of any third
 127  * party or that the license provides you with all the necessary rights
 128  * to make use of the Contribution.
 129  *
 130  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 131  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 132  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 133  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 134  * OTHERWISE. */
 135
 136 #include <stdio.h>
 137 #include <assert.h>
 138
 139 #include <openssl/err.h>
 140 #include <openssl/evp.h>
 141 #include <openssl/hmac.h>
 142 #include <openssl/md5.h>
 143 #include <openssl/mem.h>
 144 #include <openssl/obj.h>
 145 #include <openssl/rand.h>
 146
 147 #include "ssl_locl.h"
 148
 149 /* seed1 through seed5 are virtually concatenated */
 150 static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
 151                         int sec_len,
 152                         const void *seed1, int seed1_len,
 153                         const void *seed2, int seed2_len,
 154                         const void *seed3, int seed3_len,
 155                         const void *seed4, int seed4_len,
 156                         const void *seed5, int seed5_len,
 157                         unsigned char *out, int olen)
 158         {
 159         int chunk;
 160         size_t j;
 161         EVP_MD_CTX ctx, ctx_tmp, ctx_init;
 162         EVP_PKEY *mac_key;
 163         unsigned char A1[EVP_MAX_MD_SIZE];
 164         size_t A1_len;
 165         int ret = 0;
 166
 167         chunk=EVP_MD_size(md);
 168
 169         EVP_MD_CTX_init(&ctx);
 170         EVP_MD_CTX_init(&ctx_tmp);
 171         EVP_MD_CTX_init(&ctx_init);
 172         mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
 173         if (!mac_key)
 174                 goto err;
 175         if (!EVP_DigestSignInit(&ctx_init,NULL,md, NULL, mac_key))
 176                 goto err;
 177         if (!EVP_MD_CTX_copy_ex(&ctx,&ctx_init))
 178                 goto err;
 179         if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len))
 180                 goto err;
 181         if (seed2 && !EVP_DigestSignUpdate(&ctx,seed2,seed2_len))
 182                 goto err;
 183         if (seed3 && !EVP_DigestSignUpdate(&ctx,seed3,seed3_len))
 184                 goto err;
 185         if (seed4 && !EVP_DigestSignUpdate(&ctx,seed4,seed4_len))
 186                 goto err;
 187         if (seed5 && !EVP_DigestSignUpdate(&ctx,seed5,seed5_len))
 188                 goto err;
 189         A1_len = EVP_MAX_MD_SIZE;
 190         if (!EVP_DigestSignFinal(&ctx,A1,&A1_len))
 191                 goto err;
 192
 193         for (;;)
 194                 {
 195                 /* Reinit mac contexts */
 196                 if (!EVP_MD_CTX_copy_ex(&ctx,&ctx_init))
 197                         goto err;
 198                 if (!EVP_DigestSignUpdate(&ctx,A1,A1_len))
 199                         goto err;
 200                 if (olen>chunk && !EVP_MD_CTX_copy_ex(&ctx_tmp,&ctx))
 201                         goto err;
 202                 if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len))
 203                         goto err;
 204                 if (seed2 && !EVP_DigestSignUpdate(&ctx,seed2,seed2_len))
 205                         goto err;
 206                 if (seed3 && !EVP_DigestSignUpdate(&ctx,seed3,seed3_len))
 207                         goto err;
 208                 if (seed4 && !EVP_DigestSignUpdate(&ctx,seed4,seed4_len))
 209                         goto err;
 210                 if (seed5 && !EVP_DigestSignUpdate(&ctx,seed5,seed5_len))
 211                         goto err;
 212
 213                 if (olen > chunk)
 214                         {
 215                         j = olen;
 216                         if (!EVP_DigestSignFinal(&ctx,out,&j))
 217                                 goto err;
 218                         out+=j;
 219                         olen-=j;
 220                         /* calc the next A1 value */
 221                         A1_len = EVP_MAX_MD_SIZE;
 222                         if (!EVP_DigestSignFinal(&ctx_tmp,A1,&A1_len))
 223                                 goto err;
 224                         }
 225                 else    /* last one */
 226                         {
 227                         A1_len = EVP_MAX_MD_SIZE;
 228                         if (!EVP_DigestSignFinal(&ctx,A1,&A1_len))
 229                                 goto err;
 230                         memcpy(out,A1,olen);
 231                         break;
 232                         }
 233                 }
 234         ret = 1;
 235 err:
 236         EVP_PKEY_free(mac_key);
 237         EVP_MD_CTX_cleanup(&ctx);
 238         EVP_MD_CTX_cleanup(&ctx_tmp);
 239         EVP_MD_CTX_cleanup(&ctx_init);
 240         OPENSSL_cleanse(A1,sizeof(A1));
 241         return ret;
 242         }
 243
 244 /* seed1 through seed5 are virtually concatenated */
 245 static int tls1_PRF(long digest_mask,
 246                      const void *seed1, int seed1_len,
 247                      const void *seed2, int seed2_len,
 248                      const void *seed3, int seed3_len,
 249                      const void *seed4, int seed4_len,
 250                      const void *seed5, int seed5_len,
 251                      const unsigned char *sec, int slen,
 252                      unsigned char *out1,
 253                      unsigned char *out2, int olen)
 254         {
 255         int len,i,idx,count;
 256         const unsigned char *S1;
 257         long m;
 258         const EVP_MD *md;
 259         int ret = 0;
 260
 261         /* Count number of digests and partition sec evenly */
 262         count=0;
 263         for (idx=0;ssl_get_handshake_digest(idx,&m,&md);idx++) {
 264                 if ((m<<TLS1_PRF_DGST_SHIFT) & digest_mask) count++;
 265         }
 266         len=slen/count;
 267         if (count == 1)
 268                 slen = 0;
 269         S1=sec;
 270         memset(out1,0,olen);
 271         for (idx=0;ssl_get_handshake_digest(idx,&m,&md);idx++) {
 272                 if ((m<<TLS1_PRF_DGST_SHIFT) & digest_mask) {
 273                         if (!md) {
 274                                 OPENSSL_PUT_ERROR(SSL, tls1_PRF, SSL_R_UNSUPPORTED_DIGEST_TYPE);
 275                                 goto err;
 276                         }
 277                         if (!tls1_P_hash(md ,S1,len+(slen&1),
