Commit 1b6ab411 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Use enc_flags when deciding protocol variations. 

Use the enc_flags field to determine whether we should use explicit IV,
signature algorithms or SHA256 default PRF instead of hard coding which
versions support each requirement.
(cherry picked from commit cbd64894)

Conflicts:

	ssl/ssl_locl.h
parent d88d98ed

ssl/s3_cbc.c

+1 −1
Original line number Diff line number Diff line
@@ -148,7 +148,7 @@ int tls1_cbc_remove_padding(const SSL* s, 
	unsigned padding_length, good, to_check, i;

	const unsigned overhead = 1 /* padding length byte */ + mac_size;

	/* Check if version requires explicit IV */

	if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)

	if (SSL_USE_EXPLICIT_IV(s))

		{

		/* These lengths are all public so we can test them in

		 * non-constant time.

ssl/s3_clnt.c

+8 −8
Original line number Diff line number Diff line
@@ -1030,10 +1030,10 @@ int ssl3_get_server_hello(SSL *s) 
			}

		}

	s->s3->tmp.new_cipher=c;

	/* Don't digest cached records if TLS v1.2: we may need them for

	/* Don't digest cached records if no sigalgs: we may need them for

	 * client authentication.

	 */

	if (TLS1_get_version(s) < TLS1_2_VERSION && !ssl3_digest_cached_records(s))

	if (!SSL_USE_SIGALGS(s) && !ssl3_digest_cached_records(s))

		goto f_err;

	/* lets get the compression algorithm */

	/* COMPRESSION */
@@ -1785,7 +1785,7 @@ int ssl3_get_key_exchange(SSL *s) 
	/* if it was signed, check the signature */

	if (pkey != NULL)

		{

		if (TLS1_get_version(s) >= TLS1_2_VERSION)

		if (SSL_USE_SIGALGS(s))

			{

			int rv = tls12_check_peer_sigalg(&md, s, p, pkey);

			if (rv == -1)
@@ -1817,7 +1817,7 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md)); 
			}



#ifndef OPENSSL_NO_RSA

		if (pkey->type == EVP_PKEY_RSA && TLS1_get_version(s) < TLS1_2_VERSION)

		if (pkey->type == EVP_PKEY_RSA && !SSL_USE_SIGALGS(s))

			{

			int num;
@@ -1991,7 +1991,7 @@ int ssl3_get_certificate_request(SSL *s) 
	for (i=0; i<ctype_num; i++)

		s->s3->tmp.ctype[i]= p[i];

	p+=p[-1];

	if (TLS1_get_version(s) >= TLS1_2_VERSION)

	if (SSL_USE_SIGALGS(s))

		{

		n2s(p, llen);

		/* Check we have enough room for signature algorithms and
@@ -3051,7 +3051,7 @@ int ssl3_send_client_verify(SSL *s) 
		EVP_PKEY_sign_init(pctx);

		if (EVP_PKEY_CTX_set_signature_md(pctx, EVP_sha1())>0)

			{

			if (TLS1_get_version(s) < TLS1_2_VERSION)

			if (!SSL_USE_SIGALGS(s))

				s->method->ssl3_enc->cert_verify_mac(s,

						NID_sha1,

						&(data[MD5_DIGEST_LENGTH]));
@@ -3063,7 +3063,7 @@ int ssl3_send_client_verify(SSL *s) 
		/* For TLS v1.2 send signature algorithm and signature

		 * using agreed digest and cached handshake records.

		 */

		if (TLS1_get_version(s) >= TLS1_2_VERSION)

		if (SSL_USE_SIGALGS(s))

			{

			long hdatalen = 0;

			void *hdata;
@@ -3193,7 +3193,7 @@ static int ssl3_check_client_certificate(SSL *s) 
	if (!s->cert || !s->cert->key->x509 || !s->cert->key->privatekey)

		return 0;

	/* If no suitable signature algorithm can't use certificate */

	if (TLS1_get_version(s) >= TLS1_2_VERSION && !s->cert->key->digest)

	if (SSL_USE_SIGALGS(s) && !s->cert->key->digest)

		return 0;

	/* If strict mode check suitability of chain before using it.

	 * This also adjusts suite B digest if necessary.

ssl/s3_lib.c

+4 −4
Original line number Diff line number Diff line
@@ -4474,14 +4474,14 @@ need to go to SSL_ST_ACCEPT. 
		}

	return(ret);

	}

/* If we are using TLS v1.2 or later and default SHA1+MD5 algorithms switch

 * to new SHA256 PRF and handshake macs

/* If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF

 * and handshake macs if required.

