diff options
Diffstat (limited to 'security/nss/lib/ssl')
44 files changed, 0 insertions, 30827 deletions
diff --git a/security/nss/lib/ssl/Makefile b/security/nss/lib/ssl/Makefile deleted file mode 100644 index a777569c2..000000000 --- a/security/nss/lib/ssl/Makefile +++ /dev/null @@ -1,93 +0,0 @@ -#! gmake -# -# ***** BEGIN LICENSE BLOCK ***** -# Version: MPL 1.1/GPL 2.0/LGPL 2.1 -# -# The contents of this file are subject to the Mozilla Public License Version -# 1.1 (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# http://www.mozilla.org/MPL/ -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License -# for the specific language governing rights and limitations under the -# License. -# -# The Original Code is the Netscape security libraries. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1994-2000 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# -# Alternatively, the contents of this file may be used under the terms of -# either the GNU General Public License Version 2 or later (the "GPL"), or -# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), -# in which case the provisions of the GPL or the LGPL are applicable instead -# of those above. If you wish to allow use of your version of this file only -# under the terms of either the GPL or the LGPL, and not to allow others to -# use your version of this file under the terms of the MPL, indicate your -# decision by deleting the provisions above and replace them with the notice -# and other provisions required by the GPL or the LGPL. If you do not delete -# the provisions above, a recipient may use your version of this file under -# the terms of any one of the MPL, the GPL or the LGPL. -# -# ***** END LICENSE BLOCK ***** - -####################################################################### -# (1) Include initial platform-independent assignments (MANDATORY). # -####################################################################### - -include manifest.mn - -####################################################################### -# (2) Include "global" configuration information. (OPTIONAL) # -####################################################################### - -include $(CORE_DEPTH)/coreconf/config.mk - -####################################################################### -# (3) Include "component" configuration information. (OPTIONAL) # -####################################################################### - - - -####################################################################### -# (4) Include "local" platform-dependent assignments (OPTIONAL). # -####################################################################### - -include config.mk - -ifeq (,$(filter-out WIN%,$(OS_TARGET))) -CSRCS += win32err.c -DEFINES += -DIN_LIBSSL -else -ifeq ($(OS_TARGET),OS2) -CSRCS += os2_err.c -else -CSRCS += unix_err.c -endif -endif - -####################################################################### -# (5) Execute "global" rules. (OPTIONAL) # -####################################################################### - -include $(CORE_DEPTH)/coreconf/rules.mk - -####################################################################### -# (6) Execute "component" rules. (OPTIONAL) # -####################################################################### - - - -####################################################################### -# (7) Execute "local" rules. (OPTIONAL). # -####################################################################### - -export:: private_export - -# indicates dependency on freebl static lib -$(SHARED_LIBRARY): $(CRYPTOLIB) diff --git a/security/nss/lib/ssl/authcert.c b/security/nss/lib/ssl/authcert.c deleted file mode 100644 index 0e02c15fa..000000000 --- a/security/nss/lib/ssl/authcert.c +++ /dev/null @@ -1,122 +0,0 @@ -/* - * NSS utility functions - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include <stdio.h> -#include <string.h> -#include "prerror.h" -#include "secitem.h" -#include "prnetdb.h" -#include "cert.h" -#include "nspr.h" -#include "secder.h" -#include "key.h" -#include "nss.h" -#include "ssl.h" -#include "pk11func.h" /* for PK11_ function calls */ - -/* - * This callback used by SSL to pull client sertificate upon - * server request - */ -SECStatus -NSS_GetClientAuthData(void * arg, - PRFileDesc * socket, - struct CERTDistNamesStr * caNames, - struct CERTCertificateStr ** pRetCert, - struct SECKEYPrivateKeyStr **pRetKey) -{ - CERTCertificate * cert = NULL; - SECKEYPrivateKey * privkey = NULL; - char * chosenNickName = (char *)arg; /* CONST */ - void * proto_win = NULL; - SECStatus rv = SECFailure; - - proto_win = SSL_RevealPinArg(socket); - - if (chosenNickName) { - cert = CERT_FindUserCertByUsage(CERT_GetDefaultCertDB(), - chosenNickName, certUsageSSLClient, - PR_FALSE, proto_win); - if ( cert ) { - privkey = PK11_FindKeyByAnyCert(cert, proto_win); - if ( privkey ) { - rv = SECSuccess; - } else { - CERT_DestroyCertificate(cert); - } - } - } else { /* no name given, automatically find the right cert. */ - CERTCertNicknames * names; - int i; - - names = CERT_GetCertNicknames(CERT_GetDefaultCertDB(), - SEC_CERT_NICKNAMES_USER, proto_win); - if (names != NULL) { - for (i = 0; i < names->numnicknames; i++) { - cert = CERT_FindUserCertByUsage(CERT_GetDefaultCertDB(), - names->nicknames[i], certUsageSSLClient, - PR_FALSE, proto_win); - if ( !cert ) - continue; - /* Only check unexpired certs */ - if (CERT_CheckCertValidTimes(cert, PR_Now(), PR_TRUE) != - secCertTimeValid ) { - CERT_DestroyCertificate(cert); - continue; - } - rv = NSS_CmpCertChainWCANames(cert, caNames); - if ( rv == SECSuccess ) { - privkey = PK11_FindKeyByAnyCert(cert, proto_win); - if ( privkey ) - break; - } - rv = SECFailure; - CERT_DestroyCertificate(cert); - } - CERT_FreeNicknames(names); - } - } - if (rv == SECSuccess) { - *pRetCert = cert; - *pRetKey = privkey; - } - return rv; -} - diff --git a/security/nss/lib/ssl/cmpcert.c b/security/nss/lib/ssl/cmpcert.c deleted file mode 100644 index 493766237..000000000 --- a/security/nss/lib/ssl/cmpcert.c +++ /dev/null @@ -1,123 +0,0 @@ -/* - * NSS utility functions - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include <stdio.h> -#include <string.h> -#include "prerror.h" -#include "secitem.h" -#include "prnetdb.h" -#include "cert.h" -#include "nspr.h" -#include "secder.h" -#include "key.h" -#include "nss.h" - -/* - * Look to see if any of the signers in the cert chain for "cert" are found - * in the list of caNames. - * Returns SECSuccess if so, SECFailure if not. - */ -SECStatus -NSS_CmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) -{ - SECItem * caname; - CERTCertificate * curcert; - CERTCertificate * oldcert; - PRInt32 contentlen; - int j; - int headerlen; - int depth; - SECStatus rv; - SECItem issuerName; - SECItem compatIssuerName; - - if (!cert || !caNames || !caNames->nnames || !caNames->names || - !caNames->names->data) - return SECFailure; - depth=0; - curcert = CERT_DupCertificate(cert); - - while( curcert ) { - issuerName = curcert->derIssuer; - - /* compute an alternate issuer name for compatibility with 2.0 - * enterprise server, which send the CA names without - * the outer layer of DER header - */ - rv = DER_Lengths(&issuerName, &headerlen, (PRUint32 *)&contentlen); - if ( rv == SECSuccess ) { - compatIssuerName.data = &issuerName.data[headerlen]; - compatIssuerName.len = issuerName.len - headerlen; - } else { - compatIssuerName.data = NULL; - compatIssuerName.len = 0; - } - - for (j = 0; j < caNames->nnames; j++) { - caname = &caNames->names[j]; - if (SECITEM_CompareItem(&issuerName, caname) == SECEqual) { - rv = SECSuccess; - CERT_DestroyCertificate(curcert); - goto done; - } else if (SECITEM_CompareItem(&compatIssuerName, caname) == SECEqual) { - rv = SECSuccess; - CERT_DestroyCertificate(curcert); - goto done; - } - } - if ( ( depth <= 20 ) && - ( SECITEM_CompareItem(&curcert->derIssuer, &curcert->derSubject) - != SECEqual ) ) { - oldcert = curcert; - curcert = CERT_FindCertByName(curcert->dbhandle, - &curcert->derIssuer); - CERT_DestroyCertificate(oldcert); - depth++; - } else { - CERT_DestroyCertificate(curcert); - curcert = NULL; - } - } - rv = SECFailure; - -done: - return rv; -} - diff --git a/security/nss/lib/ssl/config.mk b/security/nss/lib/ssl/config.mk deleted file mode 100644 index 8901280f6..000000000 --- a/security/nss/lib/ssl/config.mk +++ /dev/null @@ -1,125 +0,0 @@ -# -# ***** BEGIN LICENSE BLOCK ***** -# Version: MPL 1.1/GPL 2.0/LGPL 2.1 -# -# The contents of this file are subject to the Mozilla Public License Version -# 1.1 (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# http://www.mozilla.org/MPL/ -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License -# for the specific language governing rights and limitations under the -# License. -# -# The Original Code is the Netscape security libraries. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1994-2000 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# -# Alternatively, the contents of this file may be used under the terms of -# either the GNU General Public License Version 2 or later (the "GPL"), or -# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), -# in which case the provisions of the GPL or the LGPL are applicable instead -# of those above. If you wish to allow use of your version of this file only -# under the terms of either the GPL or the LGPL, and not to allow others to -# use your version of this file under the terms of the MPL, indicate your -# decision by deleting the provisions above and replace them with the notice -# and other provisions required by the GPL or the LGPL. If you do not delete -# the provisions above, a recipient may use your version of this file under -# the terms of any one of the MPL, the GPL or the LGPL. -# -# ***** END LICENSE BLOCK ***** - -ifdef NISCC_TEST -DEFINES += -DNISCC_TEST -endif - -ifdef NSS_SURVIVE_DOUBLE_BYPASS_FAILURE -DEFINES += -DNSS_SURVIVE_DOUBLE_BYPASS_FAILURE -endif - -ifeq (,$(filter-out WIN%,$(OS_TARGET))) - -# don't want the 32 in the shared library name -SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX) -IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX) - -RES = $(OBJDIR)/ssl.res -RESNAME = ssl.rc - -ifdef NS_USE_GCC -EXTRA_SHARED_LIBS += \ - -L$(DIST)/lib \ - -lnss3 \ - -L$(NSSUTIL_LIB_DIR) \ - -lnssutil3 \ - -L$(NSPR_LIB_DIR) \ - -lplc4 \ - -lplds4 \ - -lnspr4 \ - $(NULL) -else # ! NS_USE_GCC -EXTRA_SHARED_LIBS += \ - $(DIST)/lib/nss3.lib \ - $(DIST)/lib/nssutil3.lib \ - $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \ - $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \ - $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \ - $(NULL) -endif # NS_USE_GCC - -# $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS) -CRYPTOLIB=$(SOFTOKEN_LIB_DIR)/$(LIB_PREFIX)freebl.$(LIB_SUFFIX) - -EXTRA_LIBS += \ - $(CRYPTOLIB) \ - $(NULL) - -else - -# $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS) -CRYPTOLIB=$(SOFTOKEN_LIB_DIR)/$(LIB_PREFIX)freebl.$(LIB_SUFFIX) - -EXTRA_LIBS += \ - $(CRYPTOLIB) \ - $(NULL) - - -# $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS) -# $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX. -EXTRA_SHARED_LIBS += \ - -L$(DIST)/lib \ - -lnss3 \ - -L$(NSSUTIL_LIB_DIR) \ - -lnssutil3 \ - -L$(NSPR_LIB_DIR) \ - -lplc4 \ - -lplds4 \ - -lnspr4 \ - $(NULL) - -ifeq ($(OS_ARCH), BeOS) -EXTRA_SHARED_LIBS += -lbe -endif - -ifeq ($(OS_TARGET),SunOS) -# The -R '$ORIGIN' linker option instructs this library to search for its -# dependencies in the same directory where it resides. -MKSHLIB += -R '$$ORIGIN' -endif - -ifeq ($(OS_ARCH), HP-UX) -ifneq ($(OS_TEST), ia64) -# pa-risc -ifeq ($(USE_64), 1) -MKSHLIB += +b '$$ORIGIN' -endif -endif -endif - -endif diff --git a/security/nss/lib/ssl/derive.c b/security/nss/lib/ssl/derive.c deleted file mode 100644 index e200f4b84..000000000 --- a/security/nss/lib/ssl/derive.c +++ /dev/null @@ -1,853 +0,0 @@ -/* - * Key Derivation that doesn't use PKCS11 - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2005 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "ssl.h" /* prereq to sslimpl.h */ -#include "certt.h" /* prereq to sslimpl.h */ -#include "keythi.h" /* prereq to sslimpl.h */ -#include "sslimpl.h" -#include "blapi.h" - -#include "keyhi.h" -#include "pk11func.h" -#include "secasn1.h" -#include "cert.h" -#include "secmodt.h" - -#include "sslproto.h" -#include "sslerr.h" - -/* make this a macro! */ -#ifdef NOT_A_MACRO -static void -buildSSLKey(unsigned char * keyBlock, unsigned int keyLen, SECItem * result, - const char * label) -{ - result->type = siBuffer; - result->data = keyBlock; - result->len = keyLen; - PRINT_BUF(100, (NULL, label, keyBlock, keyLen)); -} -#else -#define buildSSLKey(keyBlock, keyLen, result, label) \ -{ \ - (result)->type = siBuffer; \ - (result)->data = keyBlock; \ - (result)->len = keyLen; \ - PRINT_BUF(100, (NULL, label, keyBlock, keyLen)); \ -} -#endif - -/* - * SSL Key generation given pre master secret - */ -#ifndef NUM_MIXERS -#define NUM_MIXERS 9 -#endif -static const char * const mixers[NUM_MIXERS] = { - "A", - "BB", - "CCC", - "DDDD", - "EEEEE", - "FFFFFF", - "GGGGGGG", - "HHHHHHHH", - "IIIIIIIII" -}; - - -SECStatus -ssl3_KeyAndMacDeriveBypass( - ssl3CipherSpec * pwSpec, - const unsigned char * cr, - const unsigned char * sr, - PRBool isTLS, - PRBool isExport) -{ - const ssl3BulkCipherDef *cipher_def = pwSpec->cipher_def; - unsigned char * key_block = pwSpec->key_block; - unsigned char * key_block2 = NULL; - unsigned int block_bytes = 0; - unsigned int block_needed = 0; - unsigned int i; - unsigned int keySize; /* actual size of cipher keys */ - unsigned int effKeySize; /* effective size of cipher keys */ - unsigned int macSize; /* size of MAC secret */ - unsigned int IVSize; /* size of IV */ - SECStatus rv = SECFailure; - SECStatus status = SECSuccess; - PRBool isFIPS = PR_FALSE; - - SECItem srcr; - SECItem crsr; - - unsigned char srcrdata[SSL3_RANDOM_LENGTH * 2]; - unsigned char crsrdata[SSL3_RANDOM_LENGTH * 2]; - PRUint64 md5buf[22]; - PRUint64 shabuf[40]; - -#define md5Ctx ((MD5Context *)md5buf) -#define shaCtx ((SHA1Context *)shabuf) - - static const SECItem zed = { siBuffer, NULL, 0 }; - - if (pwSpec->msItem.data == NULL || - pwSpec->msItem.len != SSL3_MASTER_SECRET_LENGTH) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return rv; - } - - PRINT_BUF(100, (NULL, "Master Secret", pwSpec->msItem.data, - pwSpec->msItem.len)); - - /* figure out how much is needed */ - macSize = pwSpec->mac_size; - keySize = cipher_def->key_size; - effKeySize = cipher_def->secret_key_size; - IVSize = cipher_def->iv_size; - if (keySize == 0) { - effKeySize = IVSize = 0; /* only MACing */ - } - block_needed = 2 * (macSize + effKeySize + ((!isExport) * IVSize)); - - /* - * clear out our returned keys so we can recover on failure - */ - pwSpec->client.write_key_item = zed; - pwSpec->client.write_mac_key_item = zed; - pwSpec->server.write_key_item = zed; - pwSpec->server.write_mac_key_item = zed; - - /* initialize the server random, client random block */ - srcr.type = siBuffer; - srcr.data = srcrdata; - srcr.len = sizeof srcrdata; - PORT_Memcpy(srcrdata, sr, SSL3_RANDOM_LENGTH); - PORT_Memcpy(srcrdata + SSL3_RANDOM_LENGTH, cr, SSL3_RANDOM_LENGTH); - - /* initialize the client random, server random block */ - crsr.type = siBuffer; - crsr.data = crsrdata; - crsr.len = sizeof crsrdata; - PORT_Memcpy(crsrdata, cr, SSL3_RANDOM_LENGTH); - PORT_Memcpy(crsrdata + SSL3_RANDOM_LENGTH, sr, SSL3_RANDOM_LENGTH); - PRINT_BUF(100, (NULL, "Key & MAC CRSR", crsr.data, crsr.len)); - - /* - * generate the key material: - */ - if (isTLS) { - SECItem keyblk; - - keyblk.type = siBuffer; - keyblk.data = key_block; - keyblk.len = block_needed; - - status = TLS_PRF(&pwSpec->msItem, "key expansion", &srcr, &keyblk, - isFIPS); - if (status != SECSuccess) { - goto key_and_mac_derive_fail; - } - block_bytes = keyblk.len; - } else { - /* key_block = - * MD5(master_secret + SHA('A' + master_secret + - * ServerHello.random + ClientHello.random)) + - * MD5(master_secret + SHA('BB' + master_secret + - * ServerHello.random + ClientHello.random)) + - * MD5(master_secret + SHA('CCC' + master_secret + - * ServerHello.random + ClientHello.random)) + - * [...]; - */ - unsigned int made = 0; - for (i = 0; made < block_needed && i < NUM_MIXERS; ++i) { - unsigned int outLen; - unsigned char sha_out[SHA1_LENGTH]; - - SHA1_Begin(shaCtx); - SHA1_Update(shaCtx, (unsigned char*)(mixers[i]), i+1); - SHA1_Update(shaCtx, pwSpec->msItem.data, pwSpec->msItem.len); - SHA1_Update(shaCtx, srcr.data, srcr.len); - SHA1_End(shaCtx, sha_out, &outLen, SHA1_LENGTH); - PORT_Assert(outLen == SHA1_LENGTH); - - MD5_Begin(md5Ctx); - MD5_Update(md5Ctx, pwSpec->msItem.data, pwSpec->msItem.len); - MD5_Update(md5Ctx, sha_out, outLen); - MD5_End(md5Ctx, key_block + made, &outLen, MD5_LENGTH); - PORT_Assert(outLen == MD5_LENGTH); - made += MD5_LENGTH; - } - block_bytes = made; - } - PORT_Assert(block_bytes >= block_needed); - PORT_Assert(block_bytes <= sizeof pwSpec->key_block); - PRINT_BUF(100, (NULL, "key block", key_block, block_bytes)); - - /* - * Put the key material where it goes. - */ - key_block2 = key_block + block_bytes; - i = 0; /* now shows how much consumed */ - - /* - * The key_block is partitioned as follows: - * client_write_MAC_secret[CipherSpec.hash_size] - */ - buildSSLKey(&key_block[i],macSize, &pwSpec->client.write_mac_key_item, \ - "Client Write MAC Secret"); - i += macSize; - - /* - * server_write_MAC_secret[CipherSpec.hash_size] - */ - buildSSLKey(&key_block[i],macSize, &pwSpec->server.write_mac_key_item, \ - "Server Write MAC Secret"); - i += macSize; - - if (!keySize) { - /* only MACing */ - buildSSLKey(NULL, 0, &pwSpec->client.write_key_item, \ - "Client Write Key (MAC only)"); - buildSSLKey(NULL, 0, &pwSpec->server.write_key_item, \ - "Server Write Key (MAC only)"); - buildSSLKey(NULL, 0, &pwSpec->client.write_iv_item, \ - "Client Write IV (MAC only)"); - buildSSLKey(NULL, 0, &pwSpec->server.write_iv_item, \ - "Server Write IV (MAC only)"); - } else if (!isExport) { - /* - ** Generate Domestic write keys and IVs. - ** client_write_key[CipherSpec.key_material] - */ - buildSSLKey(&key_block[i], keySize, &pwSpec->client.write_key_item, \ - "Domestic Client Write Key"); - i += keySize; - - /* - ** server_write_key[CipherSpec.key_material] - */ - buildSSLKey(&key_block[i], keySize, &pwSpec->server.write_key_item, \ - "Domestic Server Write Key"); - i += keySize; - - if (IVSize > 0) { - /* - ** client_write_IV[CipherSpec.IV_size] - */ - buildSSLKey(&key_block[i], IVSize, &pwSpec->client.write_iv_item, \ - "Domestic Client Write IV"); - i += IVSize; - - /* - ** server_write_IV[CipherSpec.IV_size] - */ - buildSSLKey(&key_block[i], IVSize, &pwSpec->server.write_iv_item, \ - "Domestic Server Write IV"); - i += IVSize; - } - PORT_Assert(i <= block_bytes); - - } else if (!isTLS) { - /* - ** Generate SSL3 Export write keys and IVs. - */ - unsigned int outLen; - - /* - ** client_write_key[CipherSpec.key_material] - ** final_client_write_key = MD5(client_write_key + - ** ClientHello.random + ServerHello.random); - */ - MD5_Begin(md5Ctx); - MD5_Update(md5Ctx, &key_block[i], effKeySize); - MD5_Update(md5Ctx, crsr.data, crsr.len); - MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); - i += effKeySize; - buildSSLKey(key_block2, keySize, &pwSpec->client.write_key_item, \ - "SSL3 Export Client Write Key"); - key_block2 += keySize; - - /* - ** server_write_key[CipherSpec.key_material] - ** final_server_write_key = MD5(server_write_key + - ** ServerHello.random + ClientHello.random); - */ - MD5_Begin(md5Ctx); - MD5_Update(md5Ctx, &key_block[i], effKeySize); - MD5_Update(md5Ctx, srcr.data, srcr.len); - MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); - i += effKeySize; - buildSSLKey(key_block2, keySize, &pwSpec->server.write_key_item, \ - "SSL3 Export Server Write Key"); - key_block2 += keySize; - PORT_Assert(i <= block_bytes); - - if (IVSize) { - /* - ** client_write_IV = - ** MD5(ClientHello.random + ServerHello.random); - */ - MD5_Begin(md5Ctx); - MD5_Update(md5Ctx, crsr.data, crsr.len); - MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); - buildSSLKey(key_block2, IVSize, &pwSpec->client.write_iv_item, \ - "SSL3 Export Client Write IV"); - key_block2 += IVSize; - - /* - ** server_write_IV = - ** MD5(ServerHello.random + ClientHello.random); - */ - MD5_Begin(md5Ctx); - MD5_Update(md5Ctx, srcr.data, srcr.len); - MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); - buildSSLKey(key_block2, IVSize, &pwSpec->server.write_iv_item, \ - "SSL3 Export Server Write IV"); - key_block2 += IVSize; - } - - PORT_Assert(key_block2 - key_block <= sizeof pwSpec->key_block); - } else { - /* - ** Generate TLS Export write keys and IVs. - */ - SECItem secret ; - SECItem keyblk ; - - secret.type = siBuffer; - keyblk.type = siBuffer; - /* - ** client_write_key[CipherSpec.key_material] - ** final_client_write_key = PRF(client_write_key, - ** "client write key", - ** client_random + server_random); - */ - secret.data = &key_block[i]; - secret.len = effKeySize; - i += effKeySize; - keyblk.data = key_block2; - keyblk.len = keySize; - status = TLS_PRF(&secret, "client write key", &crsr, &keyblk, isFIPS); - if (status != SECSuccess) { - goto key_and_mac_derive_fail; - } - buildSSLKey(key_block2, keySize, &pwSpec->client.write_key_item, \ - "TLS Export Client Write Key"); - key_block2 += keySize; - - /* - ** server_write_key[CipherSpec.key_material] - ** final_server_write_key = PRF(server_write_key, - ** "server write key", - ** client_random + server_random); - */ - secret.data = &key_block[i]; - secret.len = effKeySize; - i += effKeySize; - keyblk.data = key_block2; - keyblk.len = keySize; - status = TLS_PRF(&secret, "server write key", &crsr, &keyblk, isFIPS); - if (status != SECSuccess) { - goto key_and_mac_derive_fail; - } - buildSSLKey(key_block2, keySize, &pwSpec->server.write_key_item, \ - "TLS Export Server Write Key"); - key_block2 += keySize; - - /* - ** iv_block = PRF("", "IV block", client_random + server_random); - ** client_write_IV[SecurityParameters.IV_size] - ** server_write_IV[SecurityParameters.IV_size] - */ - if (IVSize) { - secret.data = NULL; - secret.len = 0; - keyblk.data = key_block2; - keyblk.len = 2 * IVSize; - status = TLS_PRF(&secret, "IV block", &crsr, &keyblk, isFIPS); - if (status != SECSuccess) { - goto key_and_mac_derive_fail; - } - buildSSLKey(key_block2, IVSize, \ - &pwSpec->client.write_iv_item, \ - "TLS Export Client Write IV"); - buildSSLKey(key_block2 + IVSize, IVSize, \ - &pwSpec->server.write_iv_item, \ - "TLS Export Server Write IV"); - key_block2 += 2 * IVSize; - } - PORT_Assert(key_block2 - key_block <= sizeof pwSpec->key_block); - } - rv = SECSuccess; - -key_and_mac_derive_fail: - - MD5_DestroyContext(md5Ctx, PR_FALSE); - SHA1_DestroyContext(shaCtx, PR_FALSE); - - if (rv != SECSuccess) { - PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - } - - return rv; -} - - -/* derive the Master Secret from the PMS */ -/* Presently, this is only done wtih RSA PMS, and only on the server side, - * so isRSA is always true. - */ -SECStatus -ssl3_MasterKeyDeriveBypass( - ssl3CipherSpec * pwSpec, - const unsigned char * cr, - const unsigned char * sr, - const SECItem * pms, - PRBool isTLS, - PRBool isRSA) -{ - unsigned char * key_block = pwSpec->key_block; - SECStatus rv = SECSuccess; - PRBool isFIPS = PR_FALSE; - - SECItem crsr; - - unsigned char crsrdata[SSL3_RANDOM_LENGTH * 2]; - PRUint64 md5buf[22]; - PRUint64 shabuf[40]; - -#define md5Ctx ((MD5Context *)md5buf) -#define shaCtx ((SHA1Context *)shabuf) - - /* first do the consistancy checks */ - if (isRSA) { - PORT_Assert(pms->len == SSL3_RSA_PMS_LENGTH); - if (pms->len != SSL3_RSA_PMS_LENGTH) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - /* caller must test PMS version for rollback */ - } - - /* initialize the client random, server random block */ - crsr.type = siBuffer; - crsr.data = crsrdata; - crsr.len = sizeof crsrdata; - PORT_Memcpy(crsrdata, cr, SSL3_RANDOM_LENGTH); - PORT_Memcpy(crsrdata + SSL3_RANDOM_LENGTH, sr, SSL3_RANDOM_LENGTH); - PRINT_BUF(100, (NULL, "Master Secret CRSR", crsr.data, crsr.len)); - - /* finally do the key gen */ - if (isTLS) { - SECItem master = { siBuffer, NULL, 0 }; - - master.data = key_block; - master.len = SSL3_MASTER_SECRET_LENGTH; - - rv = TLS_PRF(pms, "master secret", &crsr, &master, isFIPS); - if (rv != SECSuccess) { - PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - } - } else { - int i; - unsigned int made = 0; - for (i = 0; i < 3; i++) { - unsigned int outLen; - unsigned char sha_out[SHA1_LENGTH]; - - SHA1_Begin(shaCtx); - SHA1_Update(shaCtx, (unsigned char*) mixers[i], i+1); - SHA1_Update(shaCtx, pms->data, pms->len); - SHA1_Update(shaCtx, crsr.data, crsr.len); - SHA1_End(shaCtx, sha_out, &outLen, SHA1_LENGTH); - PORT_Assert(outLen == SHA1_LENGTH); - - MD5_Begin(md5Ctx); - MD5_Update(md5Ctx, pms->data, pms->len); - MD5_Update(md5Ctx, sha_out, outLen); - MD5_End(md5Ctx, key_block + made, &outLen, MD5_LENGTH); - PORT_Assert(outLen == MD5_LENGTH); - made += outLen; - } - } - - /* store the results */ - PORT_Memcpy(pwSpec->raw_master_secret, key_block, - SSL3_MASTER_SECRET_LENGTH); - pwSpec->msItem.data = pwSpec->raw_master_secret; - pwSpec->msItem.len = SSL3_MASTER_SECRET_LENGTH; - PRINT_BUF(100, (NULL, "Master Secret", pwSpec->msItem.data, - pwSpec->msItem.len)); - - return rv; -} - -static SECStatus -ssl_canExtractMS(PK11SymKey *pms, PRBool isTLS, PRBool isDH, PRBool *pcbp) -{ SECStatus rv; - PK11SymKey * ms = NULL; - SECItem params = {siBuffer, NULL, 0}; - CK_SSL3_MASTER_KEY_DERIVE_PARAMS master_params; - unsigned char rand[SSL3_RANDOM_LENGTH]; - CK_VERSION pms_version; - CK_MECHANISM_TYPE master_derive; - CK_MECHANISM_TYPE key_derive; - CK_FLAGS keyFlags; - - if (pms == NULL) - return(SECFailure); - - PORT_Memset(rand, 0, SSL3_RANDOM_LENGTH); - - if (isTLS) { - if(isDH) master_derive = CKM_TLS_MASTER_KEY_DERIVE_DH; - else master_derive = CKM_TLS_MASTER_KEY_DERIVE; - key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; - keyFlags = CKF_SIGN | CKF_VERIFY; - } else { - if (isDH) master_derive = CKM_SSL3_MASTER_KEY_DERIVE_DH; - else master_derive = CKM_SSL3_MASTER_KEY_DERIVE; - key_derive = CKM_SSL3_KEY_AND_MAC_DERIVE; - keyFlags = 0; - } - - master_params.pVersion = &pms_version; - master_params.RandomInfo.pClientRandom = rand; - master_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH; - master_params.RandomInfo.pServerRandom = rand; - master_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH; - - params.data = (unsigned char *) &master_params; - params.len = sizeof master_params; - - ms = PK11_DeriveWithFlags(pms, master_derive, ¶ms, key_derive, - CKA_DERIVE, 0, keyFlags); - if (ms == NULL) - return(SECFailure); - - rv = PK11_ExtractKeyValue(ms); - *pcbp = (rv == SECSuccess); - PK11_FreeSymKey(ms); - - return(rv); - -} - -/* Check the key exchange algorithm for each cipher in the list to see if - * a master secret key can be extracted. If the KEA will use keys from the - * specified cert make sure the extract operation is attempted from the slot - * where the private key resides. - * If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and - * SECSuccess is returned. In all other cases but one (*pcanbypass) is - * set to FALSE and SECFailure is returned. - * In that last case Derive() has been called successfully but the MS is null, - * CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the - * arguments were all valid but the slot cannot be bypassed. - */ - -SECStatus -SSL_CanBypass(CERTCertificate *cert, SECKEYPrivateKey *srvPrivkey, - PRUint32 protocolmask, PRUint16 *ciphersuites, int nsuites, - PRBool *pcanbypass, void *pwArg) -{ SECStatus rv; - int i; - PRUint16 suite; - PK11SymKey * pms = NULL; - SECKEYPublicKey * srvPubkey = NULL; - KeyType privKeytype; - PK11SlotInfo * slot = NULL; - SECItem param; - CK_VERSION version; - CK_MECHANISM_TYPE mechanism_array[2]; - SECItem enc_pms = {siBuffer, NULL, 0}; - PRBool isTLS = PR_FALSE; - SSLCipherSuiteInfo csdef; - PRBool testrsa = PR_FALSE; - PRBool testrsa_export = PR_FALSE; - PRBool testecdh = PR_FALSE; - PRBool testecdhe = PR_FALSE; - - if (!cert || !srvPrivkey || !ciphersuites || !pcanbypass) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - - srvPubkey = CERT_ExtractPublicKey(cert); - if (!srvPubkey) - return SECFailure; - - *pcanbypass = PR_TRUE; - rv = SECFailure; - - /* determine which KEAs to test */ - /* 0 (SSL_NULL_WITH_NULL_NULL) is used as a list terminator because - * SSL3 and TLS specs forbid negotiating that cipher suite number. - */ - for (i=0; i < nsuites && (suite = *ciphersuites++) != 0; i++) { - /* skip SSL2 cipher suites and ones NSS doesn't support */ - if (SSL_GetCipherSuiteInfo(suite, &csdef, sizeof(csdef)) != SECSuccess - || SSL_IS_SSL2_CIPHER(suite) ) - continue; - switch (csdef.keaType) { - case ssl_kea_rsa: - switch (csdef.cipherSuite) { - case TLS_RSA_EXPORT1024_WITH_RC4_56_SHA: - case TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA: - case SSL_RSA_EXPORT_WITH_RC4_40_MD5: - case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: - testrsa_export = PR_TRUE; - } - if (!testrsa_export) - testrsa = PR_TRUE; - break; - case ssl_kea_ecdh: - if (strcmp(csdef.keaTypeName, "ECDHE") == 0) /* ephemeral? */ - testecdhe = PR_TRUE; - else - testecdh = PR_TRUE; - break; - case ssl_kea_dh: - /* this is actually DHE */ - default: - continue; - } - } - - /* For each protocol try to derive and extract an MS. - * Failure of function any function except MS extract means - * continue with the next cipher test. Stop testing when the list is - * exhausted or when the first MS extract--not derive--fails. - */ - privKeytype = SECKEY_GetPrivateKeyType(srvPrivkey); - protocolmask &= SSL_CBP_SSL3|SSL_CBP_TLS1_0; - while (protocolmask) { - if (protocolmask & SSL_CBP_SSL3) { - isTLS = PR_FALSE; - protocolmask ^= SSL_CBP_SSL3; - } else { - isTLS = PR_TRUE; - protocolmask ^= SSL_CBP_TLS1_0; - } - - if (privKeytype == rsaKey && testrsa_export) { - if (PK11_GetPrivateModulusLen(srvPrivkey) > EXPORT_RSA_KEY_LENGTH) { - *pcanbypass = PR_FALSE; - rv = SECSuccess; - break; - } else - testrsa = PR_TRUE; - } - for (; privKeytype == rsaKey && testrsa; ) { - /* TLS_RSA */ - unsigned char rsaPmsBuf[SSL3_RSA_PMS_LENGTH]; - unsigned int outLen = 0; - CK_MECHANISM_TYPE target; - SECStatus irv; - - mechanism_array[0] = CKM_SSL3_PRE_MASTER_KEY_GEN; - mechanism_array[1] = CKM_RSA_PKCS; - - slot = PK11_GetBestSlotMultiple(mechanism_array, 2, pwArg); - if (slot == NULL) { - PORT_SetError(SSL_ERROR_TOKEN_SLOT_NOT_FOUND); - break; - } - - /* Generate the pre-master secret ... (client side) */ - version.major = 3 /*MSB(clientHelloVersion)*/; - version.minor = 0 /*LSB(clientHelloVersion)*/; - param.data = (unsigned char *)&version; - param.len = sizeof version; - pms = PK11_KeyGen(slot, CKM_SSL3_PRE_MASTER_KEY_GEN, ¶m, 0, pwArg); - PK11_FreeSlot(slot); - if (!pms) - break; - /* now wrap it */ - enc_pms.len = SECKEY_PublicKeyStrength(srvPubkey); - enc_pms.data = (unsigned char*)PORT_Alloc(enc_pms.len); - irv = PK11_PubWrapSymKey(CKM_RSA_PKCS, srvPubkey, pms, &enc_pms); - if (irv != SECSuccess) - break; - PK11_FreeSymKey(pms); - /* now do the server side--check the triple bypass first */ - rv = PK11_PrivDecryptPKCS1(srvPrivkey, rsaPmsBuf, &outLen, - sizeof rsaPmsBuf, - (unsigned char *)enc_pms.data, - enc_pms.len); - /* if decrypt worked we're done with the RSA test */ - if (rv == SECSuccess) { - *pcanbypass = PR_TRUE; - break; - } - /* check for fallback to double bypass */ - target = isTLS ? CKM_TLS_MASTER_KEY_DERIVE - : CKM_SSL3_MASTER_KEY_DERIVE; - pms = PK11_PubUnwrapSymKey(srvPrivkey, &enc_pms, - target, CKA_DERIVE, 0); - rv = ssl_canExtractMS(pms, isTLS, PR_FALSE, pcanbypass); - if (rv == SECSuccess && *pcanbypass == PR_FALSE) - goto done; - break; - } -#ifdef NSS_ENABLE_ECC - for (; (privKeytype == ecKey && ( testecdh || testecdhe)) || - (privKeytype == rsaKey && testecdhe); ) { - CK_MECHANISM_TYPE target; - SECKEYPublicKey *keapub = NULL; - SECKEYPrivateKey *keapriv; - SECKEYPublicKey *cpub = NULL; /* client's ephemeral ECDH keys */ - SECKEYPrivateKey *cpriv = NULL; - SECKEYECParams ecParams = { siBuffer, NULL, 0 }, - *pecParams; - - if (privKeytype == ecKey && testecdhe) { - /* TLS_ECDHE_ECDSA */ - pecParams = &srvPubkey->u.ec.DEREncodedParams; - } else if (privKeytype == rsaKey && testecdhe) { - /* TLS_ECDHE_RSA */ - ECName ec_curve; - int serverKeyStrengthInBits; - int signatureKeyStrength; - int requiredECCbits; - - /* find a curve of equivalent strength to the RSA key's */ - requiredECCbits = PK11_GetPrivateModulusLen(srvPrivkey); - if (requiredECCbits < 0) - break; - requiredECCbits *= BPB; - serverKeyStrengthInBits = srvPubkey->u.rsa.modulus.len; - if (srvPubkey->u.rsa.modulus.data[0] == 0) { - serverKeyStrengthInBits--; - } - /* convert to strength in bits */ - serverKeyStrengthInBits *= BPB; - - signatureKeyStrength = - SSL_RSASTRENGTH_TO_ECSTRENGTH(serverKeyStrengthInBits); - - if ( requiredECCbits > signatureKeyStrength ) - requiredECCbits = signatureKeyStrength; - - ec_curve = - ssl3_GetCurveWithECKeyStrength(SSL3_SUPPORTED_CURVES_MASK, - requiredECCbits); - rv = ssl3_ECName2Params(NULL, ec_curve, &ecParams); - if (rv == SECFailure) { - break; - } - pecParams = &ecParams; - } - - if (testecdhe) { - /* generate server's ephemeral keys */ - keapriv = SECKEY_CreateECPrivateKey(pecParams, &keapub, NULL); - if (!keapriv || !keapub) { - if (keapriv) - SECKEY_DestroyPrivateKey(keapriv); - if (keapub) - SECKEY_DestroyPublicKey(keapub); - PORT_SetError(SEC_ERROR_KEYGEN_FAIL); - rv = SECFailure; - break; - } - } else { - /* TLS_ECDH_ECDSA */ - keapub = srvPubkey; - keapriv = srvPrivkey; - pecParams = &srvPubkey->u.ec.DEREncodedParams; - } - - /* perform client side ops */ - /* generate a pair of ephemeral keys using server's parms */ - cpriv = SECKEY_CreateECPrivateKey(pecParams, &cpub, NULL); - if (!cpriv || !cpub) { - if (testecdhe) { - SECKEY_DestroyPrivateKey(keapriv); - SECKEY_DestroyPublicKey(keapub); - } - PORT_SetError(SEC_ERROR_KEYGEN_FAIL); - rv = SECFailure; - break; - } - /* now do the server side */ - /* determine the PMS using client's public value */ - target = isTLS ? CKM_TLS_MASTER_KEY_DERIVE_DH - : CKM_SSL3_MASTER_KEY_DERIVE_DH; - pms = PK11_PubDeriveWithKDF(keapriv, cpub, PR_FALSE, NULL, NULL, - CKM_ECDH1_DERIVE, - target, - CKA_DERIVE, 0, CKD_NULL, NULL, NULL); - rv = ssl_canExtractMS(pms, isTLS, PR_TRUE, pcanbypass); - SECKEY_DestroyPrivateKey(cpriv); - SECKEY_DestroyPublicKey(cpub); - if (testecdhe) { - SECKEY_DestroyPrivateKey(keapriv); - SECKEY_DestroyPublicKey(keapub); - if (privKeytype == rsaKey) - PORT_Free(ecParams.data); - } - if (rv == SECSuccess && *pcanbypass == PR_FALSE) - goto done; - break; - } -#endif /* NSS_ENABLE_ECC */ - if (pms) - PK11_FreeSymKey(pms); - } - - /* *pcanbypass has been set */ - rv = SECSuccess; - - done: - if (pms) - PK11_FreeSymKey(pms); - - SECITEM_FreeItem(&enc_pms, PR_FALSE); - - if (srvPubkey) { - SECKEY_DestroyPublicKey(srvPubkey); - srvPubkey = NULL; - } - - - return rv; -} - diff --git a/security/nss/lib/ssl/manifest.mn b/security/nss/lib/ssl/manifest.mn deleted file mode 100644 index 84512296d..000000000 --- a/security/nss/lib/ssl/manifest.mn +++ /dev/null @@ -1,83 +0,0 @@ -# -# ***** BEGIN LICENSE BLOCK ***** -# Version: MPL 1.1/GPL 2.0/LGPL 2.1 -# -# The contents of this file are subject to the Mozilla Public License Version -# 1.1 (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# http://www.mozilla.org/MPL/ -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License -# for the specific language governing rights and limitations under the -# License. -# -# The Original Code is the Netscape security libraries. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1994-2000 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# -# Alternatively, the contents of this file may be used under the terms of -# either the GNU General Public License Version 2 or later (the "GPL"), or -# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), -# in which case the provisions of the GPL or the LGPL are applicable instead -# of those above. If you wish to allow use of your version of this file only -# under the terms of either the GPL or the LGPL, and not to allow others to -# use your version of this file under the terms of the MPL, indicate your -# decision by deleting the provisions above and replace them with the notice -# and other provisions required by the GPL or the LGPL. If you do not delete -# the provisions above, a recipient may use your version of this file under -# the terms of any one of the MPL, the GPL or the LGPL. -# -# ***** END LICENSE BLOCK ***** -CORE_DEPTH = ../../.. - -# DEFINES = -DTRACE - -EXPORTS = \ - ssl.h \ - sslt.h \ - sslerr.h \ - sslproto.h \ - preenc.h \ - $(NULL) - -MODULE = nss -MAPFILE = $(OBJDIR)/ssl.def - -CSRCS = \ - derive.c \ - prelib.c \ - ssl3con.c \ - ssl3gthr.c \ - sslauth.c \ - sslcon.c \ - ssldef.c \ - sslenum.c \ - sslerr.c \ - ssl3ext.c \ - sslgathr.c \ - sslmutex.c \ - sslnonce.c \ - sslreveal.c \ - sslsecur.c \ - sslsnce.c \ - sslsock.c \ - ssltrace.c \ - sslver.c \ - authcert.c \ - cmpcert.c \ - nsskea.c \ - sslinfo.c \ - ssl3ecc.c \ - $(NULL) - -LIBRARY_NAME = ssl -LIBRARY_VERSION = 3 - -# This part of the code, including all sub-dirs, can be optimized for size -export ALLOW_OPT_CODE_SIZE = 1 diff --git a/security/nss/lib/ssl/notes.txt b/security/nss/lib/ssl/notes.txt deleted file mode 100644 index 772da4d58..000000000 --- a/security/nss/lib/ssl/notes.txt +++ /dev/null @@ -1,166 +0,0 @@ -***** BEGIN LICENSE BLOCK ***** -Version: MPL 1.1/GPL 2.0/LGPL 2.1 - -The contents of this file are subject to the Mozilla Public License Version -1.1 (the "License"); you may not use this file except in compliance with -the License. You may obtain a copy of the License at -http://www.mozilla.org/MPL/ - -Software distributed under the License is distributed on an "AS IS" basis, -WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License -for the specific language governing rights and limitations under the -License. - -The Original Code is the Netscape security libraries. - -The Initial Developer of the Original Code is -Netscape Communications Corporation. -Portions created by the Initial Developer are Copyright (C) 1994-2000 -the Initial Developer. All Rights Reserved. - -Contributor(s): - -Alternatively, the contents of this file may be used under the terms of -either the GNU General Public License Version 2 or later (the "GPL"), or -the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), -in which case the provisions of the GPL or the LGPL are applicable instead -of those above. If you wish to allow use of your version of this file only -under the terms of either the GPL or the LGPL, and not to allow others to -use your version of this file under the terms of the MPL, indicate your -decision by deleting the provisions above and replace them with the notice -and other provisions required by the GPL or the LGPL. If you do not delete -the provisions above, a recipient may use your version of this file under -the terms of any one of the MPL, the GPL or the LGPL. - -***** END LICENSE BLOCK ***** - -SSL's Buffers: enumerated and explained. - ---------------------------------------------------------------------------- -incoming: - -gs = ss->gather -hs = ss->ssl3->hs - -gs->inbuf SSL3 only: incoming (encrypted) ssl records are placed here, - and then decrypted (or copied) to gs->buf. - -gs->buf SSL2: incoming SSL records are put here, and then decrypted - in place. - SSL3: ssl3_HandleHandshake puts decrypted ssl records here. - -hs.msg_body (SSL3 only) When an incoming handshake message spans more - than one ssl record, the first part(s) of it are accumulated - here until it all arrives. - -hs.msgState (SSL3 only) an alternative set of pointers/lengths for gs->buf. - Used only when a handleHandshake function returns SECWouldBlock. - ssl3_HandleHandshake remembers how far it previously got by - using these pointers instead of gs->buf when it is called - after a previous SECWouldBlock return. - ---------------------------------------------------------------------------- -outgoing: - -sec = ss->sec -ci = ss->sec->ci /* connect info */ - -ci->sendBuf Outgoing handshake messages are appended to this buffer. - This buffer will then be sent as a single SSL record. - -sec->writeBuf outgoing ssl records are constructed here and encrypted in - place before being written or copied to pendingBuf. - -ss->pendingBuf contains outgoing ciphertext that was saved after a write - attempt to the socket failed, e.g. EWouldBlock. - Generally empty with blocking sockets (should be no incomplete - writes). - -ss->saveBuf Used only by socks code. Intended to be used to buffer - outgoing data until a socks handshake completes. However, - this buffer is always empty. There is no code to put - anything into it. - ---------------------------------------------------------------------------- - -SECWouldBlock means that the function cannot make progress because it is -waiting for some event OTHER THAN socket I/O completion (e.g. waiting for -user dialog to finish). It is not the same as EWOULDBLOCK. - ---------------------------------------------------------------------------- - -Rank (order) of locks - -[ReadLock ->]\ [firstHandshake ->] [ssl3Handshake ->] recvbuf \ -> "spec" -[WriteLock->]/ xmitbuf / - -crypto and hash Data that must be protected while turning plaintext into -ciphertext: - -SSL2: (in ssl2_Send*) - sec->hash* - sec->hashcx (ptr and data) - sec->enc - sec->writecx* (ptr and content) - sec->sendSecret*(ptr and content) - sec->sendSequence locked by xmitBufLock - sec->blockSize - sec->writeBuf* (ptr & content) locked by xmitBufLock - "in" locked by xmitBufLock - -SSl3: (in ssl3_SendPlainText) - ss->ssl3 (the pointer) - ss->ssl3->current_write* (the pointer and the data in the spec - and any data referenced by the spec. - - ss->sec->isServer - ss->sec->writebuf* (ptr & content) locked by xmitBufLock - "buf" locked by xmitBufLock - -crypto and hash data that must be protected while turning ciphertext into -plaintext: - -SSL2: (in ssl2_GatherData) - gs->* (locked by recvBufLock ) - sec->dec - sec->readcx - sec->hash* (ptr and data) - sec->hashcx (ptr and data) - -SSL3: (in ssl3_HandleRecord ) - ssl3->current_read* (the pointer and all data refernced) - ss->sec->isServer - - -Data that must be protected while being used by a "writer": - -ss->pendingBuf.* -ss->saveBuf.* (which is dead) - -in ssl3_sendPlainText - -ss->ssl3->current_write-> (spec) -ss->sec->writeBuf.* -ss->sec->isServer - -in SendBlock - -ss->sec->hash->length -ss->sec->blockSize -ss->sec->writeBuf.* -ss->sec->sendSecret -ss->sec->sendSequence -ss->sec->writecx * -ss->pendingBuf - --------------------------------------------------------------------------- - -Data variables (not const) protected by the "sslGlobalDataLock". -Note, this really should be a reader/writer lock. - -allowedByPolicy sslcon.c -maybeAllowedByPolicy sslcon.c -chosenPreference sslcon.c -policyWasSet sslcon.c - -cipherSuites[] ssl3con.c diff --git a/security/nss/lib/ssl/nsskea.c b/security/nss/lib/ssl/nsskea.c deleted file mode 100644 index beafc506e..000000000 --- a/security/nss/lib/ssl/nsskea.c +++ /dev/null @@ -1,78 +0,0 @@ -/* - * Return SSLKEAType derived from cert's Public Key algorithm info. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "ssl.h" /* for SSLKEAType */ -#include "secoid.h" - -SSLKEAType -NSS_FindCertKEAType(CERTCertificate * cert) -{ - SSLKEAType keaType = kt_null; - int tag; - - if (!cert) goto loser; - - tag = SECOID_GetAlgorithmTag(&(cert->subjectPublicKeyInfo.algorithm)); - - switch (tag) { - case SEC_OID_X500_RSA_ENCRYPTION: - case SEC_OID_PKCS1_RSA_ENCRYPTION: - keaType = kt_rsa; - break; - case SEC_OID_X942_DIFFIE_HELMAN_KEY: - keaType = kt_dh; - break; -#ifdef NSS_ENABLE_ECC - case SEC_OID_ANSIX962_EC_PUBLIC_KEY: - keaType = kt_ecdh; - break; -#endif /* NSS_ENABLE_ECC */ - default: - keaType = kt_null; - } - - loser: - - return keaType; - -} - diff --git a/security/nss/lib/ssl/os2_err.c b/security/nss/lib/ssl/os2_err.c deleted file mode 100644 index 0274676c0..000000000 --- a/security/nss/lib/ssl/os2_err.c +++ /dev/null @@ -1,313 +0,0 @@ -/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ -/* - * This file essentially replicates NSPR's source for the functions that - * map system-specific error codes to NSPR error codes. We would use - * NSPR's functions, instead of duplicating them, but they're private. - * As long as SSL's server session cache code must do platform native I/O - * to accomplish its job, and NSPR's error mapping functions remain private, - * this code will continue to need to be replicated. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "prerror.h" -#include "prlog.h" -#include <errno.h> - - -/* - * Based on win32err.c - * OS2TODO Stub everything for now to build. HCT - */ - -/* forward declaration. */ -void nss_MD_os2_map_default_error(PRInt32 err); - -void nss_MD_os2_map_opendir_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_closedir_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_readdir_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_delete_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -/* The error code for stat() is in errno. */ -void nss_MD_os2_map_stat_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_fstat_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_rename_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -/* The error code for access() is in errno. */ -void nss_MD_os2_map_access_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_mkdir_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_rmdir_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_read_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_transmitfile_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_write_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_lseek_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_fsync_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -/* - * For both CloseHandle() and closesocket(). - */ -void nss_MD_os2_map_close_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_socket_error(PRInt32 err) -{ -// PR_ASSERT(err != WSANOTINITIALISED); - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_recv_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_recvfrom_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_send_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_sendto_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_accept_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; -// case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_acceptex_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_connect_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEWOULDBLOCK: prError = PR_IN_PROGRESS_ERROR; break; -// case WSAEINVAL: prError = PR_ALREADY_INITIATED_ERROR; break; -// case WSAETIMEDOUT: prError = PR_IO_TIMEOUT_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_bind_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEINVAL: prError = PR_SOCKET_ADDRESS_IS_BOUND_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_listen_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; -// case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_shutdown_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_getsockname_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_getpeername_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_getsockopt_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_setsockopt_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_open_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -void nss_MD_os2_map_gethostname_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - -/* Win32 select() only works on sockets. So in this -** context, WSAENOTSOCK is equivalent to EBADF on Unix. -*/ -void nss_MD_os2_map_select_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { -// case WSAENOTSOCK: prError = PR_BAD_DESCRIPTOR_ERROR; break; - default: nss_MD_os2_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_os2_map_lockf_error(PRInt32 err) -{ - nss_MD_os2_map_default_error(err); -} - - - -void nss_MD_os2_map_default_error(PRInt32 err) -{ - PRErrorCode prError; - - switch (err) { -// case ENOENT: prError = PR_FILE_NOT_FOUND_ERROR; break; -// case ERROR_ACCESS_DENIED: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; -// case ERROR_ALREADY_EXISTS: prError = PR_FILE_EXISTS_ERROR; break; -// case ERROR_DISK_CORRUPT: prError = PR_IO_ERROR; break; -// case ERROR_DISK_FULL: prError = PR_NO_DEVICE_SPACE_ERROR; break; -// case ERROR_DISK_OPERATION_FAILED: prError = PR_IO_ERROR; break; -// case ERROR_DRIVE_LOCKED: prError = PR_FILE_IS_LOCKED_ERROR; break; -// case ERROR_FILENAME_EXCED_RANGE: prError = PR_NAME_TOO_LONG_ERROR; break; -// case ERROR_FILE_CORRUPT: prError = PR_IO_ERROR; break; -// case ERROR_FILE_EXISTS: prError = PR_FILE_EXISTS_ERROR; break; -// case ERROR_FILE_INVALID: prError = PR_BAD_DESCRIPTOR_ERROR; break; -#if ERROR_FILE_NOT_FOUND != ENOENT -// case ERROR_FILE_NOT_FOUND: prError = PR_FILE_NOT_FOUND_ERROR; break; -#endif - default: prError = PR_UNKNOWN_ERROR; break; - } - PR_SetError(prError, err); -} - diff --git a/security/nss/lib/ssl/os2_err.h b/security/nss/lib/ssl/os2_err.h deleted file mode 100644 index 151932132..000000000 --- a/security/nss/lib/ssl/os2_err.h +++ /dev/null @@ -1,86 +0,0 @@ -/* - * This file essentially replicates NSPR's source for the functions that - * map system-specific error codes to NSPR error codes. We would use - * NSPR's functions, instead of duplicating them, but they're private. - * As long as SSL's server session cache code must do platform native I/O - * to accomplish its job, and NSPR's error mapping functions remain private, - * This code will continue to need to be replicated. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -/* NSPR doesn't make these functions public, so we have to duplicate -** them in NSS. -*/ - -//HCT Based on Win32err.h -extern void nss_MD_os2_map_accept_error(PRInt32 err); -extern void nss_MD_os2_map_acceptex_error(PRInt32 err); -extern void nss_MD_os2_map_access_error(PRInt32 err); -extern void nss_MD_os2_map_bind_error(PRInt32 err); -extern void nss_MD_os2_map_close_error(PRInt32 err); -extern void nss_MD_os2_map_closedir_error(PRInt32 err); -extern void nss_MD_os2_map_connect_error(PRInt32 err); -extern void nss_MD_os2_map_default_error(PRInt32 err); -extern void nss_MD_os2_map_delete_error(PRInt32 err); -extern void nss_MD_os2_map_fstat_error(PRInt32 err); -extern void nss_MD_os2_map_fsync_error(PRInt32 err); -extern void nss_MD_os2_map_gethostname_error(PRInt32 err); -extern void nss_MD_os2_map_getpeername_error(PRInt32 err); -extern void nss_MD_os2_map_getsockname_error(PRInt32 err); -extern void nss_MD_os2_map_getsockopt_error(PRInt32 err); -extern void nss_MD_os2_map_listen_error(PRInt32 err); -extern void nss_MD_os2_map_lockf_error(PRInt32 err); -extern void nss_MD_os2_map_lseek_error(PRInt32 err); -extern void nss_MD_os2_map_mkdir_error(PRInt32 err); -extern void nss_MD_os2_map_open_error(PRInt32 err); -extern void nss_MD_os2_map_opendir_error(PRInt32 err); -extern void nss_MD_os2_map_read_error(PRInt32 err); -extern void nss_MD_os2_map_readdir_error(PRInt32 err); -extern void nss_MD_os2_map_recv_error(PRInt32 err); -extern void nss_MD_os2_map_recvfrom_error(PRInt32 err); -extern void nss_MD_os2_map_rename_error(PRInt32 err); -extern void nss_MD_os2_map_rmdir_error(PRInt32 err); -extern void nss_MD_os2_map_select_error(PRInt32 err); -extern void nss_MD_os2_map_send_error(PRInt32 err); -extern void nss_MD_os2_map_sendto_error(PRInt32 err); -extern void nss_MD_os2_map_setsockopt_error(PRInt32 err); -extern void nss_MD_os2_map_shutdown_error(PRInt32 err); -extern void nss_MD_os2_map_socket_error(PRInt32 err); -extern void nss_MD_os2_map_stat_error(PRInt32 err); -extern void nss_MD_os2_map_transmitfile_error(PRInt32 err); -extern void nss_MD_os2_map_write_error(PRInt32 err); diff --git a/security/nss/lib/ssl/preenc.h b/security/nss/lib/ssl/preenc.h deleted file mode 100644 index f7c9093cb..000000000 --- a/security/nss/lib/ssl/preenc.h +++ /dev/null @@ -1,146 +0,0 @@ -/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil -*- */ - -/* - * Fortezza support is removed. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -/* Fortezza support is removed. - * This file remains so that old programs will continue to compile, - * But this functionality is no longer supported or implemented. - */ - -#include "seccomon.h" -#include "prio.h" - -typedef struct PEHeaderStr PEHeader; - -#define PE_MIME_TYPE "application/pre-encrypted" - -typedef struct PEFortezzaHeaderStr PEFortezzaHeader; -typedef struct PEFortezzaGeneratedHeaderStr PEFortezzaGeneratedHeader; -typedef struct PEFixedKeyHeaderStr PEFixedKeyHeader; -typedef struct PERSAKeyHeaderStr PERSAKeyHeader; - -struct PEFortezzaHeaderStr { - unsigned char key[12]; - unsigned char iv[24]; - unsigned char hash[20]; - unsigned char serial[8]; -}; - -struct PEFortezzaGeneratedHeaderStr { - unsigned char key[12]; - unsigned char iv[24]; - unsigned char hash[20]; - unsigned char Ra[128]; - unsigned char Y[128]; -}; - -struct PEFixedKeyHeaderStr { - unsigned char pkcs11Mech[4]; - unsigned char labelLen[2]; - unsigned char keyIDLen[2]; - unsigned char ivLen[2]; - unsigned char keyLen[2]; - unsigned char data[1]; -}; - -struct PERSAKeyHeaderStr { - unsigned char pkcs11Mech[4]; - unsigned char issuerLen[2]; - unsigned char serialLen[2]; - unsigned char ivLen[2]; - unsigned char keyLen[2]; - unsigned char data[1]; -}; - -#define PEFIXED_Label(header) (header->data) -#define PEFIXED_KeyID(header) (&header->data[GetInt2(header->labelLen)]) -#define PEFIXED_IV(header) (&header->data[GetInt2(header->labelLen)\ - +GetInt2(header->keyIDLen)]) -#define PEFIXED_Key(header) (&header->data[GetInt2(header->labelLen)\ - +GetInt2(header->keyIDLen)+GetInt2(header->keyLen)]) -#define PERSA_Issuer(header) (header->data) -#define PERSA_Serial(header) (&header->data[GetInt2(header->issuerLen)]) -#define PERSA_IV(header) (&header->data[GetInt2(header->issuerLen)\ - +GetInt2(header->serialLen)]) -#define PERSA_Key(header) (&header->data[GetInt2(header->issuerLen)\ - +GetInt2(header->serialLen)+GetInt2(header->keyLen)]) -struct PEHeaderStr { - unsigned char magic [2]; - unsigned char len [2]; - unsigned char type [2]; - unsigned char version[2]; - union { - PEFortezzaHeader fortezza; - PEFortezzaGeneratedHeader g_fortezza; - PEFixedKeyHeader fixed; - PERSAKeyHeader rsa; - } u; -}; - -#define PE_CRYPT_INTRO_LEN 8 -#define PE_INTRO_LEN 4 -#define PE_BASE_HEADER_LEN 8 - -#define PRE_BLOCK_SIZE 8 - - -#define GetInt2(c) ((c[0] << 8) | c[1]) -#define GetInt4(c) (((unsigned long)c[0] << 24)|((unsigned long)c[1] << 16)\ - |((unsigned long)c[2] << 8)| ((unsigned long)c[3])) -#define PutInt2(c,i) ((c[1] = (i) & 0xff), (c[0] = ((i) >> 8) & 0xff)) -#define PutInt4(c,i) ((c[0]=((i) >> 24) & 0xff),(c[1]=((i) >> 16) & 0xff),\ - (c[2] = ((i) >> 8) & 0xff), (c[3] = (i) & 0xff)) - -#define PRE_MAGIC 0xc0de -#define PRE_VERSION 0x1010 -#define PRE_FORTEZZA_FILE 0x00ff -#define PRE_FORTEZZA_STREAM 0x00f5 -#define PRE_FORTEZZA_GEN_STREAM 0x00f6 -#define PRE_FIXED_FILE 0x000f -#define PRE_RSA_FILE 0x001f -#define PRE_FIXED_STREAM 0x0005 - -PEHeader *SSL_PreencryptedStreamToFile(PRFileDesc *fd, PEHeader *, - int *headerSize); - -PEHeader *SSL_PreencryptedFileToStream(PRFileDesc *fd, PEHeader *, - int *headerSize); - diff --git a/security/nss/lib/ssl/prelib.c b/security/nss/lib/ssl/prelib.c deleted file mode 100644 index c63483924..000000000 --- a/security/nss/lib/ssl/prelib.c +++ /dev/null @@ -1,67 +0,0 @@ -/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil -*- */ - -/* - * Functions used by https servers to send (download) pre-encrypted files - * over SSL connections that use Fortezza ciphersuites. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "ssl.h" -#include "keyhi.h" -#include "secitem.h" -#include "sslimpl.h" -#include "pkcs11t.h" -#include "preenc.h" -#include "pk11func.h" - -PEHeader *SSL_PreencryptedStreamToFile(PRFileDesc *fd, PEHeader *inHeader, - int *headerSize) -{ - PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); - return NULL; -} - -PEHeader *SSL_PreencryptedFileToStream(PRFileDesc *fd, PEHeader *header, - int *headerSize) -{ - PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); - return NULL; -} - - diff --git a/security/nss/lib/ssl/ssl.def b/security/nss/lib/ssl/ssl.def deleted file mode 100644 index e4d4d1dc0..000000000 --- a/security/nss/lib/ssl/ssl.def +++ /dev/null @@ -1,141 +0,0 @@ -;+# -;+# ***** BEGIN LICENSE BLOCK ***** -;+# Version: MPL 1.1/GPL 2.0/LGPL 2.1 -;+# -;+# The contents of this file are subject to the Mozilla Public License Version -;+# 1.1 (the "License"); you may not use this file except in compliance with -;+# the License. You may obtain a copy of the License at -;+# http://www.mozilla.org/MPL/ -;+# -;+# Software distributed under the License is distributed on an "AS IS" basis, -;+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License -;+# for the specific language governing rights and limitations under the -;+# License. -;+# -;+# The Original Code is the Netscape security libraries. -;+# -;+# The Initial Developer of the Original Code is -;+# Netscape Communications Corporation. -;+# Portions created by the Initial Developer are Copyright (C) 2000 -;+# the Initial Developer. All Rights Reserved. -;+# -;+# Contributor(s): -;+# -;+# Alternatively, the contents of this file may be used under the terms of -;+# either the GNU General Public License Version 2 or later (the "GPL"), or -;+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), -;+# in which case the provisions of the GPL or the LGPL are applicable instead -;+# of those above. If you wish to allow use of your version of this file only -;+# under the terms of either the GPL or the LGPL, and not to allow others to -;+# use your version of this file under the terms of the MPL, indicate your -;+# decision by deleting the provisions above and replace them with the notice -;+# and other provisions required by the GPL or the LGPL. If you do not delete -;+# the provisions above, a recipient may use your version of this file under -;+# the terms of any one of the MPL, the GPL or the LGPL. -;+# -;+# ***** END LICENSE BLOCK ***** -;+# -;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS -;+# 1. For all unix platforms, the string ";-" means "remove this line" -;+# 2. For all unix platforms, the string " DATA " will be removed from any -;+# line on which it occurs. -;+# 3. Lines containing ";+" will have ";+" removed on SUN and LINUX. -;+# On AIX, lines containing ";+" will be removed. -;+# 4. For all unix platforms, the string ";;" will thave the ";;" removed. -;+# 5. For all unix platforms, after the above processing has taken place, -;+# all characters after the first ";" on the line will be removed. -;+# And for AIX, the first ";" will also be removed. -;+# This file is passed directly to windows. Since ';' is a comment, all UNIX -;+# directives are hidden behind ";", ";+", and ";-" -;+ -;+NSS_3.2 { # NSS 3.2 release -;+ global: -LIBRARY ssl3 ;- -EXPORTS ;- -SSL_ImplementedCiphers DATA ; -SSL_NumImplementedCiphers DATA ; -NSS_CmpCertChainWCANames; -NSS_FindCertKEAType; -NSS_GetClientAuthData; -NSS_SetDomesticPolicy; -NSS_SetExportPolicy; -NSS_SetFrancePolicy; -SSL_AuthCertificate; -SSL_AuthCertificateHook; -SSL_BadCertHook; -SSL_CertDBHandleSet; -SSL_CipherPolicyGet; -SSL_CipherPolicySet; -SSL_CipherPrefGet; -SSL_CipherPrefGetDefault; -SSL_CipherPrefSet; -SSL_CipherPrefSetDefault; -SSL_ClearSessionCache; -SSL_ConfigMPServerSIDCache; -SSL_ConfigSecureServer; -SSL_ConfigServerSessionIDCache; -SSL_DataPending; -SSL_ForceHandshake; -SSL_GetClientAuthDataHook; -SSL_GetSessionID; -SSL_GetStatistics; -SSL_HandshakeCallback; -SSL_ImportFD; -SSL_InheritMPServerSIDCache; -SSL_InvalidateSession; -SSL_OptionGet; -SSL_OptionGetDefault; -SSL_OptionSet; -SSL_OptionSetDefault; -SSL_PeerCertificate; -SSL_PreencryptedFileToStream; -SSL_PreencryptedStreamToFile; -SSL_ReHandshake; -SSL_ResetHandshake; -SSL_RestartHandshakeAfterCertReq; -SSL_RestartHandshakeAfterServerCert; -SSL_RevealCert; -SSL_RevealPinArg; -SSL_RevealURL; -SSL_SecurityStatus; -SSL_SetPKCS11PinArg; -SSL_SetSockPeerID; -SSL_SetURL; -;+ local: -;+*; -;+}; -;+NSS_3.2.1 { # NSS 3.2.1 release -;+ global: -NSSSSL_VersionCheck; -;+ local: -;+*; -;+}; -;+NSS_3.4 { # NSS 3.4 release -;+ global: -SSL_GetChannelInfo; -SSL_GetCipherSuiteInfo; -SSL_GetMaxServerCacheLocks; -SSL_LocalCertificate; -SSL_SetMaxServerCacheLocks; -;+ local: -;+*; -;+}; -;+NSS_3.7.4 { # NSS 3.7.4 release -;+ global: -SSL_ShutdownServerSessionIDCache; -;+ local: -;+*; -;+}; -;+NSS_3.11.4 { # NSS 3.11.4 release -;+ global: -SSL_ForceHandshakeWithTimeout; -SSL_ReHandshakeWithTimeout; -;+ local: -;+*; -;+}; -;+NSS_3.11.8 { # NSS 3.11.8 release -;+ global: -SSL_CanBypass; -;+ local: -;+*; -;+}; diff --git a/security/nss/lib/ssl/ssl.h b/security/nss/lib/ssl/ssl.h deleted file mode 100644 index aca8cf8b4..000000000 --- a/security/nss/lib/ssl/ssl.h +++ /dev/null @@ -1,512 +0,0 @@ -/* - * This file contains prototypes for the public SSL functions. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#ifndef __ssl_h_ -#define __ssl_h_ - -#include "prtypes.h" -#include "prerror.h" -#include "prio.h" -#include "seccomon.h" -#include "cert.h" -#include "keyt.h" - -#include "sslt.h" /* public ssl data types */ - -#if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) -#define SSL_IMPORT extern __declspec(dllimport) -#else -#define SSL_IMPORT extern -#endif - -SEC_BEGIN_PROTOS - -/* constant table enumerating all implemented SSL 2 and 3 cipher suites. */ -SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; - -/* number of entries in the above table. */ -SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; - -/* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ -#define SSL_IS_SSL2_CIPHER(which) (((which) & 0xfff0) == 0xff00) - -/* -** Imports fd into SSL, returning a new socket. Copies SSL configuration -** from model. -*/ -SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); - -/* -** Enable/disable an ssl mode -** -** SSL_SECURITY: -** enable/disable use of SSL security protocol before connect -** -** SSL_SOCKS: -** enable/disable use of socks before connect -** (No longer supported). -** -** SSL_REQUEST_CERTIFICATE: -** require a certificate during secure connect -*/ -/* options */ -#define SSL_SECURITY 1 /* (on by default) */ -#define SSL_SOCKS 2 /* (off by default) */ -#define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ -#define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ - /* (off by default) */ -#define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ - /* (off by default) */ -#define SSL_ENABLE_SSL2 7 /* enable ssl v2 (on by default) */ -#define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ -#define SSL_NO_CACHE 9 /* don't use the session cache */ - /* (off by default) */ -#define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ - /* by default) */ -#define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ - /* (off by default) */ -#define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ - /* (on by default) */ -#define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ -#define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ -#define SSL_NO_STEP_DOWN 15 /* Disable export cipher suites */ - /* if step-down keys are needed. */ - /* default: off, generate */ - /* step-down keys if needed. */ -#define SSL_BYPASS_PKCS11 16 /* use PKCS#11 for pub key only */ -#define SSL_NO_LOCKS 17 /* Don't use locks for protection */ -#define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ - /* extension (off by default) */ - -#ifdef SSL_DEPRECATED_FUNCTION -/* Old deprecated function names */ -SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on); -SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on); -#endif - -/* New function names */ -SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on); -SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on); -SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on); -SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on); -SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle); - -/* -** Control ciphers that SSL uses. If on is non-zero then the named cipher -** is enabled, otherwise it is disabled. -** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). -** EnableCipher records user preferences. -** SetPolicy sets the policy according to the policy module. -*/ -#ifdef SSL_DEPRECATED_FUNCTION -/* Old deprecated function names */ -SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); -SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); -#endif - -/* New function names */ -SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled); -SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled); -SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); -SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); -SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); -SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); - -/* Values for "policy" argument to SSL_PolicySet */ -/* Values returned by SSL_CipherPolicyGet. */ -#define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ -#define SSL_ALLOWED 1 -#define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ - -/* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ -#define SSL_REQUIRE_NEVER ((PRBool)0) -#define SSL_REQUIRE_ALWAYS ((PRBool)1) -#define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) -#define SSL_REQUIRE_NO_ERROR ((PRBool)3) - -/* -** Reset the handshake state for fd. This will make the complete SSL -** handshake protocol execute from the ground up on the next i/o -** operation. -*/ -SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); - -/* -** Force the handshake for fd to complete immediately. This blocks until -** the complete SSL handshake protocol is finished. -*/ -SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); - -/* -** Same as above, but with an I/O timeout. - */ -SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, - PRIntervalTime timeout); - -/* -** Query security status of socket. *on is set to one if security is -** enabled. *keySize will contain the stream key size used. *issuer will -** contain the RFC1485 verison of the name of the issuer of the -** certificate at the other end of the connection. For a client, this is -** the issuer of the server's certificate; for a server, this is the -** issuer of the client's certificate (if any). Subject is the subject of -** the other end's certificate. The pointers can be zero if the desired -** data is not needed. All strings returned by this function are owned -** by the caller, and need to be freed with PORT_Free. -*/ -SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, - int *keySize, int *secretKeySize, - char **issuer, char **subject); - -/* Values for "on" */ -#define SSL_SECURITY_STATUS_NOOPT -1 -#define SSL_SECURITY_STATUS_OFF 0 -#define SSL_SECURITY_STATUS_ON_HIGH 1 -#define SSL_SECURITY_STATUS_ON_LOW 2 -#define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ - -/* -** Return the certificate for our SSL peer. If the client calls this -** it will always return the server's certificate. If the server calls -** this, it may return NULL if client authentication is not enabled or -** if the client had no certificate when asked. -** "fd" the socket "file" descriptor -*/ -SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); - -/* -** Authenticate certificate hook. Called when a certificate comes in -** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the -** certificate. -*/ -typedef SECStatus (PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, - PRBool checkSig, - PRBool isServer); - -SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, - SSLAuthCertificate f, - void *arg); - -/* An implementation of the certificate authentication hook */ -SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, - PRBool checkSig, PRBool isServer); - -/* - * Prototype for SSL callback to get client auth data from the application. - * arg - application passed argument - * caNames - pointer to distinguished names of CAs that the server likes - * pRetCert - pointer to pointer to cert, for return of cert - * pRetKey - pointer to key pointer, for return of key - */ -typedef SECStatus (PR_CALLBACK *SSLGetClientAuthData)(void *arg, - PRFileDesc *fd, - CERTDistNames *caNames, - CERTCertificate **pRetCert,/*return */ - SECKEYPrivateKey **pRetKey);/* return */ - -/* - * Set the client side callback for SSL to retrieve user's private key - * and certificate. - * fd - the file descriptor for the connection in question - * f - the application's callback that delivers the key and cert - * a - application specific data - */ -SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, - SSLGetClientAuthData f, void *a); - - -/* - * Set the client side argument for SSL to retrieve PKCS #11 pin. - * fd - the file descriptor for the connection in question - * a - pkcs11 application specific data - */ -SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); - -/* -** This is a callback for dealing with server certs that are not authenticated -** by the client. The client app can decide that it actually likes the -** cert by some external means and restart the connection. -*/ -typedef SECStatus (PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); -SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, - void *arg); - -/* -** Configure ssl for running a secure server. Needs the -** certificate for the server and the servers private key. The arguments -** are copied. -*/ -SSL_IMPORT SECStatus SSL_ConfigSecureServer( - PRFileDesc *fd, CERTCertificate *cert, - SECKEYPrivateKey *key, SSLKEAType kea); - -/* -** Configure a secure servers session-id cache. Define the maximum number -** of entries in the cache, the longevity of the entires, and the directory -** where the cache files will be placed. These values can be zero, and -** if so, the implementation will choose defaults. -** This version of the function is for use in applications that have only one -** process that uses the cache (even if that process has multiple threads). -*/ -SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, - PRUint32 timeout, - PRUint32 ssl3_timeout, - const char * directory); -/* -** Like SSL_ConfigServerSessionIDCache, with one important difference. -** If the application will run multiple processes (as opposed to, or in -** addition to multiple threads), then it must call this function, instead -** of calling SSL_ConfigServerSessionIDCache(). -** This has nothing to do with the number of processORs, only processEs. -** This function sets up a Server Session ID (SID) cache that is safe for -** access by multiple processes on the same system. -*/ -SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, - PRUint32 timeout, - PRUint32 ssl3_timeout, - const char * directory); - -/* Get and set the configured maximum number of mutexes used for the -** server's store of SSL sessions. This value is used by the server -** session ID cache initialization functions shown above. Note that on -** some platforms, these mutexes are actually implemented with POSIX -** semaphores, or with unnamed pipes. The default value varies by platform. -** An attempt to set a too-low maximum will return an error and the -** configured value will not be changed. -*/ -SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); -SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); - -/* environment variable set by SSL_ConfigMPServerSIDCache, and queried by - * SSL_InheritMPServerSIDCache when envString is NULL. - */ -#define SSL_ENV_VAR_NAME "SSL_INHERITANCE" - -/* called in child to inherit SID Cache variables. - * If envString is NULL, this function will use the value of the environment - * variable "SSL_INHERITANCE", otherwise the string value passed in will be - * used. - */ -SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString); - -/* -** Set the callback on a particular socket that gets called when we finish -** performing a handshake. -*/ -typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, - void *client_data); -SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, - SSLHandshakeCallback cb, void *client_data); - -/* -** For the server, request a new handshake. For the client, begin a new -** handshake. If flushCache is non-zero, the SSL3 cache entry will be -** flushed first, ensuring that a full SSL handshake will be done. -** If flushCache is zero, and an SSL connection is established, it will -** do the much faster session restart handshake. This will change the -** session keys without doing another private key operation. -*/ -SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); - -/* -** Same as above, but with an I/O timeout. - */ -SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, - PRBool flushCache, - PRIntervalTime timeout); - - -#ifdef SSL_DEPRECATED_FUNCTION -/* deprecated! -** For the server, request a new handshake. For the client, begin a new -** handshake. Flushes SSL3 session cache entry first, ensuring that a -** full handshake will be done. -** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) -*/ -SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); -#endif - -/* - * Allow the application to pass a URL or hostname into the SSL library - */ -SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); - -/* -** Return the number of bytes that SSL has waiting in internal buffers. -** Return 0 if security is not enabled. -*/ -SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); - -/* -** Invalidate the SSL session associated with fd. -*/ -SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); - -/* -** Return a SECItem containing the SSL session ID associated with the fd. -*/ -SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); - -/* -** Clear out the client's SSL session cache, not the server's session cache. -*/ -SSL_IMPORT void SSL_ClearSessionCache(void); - -/* -** Close the server's SSL session cache. -*/ -SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); - -/* -** Set peer information so we can correctly look up SSL session later. -** You only have to do this if you're tunneling through a proxy. -*/ -SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, char *peerID); - -/* -** Reveal the security information for the peer. -*/ -SSL_IMPORT CERTCertificate * SSL_RevealCert(PRFileDesc * socket); -SSL_IMPORT void * SSL_RevealPinArg(PRFileDesc * socket); -SSL_IMPORT char * SSL_RevealURL(PRFileDesc * socket); - - -/* This callback may be passed to the SSL library via a call to - * SSL_GetClientAuthDataHook() for each SSL client socket. - * It will be invoked when SSL needs to know what certificate and private key - * (if any) to use to respond to a request for client authentication. - * If arg is non-NULL, it is a pointer to a NULL-terminated string containing - * the nickname of the cert/key pair to use. - * If arg is NULL, this function will search the cert and key databases for - * a suitable match and send it if one is found. - */ -SSL_IMPORT SECStatus -NSS_GetClientAuthData(void * arg, - PRFileDesc * socket, - struct CERTDistNamesStr * caNames, - struct CERTCertificateStr ** pRetCert, - struct SECKEYPrivateKeyStr **pRetKey); - -/* - * Look to see if any of the signers in the cert chain for "cert" are found - * in the list of caNames. - * Returns SECSuccess if so, SECFailure if not. - * Used by NSS_GetClientAuthData. May be used by other callback functions. - */ -SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, - CERTDistNames *caNames); - -/* - * Returns key exchange type of the keys in an SSL server certificate. - */ -SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate * cert); - -/* Set cipher policies to a predefined Domestic (U.S.A.) policy. - * This essentially enables all supported ciphers. - */ -SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); - -/* Set cipher policies to a predefined Policy that is exportable from the USA - * according to present U.S. policies as we understand them. - * See documentation for the list. - * Note that your particular application program may be able to obtain - * an export license with more or fewer capabilities than those allowed - * by this function. In that case, you