 278                                         seed1,seed1_len,seed2,seed2_len,seed3,seed3_len,seed4,seed4_len,seed5,seed5_len,
 279                                         out2,olen))
 280                                 goto err;
 281                         S1+=len;
 282                         for (i=0; i<olen; i++)
 283                         {
 284                                 out1[i]^=out2[i];
 285                         }
 286                 }
 287         }
 288         ret = 1;
 289 err:
 290         return ret;
 291 }
 292
 293 static int tls1_generate_key_block(SSL *s, unsigned char *km,
 294              unsigned char *tmp, int num)
 295         {
 296         int ret;
 297         ret = tls1_PRF(ssl_get_algorithm2(s),
 298                  TLS_MD_KEY_EXPANSION_CONST,TLS_MD_KEY_EXPANSION_CONST_SIZE,
 299                  s->s3->server_random,SSL3_RANDOM_SIZE,
 300                  s->s3->client_random,SSL3_RANDOM_SIZE,
 301                  NULL,0,NULL,0,
 302                  s->session->master_key,s->session->master_key_length,
 303                  km,tmp,num);
 304 #ifdef KSSL_DEBUG
 305         printf("tls1_generate_key_block() ==> %d byte master_key =\n\t",
 306                 s->session->master_key_length);
 307         {
 308         int i;
 309         for (i=0; i < s->session->master_key_length; i++)
 310                 {
 311                 printf("%02X", s->session->master_key[i]);
 312                 }
 313         printf("\n");  }
 314 #endif    /* KSSL_DEBUG */
 315         return ret;
 316         }
 317
 318 /* tls1_aead_ctx_init allocates |*aead_ctx|, if needed and returns 1. It
 319  * returns 0 on malloc error. */
 320 static int tls1_aead_ctx_init(SSL_AEAD_CTX **aead_ctx)
 321         {
 322         if (*aead_ctx != NULL)
 323                 EVP_AEAD_CTX_cleanup(&(*aead_ctx)->ctx);
 324         else
 325                 {
 326                 *aead_ctx = (SSL_AEAD_CTX*) OPENSSL_malloc(sizeof(SSL_AEAD_CTX));
 327                 if (*aead_ctx == NULL)
 328                         {
 329                         OPENSSL_PUT_ERROR(SSL, tls1_aead_ctx_init, ERR_R_MALLOC_FAILURE);
 330                         return 0;
 331                         }
 332                 }
 333
 334         return 1;
 335         }
 336
 337 static int tls1_change_cipher_state_aead(SSL *s, char is_read,
 338         const unsigned char *key, unsigned key_len,
 339         const unsigned char *iv, unsigned iv_len,
 340         const unsigned char *mac_secret, unsigned mac_secret_len)
 341         {
 342         const EVP_AEAD *aead = s->s3->tmp.new_aead;
 343         SSL_AEAD_CTX *aead_ctx;
 344         /* mac_key_and_key is used to merge the MAC and cipher keys for an AEAD
 345          * which simulates pre-AEAD cipher suites. It needs to be large enough
 346          * to cope with the largest pair of keys. */
 347         uint8_t mac_key_and_key[32 /* HMAC(SHA256) */ + 32 /* AES-256 */];
 348
 349         if (mac_secret_len > 0)
 350                 {
 351                 /* This is a "stateful" AEAD (for compatibility with pre-AEAD
 352                  * cipher suites). */
 353                 if (mac_secret_len + key_len > sizeof(mac_key_and_key))
 354                         {
 355                         OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state_aead, ERR_R_INTERNAL_ERROR);
 356                         return 0;
 357                         }
 358                 memcpy(mac_key_and_key, mac_secret, mac_secret_len);
 359                 memcpy(mac_key_and_key + mac_secret_len, key, key_len);
 360                 key = mac_key_and_key;
 361                 key_len += mac_secret_len;
 362                 }
 363
 364         if (is_read)
 365                 {
 366                 if (!tls1_aead_ctx_init(&s->aead_read_ctx))
 367                         return 0;
 368                 aead_ctx = s->aead_read_ctx;
 369                 }
 370         else
 371                 {
 372                 if (!tls1_aead_ctx_init(&s->aead_write_ctx))
 373                         return 0;
 374                 aead_ctx = s->aead_write_ctx;
 375                 }
 376
 377         if (!EVP_AEAD_CTX_init(&aead_ctx->ctx, aead, key, key_len,
 378                                EVP_AEAD_DEFAULT_TAG_LENGTH, NULL /* engine */))
 379                 return 0;
 380         if (iv_len > sizeof(aead_ctx->fixed_nonce))
 381                 {
 382                 OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state_aead, ERR_R_INTERNAL_ERROR);
 383                 return 0;
 384                 }
 385         memcpy(aead_ctx->fixed_nonce, iv, iv_len);
 386         aead_ctx->fixed_nonce_len = iv_len;
 387         aead_ctx->variable_nonce_len = 8;  /* correct for all true AEADs so far. */
 388         if (s->s3->tmp.new_cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_STATEFUL_AEAD)
 389                 aead_ctx->variable_nonce_len = 0;
 390         aead_ctx->variable_nonce_included_in_record =
 391                 (s->s3->tmp.new_cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD) != 0;
 392         if (aead_ctx->variable_nonce_len + aead_ctx->fixed_nonce_len != EVP_AEAD_nonce_length(aead))
 393                 {
 394                 OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state_aead, ERR_R_INTERNAL_ERROR);
 395                 return 0;
 396                 }
 397         aead_ctx->tag_len = EVP_AEAD_max_overhead(aead);
 398
 399         return 1;
 400         }
 401
 402 /* tls1_change_cipher_state_cipher performs the work needed to switch cipher
 403  * states when using EVP_CIPHER. The argument |is_read| is true iff this
 404  * function is being called due to reading, as opposed to writing, a
 405  * ChangeCipherSpec message. In order to support export ciphersuites,
 406  * use_client_keys indicates whether the key material provided is in the
 407  * "client write" direction. */
 408 static int tls1_change_cipher_state_cipher(
 409         SSL *s, char is_read, char use_client_keys,
 410         const unsigned char *mac_secret, unsigned mac_secret_len,
 411         const unsigned char *key, unsigned key_len,
 412         const unsigned char *iv, unsigned iv_len)
 413         {
 414         const EVP_CIPHER *cipher = s->s3->tmp.new_sym_enc;
 415         EVP_CIPHER_CTX *cipher_ctx;