 */

long ssl_get_algorithm2(SSL *s)

	{

	long alg2 = s->s3->tmp.new_cipher->algorithm2;

	if (TLS1_get_version(s) >= TLS1_2_VERSION &&

	    alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))

	if (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF

	    && alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))

		return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;

	return alg2;

	}

ssl/s3_pkt.c

+6 −6
Original line number Diff line number Diff line
@@ -180,7 +180,7 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) 
	/* For DTLS/UDP reads should not span multiple packets

	 * because the read operation returns the whole packet

	 * at once (as long as it fits into the buffer). */

	if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)

	if (SSL_IS_DTLS(s))

		{

		if (left > 0 && n > left)

			n = left;
@@ -248,7 +248,7 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) 
			{

			rb->left = left;

			if (s->mode & SSL_MODE_RELEASE_BUFFERS &&

			    SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)

				!SSL_IS_DTLS(s))

				if (len+left == 0)

					ssl3_release_read_buffer(s);

			return(i);
@@ -257,7 +257,7 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) 
		/* reads should *never* span multiple packets for DTLS because

		 * the underlying transport protocol is message oriented as opposed

		 * to byte oriented as in the TLS case. */

		if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)

		if (SSL_IS_DTLS(s))

			{

			if (n > left)

				n = left; /* makes the while condition false */
@@ -759,8 +759,8 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf, 
	/* field where we are to write out packet length */

	plen=p; 

	p+=2;

	/* Explicit IV length, block ciphers and TLS version 1.1 or later */

	if (s->enc_write_ctx && s->version >= TLS1_1_VERSION)

	/* Explicit IV length, block ciphers appropriate version flag */

	if (s->enc_write_ctx && SSL_USE_EXPLICIT_IV(s))

		{

		int mode = EVP_CIPHER_CTX_mode(s->enc_write_ctx);

		if (mode == EVP_CIPH_CBC_MODE)
@@ -897,7 +897,7 @@ int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, 
			wb->left=0;

			wb->offset+=i;

			if (s->mode & SSL_MODE_RELEASE_BUFFERS &&

			    SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)

				!SSL_IS_DTLS(s))

				ssl3_release_write_buffer(s);

			s->rwstate=SSL_NOTHING;

			return(s->s3->wpend_ret);

ssl/s3_srvr.c

+11 −13
Original line number Diff line number Diff line
@@ -641,13 +641,13 @@ int ssl3_accept(SSL *s) 
#endif

				s->init_num = 0;

				}

			else if (TLS1_get_version(s) >= TLS1_2_VERSION)

			else if (SSL_USE_SIGALGS(s))

				{

				s->state=SSL3_ST_SR_CERT_VRFY_A;

				s->init_num=0;

				if (!s->session->peer)

					break;

				/* For TLS v1.2 freeze the handshake buffer

				/* For sigalgs freeze the handshake buffer

				 * at this point and digest cached records.

				 */

				if (!s->s3->handshake_buffer)
@@ -1038,7 +1038,7 @@ int ssl3_get_client_hello(SSL *s) 


	p+=j;



	if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)

	if (SSL_IS_DTLS(s))

		{

		/* cookie stuff */

		cookie_len = *(p++);
@@ -1403,7 +1403,7 @@ int ssl3_get_client_hello(SSL *s) 
		s->s3->tmp.new_cipher=s->session->cipher;

		}



	if (TLS1_get_version(s) < TLS1_2_VERSION || !(s->verify_mode & SSL_VERIFY_PEER))

	if (!SSL_USE_SIGALGS(s) || !(s->verify_mode & SSL_VERIFY_PEER))

		{

		if (!ssl3_digest_cached_records(s))

			goto f_err;
@@ -1934,8 +1934,7 @@ int ssl3_send_server_key_exchange(SSL *s) 
			/* n is the length of the params, they start at &(d[4])

			 * and p points to the space at the end. */

#ifndef OPENSSL_NO_RSA

			if (pkey->type == EVP_PKEY_RSA

					&& TLS1_get_version(s) < TLS1_2_VERSION)

			if (pkey->type == EVP_PKEY_RSA && !SSL_USE_SIGALGS(s))

				{

				q=md_buf;

				j=0;
@@ -1966,9 +1965,8 @@ int ssl3_send_server_key_exchange(SSL *s) 
#endif

			if (md)

				{

				/* For TLS1.2 and later send signature

				 * algorithm */

				if (TLS1_get_version(s) >= TLS1_2_VERSION)

				/* send signature algorithm */

				if (SSL_USE_SIGALGS(s))

					{

					if (!tls12_get_sigandhash(p, pkey, md))

						{
@@ -1995,7 +1993,7 @@ int ssl3_send_server_key_exchange(SSL *s) 
					}

				s2n(i,p);

				n+=i+2;

				if (TLS1_get_version(s) >= TLS1_2_VERSION)

				if (SSL_USE_SIGALGS(s))

					n+= 2;

				}

			else
@@ -2045,7 +2043,7 @@ int ssl3_send_certificate_request(SSL *s) 
		p+=n;

		n++;



		if (TLS1_get_version(s) >= TLS1_2_VERSION)

		if (SSL_USE_SIGALGS(s))

			{

			const unsigned char *psigs;

			nl = tls12_get_psigalgs(s, &psigs);
@@ -3017,7 +3015,7 @@ int ssl3_get_cert_verify(SSL *s) 
		} 

	else 

		{	

		if (TLS1_get_version(s) >= TLS1_2_VERSION)

		if (SSL_USE_SIGALGS(s))

			{

			int rv = tls12_check_peer_sigalg(&md, s, p, pkey);

			if (rv == -1)
@@ -3053,7 +3051,7 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md)); 
		goto f_err;

		}



	if (TLS1_get_version(s) >= TLS1_2_VERSION)

	if (SSL_USE_SIGALGS(s))

		{

		long hdatalen = 0;

		void *hdata;