should use SSL_SetPolicy() - * to explicitly allow those ciphers you may legally export. - */ -SSL_IMPORT SECStatus NSS_SetExportPolicy(void); - -/* Set cipher policies to a predefined Policy that is exportable from the USA - * according to present U.S. policies as we understand them, and that the - * nation of France will permit to be imported into their country. - * See documentation for the list. - */ -SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); - -SSL_IMPORT SSL3Statistics * SSL_GetStatistics(void); - -/* Report more information than SSL_SecurityStatus. -** Caller supplies the info struct. Function fills it in. -*/ -SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, - PRUintn len); -SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, - SSLCipherSuiteInfo *info, PRUintn len); - -/* -** Return a new reference to the certificate that was most recently sent -** to the peer on this SSL/TLS connection, or NULL if none has been sent. -*/ -SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd); - -/* Test an SSL configuration to see if SSL_BYPASS_PKCS11 can be turned on. -** Check the key exchange algorithm for each cipher in the list to see if -** a master secret key can be extracted after being derived with the mechanism -** required by the protocolmask argument. If the KEA will use keys from the -** specified cert make sure the extract operation is attempted from the slot -** where the private key resides. -** If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and -** SECSuccess is returned. In all other cases but one (*pcanbypass) is -** set to FALSE and SECFailure is returned. -** In that last case Derive() has been called successfully but the MS is null, -** CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the -** arguments were all valid but the slot cannot be bypassed. -** -** Note: A TRUE return code from CanBypass means "Your configuration will perform -** NO WORSE with the bypass enabled than without"; it does NOT mean that every -** cipher suite listed will work properly with the selected protocols. -** -** Caveat: If export cipher suites are included in the argument list Canbypass -** will return FALSE. -**/ - -/* protocol mask bits */ -#define SSL_CBP_SSL3 0x0001 /* test SSL v3 mechanisms */ -#define SSL_CBP_TLS1_0 0x0002 /* test TLS v1.0 mechanisms */ - -SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, - SECKEYPrivateKey *privKey, - PRUint32 protocolmask, - PRUint16 *ciphers, int nciphers, - PRBool *pcanbypass, void *pwArg); - -SEC_END_PROTOS - -#endif /* __ssl_h_ */ diff --git a/security/nss/lib/ssl/ssl.rc b/security/nss/lib/ssl/ssl.rc deleted file mode 100644 index b7d827de7..000000000 --- a/security/nss/lib/ssl/ssl.rc +++ /dev/null @@ -1,100 +0,0 @@ -/* ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 2001 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ - -#include "nss.h" -#include <winver.h> - -#define MY_LIBNAME "ssl" -#define MY_FILEDESCRIPTION "NSS SSL Library" - -#define STRINGIZE(x) #x -#define STRINGIZE2(x) STRINGIZE(x) -#define NSS_VMAJOR_STR STRINGIZE2(NSS_VMAJOR) - -#ifdef _DEBUG -#define MY_DEBUG_STR " (debug)" -#define MY_FILEFLAGS_1 VS_FF_DEBUG -#else -#define MY_DEBUG_STR "" -#define MY_FILEFLAGS_1 0x0L -#endif -#if NSS_BETA -#define MY_FILEFLAGS_2 MY_FILEFLAGS_1|VS_FF_PRERELEASE -#else -#define MY_FILEFLAGS_2 MY_FILEFLAGS_1 -#endif - -#ifdef WINNT -#define MY_FILEOS VOS_NT_WINDOWS32 -#else -#define MY_FILEOS VOS__WINDOWS32 -#endif - -#define MY_INTERNAL_NAME MY_LIBNAME NSS_VMAJOR_STR - -///////////////////////////////////////////////////////////////////////////// -// -// Version-information resource -// - -VS_VERSION_INFO VERSIONINFO - FILEVERSION NSS_VMAJOR,NSS_VMINOR,NSS_VPATCH,0 - PRODUCTVERSION NSS_VMAJOR,NSS_VMINOR,NSS_VPATCH,0 - FILEFLAGSMASK VS_FFI_FILEFLAGSMASK - FILEFLAGS MY_FILEFLAGS_2 - FILEOS MY_FILEOS - FILETYPE VFT_DLL - FILESUBTYPE 0x0L // not used - -BEGIN - BLOCK "StringFileInfo" - BEGIN - BLOCK "040904B0" // Lang=US English, CharSet=Unicode - BEGIN - VALUE "CompanyName", "Mozilla Foundation\0" - VALUE "FileDescription", MY_FILEDESCRIPTION MY_DEBUG_STR "\0" - VALUE "FileVersion", NSS_VERSION "\0" - VALUE "InternalName", MY_INTERNAL_NAME "\0" - VALUE "OriginalFilename", MY_INTERNAL_NAME ".dll\0" - VALUE "ProductName", "Network Security Services\0" - VALUE "ProductVersion", NSS_VERSION "\0" - END - END - BLOCK "VarFileInfo" - BEGIN - VALUE "Translation", 0x409, 1200 - END -END diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c deleted file mode 100644 index da6427deb..000000000 --- a/security/nss/lib/ssl/ssl3con.c +++ /dev/null @@ -1,8764 +0,0 @@ -/* - * SSL3 Protocol - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Stephen Henson <stephen.henson@gemplus.com> - * Dr Vipul Gupta <vipul.gupta@sun.com> and - * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "ssl.h" -#include "cryptohi.h" /* for DSAU_ stuff */ -#include "keyhi.h" -#include "secder.h" -#include "secitem.h" - -#include "sslimpl.h" -#include "sslproto.h" -#include "sslerr.h" -#include "prtime.h" -#include "prinrval.h" -#include "prerror.h" -#include "pratom.h" -#include "prthread.h" - -#include "pk11func.h" -#include "secmod.h" -#include "blapi.h" - -#include <stdio.h> - -#ifndef PK11_SETATTRS -#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \ - (x)->pValue=(v); (x)->ulValueLen = (l); -#endif - -static void ssl3_CleanupPeerCerts(sslSocket *ss); -static PK11SymKey *ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec, - PK11SlotInfo * serverKeySlot); -static SECStatus ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms); -static SECStatus ssl3_DeriveConnectionKeysPKCS11(sslSocket *ss); -static SECStatus ssl3_HandshakeFailure( sslSocket *ss); -static SECStatus ssl3_InitState( sslSocket *ss); -static SECStatus ssl3_SendCertificate( sslSocket *ss); -static SECStatus ssl3_SendEmptyCertificate( sslSocket *ss); -static SECStatus ssl3_SendCertificateRequest(sslSocket *ss); -static SECStatus ssl3_SendFinished( sslSocket *ss, PRInt32 flags); -static SECStatus ssl3_SendServerHello( sslSocket *ss); -static SECStatus ssl3_SendServerHelloDone( sslSocket *ss); -static SECStatus ssl3_SendServerKeyExchange( sslSocket *ss); -static SECStatus ssl3_NewHandshakeHashes( sslSocket *ss); -static SECStatus ssl3_UpdateHandshakeHashes( sslSocket *ss, unsigned char *b, - unsigned int l); - -static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen, - int maxOutputLen, const unsigned char *input, - int inputLen); - -#define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */ -#define MIN_SEND_BUF_LENGTH 4000 - -#define MAX_CIPHER_SUITES 20 - -/* This list of SSL3 cipher suites is sorted in descending order of - * precedence (desirability). It only includes cipher suites we implement. - * This table is modified by SSL3_SetPolicy(). The ordering of cipher suites - * in this table must match the ordering in SSL_ImplementedCiphers (sslenum.c) - */ -static ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED] = { - /* cipher_suite policy enabled is_present*/ -#ifdef NSS_ENABLE_ECC - { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#ifdef NSS_ENABLE_ECC - { TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - -#ifdef NSS_ENABLE_ECC - { TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#ifdef NSS_ENABLE_ECC - { TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { TLS_RSA_WITH_SEED_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { SSL_RSA_WITH_RC4_128_MD5, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_RSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - -#ifdef NSS_ENABLE_ECC - { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#ifdef NSS_ENABLE_ECC - { TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - - - { SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - - { SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - -#ifdef NSS_ENABLE_ECC - { TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_ECDH_RSA_WITH_NULL_SHA, SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ - { SSL_RSA_WITH_NULL_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - { SSL_RSA_WITH_NULL_MD5, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, - -}; - -static const /*SSL3CompressionMethod*/ uint8 compressions [] = { - compression_null -}; - -static const int compressionMethodsCount = - sizeof(compressions) / sizeof(compressions[0]); - -static const /*SSL3ClientCertificateType */ uint8 certificate_types [] = { - ct_RSA_sign, - ct_DSS_sign, -#ifdef NSS_ENABLE_ECC - ct_ECDSA_sign, -#endif /* NSS_ENABLE_ECC */ -}; - - -/* - * make sure there is room in the write buffer for padding and - * other compression and cryptographic expansions - */ -#define SSL3_BUFFER_FUDGE 100 - -#define EXPORT_RSA_KEY_LENGTH 64 /* bytes */ - - -/* This is a hack to make sure we don't do double handshakes for US policy */ -PRBool ssl3_global_policy_some_restricted = PR_FALSE; - -/* This global item is used only in servers. It is is initialized by -** SSL_ConfigSecureServer(), and is used in ssl3_SendCertificateRequest(). -*/ -CERTDistNames *ssl3_server_ca_list = NULL; -static SSL3Statistics ssl3stats; - -/* indexed by SSL3BulkCipher */ -static const ssl3BulkCipherDef bulk_cipher_defs[] = { - /* cipher calg keySz secretSz type ivSz BlkSz keygen */ - {cipher_null, calg_null, 0, 0, type_stream, 0, 0, kg_null}, - {cipher_rc4, calg_rc4, 16, 16, type_stream, 0, 0, kg_strong}, - {cipher_rc4_40, calg_rc4, 16, 5, type_stream, 0, 0, kg_export}, - {cipher_rc4_56, calg_rc4, 16, 7, type_stream, 0, 0, kg_export}, - {cipher_rc2, calg_rc2, 16, 16, type_block, 8, 8, kg_strong}, - {cipher_rc2_40, calg_rc2, 16, 5, type_block, 8, 8, kg_export}, - {cipher_des, calg_des, 8, 8, type_block, 8, 8, kg_strong}, - {cipher_3des, calg_3des, 24, 24, type_block, 8, 8, kg_strong}, - {cipher_des40, calg_des, 8, 5, type_block, 8, 8, kg_export}, - {cipher_idea, calg_idea, 16, 16, type_block, 8, 8, kg_strong}, - {cipher_aes_128, calg_aes, 16, 16, type_block, 16,16, kg_strong}, - {cipher_aes_256, calg_aes, 32, 32, type_block, 16,16, kg_strong}, - {cipher_camellia_128, calg_camellia,16, 16, type_block, 16,16, kg_strong}, - {cipher_camellia_256, calg_camellia,32, 32, type_block, 16,16, kg_strong}, - {cipher_seed, calg_seed, 16, 16, type_block, 16,16, kg_strong}, - {cipher_missing, calg_null, 0, 0, type_stream, 0, 0, kg_null}, -}; - -static const ssl3KEADef kea_defs[] = -{ /* indexed by SSL3KeyExchangeAlgorithm */ - /* kea exchKeyType signKeyType is_limited limit tls_keygen */ - {kea_null, kt_null, sign_null, PR_FALSE, 0, PR_FALSE}, - {kea_rsa, kt_rsa, sign_rsa, PR_FALSE, 0, PR_FALSE}, - {kea_rsa_export, kt_rsa, sign_rsa, PR_TRUE, 512, PR_FALSE}, - {kea_rsa_export_1024,kt_rsa, sign_rsa, PR_TRUE, 1024, PR_FALSE}, - {kea_dh_dss, kt_dh, sign_dsa, PR_FALSE, 0, PR_FALSE}, - {kea_dh_dss_export, kt_dh, sign_dsa, PR_TRUE, 512, PR_FALSE}, - {kea_dh_rsa, kt_dh, sign_rsa, PR_FALSE, 0, PR_FALSE}, - {kea_dh_rsa_export, kt_dh, sign_rsa, PR_TRUE, 512, PR_FALSE}, - {kea_dhe_dss, kt_dh, sign_dsa, PR_FALSE, 0, PR_FALSE}, - {kea_dhe_dss_export, kt_dh, sign_dsa, PR_TRUE, 512, PR_FALSE}, - {kea_dhe_rsa, kt_dh, sign_rsa, PR_FALSE, 0, PR_FALSE}, - {kea_dhe_rsa_export, kt_dh, sign_rsa, PR_TRUE, 512, PR_FALSE}, - {kea_dh_anon, kt_dh, sign_null, PR_FALSE, 0, PR_FALSE}, - {kea_dh_anon_export, kt_dh, sign_null, PR_TRUE, 512, PR_FALSE}, - {kea_rsa_fips, kt_rsa, sign_rsa, PR_FALSE, 0, PR_TRUE }, -#ifdef NSS_ENABLE_ECC - {kea_ecdh_ecdsa, kt_ecdh, sign_ecdsa, PR_FALSE, 0, PR_FALSE}, - {kea_ecdhe_ecdsa, kt_ecdh, sign_ecdsa, PR_FALSE, 0, PR_FALSE}, - {kea_ecdh_rsa, kt_ecdh, sign_rsa, PR_FALSE, 0, PR_FALSE}, - {kea_ecdhe_rsa, kt_ecdh, sign_rsa, PR_FALSE, 0, PR_FALSE}, - {kea_ecdh_anon, kt_ecdh, sign_null, PR_FALSE, 0, PR_FALSE}, -#endif /* NSS_ENABLE_ECC */ -}; - -/* must use ssl_LookupCipherSuiteDef to access */ -static const ssl3CipherSuiteDef cipher_suite_defs[] = -{ -/* cipher_suite bulk_cipher_alg mac_alg key_exchange_alg */ - - {SSL_NULL_WITH_NULL_NULL, cipher_null, mac_null, kea_null}, - {SSL_RSA_WITH_NULL_MD5, cipher_null, mac_md5, kea_rsa}, - {SSL_RSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_rsa}, - {SSL_RSA_EXPORT_WITH_RC4_40_MD5,cipher_rc4_40, mac_md5, kea_rsa_export}, - {SSL_RSA_WITH_RC4_128_MD5, cipher_rc4, mac_md5, kea_rsa}, - {SSL_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_rsa}, - {SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, - cipher_rc2_40, mac_md5, kea_rsa_export}, -#if 0 /* not implemented */ - {SSL_RSA_WITH_IDEA_CBC_SHA, cipher_idea, mac_sha, kea_rsa}, - {SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, - cipher_des40, mac_sha, kea_rsa_export}, -#endif - {SSL_RSA_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_rsa}, - {SSL_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_rsa}, - {SSL_DHE_DSS_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_dhe_dss}, - {SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, - cipher_3des, mac_sha, kea_dhe_dss}, - {TLS_DHE_DSS_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_dhe_dss}, -#if 0 /* not implemented */ - {SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA, - cipher_des40, mac_sha, kea_dh_dss_export}, - {SSL_DH_DSS_DES_CBC_SHA, cipher_des, mac_sha, kea_dh_dss}, - {SSL_DH_DSS_3DES_CBC_SHA, cipher_3des, mac_sha, kea_dh_dss}, - {SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA, - cipher_des40, mac_sha, kea_dh_rsa_export}, - {SSL_DH_RSA_DES_CBC_SHA, cipher_des, mac_sha, kea_dh_rsa}, - {SSL_DH_RSA_3DES_CBC_SHA, cipher_3des, mac_sha, kea_dh_rsa}, - {SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, - cipher_des40, mac_sha, kea_dh_dss_export}, - {SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, - cipher_des40, mac_sha, kea_dh_rsa_export}, -#endif - {SSL_DHE_RSA_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_dhe_rsa}, - {SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, - cipher_3des, mac_sha, kea_dhe_rsa}, -#if 0 - {SSL_DH_ANON_EXPORT_RC4_40_MD5, cipher_rc4_40, mac_md5, kea_dh_anon_export}, - {SSL_DH_ANON_EXPORT_RC4_40_MD5, cipher_rc4, mac_md5, kea_dh_anon_export}, - {SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA, - cipher_des40, mac_sha, kea_dh_anon_export}, - {SSL_DH_ANON_DES_CBC_SHA, cipher_des, mac_sha, kea_dh_anon}, - {SSL_DH_ANON_3DES_CBC_SHA, cipher_3des, mac_sha, kea_dh_anon}, -#endif - - -/* New TLS cipher suites */ - {TLS_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_rsa}, - {TLS_DHE_DSS_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dhe_dss}, - {TLS_DHE_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dhe_rsa}, - {TLS_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_rsa}, - {TLS_DHE_DSS_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dhe_dss}, - {TLS_DHE_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dhe_rsa}, -#if 0 - {TLS_DH_DSS_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dh_dss}, - {TLS_DH_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dh_rsa}, - {TLS_DH_ANON_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dh_anon}, - {TLS_DH_DSS_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dh_dss}, - {TLS_DH_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dh_rsa}, - {TLS_DH_ANON_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dh_anon}, -#endif - - {TLS_RSA_WITH_SEED_CBC_SHA, cipher_seed, mac_sha, kea_rsa}, - - {TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, cipher_camellia_128, mac_sha, kea_rsa}, - {TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, - cipher_camellia_128, mac_sha, kea_dhe_dss}, - {TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, - cipher_camellia_128, mac_sha, kea_dhe_rsa}, - {TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, cipher_camellia_256, mac_sha, kea_rsa}, - {TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, - cipher_camellia_256, mac_sha, kea_dhe_dss}, - {TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, - cipher_camellia_256, mac_sha, kea_dhe_rsa}, - - {TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, - cipher_des, mac_sha,kea_rsa_export_1024}, - {TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, - cipher_rc4_56, mac_sha,kea_rsa_export_1024}, - - {SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_rsa_fips}, - {SSL_RSA_FIPS_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_rsa_fips}, - -#ifdef NSS_ENABLE_ECC - {TLS_ECDH_ECDSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdh_ecdsa}, - {TLS_ECDH_ECDSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdh_ecdsa}, - {TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_ecdsa}, - {TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_ecdsa}, - {TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_ecdsa}, - - {TLS_ECDHE_ECDSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdhe_ecdsa}, - {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdhe_ecdsa}, - {TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdhe_ecdsa}, - {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdhe_ecdsa}, - {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdhe_ecdsa}, - - {TLS_ECDH_RSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdh_rsa}, - {TLS_ECDH_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdh_rsa}, - {TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_rsa}, - {TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_rsa}, - {TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_rsa}, - - {TLS_ECDHE_RSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdhe_rsa}, - {TLS_ECDHE_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdhe_rsa}, - {TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdhe_rsa}, - {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdhe_rsa}, - {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdhe_rsa}, - -#if 0 - {TLS_ECDH_anon_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdh_anon}, - {TLS_ECDH_anon_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdh_anon}, - {TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_anon}, - {TLS_ECDH_anon_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_anon}, - {TLS_ECDH_anon_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_anon}, -#endif -#endif /* NSS_ENABLE_ECC */ -}; - -static const CK_MECHANISM_TYPE kea_alg_defs[] = { - 0x80000000L, - CKM_RSA_PKCS, - CKM_DH_PKCS_DERIVE, - CKM_KEA_KEY_DERIVE, - CKM_ECDH1_DERIVE -}; - -typedef struct SSLCipher2MechStr { - SSLCipherAlgorithm calg; - CK_MECHANISM_TYPE cmech; -} SSLCipher2Mech; - -/* indexed by type SSLCipherAlgorithm */ -static const SSLCipher2Mech alg2Mech[] = { - /* calg, cmech */ - { calg_null , (CK_MECHANISM_TYPE)0x80000000L }, - { calg_rc4 , CKM_RC4 }, - { calg_rc2 , CKM_RC2_CBC }, - { calg_des , CKM_DES_CBC }, - { calg_3des , CKM_DES3_CBC }, - { calg_idea , CKM_IDEA_CBC }, - { calg_fortezza , CKM_SKIPJACK_CBC64 }, - { calg_aes , CKM_AES_CBC }, - { calg_camellia , CKM_CAMELLIA_CBC }, - { calg_seed , CKM_SEED_CBC }, -/* { calg_init , (CK_MECHANISM_TYPE)0x7fffffffL } */ -}; - -#define mmech_null (CK_MECHANISM_TYPE)0x80000000L -#define mmech_md5 CKM_SSL3_MD5_MAC -#define mmech_sha CKM_SSL3_SHA1_MAC -#define mmech_md5_hmac CKM_MD5_HMAC -#define mmech_sha_hmac CKM_SHA_1_HMAC - -static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */ - /* mac mmech pad_size mac_size */ - { mac_null, mmech_null, 0, 0 }, - { mac_md5, mmech_md5, 48, MD5_LENGTH }, - { mac_sha, mmech_sha, 40, SHA1_LENGTH}, - {hmac_md5, mmech_md5_hmac, 48, MD5_LENGTH }, - {hmac_sha, mmech_sha_hmac, 40, SHA1_LENGTH}, -}; - -/* indexed by SSL3BulkCipher */ -const char * const ssl3_cipherName[] = { - "NULL", - "RC4", - "RC4-40", - "RC4-56", - "RC2-CBC", - "RC2-CBC-40", - "DES-CBC", - "3DES-EDE-CBC", - "DES-CBC-40", - "IDEA-CBC", - "AES-128", - "AES-256", - "Camellia-128", - "Camellia-256", - "SEED-CBC", - "missing" -}; - -#ifdef NSS_ENABLE_ECC -/* The ECCWrappedKeyInfo structure defines how various pieces of - * information are laid out within wrappedSymmetricWrappingkey - * for ECDH key exchange. Since wrappedSymmetricWrappingkey is - * a 512-byte buffer (see sslimpl.h), the variable length field - * in ECCWrappedKeyInfo can be at most (512 - 8) = 504 bytes. - * - * XXX For now, NSS only supports named elliptic curves of size 571 bits - * or smaller. The public value will fit within 145 bytes and EC params - * will fit within 12 bytes. We'll need to revisit this when NSS - * supports arbitrary curves. - */ -#define MAX_EC_WRAPPED_KEY_BUFLEN 504 - -typedef struct ECCWrappedKeyInfoStr { - PRUint16 size; /* EC public key size in bits */ - PRUint16 encodedParamLen; /* length (in bytes) of DER encoded EC params */ - PRUint16 pubValueLen; /* length (in bytes) of EC public value */ - PRUint16 wrappedKeyLen; /* length (in bytes) of the wrapped key */ - PRUint8 var[MAX_EC_WRAPPED_KEY_BUFLEN]; /* this buffer contains the */ - /* EC public-key params, the EC public value and the wrapped key */ -} ECCWrappedKeyInfo; -#endif /* NSS_ENABLE_ECC */ - -#if defined(TRACE) - -static char * -ssl3_DecodeHandshakeType(int msgType) -{ - char * rv; - static char line[40]; - - switch(msgType) { - case hello_request: rv = "hello_request (0)"; break; - case client_hello: rv = "client_hello (1)"; break; - case server_hello: rv = "server_hello (2)"; break; - case certificate: rv = "certificate (11)"; break; - case server_key_exchange: rv = "server_key_exchange (12)"; break; - case certificate_request: rv = "certificate_request (13)"; break; - case server_hello_done: rv = "server_hello_done (14)"; break; - case certificate_verify: rv = "certificate_verify (15)"; break; - case client_key_exchange: rv = "client_key_exchange (16)"; break; - case finished: rv = "finished (20)"; break; - default: - sprintf(line, "*UNKNOWN* handshake type! (%d)", msgType); - rv = line; - } - return rv; -} - -static char * -ssl3_DecodeContentType(int msgType) -{ - char * rv; - static char line[40]; - - switch(msgType) { - case content_change_cipher_spec: - rv = "change_cipher_spec (20)"; break; - case content_alert: rv = "alert (21)"; break; - case content_handshake: rv = "handshake (22)"; break; - case content_application_data: - rv = "application_data (23)"; break; - default: - sprintf(line, "*UNKNOWN* record type! (%d)", msgType); - rv = line; - } - return rv; -} - -#endif - -SSL3Statistics * -SSL_GetStatistics(void) -{ - return &ssl3stats; -} - -typedef struct tooLongStr { -#if defined(IS_LITTLE_ENDIAN) - PRInt32 low; - PRInt32 high; -#else - PRInt32 high; - PRInt32 low; -#endif -} tooLong; - -void SSL_AtomicIncrementLong(long * x) -{ - if ((sizeof *x) == sizeof(PRInt32)) { - PR_AtomicIncrement((PRInt32 *)x); - } else { - tooLong * tl = (tooLong *)x; - if (PR_AtomicIncrement(&tl->low) == 0) - PR_AtomicIncrement(&tl->high); - } -} - -/* return pointer to ssl3CipherSuiteDef for suite, or NULL */ -/* XXX This does a linear search. A binary search would be better. */ -static const ssl3CipherSuiteDef * -ssl_LookupCipherSuiteDef(ssl3CipherSuite suite) -{ - int cipher_suite_def_len = - sizeof(cipher_suite_defs) / sizeof(cipher_suite_defs[0]); - int i; - - for (i = 0; i < cipher_suite_def_len; i++) { - if (cipher_suite_defs[i].cipher_suite == suite) - return &cipher_suite_defs[i]; - } - PORT_Assert(PR_FALSE); /* We should never get here. */ - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - return NULL; -} - -/* Find the cipher configuration struct associate with suite */ -/* XXX This does a linear search. A binary search would be better. */ -static ssl3CipherSuiteCfg * -ssl_LookupCipherSuiteCfg(ssl3CipherSuite suite, ssl3CipherSuiteCfg *suites) -{ - int i; - - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - if (suites[i].cipher_suite == suite) - return &suites[i]; - } - /* return NULL and let the caller handle it. */ - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - return NULL; -} - - -/* Initialize the suite->isPresent value for config_match - * Returns count of enabled ciphers supported by extant tokens, - * regardless of policy or user preference. - * If this returns zero, the user cannot do SSL v3. - */ -int -ssl3_config_match_init(sslSocket *ss) -{ - ssl3CipherSuiteCfg * suite; - const ssl3CipherSuiteDef *cipher_def; - SSLCipherAlgorithm cipher_alg; - CK_MECHANISM_TYPE cipher_mech; - SSL3KEAType exchKeyType; - int i; - int numPresent = 0; - int numEnabled = 0; - PRBool isServer; - sslServerCerts *svrAuth; - - PORT_Assert(ss); - if (!ss) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return 0; - } - if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) { - return 0; - } - isServer = (PRBool)(ss->sec.isServer != 0); - - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - suite = &ss->cipherSuites[i]; - if (suite->enabled) { - ++numEnabled; - /* We need the cipher defs to see if we have a token that can handle - * this cipher. It isn't part of the static definition. - */ - cipher_def = ssl_LookupCipherSuiteDef(suite->cipher_suite); - if (!cipher_def) { - suite->isPresent = PR_FALSE; - continue; - } - cipher_alg=bulk_cipher_defs[cipher_def->bulk_cipher_alg ].calg; - PORT_Assert( alg2Mech[cipher_alg].calg == cipher_alg); - cipher_mech = alg2Mech[cipher_alg].cmech; - exchKeyType = - kea_defs[cipher_def->key_exchange_alg].exchKeyType; -#ifndef NSS_ENABLE_ECC - svrAuth = ss->serverCerts + exchKeyType; -#else - /* XXX SSLKEAType isn't really a good choice for - * indexing certificates. It doesn't work for - * (EC)DHE-* ciphers. Here we use a hack to ensure - * that the server uses an RSA cert for (EC)DHE-RSA. - */ - switch (cipher_def->key_exchange_alg) { - case kea_ecdhe_rsa: -#if NSS_SERVER_DHE_IMPLEMENTED - /* XXX NSS does not yet implement the server side of _DHE_ - * cipher suites. Correcting the computation for svrAuth, - * as the case below does, causes NSS SSL servers to begin to - * negotiate cipher suites they do not implement. So, until - * server side _DHE_ is implemented, keep this disabled. - */ - case kea_dhe_rsa: -#endif - svrAuth = ss->serverCerts + kt_rsa; - break; - case kea_ecdh_ecdsa: - case kea_ecdh_rsa: - /* - * XXX We ought to have different indices for - * ECDSA- and RSA-signed EC certificates so - * we could support both key exchange mechanisms - * simultaneously. For now, both of them use - * whatever is in the certificate slot for kt_ecdh - */ - default: - svrAuth = ss->serverCerts + exchKeyType; - break; - } -#endif /* NSS_ENABLE_ECC */ - - /* Mark the suites that are backed by real tokens, certs and keys */ - suite->isPresent = (PRBool) - (((exchKeyType == kt_null) || - ((!isServer || (svrAuth->serverKeyPair && - svrAuth->SERVERKEY && - svrAuth->serverCertChain)) && - PK11_TokenExists(kea_alg_defs[exchKeyType]))) && - ((cipher_alg == calg_null) || PK11_TokenExists(cipher_mech))); - if (suite->isPresent) - ++numPresent; - } - } - PORT_Assert(numPresent > 0 || numEnabled == 0); - if (numPresent <= 0) { - PORT_SetError(SSL_ERROR_NO_CIPHERS_SUPPORTED); - } - return numPresent; -} - - -/* return PR_TRUE if suite matches policy and enabled state */ -/* It would be a REALLY BAD THING (tm) if we ever permitted the use -** of a cipher that was NOT_ALLOWED. So, if this is ever called with -** policy == SSL_NOT_ALLOWED, report no match. -*/ -/* adjust suite enabled to the availability of a token that can do the - * cipher suite. */ -static PRBool -config_match(ssl3CipherSuiteCfg *suite, int policy, PRBool enabled) -{ - PORT_Assert(policy != SSL_NOT_ALLOWED && enabled != PR_FALSE); - if (policy == SSL_NOT_ALLOWED || !enabled) - return PR_FALSE; - return (PRBool)(suite->enabled && - suite->isPresent && - suite->policy != SSL_NOT_ALLOWED && - suite->policy <= policy); -} - -/* return number of cipher suites that match policy and enabled state */ -/* called from ssl3_SendClientHello and ssl3_ConstructV2CipherSpecsHack */ -static int -count_cipher_suites(sslSocket *ss, int policy, PRBool enabled) -{ - int i, count = 0; - - if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) { - return 0; - } - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - if (config_match(&ss->cipherSuites[i], policy, enabled)) - count++; - } - if (count <= 0) { - PORT_SetError(SSL_ERROR_SSL_DISABLED); - } - return count; -} - -static PRBool -anyRestrictedEnabled(sslSocket *ss) -{ - int i; - - if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) { - return PR_FALSE; - } - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i]; - if (suite->policy == SSL_RESTRICTED && - suite->enabled && - suite->isPresent) - return PR_TRUE; - } - return PR_FALSE; -} - -/* - * Null compression, mac and encryption functions - */ - -static SECStatus -Null_Cipher(void *ctx, unsigned char *output, int *outputLen, int maxOutputLen, - const unsigned char *input, int inputLen) -{ - *outputLen = inputLen; - if (input != output) - PORT_Memcpy(output, input, inputLen); - return SECSuccess; -} - -/* - * SSL3 Utility functions - */ - -SECStatus -ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion) -{ - SSL3ProtocolVersion version; - SSL3ProtocolVersion maxVersion; - - if (ss->opt.enableTLS) { - maxVersion = SSL_LIBRARY_VERSION_3_1_TLS; - } else if (ss->opt.enableSSL3) { - maxVersion = SSL_LIBRARY_VERSION_3_0; - } else { - /* what are we doing here? */ - PORT_Assert(ss->opt.enableSSL3 || ss->opt.enableTLS); - PORT_SetError(SSL_ERROR_SSL_DISABLED); - return SECFailure; - } - - ss->version = version = PR_MIN(maxVersion, peerVersion); - - if ((version == SSL_LIBRARY_VERSION_3_1_TLS && ss->opt.enableTLS) || - (version == SSL_LIBRARY_VERSION_3_0 && ss->opt.enableSSL3)) { - return SECSuccess; - } - - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return SECFailure; - -} - -static SECStatus -ssl3_GetNewRandom(SSL3Random *random) -{ - PRUint32 gmt = ssl_Time(); - SECStatus rv; - - random->rand[0] = (unsigned char)(gmt >> 24); - random->rand[1] = (unsigned char)(gmt >> 16); - random->rand[2] = (unsigned char)(gmt >> 8); - random->rand[3] = (unsigned char)(gmt); - - /* first 4 bytes are reserverd for time */ - rv = PK11_GenerateRandom(&random->rand[4], SSL3_RANDOM_LENGTH - 4); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE); - } - return rv; -} - -/* Called by ssl3_SendServerKeyExchange and ssl3_SendCertificateVerify */ -SECStatus -ssl3_SignHashes(SSL3Hashes *hash, SECKEYPrivateKey *key, SECItem *buf, - PRBool isTLS) -{ - SECStatus rv = SECFailure; - PRBool doDerEncode = PR_FALSE; - int signatureLen; - SECItem hashItem; - - buf->data = NULL; - signatureLen = PK11_SignatureLen(key); - if (signatureLen <= 0) { - PORT_SetError(SEC_ERROR_INVALID_KEY); - goto done; - } - - buf->len = (unsigned)signatureLen; - buf->data = (unsigned char *)PORT_Alloc(signatureLen); - if (!buf->data) - goto done; /* error code was set. */ - - switch (key->keyType) { - case rsaKey: - hashItem.data = hash->md5; - hashItem.len = sizeof(SSL3Hashes); - break; - case dsaKey: - doDerEncode = isTLS; - hashItem.data = hash->sha; - hashItem.len = sizeof(hash->sha); - break; -#ifdef NSS_ENABLE_ECC - case ecKey: - doDerEncode = PR_TRUE; - hashItem.data = hash->sha; - hashItem.len = sizeof(hash->sha); - break; -#endif /* NSS_ENABLE_ECC */ - default: - PORT_SetError(SEC_ERROR_INVALID_KEY); - goto done; - } - PRINT_BUF(60, (NULL, "hash(es) to be signed", hashItem.data, hashItem.len)); - - rv = PK11_Sign(key, buf, &hashItem); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE); - } else if (doDerEncode) { - SECItem derSig = {siBuffer, NULL, 0}; - - /* This also works for an ECDSA signature */ - rv = DSAU_EncodeDerSigWithLen(&derSig, buf, buf->len); - if (rv == SECSuccess) { - PORT_Free(buf->data); /* discard unencoded signature. */ - *buf = derSig; /* give caller encoded signature. */ - } else if (derSig.data) { - PORT_Free(derSig.data); - } - } - - PRINT_BUF(60, (NULL, "signed hashes", (unsigned char*)buf->data, buf->len)); -done: - if (rv != SECSuccess && buf->data) { - PORT_Free(buf->data); - buf->data = NULL; - } - return rv; -} - -/* Called from ssl3_HandleServerKeyExchange, ssl3_HandleCertificateVerify */ -SECStatus -ssl3_VerifySignedHashes(SSL3Hashes *hash, CERTCertificate *cert, - SECItem *buf, PRBool isTLS, void *pwArg) -{ - SECKEYPublicKey * key; - SECItem * signature = NULL; - SECStatus rv; - SECItem hashItem; -#ifdef NSS_ENABLE_ECC - unsigned int len; -#endif /* NSS_ENABLE_ECC */ - - - PRINT_BUF(60, (NULL, "check signed hashes", - buf->data, buf->len)); - - key = CERT_ExtractPublicKey(cert); - if (key == NULL) { - /* CERT_ExtractPublicKey doesn't set error code */ - PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE); - return SECFailure; - } - - switch (key->keyType) { - case rsaKey: - hashItem.data = hash->md5; - hashItem.len = sizeof(SSL3Hashes); - break; - case dsaKey: - hashItem.data = hash->sha; - hashItem.len = sizeof(hash->sha); - /* Allow DER encoded DSA signatures in SSL 3.0 */ - if (isTLS || buf->len != DSA_SIGNATURE_LEN) { - signature = DSAU_DecodeDerSig(buf); - if (!signature) { - PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); - return SECFailure; - } - buf = signature; - } - break; - -#ifdef NSS_ENABLE_ECC - case ecKey: - hashItem.data = hash->sha; - hashItem.len = sizeof(hash->sha); - /* - * ECDSA signatures always encode the integers r and s - * using ASN (unlike DSA where ASN encoding is used - * with TLS but not with SSL3) - */ - len = SECKEY_SignatureLen(key); - if (len == 0) { - SECKEY_DestroyPublicKey(key); - PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE); - return SECFailure; - } - signature = DSAU_DecodeDerSigToLen(buf, len); - if (!signature) { - PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); - return SECFailure; - } - buf = signature; - break; -#endif /* NSS_ENABLE_ECC */ - - default: - SECKEY_DestroyPublicKey(key); - PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); - return SECFailure; - } - - PRINT_BUF(60, (NULL, "hash(es) to be verified", - hashItem.data, hashItem.len)); - - rv = PK11_Verify(key, buf, &hashItem, pwArg); - SECKEY_DestroyPublicKey(key); - if (signature) { - SECITEM_FreeItem(signature, PR_TRUE); - } - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); - } - return rv; -} - - -/* Caller must set hiLevel error code. */ -/* Called from ssl3_ComputeExportRSAKeyHash - * ssl3_ComputeDHKeyHash - * which are called from ssl3_HandleServerKeyExchange. - */ -SECStatus -ssl3_ComputeCommonKeyHash(PRUint8 * hashBuf, unsigned int bufLen, - SSL3Hashes *hashes, PRBool bypassPKCS11) -{ - SECStatus rv = SECSuccess; - - if (bypassPKCS11) { - MD5_HashBuf (hashes->md5, hashBuf, bufLen); - SHA1_HashBuf(hashes->sha, hashBuf, bufLen); - } else { - rv = PK11_HashBuf(SEC_OID_MD5, hashes->md5, hashBuf, bufLen); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - rv = SECFailure; - goto done; - } - - rv = PK11_HashBuf(SEC_OID_SHA1, hashes->sha, hashBuf, bufLen); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - rv = SECFailure; - } - } -done: - return rv; -} - -/* Caller must set hiLevel error code. -** Called from ssl3_SendServerKeyExchange and -** ssl3_HandleServerKeyExchange. -*/ -static SECStatus -ssl3_ComputeExportRSAKeyHash(SECItem modulus, SECItem publicExponent, - SSL3Random *client_rand, SSL3Random *server_rand, - SSL3Hashes *hashes, PRBool bypassPKCS11) -{ - PRUint8 * hashBuf; - PRUint8 * pBuf; - SECStatus rv = SECSuccess; - unsigned int bufLen; - PRUint8 buf[2*SSL3_RANDOM_LENGTH + 2 + 4096/8 + 2 + 4096/8]; - - bufLen = 2*SSL3_RANDOM_LENGTH + 2 + modulus.len + 2 + publicExponent.len; - if (bufLen <= sizeof buf) { - hashBuf = buf; - } else { - hashBuf = PORT_Alloc(bufLen); - if (!hashBuf) { - return SECFailure; - } - } - - memcpy(hashBuf, client_rand, SSL3_RANDOM_LENGTH); - pBuf = hashBuf + SSL3_RANDOM_LENGTH; - memcpy(pBuf, server_rand, SSL3_RANDOM_LENGTH); - pBuf += SSL3_RANDOM_LENGTH; - pBuf[0] = (PRUint8)(modulus.len >> 8); - pBuf[1] = (PRUint8)(modulus.len); - pBuf += 2; - memcpy(pBuf, modulus.data, modulus.len); - pBuf += modulus.len; - pBuf[0] = (PRUint8)(publicExponent.len >> 8); - pBuf[1] = (PRUint8)(publicExponent.len); - pBuf += 2; - memcpy(pBuf, publicExponent.data, publicExponent.len); - pBuf += publicExponent.len; - PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen); - - rv = ssl3_ComputeCommonKeyHash(hashBuf, bufLen, hashes, bypassPKCS11); - - PRINT_BUF(95, (NULL, "RSAkey hash: ", hashBuf, bufLen)); - PRINT_BUF(95, (NULL, "RSAkey hash: MD5 result", hashes->md5, MD5_LENGTH)); - PRINT_BUF(95, (NULL, "RSAkey hash: SHA1 result", hashes->sha, SHA1_LENGTH)); - - if (hashBuf != buf && hashBuf != NULL) - PORT_Free(hashBuf); - return rv; -} - -/* Caller must set hiLevel error code. */ -/* Called from ssl3_HandleServerKeyExchange. */ -static SECStatus -ssl3_ComputeDHKeyHash(SECItem dh_p, SECItem dh_g, SECItem dh_Ys, - SSL3Random *client_rand, SSL3Random *server_rand, - SSL3Hashes *hashes, PRBool bypassPKCS11) -{ - PRUint8 * hashBuf; - PRUint8 * pBuf; - SECStatus rv = SECSuccess; - unsigned int bufLen; - PRUint8 buf[2*SSL3_RANDOM_LENGTH + 2 + 4096/8 + 2 + 4096/8]; - - bufLen = 2*SSL3_RANDOM_LENGTH + 2 + dh_p.len + 2 + dh_g.len + 2 + dh_Ys.len; - if (bufLen <= sizeof buf) { - hashBuf = buf; - } else { - hashBuf = PORT_Alloc(bufLen); - if (!hashBuf) { - return SECFailure; - } - } - - memcpy(hashBuf, client_rand, SSL3_RANDOM_LENGTH); - pBuf = hashBuf + SSL3_RANDOM_LENGTH; - memcpy(pBuf, server_rand, SSL3_RANDOM_LENGTH); - pBuf += SSL3_RANDOM_LENGTH; - pBuf[0] = (PRUint8)(dh_p.len >> 8); - pBuf[1] = (PRUint8)(dh_p.len); - pBuf += 2; - memcpy(pBuf, dh_p.data, dh_p.len); - pBuf += dh_p.len; - pBuf[0] = (PRUint8)(dh_g.len >> 8); - pBuf[1] = (PRUint8)(dh_g.len); - pBuf += 2; - memcpy(pBuf, dh_g.data, dh_g.len); - pBuf += dh_g.len; - pBuf[0] = (PRUint8)(dh_Ys.len >> 8); - pBuf[1] = (PRUint8)(dh_Ys.len); - pBuf += 2; - memcpy(pBuf, dh_Ys.data, dh_Ys.len); - pBuf += dh_Ys.len; - PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen); - - rv = ssl3_ComputeCommonKeyHash(hashBuf, bufLen, hashes, bypassPKCS11); - - PRINT_BUF(95, (NULL, "DHkey hash: ", hashBuf, bufLen)); - PRINT_BUF(95, (NULL, "DHkey hash: MD5 result", hashes->md5, MD5_LENGTH)); - PRINT_BUF(95, (NULL, "DHkey hash: SHA1 result", hashes->sha, SHA1_LENGTH)); - - if (hashBuf != buf && hashBuf != NULL) - PORT_Free(hashBuf); - return rv; -} - -static void -ssl3_BumpSequenceNumber(SSL3SequenceNumber *num) -{ - num->low++; - if (num->low == 0) - num->high++; -} - -/* Called twice, only from ssl3_DestroyCipherSpec (immediately below). */ -static void -ssl3_CleanupKeyMaterial(ssl3KeyMaterial *mat) -{ - if (mat->write_key != NULL) { - PK11_FreeSymKey(mat->write_key); - mat->write_key = NULL; - } - if (mat->write_mac_key != NULL) { - PK11_FreeSymKey(mat->write_mac_key); - mat->write_mac_key = NULL; - } - if (mat->write_mac_context != NULL) { - PK11_DestroyContext(mat->write_mac_context, PR_TRUE); - mat->write_mac_context = NULL; - } -} - -/* Called from ssl3_SendChangeCipherSpecs() and -** ssl3_HandleChangeCipherSpecs() -** ssl3_DestroySSL3Info -** Caller must hold SpecWriteLock. -*/ -static void -ssl3_DestroyCipherSpec(ssl3CipherSpec *spec) -{ - PRBool freeit = (PRBool)(!spec->bypassCiphers); -/* PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); Don't have ss! */ - if (spec->destroy) { - spec->destroy(spec->encodeContext, freeit); - spec->destroy(spec->decodeContext, freeit); - spec->encodeContext = NULL; /* paranoia */ - spec->decodeContext = NULL; - } - if (spec->master_secret != NULL) { - PK11_FreeSymKey(spec->master_secret); - spec->master_secret = NULL; - } - spec->msItem.data = NULL; - spec->msItem.len = 0; - ssl3_CleanupKeyMaterial(&spec->client); - ssl3_CleanupKeyMaterial(&spec->server); - spec->bypassCiphers = PR_FALSE; - spec->destroy=NULL; -} - -/* Fill in the pending cipher spec with info from the selected ciphersuite. -** This is as much initialization as we can do without having key material. -** Called from ssl3_HandleServerHello(), ssl3_SendServerHello() -** Caller must hold the ssl3 handshake lock. -** Acquires & releases SpecWriteLock. -*/ -static SECStatus -ssl3_SetupPendingCipherSpec(sslSocket *ss) -{ - ssl3CipherSpec * pwSpec; - ssl3CipherSpec * cwSpec; - ssl3CipherSuite suite = ss->ssl3.hs.cipher_suite; - SSL3MACAlgorithm mac; - SSL3BulkCipher cipher; - SSL3KeyExchangeAlgorithm kea; - const ssl3CipherSuiteDef *suite_def; - PRBool isTLS; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - ssl_GetSpecWriteLock(ss); /*******************************/ - - pwSpec = ss->ssl3.pwSpec; - PORT_Assert(pwSpec == ss->ssl3.prSpec); - - /* This hack provides maximal interoperability with SSL 3 servers. */ - cwSpec = ss->ssl3.cwSpec; - if (cwSpec->mac_def->mac == mac_null) { - /* SSL records are not being MACed. */ - cwSpec->version = ss->version; - } - - pwSpec->version = ss->version; - isTLS = (PRBool)(pwSpec->version > SSL_LIBRARY_VERSION_3_0); - - SSL_TRC(3, ("%d: SSL3[%d]: Set XXX Pending Cipher Suite to 0x%04x", - SSL_GETPID(), ss->fd, suite)); - - suite_def = ssl_LookupCipherSuiteDef(suite); - if (suite_def == NULL) { - ssl_ReleaseSpecWriteLock(ss); - return SECFailure; /* error code set by ssl_LookupCipherSuiteDef */ - } - - - cipher = suite_def->bulk_cipher_alg; - kea = suite_def->key_exchange_alg; - mac = suite_def->mac_alg; - if (isTLS) - mac += 2; - - ss->ssl3.hs.suite_def = suite_def; - ss->ssl3.hs.kea_def = &kea_defs[kea]; - PORT_Assert(ss->ssl3.hs.kea_def->kea == kea); - - pwSpec->cipher_def = &bulk_cipher_defs[cipher]; - PORT_Assert(pwSpec->cipher_def->cipher == cipher); - - pwSpec->mac_def = &mac_defs[mac]; - PORT_Assert(pwSpec->mac_def->mac == mac); - - ss->sec.keyBits = pwSpec->cipher_def->key_size * BPB; - ss->sec.secretKeyBits = pwSpec->cipher_def->secret_key_size * BPB; - ss->sec.cipherType = cipher; - - pwSpec->encodeContext = NULL; - pwSpec->decodeContext = NULL; - - pwSpec->mac_size = pwSpec->mac_def->mac_size; - - ssl_ReleaseSpecWriteLock(ss); /*******************************/ - return SECSuccess; -} - -/* Initialize encryption and MAC contexts for pending spec. - * Master Secret already is derived in spec->msItem - * Caller holds Spec write lock. - */ -static SECStatus -ssl3_InitPendingContextsBypass(sslSocket *ss) -{ - ssl3CipherSpec * pwSpec; -const ssl3BulkCipherDef *cipher_def; - void * serverContext = NULL; - void * clientContext = NULL; - BLapiInitContextFunc initFn = (BLapiInitContextFunc)NULL; - int mode = 0; - unsigned int optArg1 = 0; - unsigned int optArg2 = 0; - PRBool server_encrypts = ss->sec.isServer; - CK_ULONG macLength; - SSLCipherAlgorithm calg; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); - - pwSpec = ss->ssl3.pwSpec; - cipher_def = pwSpec->cipher_def; - macLength = pwSpec->mac_size; - - /* MAC setup is done when computing the mac, not here. - * Now setup the crypto contexts. - */ - - calg = cipher_def->calg; - - serverContext = pwSpec->server.cipher_context; - clientContext = pwSpec->client.cipher_context; - - switch (calg) { - case ssl_calg_null: - pwSpec->encode = Null_Cipher; - pwSpec->decode = Null_Cipher; - pwSpec->destroy = NULL; - goto success; - - case ssl_calg_rc4: - initFn = (BLapiInitContextFunc)RC4_InitContext; - pwSpec->encode = (SSLCipher) RC4_Encrypt; - pwSpec->decode = (SSLCipher) RC4_Decrypt; - pwSpec->destroy = (SSLDestroy) RC4_DestroyContext; - break; - case ssl_calg_rc2: - initFn = (BLapiInitContextFunc)RC2_InitContext; - mode = NSS_RC2_CBC; - optArg1 = cipher_def->key_size; - pwSpec->encode = (SSLCipher) RC2_Encrypt; - pwSpec->decode = (SSLCipher) RC2_Decrypt; - pwSpec->destroy = (SSLDestroy) RC2_DestroyContext; - break; - case ssl_calg_des: - initFn = (BLapiInitContextFunc)DES_InitContext; - mode = NSS_DES_CBC; - optArg1 = server_encrypts; - pwSpec->encode = (SSLCipher) DES_Encrypt; - pwSpec->decode = (SSLCipher) DES_Decrypt; - pwSpec->destroy = (SSLDestroy) DES_DestroyContext; - break; - case ssl_calg_3des: - initFn = (BLapiInitContextFunc)DES_InitContext; - mode = NSS_DES_EDE3_CBC; - optArg1 = server_encrypts; - pwSpec->encode = (SSLCipher) DES_Encrypt; - pwSpec->decode = (SSLCipher) DES_Decrypt; - pwSpec->destroy = (SSLDestroy) DES_DestroyContext; - break; - case ssl_calg_aes: - initFn = (BLapiInitContextFunc)AES_InitContext; - mode = NSS_AES_CBC; - optArg1 = server_encrypts; - optArg2 = AES_BLOCK_SIZE; - pwSpec->encode = (SSLCipher) AES_Encrypt; - pwSpec->decode = (SSLCipher) AES_Decrypt; - pwSpec->destroy = (SSLDestroy) AES_DestroyContext; - break; - - case ssl_calg_camellia: - initFn = (BLapiInitContextFunc)Camellia_InitContext; - mode = NSS_CAMELLIA_CBC; - optArg1 = server_encrypts; - optArg2 = CAMELLIA_BLOCK_SIZE; - pwSpec->encode = (SSLCipher) Camellia_Encrypt; - pwSpec->decode = (SSLCipher) Camellia_Decrypt; - pwSpec->destroy = (SSLDestroy) Camellia_DestroyContext; - break; - - case ssl_calg_seed: - initFn = (BLapiInitContextFunc)SEED_InitContext; - mode = NSS_SEED_CBC; - optArg1 = server_encrypts; - optArg2 = SEED_BLOCK_SIZE; - pwSpec->encode = (SSLCipher) SEED_Encrypt; - pwSpec->decode = (SSLCipher) SEED_Decrypt; - pwSpec->destroy = (SSLDestroy) SEED_DestroyContext; - break; - - case ssl_calg_idea: - case ssl_calg_fortezza : - default: - PORT_Assert(0); - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - goto bail_out; - } - rv = (*initFn)(serverContext, - pwSpec->server.write_key_item.data, - pwSpec->server.write_key_item.len, - pwSpec->server.write_iv_item.data, - mode, optArg1, optArg2); - if (rv != SECSuccess) { - PORT_Assert(0); - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - goto bail_out; - } - - switch (calg) { - case ssl_calg_des: - case ssl_calg_3des: - case ssl_calg_aes: - case ssl_calg_camellia: - case ssl_calg_seed: - /* For block ciphers, if the server is encrypting, then the client - * is decrypting, and vice versa. - */ - optArg1 = !optArg1; - } - - rv = (*initFn)(clientContext, - pwSpec->client.write_key_item.data, - pwSpec->client.write_key_item.len, - pwSpec->client.write_iv_item.data, - mode, optArg1, optArg2); - if (rv != SECSuccess) { - PORT_Assert(0); - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - goto bail_out; - } - - pwSpec->encodeContext = (ss->sec.isServer) ? serverContext : clientContext; - pwSpec->decodeContext = (ss->sec.isServer) ? clientContext : serverContext; - -success: - return SECSuccess; - -bail_out: - return SECFailure; -} - -/* This function should probably be moved to pk11wrap and be named - * PK11_ParamFromIVAndEffectiveKeyBits - */ -static SECItem * -ssl3_ParamFromIV(CK_MECHANISM_TYPE mtype, SECItem *iv, CK_ULONG ulEffectiveBits) -{ - SECItem * param = PK11_ParamFromIV(mtype, iv); - if (param && param->data && param->len >= sizeof(CK_RC2_PARAMS)) { - switch (mtype) { - case CKM_RC2_KEY_GEN: - case CKM_RC2_ECB: - case CKM_RC2_CBC: - case CKM_RC2_MAC: - case CKM_RC2_MAC_GENERAL: - case CKM_RC2_CBC_PAD: - *(CK_RC2_PARAMS *)param->data = ulEffectiveBits; - default: break; - } - } - return param; -} - -/* Initialize encryption and MAC contexts for pending spec. - * Master Secret already is derived. - * Caller holds Spec write lock. - */ -static SECStatus -ssl3_InitPendingContextsPKCS11(sslSocket *ss) -{ - ssl3CipherSpec * pwSpec; -const ssl3BulkCipherDef *cipher_def; - PK11Context * serverContext = NULL; - PK11Context * clientContext = NULL; - SECItem * param; - CK_MECHANISM_TYPE mechanism; - CK_MECHANISM_TYPE mac_mech; - CK_ULONG macLength; - CK_ULONG effKeyBits; - SECItem iv; - SECItem mac_param; - SSLCipherAlgorithm calg; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); - - pwSpec = ss->ssl3.pwSpec; - cipher_def = pwSpec->cipher_def; - macLength = pwSpec->mac_size; - - /* - ** Now setup the MAC contexts, - ** crypto contexts are setup below. - */ - - pwSpec->client.write_mac_context = NULL; - pwSpec->server.write_mac_context = NULL; - mac_mech = pwSpec->mac_def->mmech; - mac_param.data = (unsigned char *)&macLength; - mac_param.len = sizeof(macLength); - mac_param.type = 0; - - pwSpec->client.write_mac_context = PK11_CreateContextBySymKey( - mac_mech, CKA_SIGN, pwSpec->client.write_mac_key, &mac_param); - if (pwSpec->client.write_mac_context == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); - goto fail; - } - pwSpec->server.write_mac_context = PK11_CreateContextBySymKey( - mac_mech, CKA_SIGN, pwSpec->server.write_mac_key, &mac_param); - if (pwSpec->server.write_mac_context == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); - goto fail; - } - - /* - ** Now setup the crypto contexts. - */ - - calg = cipher_def->calg; - PORT_Assert(alg2Mech[calg].calg == calg); - - if (calg == calg_null) { - pwSpec->encode = Null_Cipher; - pwSpec->decode = Null_Cipher; - pwSpec->destroy = NULL; - return SECSuccess; - } - mechanism = alg2Mech[calg].cmech; - effKeyBits = cipher_def->key_size * BPB; - - /* - * build the server context - */ - iv.data = pwSpec->server.write_iv; - iv.len = cipher_def->iv_size; - param = ssl3_ParamFromIV(mechanism, &iv, effKeyBits); - if (param == NULL) { - ssl_MapLowLevelError(SSL_ERROR_IV_PARAM_FAILURE); - goto fail; - } - serverContext = PK11_CreateContextBySymKey(mechanism, - (ss->sec.isServer ? CKA_ENCRYPT : CKA_DECRYPT), - pwSpec->server.write_key, param); - iv.data = PK11_IVFromParam(mechanism, param, (int *)&iv.len); - if (iv.data) - PORT_Memcpy(pwSpec->server.write_iv, iv.data, iv.len); - SECITEM_FreeItem(param, PR_TRUE); - if (serverContext == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); - goto fail; - } - - /* - * build the client context - */ - iv.data = pwSpec->client.write_iv; - iv.len = cipher_def->iv_size; - - param = ssl3_ParamFromIV(mechanism, &iv, effKeyBits); - if (param == NULL) { - ssl_MapLowLevelError(SSL_ERROR_IV_PARAM_FAILURE); - goto fail; - } - clientContext = PK11_CreateContextBySymKey(mechanism, - (ss->sec.isServer ? CKA_DECRYPT : CKA_ENCRYPT), - pwSpec->client.write_key, param); - iv.data = PK11_IVFromParam(mechanism, param, (int *)&iv.len); - if (iv.data) - PORT_Memcpy(pwSpec->client.write_iv, iv.data, iv.len); - SECITEM_FreeItem(param,PR_TRUE); - if (clientContext == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); - goto fail; - } - pwSpec->encode = (SSLCipher) PK11_CipherOp; - pwSpec->decode = (SSLCipher) PK11_CipherOp; - pwSpec->destroy = (SSLDestroy) PK11_DestroyContext; - - pwSpec->encodeContext = (ss->sec.isServer) ? serverContext : clientContext; - pwSpec->decodeContext = (ss->sec.isServer) ? clientContext : serverContext; - - serverContext = NULL; - clientContext = NULL; - - return SECSuccess; - -fail: - if (serverContext != NULL) PK11_DestroyContext(serverContext, PR_TRUE); - if (clientContext != NULL) PK11_DestroyContext(clientContext, PR_TRUE); - if (pwSpec->client.write_mac_context != NULL) { - PK11_DestroyContext(pwSpec->client.write_mac_context,PR_TRUE); - pwSpec->client.write_mac_context = NULL; - } - if (pwSpec->server.write_mac_context != NULL) { - PK11_DestroyContext(pwSpec->server.write_mac_context,PR_TRUE); - pwSpec->server.write_mac_context = NULL; - } - - return SECFailure; -} - -/* Complete the initialization of all keys, ciphers, MACs and their contexts - * for the pending Cipher Spec. - * Called from: ssl3_SendClientKeyExchange (for Full handshake) - * ssl3_HandleRSAClientKeyExchange (for Full handshake) - * ssl3_HandleServerHello (for session restart) - * ssl3_HandleClientHello (for session restart) - * Sets error code, but caller probably should override to disambiguate. - * NULL pms means re-use old master_secret. - * - * This code is common to the bypass and PKCS11 execution paths. - * For the bypass case, pms is NULL. - */ -SECStatus -ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms) -{ - ssl3CipherSpec * pwSpec; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - ssl_GetSpecWriteLock(ss); /**************************************/ - - PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); - - pwSpec = ss->ssl3.pwSpec; - - if (pms || (!pwSpec->msItem.len && !pwSpec->master_secret)) { - rv = ssl3_DeriveMasterSecret(ss, pms); - if (rv != SECSuccess) { - goto done; /* err code set by ssl3_DeriveMasterSecret */ - } - } - if (ss->opt.bypassPKCS11 && pwSpec->msItem.len && pwSpec->msItem.data) { - /* Double Bypass succeeded in extracting the master_secret */ - const ssl3KEADef * kea_def = ss->ssl3.hs.kea_def; - PRBool isTLS = (PRBool)(kea_def->tls_keygen || - (pwSpec->version > SSL_LIBRARY_VERSION_3_0)); - pwSpec->bypassCiphers = PR_TRUE; - rv = ssl3_KeyAndMacDeriveBypass( pwSpec, - (const unsigned char *)&ss->ssl3.hs.client_random, - (const unsigned char *)&ss->ssl3.hs.server_random, - isTLS, - (PRBool)(kea_def->is_limited)); - if (rv == SECSuccess) { - rv = ssl3_InitPendingContextsBypass(ss); - } - } else if (pwSpec->master_secret) { - rv = ssl3_DeriveConnectionKeysPKCS11(ss); - if (rv == SECSuccess) { - rv = ssl3_InitPendingContextsPKCS11(ss); - } - } else { - PORT_Assert(pwSpec->master_secret); - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - rv = SECFailure; - } - -done: - ssl_ReleaseSpecWriteLock(ss); /******************************/ - if (rv != SECSuccess) - ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - return rv; -} - -/* - * 60 bytes is 3 times the maximum length MAC size that is supported. - */ -static const unsigned char mac_pad_1 [60] = { - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, - 0x36, 0x36, 0x36, 0x36 -}; -static const unsigned char mac_pad_2 [60] = { - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, - 0x5c, 0x5c, 0x5c, 0x5c -}; - -/* Called from: ssl3_SendRecord() -** ssl3_HandleRecord() -** Caller must already hold the SpecReadLock. (wish we could assert that!) -*/ -static SECStatus -ssl3_ComputeRecordMAC( - ssl3CipherSpec * spec, - PRBool useServerMacKey, - SSL3ContentType type, - SSL3ProtocolVersion version, - SSL3SequenceNumber seq_num, - const SSL3Opaque * input, - int inputLength, - unsigned char * outbuf, - unsigned int * outLength) -{ - const ssl3MACDef * mac_def; - SECStatus rv; - PRBool isTLS; - unsigned int tempLen; - unsigned char temp[MAX_MAC_LENGTH]; - - temp[0] = (unsigned char)(seq_num.high >> 24); - temp[1] = (unsigned char)(seq_num.high >> 16); - temp[2] = (unsigned char)(seq_num.high >> 8); - temp[3] = (unsigned char)(seq_num.high >> 0); - temp[4] = (unsigned char)(seq_num.low >> 24); - temp[5] = (unsigned char)(seq_num.low >> 16); - temp[6] = (unsigned char)(seq_num.low >> 8); - temp[7] = (unsigned char)(seq_num.low >> 0); - temp[8] = type; - - /* TLS MAC includes the record's version field, SSL's doesn't. - ** We decide which MAC defintiion to use based on the version of - ** the protocol that was negotiated when the spec became current, - ** NOT based on the version value in the record itself. - ** But, we use the record'v version value in the computation. - */ - if (spec->version <= SSL_LIBRARY_VERSION_3_0) { - temp[9] = MSB(inputLength); - temp[10] = LSB(inputLength); - tempLen = 11; - isTLS = PR_FALSE; - } else { - /* New TLS hash includes version. */ - temp[9] = MSB(version); - temp[10] = LSB(version); - temp[11] = MSB(inputLength); - temp[12] = LSB(inputLength); - tempLen = 13; - isTLS = PR_TRUE; - } - - PRINT_BUF(95, (NULL, "frag hash1: temp", temp, tempLen)); - PRINT_BUF(95, (NULL, "frag hash1: input", input, inputLength)); - - mac_def = spec->mac_def; - if (mac_def->mac == mac_null) { - *outLength = 0; - return SECSuccess; - } - if (! spec->bypassCiphers) { - PK11Context *mac_context = - (useServerMacKey ? spec->server.write_mac_context - : spec->client.write_mac_context); - rv = PK11_DigestBegin(mac_context); - rv |= PK11_DigestOp(mac_context, temp, tempLen); - rv |= PK11_DigestOp(mac_context, input, inputLength); - rv |= PK11_DigestFinal(mac_context, outbuf, outLength, spec->mac_size); - } else { - /* bypass version */ - const SECHashObject *hashObj = NULL; - unsigned int pad_bytes = 0; - PRUint64 write_mac_context[MAX_MAC_CONTEXT_LLONGS]; - - switch (mac_def->mac) { - case ssl_mac_null: - *outLength = 0; - return SECSuccess; - case ssl_mac_md5: - pad_bytes = 48; - hashObj = HASH_GetRawHashObject(HASH_AlgMD5); - break; - case ssl_mac_sha: - pad_bytes = 40; - hashObj = HASH_GetRawHashObject(HASH_AlgSHA1); - break; - case ssl_hmac_md5: /* used with TLS */ - hashObj = HASH_GetRawHashObject(HASH_AlgMD5); - break; - case ssl_hmac_sha: /* used with TLS */ - hashObj = HASH_GetRawHashObject(HASH_AlgSHA1); - break; - default: - break; - } - if (!hashObj) { - PORT_Assert(0); - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - return SECFailure; - } - - if (!isTLS) { - /* compute "inner" part of SSL3 MAC */ - hashObj->begin(write_mac_context); - if (useServerMacKey) - hashObj->update(write_mac_context, - spec->server.write_mac_key_item.data, - spec->server.write_mac_key_item.len); - else - hashObj->update(write_mac_context, - spec->client.write_mac_key_item.data, - spec->client.write_mac_key_item.len); - hashObj->update(write_mac_context, mac_pad_1, pad_bytes); - hashObj->update(write_mac_context, temp, tempLen); - hashObj->update(write_mac_context, input, inputLength); - hashObj->end(write_mac_context, temp, &tempLen, sizeof temp); - - /* compute "outer" part of SSL3 MAC */ - hashObj->begin(write_mac_context); - if (useServerMacKey) - hashObj->update(write_mac_context, - spec->server.write_mac_key_item.data, - spec->server.write_mac_key_item.len); - else - hashObj->update(write_mac_context, - spec->client.write_mac_key_item.data, - spec->client.write_mac_key_item.len); - hashObj->update(write_mac_context, mac_pad_2, pad_bytes); - hashObj->update(write_mac_context, temp, tempLen); - hashObj->end(write_mac_context, outbuf, outLength, spec->mac_size); - rv = SECSuccess; - } else { /* is TLS */ -#define cx ((HMACContext *)write_mac_context) - if (useServerMacKey) { - rv = HMAC_Init(cx, hashObj, - spec->server.write_mac_key_item.data, - spec->server.write_mac_key_item.len, PR_FALSE); - } else { - rv = HMAC_Init(cx, hashObj, - spec->client.write_mac_key_item.data, - spec->client.write_mac_key_item.len, PR_FALSE); - } - if (rv == SECSuccess) { - HMAC_Begin(cx); - HMAC_Update(cx, temp, tempLen); - HMAC_Update(cx, input, inputLength); - rv = HMAC_Finish(cx, outbuf, outLength, spec->mac_size); - HMAC_Destroy(cx, PR_FALSE); - } -#undef cx - } - } - - PORT_Assert(rv != SECSuccess || *outLength == (unsigned)spec->mac_size); - - PRINT_BUF(95, (NULL, "frag hash2: result", outbuf, *outLength)); - - if (rv != SECSuccess) { - rv = SECFailure; - ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE); - } - return rv; -} - -static PRBool -ssl3_ClientAuthTokenPresent(sslSessionID *sid) { - PK11SlotInfo *slot = NULL; - PRBool isPresent = PR_TRUE; - - /* we only care if we are doing client auth */ - if (!sid || !sid->u.ssl3.clAuthValid) { - return PR_TRUE; - } - - /* get the slot */ - slot = SECMOD_LookupSlot(sid->u.ssl3.clAuthModuleID, - sid->u.ssl3.clAuthSlotID); - if (slot == NULL || - !PK11_IsPresent(slot) || - sid->u.ssl3.clAuthSeries != PK11_GetSlotSeries(slot) || - sid->u.ssl3.clAuthSlotID != PK11_GetSlotID(slot) || - sid->u.ssl3.clAuthModuleID != PK11_GetModuleID(slot) || - (PK11_NeedLogin(slot) && !PK11_IsLoggedIn(slot, NULL))) { - isPresent = PR_FALSE; - } - if (slot) { - PK11_FreeSlot(slot); - } - return isPresent; -} - -static SECStatus -ssl3_CompressMACEncryptRecord(sslSocket * ss, - SSL3ContentType type, - const SSL3Opaque * pIn, - PRUint32 contentLen) -{ - ssl3CipherSpec * cwSpec; - const ssl3BulkCipherDef * cipher_def; - sslBuffer * wrBuf = &ss->sec.writeBuf; - SECStatus rv; - PRUint32 macLen = 0; - PRUint32 fragLen; - PRUint32 p1Len, p2Len, oddLen = 0; - PRInt32 cipherBytes = 0; - - /* - * null compression is easy to do - PORT_Memcpy(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH, pIn, contentLen); - */ - - ssl_GetSpecReadLock(ss); /********************************/ - - cwSpec = ss->ssl3.cwSpec; - cipher_def = cwSpec->cipher_def; - /* - * Add the MAC - */ - rv = ssl3_ComputeRecordMAC( cwSpec, (PRBool)(ss->sec.isServer), - type, cwSpec->version, cwSpec->write_seq_num, pIn, contentLen, - wrBuf->buf + contentLen + SSL3_RECORD_HEADER_LENGTH, &macLen); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE); - goto spec_locked_loser; - } - p1Len = contentLen; - p2Len = macLen; - fragLen = contentLen + macLen; /* needs to be encrypted */ - PORT_Assert(fragLen <= MAX_FRAGMENT_LENGTH + 1024); - - /* - * Pad the text (if we're doing a block cipher) - * then Encrypt it - */ - if (cipher_def->type == type_block) { - unsigned char * pBuf; - int padding_length; - int i; - - oddLen = contentLen % cipher_def->block_size; - /* Assume blockSize is a power of two */ - padding_length = cipher_def->block_size - 1 - - ((fragLen) & (cipher_def->block_size - 1)); - fragLen += padding_length + 1; - PORT_Assert((fragLen % cipher_def->block_size) == 0); - - /* Pad according to TLS rules (also acceptable to SSL3). */ - pBuf = &wrBuf->buf[fragLen + SSL3_RECORD_HEADER_LENGTH - 1]; - for (i = padding_length + 1; i > 0; --i) { - *pBuf-- = padding_length; - } - /* now, if contentLen is not a multiple of block size, fix it */ - p2Len = fragLen - p1Len; - } - if (p1Len < 256) { - oddLen = p1Len; - p1Len = 0; - } else { - p1Len -= oddLen; - } - if (oddLen) { - p2Len += oddLen; - PORT_Assert( (cipher_def->block_size < 2) || \ - (p2Len % cipher_def->block_size) == 0); - memcpy(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len, - pIn + p1Len, oddLen); - } - if (p1Len > 0) { - rv = cwSpec->encode( cwSpec->encodeContext, - wrBuf->buf + SSL3_RECORD_HEADER_LENGTH, /* output */ - &cipherBytes, /* actual outlen */ - p1Len, /* max outlen */ - pIn, p1Len); /* input, and inputlen */ - PORT_Assert(rv == SECSuccess && cipherBytes == p1Len); - if (rv != SECSuccess || cipherBytes != p1Len) { - PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); - goto spec_locked_loser; - } - } - if (p2Len > 0) { - PRInt32 cipherBytesPart2 = -1; - rv = cwSpec->encode( cwSpec->encodeContext, - wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len, - &cipherBytesPart2, /* output and actual outLen */ - p2Len, /* max outlen */ - wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len, - p2Len); /* input and inputLen*/ - PORT_Assert(rv == SECSuccess && cipherBytesPart2 == p2Len); - if (rv != SECSuccess || cipherBytesPart2 != p2Len) { - PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); - goto spec_locked_loser; - } - cipherBytes += cipherBytesPart2; - } - PORT_Assert(cipherBytes <= MAX_FRAGMENT_LENGTH + 1024); - - ssl3_BumpSequenceNumber(&cwSpec->write_seq_num); - - wrBuf->len = cipherBytes + SSL3_RECORD_HEADER_LENGTH; - wrBuf->buf[0] = type; - wrBuf->buf[1] = MSB(cwSpec->version); - wrBuf->buf[2] = LSB(cwSpec->version); - wrBuf->buf[3] = MSB(cipherBytes); - wrBuf->buf[4] = LSB(cipherBytes); - - ssl_ReleaseSpecReadLock(ss); /************************************/ - - return SECSuccess; - -spec_locked_loser: - ssl_ReleaseSpecReadLock(ss); - return SECFailure; -} - -/* Process the plain text before sending it. - * Returns the number of bytes of plaintext that were successfully sent - * plus the number of bytes of plaintext that were copied into the - * output (write) buffer. - * Returns SECFailure on a hard IO error, memory error, or crypto error. - * Does NOT return SECWouldBlock. - * - * Notes on the use of the private ssl flags: - * (no private SSL flags) - * Attempt to make and send SSL records for all plaintext - * If non-blocking and a send gets WOULD_BLOCK, - * or if the pending (ciphertext) buffer is not empty, - * then buffer remaining bytes of ciphertext into pending buf, - * and continue to do that for all succssive records until all - * bytes are used. - * ssl_SEND_FLAG_FORCE_INTO_BUFFER - * As above, except this suppresses all write attempts, and forces - * all ciphertext into the pending ciphertext buffer. - * - */ -static PRInt32 -ssl3_SendRecord( sslSocket * ss, - SSL3ContentType type, - const SSL3Opaque * pIn, /* input buffer */ - PRInt32 nIn, /* bytes of input */ - PRInt32 flags) -{ - sslBuffer * wrBuf = &ss->sec.writeBuf; - SECStatus rv; - PRInt32 totalSent = 0; - - SSL_TRC(3, ("%d: SSL3[%d] SendRecord type: %s nIn=%d", - SSL_GETPID(), ss->fd, ssl3_DecodeContentType(type), - nIn)); - PRINT_BUF(3, (ss, "Send record (plain text)", pIn, nIn)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - if (ss->ssl3.initialized == PR_FALSE) { - /* This can happen on a server if the very first incoming record - ** looks like a defective ssl3 record (e.g. too long), and we're - ** trying to send an alert. - */ - PR_ASSERT(type == content_alert); - rv = ssl3_InitState(ss); - if (rv != SECSuccess) { - return SECFailure; /* ssl3_InitState has set the error code. */ - } - } - - /* check for Token Presence */ - if (!ssl3_ClientAuthTokenPresent(ss->sec.ci.sid)) { - PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); - return SECFailure; - } - - while (nIn > 0) { - PRUint32 contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH); - - if (wrBuf->space < contentLen + SSL3_BUFFER_FUDGE) { - PRInt32 newSpace = PR_MAX(wrBuf->space * 2, contentLen); - newSpace = PR_MIN(newSpace, MAX_FRAGMENT_LENGTH); - newSpace += SSL3_BUFFER_FUDGE; - rv = sslBuffer_Grow(wrBuf, newSpace); - if (rv != SECSuccess) { - SSL_DBG(("%d: SSL3[%d]: SendRecord, tried to get %d bytes", - SSL_GETPID(), ss->fd, newSpace)); - return SECFailure; /* sslBuffer_Grow set a memory error code. */ - } - } - - rv = ssl3_CompressMACEncryptRecord( ss, type, pIn, contentLen); - if (rv != SECSuccess) - return SECFailure; - - pIn += contentLen; - nIn -= contentLen; - PORT_Assert( nIn >= 0 ); - - PRINT_BUF(50, (ss, "send (encrypted) record data:", wrBuf->buf, wrBuf->len)); - - /* If there's still some previously saved ciphertext, - * or the caller doesn't want us to send the data yet, - * then add all our new ciphertext to the amount previously saved. - */ - if ((ss->pendingBuf.len > 0) || - (flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) { - - rv = ssl_SaveWriteData(ss, wrBuf->buf, wrBuf->len); - if (rv != SECSuccess) { - /* presumably a memory error, SEC_ERROR_NO_MEMORY */ - return SECFailure; - } - wrBuf->len = 0; /* All cipher text is saved away. */ - - if (!(flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) { - PRInt32 sent; - ss->handshakeBegun = 1; - sent = ssl_SendSavedWriteData(ss); - if (sent < 0 && PR_GetError() != PR_WOULD_BLOCK_ERROR) { - ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE); - return SECFailure; - } - if (ss->pendingBuf.len) { - flags |= ssl_SEND_FLAG_FORCE_INTO_BUFFER; - } - } - } else if (wrBuf->len > 0) { - PRInt32 sent; - ss->handshakeBegun = 1; - sent = ssl_DefSend(ss, wrBuf->buf, wrBuf->len, - flags & ~ssl_SEND_FLAG_MASK); - if (sent < 0) { - if (PR_GetError() != PR_WOULD_BLOCK_ERROR) { - ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE); - return SECFailure; - } - /* we got PR_WOULD_BLOCK_ERROR, which means none was sent. */ - sent = 0; - } - wrBuf->len -= sent; - if (wrBuf->len) { - /* now take all the remaining unsent new ciphertext and - * append it to the buffer of previously unsent ciphertext. - */ - rv = ssl_SaveWriteData(ss, wrBuf->buf + sent, wrBuf->len); - if (rv != SECSuccess) { - /* presumably a memory error, SEC_ERROR_NO_MEMORY */ - return SECFailure; - } - } - } - totalSent += contentLen; - } - return totalSent; -} - -#define SSL3_PENDING_HIGH_WATER 1024 - -/* Attempt to send the content of "in" in an SSL application_data record. - * Returns "len" or SECFailure, never SECWouldBlock, nor SECSuccess. - */ -int -ssl3_SendApplicationData(sslSocket *ss, const unsigned char *in, - PRInt32 len, PRInt32 flags) -{ - PRInt32 totalSent = 0; - PRInt32 discarded = 0; - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - if (len < 0 || !in) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - - if (ss->pendingBuf.len > SSL3_PENDING_HIGH_WATER && - !ssl_SocketIsBlocking(ss)) { - PORT_Assert(!ssl_SocketIsBlocking(ss)); - PORT_SetError(PR_WOULD_BLOCK_ERROR); - return SECFailure; - } - - if (ss->appDataBuffered && len) { - PORT_Assert (in[0] == (unsigned char)(ss->appDataBuffered)); - if (in[0] != (unsigned char)(ss->appDataBuffered)) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - in++; - len--; - discarded = 1; - } - while (len > totalSent) { - PRInt32 sent, toSend; - - if (totalSent > 0) { - /* - * The thread yield is intended to give the reader thread a - * chance to get some cycles while the writer thread is in - * the middle of a large application data write. (See - * Bugzilla bug 127740, comment #1.) - */ - ssl_ReleaseXmitBufLock(ss); - PR_Sleep(PR_INTERVAL_NO_WAIT); /* PR_Yield(); */ - ssl_GetXmitBufLock(ss); - } - toSend = PR_MIN(len - totalSent, MAX_FRAGMENT_LENGTH); - sent = ssl3_SendRecord(ss, content_application_data, - in + totalSent, toSend, flags); - if (sent < 0) { - if (totalSent > 0 && PR_GetError() == PR_WOULD_BLOCK_ERROR) { - PORT_Assert(ss->lastWriteBlocked); - break; - } - return SECFailure; /* error code set by ssl3_SendRecord */ - } - totalSent += sent; - if (ss->pendingBuf.len) { - /* must be a non-blocking socket */ - PORT_Assert(!ssl_SocketIsBlocking(ss)); - PORT_Assert(ss->lastWriteBlocked); - break; - } - } - if (ss->pendingBuf.len) { - /* Must be non-blocking. */ - PORT_Assert(!ssl_SocketIsBlocking(ss)); - if (totalSent > 0) { - ss->appDataBuffered = 0x100 | in[totalSent - 1]; - } - - totalSent = totalSent + discarded - 1; - if (totalSent <= 0) { - PORT_SetError(PR_WOULD_BLOCK_ERROR); - totalSent = SECFailure; - } - return totalSent; - } - ss->appDataBuffered = 0; - return totalSent + discarded; -} - -/* Attempt to send the content of sendBuf buffer in an SSL handshake record. - * This function returns SECSuccess or SECFailure, never SECWouldBlock. - * Always set sendBuf.len to 0, even when returning SECFailure. - * - * Called from SSL3_SendAlert(), ssl3_SendChangeCipherSpecs(), - * ssl3_AppendHandshake(), ssl3_SendClientHello(), - * ssl3_SendHelloRequest(), ssl3_SendServerHelloDone(), - * ssl3_SendFinished(), - */ -static SECStatus -ssl3_FlushHandshake(sslSocket *ss, PRInt32 flags) -{ - PRInt32 rv = SECSuccess; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - if (!ss->sec.ci.sendBuf.buf || !ss->sec.ci.sendBuf.len) - return rv; - - /* only this flag is allowed */ - PORT_Assert(!