 416         EVP_MD_CTX *mac_ctx;
 417
 418         if (is_read)
 419                 {
 420                 if (s->enc_read_ctx != NULL && !SSL_IS_DTLS(s))
 421                         EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
 422                 else if ((s->enc_read_ctx=EVP_CIPHER_CTX_new()) == NULL)
 423                         goto err;
 424
 425                 cipher_ctx = s->enc_read_ctx;
 426                 mac_ctx = ssl_replace_hash(&s->read_hash, NULL);
 427
 428                 memcpy(s->s3->read_mac_secret, mac_secret, mac_secret_len);
 429                 s->s3->read_mac_secret_size = mac_secret_len;
 430                 }
 431         else
 432                 {
 433                 /* When updating the write contexts for DTLS, we do not wish to
 434                  * free the old ones because DTLS stores pointers to them in
 435                  * order to implement retransmission. */
 436
 437                 if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))
 438                         EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
 439                 else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
 440                         goto err;
 441                 else
 442                         /* make sure it's intialized in case we exit later with an error */
 443                         EVP_CIPHER_CTX_init(s->enc_write_ctx);
 444
 445                 cipher_ctx = s->enc_write_ctx;
 446                 if (SSL_IS_DTLS(s))
 447                         {
 448                         /* This is the same as ssl_replace_hash, but doesn't
 449                          * free the old |s->write_hash|. */
 450                         mac_ctx = EVP_MD_CTX_create();
 451                         if (!mac_ctx)
 452                                 goto err;
 453                         s->write_hash = mac_ctx;
 454                         }
 455                 else
 456                         mac_ctx = ssl_replace_hash(&s->write_hash, NULL);
 457
 458                 memcpy(s->s3->write_mac_secret, mac_secret, mac_secret_len);
 459                 s->s3->write_mac_secret_size = mac_secret_len;
 460                 }
 461
 462         EVP_PKEY *mac_key =
 463                 EVP_PKEY_new_mac_key(s->s3->tmp.new_mac_pkey_type,
 464                                      NULL, mac_secret, mac_secret_len);
 465         if (!mac_key)
 466                 return 0;
 467         EVP_DigestSignInit(mac_ctx, NULL, s->s3->tmp.new_hash, NULL, mac_key);
 468         EVP_PKEY_free(mac_key);
 469
 470         EVP_CipherInit_ex(cipher_ctx, cipher, NULL /* engine */, key, iv, !is_read);
 471
 472         return 1;
 473
 474 err:
 475         OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state_cipher, ERR_R_MALLOC_FAILURE);
 476         return 0;
 477         }
 478
 479 int tls1_change_cipher_state(SSL *s, int which)
 480         {
 481         /* is_read is true if we have just read a ChangeCipherSpec message -
 482          * i.e. we need to update the read cipherspec. Otherwise we have just
 483          * written one. */
 484         const char is_read = (which & SSL3_CC_READ) != 0;
 485         /* use_client_keys is true if we wish to use the keys for the "client
 486          * write" direction. This is the case if we're a client sending a
 487          * ChangeCipherSpec, or a server reading a client's ChangeCipherSpec. */
 488         const char use_client_keys = which == SSL3_CHANGE_CIPHER_CLIENT_WRITE ||
 489                                      which == SSL3_CHANGE_CIPHER_SERVER_READ;
 490         const unsigned char *client_write_mac_secret, *server_write_mac_secret, *mac_secret;
 491         const unsigned char *client_write_key, *server_write_key, *key;
 492         const unsigned char *client_write_iv, *server_write_iv, *iv;
 493         const EVP_CIPHER *cipher = s->s3->tmp.new_sym_enc;
 494         const EVP_AEAD *aead = s->s3->tmp.new_aead;
 495         unsigned key_len, iv_len, mac_secret_len;
 496         const unsigned char *key_data;
 497
 498         /* Reset sequence number to zero. */
 499         if (!SSL_IS_DTLS(s))
 500                 memset(is_read ? s->s3->read_sequence : s->s3->write_sequence, 0, 8);
 501
 502         /* key_arg is used for SSLv2. We don't need it for TLS. */
 503         s->session->key_arg_length = 0;
 504
 505         mac_secret_len = s->s3->tmp.new_mac_secret_size;
 506
 507         if (aead != NULL)
 508                 {
 509                 key_len = EVP_AEAD_key_length(aead);
 510                 /* For "stateful" AEADs (i.e. compatibility with pre-AEAD
 511                  * cipher suites) the key length reported by
 512                  * |EVP_AEAD_key_length| will include the MAC key bytes. */
 513                 if (key_len < mac_secret_len)
 514                         {
 515                         OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state, ERR_R_INTERNAL_ERROR);
 516                         return 0;
 517                         }
 518                 key_len -= mac_secret_len;
 519                 iv_len = SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s->s3->tmp.new_cipher);
 520                 }
 521         else
 522                 {
 523                 key_len = EVP_CIPHER_key_length(cipher);
 524                 iv_len = EVP_CIPHER_iv_length(cipher);
 525                 }
 526
 527         key_data = s->s3->tmp.key_block;
 528         client_write_mac_secret = key_data; key_data += mac_secret_len;
 529         server_write_mac_secret = key_data; key_data += mac_secret_len;
 530         client_write_key =        key_data; key_data += key_len;
 531         server_write_key =        key_data; key_data += key_len;
 532         client_write_iv  =        key_data; key_data += iv_len;
 533         server_write_iv  =        key_data; key_data += iv_len;
 534
 535         if (use_client_keys)
 536                 {
 537                 mac_secret = client_write_mac_secret;
 538                 key = client_write_key;
 539                 iv = client_write_iv;
 540                 }
 541         else
 542                 {
 543                 mac_secret = server_write_mac_secret;
 544                 key = server_write_key;
 545                 iv = server_write_iv;
 546                 }
 547
 548         if (key_data - s->s3->tmp.key_block != s->s3->tmp.key_block_length)