(flags & ~ssl_SEND_FLAG_FORCE_INTO_BUFFER)); - if ((flags & ~ssl_SEND_FLAG_FORCE_INTO_BUFFER) != 0) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } else { - rv = ssl3_SendRecord(ss, content_handshake, ss->sec.ci.sendBuf.buf, - ss->sec.ci.sendBuf.len, flags); - } - if (rv < 0) { - int err = PORT_GetError(); - PORT_Assert(err != PR_WOULD_BLOCK_ERROR); - if (err == PR_WOULD_BLOCK_ERROR) { - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - } - } else if (rv < ss->sec.ci.sendBuf.len) { - /* short write should never happen */ - PORT_Assert(rv >= ss->sec.ci.sendBuf.len); - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - rv = SECFailure; - } else { - rv = SECSuccess; - } - - /* Whether we succeeded or failed, toss the old handshake data. */ - ss->sec.ci.sendBuf.len = 0; - return rv; -} - -/* - * Called from ssl3_HandleAlert and from ssl3_HandleCertificate when - * the remote client sends a negative response to our certificate request. - * Returns SECFailure if the application has required client auth. - * SECSuccess otherwise. - */ -static SECStatus -ssl3_HandleNoCertificate(sslSocket *ss) -{ - if (ss->sec.peerCert != NULL) { - if (ss->sec.peerKey != NULL) { - SECKEY_DestroyPublicKey(ss->sec.peerKey); - ss->sec.peerKey = NULL; - } - CERT_DestroyCertificate(ss->sec.peerCert); - ss->sec.peerCert = NULL; - } - ssl3_CleanupPeerCerts(ss); - - /* If the server has required client-auth blindly but doesn't - * actually look at the certificate it won't know that no - * certificate was presented so we shutdown the socket to ensure - * an error. We only do this if we haven't already completed the - * first handshake because if we're redoing the handshake we - * know the server is paying attention to the certificate. - */ - if ((ss->opt.requireCertificate == SSL_REQUIRE_ALWAYS) || - (!ss->firstHsDone && - (ss->opt.requireCertificate == SSL_REQUIRE_FIRST_HANDSHAKE))) { - PRFileDesc * lower; - - ss->sec.uncache(ss->sec.ci.sid); - SSL3_SendAlert(ss, alert_fatal, bad_certificate); - - lower = ss->fd->lower; -#ifdef _WIN32 - lower->methods->shutdown(lower, PR_SHUTDOWN_SEND); -#else - lower->methods->shutdown(lower, PR_SHUTDOWN_BOTH); -#endif - PORT_SetError(SSL_ERROR_NO_CERTIFICATE); - return SECFailure; - } - return SECSuccess; -} - -/************************************************************************ - * Alerts - */ - -/* -** Acquires both handshake and XmitBuf locks. -** Called from: ssl3_IllegalParameter <- -** ssl3_HandshakeFailure <- -** ssl3_HandleAlert <- ssl3_HandleRecord. -** ssl3_HandleChangeCipherSpecs <- ssl3_HandleRecord -** ssl3_ConsumeHandshakeVariable <- -** ssl3_HandleHelloRequest <- -** ssl3_HandleServerHello <- -** ssl3_HandleServerKeyExchange <- -** ssl3_HandleCertificateRequest <- -** ssl3_HandleServerHelloDone <- -** ssl3_HandleClientHello <- -** ssl3_HandleV2ClientHello <- -** ssl3_HandleCertificateVerify <- -** ssl3_HandleClientKeyExchange <- -** ssl3_HandleCertificate <- -** ssl3_HandleFinished <- -** ssl3_HandleHandshakeMessage <- -** ssl3_HandleRecord <- -** -*/ -SECStatus -SSL3_SendAlert(sslSocket *ss, SSL3AlertLevel level, SSL3AlertDescription desc) -{ - uint8 bytes[2]; - SECStatus rv; - - SSL_TRC(3, ("%d: SSL3[%d]: send alert record, level=%d desc=%d", - SSL_GETPID(), ss->fd, level, desc)); - - bytes[0] = level; - bytes[1] = desc; - - ssl_GetSSL3HandshakeLock(ss); - if (level == alert_fatal) { - if (ss->sec.ci.sid) { - ss->sec.uncache(ss->sec.ci.sid); - } - } - ssl_GetXmitBufLock(ss); - rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); - if (rv == SECSuccess) { - PRInt32 sent; - sent = ssl3_SendRecord(ss, content_alert, bytes, 2, - desc == no_certificate - ? ssl_SEND_FLAG_FORCE_INTO_BUFFER : 0); - rv = (sent >= 0) ? SECSuccess : (SECStatus)sent; - } - ssl_ReleaseXmitBufLock(ss); - ssl_ReleaseSSL3HandshakeLock(ss); - return rv; /* error set by ssl3_FlushHandshake or ssl3_SendRecord */ -} - -/* - * Send illegal_parameter alert. Set generic error number. - */ -static SECStatus -ssl3_IllegalParameter(sslSocket *ss) -{ - PRBool isTLS; - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - (void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter); - PORT_SetError(ss->sec.isServer ? SSL_ERROR_BAD_CLIENT - : SSL_ERROR_BAD_SERVER ); - return SECFailure; -} - -/* - * Send handshake_Failure alert. Set generic error number. - */ -static SECStatus -ssl3_HandshakeFailure(sslSocket *ss) -{ - (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure); - PORT_SetError( ss->sec.isServer ? SSL_ERROR_BAD_CLIENT - : SSL_ERROR_BAD_SERVER ); - return SECFailure; -} - -/* - * Send handshake_Failure alert. Set generic error number. - */ -static SECStatus -ssl3_DecodeError(sslSocket *ss) -{ - (void)SSL3_SendAlert(ss, alert_fatal, - ss->version > SSL_LIBRARY_VERSION_3_0 ? decode_error - : illegal_parameter); - PORT_SetError( ss->sec.isServer ? SSL_ERROR_BAD_CLIENT - : SSL_ERROR_BAD_SERVER ); - return SECFailure; -} - -/* Called from ssl3_HandleRecord. -** Caller must hold both RecvBuf and Handshake locks. -*/ -static SECStatus -ssl3_HandleAlert(sslSocket *ss, sslBuffer *buf) -{ - SSL3AlertLevel level; - SSL3AlertDescription desc; - int error; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - SSL_TRC(3, ("%d: SSL3[%d]: handle alert record", SSL_GETPID(), ss->fd)); - - if (buf->len != 2) { - (void)ssl3_DecodeError(ss); - PORT_SetError(SSL_ERROR_RX_MALFORMED_ALERT); - return SECFailure; - } - level = (SSL3AlertLevel)buf->buf[0]; - desc = (SSL3AlertDescription)buf->buf[1]; - buf->len = 0; - SSL_TRC(5, ("%d: SSL3[%d] received alert, level = %d, description = %d", - SSL_GETPID(), ss->fd, level, desc)); - - switch (desc) { - case close_notify: ss->recvdCloseNotify = 1; - error = SSL_ERROR_CLOSE_NOTIFY_ALERT; break; - case unexpected_message: error = SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT; - break; - case bad_record_mac: error = SSL_ERROR_BAD_MAC_ALERT; break; - case decryption_failed: error = SSL_ERROR_DECRYPTION_FAILED_ALERT; - break; - case record_overflow: error = SSL_ERROR_RECORD_OVERFLOW_ALERT; break; - case decompression_failure: error = SSL_ERROR_DECOMPRESSION_FAILURE_ALERT; - break; - case handshake_failure: error = SSL_ERROR_HANDSHAKE_FAILURE_ALERT; - break; - case no_certificate: error = SSL_ERROR_NO_CERTIFICATE; break; - case bad_certificate: error = SSL_ERROR_BAD_CERT_ALERT; break; - case unsupported_certificate:error = SSL_ERROR_UNSUPPORTED_CERT_ALERT;break; - case certificate_revoked: error = SSL_ERROR_REVOKED_CERT_ALERT; break; - case certificate_expired: error = SSL_ERROR_EXPIRED_CERT_ALERT; break; - case certificate_unknown: error = SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT; - break; - case illegal_parameter: error = SSL_ERROR_ILLEGAL_PARAMETER_ALERT;break; - - /* All alerts below are TLS only. */ - case unknown_ca: error = SSL_ERROR_UNKNOWN_CA_ALERT; break; - case access_denied: error = SSL_ERROR_ACCESS_DENIED_ALERT; break; - case decode_error: error = SSL_ERROR_DECODE_ERROR_ALERT; break; - case decrypt_error: error = SSL_ERROR_DECRYPT_ERROR_ALERT; break; - case export_restriction: error = SSL_ERROR_EXPORT_RESTRICTION_ALERT; - break; - case protocol_version: error = SSL_ERROR_PROTOCOL_VERSION_ALERT; break; - case insufficient_security: error = SSL_ERROR_INSUFFICIENT_SECURITY_ALERT; - break; - case internal_error: error = SSL_ERROR_INTERNAL_ERROR_ALERT; break; - case user_canceled: error = SSL_ERROR_USER_CANCELED_ALERT; break; - case no_renegotiation: error = SSL_ERROR_NO_RENEGOTIATION_ALERT; break; - - /* Alerts for TLS client hello extensions */ - case unsupported_extension: - error = SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT; break; - case certificate_unobtainable: - error = SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT; break; - case unrecognized_name: - error = SSL_ERROR_UNRECOGNIZED_NAME_ALERT; break; - case bad_certificate_status_response: - error = SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT; break; - case bad_certificate_hash_value: - error = SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT; break; - default: error = SSL_ERROR_RX_UNKNOWN_ALERT; break; - } - if (level == alert_fatal) { - ss->sec.uncache(ss->sec.ci.sid); - if ((ss->ssl3.hs.ws == wait_server_hello) && - (desc == handshake_failure)) { - /* XXX This is a hack. We're assuming that any handshake failure - * XXX on the client hello is a failure to match ciphers. - */ - error = SSL_ERROR_NO_CYPHER_OVERLAP; - } - PORT_SetError(error); - return SECFailure; - } - if ((desc == no_certificate) && (ss->ssl3.hs.ws == wait_client_cert)) { - /* I'm a server. I've requested a client cert. He hasn't got one. */ - SECStatus rv; - - PORT_Assert(ss->sec.isServer); - ss->ssl3.hs.ws = wait_client_key; - rv = ssl3_HandleNoCertificate(ss); - return rv; - } - return SECSuccess; -} - -/* - * Change Cipher Specs - * Called from ssl3_HandleServerHelloDone, - * ssl3_HandleClientHello, - * and ssl3_HandleFinished - * - * Acquires and releases spec write lock, to protect switching the current - * and pending write spec pointers. - */ - -static SECStatus -ssl3_SendChangeCipherSpecs(sslSocket *ss) -{ - uint8 change = change_cipher_spec_choice; - ssl3CipherSpec * pwSpec; - SECStatus rv; - PRInt32 sent; - - SSL_TRC(3, ("%d: SSL3[%d]: send change_cipher_spec record", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); - if (rv != SECSuccess) { - return rv; /* error code set by ssl3_FlushHandshake */ - } - sent = ssl3_SendRecord(ss, content_change_cipher_spec, &change, 1, - ssl_SEND_FLAG_FORCE_INTO_BUFFER); - if (sent < 0) { - return (SECStatus)sent; /* error code set by ssl3_SendRecord */ - } - - /* swap the pending and current write specs. */ - ssl_GetSpecWriteLock(ss); /**************************************/ - pwSpec = ss->ssl3.pwSpec; - pwSpec->write_seq_num.high = 0; - pwSpec->write_seq_num.low = 0; - - ss->ssl3.pwSpec = ss->ssl3.cwSpec; - ss->ssl3.cwSpec = pwSpec; - - SSL_TRC(3, ("%d: SSL3[%d] Set Current Write Cipher Suite to Pending", - SSL_GETPID(), ss->fd )); - - /* We need to free up the contexts, keys and certs ! */ - /* If we are really through with the old cipher spec - * (Both the read and write sides have changed) destroy it. - */ - if (ss->ssl3.prSpec == ss->ssl3.pwSpec) { - ssl3_DestroyCipherSpec(ss->ssl3.pwSpec); - } - ssl_ReleaseSpecWriteLock(ss); /**************************************/ - - return SECSuccess; -} - -/* Called from ssl3_HandleRecord. -** Caller must hold both RecvBuf and Handshake locks. - * - * Acquires and releases spec write lock, to protect switching the current - * and pending write spec pointers. -*/ -static SECStatus -ssl3_HandleChangeCipherSpecs(sslSocket *ss, sslBuffer *buf) -{ - ssl3CipherSpec * prSpec; - SSL3WaitState ws = ss->ssl3.hs.ws; - SSL3ChangeCipherSpecChoice change; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - SSL_TRC(3, ("%d: SSL3[%d]: handle change_cipher_spec record", - SSL_GETPID(), ss->fd)); - - if (ws != wait_change_cipher) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER); - return SECFailure; - } - - if(buf->len != 1) { - (void)ssl3_DecodeError(ss); - PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); - return SECFailure; - } - change = (SSL3ChangeCipherSpecChoice)buf->buf[0]; - if (change != change_cipher_spec_choice) { - /* illegal_parameter is correct here for both SSL3 and TLS. */ - (void)ssl3_IllegalParameter(ss); - PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); - return SECFailure; - } - buf->len = 0; - - /* Swap the pending and current read specs. */ - ssl_GetSpecWriteLock(ss); /*************************************/ - prSpec = ss->ssl3.prSpec; - prSpec->read_seq_num.high = prSpec->read_seq_num.low = 0; - - ss->ssl3.prSpec = ss->ssl3.crSpec; - ss->ssl3.crSpec = prSpec; - ss->ssl3.hs.ws = wait_finished; - - SSL_TRC(3, ("%d: SSL3[%d] Set Current Read Cipher Suite to Pending", - SSL_GETPID(), ss->fd )); - - /* If we are really through with the old cipher prSpec - * (Both the read and write sides have changed) destroy it. - */ - if (ss->ssl3.prSpec == ss->ssl3.pwSpec) { - ssl3_DestroyCipherSpec(ss->ssl3.prSpec); - } - ssl_ReleaseSpecWriteLock(ss); /*************************************/ - return SECSuccess; -} - -/* This method uses PKCS11 to derive the MS from the PMS, where PMS -** is a PKCS11 symkey. This is used in all cases except the -** "triple bypass" with RSA key exchange. -** Called from ssl3_InitPendingCipherSpec. prSpec is pwSpec. -*/ -static SECStatus -ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms) -{ - ssl3CipherSpec * pwSpec = ss->ssl3.pwSpec; - const ssl3KEADef *kea_def= ss->ssl3.hs.kea_def; - unsigned char * cr = (unsigned char *)&ss->ssl3.hs.client_random; - unsigned char * sr = (unsigned char *)&ss->ssl3.hs.server_random; - PRBool isTLS = (PRBool)(kea_def->tls_keygen || - (pwSpec->version > SSL_LIBRARY_VERSION_3_0)); - /* - * Whenever isDH is true, we need to use CKM_TLS_MASTER_KEY_DERIVE_DH - * which, unlike CKM_TLS_MASTER_KEY_DERIVE, converts arbitrary size - * data into a 48-byte value. - */ - PRBool isDH = (PRBool) ((ss->ssl3.hs.kea_def->exchKeyType == kt_dh) || - (ss->ssl3.hs.kea_def->exchKeyType == kt_ecdh)); - SECStatus rv = SECFailure; - CK_MECHANISM_TYPE master_derive; - CK_MECHANISM_TYPE key_derive; - SECItem params; - CK_FLAGS keyFlags; - CK_VERSION pms_version; - CK_SSL3_MASTER_KEY_DERIVE_PARAMS master_params; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); - PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); - if (isTLS) { - if(isDH) master_derive = CKM_TLS_MASTER_KEY_DERIVE_DH; - else master_derive = CKM_TLS_MASTER_KEY_DERIVE; - key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; - keyFlags = CKF_SIGN | CKF_VERIFY; - } else { - if (isDH) master_derive = CKM_SSL3_MASTER_KEY_DERIVE_DH; - else master_derive = CKM_SSL3_MASTER_KEY_DERIVE; - key_derive = CKM_SSL3_KEY_AND_MAC_DERIVE; - keyFlags = 0; - } - - if (pms || !pwSpec->master_secret) { - master_params.pVersion = &pms_version; - master_params.RandomInfo.pClientRandom = cr; - master_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH; - master_params.RandomInfo.pServerRandom = sr; - master_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH; - - params.data = (unsigned char *) &master_params; - params.len = sizeof master_params; - } - - if (pms != NULL) { -#if defined(TRACE) - if (ssl_trace >= 100) { - SECStatus extractRV = PK11_ExtractKeyValue(pms); - if (extractRV == SECSuccess) { - SECItem * keyData = PK11_GetKeyData(pms); - if (keyData && keyData->data && keyData->len) { - ssl_PrintBuf(ss, "Pre-Master Secret", - keyData->data, keyData->len); - } - } - } -#endif - pwSpec->master_secret = PK11_DeriveWithFlags(pms, master_derive, - ¶ms, key_derive, CKA_DERIVE, 0, keyFlags); - if (!isDH && pwSpec->master_secret && ss->opt.detectRollBack) { - SSL3ProtocolVersion client_version; - client_version = pms_version.major << 8 | pms_version.minor; - if (client_version != ss->clientHelloVersion) { - /* Destroy it. Version roll-back detected. */ - PK11_FreeSymKey(pwSpec->master_secret); - pwSpec->master_secret = NULL; - } - } - if (pwSpec->master_secret == NULL) { - /* Generate a faux master secret in the same slot as the old one. */ - PK11SlotInfo * slot = PK11_GetSlotFromKey((PK11SymKey *)pms); - PK11SymKey * fpms = ssl3_GenerateRSAPMS(ss, pwSpec, slot); - - PK11_FreeSlot(slot); - if (fpms != NULL) { - pwSpec->master_secret = PK11_DeriveWithFlags(fpms, - master_derive, ¶ms, key_derive, - CKA_DERIVE, 0, keyFlags); - PK11_FreeSymKey(fpms); - } - } - } - if (pwSpec->master_secret == NULL) { - /* Generate a faux master secret from the internal slot. */ - PK11SlotInfo * slot = PK11_GetInternalSlot(); - PK11SymKey * fpms = ssl3_GenerateRSAPMS(ss, pwSpec, slot); - - PK11_FreeSlot(slot); - if (fpms != NULL) { - pwSpec->master_secret = PK11_DeriveWithFlags(fpms, - master_derive, ¶ms, key_derive, - CKA_DERIVE, 0, keyFlags); - if (pwSpec->master_secret == NULL) { - pwSpec->master_secret = fpms; /* use the fpms as the master. */ - fpms = NULL; - } - } - if (fpms) { - PK11_FreeSymKey(fpms); - } - } - if (pwSpec->master_secret == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - return rv; - } - if (ss->opt.bypassPKCS11) { - SECItem * keydata; - /* In hope of doing a "double bypass", - * need to extract the master secret's value from the key object - * and store it raw in the sslSocket struct. - */ - rv = PK11_ExtractKeyValue(pwSpec->master_secret); - if (rv != SECSuccess) { -#if defined(NSS_SURVIVE_DOUBLE_BYPASS_FAILURE) - /* The double bypass failed. - * Attempt to revert to an all PKCS#11, non-bypass method. - * Do we need any unacquired locks here? - */ - ss->opt.bypassPKCS11 = 0; - rv = ssl3_NewHandshakeHashes(ss); - if (rv == SECSuccess) { - rv = ssl3_UpdateHandshakeHashes(ss, ss->ssl3.hs.messages.buf, - ss->ssl3.hs.messages.len); - } -#endif - return rv; - } - /* This returns the address of the secItem inside the key struct, - * not a copy or a reference. So, there's no need to free it. - */ - keydata = PK11_GetKeyData(pwSpec->master_secret); - if (keydata && keydata->len <= sizeof pwSpec->raw_master_secret) { - memcpy(pwSpec->raw_master_secret, keydata->data, keydata->len); - pwSpec->msItem.data = pwSpec->raw_master_secret; - pwSpec->msItem.len = keydata->len; - } else { - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - return SECFailure; - } - } - return SECSuccess; -} - - -/* - * Derive encryption and MAC Keys (and IVs) from master secret - * Sets a useful error code when returning SECFailure. - * - * Called only from ssl3_InitPendingCipherSpec(), - * which in turn is called from - * sendRSAClientKeyExchange (for Full handshake) - * sendDHClientKeyExchange (for Full handshake) - * ssl3_HandleClientKeyExchange (for Full handshake) - * ssl3_HandleServerHello (for session restart) - * ssl3_HandleClientHello (for session restart) - * Caller MUST hold the specWriteLock, and SSL3HandshakeLock. - * ssl3_InitPendingCipherSpec does that. - * - */ -static SECStatus -ssl3_DeriveConnectionKeysPKCS11(sslSocket *ss) -{ - ssl3CipherSpec * pwSpec = ss->ssl3.pwSpec; - const ssl3KEADef * kea_def = ss->ssl3.hs.kea_def; - unsigned char * cr = (unsigned char *)&ss->ssl3.hs.client_random; - unsigned char * sr = (unsigned char *)&ss->ssl3.hs.server_random; - PRBool isTLS = (PRBool)(kea_def->tls_keygen || - (pwSpec->version > SSL_LIBRARY_VERSION_3_0)); - /* following variables used in PKCS11 path */ - const ssl3BulkCipherDef *cipher_def = pwSpec->cipher_def; - PK11SlotInfo * slot = NULL; - PK11SymKey * symKey = NULL; - void * pwArg = ss->pkcs11PinArg; - int keySize; - CK_SSL3_KEY_MAT_PARAMS key_material_params; - CK_SSL3_KEY_MAT_OUT returnedKeys; - CK_MECHANISM_TYPE key_derive; - CK_MECHANISM_TYPE bulk_mechanism; - SSLCipherAlgorithm calg; - SECItem params; - PRBool skipKeysAndIVs = (PRBool)(cipher_def->calg == calg_null); - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); - PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); - - if (!pwSpec->master_secret) { - PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - return SECFailure; - } - /* - * generate the key material - */ - key_material_params.ulMacSizeInBits = pwSpec->mac_size * BPB; - key_material_params.ulKeySizeInBits = cipher_def->secret_key_size* BPB; - key_material_params.ulIVSizeInBits = cipher_def->iv_size * BPB; - - key_material_params.bIsExport = (CK_BBOOL)(kea_def->is_limited); - /* was: (CK_BBOOL)(cipher_def->keygen_mode != kg_strong); */ - - key_material_params.RandomInfo.pClientRandom = cr; - key_material_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH; - key_material_params.RandomInfo.pServerRandom = sr; - key_material_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH; - key_material_params.pReturnedKeyMaterial = &returnedKeys; - - returnedKeys.pIVClient = pwSpec->client.write_iv; - returnedKeys.pIVServer = pwSpec->server.write_iv; - keySize = cipher_def->key_size; - - if (skipKeysAndIVs) { - keySize = 0; - key_material_params.ulKeySizeInBits = 0; - key_material_params.ulIVSizeInBits = 0; - returnedKeys.pIVClient = NULL; - returnedKeys.pIVServer = NULL; - } - - calg = cipher_def->calg; - PORT_Assert( alg2Mech[calg].calg == calg); - bulk_mechanism = alg2Mech[calg].cmech; - - params.data = (unsigned char *)&key_material_params; - params.len = sizeof(key_material_params); - - if (isTLS) { - key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; - } else { - key_derive = CKM_SSL3_KEY_AND_MAC_DERIVE; - } - - /* CKM_SSL3_KEY_AND_MAC_DERIVE is defined to set ENCRYPT, DECRYPT, and - * DERIVE by DEFAULT */ - symKey = PK11_Derive(pwSpec->master_secret, key_derive, ¶ms, - bulk_mechanism, CKA_ENCRYPT, keySize); - if (!symKey) { - ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - return SECFailure; - } - /* we really should use the actual mac'ing mechanism here, but we - * don't because these types are used to map keytype anyway and both - * mac's map to the same keytype. - */ - slot = PK11_GetSlotFromKey(symKey); - - PK11_FreeSlot(slot); /* slot is held until the key is freed */ - pwSpec->client.write_mac_key = - PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, - CKM_SSL3_SHA1_MAC, returnedKeys.hClientMacSecret, PR_TRUE, pwArg); - if (pwSpec->client.write_mac_key == NULL ) { - goto loser; /* loser sets err */ - } - pwSpec->server.write_mac_key = - PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, - CKM_SSL3_SHA1_MAC, returnedKeys.hServerMacSecret, PR_TRUE, pwArg); - if (pwSpec->server.write_mac_key == NULL ) { - goto loser; /* loser sets err */ - } - if (!skipKeysAndIVs) { - pwSpec->client.write_key = - PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, - bulk_mechanism, returnedKeys.hClientKey, PR_TRUE, pwArg); - if (pwSpec->client.write_key == NULL ) { - goto loser; /* loser sets err */ - } - pwSpec->server.write_key = - PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, - bulk_mechanism, returnedKeys.hServerKey, PR_TRUE, pwArg); - if (pwSpec->server.write_key == NULL ) { - goto loser; /* loser sets err */ - } - } - PK11_FreeSymKey(symKey); - return SECSuccess; - - -loser: - if (symKey) PK11_FreeSymKey(symKey); - ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); - return SECFailure; -} - -static SECStatus -ssl3_RestartHandshakeHashes(sslSocket *ss) -{ - SECStatus rv = SECSuccess; - - if (ss->opt.bypassPKCS11) { - ss->ssl3.hs.messages.len = 0; - MD5_Begin((MD5Context *)ss->ssl3.hs.md5_cx); - SHA1_Begin((SHA1Context *)ss->ssl3.hs.sha_cx); - } else { - rv = PK11_DigestBegin(ss->ssl3.hs.md5); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - return rv; - } - rv = PK11_DigestBegin(ss->ssl3.hs.sha); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - return rv; - } - } - return rv; -} - -static SECStatus -ssl3_NewHandshakeHashes(sslSocket *ss) -{ - PK11Context *md5 = NULL; - PK11Context *sha = NULL; - - /* - * note: We should probably lookup an SSL3 slot for these - * handshake hashes in hopes that we wind up with the same slots - * that the master secret will wind up in ... - */ - SSL_TRC(30,("%d: SSL3[%d]: start handshake hashes", SSL_GETPID(), ss->fd)); - if (ss->opt.bypassPKCS11) { - PORT_Assert(!ss->ssl3.hs.messages.buf && !ss->ssl3.hs.messages.space); - ss->ssl3.hs.messages.buf = NULL; - ss->ssl3.hs.messages.space = 0; - } else { - ss->ssl3.hs.md5 = md5 = PK11_CreateDigestContext(SEC_OID_MD5); - ss->ssl3.hs.sha = sha = PK11_CreateDigestContext(SEC_OID_SHA1); - if (md5 == NULL) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - goto loser; - } - if (sha == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - goto loser; - } - } - if (SECSuccess == ssl3_RestartHandshakeHashes(ss)) { - return SECSuccess; - } - -loser: - if (md5 != NULL) { - PK11_DestroyContext(md5, PR_TRUE); - ss->ssl3.hs.md5 = NULL; - } - if (sha != NULL) { - PK11_DestroyContext(sha, PR_TRUE); - ss->ssl3.hs.sha = NULL; - } - return SECFailure; - -} - -/* - * Handshake messages - */ -/* Called from ssl3_AppendHandshake() -** ssl3_StartHandshakeHash() -** ssl3_HandleV2ClientHello() -** ssl3_HandleHandshakeMessage() -** Caller must hold the ssl3Handshake lock. -*/ -static SECStatus -ssl3_UpdateHandshakeHashes(sslSocket *ss, unsigned char *b, unsigned int l) -{ - SECStatus rv = SECSuccess; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - PRINT_BUF(90, (NULL, "MD5 & SHA handshake hash input:", b, l)); - - if (ss->opt.bypassPKCS11) { - MD5_Update((MD5Context *)ss->ssl3.hs.md5_cx, b, l); - SHA1_Update((SHA1Context *)ss->ssl3.hs.sha_cx, b, l); -#if defined(NSS_SURVIVE_DOUBLE_BYPASS_FAILURE) - rv = sslBuffer_Append(&ss->ssl3.hs.messages, b, l); -#endif - return rv; - } - rv = PK11_DigestOp(ss->ssl3.hs.md5, b, l); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - return rv; - } - rv = PK11_DigestOp(ss->ssl3.hs.sha, b, l); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - return rv; - } - return rv; -} - -/************************************************************************** - * Append Handshake functions. - * All these functions set appropriate error codes. - * Most rely on ssl3_AppendHandshake to set the error code. - **************************************************************************/ -SECStatus -ssl3_AppendHandshake(sslSocket *ss, const void *void_src, PRInt32 bytes) -{ - unsigned char * src = (unsigned char *)void_src; - int room = ss->sec.ci.sendBuf.space - ss->sec.ci.sendBuf.len; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); /* protects sendBuf. */ - - if (ss->sec.ci.sendBuf.space < MAX_SEND_BUF_LENGTH && room < bytes) { - rv = sslBuffer_Grow(&ss->sec.ci.sendBuf, PR_MAX(MIN_SEND_BUF_LENGTH, - PR_MIN(MAX_SEND_BUF_LENGTH, ss->sec.ci.sendBuf.len + bytes))); - if (rv != SECSuccess) - return rv; /* sslBuffer_Grow has set a memory error code. */ - room = ss->sec.ci.sendBuf.space - ss->sec.ci.sendBuf.len; - } - - PRINT_BUF(60, (ss, "Append to Handshake", (unsigned char*)void_src, bytes)); - rv = ssl3_UpdateHandshakeHashes(ss, src, bytes); - if (rv != SECSuccess) - return rv; /* error code set by ssl3_UpdateHandshakeHashes */ - - while (bytes > room) { - if (room > 0) - PORT_Memcpy(ss->sec.ci.sendBuf.buf + ss->sec.ci.sendBuf.len, src, - room); - ss->sec.ci.sendBuf.len += room; - rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); - if (rv != SECSuccess) { - return rv; /* error code set by ssl3_FlushHandshake */ - } - bytes -= room; - src += room; - room = ss->sec.ci.sendBuf.space; - PORT_Assert(ss->sec.ci.sendBuf.len == 0); - } - PORT_Memcpy(ss->sec.ci.sendBuf.buf + ss->sec.ci.sendBuf.len, src, bytes); - ss->sec.ci.sendBuf.len += bytes; - return SECSuccess; -} - -SECStatus -ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num, PRInt32 lenSize) -{ - SECStatus rv; - uint8 b[4]; - uint8 * p = b; - - switch (lenSize) { - case 4: - *p++ = (num >> 24) & 0xff; - case 3: - *p++ = (num >> 16) & 0xff; - case 2: - *p++ = (num >> 8) & 0xff; - case 1: - *p = num & 0xff; - } - SSL_TRC(60, ("%d: number:", SSL_GETPID())); - rv = ssl3_AppendHandshake(ss, &b[0], lenSize); - return rv; /* error code set by AppendHandshake, if applicable. */ -} - -SECStatus -ssl3_AppendHandshakeVariable( - sslSocket *ss, const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize) -{ - SECStatus rv; - - PORT_Assert((bytes < (1<<8) && lenSize == 1) || - (bytes < (1L<<16) && lenSize == 2) || - (bytes < (1L<<24) && lenSize == 3)); - - SSL_TRC(60,("%d: append variable:", SSL_GETPID())); - rv = ssl3_AppendHandshakeNumber(ss, bytes, lenSize); - if (rv != SECSuccess) { - return rv; /* error code set by AppendHandshake, if applicable. */ - } - SSL_TRC(60, ("data:")); - rv = ssl3_AppendHandshake(ss, src, bytes); - return rv; /* error code set by AppendHandshake, if applicable. */ -} - -SECStatus -ssl3_AppendHandshakeHeader(sslSocket *ss, SSL3HandshakeType t, PRUint32 length) -{ - SECStatus rv; - - SSL_TRC(30,("%d: SSL3[%d]: append handshake header: type %s", - SSL_GETPID(), ss->fd, ssl3_DecodeHandshakeType(t))); - PRINT_BUF(60, (ss, "MD5 handshake hash:", - (unsigned char*)ss->ssl3.hs.md5_cx, MD5_LENGTH)); - PRINT_BUF(95, (ss, "SHA handshake hash:", - (unsigned char*)ss->ssl3.hs.sha_cx, SHA1_LENGTH)); - - rv = ssl3_AppendHandshakeNumber(ss, t, 1); - if (rv != SECSuccess) { - return rv; /* error code set by AppendHandshake, if applicable. */ - } - rv = ssl3_AppendHandshakeNumber(ss, length, 3); - return rv; /* error code set by AppendHandshake, if applicable. */ -} - -/************************************************************************** - * Consume Handshake functions. - * - * All data used in these functions is protected by two locks, - * the RecvBufLock and the SSL3HandshakeLock - **************************************************************************/ - -/* Read up the next "bytes" number of bytes from the (decrypted) input - * stream "b" (which is *length bytes long). Copy them into buffer "v". - * Reduces *length by bytes. Advances *b by bytes. - * - * If this function returns SECFailure, it has already sent an alert, - * and has set a generic error code. The caller should probably - * override the generic error code by setting another. - */ -SECStatus -ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRInt32 bytes, SSL3Opaque **b, - PRUint32 *length) -{ - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if ((PRUint32)bytes > *length) { - return ssl3_DecodeError(ss); - } - PORT_Memcpy(v, *b, bytes); - PRINT_BUF(60, (ss, "consume bytes:", *b, bytes)); - *b += bytes; - *length -= bytes; - return SECSuccess; -} - -/* Read up the next "bytes" number of bytes from the (decrypted) input - * stream "b" (which is *length bytes long), and interpret them as an - * integer in network byte order. Returns the received value. - * Reduces *length by bytes. Advances *b by bytes. - * - * Returns SECFailure (-1) on failure. - * This value is indistinguishable from the equivalent received value. - * Only positive numbers are to be received this way. - * Thus, the largest value that may be sent this way is 0x7fffffff. - * On error, an alert has been sent, and a generic error code has been set. - */ -PRInt32 -ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRInt32 bytes, SSL3Opaque **b, - PRUint32 *length) -{ - uint8 *buf = *b; - int i; - PRInt32 num = 0; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( bytes <= sizeof num); - - if ((PRUint32)bytes > *length) { - return ssl3_DecodeError(ss); - } - PRINT_BUF(60, (ss, "consume bytes:", *b, bytes)); - - for (i = 0; i < bytes; i++) - num = (num << 8) + buf[i]; - *b += bytes; - *length -= bytes; - return num; -} - -/* Read in two values from the incoming decrypted byte stream "b", which is - * *length bytes long. The first value is a number whose size is "bytes" - * bytes long. The second value is a byte-string whose size is the value - * of the first number received. The latter byte-string, and its length, - * is returned in the SECItem i. - * - * Returns SECFailure (-1) on failure. - * On error, an alert has been sent, and a generic error code has been set. - * - * RADICAL CHANGE for NSS 3.11. All callers of this function make copies - * of the data returned in the SECItem *i, so making a copy of it here - * is simply wasteful. So, This function now just sets SECItem *i to - * point to the values in the buffer **b. - */ -SECStatus -ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, PRInt32 bytes, - SSL3Opaque **b, PRUint32 *length) -{ - PRInt32 count; - - PORT_Assert(bytes <= 3); - i->len = 0; - i->data = NULL; - count = ssl3_ConsumeHandshakeNumber(ss, bytes, b, length); - if (count < 0) { /* Can't test for SECSuccess here. */ - return SECFailure; - } - if (count > 0) { - if ((PRUint32)count > *length) { - return ssl3_DecodeError(ss); - } - i->data = *b; - i->len = count; - *b += count; - *length -= count; - } - return SECSuccess; -} - -/************************************************************************** - * end of Consume Handshake functions. - **************************************************************************/ - -/* Extract the hashes of handshake messages to this point. - * Called from ssl3_SendCertificateVerify - * ssl3_SendFinished - * ssl3_HandleHandshakeMessage - * - * Caller must hold the SSL3HandshakeLock. - * Caller must hold a read or write lock on the Spec R/W lock. - * (There is presently no way to assert on a Read lock.) - */ -static SECStatus -ssl3_ComputeHandshakeHashes(sslSocket * ss, - ssl3CipherSpec *spec, /* uses ->master_secret */ - SSL3Hashes * hashes, /* output goes here. */ - PRUint32 sender) -{ - SECStatus rv = SECSuccess; - PRBool isTLS = (PRBool)(spec->version > SSL_LIBRARY_VERSION_3_0); - unsigned int outLength; - SSL3Opaque md5_inner[MAX_MAC_LENGTH]; - SSL3Opaque sha_inner[MAX_MAC_LENGTH]; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->opt.bypassPKCS11) { - /* compute them without PKCS11 */ - PRUint64 md5_cx[MAX_MAC_CONTEXT_LLONGS]; - PRUint64 sha_cx[MAX_MAC_CONTEXT_LLONGS]; - -#define md5cx ((MD5Context *)md5_cx) -#define shacx ((SHA1Context *)sha_cx) - - if (!spec->msItem.data) { - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); - return SECFailure; - } - - MD5_Clone (md5cx, (MD5Context *)ss->ssl3.hs.md5_cx); - SHA1_Clone(shacx, (SHA1Context *)ss->ssl3.hs.sha_cx); - - if (!isTLS) { - /* compute hashes for SSL3. */ - unsigned char s[4]; - - s[0] = (unsigned char)(sender >> 24); - s[1] = (unsigned char)(sender >> 16); - s[2] = (unsigned char)(sender >> 8); - s[3] = (unsigned char)sender; - - if (sender != 0) { - MD5_Update(md5cx, s, 4); - PRINT_BUF(95, (NULL, "MD5 inner: sender", s, 4)); - } - - PRINT_BUF(95, (NULL, "MD5 inner: MAC Pad 1", mac_pad_1, - mac_defs[mac_md5].pad_size)); - - MD5_Update(md5cx, spec->msItem.data, spec->msItem.len); - MD5_Update(md5cx, mac_pad_1, mac_defs[mac_md5].pad_size); - MD5_End(md5cx, md5_inner, &outLength, MD5_LENGTH); - - PRINT_BUF(95, (NULL, "MD5 inner: result", md5_inner, outLength)); - - if (sender != 0) { - SHA1_Update(shacx, s, 4); - PRINT_BUF(95, (NULL, "SHA inner: sender", s, 4)); - } - - PRINT_BUF(95, (NULL, "SHA inner: MAC Pad 1", mac_pad_1, - mac_defs[mac_sha].pad_size)); - - SHA1_Update(shacx, spec->msItem.data, spec->msItem.len); - SHA1_Update(shacx, mac_pad_1, mac_defs[mac_sha].pad_size); - SHA1_End(shacx, sha_inner, &outLength, SHA1_LENGTH); - - PRINT_BUF(95, (NULL, "SHA inner: result", sha_inner, outLength)); - PRINT_BUF(95, (NULL, "MD5 outer: MAC Pad 2", mac_pad_2, - mac_defs[mac_md5].pad_size)); - PRINT_BUF(95, (NULL, "MD5 outer: MD5 inner", md5_inner, MD5_LENGTH)); - - MD5_Begin(md5cx); - MD5_Update(md5cx, spec->msItem.data, spec->msItem.len); - MD5_Update(md5cx, mac_pad_2, mac_defs[mac_md5].pad_size); - MD5_Update(md5cx, md5_inner, MD5_LENGTH); - } - MD5_End(md5cx, hashes->md5, &outLength, MD5_LENGTH); - - PRINT_BUF(60, (NULL, "MD5 outer: result", hashes->md5, MD5_LENGTH)); - - if (!isTLS) { - PRINT_BUF(95, (NULL, "SHA outer: MAC Pad 2", mac_pad_2, - mac_defs[mac_sha].pad_size)); - PRINT_BUF(95, (NULL, "SHA outer: SHA inner", sha_inner, SHA1_LENGTH)); - - SHA1_Begin(shacx); - SHA1_Update(shacx, spec->msItem.data, spec->msItem.len); - SHA1_Update(shacx, mac_pad_2, mac_defs[mac_sha].pad_size); - SHA1_Update(shacx, sha_inner, SHA1_LENGTH); - } - SHA1_End(shacx, hashes->sha, &outLength, SHA1_LENGTH); - - PRINT_BUF(60, (NULL, "SHA outer: result", hashes->sha, SHA1_LENGTH)); - - rv = SECSuccess; -#undef md5cx -#undef shacx - } else { - /* compute hases with PKCS11 */ - PK11Context * md5; - PK11Context * sha = NULL; - unsigned char *md5StateBuf = NULL; - unsigned char *shaStateBuf = NULL; - unsigned int md5StateLen, shaStateLen; - unsigned char md5StackBuf[256]; - unsigned char shaStackBuf[512]; - - if (!spec->master_secret) { - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); - return SECFailure; - } - - md5StateBuf = PK11_SaveContextAlloc(ss->ssl3.hs.md5, md5StackBuf, - sizeof md5StackBuf, &md5StateLen); - if (md5StateBuf == NULL) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - goto loser; - } - md5 = ss->ssl3.hs.md5; - - shaStateBuf = PK11_SaveContextAlloc(ss->ssl3.hs.sha, shaStackBuf, - sizeof shaStackBuf, &shaStateLen); - if (shaStateBuf == NULL) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - goto loser; - } - sha = ss->ssl3.hs.sha; - - if (!isTLS) { - /* compute hashes for SSL3. */ - unsigned char s[4]; - - s[0] = (unsigned char)(sender >> 24); - s[1] = (unsigned char)(sender >> 16); - s[2] = (unsigned char)(sender >> 8); - s[3] = (unsigned char)sender; - - if (sender != 0) { - rv |= PK11_DigestOp(md5, s, 4); - PRINT_BUF(95, (NULL, "MD5 inner: sender", s, 4)); - } - - PRINT_BUF(95, (NULL, "MD5 inner: MAC Pad 1", mac_pad_1, - mac_defs[mac_md5].pad_size)); - - rv |= PK11_DigestKey(md5,spec->master_secret); - rv |= PK11_DigestOp(md5, mac_pad_1, mac_defs[mac_md5].pad_size); - rv |= PK11_DigestFinal(md5, md5_inner, &outLength, MD5_LENGTH); - PORT_Assert(rv != SECSuccess || outLength == MD5_LENGTH); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - rv = SECFailure; - goto loser; - } - - PRINT_BUF(95, (NULL, "MD5 inner: result", md5_inner, outLength)); - - if (sender != 0) { - rv |= PK11_DigestOp(sha, s, 4); - PRINT_BUF(95, (NULL, "SHA inner: sender", s, 4)); - } - - PRINT_BUF(95, (NULL, "SHA inner: MAC Pad 1", mac_pad_1, - mac_defs[mac_sha].pad_size)); - - rv |= PK11_DigestKey(sha, spec->master_secret); - rv |= PK11_DigestOp(sha, mac_pad_1, mac_defs[mac_sha].pad_size); - rv |= PK11_DigestFinal(sha, sha_inner, &outLength, SHA1_LENGTH); - PORT_Assert(rv != SECSuccess || outLength == SHA1_LENGTH); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - rv = SECFailure; - goto loser; - } - - PRINT_BUF(95, (NULL, "SHA inner: result", sha_inner, outLength)); - - PRINT_BUF(95, (NULL, "MD5 outer: MAC Pad 2", mac_pad_2, - mac_defs[mac_md5].pad_size)); - PRINT_BUF(95, (NULL, "MD5 outer: MD5 inner", md5_inner, MD5_LENGTH)); - - rv |= PK11_DigestBegin(md5); - rv |= PK11_DigestKey(md5, spec->master_secret); - rv |= PK11_DigestOp(md5, mac_pad_2, mac_defs[mac_md5].pad_size); - rv |= PK11_DigestOp(md5, md5_inner, MD5_LENGTH); - } - rv |= PK11_DigestFinal(md5, hashes->md5, &outLength, MD5_LENGTH); - PORT_Assert(rv != SECSuccess || outLength == MD5_LENGTH); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - rv = SECFailure; - goto loser; - } - - PRINT_BUF(60, (NULL, "MD5 outer: result", hashes->md5, MD5_LENGTH)); - - if (!isTLS) { - PRINT_BUF(95, (NULL, "SHA outer: MAC Pad 2", mac_pad_2, - mac_defs[mac_sha].pad_size)); - PRINT_BUF(95, (NULL, "SHA outer: SHA inner", sha_inner, SHA1_LENGTH)); - - rv |= PK11_DigestBegin(sha); - rv |= PK11_DigestKey(sha,spec->master_secret); - rv |= PK11_DigestOp(sha, mac_pad_2, mac_defs[mac_sha].pad_size); - rv |= PK11_DigestOp(sha, sha_inner, SHA1_LENGTH); - } - rv |= PK11_DigestFinal(sha, hashes->sha, &outLength, SHA1_LENGTH); - PORT_Assert(rv != SECSuccess || outLength == SHA1_LENGTH); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - rv = SECFailure; - goto loser; - } - - PRINT_BUF(60, (NULL, "SHA outer: result", hashes->sha, SHA1_LENGTH)); - - rv = SECSuccess; - - loser: - if (md5StateBuf) { - if (PK11_RestoreContext(ss->ssl3.hs.md5, md5StateBuf, md5StateLen) - != SECSuccess) - { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - rv = SECFailure; - } - if (md5StateBuf != md5StackBuf) { - PORT_ZFree(md5StateBuf, md5StateLen); - } - } - if (shaStateBuf) { - if (PK11_RestoreContext(ss->ssl3.hs.sha, shaStateBuf, shaStateLen) - != SECSuccess) - { - ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); - rv = SECFailure; - } - if (shaStateBuf != shaStackBuf) { - PORT_ZFree(shaStateBuf, shaStateLen); - } - } - } - return rv; -} - -/* - * SSL 2 based implementations pass in the initial outbound buffer - * so that the handshake hash can contain the included information. - * - * Called from ssl2_BeginClientHandshake() in sslcon.c - */ -SECStatus -ssl3_StartHandshakeHash(sslSocket *ss, unsigned char * buf, int length) -{ - SECStatus rv; - - ssl_GetSSL3HandshakeLock(ss); /**************************************/ - - rv = ssl3_InitState(ss); - if (rv != SECSuccess) { - goto done; /* ssl3_InitState has set the error code. */ - } - - PORT_Memset(&ss->ssl3.hs.client_random, 0, SSL3_RANDOM_LENGTH); - PORT_Memcpy( - &ss->ssl3.hs.client_random.rand[SSL3_RANDOM_LENGTH - SSL_CHALLENGE_BYTES], - &ss->sec.ci.clientChallenge, - SSL_CHALLENGE_BYTES); - - rv = ssl3_UpdateHandshakeHashes(ss, buf, length); - /* if it failed, ssl3_UpdateHandshakeHashes has set the error code. */ - -done: - ssl_ReleaseSSL3HandshakeLock(ss); /**************************************/ - return rv; -} - -/************************************************************************** - * end of Handshake Hash functions. - * Begin Send and Handle functions for handshakes. - **************************************************************************/ - -/* Called from ssl3_HandleHelloRequest(), - * ssl3_HandleFinished() (for step-up) - * ssl3_RedoHandshake() - * ssl2_BeginClientHandshake (when resuming ssl3 session) - */ -SECStatus -ssl3_SendClientHello(sslSocket *ss) -{ - sslSessionID * sid; - ssl3CipherSpec * cwSpec; - SECStatus rv; - int i; - int length; - int num_suites; - int actual_count = 0; - PRInt32 total_exten_len = 0; - - SSL_TRC(3, ("%d: SSL3[%d]: send client_hello handshake", SSL_GETPID(), - ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - rv = ssl3_InitState(ss); - if (rv != SECSuccess) { - return rv; /* ssl3_InitState has set the error code. */ - } - - /* We might be starting a session renegotiation in which case we should - * clear previous state. - */ - PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData)); - - SSL_TRC(30,("%d: SSL3[%d]: reset handshake hashes", - SSL_GETPID(), ss->fd )); - rv = ssl3_RestartHandshakeHashes(ss); - if (rv != SECSuccess) { - return rv; - } - - /* We ignore ss->sec.ci.sid here, and use ssl_Lookup because Lookup - * handles expired entries and other details. - * XXX If we've been called from ssl2_BeginClientHandshake, then - * this lookup is duplicative and wasteful. - */ - sid = (ss->opt.noCache) ? NULL - : ssl_LookupSID(&ss->sec.ci.peer, ss->sec.ci.port, ss->peerID, ss->url); - - /* We can't resume based on a different token. If the sid exists, - * make sure the token that holds the master secret still exists ... - * If we previously did client-auth, make sure that the token that holds - * the private key still exists, is logged in, hasn't been removed, etc. - */ - if (sid) { - PRBool sidOK = PR_TRUE; - if (sid->u.ssl3.keys.msIsWrapped) { - /* Session key was wrapped, which means it was using PKCS11, */ - PK11SlotInfo *slot = NULL; - if (sid->u.ssl3.masterValid && !ss->opt.bypassPKCS11) { - slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID, - sid->u.ssl3.masterSlotID); - } - if (slot == NULL) { - sidOK = PR_FALSE; - } else { - PK11SymKey *wrapKey = NULL; - if (!PK11_IsPresent(slot) || - ((wrapKey = PK11_GetWrapKey(slot, - sid->u.ssl3.masterWrapIndex, - sid->u.ssl3.masterWrapMech, - sid->u.ssl3.masterWrapSeries, - ss->pkcs11PinArg)) == NULL) ) { - sidOK = PR_FALSE; - } - if (wrapKey) PK11_FreeSymKey(wrapKey); - PK11_FreeSlot(slot); - slot = NULL; - } - } - /* If we previously did client-auth, make sure that the token that - ** holds the private key still exists, is logged in, hasn't been - ** removed, etc. - */ - if (sidOK && !ssl3_ClientAuthTokenPresent(sid)) { - sidOK = PR_FALSE; - } - - if (!sidOK) { - SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_not_ok ); - (*ss->sec.uncache)(sid); - ssl_FreeSID(sid); - sid = NULL; - } - } - - if (sid) { - SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_hits ); - - /* Are we attempting a stateless session resume? */ - if (sid->version > SSL_LIBRARY_VERSION_3_0 && - sid->u.ssl3.sessionTicket.ticket.data) - SSL_AtomicIncrementLong(& ssl3stats.sch_sid_stateless_resumes ); - - rv = ssl3_NegotiateVersion(ss, sid->version); - if (rv != SECSuccess) - return rv; /* error code was set */ - - PRINT_BUF(4, (ss, "client, found session-id:", sid->u.ssl3.sessionID, - sid->u.ssl3.sessionIDLength)); - - ss->ssl3.policy = sid->u.ssl3.policy; - } else { - SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_misses ); - - rv = ssl3_NegotiateVersion(ss, SSL_LIBRARY_VERSION_3_1_TLS); - if (rv != SECSuccess) - return rv; /* error code was set */ - - sid = ssl3_NewSessionID(ss, PR_FALSE); - if (!sid) { - return SECFailure; /* memory error is set */ - } - } - - ssl_GetSpecWriteLock(ss); - cwSpec = ss->ssl3.cwSpec; - if (cwSpec->mac_def->mac == mac_null) { - /* SSL records are not being MACed. */ - cwSpec->version = ss->version; - } - ssl_ReleaseSpecWriteLock(ss); - - if (ss->sec.ci.sid != NULL) { - ssl_FreeSID(ss->sec.ci.sid); /* decrement ref count, free if zero */ - } - ss->sec.ci.sid = sid; - - ss->sec.send = ssl3_SendApplicationData; - - /* shouldn't get here if SSL3 is disabled, but ... */ - PORT_Assert(ss->opt.enableSSL3 || ss->opt.enableTLS); - if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) { - PORT_SetError(SSL_ERROR_SSL_DISABLED); - return SECFailure; - } - - /* how many suites does our PKCS11 support (regardless of policy)? */ - num_suites = ssl3_config_match_init(ss); - if (!num_suites) - return SECFailure; /* ssl3_config_match_init has set error code. */ - - if (ss->opt.enableTLS && ss->version > SSL_LIBRARY_VERSION_3_0) { - PRUint32 maxBytes = 65535; /* 2^16 - 1 */ - PRInt32 extLen; - - extLen = ssl3_CallHelloExtensionSenders(ss, PR_FALSE, maxBytes, NULL); - if (extLen < 0) { - return SECFailure; - } - maxBytes -= extLen; - total_exten_len += extLen; - - if (total_exten_len > 0) - total_exten_len += 2; - } -#if defined(NSS_ENABLE_ECC) && !defined(NSS_ECC_MORE_THAN_SUITE_B) - else { /* SSL3 only */ - ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */ - } -#endif - - /* how many suites are permitted by policy and user preference? */ - num_suites = count_cipher_suites(ss, ss->ssl3.policy, PR_TRUE); - if (!num_suites) - return SECFailure; /* count_cipher_suites has set error code. */ - - length = sizeof(SSL3ProtocolVersion) + SSL3_RANDOM_LENGTH + - 1 + ((sid == NULL) ? 0 : sid->u.ssl3.sessionIDLength) + - 2 + num_suites*sizeof(ssl3CipherSuite) + - 1 + compressionMethodsCount + total_exten_len; - - rv = ssl3_AppendHandshakeHeader(ss, client_hello, length); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - - ss->clientHelloVersion = ss->version; - rv = ssl3_AppendHandshakeNumber(ss, ss->clientHelloVersion, 2); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - rv = ssl3_GetNewRandom(&ss->ssl3.hs.client_random); - if (rv != SECSuccess) { - return rv; /* err set by GetNewRandom. */ - } - rv = ssl3_AppendHandshake(ss, &ss->ssl3.hs.client_random, - SSL3_RANDOM_LENGTH); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - - if (sid) - rv = ssl3_AppendHandshakeVariable( - ss, sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength, 1); - else - rv = ssl3_AppendHandshakeVariable(ss, NULL, 0, 1); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - - rv = ssl3_AppendHandshakeNumber(ss, num_suites*sizeof(ssl3CipherSuite), 2); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - - - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i]; - if (config_match(suite, ss->ssl3.policy, PR_TRUE)) { - actual_count++; - if (actual_count > num_suites) { - /* set error card removal/insertion error */ - PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); - return SECFailure; - } - rv = ssl3_AppendHandshakeNumber(ss, suite->cipher_suite, - sizeof(ssl3CipherSuite)); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - } - } - - /* if cards were removed or inserted between count_cipher_suites and - * generating our list, detect the error here rather than send it off to - * the server.. */ - if (actual_count != num_suites) { - /* Card removal/insertion error */ - PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); - return SECFailure; - } - - rv = ssl3_AppendHandshakeNumber(ss, compressionMethodsCount, 1); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - for (i = 0; i < compressionMethodsCount; i++) { - rv = ssl3_AppendHandshakeNumber(ss, compressions[i], 1); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_AppendHandshake* */ - } - } - - if (total_exten_len) { - PRUint32 maxBytes = total_exten_len - 2; - PRInt32 extLen; - - rv = ssl3_AppendHandshakeNumber(ss, maxBytes, 2); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - - extLen = ssl3_CallHelloExtensionSenders(ss, PR_TRUE, maxBytes, NULL); - if (extLen < 0) { - return SECFailure; - } - maxBytes -= extLen; - PORT_Assert(!maxBytes); - } - - - rv = ssl3_FlushHandshake(ss, 0); - if (rv != SECSuccess) { - return rv; /* error code set by ssl3_FlushHandshake */ - } - - ss->ssl3.hs.ws = wait_server_hello; - return rv; -} - - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Hello Request. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleHelloRequest(sslSocket *ss) -{ - sslSessionID *sid = ss->sec.ci.sid; - SECStatus rv; - - SSL_TRC(3, ("%d: SSL3[%d]: handle hello_request handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->ssl3.hs.ws == wait_server_hello) - return SECSuccess; - if (ss->ssl3.hs.ws != idle_handshake || ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST); - return SECFailure; - } - if (sid) { - ss->sec.uncache(sid); - ssl_FreeSID(sid); - ss->sec.ci.sid = NULL; - } - - ssl_GetXmitBufLock(ss); - rv = ssl3_SendClientHello(ss); - ssl_ReleaseXmitBufLock(ss); - - return rv; -} - -#define UNKNOWN_WRAP_MECHANISM 0x7fffffff - -static const CK_MECHANISM_TYPE wrapMechanismList[SSL_NUM_WRAP_MECHS] = { - CKM_DES3_ECB, - CKM_CAST5_ECB, - CKM_DES_ECB, - CKM_KEY_WRAP_LYNKS, - CKM_IDEA_ECB, - CKM_CAST3_ECB, - CKM_CAST_ECB, - CKM_RC5_ECB, - CKM_RC2_ECB, - CKM_CDMF_ECB, - CKM_SKIPJACK_WRAP, - CKM_SKIPJACK_CBC64, - CKM_AES_ECB, - CKM_CAMELLIA_ECB, - CKM_SEED_ECB, - UNKNOWN_WRAP_MECHANISM -}; - -static int -ssl_FindIndexByWrapMechanism(CK_MECHANISM_TYPE mech) -{ - const CK_MECHANISM_TYPE *pMech = wrapMechanismList; - - while (mech != *pMech && *pMech != UNKNOWN_WRAP_MECHANISM) { - ++pMech; - } - return (*pMech == UNKNOWN_WRAP_MECHANISM) ? -1 - : (pMech - wrapMechanismList); -} - -static PK11SymKey * -ssl_UnwrapSymWrappingKey( - SSLWrappedSymWrappingKey *pWswk, - SECKEYPrivateKey * svrPrivKey, - SSL3KEAType exchKeyType, - CK_MECHANISM_TYPE masterWrapMech, - void * pwArg) -{ - PK11SymKey * unwrappedWrappingKey = NULL; - SECItem wrappedKey; -#ifdef NSS_ENABLE_ECC - PK11SymKey * Ks; - SECKEYPublicKey pubWrapKey; - ECCWrappedKeyInfo *ecWrapped; -#endif /* NSS_ENABLE_ECC */ - - /* found the wrapping key on disk. */ - PORT_Assert(pWswk->symWrapMechanism == masterWrapMech); - PORT_Assert(pWswk->exchKeyType == exchKeyType); - if (pWswk->symWrapMechanism != masterWrapMech || - pWswk->exchKeyType != exchKeyType) { - goto loser; - } - wrappedKey.type = siBuffer; - wrappedKey.data = pWswk->wrappedSymmetricWrappingkey; - wrappedKey.len = pWswk->wrappedSymKeyLen; - PORT_Assert(wrappedKey.len <= sizeof pWswk->wrappedSymmetricWrappingkey); - - switch (exchKeyType) { - - case kt_rsa: - unwrappedWrappingKey = - PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey, - masterWrapMech, CKA_UNWRAP, 0); - break; - -#ifdef NSS_ENABLE_ECC - case kt_ecdh: - /* - * For kt_ecdh, we first create an EC public key based on - * data stored with the wrappedSymmetricWrappingkey. Next, - * we do an ECDH computation involving this public key and - * the SSL server's (long-term) EC private key. The resulting - * shared secret is treated the same way as Fortezza's Ks, i.e., - * it is used to recover the symmetric wrapping key. - * - * The data in wrappedSymmetricWrappingkey is laid out as defined - * in the ECCWrappedKeyInfo structure. - */ - ecWrapped = (ECCWrappedKeyInfo *) pWswk->wrappedSymmetricWrappingkey; - - PORT_Assert(ecWrapped->encodedParamLen + ecWrapped->pubValueLen + - ecWrapped->wrappedKeyLen <= MAX_EC_WRAPPED_KEY_BUFLEN); - - if (ecWrapped->encodedParamLen + ecWrapped->pubValueLen + - ecWrapped->wrappedKeyLen > MAX_EC_WRAPPED_KEY_BUFLEN) { - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - goto loser; - } - - pubWrapKey.keyType = ecKey; - pubWrapKey.u.ec.size = ecWrapped->size; - pubWrapKey.u.ec.DEREncodedParams.len = ecWrapped->encodedParamLen; - pubWrapKey.u.ec.DEREncodedParams.data = ecWrapped->var; - pubWrapKey.u.ec.publicValue.len = ecWrapped->pubValueLen; - pubWrapKey.u.ec.publicValue.data = ecWrapped->var + - ecWrapped->encodedParamLen; - - wrappedKey.len = ecWrapped->wrappedKeyLen; - wrappedKey.data = ecWrapped->var + ecWrapped->encodedParamLen + - ecWrapped->pubValueLen; - - /* Derive Ks using ECDH */ - Ks = PK11_PubDeriveWithKDF(svrPrivKey, &pubWrapKey, PR_FALSE, NULL, - NULL, CKM_ECDH1_DERIVE, masterWrapMech, - CKA_DERIVE, 0, CKD_NULL, NULL, NULL); - if (Ks == NULL) { - goto loser; - } - - /* Use Ks to unwrap the wrapping key */ - unwrappedWrappingKey = PK11_UnwrapSymKey(Ks, masterWrapMech, NULL, - &wrappedKey, masterWrapMech, - CKA_UNWRAP, 0); - PK11_FreeSymKey(Ks); - - break; -#endif - - default: - /* Assert? */ - SET_ERROR_CODE - goto loser; - } -loser: - return unwrappedWrappingKey; -} - -/* Each process sharing the server session ID cache has its own array of - * SymKey pointers for the symmetric wrapping keys that are used to wrap - * the master secrets. There is one key for each KEA type. These Symkeys - * correspond to the wrapped SymKeys kept in the server session cache. - */ - -typedef struct { - PK11SymKey * symWrapKey[kt_kea_size]; -} ssl3SymWrapKey; - -static PZLock * symWrapKeysLock = NULL; -static ssl3SymWrapKey symWrapKeys[SSL_NUM_WRAP_MECHS]; - -SECStatus ssl_FreeSymWrapKeysLock(void) -{ - if (symWrapKeysLock) { - PZ_DestroyLock(symWrapKeysLock); - symWrapKeysLock = NULL; - return SECSuccess; - } - PORT_SetError(SEC_ERROR_NOT_INITIALIZED); - return SECFailure; -} - -SECStatus -SSL3_ShutdownServerCache(void) -{ - int i, j; - - if (!symWrapKeysLock) - return SECSuccess; /* lock was never initialized */ - PZ_Lock(symWrapKeysLock); - /* get rid of all symWrapKeys */ - for (i = 0; i < SSL_NUM_WRAP_MECHS; ++i) { - for (j = 0; j < kt_kea_size; ++j) { - PK11SymKey ** pSymWrapKey; - pSymWrapKey = &symWrapKeys[i].symWrapKey[j]; - if (*pSymWrapKey) { - PK11_FreeSymKey(*pSymWrapKey); - *pSymWrapKey = NULL; - } - } - } - - PZ_Unlock(symWrapKeysLock); - ssl_FreeSessionCacheLocks(); - return SECSuccess; -} - -SECStatus ssl_InitSymWrapKeysLock(void) -{ - symWrapKeysLock = PZ_NewLock(nssILockOther); - return symWrapKeysLock ? SECSuccess : SECFailure; -} - -/* Try to get wrapping key for mechanism from in-memory array. - * If that fails, look for one on disk. - * If that fails, generate a new one, put the new one on disk, - * Put the new key in the in-memory array. - */ -static PK11SymKey * -getWrappingKey( sslSocket * ss, - PK11SlotInfo * masterSecretSlot, - SSL3KEAType exchKeyType, - CK_MECHANISM_TYPE masterWrapMech, - void * pwArg) -{ - SECKEYPrivateKey * svrPrivKey; - SECKEYPublicKey * svrPubKey = NULL; - PK11SymKey * unwrappedWrappingKey = NULL; - PK11SymKey ** pSymWrapKey; - CK_MECHANISM_TYPE asymWrapMechanism = CKM_INVALID_MECHANISM; - int length; - int symWrapMechIndex; - SECStatus rv; - SECItem wrappedKey; - SSLWrappedSymWrappingKey wswk; - - svrPrivKey = ss->serverCerts[exchKeyType].SERVERKEY; - PORT_Assert(svrPrivKey != NULL); - if (!svrPrivKey) { - return NULL; /* why are we here?!? */ - } - - symWrapMechIndex = ssl_FindIndexByWrapMechanism(masterWrapMech); - PORT_Assert(symWrapMechIndex >= 0); - if (symWrapMechIndex < 0) - return NULL; /* invalid masterWrapMech. */ - - pSymWrapKey = &symWrapKeys[symWrapMechIndex].symWrapKey[exchKeyType]; - - ssl_InitSessionCacheLocks(PR_TRUE); - - PZ_Lock(symWrapKeysLock); - - unwrappedWrappingKey = *pSymWrapKey; - if (unwrappedWrappingKey != NULL) { - if (PK11_VerifyKeyOK(unwrappedWrappingKey)) { - unwrappedWrappingKey = PK11_ReferenceSymKey(unwrappedWrappingKey); - goto done; - } - /* slot series has changed, so this key is no good any more. */ - PK11_FreeSymKey(unwrappedWrappingKey); - *pSymWrapKey = unwrappedWrappingKey = NULL; - } - - /* Try to get wrapped SymWrapping key out of the (disk) cache. */ - /* Following call fills in wswk on success. */ - if (ssl_GetWrappingKey(symWrapMechIndex, exchKeyType, &wswk)) { - /* found the wrapped sym wrapping key on disk. */ - unwrappedWrappingKey = - ssl_UnwrapSymWrappingKey(&wswk, svrPrivKey, exchKeyType, - masterWrapMech, pwArg); - if (unwrappedWrappingKey) { - goto install; - } - } - - if (!masterSecretSlot) /* caller doesn't want to create a new one. */ - goto loser; - - length = PK11_GetBestKeyLength(masterSecretSlot, masterWrapMech); - /* Zero length means fixed key length algorithm, or error. - * It's ambiguous. - */ - unwrappedWrappingKey = PK11_KeyGen(masterSecretSlot, masterWrapMech, NULL, - length, pwArg); - if (!unwrappedWrappingKey) { - goto loser; - } - - /* Prepare the buffer to receive the wrappedWrappingKey, - * the symmetric wrapping key wrapped using the server's pub key. - */ - PORT_Memset(&wswk, 0, sizeof wswk); /* eliminate UMRs. */ - - if (ss->serverCerts[exchKeyType].serverKeyPair) { - svrPubKey = ss->serverCerts[exchKeyType].serverKeyPair->pubKey; - } - if (svrPubKey == NULL) { - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - goto loser; - } - wrappedKey.type = siBuffer; - wrappedKey.len = SECKEY_PublicKeyStrength(svrPubKey); - wrappedKey.data = wswk.wrappedSymmetricWrappingkey; - - PORT_Assert(wrappedKey.len <= sizeof wswk.wrappedSymmetricWrappingkey); - if (wrappedKey.len > sizeof wswk.wrappedSymmetricWrappingkey) - goto loser; - - /* wrap symmetric wrapping key in server's public key. */ - switch (exchKeyType) { -#ifdef NSS_ENABLE_ECC - PK11SymKey * Ks = NULL; - SECKEYPublicKey *pubWrapKey = NULL; - SECKEYPrivateKey *privWrapKey = NULL; - ECCWrappedKeyInfo *ecWrapped; -#endif /* NSS_ENABLE_ECC */ - - case kt_rsa: - asymWrapMechanism = CKM_RSA_PKCS; - rv = PK11_PubWrapSymKey(asymWrapMechanism, svrPubKey, - unwrappedWrappingKey, &wrappedKey); - break; - -#ifdef NSS_ENABLE_ECC - case kt_ecdh: - /* - * We generate an ephemeral EC key pair. Perform an ECDH - * computation involving this ephemeral EC public key and - * the SSL server's (long-term) EC private key. The resulting - * shared secret is treated in the same way as Fortezza's Ks, - * i.e., it is used to wrap the wrapping key. To facilitate - * unwrapping in ssl_UnwrapWrappingKey, we also store all - * relevant info about the ephemeral EC public key in - * wswk.wrappedSymmetricWrappingkey and lay it out as - * described in the ECCWrappedKeyInfo structure. - */ - PORT_Assert(svrPubKey->keyType == ecKey); - if (svrPubKey->keyType != ecKey) { - /* something is wrong in sslsecur.c if this isn't an ecKey */ - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - rv = SECFailure; - goto ec_cleanup; - } - - privWrapKey = SECKEY_CreateECPrivateKey( - &svrPubKey->u.ec.DEREncodedParams, &pubWrapKey, NULL); - if ((privWrapKey == NULL) || (pubWrapKey == NULL)) { - rv = SECFailure; - goto ec_cleanup; - } - - /* Set the key size in bits */ - if (pubWrapKey->u.ec.size == 0) { - pubWrapKey->u.ec.size = SECKEY_PublicKeyStrengthInBits(svrPubKey); - } - - PORT_Assert(pubWrapKey->u.ec.DEREncodedParams.len + - pubWrapKey->u.ec.publicValue.len < MAX_EC_WRAPPED_KEY_BUFLEN); - if (pubWrapKey->u.ec.DEREncodedParams.len + - pubWrapKey->u.ec.publicValue.len >= MAX_EC_WRAPPED_KEY_BUFLEN) { - PORT_SetError(SEC_ERROR_INVALID_KEY); - rv = SECFailure; - goto ec_cleanup; - } - - /* Derive Ks using ECDH */ - Ks = PK11_PubDeriveWithKDF(svrPrivKey, pubWrapKey, PR_FALSE, NULL, - NULL, CKM_ECDH1_DERIVE, masterWrapMech, - CKA_DERIVE, 0, CKD_NULL, NULL, NULL); - if (Ks == NULL) { - rv = SECFailure; - goto ec_cleanup; - } - - ecWrapped = (ECCWrappedKeyInfo *) (wswk.wrappedSymmetricWrappingkey); - ecWrapped->size = pubWrapKey->u.ec.size; - ecWrapped->encodedParamLen = pubWrapKey->u.ec.DEREncodedParams.len; - PORT_Memcpy(ecWrapped->var, pubWrapKey->u.ec.DEREncodedParams.data, - pubWrapKey->u.ec.DEREncodedParams.len); - - ecWrapped->pubValueLen = pubWrapKey->u.ec.publicValue.len; - PORT_Memcpy(ecWrapped->var + ecWrapped->encodedParamLen, - pubWrapKey->u.ec.publicValue.data, - pubWrapKey->u.ec.publicValue.len); - - wrappedKey.len = MAX_EC_WRAPPED_KEY_BUFLEN - - (ecWrapped->encodedParamLen + ecWrapped->pubValueLen); - wrappedKey.data = ecWrapped->var + ecWrapped->encodedParamLen + - ecWrapped->pubValueLen; - - /* wrap symmetricWrapping key with the local Ks */ - rv = PK11_WrapSymKey(masterWrapMech, NULL, Ks, - unwrappedWrappingKey, &wrappedKey); - - if (rv != SECSuccess) { - goto ec_cleanup; - } - - /* Write down the length of wrapped key in the buffer - * wswk.wrappedSymmetricWrappingkey at the appropriate offset - */ - ecWrapped->wrappedKeyLen = wrappedKey.len; - -ec_cleanup: - if (privWrapKey) SECKEY_DestroyPrivateKey(privWrapKey); - if (pubWrapKey) SECKEY_DestroyPublicKey(pubWrapKey); - if (Ks) PK11_FreeSymKey(Ks); - asymWrapMechanism = masterWrapMech; - break; -#endif /* NSS_ENABLE_ECC */ - - default: - rv = SECFailure; - break; - } - - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - PORT_Assert(asymWrapMechanism != CKM_INVALID_MECHANISM); - - wswk.symWrapMechanism = masterWrapMech; - wswk.symWrapMechIndex = symWrapMechIndex; - wswk.asymWrapMechanism = asymWrapMechanism; - wswk.exchKeyType = exchKeyType; - wswk.wrappedSymKeyLen = wrappedKey.len; - - /* put it on disk. */ - /* If the wrapping key for this KEA type has already been set, - * then abandon the value we just computed and - * use the one we got from the disk. - */ - if (ssl_SetWrappingKey(&wswk)) { - /* somebody beat us to it. The original contents of our wswk - * has been replaced with the content on disk. Now, discard - * the key we just created and unwrap this new one. - */ - PK11_FreeSymKey(unwrappedWrappingKey); - - unwrappedWrappingKey = - ssl_UnwrapSymWrappingKey(&wswk, svrPrivKey, exchKeyType, - masterWrapMech, pwArg); - } - -install: - if (unwrappedWrappingKey) { - *pSymWrapKey = PK11_ReferenceSymKey(unwrappedWrappingKey); - } - -loser: -done: - PZ_Unlock(symWrapKeysLock); - return unwrappedWrappingKey; -} - - -/* Called from ssl3_SendClientKeyExchange(). */ -/* Presently, this always uses PKCS11. There is no bypass for this. */ -static SECStatus -sendRSAClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) -{ - PK11SymKey * pms = NULL; - SECStatus rv = SECFailure; - SECItem enc_pms = {siBuffer, NULL, 0}; - PRBool isTLS; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - - /* Generate the pre-master secret ... */ - ssl_GetSpecWriteLock(ss); - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - - pms = ssl3_GenerateRSAPMS(ss, ss->ssl3.pwSpec, NULL); - ssl_ReleaseSpecWriteLock(ss); - if (pms == NULL) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - -#if defined(TRACE) - if (ssl_trace >= 100) { - SECStatus extractRV = PK11_ExtractKeyValue(pms); - if (extractRV == SECSuccess) { - SECItem * keyData = PK11_GetKeyData(pms); - if (keyData && keyData->data && keyData->len) { - ssl_PrintBuf(ss, "Pre-Master Secret", - keyData->data, keyData->len); - } - } - } -#endif - - /* Get the wrapped (encrypted) pre-master secret, enc_pms */ - enc_pms.len = SECKEY_PublicKeyStrength(svrPubKey); - enc_pms.data = (unsigned char*)PORT_Alloc(enc_pms.len); - if (enc_pms.data == NULL) { - goto loser; /* err set by PORT_Alloc */ - } - - /* wrap pre-master secret in server's public key. */ - rv = PK11_PubWrapSymKey(CKM_RSA_PKCS, svrPubKey, pms, &enc_pms); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - rv = ssl3_InitPendingCipherSpec(ss, pms); - PK11_FreeSymKey(pms); pms = NULL; - - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, - isTLS ? enc_pms.len + 2 : enc_pms.len); - if (rv != SECSuccess) { - goto loser; /* err set by ssl3_AppendHandshake* */ - } - if (isTLS) { - rv = ssl3_AppendHandshakeVariable(ss, enc_pms.data, enc_pms.len, 2); - } else { - rv = ssl3_AppendHandshake(ss, enc_pms.data, enc_pms.len); - } - if (rv != SECSuccess) { - goto loser; /* err set by ssl3_AppendHandshake* */ - } - - rv = SECSuccess; - -loser: - if (enc_pms.data != NULL) { - PORT_Free(enc_pms.data); - } - if (pms != NULL) { - PK11_FreeSymKey(pms); - } - return rv; -} - -/* Called from ssl3_SendClientKeyExchange(). */ -/* Presently, this always uses PKCS11. There is no bypass for this. */ -static SECStatus -sendDHClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) -{ - PK11SymKey * pms = NULL; - SECStatus rv = SECFailure; - PRBool isTLS; - CK_MECHANISM_TYPE target; - - SECKEYDHParams dhParam; /* DH parameters */ - SECKEYPublicKey *pubKey = NULL; /* Ephemeral DH key */ - SECKEYPrivateKey *privKey = NULL; /* Ephemeral DH key */ - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - - /* Copy DH parameters from server key */ - - if (svrPubKey->keyType != dhKey) { - PORT_SetError(SEC_ERROR_BAD_KEY); - goto loser; - } - dhParam.prime.data = svrPubKey->u.dh.prime.data; - dhParam.prime.len = svrPubKey->u.dh.prime.len; - dhParam.base.data = svrPubKey->u.dh.base.data; - dhParam.base.len = svrPubKey->u.dh.base.len; - - /* Generate ephemeral DH keypair */ - privKey = SECKEY_CreateDHPrivateKey(&dhParam, &pubKey, NULL); - if (!privKey || !pubKey) { - ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); - rv = SECFailure; - goto loser; - } - PRINT_BUF(50, (ss, "DH public value:", - pubKey->u.dh.publicValue.data, - pubKey->u.dh.publicValue.len)); - - if (isTLS) target = CKM_TLS_MASTER_KEY_DERIVE_DH; - else target = CKM_SSL3_MASTER_KEY_DERIVE_DH; - - /* Determine the PMS */ - - pms = PK11_PubDerive(privKey, svrPubKey, PR_FALSE, NULL, NULL, - CKM_DH_PKCS_DERIVE, target, CKA_DERIVE, 0, NULL); - - if (pms == NULL) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - SECKEY_DestroyPrivateKey(privKey); - privKey = NULL; - - rv = ssl3_InitPendingCipherSpec(ss, pms); - PK11_FreeSymKey(pms); pms = NULL; - - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, - pubKey->u.dh.publicValue.len + 2); - if (rv != SECSuccess) { - goto loser; /* err set by ssl3_AppendHandshake* */ - } - rv = ssl3_AppendHandshakeVariable(ss, - pubKey->u.dh.publicValue.data, - pubKey->u.dh.publicValue.len, 2); - SECKEY_DestroyPublicKey(pubKey); - pubKey = NULL; - - if (rv != SECSuccess) { - goto loser; /* err set by ssl3_AppendHandshake* */ - } - - rv = SECSuccess; - - -loser: - - if(pms) PK11_FreeSymKey(pms); - if(privKey) SECKEY_DestroyPrivateKey(privKey); - if(pubKey) SECKEY_DestroyPublicKey(pubKey); - return rv; -} - - - - - -/* Called from ssl3_HandleServerHelloDone(). */ -static SECStatus -ssl3_SendClientKeyExchange(sslSocket *ss) -{ - SECKEYPublicKey * serverKey = NULL; - SECStatus rv = SECFailure; - PRBool isTLS; - - SSL_TRC(3, ("%d: SSL3[%d]: send client_key_exchange handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - if (ss->sec.peerKey == NULL) { - serverKey = CERT_ExtractPublicKey(ss->sec.peerCert); - if (serverKey == NULL) { - PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE); - return SECFailure; - } - } else { - serverKey = ss->sec.peerKey; - ss->sec.peerKey = NULL; /* we're done with it now */ - } - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - /* enforce limits on kea key sizes. */ - if (ss->ssl3.hs.kea_def->is_limited) { - int keyLen = SECKEY_PublicKeyStrength(serverKey); /* bytes */ - - if (keyLen * BPB > ss->ssl3.hs.kea_def->key_size_limit) { - if (isTLS) - (void)SSL3_SendAlert(ss, alert_fatal, export_restriction); - else - (void)ssl3_HandshakeFailure(ss); - PORT_SetError(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED); - goto loser; - } - } - - ss->sec.keaType = ss->ssl3.hs.kea_def->exchKeyType; - ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(serverKey); - - switch (ss->ssl3.hs.kea_def->exchKeyType) { - case kt_rsa: - rv = sendRSAClientKeyExchange(ss, serverKey); - break; - - case kt_dh: - rv = sendDHClientKeyExchange(ss, serverKey); - break; - -#ifdef NSS_ENABLE_ECC - case kt_ecdh: - rv = ssl3_SendECDHClientKeyExchange(ss, serverKey); - break; -#endif /* NSS_ENABLE_ECC */ - - default: - /* got an unknown or unsupported Key Exchange Algorithm. */ - SEND_ALERT - PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); - break; - } - - SSL_TRC(3, ("%d: SSL3[%d]: DONE sending client_key_exchange", - SSL_GETPID(), ss->fd)); - -loser: - if (serverKey) - SECKEY_DestroyPublicKey(serverKey); - return rv; /* err code already set. */ -} - -/* Called from ssl3_HandleServerHelloDone(). */ -static SECStatus -ssl3_SendCertificateVerify(sslSocket *ss) -{ - SECStatus rv = SECFailure; - PRBool isTLS; - SECItem buf = {siBuffer, NULL, 0}; - SSL3Hashes hashes; - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - SSL_TRC(3, ("%d: SSL3[%d]: send certificate_verify handshake", - SSL_GETPID(), ss->fd)); - - ssl_GetSpecReadLock(ss); - rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.pwSpec, &hashes, 0); - ssl_ReleaseSpecReadLock(ss); - if (rv != SECSuccess) { - goto done; /* err code was set by ssl3_ComputeHandshakeHashes */ - } - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - rv = ssl3_SignHashes(&hashes, ss->ssl3.clientPrivateKey, &buf, isTLS); - if (rv == SECSuccess) { - PK11SlotInfo * slot; - sslSessionID * sid = ss->sec.ci.sid; - - /* Remember the info about the slot that did the signing. - ** Later, when doing an SSL restart handshake, verify this. - ** These calls are mere accessors, and can't fail. - */ - slot = PK11_GetSlotFromPrivateKey(ss->ssl3.clientPrivateKey); - sid->u.ssl3.clAuthSeries = PK11_GetSlotSeries(slot); - sid->u.ssl3.clAuthSlotID = PK11_GetSlotID(slot); - sid->u.ssl3.clAuthModuleID = PK11_GetModuleID(slot); - sid->u.ssl3.clAuthValid = PR_TRUE; - PK11_FreeSlot(slot); - } - /* If we're doing RSA key exchange, we're all done with the private key - * here. Diffie-Hellman key exchanges need the client's - * private key for the key exchange. - */ - if (ss->ssl3.hs.kea_def->exchKeyType == kt_rsa) { - SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); - ss->ssl3.clientPrivateKey = NULL; - } - if (rv != SECSuccess) { - goto done; /* err code was set by ssl3_SignHashes */ - } - - rv = ssl3_AppendHandshakeHeader(ss, certificate_verify, buf.len + 2); - if (rv != SECSuccess) { - goto done; /* error code set by AppendHandshake */ - } - rv = ssl3_AppendHandshakeVariable(ss, buf.data, buf.len, 2); - if (rv != SECSuccess) { - goto done; /* error code set by AppendHandshake */ - } - -done: - if (buf.data) - PORT_Free(buf.data); - return rv; -} - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 ServerHello message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - sslSessionID *sid = ss->sec.ci.sid; - PRInt32 temp; /* allow for consume number failure */ - PRBool suite_found = PR_FALSE; - int i; - int errCode = SSL_ERROR_RX_MALFORMED_SERVER_HELLO; - SECStatus rv; - SECItem sidBytes = {siBuffer, NULL, 0}; - PRBool sid_match; - PRBool isTLS = PR_FALSE; - SSL3AlertDescription desc = illegal_parameter; - SSL3ProtocolVersion version; - - SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello handshake", - SSL_GETPID(), ss->fd)); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - rv = ssl3_InitState(ss); - if (rv != SECSuccess) { - errCode = PORT_GetError(); /* ssl3_InitState has set the error code. */ - goto alert_loser; - } - if (ss->ssl3.hs.ws != wait_server_hello) { - errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO; - desc = unexpected_message; - goto alert_loser; - } - - temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); - if (temp < 0) { - goto loser; /* alert has been sent */ - } - version = (SSL3ProtocolVersion)temp; - - /* this is appropriate since the negotiation is complete, and we only - ** know SSL 3.x. - */ - if (MSB(version) != MSB(SSL_LIBRARY_VERSION_3_0)) { - desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version - : handshake_failure; - goto alert_loser; - } - - rv = ssl3_NegotiateVersion(ss, version); - if (rv != SECSuccess) { - desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version - : handshake_failure; - errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - goto alert_loser; - } - isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0); - - rv = ssl3_ConsumeHandshake( - ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH, &b, &length); - if (rv != SECSuccess) { - goto loser; /* alert has been sent */ - } - - rv = ssl3_ConsumeHandshakeVariable(ss, &sidBytes, 1, &b, &length); - if (rv != SECSuccess) { - goto loser; /* alert has been sent */ - } - if (sidBytes.len > SSL3_SESSIONID_BYTES) { - if (isTLS) - desc = decode_error; - goto alert_loser; /* malformed. */ - } - - /* find selected cipher suite in our list. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); - if (temp < 0) { - goto loser; /* alert has been sent */ - } - ssl3_config_match_init(ss); - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i]; - if ((temp == suite->cipher_suite) && - (config_match(suite, ss->ssl3.policy, PR_TRUE))) { - suite_found = PR_TRUE; - break; /* success */ - } - } - if (!suite_found) { - desc = handshake_failure; - errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - goto alert_loser; - } - ss->ssl3.hs.cipher_suite = (ssl3CipherSuite)temp; - ss->ssl3.hs.suite_def = ssl_LookupCipherSuiteDef((ssl3CipherSuite)temp); - PORT_Assert(ss->ssl3.hs.suite_def); - if (!ss->ssl3.hs.suite_def) { - PORT_SetError(errCode = SEC_ERROR_LIBRARY_FAILURE); - goto loser; /* we don't send alerts for our screw-ups. */ - } - - /* find selected compression method in our list. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &b, &length); - if (temp < 0) { - goto loser; /* alert has been sent */ - } - suite_found = PR_FALSE; - for (i = 0; i < compressionMethodsCount; i++) { - if (temp == compressions[i]) { - suite_found = PR_TRUE; - break; /* success */ - } - } - if (!suite_found) { - desc = handshake_failure; - errCode = SSL_ERROR_NO_COMPRESSION_OVERLAP; - goto alert_loser; - } - ss->ssl3.hs.compression = (SSL3CompressionMethod)temp; - - /* Note that if !isTLS && length != 0, we do NOT goto alert_loser. - * There are some old SSL 3.0 implementations that do send stuff - * after the end of the server hello, and we deliberately ignore - * such stuff in the interest of maximal interoperability (being - * "generous in what you accept"). - */ - if (isTLS && length != 0) { - SECItem extensions; - rv = ssl3_ConsumeHandshakeVariable(ss, &extensions, 2, &b, &length); - if (rv != SECSuccess || length != 0) - goto alert_loser; - rv = ssl3_HandleHelloExtensions(ss, &extensions.data, &extensions.len); - if (rv != SECSuccess) - goto alert_loser; - } - - /* Any errors after this point are not "malformed" errors. */ - desc = handshake_failure; - - /* we need to call ssl3_SetupPendingCipherSpec here so we can check the - * key exchange algorithm. */ - rv = ssl3_SetupPendingCipherSpec(ss); - if (rv != SECSuccess) { - goto alert_loser; /* error code is set. */ - } - - /* We may or may not have sent a session id, we may get one back or - * not and if so it may match the one we sent. - * Attempt to restore the master secret to see if this is so... - * Don't consider failure to find a matching SID an error. - */ - sid_match = (PRBool)(sidBytes.len > 0 && - sidBytes.len == sid->u.ssl3.sessionIDLength && - !PORT_Memcmp(sid->u.ssl3.sessionID, sidBytes.data, sidBytes.len)); - - if (sid_match && - sid->version == ss->version && - sid->u.ssl3.cipherSuite == ss->ssl3.hs.cipher_suite) do { - ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec; - - SECItem wrappedMS; /* wrapped master secret. */ - - ss->sec.authAlgorithm = sid->authAlgorithm; - ss->sec.authKeyBits = sid->authKeyBits; - ss->sec.keaType = sid->keaType; - ss->sec.keaKeyBits = sid->keaKeyBits; - - /* 3 cases here: - * a) key is wrapped (implies using PKCS11) - * b) key is unwrapped, but we're still using PKCS11 - * c) key is unwrapped, and we're bypassing PKCS11. - */ - if (sid->u.ssl3.keys.msIsWrapped) { - PK11SlotInfo *slot; - PK11SymKey * wrapKey; /* wrapping key */ - CK_FLAGS keyFlags = 0; - - if (ss->opt.bypassPKCS11) { - /* we cannot restart a non-bypass session in a - ** bypass socket. - */ - break; - } - /* unwrap master secret with PKCS11 */ - slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID, - sid->u.ssl3.masterSlotID); - if (slot == NULL) { - break; /* not considered an error. */ - } - if (!PK11_IsPresent(slot)) { - PK11_FreeSlot(slot); - break; /* not considered an error. */ - } - wrapKey = PK11_GetWrapKey(slot, sid->u.ssl3.masterWrapIndex, - sid->u.ssl3.masterWrapMech, - sid->u.ssl3.masterWrapSeries, - ss->pkcs11PinArg); - PK11_FreeSlot(slot); - if (wrapKey == NULL) { - break; /* not considered an error. */ - } - - if (ss->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */ - keyFlags = CKF_SIGN | CKF_VERIFY; - } - - wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; - wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; - pwSpec->master_secret = - PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, - NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE, - CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags); - errCode = PORT_GetError(); - PK11_FreeSymKey(wrapKey); - if (pwSpec->master_secret == NULL) { - break; /* errorCode set just after call to UnwrapSymKey. */ - } - } else if (ss->opt.bypassPKCS11) { - /* MS is not wrapped */ - wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; - wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; - memcpy(pwSpec->raw_master_secret, wrappedMS.data, wrappedMS.len); - pwSpec->msItem.data = pwSpec->raw_master_secret; - pwSpec->msItem.len = wrappedMS.len; - } else { - /* We CAN restart a bypass session in a non-bypass socket. */ - /* need to import the raw master secret to session object */ - PK11SlotInfo *slot = PK11_GetInternalSlot(); - wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; - wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; - pwSpec->master_secret = - PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, - PK11_OriginUnwrap, CKA_ENCRYPT, - &wrappedMS, NULL); - PK11_FreeSlot(slot); - if (pwSpec->master_secret == NULL) { - break; - } - } - - /* Got a Match */ - SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_hits ); - - /* If we sent a session ticket, then this is a stateless resume. */ - if (sid->version > SSL_LIBRARY_VERSION_3_0 && - sid->u.ssl3.sessionTicket.ticket.data != NULL) - SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_stateless_resumes ); - - if (ssl3_ExtensionNegotiated(ss, session_ticket_xtn)) - ss->ssl3.hs.ws = wait_new_session_ticket; - else - ss->ssl3.hs.ws = wait_change_cipher; - - ss->ssl3.hs.isResuming = PR_TRUE; - - /* copy the peer cert from the SID */ - if (sid->peerCert != NULL) { - ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); - } - - - /* NULL value for PMS signifies re-use of the old MS */ - rv = ssl3_InitPendingCipherSpec(ss, NULL); - if (rv != SECSuccess) { - goto alert_loser; /* err code was set */ - } - return SECSuccess; - } while (0); - - if (sid_match) - SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_not_ok ); - else - SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_misses ); - - /* throw the old one away */ - sid->u.ssl3.keys.resumable = PR_FALSE; - (*ss->sec.uncache)(sid); - ssl_FreeSID(sid); - - /* get a new sid */ - ss->sec.ci.sid = sid = ssl3_NewSessionID(ss, PR_FALSE); - if (sid == NULL) { - goto alert_loser; /* memory error is set. */ - } - - sid->version = ss->version; - sid->u.ssl3.sessionIDLength = sidBytes.len; - PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes.data, sidBytes.len); - - ss->ssl3.hs.isResuming = PR_FALSE; - ss->ssl3.hs.ws = wait_server_cert; - return SECSuccess; - -alert_loser: - (void)SSL3_SendAlert(ss, alert_fatal, desc); - -loser: - errCode = ssl_MapLowLevelError(errCode); - return SECFailure; -} - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 ServerKeyExchange message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - PRArenaPool * arena = NULL; - SECKEYPublicKey *peerKey = NULL; - PRBool isTLS; - SECStatus rv; - int errCode = SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH; - SSL3AlertDescription desc = illegal_parameter; - SSL3Hashes hashes; - SECItem signature = {siBuffer, NULL, 0}; - - SSL_TRC(3, ("%d: SSL3[%d]: handle server_key_exchange handshake", - SSL_GETPID(), ss->fd)); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->ssl3.hs.ws != wait_server_key && - ss->ssl3.hs.ws != wait_server_cert) { - errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH; - desc = unexpected_message; - goto alert_loser; - } - if (ss->sec.peerCert == NULL) { - errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH; - desc = unexpected_message; - goto alert_loser; - } - - isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); - - switch (ss->ssl3.hs.kea_def->exchKeyType) { - - case kt_rsa: { - SECItem modulus = {siBuffer, NULL, 0}; - SECItem exponent = {siBuffer, NULL, 0}; - - rv = ssl3_ConsumeHandshakeVariable(ss, &modulus, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - rv = ssl3_ConsumeHandshakeVariable(ss, &exponent, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - if (length != 0) { - if (isTLS) - desc = decode_error; - goto alert_loser; /* malformed. */ - } - - /* failures after this point are not malformed handshakes. */ - /* TLS: send decrypt_error if signature failed. */ - desc = isTLS ? decrypt_error : handshake_failure; - - /* - * check to make sure the hash is signed by right guy - */ - rv = ssl3_ComputeExportRSAKeyHash(modulus, exponent, - &ss->ssl3.hs.client_random, - &ss->ssl3.hs.server_random, - &hashes, ss->opt.bypassPKCS11); - if (rv != SECSuccess) { - errCode = - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto alert_loser; - } - rv = ssl3_VerifySignedHashes(&hashes, ss->sec.peerCert, &signature, - isTLS, ss->pkcs11PinArg); - if (rv != SECSuccess) { - errCode = - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto alert_loser; - } - - /* - * we really need to build a new key here because we can no longer - * ignore calling SECKEY_DestroyPublicKey. Using the key may allocate - * pkcs11 slots and ID's. - */ - arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); - if (arena == NULL) { - goto no_memory; - } - - peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey); - if (peerKey == NULL) { - PORT_FreeArena(arena, PR_FALSE); - goto no_memory; - } - - peerKey->arena = arena; - peerKey->keyType = rsaKey; - peerKey->pkcs11Slot = NULL; - peerKey->pkcs11ID = CK_INVALID_HANDLE; - if (SECITEM_CopyItem(arena, &peerKey->u.rsa.modulus, &modulus) || - SECITEM_CopyItem(arena, &peerKey->u.rsa.publicExponent, &exponent)) - { - PORT_FreeArena(arena, PR_FALSE); - goto no_memory; - } - ss->sec.peerKey = peerKey; - ss->ssl3.hs.ws = wait_cert_request; - return SECSuccess; - } - - case kt_dh: { - SECItem dh_p = {siBuffer, NULL, 0}; - SECItem dh_g = {siBuffer, NULL, 0}; - SECItem dh_Ys = {siBuffer, NULL, 0}; - - rv = ssl3_ConsumeHandshakeVariable(ss, &dh_p, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - rv = ssl3_ConsumeHandshakeVariable(ss, &dh_g, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - rv = ssl3_ConsumeHandshakeVariable(ss, &dh_Ys, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - if (length != 0) { - if (isTLS) - desc = decode_error; - goto alert_loser; /* malformed. */ - } - - PRINT_BUF(60, (NULL, "Server DH p", dh_p.data, dh_p.len)); - PRINT_BUF(60, (NULL, "Server DH g", dh_g.data, dh_g.len)); - PRINT_BUF(60, (NULL, "Server DH Ys", dh_Ys.data, dh_Ys.len)); - - /* failures after this point are not malformed handshakes. */ - /* TLS: send decrypt_error if signature failed. */ - desc = isTLS ? decrypt_error : handshake_failure; - - /* - * check to make sure the hash is signed by right guy - */ - rv = ssl3_ComputeDHKeyHash(dh_p, dh_g, dh_Ys, - &ss->ssl3.hs.client_random, - &ss->ssl3.hs.server_random, - &hashes, ss->opt.bypassPKCS11); - if (rv != SECSuccess) { - errCode = - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto alert_loser; - } - rv = ssl3_VerifySignedHashes(&hashes, ss->sec.peerCert, &signature, - isTLS, ss->pkcs11PinArg); - if (rv != SECSuccess) { - errCode = - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto alert_loser; - } - - /* - * we really need to build a new key here because we can no longer - * ignore calling SECKEY_DestroyPublicKey. Using the key may allocate - * pkcs11 slots and ID's. - */ - arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); - if (arena == NULL) { - goto no_memory; - } - - ss->sec.peerKey = peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey); - if (peerKey == NULL) { - goto no_memory; - } - - peerKey->arena = arena; - peerKey->keyType = dhKey; - peerKey->pkcs11Slot = NULL; - peerKey->pkcs11ID = CK_INVALID_HANDLE; - - if (SECITEM_CopyItem(arena, &peerKey->u.dh.prime, &dh_p) || - SECITEM_CopyItem(arena, &peerKey->u.dh.base, &dh_g) || - SECITEM_CopyItem(arena, &peerKey->u.dh.publicValue, &dh_Ys)) - { - PORT_FreeArena(arena, PR_FALSE); - goto no_memory; - } - ss->sec.peerKey = peerKey; - ss->ssl3.hs.ws = wait_cert_request; - return SECSuccess; - } - -#ifdef NSS_ENABLE_ECC - case kt_ecdh: - rv = ssl3_HandleECDHServerKeyExchange(ss, b, length); - return rv; -#endif /* NSS_ENABLE_ECC */ - - default: - desc = handshake_failure; - errCode = SEC_ERROR_UNSUPPORTED_KEYALG; - break; /* goto alert_loser; */ - } - -alert_loser: - (void)SSL3_SendAlert(ss, alert_fatal, desc); -loser: - PORT_SetError( errCode ); - return SECFailure; - -no_memory: /* no-memory error has already been set. */ - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - return SECFailure; -} - - -typedef struct dnameNode { - struct dnameNode *next; - SECItem name; -} dnameNode; - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Certificate Request message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - PRArenaPool * arena = NULL; - dnameNode * node; - PRInt32 remaining; - PRBool isTLS = PR_FALSE; - int i; - int errCode = SSL_ERROR_RX_MALFORMED_CERT_REQUEST; - int nnames = 0; - SECStatus rv; - SSL3AlertDescription desc = illegal_parameter; - SECItem cert_types = {siBuffer, NULL, 0}; - CERTDistNames ca_list; - - SSL_TRC(3, ("%d: SSL3[%d]: handle certificate_request handshake", - SSL_GETPID(), ss->fd)); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->ssl3.hs.ws != wait_cert_request && - ss->ssl3.hs.ws != wait_server_key) { - desc = unexpected_message; - errCode = SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST; - goto alert_loser; - } - - /* clean up anything left from previous handshake. */ - if (ss->ssl3.clientCertChain != NULL) { - CERT_DestroyCertificateList(ss->ssl3.clientCertChain); - ss->ssl3.clientCertChain = NULL; - } - if (ss->ssl3.clientCertificate != NULL) { - CERT_DestroyCertificate(ss->ssl3.clientCertificate); - ss->ssl3.clientCertificate = NULL; - } - if (ss->ssl3.clientPrivateKey != NULL) { - SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); - ss->ssl3.clientPrivateKey = NULL; - } - - isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); - rv = ssl3_ConsumeHandshakeVariable(ss, &cert_types, 1, &b, &length); - if (rv != SECSuccess) - goto loser; /* malformed, alert has been sent */ - - arena = ca_list.arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); - if (arena == NULL) - goto no_mem; - - remaining = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); - if (remaining < 0) - goto loser; /* malformed, alert has been sent */ - - if ((PRUint32)remaining > length) - goto alert_loser; - - ca_list.head = node = PORT_ArenaZNew(arena, dnameNode); - if (node == NULL) - goto no_mem; - - while (remaining > 0) { - PRInt32 len; - - if (remaining < 2) - goto alert_loser; /* malformed */ - - node->name.len = len = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); - if (len <= 0) - goto loser; /* malformed, alert has been sent */ - - remaining -= 2; - if (remaining < len) - goto alert_loser; /* malformed */ - - node->name.data = b; - b += len; - length -= len; - remaining -= len; - nnames++; - if (remaining <= 0) - break; /* success */ - - node->next = PORT_ArenaZNew(arena, dnameNode); - node = node->next; - if (node == NULL) - goto no_mem; - } - - ca_list.nnames = nnames; - ca_list.names = PORT_ArenaNewArray(arena, SECItem, nnames); - if (nnames > 0 && ca_list.names == NULL) - goto no_mem; - - for(i = 0, node = (dnameNode*)ca_list.head; - i < nnames; - i++, node = node->next) { - ca_list.names[i] = node->name; - } - - if (length != 0) - goto alert_loser; /* malformed */ - - desc = no_certificate; - ss->ssl3.hs.ws = wait_hello_done; - - if (ss->getClientAuthData == NULL) { - rv = SECFailure; /* force it to send a no_certificate alert */ - } else { - /* XXX Should pass cert_types in this call!! */ - rv = (SECStatus)(*ss->getClientAuthData)(ss->getClientAuthDataArg, - ss->fd, &ca_list, - &ss->ssl3.clientCertificate, - &ss->ssl3.clientPrivateKey); - } - switch (rv) { - case SECWouldBlock: /* getClientAuthData has put up a dialog box. */ - ssl_SetAlwaysBlock(ss); - break; /* not an error */ - - case SECSuccess: - /* check what the callback function returned */ - if ((!ss->ssl3.clientCertificate) || (!ss->ssl3.clientPrivateKey)) { - /* we are missing either the key or cert */ - if (ss->ssl3.clientCertificate) { - /* got a cert, but no key - free it */ - CERT_DestroyCertificate(ss->ssl3.clientCertificate); - ss->ssl3.clientCertificate = NULL; - } - if (ss->ssl3.clientPrivateKey) { - /* got a key, but no cert - free it */ - SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); - ss->ssl3.clientPrivateKey = NULL; - } - goto send_no_certificate; - } - /* Setting ssl3.clientCertChain non-NULL will cause - * ssl3_HandleServerHelloDone to call SendCertificate. - */ - ss->ssl3.clientCertChain = CERT_CertChainFromCert( - ss->ssl3.clientCertificate, - certUsageSSLClient, PR_FALSE); - if (ss->ssl3.clientCertChain == NULL) { - if (ss->ssl3.clientCertificate != NULL) { - CERT_DestroyCertificate(ss->ssl3.clientCertificate); - ss->ssl3.clientCertificate = NULL; - } - if (ss->ssl3.clientPrivateKey != NULL) { - SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); - ss->ssl3.clientPrivateKey = NULL; - } - goto send_no_certificate; - } - break; /* not an error */ - - case SECFailure: - default: -send_no_certificate: - if (isTLS) { - ss->ssl3.sendEmptyCert = PR_TRUE; - } else { - (void)SSL3_SendAlert(ss, alert_warning, no_certificate); - } - rv = SECSuccess; - break; - } - goto done; - -no_mem: - rv = SECFailure; - PORT_SetError(SEC_ERROR_NO_MEMORY); - goto done; - -alert_loser: - if (isTLS && desc == illegal_parameter) - desc = decode_error; - (void)SSL3_SendAlert(ss, alert_fatal, desc); -loser: - PORT_SetError(errCode); - rv = SECFailure; -done: - if (arena != NULL) - PORT_FreeArena(arena, PR_FALSE); - return rv; -} - -/* - * attempt to restart the handshake after asynchronously handling - * a request for the client's certificate. - * - * inputs: - * cert Client cert chosen by application. - * Note: ssl takes this reference, and does not bump the - * reference count. The caller should drop its reference - * without calling CERT_DestroyCert after calling this function. - * - * key Private key associated with cert. This function makes a - * copy of the private key, so the caller remains responsible - * for destroying its copy after this function returns. - * - * certChain DER-encoded certs, client cert and its signers. - * Note: ssl takes this reference, and does not copy the chain. - * The caller should drop its reference without destroying the - * chain. SSL will free the chain when it is done with it. - * - * Return value: XXX - * - * XXX This code only works on the initial handshake on a connection, XXX - * It does not work on a subsequent handshake (redo). - * - * Caller holds 1stHandshakeLock. - */ -SECStatus -ssl3_RestartHandshakeAfterCertReq(sslSocket * ss, - CERTCertificate * cert, - SECKEYPrivateKey * key, - CERTCertificateList *certChain) -{ - SECStatus rv = SECSuccess; - - if (MSB(ss->version) == MSB(SSL_LIBRARY_VERSION_3_0)) { - /* XXX This code only works on the initial handshake on a connection, - ** XXX It does not work on a subsequent handshake (redo). - */ - if (ss->handshake != 0) { - ss->handshake = ssl_GatherRecord1stHandshake; - ss->ssl3.clientCertificate = cert; - ss->ssl3.clientCertChain = certChain; - if (key == NULL) { - (void)SSL3_SendAlert(ss, alert_warning, no_certificate); - ss->ssl3.clientPrivateKey = NULL; - } else { - ss->ssl3.clientPrivateKey = SECKEY_CopyPrivateKey(key); - } - ssl_GetRecvBufLock(ss); - if (ss->ssl3.hs.msgState.buf != NULL) { - rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf); - } - ssl_ReleaseRecvBufLock(ss); - } - } - return rv; -} - - - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Server Hello Done message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleServerHelloDone(sslSocket *ss) -{ - SECStatus rv; - SSL3WaitState ws = ss->ssl3.hs.ws; - PRBool send_verify = PR_FALSE; - - SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello_done handshake", - SSL_GETPID(), ss->fd)); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ws != wait_hello_done && - ws != wait_server_cert && - ws != wait_server_key && - ws != wait_cert_request) { - SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE); - return SECFailure; - } - - ssl_GetXmitBufLock(ss); /*******************************/ - - if (ss->ssl3.sendEmptyCert) { - ss->ssl3.sendEmptyCert = PR_FALSE; - rv = ssl3_SendEmptyCertificate(ss); - /* Don't send verify */ - if (rv != SECSuccess) { - goto loser; /* error code is set. */ - } - } else - if (ss->ssl3.clientCertChain != NULL && - ss->ssl3.clientPrivateKey != NULL) { - send_verify = PR_TRUE; - rv = ssl3_SendCertificate(ss); - if (rv != SECSuccess) { - goto loser; /* error code is set. */ - } - } - - rv = ssl3_SendClientKeyExchange(ss); - if (rv != SECSuccess) { - goto loser; /* err is set. */ - } - - if (send_verify) { - rv = ssl3_SendCertificateVerify(ss); - if (rv != SECSuccess) { - goto loser; /* err is set. */ - } - } - rv = ssl3_SendChangeCipherSpecs(ss); - if (rv != SECSuccess) { - goto loser; /* err code was set. */ - } - rv = ssl3_SendFinished(ss, 0); - if (rv != SECSuccess) { - goto loser; /* err code was set. */ - } - - ssl_ReleaseXmitBufLock(ss); /*******************************/ - - if (ssl3_ExtensionNegotiated(ss, session_ticket_xtn)) - ss->ssl3.hs.ws = wait_new_session_ticket; - else - ss->ssl3.hs.ws = wait_change_cipher; - return SECSuccess; - -loser: - ssl_ReleaseXmitBufLock(ss); - return rv; -} - -/* - * Routines used by servers - */ -static SECStatus -ssl3_SendHelloRequest(sslSocket *ss) -{ - SECStatus rv; - - SSL_TRC(3, ("%d: SSL3[%d]: send hello_request handshake", SSL_GETPID(), - ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - rv = ssl3_AppendHandshakeHeader(ss, hello_request, 0); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake */ - } - rv = ssl3_FlushHandshake(ss, 0); - if (rv != SECSuccess) { - return rv; /* error code set by ssl3_FlushHandshake */ - } - ss->ssl3.hs.ws = wait_client_hello; - return SECSuccess; -} - -/* Sets memory error when returning NULL. - * Called from: - * ssl3_SendClientHello() - * ssl3_HandleServerHello() - * ssl3_HandleClientHello() - * ssl3_HandleV2ClientHello() - */ -sslSessionID * -ssl3_NewSessionID(sslSocket *ss, PRBool is_server) -{ - sslSessionID *sid; - - sid = PORT_ZNew(sslSessionID); - if (sid == NULL) - return sid; - - sid->peerID = (ss->peerID == NULL) ? NULL : PORT_Strdup(ss->peerID); - sid->urlSvrName = (ss->url == NULL) ? NULL : PORT_Strdup(ss->url); - sid->addr = ss->sec.ci.peer; - sid->port = ss->sec.ci.port; - sid->references = 1; - sid->cached = never_cached; - sid->version = ss->version; - - sid->u.ssl3.keys.resumable = PR_TRUE; - sid->u.ssl3.policy = SSL_ALLOWED; - sid->u.ssl3.clientWriteKey = NULL; - sid->u.ssl3.serverWriteKey = NULL; - - if (is_server) { - SECStatus rv; - int pid = SSL_GETPID(); - - sid->u.ssl3.sessionIDLength = SSL3_SESSIONID_BYTES; - sid->u.ssl3.sessionID[0] = (pid >> 8) & 0xff; - sid->u.ssl3.sessionID[1] = pid & 0xff; - rv = PK11_GenerateRandom(sid->u.ssl3.sessionID + 2, - SSL3_SESSIONID_BYTES -2); - if (rv != SECSuccess) { - ssl_FreeSID(sid); - ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE); - return NULL; - } - } - return sid; -} - -/* Called from: ssl3_HandleClientHello, ssl3_HandleV2ClientHello */ -static SECStatus -ssl3_SendServerHelloSequence(sslSocket *ss) -{ - const ssl3KEADef *kea_def; - SECStatus rv; - - SSL_TRC(3, ("%d: SSL3[%d]: begin send server_hello sequence", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - rv = ssl3_SendServerHello(ss); - if (rv != SECSuccess) { - return rv; /* err code is set. */ - } - rv = ssl3_SendCertificate(ss); - if (rv != SECSuccess) { - return rv; /* error code is set. */ - } - /* We have to do this after the call to ssl3_SendServerHello, - * because kea_def is set up by ssl3_SendServerHello(). - */ - kea_def = ss->ssl3.hs.kea_def; - ss->ssl3.hs.usedStepDownKey = PR_FALSE; - - if (kea_def->is_limited && kea_def->exchKeyType == kt_rsa) { - /* see if we can legally use the key in the cert. */ - int keyLen; /* bytes */ - - keyLen = PK11_GetPrivateModulusLen( - ss->serverCerts[kea_def->exchKeyType].SERVERKEY); - - if (keyLen > 0 && - keyLen * BPB <= kea_def->key_size_limit ) { - /* XXX AND cert is not signing only!! */ - /* just fall through and use it. */ - } else if (ss->stepDownKeyPair != NULL) { - ss->ssl3.hs.usedStepDownKey = PR_TRUE; - rv = ssl3_SendServerKeyExchange(ss); - if (rv != SECSuccess) { - return rv; /* err code was set. */ - } - } else { -#ifndef HACKED_EXPORT_SERVER - PORT_SetError(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED); - return rv; -#endif - } -#ifdef NSS_ENABLE_ECC - } else if ((kea_def->kea == kea_ecdhe_rsa) || - (kea_def->kea == kea_ecdhe_ecdsa)) { - rv = ssl3_SendServerKeyExchange(ss); - if (rv != SECSuccess) { - return rv; /* err code was set. */ - } -#endif /* NSS_ENABLE_ECC */ - } - - if (ss->opt.requestCertificate) { - rv = ssl3_SendCertificateRequest(ss); - if (rv != SECSuccess) { - return rv; /* err code is set. */ - } - } - rv = ssl3_SendServerHelloDone(ss); - if (rv != SECSuccess) { - return rv; /* err code is set. */ - } - - ss->ssl3.hs.ws = (ss->opt.requestCertificate) ? wait_client_cert - : wait_client_key; - return SECSuccess; -} - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Client Hello message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - sslSessionID * sid = NULL; - PRInt32 tmp; - unsigned int i; - int j; - SECStatus rv; - int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; - SSL3AlertDescription desc = illegal_parameter; - SSL3ProtocolVersion version; - SECItem sidBytes = {siBuffer, NULL, 0}; - SECItem suites = {siBuffer, NULL, 0}; - SECItem comps = {siBuffer, NULL, 0}; - PRBool haveSpecWriteLock = PR_FALSE; - PRBool haveXmitBufLock = PR_FALSE; - - SSL_TRC(3, ("%d: SSL3[%d]: handle client_hello handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - /* Get peer name of client */ - rv = ssl_GetPeerInfo(ss); - if (rv != SECSuccess) { - return rv; /* error code is set. */ - } - - /* We might be starting session renegotiation in which case we should - * clear previous state. - */ - PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData)); - ss->statelessResume = PR_FALSE; - - rv = ssl3_InitState(ss); - if (rv != SECSuccess) { - return rv; /* ssl3_InitState has set the error code. */ - } - - if ((ss->ssl3.hs.ws != wait_client_hello) && - (ss->ssl3.hs.ws != idle_handshake)) { - desc = unexpected_message; - errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO; - goto alert_loser; - } - - tmp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); - if (tmp < 0) - goto loser; /* malformed, alert already sent */ - ss->clientHelloVersion = version = (SSL3ProtocolVersion)tmp; - rv = ssl3_NegotiateVersion(ss, version); - if (rv != SECSuccess) { - desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure; - errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - goto alert_loser; - } - - /* grab the client random data. */ - rv = ssl3_ConsumeHandshake( - ss, &ss->ssl3.hs.client_random, SSL3_RANDOM_LENGTH, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed */ - } - - /* grab the client's SID, if present. */ - rv = ssl3_ConsumeHandshakeVariable(ss, &sidBytes, 1, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed */ - } - - /* grab the list of cipher suites. */ - rv = ssl3_ConsumeHandshakeVariable(ss, &suites, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed */ - } - - /* grab the list of compression methods. */ - rv = ssl3_ConsumeHandshakeVariable(ss, &comps, 1, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed */ - } - - desc = handshake_failure; - - /* Handle TLS hello extensions for SSL3 & TLS. We do not know if - * we are restarting a previous session until extensions have been - * parsed, since we might have received a SessionTicket extension. - * Note: we allow extensions even when negotiating SSL3 for the sake - * of interoperability (and backwards compatibility). - */ - - if (length) { - /* Get length of hello extensions */ - PRInt32 extension_length; - extension_length = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); - if (extension_length < 0) { - goto loser; /* alert already sent */ - } - if (extension_length != length) { - ssl3_DecodeError(ss); /* send alert */ - goto loser; - } - rv = ssl3_HandleHelloExtensions(ss, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed */ - } - } - - /* We do stateful resumes only if either of the following - * conditions are satisfied: (1) the client does not support the - * session ticket extension, or (2) the client support the session - * ticket extension, but sent an empty ticket. - */ - if (!ssl3_ExtensionNegotiated(ss, session_ticket_xtn) || - ss->xtnData.emptySessionTicket) { - if (sidBytes.len > 0 && !ss->opt.noCache) { - SSL_TRC(7, ("%d: SSL3[%d]: server, lookup client session-id for 0x%08x%08x%08x%08x", - SSL_GETPID(), ss->fd, ss->sec.ci.peer.pr_s6_addr32[0], - ss->sec.ci.peer.pr_s6_addr32[1], - ss->sec.ci.peer.pr_s6_addr32[2], - ss->sec.ci.peer.pr_s6_addr32[3])); - if (ssl_sid_lookup) { - sid = (*ssl_sid_lookup)(&ss->sec.ci.peer, sidBytes.data, - sidBytes.len, ss->dbHandle); - } else { - errCode = SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED; - goto loser; - } - } - } else if (ss->statelessResume) { - /* Fill in the client's session ID if doing a stateless resume. - * (When doing stateless resumes, server echos client's SessionID.) - */ - sid = ss->sec.ci.sid; - PORT_Assert(sid != NULL); /* Should have already been filled in.*/ - - if (sidBytes.len > 0 && sidBytes.len <= SSL3_SESSIONID_BYTES) { - sid->u.ssl3.sessionIDLength = sidBytes.len; - PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes.data, - sidBytes.len); - sid->u.ssl3.sessionIDLength = sidBytes.len; - } else { - sid->u.ssl3.sessionIDLength = 0; - } - ss->sec.ci.sid = NULL; - } - - /* We only send a session ticket extension if the client supports - * the extension and we are unable to do either a stateful or - * stateless resume. - * - * TODO: send a session ticket if performing a stateful - * resumption. (As per RFC4507, a server may issue a session - * ticket while doing a (stateless or stateful) session resume, - * but OpenSSL-0.9.8g does not accept session tickets while - * resuming.) - */ - if (ssl3_ExtensionNegotiated(ss, session_ticket_xtn) && sid == NULL) { - ssl3_RegisterServerHelloExtensionSender(ss, - session_ticket_xtn, ssl3_SendSessionTicketXtn); - } - - if (sid != NULL) { - /* We've found a session cache entry for this client. - * Now, if we're going to require a client-auth cert, - * and we don't already have this client's cert in the session cache, - * and this is the first handshake on this connection (not a redo), - * then drop this old cache entry and start a new session. - */ - if ((sid->peerCert == NULL) && ss->opt.requestCertificate && - ((ss->opt.requireCertificate == SSL_REQUIRE_ALWAYS) || - (ss->opt.requireCertificate == SSL_REQUIRE_NO_ERROR) || - ((ss->opt.requireCertificate == SSL_REQUIRE_FIRST_HANDSHAKE) - && !ss->firstHsDone))) { - - SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_not_ok ); - ss->sec.uncache(sid); - ssl_FreeSID(sid); - sid = NULL; - } - } - -#ifdef NSS_ENABLE_ECC - /* Disable any ECC cipher suites for which we have no cert. */ - ssl3_FilterECCipherSuitesByServerCerts(ss); -#endif - -#ifdef PARANOID - /* Look for a matching cipher suite. */ - j = ssl3_config_match_init(ss); - if (j <= 0) { /* no ciphers are working/supported by PK11 */ - errCode = PORT_GetError(); /* error code is already set. */ - goto alert_loser; - } -#endif - - /* If we already have a session for this client, be sure to pick the - ** same cipher suite we picked before. - ** This is not a loop, despite appearances. - */ - if (sid) do { - ssl3CipherSuiteCfg *suite = ss->cipherSuites; - /* Find the entry for the cipher suite used in the cached session. */ - for (j = ssl_V3_SUITES_IMPLEMENTED; j > 0; --j, ++suite) { - if (suite->cipher_suite == sid->u.ssl3.cipherSuite) - break; - } - PORT_Assert(j > 0); - if (j <= 0) - break; -#ifdef PARANOID - /* Double check that the cached cipher suite is still enabled, - * implemented, and allowed by policy. Might have been disabled. - * The product policy won't change during the process lifetime. - * Implemented ("isPresent") shouldn't change for servers. - */ - if (!config_match(suite, ss->ssl3.policy, PR_TRUE)) - break; -#else - if (!suite->enabled) - break; -#endif - /* Double check that the cached cipher suite is in the client's list */ - for (i = 0; i < suites.len; i += 2) { - if ((suites.data[i] == MSB(suite->cipher_suite)) && - (suites.data[i + 1] == LSB(suite->cipher_suite))) { - - ss->ssl3.hs.cipher_suite = suite->cipher_suite; - ss->ssl3.hs.suite_def = - ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite); - goto suite_found; - } - } - } while (0); - - /* START A NEW SESSION */ - -#ifndef PARANOID - /* Look for a matching cipher suite. */ - j = ssl3_config_match_init(ss); - if (j <= 0) { /* no ciphers are working/supported by PK11 */ - errCode = PORT_GetError(); /* error code is already set. */ - goto alert_loser; - } -#endif - - /* Select a cipher suite. - ** NOTE: This suite selection algorithm should be the same as the one in - ** ssl3_HandleV2ClientHello(). - */ - for (j = 0; j < ssl_V3_SUITES_IMPLEMENTED; j++) { - ssl3CipherSuiteCfg *suite = &ss->cipherSuites[j]; - if (!config_match(suite, ss->ssl3.policy, PR_TRUE)) - continue; - for (i = 0; i < suites.len; i += 2) { - if ((suites.data[i] == MSB(suite->cipher_suite)) && - (suites.data[i + 1] == LSB(suite->cipher_suite))) { - - ss->ssl3.hs.cipher_suite = suite->cipher_suite; - ss->ssl3.hs.suite_def = - ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite); - goto suite_found; - } - } - } - errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - goto alert_loser; - -suite_found: - /* Look for a matching compression algorithm. */ - for (i = 0; i < comps.len; i++) { - for (j = 0; j < compressionMethodsCount; j++) { - if (comps.data[i] == compressions[j]) { - ss->ssl3.hs.compression = - (SSL3CompressionMethod)compressions[j]; - goto compression_found; - } - } - } - errCode = SSL_ERROR_NO_COMPRESSION_OVERLAP; - /* null compression must be supported */ - goto alert_loser; - -compression_found: - suites.data = NULL; - comps.data = NULL; - - ss->sec.send = ssl3_SendApplicationData; - - /* If there are any failures while processing the old sid, - * we don't consider them to be errors. Instead, We just behave - * as if the client had sent us no sid to begin with, and make a new one. - */ - if (sid != NULL) do { - ssl3CipherSpec *pwSpec; - SECItem wrappedMS; /* wrapped key */ - - if (sid->version != ss->version || - sid->u.ssl3.cipherSuite != ss->ssl3.hs.cipher_suite) { - break; /* not an error */ - } - - if (ss->sec.ci.sid) { - ss->sec.uncache(ss->sec.ci.sid); - PORT_Assert(ss->sec.ci.sid != sid); /* should be impossible, but ... */ - if (ss->sec.ci.sid != sid) { - ssl_FreeSID(ss->sec.ci.sid); - } - ss->sec.ci.sid = NULL; - } - /* we need to resurrect the master secret.... */ - - ssl_GetSpecWriteLock(ss); haveSpecWriteLock = PR_TRUE; - pwSpec = ss->ssl3.pwSpec; - if (sid->u.ssl3.keys.msIsWrapped) { - PK11SymKey * wrapKey; /* wrapping key */ - CK_FLAGS keyFlags = 0; - if (ss->opt.bypassPKCS11) { - /* we cannot restart a non-bypass session in a - ** bypass socket. - */ - break; - } - - wrapKey = getWrappingKey(ss, NULL, sid->u.ssl3.exchKeyType, - sid->u.ssl3.masterWrapMech, - ss->pkcs11PinArg); - if (!wrapKey) { - /* we have a SID cache entry, but no wrapping key for it??? */ - break; - } - - if (ss->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */ - keyFlags = CKF_SIGN | CKF_VERIFY; - } - - wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; - wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; - - /* unwrap the master secret. */ - pwSpec->master_secret = - PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, - NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE, - CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags); - PK11_FreeSymKey(wrapKey); - if (pwSpec->master_secret == NULL) { - break; /* not an error */ - } - } else if (ss->opt.bypassPKCS11) { - wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; - wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; - memcpy(pwSpec->raw_master_secret, wrappedMS.data, wrappedMS.len); - pwSpec->msItem.data = pwSpec->raw_master_secret; - pwSpec->msItem.len = wrappedMS.len; - } else { - /* We CAN restart a bypass session in a non-bypass socket. */ - /* need to import the raw master secret to session object */ - PK11SlotInfo * slot; - wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; - wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; - slot = PK11_GetInternalSlot(); - pwSpec->master_secret = - PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, - PK11_OriginUnwrap, CKA_ENCRYPT, &wrappedMS, - NULL); - PK11_FreeSlot(slot); - if (pwSpec->master_secret == NULL) { - break; /* not an error */ - } - } - ss->sec.ci.sid = sid; - if (sid->peerCert != NULL) { - ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); - } - - /* - * Old SID passed all tests, so resume this old session. - * - * XXX make sure compression still matches - */ - SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_hits ); - if (ss->statelessResume) - SSL_AtomicIncrementLong(& ssl3stats.hch_sid_stateless_resumes ); - ss->ssl3.hs.isResuming = PR_TRUE; - - ss->sec.authAlgorithm = sid->authAlgorithm; - ss->sec.authKeyBits = sid->authKeyBits; - ss->sec.keaType = sid->keaType; - ss->sec.keaKeyBits = sid->keaKeyBits; - - /* server sids don't remember the server cert we previously sent, - ** but they do remember the kea type we originally used, so we - ** can locate it again, provided that the current ssl socket - ** has had its server certs configured the same as the previous one. - */ - ss->sec.localCert = - CERT_DupCertificate(ss->serverCerts[sid->keaType].serverCert); - - ssl_GetXmitBufLock(ss); haveXmitBufLock = PR_TRUE; - - rv = ssl3_SendServerHello(ss); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - - if (haveSpecWriteLock) { - ssl_ReleaseSpecWriteLock(ss); - haveSpecWriteLock = PR_FALSE; - } - - /* NULL value for PMS signifies re-use of the old MS */ - rv = ssl3_InitPendingCipherSpec(ss, NULL); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - - rv = ssl3_SendChangeCipherSpecs(ss); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - rv = ssl3_SendFinished(ss, 0); - ss->ssl3.hs.ws = wait_change_cipher; - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - - if (haveXmitBufLock) { - ssl_ReleaseXmitBufLock(ss); - haveXmitBufLock = PR_FALSE; - } - - return SECSuccess; - } while (0); - - if (haveSpecWriteLock) { - ssl_ReleaseSpecWriteLock(ss); - haveSpecWriteLock = PR_FALSE; - } - - if (sid) { /* we had a sid, but it's no longer valid, free it */ - SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_not_ok ); - ss->sec.uncache(sid); - ssl_FreeSID(sid); - sid = NULL; - } - SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_misses ); - - sid = ssl3_NewSessionID(ss, PR_TRUE); - if (sid == NULL) { - errCode = PORT_GetError(); - goto loser; /* memory error is set. */ - } - ss->sec.ci.sid = sid; - - ss->ssl3.hs.isResuming = PR_FALSE; - ssl_GetXmitBufLock(ss); - rv = ssl3_SendServerHelloSequence(ss); - ssl_ReleaseXmitBufLock(ss); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - - if (haveXmitBufLock) { - ssl_ReleaseXmitBufLock(ss); - haveXmitBufLock = PR_FALSE; - } - - return SECSuccess; - -alert_loser: - if (haveSpecWriteLock) { - ssl_ReleaseSpecWriteLock(ss); - haveSpecWriteLock = PR_FALSE; - } - (void)SSL3_SendAlert(ss, alert_fatal, desc); - /* FALLTHRU */ -loser: - if (haveSpecWriteLock) { - ssl_ReleaseSpecWriteLock(ss); - haveSpecWriteLock = PR_FALSE; - } - - if (haveXmitBufLock) { - ssl_ReleaseXmitBufLock(ss); - haveXmitBufLock = PR_FALSE; - } - - PORT_SetError(errCode); - return SECFailure; -} - -/* - * ssl3_HandleV2ClientHello is used when a V2 formatted hello comes - * in asking to use the V3 handshake. - * Called from ssl2_HandleClientHelloMessage() in sslcon.c - */ -SECStatus -ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length) -{ - sslSessionID * sid = NULL; - unsigned char * suites; - unsigned char * random; - SSL3ProtocolVersion version; - SECStatus rv; - int i; - int j; - int sid_length; - int suite_length; - int rand_length; - int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; - SSL3AlertDescription desc = handshake_failure; - - SSL_TRC(3, ("%d: SSL3[%d]: handle v2 client_hello", SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - - ssl_GetSSL3HandshakeLock(ss); - - PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData)); - - rv = ssl3_InitState(ss); - if (rv != SECSuccess) { - ssl_ReleaseSSL3HandshakeLock(ss); - return rv; /* ssl3_InitState has set the error code. */ - } - - if (ss->ssl3.hs.ws != wait_client_hello) { - desc = unexpected_message; - errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO; - goto loser; /* alert_loser */ - } - - version = (buffer[1] << 8) | buffer[2]; - suite_length = (buffer[3] << 8) | buffer[4]; - sid_length = (buffer[5] << 8) | buffer[6]; - rand_length = (buffer[7] << 8) | buffer[8]; - ss->clientHelloVersion = version; - - rv = ssl3_NegotiateVersion(ss, version); - if (rv != SECSuccess) { - /* send back which ever alert client will understand. */ - desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure; - errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - goto alert_loser; - } - - /* if we get a non-zero SID, just ignore it. */ - if (length != - SSL_HL_CLIENT_HELLO_HBYTES + suite_length + sid_length + rand_length) { - SSL_DBG(("%d: SSL3[%d]: bad v2 client hello message, len=%d should=%d", - SSL_GETPID(), ss->fd, length, - SSL_HL_CLIENT_HELLO_HBYTES + suite_length + sid_length + - rand_length)); - goto loser; /* malformed */ /* alert_loser */ - } - - suites = buffer + SSL_HL_CLIENT_HELLO_HBYTES; - random = suites + suite_length + sid_length; - - if (rand_length < SSL_MIN_CHALLENGE_BYTES || - rand_length > SSL_MAX_CHALLENGE_BYTES) { - goto loser; /* malformed */ /* alert_loser */ - } - - PORT_Assert(SSL_MAX_CHALLENGE_BYTES == SSL3_RANDOM_LENGTH); - - PORT_Memset(&ss->ssl3.hs.client_random, 0, SSL3_RANDOM_LENGTH); - PORT_Memcpy( - &ss->ssl3.hs.client_random.rand[SSL3_RANDOM_LENGTH - rand_length], - random, rand_length); - - PRINT_BUF(60, (ss, "client random:", &ss->ssl3.hs.client_random.rand[0], - SSL3_RANDOM_LENGTH)); -#ifdef NSS_ENABLE_ECC - /* Disable any ECC cipher suites for which we have no cert. */ - ssl3_FilterECCipherSuitesByServerCerts(ss); -#endif - i = ssl3_config_match_init(ss); - if (i <= 0) { - errCode = PORT_GetError(); /* error code is already set. */ - goto alert_loser; - } - - /* Select a cipher suite. - ** NOTE: This suite selection algorithm should be the same as the one in - ** ssl3_HandleClientHello(). - */ - for (j = 0; j < ssl_V3_SUITES_IMPLEMENTED; j++) { - ssl3CipherSuiteCfg *suite = &ss->cipherSuites[j]; - if (!config_match(suite, ss->ssl3.policy, PR_TRUE)) - continue; - for (i = 0; i < suite_length; i += 3) { - if ((suites[i] == 0) && - (suites[i+1] == MSB(suite->cipher_suite)) && - (suites[i+2] == LSB(suite->cipher_suite))) { - - ss->ssl3.hs.cipher_suite = suite->cipher_suite; - ss->ssl3.hs.suite_def = - ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite); - goto suite_found; - } - } - } - errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - goto alert_loser; - -suite_found: - - ss->ssl3.hs.compression = compression_null; - ss->sec.send = ssl3_SendApplicationData; - - /* we don't even search for a cache hit here. It's just a miss. */ - SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_misses ); - sid = ssl3_NewSessionID(ss, PR_TRUE); - if (sid == NULL) { - errCode = PORT_GetError(); - goto loser; /* memory error is set. */ - } - ss->sec.ci.sid = sid; - /* do not worry about memory leak of sid since it now belongs to ci */ - - /* We have to update the handshake hashes before we can send stuff */ - rv = ssl3_UpdateHandshakeHashes(ss, buffer, length); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - - ssl_GetXmitBufLock(ss); - rv = ssl3_SendServerHelloSequence(ss); - ssl_ReleaseXmitBufLock(ss); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - - /* XXX_1 The call stack to here is: - * ssl_Do1stHandshake -> ssl2_HandleClientHelloMessage -> here. - * ssl2_HandleClientHelloMessage returns whatever we return here. - * ssl_Do1stHandshake will continue looping if it gets back either - * SECSuccess or SECWouldBlock. - * SECSuccess is preferable here. See XXX_1 in sslgathr.c. - */ - ssl_ReleaseSSL3HandshakeLock(ss); - return SECSuccess; - -alert_loser: - SSL3_SendAlert(ss, alert_fatal, desc); -loser: - ssl_ReleaseSSL3HandshakeLock(ss); - PORT_SetError(errCode); - return SECFailure; -} - -/* The negotiated version number has been already placed in ss->version. -** -** Called from: ssl3_HandleClientHello (resuming session), -** ssl3_SendServerHelloSequence <- ssl3_HandleClientHello (new session), -** ssl3_SendServerHelloSequence <- ssl3_HandleV2ClientHello (new session) -*/ -static SECStatus -ssl3_SendServerHello(sslSocket *ss) -{ - sslSessionID *sid; - SECStatus rv; - PRUint32 maxBytes = 65535; - PRUint32 length; - PRInt32 extensions_len = 0; - - SSL_TRC(3, ("%d: SSL3[%d]: send server_hello handshake", SSL_GETPID(), - ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - PORT_Assert( MSB(ss->version) == MSB(SSL_LIBRARY_VERSION_3_0)); - - if (MSB(ss->version) != MSB(SSL_LIBRARY_VERSION_3_0)) { - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return SECFailure; - } - - sid = ss->sec.ci.sid; - - extensions_len = ssl3_CallHelloExtensionSenders(ss, PR_FALSE, maxBytes, - &ss->xtnData.serverSenders[0]); - if (extensions_len > 0) - extensions_len += 2; /* Add sizeof total extension length */ - - length = sizeof(SSL3ProtocolVersion) + SSL3_RANDOM_LENGTH + 1 + - ((sid == NULL) ? 0: sid->u.ssl3.sessionIDLength) + - sizeof(ssl3CipherSuite) + 1 + extensions_len; - rv = ssl3_AppendHandshakeHeader(ss, server_hello, length); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeNumber(ss, ss->version, 2); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - rv = ssl3_GetNewRandom(&ss->ssl3.hs.server_random); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE); - return rv; - } - rv = ssl3_AppendHandshake( - ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - - if (sid) - rv = ssl3_AppendHandshakeVariable( - ss, sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength, 1); - else - rv = ssl3_AppendHandshakeVariable(ss, NULL, 0, 1); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.cipher_suite, 2); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.compression, 1); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - if (extensions_len) { - PRInt32 sent_len; - - extensions_len -= 2; - rv = ssl3_AppendHandshakeNumber(ss, extensions_len, 2); - if (rv != SECSuccess) - return rv; /* err set by ssl3_SetupPendingCipherSpec */ - sent_len = ssl3_CallHelloExtensionSenders(ss, PR_TRUE, extensions_len, - &ss->xtnData.serverSenders[0]); - PORT_Assert(sent_len == extensions_len); - if (sent_len != extensions_len) { - if (sent_len >= 0) - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - return SECFailure; - } - } - rv = ssl3_SetupPendingCipherSpec(ss); - if (rv != SECSuccess) { - return rv; /* err set by ssl3_SetupPendingCipherSpec */ - } - - return SECSuccess; -} - - -static SECStatus -ssl3_SendServerKeyExchange(sslSocket *ss) -{ -const ssl3KEADef * kea_def = ss->ssl3.hs.kea_def; - SECStatus rv = SECFailure; - int length; - PRBool isTLS; - SECItem signed_hash = {siBuffer, NULL, 0}; - SSL3Hashes hashes; - SECKEYPublicKey * sdPub; /* public key for step-down */ - - SSL_TRC(3, ("%d: SSL3[%d]: send server_key_exchange handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - switch (kea_def->exchKeyType) { - case kt_rsa: - /* Perform SSL Step-Down here. */ - sdPub = ss->stepDownKeyPair->pubKey; - PORT_Assert(sdPub != NULL); - if (!sdPub) { - PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - return SECFailure; - } - rv = ssl3_ComputeExportRSAKeyHash(sdPub->u.rsa.modulus, - sdPub->u.rsa.publicExponent, - &ss->ssl3.hs.client_random, - &ss->ssl3.hs.server_random, - &hashes, ss->opt.bypassPKCS11); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - return rv; - } - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - rv = ssl3_SignHashes(&hashes, ss->serverCerts[kt_rsa].SERVERKEY, - &signed_hash, isTLS); - if (rv != SECSuccess) { - goto loser; /* ssl3_SignHashes has set err. */ - } - if (signed_hash.data == NULL) { - /* how can this happen and rv == SECSuccess ?? */ - PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto loser; - } - length = 2 + sdPub->u.rsa.modulus.len + - 2 + sdPub->u.rsa.publicExponent.len + - 2 + signed_hash.len; - - rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeVariable(ss, sdPub->u.rsa.modulus.data, - sdPub->u.rsa.modulus.len, 2); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeVariable( - ss, sdPub->u.rsa.publicExponent.data, - sdPub->u.rsa.publicExponent.len, 2); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data, - signed_hash.len, 2); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - PORT_Free(signed_hash.data); - return SECSuccess; - -#ifdef NSS_ENABLE_ECC - case kt_ecdh: { - rv = ssl3_SendECDHServerKeyExchange(ss); - return rv; - } -#endif /* NSS_ENABLE_ECC */ - - case kt_dh: - case kt_null: - default: - PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); - break; - } -loser: - if (signed_hash.data != NULL) - PORT_Free(signed_hash.data); - return SECFailure; -} - - -static SECStatus -ssl3_SendCertificateRequest(sslSocket *ss) -{ - SECItem * name; - CERTDistNames *ca_list; -const uint8 * certTypes; - SECItem * names = NULL; - SECStatus rv; - int length; - int i; - int calen = 0; - int nnames = 0; - int certTypesLength; - - SSL_TRC(3, ("%d: SSL3[%d]: send certificate_request handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - /* ssl3.ca_list is initialized to NULL, and never changed. */ - ca_list = ss->ssl3.ca_list; - if (!ca_list) { - ca_list = ssl3_server_ca_list; - } - - if (ca_list != NULL) { - names = ca_list->names; - nnames = ca_list->nnames; - } - - if (!nnames) { - PORT_SetError(SSL_ERROR_NO_TRUSTED_SSL_CLIENT_CA); - return SECFailure; - } - - for (i = 0, name = names; i < nnames; i++, name++) { - calen += 2 + name->len; - } - - certTypes = certificate_types; - certTypesLength = sizeof certificate_types; - - length = 1 + certTypesLength + 2 + calen; - - rv = ssl3_AppendHandshakeHeader(ss, certificate_request, length); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - rv = ssl3_AppendHandshakeVariable(ss, certTypes, certTypesLength, 1); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - rv = ssl3_AppendHandshakeNumber(ss, calen, 2); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - for (i = 0, name = names; i < nnames; i++, name++) { - rv = ssl3_AppendHandshakeVariable(ss, name->data, name->len, 2); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - } - - return SECSuccess; -} - -static SECStatus -ssl3_SendServerHelloDone(sslSocket *ss) -{ - SECStatus rv; - - SSL_TRC(3, ("%d: SSL3[%d]: send server_hello_done handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - rv = ssl3_AppendHandshakeHeader(ss, server_hello_done, 0); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - rv = ssl3_FlushHandshake(ss, 0); - if (rv != SECSuccess) { - return rv; /* error code set by ssl3_FlushHandshake */ - } - return SECSuccess; -} - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Certificate Verify message - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length, - SSL3Hashes *hashes) -{ - SECItem signed_hash = {siBuffer, NULL, 0}; - SECStatus rv; - int errCode = SSL_ERROR_RX_MALFORMED_CERT_VERIFY; - SSL3AlertDescription desc = handshake_failure; - PRBool isTLS; - - SSL_TRC(3, ("%d: SSL3[%d]: handle certificate_verify handshake", - SSL_GETPID(), ss->fd)); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->ssl3.hs.ws != wait_cert_verify || ss->sec.peerCert == NULL) { - desc = unexpected_message; - errCode = SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY; - goto alert_loser; - } - - rv = ssl3_ConsumeHandshakeVariable(ss, &signed_hash, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - - isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); - - /* XXX verify that the key & kea match */ - rv = ssl3_VerifySignedHashes(hashes, ss->sec.peerCert, &signed_hash, - isTLS, ss->pkcs11PinArg); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - desc = isTLS ? decrypt_error : handshake_failure; - goto alert_loser; - } - - signed_hash.data = NULL; - - if (length != 0) { - desc = isTLS ? decode_error : illegal_parameter; - goto alert_loser; /* malformed */ - } - ss->ssl3.hs.ws = wait_change_cipher; - return SECSuccess; - -alert_loser: - SSL3_SendAlert(ss, alert_fatal, desc); -loser: - PORT_SetError(errCode); - return SECFailure; -} - - -/* find a slot that is able to generate a PMS and wrap it with RSA. - * Then generate and return the PMS. - * If the serverKeySlot parameter is non-null, this function will use - * that slot to do the job, otherwise it will find a slot. - * - * Called from ssl3_DeriveConnectionKeysPKCS11() (above) - * sendRSAClientKeyExchange() (above) - * ssl3_HandleRSAClientKeyExchange() (below) - * Caller must hold the SpecWriteLock, the SSL3HandshakeLock - */ -static PK11SymKey * -ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec, - PK11SlotInfo * serverKeySlot) -{ - PK11SymKey * pms = NULL; - PK11SlotInfo * slot = serverKeySlot; - void * pwArg = ss->pkcs11PinArg; - SECItem param; - CK_VERSION version; - CK_MECHANISM_TYPE mechanism_array[3]; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (slot == NULL) { - SSLCipherAlgorithm calg; - /* The specReadLock would suffice here, but we cannot assert on - ** read locks. Also, all the callers who call with a non-null - ** slot already hold the SpecWriteLock. - */ - PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); - PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); - - calg = spec->cipher_def->calg; - PORT_Assert(alg2Mech[calg].calg == calg); - - /* First get an appropriate slot. */ - mechanism_array[0] = CKM_SSL3_PRE_MASTER_KEY_GEN; - mechanism_array[1] = CKM_RSA_PKCS; - mechanism_array[2] = alg2Mech[calg].cmech; - - slot = PK11_GetBestSlotMultiple(mechanism_array, 3, pwArg); - if (slot == NULL) { - /* can't find a slot with all three, find a slot with the minimum */ - slot = PK11_GetBestSlotMultiple(mechanism_array, 2, pwArg); - if (slot == NULL) { - PORT_SetError(SSL_ERROR_TOKEN_SLOT_NOT_FOUND); - return pms; /* which is NULL */ - } - } - } - - /* Generate the pre-master secret ... */ - version.major = MSB(ss->clientHelloVersion); - version.minor = LSB(ss->clientHelloVersion); - - param.data = (unsigned char *)&version; - param.len = sizeof version; - - pms = PK11_KeyGen(slot, CKM_SSL3_PRE_MASTER_KEY_GEN, ¶m, 0, pwArg); - if (!serverKeySlot) - PK11_FreeSlot(slot); - if (pms == NULL) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - } - return pms; -} - -/* Note: The Bleichenbacher attack on PKCS#1 necessitates that we NEVER - * return any indication of failure of the Client Key Exchange message, - * where that failure is caused by the content of the client's message. - * This function must not return SECFailure for any reason that is directly - * or indirectly caused by the content of the client's encrypted PMS. - * We must not send an alert and also not drop the connection. - * Instead, we generate a random PMS. This will cause a failure - * in the processing the finished message, which is exactly where - * the failure must occur. - * - * Called from ssl3_HandleClientKeyExchange - */ -static SECStatus -ssl3_HandleRSAClientKeyExchange(sslSocket *ss, - SSL3Opaque *b, - PRUint32 length, - SECKEYPrivateKey *serverKey) -{ - PK11SymKey * pms; - unsigned char * cr = (unsigned char *)&ss->ssl3.hs.client_random; - unsigned char * sr = (unsigned char *)&ss->ssl3.hs.server_random; - ssl3CipherSpec * pwSpec = ss->ssl3.pwSpec; - unsigned int outLen = 0; - PRBool isTLS = PR_FALSE; - SECStatus rv; - SECItem enc_pms; - unsigned char rsaPmsBuf[SSL3_RSA_PMS_LENGTH]; - SECItem pmsItem = {siBuffer, NULL, 0}; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - enc_pms.data = b; - enc_pms.len = length; - pmsItem.data = rsaPmsBuf; - pmsItem.len = sizeof rsaPmsBuf; - - if (ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */ - PRInt32 kLen; - kLen = ssl3_ConsumeHandshakeNumber(ss, 2, &enc_pms.data, &enc_pms.len); - if (kLen < 0) { - PORT_SetError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - return SECFailure; - } - if ((unsigned)kLen < enc_pms.len) { - enc_pms.len = kLen; - } - isTLS = PR_TRUE; - } else { - isTLS = (PRBool)(ss->ssl3.hs.kea_def->tls_keygen != 0); - } - - if (ss->opt.bypassPKCS11) { - /* TRIPLE BYPASS, get PMS directly from RSA decryption. - * Use PK11_PrivDecryptPKCS1 to decrypt the PMS to a buffer, - * then, check for version rollback attack, then - * do the equivalent of ssl3_DeriveMasterSecret, placing the MS in - * pwSpec->msItem. Finally call ssl3_InitPendingCipherSpec with - * ss and NULL, so that it will use the MS we've already derived here. - */ - - rv = PK11_PrivDecryptPKCS1(serverKey, rsaPmsBuf, &outLen, - sizeof rsaPmsBuf, enc_pms.data, enc_pms.len); - if (rv != SECSuccess) { - /* triple bypass failed. Let's try for a double bypass. */ - goto double_bypass; - } else if (ss->opt.detectRollBack) { - SSL3ProtocolVersion client_version = - (rsaPmsBuf[0] << 8) | rsaPmsBuf[1]; - if (client_version != ss->clientHelloVersion) { - /* Version roll-back detected. ensure failure. */ - rv = PK11_GenerateRandom(rsaPmsBuf, sizeof rsaPmsBuf); - } - } - /* have PMS, build MS without PKCS11 */ - rv = ssl3_MasterKeyDeriveBypass(pwSpec, cr, sr, &pmsItem, isTLS, - PR_TRUE); - if (rv != SECSuccess) { - pwSpec->msItem.data = pwSpec->raw_master_secret; - pwSpec->msItem.len = SSL3_MASTER_SECRET_LENGTH; - PK11_GenerateRandom(pwSpec->msItem.data, pwSpec->msItem.len); - } - rv = ssl3_InitPendingCipherSpec(ss, NULL); - } else { -double_bypass: - /* - * unwrap pms out of the incoming buffer - * Note: CKM_SSL3_MASTER_KEY_DERIVE is NOT the mechanism used to do - * the unwrap. Rather, it is the mechanism with which the - * unwrapped pms will be used. - */ - pms = PK11_PubUnwrapSymKey(serverKey, &enc_pms, - CKM_SSL3_MASTER_KEY_DERIVE, CKA_DERIVE, 0); - if (pms != NULL) { - PRINT_BUF(60, (ss, "decrypted premaster secret:", - PK11_GetKeyData(pms)->data, - PK11_GetKeyData(pms)->len)); - } else { - /* unwrap failed. Generate a bogus PMS and carry on. */ - PK11SlotInfo * slot = PK11_GetSlotFromPrivateKey(serverKey); - - ssl_GetSpecWriteLock(ss); - pms = ssl3_GenerateRSAPMS(ss, ss->ssl3.prSpec, slot); - ssl_ReleaseSpecWriteLock(ss); - PK11_FreeSlot(slot); - } - - if (pms == NULL) { - /* last gasp. */ - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - return SECFailure; - } - - /* This step will derive the MS from the PMS, among other things. */ - rv = ssl3_InitPendingCipherSpec(ss, pms); - PK11_FreeSymKey(pms); - } - - if (rv != SECSuccess) { - SEND_ALERT - return SECFailure; /* error code set by ssl3_InitPendingCipherSpec */ - } - return SECSuccess; -} - - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 ClientKeyExchange message from the remote client - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleClientKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - SECKEYPrivateKey *serverKey = NULL; - SECStatus rv; -const ssl3KEADef * kea_def; - ssl3KeyPair *serverKeyPair = NULL; -#ifdef NSS_ENABLE_ECC - SECKEYPublicKey *serverPubKey = NULL; -#endif /* NSS_ENABLE_ECC */ - - SSL_TRC(3, ("%d: SSL3[%d]: handle client_key_exchange handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->ssl3.hs.ws != wait_client_key) { - SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH); - return SECFailure; - } - - kea_def = ss->ssl3.hs.kea_def; - - if (ss->ssl3.hs.usedStepDownKey) { - PORT_Assert(kea_def->is_limited /* XXX OR cert is signing only */ - && kea_def->exchKeyType == kt_rsa - && ss->stepDownKeyPair != NULL); - if (!kea_def->is_limited || - kea_def->exchKeyType != kt_rsa || - ss->stepDownKeyPair == NULL) { - /* shouldn't happen, don't use step down if it does */ - goto skip; - } - serverKeyPair = ss->stepDownKeyPair; - ss->sec.keaKeyBits = EXPORT_RSA_KEY_LENGTH * BPB; - } else -skip: -#ifdef NSS_ENABLE_ECC - /* XXX Using SSLKEAType to index server certifiates - * does not work for (EC)DHE ciphers. Until we have - * an indexing mechanism general enough for all key - * exchange algorithms, we'll need to deal with each - * one seprately. - */ - if ((kea_def->kea == kea_ecdhe_rsa) || - (kea_def->kea == kea_ecdhe_ecdsa)) { - if (ss->ephemeralECDHKeyPair != NULL) { - serverKeyPair = ss->ephemeralECDHKeyPair; - if (serverKeyPair->pubKey) { - ss->sec.keaKeyBits = - SECKEY_PublicKeyStrengthInBits(serverKeyPair->pubKey); - } - } - } else -#endif - { - sslServerCerts * sc = ss->serverCerts + kea_def->exchKeyType; - serverKeyPair = sc->serverKeyPair; - ss->sec.keaKeyBits = sc->serverKeyBits; - } - - if (serverKeyPair) { - serverKey = serverKeyPair->privKey; - } - - if (serverKey == NULL) { - SEND_ALERT - PORT_SetError(SSL_ERROR_NO_SERVER_KEY_FOR_ALG); - return SECFailure; - } - - ss->sec.keaType = kea_def->exchKeyType; - - switch (kea_def->exchKeyType) { - case kt_rsa: - rv = ssl3_HandleRSAClientKeyExchange(ss, b, length, serverKey); - if (rv != SECSuccess) { - SEND_ALERT - return SECFailure; /* error code set */ - } - break; - - -#ifdef NSS_ENABLE_ECC - case kt_ecdh: - /* XXX We really ought to be able to store multiple - * EC certs (a requirement if we wish to support both - * ECDH-RSA and ECDH-ECDSA key exchanges concurrently). - * When we make that change, we'll need an index other - * than kt_ecdh to pick the right EC certificate. - */ - if (serverKeyPair) { - serverPubKey = serverKeyPair->pubKey; - } - if (serverPubKey == NULL) { - /* XXX Is this the right error code? */ - PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE); - return SECFailure; - } - rv = ssl3_HandleECDHClientKeyExchange(ss, b, length, - serverPubKey, serverKey); - if (rv != SECSuccess) { - return SECFailure; /* error code set */ - } - break; -#endif /* NSS_ENABLE_ECC */ - - default: - (void) ssl3_HandshakeFailure(ss); - PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); - return SECFailure; - } - ss->ssl3.hs.ws = ss->sec.peerCert ? wait_cert_verify : wait_change_cipher; - return SECSuccess; - -} - -/* This is TLS's equivalent of sending a no_certificate alert. */ -static SECStatus -ssl3_SendEmptyCertificate(sslSocket *ss) -{ - SECStatus rv; - - rv = ssl3_AppendHandshakeHeader(ss, certificate, 3); - if (rv == SECSuccess) { - rv = ssl3_AppendHandshakeNumber(ss, 0, 3); - } - return rv; /* error, if any, set by functions called above. */ -} - -SECStatus -ssl3_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - SECStatus rv; - NewSessionTicket session_ticket; - - SSL_TRC(3, ("%d: SSL3[%d]: handle session_ticket handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (ss->ssl3.hs.ws != wait_new_session_ticket) { - SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET); - return SECFailure; - } - - session_ticket.received_timestamp = ssl_Time(); - if (length < 4) { - (void)SSL3_SendAlert(ss, alert_fatal, decode_error); - PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); - return SECFailure; - } - session_ticket.ticket_lifetime_hint = - (PRUint32)ssl3_ConsumeHandshakeNumber(ss, 4, &b, &length); - - rv = ssl3_ConsumeHandshakeVariable(ss, &session_ticket.ticket, 2, - &b, &length); - if (length != 0 || rv != SECSuccess) { - (void)SSL3_SendAlert(ss, alert_fatal, decode_error); - PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); - return SECFailure; /* malformed */ - } - - rv = ssl3_SetSIDSessionTicket(ss->sec.ci.sid, &session_ticket); - if (rv != SECSuccess) { - (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure); - PORT_SetError(SSL_ERROR_INTERNAL_ERROR_ALERT); - return SECFailure; - } - ss->ssl3.hs.ws = wait_change_cipher; - return SECSuccess; -} - -#ifdef NISCC_TEST -static PRInt32 connNum = 0; - -static SECStatus -get_fake_cert(SECItem *pCertItem, int *pIndex) -{ - PRFileDesc *cf; - char * testdir; - char * startat; - char * stopat; - const char *extension; - int fileNum; - PRInt32 numBytes = 0; - PRStatus prStatus; - PRFileInfo info; - char cfn[100]; - - pCertItem->data = 0; - if ((testdir = PR_GetEnv("NISCC_TEST")) == NULL) { - return SECSuccess; - } - *pIndex = (NULL != strstr(testdir, "root")); - extension = (strstr(testdir, "simple") ? "" : ".der"); - fileNum = PR_AtomicIncrement(&connNum) - 1; - if ((startat = PR_GetEnv("START_AT")) != NULL) { - fileNum += atoi(startat); - } - if ((stopat = PR_GetEnv("STOP_AT")) != NULL && - fileNum >= atoi(stopat)) { - *pIndex = -1; - return SECSuccess; - } - sprintf(cfn, "%s/%08d%s", testdir, fileNum, extension); - cf = PR_Open(cfn, PR_RDONLY, 0); - if (!cf) { - goto loser; - } - prStatus = PR_GetOpenFileInfo(cf, &info); - if (prStatus != PR_SUCCESS) { - PR_Close(cf); - goto loser; - } - pCertItem = SECITEM_AllocItem(NULL, pCertItem, info.size); - if (pCertItem) { - numBytes = PR_Read(cf, pCertItem->data, info.size); - } - PR_Close(cf); - if (numBytes != info.size) { - SECITEM_FreeItem(pCertItem, PR_FALSE); - PORT_SetError(SEC_ERROR_IO); - goto loser; - } - fprintf(stderr, "using %s\n", cfn); - return SECSuccess; - -loser: - fprintf(stderr, "failed to use %s\n", cfn); - *pIndex = -1; - return SECFailure; -} -#endif - -/* - * Used by both client and server. - * Called from HandleServerHelloDone and from SendServerHelloSequence. - */ -static SECStatus -ssl3_SendCertificate(sslSocket *ss) -{ - SECStatus rv; - CERTCertificateList *certChain; - int len = 0; - int i; - SSL3KEAType certIndex; -#ifdef NISCC_TEST - SECItem fakeCert; - int ndex = -1; -#endif - - SSL_TRC(3, ("%d: SSL3[%d]: send certificate handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - if (ss->sec.localCert) - CERT_DestroyCertificate(ss->sec.localCert); - if (ss->sec.isServer) { - sslServerCerts * sc = NULL; - - /* XXX SSLKEAType isn't really a good choice for - * indexing certificates (it breaks when we deal - * with (EC)DHE-* cipher suites. This hack ensures - * the RSA cert is picked for (EC)DHE-RSA. - * Revisit this when we add server side support - * for ECDHE-ECDSA or client-side authentication - * using EC certificates. - */ - if ((ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) || - (ss->ssl3.hs.kea_def->kea == kea_dhe_rsa)) { - certIndex = kt_rsa; - } else { - certIndex = ss->ssl3.hs.kea_def->exchKeyType; - } - sc = ss->serverCerts + certIndex; - certChain = sc->serverCertChain; - ss->sec.authKeyBits = sc->serverKeyBits; - ss->sec.authAlgorithm = ss->ssl3.hs.kea_def->signKeyType; - ss->sec.localCert = CERT_DupCertificate(sc->serverCert); - } else { - certChain = ss->ssl3.clientCertChain; - ss->sec.localCert = CERT_DupCertificate(ss->ssl3.clientCertificate); - } - -#ifdef NISCC_TEST - rv = get_fake_cert(&fakeCert, &ndex); -#endif - - if (certChain) { - for (i = 0; i < certChain->len; i++) { -#ifdef NISCC_TEST - if (fakeCert.len > 0 && i == ndex) { - len += fakeCert.len + 3; - } else { - len += certChain->certs[i].len + 3; - } -#else - len += certChain->certs[i].len + 3; -#endif - } - } - - rv = ssl3_AppendHandshakeHeader(ss, certificate, len + 3); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - rv = ssl3_AppendHandshakeNumber(ss, len, 3); - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - if (certChain) { - for (i = 0; i < certChain->len; i++) { -#ifdef NISCC_TEST - if (fakeCert.len > 0 && i == ndex) { - rv = ssl3_AppendHandshakeVariable(ss, fakeCert.data, - fakeCert.len, 3); - SECITEM_FreeItem(&fakeCert, PR_FALSE); - } else { - rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data, - certChain->certs[i].len, 3); - } -#else - rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data, - certChain->certs[i].len, 3); -#endif - if (rv != SECSuccess) { - return rv; /* err set by AppendHandshake. */ - } - } - } - - return SECSuccess; -} - -/* This is used to delete the CA certificates in the peer certificate chain - * from the cert database after they've been validated. - */ -static void -ssl3_CleanupPeerCerts(sslSocket *ss) -{ - PRArenaPool * arena = ss->ssl3.peerCertArena; - ssl3CertNode *certs = (ssl3CertNode *)ss->ssl3.peerCertChain; - - for (; certs; certs = certs->next) { - CERT_DestroyCertificate(certs->cert); - } - if (arena) PORT_FreeArena(arena, PR_FALSE); - ss->ssl3.peerCertArena = NULL; - ss->ssl3.peerCertChain = NULL; -} - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Certificate message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - ssl3CertNode * c; - ssl3CertNode * certs = NULL; - PRArenaPool * arena = NULL; - CERTCertificate *cert; - PRInt32 remaining = 0; - PRInt32 size; - SECStatus rv; - PRBool isServer = (PRBool)(!!ss->sec.isServer); - PRBool trusted = PR_FALSE; - PRBool isTLS; - SSL3AlertDescription desc = bad_certificate; - int errCode = SSL_ERROR_RX_MALFORMED_CERTIFICATE; - SECItem certItem; - - SSL_TRC(3, ("%d: SSL3[%d]: handle certificate handshake", - SSL_GETPID(), ss->fd)); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if ((ss->ssl3.hs.ws != wait_server_cert) && - (ss->ssl3.hs.ws != wait_client_cert)) { - desc = unexpected_message; - errCode = SSL_ERROR_RX_UNEXPECTED_CERTIFICATE; - goto alert_loser; - } - - if (ss->sec.peerCert != NULL) { - if (ss->sec.peerKey) { - SECKEY_DestroyPublicKey(ss->sec.peerKey); - ss->sec.peerKey = NULL; - } - CERT_DestroyCertificate(ss->sec.peerCert); - ss->sec.peerCert = NULL; - } - - ssl3_CleanupPeerCerts(ss); - isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); - - /* It is reported that some TLS client sends a Certificate message - ** with a zero-length message body. We'll treat that case like a - ** normal no_certificates message to maximize interoperability. - */ - if (length) { - remaining = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); - if (remaining < 0) - goto loser; /* fatal alert already sent by ConsumeHandshake. */ - if ((PRUint32)remaining > length) - goto decode_loser; - } - - if (!remaining) { - if (!(isTLS && isServer)) - goto alert_loser; - /* This is TLS's version of a no_certificate alert. */ - /* I'm a server. I've requested a client cert. He hasn't got one. */ - rv = ssl3_HandleNoCertificate(ss); - if (rv != SECSuccess) { - errCode = PORT_GetError(); - goto loser; - } - goto cert_block; - } - - ss->ssl3.peerCertArena = arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); - if ( arena == NULL ) { - goto loser; /* don't send alerts on memory errors */ - } - - /* First get the peer cert. */ - remaining -= 3; - if (remaining < 0) - goto decode_loser; - - size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); - if (size <= 0) - goto loser; /* fatal alert already sent by ConsumeHandshake. */ - - if (remaining < size) - goto decode_loser; - - certItem.data = b; - certItem.len = size; - b += size; - length -= size; - remaining -= size; - - ss->sec.peerCert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL, - PR_FALSE, PR_TRUE); - if (ss->sec.peerCert == NULL) { - /* We should report an alert if the cert was bad, but not if the - * problem was just some local problem, like memory error. - */ - goto ambiguous_err; - } - - /* Now get all of the CA certs. */ - while (remaining > 0) { - remaining -= 3; - if (remaining < 0) - goto decode_loser; - - size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); - if (size <= 0) - goto loser; /* fatal alert already sent by ConsumeHandshake. */ - - if (remaining < size) - goto decode_loser; - - certItem.data = b; - certItem.len = size; - b += size; - length -= size; - remaining -= size; - - c = PORT_ArenaNew(arena, ssl3CertNode); - if (c == NULL) { - goto loser; /* don't send alerts on memory errors */ - } - - c->cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL, - PR_FALSE, PR_TRUE); - if (c->cert == NULL) { - goto ambiguous_err; - } - - if (c->cert->trust) - trusted = PR_TRUE; - - c->next = certs; - certs = c; - } - - if (remaining != 0) - goto decode_loser; - - SECKEY_UpdateCertPQG(ss->sec.peerCert); - - /* - * Ask caller-supplied callback function to validate cert chain. - */ - rv = (SECStatus)(*ss->authCertificate)(ss->authCertificateArg, ss->fd, - PR_TRUE, isServer); - if (rv) { - errCode = PORT_GetError(); - if (!ss->handleBadCert) { - goto bad_cert; - } - rv = (SECStatus)(*ss->handleBadCert)(ss->badCertArg, ss->fd); - if ( rv ) { - if ( rv == SECWouldBlock ) { - /* someone will handle this connection asynchronously*/ - SSL_DBG(("%d: SSL3[%d]: go to async cert handler", - SSL_GETPID(), ss->fd)); - ss->ssl3.peerCertChain = certs; - certs = NULL; - ssl_SetAlwaysBlock(ss); - goto cert_block; - } - /* cert is bad */ - goto bad_cert; - } - /* cert is good */ - } - - /* start SSL Step Up, if appropriate */ - cert = ss->sec.peerCert; - if (!isServer && - ssl3_global_policy_some_restricted && - ss->ssl3.policy == SSL_ALLOWED && - anyRestrictedEnabled(ss) && - SECSuccess == CERT_VerifyCertNow(cert->dbhandle, cert, - PR_FALSE, /* checkSig */ - certUsageSSLServerWithStepUp, -/*XXX*/ ss->authCertificateArg) ) { - ss->ssl3.policy = SSL_RESTRICTED; - ss->ssl3.hs.rehandshake = PR_TRUE; - } - - ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert); - - if (!ss->sec.isServer) { - /* set the server authentication and key exchange types and sizes - ** from the value in the cert. If the key exchange key is different, - ** it will get fixed when we handle the server key exchange message. - */ - SECKEYPublicKey * pubKey = CERT_ExtractPublicKey(cert); - ss->sec.authAlgorithm = ss->ssl3.hs.kea_def->signKeyType; - ss->sec.keaType = ss->ssl3.hs.kea_def->exchKeyType; - if (pubKey) { - ss->sec.keaKeyBits = ss->sec.authKeyBits = - SECKEY_PublicKeyStrengthInBits(pubKey); -#ifdef NSS_ENABLE_ECC - if (ss->sec.keaType == kt_ecdh) { - /* Get authKeyBits from signing key. - * XXX The code below uses a quick approximation of - * key size based on cert->signatureWrap.signature.data - * (which contains the DER encoded signature). The field - * cert->signatureWrap.signature.len contains the - * length of the encoded signature in bits. - */ - if (ss->ssl3.hs.kea_def->kea == kea_ecdh_ecdsa) { - ss->sec.authKeyBits = - cert->signatureWrap.signature.data[3]*8; - if (cert->signatureWrap.signature.data[4] == 0x00) - ss->sec.authKeyBits -= 8; - /* - * XXX: if cert is not signed by ecdsa we should - * destroy pubKey and goto bad_cert - */ - } else if (ss->ssl3.hs.kea_def->kea == kea_ecdh_rsa) { - ss->sec.authKeyBits = cert->signatureWrap.signature.len; - /* - * XXX: if cert is not signed by rsa we should - * destroy pubKey and goto bad_cert - */ - } - } -#endif /* NSS_ENABLE_ECC */ - SECKEY_DestroyPublicKey(pubKey); - pubKey = NULL; - } - } - - ss->ssl3.peerCertChain = certs; certs = NULL; arena = NULL; - -cert_block: - if (ss->sec.isServer) { - ss->ssl3.hs.ws = wait_client_key; - } else { - ss->ssl3.hs.ws = wait_cert_request; /* disallow server_key_exchange */ - if (ss->ssl3.hs.kea_def->is_limited || - /* XXX OR server cert is signing only. */ -#ifdef NSS_ENABLE_ECC - ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa || - ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa || -#endif /* NSS_ENABLE_ECC */ - ss->ssl3.hs.kea_def->exchKeyType == kt_dh) { - ss->ssl3.hs.ws = wait_server_key; /* allow server_key_exchange */ - } - } - - /* rv must normally be equal to SECSuccess here. If we called - * handleBadCert, it can also be SECWouldBlock. - */ - return rv; - -ambiguous_err: - errCode = PORT_GetError(); - switch (errCode) { - case PR_OUT_OF_MEMORY_ERROR: - case SEC_ERROR_BAD_DATABASE: - case SEC_ERROR_NO_MEMORY: - if (isTLS) { - desc = internal_error; - goto alert_loser; - } - goto loser; - } - /* fall through to bad_cert. */ - -bad_cert: /* caller has set errCode. */ - switch (errCode) { - case SEC_ERROR_LIBRARY_FAILURE: desc = unsupported_certificate; break; - case SEC_ERROR_EXPIRED_CERTIFICATE: desc = certificate_expired; break; - case SEC_ERROR_REVOKED_CERTIFICATE: desc = certificate_revoked; break; - case SEC_ERROR_INADEQUATE_KEY_USAGE: - case SEC_ERROR_INADEQUATE_CERT_TYPE: - desc = certificate_unknown; break; - case SEC_ERROR_UNTRUSTED_CERT: - desc = isTLS ? access_denied : certificate_unknown; break; - case SEC_ERROR_UNKNOWN_ISSUER: - case SEC_ERROR_UNTRUSTED_ISSUER: - desc = isTLS ? unknown_ca : certificate_unknown; break; - case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: - desc = isTLS ? unknown_ca : certificate_expired; break; - - case SEC_ERROR_CERT_NOT_IN_NAME_SPACE: - case SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID: - case SEC_ERROR_CA_CERT_INVALID: - case SEC_ERROR_BAD_SIGNATURE: - default: desc = bad_certificate; break; - } - SSL_DBG(("%d: SSL3[%d]: peer certificate is no good: error=%d", - SSL_GETPID(), ss->fd, errCode)); - - goto alert_loser; - -decode_loser: - desc = isTLS ? decode_error : bad_certificate; - -alert_loser: - (void)SSL3_SendAlert(ss, alert_fatal, desc); - -loser: - ss->ssl3.peerCertChain = certs; certs = NULL; arena = NULL; - ssl3_CleanupPeerCerts(ss); - - if (ss->sec.peerCert != NULL) { - CERT_DestroyCertificate(ss->sec.peerCert); - ss->sec.peerCert = NULL; - } - (void)ssl_MapLowLevelError(errCode); - return SECFailure; -} - - -/* restart an SSL connection that we stopped to run certificate dialogs -** XXX Need to document here how an application marks a cert to show that -** the application has accepted it (overridden CERT_VerifyCert). - * - * XXX This code only works on the initial handshake on a connection, XXX - * It does not work on a subsequent handshake (redo). - * - * Return value: XXX - * - * Caller holds 1stHandshakeLock. -*/ -int -ssl3_RestartHandshakeAfterServerCert(sslSocket *ss) -{ - CERTCertificate * cert; - int rv = SECSuccess; - - if (MSB(ss->version) != MSB(SSL_LIBRARY_VERSION_3_0)) { - SET_ERROR_CODE - return SECFailure; - } - if (!ss->ssl3.initialized) { - SET_ERROR_CODE - return SECFailure; - } - - cert = ss->sec.peerCert; - - /* Permit step up if user decided to accept the cert */ - if (!ss->sec.isServer && - ssl3_global_policy_some_restricted && - ss->ssl3.policy == SSL_ALLOWED && - anyRestrictedEnabled(ss) && - (SECSuccess == CERT_VerifyCertNow(cert->dbhandle, cert, - PR_FALSE, /* checksig */ - certUsageSSLServerWithStepUp, -/*XXX*/ ss->authCertificateArg) )) { - ss->ssl3.policy = SSL_RESTRICTED; - ss->ssl3.hs.rehandshake = PR_TRUE; - } - - if (ss->handshake != NULL) { - ss->handshake = ssl_GatherRecord1stHandshake; - ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert); - - ssl_GetRecvBufLock(ss); - if (ss->ssl3.hs.msgState.buf != NULL) { - rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf); - } - ssl_ReleaseRecvBufLock(ss); - } - - return rv; -} - -static SECStatus -ssl3_ComputeTLSFinished(ssl3CipherSpec *spec, - PRBool isServer, - const SSL3Finished * hashes, - TLSFinished * tlsFinished) -{ - const char * label; - unsigned int len; - SECStatus rv; - - label = isServer ? "server finished" : "client finished"; - len = 15; - - if (spec->master_secret && !spec->bypassCiphers) { - SECItem param = {siBuffer, NULL, 0}; - PK11Context *prf_context = - PK11_CreateContextBySymKey(CKM_TLS_PRF_GENERAL, CKA_SIGN, - spec->master_secret, ¶m); - if (!prf_context) - return SECFailure; - - rv = PK11_DigestBegin(prf_context); - rv |= PK11_DigestOp(prf_context, (const unsigned char *) label, len); - rv |= PK11_DigestOp(prf_context, hashes->md5, sizeof *hashes); - rv |= PK11_DigestFinal(prf_context, tlsFinished->verify_data, - &len, sizeof tlsFinished->verify_data); - PORT_Assert(rv != SECSuccess || len == sizeof *tlsFinished); - - PK11_DestroyContext(prf_context, PR_TRUE); - } else { - /* bypass PKCS11 */ - SECItem inData = { siBuffer, }; - SECItem outData = { siBuffer, }; - PRBool isFIPS = PR_FALSE; - - inData.data = (unsigned char *)hashes->md5; - inData.len = sizeof hashes[0]; - outData.data = tlsFinished->verify_data; - outData.len = sizeof tlsFinished->verify_data; - rv = TLS_PRF(&spec->msItem, label, &inData, &outData, isFIPS); - PORT_Assert(rv != SECSuccess || \ - outData.len == sizeof tlsFinished->verify_data); - } - return rv; -} - -/* called from ssl3_HandleServerHelloDone - * ssl3_HandleClientHello - * ssl3_HandleFinished - */ -static SECStatus -ssl3_SendFinished(sslSocket *ss, PRInt32 flags) -{ - ssl3CipherSpec *cwSpec; - PRBool isTLS; - PRBool isServer = ss->sec.isServer; - SECStatus rv; - SSL3Sender sender = isServer ? sender_server : sender_client; - SSL3Finished hashes; - TLSFinished tlsFinished; - - SSL_TRC(3, ("%d: SSL3[%d]: send finished handshake", SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - ssl_GetSpecReadLock(ss); - cwSpec = ss->ssl3.cwSpec; - isTLS = (PRBool)(cwSpec->version > SSL_LIBRARY_VERSION_3_0); - rv = ssl3_ComputeHandshakeHashes(ss, cwSpec, &hashes, sender); - if (isTLS && rv == SECSuccess) { - rv = ssl3_ComputeTLSFinished(cwSpec, isServer, &hashes, &tlsFinished); - } - ssl_ReleaseSpecReadLock(ss); - if (rv != SECSuccess) { - goto fail; /* err code was set by ssl3_ComputeHandshakeHashes */ - } - - if (isTLS) { - rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof tlsFinished); - if (rv != SECSuccess) - goto fail; /* err set by AppendHandshake. */ - rv = ssl3_AppendHandshake(ss, &tlsFinished, sizeof tlsFinished); - if (rv != SECSuccess) - goto fail; /* err set by AppendHandshake. */ - } else { - rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof hashes); - if (rv != SECSuccess) - goto fail; /* err set by AppendHandshake. */ - rv = ssl3_AppendHandshake(ss, &hashes, sizeof hashes); - if (rv != SECSuccess) - goto fail; /* err set by AppendHandshake. */ - } - rv = ssl3_FlushHandshake(ss, flags); - if (rv != SECSuccess) { - goto fail; /* error code set by ssl3_FlushHandshake */ - } - return SECSuccess; - -fail: - return rv; -} - -/* wrap the master secret, and put it into the SID. - * Caller holds the Spec read lock. - */ -SECStatus -ssl3_CacheWrappedMasterSecret(sslSocket *ss, sslSessionID *sid, - ssl3CipherSpec *spec, SSL3KEAType effectiveExchKeyType) -{ - PK11SymKey * wrappingKey = NULL; - PK11SlotInfo * symKeySlot; - void * pwArg = ss->pkcs11PinArg; - SECStatus rv = SECFailure; - PRBool isServer = ss->sec.isServer; - CK_MECHANISM_TYPE mechanism = CKM_INVALID_MECHANISM; - symKeySlot = PK11_GetSlotFromKey(spec->master_secret); - if (!isServer) { - int wrapKeyIndex; - int incarnation; - - /* these next few functions are mere accessors and don't fail. */ - sid->u.ssl3.masterWrapIndex = wrapKeyIndex = - PK11_GetCurrentWrapIndex(symKeySlot); - PORT_Assert(wrapKeyIndex == 0); /* array has only one entry! */ - - sid->u.ssl3.masterWrapSeries = incarnation = - PK11_GetSlotSeries(symKeySlot); - sid->u.ssl3.masterSlotID = PK11_GetSlotID(symKeySlot); - sid->u.ssl3.masterModuleID = PK11_GetModuleID(symKeySlot); - sid->u.ssl3.masterValid = PR_TRUE; - /* Get the default wrapping key, for wrapping the master secret before - * placing it in the SID cache entry. */ - wrappingKey = PK11_GetWrapKey(symKeySlot, wrapKeyIndex, - CKM_INVALID_MECHANISM, incarnation, - pwArg); - if (wrappingKey) { - mechanism = PK11_GetMechanism(wrappingKey); /* can't fail. */ - } else { - int keyLength; - /* if the wrappingKey doesn't exist, attempt to create it. - * Note: we intentionally ignore errors here. If we cannot - * generate a wrapping key, it is not fatal to this SSL connection, - * but we will not be able to restart this session. - */ - mechanism = PK11_GetBestWrapMechanism(symKeySlot); - keyLength = PK11_GetBestKeyLength(symKeySlot, mechanism); - /* Zero length means fixed key length algorithm, or error. - * It's ambiguous. - */ - wrappingKey = PK11_KeyGen(symKeySlot, mechanism, NULL, - keyLength, pwArg); - if (wrappingKey) { - PK11_SetWrapKey(symKeySlot, wrapKeyIndex, wrappingKey); - } - } - } else { - /* server socket using session cache. */ - mechanism = PK11_GetBestWrapMechanism(symKeySlot); - if (mechanism != CKM_INVALID_MECHANISM) { - wrappingKey = - getWrappingKey(ss, symKeySlot, effectiveExchKeyType, - mechanism, pwArg); - if (wrappingKey) { - mechanism = PK11_GetMechanism(wrappingKey); /* can't fail. */ - } - } - } - - sid->u.ssl3.masterWrapMech = mechanism; - PK11_FreeSlot(symKeySlot); - - if (wrappingKey) { - SECItem wmsItem; - - wmsItem.data = sid->u.ssl3.keys.wrapped_master_secret; - wmsItem.len = sizeof sid->u.ssl3.keys.wrapped_master_secret; - rv = PK11_WrapSymKey(mechanism, NULL, wrappingKey, - spec->master_secret, &wmsItem); - /* rv is examined below. */ - sid->u.ssl3.keys.wrapped_master_secret_len = wmsItem.len; - PK11_FreeSymKey(wrappingKey); - } - return rv; -} - -/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete - * ssl3 Finished message from the peer. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length, - const SSL3Hashes *hashes) -{ - sslSessionID * sid = ss->sec.ci.sid; - SECStatus rv = SECSuccess; - PRBool isServer = ss->sec.isServer; - PRBool isTLS; - PRBool doStepUp; - SSL3KEAType effectiveExchKeyType; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - SSL_TRC(3, ("%d: SSL3[%d]: handle finished handshake", - SSL_GETPID(), ss->fd)); - - if (ss->ssl3.hs.ws != wait_finished) { - SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_FINISHED); - return SECFailure; - } - - isTLS = (PRBool)(ss->ssl3.crSpec->version > SSL_LIBRARY_VERSION_3_0); - if (isTLS) { - TLSFinished tlsFinished; - - if (length != sizeof tlsFinished) { - (void)SSL3_SendAlert(ss, alert_fatal, decode_error); - PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED); - return SECFailure; - } - rv = ssl3_ComputeTLSFinished(ss->ssl3.crSpec, !isServer, - hashes, &tlsFinished); - if (rv != SECSuccess || - 0 != PORT_Memcmp(&tlsFinished, b, length)) { - (void)SSL3_SendAlert(ss, alert_fatal, decrypt_error); - PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); - return SECFailure; - } - } else { - if (length != sizeof(SSL3Hashes)) { - (void)ssl3_IllegalParameter(ss); - PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED); - return SECFailure; - } - - if (0 != PORT_Memcmp(hashes, b, length)) { - (void)ssl3_HandshakeFailure(ss); - PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); - return SECFailure; - } - } - - doStepUp = (PRBool)(!isServer && ss->ssl3.hs.rehandshake); - - ssl_GetXmitBufLock(ss); /*************************************/ - - if ((isServer && !ss->ssl3.hs.isResuming) || - (!isServer && ss->ssl3.hs.isResuming)) { - PRInt32 flags = 0; - - /* Send a NewSessionTicket message if the client sent us - * either an empty session ticket, or one that did not verify. - * (Note that if either of these conditions was met, then the - * server has sent a SessionTicket extension in the - * ServerHello message.) - */ - if (isServer && !ss->ssl3.hs.isResuming && - ssl3_ExtensionNegotiated(ss, session_ticket_xtn)) { - rv = ssl3_SendNewSessionTicket(ss); - if (rv != SECSuccess) { - goto xmit_loser; - } - } - - rv = ssl3_SendChangeCipherSpecs(ss); - if (rv != SECSuccess) { - goto xmit_loser; /* err is set. */ - } - /* If this thread is in SSL_SecureSend (trying to write some data) - ** or if it is going to step up, - ** then set the ssl_SEND_FLAG_FORCE_INTO_BUFFER flag, so that the - ** last two handshake messages (change cipher spec and finished) - ** will be sent in the same send/write call as the application data. - */ - if (doStepUp || ss->writerThread == PR_GetCurrentThread()) { - flags = ssl_SEND_FLAG_FORCE_INTO_BUFFER; - } - rv = ssl3_SendFinished(ss, flags); - if (rv != SECSuccess) { - goto xmit_loser; /* err is set. */ - } - } - - /* Optimization: don't cache this connection if we're going to step up. */ - if (doStepUp) { - ssl_FreeSID(sid); - ss->sec.ci.sid = sid = NULL; - ss->ssl3.hs.rehandshake = PR_FALSE; - rv = ssl3_SendClientHello(ss); -xmit_loser: - ssl_ReleaseXmitBufLock(ss); - return rv; /* err code is set if appropriate. */ - } - - ssl_ReleaseXmitBufLock(ss); /*************************************/ - - /* The first handshake is now completed. */ - ss->handshake = NULL; - ss->firstHsDone = PR_TRUE; - ss->gs.writeOffset = 0; - ss->gs.readOffset = 0; - - if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) { - effectiveExchKeyType = kt_rsa; - } else { - effectiveExchKeyType = ss->ssl3.hs.kea_def->exchKeyType; - } - - if (sid->cached == never_cached && !ss->opt.noCache && ss->sec.cache) { - /* fill in the sid */ - sid->u.ssl3.cipherSuite = ss->ssl3.hs.cipher_suite; - sid->u.ssl3.compression = ss->ssl3.hs.compression; - sid->u.ssl3.policy = ss->ssl3.policy; -#ifdef NSS_ENABLE_ECC - sid->u.ssl3.negotiatedECCurves = ss->ssl3.hs.negotiatedECCurves; -#endif - sid->u.ssl3.exchKeyType = effectiveExchKeyType; - sid->version = ss->version; - sid->authAlgorithm = ss->sec.authAlgorithm; - sid->authKeyBits = ss->sec.authKeyBits; - sid->keaType = ss->sec.keaType; - sid->keaKeyBits = ss->sec.keaKeyBits; - sid->lastAccessTime = sid->creationTime = ssl_Time(); - sid->expirationTime = sid->creationTime + ssl3_sid_timeout; - sid->localCert = CERT_DupCertificate(ss->sec.localCert); - - ssl_GetSpecReadLock(ss); /*************************************/ - - /* Copy the master secret (wrapped or unwrapped) into the sid */ - if (ss->ssl3.crSpec->msItem.len && ss->ssl3.crSpec->msItem.data) { - sid->u.ssl3.keys.wrapped_master_secret_len = - ss->ssl3.crSpec->msItem.len; - memcpy(sid->u.ssl3.keys.wrapped_master_secret, - ss->ssl3.crSpec->msItem.data, ss->ssl3.crSpec->msItem.len); - sid->u.ssl3.masterValid = PR_TRUE; - sid->u.ssl3.keys.msIsWrapped = PR_FALSE; - rv = SECSuccess; - } else { - rv = ssl3_CacheWrappedMasterSecret(ss, ss->sec.ci.sid, - ss->ssl3.crSpec, - effectiveExchKeyType); - sid->u.ssl3.keys.msIsWrapped = PR_TRUE; - } - ssl_ReleaseSpecReadLock(ss); /*************************************/ - - /* If the wrap failed, we don't cache the sid. - * The connection continues normally however. - */ - if (rv == SECSuccess) { - (*ss->sec.cache)(sid); - } - } - ss->ssl3.hs.ws = idle_handshake; - - /* Do the handshake callback for sslv3 here. */ - if (ss->handshakeCallback != NULL) { - (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData); - } - - return SECSuccess; -} - -/* Called from ssl3_HandleHandshake() when it has gathered a complete ssl3 - * hanshake message. - * Caller must hold Handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - SECStatus rv = SECSuccess; - SSL3HandshakeType type = ss->ssl3.hs.msg_type; - SSL3Hashes hashes; /* computed hashes are put here. */ - PRUint8 hdr[4]; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - /* - * We have to compute the hashes before we update them with the - * current message. - */ - ssl_GetSpecReadLock(ss); /************************************/ - if((type == finished) || (type == certificate_verify)) { - SSL3Sender sender = (SSL3Sender)0; - ssl3CipherSpec *rSpec = ss->ssl3.prSpec; - - if (type == finished) { - sender = ss->sec.isServer ? sender_client : sender_server; - rSpec = ss->ssl3.crSpec; - } - rv = ssl3_ComputeHandshakeHashes(ss, rSpec, &hashes, sender); - } - ssl_ReleaseSpecReadLock(ss); /************************************/ - if (rv != SECSuccess) { - return rv; /* error code was set by ssl3_ComputeHandshakeHashes*/ - } - SSL_TRC(30,("%d: SSL3[%d]: handle handshake message: %s", SSL_GETPID(), - ss->fd, ssl3_DecodeHandshakeType(ss->ssl3.hs.msg_type))); - PRINT_BUF(60, (ss, "MD5 handshake hash:", - (unsigned char*)ss->ssl3.hs.md5_cx, MD5_LENGTH)); - PRINT_BUF(95, (ss, "SHA handshake hash:", - (unsigned char*)ss->ssl3.hs.sha_cx, SHA1_LENGTH)); - - hdr[0] = (PRUint8)ss->ssl3.hs.msg_type; - hdr[1] = (PRUint8)(length >> 16); - hdr[2] = (PRUint8)(length >> 8); - hdr[3] = (PRUint8)(length ); - - /* Start new handshake hashes when we start a new handshake */ - if (ss->ssl3.hs.msg_type == client_hello) { - SSL_TRC(30,("%d: SSL3[%d]: reset handshake hashes", - SSL_GETPID(), ss->fd )); - rv = ssl3_RestartHandshakeHashes(ss); - if (rv != SECSuccess) { - return rv; - } - } - /* We should not include hello_request messages in the handshake hashes */ - if (ss->ssl3.hs.msg_type != hello_request) { - rv = ssl3_UpdateHandshakeHashes(ss, (unsigned char*) hdr, 4); - if (rv != SECSuccess) return rv; /* err code already set. */ - rv = ssl3_UpdateHandshakeHashes(ss, b, length); - if (rv != SECSuccess) return rv; /* err code already set. */ - } - - PORT_SetError(0); /* each message starts with no error. */ - switch (ss->ssl3.hs.msg_type) { - case hello_request: - if (length != 0) { - (void)ssl3_DecodeError(ss); - PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_REQUEST); - return SECFailure; - } - if (ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST); - return SECFailure; - } - rv = ssl3_HandleHelloRequest(ss); - break; - case client_hello: - if (!ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO); - return SECFailure; - } - rv = ssl3_HandleClientHello(ss, b, length); - break; - case server_hello: - if (ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO); - return SECFailure; - } - rv = ssl3_HandleServerHello(ss, b, length); - break; - case certificate: - rv = ssl3_HandleCertificate(ss, b, length); - break; - case server_key_exchange: - if (ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH); - return SECFailure; - } - rv = ssl3_HandleServerKeyExchange(ss, b, length); - break; - case certificate_request: - if (ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST); - return SECFailure; - } - rv = ssl3_HandleCertificateRequest(ss, b, length); - break; - case server_hello_done: - if (length != 0) { - (void)ssl3_DecodeError(ss); - PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_DONE); - return SECFailure; - } - if (ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE); - return SECFailure; - } - rv = ssl3_HandleServerHelloDone(ss); - break; - case certificate_verify: - if (!ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY); - return SECFailure; - } - rv = ssl3_HandleCertificateVerify(ss, b, length, &hashes); - break; - case client_key_exchange: - if (!ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH); - return SECFailure; - } - rv = ssl3_HandleClientKeyExchange(ss, b, length); - break; - case new_session_ticket: - if (ss->sec.isServer) { - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET); - return SECFailure; - } - rv = ssl3_HandleNewSessionTicket(ss, b, length); - break; - case finished: - rv = ssl3_HandleFinished(ss, b, length, &hashes); - break; - default: - (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); - PORT_SetError(SSL_ERROR_RX_UNKNOWN_HANDSHAKE); - rv = SECFailure; - } - return rv; -} - -/* Called only from ssl3_HandleRecord, for each (deciphered) ssl3 record. - * origBuf is the decrypted ssl record content. - * Caller must hold the handshake and RecvBuf locks. - */ -static SECStatus -ssl3_HandleHandshake(sslSocket *ss, sslBuffer *origBuf) -{ - /* - * There may be a partial handshake message already in the handshake - * state. The incoming buffer may contain another portion, or a - * complete message or several messages followed by another portion. - * - * Each message is made contiguous before being passed to the actual - * message parser. - */ - sslBuffer *buf = &ss->ssl3.hs.msgState; /* do not lose the original buffer pointer */ - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (buf->buf == NULL) { - *buf = *origBuf; - } - while (buf->len > 0) { - if (ss->ssl3.hs.header_bytes < 4) { - uint8 t; - t = *(buf->buf++); - buf->len--; - if (ss->ssl3.hs.header_bytes++ == 0) - ss->ssl3.hs.msg_type = (SSL3HandshakeType)t; - else - ss->ssl3.hs.msg_len = (ss->ssl3.hs.msg_len << 8) + t; - if (ss->ssl3.hs.header_bytes < 4) - continue; - -#define MAX_HANDSHAKE_MSG_LEN 0x1ffff /* 128k - 1 */ - if (ss->ssl3.hs.msg_len > MAX_HANDSHAKE_MSG_LEN) { - (void)ssl3_DecodeError(ss); - PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); - return SECFailure; - } -#undef MAX_HANDSHAKE_MSG_LEN - - /* If msg_len is zero, be sure we fall through, - ** even if buf->len is zero. - */ - if (ss->ssl3.hs.msg_len > 0) - continue; - } - - /* - * Header has been gathered and there is at least one byte of new - * data available for this message. If it can be done right out - * of the original buffer, then use it from there. - */ - if (ss->ssl3.hs.msg_body.len == 0 && buf->len >= ss->ssl3.hs.msg_len) { - /* handle it from input buffer */ - rv = ssl3_HandleHandshakeMessage(ss, buf->buf, ss->ssl3.hs.msg_len); - if (rv == SECFailure) { - /* This test wants to fall through on either - * SECSuccess or SECWouldBlock. - * ssl3_HandleHandshakeMessage MUST set the error code. - */ - return rv; - } - buf->buf += ss->ssl3.hs.msg_len; - buf->len -= ss->ssl3.hs.msg_len; - ss->ssl3.hs.msg_len = 0; - ss->ssl3.hs.header_bytes = 0; - if (rv != SECSuccess) { /* return if SECWouldBlock. */ - return rv; - } - } else { - /* must be copied to msg_body and dealt with from there */ - unsigned int bytes; - - PORT_Assert(ss->ssl3.hs.msg_body.len <= ss->ssl3.hs.msg_len); - bytes = PR_MIN(buf->len, ss->ssl3.hs.msg_len - ss->ssl3.hs.msg_body.len); - - /* Grow the buffer if needed */ - rv = sslBuffer_Grow(&ss->ssl3.hs.msg_body, ss->ssl3.hs.msg_len); - if (rv != SECSuccess) { - /* sslBuffer_Grow has set a memory error code. */ - return SECFailure; - } - - PORT_Memcpy(ss->ssl3.hs.msg_body.buf + ss->ssl3.hs.msg_body.len, - buf->buf, bytes); - ss->ssl3.hs.msg_body.len += bytes; - buf->buf += bytes; - buf->len -= bytes; - - PORT_Assert(ss->ssl3.hs.msg_body.len <= ss->ssl3.hs.msg_len); - - /* if we have a whole message, do it */ - if (ss->ssl3.hs.msg_body.len == ss->ssl3.hs.msg_len) { - rv = ssl3_HandleHandshakeMessage( - ss, ss->ssl3.hs.msg_body.buf, ss->ssl3.hs.msg_len); - /* - * XXX This appears to be wrong. This error handling - * should clean up after a SECWouldBlock return, like the - * error handling used 40 lines before/above this one, - */ - if (rv != SECSuccess) { - /* ssl3_HandleHandshakeMessage MUST set error code. */ - return rv; - } - ss->ssl3.hs.msg_body.len = 0; - ss->ssl3.hs.msg_len = 0; - ss->ssl3.hs.header_bytes = 0; - } else { - PORT_Assert(buf->len == 0); - break; - } - } - } /* end loop */ - - origBuf->len = 0; /* So ssl3_GatherAppDataRecord will keep looping. */ - buf->buf = NULL; /* not a leak. */ - return SECSuccess; -} - -/* if cText is non-null, then decipher, check MAC, and decompress the - * SSL record from cText->buf (typically gs->inbuf) - * into databuf (typically gs->buf), and any previous contents of databuf - * is lost. Then handle databuf according to its SSL record type, - * unless it's an application record. - * - * If cText is NULL, then the ciphertext has previously been deciphered and - * checked, and is already sitting in databuf. It is processed as an SSL - * Handshake message. - * - * DOES NOT process the decrypted/decompressed application data. - * On return, databuf contains the decrypted/decompressed record. - * - * Called from ssl3_GatherCompleteHandshake - * ssl3_RestartHandshakeAfterCertReq - * ssl3_RestartHandshakeAfterServerCert - * - * Caller must hold the RecvBufLock. - * - * This function aquires and releases the SSL3Handshake Lock, holding the - * lock around any calls to functions that handle records other than - * Application Data records. - */ -SECStatus -ssl3_HandleRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *databuf) -{ -const ssl3BulkCipherDef *cipher_def; - ssl3CipherSpec * crSpec; - SECStatus rv; - unsigned int hashBytes = MAX_MAC_LENGTH + 1; - unsigned int padding_length; - PRBool isTLS; - PRBool padIsBad = PR_FALSE; - SSL3ContentType rType; - SSL3Opaque hash[MAX_MAC_LENGTH]; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - - if (!ss->ssl3.initialized) { - ssl_GetSSL3HandshakeLock(ss); - rv = ssl3_InitState(ss); - ssl_ReleaseSSL3HandshakeLock(ss); - if (rv != SECSuccess) { - return rv; /* ssl3_InitState has set the error code. */ - } - } - - /* check for Token Presence */ - if (!ssl3_ClientAuthTokenPresent(ss->sec.ci.sid)) { - PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); - return SECFailure; - } - - /* cText is NULL when we're called from ssl3_RestartHandshakeAfterXXX(). - * This implies that databuf holds a previously deciphered SSL Handshake - * message. - */ - if (cText == NULL) { - SSL_DBG(("%d: SSL3[%d]: HandleRecord, resuming handshake", - SSL_GETPID(), ss->fd)); - rType = content_handshake; - goto process_it; - } - - databuf->len = 0; /* filled in by decode call below. */ - if (databuf->space < MAX_FRAGMENT_LENGTH) { - rv = sslBuffer_Grow(databuf, MAX_FRAGMENT_LENGTH + 2048); - if (rv != SECSuccess) { - SSL_DBG(("%d: SSL3[%d]: HandleRecord, tried to get %d bytes", - SSL_GETPID(), ss->fd, MAX_FRAGMENT_LENGTH + 2048)); - /* sslBuffer_Grow has set a memory error code. */ - /* Perhaps we should send an alert. (but we have no memory!) */ - return SECFailure; - } - } - - PRINT_BUF(80, (ss, "ciphertext:", cText->buf->buf, cText->buf->len)); - - ssl_GetSpecReadLock(ss); /******************************************/ - - crSpec = ss->ssl3.crSpec; - cipher_def = crSpec->cipher_def; - isTLS = (PRBool)(crSpec->version > SSL_LIBRARY_VERSION_3_0); - - if (isTLS && cText->buf->len > (MAX_FRAGMENT_LENGTH + 2048)) { - ssl_ReleaseSpecReadLock(ss); - SSL3_SendAlert(ss, alert_fatal, record_overflow); - PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); - return SECFailure; - } - /* decrypt from cText buf to databuf. */ - rv = crSpec->decode( - crSpec->decodeContext, databuf->buf, (int *)&databuf->len, - databuf->space, cText->buf->buf, cText->buf->len); - - PRINT_BUF(80, (ss, "cleartext:", databuf->buf, databuf->len)); - if (rv != SECSuccess) { - int err = ssl_MapLowLevelError(SSL_ERROR_DECRYPTION_FAILURE); - ssl_ReleaseSpecReadLock(ss); - SSL3_SendAlert(ss, alert_fatal, - isTLS ? decryption_failed : bad_record_mac); - PORT_SetError(err); - return SECFailure; - } - - /* If it's a block cipher, check and strip the padding. */ - if (cipher_def->type == type_block) { - padding_length = *(databuf->buf + databuf->len - 1); - /* TLS permits padding to exceed the block size, up to 255 bytes. */ - if (padding_length + 1 + crSpec->mac_size > databuf->len) - padIsBad = PR_TRUE; - /* if TLS, check value of first padding byte. */ - else if (padding_length && isTLS && - padding_length != - *(databuf->buf + databuf->len - (padding_length + 1))) - padIsBad = PR_TRUE; - else - databuf->len -= padding_length + 1; - } - - /* Remove the MAC. */ - if (databuf->len >= crSpec->mac_size) - databuf->len -= crSpec->mac_size; - else - padIsBad = PR_TRUE; /* really macIsBad */ - - /* compute the MAC */ - rType = cText->type; - rv = ssl3_ComputeRecordMAC( crSpec, (PRBool)(!ss->sec.isServer), - rType, cText->version, crSpec->read_seq_num, - databuf->buf, databuf->len, hash, &hashBytes); - if (rv != SECSuccess) { - int err = ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE); - ssl_ReleaseSpecReadLock(ss); - SSL3_SendAlert(ss, alert_fatal, bad_record_mac); - PORT_SetError(err); - return rv; - } - - /* Check the MAC */ - if (hashBytes != (unsigned)crSpec->mac_size || padIsBad || - PORT_Memcmp(databuf->buf + databuf->len, hash, crSpec->mac_size) != 0) { - /* must not hold spec lock when calling SSL3_SendAlert. */ - ssl_ReleaseSpecReadLock(ss); - SSL3_SendAlert(ss, alert_fatal, bad_record_mac); - /* always log mac error, in case attacker can read server logs. */ - PORT_SetError(SSL_ERROR_BAD_MAC_READ); - - SSL_DBG(("%d: SSL3[%d]: mac check failed", SSL_GETPID(), ss->fd)); - - return SECFailure; - } - - ssl3_BumpSequenceNumber(&crSpec->read_seq_num); - - ssl_ReleaseSpecReadLock(ss); /*****************************************/ - - /* - * The decrypted data is now in databuf. - * - * the null decompression routine is right here - */ - - /* - ** Having completed the decompression, check the length again. - */ - if (isTLS && databuf->len > (MAX_FRAGMENT_LENGTH + 1024)) { - SSL3_SendAlert(ss, alert_fatal, record_overflow); - PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); - return SECFailure; - } - - /* Application data records are processed by the caller of this - ** function, not by this function. - */ - if (rType == content_application_data) { - return SECSuccess; - } - - /* It's a record that must be handled by ssl itself, not the application. - */ -process_it: - /* XXX Get the xmit lock here. Odds are very high that we'll be xmiting - * data ang getting the xmit lock here prevents deadlocks. - */ - ssl_GetSSL3HandshakeLock(ss); - - /* All the functions called in this switch MUST set error code if - ** they return SECFailure or SECWouldBlock. - */ - switch (rType) { - case content_change_cipher_spec: - rv = ssl3_HandleChangeCipherSpecs(ss, databuf); - break; - case content_alert: - rv = ssl3_HandleAlert(ss, databuf); - break; - case content_handshake: - rv = ssl3_HandleHandshake(ss, databuf); - break; - /* - case content_application_data is handled before this switch - */ - default: - SSL_DBG(("%d: SSL3[%d]: bogus content type=%d", - SSL_GETPID(), ss->fd, cText->type)); - /* XXX Send an alert ??? */ - PORT_SetError(SSL_ERROR_RX_UNKNOWN_RECORD_TYPE); - rv = SECFailure; - break; - } - - ssl_ReleaseSSL3HandshakeLock(ss); - return rv; - -} - -/* - * Initialization functions - */ - -/* Called from ssl3_InitState, immediately below. */ -/* Caller must hold the SpecWriteLock. */ -static void -ssl3_InitCipherSpec(sslSocket *ss, ssl3CipherSpec *spec) -{ - spec->cipher_def = &bulk_cipher_defs[cipher_null]; - PORT_Assert(spec->cipher_def->cipher == cipher_null); - spec->mac_def = &mac_defs[mac_null]; - PORT_Assert(spec->mac_def->mac == mac_null); - spec->encode = Null_Cipher; - spec->decode = Null_Cipher; - spec->destroy = NULL; - spec->mac_size = 0; - spec->master_secret = NULL; - spec->bypassCiphers = PR_FALSE; - - spec->msItem.data = NULL; - spec->msItem.len = 0; - - spec->client.write_key = NULL; - spec->client.write_mac_key = NULL; - spec->client.write_mac_context = NULL; - - spec->server.write_key = NULL; - spec->server.write_mac_key = NULL; - spec->server.write_mac_context = NULL; - - spec->write_seq_num.high = 0; - spec->write_seq_num.low = 0; - - spec->read_seq_num.high = 0; - spec->read_seq_num.low = 0; - - spec->version = ss->opt.enableTLS - ? SSL_LIBRARY_VERSION_3_1_TLS - : SSL_LIBRARY_VERSION_3_0; -} - -/* Called from: ssl3_SendRecord -** ssl3_StartHandshakeHash() <- ssl2_BeginClientHandshake() -** ssl3_SendClientHello() -** ssl3_HandleServerHello() -** ssl3_HandleClientHello() -** ssl3_HandleV2ClientHello() -** ssl3_HandleRecord() -** -** This function should perhaps acquire and release the SpecWriteLock. -** -** -*/ -static SECStatus -ssl3_InitState(sslSocket *ss) -{ - SECStatus rv; - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - if (ss->ssl3.initialized) - return SECSuccess; /* Function should be idempotent */ - - ss->ssl3.policy = SSL_ALLOWED; - - ssl_GetSpecWriteLock(ss); - ss->ssl3.crSpec = ss->ssl3.cwSpec = &ss->ssl3.specs[0]; - ss->ssl3.prSpec = ss->ssl3.pwSpec = &ss->ssl3.specs[1]; - ss->ssl3.hs.rehandshake = PR_FALSE; - ssl3_InitCipherSpec(ss, ss->ssl3.crSpec); - ssl3_InitCipherSpec(ss, ss->ssl3.prSpec); - - ss->ssl3.hs.ws = (ss->sec.isServer) ? wait_client_hello : wait_server_hello; -#ifdef NSS_ENABLE_ECC - ss->ssl3.hs.negotiatedECCurves = SSL3_SUPPORTED_CURVES_MASK; -#endif - ssl_ReleaseSpecWriteLock(ss); - - PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData)); - - rv = ssl3_NewHandshakeHashes(ss); - if (rv == SECSuccess) { - ss->ssl3.initialized = PR_TRUE; - } - - return rv; -} - -/* Returns a reference counted object that contains a key pair. - * Or NULL on failure. Initial ref count is 1. - * Uses the keys in the pair as input. - */ -ssl3KeyPair * -ssl3_NewKeyPair( SECKEYPrivateKey * privKey, SECKEYPublicKey * pubKey) -{ - ssl3KeyPair * pair; - - if (!privKey || !pubKey) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return NULL; - } - pair = PORT_ZNew(ssl3KeyPair); - if (!pair) - return NULL; /* error code is set. */ - pair->refCount = 1; - pair->privKey = privKey; - pair->pubKey = pubKey; - return pair; /* success */ -} - -ssl3KeyPair * -ssl3_GetKeyPairRef(ssl3KeyPair * keyPair) -{ - PR_AtomicIncrement(&keyPair->refCount); - return keyPair; -} - -void -ssl3_FreeKeyPair(ssl3KeyPair * keyPair) -{ - PRInt32 newCount = PR_AtomicDecrement(&keyPair->refCount); - if (!newCount) { - if (keyPair->privKey) - SECKEY_DestroyPrivateKey(keyPair->privKey); - if (keyPair->pubKey) - SECKEY_DestroyPublicKey( keyPair->pubKey); - PORT_Free(keyPair); - } -} - - - -/* - * Creates the public and private RSA keys for SSL Step down. - * Called from SSL_ConfigSecureServer in sslsecur.c - */ -SECStatus -ssl3_CreateRSAStepDownKeys(sslSocket *ss) -{ - SECStatus rv = SECSuccess; - SECKEYPrivateKey * privKey; /* RSA step down key */ - SECKEYPublicKey * pubKey; /* RSA step down key */ - - if (ss->stepDownKeyPair) - ssl3_FreeKeyPair(ss->stepDownKeyPair); - ss->stepDownKeyPair = NULL; -#ifndef HACKED_EXPORT_SERVER - /* Sigh, should have a get key strength call for private keys */ - if (PK11_GetPrivateModulusLen(ss->serverCerts[kt_rsa].SERVERKEY) > - EXPORT_RSA_KEY_LENGTH) { - /* need to ask for the key size in bits */ - privKey = SECKEY_CreateRSAPrivateKey(EXPORT_RSA_KEY_LENGTH * BPB, - &pubKey, NULL); - if (!privKey || !pubKey || - !(ss->stepDownKeyPair = ssl3_NewKeyPair(privKey, pubKey))) { - ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); - rv = SECFailure; - } - } -#endif - return rv; -} - - -/* record the export policy for this cipher suite */ -SECStatus -ssl3_SetPolicy(ssl3CipherSuite which, int policy) -{ - ssl3CipherSuiteCfg *suite; - - suite = ssl_LookupCipherSuiteCfg(which, cipherSuites); - if (suite == NULL) { - return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */ - } - suite->policy = policy; - - if (policy == SSL_RESTRICTED) { - ssl3_global_policy_some_restricted = PR_TRUE; - } - - return SECSuccess; -} - -SECStatus -ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *oPolicy) -{ - ssl3CipherSuiteCfg *suite; - PRInt32 policy; - SECStatus rv; - - suite = ssl_LookupCipherSuiteCfg(which, cipherSuites); - if (suite) { - policy = suite->policy; - rv = SECSuccess; - } else { - policy = SSL_NOT_ALLOWED; - rv = SECFailure; /* err code was set by Lookup. */ - } - *oPolicy = policy; - return rv; -} - -/* record the user preference for this suite */ -SECStatus -ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool enabled) -{ - ssl3CipherSuiteCfg *suite; - - suite = ssl_LookupCipherSuiteCfg(which, cipherSuites); - if (suite == NULL) { - return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */ - } - suite->enabled = enabled; - return SECSuccess; -} - -/* return the user preference for this suite */ -SECStatus -ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *enabled) -{ - ssl3CipherSuiteCfg *suite; - PRBool pref; - SECStatus rv; - - suite = ssl_LookupCipherSuiteCfg(which, cipherSuites); - if (suite) { - pref = suite->enabled; - rv = SECSuccess; - } else { - pref = SSL_NOT_ALLOWED; - rv = SECFailure; /* err code was set by Lookup. */ - } - *enabled = pref; - return rv; -} - -SECStatus -ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool enabled) -{ - ssl3CipherSuiteCfg *suite; - - suite = ssl_LookupCipherSuiteCfg(which, ss->cipherSuites); - if (suite == NULL) { - return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */ - } - suite->enabled = enabled; - return SECSuccess; -} - -SECStatus -ssl3_CipherPrefGet(sslSocket *ss, ssl3CipherSuite which, PRBool *enabled) -{ - ssl3CipherSuiteCfg *suite; - PRBool pref; - SECStatus rv; - - suite = ssl_LookupCipherSuiteCfg(which, ss->cipherSuites); - if (suite) { - pref = suite->enabled; - rv = SECSuccess; - } else { - pref = SSL_NOT_ALLOWED; - rv = SECFailure; /* err code was set by Lookup. */ - } - *enabled = pref; - return rv; -} - -/* copy global default policy into socket. */ -void -ssl3_InitSocketPolicy(sslSocket *ss) -{ - PORT_Memcpy(ss->cipherSuites, cipherSuites, sizeof cipherSuites); -} - -/* ssl3_config_match_init must have already been called by - * the caller of this function. - */ -SECStatus -ssl3_ConstructV2CipherSpecsHack(sslSocket *ss, unsigned char *cs, int *size) -{ - int i, count = 0; - - PORT_Assert(ss != 0); - if (!ss) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) { - *size = 0; - return SECSuccess; - } - if (cs == NULL) { - *size = count_cipher_suites(ss, SSL_ALLOWED, PR_TRUE); - return SECSuccess; - } - - /* ssl3_config_match_init was called by the caller of this function. */ - for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { - ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i]; - if (config_match(suite, SSL_ALLOWED, PR_TRUE)) { - if (cs != NULL) { - *cs++ = 0x00; - *cs++ = (suite->cipher_suite >> 8) & 0xFF; - *cs++ = suite->cipher_suite & 0xFF; - } - count++; - } - } - *size = count; - return SECSuccess; -} - -/* -** If ssl3 socket has completed the first handshake, and is in idle state, -** then start a new handshake. -** If flushCache is true, the SID cache will be flushed first, forcing a -** "Full" handshake (not a session restart handshake), to be done. -** -** called from SSL_RedoHandshake(), which already holds the handshake locks. -*/ -SECStatus -ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache) -{ - sslSessionID * sid = ss->sec.ci.sid; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - if (!ss->firstHsDone || - ((ss->version >= SSL_LIBRARY_VERSION_3_0) && - ss->ssl3.initialized && - (ss->ssl3.hs.ws != idle_handshake))) { - PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED); - return SECFailure; - } - if (sid && flushCache) { - ss->sec.uncache(sid); /* remove it from whichever cache it's in. */ - ssl_FreeSID(sid); /* dec ref count and free if zero. */ - ss->sec.ci.sid = NULL; - } - - ssl_GetXmitBufLock(ss); /**************************************/ - - /* start off a new handshake. */ - rv = (ss->sec.isServer) ? ssl3_SendHelloRequest(ss) - : ssl3_SendClientHello(ss); - - ssl_ReleaseXmitBufLock(ss); /**************************************/ - return rv; -} - -/* Called from ssl_DestroySocketContents() in sslsock.c */ -void -ssl3_DestroySSL3Info(sslSocket *ss) -{ - - if (ss->ssl3.clientCertificate != NULL) - CERT_DestroyCertificate(ss->ssl3.clientCertificate); - - if (ss->ssl3.clientPrivateKey != NULL) - SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); - - if (ss->ssl3.peerCertArena != NULL) - ssl3_CleanupPeerCerts(ss); - - if (ss->ssl3.clientCertChain != NULL) { - CERT_DestroyCertificateList(ss->ssl3.clientCertChain); - ss->ssl3.clientCertChain = NULL; - } - - /* clean up handshake */ - if (ss->opt.bypassPKCS11) { - SHA1_DestroyContext((SHA1Context *)ss->ssl3.hs.sha_cx, PR_FALSE); - MD5_DestroyContext((MD5Context *)ss->ssl3.hs.md5_cx, PR_FALSE); - } - if (ss->ssl3.hs.md5) { - PK11_DestroyContext(ss->ssl3.hs.md5,PR_TRUE); - } - if (ss->ssl3.hs.sha) { - PK11_DestroyContext(ss->ssl3.hs.sha,PR_TRUE); - } - if (ss->ssl3.hs.messages.buf) { - PORT_Free(ss->ssl3.hs.messages.buf); - ss->ssl3.hs.messages.buf = NULL; - ss->ssl3.hs.messages.len = 0; - ss->ssl3.hs.messages.space = 0; - } - - /* free the SSL3Buffer (msg_body) */ - PORT_Free(ss->ssl3.hs.msg_body.buf); - - /* free up the CipherSpecs */ - ssl3_DestroyCipherSpec(&ss->ssl3.specs[0]); - ssl3_DestroyCipherSpec(&ss->ssl3.specs[1]); - - ss->ssl3.initialized = PR_FALSE; -} - -/* End of ssl3con.c */ diff --git a/security/nss/lib/ssl/ssl3ecc.c b/security/nss/lib/ssl/ssl3ecc.c deleted file mode 100644 index af0e2c9b6..000000000 --- a/security/nss/lib/ssl/ssl3ecc.c +++ /dev/null @@ -1,1193 +0,0 @@ -/* - * SSL3 Protocol - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com> and - * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ - -/* ECC code moved here from ssl3con.c */ -/* $Id$ */ - -#include "nss.h" -#include "cert.h" -#include "ssl.h" -#include "cryptohi.h" /* for DSAU_ stuff */ -#include "keyhi.h" -#include "secder.h" -#include "secitem.h" - -#include "sslimpl.h" -#include "sslproto.h" -#include "sslerr.h" -#include "prtime.h" -#include "prinrval.h" -#include "prerror.h" -#include "pratom.h" -#include "prthread.h" -#include "prinit.h" - -#include "pk11func.h" -#include "secmod.h" -#include "ec.h" -#include "blapi.h" - -#include <stdio.h> - -#ifdef NSS_ENABLE_ECC - -#ifndef PK11_SETATTRS -#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \ - (x)->pValue=(v); (x)->ulValueLen = (l); -#endif - -#define SSL_GET_SERVER_PUBLIC_KEY(sock, type) \ - (ss->serverCerts[type].serverKeyPair ? \ - ss->serverCerts[type].serverKeyPair->pubKey : NULL) - -#define SSL_IS_CURVE_NEGOTIATED(curvemsk, curveName) \ - ((curveName > ec_noName) && \ - (curveName < ec_pastLastName) && \ - ((1UL << curveName) & curvemsk) != 0) - - - -static SECStatus ssl3_CreateECDHEphemeralKeys(sslSocket *ss, ECName ec_curve); - -#define supportedCurve(x) (((x) > ec_noName) && ((x) < ec_pastLastName)) - -/* Table containing OID tags for elliptic curves named in the - * ECC-TLS IETF draft. - */ -static const SECOidTag ecName2OIDTag[] = { - 0, - SEC_OID_SECG_EC_SECT163K1, /* 1 */ - SEC_OID_SECG_EC_SECT163R1, /* 2 */ - SEC_OID_SECG_EC_SECT163R2, /* 3 */ - SEC_OID_SECG_EC_SECT193R1, /* 4 */ - SEC_OID_SECG_EC_SECT193R2, /* 5 */ - SEC_OID_SECG_EC_SECT233K1, /* 6 */ - SEC_OID_SECG_EC_SECT233R1, /* 7 */ - SEC_OID_SECG_EC_SECT239K1, /* 8 */ - SEC_OID_SECG_EC_SECT283K1, /* 9 */ - SEC_OID_SECG_EC_SECT283R1, /* 10 */ - SEC_OID_SECG_EC_SECT409K1, /* 11 */ - SEC_OID_SECG_EC_SECT409R1, /* 12 */ - SEC_OID_SECG_EC_SECT571K1, /* 13 */ - SEC_OID_SECG_EC_SECT571R1, /* 14 */ - SEC_OID_SECG_EC_SECP160K1, /* 15 */ - SEC_OID_SECG_EC_SECP160R1, /* 16 */ - SEC_OID_SECG_EC_SECP160R2, /* 17 */ - SEC_OID_SECG_EC_SECP192K1, /* 18 */ - SEC_OID_SECG_EC_SECP192R1, /* 19 */ - SEC_OID_SECG_EC_SECP224K1, /* 20 */ - SEC_OID_SECG_EC_SECP224R1, /* 21 */ - SEC_OID_SECG_EC_SECP256K1, /* 22 */ - SEC_OID_SECG_EC_SECP256R1, /* 23 */ - SEC_OID_SECG_EC_SECP384R1, /* 24 */ - SEC_OID_SECG_EC_SECP521R1, /* 25 */ -}; - -static const PRUint16 curve2bits[] = { - 0, /* ec_noName = 0, */ - 163, /* ec_sect163k1 = 1, */ - 163, /* ec_sect163r1 = 2, */ - 163, /* ec_sect163r2 = 3, */ - 193, /* ec_sect193r1 = 4, */ - 193, /* ec_sect193r2 = 5, */ - 233, /* ec_sect233k1 = 6, */ - 233, /* ec_sect233r1 = 7, */ - 239, /* ec_sect239k1 = 8, */ - 283, /* ec_sect283k1 = 9, */ - 283, /* ec_sect283r1 = 10, */ - 409, /* ec_sect409k1 = 11, */ - 409, /* ec_sect409r1 = 12, */ - 571, /* ec_sect571k1 = 13, */ - 571, /* ec_sect571r1 = 14, */ - 160, /* ec_secp160k1 = 15, */ - 160, /* ec_secp160r1 = 16, */ - 160, /* ec_secp160r2 = 17, */ - 192, /* ec_secp192k1 = 18, */ - 192, /* ec_secp192r1 = 19, */ - 224, /* ec_secp224k1 = 20, */ - 224, /* ec_secp224r1 = 21, */ - 256, /* ec_secp256k1 = 22, */ - 256, /* ec_secp256r1 = 23, */ - 384, /* ec_secp384r1 = 24, */ - 521, /* ec_secp521r1 = 25, */ - 65535 /* ec_pastLastName */ -}; - -typedef struct Bits2CurveStr { - PRUint16 bits; - ECName curve; -} Bits2Curve; - -static const Bits2Curve bits2curve [] = { - { 192, ec_secp192r1 /* = 19, fast */ }, - { 160, ec_secp160r2 /* = 17, fast */ }, - { 160, ec_secp160k1 /* = 15, */ }, - { 160, ec_secp160r1 /* = 16, */ }, - { 163, ec_sect163k1 /* = 1, */ }, - { 163, ec_sect163r1 /* = 2, */ }, - { 163, ec_sect163r2 /* = 3, */ }, - { 192, ec_secp192k1 /* = 18, */ }, - { 193, ec_sect193r1 /* = 4, */ }, - { 193, ec_sect193r2 /* = 5, */ }, - { 224, ec_secp224r1 /* = 21, fast */ }, - { 224, ec_secp224k1 /* = 20, */ }, - { 233, ec_sect233k1 /* = 6, */ }, - { 233, ec_sect233r1 /* = 7, */ }, - { 239, ec_sect239k1 /* = 8, */ }, - { 256, ec_secp256r1 /* = 23, fast */ }, - { 256, ec_secp256k1 /* = 22, */ }, - { 283, ec_sect283k1 /* = 9, */ }, - { 283, ec_sect283r1 /* = 10, */ }, - { 384, ec_secp384r1 /* = 24, fast */ }, - { 409, ec_sect409k1 /* = 11, */ }, - { 409, ec_sect409r1 /* = 12, */ }, - { 521, ec_secp521r1 /* = 25, fast */ }, - { 571, ec_sect571k1 /* = 13, */ }, - { 571, ec_sect571r1 /* = 14, */ }, - { 65535, ec_noName } -}; - -typedef struct ECDHEKeyPairStr { - ssl3KeyPair * pair; - int error; /* error code of the call-once function */ - PRCallOnceType once; -} ECDHEKeyPair; - -/* arrays of ECDHE KeyPairs */ -static ECDHEKeyPair gECDHEKeyPairs[ec_pastLastName]; - -SECStatus -ssl3_ECName2Params(PRArenaPool * arena, ECName curve, SECKEYECParams * params) -{ - SECOidData *oidData = NULL; - - if ((curve <= ec_noName) || (curve >= ec_pastLastName) || - ((oidData = SECOID_FindOIDByTag(ecName2OIDTag[curve])) == NULL)) { - PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE); - return SECFailure; - } - - SECITEM_AllocItem(arena, params, (2 + oidData->oid.len)); - /* - * params->data needs to contain the ASN encoding of an object ID (OID) - * representing the named curve. The actual OID is in - * oidData->oid.data so we simply prepend 0x06 and OID length - */ - params->data[0] = SEC_ASN1_OBJECT_ID; - params->data[1] = oidData->oid.len; - memcpy(params->data + 2, oidData->oid.data, oidData->oid.len); - - return SECSuccess; -} - -static ECName -params2ecName(SECKEYECParams * params) -{ - SECItem oid = { siBuffer, NULL, 0}; - SECOidData *oidData = NULL; - ECName i; - - /* - * params->data needs to contain the ASN encoding of an object ID (OID) - * representing a named curve. Here, we strip away everything - * before the actual OID and use the OID to look up a named curve. - */ - if (params->data[0] != SEC_ASN1_OBJECT_ID) return ec_noName; - oid.len = params->len - 2; - oid.data = params->data + 2; - if ((oidData = SECOID_FindOID(&oid)) == NULL) return ec_noName; - for (i = ec_noName + 1; i < ec_pastLastName; i++) { - if (ecName2OIDTag[i] == oidData->offset) - return i; - } - - return ec_noName; -} - -/* Caller must set hiLevel error code. */ -static SECStatus -ssl3_ComputeECDHKeyHash(SECItem ec_params, SECItem server_ecpoint, - SSL3Random *client_rand, SSL3Random *server_rand, - SSL3Hashes *hashes, PRBool bypassPKCS11) -{ - PRUint8 * hashBuf; - PRUint8 * pBuf; - SECStatus rv = SECSuccess; - unsigned int bufLen; - /* - * XXX For now, we only support named curves (the appropriate - * checks are made before this method is called) so ec_params - * takes up only two bytes. ECPoint needs to fit in 256 bytes - * (because the spec says the length must fit in one byte) - */ - PRUint8 buf[2*SSL3_RANDOM_LENGTH + 2 + 1 + 256]; - - bufLen = 2*SSL3_RANDOM_LENGTH + ec_params.len + 1 + server_ecpoint.len; - if (bufLen <= sizeof buf) { - hashBuf = buf; - } else { - hashBuf = PORT_Alloc(bufLen); - if (!hashBuf) { - return SECFailure; - } - } - - memcpy(hashBuf, client_rand, SSL3_RANDOM_LENGTH); - pBuf = hashBuf + SSL3_RANDOM_LENGTH; - memcpy(pBuf, server_rand, SSL3_RANDOM_LENGTH); - pBuf += SSL3_RANDOM_LENGTH; - memcpy(pBuf, ec_params.data, ec_params.len); - pBuf += ec_params.len; - pBuf[0] = (PRUint8)(server_ecpoint.len); - pBuf += 1; - memcpy(pBuf, server_ecpoint.data, server_ecpoint.len); - pBuf += server_ecpoint.len; - PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen); - - rv = ssl3_ComputeCommonKeyHash(hashBuf, bufLen, hashes, bypassPKCS11); - - PRINT_BUF(95, (NULL, "ECDHkey hash: ", hashBuf, bufLen)); - PRINT_BUF(95, (NULL, "ECDHkey hash: MD5 result", hashes->md5, MD5_LENGTH)); - PRINT_BUF(95, (NULL, "ECDHkey hash: SHA1 result", hashes->sha, SHA1_LENGTH)); - - if (hashBuf != buf && hashBuf != NULL) - PORT_Free(hashBuf); - return rv; -} - - -/* Called from ssl3_SendClientKeyExchange(). */ -SECStatus -ssl3_SendECDHClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) -{ - PK11SymKey * pms = NULL; - SECStatus rv = SECFailure; - PRBool isTLS; - CK_MECHANISM_TYPE target; - SECKEYPublicKey *pubKey = NULL; /* Ephemeral ECDH key */ - SECKEYPrivateKey *privKey = NULL; /* Ephemeral ECDH key */ - - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - - /* Generate ephemeral EC keypair */ - if (svrPubKey->keyType != ecKey) { - PORT_SetError(SEC_ERROR_BAD_KEY); - goto loser; - } - /* XXX SHOULD CALL ssl3_CreateECDHEphemeralKeys here, instead! */ - privKey = SECKEY_CreateECPrivateKey(&svrPubKey->u.ec.DEREncodedParams, - &pubKey, NULL); - if (!privKey || !pubKey) { - ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); - rv = SECFailure; - goto loser; - } - PRINT_BUF(50, (ss, "ECDH public value:", - pubKey->u.ec.publicValue.data, - pubKey->u.ec.publicValue.len)); - - if (isTLS) target = CKM_TLS_MASTER_KEY_DERIVE_DH; - else target = CKM_SSL3_MASTER_KEY_DERIVE_DH; - - /* Determine the PMS */ - pms = PK11_PubDeriveWithKDF(privKey, svrPubKey, PR_FALSE, NULL, NULL, - CKM_ECDH1_DERIVE, target, CKA_DERIVE, 0, - CKD_NULL, NULL, NULL); - - if (pms == NULL) { - SSL3AlertDescription desc = illegal_parameter; - (void)SSL3_SendAlert(ss, alert_fatal, desc); - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - SECKEY_DestroyPrivateKey(privKey); - privKey = NULL; - - rv = ssl3_InitPendingCipherSpec(ss, pms); - PK11_FreeSymKey(pms); pms = NULL; - - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - goto loser; - } - - rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, - pubKey->u.ec.publicValue.len + 1); - if (rv != SECSuccess) { - goto loser; /* err set by ssl3_AppendHandshake* */ - } - - rv = ssl3_AppendHandshakeVariable(ss, - pubKey->u.ec.publicValue.data, - pubKey->u.ec.publicValue.len, 1); - SECKEY_DestroyPublicKey(pubKey); - pubKey = NULL; - - if (rv != SECSuccess) { - goto loser; /* err set by ssl3_AppendHandshake* */ - } - - rv = SECSuccess; - -loser: - if(pms) PK11_FreeSymKey(pms); - if(privKey) SECKEY_DestroyPrivateKey(privKey); - if(pubKey) SECKEY_DestroyPublicKey(pubKey); - return rv; -} - - -/* -** Called from ssl3_HandleClientKeyExchange() -*/ -SECStatus -ssl3_HandleECDHClientKeyExchange(sslSocket *ss, SSL3Opaque *b, - PRUint32 length, - SECKEYPublicKey *srvrPubKey, - SECKEYPrivateKey *srvrPrivKey) -{ - PK11SymKey * pms; - SECStatus rv; - SECKEYPublicKey clntPubKey; - CK_MECHANISM_TYPE target; - PRBool isTLS; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); - - clntPubKey.keyType = ecKey; - clntPubKey.u.ec.DEREncodedParams.len = - srvrPubKey->u.ec.DEREncodedParams.len; - clntPubKey.u.ec.DEREncodedParams.data = - srvrPubKey->u.ec.DEREncodedParams.data; - - rv = ssl3_ConsumeHandshakeVariable(ss, &clntPubKey.u.ec.publicValue, - 1, &b, &length); - if (rv != SECSuccess) { - SEND_ALERT - return SECFailure; /* XXX Who sets the error code?? */ - } - - isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); - - if (isTLS) target = CKM_TLS_MASTER_KEY_DERIVE_DH; - else target = CKM_SSL3_MASTER_KEY_DERIVE_DH; - - /* Determine the PMS */ - pms = PK11_PubDeriveWithKDF(srvrPrivKey, &clntPubKey, PR_FALSE, NULL, NULL, - CKM_ECDH1_DERIVE, target, CKA_DERIVE, 0, - CKD_NULL, NULL, NULL); - - if (pms == NULL) { - /* last gasp. */ - ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); - return SECFailure; - } - - rv = ssl3_InitPendingCipherSpec(ss, pms); - PK11_FreeSymKey(pms); - if (rv != SECSuccess) { - SEND_ALERT - return SECFailure; /* error code set by ssl3_InitPendingCipherSpec */ - } - return SECSuccess; -} - -ECName -ssl3_GetCurveWithECKeyStrength(PRUint32 curvemsk, int requiredECCbits) -{ - int i; - - for ( i = 0; bits2curve[i].curve != ec_noName; i++) { - if (bits2curve[i].bits < requiredECCbits) - continue; - if (SSL_IS_CURVE_NEGOTIATED(curvemsk, bits2curve[i].curve)) { - return bits2curve[i].curve; - } - } - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return ec_noName; -} - -/* find the "weakest link". Get strength of signature key and of sym key. - * choose curve for the weakest of those two. - */ -ECName -ssl3_GetCurveNameForServerSocket(sslSocket *ss) -{ - SECKEYPublicKey * svrPublicKey = NULL; - ECName ec_curve = ec_noName; - int signatureKeyStrength = 521; - int requiredECCbits = ss->sec.secretKeyBits * 2; - - if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa) { - svrPublicKey = SSL_GET_SERVER_PUBLIC_KEY(ss, kt_ecdh); - if (svrPublicKey) - ec_curve = params2ecName(&svrPublicKey->u.ec.DEREncodedParams); - if (!SSL_IS_CURVE_NEGOTIATED(ss->ssl3.hs.negotiatedECCurves, ec_curve)) { - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return ec_noName; - } - signatureKeyStrength = curve2bits[ ec_curve ]; - } else { - /* RSA is our signing cert */ - int serverKeyStrengthInBits; - - svrPublicKey = SSL_GET_SERVER_PUBLIC_KEY(ss, kt_rsa); - if (!svrPublicKey) { - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return ec_noName; - } - - /* currently strength in bytes */ - serverKeyStrengthInBits = svrPublicKey->u.rsa.modulus.len; - if (svrPublicKey->u.rsa.modulus.data[0] == 0) { - serverKeyStrengthInBits--; - } - /* convert to strength in bits */ - serverKeyStrengthInBits *= BPB; - - signatureKeyStrength = - SSL_RSASTRENGTH_TO_ECSTRENGTH(serverKeyStrengthInBits); - } - if ( requiredECCbits > signatureKeyStrength ) - requiredECCbits = signatureKeyStrength; - - return ssl3_GetCurveWithECKeyStrength(ss->ssl3.hs.negotiatedECCurves, - requiredECCbits); -} - -/* function to clear out the lists */ -static SECStatus -ssl3_ShutdownECDHECurves(void *appData, void *nssData) -{ - int i; - ECDHEKeyPair *keyPair = &gECDHEKeyPairs[0]; - - for (i=0; i < ec_pastLastName; i++, keyPair++) { - if (keyPair->pair) { - ssl3_FreeKeyPair(keyPair->pair); - } - } - memset(gECDHEKeyPairs, 0, sizeof gECDHEKeyPairs); - return SECSuccess; -} - -static PRStatus -ssl3_ECRegister(void) -{ - SECStatus rv; - rv = NSS_RegisterShutdown(ssl3_ShutdownECDHECurves, gECDHEKeyPairs); - if (rv != SECSuccess) { - gECDHEKeyPairs[ec_noName].error = PORT_GetError(); - } - return (PRStatus)rv; -} - -/* CallOnce function, called once for each named curve. */ -static PRStatus -ssl3_CreateECDHEphemeralKeyPair(void * arg) -{ - SECKEYPrivateKey * privKey = NULL; - SECKEYPublicKey * pubKey = NULL; - ssl3KeyPair * keyPair = NULL; - ECName ec_curve = (ECName)arg; - SECKEYECParams ecParams = { siBuffer, NULL, 0 }; - - PORT_Assert(gECDHEKeyPairs[ec_curve].pair == NULL); - - /* ok, no one has generated a global key for this curve yet, do so */ - if (ssl3_ECName2Params(NULL, ec_curve, &ecParams) != SECSuccess) { - gECDHEKeyPairs[ec_curve].error = PORT_GetError(); - return PR_FAILURE; - } - - privKey = SECKEY_CreateECPrivateKey(&ecParams, &pubKey, NULL); - SECITEM_FreeItem(&ecParams, PR_FALSE); - - if (!privKey || !pubKey || !(keyPair = ssl3_NewKeyPair(privKey, pubKey))) { - if (privKey) { - SECKEY_DestroyPrivateKey(privKey); - } - if (pubKey) { - SECKEY_DestroyPublicKey(pubKey); - } - ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); - gECDHEKeyPairs[ec_curve].error = PORT_GetError(); - return PR_FAILURE; - } - - gECDHEKeyPairs[ec_curve].pair = keyPair; - return PR_SUCCESS; -} - -/* - * Creates the ephemeral public and private ECDH keys used by - * server in ECDHE_RSA and ECDHE_ECDSA handshakes. - * For now, the elliptic curve is chosen to be the same - * strength as the signing certificate (ECC or RSA). - * We need an API to specify the curve. This won't be a real - * issue until we further develop server-side support for ECC - * cipher suites. - */ -static SECStatus -ssl3_CreateECDHEphemeralKeys(sslSocket *ss, ECName ec_curve) -{ - ssl3KeyPair * keyPair = NULL; - - /* if there's no global key for this curve, make one. */ - if (gECDHEKeyPairs[ec_curve].pair == NULL) { - PRStatus status; - - status = PR_CallOnce(&gECDHEKeyPairs[ec_noName].once, ssl3_ECRegister); - if (status != PR_SUCCESS) { - PORT_SetError(gECDHEKeyPairs[ec_noName].error); - return SECFailure; - } - status = PR_CallOnceWithArg(&gECDHEKeyPairs[ec_curve].once, - ssl3_CreateECDHEphemeralKeyPair, - (void *)ec_curve); - if (status != PR_SUCCESS) { - PORT_SetError(gECDHEKeyPairs[ec_curve].error); - return SECFailure; - } - } - - keyPair = gECDHEKeyPairs[ec_curve].pair; - PORT_Assert(keyPair != NULL); - if (!keyPair) - return SECFailure; - ss->ephemeralECDHKeyPair = ssl3_GetKeyPairRef(keyPair); - - return SECSuccess; -} - -SECStatus -ssl3_HandleECDHServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) -{ - PRArenaPool * arena = NULL; - SECKEYPublicKey *peerKey = NULL; - PRBool isTLS; - SECStatus rv; - int errCode = SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH; - SSL3AlertDescription desc = illegal_parameter; - SSL3Hashes hashes; - SECItem signature = {siBuffer, NULL, 0}; - - SECItem ec_params = {siBuffer, NULL, 0}; - SECItem ec_point = {siBuffer, NULL, 0}; - unsigned char paramBuf[3]; /* only for curve_type == named_curve */ - - isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); - - /* XXX This works only for named curves, revisit this when - * we support generic curves. - */ - ec_params.len = sizeof paramBuf; - ec_params.data = paramBuf; - rv = ssl3_ConsumeHandshake(ss, ec_params.data, ec_params.len, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - - /* Fail if the curve is not a named curve */ - if ((ec_params.data[0] != ec_type_named) || - (ec_params.data[1] != 0) || - !supportedCurve(ec_params.data[2])) { - errCode = SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE; - desc = handshake_failure; - goto alert_loser; - } - - rv = ssl3_ConsumeHandshakeVariable(ss, &ec_point, 1, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - /* Fail if the ec point uses compressed representation */ - if (ec_point.data[0] != EC_POINT_FORM_UNCOMPRESSED) { - errCode = SEC_ERROR_UNSUPPORTED_EC_POINT_FORM; - desc = handshake_failure; - goto alert_loser; - } - - rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length); - if (rv != SECSuccess) { - goto loser; /* malformed. */ - } - - if (length != 0) { - if (isTLS) - desc = decode_error; - goto alert_loser; /* malformed. */ - } - - PRINT_BUF(60, (NULL, "Server EC params", ec_params.data, - ec_params.len)); - PRINT_BUF(60, (NULL, "Server EC point", ec_point.data, ec_point.len)); - - /* failures after this point are not malformed handshakes. */ - /* TLS: send decrypt_error if signature failed. */ - desc = isTLS ? decrypt_error : handshake_failure; - - /* - * check to make sure the hash is signed by right guy - */ - rv = ssl3_ComputeECDHKeyHash(ec_params, ec_point, - &ss->ssl3.hs.client_random, - &ss->ssl3.hs.server_random, - &hashes, ss->opt.bypassPKCS11); - - if (rv != SECSuccess) { - errCode = - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto alert_loser; - } - rv = ssl3_VerifySignedHashes(&hashes, ss->sec.peerCert, &signature, - isTLS, ss->pkcs11PinArg); - if (rv != SECSuccess) { - errCode = - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto alert_loser; - } - - arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); - if (arena == NULL) { - goto no_memory; - } - - ss->sec.peerKey = peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey); - if (peerKey == NULL) { - goto no_memory; - } - - peerKey->arena = arena; - peerKey->keyType = ecKey; - - /* set up EC parameters in peerKey */ - if (ssl3_ECName2Params(arena, ec_params.data[2], - &peerKey->u.ec.DEREncodedParams) != SECSuccess) { - /* we should never get here since we already - * checked that we are dealing with a supported curve - */ - errCode = SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE; - goto alert_loser; - } - - /* copy publicValue in peerKey */ - if (SECITEM_CopyItem(arena, &peerKey->u.ec.publicValue, &ec_point)) - { - PORT_FreeArena(arena, PR_FALSE); - goto no_memory; - } - peerKey->pkcs11Slot = NULL; - peerKey->pkcs11ID = CK_INVALID_HANDLE; - - ss->sec.peerKey = peerKey; - ss->ssl3.hs.ws = wait_cert_request; - - return SECSuccess; - -alert_loser: - (void)SSL3_SendAlert(ss, alert_fatal, desc); -loser: - PORT_SetError( errCode ); - return SECFailure; - -no_memory: /* no-memory error has already been set. */ - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - return SECFailure; -} - -SECStatus -ssl3_SendECDHServerKeyExchange(sslSocket *ss) -{ -const ssl3KEADef * kea_def = ss->ssl3.hs.kea_def; - SECStatus rv = SECFailure; - int length; - PRBool isTLS; - SECItem signed_hash = {siBuffer, NULL, 0}; - SSL3Hashes hashes; - - SECKEYPublicKey * ecdhePub; - SECItem ec_params = {siBuffer, NULL, 0}; - unsigned char paramBuf[3]; - ECName curve; - SSL3KEAType certIndex; - - - /* Generate ephemeral ECDH key pair and send the public key */ - curve = ssl3_GetCurveNameForServerSocket(ss); - if (curve == ec_noName) { - goto loser; - } - rv = ssl3_CreateECDHEphemeralKeys(ss, curve); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - ecdhePub = ss->ephemeralECDHKeyPair->pubKey; - PORT_Assert(ecdhePub != NULL); - if (!ecdhePub) { - PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - return SECFailure; - } - - ec_params.len = sizeof paramBuf; - ec_params.data = paramBuf; - curve = params2ecName(&ecdhePub->u.ec.DEREncodedParams); - if (curve != ec_noName) { - ec_params.data[0] = ec_type_named; - ec_params.data[1] = 0x00; - ec_params.data[2] = curve; - } else { - PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE); - goto loser; - } - - rv = ssl3_ComputeECDHKeyHash(ec_params, ecdhePub->u.ec.publicValue, - &ss->ssl3.hs.client_random, - &ss->ssl3.hs.server_random, - &hashes, ss->opt.bypassPKCS11); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto loser; - } - - isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); - - /* XXX SSLKEAType isn't really a good choice for - * indexing certificates but that's all we have - * for now. - */ - if (kea_def->kea == kea_ecdhe_rsa) - certIndex = kt_rsa; - else /* kea_def->kea == kea_ecdhe_ecdsa */ - certIndex = kt_ecdh; - - rv = ssl3_SignHashes(&hashes, ss->serverCerts[certIndex].SERVERKEY, - &signed_hash, isTLS); - if (rv != SECSuccess) { - goto loser; /* ssl3_SignHashes has set err. */ - } - if (signed_hash.data == NULL) { - /* how can this happen and rv == SECSuccess ?? */ - PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); - goto loser; - } - - length = ec_params.len + - 1 + ecdhePub->u.ec.publicValue.len + - 2 + signed_hash.len; - - rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshake(ss, ec_params.data, ec_params.len); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeVariable(ss, ecdhePub->u.ec.publicValue.data, - ecdhePub->u.ec.publicValue.len, 1); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data, - signed_hash.len, 2); - if (rv != SECSuccess) { - goto loser; /* err set by AppendHandshake. */ - } - - PORT_Free(signed_hash.data); - return SECSuccess; - -loser: - if (signed_hash.data != NULL) - PORT_Free(signed_hash.data); - return SECFailure; -} - -/* Lists of ECC cipher suites for searching and disabling. */ - -static const ssl3CipherSuite ecdh_suites[] = { - TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_ECDSA_WITH_NULL_SHA, - TLS_ECDH_ECDSA_WITH_RC4_128_SHA, - TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_RSA_WITH_NULL_SHA, - TLS_ECDH_RSA_WITH_RC4_128_SHA, - 0 /* end of list marker */ -}; - -static const ssl3CipherSuite ecdh_ecdsa_suites[] = { - TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_ECDSA_WITH_NULL_SHA, - TLS_ECDH_ECDSA_WITH_RC4_128_SHA, - 0 /* end of list marker */ -}; - -static const ssl3CipherSuite ecdh_rsa_suites[] = { - TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_RSA_WITH_NULL_SHA, - TLS_ECDH_RSA_WITH_RC4_128_SHA, - 0 /* end of list marker */ -}; - -static const ssl3CipherSuite ecdhe_ecdsa_suites[] = { - TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - TLS_ECDHE_ECDSA_WITH_NULL_SHA, - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, - 0 /* end of list marker */ -}; - -static const ssl3CipherSuite ecdhe_rsa_suites[] = { - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, - TLS_ECDHE_RSA_WITH_NULL_SHA, - TLS_ECDHE_RSA_WITH_RC4_128_SHA, - 0 /* end of list marker */ -}; - -/* List of all ECC cipher suites */ -static const ssl3CipherSuite ecSuites[] = { - TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - TLS_ECDHE_ECDSA_WITH_NULL_SHA, - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, - TLS_ECDHE_RSA_WITH_NULL_SHA, - TLS_ECDHE_RSA_WITH_RC4_128_SHA, - TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_ECDSA_WITH_NULL_SHA, - TLS_ECDH_ECDSA_WITH_RC4_128_SHA, - TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_RSA_WITH_NULL_SHA, - TLS_ECDH_RSA_WITH_RC4_128_SHA, - 0 /* end of list marker */ -}; - -/* On this socket, Disable the ECC cipher suites in the argument's list */ -SECStatus -ssl3_DisableECCSuites(sslSocket * ss, const ssl3CipherSuite * suite) -{ - if (!suite) - suite = ecSuites; - for (; *suite; ++suite) { - SECStatus rv = ssl3_CipherPrefSet(ss, *suite, PR_FALSE); - - PORT_Assert(rv == SECSuccess); /* else is coding error */ - } - return SECSuccess; -} - -/* Look at the server certs configured on this socket, and disable any - * ECC cipher suites that are not supported by those certs. - */ -void -ssl3_FilterECCipherSuitesByServerCerts(sslSocket * ss) -{ - CERTCertificate * svrCert; - - svrCert = ss->serverCerts[kt_rsa].serverCert; - if (!svrCert) { - ssl3_DisableECCSuites(ss, ecdhe_rsa_suites); - } - - svrCert = ss->serverCerts[kt_ecdh].serverCert; - if (!svrCert) { - ssl3_DisableECCSuites(ss, ecdh_suites); - ssl3_DisableECCSuites(ss, ecdhe_ecdsa_suites); - } else { - SECOidTag sigTag = SECOID_GetAlgorithmTag(&svrCert->signature); - - switch (sigTag) { - case SEC_OID_PKCS1_RSA_ENCRYPTION: - case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION: - case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION: - case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION: - case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION: - case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION: - case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION: - case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION: - ssl3_DisableECCSuites(ss, ecdh_ecdsa_suites); - break; - case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE: - case SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE: - case SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE: - case SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE: - case SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE: - case SEC_OID_ANSIX962_ECDSA_SIGNATURE_RECOMMENDED_DIGEST: - case SEC_OID_ANSIX962_ECDSA_SIGNATURE_SPECIFIED_DIGEST: - ssl3_DisableECCSuites(ss, ecdh_rsa_suites); - break; - default: - ssl3_DisableECCSuites(ss, ecdh_suites); - break; - } - } -} - -/* Ask: is ANY ECC cipher suite enabled on this socket? */ -/* Order(N^2). Yuk. Also, this ignores export policy. */ -PRBool -ssl3_IsECCEnabled(sslSocket * ss) -{ - const ssl3CipherSuite * suite; - - for (suite = ecSuites; *suite; ++suite) { - PRBool enabled = PR_FALSE; - SECStatus rv = ssl3_CipherPrefGet(ss, *suite, &enabled); - - PORT_Assert(rv == SECSuccess); /* else is coding error */ - if (rv == SECSuccess && enabled) - return PR_TRUE; - } - return PR_FALSE; -} - -#define BE(n) 0, n - -#ifndef NSS_ECC_MORE_THAN_SUITE_B -/* Prefabricated TLS client hello extension, Elliptic Curves List, - * offers only 3 curves, the Suite B curves, 23-25 - */ -static const PRUint8 EClist[12] = { - BE(10), /* Extension type */ - BE( 8), /* octets that follow ( 3 pairs + 1 length pair) */ - BE( 6), /* octets that follow ( 3 pairs) */ - BE(23), BE(24), BE(25) -}; -#else -/* Prefabricated TLS client hello extension, Elliptic Curves List, - * offers curves 1-25. - */ -static const PRUint8 EClist[56] = { - BE(10), /* Extension type */ - BE(52), /* octets that follow (25 pairs + 1 length pair) */ - BE(50), /* octets that follow (25 pairs) */ - BE( 1), BE( 2), BE( 3), BE( 4), BE( 5), BE( 6), BE( 7), - BE( 8), BE( 9), BE(10), BE(11), BE(12), BE(13), BE(14), BE(15), - BE(16), BE(17), BE(18), BE(19), BE(20), BE(21), BE(22), BE(23), - BE(24), BE(25) -}; -#endif - -static const PRUint8 ECPtFmt[6] = { - BE(11), /* Extension type */ - BE( 2), /* octets that follow */ - 1, /* octets that follow */ - 0 /* uncompressed type only */ -}; - -/* Send our "canned" (precompiled) Supported Elliptic Curves extension, - * which says that we support all TLS-defined named curves. - */ -PRInt32 -ssl3_SendSupportedCurvesXtn( - sslSocket * ss, - PRBool append, - PRUint32 maxBytes) -{ - if (!ss || !ssl3_IsECCEnabled(ss)) - return 0; - if (append && maxBytes >= (sizeof EClist)) { - SECStatus rv = ssl3_AppendHandshake(ss, EClist, (sizeof EClist)); - if (rv != SECSuccess) - return -1; - if (!ss->sec.isServer) { - TLSExtensionData *xtnData = &ss->xtnData; - xtnData->advertised[xtnData->numAdvertised++] = - elliptic_curves_xtn; - } - } - return (sizeof EClist); -} - -/* Send our "canned" (precompiled) Supported Point Formats extension, - * which says that we only support uncompressed points. - */ -PRInt32 -ssl3_SendSupportedPointFormatsXtn( - sslSocket * ss, - PRBool append, - PRUint32 maxBytes) -{ - if (!ss || !ssl3_IsECCEnabled(ss)) - return 0; - if (append && maxBytes >= (sizeof ECPtFmt)) { - SECStatus rv = ssl3_AppendHandshake(ss, ECPtFmt, (sizeof ECPtFmt)); - if (rv != SECSuccess) - return -1; - if (!ss->sec.isServer) { - TLSExtensionData *xtnData = &ss->xtnData; - xtnData->advertised[xtnData->numAdvertised++] = - ec_point_formats_xtn; - } - } - return (sizeof ECPtFmt); -} - -/* Just make sure that the remote client supports uncompressed points, - * Since that is all we support. Disable ECC cipher suites if it doesn't. - */ -SECStatus -ssl3_HandleSupportedPointFormatsXtn(sslSocket *ss, PRUint16 ex_type, - SECItem *data) -{ - int i; - - if (data->len < 2 || data->len > 255 || !data->data || - data->len != (unsigned int)data->data[0] + 1) { - /* malformed */ - goto loser; - } - for (i = data->len; --i > 0; ) { - if (data->data[i] == 0) { - /* indicate that we should send a reply */ - SECStatus rv; - rv = ssl3_RegisterServerHelloExtensionSender(ss, ex_type, - &ssl3_SendSupportedPointFormatsXtn); - return rv; - } - } -loser: - /* evil client doesn't support uncompressed */ - ssl3_DisableECCSuites(ss, ecSuites); - return SECFailure; -} - - -#define SSL3_GET_SERVER_PUBLICKEY(sock, type) \ - (ss->serverCerts[type].serverKeyPair ? \ - ss->serverCerts[type].serverKeyPair->pubKey : NULL) - -/* Extract the TLS curve name for the public key in our EC server cert. */ -ECName ssl3_GetSvrCertCurveName(sslSocket *ss) -{ - SECKEYPublicKey *srvPublicKey; - ECName ec_curve = ec_noName; - - srvPublicKey = SSL3_GET_SERVER_PUBLICKEY(ss, kt_ecdh); - if (srvPublicKey) { - ec_curve = params2ecName(&srvPublicKey->u.ec.DEREncodedParams); - } - return ec_curve; -} - -/* Ensure that the curve in our server cert is one of the ones suppored - * by the remote client, and disable all ECC cipher suites if not. - */ -SECStatus -ssl3_HandleSupportedCurvesXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data) -{ - PRInt32 list_len; - PRUint32 peerCurves = 0; - PRUint32 mutualCurves = 0; - PRUint16 svrCertCurveName; - - if (!data->data || data->len < 4 || data->len > 65535) - goto loser; - /* get the length of elliptic_curve_list */ - list_len = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len); - if (list_len < 0 || data->len != list_len || (data->len % 2) != 0) { - /* malformed */ - goto loser; - } - /* build bit vector of peer's supported curve names */ - while (data->len) { - PRInt32 curve_name = - ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len); - if (curve_name > ec_noName && curve_name < ec_pastLastName) { - peerCurves |= (1U << curve_name); - } - } - /* What curves do we support in common? */ - mutualCurves = ss->ssl3.hs.negotiatedECCurves &= peerCurves; - if (!mutualCurves) { /* no mutually supported EC Curves */ - goto loser; - } - - /* if our ECC cert doesn't use one of these supported curves, - * disable ECC cipher suites that require an ECC cert. - */ - svrCertCurveName = ssl3_GetSvrCertCurveName(ss); - if (svrCertCurveName != ec_noName && - (mutualCurves & (1U << svrCertCurveName)) != 0) { - return SECSuccess; - } - /* Our EC cert doesn't contain a mutually supported curve. - * Disable all ECC cipher suites that require an EC cert - */ - ssl3_DisableECCSuites(ss, ecdh_ecdsa_suites); - ssl3_DisableECCSuites(ss, ecdhe_ecdsa_suites); - return SECFailure; - -loser: - /* no common curve supported */ - ssl3_DisableECCSuites(ss, ecSuites); - return SECFailure; -} - -#endif /* NSS_ENABLE_ECC */ diff --git a/security/nss/lib/ssl/ssl3ext.c b/security/nss/lib/ssl/ssl3ext.c deleted file mode 100644 index c4a7b151e..000000000 --- a/security/nss/lib/ssl/ssl3ext.c +++ /dev/null @@ -1,1268 +0,0 @@ -/* - * SSL3 Protocol - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com> and - * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories - * Nagendra Modadugu <ngm@google.com>, Google Inc. - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ - -/* TLS extension code moved here from ssl3ecc.c */ -/* $Id$ */ - -#include "nssrenam.h" -#include "nss.h" -#include "ssl.h" -#include "sslimpl.h" -#include "pk11pub.h" -#include "blapi.h" -#include "prinit.h" - -static unsigned char key_name[SESS_TICKET_KEY_NAME_LEN]; -static PK11SymKey *session_ticket_enc_key_pkcs11 = NULL; -static PK11SymKey *session_ticket_mac_key_pkcs11 = NULL; - -static unsigned char session_ticket_enc_key[32]; -static unsigned char session_ticket_mac_key[SHA256_LENGTH]; - -static PRBool session_ticket_keys_initialized = PR_FALSE; -static PRCallOnceType generate_session_keys_once; - -static PRInt32 ssl3_SendServerNameXtn(sslSocket * ss, - PRBool append, PRUint32 maxBytes); -static SECStatus ssl3_ParseEncryptedSessionTicket(sslSocket *ss, - SECItem *data, EncryptedSessionTicket *enc_session_ticket); -static SECStatus ssl3_AppendToItem(SECItem *item, const unsigned char *buf, - PRUint32 bytes); -static SECStatus ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, - PRInt32 lenSize); -static SECStatus ssl3_GetSessionTicketKeysPKCS11(sslSocket *ss, - PK11SymKey **aes_key, PK11SymKey **mac_key); -static SECStatus ssl3_GetSessionTicketKeys(const unsigned char **aes_key, - PRUint32 *aes_key_length, const unsigned char **mac_key, - PRUint32 *mac_key_length); - -/* - * Write bytes. Using this function means the SECItem structure - * cannot be freed. The caller is expected to call this function - * on a shallow copy of the structure. - */ -static SECStatus -ssl3_AppendToItem(SECItem *item, const unsigned char *buf, PRUint32 bytes) -{ - if (bytes > item->len) - return SECFailure; - - PORT_Memcpy(item->data, buf, bytes); - item->data += bytes; - item->len -= bytes; - return SECSuccess; -} - -/* - * Write a number in network byte order. Using this function means the - * SECItem structure cannot be freed. The caller is expected to call - * this function on a shallow copy of the structure. - */ -static SECStatus -ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, PRInt32 lenSize) -{ - SECStatus rv; - uint8 b[4]; - uint8 * p = b; - - switch (lenSize) { - case 4: - *p++ = (uint8) (num >> 24); - case 3: - *p++ = (uint8) (num >> 16); - case 2: - *p++ = (uint8) (num >> 8); - case 1: - *p = (uint8) num; - } - rv = ssl3_AppendToItem(item, &b[0], lenSize); - return rv; -} - -static SECStatus ssl3_SessionTicketShutdown(void* appData, void* nssData) -{ - if (session_ticket_enc_key_pkcs11) { - PK11_FreeSymKey(session_ticket_enc_key_pkcs11); - session_ticket_enc_key_pkcs11 = NULL; - } - if (session_ticket_mac_key_pkcs11) { - PK11_FreeSymKey(session_ticket_mac_key_pkcs11); - session_ticket_mac_key_pkcs11 = NULL; - } - PORT_Memset(&generate_session_keys_once, 0, - sizeof(generate_session_keys_once)); - return SECSuccess; -} - - -static PRStatus -ssl3_GenerateSessionTicketKeysPKCS11(void *data) -{ - SECStatus rv; - sslSocket *ss = (sslSocket *)data; - SECKEYPrivateKey *svrPrivKey = ss->serverCerts[kt_rsa].SERVERKEY; - SECKEYPublicKey *svrPubKey = ss->serverCerts[kt_rsa].serverKeyPair->pubKey; - - if (svrPrivKey == NULL || svrPubKey == NULL) { - SSL_DBG(("%d: SSL[%d]: Pub or priv key(s) is NULL.", - SSL_GETPID(), ss->fd)); - goto loser; - } - - /* Get a copy of the session keys from shared memory. */ - PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX, - sizeof(SESS_TICKET_KEY_NAME_PREFIX)); - if (!ssl_GetSessionTicketKeysPKCS11(svrPrivKey, svrPubKey, - ss->pkcs11PinArg, &key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN], - &session_ticket_enc_key_pkcs11, &session_ticket_mac_key_pkcs11)) - return PR_FAILURE; - - rv = NSS_RegisterShutdown(ssl3_SessionTicketShutdown, NULL); - if (rv != SECSuccess) - goto loser; - - return PR_SUCCESS; - -loser: - ssl3_SessionTicketShutdown(NULL, NULL); - return PR_FAILURE; -} - -static SECStatus -ssl3_GetSessionTicketKeysPKCS11(sslSocket *ss, PK11SymKey **aes_key, - PK11SymKey **mac_key) -{ - if (PR_CallOnceWithArg(&generate_session_keys_once, - ssl3_GenerateSessionTicketKeysPKCS11, ss) != PR_SUCCESS) - return SECFailure; - - if (session_ticket_enc_key_pkcs11 == NULL || - session_ticket_mac_key_pkcs11 == NULL) - return SECFailure; - - *aes_key = session_ticket_enc_key_pkcs11; - *mac_key = session_ticket_mac_key_pkcs11; - return SECSuccess; -} - -static PRStatus -ssl3_GenerateSessionTicketKeys(void) -{ - PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX, - sizeof(SESS_TICKET_KEY_NAME_PREFIX)); - - if (!ssl_GetSessionTicketKeys(&key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN], - session_ticket_enc_key, session_ticket_mac_key)) - return PR_FAILURE; - - session_ticket_keys_initialized = PR_TRUE; - return PR_SUCCESS; -} - -static SECStatus -ssl3_GetSessionTicketKeys(const unsigned char **aes_key, - PRUint32 *aes_key_length, const unsigned char **mac_key, - PRUint32 *mac_key_length) -{ - if (PR_CallOnce(&generate_session_keys_once, - ssl3_GenerateSessionTicketKeys) != SECSuccess) - return SECFailure; - - if (!session_ticket_keys_initialized) - return SECFailure; - - *aes_key = session_ticket_enc_key; - *aes_key_length = sizeof(session_ticket_enc_key); - *mac_key = session_ticket_mac_key; - *mac_key_length = sizeof(session_ticket_mac_key); - - return SECSuccess; -} - -/* Table of handlers for received TLS hello extensions, one per extension. - * In the second generation, this table will be dynamic, and functions - * will be registered here. - */ -static const ssl3HelloExtensionHandler clientHelloHandlers[] = { - { server_name_xtn, &ssl3_HandleServerNameXtn }, -#ifdef NSS_ENABLE_ECC - { elliptic_curves_xtn, &ssl3_HandleSupportedCurvesXtn }, - { ec_point_formats_xtn, &ssl3_HandleSupportedPointFormatsXtn }, -#endif - { session_ticket_xtn, &ssl3_ServerHandleSessionTicketXtn }, - { -1, NULL } -}; - -static const ssl3HelloExtensionHandler serverHelloHandlers[] = { - { server_name_xtn, &ssl3_HandleServerNameXtn }, - /* TODO: add a handler for ec_point_formats_xtn */ - { session_ticket_xtn, &ssl3_ClientHandleSessionTicketXtn }, - { -1, NULL } -}; - -/* Table of functions to format TLS hello extensions, one per extension. - * This static table is for the formatting of client hello extensions. - * The server's table of hello senders is dynamic, in the socket struct, - * and sender functions are registered there. - */ -static const -ssl3HelloExtensionSender clientHelloSenders[MAX_EXTENSIONS] = { - { server_name_xtn, &ssl3_SendServerNameXtn }, -#ifdef NSS_ENABLE_ECC - { elliptic_curves_xtn, &ssl3_SendSupportedCurvesXtn }, - { ec_point_formats_xtn, &ssl3_SendSupportedPointFormatsXtn }, -#else - { -1, NULL }, - { -1, NULL }, -#endif - { session_ticket_xtn, ssl3_SendSessionTicketXtn } -}; - -static PRBool -arrayContainsExtension(const PRUint16 *array, PRUint32 len, PRUint16 ex_type) -{ - int i; - for (i = 0; i < len; i++) { - if (ex_type == array[i]) - return PR_TRUE; - } - return PR_FALSE; -} - -PRBool -ssl3_ExtensionNegotiated(sslSocket *ss, PRUint16 ex_type) { - TLSExtensionData *xtnData = &ss->xtnData; - return arrayContainsExtension(xtnData->negotiated, - xtnData->numNegotiated, ex_type); -} - -static PRBool -ssl3_ClientExtensionAdvertised(sslSocket *ss, PRUint16 ex_type) { - TLSExtensionData *xtnData = &ss->xtnData; - return arrayContainsExtension(xtnData->advertised, - xtnData->numAdvertised, ex_type); -} - -/* Format an SNI extension, using the name from the socket's URL, - * unless that name is a dotted decimal string. - */ -static PRInt32 -ssl3_SendServerNameXtn( - sslSocket * ss, - PRBool append, - PRUint32 maxBytes) -{ - PRUint32 len; - PRNetAddr netAddr; - - /* must have a hostname */ - if (!ss || !ss->url || !ss->url[0]) - return 0; - /* must not be an IPv4 or IPv6 address */ - if (PR_SUCCESS == PR_StringToNetAddr(ss->url, &netAddr)) { - /* is an IP address (v4 or v6) */ - return 0; - } - len = PORT_Strlen(ss->url); - if (append && maxBytes >= len + 9) { - SECStatus rv; - /* extension_type */ - rv = ssl3_AppendHandshakeNumber(ss, server_name_xtn, 2); - if (rv != SECSuccess) return -1; - /* length of extension_data */ - rv = ssl3_AppendHandshakeNumber(ss, len + 5, 2); - if (rv != SECSuccess) return -1; - /* length of server_name_list */ - rv = ssl3_AppendHandshakeNumber(ss, len + 3, 2); - if (rv != SECSuccess) return -1; - /* Name Type (host_name) */ - rv = ssl3_AppendHandshake(ss, "\0", 1); - if (rv != SECSuccess) return -1; - /* HostName (length and value) */ - rv = ssl3_AppendHandshakeVariable(ss, (unsigned char *)ss->url, len, 2); - if (rv != SECSuccess) return -1; - if (!ss->sec.isServer) { - TLSExtensionData *xtnData = &ss->xtnData; - xtnData->advertised[xtnData->numAdvertised++] = server_name_xtn; - } - } - return len + 9; -} - -/* handle an incoming SNI extension, by ignoring it. */ -SECStatus -ssl3_HandleServerNameXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data) -{ - /* TODO: if client, should verify extension_data is empty. */ - /* TODO: if server, should send empty extension_data. */ - /* For now, we ignore this, as if we didn't understand it. :-) */ - return SECSuccess; -} - -/* Called by both clients and servers. - * Clients sends a filled in session ticket if one is available, and otherwise - * sends an empty ticket. Servers always send empty tickets. - */ -PRInt32 -ssl3_SendSessionTicketXtn( - sslSocket * ss, - PRBool append, - PRUint32 maxBytes) -{ - PRInt32 extension_length; - NewSessionTicket *session_ticket = NULL; - - /* Ignore the SessionTicket extension if processing is disabled. */ - if (!ss->opt.enableSessionTickets) - return 0; - - /* Empty extension length = extension_type (2-bytes) + - * length(extension_data) (2-bytes) - */ - extension_length = 4; - - /* If we are a client then send a session ticket if one is availble. - * Servers that support the extension and are willing to negotiate the - * the extension always respond with an empty extension. - */ - if (!ss->sec.isServer) { - sslSessionID *sid = ss->sec.ci.sid; - session_ticket = &sid->u.ssl3.sessionTicket; - if (session_ticket->ticket.data) { - if (ss->xtnData.ticketTimestampVerified) { - extension_length += session_ticket->ticket.len; - } else if (!append && - (session_ticket->ticket_lifetime_hint == 0 || - (session_ticket->ticket_lifetime_hint + - session_ticket->received_timestamp > ssl_Time()))) { - extension_length += session_ticket->ticket.len; - ss->xtnData.ticketTimestampVerified = PR_TRUE; - } - } - } - - if (append && maxBytes >= extension_length) { - SECStatus rv; - /* extension_type */ - rv = ssl3_AppendHandshakeNumber(ss, session_ticket_xtn, 2); - if (rv != SECSuccess) - goto loser; - if (session_ticket && session_ticket->ticket.data && - ss->xtnData.ticketTimestampVerified) { - rv = ssl3_AppendHandshakeVariable(ss, session_ticket->ticket.data, - session_ticket->ticket.len, 2); - ss->xtnData.ticketTimestampVerified = PR_FALSE; - } else { - rv = ssl3_AppendHandshakeNumber(ss, 0, 2); - } - if (rv != SECSuccess) - goto loser; - - if (!ss->sec.isServer) { - TLSExtensionData *xtnData = &ss->xtnData; - xtnData->advertised[xtnData->numAdvertised++] = session_ticket_xtn; - } - } else if (maxBytes < extension_length) { - PORT_Assert(0); - return 0; - } - return extension_length; - - loser: - ss->xtnData.ticketTimestampVerified = PR_FALSE; - return -1; -} - -/* - * NewSessionTicket - * Called from ssl3_HandleFinished - */ -SECStatus -ssl3_SendNewSessionTicket(sslSocket *ss) -{ - int i; - SECStatus rv; - NewSessionTicket ticket; - SECItem plaintext; - SECItem plaintext_item = {0, NULL, 0}; - SECItem ciphertext = {0, NULL, 0}; - PRUint32 ciphertext_length; - PRBool ms_is_wrapped; - unsigned char wrapped_ms[SSL3_MASTER_SECRET_LENGTH]; - SECItem ms_item = {0, NULL, 0}; - SSL3KEAType effectiveExchKeyType = ssl_kea_null; - PRUint32 padding_length; - PRUint32 message_length; - PRUint32 cert_length; - uint8 length_buf[4]; - PRUint32 now; - PK11SymKey *aes_key_pkcs11; - PK11SymKey *mac_key_pkcs11; - const unsigned char *aes_key; - const unsigned char *mac_key; - PRUint32 aes_key_length; - PRUint32 mac_key_length; - PRUint64 aes_ctx_buf[MAX_CIPHER_CONTEXT_LLONGS]; - AESContext *aes_ctx; - CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC; - PK11Context *aes_ctx_pkcs11; - const SECHashObject *hashObj = NULL; - PRUint64 hmac_ctx_buf[MAX_MAC_CONTEXT_LLONGS]; - HMACContext *hmac_ctx; - CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC; - PK11Context *hmac_ctx_pkcs11; - unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH]; - unsigned int computed_mac_length; - unsigned char iv[AES_BLOCK_SIZE]; - SECItem ivItem; - CK_MECHANISM_TYPE msWrapMech = 0; /* dummy default value, - * must be >= 0 */ - - SSL_TRC(3, ("%d: SSL3[%d]: send session_ticket handshake", - SSL_GETPID(), ss->fd)); - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); - - ticket.ticket_lifetime_hint = TLS_EX_SESS_TICKET_LIFETIME_HINT; - cert_length = (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) ? - 3 + ss->sec.ci.sid->peerCert->derCert.len : 0; - - /* Get IV and encryption keys */ - ivItem.data = iv; - ivItem.len = sizeof(iv); - rv = PK11_GenerateRandom(iv, sizeof(iv)); - if (rv != SECSuccess) goto loser; - - if (ss->opt.bypassPKCS11) { - rv = ssl3_GetSessionTicketKeys(&aes_key, &aes_key_length, - &mac_key, &mac_key_length); - } else { - rv = ssl3_GetSessionTicketKeysPKCS11(ss, &aes_key_pkcs11, - &mac_key_pkcs11); - } - if (rv != SECSuccess) goto loser; - - if (ss->ssl3.pwSpec->msItem.len && ss->ssl3.pwSpec->msItem.data) { - /* The master secret is available unwrapped. */ - ms_item.data = ss->ssl3.pwSpec->msItem.data; - ms_item.len = ss->ssl3.pwSpec->msItem.len; - ms_is_wrapped = PR_FALSE; - } else { - /* Extract the master secret wrapped. */ - sslSessionID sid; - PORT_Memset(&sid, 0, sizeof(sslSessionID)); - - if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) { - effectiveExchKeyType = kt_rsa; - } else { - effectiveExchKeyType = ss->ssl3.hs.kea_def->exchKeyType; - } - - rv = ssl3_CacheWrappedMasterSecret(ss, &sid, ss->ssl3.pwSpec, - effectiveExchKeyType); - if (rv == SECSuccess) { - if (sid.u.ssl3.keys.wrapped_master_secret_len > sizeof(wrapped_ms)) - goto loser; - memcpy(wrapped_ms, sid.u.ssl3.keys.wrapped_master_secret, - sid.u.ssl3.keys.wrapped_master_secret_len); - ms_item.data = wrapped_ms; - ms_item.len = sid.u.ssl3.keys.wrapped_master_secret_len; - msWrapMech = sid.u.ssl3.masterWrapMech; - } else { - /* TODO: else send an empty ticket. */ - goto loser; - } - ms_is_wrapped = PR_TRUE; - } - - ciphertext_length = - sizeof(PRUint16) /* ticket_version */ - + sizeof(SSL3ProtocolVersion) /* ssl_version */ - + sizeof(ssl3CipherSuite) /* ciphersuite */ - + 1 /* compression */ - + 10 /* cipher spec parameters */ - + 1 /* SessionTicket.ms_is_wrapped */ - + 1 /* effectiveExchKeyType */ - + 4 /* msWrapMech */ - + 2 /* master_secret.length */ - + ms_item.len /* master_secret */ - + 1 /* client_auth_type */ - + cert_length /* cert */ - + sizeof(ticket.ticket_lifetime_hint); - padding_length = AES_BLOCK_SIZE - - (ciphertext_length % AES_BLOCK_SIZE); - ciphertext_length += padding_length; - - message_length = - sizeof(ticket.ticket_lifetime_hint) /* ticket_lifetime_hint */ - + 2 /* length field for NewSessionTicket.ticket */ - + SESS_TICKET_KEY_NAME_LEN /* key_name */ - + AES_BLOCK_SIZE /* iv */ - + 2 /* length field for NewSessionTicket.ticket.encrypted_state */ - + ciphertext_length /* encrypted_state */ - + TLS_EX_SESS_TICKET_MAC_LENGTH; /* mac */ - - if (SECITEM_AllocItem(NULL, &plaintext_item, ciphertext_length) == NULL) - goto loser; - - plaintext = plaintext_item; - - /* ticket_version */ - rv = ssl3_AppendNumberToItem(&plaintext, TLS_EX_SESS_TICKET_VERSION, - sizeof(PRUint16)); - if (rv != SECSuccess) goto loser; - - /* ssl_version */ - rv = ssl3_AppendNumberToItem(&plaintext, ss->version, - sizeof(SSL3ProtocolVersion)); - if (rv != SECSuccess) goto loser; - - /* ciphersuite */ - rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.cipher_suite, - sizeof(ssl3CipherSuite)); - if (rv != SECSuccess) goto loser; - - /* compression */ - rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.compression, 1); - if (rv != SECSuccess) goto loser; - - /* cipher spec parameters */ - rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authAlgorithm, 1); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authKeyBits, 4); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaType, 1); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaKeyBits, 4); - if (rv != SECSuccess) goto loser; - - /* master_secret */ - rv = ssl3_AppendNumberToItem(&plaintext, ms_is_wrapped, 1); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, effectiveExchKeyType, 1); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, msWrapMech, 4); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, ms_item.len, 2); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendToItem(&plaintext, ms_item.data, ms_item.len); - if (rv != SECSuccess) goto loser; - - /* client_identity */ - if (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) { - rv = ssl3_AppendNumberToItem(&plaintext, CLIENT_AUTH_CERTIFICATE, 1); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendNumberToItem(&plaintext, - ss->sec.ci.sid->peerCert->derCert.len, 3); - if (rv != SECSuccess) goto loser; - rv = ssl3_AppendToItem(&plaintext, - ss->sec.ci.sid->peerCert->derCert.data, - ss->sec.ci.sid->peerCert->derCert.len); - if (rv != SECSuccess) goto loser; - } else { - rv = ssl3_AppendNumberToItem(&plaintext, 0, 1); - if (rv != SECSuccess) goto loser; - } - - /* timestamp */ - now = ssl_Time(); - rv = ssl3_AppendNumberToItem(&plaintext, now, - sizeof(ticket.ticket_lifetime_hint)); - if (rv != SECSuccess) goto loser; - - PORT_Assert(plaintext.len == padding_length); - for (i = 0; i < padding_length; i++) - plaintext.data[i] = (unsigned char)padding_length; - - if (SECITEM_AllocItem(NULL, &ciphertext, ciphertext_length) == NULL) { - rv = SECFailure; - goto loser; - } - - /* Generate encrypted portion of ticket. */ - if (ss->opt.bypassPKCS11) { - aes_ctx = (AESContext *)aes_ctx_buf; - rv = AES_InitContext(aes_ctx, aes_key, aes_key_length, iv, - NSS_AES_CBC, 1, AES_BLOCK_SIZE); - if (rv != SECSuccess) goto loser; - - rv = AES_Encrypt(aes_ctx, ciphertext.data, &ciphertext.len, - ciphertext.len, plaintext_item.data, - plaintext_item.len); - if (rv != SECSuccess) goto loser; - } else { - aes_ctx_pkcs11 = PK11_CreateContextBySymKey(cipherMech, - CKA_ENCRYPT, aes_key_pkcs11, &ivItem); - if (!aes_ctx_pkcs11) - goto loser; - - rv = PK11_CipherOp(aes_ctx_pkcs11, ciphertext.data, - (int *)&ciphertext.len, ciphertext.len, - plaintext_item.data, plaintext_item.len); - PK11_Finalize(aes_ctx_pkcs11); - PK11_DestroyContext(aes_ctx_pkcs11, PR_TRUE); - if (rv != SECSuccess) goto loser; - } - - /* Convert ciphertext length to network order. */ - length_buf[0] = (ciphertext.len >> 8) & 0xff; - length_buf[1] = (ciphertext.len ) & 0xff; - - /* Compute MAC. */ - if (ss->opt.bypassPKCS11) { - hmac_ctx = (HMACContext *)hmac_ctx_buf; - hashObj = HASH_GetRawHashObject(HASH_AlgSHA256); - if (HMAC_Init(hmac_ctx, hashObj, mac_key, - mac_key_length, PR_FALSE) != SECSuccess) - goto loser; - - HMAC_Begin(hmac_ctx); - HMAC_Update(hmac_ctx, key_name, SESS_TICKET_KEY_NAME_LEN); - HMAC_Update(hmac_ctx, iv, sizeof(iv)); - HMAC_Update(hmac_ctx, (unsigned char *)length_buf, 2); - HMAC_Update(hmac_ctx, ciphertext.data, ciphertext.len); - HMAC_Finish(hmac_ctx, computed_mac, &computed_mac_length, - sizeof(computed_mac)); - } else { - SECItem macParam; - macParam.data = NULL; - macParam.len = 0; - hmac_ctx_pkcs11 = PK11_CreateContextBySymKey(macMech, - CKA_SIGN, mac_key_pkcs11, &macParam); - if (!hmac_ctx_pkcs11) - goto loser; - - rv = PK11_DigestBegin(hmac_ctx_pkcs11); - rv = PK11_DigestOp(hmac_ctx_pkcs11, key_name, - SESS_TICKET_KEY_NAME_LEN); - rv = PK11_DigestOp(hmac_ctx_pkcs11, iv, sizeof(iv)); - rv = PK11_DigestOp(hmac_ctx_pkcs11, (unsigned char *)length_buf, 2); - rv = PK11_DigestOp(hmac_ctx_pkcs11, ciphertext.data, ciphertext.len); - rv = PK11_DigestFinal(hmac_ctx_pkcs11, computed_mac, - &computed_mac_length, sizeof(computed_mac)); - PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE); - if (rv != SECSuccess) goto loser; - } - - /* Serialize the handshake message. */ - rv = ssl3_AppendHandshakeHeader(ss, new_session_ticket, message_length); - if (rv != SECSuccess) goto loser; - - rv = ssl3_AppendHandshakeNumber(ss, ticket.ticket_lifetime_hint, - sizeof(ticket.ticket_lifetime_hint)); - if (rv != SECSuccess) goto loser; - - rv = ssl3_AppendHandshakeNumber(ss, - message_length - sizeof(ticket.ticket_lifetime_hint) - 2, 2); - if (rv != SECSuccess) goto loser; - - rv = ssl3_AppendHandshake(ss, key_name, SESS_TICKET_KEY_NAME_LEN); - if (rv != SECSuccess) goto loser; - - rv = ssl3_AppendHandshake(ss, iv, sizeof(iv)); - if (rv != SECSuccess) goto loser; - - rv = ssl3_AppendHandshakeVariable(ss, ciphertext.data, ciphertext.len, 2); - if (rv != SECSuccess) goto loser; - - rv = ssl3_AppendHandshake(ss, computed_mac, computed_mac_length); - if (rv != SECSuccess) goto loser; - -loser: - if (plaintext_item.data) - SECITEM_FreeItem(&plaintext_item, PR_FALSE); - if (ciphertext.data) - SECITEM_FreeItem(&ciphertext, PR_FALSE); - - return rv; -} - -/* When a client receives a SessionTicket extension a NewSessionTicket - * message is expected during the handshake. - */ -SECStatus -ssl3_ClientHandleSessionTicketXtn(sslSocket *ss, PRUint16 ex_type, - SECItem *data) -{ - if (data->len != 0) - return SECFailure; - - /* Keep track of negotiated extensions. */ - ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type; - return SECSuccess; -} - -SECStatus -ssl3_ServerHandleSessionTicketXtn(sslSocket *ss, PRUint16 ex_type, - SECItem *data) -{ - SECStatus rv; - SECItem *decrypted_state = NULL; - SessionTicket *parsed_session_ticket = NULL; - sslSessionID *sid = NULL; - SSL3Statistics *ssl3stats; - - /* Ignore the SessionTicket extension if processing is disabled. */ - if (!ss->opt.enableSessionTickets) - return SECSuccess; - - /* Keep track of negotiated extensions. */ - ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type; - - /* Parse the received ticket sent in by the client. We are - * lenient about some parse errors, falling back to a fullshake - * instead of terminating the current connection. - */ - if (data->len == 0) { - ss->xtnData.emptySessionTicket = PR_TRUE; - } else { - int i; - SECItem extension_data; - EncryptedSessionTicket enc_session_ticket; - unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH]; - unsigned int computed_mac_length; - const SECHashObject *hashObj; - const unsigned char *aes_key; - const unsigned char *mac_key; - PK11SymKey *aes_key_pkcs11; - PK11SymKey *mac_key_pkcs11; - PRUint32 aes_key_length; - PRUint32 mac_key_length; - PRUint64 hmac_ctx_buf[MAX_MAC_CONTEXT_LLONGS]; - HMACContext *hmac_ctx; - PK11Context *hmac_ctx_pkcs11; - CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC; - PRUint64 aes_ctx_buf[MAX_CIPHER_CONTEXT_LLONGS]; - AESContext *aes_ctx; - PK11Context *aes_ctx_pkcs11; - CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC; - unsigned char * padding; - PRUint32 padding_length; - unsigned char *buffer; - unsigned int buffer_len; - PRInt32 temp; - SECItem cert_item; - - /* Turn off stateless session resumption if the client sends a - * SessionTicket extension, even if the extension turns out to be - * malformed (ss->sec.ci.sid is non-NULL when doing session - * renegotiation.) - */ - if (ss->sec.ci.sid != NULL) { - ss->sec.uncache(ss->sec.ci.sid); - ssl_FreeSID(ss->sec.ci.sid); - ss->sec.ci.sid = NULL; - } - - extension_data.data = data->data; /* Keep a copy for future use. */ - extension_data.len = data->len; - - if (ssl3_ParseEncryptedSessionTicket(ss, data, &enc_session_ticket) - != SECSuccess) - return SECFailure; - - /* Get session ticket keys. */ - if (ss->opt.bypassPKCS11) { - rv = ssl3_GetSessionTicketKeys(&aes_key, &aes_key_length, - &mac_key, &mac_key_length); - } else { - rv = ssl3_GetSessionTicketKeysPKCS11(ss, &aes_key_pkcs11, - &mac_key_pkcs11); - } - if (rv != SECSuccess) { - SSL_DBG(("%d: SSL[%d]: Unable to get/generate session ticket keys.", - SSL_GETPID(), ss->fd)); - goto loser; - } - - /* If the ticket sent by the client was generated under a key different - * from the one we have, bypass ticket processing. - */ - if (PORT_Memcmp(enc_session_ticket.key_name, key_name, - SESS_TICKET_KEY_NAME_LEN) != 0) { - SSL_DBG(("%d: SSL[%d]: Session ticket key_name sent mismatch.", - SSL_GETPID(), ss->fd)); - goto no_ticket; - } - - /* Verify the MAC on the ticket. MAC verification may also - * fail if the MAC key has been recently refreshed. - */ - if (ss->opt.bypassPKCS11) { - hmac_ctx = (HMACContext *)hmac_ctx_buf; - hashObj = HASH_GetRawHashObject(HASH_AlgSHA256); - if (HMAC_Init(hmac_ctx, hashObj, mac_key, - sizeof(session_ticket_mac_key), PR_FALSE) != SECSuccess) - goto no_ticket; - HMAC_Begin(hmac_ctx); - HMAC_Update(hmac_ctx, extension_data.data, - extension_data.len - TLS_EX_SESS_TICKET_MAC_LENGTH); - if (HMAC_Finish(hmac_ctx, computed_mac, &computed_mac_length, - sizeof(computed_mac)) != SECSuccess) - goto no_ticket; - } else { - SECItem macParam; - macParam.data = NULL; - macParam.len = 0; - hmac_ctx_pkcs11 = PK11_CreateContextBySymKey(macMech, - CKA_SIGN, mac_key_pkcs11, &macParam); - if (!hmac_ctx_pkcs11) { - SSL_DBG(("%d: SSL[%d]: Unable to create HMAC context: %d.", - SSL_GETPID(), ss->fd, PORT_GetError())); - goto no_ticket; - } else { - SSL_DBG(("%d: SSL[%d]: Successfully created HMAC context.", - SSL_GETPID(), ss->fd)); - } - rv = PK11_DigestBegin(hmac_ctx_pkcs11); - rv = PK11_DigestOp(hmac_ctx_pkcs11, extension_data.data, - extension_data.len - TLS_EX_SESS_TICKET_MAC_LENGTH); - if (rv != SECSuccess) { - PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE); - goto no_ticket; - } - rv = PK11_DigestFinal(hmac_ctx_pkcs11, computed_mac, - &computed_mac_length, sizeof(computed_mac)); - PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE); - if (rv != SECSuccess) - goto no_ticket; - } - if (PORT_Memcmp(computed_mac, enc_session_ticket.mac, - computed_mac_length) != 0) { - SSL_DBG(("%d: SSL[%d]: Session ticket MAC mismatch.", - SSL_GETPID(), ss->fd)); - goto no_ticket; - } - - /* We ignore key_name for now. - * This is ok as MAC verification succeeded. - */ - - /* Decrypt the ticket. */ - - /* Plaintext is shorter than the ciphertext due to padding. */ - decrypted_state = SECITEM_AllocItem(NULL, NULL, - enc_session_ticket.encrypted_state.len); - - if (ss->opt.bypassPKCS11) { - aes_ctx = (AESContext *)aes_ctx_buf; - rv = AES_InitContext(aes_ctx, aes_key, - sizeof(session_ticket_enc_key), enc_session_ticket.iv, - NSS_AES_CBC, 0,AES_BLOCK_SIZE); - if (rv != SECSuccess) { - SSL_DBG(("%d: SSL[%d]: Unable to create AES context.", - SSL_GETPID(), ss->fd)); - goto no_ticket; - } - - rv = AES_Decrypt(aes_ctx, decrypted_state->data, - &decrypted_state->len, decrypted_state->len, - enc_session_ticket.encrypted_state.data, - enc_session_ticket.encrypted_state.len); - if (rv != SECSuccess) - goto no_ticket; - } else { - SECItem ivItem; - ivItem.data = enc_session_ticket.iv; - ivItem.len = AES_BLOCK_SIZE; - aes_ctx_pkcs11 = PK11_CreateContextBySymKey(cipherMech, - CKA_DECRYPT, aes_key_pkcs11, &ivItem); - if (!aes_ctx_pkcs11) { - SSL_DBG(("%d: SSL[%d]: Unable to create AES context.", - SSL_GETPID(), ss->fd)); - goto no_ticket; - } - - rv = PK11_CipherOp(aes_ctx_pkcs11, decrypted_state->data, - (int *)&decrypted_state->len, decrypted_state->len, - enc_session_ticket.encrypted_state.data, - enc_session_ticket.encrypted_state.len); - PK11_Finalize(aes_ctx_pkcs11); - PK11_DestroyContext(aes_ctx_pkcs11, PR_TRUE); - if (rv != SECSuccess) - goto no_ticket; - } - - /* Check padding. */ - padding_length = - (PRUint32)decrypted_state->data[decrypted_state->len - 1]; - if (padding_length == 0 || padding_length > AES_BLOCK_SIZE) - goto no_ticket; - - padding = &decrypted_state->data[decrypted_state->len - padding_length]; - for (i = 0; i < padding_length; i++, padding++) { - if (padding_length != (PRUint32)*padding) - goto no_ticket; - } - - /* Deserialize session state. */ - buffer = decrypted_state->data; - buffer_len = decrypted_state->len; - - parsed_session_ticket = PORT_ZAlloc(sizeof(SessionTicket)); - if (parsed_session_ticket == NULL) { - rv = SECFailure; - goto loser; - } - - /* Read ticket_version (which is ignored for now.) */ - temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->ticket_version = (SSL3ProtocolVersion)temp; - - /* Read SSLVersion. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->ssl_version = (SSL3ProtocolVersion)temp; - - /* Read cipher_suite. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->cipher_suite = (ssl3CipherSuite)temp; - - /* Read compression_method. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->compression_method = (SSL3CompressionMethod)temp; - - /* Read cipher spec parameters. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->authAlgorithm = (SSLSignType)temp; - temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->authKeyBits = (PRUint32)temp; - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->keaType = (SSLKEAType)temp; - temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->keaKeyBits = (PRUint32)temp; - - /* Read wrapped master_secret. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->ms_is_wrapped = (PRBool)temp; - - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->exchKeyType = (SSL3KEAType)temp; - - temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->msWrapMech = (CK_MECHANISM_TYPE)temp; - - temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); - if (temp < 0) goto no_ticket; - parsed_session_ticket->ms_length = (PRUint16)temp; - if (parsed_session_ticket->ms_length == 0 || /* sanity check MS. */ - parsed_session_ticket->ms_length > - sizeof(parsed_session_ticket->master_secret)) - goto no_ticket; - - /* Allow for the wrapped master secret to be longer. */ - if (buffer_len < sizeof(SSL3_MASTER_SECRET_LENGTH)) - goto no_ticket; - PORT_Memcpy(parsed_session_ticket->master_secret, buffer, - parsed_session_ticket->ms_length); - buffer += parsed_session_ticket->ms_length; - buffer_len -= parsed_session_ticket->ms_length; - - /* Read client_identity */ - temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); - if (temp < 0) - goto no_ticket; - parsed_session_ticket->client_identity.client_auth_type = - (ClientAuthenticationType)temp; - switch(parsed_session_ticket->client_identity.client_auth_type) { - case CLIENT_AUTH_ANONYMOUS: - break; - case CLIENT_AUTH_CERTIFICATE: - rv = ssl3_ConsumeHandshakeVariable(ss, &cert_item, 3, - &buffer, &buffer_len); - if (rv != SECSuccess) goto no_ticket; - rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->peer_cert, - &cert_item); - if (rv != SECSuccess) goto no_ticket; - break; - default: - goto no_ticket; - } - /* Read timestamp. */ - temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); - if (temp < 0) - goto no_ticket; - parsed_session_ticket->timestamp = (PRUint32)temp; - - /* Done parsing. Check that all bytes have been consumed. */ - if (buffer_len != padding_length) - goto no_ticket; - - /* Use the ticket if it has not expired, otherwise free the allocated - * memory since the ticket is of no use. - */ - if (parsed_session_ticket->timestamp != 0 && - parsed_session_ticket->timestamp + - TLS_EX_SESS_TICKET_LIFETIME_HINT > ssl_Time()) { - - sid = ssl3_NewSessionID(ss, PR_TRUE); - if (sid == NULL) { - rv = SECFailure; - goto loser; - } - - /* Copy over parameters. */ - sid->version = parsed_session_ticket->ssl_version; - sid->u.ssl3.cipherSuite = parsed_session_ticket->cipher_suite; - sid->u.ssl3.compression = parsed_session_ticket->compression_method; - sid->authAlgorithm = parsed_session_ticket->authAlgorithm; - sid->authKeyBits = parsed_session_ticket->authKeyBits; - sid->keaType = parsed_session_ticket->keaType; - sid->keaKeyBits = parsed_session_ticket->keaKeyBits; - - /* Copy master secret. */ - if (ss->opt.bypassPKCS11 && - parsed_session_ticket->ms_is_wrapped) - goto no_ticket; - if (parsed_session_ticket->ms_length > - sizeof(sid->u.ssl3.keys.wrapped_master_secret)) - goto no_ticket; - PORT_Memcpy(sid->u.ssl3.keys.wrapped_master_secret, - parsed_session_ticket->master_secret, - parsed_session_ticket->ms_length); - sid->u.ssl3.keys.wrapped_master_secret_len = - parsed_session_ticket->ms_length; - sid->u.ssl3.exchKeyType = parsed_session_ticket->exchKeyType; - sid->u.ssl3.masterWrapMech = parsed_session_ticket->msWrapMech; - sid->u.ssl3.keys.msIsWrapped = - parsed_session_ticket->ms_is_wrapped; - sid->u.ssl3.masterValid = PR_TRUE; - sid->u.ssl3.keys.resumable = PR_TRUE; - - /* Copy over client cert from session ticket if there is one. */ - if (parsed_session_ticket->peer_cert.data != NULL) { - if (sid->peerCert != NULL) - CERT_DestroyCertificate(sid->peerCert); - sid->peerCert = CERT_NewTempCertificate(ss->dbHandle, - &parsed_session_ticket->peer_cert, NULL, PR_FALSE, PR_TRUE); - if (sid->peerCert == NULL) { - rv = SECFailure; - goto loser; - } - } - ss->statelessResume = PR_TRUE; - ss->sec.ci.sid = sid; - } - } - - if (0) { -no_ticket: - SSL_DBG(("%d: SSL[%d]: Session ticket parsing failed.", - SSL_GETPID(), ss->fd)); - ssl3stats = SSL_GetStatistics(); - SSL_AtomicIncrementLong(& ssl3stats->hch_sid_ticket_parse_failures ); - if (sid) { - ssl_FreeSID(sid); - sid = NULL; - } - } - rv = SECSuccess; - -loser: - if (decrypted_state != NULL) { - SECITEM_FreeItem(decrypted_state, PR_TRUE); - decrypted_state = NULL; - } - - if (parsed_session_ticket != NULL) { - if (parsed_session_ticket->peer_cert.data) { - SECITEM_FreeItem(&parsed_session_ticket->peer_cert, PR_FALSE); - } - PORT_ZFree(parsed_session_ticket, sizeof(SessionTicket)); - } - - return rv; -} - -/* - * Read bytes. Using this function means the SECItem structure - * cannot be freed. The caller is expected to call this function - * on a shallow copy of the structure. - */ -static SECStatus -ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes) -{ - if (bytes > item->len) - return SECFailure; - - *buf = item->data; - item->data += bytes; - item->len -= bytes; - return SECSuccess; -} - -static SECStatus -ssl3_ParseEncryptedSessionTicket(sslSocket *ss, SECItem *data, - EncryptedSessionTicket *enc_session_ticket) -{ - if (ssl3_ConsumeFromItem(data, &enc_session_ticket->key_name, - SESS_TICKET_KEY_NAME_LEN) != SECSuccess) - return SECFailure; - if (ssl3_ConsumeFromItem(data, &enc_session_ticket->iv, - AES_BLOCK_SIZE) != SECSuccess) - return SECFailure; - if (ssl3_ConsumeHandshakeVariable(ss, &enc_session_ticket->encrypted_state, - 2, &data->data, &data->len) != SECSuccess) - return SECFailure; - if (ssl3_ConsumeFromItem(data, &enc_session_ticket->mac, - TLS_EX_SESS_TICKET_MAC_LENGTH) != SECSuccess) - return SECFailure; - if (data->len != 0) /* Make sure that we have consumed all bytes. */ - return SECFailure; - - return SECSuccess; -} - -/* go through hello extensions in buffer "b". - * For each one, find the extension handler in the table, and - * if present, invoke that handler. - * Servers ignore any extensions with unknown extension types. - * Clients reject any extensions with unadvertised extension types. - */ -SECStatus -ssl3_HandleHelloExtensions(sslSocket *ss, SSL3Opaque **b, PRUint32 *length) -{ - const ssl3HelloExtensionHandler * handlers = - ss->sec.isServer ? clientHelloHandlers : serverHelloHandlers; - - while (*length) { - const ssl3HelloExtensionHandler * handler; - SECStatus rv; - PRInt32 extension_type; - SECItem extension_data; - - /* Get the extension's type field */ - extension_type = ssl3_ConsumeHandshakeNumber(ss, 2, b, length); - if (extension_type < 0) /* failure to decode extension_type */ - return SECFailure; /* alert already sent */ - - /* get the data for this extension, so we can pass it or skip it. */ - rv = ssl3_ConsumeHandshakeVariable(ss, &extension_data, 2, b, length); - if (rv != SECSuccess) - return rv; - - /* Check whether the server sent an extension which was not advertised - * in the ClientHello. - */ - if (!ss->sec.isServer && - !ssl3_ClientExtensionAdvertised(ss, extension_type)) - return SECFailure; /* TODO: send unsupported_extension alert */ - - /* Check whether an extension has been sent multiple times. */ - if (ssl3_ExtensionNegotiated(ss, extension_type)) - return SECFailure; - - /* find extension_type in table of Hello Extension Handlers */ - for (handler = handlers; handler->ex_type >= 0; handler++) { - /* if found, call this handler */ - if (handler->ex_type == extension_type) { - rv = (*handler->ex_handler)(ss, (PRUint16)extension_type, - &extension_data); - /* Ignore this result */ - /* Treat all bad extensions as unrecognized types. */ - break; - } - } - } - return SECSuccess; -} - -/* Add a callback function to the table of senders of server hello extensions. - */ -SECStatus -ssl3_RegisterServerHelloExtensionSender(sslSocket *ss, PRUint16 ex_type, - ssl3HelloExtensionSenderFunc cb) -{ - int i; - ssl3HelloExtensionSender *sender = &ss->xtnData.serverSenders[0]; - - for (i = 0; i < MAX_EXTENSIONS; ++i, ++sender) { - if (!sender->ex_sender) { - sender->ex_type = ex_type; - sender->ex_sender = cb; - return SECSuccess; - } - /* detect duplicate senders */ - PORT_Assert(sender->ex_type != ex_type); - if (sender->ex_type == ex_type) { - /* duplicate */ - break; - } - } - PORT_Assert(i < MAX_EXTENSIONS); /* table needs to grow */ - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - return SECFailure; -} - -/* call each of the extension senders and return the accumulated length */ -PRInt32 -ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes, - const ssl3HelloExtensionSender *sender) -{ - PRInt32 total_exten_len = 0; - int i; - - if (!sender) - sender = &clientHelloSenders[0]; - - for (i = 0; i < MAX_EXTENSIONS; ++i, ++sender) { - if (sender->ex_sender) { - PRInt32 extLen = (*sender->ex_sender)(ss, append, maxBytes); - if (extLen < 0) - return -1; - maxBytes -= extLen; - total_exten_len += extLen; - } - } - return total_exten_len; -} diff --git a/security/nss/lib/ssl/ssl3gthr.c b/security/nss/lib/ssl/ssl3gthr.c deleted file mode 100644 index 4465c4359..000000000 --- a/security/nss/lib/ssl/ssl3gthr.c +++ /dev/null @@ -1,239 +0,0 @@ -/* - * Gather (Read) entire SSL3 records from socket into buffer. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "ssl.h" -#include "sslimpl.h" -#include "ssl3prot.h" - -/* - * Attempt to read in an entire SSL3 record. - * Blocks here for blocking sockets, otherwise returns -1 with - * PR_WOULD_BLOCK_ERROR when socket would block. - * - * returns 1 if received a complete SSL3 record. - * returns 0 if recv returns EOF - * returns -1 if recv returns <0 - * (The error value may have already been set to PR_WOULD_BLOCK_ERROR) - * - * Caller must hold the recv buf lock. - * - * The Gather state machine has 3 states: GS_INIT, GS_HEADER, GS_DATA. - * GS_HEADER: waiting for the 5-byte SSL3 record header to come in. - * GS_DATA: waiting for the body of the SSL3 record to come in. - * - * This loop returns when either (a) an error or EOF occurs, - * (b) PR_WOULD_BLOCK_ERROR, - * (c) data (entire SSL3 record) has been received. - */ -static int -ssl3_GatherData(sslSocket *ss, sslGather *gs, int flags) -{ - unsigned char *bp; - unsigned char *lbp; - int nb; - int err; - int rv = 1; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - if (gs->state == GS_INIT) { - gs->state = GS_HEADER; - gs->remainder = 5; - gs->offset = 0; - gs->writeOffset = 0; - gs->readOffset = 0; - gs->inbuf.len = 0; - } - - lbp = gs->inbuf.buf; - for(;;) { - SSL_TRC(30, ("%d: SSL3[%d]: gather state %d (need %d more)", - SSL_GETPID(), ss->fd, gs->state, gs->remainder)); - bp = ((gs->state != GS_HEADER) ? lbp : gs->hdr) + gs->offset; - nb = ssl_DefRecv(ss, bp, gs->remainder, flags); - - if (nb > 0) { - PRINT_BUF(60, (ss, "raw gather data:", bp, nb)); - } else if (nb == 0) { - /* EOF */ - SSL_TRC(30, ("%d: SSL3[%d]: EOF", SSL_GETPID(), ss->fd)); - rv = 0; - break; - } else /* if (nb < 0) */ { - SSL_DBG(("%d: SSL3[%d]: recv error %d", SSL_GETPID(), ss->fd, - PR_GetError())); - rv = SECFailure; - break; - } - - PORT_Assert( nb <= gs->remainder ); - if (nb > gs->remainder) { - /* ssl_DefRecv is misbehaving! this error is fatal to SSL. */ - gs->state = GS_INIT; /* so we don't crash next time */ - rv = SECFailure; - break; - } - - gs->offset += nb; - gs->remainder -= nb; - if (gs->state == GS_DATA) - gs->inbuf.len += nb; - - /* if there's more to go, read some more. */ - if (gs->remainder > 0) { - continue; - } - - /* have received entire record header, or entire record. */ - switch (gs->state) { - case GS_HEADER: - /* - ** Have received SSL3 record header in gs->hdr. - ** Now extract the length of the following encrypted data, - ** and then read in the rest of the SSL3 record into gs->inbuf. - */ - gs->remainder = (gs->hdr[3] << 8) | gs->hdr[4]; - - /* This is the max fragment length for an encrypted fragment - ** plus the size of the record header. - */ - if(gs->remainder > (MAX_FRAGMENT_LENGTH + 2048 + 5)) { - SSL3_SendAlert(ss, alert_fatal, unexpected_message); - gs->state = GS_INIT; - PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); - return SECFailure; - } - - gs->state = GS_DATA; - gs->offset = 0; - gs->inbuf.len = 0; - - if (gs->remainder > gs->inbuf.space) { - err = sslBuffer_Grow(&gs->inbuf, gs->remainder); - if (err) { /* realloc has set error code to no mem. */ - return err; - } - lbp = gs->inbuf.buf; - } - break; /* End this case. Continue around the loop. */ - - - case GS_DATA: - /* - ** SSL3 record has been completely received. - */ - gs->state = GS_INIT; - return 1; - } - } - - return rv; -} - -/* Gather in a record and when complete, Handle that record. - * Repeat this until the handshake is complete, - * or until application data is available. - * - * Returns 1 when the handshake is completed without error, or - * application data is available. - * Returns 0 if ssl3_GatherData hits EOF. - * Returns -1 on read error, or PR_WOULD_BLOCK_ERROR, or handleRecord error. - * Returns -2 on SECWouldBlock return from ssl3_HandleRecord. - * - * Called from ssl_GatherRecord1stHandshake in sslcon.c, - * and from SSL_ForceHandshake in sslsecur.c - * and from ssl3_GatherAppDataRecord below (<- DoRecv in sslsecur.c). - * - * Caller must hold the recv buf lock. - */ -int -ssl3_GatherCompleteHandshake(sslSocket *ss, int flags) -{ - SSL3Ciphertext cText; - int rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - do { - /* bring in the next sslv3 record. */ - rv = ssl3_GatherData(ss, &ss->gs, flags); - if (rv <= 0) { - return rv; - } - - /* decipher it, and handle it if it's a handshake. - * If it's application data, ss->gs.buf will not be empty upon return. - */ - cText.type = (SSL3ContentType)ss->gs.hdr[0]; - cText.version = (ss->gs.hdr[1] << 8) | ss->gs.hdr[2]; - cText.buf = &ss->gs.inbuf; - rv = ssl3_HandleRecord(ss, &cText, &ss->gs.buf); - if (rv < 0) { - return ss->recvdCloseNotify ? 0 : rv; - } - } while (ss->ssl3.hs.ws != idle_handshake && ss->gs.buf.len == 0); - - ss->gs.readOffset = 0; - ss->gs.writeOffset = ss->gs.buf.len; - return 1; -} - -/* Repeatedly gather in a record and when complete, Handle that record. - * Repeat this until some application data is received. - * - * Returns 1 when application data is available. - * Returns 0 if ssl3_GatherData hits EOF. - * Returns -1 on read error, or PR_WOULD_BLOCK_ERROR, or handleRecord error. - * Returns -2 on SECWouldBlock return from ssl3_HandleRecord. - * - * Called from DoRecv in sslsecur.c - * Caller must hold the recv buf lock. - */ -int -ssl3_GatherAppDataRecord(sslSocket *ss, int flags) -{ - int rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - do { - rv = ssl3_GatherCompleteHandshake(ss, flags); - } while (rv > 0 && ss->gs.buf.len == 0); - - return rv; -} diff --git a/security/nss/lib/ssl/ssl3prot.h b/security/nss/lib/ssl/ssl3prot.h deleted file mode 100644 index e410b1cfd..000000000 --- a/security/nss/lib/ssl/ssl3prot.h +++ /dev/null @@ -1,363 +0,0 @@ -/* Private header file of libSSL. - * Various and sundry protocol constants. DON'T CHANGE THESE. These - * values are defined by the SSL 3.0 protocol specification. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#ifndef __ssl3proto_h_ -#define __ssl3proto_h_ - -typedef uint8 SSL3Opaque; - -typedef uint16 SSL3ProtocolVersion; -/* version numbers are defined in sslproto.h */ - -typedef uint16 ssl3CipherSuite; -/* The cipher suites are defined in sslproto.h */ - -#define MAX_CERT_TYPES 10 -#define MAX_COMPRESSION_METHODS 10 -#define MAX_MAC_LENGTH 64 -#define MAX_PADDING_LENGTH 64 -#define MAX_KEY_LENGTH 64 -#define EXPORT_KEY_LENGTH 5 -#define SSL3_RANDOM_LENGTH 32 - -#define SSL3_RECORD_HEADER_LENGTH 5 - -#define MAX_FRAGMENT_LENGTH 16384 - -typedef enum { - content_change_cipher_spec = 20, - content_alert = 21, - content_handshake = 22, - content_application_data = 23 -} SSL3ContentType; - -typedef struct { - SSL3ContentType type; - SSL3ProtocolVersion version; - uint16 length; - SECItem fragment; -} SSL3Plaintext; - -typedef struct { - SSL3ContentType type; - SSL3ProtocolVersion version; - uint16 length; - SECItem fragment; -} SSL3Compressed; - -typedef struct { - SECItem content; - SSL3Opaque MAC[MAX_MAC_LENGTH]; -} SSL3GenericStreamCipher; - -typedef struct { - SECItem content; - SSL3Opaque MAC[MAX_MAC_LENGTH]; - uint8 padding[MAX_PADDING_LENGTH]; - uint8 padding_length; -} SSL3GenericBlockCipher; - -typedef enum { change_cipher_spec_choice = 1 } SSL3ChangeCipherSpecChoice; - -typedef struct { - SSL3ChangeCipherSpecChoice choice; -} SSL3ChangeCipherSpec; - -typedef enum { alert_warning = 1, alert_fatal = 2 } SSL3AlertLevel; - -typedef enum { - close_notify = 0, - unexpected_message = 10, - bad_record_mac = 20, - decryption_failed = 21, /* TLS only */ - record_overflow = 22, /* TLS only */ - decompression_failure = 30, - handshake_failure = 40, - no_certificate = 41, /* SSL3 only, NOT TLS */ - bad_certificate = 42, - unsupported_certificate = 43, - certificate_revoked = 44, - certificate_expired = 45, - certificate_unknown = 46, - illegal_parameter = 47, - -/* All alerts below are TLS only. */ - unknown_ca = 48, - access_denied = 49, - decode_error = 50, - decrypt_error = 51, - export_restriction = 60, - protocol_version = 70, - insufficient_security = 71, - internal_error = 80, - user_canceled = 90, - no_renegotiation = 100, - -/* Alerts for client hello extensions */ - unsupported_extension = 110, - certificate_unobtainable = 111, - unrecognized_name = 112, - bad_certificate_status_response = 113, - bad_certificate_hash_value = 114 - -} SSL3AlertDescription; - -typedef struct { - SSL3AlertLevel level; - SSL3AlertDescription description; -} SSL3Alert; - -typedef enum { - hello_request = 0, - client_hello = 1, - server_hello = 2, - new_session_ticket = 4, - certificate = 11, - server_key_exchange = 12, - certificate_request = 13, - server_hello_done = 14, - certificate_verify = 15, - client_key_exchange = 16, - finished = 20 -} SSL3HandshakeType; - -typedef struct { - uint8 empty; -} SSL3HelloRequest; - -typedef struct { - SSL3Opaque rand[SSL3_RANDOM_LENGTH]; -} SSL3Random; - -typedef struct { - SSL3Opaque id[32]; - uint8 length; -} SSL3SessionID; - -typedef enum { compression_null = 0 } SSL3CompressionMethod; - -typedef struct { - SSL3ProtocolVersion client_version; - SSL3Random random; - SSL3SessionID session_id; - SECItem cipher_suites; - uint8 cm_count; - SSL3CompressionMethod compression_methods[MAX_COMPRESSION_METHODS]; -} SSL3ClientHello; - -typedef struct { - SSL3ProtocolVersion server_version; - SSL3Random random; - SSL3SessionID session_id; - ssl3CipherSuite cipher_suite; - SSL3CompressionMethod compression_method; -} SSL3ServerHello; - -typedef struct { - SECItem list; -} SSL3Certificate; - -/* SSL3SignType moved to ssl.h */ - -/* The SSL key exchange method used */ -typedef enum { - kea_null, - kea_rsa, - kea_rsa_export, - kea_rsa_export_1024, - kea_dh_dss, - kea_dh_dss_export, - kea_dh_rsa, - kea_dh_rsa_export, - kea_dhe_dss, - kea_dhe_dss_export, - kea_dhe_rsa, - kea_dhe_rsa_export, - kea_dh_anon, - kea_dh_anon_export, - kea_rsa_fips, - kea_ecdh_ecdsa, - kea_ecdhe_ecdsa, - kea_ecdh_rsa, - kea_ecdhe_rsa, - kea_ecdh_anon -} SSL3KeyExchangeAlgorithm; - -typedef struct { - SECItem modulus; - SECItem exponent; -} SSL3ServerRSAParams; - -typedef struct { - SECItem p; - SECItem g; - SECItem Ys; -} SSL3ServerDHParams; - -typedef struct { - union { - SSL3ServerDHParams dh; - SSL3ServerRSAParams rsa; - } u; -} SSL3ServerParams; - -typedef struct { - uint8 md5[16]; - uint8 sha[20]; -} SSL3Hashes; - -typedef struct { - union { - SSL3Opaque anonymous; - SSL3Hashes certified; - } u; -} SSL3ServerKeyExchange; - -typedef enum { - ct_RSA_sign = 1, - ct_DSS_sign = 2, - ct_RSA_fixed_DH = 3, - ct_DSS_fixed_DH = 4, - ct_RSA_ephemeral_DH = 5, - ct_DSS_ephemeral_DH = 6, - ct_ECDSA_sign = 64, - ct_RSA_fixed_ECDH = 65, - ct_ECDSA_fixed_ECDH = 66 - -} SSL3ClientCertificateType; - -typedef SECItem *SSL3DistinquishedName; - -typedef struct { - SSL3Opaque client_version[2]; - SSL3Opaque random[46]; -} SSL3RSAPreMasterSecret; - -typedef SECItem SSL3EncryptedPreMasterSecret; - - -typedef SSL3Opaque SSL3MasterSecret[48]; - -typedef enum { implicit, explicit } SSL3PublicValueEncoding; - -typedef struct { - union { - SSL3Opaque implicit; - SECItem explicit; - } dh_public; -} SSL3ClientDiffieHellmanPublic; - -typedef struct { - union { - SSL3EncryptedPreMasterSecret rsa; - SSL3ClientDiffieHellmanPublic diffie_helman; - } exchange_keys; -} SSL3ClientKeyExchange; - -typedef SSL3Hashes SSL3PreSignedCertificateVerify; - -typedef SECItem SSL3CertificateVerify; - -typedef enum { - sender_client = 0x434c4e54, - sender_server = 0x53525652 -} SSL3Sender; - -typedef SSL3Hashes SSL3Finished; - -typedef struct { - SSL3Opaque verify_data[12]; -} TLSFinished; - -/* - * TLS extension related data structures and constants. - */ - -/* SessionTicket extension related data structures. */ - -/* NewSessionTicket handshake message. */ -typedef struct { - uint32 received_timestamp; - uint32 ticket_lifetime_hint; - SECItem ticket; -} NewSessionTicket; - -typedef enum { - CLIENT_AUTH_ANONYMOUS = 0, - CLIENT_AUTH_CERTIFICATE = 1 -} ClientAuthenticationType; - -typedef struct { - ClientAuthenticationType client_auth_type; - union { - SSL3Opaque *certificate_list; - } identity; -} ClientIdentity; - -#define SESS_TICKET_KEY_NAME_LEN 16 -#define SESS_TICKET_KEY_NAME_PREFIX "NSS!" -#define SESS_TICKET_KEY_NAME_PREFIX_LEN 4 -#define SESS_TICKET_KEY_VAR_NAME_LEN 12 - -typedef struct { - unsigned char *key_name; - unsigned char *iv; - SECItem encrypted_state; - unsigned char *mac; -} EncryptedSessionTicket; - -/* Supported extensions. */ -/* Update MAX_EXTENSIONS whenever a new extension type is added. */ -typedef enum { - server_name_xtn = 0, -#ifdef NSS_ENABLE_ECC - elliptic_curves_xtn = 10, - ec_point_formats_xtn = 11, -#endif - session_ticket_xtn = 35 -} ExtensionType; - -#define MAX_EXTENSIONS 4 - -#define TLS_EX_SESS_TICKET_MAC_LENGTH 32 - -#endif /* __ssl3proto_h_ */ diff --git a/security/nss/lib/ssl/sslauth.c b/security/nss/lib/ssl/sslauth.c deleted file mode 100644 index 45108afd7..000000000 --- a/security/nss/lib/ssl/sslauth.c +++ /dev/null @@ -1,273 +0,0 @@ -/* ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#include "cert.h" -#include "secitem.h" -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" -#include "pk11func.h" - -/* NEED LOCKS IN HERE. */ -CERTCertificate * -SSL_PeerCertificate(PRFileDesc *fd) -{ - sslSocket *ss; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificate", - SSL_GETPID(), fd)); - return 0; - } - if (ss->opt.useSecurity && ss->sec.peerCert) { - return CERT_DupCertificate(ss->sec.peerCert); - } - return 0; -} - -/* NEED LOCKS IN HERE. */ -CERTCertificate * -SSL_LocalCertificate(PRFileDesc *fd) -{ - sslSocket *ss; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificate", - SSL_GETPID(), fd)); - return NULL; - } - if (ss->opt.useSecurity) { - if (ss->sec.localCert) { - return CERT_DupCertificate(ss->sec.localCert); - } - if (ss->sec.ci.sid && ss->sec.ci.sid->localCert) { - return CERT_DupCertificate(ss->sec.ci.sid->localCert); - } - } - return NULL; -} - - - -/* NEED LOCKS IN HERE. */ -SECStatus -SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1, - char **ip, char **sp) -{ - sslSocket *ss; - const char *cipherName; - PRBool isDes = PR_FALSE; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SecurityStatus", - SSL_GETPID(), fd)); - return SECFailure; - } - - if (cp) *cp = 0; - if (kp0) *kp0 = 0; - if (kp1) *kp1 = 0; - if (ip) *ip = 0; - if (sp) *sp = 0; - if (op) { - *op = SSL_SECURITY_STATUS_OFF; - } - - if (ss->opt.useSecurity && ss->firstHsDone) { - - if (ss->version < SSL_LIBRARY_VERSION_3_0) { - cipherName = ssl_cipherName[ss->sec.cipherType]; - } else { - cipherName = ssl3_cipherName[ss->sec.cipherType]; - } - PORT_Assert(cipherName); - if (cipherName) { - if (PORT_Strstr(cipherName, "DES")) isDes = PR_TRUE; - - if (cp) { - *cp = PORT_Strdup(cipherName); - } - } - - if (kp0) { - *kp0 = ss->sec.keyBits; - if (isDes) *kp0 = (*kp0 * 7) / 8; - } - if (kp1) { - *kp1 = ss->sec.secretKeyBits; - if (isDes) *kp1 = (*kp1 * 7) / 8; - } - if (op) { - if (ss->sec.keyBits == 0) { - *op = SSL_SECURITY_STATUS_OFF; - } else if (ss->sec.secretKeyBits < 90) { - *op = SSL_SECURITY_STATUS_ON_LOW; - - } else { - *op = SSL_SECURITY_STATUS_ON_HIGH; - } - } - - if (ip || sp) { - CERTCertificate *cert; - - cert = ss->sec.peerCert; - if (cert) { - if (ip) { - *ip = CERT_NameToAscii(&cert->issuer); - } - if (sp) { - *sp = CERT_NameToAscii(&cert->subject); - } - } else { - if (ip) { - *ip = PORT_Strdup("no certificate"); - } - if (sp) { - *sp = PORT_Strdup("no certificate"); - } - } - } - } - - return SECSuccess; -} - -/************************************************************************/ - -/* NEED LOCKS IN HERE. */ -SECStatus -SSL_AuthCertificateHook(PRFileDesc *s, SSLAuthCertificate func, void *arg) -{ - sslSocket *ss; - - ss = ssl_FindSocket(s); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in AuthCertificateHook", - SSL_GETPID(), s)); - return SECFailure; - } - - ss->authCertificate = func; - ss->authCertificateArg = arg; - - return SECSuccess; -} - -/* NEED LOCKS IN HERE. */ -SECStatus -SSL_GetClientAuthDataHook(PRFileDesc *s, SSLGetClientAuthData func, - void *arg) -{ - sslSocket *ss; - - ss = ssl_FindSocket(s); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in GetClientAuthDataHook", - SSL_GETPID(), s)); - return SECFailure; - } - - ss->getClientAuthData = func; - ss->getClientAuthDataArg = arg; - return SECSuccess; -} - -/* NEED LOCKS IN HERE. */ -SECStatus -SSL_SetPKCS11PinArg(PRFileDesc *s, void *arg) -{ - sslSocket *ss; - - ss = ssl_FindSocket(s); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in GetClientAuthDataHook", - SSL_GETPID(), s)); - return SECFailure; - } - - ss->pkcs11PinArg = arg; - return SECSuccess; -} - - -/* This is the "default" authCert callback function. It is called when a - * certificate message is received from the peer and the local application - * has not registered an authCert callback function. - */ -SECStatus -SSL_AuthCertificate(void *arg, PRFileDesc *fd, PRBool checkSig, PRBool isServer) -{ - SECStatus rv; - CERTCertDBHandle * handle; - sslSocket * ss; - SECCertUsage certUsage; - const char * hostname = NULL; - - ss = ssl_FindSocket(fd); - PORT_Assert(ss != NULL); - if (!ss) { - return SECFailure; - } - - handle = (CERTCertDBHandle *)arg; - - /* this may seem backwards, but isn't. */ - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; - - rv = CERT_VerifyCertNow(handle, ss->sec.peerCert, checkSig, certUsage, - ss->pkcs11PinArg); - - if ( rv != SECSuccess || isServer ) - return rv; - - /* cert is OK. This is the client side of an SSL connection. - * Now check the name field in the cert against the desired hostname. - * NB: This is our only defense against Man-In-The-Middle (MITM) attacks! - */ - hostname = ss->url; - if (hostname && hostname[0]) - rv = CERT_VerifyCertName(ss->sec.peerCert, hostname); - else - rv = SECFailure; - if (rv != SECSuccess) - PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN); - - return rv; -} diff --git a/security/nss/lib/ssl/sslcon.c b/security/nss/lib/ssl/sslcon.c deleted file mode 100644 index aaff9e097..000000000 --- a/security/nss/lib/ssl/sslcon.c +++ /dev/null @@ -1,3832 +0,0 @@ -/* - * SSL v2 handshake functions, and functions common to SSL2 and SSL3. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "nssrenam.h" -#include "cert.h" -#include "secitem.h" -#include "sechash.h" -#include "cryptohi.h" /* for SGN_ funcs */ -#include "keyhi.h" /* for SECKEY_ high level functions. */ -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" -#include "ssl3prot.h" -#include "sslerr.h" -#include "pk11func.h" -#include "prinit.h" -#include "prtime.h" /* for PR_Now() */ - -#define XXX -static PRBool policyWasSet; - -/* This ordered list is indexed by (SSL_CK_xx * 3) */ -/* Second and third bytes are MSB and LSB of master key length. */ -static const PRUint8 allCipherSuites[] = { - 0, 0, 0, - SSL_CK_RC4_128_WITH_MD5, 0x00, 0x80, - SSL_CK_RC4_128_EXPORT40_WITH_MD5, 0x00, 0x80, - SSL_CK_RC2_128_CBC_WITH_MD5, 0x00, 0x80, - SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5, 0x00, 0x80, - SSL_CK_IDEA_128_CBC_WITH_MD5, 0x00, 0x80, - SSL_CK_DES_64_CBC_WITH_MD5, 0x00, 0x40, - SSL_CK_DES_192_EDE3_CBC_WITH_MD5, 0x00, 0xC0, - 0, 0, 0 -}; - -#define ssl2_NUM_SUITES_IMPLEMENTED 6 - -/* This list is sent back to the client when the client-hello message - * contains no overlapping ciphers, so the client can report what ciphers - * are supported by the server. Unlike allCipherSuites (above), this list - * is sorted by descending preference, not by cipherSuite number. - */ -static const PRUint8 implementedCipherSuites[ssl2_NUM_SUITES_IMPLEMENTED * 3] = { - SSL_CK_RC4_128_WITH_MD5, 0x00, 0x80, - SSL_CK_RC2_128_CBC_WITH_MD5, 0x00, 0x80, - SSL_CK_DES_192_EDE3_CBC_WITH_MD5, 0x00, 0xC0, - SSL_CK_DES_64_CBC_WITH_MD5, 0x00, 0x40, - SSL_CK_RC4_128_EXPORT40_WITH_MD5, 0x00, 0x80, - SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5, 0x00, 0x80 -}; - -typedef struct ssl2SpecsStr { - PRUint8 nkm; /* do this many hashes to generate key material. */ - PRUint8 nkd; /* size of readKey and writeKey in bytes. */ - PRUint8 blockSize; - PRUint8 blockShift; - CK_MECHANISM_TYPE mechanism; - PRUint8 keyLen; /* cipher symkey size in bytes. */ - PRUint8 pubLen; /* publicly reveal this many bytes of key. */ - PRUint8 ivLen; /* length of IV data at *ca. */ -} ssl2Specs; - -static const ssl2Specs ssl_Specs[] = { -/* NONE */ - { 0, 0, 0, 0, }, -/* SSL_CK_RC4_128_WITH_MD5 */ - { 2, 16, 1, 0, CKM_RC4, 16, 0, 0, }, -/* SSL_CK_RC4_128_EXPORT40_WITH_MD5 */ - { 2, 16, 1, 0, CKM_RC4, 16, 11, 0, }, -/* SSL_CK_RC2_128_CBC_WITH_MD5 */ - { 2, 16, 8, 3, CKM_RC2_CBC, 16, 0, 8, }, -/* SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 */ - { 2, 16, 8, 3, CKM_RC2_CBC, 16, 11, 8, }, -/* SSL_CK_IDEA_128_CBC_WITH_MD5 */ - { 0, 0, 0, 0, }, -/* SSL_CK_DES_64_CBC_WITH_MD5 */ - { 1, 8, 8, 3, CKM_DES_CBC, 8, 0, 8, }, -/* SSL_CK_DES_192_EDE3_CBC_WITH_MD5 */ - { 3, 24, 8, 3, CKM_DES3_CBC, 24, 0, 8, }, -}; - -#define SET_ERROR_CODE /* reminder */ -#define TEST_FOR_FAILURE /* reminder */ - -/* -** Put a string tag in the library so that we can examine an executable -** and see what kind of security it supports. -*/ -const char *ssl_version = "SECURITY_VERSION:" - " +us" - " +export" -#ifdef TRACE - " +trace" -#endif -#ifdef DEBUG - " +debug" -#endif - ; - -const char * const ssl_cipherName[] = { - "unknown", - "RC4", - "RC4-Export", - "RC2-CBC", - "RC2-CBC-Export", - "IDEA-CBC", - "DES-CBC", - "DES-EDE3-CBC", - "unknown", - "unknown", /* was fortezza, NO LONGER USED */ -}; - - -/* bit-masks, showing which SSLv2 suites are allowed. - * lsb corresponds to first cipher suite in allCipherSuites[]. - */ -static PRUint16 allowedByPolicy; /* all off by default */ -static PRUint16 maybeAllowedByPolicy; /* all off by default */ -static PRUint16 chosenPreference = 0xff; /* all on by default */ - -/* bit values for the above two bit masks */ -#define SSL_CB_RC4_128_WITH_MD5 (1 << SSL_CK_RC4_128_WITH_MD5) -#define SSL_CB_RC4_128_EXPORT40_WITH_MD5 (1 << SSL_CK_RC4_128_EXPORT40_WITH_MD5) -#define SSL_CB_RC2_128_CBC_WITH_MD5 (1 << SSL_CK_RC2_128_CBC_WITH_MD5) -#define SSL_CB_RC2_128_CBC_EXPORT40_WITH_MD5 (1 << SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5) -#define SSL_CB_IDEA_128_CBC_WITH_MD5 (1 << SSL_CK_IDEA_128_CBC_WITH_MD5) -#define SSL_CB_DES_64_CBC_WITH_MD5 (1 << SSL_CK_DES_64_CBC_WITH_MD5) -#define SSL_CB_DES_192_EDE3_CBC_WITH_MD5 (1 << SSL_CK_DES_192_EDE3_CBC_WITH_MD5) -#define SSL_CB_IMPLEMENTED \ - (SSL_CB_RC4_128_WITH_MD5 | \ - SSL_CB_RC4_128_EXPORT40_WITH_MD5 | \ - SSL_CB_RC2_128_CBC_WITH_MD5 | \ - SSL_CB_RC2_128_CBC_EXPORT40_WITH_MD5 | \ - SSL_CB_DES_64_CBC_WITH_MD5 | \ - SSL_CB_DES_192_EDE3_CBC_WITH_MD5) - - -/* Construct a socket's list of cipher specs from the global default values. - */ -static SECStatus -ssl2_ConstructCipherSpecs(sslSocket *ss) -{ - PRUint8 * cs = NULL; - unsigned int allowed; - unsigned int count; - int ssl3_count = 0; - int final_count; - int i; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - count = 0; - PORT_Assert(ss != 0); - allowed = !ss->opt.enableSSL2 ? 0 : - (ss->allowedByPolicy & ss->chosenPreference & SSL_CB_IMPLEMENTED); - while (allowed) { - if (allowed & 1) - ++count; - allowed >>= 1; - } - - /* Call ssl3_config_match_init() once here, - * instead of inside ssl3_ConstructV2CipherSpecsHack(), - * because the latter gets called twice below, - * and then again in ssl2_BeginClientHandshake(). - */ - ssl3_config_match_init(ss); - - /* ask SSL3 how many cipher suites it has. */ - rv = ssl3_ConstructV2CipherSpecsHack(ss, NULL, &ssl3_count); - if (rv < 0) - return rv; - count += ssl3_count; - - /* Allocate memory to hold cipher specs */ - if (count > 0) - cs = (PRUint8*) PORT_Alloc(count * 3); - else - PORT_SetError(SSL_ERROR_SSL_DISABLED); - if (cs == NULL) - return SECFailure; - - if (ss->cipherSpecs != NULL) { - PORT_Free(ss->cipherSpecs); - } - ss->cipherSpecs = cs; - ss->sizeCipherSpecs = count * 3; - - /* fill in cipher specs for SSL2 cipher suites */ - allowed = !ss->opt.enableSSL2 ? 0 : - (ss->allowedByPolicy & ss->chosenPreference & SSL_CB_IMPLEMENTED); - for (i = 0; i < ssl2_NUM_SUITES_IMPLEMENTED * 3; i += 3) { - const PRUint8 * hs = implementedCipherSuites + i; - int ok = allowed & (1U << hs[0]); - if (ok) { - cs[0] = hs[0]; - cs[1] = hs[1]; - cs[2] = hs[2]; - cs += 3; - } - } - - /* now have SSL3 add its suites onto the end */ - rv = ssl3_ConstructV2CipherSpecsHack(ss, cs, &final_count); - - /* adjust for any difference between first pass and second pass */ - ss->sizeCipherSpecs -= (ssl3_count - final_count) * 3; - - return rv; -} - -/* This function is called immediately after ssl2_ConstructCipherSpecs() -** at the beginning of a handshake. It detects cases where a protocol -** (e.g. SSL2 or SSL3) is logically enabled, but all its cipher suites -** for that protocol have been disabled. If such cases, it clears the -** enable bit for the protocol. If no protocols remain enabled, or -** if no cipher suites are found, it sets the error code and returns -** SECFailure, otherwise it returns SECSuccess. -*/ -static SECStatus -ssl2_CheckConfigSanity(sslSocket *ss) -{ - unsigned int allowed; - int ssl3CipherCount = 0; - SECStatus rv; - - /* count the SSL2 and SSL3 enabled ciphers. - * if either is zero, clear the socket's enable for that protocol. - */ - if (!ss->cipherSpecs) - goto disabled; - - allowed = ss->allowedByPolicy & ss->chosenPreference; - if (! allowed) - ss->opt.enableSSL2 = PR_FALSE; /* not really enabled if no ciphers */ - - /* ssl3_config_match_init was called in ssl2_ConstructCipherSpecs(). */ - /* Ask how many ssl3 CipherSuites were enabled. */ - rv = ssl3_ConstructV2CipherSpecsHack(ss, NULL, &ssl3CipherCount); - if (rv != SECSuccess || ssl3CipherCount <= 0) { - ss->opt.enableSSL3 = PR_FALSE; /* not really enabled if no ciphers */ - ss->opt.enableTLS = PR_FALSE; - } - - if (!ss->opt.enableSSL2 && !ss->opt.enableSSL3 && !ss->opt.enableTLS) { - SSL_DBG(("%d: SSL[%d]: Can't handshake! both v2 and v3 disabled.", - SSL_GETPID(), ss->fd)); -disabled: - PORT_SetError(SSL_ERROR_SSL_DISABLED); - return SECFailure; - } - return SECSuccess; -} - -/* - * Since this is a global (not per-socket) setting, we cannot use the - * HandshakeLock to protect this. Probably want a global lock. - */ -SECStatus -ssl2_SetPolicy(PRInt32 which, PRInt32 policy) -{ - PRUint32 bitMask; - SECStatus rv = SECSuccess; - - which &= 0x000f; - bitMask = 1 << which; - - if (!(bitMask & SSL_CB_IMPLEMENTED)) { - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - return SECFailure; - } - - if (policy == SSL_ALLOWED) { - allowedByPolicy |= bitMask; - maybeAllowedByPolicy |= bitMask; - } else if (policy == SSL_RESTRICTED) { - allowedByPolicy &= ~bitMask; - maybeAllowedByPolicy |= bitMask; - } else { - allowedByPolicy &= ~bitMask; - maybeAllowedByPolicy &= ~bitMask; - } - allowedByPolicy &= SSL_CB_IMPLEMENTED; - maybeAllowedByPolicy &= SSL_CB_IMPLEMENTED; - - policyWasSet = PR_TRUE; - return rv; -} - -SECStatus -ssl2_GetPolicy(PRInt32 which, PRInt32 *oPolicy) -{ - PRUint32 bitMask; - PRInt32 policy; - - which &= 0x000f; - bitMask = 1 << which; - - /* Caller assures oPolicy is not null. */ - if (!(bitMask & SSL_CB_IMPLEMENTED)) { - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - *oPolicy = SSL_NOT_ALLOWED; - return SECFailure; - } - - if (maybeAllowedByPolicy & bitMask) { - policy = (allowedByPolicy & bitMask) ? SSL_ALLOWED : SSL_RESTRICTED; - } else { - policy = SSL_NOT_ALLOWED; - } - - *oPolicy = policy; - return SECSuccess; -} - -/* - * Since this is a global (not per-socket) setting, we cannot use the - * HandshakeLock to protect this. Probably want a global lock. - * Called from SSL_CipherPrefSetDefault in sslsock.c - * These changes have no effect on any sslSockets already created. - */ -SECStatus -ssl2_CipherPrefSetDefault(PRInt32 which, PRBool enabled) -{ - PRUint32 bitMask; - - which &= 0x000f; - bitMask = 1 << which; - - if (!(bitMask & SSL_CB_IMPLEMENTED)) { - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - return SECFailure; - } - - if (enabled) - chosenPreference |= bitMask; - else - chosenPreference &= ~bitMask; - chosenPreference &= SSL_CB_IMPLEMENTED; - - return SECSuccess; -} - -SECStatus -ssl2_CipherPrefGetDefault(PRInt32 which, PRBool *enabled) -{ - PRBool rv = PR_FALSE; - PRUint32 bitMask; - - which &= 0x000f; - bitMask = 1 << which; - - if (!(bitMask & SSL_CB_IMPLEMENTED)) { - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - *enabled = PR_FALSE; - return SECFailure; - } - - rv = (PRBool)((chosenPreference & bitMask) != 0); - *enabled = rv; - return SECSuccess; -} - -SECStatus -ssl2_CipherPrefSet(sslSocket *ss, PRInt32 which, PRBool enabled) -{ - PRUint32 bitMask; - - which &= 0x000f; - bitMask = 1 << which; - - if (!(bitMask & SSL_CB_IMPLEMENTED)) { - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - return SECFailure; - } - - if (enabled) - ss->chosenPreference |= bitMask; - else - ss->chosenPreference &= ~bitMask; - ss->chosenPreference &= SSL_CB_IMPLEMENTED; - - return SECSuccess; -} - -SECStatus -ssl2_CipherPrefGet(sslSocket *ss, PRInt32 which, PRBool *enabled) -{ - PRBool rv = PR_FALSE; - PRUint32 bitMask; - - which &= 0x000f; - bitMask = 1 << which; - - if (!(bitMask & SSL_CB_IMPLEMENTED)) { - PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); - *enabled = PR_FALSE; - return SECFailure; - } - - rv = (PRBool)((ss->chosenPreference & bitMask) != 0); - *enabled = rv; - return SECSuccess; -} - - -/* copy global default policy into socket. */ -void -ssl2_InitSocketPolicy(sslSocket *ss) -{ - ss->allowedByPolicy = allowedByPolicy; - ss->maybeAllowedByPolicy = maybeAllowedByPolicy; - ss->chosenPreference = chosenPreference; -} - - -/************************************************************************/ - -/* Called from ssl2_CreateSessionCypher(), which already holds handshake lock. - */ -static SECStatus -ssl2_CreateMAC(sslSecurityInfo *sec, SECItem *readKey, SECItem *writeKey, - int cipherChoice) -{ - switch (cipherChoice) { - - case SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5: - case SSL_CK_RC2_128_CBC_WITH_MD5: - case SSL_CK_RC4_128_EXPORT40_WITH_MD5: - case SSL_CK_RC4_128_WITH_MD5: - case SSL_CK_DES_64_CBC_WITH_MD5: - case SSL_CK_DES_192_EDE3_CBC_WITH_MD5: - sec->hash = HASH_GetHashObject(HASH_AlgMD5); - SECITEM_CopyItem(0, &sec->sendSecret, writeKey); - SECITEM_CopyItem(0, &sec->rcvSecret, readKey); - break; - - default: - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return SECFailure; - } - sec->hashcx = (*sec->hash->create)(); - if (sec->hashcx == NULL) - return SECFailure; - return SECSuccess; -} - -/************************************************************************ - * All the Send functions below must acquire and release the socket's - * xmitBufLock. - */ - -/* Called from all the Send* functions below. */ -static SECStatus -ssl2_GetSendBuffer(sslSocket *ss, unsigned int len) -{ - SECStatus rv = SECSuccess; - - PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); - - if (len < 128) { - len = 128; - } - if (len > ss->sec.ci.sendBuf.space) { - rv = sslBuffer_Grow(&ss->sec.ci.sendBuf, len); - if (rv != SECSuccess) { - SSL_DBG(("%d: SSL[%d]: ssl2_GetSendBuffer failed, tried to get %d bytes", - SSL_GETPID(), ss->fd, len)); - rv = SECFailure; - } - } - return rv; -} - -/* Called from: - * ssl2_ClientSetupSessionCypher() <- ssl2_HandleServerHelloMessage() - * ssl2_HandleRequestCertificate() <- ssl2_HandleMessage() <- - ssl_Do1stHandshake() - * ssl2_HandleMessage() <- ssl_Do1stHandshake() - * ssl2_HandleServerHelloMessage() <- ssl_Do1stHandshake() - after ssl2_BeginClientHandshake() - * ssl2_RestartHandshakeAfterCertReq() <- Called from certdlgs.c in nav. - * ssl2_HandleClientHelloMessage() <- ssl_Do1stHandshake() - after ssl2_BeginServerHandshake() - * - * Acquires and releases the socket's xmitBufLock. - */ -int -ssl2_SendErrorMessage(sslSocket *ss, int error) -{ - int rv; - PRUint8 msg[SSL_HL_ERROR_HBYTES]; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - msg[0] = SSL_MT_ERROR; - msg[1] = MSB(error); - msg[2] = LSB(error); - - ssl_GetXmitBufLock(ss); /***************************************/ - - SSL_TRC(3, ("%d: SSL[%d]: sending error %d", SSL_GETPID(), ss->fd, error)); - - ss->handshakeBegun = 1; - rv = (*ss->sec.send)(ss, msg, sizeof(msg), 0); - if (rv >= 0) { - rv = SECSuccess; - } - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/* Called from ssl2_TryToFinish(). - * Acquires and releases the socket's xmitBufLock. - */ -static SECStatus -ssl2_SendClientFinishedMessage(sslSocket *ss) -{ - SECStatus rv = SECSuccess; - int sent; - PRUint8 msg[1 + SSL_CONNECTIONID_BYTES]; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetXmitBufLock(ss); /***************************************/ - - if (ss->sec.ci.sentFinished == 0) { - ss->sec.ci.sentFinished = 1; - - SSL_TRC(3, ("%d: SSL[%d]: sending client-finished", - SSL_GETPID(), ss->fd)); - - msg[0] = SSL_MT_CLIENT_FINISHED; - PORT_Memcpy(msg+1, ss->sec.ci.connectionID, - sizeof(ss->sec.ci.connectionID)); - - DUMP_MSG(29, (ss, msg, 1 + sizeof(ss->sec.ci.connectionID))); - sent = (*ss->sec.send)(ss, msg, 1 + sizeof(ss->sec.ci.connectionID), 0); - rv = (sent >= 0) ? SECSuccess : (SECStatus)sent; - } - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/* Called from - * ssl2_HandleClientSessionKeyMessage() <- ssl2_HandleClientHelloMessage() - * ssl2_HandleClientHelloMessage() <- ssl_Do1stHandshake() - after ssl2_BeginServerHandshake() - * Acquires and releases the socket's xmitBufLock. - */ -static SECStatus -ssl2_SendServerVerifyMessage(sslSocket *ss) -{ - PRUint8 * msg; - int sendLen; - int sent; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetXmitBufLock(ss); /***************************************/ - - sendLen = 1 + SSL_CHALLENGE_BYTES; - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv != SECSuccess) { - goto done; - } - - msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_SERVER_VERIFY; - PORT_Memcpy(msg+1, ss->sec.ci.clientChallenge, SSL_CHALLENGE_BYTES); - - DUMP_MSG(29, (ss, msg, sendLen)); - sent = (*ss->sec.send)(ss, msg, sendLen, 0); - - rv = (sent >= 0) ? SECSuccess : (SECStatus)sent; - -done: - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/* Called from ssl2_TryToFinish(). - * Acquires and releases the socket's xmitBufLock. - */ -static SECStatus -ssl2_SendServerFinishedMessage(sslSocket *ss) -{ - sslSessionID * sid; - PRUint8 * msg; - int sendLen, sent; - SECStatus rv = SECSuccess; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetXmitBufLock(ss); /***************************************/ - - if (ss->sec.ci.sentFinished == 0) { - ss->sec.ci.sentFinished = 1; - PORT_Assert(ss->sec.ci.sid != 0); - sid = ss->sec.ci.sid; - - SSL_TRC(3, ("%d: SSL[%d]: sending server-finished", - SSL_GETPID(), ss->fd)); - - sendLen = 1 + sizeof(sid->u.ssl2.sessionID); - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv != SECSuccess) { - goto done; - } - - msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_SERVER_FINISHED; - PORT_Memcpy(msg+1, sid->u.ssl2.sessionID, - sizeof(sid->u.ssl2.sessionID)); - - DUMP_MSG(29, (ss, msg, sendLen)); - sent = (*ss->sec.send)(ss, msg, sendLen, 0); - - if (sent < 0) { - /* If send failed, it is now a bogus session-id */ - (*ss->sec.uncache)(sid); - rv = (SECStatus)sent; - } else if (!ss->opt.noCache) { - /* Put the sid in session-id cache, (may already be there) */ - (*ss->sec.cache)(sid); - rv = SECSuccess; - } - ssl_FreeSID(sid); - ss->sec.ci.sid = 0; - } -done: - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/* Called from ssl2_ClientSetupSessionCypher() <- - * ssl2_HandleServerHelloMessage() - * after ssl2_BeginClientHandshake() - * Acquires and releases the socket's xmitBufLock. - */ -static SECStatus -ssl2_SendSessionKeyMessage(sslSocket *ss, int cipher, int keySize, - PRUint8 *ca, int caLen, - PRUint8 *ck, int ckLen, - PRUint8 *ek, int ekLen) -{ - PRUint8 * msg; - int sendLen; - int sent; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetXmitBufLock(ss); /***************************************/ - - sendLen = SSL_HL_CLIENT_MASTER_KEY_HBYTES + ckLen + ekLen + caLen; - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv != SECSuccess) - goto done; - - SSL_TRC(3, ("%d: SSL[%d]: sending client-session-key", - SSL_GETPID(), ss->fd)); - - msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_CLIENT_MASTER_KEY; - msg[1] = cipher; - msg[2] = MSB(keySize); - msg[3] = LSB(keySize); - msg[4] = MSB(ckLen); - msg[5] = LSB(ckLen); - msg[6] = MSB(ekLen); - msg[7] = LSB(ekLen); - msg[8] = MSB(caLen); - msg[9] = LSB(caLen); - PORT_Memcpy(msg+SSL_HL_CLIENT_MASTER_KEY_HBYTES, ck, ckLen); - PORT_Memcpy(msg+SSL_HL_CLIENT_MASTER_KEY_HBYTES+ckLen, ek, ekLen); - PORT_Memcpy(msg+SSL_HL_CLIENT_MASTER_KEY_HBYTES+ckLen+ekLen, ca, caLen); - - DUMP_MSG(29, (ss, msg, sendLen)); - sent = (*ss->sec.send)(ss, msg, sendLen, 0); - rv = (sent >= 0) ? SECSuccess : (SECStatus)sent; -done: - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/* Called from ssl2_TriggerNextMessage() <- ssl2_HandleMessage() - * Acquires and releases the socket's xmitBufLock. - */ -static SECStatus -ssl2_SendCertificateRequestMessage(sslSocket *ss) -{ - PRUint8 * msg; - int sent; - int sendLen; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetXmitBufLock(ss); /***************************************/ - - sendLen = SSL_HL_REQUEST_CERTIFICATE_HBYTES + SSL_CHALLENGE_BYTES; - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv != SECSuccess) - goto done; - - SSL_TRC(3, ("%d: SSL[%d]: sending certificate request", - SSL_GETPID(), ss->fd)); - - /* Generate random challenge for client to encrypt */ - PK11_GenerateRandom(ss->sec.ci.serverChallenge, SSL_CHALLENGE_BYTES); - - msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_REQUEST_CERTIFICATE; - msg[1] = SSL_AT_MD5_WITH_RSA_ENCRYPTION; - PORT_Memcpy(msg + SSL_HL_REQUEST_CERTIFICATE_HBYTES, - ss->sec.ci.serverChallenge, SSL_CHALLENGE_BYTES); - - DUMP_MSG(29, (ss, msg, sendLen)); - sent = (*ss->sec.send)(ss, msg, sendLen, 0); - rv = (sent >= 0) ? SECSuccess : (SECStatus)sent; -done: - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/* Called from ssl2_HandleRequestCertificate() <- ssl2_HandleMessage() - * ssl2_RestartHandshakeAfterCertReq() <- (application) - * Acquires and releases the socket's xmitBufLock. - */ -static int -ssl2_SendCertificateResponseMessage(sslSocket *ss, SECItem *cert, - SECItem *encCode) -{ - PRUint8 *msg; - int rv, sendLen; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetXmitBufLock(ss); /***************************************/ - - sendLen = SSL_HL_CLIENT_CERTIFICATE_HBYTES + encCode->len + cert->len; - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv) - goto done; - - SSL_TRC(3, ("%d: SSL[%d]: sending certificate response", - SSL_GETPID(), ss->fd)); - - msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_CLIENT_CERTIFICATE; - msg[1] = SSL_CT_X509_CERTIFICATE; - msg[2] = MSB(cert->len); - msg[3] = LSB(cert->len); - msg[4] = MSB(encCode->len); - msg[5] = LSB(encCode->len); - PORT_Memcpy(msg + SSL_HL_CLIENT_CERTIFICATE_HBYTES, cert->data, cert->len); - PORT_Memcpy(msg + SSL_HL_CLIENT_CERTIFICATE_HBYTES + cert->len, - encCode->data, encCode->len); - - DUMP_MSG(29, (ss, msg, sendLen)); - rv = (*ss->sec.send)(ss, msg, sendLen, 0); - if (rv >= 0) { - rv = SECSuccess; - } -done: - ssl_ReleaseXmitBufLock(ss); /***************************************/ - return rv; -} - -/******************************************************************** -** Send functions above this line must aquire & release the socket's -** xmitBufLock. -** All the ssl2_Send functions below this line are called vis ss->sec.send -** and require that the caller hold the xmitBufLock. -*/ - -/* -** Called from ssl2_SendStream, ssl2_SendBlock, but not from ssl2_SendClear. -*/ -static SECStatus -ssl2_CalcMAC(PRUint8 * result, - sslSecurityInfo * sec, - const PRUint8 * data, - unsigned int dataLen, - unsigned int paddingLen) -{ - const PRUint8 * secret = sec->sendSecret.data; - unsigned int secretLen = sec->sendSecret.len; - unsigned long sequenceNumber = sec->sendSequence; - unsigned int nout; - PRUint8 seq[4]; - PRUint8 padding[32];/* XXX max blocksize? */ - - if (!sec->hash || !sec->hash->length) - return SECSuccess; - if (!sec->hashcx) - return SECFailure; - - /* Reset hash function */ - (*sec->hash->begin)(sec->hashcx); - - /* Feed hash the data */ - (*sec->hash->update)(sec->hashcx, secret, secretLen); - (*sec->hash->update)(sec->hashcx, data, dataLen); - PORT_Memset(padding, paddingLen, paddingLen); - (*sec->hash->update)(sec->hashcx, padding, paddingLen); - - seq[0] = (PRUint8) (sequenceNumber >> 24); - seq[1] = (PRUint8) (sequenceNumber >> 16); - seq[2] = (PRUint8) (sequenceNumber >> 8); - seq[3] = (PRUint8) (sequenceNumber); - - PRINT_BUF(60, (0, "calc-mac secret:", secret, secretLen)); - PRINT_BUF(60, (0, "calc-mac data:", data, dataLen)); - PRINT_BUF(60, (0, "calc-mac padding:", padding, paddingLen)); - PRINT_BUF(60, (0, "calc-mac seq:", seq, 4)); - - (*sec->hash->update)(sec->hashcx, seq, 4); - - /* Get result */ - (*sec->hash->end)(sec->hashcx, result, &nout, sec->hash->length); - - return SECSuccess; -} - -/* -** Maximum transmission amounts. These are tiny bit smaller than they -** need to be (they account for the MAC length plus some padding), -** assuming the MAC is 16 bytes long and the padding is a max of 7 bytes -** long. This gives an additional 9 bytes of slop to work within. -*/ -#define MAX_STREAM_CYPHER_LEN 0x7fe0 -#define MAX_BLOCK_CYPHER_LEN 0x3fe0 - -/* -** Send some data in the clear. -** Package up data with the length header and send it. -** -** Return count of bytes successfully written, or negative number (failure). -*/ -static PRInt32 -ssl2_SendClear(sslSocket *ss, const PRUint8 *in, PRInt32 len, PRInt32 flags) -{ - PRUint8 * out; - int rv; - int amount; - int count = 0; - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - SSL_TRC(10, ("%d: SSL[%d]: sending %d bytes in the clear", - SSL_GETPID(), ss->fd, len)); - PRINT_BUF(50, (ss, "clear data:", (PRUint8*) in, len)); - - while (len) { - amount = PR_MIN( len, MAX_STREAM_CYPHER_LEN ); - if (amount + 2 > ss->sec.writeBuf.space) { - rv = sslBuffer_Grow(&ss->sec.writeBuf, amount + 2); - if (rv != SECSuccess) { - count = rv; - break; - } - } - out = ss->sec.writeBuf.buf; - - /* - ** Construct message. - */ - out[0] = 0x80 | MSB(amount); - out[1] = LSB(amount); - PORT_Memcpy(&out[2], in, amount); - - /* Now send the data */ - rv = ssl_DefSend(ss, out, amount + 2, flags & ~ssl_SEND_FLAG_MASK); - if (rv < 0) { - if (PORT_GetError() == PR_WOULD_BLOCK_ERROR) { - rv = 0; - } else { - /* Return short write if some data already went out... */ - if (count == 0) - count = rv; - break; - } - } - - if ((unsigned)rv < (amount + 2)) { - /* Short write. Save the data and return. */ - if (ssl_SaveWriteData(ss, out + rv, amount + 2 - rv) - == SECFailure) { - count = SECFailure; - } else { - count += amount; - ss->sec.sendSequence++; - } - break; - } - - ss->sec.sendSequence++; - in += amount; - count += amount; - len -= amount; - } - - return count; -} - -/* -** Send some data, when using a stream cipher. Stream ciphers have a -** block size of 1. Package up the data with the length header -** and send it. -*/ -static PRInt32 -ssl2_SendStream(sslSocket *ss, const PRUint8 *in, PRInt32 len, PRInt32 flags) -{ - PRUint8 * out; - int rv; - int count = 0; - - int amount; - PRUint8 macLen; - int nout; - int buflen; - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - SSL_TRC(10, ("%d: SSL[%d]: sending %d bytes using stream cipher", - SSL_GETPID(), ss->fd, len)); - PRINT_BUF(50, (ss, "clear data:", (PRUint8*) in, len)); - - while (len) { - ssl_GetSpecReadLock(ss); /*************************************/ - - macLen = ss->sec.hash->length; - amount = PR_MIN( len, MAX_STREAM_CYPHER_LEN ); - buflen = amount + 2 + macLen; - if (buflen > ss->sec.writeBuf.space) { - rv = sslBuffer_Grow(&ss->sec.writeBuf, buflen); - if (rv != SECSuccess) { - goto loser; - } - } - out = ss->sec.writeBuf.buf; - nout = amount + macLen; - out[0] = 0x80 | MSB(nout); - out[1] = LSB(nout); - - /* Calculate MAC */ - rv = ssl2_CalcMAC(out+2, /* put MAC here */ - &ss->sec, - in, amount, /* input addr & length */ - 0); /* no padding */ - if (rv != SECSuccess) - goto loser; - - /* Encrypt MAC */ - rv = (*ss->sec.enc)(ss->sec.writecx, out+2, &nout, macLen, out+2, macLen); - if (rv) goto loser; - - /* Encrypt data from caller */ - rv = (*ss->sec.enc)(ss->sec.writecx, out+2+macLen, &nout, amount, in, amount); - if (rv) goto loser; - - ssl_ReleaseSpecReadLock(ss); /*************************************/ - - PRINT_BUF(50, (ss, "encrypted data:", out, buflen)); - - rv = ssl_DefSend(ss, out, buflen, flags & ~ssl_SEND_FLAG_MASK); - if (rv < 0) { - if (PORT_GetError() == PR_WOULD_BLOCK_ERROR) { - SSL_TRC(50, ("%d: SSL[%d]: send stream would block, " - "saving data", SSL_GETPID(), ss->fd)); - rv = 0; - } else { - SSL_TRC(10, ("%d: SSL[%d]: send stream error %d", - SSL_GETPID(), ss->fd, PORT_GetError())); - /* Return short write if some data already went out... */ - if (count == 0) - count = rv; - goto done; - } - } - - if ((unsigned)rv < buflen) { - /* Short write. Save the data and return. */ - if (ssl_SaveWriteData(ss, out + rv, buflen - rv) == SECFailure) { - count = SECFailure; - } else { - count += amount; - ss->sec.sendSequence++; - } - goto done; - } - - ss->sec.sendSequence++; - in += amount; - count += amount; - len -= amount; - } - -done: - return count; - -loser: - ssl_ReleaseSpecReadLock(ss); - return SECFailure; -} - -/* -** Send some data, when using a block cipher. Package up the data with -** the length header and send it. -*/ -/* XXX assumes blocksize is > 7 */ -static PRInt32 -ssl2_SendBlock(sslSocket *ss, const PRUint8 *in, PRInt32 len, PRInt32 flags) -{ - PRUint8 * out; /* begining of output buffer. */ - PRUint8 * op; /* next output byte goes here. */ - int rv; /* value from funcs we called. */ - int count = 0; /* this function's return value. */ - - unsigned int hlen; /* output record hdr len, 2 or 3 */ - unsigned int macLen; /* MAC is this many bytes long. */ - int amount; /* of plaintext to go in record. */ - unsigned int padding; /* add this many padding byte. */ - int nout; /* ciphertext size after header. */ - int buflen; /* size of generated record. */ - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - - SSL_TRC(10, ("%d: SSL[%d]: sending %d bytes using block cipher", - SSL_GETPID(), ss->fd, len)); - PRINT_BUF(50, (ss, "clear data:", in, len)); - - while (len) { - ssl_GetSpecReadLock(ss); /*************************************/ - - macLen = ss->sec.hash->length; - /* Figure out how much to send, including mac and padding */ - amount = PR_MIN( len, MAX_BLOCK_CYPHER_LEN ); - nout = amount + macLen; - padding = nout & (ss->sec.blockSize - 1); - if (padding) { - hlen = 3; - padding = ss->sec.blockSize - padding; - nout += padding; - } else { - hlen = 2; - } - buflen = hlen + nout; - if (buflen > ss->sec.writeBuf.space) { - rv = sslBuffer_Grow(&ss->sec.writeBuf, buflen); - if (rv != SECSuccess) { - goto loser; - } - } - out = ss->sec.writeBuf.buf; - - /* Construct header */ - op = out; - if (padding) { - *op++ = MSB(nout); - *op++ = LSB(nout); - *op++ = padding; - } else { - *op++ = 0x80 | MSB(nout); - *op++ = LSB(nout); - } - - /* Calculate MAC */ - rv = ssl2_CalcMAC(op, /* MAC goes here. */ - &ss->sec, - in, amount, /* intput addr, len */ - padding); - if (rv != SECSuccess) - goto loser; - op += macLen; - - /* Copy in the input data */ - /* XXX could eliminate the copy by folding it into the encryption */ - PORT_Memcpy(op, in, amount); - op += amount; - if (padding) { - PORT_Memset(op, padding, padding); - op += padding; - } - - /* Encrypt result */ - rv = (*ss->sec.enc)(ss->sec.writecx, out+hlen, &nout, buflen-hlen, - out+hlen, op - (out + hlen)); - if (rv) - goto loser; - - ssl_ReleaseSpecReadLock(ss); /*************************************/ - - PRINT_BUF(50, (ss, "final xmit data:", out, op - out)); - - rv = ssl_DefSend(ss, out, op - out, flags & ~ssl_SEND_FLAG_MASK); - if (rv < 0) { - if (PORT_GetError() == PR_WOULD_BLOCK_ERROR) { - rv = 0; - } else { - SSL_TRC(10, ("%d: SSL[%d]: send block error %d", - SSL_GETPID(), ss->fd, PORT_GetError())); - /* Return short write if some data already went out... */ - if (count == 0) - count = rv; - goto done; - } - } - - if (rv < (op - out)) { - /* Short write. Save the data and return. */ - if (ssl_SaveWriteData(ss, out + rv, op - out - rv) == SECFailure) { - count = SECFailure; - } else { - count += amount; - ss->sec.sendSequence++; - } - goto done; - } - - ss->sec.sendSequence++; - in += amount; - count += amount; - len -= amount; - } - -done: - return count; - -loser: - ssl_ReleaseSpecReadLock(ss); - return SECFailure; -} - -/* -** Called from: ssl2_HandleServerHelloMessage, -** ssl2_HandleClientSessionKeyMessage, -** ssl2_RestartHandshakeAfterServerCert, -** ssl2_HandleClientHelloMessage, -** -*/ -static void -ssl2_UseEncryptedSendFunc(sslSocket *ss) -{ - ssl_GetXmitBufLock(ss); - PORT_Assert(ss->sec.hashcx != 0); - - ss->gs.encrypted = 1; - ss->sec.send = (ss->sec.blockSize > 1) ? ssl2_SendBlock : ssl2_SendStream; - ssl_ReleaseXmitBufLock(ss); -} - -/* Called while initializing socket in ssl_CreateSecurityInfo(). -** This function allows us to keep the name of ssl2_SendClear static. -*/ -void -ssl2_UseClearSendFunc(sslSocket *ss) -{ - ss->sec.send = ssl2_SendClear; -} - -/************************************************************************ -** END of Send functions. * -*************************************************************************/ - -/*********************************************************************** - * For SSL3, this gathers in and handles records/messages until either - * the handshake is complete or application data is available. - * - * For SSL2, this gathers in only the next SSLV2 record. - * - * Called from ssl_Do1stHandshake() via function pointer ss->handshake. - * Caller must hold handshake lock. - * This function acquires and releases the RecvBufLock. - * - * returns SECSuccess for success. - * returns SECWouldBlock when that value is returned by ssl2_GatherRecord() or - * ssl3_GatherCompleteHandshake(). - * returns SECFailure on all other errors. - * - * The gather functions called by ssl_GatherRecord1stHandshake are expected - * to return values interpreted as follows: - * 1 : the function completed without error. - * 0 : the function read EOF. - * -1 : read error, or PR_WOULD_BLOCK_ERROR, or handleRecord error. - * -2 : the function wants ssl_GatherRecord1stHandshake to be called again - * immediately, by ssl_Do1stHandshake. - * - * This code is similar to, and easily confused with, DoRecv() in sslsecur.c - * - * This function is called from ssl_Do1stHandshake(). - * The following functions put ssl_GatherRecord1stHandshake into ss->handshake: - * ssl2_HandleMessage - * ssl2_HandleVerifyMessage - * ssl2_HandleServerHelloMessage - * ssl2_BeginClientHandshake - * ssl2_HandleClientSessionKeyMessage - * ssl2_RestartHandshakeAfterCertReq - * ssl3_RestartHandshakeAfterCertReq - * ssl2_RestartHandshakeAfterServerCert - * ssl3_RestartHandshakeAfterServerCert - * ssl2_HandleClientHelloMessage - * ssl2_BeginServerHandshake - */ -SECStatus -ssl_GatherRecord1stHandshake(sslSocket *ss) -{ - int rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetRecvBufLock(ss); - - if (ss->version >= SSL_LIBRARY_VERSION_3_0) { - /* Wait for handshake to complete, or application data to arrive. */ - rv = ssl3_GatherCompleteHandshake(ss, 0); - } else { - /* See if we have a complete record */ - rv = ssl2_GatherRecord(ss, 0); - } - SSL_TRC(10, ("%d: SSL[%d]: handshake gathering, rv=%d", - SSL_GETPID(), ss->fd, rv)); - - ssl_ReleaseRecvBufLock(ss); - - if (rv <= 0) { - if (rv == SECWouldBlock) { - /* Progress is blocked waiting for callback completion. */ - SSL_TRC(10, ("%d: SSL[%d]: handshake blocked (need %d)", - SSL_GETPID(), ss->fd, ss->gs.remainder)); - return SECWouldBlock; - } - if (rv == 0) { - /* EOF. Loser */ - PORT_SetError(PR_END_OF_FILE_ERROR); - } - return SECFailure; /* rv is < 0 here. */ - } - - SSL_TRC(10, ("%d: SSL[%d]: got handshake record of %d bytes", - SSL_GETPID(), ss->fd, ss->gs.recordLen)); - - ss->handshake = 0; /* makes ssl_Do1stHandshake call ss->nextHandshake.