 549                 {
 550                 OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state, ERR_R_INTERNAL_ERROR);
 551                 return 0;
 552                 }
 553
 554         if (aead != NULL)
 555                 {
 556                 if (!tls1_change_cipher_state_aead(s, is_read,
 557                                                    key, key_len, iv, iv_len,
 558                                                    mac_secret, mac_secret_len))
 559                         return 0;
 560                 }
 561         else
 562                 {
 563                 if (!tls1_change_cipher_state_cipher(s, is_read, use_client_keys,
 564                                                      mac_secret, mac_secret_len,
 565                                                      key, key_len,
 566                                                      iv, iv_len))
 567                         return 0;
 568                 }
 569
 570         return 1;
 571         }
 572
 573 int tls1_setup_key_block(SSL *s)
 574         {
 575         unsigned char *p1,*p2=NULL;
 576         const EVP_CIPHER *c = NULL;
 577         const EVP_MD *hash = NULL;
 578         const EVP_AEAD *aead = NULL;
 579         int num;
 580         int mac_type= NID_undef,mac_secret_size=0;
 581         int ret=0;
 582         unsigned key_len, iv_len;
 583
 584 #ifdef KSSL_DEBUG
 585         printf ("tls1_setup_key_block()\n");
 586 #endif  /* KSSL_DEBUG */
 587
 588         if (s->s3->tmp.key_block_length != 0)
 589                 return(1);
 590
 591         if (s->session->cipher &&
 592             ((s->session->cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_AEAD) ||
 593              (s->session->cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_STATEFUL_AEAD)))
 594                 {
 595                 if (!ssl_cipher_get_evp_aead(s->session, &aead))
 596                         goto cipher_unavailable_err;
 597                 key_len = EVP_AEAD_key_length(aead);
 598                 iv_len = SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s->session->cipher);
 599                 if ((s->session->cipher->algorithm2 &
 600                                 SSL_CIPHER_ALGORITHM2_STATEFUL_AEAD) &&
 601                         !ssl_cipher_get_mac(s->session, &hash, &mac_type, &mac_secret_size))
 602                         goto cipher_unavailable_err;
 603                 /* For "stateful" AEADs (i.e. compatibility with pre-AEAD
 604                  * cipher suites) the key length reported by
 605                  * |EVP_AEAD_key_length| will include the MAC key bytes. */
 606                 if (key_len < mac_secret_size)
 607                         {
 608                         OPENSSL_PUT_ERROR(SSL, tls1_change_cipher_state, ERR_R_INTERNAL_ERROR);
 609                         return 0;
 610                         }
 611                 key_len -= mac_secret_size;
 612                 }
 613         else
 614                 {
 615                 if (!ssl_cipher_get_evp(s->session,&c,&hash,&mac_type,&mac_secret_size))
 616                         goto cipher_unavailable_err;
 617                 key_len = EVP_CIPHER_key_length(c);
 618                 iv_len = EVP_CIPHER_iv_length(c);
 619                 }
 620
 621         s->s3->tmp.new_aead=aead;
 622         s->s3->tmp.new_sym_enc=c;
 623         s->s3->tmp.new_hash=hash;
 624         s->s3->tmp.new_mac_pkey_type = mac_type;
 625         s->s3->tmp.new_mac_secret_size = mac_secret_size;
 626
 627         num=key_len+mac_secret_size+iv_len;
 628         num*=2;
 629
 630         ssl3_cleanup_key_block(s);
 631
 632         if ((p1=(unsigned char *)OPENSSL_malloc(num)) == NULL)
 633                 {
 634                 OPENSSL_PUT_ERROR(SSL, tls1_setup_key_block, ERR_R_MALLOC_FAILURE);
 635                 goto err;
 636                 }
 637
 638         s->s3->tmp.key_block_length=num;
 639         s->s3->tmp.key_block=p1;
 640
 641         if ((p2=(unsigned char *)OPENSSL_malloc(num)) == NULL)
 642                 {
 643                 OPENSSL_PUT_ERROR(SSL, tls1_setup_key_block, ERR_R_MALLOC_FAILURE);
 644                 goto err;
 645                 }
 646
 647 #ifdef TLS_DEBUG
 648 printf("client random\n");
 649 { int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->client_random[z],((z+1)%16)?' ':'\n'); }
 650 printf("server random\n");
 651 { int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->server_random[z],((z+1)%16)?' ':'\n'); }
 652 printf("pre-master\n");
 653 { int z; for (z=0; z<s->session->master_key_length; z++) printf("%02X%c",s->session->master_key[z],((z+1)%16)?' ':'\n'); }
 654 #endif
 655         if (!tls1_generate_key_block(s,p1,p2,num))
 656                 goto err;
 657 #ifdef TLS_DEBUG
 658 printf("\nkey block\n");
 659 { int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }
 660 #endif
 661
 662         if (s->method->version <= TLS1_VERSION &&
 663             (s->mode & SSL_MODE_CBC_RECORD_SPLITTING) != 0)
 664                 {
 665                 /* enable vulnerability countermeasure for CBC ciphers with
 666                  * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
 667                  */
 668                 s->s3->need_record_splitting = 1;
 669
 670                 if (s->session->cipher != NULL)
 671                         {
 672                         if (s->session->cipher->algorithm_enc == SSL_RC4)
 673                                 s->s3->need_record_splitting = 0;
 674                         }
 675                 }
 676
 677         ret = 1;
 678 err:
 679         if (p2)
 680                 {
 681                 OPENSSL_cleanse(p2,num);
 682                 OPENSSL_free(p2);
 683                 }
 684         return(ret);
 685
 686 cipher_unavailable_err:
 687         OPENSSL_PUT_ERROR(SSL, tls1_setup_key_block, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
 688         return 0;
 689         }
 690
 691 /* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
 692  *
 693  * Returns:
 694  *   0: (in non-constant time) if the record is publically invalid (i.e. too
 695  *       short etc).
 696  *   1: if the record's padding is valid / the encryption was successful.
 697  *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
 698  *       an internal error occured.
 699  */
 700 int tls1_enc(SSL *s, int send)
 701         {
 702         SSL3_RECORD *rec;
 703         EVP_CIPHER_CTX *ds;
 704         unsigned long l;
 705         int bs,i,j,k,pad=0,ret,mac_size=0;
 706         const EVP_CIPHER *enc;
 707         const SSL_AEAD_CTX *aead;
 708
 709         if (send)
 710                 rec = &s->s3->wrec;
 711         else
 712                 rec = &s->s3->rrec;
 713
 714         if (send)
 715                 aead = s->aead_write_ctx;
 716         else
 717                 aead = s->aead_read_ctx;
 718
 719         if (aead)
 720                 {
 721                 unsigned char ad[13], *seq, *in, *out, nonce[16];
 722                 unsigned nonce_used;
 723                 size_t n;
 724
 725                 seq = send ? s->s3->write_sequence : s->s3->read_sequence;
 726
 727                 if (SSL_IS_DTLS(s))
 728                         {
 729                         unsigned char dtlsseq[9], *p = dtlsseq;
 730
 731                         s2n(send ? s->d1->w_epoch : s->d1->r_epoch, p);
 732                         memcpy(p, &seq[2], 6);
 733                         memcpy(ad, dtlsseq, 8);
 734                         }
 735                 else
 736                         {
 737                         memcpy(ad, seq, 8);
 738                         for (i=7; i>=0; i--)    /* increment */
 739                                 {
 740                                 ++seq[i];
 741                                 if (seq[i] != 0)
 742                                         break;
 743                                 }
 744                         }
 745
 746                 ad[8]  = rec->type;
 747                 ad[9]  = (unsigned char)(s->version>>8);
 748                 ad[10] = (unsigned char)(s->version);
 749
 750                 if (aead->fixed_nonce_len + aead->variable_nonce_len > sizeof(nonce) ||
 751                     aead->variable_nonce_len > 8)
 752                         return -1;  /* internal error - should never happen. */
 753
 754                 memcpy(nonce, aead->fixed_nonce, aead->fixed_nonce_len);
 755                 nonce_used = aead->fixed_nonce_len;
 756
 757                 if (send)
 758                         {
 759                         size_t len = rec->length;
 760                         size_t eivlen = 0;
 761                         in = rec->input;
 762                         out = rec->data;
 763
 764                         /* When sending we use the sequence number as the
 765                          * variable part of the nonce. */
 766                         if (aead->variable_nonce_len > 8)
 767                                 return -1;
 768                         memcpy(nonce + nonce_used, ad, aead->variable_nonce_len);
 769                         nonce_used += aead->variable_nonce_len;
 770
 771                         /* in do_ssl3_write, rec->input is moved forward by
 772                          * variable_nonce_len in order to leave space for the
 773                          * variable nonce. Thus we can copy the sequence number
 774                          * bytes into place without overwriting any of the
 775                          * plaintext. */
 776                         if (aead->variable_nonce_included_in_record)
 777                                 {
 778                                 memcpy(out, ad, aead->variable_nonce_len);
 779                                 len -= aead->variable_nonce_len;
 780                                 eivlen = aead->variable_nonce_len;
 781                                 }
 782
 783                         ad[11] = len >> 8;
 784                         ad[12] = len & 0xff;
 785
 786                         if (!EVP_AEAD_CTX_seal(
 787                                 &aead->ctx,
 788                                 out + eivlen, &n, len + aead->tag_len,
 789                                 nonce, nonce_used,
 790                                 in + eivlen, len,
 791                                 ad, sizeof(ad)))
 792                                 {
 793                                 return -1;
 794                                 }
 795                         if (aead->variable_nonce_included_in_record)
 796                                 n += aead->variable_nonce_len;
 797                         }
 798                 else
 799                         {
 800                         /* receive */
 801                         size_t len = rec->length;
 802
 803                         if (rec->data != rec->input)
 804                                 return -1;  /* internal error - should never happen. */
 805                         out = in = rec->input;
 806
 807                         if (len < aead->variable_nonce_len)
 808                                 return 0;
 809                         memcpy(nonce + nonce_used,
 810                                aead->variable_nonce_included_in_record ? in : ad,
 811                                aead->variable_nonce_len);
 812                         nonce_used += aead->variable_nonce_len;
 813
 814                         if (aead->variable_nonce_included_in_record)
 815                                 {
 816                                 in += aead->variable_nonce_len;
 817                                 len -= aead->variable_nonce_len;
 818                                 out += aead->variable_nonce_len;
 819                                 }
 820
 821                         if (len < aead->tag_len)
 822                                 return 0;
 823                         len -= aead->tag_len;
 824
 825                         ad[11] = len >> 8;
 826                         ad[12] = len & 0xff;
 827
 828                         if (!EVP_AEAD_CTX_open(
 829                                 &aead->ctx,
 830                                 out, &n, len,
 831                                 nonce, nonce_used,
 832                                 in, len + aead->tag_len,
 833                                 ad, sizeof(ad)))
 834                                 {
 835                                 return -1;
 836                                 }
 837
 838                         rec->data = rec->input = out;
 839                         }
 840
 841                 rec->length = n;
 842                 return 1;
 843                 }
 844
 845         if (send)
 846                 {
 847                 ds=s->enc_write_ctx;
 848                 rec= &(s->s3->wrec);
 849                 if (s->enc_write_ctx == NULL)
 850                         enc=NULL;
 851                 else
 852                         {
 853                         int ivlen;
 854                         enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
 855                         /* For TLSv1.1 and later explicit IV */
 856                         if (SSL_USE_EXPLICIT_IV(s)
 857                                 && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)
 858                                 ivlen = EVP_CIPHER_iv_length(enc);
 859                         else
 860                                 ivlen = 0;
 861                         if (ivlen > 1)
 862                                 {
 863                                 if ( rec->data != rec->input)
 864                                         /* we can't write into the input stream:
 865                                          * Can this ever happen?? (steve)
 866                                          */
 867                                         fprintf(stderr,
 868                                                 "%s:%d: rec->data != rec->input\n",
 869                                                 __FILE__, __LINE__);
 870                                 else if (RAND_bytes(rec->input, ivlen) <= 0)
 871                                         return -1;
 872                                 }
 873                         }
 874                 }
 875         else
 876                 {
 877                 ds=s->enc_read_ctx;
 878                 rec= &(s->s3->rrec);
 879                 if (s->enc_read_ctx == NULL)
 880                         enc=NULL;
 881                 else
 882                         enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
 883                 }
 884
 885 #ifdef KSSL_DEBUG
 886         printf("tls1_enc(%d)\n", send);
 887 #endif    /* KSSL_DEBUG */
 888
 889         if ((s->session == NULL) || (ds == NULL) || (enc == NULL))
 890                 {
 891                 memmove(rec->data,rec->input,rec->length);
 892                 rec->input=rec->data;
 893                 ret = 1;
 894                 }
 895         else
 896                 {
 897                 l=rec->length;
 898                 bs=EVP_CIPHER_block_size(ds->cipher);
 899
 900                 if ((bs != 1) && send)
 901                         {
 902                         i=bs-((int)l%bs);
 903
 904                         /* Add weird padding of upto 256 bytes */
 905
 906                         /* we need to add 'i' padding bytes of value j */
 907                         j=i-1;
 908                         for (k=(int)l; k<(int)(l+i); k++)
 909                                 rec->input[k]=j;
 910                         l+=i;
 911                         rec->length+=i;
 912                         }
 913
 914 #ifdef KSSL_DEBUG
 915                 {
 916                 unsigned long ui;
 917                 printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
 918                         ds,rec->data,rec->input,l);
 919                 printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
 920                         ds->buf_len, ds->cipher->key_len,
 921                         DES_KEY_SZ, DES_SCHEDULE_SZ,
 922                         ds->cipher->iv_len);
 923                 printf("\t\tIV: ");
 924                 for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
 925                 printf("\n");
 926                 printf("\trec->input=");
 927                 for (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]);
 928                 printf("\n");
 929                 }
 930 #endif  /* KSSL_DEBUG */
 931
 932                 if (!send)
 933                         {
 934                         if (l == 0 || l%bs != 0)
 935                                 return 0;
 936                         }
 937
 938                 i = EVP_Cipher(ds,rec->data,rec->input,l);
 939                 if ((EVP_CIPHER_flags(ds->cipher)&EVP_CIPH_FLAG_CUSTOM_CIPHER)
 940                                                 ?(i<0)
 941                                                 :(i==0))
 942                         return -1;      /* AEAD can fail to verify MAC */
 943
 944 #ifdef KSSL_DEBUG
 945                 {
 946                 unsigned long i;
 947                 printf("\trec->data=");
 948                 for (i=0; i<l; i++)
 949                         printf(" %02x", rec->data[i]);  printf("\n");
 950                 }
 951 #endif  /* KSSL_DEBUG */
 952
 953                 ret = 1;
 954                 if (EVP_MD_CTX_md(s->read_hash) != NULL)
 955                         mac_size = EVP_MD_CTX_size(s->read_hash);
 956                 if ((bs != 1) && !send)
 957                         ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
 958                 if (pad && !send)
 959                         rec->length -= pad;
 960                 }
 961         return ret;
 962         }
 963
 964 int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
 965         {
 966         unsigned int ret;
 967         EVP_MD_CTX ctx, *d=NULL;
 968         int i;
 969
 970         if (s->s3->handshake_buffer)
 971                 if (!ssl3_digest_cached_records(s))
 972                         return 0;
 973
 974         for (i=0;i<SSL_MAX_DIGEST;i++)
 975                 {
 976                   if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i])==md_nid)
 977                         {
 978                         d=s->s3->handshake_dgst[i];
 979                         break;
 980                         }
 981                 }
 982         if (!d) {
 983                 OPENSSL_PUT_ERROR(SSL, tls1_cert_verify_mac, SSL_R_NO_REQUIRED_DIGEST);
 984                 return 0;
 985         }
 986
 987         EVP_MD_CTX_init(&ctx);
 988         EVP_MD_CTX_copy_ex(&ctx,d);
 989         EVP_DigestFinal_ex(&ctx,out,&ret);
 990         EVP_MD_CTX_cleanup(&ctx);
 991         return((int)ret);
 992         }
 993
 994 /* tls1_handshake_digest calculates the current handshake hash and writes it to
 995  * |out|, which has space for |out_len| bytes. It returns the number of bytes
 996  * written or -1 in the event of an error. This function works on a copy of the
 997  * underlying digests so can be called multiple times and prior to the final
 998  * update etc. */
 999 int tls1_handshake_digest(SSL *s, unsigned char *out, size_t out_len)
1000         {
1001         const EVP_MD *md;
1002         EVP_MD_CTX ctx;
1003         int i, err = 0, len = 0;
1004         long mask;
1005
1006         EVP_MD_CTX_init(&ctx);
1007
1008         for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++)
1009                 {
1010                 int hash_size;
1011                 unsigned int digest_len;
1012                 EVP_MD_CTX *hdgst = s->s3->handshake_dgst[i];
1013
1014                 if ((mask & ssl_get_algorithm2(s)) == 0)
1015                         continue;
1016
1017                 hash_size = EVP_MD_size(md);
1018                 if (!hdgst || hash_size < 0 || (size_t)hash_size > out_len)
1019                         {
1020                         err = 1;
1021                         break;
1022                         }
1023
1024                 if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) ||
1025                     !EVP_DigestFinal_ex(&ctx, out, &digest_len) ||
1026                     digest_len != (unsigned int)hash_size) /* internal error */
1027                         {
1028                         err = 1;
1029                         break;
1030                         }
1031                 out += digest_len;
1032                 out_len -= digest_len;
1033                 len += digest_len;
1034                 }
1035
1036         EVP_MD_CTX_cleanup(&ctx);
1037
1038         if (err != 0)
1039                 return -1;
1040         return len;
1041         }
1042
1043 int tls1_final_finish_mac(SSL *s,
1044              const char *str, int slen, unsigned char *out)
1045         {
1046         unsigned char buf[2*EVP_MAX_MD_SIZE];
1047         unsigned char buf2[12];
1048         int err=0;
1049         int digests_len;
1050
1051         if (s->s3->handshake_buffer)
1052                 if (!ssl3_digest_cached_records(s))
1053                         return 0;
1054
1055         digests_len = tls1_handshake_digest(s, buf, sizeof(buf));
1056         if (digests_len < 0)
1057                 {
1058                 err = 1;
1059                 digests_len = 0;
1060                 }
1061
1062         if (!tls1_PRF(ssl_get_algorithm2(s),
1063                         str,slen, buf, digests_len, NULL,0, NULL,0, NULL,0,
1064                         s->session->master_key,s->session->master_key_length,
1065                         out,buf2,sizeof buf2))
1066                 err = 1;
1067
1068         if (err)
1069                 return 0;
1070         else
1071                 return sizeof buf2;
1072         }
1073
1074 int tls1_mac(SSL *ssl, unsigned char *md, int send)
1075         {
1076         SSL3_RECORD *rec;
1077         unsigned char *seq;
1078         EVP_MD_CTX *hash;
1079         size_t md_size, orig_len;
1080         int i;
1081         EVP_MD_CTX hmac, *mac_ctx;
1082         unsigned char header[13];
1083         int t;
1084
1085         if (send)
1086                 {
1087                 rec= &(ssl->s3->wrec);
1088                 seq= &(ssl->s3->write_sequence[0]);
1089                 hash=ssl->write_hash;
1090                 }
1091         else
1092                 {
1093                 rec= &(ssl->s3->rrec);
1094                 seq= &(ssl->s3->read_sequence[0]);
1095                 hash=ssl->read_hash;
1096                 }
1097
1098         t=EVP_MD_CTX_size(hash);
1099         assert(t >= 0);
1100         md_size=t;
1101
1102         if (!EVP_MD_CTX_copy(&hmac,hash))
1103                 return -1;
1104         mac_ctx = &hmac;
1105
1106         if (SSL_IS_DTLS(ssl))
1107                 {
1108                 unsigned char dtlsseq[8],*p=dtlsseq;
1109
1110                 s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
1111                 memcpy (p,&seq[2],6);
1112
1113                 memcpy(header, dtlsseq, 8);
1114                 }
1115         else
1116                 memcpy(header, seq, 8);
1117
1118         /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
1119         orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
1120         rec->type &= 0xff;
1121
1122         header[8]=rec->type;
1123         header[9]=(unsigned char)(ssl->version>>8);
1124         header[10]=(unsigned char)(ssl->version);
1125         header[11]=(rec->length)>>8;
1126         header[12]=(rec->length)&0xff;
1127
1128         if (!send &&
1129             EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1130             ssl3_cbc_record_digest_supported(mac_ctx))
1131                 {
1132                 /* This is a CBC-encrypted record. We must avoid leaking any
1133                  * timing-side channel information about how many blocks of
1134                  * data we are hashing because that gives an attacker a
1135                  * timing-oracle. */
1136                 ssl3_cbc_digest_record(
1137                         mac_ctx,
1138                         md, &md_size,
1139                         header, rec->input,
1140                         rec->length + md_size, orig_len,
1141                         ssl->s3->read_mac_secret,
1142                         ssl->s3->read_mac_secret_size,
1143                         0 /* not SSLv3 */);
1144                 }
1145         else
1146                 {
1147                 EVP_DigestSignUpdate(mac_ctx,header,sizeof(header));
1148                 EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
1149                 t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
1150                 assert(t > 0);
1151                 }
1152
1153         EVP_MD_CTX_cleanup(&hmac);
1154
1155         if (!SSL_IS_DTLS(ssl))
1156                 {
1157                 for (i=7; i>=0; i--)
1158                         {
1159                         ++seq[i];
1160                         if (seq[i] != 0) break;
1161                         }
1162                 }
1163
1164         return(md_size);
1165         }
1166
1167 int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
1168              int len)
1169         {
1170         unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH];
1171         const void *co = NULL, *so = NULL;
1172         int col = 0, sol = 0;
1173
1174
1175 #ifdef KSSL_DEBUG
1176         printf ("tls1_generate_master_secret(%p,%p, %p, %d)\n", s,out, p,len);
1177 #endif  /* KSSL_DEBUG */
1178
1179         tls1_PRF(ssl_get_algorithm2(s),
1180                 TLS_MD_MASTER_SECRET_CONST,TLS_MD_MASTER_SECRET_CONST_SIZE,
1181                 s->s3->client_random,SSL3_RANDOM_SIZE,
1182                 co, col,
1183                 s->s3->server_random,SSL3_RANDOM_SIZE,
1184                 so, sol,
1185                 p,len,
1186                 s->session->master_key,buff,sizeof buff);
1187 #ifdef SSL_DEBUG
1188         fprintf(stderr, "Premaster Secret:\n");
1189         BIO_dump_fp(stderr, (char *)p, len);
1190         fprintf(stderr, "Client Random:\n");
1191         BIO_dump_fp(stderr, (char *)s->s3->client_random, SSL3_RANDOM_SIZE);
1192         fprintf(stderr, "Server Random:\n");
1193         BIO_dump_fp(stderr, (char *)s->s3->server_random, SSL3_RANDOM_SIZE);
1194         fprintf(stderr, "Master Secret:\n");
1195         BIO_dump_fp(stderr, (char *)s->session->master_key, SSL3_MASTER_SECRET_SIZE);
1196 #endif
1197
1198 #ifdef OPENSSL_SSL_TRACE_CRYPTO
1199         if (s->msg_callback)
1200                 {
1201                 s->msg_callback(2, s->version, TLS1_RT_CRYPTO_PREMASTER,
1202                                                 p, len, s, s->msg_callback_arg);
1203                 s->msg_callback(2, s->version, TLS1_RT_CRYPTO_CLIENT_RANDOM,
1204                                         s->s3->client_random, SSL3_RANDOM_SIZE,
1205                                                 s, s->msg_callback_arg);
1206                 s->msg_callback(2, s->version, TLS1_RT_CRYPTO_SERVER_RANDOM,
1207                                         s->s3->server_random, SSL3_RANDOM_SIZE,
1208                                         s, s->msg_callback_arg);
1209                 s->msg_callback(2, s->version, TLS1_RT_CRYPTO_MASTER,
1210                                         s->session->master_key,
1211                                         SSL3_MASTER_SECRET_SIZE,
1212                                         s, s->msg_callback_arg);
1213                 }
1214 #endif
1215
1216 #ifdef KSSL_DEBUG
1217         printf ("tls1_generate_master_secret() complete\n");
1218 #endif  /* KSSL_DEBUG */
1219         return(SSL3_MASTER_SECRET_SIZE);
1220         }
1221
1222 int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1223          const char *label, size_t llen, const unsigned char *context,
1224          size_t contextlen, int use_context)
1225         {
1226         unsigned char *buff;
1227         unsigned char *val = NULL;
1228         size_t vallen, currentvalpos;
1229         int rv;
1230
1231 #ifdef KSSL_DEBUG
1232         printf ("tls1_export_keying_material(%p,%p,%d,%s,%d,%p,%d)\n", s, out, olen, label, llen, p, plen);
1233 #endif  /* KSSL_DEBUG */
1234
1235         buff = OPENSSL_malloc(olen);
1236         if (buff == NULL) goto err2;
1237
1238         /* construct PRF arguments
1239          * we construct the PRF argument ourself rather than passing separate
1240          * values into the TLS PRF to ensure that the concatenation of values
1241          * does not create a prohibited label.
1242          */
1243         vallen = llen + SSL3_RANDOM_SIZE * 2;
1244         if (use_context)
1245                 {
1246                 vallen += 2 + contextlen;
1247                 }
1248
1249         val = OPENSSL_malloc(vallen);
1250         if (val == NULL) goto err2;
1251         currentvalpos = 0;
1252         memcpy(val + currentvalpos, (unsigned char *) label, llen);
1253         currentvalpos += llen;
1254         memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
1255         currentvalpos += SSL3_RANDOM_SIZE;
1256         memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
1257         currentvalpos += SSL3_RANDOM_SIZE;
1258
1259         if (use_context)
1260                 {
1261                 val[currentvalpos] = (contextlen >> 8) & 0xff;
1262                 currentvalpos++;
1263                 val[currentvalpos] = contextlen & 0xff;
1264                 currentvalpos++;
1265                 if ((contextlen > 0) || (context != NULL))
1266                         {
1267                         memcpy(val + currentvalpos, context, contextlen);
1268                         }
1269                 }
1270
1271         /* disallow prohibited labels
1272          * note that SSL3_RANDOM_SIZE > max(prohibited label len) =
1273          * 15, so size of val > max(prohibited label len) = 15 and the
1274          * comparisons won't have buffer overflow
1275          */
1276         if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST,
1277                  TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) goto err1;
1278         if (memcmp(val, TLS_MD_SERVER_FINISH_CONST,
1279                  TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) goto err1;
1280         if (memcmp(val, TLS_MD_MASTER_SECRET_CONST,
1281                  TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) goto err1;
1282         if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST,
1283                  TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) goto err1;
1284
1285         rv = tls1_PRF(ssl_get_algorithm2(s),
1286                       val, vallen,
1287                       NULL, 0,
1288                       NULL, 0,
1289                       NULL, 0,
1290                       NULL, 0,
1291                       s->session->master_key,s->session->master_key_length,
1292                       out,buff,olen);
1293
1294 #ifdef KSSL_DEBUG
1295         printf ("tls1_export_keying_material() complete\n");
1296 #endif  /* KSSL_DEBUG */
1297         goto ret;
1298 err1:
1299         OPENSSL_PUT_ERROR(SSL, tls1_export_keying_material, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL);
1300         rv = 0;
1301         goto ret;
1302 err2:
1303         OPENSSL_PUT_ERROR(SSL, tls1_export_keying_material, ERR_R_MALLOC_FAILURE);
1304         rv = 0;
1305 ret:
1306         if (buff != NULL) OPENSSL_free(buff);
1307         if (val != NULL) OPENSSL_free(val);
1308         return(rv);
1309         }
1310
1311 int tls1_alert_code(int code)
1312         {
1313         switch (code)
1314                 {
1315         case SSL_AD_CLOSE_NOTIFY:       return(SSL3_AD_CLOSE_NOTIFY);
1316         case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE);
1317         case SSL_AD_BAD_RECORD_MAC:     return(SSL3_AD_BAD_RECORD_MAC);
1318         case SSL_AD_DECRYPTION_FAILED:  return(TLS1_AD_DECRYPTION_FAILED);
1319         case SSL_AD_RECORD_OVERFLOW:    return(TLS1_AD_RECORD_OVERFLOW);
1320         case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE);
1321         case SSL_AD_HANDSHAKE_FAILURE:  return(SSL3_AD_HANDSHAKE_FAILURE);
1322         case SSL_AD_NO_CERTIFICATE:     return(-1);
1323         case SSL_AD_BAD_CERTIFICATE:    return(SSL3_AD_BAD_CERTIFICATE);
1324         case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE);
1325         case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED);
1326         case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED);
1327         case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN);
1328         case SSL_AD_ILLEGAL_PARAMETER:  return(SSL3_AD_ILLEGAL_PARAMETER);
1329         case SSL_AD_UNKNOWN_CA:         return(TLS1_AD_UNKNOWN_CA);
1330         case SSL_AD_ACCESS_DENIED:      return(TLS1_AD_ACCESS_DENIED);
1331         case SSL_AD_DECODE_ERROR:       return(TLS1_AD_DECODE_ERROR);
1332         case SSL_AD_DECRYPT_ERROR:      return(TLS1_AD_DECRYPT_ERROR);
1333         case SSL_AD_EXPORT_RESTRICTION: return(TLS1_AD_EXPORT_RESTRICTION);
1334         case SSL_AD_PROTOCOL_VERSION:   return(TLS1_AD_PROTOCOL_VERSION);
1335         case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY);
1336         case SSL_AD_INTERNAL_ERROR:     return(TLS1_AD_INTERNAL_ERROR);
1337         case SSL_AD_USER_CANCELLED:     return(TLS1_AD_USER_CANCELLED);
1338         case SSL_AD_NO_RENEGOTIATION:   return(TLS1_AD_NO_RENEGOTIATION);
1339         case SSL_AD_UNSUPPORTED_EXTENSION: return(TLS1_AD_UNSUPPORTED_EXTENSION);
1340         case SSL_AD_CERTIFICATE_UNOBTAINABLE: return(TLS1_AD_CERTIFICATE_UNOBTAINABLE);
1341         case SSL_AD_UNRECOGNIZED_NAME:  return(TLS1_AD_UNRECOGNIZED_NAME);
1342         case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
1343         case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
1344         case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
1345         case SSL_AD_INAPPROPRIATE_FALLBACK:return(SSL3_AD_INAPPROPRIATE_FALLBACK);
1346 #if 0 /* not appropriate for TLS, not used for DTLS */
1347         case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return
1348                                           (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
1349 #endif
1350         default:                        return(-1);
1351                 }
1352         }