*/ - return SECSuccess; -} - -/************************************************************************/ - -/* Called from ssl2_ServerSetupSessionCypher() - * ssl2_ClientSetupSessionCypher() - */ -static SECStatus -ssl2_FillInSID(sslSessionID * sid, - int cipher, - PRUint8 *keyData, - int keyLen, - PRUint8 *ca, - int caLen, - int keyBits, - int secretKeyBits, - SSLSignType authAlgorithm, - PRUint32 authKeyBits, - SSLKEAType keaType, - PRUint32 keaKeyBits) -{ - PORT_Assert(sid->references == 1); - PORT_Assert(sid->cached == never_cached); - PORT_Assert(sid->u.ssl2.masterKey.data == 0); - PORT_Assert(sid->u.ssl2.cipherArg.data == 0); - - sid->version = SSL_LIBRARY_VERSION_2; - - sid->u.ssl2.cipherType = cipher; - sid->u.ssl2.masterKey.data = (PRUint8*) PORT_Alloc(keyLen); - if (!sid->u.ssl2.masterKey.data) { - return SECFailure; - } - PORT_Memcpy(sid->u.ssl2.masterKey.data, keyData, keyLen); - sid->u.ssl2.masterKey.len = keyLen; - sid->u.ssl2.keyBits = keyBits; - sid->u.ssl2.secretKeyBits = secretKeyBits; - sid->authAlgorithm = authAlgorithm; - sid->authKeyBits = authKeyBits; - sid->keaType = keaType; - sid->keaKeyBits = keaKeyBits; - sid->lastAccessTime = sid->creationTime = ssl_Time(); - sid->expirationTime = sid->creationTime + ssl_sid_timeout; - - if (caLen) { - sid->u.ssl2.cipherArg.data = (PRUint8*) PORT_Alloc(caLen); - if (!sid->u.ssl2.cipherArg.data) { - return SECFailure; - } - sid->u.ssl2.cipherArg.len = caLen; - PORT_Memcpy(sid->u.ssl2.cipherArg.data, ca, caLen); - } - return SECSuccess; -} - -/* -** Construct session keys given the masterKey (tied to the session-id), -** the client's challenge and the server's nonce. -** -** Called from ssl2_CreateSessionCypher() <- -*/ -static SECStatus -ssl2_ProduceKeys(sslSocket * ss, - SECItem * readKey, - SECItem * writeKey, - SECItem * masterKey, - PRUint8 * challenge, - PRUint8 * nonce, - int cipherType) -{ - PK11Context * cx = 0; - unsigned nkm = 0; /* number of hashes to generate key mat. */ - unsigned nkd = 0; /* size of readKey and writeKey. */ - unsigned part; - unsigned i; - unsigned off; - SECStatus rv; - PRUint8 countChar; - PRUint8 km[3*16]; /* buffer for key material. */ - - readKey->data = 0; - writeKey->data = 0; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - rv = SECSuccess; - cx = PK11_CreateDigestContext(SEC_OID_MD5); - if (cx == NULL) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - return SECFailure; - } - - nkm = ssl_Specs[cipherType].nkm; - nkd = ssl_Specs[cipherType].nkd; - - readKey->data = (PRUint8*) PORT_Alloc(nkd); - if (!readKey->data) - goto loser; - readKey->len = nkd; - - writeKey->data = (PRUint8*) PORT_Alloc(nkd); - if (!writeKey->data) - goto loser; - writeKey->len = nkd; - - /* Produce key material */ - countChar = '0'; - for (i = 0, off = 0; i < nkm; i++, off += 16) { - rv = PK11_DigestBegin(cx); - rv |= PK11_DigestOp(cx, masterKey->data, masterKey->len); - rv |= PK11_DigestOp(cx, &countChar, 1); - rv |= PK11_DigestOp(cx, challenge, SSL_CHALLENGE_BYTES); - rv |= PK11_DigestOp(cx, nonce, SSL_CONNECTIONID_BYTES); - rv |= PK11_DigestFinal(cx, km+off, &part, MD5_LENGTH); - if (rv != SECSuccess) { - ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); - rv = SECFailure; - goto loser; - } - countChar++; - } - - /* Produce keys */ - PORT_Memcpy(readKey->data, km, nkd); - PORT_Memcpy(writeKey->data, km + nkd, nkd); - -loser: - PK11_DestroyContext(cx, PR_TRUE); - return rv; -} - -/* Called from ssl2_ServerSetupSessionCypher() -** <- ssl2_HandleClientSessionKeyMessage() -** <- ssl2_HandleClientHelloMessage() -** and from ssl2_ClientSetupSessionCypher() -** <- ssl2_HandleServerHelloMessage() -*/ -static SECStatus -ssl2_CreateSessionCypher(sslSocket *ss, sslSessionID *sid, PRBool isClient) -{ - SECItem * rk = NULL; - SECItem * wk = NULL; - SECItem * param; - SECStatus rv; - int cipherType = sid->u.ssl2.cipherType; - PK11SlotInfo * slot = NULL; - CK_MECHANISM_TYPE mechanism; - SECItem readKey; - SECItem writeKey; - - void *readcx = 0; - void *writecx = 0; - readKey.data = 0; - writeKey.data = 0; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - if((ss->sec.ci.sid == 0)) - goto sec_loser; /* don't crash if asserts are off */ - - /* Trying to cut down on all these switch statements that should be tables. - * So, test cipherType once, here, and then use tables below. - */ - switch (cipherType) { - case SSL_CK_RC4_128_EXPORT40_WITH_MD5: - case SSL_CK_RC4_128_WITH_MD5: - case SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5: - case SSL_CK_RC2_128_CBC_WITH_MD5: - case SSL_CK_DES_64_CBC_WITH_MD5: - case SSL_CK_DES_192_EDE3_CBC_WITH_MD5: - break; - - default: - SSL_DBG(("%d: SSL[%d]: ssl2_CreateSessionCypher: unknown cipher=%d", - SSL_GETPID(), ss->fd, cipherType)); - PORT_SetError(isClient ? SSL_ERROR_BAD_SERVER : SSL_ERROR_BAD_CLIENT); - goto sec_loser; - } - - rk = isClient ? &readKey : &writeKey; - wk = isClient ? &writeKey : &readKey; - - /* Produce the keys for this session */ - rv = ssl2_ProduceKeys(ss, &readKey, &writeKey, &sid->u.ssl2.masterKey, - ss->sec.ci.clientChallenge, ss->sec.ci.connectionID, - cipherType); - if (rv != SECSuccess) - goto loser; - PRINT_BUF(7, (ss, "Session read-key: ", rk->data, rk->len)); - PRINT_BUF(7, (ss, "Session write-key: ", wk->data, wk->len)); - - PORT_Memcpy(ss->sec.ci.readKey, readKey.data, readKey.len); - PORT_Memcpy(ss->sec.ci.writeKey, writeKey.data, writeKey.len); - ss->sec.ci.keySize = readKey.len; - - /* Setup the MAC */ - rv = ssl2_CreateMAC(&ss->sec, rk, wk, cipherType); - if (rv != SECSuccess) - goto loser; - - /* First create the session key object */ - SSL_TRC(3, ("%d: SSL[%d]: using %s", SSL_GETPID(), ss->fd, - ssl_cipherName[cipherType])); - - - mechanism = ssl_Specs[cipherType].mechanism; - - /* set destructer before we call loser... */ - ss->sec.destroy = (void (*)(void*, PRBool)) PK11_DestroyContext; - slot = PK11_GetBestSlot(mechanism, ss->pkcs11PinArg); - if (slot == NULL) - goto loser; - - param = PK11_ParamFromIV(mechanism, &sid->u.ssl2.cipherArg); - if (param == NULL) - goto loser; - readcx = PK11_CreateContextByRawKey(slot, mechanism, PK11_OriginUnwrap, - CKA_DECRYPT, rk, param, - ss->pkcs11PinArg); - SECITEM_FreeItem(param, PR_TRUE); - if (readcx == NULL) - goto loser; - - /* build the client context */ - param = PK11_ParamFromIV(mechanism, &sid->u.ssl2.cipherArg); - if (param == NULL) - goto loser; - writecx = PK11_CreateContextByRawKey(slot, mechanism, PK11_OriginUnwrap, - CKA_ENCRYPT, wk, param, - ss->pkcs11PinArg); - SECITEM_FreeItem(param,PR_TRUE); - if (writecx == NULL) - goto loser; - PK11_FreeSlot(slot); - - rv = SECSuccess; - ss->sec.enc = (SSLCipher) PK11_CipherOp; - ss->sec.dec = (SSLCipher) PK11_CipherOp; - ss->sec.readcx = (void *) readcx; - ss->sec.writecx = (void *) writecx; - ss->sec.blockSize = ssl_Specs[cipherType].blockSize; - ss->sec.blockShift = ssl_Specs[cipherType].blockShift; - ss->sec.cipherType = sid->u.ssl2.cipherType; - ss->sec.keyBits = sid->u.ssl2.keyBits; - ss->sec.secretKeyBits = sid->u.ssl2.secretKeyBits; - goto done; - - loser: - if (ss->sec.destroy) { - if (readcx) (*ss->sec.destroy)(readcx, PR_TRUE); - if (writecx) (*ss->sec.destroy)(writecx, PR_TRUE); - } - ss->sec.destroy = NULL; - if (slot) PK11_FreeSlot(slot); - - sec_loser: - rv = SECFailure; - - done: - if (rk) { - SECITEM_ZfreeItem(rk, PR_FALSE); - } - if (wk) { - SECITEM_ZfreeItem(wk, PR_FALSE); - } - return rv; -} - -/* -** Setup the server ciphers given information from a CLIENT-MASTER-KEY -** message. -** "ss" pointer to the ssl-socket object -** "cipher" the cipher type to use -** "keyBits" the size of the final cipher key -** "ck" the clear-key data -** "ckLen" the number of bytes of clear-key data -** "ek" the encrypted-key data -** "ekLen" the number of bytes of encrypted-key data -** "ca" the cipher-arg data -** "caLen" the number of bytes of cipher-arg data -** -** The MASTER-KEY is constructed by first decrypting the encrypted-key -** data. This produces the SECRET-KEY-DATA. The MASTER-KEY is composed by -** concatenating the clear-key data with the SECRET-KEY-DATA. This code -** checks to make sure that the client didn't send us an improper amount -** of SECRET-KEY-DATA (it restricts the length of that data to match the -** spec). -** -** Called from ssl2_HandleClientSessionKeyMessage(). -*/ -static SECStatus -ssl2_ServerSetupSessionCypher(sslSocket *ss, int cipher, unsigned int keyBits, - PRUint8 *ck, unsigned int ckLen, - PRUint8 *ek, unsigned int ekLen, - PRUint8 *ca, unsigned int caLen) -{ - PRUint8 * dk = NULL; /* decrypted master key */ - sslSessionID * sid; - sslServerCerts * sc = ss->serverCerts + kt_rsa; - PRUint8 * kbuf = 0; /* buffer for RSA decrypted data. */ - unsigned int ddLen; /* length of RSA decrypted data in kbuf */ - unsigned int keySize; - unsigned int dkLen; /* decrypted key length in bytes */ - int modulusLen; - SECStatus rv; - PRUint16 allowed; /* cipher kinds enabled and allowed by policy */ - PRUint8 mkbuf[SSL_MAX_MASTER_KEY_BYTES]; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert((sc->SERVERKEY != 0)); - PORT_Assert((ss->sec.ci.sid != 0)); - sid = ss->sec.ci.sid; - - /* Trying to cut down on all these switch statements that should be tables. - * So, test cipherType once, here, and then use tables below. - */ - switch (cipher) { - case SSL_CK_RC4_128_EXPORT40_WITH_MD5: - case SSL_CK_RC4_128_WITH_MD5: - case SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5: - case SSL_CK_RC2_128_CBC_WITH_MD5: - case SSL_CK_DES_64_CBC_WITH_MD5: - case SSL_CK_DES_192_EDE3_CBC_WITH_MD5: - break; - - default: - SSL_DBG(("%d: SSL[%d]: ssl2_ServerSetupSessionCypher: unknown cipher=%d", - SSL_GETPID(), ss->fd, cipher)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto loser; - } - - allowed = ss->allowedByPolicy & ss->chosenPreference & SSL_CB_IMPLEMENTED; - if (!(allowed & (1 << cipher))) { - /* client chose a kind we don't allow! */ - SSL_DBG(("%d: SSL[%d]: disallowed cipher=%d", - SSL_GETPID(), ss->fd, cipher)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto loser; - } - - keySize = ssl_Specs[cipher].keyLen; - if (keyBits != keySize * BPB) { - SSL_DBG(("%d: SSL[%d]: invalid master secret key length=%d (bits)!", - SSL_GETPID(), ss->fd, keyBits)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto loser; - } - - if (ckLen != ssl_Specs[cipher].pubLen) { - SSL_DBG(("%d: SSL[%d]: invalid clear key length, ckLen=%d (bytes)!", - SSL_GETPID(), ss->fd, ckLen)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto loser; - } - - if (caLen != ssl_Specs[cipher].ivLen) { - SSL_DBG(("%d: SSL[%d]: invalid key args length, caLen=%d (bytes)!", - SSL_GETPID(), ss->fd, caLen)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto loser; - } - - modulusLen = PK11_GetPrivateModulusLen(sc->SERVERKEY); - if (modulusLen == -1) { - /* XXX If the key is bad, then PK11_PubDecryptRaw will fail below. */ - modulusLen = ekLen; - } - if (ekLen > modulusLen || ekLen + ckLen < keySize) { - SSL_DBG(("%d: SSL[%d]: invalid encrypted key length, ekLen=%d (bytes)!", - SSL_GETPID(), ss->fd, ekLen)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto loser; - } - - /* allocate the buffer to hold the decrypted portion of the key. */ - kbuf = (PRUint8*)PORT_Alloc(modulusLen); - if (!kbuf) { - goto loser; - } - dkLen = keySize - ckLen; - dk = kbuf + modulusLen - dkLen; - - /* Decrypt encrypted half of the key. - ** NOTE: PK11_PubDecryptRaw will barf on a non-RSA key. This is - ** desired behavior here. - */ - rv = PK11_PubDecryptRaw(sc->SERVERKEY, kbuf, &ddLen, modulusLen, ek, ekLen); - if (rv != SECSuccess) - goto hide_loser; - - /* Is the length of the decrypted data (ddLen) the expected value? */ - if (modulusLen != ddLen) - goto hide_loser; - - /* Cheaply verify that PKCS#1 was used to format the encryption block */ - if ((kbuf[0] != 0x00) || (kbuf[1] != 0x02) || (dk[-1] != 0x00)) { - SSL_DBG(("%d: SSL[%d]: strange encryption block", - SSL_GETPID(), ss->fd)); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto hide_loser; - } - - /* Make sure we're not subject to a version rollback attack. */ - if (ss->opt.enableSSL3 || ss->opt.enableTLS) { - static const PRUint8 threes[8] = { 0x03, 0x03, 0x03, 0x03, - 0x03, 0x03, 0x03, 0x03 }; - - if (PORT_Memcmp(dk - 8 - 1, threes, 8) == 0) { - PORT_SetError(SSL_ERROR_BAD_CLIENT); - goto hide_loser; - } - } - if (0) { -hide_loser: - /* Defense against the Bleichenbacher attack. - * Provide the client with NO CLUES that the decrypted master key - * was erroneous. Don't send any error messages. - * Instead, Generate a completely bogus master key . - */ - PK11_GenerateRandom(dk, dkLen); - } - - /* - ** Construct master key out of the pieces. - */ - if (ckLen) { - PORT_Memcpy(mkbuf, ck, ckLen); - } - PORT_Memcpy(mkbuf + ckLen, dk, dkLen); - - /* Fill in session-id */ - rv = ssl2_FillInSID(sid, cipher, mkbuf, keySize, ca, caLen, - keyBits, keyBits - (ckLen<<3), - ss->sec.authAlgorithm, ss->sec.authKeyBits, - ss->sec.keaType, ss->sec.keaKeyBits); - if (rv != SECSuccess) { - goto loser; - } - - /* Create session ciphers */ - rv = ssl2_CreateSessionCypher(ss, sid, PR_FALSE); - if (rv != SECSuccess) { - goto loser; - } - - SSL_TRC(1, ("%d: SSL[%d]: server, using %s cipher, clear=%d total=%d", - SSL_GETPID(), ss->fd, ssl_cipherName[cipher], - ckLen<<3, keySize<<3)); - rv = SECSuccess; - goto done; - - loser: - rv = SECFailure; - - done: - PORT_Free(kbuf); - return rv; -} - -/************************************************************************/ - -/* -** Rewrite the incoming cipher specs, comparing to list of specs we support, -** (ss->cipherSpecs) and eliminating anything we don't support -** -* Note: Our list may contain SSL v3 ciphers. -* We MUST NOT match on any of those. -* Fortunately, this is easy to detect because SSLv3 ciphers have zero -* in the first byte, and none of the SSLv2 ciphers do. -* -* Called from ssl2_HandleClientHelloMessage(). -* Returns the number of bytes of "qualified cipher specs", -* which is typically a multiple of 3, but will be zero if there are none. -*/ -static int -ssl2_QualifyCypherSpecs(sslSocket *ss, - PRUint8 * cs, /* cipher specs in client hello msg. */ - int csLen) -{ - PRUint8 * ms; - PRUint8 * hs; - PRUint8 * qs; - int mc; - int hc; - PRUint8 qualifiedSpecs[ssl2_NUM_SUITES_IMPLEMENTED * 3]; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - - if (!ss->cipherSpecs) { - SECStatus rv = ssl2_ConstructCipherSpecs(ss); - if (rv != SECSuccess || !ss->cipherSpecs) - return 0; - } - - PRINT_BUF(10, (ss, "specs from client:", cs, csLen)); - qs = qualifiedSpecs; - ms = ss->cipherSpecs; - for (mc = ss->sizeCipherSpecs; mc > 0; mc -= 3, ms += 3) { - if (ms[0] == 0) - continue; - for (hs = cs, hc = csLen; hc > 0; hs += 3, hc -= 3) { - if ((hs[0] == ms[0]) && - (hs[1] == ms[1]) && - (hs[2] == ms[2])) { - /* Copy this cipher spec into the "keep" section */ - qs[0] = hs[0]; - qs[1] = hs[1]; - qs[2] = hs[2]; - qs += 3; - break; - } - } - } - hc = qs - qualifiedSpecs; - PRINT_BUF(10, (ss, "qualified specs from client:", qualifiedSpecs, hc)); - PORT_Memcpy(cs, qualifiedSpecs, hc); - return hc; -} - -/* -** Pick the best cipher we can find, given the array of server cipher -** specs. Returns cipher number (e.g. SSL_CK_*), or -1 for no overlap. -** If successful, stores the master key size (bytes) in *pKeyLen. -** -** This is correct only for the client side, but presently -** this function is only called from -** ssl2_ClientSetupSessionCypher() <- ssl2_HandleServerHelloMessage() -** -** Note that most servers only return a single cipher suite in their -** ServerHello messages. So, the code below for finding the "best" cipher -** suite usually has only one choice. The client and server should send -** their cipher suite lists sorted in descending order by preference. -*/ -static int -ssl2_ChooseSessionCypher(sslSocket *ss, - int hc, /* number of cs's in hs. */ - PRUint8 * hs, /* server hello's cipher suites. */ - int * pKeyLen) /* out: sym key size in bytes. */ -{ - PRUint8 * ms; - unsigned int i; - int bestKeySize; - int bestRealKeySize; - int bestCypher; - int keySize; - int realKeySize; - PRUint8 * ohs = hs; - const PRUint8 * preferred; - static const PRUint8 noneSuch[3] = { 0, 0, 0 }; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - - if (!ss->cipherSpecs) { - SECStatus rv = ssl2_ConstructCipherSpecs(ss); - if (rv != SECSuccess || !ss->cipherSpecs) - goto loser; - } - - if (!ss->preferredCipher) { - unsigned int allowed = ss->allowedByPolicy & ss->chosenPreference & - SSL_CB_IMPLEMENTED; - if (allowed) { - preferred = implementedCipherSuites; - for (i = ssl2_NUM_SUITES_IMPLEMENTED; i > 0; --i) { - if (0 != (allowed & (1U << preferred[0]))) { - ss->preferredCipher = preferred; - break; - } - preferred += 3; - } - } - } - preferred = ss->preferredCipher ? ss->preferredCipher : noneSuch; - /* - ** Scan list of ciphers recieved from peer and look for a match in - ** our list. - * Note: Our list may contain SSL v3 ciphers. - * We MUST NOT match on any of those. - * Fortunately, this is easy to detect because SSLv3 ciphers have zero - * in the first byte, and none of the SSLv2 ciphers do. - */ - bestKeySize = bestRealKeySize = 0; - bestCypher = -1; - while (--hc >= 0) { - for (i = 0, ms = ss->cipherSpecs; i < ss->sizeCipherSpecs; i += 3, ms += 3) { - if ((hs[0] == preferred[0]) && - (hs[1] == preferred[1]) && - (hs[2] == preferred[2]) && - hs[0] != 0) { - /* Pick this cipher immediately! */ - *pKeyLen = (((hs[1] << 8) | hs[2]) + 7) >> 3; - return hs[0]; - } - if ((hs[0] == ms[0]) && (hs[1] == ms[1]) && (hs[2] == ms[2]) && - hs[0] != 0) { - /* Found a match */ - - /* Use secret keySize to determine which cipher is best */ - realKeySize = (hs[1] << 8) | hs[2]; - switch (hs[0]) { - case SSL_CK_RC4_128_EXPORT40_WITH_MD5: - case SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5: - keySize = 40; - break; - default: - keySize = realKeySize; - break; - } - if (keySize > bestKeySize) { - bestCypher = hs[0]; - bestKeySize = keySize; - bestRealKeySize = realKeySize; - } - } - } - hs += 3; - } - if (bestCypher < 0) { - /* - ** No overlap between server and client. Re-examine server list - ** to see what kind of ciphers it does support so that we can set - ** the error code appropriately. - */ - if ((ohs[0] == SSL_CK_RC4_128_WITH_MD5) || - (ohs[0] == SSL_CK_RC2_128_CBC_WITH_MD5)) { - PORT_SetError(SSL_ERROR_US_ONLY_SERVER); - } else if ((ohs[0] == SSL_CK_RC4_128_EXPORT40_WITH_MD5) || - (ohs[0] == SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5)) { - PORT_SetError(SSL_ERROR_EXPORT_ONLY_SERVER); - } else { - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - } - SSL_DBG(("%d: SSL[%d]: no cipher overlap", SSL_GETPID(), ss->fd)); - goto loser; - } - *pKeyLen = (bestRealKeySize + 7) >> 3; - return bestCypher; - - loser: - return -1; -} - -static SECStatus -ssl2_ClientHandleServerCert(sslSocket *ss, PRUint8 *certData, int certLen) -{ - CERTCertificate *cert = NULL; - SECItem certItem; - - certItem.data = certData; - certItem.len = certLen; - - /* decode the certificate */ - cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL, - PR_FALSE, PR_TRUE); - - if (cert == NULL) { - SSL_DBG(("%d: SSL[%d]: decode of server certificate fails", - SSL_GETPID(), ss->fd)); - PORT_SetError(SSL_ERROR_BAD_CERTIFICATE); - return SECFailure; - } - -#ifdef TRACE - { - if (ssl_trace >= 1) { - char *issuer; - char *subject; - issuer = CERT_NameToAscii(&cert->issuer); - subject = CERT_NameToAscii(&cert->subject); - SSL_TRC(1,("%d: server certificate issuer: '%s'", - SSL_GETPID(), issuer ? issuer : "OOPS")); - SSL_TRC(1,("%d: server name: '%s'", - SSL_GETPID(), subject ? subject : "OOPS")); - PORT_Free(issuer); - PORT_Free(subject); - } - } -#endif - - ss->sec.peerCert = cert; - return SECSuccess; -} - - -/* - * Format one block of data for public/private key encryption using - * the rules defined in PKCS #1. SSL2 does this itself to handle the - * rollback detection. - */ -#define RSA_BLOCK_MIN_PAD_LEN 8 -#define RSA_BLOCK_FIRST_OCTET 0x00 -#define RSA_BLOCK_AFTER_PAD_OCTET 0x00 -#define RSA_BLOCK_PUBLIC_OCTET 0x02 -unsigned char * -ssl_FormatSSL2Block(unsigned modulusLen, SECItem *data) -{ - unsigned char *block; - unsigned char *bp; - int padLen; - SECStatus rv; - int i; - - if (modulusLen < data->len + (3 + RSA_BLOCK_MIN_PAD_LEN)) { - PORT_SetError(SEC_ERROR_BAD_KEY); - return NULL; - } - block = (unsigned char *) PORT_Alloc(modulusLen); - if (block == NULL) - return NULL; - - bp = block; - - /* - * All RSA blocks start with two octets: - * 0x00 || BlockType - */ - *bp++ = RSA_BLOCK_FIRST_OCTET; - *bp++ = RSA_BLOCK_PUBLIC_OCTET; - - /* - * 0x00 || BT || Pad || 0x00 || ActualData - * 1 1 padLen 1 data->len - * Pad is all non-zero random bytes. - */ - padLen = modulusLen - data->len - 3; - PORT_Assert (padLen >= RSA_BLOCK_MIN_PAD_LEN); - rv = PK11_GenerateRandom(bp, padLen); - if (rv == SECFailure) goto loser; - /* replace all the 'zero' bytes */ - for (i = 0; i < padLen; i++) { - while (bp[i] == RSA_BLOCK_AFTER_PAD_OCTET) { - rv = PK11_GenerateRandom(bp+i, 1); - if (rv == SECFailure) goto loser; - } - } - bp += padLen; - *bp++ = RSA_BLOCK_AFTER_PAD_OCTET; - PORT_Memcpy (bp, data->data, data->len); - - return block; -loser: - if (block) PORT_Free(block); - return NULL; -} - -/* -** Given the server's public key and cipher specs, generate a session key -** that is ready to use for encrypting/decrypting the byte stream. At -** the same time, generate the SSL_MT_CLIENT_MASTER_KEY message and -** send it to the server. -** -** Called from ssl2_HandleServerHelloMessage() -*/ -static SECStatus -ssl2_ClientSetupSessionCypher(sslSocket *ss, PRUint8 *cs, int csLen) -{ - sslSessionID * sid; - PRUint8 * ca; /* points to iv data, or NULL if none. */ - PRUint8 * ekbuf = 0; - CERTCertificate * cert = 0; - SECKEYPublicKey * serverKey = 0; - unsigned modulusLen = 0; - SECStatus rv; - int cipher; - int keyLen; /* cipher symkey size in bytes. */ - int ckLen; /* publicly reveal this many bytes of key. */ - int caLen; /* length of IV data at *ca. */ - int nc; - - unsigned char *eblock; /* holds unencrypted PKCS#1 formatted key. */ - SECItem rek; /* holds portion of symkey to be encrypted. */ - - PRUint8 keyData[SSL_MAX_MASTER_KEY_BYTES]; - PRUint8 iv [8]; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - eblock = NULL; - - sid = ss->sec.ci.sid; - PORT_Assert(sid != 0); - - cert = ss->sec.peerCert; - - serverKey = CERT_ExtractPublicKey(cert); - if (!serverKey) { - SSL_DBG(("%d: SSL[%d]: extract public key failed: error=%d", - SSL_GETPID(), ss->fd, PORT_GetError())); - PORT_SetError(SSL_ERROR_BAD_CERTIFICATE); - rv = SECFailure; - goto loser2; - } - - ss->sec.authAlgorithm = ssl_sign_rsa; - ss->sec.keaType = ssl_kea_rsa; - ss->sec.keaKeyBits = \ - ss->sec.authKeyBits = SECKEY_PublicKeyStrengthInBits(serverKey); - - /* Choose a compatible cipher with the server */ - nc = csLen / 3; - cipher = ssl2_ChooseSessionCypher(ss, nc, cs, &keyLen); - if (cipher < 0) { - /* ssl2_ChooseSessionCypher has set error code. */ - ssl2_SendErrorMessage(ss, SSL_PE_NO_CYPHERS); - goto loser; - } - - /* Generate the random keys */ - PK11_GenerateRandom(keyData, sizeof(keyData)); - - /* - ** Next, carve up the keys into clear and encrypted portions. The - ** clear data is taken from the start of keyData and the encrypted - ** portion from the remainder. Note that each of these portions is - ** carved in half, one half for the read-key and one for the - ** write-key. - */ - ca = 0; - - /* We know that cipher is a legit value here, because - * ssl2_ChooseSessionCypher doesn't return bogus values. - */ - ckLen = ssl_Specs[cipher].pubLen; /* cleartext key length. */ - caLen = ssl_Specs[cipher].ivLen; /* IV length. */ - if (caLen) { - PORT_Assert(sizeof iv >= caLen); - PK11_GenerateRandom(iv, caLen); - ca = iv; - } - - /* Fill in session-id */ - rv = ssl2_FillInSID(sid, cipher, keyData, keyLen, - ca, caLen, keyLen << 3, (keyLen - ckLen) << 3, - ss->sec.authAlgorithm, ss->sec.authKeyBits, - ss->sec.keaType, ss->sec.keaKeyBits); - if (rv != SECSuccess) { - goto loser; - } - - SSL_TRC(1, ("%d: SSL[%d]: client, using %s cipher, clear=%d total=%d", - SSL_GETPID(), ss->fd, ssl_cipherName[cipher], - ckLen<<3, keyLen<<3)); - - /* Now setup read and write ciphers */ - rv = ssl2_CreateSessionCypher(ss, sid, PR_TRUE); - if (rv != SECSuccess) { - goto loser; - } - - /* - ** Fill in the encryption buffer with some random bytes. Then - ** copy in the portion of the session key we are encrypting. - */ - modulusLen = SECKEY_PublicKeyStrength(serverKey); - rek.data = keyData + ckLen; - rek.len = keyLen - ckLen; - eblock = ssl_FormatSSL2Block(modulusLen, &rek); - if (eblock == NULL) - goto loser; - - /* Set up the padding for version 2 rollback detection. */ - /* XXX We should really use defines here */ - if (ss->opt.enableSSL3 || ss->opt.enableTLS) { - PORT_Assert((modulusLen - rek.len) > 12); - PORT_Memset(eblock + modulusLen - rek.len - 8 - 1, 0x03, 8); - } - ekbuf = (PRUint8*) PORT_Alloc(modulusLen); - if (!ekbuf) - goto loser; - PRINT_BUF(10, (ss, "master key encryption block:", - eblock, modulusLen)); - - /* Encrypt ekitem */ - rv = PK11_PubEncryptRaw(serverKey, ekbuf, eblock, modulusLen, - ss->pkcs11PinArg); - if (rv) - goto loser; - - /* Now we have everything ready to send */ - rv = ssl2_SendSessionKeyMessage(ss, cipher, keyLen << 3, ca, caLen, - keyData, ckLen, ekbuf, modulusLen); - if (rv != SECSuccess) { - goto loser; - } - rv = SECSuccess; - goto done; - - loser: - rv = SECFailure; - - loser2: - done: - PORT_Memset(keyData, 0, sizeof(keyData)); - PORT_ZFree(ekbuf, modulusLen); - PORT_ZFree(eblock, modulusLen); - SECKEY_DestroyPublicKey(serverKey); - return rv; -} - -/************************************************************************/ - -/* - * Called from ssl2_HandleMessage in response to SSL_MT_SERVER_FINISHED message. - * Caller holds recvBufLock and handshakeLock - */ -static void -ssl2_ClientRegSessionID(sslSocket *ss, PRUint8 *s) -{ - sslSessionID *sid = ss->sec.ci.sid; - - /* Record entry in nonce cache */ - if (sid->peerCert == NULL) { - PORT_Memcpy(sid->u.ssl2.sessionID, s, sizeof(sid->u.ssl2.sessionID)); - sid->peerCert = CERT_DupCertificate(ss->sec.peerCert); - - } - if (!ss->opt.noCache) - (*ss->sec.cache)(sid); -} - -/* Called from ssl2_HandleMessage() */ -static SECStatus -ssl2_TriggerNextMessage(sslSocket *ss) -{ - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - if ((ss->sec.ci.requiredElements & CIS_HAVE_CERTIFICATE) && - !(ss->sec.ci.sentElements & CIS_HAVE_CERTIFICATE)) { - ss->sec.ci.sentElements |= CIS_HAVE_CERTIFICATE; - rv = ssl2_SendCertificateRequestMessage(ss); - return rv; - } - return SECSuccess; -} - -/* See if it's time to send our finished message, or if the handshakes are -** complete. Send finished message if appropriate. -** Returns SECSuccess unless anything goes wrong. -** -** Called from ssl2_HandleMessage, -** ssl2_HandleVerifyMessage -** ssl2_HandleServerHelloMessage -** ssl2_HandleClientSessionKeyMessage -** ssl2_RestartHandshakeAfterCertReq -** ssl2_RestartHandshakeAfterServerCert -*/ -static SECStatus -ssl2_TryToFinish(sslSocket *ss) -{ - SECStatus rv; - char e, ef; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - e = ss->sec.ci.elements; - ef = e | CIS_HAVE_FINISHED; - if ((ef & ss->sec.ci.requiredElements) == ss->sec.ci.requiredElements) { - if (ss->sec.isServer) { - /* Send server finished message if we already didn't */ - rv = ssl2_SendServerFinishedMessage(ss); - } else { - /* Send client finished message if we already didn't */ - rv = ssl2_SendClientFinishedMessage(ss); - } - if (rv != SECSuccess) { - return rv; - } - if ((e & ss->sec.ci.requiredElements) == ss->sec.ci.requiredElements) { - /* Totally finished */ - ss->handshake = 0; - return SECSuccess; - } - } - return SECSuccess; -} - -/* -** Called from ssl2_HandleRequestCertificate -** ssl2_RestartHandshakeAfterCertReq -*/ -static SECStatus -ssl2_SignResponse(sslSocket *ss, - SECKEYPrivateKey *key, - SECItem *response) -{ - SGNContext * sgn = NULL; - PRUint8 * challenge; - unsigned int len; - SECStatus rv = SECFailure; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - challenge = ss->sec.ci.serverChallenge; - len = ss->sec.ci.serverChallengeLen; - - /* Sign the expected data... */ - sgn = SGN_NewContext(SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION,key); - if (!sgn) - goto done; - rv = SGN_Begin(sgn); - if (rv != SECSuccess) - goto done; - rv = SGN_Update(sgn, ss->sec.ci.readKey, ss->sec.ci.keySize); - if (rv != SECSuccess) - goto done; - rv = SGN_Update(sgn, ss->sec.ci.writeKey, ss->sec.ci.keySize); - if (rv != SECSuccess) - goto done; - rv = SGN_Update(sgn, challenge, len); - if (rv != SECSuccess) - goto done; - rv = SGN_Update(sgn, ss->sec.peerCert->derCert.data, - ss->sec.peerCert->derCert.len); - if (rv != SECSuccess) - goto done; - rv = SGN_End(sgn, response); - if (rv != SECSuccess) - goto done; - -done: - SGN_DestroyContext(sgn, PR_TRUE); - return rv == SECSuccess ? SECSuccess : SECFailure; -} - -/* -** Try to handle a request-certificate message. Get client's certificate -** and private key and sign a message for the server to see. -** Caller must hold handshakeLock -** -** Called from ssl2_HandleMessage(). -*/ -static int -ssl2_HandleRequestCertificate(sslSocket *ss) -{ - CERTCertificate * cert = NULL; /* app-selected client cert. */ - SECKEYPrivateKey *key = NULL; /* priv key for cert. */ - SECStatus rv; - SECItem response; - int ret = 0; - PRUint8 authType; - - - /* - * These things all need to be initialized before we can "goto loser". - */ - response.data = NULL; - - /* get challenge info from connectionInfo */ - authType = ss->sec.ci.authType; - - if (authType != SSL_AT_MD5_WITH_RSA_ENCRYPTION) { - SSL_TRC(7, ("%d: SSL[%d]: unsupported auth type 0x%x", SSL_GETPID(), - ss->fd, authType)); - goto no_cert_error; - } - - /* Get certificate and private-key from client */ - if (!ss->getClientAuthData) { - SSL_TRC(7, ("%d: SSL[%d]: client doesn't support client-auth", - SSL_GETPID(), ss->fd)); - goto no_cert_error; - } - ret = (*ss->getClientAuthData)(ss->getClientAuthDataArg, ss->fd, - NULL, &cert, &key); - if ( ret == SECWouldBlock ) { - ssl_SetAlwaysBlock(ss); - goto done; - } - - if (ret) { - goto no_cert_error; - } - - /* check what the callback function returned */ - if ((!cert) || (!key)) { - /* we are missing either the key or cert */ - if (cert) { - /* got a cert, but no key - free it */ - CERT_DestroyCertificate(cert); - cert = NULL; - } - if (key) { - /* got a key, but no cert - free it */ - SECKEY_DestroyPrivateKey(key); - key = NULL; - } - goto no_cert_error; - } - - rv = ssl2_SignResponse(ss, key, &response); - if ( rv != SECSuccess ) { - ret = -1; - goto loser; - } - - /* Send response message */ - ret = ssl2_SendCertificateResponseMessage(ss, &cert->derCert, &response); - - /* Now, remember the cert we sent. But first, forget any previous one. */ - if (ss->sec.localCert) { - CERT_DestroyCertificate(ss->sec.localCert); - } - ss->sec.localCert = CERT_DupCertificate(cert); - PORT_Assert(!ss->sec.ci.sid->localCert); - if (ss->sec.ci.sid->localCert) { - CERT_DestroyCertificate(ss->sec.ci.sid->localCert); - } - ss->sec.ci.sid->localCert = cert; - cert = NULL; - - goto done; - - no_cert_error: - SSL_TRC(7, ("%d: SSL[%d]: no certificate (ret=%d)", SSL_GETPID(), - ss->fd, ret)); - ret = ssl2_SendErrorMessage(ss, SSL_PE_NO_CERTIFICATE); - - loser: - done: - if ( cert ) { - CERT_DestroyCertificate(cert); - } - if ( key ) { - SECKEY_DestroyPrivateKey(key); - } - if ( response.data ) { - PORT_Free(response.data); - } - - return ret; -} - -/* -** Called from ssl2_HandleMessage for SSL_MT_CLIENT_CERTIFICATE message. -** Caller must hold HandshakeLock and RecvBufLock, since cd and response -** are contained in the gathered input data. -*/ -static SECStatus -ssl2_HandleClientCertificate(sslSocket * ss, - PRUint8 certType, /* XXX unused */ - PRUint8 * cd, - unsigned int cdLen, - PRUint8 * response, - unsigned int responseLen) -{ - CERTCertificate *cert = NULL; - SECKEYPublicKey *pubKey = NULL; - VFYContext * vfy = NULL; - SECItem * derCert; - SECStatus rv = SECFailure; - SECItem certItem; - SECItem rep; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - - /* Extract the certificate */ - certItem.data = cd; - certItem.len = cdLen; - - cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL, - PR_FALSE, PR_TRUE); - if (cert == NULL) { - goto loser; - } - - /* save the certificate, since the auth routine will need it */ - ss->sec.peerCert = cert; - - /* Extract the public key */ - pubKey = CERT_ExtractPublicKey(cert); - if (!pubKey) - goto loser; - - /* Verify the response data... */ - rep.data = response; - rep.len = responseLen; - /* SSL 2.0 only supports RSA certs, so we don't have to worry about - * DSA here. */ - vfy = VFY_CreateContext(pubKey, &rep, SEC_OID_PKCS1_RSA_ENCRYPTION, - ss->pkcs11PinArg); - if (!vfy) - goto loser; - rv = VFY_Begin(vfy); - if (rv) - goto loser; - - rv = VFY_Update(vfy, ss->sec.ci.readKey, ss->sec.ci.keySize); - if (rv) - goto loser; - rv = VFY_Update(vfy, ss->sec.ci.writeKey, ss->sec.ci.keySize); - if (rv) - goto loser; - rv = VFY_Update(vfy, ss->sec.ci.serverChallenge, SSL_CHALLENGE_BYTES); - if (rv) - goto loser; - - derCert = &ss->serverCerts[kt_rsa].serverCert->derCert; - rv = VFY_Update(vfy, derCert->data, derCert->len); - if (rv) - goto loser; - rv = VFY_End(vfy); - if (rv) - goto loser; - - /* Now ask the server application if it likes the certificate... */ - rv = (SECStatus) (*ss->authCertificate)(ss->authCertificateArg, - ss->fd, PR_TRUE, PR_TRUE); - /* Hey, it liked it. */ - if (SECSuccess == rv) - goto done; - -loser: - ss->sec.peerCert = NULL; - CERT_DestroyCertificate(cert); - -done: - VFY_DestroyContext(vfy, PR_TRUE); - SECKEY_DestroyPublicKey(pubKey); - return rv; -} - -/* -** Handle remaining messages between client/server. Process finished -** messages from either side and any authentication requests. -** This should only be called for SSLv2 handshake messages, -** not for application data records. -** Caller must hold handshake lock. -** -** Called from ssl_Do1stHandshake(). -** -*/ -static SECStatus -ssl2_HandleMessage(sslSocket *ss) -{ - PRUint8 * data; - PRUint8 * cid; - unsigned len, certType, certLen, responseLen; - int rv; - int rv2; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ssl_GetRecvBufLock(ss); - - data = ss->gs.buf.buf + ss->gs.recordOffset; - - if (ss->gs.recordLen < 1) { - goto bad_peer; - } - SSL_TRC(3, ("%d: SSL[%d]: received %d message", - SSL_GETPID(), ss->fd, data[0])); - DUMP_MSG(29, (ss, data, ss->gs.recordLen)); - - switch (data[0]) { - case SSL_MT_CLIENT_FINISHED: - if (ss->sec.ci.elements & CIS_HAVE_FINISHED) { - SSL_DBG(("%d: SSL[%d]: dup client-finished message", - SSL_GETPID(), ss->fd)); - goto bad_peer; - } - - /* See if nonce matches */ - len = ss->gs.recordLen - 1; - cid = data + 1; - if ((len != sizeof(ss->sec.ci.connectionID)) || - (PORT_Memcmp(ss->sec.ci.connectionID, cid, len) != 0)) { - SSL_DBG(("%d: SSL[%d]: bad connection-id", SSL_GETPID(), ss->fd)); - PRINT_BUF(5, (ss, "sent connection-id", - ss->sec.ci.connectionID, - sizeof(ss->sec.ci.connectionID))); - PRINT_BUF(5, (ss, "rcvd connection-id", cid, len)); - goto bad_peer; - } - - SSL_TRC(5, ("%d: SSL[%d]: got client finished, waiting for 0x%d", - SSL_GETPID(), ss->fd, - ss->sec.ci.requiredElements ^ ss->sec.ci.elements)); - ss->sec.ci.elements |= CIS_HAVE_FINISHED; - break; - - case SSL_MT_SERVER_FINISHED: - if (ss->sec.ci.elements & CIS_HAVE_FINISHED) { - SSL_DBG(("%d: SSL[%d]: dup server-finished message", - SSL_GETPID(), ss->fd)); - goto bad_peer; - } - - if (ss->gs.recordLen - 1 != SSL2_SESSIONID_BYTES) { - SSL_DBG(("%d: SSL[%d]: bad server-finished message, len=%d", - SSL_GETPID(), ss->fd, ss->gs.recordLen)); - goto bad_peer; - } - ssl2_ClientRegSessionID(ss, data+1); - SSL_TRC(5, ("%d: SSL[%d]: got server finished, waiting for 0x%d", - SSL_GETPID(), ss->fd, - ss->sec.ci.requiredElements ^ ss->sec.ci.elements)); - ss->sec.ci.elements |= CIS_HAVE_FINISHED; - break; - - case SSL_MT_REQUEST_CERTIFICATE: - len = ss->gs.recordLen - 2; - if ((len < SSL_MIN_CHALLENGE_BYTES) || - (len > SSL_MAX_CHALLENGE_BYTES)) { - /* Bad challenge */ - SSL_DBG(("%d: SSL[%d]: bad cert request message: code len=%d", - SSL_GETPID(), ss->fd, len)); - goto bad_peer; - } - - /* save auth request info */ - ss->sec.ci.authType = data[1]; - ss->sec.ci.serverChallengeLen = len; - PORT_Memcpy(ss->sec.ci.serverChallenge, data + 2, len); - - rv = ssl2_HandleRequestCertificate(ss); - if (rv == SECWouldBlock) { - SSL_TRC(3, ("%d: SSL[%d]: async cert request", - SSL_GETPID(), ss->fd)); - /* someone is handling this asynchronously */ - ssl_ReleaseRecvBufLock(ss); - return SECWouldBlock; - } - if (rv) { - SET_ERROR_CODE - goto loser; - } - break; - - case SSL_MT_CLIENT_CERTIFICATE: - if (!ss->authCertificate) { - /* Server asked for authentication and can't handle it */ - PORT_SetError(SSL_ERROR_BAD_SERVER); - goto loser; - } - if (ss->gs.recordLen < SSL_HL_CLIENT_CERTIFICATE_HBYTES) { - SET_ERROR_CODE - goto loser; - } - certType = data[1]; - certLen = (data[2] << 8) | data[3]; - responseLen = (data[4] << 8) | data[5]; - if (certType != SSL_CT_X509_CERTIFICATE) { - PORT_SetError(SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE); - goto loser; - } - if (certLen + responseLen + SSL_HL_CLIENT_CERTIFICATE_HBYTES - > ss->gs.recordLen) { - /* prevent overflow crash. */ - rv = SECFailure; - } else - rv = ssl2_HandleClientCertificate(ss, data[1], - data + SSL_HL_CLIENT_CERTIFICATE_HBYTES, - certLen, - data + SSL_HL_CLIENT_CERTIFICATE_HBYTES + certLen, - responseLen); - if (rv) { - rv2 = ssl2_SendErrorMessage(ss, SSL_PE_BAD_CERTIFICATE); - SET_ERROR_CODE - goto loser; - } - ss->sec.ci.elements |= CIS_HAVE_CERTIFICATE; - break; - - case SSL_MT_ERROR: - rv = (data[1] << 8) | data[2]; - SSL_TRC(2, ("%d: SSL[%d]: got error message, error=0x%x", - SSL_GETPID(), ss->fd, rv)); - - /* Convert protocol error number into API error number */ - switch (rv) { - case SSL_PE_NO_CYPHERS: - rv = SSL_ERROR_NO_CYPHER_OVERLAP; - break; - case SSL_PE_NO_CERTIFICATE: - rv = SSL_ERROR_NO_CERTIFICATE; - break; - case SSL_PE_BAD_CERTIFICATE: - rv = SSL_ERROR_BAD_CERTIFICATE; - break; - case SSL_PE_UNSUPPORTED_CERTIFICATE_TYPE: - rv = SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE; - break; - default: - goto bad_peer; - } - /* XXX make certificate-request optionally fail... */ - PORT_SetError(rv); - goto loser; - - default: - SSL_DBG(("%d: SSL[%d]: unknown message %d", - SSL_GETPID(), ss->fd, data[0])); - goto loser; - } - - SSL_TRC(3, ("%d: SSL[%d]: handled %d message, required=0x%x got=0x%x", - SSL_GETPID(), ss->fd, data[0], - ss->sec.ci.requiredElements, ss->sec.ci.elements)); - - rv = ssl2_TryToFinish(ss); - if (rv != SECSuccess) - goto loser; - - ss->gs.recordLen = 0; - ssl_ReleaseRecvBufLock(ss); - - if (ss->handshake == 0) { - return SECSuccess; - } - - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleMessage; - return ssl2_TriggerNextMessage(ss); - - bad_peer: - PORT_SetError(ss->sec.isServer ? SSL_ERROR_BAD_CLIENT : SSL_ERROR_BAD_SERVER); - /* FALL THROUGH */ - - loser: - ssl_ReleaseRecvBufLock(ss); - return SECFailure; -} - -/************************************************************************/ - -/* Called from ssl_Do1stHandshake, after ssl2_HandleServerHelloMessage or -** ssl2_RestartHandshakeAfterServerCert. -*/ -static SECStatus -ssl2_HandleVerifyMessage(sslSocket *ss) -{ - PRUint8 * data; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - ssl_GetRecvBufLock(ss); - - data = ss->gs.buf.buf + ss->gs.recordOffset; - DUMP_MSG(29, (ss, data, ss->gs.recordLen)); - if ((ss->gs.recordLen != 1 + SSL_CHALLENGE_BYTES) || - (data[0] != SSL_MT_SERVER_VERIFY) || - PORT_Memcmp(data+1, ss->sec.ci.clientChallenge, SSL_CHALLENGE_BYTES)) { - /* Bad server */ - PORT_SetError(SSL_ERROR_BAD_SERVER); - goto loser; - } - ss->sec.ci.elements |= CIS_HAVE_VERIFY; - - SSL_TRC(5, ("%d: SSL[%d]: got server-verify, required=0x%d got=0x%x", - SSL_GETPID(), ss->fd, ss->sec.ci.requiredElements, - ss->sec.ci.elements)); - - rv = ssl2_TryToFinish(ss); - if (rv) - goto loser; - - ss->gs.recordLen = 0; - ssl_ReleaseRecvBufLock(ss); - - if (ss->handshake == 0) { - return SECSuccess; - } - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleMessage; - return SECSuccess; - - - loser: - ssl_ReleaseRecvBufLock(ss); - return SECFailure; -} - -/* Not static because ssl2_GatherData() tests ss->nextHandshake for this value. - * ICK! - * Called from ssl_Do1stHandshake after ssl2_BeginClientHandshake() - */ -SECStatus -ssl2_HandleServerHelloMessage(sslSocket *ss) -{ - sslSessionID * sid; - PRUint8 * cert; - PRUint8 * cs; - PRUint8 * data; - SECStatus rv; - int needed, sidHit, certLen, csLen, cidLen, certType, err; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - if (!ss->opt.enableSSL2) { - PORT_SetError(SSL_ERROR_SSL2_DISABLED); - return SECFailure; - } - - ssl_GetRecvBufLock(ss); - - PORT_Assert(ss->sec.ci.sid != 0); - sid = ss->sec.ci.sid; - - data = ss->gs.buf.buf + ss->gs.recordOffset; - DUMP_MSG(29, (ss, data, ss->gs.recordLen)); - - /* Make sure first message has some data and is the server hello message */ - if ((ss->gs.recordLen < SSL_HL_SERVER_HELLO_HBYTES) - || (data[0] != SSL_MT_SERVER_HELLO)) { - if ((data[0] == SSL_MT_ERROR) && (ss->gs.recordLen == 3)) { - err = (data[1] << 8) | data[2]; - if (err == SSL_PE_NO_CYPHERS) { - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - goto loser; - } - } - goto bad_server; - } - - sidHit = data[1]; - certType = data[2]; - ss->version = (data[3] << 8) | data[4]; - certLen = (data[5] << 8) | data[6]; - csLen = (data[7] << 8) | data[8]; - cidLen = (data[9] << 8) | data[10]; - cert = data + SSL_HL_SERVER_HELLO_HBYTES; - cs = cert + certLen; - - SSL_TRC(5, - ("%d: SSL[%d]: server-hello, hit=%d vers=%x certLen=%d csLen=%d cidLen=%d", - SSL_GETPID(), ss->fd, sidHit, ss->version, certLen, - csLen, cidLen)); - if (ss->version != SSL_LIBRARY_VERSION_2) { - if (ss->version < SSL_LIBRARY_VERSION_2) { - SSL_TRC(3, ("%d: SSL[%d]: demoting self (%x) to server version (%x)", - SSL_GETPID(), ss->fd, SSL_LIBRARY_VERSION_2, - ss->version)); - } else { - SSL_TRC(1, ("%d: SSL[%d]: server version is %x (we are %x)", - SSL_GETPID(), ss->fd, ss->version, SSL_LIBRARY_VERSION_2)); - /* server claims to be newer but does not follow protocol */ - PORT_SetError(SSL_ERROR_UNSUPPORTED_VERSION); - goto loser; - } - } - - if ((SSL_HL_SERVER_HELLO_HBYTES + certLen + csLen + cidLen - > ss->gs.recordLen) - || (csLen % 3) != 0 - /* || cidLen < SSL_CONNECTIONID_BYTES || cidLen > 32 */ - ) { - goto bad_server; - } - - /* Save connection-id. - ** This code only saves the first 16 byte of the connectionID. - ** If the connectionID is shorter than 16 bytes, it is zero-padded. - */ - if (cidLen < sizeof ss->sec.ci.connectionID) - memset(ss->sec.ci.connectionID, 0, sizeof ss->sec.ci.connectionID); - cidLen = PR_MIN(cidLen, sizeof ss->sec.ci.connectionID); - PORT_Memcpy(ss->sec.ci.connectionID, cs + csLen, cidLen); - - /* See if session-id hit */ - needed = CIS_HAVE_MASTER_KEY | CIS_HAVE_FINISHED | CIS_HAVE_VERIFY; - if (sidHit) { - if (certLen || csLen) { - /* Uh oh - bogus server */ - SSL_DBG(("%d: SSL[%d]: client, huh? hit=%d certLen=%d csLen=%d", - SSL_GETPID(), ss->fd, sidHit, certLen, csLen)); - goto bad_server; - } - - /* Total winner. */ - SSL_TRC(1, ("%d: SSL[%d]: client, using nonce for peer=0x%08x " - "port=0x%04x", - SSL_GETPID(), ss->fd, ss->sec.ci.peer, ss->sec.ci.port)); - ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); - ss->sec.authAlgorithm = sid->authAlgorithm; - ss->sec.authKeyBits = sid->authKeyBits; - ss->sec.keaType = sid->keaType; - ss->sec.keaKeyBits = sid->keaKeyBits; - rv = ssl2_CreateSessionCypher(ss, sid, PR_TRUE); - if (rv != SECSuccess) { - goto loser; - } - } else { - if (certType != SSL_CT_X509_CERTIFICATE) { - PORT_SetError(SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE); - goto loser; - } - if (csLen == 0) { - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - SSL_DBG(("%d: SSL[%d]: no cipher overlap", - SSL_GETPID(), ss->fd)); - goto loser; - } - if (certLen == 0) { - SSL_DBG(("%d: SSL[%d]: client, huh? certLen=%d csLen=%d", - SSL_GETPID(), ss->fd, certLen, csLen)); - goto bad_server; - } - - if (sid->cached != never_cached) { - /* Forget our session-id - server didn't like it */ - SSL_TRC(7, ("%d: SSL[%d]: server forgot me, uncaching session-id", - SSL_GETPID(), ss->fd)); - (*ss->sec.uncache)(sid); - ssl_FreeSID(sid); - ss->sec.ci.sid = sid = (sslSessionID*) PORT_ZAlloc(sizeof(sslSessionID)); - if (!sid) { - goto loser; - } - sid->references = 1; - sid->addr = ss->sec.ci.peer; - sid->port = ss->sec.ci.port; - } - - /* decode the server's certificate */ - rv = ssl2_ClientHandleServerCert(ss, cert, certLen); - if (rv != SECSuccess) { - if (PORT_GetError() == SSL_ERROR_BAD_CERTIFICATE) { - (void) ssl2_SendErrorMessage(ss, SSL_PE_BAD_CERTIFICATE); - } - goto loser; - } - - /* Setup new session cipher */ - rv = ssl2_ClientSetupSessionCypher(ss, cs, csLen); - if (rv != SECSuccess) { - if (PORT_GetError() == SSL_ERROR_BAD_CERTIFICATE) { - (void) ssl2_SendErrorMessage(ss, SSL_PE_BAD_CERTIFICATE); - } - goto loser; - } - } - - /* Build up final list of required elements */ - ss->sec.ci.elements = CIS_HAVE_MASTER_KEY; - ss->sec.ci.requiredElements = needed; - - if (!sidHit) { - /* verify the server's certificate. if sidHit, don't check signatures */ - rv = (* ss->authCertificate)(ss->authCertificateArg, ss->fd, - (PRBool)(!sidHit), PR_FALSE); - if (rv) { - if (ss->handleBadCert) { - rv = (*ss->handleBadCert)(ss->badCertArg, ss->fd); - if ( rv ) { - if ( rv == SECWouldBlock ) { - /* someone will handle this connection asynchronously*/ - - SSL_DBG(("%d: SSL[%d]: go to async cert handler", - SSL_GETPID(), ss->fd)); - ssl_ReleaseRecvBufLock(ss); - ssl_SetAlwaysBlock(ss); - return SECWouldBlock; - } - /* cert is bad */ - SSL_DBG(("%d: SSL[%d]: server certificate is no good: error=%d", - SSL_GETPID(), ss->fd, PORT_GetError())); - goto loser; - - } - /* cert is good */ - } else { - SSL_DBG(("%d: SSL[%d]: server certificate is no good: error=%d", - SSL_GETPID(), ss->fd, PORT_GetError())); - goto loser; - } - } - } - /* - ** At this point we have a completed session key and our session - ** cipher is setup and ready to go. Switch to encrypted write routine - ** as all future message data is to be encrypted. - */ - ssl2_UseEncryptedSendFunc(ss); - - rv = ssl2_TryToFinish(ss); - if (rv != SECSuccess) - goto loser; - - ss->gs.recordLen = 0; - - ssl_ReleaseRecvBufLock(ss); - - if (ss->handshake == 0) { - return SECSuccess; - } - - SSL_TRC(5, ("%d: SSL[%d]: got server-hello, required=0x%d got=0x%x", - SSL_GETPID(), ss->fd, ss->sec.ci.requiredElements, - ss->sec.ci.elements)); - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleVerifyMessage; - return SECSuccess; - - bad_server: - PORT_SetError(SSL_ERROR_BAD_SERVER); - /* FALL THROUGH */ - - loser: - ssl_ReleaseRecvBufLock(ss); - return SECFailure; -} - -/* Sends out the initial client Hello message on the connection. - * Acquires and releases the socket's xmitBufLock. - */ -SECStatus -ssl2_BeginClientHandshake(sslSocket *ss) -{ - sslSessionID *sid; - PRUint8 *msg; - PRUint8 *cp; - PRUint8 *localCipherSpecs = NULL; - unsigned int localCipherSize; - unsigned int i; - int sendLen, sidLen = 0; - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - ss->sec.isServer = 0; - ss->sec.sendSequence = 0; - ss->sec.rcvSequence = 0; - ssl_ChooseSessionIDProcs(&ss->sec); - - if (!ss->cipherSpecs) { - rv = ssl2_ConstructCipherSpecs(ss); - if (rv != SECSuccess) - goto loser; - } - - /* count the SSL2 and SSL3 enabled ciphers. - * if either is zero, clear the socket's enable for that protocol. - */ - rv = ssl2_CheckConfigSanity(ss); - if (rv != SECSuccess) - goto loser; - - /* Get peer name of server */ - rv = ssl_GetPeerInfo(ss); - if (rv < 0) { -#ifdef HPUX11 - /* - * On some HP-UX B.11.00 systems, getpeername() occasionally - * fails with ENOTCONN after a successful completion of - * non-blocking connect. I found that if we do a write() - * and then retry getpeername(), it will work. - */ - if (PR_GetError() == PR_NOT_CONNECTED_ERROR) { - char dummy; - (void) PR_Write(ss->fd->lower, &dummy, 0); - rv = ssl_GetPeerInfo(ss); - if (rv < 0) { - goto loser; - } - } -#else - goto loser; -#endif - } - - SSL_TRC(3, ("%d: SSL[%d]: sending client-hello", SSL_GETPID(), ss->fd)); - - /* Try to find server in our session-id cache */ - if (ss->opt.noCache) { - sid = NULL; - } else { - sid = ssl_LookupSID(&ss->sec.ci.peer, ss->sec.ci.port, ss->peerID, - ss->url); - } - while (sid) { /* this isn't really a loop */ - /* if we're not doing this SID's protocol any more, drop it. */ - if (((sid->version < SSL_LIBRARY_VERSION_3_0) && !ss->opt.enableSSL2) || - ((sid->version == SSL_LIBRARY_VERSION_3_0) && !ss->opt.enableSSL3) || - ((sid->version > SSL_LIBRARY_VERSION_3_0) && !ss->opt.enableTLS)) { - ss->sec.uncache(sid); - ssl_FreeSID(sid); - sid = NULL; - break; - } - if (ss->opt.enableSSL2 && sid->version < SSL_LIBRARY_VERSION_3_0) { - /* If the cipher in this sid is not enabled, drop it. */ - for (i = 0; i < ss->sizeCipherSpecs; i += 3) { - if (ss->cipherSpecs[i] == sid->u.ssl2.cipherType) - break; - } - if (i >= ss->sizeCipherSpecs) { - ss->sec.uncache(sid); - ssl_FreeSID(sid); - sid = NULL; - break; - } - } - sidLen = sizeof(sid->u.ssl2.sessionID); - PRINT_BUF(4, (ss, "client, found session-id:", sid->u.ssl2.sessionID, - sidLen)); - ss->version = sid->version; - PORT_Assert(!ss->sec.localCert); - if (ss->sec.localCert) { - CERT_DestroyCertificate(ss->sec.localCert); - } - ss->sec.localCert = CERT_DupCertificate(sid->localCert); - break; /* this isn't really a loop */ - } - if (!sid) { - sidLen = 0; - sid = (sslSessionID*) PORT_ZAlloc(sizeof(sslSessionID)); - if (!sid) { - goto loser; - } - sid->references = 1; - sid->cached = never_cached; - sid->addr = ss->sec.ci.peer; - sid->port = ss->sec.ci.port; - if (ss->peerID != NULL) { - sid->peerID = PORT_Strdup(ss->peerID); - } - if (ss->url != NULL) { - sid->urlSvrName = PORT_Strdup(ss->url); - } - } - ss->sec.ci.sid = sid; - - PORT_Assert(sid != NULL); - - if ((sid->version >= SSL_LIBRARY_VERSION_3_0 || !ss->opt.v2CompatibleHello) && - (ss->opt.enableSSL3 || ss->opt.enableTLS)) { - - ss->gs.state = GS_INIT; - ss->handshake = ssl_GatherRecord1stHandshake; - - /* ssl3_SendClientHello will override this if it succeeds. */ - ss->version = SSL_LIBRARY_VERSION_3_0; - - ssl_GetXmitBufLock(ss); /***************************************/ - ssl_GetSSL3HandshakeLock(ss); - rv = ssl3_SendClientHello(ss); - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_ReleaseXmitBufLock(ss); /***************************************/ - - return rv; - } -#if defined(NSS_ENABLE_ECC) && !defined(NSS_ECC_MORE_THAN_SUITE_B) - /* ensure we don't neogtiate ECC cipher suites with SSL2 hello */ - ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */ - if (ss->cipherSpecs != NULL) { - PORT_Free(ss->cipherSpecs); - ss->cipherSpecs = NULL; - ss->sizeCipherSpecs = 0; - } -#endif - - if (!ss->cipherSpecs) { - rv = ssl2_ConstructCipherSpecs(ss); - if (rv < 0) { - return rv; - } - } - localCipherSpecs = ss->cipherSpecs; - localCipherSize = ss->sizeCipherSpecs; - - sendLen = SSL_HL_CLIENT_HELLO_HBYTES + localCipherSize + sidLen + - SSL_CHALLENGE_BYTES; - - /* Generate challenge bytes for server */ - PK11_GenerateRandom(ss->sec.ci.clientChallenge, SSL_CHALLENGE_BYTES); - - ssl_GetXmitBufLock(ss); /***************************************/ - - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv) - goto unlock_loser; - - /* Construct client-hello message */ - cp = msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_CLIENT_HELLO; - if ( ss->opt.enableTLS ) { - ss->clientHelloVersion = SSL_LIBRARY_VERSION_3_1_TLS; - } else if ( ss->opt.enableSSL3 ) { - ss->clientHelloVersion = SSL_LIBRARY_VERSION_3_0; - } else { - ss->clientHelloVersion = SSL_LIBRARY_VERSION_2; - } - - msg[1] = MSB(ss->clientHelloVersion); - msg[2] = LSB(ss->clientHelloVersion); - msg[3] = MSB(localCipherSize); - msg[4] = LSB(localCipherSize); - msg[5] = MSB(sidLen); - msg[6] = LSB(sidLen); - msg[7] = MSB(SSL_CHALLENGE_BYTES); - msg[8] = LSB(SSL_CHALLENGE_BYTES); - cp += SSL_HL_CLIENT_HELLO_HBYTES; - PORT_Memcpy(cp, localCipherSpecs, localCipherSize); - cp += localCipherSize; - if (sidLen) { - PORT_Memcpy(cp, sid->u.ssl2.sessionID, sidLen); - cp += sidLen; - } - PORT_Memcpy(cp, ss->sec.ci.clientChallenge, SSL_CHALLENGE_BYTES); - - /* Send it to the server */ - DUMP_MSG(29, (ss, msg, sendLen)); - ss->handshakeBegun = 1; - rv = (*ss->sec.send)(ss, msg, sendLen, 0); - - ssl_ReleaseXmitBufLock(ss); /***************************************/ - - if (rv < 0) { - goto loser; - } - - rv = ssl3_StartHandshakeHash(ss, msg, sendLen); - if (rv < 0) { - goto loser; - } - - /* Setup to receive servers hello message */ - ssl_GetRecvBufLock(ss); - ss->gs.recordLen = 0; - ssl_ReleaseRecvBufLock(ss); - - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleServerHelloMessage; - return SECSuccess; - -unlock_loser: - ssl_ReleaseXmitBufLock(ss); -loser: - return SECFailure; -} - -/************************************************************************/ - -/* Handle the CLIENT-MASTER-KEY message. -** Acquires and releases RecvBufLock. -** Called from ssl2_HandleClientHelloMessage(). -*/ -static SECStatus -ssl2_HandleClientSessionKeyMessage(sslSocket *ss) -{ - PRUint8 * data; - unsigned int caLen; - unsigned int ckLen; - unsigned int ekLen; - unsigned int keyBits; - int cipher; - SECStatus rv; - - - ssl_GetRecvBufLock(ss); - - data = ss->gs.buf.buf + ss->gs.recordOffset; - DUMP_MSG(29, (ss, data, ss->gs.recordLen)); - - if ((ss->gs.recordLen < SSL_HL_CLIENT_MASTER_KEY_HBYTES) - || (data[0] != SSL_MT_CLIENT_MASTER_KEY)) { - goto bad_client; - } - cipher = data[1]; - keyBits = (data[2] << 8) | data[3]; - ckLen = (data[4] << 8) | data[5]; - ekLen = (data[6] << 8) | data[7]; - caLen = (data[8] << 8) | data[9]; - - SSL_TRC(5, ("%d: SSL[%d]: session-key, cipher=%d keyBits=%d ckLen=%d ekLen=%d caLen=%d", - SSL_GETPID(), ss->fd, cipher, keyBits, ckLen, ekLen, caLen)); - - if (ss->gs.recordLen < - SSL_HL_CLIENT_MASTER_KEY_HBYTES + ckLen + ekLen + caLen) { - SSL_DBG(("%d: SSL[%d]: protocol size mismatch dataLen=%d", - SSL_GETPID(), ss->fd, ss->gs.recordLen)); - goto bad_client; - } - - /* Use info from client to setup session key */ - rv = ssl2_ServerSetupSessionCypher(ss, cipher, keyBits, - data + SSL_HL_CLIENT_MASTER_KEY_HBYTES, ckLen, - data + SSL_HL_CLIENT_MASTER_KEY_HBYTES + ckLen, ekLen, - data + SSL_HL_CLIENT_MASTER_KEY_HBYTES + ckLen + ekLen, caLen); - ss->gs.recordLen = 0; /* we're done with this record. */ - - ssl_ReleaseRecvBufLock(ss); - - if (rv != SECSuccess) { - goto loser; - } - ss->sec.ci.elements |= CIS_HAVE_MASTER_KEY; - ssl2_UseEncryptedSendFunc(ss); - - /* Send server verify message now that keys are established */ - rv = ssl2_SendServerVerifyMessage(ss); - if (rv != SECSuccess) - goto loser; - - rv = ssl2_TryToFinish(ss); - if (rv != SECSuccess) - goto loser; - if (ss->handshake == 0) { - return SECSuccess; - } - - SSL_TRC(5, ("%d: SSL[%d]: server: waiting for elements=0x%d", - SSL_GETPID(), ss->fd, - ss->sec.ci.requiredElements ^ ss->sec.ci.elements)); - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleMessage; - - return ssl2_TriggerNextMessage(ss); - -bad_client: - ssl_ReleaseRecvBufLock(ss); - PORT_SetError(SSL_ERROR_BAD_CLIENT); - /* FALLTHROUGH */ - -loser: - return SECFailure; -} - -/* - * attempt to restart the handshake after asynchronously handling - * a request for the client's certificate. - * - * inputs: - * cert Client cert chosen by application. - * key Private key associated with cert. - * - * XXX: need to make ssl2 and ssl3 versions of this function agree on whether - * they take the reference, or bump the ref count! - * - * Return value: XXX - * - * Caller holds 1stHandshakeLock. - */ -int -ssl2_RestartHandshakeAfterCertReq(sslSocket * ss, - CERTCertificate * cert, - SECKEYPrivateKey * key) -{ - int ret; - SECStatus rv = SECSuccess; - SECItem response; - - if (ss->version >= SSL_LIBRARY_VERSION_3_0) - return SECFailure; - - response.data = NULL; - - /* generate error if no cert or key */ - if ( ( cert == NULL ) || ( key == NULL ) ) { - goto no_cert; - } - - /* generate signed response to the challenge */ - rv = ssl2_SignResponse(ss, key, &response); - if ( rv != SECSuccess ) { - goto no_cert; - } - - /* Send response message */ - ret = ssl2_SendCertificateResponseMessage(ss, &cert->derCert, &response); - if (ret) { - goto no_cert; - } - - /* try to finish the handshake */ - ret = ssl2_TryToFinish(ss); - if (ret) { - goto loser; - } - - /* done with handshake */ - if (ss->handshake == 0) { - ret = SECSuccess; - goto done; - } - - /* continue handshake */ - ssl_GetRecvBufLock(ss); - ss->gs.recordLen = 0; - ssl_ReleaseRecvBufLock(ss); - - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleMessage; - ret = ssl2_TriggerNextMessage(ss); - goto done; - -no_cert: - /* no cert - send error */ - ret = ssl2_SendErrorMessage(ss, SSL_PE_NO_CERTIFICATE); - goto done; - -loser: - ret = SECFailure; -done: - /* free allocated data */ - if ( response.data ) { - PORT_Free(response.data); - } - - return ret; -} - - -/* restart an SSL connection that we stopped to run certificate dialogs -** XXX Need to document here how an application marks a cert to show that -** the application has accepted it (overridden CERT_VerifyCert). - * - * Return value: XXX - * - * Caller holds 1stHandshakeLock. -*/ -int -ssl2_RestartHandshakeAfterServerCert(sslSocket *ss) -{ - int rv = SECSuccess; - - if (ss->version >= SSL_LIBRARY_VERSION_3_0) - return SECFailure; - - /* SSL 2 - ** At this point we have a completed session key and our session - ** cipher is setup and ready to go. Switch to encrypted write routine - ** as all future message data is to be encrypted. - */ - ssl2_UseEncryptedSendFunc(ss); - - rv = ssl2_TryToFinish(ss); - if (rv == SECSuccess && ss->handshake != NULL) { - /* handshake is not yet finished. */ - - SSL_TRC(5, ("%d: SSL[%d]: got server-hello, required=0x%d got=0x%x", - SSL_GETPID(), ss->fd, ss->sec.ci.requiredElements, - ss->sec.ci.elements)); - - ssl_GetRecvBufLock(ss); - ss->gs.recordLen = 0; /* mark it all used up. */ - ssl_ReleaseRecvBufLock(ss); - - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleVerifyMessage; - } - - return rv; -} - -/* -** Handle the initial hello message from the client -** -** not static because ssl2_GatherData() tests ss->nextHandshake for this value. -*/ -SECStatus -ssl2_HandleClientHelloMessage(sslSocket *ss) -{ - sslSessionID *sid; - sslServerCerts * sc; - CERTCertificate *serverCert; - PRUint8 *msg; - PRUint8 *data; - PRUint8 *cs; - PRUint8 *sd; - PRUint8 *cert = NULL; - PRUint8 *challenge; - unsigned int challengeLen; - SECStatus rv; - int csLen; - int sendLen; - int sdLen; - int certLen; - int pid; - int sent; - int gotXmitBufLock = 0; -#if defined(SOLARIS) && defined(i386) - volatile PRUint8 hit; -#else - int hit; -#endif - PRUint8 csImpl[sizeof implementedCipherSuites]; - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - sc = ss->serverCerts + kt_rsa; - serverCert = sc->serverCert; - - ssl_GetRecvBufLock(ss); - - - data = ss->gs.buf.buf + ss->gs.recordOffset; - DUMP_MSG(29, (ss, data, ss->gs.recordLen)); - - /* Make sure first message has some data and is the client hello message */ - if ((ss->gs.recordLen < SSL_HL_CLIENT_HELLO_HBYTES) - || (data[0] != SSL_MT_CLIENT_HELLO)) { - goto bad_client; - } - - /* Get peer name of client */ - rv = ssl_GetPeerInfo(ss); - if (rv != SECSuccess) { - goto loser; - } - - /* Examine version information */ - /* - * See if this might be a V2 client hello asking to use the V3 protocol - */ - if ((data[0] == SSL_MT_CLIENT_HELLO) && - (data[1] >= MSB(SSL_LIBRARY_VERSION_3_0)) && - (ss->opt.enableSSL3 || ss->opt.enableTLS)) { - rv = ssl3_HandleV2ClientHello(ss, data, ss->gs.recordLen); - if (rv != SECFailure) { /* Success */ - ss->handshake = NULL; - ss->nextHandshake = ssl_GatherRecord1stHandshake; - ss->securityHandshake = NULL; - ss->gs.state = GS_INIT; - - /* ssl3_HandleV3ClientHello has set ss->version, - ** and has gotten us a brand new sid. - */ - ss->sec.ci.sid->version = ss->version; - } - ssl_ReleaseRecvBufLock(ss); - return rv; - } - /* Previously, there was a test here to see if SSL2 was enabled. - ** If not, an error code was set, and SECFailure was returned, - ** without sending any error code to the other end of the connection. - ** That test has been removed. If SSL2 has been disabled, there - ** should be no SSL2 ciphers enabled, and consequently, the code - ** below should send the ssl2 error message SSL_PE_NO_CYPHERS. - ** We now believe this is the correct thing to do, even when SSL2 - ** has been explicitly disabled by the application. - */ - - /* Extract info from message */ - ss->version = (data[1] << 8) | data[2]; - - /* If some client thinks ssl v2 is 2.0 instead of 0.2, we'll allow it. */ - if (ss->version >= SSL_LIBRARY_VERSION_3_0) { - ss->version = SSL_LIBRARY_VERSION_2; - } - - csLen = (data[3] << 8) | data[4]; - sdLen = (data[5] << 8) | data[6]; - challengeLen = (data[7] << 8) | data[8]; - cs = data + SSL_HL_CLIENT_HELLO_HBYTES; - sd = cs + csLen; - challenge = sd + sdLen; - PRINT_BUF(7, (ss, "server, client session-id value:", sd, sdLen)); - - if (!csLen || (csLen % 3) != 0 || - (sdLen != 0 && sdLen != SSL2_SESSIONID_BYTES) || - challengeLen < SSL_MIN_CHALLENGE_BYTES || - challengeLen > SSL_MAX_CHALLENGE_BYTES || - (unsigned)ss->gs.recordLen != - SSL_HL_CLIENT_HELLO_HBYTES + csLen + sdLen + challengeLen) { - SSL_DBG(("%d: SSL[%d]: bad client hello message, len=%d should=%d", - SSL_GETPID(), ss->fd, ss->gs.recordLen, - SSL_HL_CLIENT_HELLO_HBYTES+csLen+sdLen+challengeLen)); - goto bad_client; - } - - SSL_TRC(3, ("%d: SSL[%d]: client version is %x", - SSL_GETPID(), ss->fd, ss->version)); - if (ss->version != SSL_LIBRARY_VERSION_2) { - if (ss->version > SSL_LIBRARY_VERSION_2) { - /* - ** Newer client than us. Things are ok because new clients - ** are required to be backwards compatible with old servers. - ** Change version number to our version number so that client - ** knows whats up. - */ - ss->version = SSL_LIBRARY_VERSION_2; - } else { - SSL_TRC(1, ("%d: SSL[%d]: client version is %x (we are %x)", - SSL_GETPID(), ss->fd, ss->version, SSL_LIBRARY_VERSION_2)); - PORT_SetError(SSL_ERROR_UNSUPPORTED_VERSION); - goto loser; - } - } - - /* Qualify cipher specs before returning them to client */ - csLen = ssl2_QualifyCypherSpecs(ss, cs, csLen); - if (csLen == 0) { - /* no overlap, send client our list of supported SSL v2 ciphers. */ - cs = csImpl; - csLen = sizeof implementedCipherSuites; - PORT_Memcpy(cs, implementedCipherSuites, csLen); - csLen = ssl2_QualifyCypherSpecs(ss, cs, csLen); - if (csLen == 0) { - /* We don't support any SSL v2 ciphers! */ - ssl2_SendErrorMessage(ss, SSL_PE_NO_CYPHERS); - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - goto loser; - } - /* Since this handhsake is going to fail, don't cache it. */ - ss->opt.noCache = 1; - } - - /* Squirrel away the challenge for later */ - PORT_Memcpy(ss->sec.ci.clientChallenge, challenge, challengeLen); - - /* Examine message and see if session-id is good */ - ss->sec.ci.elements = 0; - if (sdLen > 0 && !ss->opt.noCache) { - SSL_TRC(7, ("%d: SSL[%d]: server, lookup client session-id for 0x%08x%08x%08x%08x", - SSL_GETPID(), ss->fd, ss->sec.ci.peer.pr_s6_addr32[0], - ss->sec.ci.peer.pr_s6_addr32[1], - ss->sec.ci.peer.pr_s6_addr32[2], - ss->sec.ci.peer.pr_s6_addr32[3])); - sid = (*ssl_sid_lookup)(&ss->sec.ci.peer, sd, sdLen, ss->dbHandle); - } else { - sid = NULL; - } - if (sid) { - /* Got a good session-id. Short cut! */ - SSL_TRC(1, ("%d: SSL[%d]: server, using session-id for 0x%08x (age=%d)", - SSL_GETPID(), ss->fd, ss->sec.ci.peer, - ssl_Time() - sid->creationTime)); - PRINT_BUF(1, (ss, "session-id value:", sd, sdLen)); - ss->sec.ci.sid = sid; - ss->sec.ci.elements = CIS_HAVE_MASTER_KEY; - hit = 1; - certLen = 0; - csLen = 0; - - ss->sec.authAlgorithm = sid->authAlgorithm; - ss->sec.authKeyBits = sid->authKeyBits; - ss->sec.keaType = sid->keaType; - ss->sec.keaKeyBits = sid->keaKeyBits; - - rv = ssl2_CreateSessionCypher(ss, sid, PR_FALSE); - if (rv != SECSuccess) { - goto loser; - } - } else { - SECItem * derCert = &serverCert->derCert; - - SSL_TRC(7, ("%d: SSL[%d]: server, lookup nonce missed", - SSL_GETPID(), ss->fd)); - if (!serverCert) { - SET_ERROR_CODE - goto loser; - } - hit = 0; - sid = (sslSessionID*) PORT_ZAlloc(sizeof(sslSessionID)); - if (!sid) { - goto loser; - } - sid->references = 1; - sid->addr = ss->sec.ci.peer; - sid->port = ss->sec.ci.port; - - /* Invent a session-id */ - ss->sec.ci.sid = sid; - PK11_GenerateRandom(sid->u.ssl2.sessionID+2, SSL2_SESSIONID_BYTES-2); - - pid = SSL_GETPID(); - sid->u.ssl2.sessionID[0] = MSB(pid); - sid->u.ssl2.sessionID[1] = LSB(pid); - cert = derCert->data; - certLen = derCert->len; - - /* pretend that server sids remember the local cert. */ - PORT_Assert(!sid->localCert); - if (sid->localCert) { - CERT_DestroyCertificate(sid->localCert); - } - sid->localCert = CERT_DupCertificate(serverCert); - - ss->sec.authAlgorithm = ssl_sign_rsa; - ss->sec.keaType = ssl_kea_rsa; - ss->sec.keaKeyBits = \ - ss->sec.authKeyBits = ss->serverCerts[kt_rsa].serverKeyBits; - } - - /* server sids don't remember the local cert, so whether we found - ** a sid or not, just "remember" we used the rsa server cert. - */ - if (ss->sec.localCert) { - CERT_DestroyCertificate(ss->sec.localCert); - } - ss->sec.localCert = CERT_DupCertificate(serverCert); - - /* Build up final list of required elements */ - ss->sec.ci.requiredElements = CIS_HAVE_MASTER_KEY | CIS_HAVE_FINISHED; - if (ss->opt.requestCertificate) { - ss->sec.ci.requiredElements |= CIS_HAVE_CERTIFICATE; - } - ss->sec.ci.sentElements = 0; - - /* Send hello message back to client */ - sendLen = SSL_HL_SERVER_HELLO_HBYTES + certLen + csLen - + SSL_CONNECTIONID_BYTES; - - ssl_GetXmitBufLock(ss); gotXmitBufLock = 1; - rv = ssl2_GetSendBuffer(ss, sendLen); - if (rv != SECSuccess) { - goto loser; - } - - SSL_TRC(3, ("%d: SSL[%d]: sending server-hello (%d)", - SSL_GETPID(), ss->fd, sendLen)); - - msg = ss->sec.ci.sendBuf.buf; - msg[0] = SSL_MT_SERVER_HELLO; - msg[1] = hit; - msg[2] = SSL_CT_X509_CERTIFICATE; - msg[3] = MSB(ss->version); - msg[4] = LSB(ss->version); - msg[5] = MSB(certLen); - msg[6] = LSB(certLen); - msg[7] = MSB(csLen); - msg[8] = LSB(csLen); - msg[9] = MSB(SSL_CONNECTIONID_BYTES); - msg[10] = LSB(SSL_CONNECTIONID_BYTES); - if (certLen) { - PORT_Memcpy(msg+SSL_HL_SERVER_HELLO_HBYTES, cert, certLen); - } - if (csLen) { - PORT_Memcpy(msg+SSL_HL_SERVER_HELLO_HBYTES+certLen, cs, csLen); - } - PORT_Memcpy(msg+SSL_HL_SERVER_HELLO_HBYTES+certLen+csLen, - ss->sec.ci.connectionID, SSL_CONNECTIONID_BYTES); - - DUMP_MSG(29, (ss, msg, sendLen)); - - ss->handshakeBegun = 1; - sent = (*ss->sec.send)(ss, msg, sendLen, 0); - if (sent < 0) { - goto loser; - } - ssl_ReleaseXmitBufLock(ss); gotXmitBufLock = 0; - - ss->gs.recordLen = 0; - ss->handshake = ssl_GatherRecord1stHandshake; - if (hit) { - /* Old SID Session key is good. Go encrypted */ - ssl2_UseEncryptedSendFunc(ss); - - /* Send server verify message now that keys are established */ - rv = ssl2_SendServerVerifyMessage(ss); - if (rv != SECSuccess) - goto loser; - - ss->nextHandshake = ssl2_HandleMessage; - ssl_ReleaseRecvBufLock(ss); - rv = ssl2_TriggerNextMessage(ss); - return rv; - } - ss->nextHandshake = ssl2_HandleClientSessionKeyMessage; - ssl_ReleaseRecvBufLock(ss); - return SECSuccess; - - bad_client: - PORT_SetError(SSL_ERROR_BAD_CLIENT); - /* FALLTHROUGH */ - - loser: - if (gotXmitBufLock) { - ssl_ReleaseXmitBufLock(ss); gotXmitBufLock = 0; - } - SSL_TRC(10, ("%d: SSL[%d]: server, wait for client-hello lossage", - SSL_GETPID(), ss->fd)); - ssl_ReleaseRecvBufLock(ss); - return SECFailure; -} - -SECStatus -ssl2_BeginServerHandshake(sslSocket *ss) -{ - SECStatus rv; - sslServerCerts * rsaAuth = ss->serverCerts + kt_rsa; - - ss->sec.isServer = 1; - ssl_ChooseSessionIDProcs(&ss->sec); - ss->sec.sendSequence = 0; - ss->sec.rcvSequence = 0; - - /* don't turn on SSL2 if we don't have an RSA key and cert */ - if (!rsaAuth->serverKeyPair || !rsaAuth->SERVERKEY || - !rsaAuth->serverCert) { - ss->opt.enableSSL2 = PR_FALSE; - } - - if (!ss->cipherSpecs) { - rv = ssl2_ConstructCipherSpecs(ss); - if (rv != SECSuccess) - goto loser; - } - - /* count the SSL2 and SSL3 enabled ciphers. - * if either is zero, clear the socket's enable for that protocol. - */ - rv = ssl2_CheckConfigSanity(ss); - if (rv != SECSuccess) - goto loser; - - /* - ** Generate connection-id. Always do this, even if things fail - ** immediately. This way the random number generator is always - ** rolling around, every time we get a connection. - */ - PK11_GenerateRandom(ss->sec.ci.connectionID, - sizeof(ss->sec.ci.connectionID)); - - ss->gs.recordLen = 0; - ss->handshake = ssl_GatherRecord1stHandshake; - ss->nextHandshake = ssl2_HandleClientHelloMessage; - return SECSuccess; - -loser: - return SECFailure; -} - -/* This function doesn't really belong in this file. -** It's here to keep AIX compilers from optimizing it away, -** and not including it in the DSO. -*/ - -#include "nss.h" -extern const char __nss_ssl_rcsid[]; -extern const char __nss_ssl_sccsid[]; - -PRBool -NSSSSL_VersionCheck(const char *importedVersion) -{ - /* - * This is the secret handshake algorithm. - * - * This release has a simple version compatibility - * check algorithm. This release is not backward - * compatible with previous major releases. It is - * not compatible with future major, minor, or - * patch releases. - */ - volatile char c; /* force a reference that won't get optimized away */ - - c = __nss_ssl_rcsid[0] + __nss_ssl_sccsid[0]; - return NSS_VersionCheck(importedVersion); -} diff --git a/security/nss/lib/ssl/ssldef.c b/security/nss/lib/ssl/ssldef.c deleted file mode 100644 index 9a473380e..000000000 --- a/security/nss/lib/ssl/ssldef.c +++ /dev/null @@ -1,238 +0,0 @@ -/* - * "Default" SSLSocket methods, used by sockets that do neither SSL nor socks. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "ssl.h" -#include "sslimpl.h" - -#if defined(WIN32) -#define MAP_ERROR(from,to) if (err == from) { PORT_SetError(to); } -#define DEFINE_ERROR PRErrorCode err = PR_GetError(); -#else -#define MAP_ERROR(from,to) -#define DEFINE_ERROR -#endif - -int ssl_DefConnect(sslSocket *ss, const PRNetAddr *sa) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->connect(lower, sa, ss->cTimeout); - return rv; -} - -int ssl_DefBind(sslSocket *ss, const PRNetAddr *addr) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->bind(lower, addr); - return rv; -} - -int ssl_DefListen(sslSocket *ss, int backlog) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->listen(lower, backlog); - return rv; -} - -int ssl_DefShutdown(sslSocket *ss, int how) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->shutdown(lower, how); - return rv; -} - -int ssl_DefRecv(sslSocket *ss, unsigned char *buf, int len, int flags) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->recv(lower, (void *)buf, len, flags, ss->rTimeout); - if (rv < 0) { - DEFINE_ERROR - MAP_ERROR(PR_SOCKET_SHUTDOWN_ERROR, PR_CONNECT_RESET_ERROR) - } else if (rv > len) { - PORT_Assert(rv <= len); - PORT_SetError(PR_BUFFER_OVERFLOW_ERROR); - rv = SECFailure; - } - return rv; -} - -/* Default (unencrypted) send. - * For blocking sockets, always returns len or SECFailure, no short writes. - * For non-blocking sockets: - * Returns positive count if any data was written, else returns SECFailure. - * Short writes may occur. Does not return SECWouldBlock. - */ -int ssl_DefSend(sslSocket *ss, const unsigned char *buf, int len, int flags) -{ - PRFileDesc *lower = ss->fd->lower; - int sent = 0; - -#if NSS_DISABLE_NAGLE_DELAYS - /* Although this is overkill, we disable Nagle delays completely for - ** SSL sockets. - */ - if (ss->opt.useSecurity && !ss->delayDisabled) { - ssl_EnableNagleDelay(ss, PR_FALSE); /* ignore error */ - ss->delayDisabled = 1; - } -#endif - do { - int rv = lower->methods->send(lower, (const void *)(buf + sent), - len - sent, flags, ss->wTimeout); - if (rv < 0) { - PRErrorCode err = PR_GetError(); - if (err == PR_WOULD_BLOCK_ERROR) { - ss->lastWriteBlocked = 1; - return sent ? sent : SECFailure; - } - ss->lastWriteBlocked = 0; - MAP_ERROR(PR_CONNECT_ABORTED_ERROR, PR_CONNECT_RESET_ERROR) - /* Loser */ - return rv; - } - sent += rv; - } while (len > sent); - ss->lastWriteBlocked = 0; - return sent; -} - -int ssl_DefRead(sslSocket *ss, unsigned char *buf, int len) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->read(lower, (void *)buf, len); - if (rv < 0) { - DEFINE_ERROR - MAP_ERROR(PR_SOCKET_SHUTDOWN_ERROR, PR_CONNECT_RESET_ERROR) - } - return rv; -} - -int ssl_DefWrite(sslSocket *ss, const unsigned char *buf, int len) -{ - PRFileDesc *lower = ss->fd->lower; - int sent = 0; - - do { - int rv = lower->methods->write(lower, (const void *)(buf + sent), - len - sent); - if (rv < 0) { - PRErrorCode err = PR_GetError(); - if (err == PR_WOULD_BLOCK_ERROR) { - ss->lastWriteBlocked = 1; - return sent ? sent : SECFailure; - } - ss->lastWriteBlocked = 0; - MAP_ERROR(PR_CONNECT_ABORTED_ERROR, PR_CONNECT_RESET_ERROR) - /* Loser */ - return rv; - } - sent += rv; - } while (len > sent); - ss->lastWriteBlocked = 0; - return sent; -} - -int ssl_DefGetpeername(sslSocket *ss, PRNetAddr *name) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->getpeername(lower, name); - return rv; -} - -int ssl_DefGetsockname(sslSocket *ss, PRNetAddr *name) -{ - PRFileDesc *lower = ss->fd->lower; - int rv; - - rv = lower->methods->getsockname(lower, name); - return rv; -} - -int ssl_DefClose(sslSocket *ss) -{ - PRFileDesc *fd; - PRFileDesc *popped; - int rv; - - fd = ss->fd; - - /* First, remove the SSL layer PRFileDesc from the socket's stack, - ** then invoke the SSL layer's PRFileDesc destructor. - ** This must happen before the next layer down is closed. - */ - PORT_Assert(fd->higher == NULL); - if (fd->higher) { - PORT_SetError(PR_BAD_DESCRIPTOR_ERROR); - return SECFailure; - } - ss->fd = NULL; - - /* PR_PopIOLayer will swap the contents of the top two PRFileDescs on - ** the stack, and then remove the second one. This way, the address - ** of the PRFileDesc on the top of the stack doesn't change. - */ - popped = PR_PopIOLayer(fd, PR_TOP_IO_LAYER); - popped->dtor(popped); - - /* fd is now the PRFileDesc for the next layer down. - ** Now close the underlying socket. - */ - rv = fd->methods->close(fd); - - ssl_FreeSocket(ss); - - SSL_TRC(5, ("%d: SSL[%d]: closing, rv=%d errno=%d", - SSL_GETPID(), fd, rv, PORT_GetError())); - return rv; -} diff --git a/security/nss/lib/ssl/sslenum.c b/security/nss/lib/ssl/sslenum.c deleted file mode 100644 index 8100231b2..000000000 --- a/security/nss/lib/ssl/sslenum.c +++ /dev/null @@ -1,151 +0,0 @@ -/* - * Table enumerating all implemented cipher suites - * Part of public API. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Stephen Henson <stephen.henson@gemplus.com> - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "ssl.h" -#include "sslproto.h" - -/* - * The ciphers are listed in the following order: - * - stronger ciphers before weaker ciphers - * - national ciphers before international ciphers - * - faster ciphers before slower ciphers - * - * National ciphers such as Camellia are listed before international ciphers - * such as AES and RC4 to allow servers that prefer Camellia to negotiate - * Camellia without having to disable AES and RC4, which are needed for - * interoperability with clients that don't yet implement Camellia. - */ -const PRUint16 SSL_ImplementedCiphers[] = { - /* 256-bit */ -#ifdef NSS_ENABLE_ECC - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, -#endif /* NSS_ENABLE_ECC */ - TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, - TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, - TLS_DHE_RSA_WITH_AES_256_CBC_SHA, - TLS_DHE_DSS_WITH_AES_256_CBC_SHA, -#ifdef NSS_ENABLE_ECC - TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, - TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, -#endif /* NSS_ENABLE_ECC */ - TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, - TLS_RSA_WITH_AES_256_CBC_SHA, - - /* 128-bit */ -#ifdef NSS_ENABLE_ECC - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - TLS_ECDHE_RSA_WITH_RC4_128_SHA, - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, -#endif /* NSS_ENABLE_ECC */ - TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, - TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, - TLS_DHE_DSS_WITH_RC4_128_SHA, - TLS_DHE_RSA_WITH_AES_128_CBC_SHA, - TLS_DHE_DSS_WITH_AES_128_CBC_SHA, -#ifdef NSS_ENABLE_ECC - TLS_ECDH_RSA_WITH_RC4_128_SHA, - TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, - TLS_ECDH_ECDSA_WITH_RC4_128_SHA, - TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, -#endif /* NSS_ENABLE_ECC */ - TLS_RSA_WITH_SEED_CBC_SHA, - TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, - SSL_RSA_WITH_RC4_128_MD5, - SSL_RSA_WITH_RC4_128_SHA, - TLS_RSA_WITH_AES_128_CBC_SHA, - - /* 112-bit 3DES */ -#ifdef NSS_ENABLE_ECC - TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, -#endif /* NSS_ENABLE_ECC */ - SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, - SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, -#ifdef NSS_ENABLE_ECC - TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, - TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, -#endif /* NSS_ENABLE_ECC */ - SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, - SSL_RSA_WITH_3DES_EDE_CBC_SHA, - - /* 56-bit DES "domestic" cipher suites */ - SSL_DHE_RSA_WITH_DES_CBC_SHA, - SSL_DHE_DSS_WITH_DES_CBC_SHA, - SSL_RSA_FIPS_WITH_DES_CBC_SHA, - SSL_RSA_WITH_DES_CBC_SHA, - - /* export ciphersuites with 1024-bit public key exchange keys */ - TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, - TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, - - /* export ciphersuites with 512-bit public key exchange keys */ - SSL_RSA_EXPORT_WITH_RC4_40_MD5, - SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, - - /* ciphersuites with no encryption */ -#ifdef NSS_ENABLE_ECC - TLS_ECDHE_ECDSA_WITH_NULL_SHA, - TLS_ECDHE_RSA_WITH_NULL_SHA, - TLS_ECDH_RSA_WITH_NULL_SHA, - TLS_ECDH_ECDSA_WITH_NULL_SHA, -#endif /* NSS_ENABLE_ECC */ - SSL_RSA_WITH_NULL_SHA, - SSL_RSA_WITH_NULL_MD5, - - /* SSL2 cipher suites. */ - SSL_EN_RC4_128_WITH_MD5, - SSL_EN_RC2_128_CBC_WITH_MD5, - SSL_EN_DES_192_EDE3_CBC_WITH_MD5, /* actually 112, not 192 */ - SSL_EN_DES_64_CBC_WITH_MD5, - SSL_EN_RC4_128_EXPORT40_WITH_MD5, - SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, - - 0 - -}; - -const PRUint16 SSL_NumImplementedCiphers = - (sizeof SSL_ImplementedCiphers) / (sizeof SSL_ImplementedCiphers[0]) - 1; - diff --git a/security/nss/lib/ssl/sslerr.c b/security/nss/lib/ssl/sslerr.c deleted file mode 100644 index d619bbfb0..000000000 --- a/security/nss/lib/ssl/sslerr.c +++ /dev/null @@ -1,74 +0,0 @@ -/* - * Function to set error code only when meaningful error has not already - * been set. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "prerror.h" -#include "secerr.h" -#include "sslerr.h" -#include "seccomon.h" - -/* look at the current value of PR_GetError, and evaluate it to see - * if it is meaningful or meaningless (out of context). - * If it is meaningless, replace it with the hiLevelError. - * Returns the chosen error value. - */ -int -ssl_MapLowLevelError(int hiLevelError) -{ - int oldErr = PORT_GetError(); - - switch (oldErr) { - - case 0: - case PR_IO_ERROR: - case SEC_ERROR_IO: - case SEC_ERROR_BAD_DATA: - case SEC_ERROR_LIBRARY_FAILURE: - case SEC_ERROR_EXTENSION_NOT_FOUND: - case SSL_ERROR_BAD_CLIENT: - case SSL_ERROR_BAD_SERVER: - case SSL_ERROR_SESSION_NOT_FOUND: - PORT_SetError(hiLevelError); - return hiLevelError; - - default: /* leave the majority of error codes alone. */ - return oldErr; - } -} diff --git a/security/nss/lib/ssl/sslerr.h b/security/nss/lib/ssl/sslerr.h deleted file mode 100644 index 3c38fbefa..000000000 --- a/security/nss/lib/ssl/sslerr.h +++ /dev/null @@ -1,202 +0,0 @@ -/* - * Enumeration of all SSL-specific error codes. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#ifndef __SSL_ERR_H_ -#define __SSL_ERR_H_ - - -#define SSL_ERROR_BASE (-0x3000) -#define SSL_ERROR_LIMIT (SSL_ERROR_BASE + 1000) - -#define IS_SSL_ERROR(code) \ - (((code) >= SSL_ERROR_BASE) && ((code) < SSL_ERROR_LIMIT)) - -#ifndef NO_SECURITY_ERROR_ENUM -typedef enum { -SSL_ERROR_EXPORT_ONLY_SERVER = (SSL_ERROR_BASE + 0), -SSL_ERROR_US_ONLY_SERVER = (SSL_ERROR_BASE + 1), -SSL_ERROR_NO_CYPHER_OVERLAP = (SSL_ERROR_BASE + 2), -/* - * Received an alert reporting what we did wrong. (more alerts below) - */ -SSL_ERROR_NO_CERTIFICATE /*_ALERT */ = (SSL_ERROR_BASE + 3), -SSL_ERROR_BAD_CERTIFICATE = (SSL_ERROR_BASE + 4), - /* error 5 is obsolete */ -SSL_ERROR_BAD_CLIENT = (SSL_ERROR_BASE + 6), -SSL_ERROR_BAD_SERVER = (SSL_ERROR_BASE + 7), -SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE = (SSL_ERROR_BASE + 8), -SSL_ERROR_UNSUPPORTED_VERSION = (SSL_ERROR_BASE + 9), - /* error 10 is obsolete */ -SSL_ERROR_WRONG_CERTIFICATE = (SSL_ERROR_BASE + 11), -SSL_ERROR_BAD_CERT_DOMAIN = (SSL_ERROR_BASE + 12), -SSL_ERROR_POST_WARNING = (SSL_ERROR_BASE + 13), -SSL_ERROR_SSL2_DISABLED = (SSL_ERROR_BASE + 14), -SSL_ERROR_BAD_MAC_READ = (SSL_ERROR_BASE + 15), -/* - * Received an alert reporting what we did wrong. - * (two more alerts above, and many more below) - */ -SSL_ERROR_BAD_MAC_ALERT = (SSL_ERROR_BASE + 16), -SSL_ERROR_BAD_CERT_ALERT = (SSL_ERROR_BASE + 17), -SSL_ERROR_REVOKED_CERT_ALERT = (SSL_ERROR_BASE + 18), -SSL_ERROR_EXPIRED_CERT_ALERT = (SSL_ERROR_BASE + 19), - -SSL_ERROR_SSL_DISABLED = (SSL_ERROR_BASE + 20), -SSL_ERROR_FORTEZZA_PQG = (SSL_ERROR_BASE + 21), -SSL_ERROR_UNKNOWN_CIPHER_SUITE = (SSL_ERROR_BASE + 22), -SSL_ERROR_NO_CIPHERS_SUPPORTED = (SSL_ERROR_BASE + 23), -SSL_ERROR_BAD_BLOCK_PADDING = (SSL_ERROR_BASE + 24), -SSL_ERROR_RX_RECORD_TOO_LONG = (SSL_ERROR_BASE + 25), -SSL_ERROR_TX_RECORD_TOO_LONG = (SSL_ERROR_BASE + 26), -/* - * Received a malformed (too long or short) SSL handshake. - */ -SSL_ERROR_RX_MALFORMED_HELLO_REQUEST = (SSL_ERROR_BASE + 27), -SSL_ERROR_RX_MALFORMED_CLIENT_HELLO = (SSL_ERROR_BASE + 28), -SSL_ERROR_RX_MALFORMED_SERVER_HELLO = (SSL_ERROR_BASE + 29), -SSL_ERROR_RX_MALFORMED_CERTIFICATE = (SSL_ERROR_BASE + 30), -SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH = (SSL_ERROR_BASE + 31), -SSL_ERROR_RX_MALFORMED_CERT_REQUEST = (SSL_ERROR_BASE + 32), -SSL_ERROR_RX_MALFORMED_HELLO_DONE = (SSL_ERROR_BASE + 33), -SSL_ERROR_RX_MALFORMED_CERT_VERIFY = (SSL_ERROR_BASE + 34), -SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH = (SSL_ERROR_BASE + 35), -SSL_ERROR_RX_MALFORMED_FINISHED = (SSL_ERROR_BASE + 36), -/* - * Received a malformed (too long or short) SSL record. - */ -SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER = (SSL_ERROR_BASE + 37), -SSL_ERROR_RX_MALFORMED_ALERT = (SSL_ERROR_BASE + 38), -SSL_ERROR_RX_MALFORMED_HANDSHAKE = (SSL_ERROR_BASE + 39), -SSL_ERROR_RX_MALFORMED_APPLICATION_DATA = (SSL_ERROR_BASE + 40), -/* - * Received an SSL handshake that was inappropriate for the state we're in. - * E.g. Server received message from server, or wrong state in state machine. - */ -SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST = (SSL_ERROR_BASE + 41), -SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO = (SSL_ERROR_BASE + 42), -SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO = (SSL_ERROR_BASE + 43), -SSL_ERROR_RX_UNEXPECTED_CERTIFICATE = (SSL_ERROR_BASE + 44), -SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH = (SSL_ERROR_BASE + 45), -SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST = (SSL_ERROR_BASE + 46), -SSL_ERROR_RX_UNEXPECTED_HELLO_DONE = (SSL_ERROR_BASE + 47), -SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY = (SSL_ERROR_BASE + 48), -SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH = (SSL_ERROR_BASE + 49), -SSL_ERROR_RX_UNEXPECTED_FINISHED = (SSL_ERROR_BASE + 50), -/* - * Received an SSL record that was inappropriate for the state we're in. - */ -SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER = (SSL_ERROR_BASE + 51), -SSL_ERROR_RX_UNEXPECTED_ALERT = (SSL_ERROR_BASE + 52), -SSL_ERROR_RX_UNEXPECTED_HANDSHAKE = (SSL_ERROR_BASE + 53), -SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA= (SSL_ERROR_BASE + 54), -/* - * Received record/message with unknown discriminant. - */ -SSL_ERROR_RX_UNKNOWN_RECORD_TYPE = (SSL_ERROR_BASE + 55), -SSL_ERROR_RX_UNKNOWN_HANDSHAKE = (SSL_ERROR_BASE + 56), -SSL_ERROR_RX_UNKNOWN_ALERT = (SSL_ERROR_BASE + 57), -/* - * Received an alert reporting what we did wrong. (more alerts above) - */ -SSL_ERROR_CLOSE_NOTIFY_ALERT = (SSL_ERROR_BASE + 58), -SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT = (SSL_ERROR_BASE + 59), -SSL_ERROR_DECOMPRESSION_FAILURE_ALERT = (SSL_ERROR_BASE + 60), -SSL_ERROR_HANDSHAKE_FAILURE_ALERT = (SSL_ERROR_BASE + 61), -SSL_ERROR_ILLEGAL_PARAMETER_ALERT = (SSL_ERROR_BASE + 62), -SSL_ERROR_UNSUPPORTED_CERT_ALERT = (SSL_ERROR_BASE + 63), -SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT = (SSL_ERROR_BASE + 64), - -SSL_ERROR_GENERATE_RANDOM_FAILURE = (SSL_ERROR_BASE + 65), -SSL_ERROR_SIGN_HASHES_FAILURE = (SSL_ERROR_BASE + 66), -SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE = (SSL_ERROR_BASE + 67), -SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE = (SSL_ERROR_BASE + 68), -SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE = (SSL_ERROR_BASE + 69), - -SSL_ERROR_ENCRYPTION_FAILURE = (SSL_ERROR_BASE + 70), -SSL_ERROR_DECRYPTION_FAILURE = (SSL_ERROR_BASE + 71), -SSL_ERROR_SOCKET_WRITE_FAILURE = (SSL_ERROR_BASE + 72), - -SSL_ERROR_MD5_DIGEST_FAILURE = (SSL_ERROR_BASE + 73), -SSL_ERROR_SHA_DIGEST_FAILURE = (SSL_ERROR_BASE + 74), -SSL_ERROR_MAC_COMPUTATION_FAILURE = (SSL_ERROR_BASE + 75), -SSL_ERROR_SYM_KEY_CONTEXT_FAILURE = (SSL_ERROR_BASE + 76), -SSL_ERROR_SYM_KEY_UNWRAP_FAILURE = (SSL_ERROR_BASE + 77), -SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED = (SSL_ERROR_BASE + 78), -SSL_ERROR_IV_PARAM_FAILURE = (SSL_ERROR_BASE + 79), -SSL_ERROR_INIT_CIPHER_SUITE_FAILURE = (SSL_ERROR_BASE + 80), -SSL_ERROR_SESSION_KEY_GEN_FAILURE = (SSL_ERROR_BASE + 81), -SSL_ERROR_NO_SERVER_KEY_FOR_ALG = (SSL_ERROR_BASE + 82), -SSL_ERROR_TOKEN_INSERTION_REMOVAL = (SSL_ERROR_BASE + 83), -SSL_ERROR_TOKEN_SLOT_NOT_FOUND = (SSL_ERROR_BASE + 84), -SSL_ERROR_NO_COMPRESSION_OVERLAP = (SSL_ERROR_BASE + 85), -SSL_ERROR_HANDSHAKE_NOT_COMPLETED = (SSL_ERROR_BASE + 86), -SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE = (SSL_ERROR_BASE + 87), -SSL_ERROR_CERT_KEA_MISMATCH = (SSL_ERROR_BASE + 88), -SSL_ERROR_NO_TRUSTED_SSL_CLIENT_CA = (SSL_ERROR_BASE + 89), -SSL_ERROR_SESSION_NOT_FOUND = (SSL_ERROR_BASE + 90), - -SSL_ERROR_DECRYPTION_FAILED_ALERT = (SSL_ERROR_BASE + 91), -SSL_ERROR_RECORD_OVERFLOW_ALERT = (SSL_ERROR_BASE + 92), -SSL_ERROR_UNKNOWN_CA_ALERT = (SSL_ERROR_BASE + 93), -SSL_ERROR_ACCESS_DENIED_ALERT = (SSL_ERROR_BASE + 94), -SSL_ERROR_DECODE_ERROR_ALERT = (SSL_ERROR_BASE + 95), -SSL_ERROR_DECRYPT_ERROR_ALERT = (SSL_ERROR_BASE + 96), -SSL_ERROR_EXPORT_RESTRICTION_ALERT = (SSL_ERROR_BASE + 97), -SSL_ERROR_PROTOCOL_VERSION_ALERT = (SSL_ERROR_BASE + 98), -SSL_ERROR_INSUFFICIENT_SECURITY_ALERT = (SSL_ERROR_BASE + 99), -SSL_ERROR_INTERNAL_ERROR_ALERT = (SSL_ERROR_BASE + 100), -SSL_ERROR_USER_CANCELED_ALERT = (SSL_ERROR_BASE + 101), -SSL_ERROR_NO_RENEGOTIATION_ALERT = (SSL_ERROR_BASE + 102), - -SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED = (SSL_ERROR_BASE + 103), - -SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT = (SSL_ERROR_BASE + 104), -SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT = (SSL_ERROR_BASE + 105), -SSL_ERROR_UNRECOGNIZED_NAME_ALERT = (SSL_ERROR_BASE + 106), -SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT = (SSL_ERROR_BASE + 107), -SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT = (SSL_ERROR_BASE + 108), - -SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET = (SSL_ERROR_BASE + 109), -SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET = (SSL_ERROR_BASE + 110), - -SSL_ERROR_END_OF_LIST /* let the c compiler determine the value of this. */ -} SSLErrorCodes; -#endif /* NO_SECURITY_ERROR_ENUM */ - -#endif /* __SSL_ERR_H_ */ diff --git a/security/nss/lib/ssl/sslgathr.c b/security/nss/lib/ssl/sslgathr.c deleted file mode 100644 index 4d7db0bc4..000000000 --- a/security/nss/lib/ssl/sslgathr.c +++ /dev/null @@ -1,483 +0,0 @@ -/* - * Gather (Read) entire SSL2 records from socket into buffer. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#include "cert.h" -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" - -/* Forward static declarations */ -static SECStatus ssl2_HandleV3HandshakeRecord(sslSocket *ss); - -/* -** Gather a single record of data from the receiving stream. This code -** first gathers the header (2 or 3 bytes long depending on the value of -** the most significant bit in the first byte) then gathers up the data -** for the record into gs->buf. This code handles non-blocking I/O -** and is to be called multiple times until ss->sec.recordLen != 0. -** This function decrypts the gathered record in place, in gs_buf. - * - * Caller must hold RecvBufLock. - * - * Returns +1 when it has gathered a complete SSLV2 record. - * Returns 0 if it hits EOF. - * Returns -1 (SECFailure) on any error - * Returns -2 (SECWouldBlock) when it gathers an SSL v3 client hello header. -** -** The SSL2 Gather State machine has 4 states: -** GS_INIT - Done reading in previous record. Haven't begun to read in -** next record. When ssl2_GatherData is called with the machine -** in this state, the machine will attempt to read the first 3 -** bytes of the SSL2 record header, and will advance the state -** to GS_HEADER. -** -** GS_HEADER - The machine is in this state while waiting for the completion -** of the first 3 bytes of the SSL2 record. When complete, the -** machine will compute the remaining unread length of this record -** and will initiate a read of that many bytes. The machine will -** advance to one of two states, depending on whether the record -** is encrypted (GS_MAC), or unencrypted (GS_DATA). -** -** GS_MAC - The machine is in this state while waiting for the remainder -** of the SSL2 record to be read in. When the read is completed, -** the machine checks the record for valid length, decrypts it, -** and checks and discards the MAC, then advances to GS_INIT. -** -** GS_DATA - The machine is in this state while waiting for the remainder -** of the unencrypted SSL2 record to be read in. Upon completion, -** the machine advances to the GS_INIT state and returns the data. -*/ -int -ssl2_GatherData(sslSocket *ss, sslGather *gs, int flags) -{ - unsigned char * bp; - unsigned char * pBuf; - int nb, err, rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - - if (gs->state == GS_INIT) { - /* Initialize gathering engine */ - gs->state = GS_HEADER; - gs->remainder = 3; - gs->count = 3; - gs->offset = 0; - gs->recordLen = 0; - gs->recordPadding = 0; - gs->hdr[2] = 0; - - gs->writeOffset = 0; - gs->readOffset = 0; - } - if (gs->encrypted) { - PORT_Assert(ss->sec.hash != 0); - } - - pBuf = gs->buf.buf; - for (;;) { - SSL_TRC(30, ("%d: SSL[%d]: gather state %d (need %d more)", - SSL_GETPID(), ss->fd, gs->state, gs->remainder)); - bp = ((gs->state != GS_HEADER) ? pBuf : gs->hdr) + gs->offset; - nb = ssl_DefRecv(ss, bp, gs->remainder, flags); - if (nb > 0) { - PRINT_BUF(60, (ss, "raw gather data:", bp, nb)); - } - if (nb == 0) { - /* EOF */ - SSL_TRC(30, ("%d: SSL[%d]: EOF", SSL_GETPID(), ss->fd)); - rv = 0; - break; - } - if (nb < 0) { - SSL_DBG(("%d: SSL[%d]: recv error %d", SSL_GETPID(), ss->fd, - PR_GetError())); - rv = SECFailure; - break; - } - - gs->offset += nb; - gs->remainder -= nb; - - if (gs->remainder > 0) { - continue; - } - - /* Probably finished this piece */ - switch (gs->state) { - case GS_HEADER: - if ((ss->opt.enableSSL3 || ss->opt.enableTLS) && !ss->firstHsDone) { - - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - /* If this looks like an SSL3 handshake record, - ** and we're expecting an SSL2 Hello message from our peer, - ** handle it here. - */ - if (gs->hdr[0] == content_handshake) { - if ((ss->nextHandshake == ssl2_HandleClientHelloMessage) || - (ss->nextHandshake == ssl2_HandleServerHelloMessage)) { - rv = ssl2_HandleV3HandshakeRecord(ss); - if (rv == SECFailure) { - return SECFailure; - } - } - /* XXX_1 The call stack to here is: - * ssl_Do1stHandshake -> ssl_GatherRecord1stHandshake -> - * ssl2_GatherRecord -> here. - * We want to return all the way out to ssl_Do1stHandshake, - * and have it call ssl_GatherRecord1stHandshake again. - * ssl_GatherRecord1stHandshake will call - * ssl3_GatherCompleteHandshake when it is called again. - * - * Returning SECWouldBlock here causes - * ssl_GatherRecord1stHandshake to return without clearing - * ss->handshake, ensuring that ssl_Do1stHandshake will - * call it again immediately. - * - * If we return 1 here, ssl_GatherRecord1stHandshake will - * clear ss->handshake before returning, and thus will not - * be called again by ssl_Do1stHandshake. - */ - return SECWouldBlock; - } else if (gs->hdr[0] == content_alert) { - if (ss->nextHandshake == ssl2_HandleServerHelloMessage) { - /* XXX This is a hack. We're assuming that any failure - * XXX on the client hello is a failure to match - * XXX ciphers. - */ - PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); - return SECFailure; - } - } - } /* ((ss->opt.enableSSL3 || ss->opt.enableTLS) && !ss->firstHsDone) */ - - /* we've got the first 3 bytes. The header may be two or three. */ - if (gs->hdr[0] & 0x80) { - /* This record has a 2-byte header, and no padding */ - gs->count = ((gs->hdr[0] & 0x7f) << 8) | gs->hdr[1]; - gs->recordPadding = 0; - } else { - /* This record has a 3-byte header that is all read in now. */ - gs->count = ((gs->hdr[0] & 0x3f) << 8) | gs->hdr[1]; - /* is_escape = (gs->hdr[0] & 0x40) != 0; */ - gs->recordPadding = gs->hdr[2]; - } - if (!gs->count) { - PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); - goto cleanup; - } - - if (gs->count > gs->buf.space) { - err = sslBuffer_Grow(&gs->buf, gs->count); - if (err) { - return err; - } - pBuf = gs->buf.buf; - } - - - if (gs->hdr[0] & 0x80) { - /* we've already read in the first byte of the body. - ** Put it into the buffer. - */ - pBuf[0] = gs->hdr[2]; - gs->offset = 1; - gs->remainder = gs->count - 1; - } else { - gs->offset = 0; - gs->remainder = gs->count; - } - - if (gs->encrypted) { - gs->state = GS_MAC; - gs->recordLen = gs->count - gs->recordPadding - - ss->sec.hash->length; - } else { - gs->state = GS_DATA; - gs->recordLen = gs->count; - } - - break; - - - case GS_MAC: - /* Have read in entire rest of the ciphertext. - ** Check for valid length. - ** Decrypt it. - ** Check the MAC. - */ - PORT_Assert(gs->encrypted); - - { - unsigned int macLen; - int nout; - unsigned char mac[SSL_MAX_MAC_BYTES]; - - ssl_GetSpecReadLock(ss); /**********************************/ - - /* If this is a stream cipher, blockSize will be 1, - * and this test will always be false. - * If this is a block cipher, this will detect records - * that are not a multiple of the blocksize in length. - */ - if (gs->count & (ss->sec.blockSize - 1)) { - /* This is an error. Sender is misbehaving */ - SSL_DBG(("%d: SSL[%d]: sender, count=%d blockSize=%d", - SSL_GETPID(), ss->fd, gs->count, - ss->sec.blockSize)); - PORT_SetError(SSL_ERROR_BAD_BLOCK_PADDING); - rv = SECFailure; - goto spec_locked_done; - } - PORT_Assert(gs->count == gs->offset); - - if (gs->offset == 0) { - rv = 0; /* means EOF. */ - goto spec_locked_done; - } - - /* Decrypt the portion of data that we just recieved. - ** Decrypt it in place. - */ - rv = (*ss->sec.dec)(ss->sec.readcx, pBuf, &nout, gs->offset, - pBuf, gs->offset); - if (rv != SECSuccess) { - goto spec_locked_done; - } - - - /* Have read in all the MAC portion of record - ** - ** Prepare MAC by resetting it and feeding it the shared secret - */ - macLen = ss->sec.hash->length; - if (gs->offset >= macLen) { - PRUint32 sequenceNumber = ss->sec.rcvSequence++; - unsigned char seq[4]; - - seq[0] = (unsigned char) (sequenceNumber >> 24); - seq[1] = (unsigned char) (sequenceNumber >> 16); - seq[2] = (unsigned char) (sequenceNumber >> 8); - seq[3] = (unsigned char) (sequenceNumber); - - (*ss->sec.hash->begin)(ss->sec.hashcx); - (*ss->sec.hash->update)(ss->sec.hashcx, ss->sec.rcvSecret.data, - ss->sec.rcvSecret.len); - (*ss->sec.hash->update)(ss->sec.hashcx, pBuf + macLen, - gs->offset - macLen); - (*ss->sec.hash->update)(ss->sec.hashcx, seq, 4); - (*ss->sec.hash->end)(ss->sec.hashcx, mac, &macLen, macLen); - } - - PORT_Assert(macLen == ss->sec.hash->length); - - ssl_ReleaseSpecReadLock(ss); /******************************/ - - if (PORT_Memcmp(mac, pBuf, macLen) != 0) { - /* MAC's didn't match... */ - SSL_DBG(("%d: SSL[%d]: mac check failed, seq=%d", - SSL_GETPID(), ss->fd, ss->sec.rcvSequence)); - PRINT_BUF(1, (ss, "computed mac:", mac, macLen)); - PRINT_BUF(1, (ss, "received mac:", pBuf, macLen)); - PORT_SetError(SSL_ERROR_BAD_MAC_READ); - rv = SECFailure; - goto cleanup; - } - - - PORT_Assert(gs->recordPadding + macLen <= gs->offset); - if (gs->recordPadding + macLen <= gs->offset) { - gs->recordOffset = macLen; - gs->readOffset = macLen; - gs->writeOffset = gs->offset - gs->recordPadding; - rv = 1; - } else { - PORT_SetError(SSL_ERROR_BAD_BLOCK_PADDING); -cleanup: - /* nothing in the buffer any more. */ - gs->recordOffset = 0; - gs->readOffset = 0; - gs->writeOffset = 0; - rv = SECFailure; - } - - gs->recordLen = gs->writeOffset - gs->readOffset; - gs->recordPadding = 0; /* forget we did any padding. */ - gs->state = GS_INIT; - - - if (rv > 0) { - PRINT_BUF(50, (ss, "recv clear record:", - pBuf + gs->recordOffset, gs->recordLen)); - } - return rv; - -spec_locked_done: - ssl_ReleaseSpecReadLock(ss); - return rv; - } - - case GS_DATA: - /* Have read in all the DATA portion of record */ - - gs->recordOffset = 0; - gs->readOffset = 0; - gs->writeOffset = gs->offset; - PORT_Assert(gs->recordLen == gs->writeOffset - gs->readOffset); - gs->recordLen = gs->offset; - gs->recordPadding = 0; - gs->state = GS_INIT; - - ++ss->sec.rcvSequence; - - PRINT_BUF(50, (ss, "recv clear record:", - pBuf + gs->recordOffset, gs->recordLen)); - return 1; - - } /* end switch gs->state */ - } /* end gather loop. */ - return rv; -} - -/* -** Gather a single record of data from the receiving stream. This code -** first gathers the header (2 or 3 bytes long depending on the value of -** the most significant bit in the first byte) then gathers up the data -** for the record into the readBuf. This code handles non-blocking I/O -** and is to be called multiple times until ss->sec.recordLen != 0. - * - * Returns +1 when it has gathered a complete SSLV2 record. - * Returns 0 if it hits EOF. - * Returns -1 (SECFailure) on any error - * Returns -2 (SECWouldBlock) - * - * Called by ssl_GatherRecord1stHandshake in sslcon.c, - * and by DoRecv in sslsecur.c - * Caller must hold RecvBufLock. - */ -int -ssl2_GatherRecord(sslSocket *ss, int flags) -{ - return ssl2_GatherData(ss, &ss->gs, flags); -} - -/* - * Returns +1 when it has gathered a complete SSLV2 record. - * Returns 0 if it hits EOF. - * Returns -1 (SECFailure) on any error - * Returns -2 (SECWouldBlock) - * - * Called from SocksStartGather in sslsocks.c - * Caller must hold RecvBufLock. - */ -int -ssl2_StartGatherBytes(sslSocket *ss, sslGather *gs, unsigned int count) -{ - int rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - gs->state = GS_DATA; - gs->remainder = count; - gs->count = count; - gs->offset = 0; - if (count > gs->buf.space) { - rv = sslBuffer_Grow(&gs->buf, count); - if (rv) { - return rv; - } - } - return ssl2_GatherData(ss, gs, 0); -} - -/* Caller should hold RecvBufLock. */ -SECStatus -ssl_InitGather(sslGather *gs) -{ - SECStatus status; - - gs->state = GS_INIT; - gs->writeOffset = 0; - gs->readOffset = 0; - status = sslBuffer_Grow(&gs->buf, 4096); - return status; -} - -/* Caller must hold RecvBufLock. */ -void -ssl_DestroyGather(sslGather *gs) -{ - if (gs) { /* the PORT_*Free functions check for NULL pointers. */ - PORT_ZFree(gs->buf.buf, gs->buf.space); - PORT_Free(gs->inbuf.buf); - } -} - -/* Caller must hold RecvBufLock. */ -static SECStatus -ssl2_HandleV3HandshakeRecord(sslSocket *ss) -{ - SECStatus rv; - SSL3ProtocolVersion version = (ss->gs.hdr[1] << 8) | ss->gs.hdr[2]; - - PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) ); - PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - - /* We've read in 3 bytes, there are 2 more to go in an ssl3 header. */ - ss->gs.remainder = 2; - ss->gs.count = 0; - - /* Clearing these handshake pointers ensures that - * ssl_Do1stHandshake won't call ssl2_HandleMessage when we return. - */ - ss->nextHandshake = 0; - ss->securityHandshake = 0; - - /* Setting ss->version to an SSL 3.x value will cause - ** ssl_GatherRecord1stHandshake to invoke ssl3_GatherCompleteHandshake() - ** the next time it is called. - **/ - rv = ssl3_NegotiateVersion(ss, version); - if (rv != SECSuccess) { - return rv; - } - - ss->sec.send = ssl3_SendApplicationData; - - return SECSuccess; -} diff --git a/security/nss/lib/ssl/sslimpl.h b/security/nss/lib/ssl/sslimpl.h deleted file mode 100644 index 1041c1630..000000000 --- a/security/nss/lib/ssl/sslimpl.h +++ /dev/null @@ -1,1577 +0,0 @@ -/* - * This file is PRIVATE to SSL and should be the first thing included by - * any SSL implementation file. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Stephen Henson <stephen.henson@gemplus.com> - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#ifndef __sslimpl_h_ -#define __sslimpl_h_ - -#ifdef DEBUG -#undef NDEBUG -#else -#undef NDEBUG -#define NDEBUG -#endif -#include "secport.h" -#include "secerr.h" -#include "sslerr.h" -#include "ssl3prot.h" -#include "hasht.h" -#include "nssilock.h" -#include "pkcs11t.h" -#if defined(XP_UNIX) || defined(XP_BEOS) -#include "unistd.h" -#endif -#include "nssrwlk.h" -#include "prthread.h" - -#include "sslt.h" /* for some formerly private types, now public */ - -/* to make some of these old enums public without namespace pollution, -** it was necessary to prepend ssl_ to the names. -** These #defines preserve compatibility with the old code here in libssl. -*/ -typedef SSLKEAType SSL3KEAType; -typedef SSLMACAlgorithm SSL3MACAlgorithm; -typedef SSLSignType SSL3SignType; - -#define sign_null ssl_sign_null -#define sign_rsa ssl_sign_rsa -#define sign_dsa ssl_sign_dsa -#define sign_ecdsa ssl_sign_ecdsa - -#define calg_null ssl_calg_null -#define calg_rc4 ssl_calg_rc4 -#define calg_rc2 ssl_calg_rc2 -#define calg_des ssl_calg_des -#define calg_3des ssl_calg_3des -#define calg_idea ssl_calg_idea -#define calg_fortezza ssl_calg_fortezza /* deprecated, must preserve */ -#define calg_aes ssl_calg_aes -#define calg_camellia ssl_calg_camellia -#define calg_seed ssl_calg_seed - -#define mac_null ssl_mac_null -#define mac_md5 ssl_mac_md5 -#define mac_sha ssl_mac_sha -#define hmac_md5 ssl_hmac_md5 -#define hmac_sha ssl_hmac_sha - -#define SET_ERROR_CODE /* reminder */ -#define SEND_ALERT /* reminder */ -#define TEST_FOR_FAILURE /* reminder */ -#define DEAL_WITH_FAILURE /* reminder */ - -#if defined(DEBUG) || defined(TRACE) -#ifdef __cplusplus -#define Debug 1 -#else -extern int Debug; -#endif -#else -#undef Debug -#endif - -#if defined(DEBUG) && !defined(TRACE) && !defined(NISCC_TEST) -#define TRACE -#endif - -#ifdef TRACE -#define SSL_TRC(a,b) if (ssl_trace >= (a)) ssl_Trace b -#define PRINT_BUF(a,b) if (ssl_trace >= (a)) ssl_PrintBuf b -#define DUMP_MSG(a,b) if (ssl_trace >= (a)) ssl_DumpMsg b -#else -#define SSL_TRC(a,b) -#define PRINT_BUF(a,b) -#define DUMP_MSG(a,b) -#endif - -#ifdef DEBUG -#define SSL_DBG(b) if (ssl_debug) ssl_Trace b -#else -#define SSL_DBG(b) -#endif - -#ifdef macintosh -#include "pprthred.h" -#else -#include "private/pprthred.h" /* for PR_InMonitor() */ -#endif -#define ssl_InMonitor(m) PZ_InMonitor(m) - -#define LSB(x) ((unsigned char) (x & 0xff)) -#define MSB(x) ((unsigned char) (((unsigned)(x)) >> 8)) - -/************************************************************************/ - -typedef enum { SSLAppOpRead = 0, - SSLAppOpWrite, - SSLAppOpRDWR, - SSLAppOpPost, - SSLAppOpHeader -} SSLAppOperation; - -#define SSL_MIN_MASTER_KEY_BYTES 5 -#define SSL_MAX_MASTER_KEY_BYTES 64 - -#define SSL2_SESSIONID_BYTES 16 -#define SSL3_SESSIONID_BYTES 32 - -#define SSL_MIN_CHALLENGE_BYTES 16 -#define SSL_MAX_CHALLENGE_BYTES 32 -#define SSL_CHALLENGE_BYTES 16 - -#define SSL_CONNECTIONID_BYTES 16 - -#define SSL_MIN_CYPHER_ARG_BYTES 0 -#define SSL_MAX_CYPHER_ARG_BYTES 32 - -#define SSL_MAX_MAC_BYTES 16 - -#define SSL3_RSA_PMS_LENGTH 48 -#define SSL3_MASTER_SECRET_LENGTH 48 - -/* number of wrap mechanisms potentially used to wrap master secrets. */ -#define SSL_NUM_WRAP_MECHS 16 - -/* This makes the cert cache entry exactly 4k. */ -#define SSL_MAX_CACHED_CERT_LEN 4060 - -#define NUM_MIXERS 9 - -/* Mask of the 25 named curves we support. */ -#ifndef NSS_ECC_MORE_THAN_SUITE_B -#define SSL3_SUPPORTED_CURVES_MASK 0x3800000 /* only 3 curves, suite B*/ -#else -#define SSL3_SUPPORTED_CURVES_MASK 0x3fffffe -#endif - -#ifndef BPB -#define BPB 8 /* Bits Per Byte */ -#endif - -#define EXPORT_RSA_KEY_LENGTH 64 /* bytes */ - -typedef struct sslBufferStr sslBuffer; -typedef struct sslConnectInfoStr sslConnectInfo; -typedef struct sslGatherStr sslGather; -typedef struct sslSecurityInfoStr sslSecurityInfo; -typedef struct sslSessionIDStr sslSessionID; -typedef struct sslSocketStr sslSocket; -typedef struct sslSocketOpsStr sslSocketOps; - -typedef struct ssl3StateStr ssl3State; -typedef struct ssl3CertNodeStr ssl3CertNode; -typedef struct ssl3BulkCipherDefStr ssl3BulkCipherDef; -typedef struct ssl3MACDefStr ssl3MACDef; -typedef struct ssl3KeyPairStr ssl3KeyPair; - -struct ssl3CertNodeStr { - struct ssl3CertNodeStr *next; - CERTCertificate * cert; -}; - -typedef SECStatus (*sslHandshakeFunc)(sslSocket *ss); - -/* This type points to the low layer send func, -** e.g. ssl2_SendStream or ssl3_SendPlainText. -** These functions return the same values as PR_Send, -** i.e. >= 0 means number of bytes sent, < 0 means error. -*/ -typedef PRInt32 (*sslSendFunc)(sslSocket *ss, const unsigned char *buf, - PRInt32 n, PRInt32 flags); - -typedef void (*sslSessionIDCacheFunc) (sslSessionID *sid); -typedef void (*sslSessionIDUncacheFunc)(sslSessionID *sid); -typedef sslSessionID *(*sslSessionIDLookupFunc)(const PRIPv6Addr *addr, - unsigned char* sid, - unsigned int sidLen, - CERTCertDBHandle * dbHandle); - -/* registerable callback function that either appends extension to buffer - * or returns length of data that it would have appended. - */ -typedef PRInt32 (*ssl3HelloExtensionSenderFunc)(sslSocket *ss, PRBool append, - PRUint32 maxBytes); - -/* registerable callback function that handles a received extension, - * of the given type. - */ -typedef SECStatus (* ssl3HelloExtensionHandlerFunc)(sslSocket *ss, - PRUint16 ex_type, - SECItem * data); - -/* row in a table of hello extension senders */ -typedef struct { - PRInt32 ex_type; - ssl3HelloExtensionSenderFunc ex_sender; -} ssl3HelloExtensionSender; - -/* row in a table of hello extension handlers */ -typedef struct { - PRInt32 ex_type; - ssl3HelloExtensionHandlerFunc ex_handler; -} ssl3HelloExtensionHandler; - -extern SECStatus -ssl3_RegisterServerHelloExtensionSender(sslSocket *ss, PRUint16 ex_type, - ssl3HelloExtensionSenderFunc cb); - -extern PRInt32 -ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes, - const ssl3HelloExtensionSender *sender); - -/* Socket ops */ -struct sslSocketOpsStr { - int (*connect) (sslSocket *, const PRNetAddr *); - PRFileDesc *(*accept) (sslSocket *, PRNetAddr *); - int (*bind) (sslSocket *, const PRNetAddr *); - int (*listen) (sslSocket *, int); - int (*shutdown)(sslSocket *, int); - int (*close) (sslSocket *); - - int (*recv) (sslSocket *, unsigned char *, int, int); - - /* points to the higher-layer send func, e.g. ssl_SecureSend. */ - int (*send) (sslSocket *, const unsigned char *, int, int); - int (*read) (sslSocket *, unsigned char *, int); - int (*write) (sslSocket *, const unsigned char *, int); - - int (*getpeername)(sslSocket *, PRNetAddr *); - int (*getsockname)(sslSocket *, PRNetAddr *); -}; - -/* Flags interpreted by ssl send functions. */ -#define ssl_SEND_FLAG_FORCE_INTO_BUFFER 0x40000000 -#define ssl_SEND_FLAG_NO_BUFFER 0x20000000 -#define ssl_SEND_FLAG_MASK 0x7f000000 - -/* -** A buffer object. -*/ -struct sslBufferStr { - unsigned char * buf; - unsigned int len; - unsigned int space; -}; - -/* -** SSL3 cipher suite policy and preference struct. -*/ -typedef struct { -#if !defined(_WIN32) - unsigned int cipher_suite : 16; - unsigned int policy : 8; - unsigned int enabled : 1; - unsigned int isPresent : 1; -#else - ssl3CipherSuite cipher_suite; - PRUint8 policy; - unsigned char enabled : 1; - unsigned char isPresent : 1; -#endif -} ssl3CipherSuiteCfg; - -#ifdef NSS_ENABLE_ECC -#define ssl_V3_SUITES_IMPLEMENTED 50 -#else -#define ssl_V3_SUITES_IMPLEMENTED 30 -#endif /* NSS_ENABLE_ECC */ - -typedef struct sslOptionsStr { - unsigned int useSecurity : 1; /* 1 */ - unsigned int useSocks : 1; /* 2 */ - unsigned int requestCertificate : 1; /* 3 */ - unsigned int requireCertificate : 2; /* 4-5 */ - unsigned int handshakeAsClient : 1; /* 6 */ - unsigned int handshakeAsServer : 1; /* 7 */ - unsigned int enableSSL2 : 1; /* 8 */ - unsigned int enableSSL3 : 1; /* 9 */ - unsigned int enableTLS : 1; /* 10 */ - unsigned int noCache : 1; /* 11 */ - unsigned int fdx : 1; /* 12 */ - unsigned int v2CompatibleHello : 1; /* 13 */ - unsigned int detectRollBack : 1; /* 14 */ - unsigned int noStepDown : 1; /* 15 */ - unsigned int bypassPKCS11 : 1; /* 16 */ - unsigned int noLocks : 1; /* 17 */ - unsigned int enableSessionTickets : 1; /* 18 */ -} sslOptions; - -typedef enum { sslHandshakingUndetermined = 0, - sslHandshakingAsClient, - sslHandshakingAsServer -} sslHandshakingType; - -typedef struct sslServerCertsStr { - /* Configuration state for server sockets */ - CERTCertificate * serverCert; - CERTCertificateList * serverCertChain; - ssl3KeyPair * serverKeyPair; - unsigned int serverKeyBits; -} sslServerCerts; - -#define SERVERKEY serverKeyPair->privKey - -#define SSL_LOCK_RANK_SPEC 255 -#define SSL_LOCK_RANK_GLOBAL NSS_RWLOCK_RANK_NONE - -/* These are the valid values for shutdownHow. -** These values are each 1 greater than the NSPR values, and the code -** depends on that relation to efficiently convert PR_SHUTDOWN values -** into ssl_SHUTDOWN values. These values use one bit for read, and -** another bit for write, and can be used as bitmasks. -*/ -#define ssl_SHUTDOWN_NONE 0 /* NOT shutdown at all */ -#define ssl_SHUTDOWN_RCV 1 /* PR_SHUTDOWN_RCV +1 */ -#define ssl_SHUTDOWN_SEND 2 /* PR_SHUTDOWN_SEND +1 */ -#define ssl_SHUTDOWN_BOTH 3 /* PR_SHUTDOWN_BOTH +1 */ - -/* -** A gather object. Used to read some data until a count has been -** satisfied. Primarily for support of async sockets. -** Everything in here is protected by the recvBufLock. -*/ -struct sslGatherStr { - int state; /* see GS_ values below. */ /* ssl 2 & 3 */ - - /* "buf" holds received plaintext SSL records, after decrypt and MAC check. - * SSL2: recv'd ciphertext records are put here, then decrypted in place. - * SSL3: recv'd ciphertext records are put in inbuf (see below), then - * decrypted into buf. - */ - sslBuffer buf; /*recvBufLock*/ /* ssl 2 & 3 */ - - /* number of bytes previously read into hdr or buf(ssl2) or inbuf (ssl3). - ** (offset - writeOffset) is the number of ciphertext bytes read in but - ** not yet deciphered. - */ - unsigned int offset; /* ssl 2 & 3 */ - - /* number of bytes to read in next call to ssl_DefRecv (recv) */ - unsigned int remainder; /* ssl 2 & 3 */ - - /* Number of ciphertext bytes to read in after 2-byte SSL record header. */ - unsigned int count; /* ssl2 only */ - - /* size of the final plaintext record. - ** == count - (recordPadding + MAC size) - */ - unsigned int recordLen; /* ssl2 only */ - - /* number of bytes of padding to be removed after decrypting. */ - /* This value is taken from the record's hdr[2], which means a too large - * value could crash us. - */ - unsigned int recordPadding; /* ssl2 only */ - - /* plaintext DATA begins this many bytes into "buf". */ - unsigned int recordOffset; /* ssl2 only */ - - int encrypted; /* SSL2 session is now encrypted. ssl2 only */ - - /* These next two values are used by SSL2 and SSL3. - ** DoRecv uses them to extract application data. - ** The difference between writeOffset and readOffset is the amount of - ** data available to the application. Note that the actual offset of - ** the data in "buf" is recordOffset (above), not readOffset. - ** In the current implementation, this is made available before the - ** MAC is checked!! - */ - unsigned int readOffset; /* Spot where DATA reader (e.g. application - ** or handshake code) will read next. - ** Always zero for SSl3 application data. - */ - /* offset in buf/inbuf/hdr into which new data will be read from socket. */ - unsigned int writeOffset; - - /* Buffer for ssl3 to read (encrypted) data from the socket */ - sslBuffer inbuf; /*recvBufLock*/ /* ssl3 only */ - - /* The ssl[23]_GatherData functions read data into this buffer, rather - ** than into buf or inbuf, while in the GS_HEADER state. - ** The portion of the SSL record header put here always comes off the wire - ** as plaintext, never ciphertext. - ** For SSL2, the plaintext portion is two bytes long. For SSl3 it is 5. - */ - unsigned char hdr[5]; /* ssl 2 & 3 */ -}; - -/* sslGather.state */ -#define GS_INIT 0 -#define GS_HEADER 1 -#define GS_MAC 2 -#define GS_DATA 3 -#define GS_PAD 4 - -typedef SECStatus (*SSLCipher)(void * context, - unsigned char * out, - int * outlen, - int maxout, - const unsigned char *in, - int inlen); -typedef SECStatus (*SSLDestroy)(void *context, PRBool freeit); - - - -/* -** ssl3State and CipherSpec structs -*/ - -/* The SSL bulk cipher definition */ -typedef enum { - cipher_null, - cipher_rc4, - cipher_rc4_40, - cipher_rc4_56, - cipher_rc2, - cipher_rc2_40, - cipher_des, - cipher_3des, - cipher_des40, - cipher_idea, - cipher_aes_128, - cipher_aes_256, - cipher_camellia_128, - cipher_camellia_256, - cipher_seed, - cipher_missing /* reserved for no such supported cipher */ - /* This enum must match ssl3_cipherName[] in ssl3con.c. */ -} SSL3BulkCipher; - -typedef enum { type_stream, type_block } CipherType; - -#define MAX_IV_LENGTH 64 - -/* - * Do not depend upon 64 bit arithmetic in the underlying machine. - */ -typedef struct { - PRUint32 high; - PRUint32 low; -} SSL3SequenceNumber; - -#define MAX_MAC_CONTEXT_BYTES 400 -#define MAX_MAC_CONTEXT_LLONGS (MAX_MAC_CONTEXT_BYTES / 8) - -#define MAX_CIPHER_CONTEXT_BYTES 2080 -#define MAX_CIPHER_CONTEXT_LLONGS (MAX_CIPHER_CONTEXT_BYTES / 8) - -typedef struct { - SSL3Opaque client_write_iv [24]; - SSL3Opaque server_write_iv [24]; - SSL3Opaque wrapped_master_secret [48]; - PRUint16 wrapped_master_secret_len; - PRUint8 msIsWrapped; - PRUint8 resumable; -} ssl3SidKeys; /* 100 bytes */ - -typedef struct { - PK11SymKey *write_key; - PK11SymKey *write_mac_key; - PK11Context *write_mac_context; - SECItem write_key_item; - SECItem write_iv_item; - SECItem write_mac_key_item; - SSL3Opaque write_iv[MAX_IV_LENGTH]; - PRUint64 cipher_context[MAX_CIPHER_CONTEXT_LLONGS]; -} ssl3KeyMaterial; - -/* -** These are the "specs" in the "ssl3" struct. -** Access to the pointers to these specs, and all the specs' contents -** (direct and indirect) is protected by the reader/writer lock ss->specLock. -*/ -typedef struct { - const ssl3BulkCipherDef *cipher_def; - const ssl3MACDef * mac_def; - int mac_size; - SSLCipher encode; - SSLCipher decode; - SSLDestroy destroy; - void * encodeContext; - void * decodeContext; - PRBool bypassCiphers; /* did double bypass (at least) */ - PK11SymKey * master_secret; - SSL3SequenceNumber write_seq_num; - SSL3SequenceNumber read_seq_num; - SSL3ProtocolVersion version; - ssl3KeyMaterial client; - ssl3KeyMaterial server; - SECItem msItem; - unsigned char key_block[NUM_MIXERS * MD5_LENGTH]; - unsigned char raw_master_secret[56]; -} ssl3CipherSpec; - -typedef enum { never_cached, - in_client_cache, - in_server_cache, - invalid_cache /* no longer in any cache. */ -} Cached; - -struct sslSessionIDStr { - sslSessionID * next; /* chain used for client sockets, only */ - - CERTCertificate * peerCert; - const char * peerID; /* client only */ - const char * urlSvrName; /* client only */ - CERTCertificate * localCert; - - PRIPv6Addr addr; - PRUint16 port; - - SSL3ProtocolVersion version; - - PRUint32 creationTime; /* seconds since Jan 1, 1970 */ - PRUint32 lastAccessTime; /* seconds since Jan 1, 1970 */ - PRUint32 expirationTime; /* seconds since Jan 1, 1970 */ - Cached cached; - int references; - - SSLSignType authAlgorithm; - PRUint32 authKeyBits; - SSLKEAType keaType; - PRUint32 keaKeyBits; - - union { - struct { - /* the V2 code depends upon the size of sessionID. */ - unsigned char sessionID[SSL2_SESSIONID_BYTES]; - - /* Stuff used to recreate key and read/write cipher objects */ - SECItem masterKey; /* never wrapped */ - int cipherType; - SECItem cipherArg; - int keyBits; - int secretKeyBits; - } ssl2; - struct { - /* values that are copied into the server's on-disk SID cache. */ - uint8 sessionIDLength; - SSL3Opaque sessionID[SSL3_SESSIONID_BYTES]; - - ssl3CipherSuite cipherSuite; - SSL3CompressionMethod compression; - int policy; - ssl3SidKeys keys; - CK_MECHANISM_TYPE masterWrapMech; - /* mechanism used to wrap master secret */ - SSL3KEAType exchKeyType; - /* key type used in exchange algorithm, - * and to wrap the sym wrapping key. */ -#ifdef NSS_ENABLE_ECC - PRUint32 negotiatedECCurves; -#endif /* NSS_ENABLE_ECC */ - - /* The following values are NOT restored from the server's on-disk - * session cache, but are restored from the client's cache. - */ - PK11SymKey * clientWriteKey; - PK11SymKey * serverWriteKey; - - /* The following values pertain to the slot that wrapped the - ** master secret. (used only in client) - */ - SECMODModuleID masterModuleID; - /* what module wrapped the master secret */ - CK_SLOT_ID masterSlotID; - PRUint16 masterWrapIndex; - /* what's the key index for the wrapping key */ - PRUint16 masterWrapSeries; - /* keep track of the slot series, so we don't - * accidently try to use new keys after the - * card gets removed and replaced.*/ - - /* The following values pertain to the slot that did the signature - ** for client auth. (used only in client) - */ - SECMODModuleID clAuthModuleID; - CK_SLOT_ID clAuthSlotID; - PRUint16 clAuthSeries; - - char masterValid; - char clAuthValid; - - /* Session ticket if we have one, is sent as an extension in the - * ClientHello message. This field is used by clients. - */ - NewSessionTicket sessionTicket; - } ssl3; - } u; -}; - - -typedef struct ssl3CipherSuiteDefStr { - ssl3CipherSuite cipher_suite; - SSL3BulkCipher bulk_cipher_alg; - SSL3MACAlgorithm mac_alg; - SSL3KeyExchangeAlgorithm key_exchange_alg; -} ssl3CipherSuiteDef; - -/* -** There are tables of these, all const. -*/ -typedef struct { - SSL3KeyExchangeAlgorithm kea; - SSL3KEAType exchKeyType; - SSL3SignType signKeyType; - PRBool is_limited; - int key_size_limit; - PRBool tls_keygen; -} ssl3KEADef; - -typedef enum { kg_null, kg_strong, kg_export } SSL3KeyGenMode; - -/* -** There are tables of these, all const. -*/ -struct ssl3BulkCipherDefStr { - SSL3BulkCipher cipher; - SSLCipherAlgorithm calg; - int key_size; - int secret_key_size; - CipherType type; - int iv_size; - int block_size; - SSL3KeyGenMode keygen_mode; -}; - -/* -** There are tables of these, all const. -*/ -struct ssl3MACDefStr { - SSL3MACAlgorithm mac; - CK_MECHANISM_TYPE mmech; - int pad_size; - int mac_size; -}; - -typedef enum { - wait_client_hello, - wait_client_cert, - wait_client_key, - wait_cert_verify, - wait_change_cipher, - wait_finished, - wait_server_hello, - wait_server_cert, - wait_server_key, - wait_cert_request, - wait_hello_done, - wait_new_session_ticket, - idle_handshake -} SSL3WaitState; - -/* - * TLS extension related constants and data structures. - */ -typedef struct TLSExtensionDataStr TLSExtensionData; -typedef struct SessionTicketDataStr SessionTicketData; - -struct TLSExtensionDataStr { - /* registered callbacks that send server hello extensions */ - ssl3HelloExtensionSender serverSenders[MAX_EXTENSIONS]; - /* Keep track of the extensions that are negotiated. */ - PRUint16 numAdvertised; - PRUint16 numNegotiated; - PRUint16 advertised[MAX_EXTENSIONS]; - PRUint16 negotiated[MAX_EXTENSIONS]; - - /* SessionTicket Extension related data. */ - PRBool ticketTimestampVerified; - PRBool emptySessionTicket; -}; - -/* -** This is the "hs" member of the "ssl3" struct. -** This entire struct is protected by ssl3HandshakeLock -*/ -typedef struct SSL3HandshakeStateStr { - SSL3Random server_random; - SSL3Random client_random; - SSL3WaitState ws; - PRUint64 md5_cx[MAX_MAC_CONTEXT_LLONGS]; - PRUint64 sha_cx[MAX_MAC_CONTEXT_LLONGS]; - PK11Context * md5; /* handshake running hashes */ - PK11Context * sha; -const ssl3KEADef * kea_def; - ssl3CipherSuite cipher_suite; -const ssl3CipherSuiteDef *suite_def; - SSL3CompressionMethod compression; - sslBuffer msg_body; /* protected by recvBufLock */ - /* partial handshake message from record layer */ - unsigned int header_bytes; - /* number of bytes consumed from handshake */ - /* message for message type and header length */ - SSL3HandshakeType msg_type; - unsigned long msg_len; - SECItem ca_list; /* used only by client */ - PRBool isResuming; /* are we resuming a session */ - PRBool rehandshake; /* immediately start another handshake - * when this one finishes */ - PRBool usedStepDownKey; /* we did a server key exchange. */ - sslBuffer msgState; /* current state for handshake messages*/ - /* protected by recvBufLock */ - sslBuffer messages; /* Accumulated handshake messages */ -#ifdef NSS_ENABLE_ECC - PRUint32 negotiatedECCurves; /* bit mask */ -#endif /* NSS_ENABLE_ECC */ -} SSL3HandshakeState; - - - -/* -** This is the "ssl3" struct, as in "ss->ssl3". -** note: -** usually, crSpec == cwSpec and prSpec == pwSpec. -** Sometimes, crSpec == pwSpec and prSpec == cwSpec. -** But there are never more than 2 actual specs. -** No spec must ever be modified if either "current" pointer points to it. -*/ -struct ssl3StateStr { - - /* - ** The following Specs and Spec pointers must be protected using the - ** Spec Lock. - */ - ssl3CipherSpec * crSpec; /* current read spec. */ - ssl3CipherSpec * prSpec; /* pending read spec. */ - ssl3CipherSpec * cwSpec; /* current write spec. */ - ssl3CipherSpec * pwSpec; /* pending write spec. */ - - CERTCertificate * clientCertificate; /* used by client */ - SECKEYPrivateKey * clientPrivateKey; /* used by client */ - CERTCertificateList *clientCertChain; /* used by client */ - PRBool sendEmptyCert; /* used by client */ - - int policy; - /* This says what cipher suites we can do, and should - * be either SSL_ALLOWED or SSL_RESTRICTED - */ - PRArenaPool * peerCertArena; - /* These are used to keep track of the peer CA */ - void * peerCertChain; - /* chain while we are trying to validate it. */ - CERTDistNames * ca_list; - /* used by server. trusted CAs for this socket. */ - PRBool initialized; - SSL3HandshakeState hs; - ssl3CipherSpec specs[2]; /* one is current, one is pending. */ -}; - -typedef struct { - SSL3ContentType type; - SSL3ProtocolVersion version; - sslBuffer * buf; -} SSL3Ciphertext; - -struct ssl3KeyPairStr { - SECKEYPrivateKey * privKey; - SECKEYPublicKey * pubKey; - PRInt32 refCount; /* use PR_Atomic calls for this. */ -}; - -typedef struct SSLWrappedSymWrappingKeyStr { - SSL3Opaque wrappedSymmetricWrappingkey[512]; - SSL3Opaque wrapIV[24]; - CK_MECHANISM_TYPE symWrapMechanism; - /* unwrapped symmetric wrapping key uses this mechanism */ - CK_MECHANISM_TYPE asymWrapMechanism; - /* mechanism used to wrap the SymmetricWrappingKey using - * server's public and/or private keys. */ - SSL3KEAType exchKeyType; /* type of keys used to wrap SymWrapKey*/ - PRInt32 symWrapMechIndex; - PRUint16 wrappedSymKeyLen; - PRUint16 wrapIVLen; -} SSLWrappedSymWrappingKey; - -typedef struct SessionTicketStr { - uint16 ticket_version; - SSL3ProtocolVersion ssl_version; - ssl3CipherSuite cipher_suite; - SSL3CompressionMethod compression_method; - SSLSignType authAlgorithm; - uint32 authKeyBits; - SSLKEAType keaType; - uint32 keaKeyBits; - /* - * exchKeyType and msWrapMech contain meaningful values only if - * ms_is_wrapped is true. - */ - uint8 ms_is_wrapped; - SSLKEAType exchKeyType; /* XXX(wtc): same as keaType above? */ - CK_MECHANISM_TYPE msWrapMech; - uint16 ms_length; - SSL3Opaque master_secret[48]; - ClientIdentity client_identity; - SECItem peer_cert; - uint32 timestamp; -} SessionTicket; - -/* - * SSL2 buffers used in SSL3. - * writeBuf in the SecurityInfo maintained by sslsecur.c is used - * to hold the data just about to be passed to the kernel - * sendBuf in the ConnectInfo maintained by sslcon.c is used - * to hold handshake messages as they are accumulated - */ - -/* -** This is "ci", as in "ss->sec.ci". -** -** Protection: All the variables in here are protected by -** firstHandshakeLock AND (in ssl3) ssl3HandshakeLock -*/ -struct sslConnectInfoStr { - /* outgoing handshakes appended to this. */ - sslBuffer sendBuf; /*xmitBufLock*/ /* ssl 2 & 3 */ - - PRIPv6Addr peer; /* ssl 2 & 3 */ - unsigned short port; /* ssl 2 & 3 */ - - sslSessionID *sid; /* ssl 2 & 3 */ - - /* see CIS_HAVE defines below for the bit values in *elements. */ - char elements; /* ssl2 only */ - char requiredElements; /* ssl2 only */ - char sentElements; /* ssl2 only */ - - char sentFinished; /* ssl2 only */ - - /* Length of server challenge. Used by client when saving challenge */ - int serverChallengeLen; /* ssl2 only */ - /* type of authentication requested by server */ - unsigned char authType; /* ssl2 only */ - - /* Challenge sent by client to server in client-hello message */ - /* SSL3 gets a copy of this. See ssl3_StartHandshakeHash(). */ - unsigned char clientChallenge[SSL_MAX_CHALLENGE_BYTES]; /* ssl 2 & 3 */ - - /* Connection-id sent by server to client in server-hello message */ - unsigned char connectionID[SSL_CONNECTIONID_BYTES]; /* ssl2 only */ - - /* Challenge sent by server to client in request-certificate message */ - unsigned char serverChallenge[SSL_MAX_CHALLENGE_BYTES]; /* ssl2 only */ - - /* Information kept to handle a request-certificate message */ - unsigned char readKey[SSL_MAX_MASTER_KEY_BYTES]; /* ssl2 only */ - unsigned char writeKey[SSL_MAX_MASTER_KEY_BYTES]; /* ssl2 only */ - unsigned keySize; /* ssl2 only */ -}; - -/* bit values for ci->elements, ci->requiredElements, sentElements. */ -#define CIS_HAVE_MASTER_KEY 0x01 -#define CIS_HAVE_CERTIFICATE 0x02 -#define CIS_HAVE_FINISHED 0x04 -#define CIS_HAVE_VERIFY 0x08 - -/* Note: The entire content of this struct and whatever it points to gets - * blown away by SSL_ResetHandshake(). This is "sec" as in "ss->sec". - * - * Unless otherwise specified below, the contents of this struct are - * protected by firstHandshakeLock AND (in ssl3) ssl3HandshakeLock. - */ -struct sslSecurityInfoStr { - sslSendFunc send; /*xmitBufLock*/ /* ssl 2 & 3 */ - int isServer; /* Spec Lock?*/ /* ssl 2 & 3 */ - sslBuffer writeBuf; /*xmitBufLock*/ /* ssl 2 & 3 */ - - int cipherType; /* ssl 2 & 3 */ - int keyBits; /* ssl 2 & 3 */ - int secretKeyBits; /* ssl 2 & 3 */ - CERTCertificate *localCert; /* ssl 2 & 3 */ - CERTCertificate *peerCert; /* ssl 2 & 3 */ - SECKEYPublicKey *peerKey; /* ssl3 only */ - - SSLSignType authAlgorithm; - PRUint32 authKeyBits; - SSLKEAType keaType; - PRUint32 keaKeyBits; - - /* - ** Procs used for SID cache (nonce) management. - ** Different implementations exist for clients/servers - ** The lookup proc is only used for servers. Baloney! - */ - sslSessionIDCacheFunc cache; /* ssl 2 & 3 */ - sslSessionIDUncacheFunc uncache; /* ssl 2 & 3 */ - - /* - ** everything below here is for ssl2 only. - ** This stuff is equivalent to SSL3's "spec", and is protected by the - ** same "Spec Lock" as used for SSL3's specs. - */ - PRUint32 sendSequence; /*xmitBufLock*/ /* ssl2 only */ - PRUint32 rcvSequence; /*recvBufLock*/ /* ssl2 only */ - - /* Hash information; used for one-way-hash functions (MD2, MD5, etc.) */ - const SECHashObject *hash; /* Spec Lock */ /* ssl2 only */ - void *hashcx; /* Spec Lock */ /* ssl2 only */ - - SECItem sendSecret; /* Spec Lock */ /* ssl2 only */ - SECItem rcvSecret; /* Spec Lock */ /* ssl2 only */ - - /* Session cypher contexts; one for each direction */ - void *readcx; /* Spec Lock */ /* ssl2 only */ - void *writecx; /* Spec Lock */ /* ssl2 only */ - SSLCipher enc; /* Spec Lock */ /* ssl2 only */ - SSLCipher dec; /* Spec Lock */ /* ssl2 only */ - void (*destroy)(void *, PRBool); /* Spec Lock */ /* ssl2 only */ - - /* Blocking information for the session cypher */ - int blockShift; /* Spec Lock */ /* ssl2 only */ - int blockSize; /* Spec Lock */ /* ssl2 only */ - - /* These are used during a connection handshake */ - sslConnectInfo ci; /* ssl 2 & 3 */ - -}; - - -/* -** SSL Socket struct -** -** Protection: XXX -*/ -struct sslSocketStr { - PRFileDesc * fd; - - /* Pointer to operations vector for this socket */ - const sslSocketOps * ops; - - /* SSL socket options */ - sslOptions opt; - - /* State flags */ - unsigned long clientAuthRequested; - unsigned long delayDisabled; /* Nagle delay disabled */ - unsigned long firstHsDone; /* first handshake is complete. */ - unsigned long handshakeBegun; - unsigned long lastWriteBlocked; - unsigned long recvdCloseNotify; /* received SSL EOF. */ - unsigned long TCPconnected; - unsigned long appDataBuffered; - - /* version of the protocol to use */ - SSL3ProtocolVersion version; - SSL3ProtocolVersion clientHelloVersion; /* version sent in client hello. */ - - sslSecurityInfo sec; /* not a pointer any more */ - - /* protected by firstHandshakeLock AND (in ssl3) ssl3HandshakeLock. */ - const char *url; /* ssl 2 & 3 */ - - sslHandshakeFunc handshake; /*firstHandshakeLock*/ - sslHandshakeFunc nextHandshake; /*firstHandshakeLock*/ - sslHandshakeFunc securityHandshake; /*firstHandshakeLock*/ - - /* the following variable is only used with socks or other proxies. */ - char * peerID; /* String uniquely identifies target server. */ - - unsigned char * cipherSpecs; - unsigned int sizeCipherSpecs; -const unsigned char * preferredCipher; - - ssl3KeyPair * stepDownKeyPair; /* RSA step down keys */ - - /* Callbacks */ - SSLAuthCertificate authCertificate; - void *authCertificateArg; - SSLGetClientAuthData getClientAuthData; - void *getClientAuthDataArg; - SSLBadCertHandler handleBadCert; - void *badCertArg; - SSLHandshakeCallback handshakeCallback; - void *handshakeCallbackData; - void *pkcs11PinArg; - - PRIntervalTime rTimeout; /* timeout for NSPR I/O */ - PRIntervalTime wTimeout; /* timeout for NSPR I/O */ - PRIntervalTime cTimeout; /* timeout for NSPR I/O */ - - PZLock * recvLock; /* lock against multiple reader threads. */ - PZLock * sendLock; /* lock against multiple sender threads. */ - - PZMonitor * recvBufLock; /* locks low level recv buffers. */ - PZMonitor * xmitBufLock; /* locks low level xmit buffers. */ - - /* Only one thread may operate on the socket until the initial handshake - ** is complete. This Monitor ensures that. Since SSL2 handshake is - ** only done once, this is also effectively the SSL2 handshake lock. - */ - PZMonitor * firstHandshakeLock; - - /* This monitor protects the ssl3 handshake state machine data. - ** Only one thread (reader or writer) may be in the ssl3 handshake state - ** machine at any time. */ - PZMonitor * ssl3HandshakeLock; - - /* reader/writer lock, protects the secret data needed to encrypt and MAC - ** outgoing records, and to decrypt and MAC check incoming ciphertext - ** records. */ - NSSRWLock * specLock; - - /* handle to perm cert db (and implicitly to the temp cert db) used - ** with this socket. - */ - CERTCertDBHandle * dbHandle; - - PRThread * writerThread; /* thread holds SSL_LOCK_WRITER lock */ - - PRUint16 shutdownHow; /* See ssl_SHUTDOWN defines below. */ - - PRUint16 allowedByPolicy; /* copy of global policy bits. */ - PRUint16 maybeAllowedByPolicy; /* copy of global policy bits. */ - PRUint16 chosenPreference; /* SSL2 cipher preferences. */ - - sslHandshakingType handshaking; - - /* Gather object used for gathering data */ - sslGather gs; /*recvBufLock*/ - - sslBuffer saveBuf; /*xmitBufLock*/ - sslBuffer pendingBuf; /*xmitBufLock*/ - - /* Configuration state for server sockets */ - /* server cert and key for each KEA type */ - sslServerCerts serverCerts[kt_kea_size]; - - ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED]; - ssl3KeyPair * ephemeralECDHKeyPair; /* for ECDHE-* handshake */ - - /* SSL3 state info. Formerly was a pointer */ - ssl3State ssl3; - - /* - * TLS extension related data. - */ - /* True when the current session is a stateless resume. */ - PRBool statelessResume; - TLSExtensionData xtnData; -}; - - - -/* All the global data items declared here should be protected using the -** ssl_global_data_lock, which is a reader/writer lock. -*/ -extern NSSRWLock * ssl_global_data_lock; -extern char ssl_debug; -extern char ssl_trace; -extern FILE * ssl_trace_iob; -extern CERTDistNames * ssl3_server_ca_list; -extern PRUint32 ssl_sid_timeout; -extern PRUint32 ssl3_sid_timeout; -extern PRBool ssl3_global_policy_some_restricted; - -extern const char * const ssl_cipherName[]; -extern const char * const ssl3_cipherName[]; - -extern sslSessionIDLookupFunc ssl_sid_lookup; -extern sslSessionIDCacheFunc ssl_sid_cache; -extern sslSessionIDUncacheFunc ssl_sid_uncache; - -/************************************************************************/ - -SEC_BEGIN_PROTOS - -/* Implementation of ops for default (non socks, non secure) case */ -extern int ssl_DefConnect(sslSocket *ss, const PRNetAddr *addr); -extern PRFileDesc *ssl_DefAccept(sslSocket *ss, PRNetAddr *addr); -extern int ssl_DefBind(sslSocket *ss, const PRNetAddr *addr); -extern int ssl_DefListen(sslSocket *ss, int backlog); -extern int ssl_DefShutdown(sslSocket *ss, int how); -extern int ssl_DefClose(sslSocket *ss); -extern int ssl_DefRecv(sslSocket *ss, unsigned char *buf, int len, int flags); -extern int ssl_DefSend(sslSocket *ss, const unsigned char *buf, - int len, int flags); -extern int ssl_DefRead(sslSocket *ss, unsigned char *buf, int len); -extern int ssl_DefWrite(sslSocket *ss, const unsigned char *buf, int len); -extern int ssl_DefGetpeername(sslSocket *ss, PRNetAddr *name); -extern int ssl_DefGetsockname(sslSocket *ss, PRNetAddr *name); -extern int ssl_DefGetsockopt(sslSocket *ss, PRSockOption optname, - void *optval, PRInt32 *optlen); -extern int ssl_DefSetsockopt(sslSocket *ss, PRSockOption optname, - const void *optval, PRInt32 optlen); - -/* Implementation of ops for socks only case */ -extern int ssl_SocksConnect(sslSocket *ss, const PRNetAddr *addr); -extern PRFileDesc *ssl_SocksAccept(sslSocket *ss, PRNetAddr *addr); -extern int ssl_SocksBind(sslSocket *ss, const PRNetAddr *addr); -extern int ssl_SocksListen(sslSocket *ss, int backlog); -extern int ssl_SocksGetsockname(sslSocket *ss, PRNetAddr *name); -extern int ssl_SocksRecv(sslSocket *ss, unsigned char *buf, int len, int flags); -extern int ssl_SocksSend(sslSocket *ss, const unsigned char *buf, - int len, int flags); -extern int ssl_SocksRead(sslSocket *ss, unsigned char *buf, int len); -extern int ssl_SocksWrite(sslSocket *ss, const unsigned char *buf, int len); - -/* Implementation of ops for secure only case */ -extern int ssl_SecureConnect(sslSocket *ss, const PRNetAddr *addr); -extern PRFileDesc *ssl_SecureAccept(sslSocket *ss, PRNetAddr *addr); -extern int ssl_SecureRecv(sslSocket *ss, unsigned char *buf, - int len, int flags); -extern int ssl_SecureSend(sslSocket *ss, const unsigned char *buf, - int len, int flags); -extern int ssl_SecureRead(sslSocket *ss, unsigned char *buf, int len); -extern int ssl_SecureWrite(sslSocket *ss, const unsigned char *buf, int len); -extern int ssl_SecureShutdown(sslSocket *ss, int how); -extern int ssl_SecureClose(sslSocket *ss); - -/* Implementation of ops for secure socks case */ -extern int ssl_SecureSocksConnect(sslSocket *ss, const PRNetAddr *addr); -extern PRFileDesc *ssl_SecureSocksAccept(sslSocket *ss, PRNetAddr *addr); -extern PRFileDesc *ssl_FindTop(sslSocket *ss); - -/* Gather funcs. */ -extern sslGather * ssl_NewGather(void); -extern SECStatus ssl_InitGather(sslGather *gs); -extern void ssl_DestroyGather(sslGather *gs); -extern int ssl2_GatherData(sslSocket *ss, sslGather *gs, int flags); -extern int ssl2_GatherRecord(sslSocket *ss, int flags); -extern SECStatus ssl_GatherRecord1stHandshake(sslSocket *ss); - -extern SECStatus ssl2_HandleClientHelloMessage(sslSocket *ss); -extern SECStatus ssl2_HandleServerHelloMessage(sslSocket *ss); -extern int ssl2_StartGatherBytes(sslSocket *ss, sslGather *gs, - unsigned int count); - -extern SECStatus ssl_CreateSecurityInfo(sslSocket *ss); -extern SECStatus ssl_CopySecurityInfo(sslSocket *ss, sslSocket *os); -extern void ssl_ResetSecurityInfo(sslSecurityInfo *sec, PRBool doMemset); -extern void ssl_DestroySecurityInfo(sslSecurityInfo *sec); - -extern sslSocket * ssl_DupSocket(sslSocket *old); - -extern void ssl_PrintBuf(sslSocket *ss, const char *msg, const void *cp, int len); -extern void ssl_DumpMsg(sslSocket *ss, unsigned char *bp, unsigned len); - -extern int ssl_SendSavedWriteData(sslSocket *ss); -extern SECStatus ssl_SaveWriteData(sslSocket *ss, - const void* p, unsigned int l); -extern SECStatus ssl2_BeginClientHandshake(sslSocket *ss); -extern SECStatus ssl2_BeginServerHandshake(sslSocket *ss); -extern int ssl_Do1stHandshake(sslSocket *ss); - -extern SECStatus sslBuffer_Grow(sslBuffer *b, unsigned int newLen); -extern SECStatus sslBuffer_Append(sslBuffer *b, const void * data, - unsigned int len); - -extern void ssl2_UseClearSendFunc(sslSocket *ss); -extern void ssl_ChooseSessionIDProcs(sslSecurityInfo *sec); - -extern sslSessionID *ssl3_NewSessionID(sslSocket *ss, PRBool is_server); -extern sslSessionID *ssl_LookupSID(const PRIPv6Addr *addr, PRUint16 port, - const char *peerID, const char *urlSvrName); -extern void ssl_FreeSID(sslSessionID *sid); - -extern int ssl3_SendApplicationData(sslSocket *ss, const PRUint8 *in, - int len, int flags); - -extern PRBool ssl_FdIsBlocking(PRFileDesc *fd); - -extern PRBool ssl_SocketIsBlocking(sslSocket *ss); - -extern void ssl_SetAlwaysBlock(sslSocket *ss); - -extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled); - -#define SSL_LOCK_READER(ss) if (ss->recvLock) PZ_Lock(ss->recvLock) -#define SSL_UNLOCK_READER(ss) if (ss->recvLock) PZ_Unlock(ss->recvLock) -#define SSL_LOCK_WRITER(ss) if (ss->sendLock) PZ_Lock(ss->sendLock) -#define SSL_UNLOCK_WRITER(ss) if (ss->sendLock) PZ_Unlock(ss->sendLock) - -#define ssl_Get1stHandshakeLock(ss) \ - { if (!ss->opt.noLocks) PZ_EnterMonitor((ss)->firstHandshakeLock); } -#define ssl_Release1stHandshakeLock(ss) \ - { if (!ss->opt.noLocks) PZ_ExitMonitor((ss)->firstHandshakeLock); } -#define ssl_Have1stHandshakeLock(ss) \ - (PZ_InMonitor((ss)->firstHandshakeLock)) - -#define ssl_GetSSL3HandshakeLock(ss) \ - { if (!ss->opt.noLocks) PZ_EnterMonitor((ss)->ssl3HandshakeLock); } -#define ssl_ReleaseSSL3HandshakeLock(ss) \ - { if (!ss->opt.noLocks) PZ_ExitMonitor((ss)->ssl3HandshakeLock); } -#define ssl_HaveSSL3HandshakeLock(ss) \ - (PZ_InMonitor((ss)->ssl3HandshakeLock)) - -#define ssl_GetSpecReadLock(ss) \ - { if (!ss->opt.noLocks) NSSRWLock_LockRead((ss)->specLock); } -#define ssl_ReleaseSpecReadLock(ss) \ - { if (!ss->opt.noLocks) NSSRWLock_UnlockRead((ss)->specLock); } - -#define ssl_GetSpecWriteLock(ss) \ - { if (!ss->opt.noLocks) NSSRWLock_LockWrite((ss)->specLock); } -#define ssl_ReleaseSpecWriteLock(ss) \ - { if (!ss->opt.noLocks) NSSRWLock_UnlockWrite((ss)->specLock); } -#define ssl_HaveSpecWriteLock(ss) \ - (NSSRWLock_HaveWriteLock((ss)->specLock)) - -#define ssl_GetRecvBufLock(ss) \ - { if (!ss->opt.noLocks) PZ_EnterMonitor((ss)->recvBufLock); } -#define ssl_ReleaseRecvBufLock(ss) \ - { if (!ss->opt.noLocks) PZ_ExitMonitor( (ss)->recvBufLock); } -#define ssl_HaveRecvBufLock(ss) \ - (PZ_InMonitor((ss)->recvBufLock)) - -#define ssl_GetXmitBufLock(ss) \ - { if (!ss->opt.noLocks) PZ_EnterMonitor((ss)->xmitBufLock); } -#define ssl_ReleaseXmitBufLock(ss) \ - { if (!ss->opt.noLocks) PZ_ExitMonitor( (ss)->xmitBufLock); } -#define ssl_HaveXmitBufLock(ss) \ - (PZ_InMonitor((ss)->xmitBufLock)) - - -extern SECStatus ssl3_KeyAndMacDeriveBypass(ssl3CipherSpec * pwSpec, - const unsigned char * cr, const unsigned char * sr, - PRBool isTLS, PRBool isExport); -extern SECStatus ssl3_MasterKeyDeriveBypass( ssl3CipherSpec * pwSpec, - const unsigned char * cr, const unsigned char * sr, - const SECItem * pms, PRBool isTLS, PRBool isRSA); - -/* These functions are called from secnav, even though they're "private". */ - -extern int ssl2_SendErrorMessage(struct sslSocketStr *ss, int error); -extern int SSL_RestartHandshakeAfterServerCert(struct sslSocketStr *ss); -extern int SSL_RestartHandshakeAfterCertReq(struct sslSocketStr *ss, - CERTCertificate *cert, - SECKEYPrivateKey *key, - CERTCertificateList *certChain); -extern sslSocket *ssl_FindSocket(PRFileDesc *fd); -extern void ssl_FreeSocket(struct sslSocketStr *ssl); -extern SECStatus SSL3_SendAlert(sslSocket *ss, SSL3AlertLevel level, - SSL3AlertDescription desc); - -extern int ssl2_RestartHandshakeAfterCertReq(sslSocket * ss, - CERTCertificate * cert, - SECKEYPrivateKey * key); - -extern SECStatus ssl3_RestartHandshakeAfterCertReq(sslSocket * ss, - CERTCertificate * cert, - SECKEYPrivateKey * key, - CERTCertificateList *certChain); - -extern int ssl2_RestartHandshakeAfterServerCert(sslSocket *ss); -extern int ssl3_RestartHandshakeAfterServerCert(sslSocket *ss); - -/* - * for dealing with SSL 3.0 clients sending SSL 2.0 format hellos - */ -extern SECStatus ssl3_HandleV2ClientHello( - sslSocket *ss, unsigned char *buffer, int length); -extern SECStatus ssl3_StartHandshakeHash( - sslSocket *ss, unsigned char *buf, int length); - -/* - * SSL3 specific routines - */ -SECStatus ssl3_SendClientHello(sslSocket *ss); - -/* - * input into the SSL3 machinery from the actualy network reading code - */ -SECStatus ssl3_HandleRecord( - sslSocket *ss, SSL3Ciphertext *cipher, sslBuffer *out); - -int ssl3_GatherAppDataRecord(sslSocket *ss, int flags); -int ssl3_GatherCompleteHandshake(sslSocket *ss, int flags); -/* - * When talking to export clients or using export cipher suites, servers - * with public RSA keys larger than 512 bits need to use a 512-bit public - * key, signed by the larger key. The smaller key is a "step down" key. - * Generate that key pair and keep it around. - */ -extern SECStatus ssl3_CreateRSAStepDownKeys(sslSocket *ss); - -#ifdef NSS_ENABLE_ECC -extern void ssl3_FilterECCipherSuitesByServerCerts(sslSocket *ss); -extern PRBool ssl3_IsECCEnabled(sslSocket *ss); -extern SECStatus ssl3_DisableECCSuites(sslSocket * ss, - const ssl3CipherSuite * suite); - -/* Macro for finding a curve equivalent in strength to RSA key's */ -#define SSL_RSASTRENGTH_TO_ECSTRENGTH(s) \ - ((s <= 1024) ? 160 \ - : ((s <= 2048) ? 224 \ - : ((s <= 3072) ? 256 \ - : ((s <= 7168) ? 384 : 521 ) ) ) ) - -/* Types and names of elliptic curves used in TLS */ -typedef enum { ec_type_explicitPrime = 1, - ec_type_explicitChar2Curve = 2, - ec_type_named -} ECType; - -typedef enum { ec_noName = 0, - ec_sect163k1 = 1, - ec_sect163r1 = 2, - ec_sect163r2 = 3, - ec_sect193r1 = 4, - ec_sect193r2 = 5, - ec_sect233k1 = 6, - ec_sect233r1 = 7, - ec_sect239k1 = 8, - ec_sect283k1 = 9, - ec_sect283r1 = 10, - ec_sect409k1 = 11, - ec_sect409r1 = 12, - ec_sect571k1 = 13, - ec_sect571r1 = 14, - ec_secp160k1 = 15, - ec_secp160r1 = 16, - ec_secp160r2 = 17, - ec_secp192k1 = 18, - ec_secp192r1 = 19, - ec_secp224k1 = 20, - ec_secp224r1 = 21, - ec_secp256k1 = 22, - ec_secp256r1 = 23, - ec_secp384r1 = 24, - ec_secp521r1 = 25, - ec_pastLastName -} ECName; - -extern SECStatus ssl3_ECName2Params(PRArenaPool *arena, ECName curve, - SECKEYECParams *params); -ECName ssl3_GetCurveWithECKeyStrength(PRUint32 curvemsk, int requiredECCbits); - - -#endif /* NSS_ENABLE_ECC */ - -extern SECStatus ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool on); -extern SECStatus ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *on); -extern SECStatus ssl2_CipherPrefSetDefault(PRInt32 which, PRBool enabled); -extern SECStatus ssl2_CipherPrefGetDefault(PRInt32 which, PRBool *enabled); - -extern SECStatus ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool on); -extern SECStatus ssl3_CipherPrefGet(sslSocket *ss, ssl3CipherSuite which, PRBool *on); -extern SECStatus ssl2_CipherPrefSet(sslSocket *ss, PRInt32 which, PRBool enabled); -extern SECStatus ssl2_CipherPrefGet(sslSocket *ss, PRInt32 which, PRBool *enabled); - -extern SECStatus ssl3_SetPolicy(ssl3CipherSuite which, PRInt32 policy); -extern SECStatus ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *policy); -extern SECStatus ssl2_SetPolicy(PRInt32 which, PRInt32 policy); -extern SECStatus ssl2_GetPolicy(PRInt32 which, PRInt32 *policy); - -extern void ssl2_InitSocketPolicy(sslSocket *ss); -extern void ssl3_InitSocketPolicy(sslSocket *ss); - -extern SECStatus ssl3_ConstructV2CipherSpecsHack(sslSocket *ss, - unsigned char *cs, int *size); - -extern SECStatus ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache); - -extern void ssl3_DestroySSL3Info(sslSocket *ss); - -extern SECStatus ssl3_NegotiateVersion(sslSocket *ss, - SSL3ProtocolVersion peerVersion); - -extern SECStatus ssl_GetPeerInfo(sslSocket *ss); - -#ifdef NSS_ENABLE_ECC -/* ECDH functions */ -extern SECStatus ssl3_SendECDHClientKeyExchange(sslSocket * ss, - SECKEYPublicKey * svrPubKey); -extern SECStatus ssl3_HandleECDHServerKeyExchange(sslSocket *ss, - SSL3Opaque *b, PRUint32 length); -extern SECStatus ssl3_HandleECDHClientKeyExchange(sslSocket *ss, - SSL3Opaque *b, PRUint32 length, - SECKEYPublicKey *srvrPubKey, - SECKEYPrivateKey *srvrPrivKey); -extern SECStatus ssl3_SendECDHServerKeyExchange(sslSocket *ss); -#endif - -extern SECStatus ssl3_ComputeCommonKeyHash(PRUint8 * hashBuf, - unsigned int bufLen, SSL3Hashes *hashes, - PRBool bypassPKCS11); -extern SECStatus ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms); -extern SECStatus ssl3_AppendHandshake(sslSocket *ss, const void *void_src, - PRInt32 bytes); -extern SECStatus ssl3_AppendHandshakeHeader(sslSocket *ss, - SSL3HandshakeType t, PRUint32 length); -extern SECStatus ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num, - PRInt32 lenSize); -extern SECStatus ssl3_AppendHandshakeVariable( sslSocket *ss, - const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize); -extern SECStatus ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRInt32 bytes, - SSL3Opaque **b, PRUint32 *length); -extern PRInt32 ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRInt32 bytes, - SSL3Opaque **b, PRUint32 *length); -extern SECStatus ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, - PRInt32 bytes, SSL3Opaque **b, PRUint32 *length); -extern SECStatus ssl3_SignHashes(SSL3Hashes *hash, SECKEYPrivateKey *key, - SECItem *buf, PRBool isTLS); -extern SECStatus ssl3_VerifySignedHashes(SSL3Hashes *hash, - CERTCertificate *cert, SECItem *buf, PRBool isTLS, - void *pwArg); -extern SECStatus ssl3_CacheWrappedMasterSecret(sslSocket *ss, - sslSessionID *sid, ssl3CipherSpec *spec, - SSL3KEAType effectiveExchKeyType); - -/* Functions that handle ClientHello and ServerHello extensions. */ -extern SECStatus ssl3_HandleServerNameXtn(sslSocket * ss, - PRUint16 ex_type, SECItem *data); -extern SECStatus ssl3_HandleSupportedCurvesXtn(sslSocket * ss, - PRUint16 ex_type, SECItem *data); -extern SECStatus ssl3_HandleSupportedPointFormatsXtn(sslSocket * ss, - PRUint16 ex_type, SECItem *data); -extern SECStatus ssl3_ClientHandleSessionTicketXtn(sslSocket *ss, - PRUint16 ex_type, SECItem *data); -extern SECStatus ssl3_ServerHandleSessionTicketXtn(sslSocket *ss, - PRUint16 ex_type, SECItem *data); - -/* ClientHello and ServerHello extension senders. - * Note that not all extension senders are exposed here; only those that - * that need exposure. - */ -extern PRInt32 ssl3_SendSessionTicketXtn(sslSocket *ss, PRBool append, - PRUint32 maxBytes); -#ifdef NSS_ENABLE_ECC -extern PRInt32 ssl3_SendSupportedCurvesXtn(sslSocket *ss, - PRBool append, PRUint32 maxBytes); -extern PRInt32 ssl3_SendSupportedPointFormatsXtn(sslSocket *ss, - PRBool append, PRUint32 maxBytes); -#endif - -/* call the registered extension handlers. */ -extern SECStatus ssl3_HandleHelloExtensions(sslSocket *ss, - SSL3Opaque **b, PRUint32 *length); - -/* Hello Extension related routines. */ -extern PRBool ssl3_ExtensionNegotiated(sslSocket *ss, PRUint16 ex_type); -extern SECStatus ssl3_SetSIDSessionTicket(sslSessionID *sid, - NewSessionTicket *session_ticket); -extern SECStatus ssl3_SendNewSessionTicket(sslSocket *ss); -extern PRBool ssl_GetSessionTicketKeys(unsigned char *keyName, - unsigned char *encKey, unsigned char *macKey); -extern PRBool ssl_GetSessionTicketKeysPKCS11(SECKEYPrivateKey *svrPrivKey, - SECKEYPublicKey *svrPubKey, void *pwArg, - unsigned char *keyName, PK11SymKey **aesKey, - PK11SymKey **macKey); - -/* Tell clients to consider tickets valid for this long. */ -#define TLS_EX_SESS_TICKET_LIFETIME_HINT (2 * 24 * 60 * 60) /* 2 days */ -#define TLS_EX_SESS_TICKET_VERSION (0x0100) - -/* Construct a new NSPR socket for the app to use */ -extern PRFileDesc *ssl_NewPRSocket(sslSocket *ss, PRFileDesc *fd); -extern void ssl_FreePRSocket(PRFileDesc *fd); - -/* Internal config function so SSL2 can initialize the present state of - * various ciphers */ -extern int ssl3_config_match_init(sslSocket *); - - -/* Create a new ref counted key pair object from two keys. */ -extern ssl3KeyPair * ssl3_NewKeyPair( SECKEYPrivateKey * privKey, - SECKEYPublicKey * pubKey); - -/* get a new reference (bump ref count) to an ssl3KeyPair. */ -extern ssl3KeyPair * ssl3_GetKeyPairRef(ssl3KeyPair * keyPair); - -/* Decrement keypair's ref count and free if zero. */ -extern void ssl3_FreeKeyPair(ssl3KeyPair * keyPair); - -/* calls for accessing wrapping keys across processes. */ -extern PRBool -ssl_GetWrappingKey( PRInt32 symWrapMechIndex, - SSL3KEAType exchKeyType, - SSLWrappedSymWrappingKey *wswk); - -/* The caller passes in the new value it wants - * to set. This code tests the wrapped sym key entry in the file on disk. - * If it is uninitialized, this function writes the caller's value into - * the disk entry, and returns false. - * Otherwise, it overwrites the caller's wswk with the value obtained from - * the disk, and returns PR_TRUE. - * This is all done while holding the locks/semaphores necessary to make - * the operation atomic. - */ -extern PRBool -ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk); - -/* get rid of the symmetric wrapping key references. */ -extern SECStatus SSL3_ShutdownServerCache(void); - -extern SECStatus ssl_InitSymWrapKeysLock(void); - -extern SECStatus ssl_FreeSymWrapKeysLock(void); - -extern SECStatus ssl_InitSessionCacheLocks(PRBool lazyInit); - -extern SECStatus ssl_FreeSessionCacheLocks(void); - - -/********************** misc calls *********************/ - -extern int ssl_MapLowLevelError(int hiLevelError); - -extern PRUint32 ssl_Time(void); - -extern void SSL_AtomicIncrementLong(long * x); - -SECStatus SSL_DisableDefaultExportCipherSuites(void); -SECStatus SSL_DisableExportCipherSuites(PRFileDesc * fd); -PRBool SSL_IsExportCipherSuite(PRUint16 cipherSuite); - - -#ifdef TRACE -#define SSL_TRACE(msg) ssl_Trace msg -#else -#define SSL_TRACE(msg) -#endif - -void ssl_Trace(const char *format, ...); - -SEC_END_PROTOS - -#if defined(XP_UNIX) || defined(XP_OS2) || defined(XP_BEOS) -#define SSL_GETPID getpid -#elif defined(_WIN32_WCE) -#define SSL_GETPID GetCurrentProcessId -#elif defined(WIN32) -extern int __cdecl _getpid(void); -#define SSL_GETPID _getpid -#else -#define SSL_GETPID() 0 -#endif - -#endif /* __sslimpl_h_ */ diff --git a/security/nss/lib/ssl/sslinfo.c b/security/nss/lib/ssl/sslinfo.c deleted file mode 100644 index af97dd8b2..000000000 --- a/security/nss/lib/ssl/sslinfo.c +++ /dev/null @@ -1,285 +0,0 @@ -/* ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 2001 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" - -SECStatus -SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, PRUintn len) -{ - sslSocket * ss; - SSLChannelInfo inf; - sslSessionID * sid; - - if (!info || len < sizeof inf.length) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetChannelInfo", - SSL_GETPID(), fd)); - return SECFailure; - } - - memset(&inf, 0, sizeof inf); - inf.length = PR_MIN(sizeof inf, len); - - if (ss->opt.useSecurity && ss->firstHsDone) { - sid = ss->sec.ci.sid; - inf.protocolVersion = ss->version; - inf.authKeyBits = ss->sec.authKeyBits; - inf.keaKeyBits = ss->sec.keaKeyBits; - if (ss->version < SSL_LIBRARY_VERSION_3_0) { /* SSL2 */ - inf.cipherSuite = ss->sec.cipherType | 0xff00; - } else if (ss->ssl3.initialized) { /* SSL3 and TLS */ - - /* XXX These should come from crSpec */ - inf.cipherSuite = ss->ssl3.hs.cipher_suite; - } - if (sid) { - inf.creationTime = sid->creationTime; - inf.lastAccessTime = sid->lastAccessTime; - inf.expirationTime = sid->expirationTime; - if (ss->version < SSL_LIBRARY_VERSION_3_0) { /* SSL2 */ - inf.sessionIDLength = SSL2_SESSIONID_BYTES; - memcpy(inf.sessionID, sid->u.ssl2.sessionID, - SSL2_SESSIONID_BYTES); - } else { - unsigned int sidLen = sid->u.ssl3.sessionIDLength; - sidLen = PR_MIN(sidLen, sizeof inf.sessionID); - inf.sessionIDLength = sidLen; - memcpy(inf.sessionID, sid->u.ssl3.sessionID, sidLen); - } - } - } - - memcpy(info, &inf, inf.length); - - return SECSuccess; -} - - -#define CS(x) x, #x -#define CK(x) x | 0xff00, #x - -#define S_DSA "DSA", ssl_auth_dsa -#define S_RSA "RSA", ssl_auth_rsa -#define S_KEA "KEA", ssl_auth_kea -#define S_ECDSA "ECDSA", ssl_auth_ecdsa - -#define K_DHE "DHE", kt_dh -#define K_RSA "RSA", kt_rsa -#define K_KEA "KEA", kt_kea -#define K_ECDH "ECDH", kt_ecdh -#define K_ECDHE "ECDHE", kt_ecdh - -#define C_SEED "SEED", calg_seed -#define C_CAMELLIA "CAMELLIA", calg_camellia -#define C_AES "AES", calg_aes -#define C_RC4 "RC4", calg_rc4 -#define C_RC2 "RC2", calg_rc2 -#define C_DES "DES", calg_des -#define C_3DES "3DES", calg_3des -#define C_NULL "NULL", calg_null -#define C_SJ "SKIPJACK", calg_sj - -#define B_256 256, 256, 256 -#define B_128 128, 128, 128 -#define B_3DES 192, 156, 112 -#define B_SJ 96, 80, 80 -#define B_DES 64, 56, 56 -#define B_56 128, 56, 56 -#define B_40 128, 40, 40 -#define B_0 0, 0, 0 - -#define M_SHA "SHA1", ssl_mac_sha, 160 -#define M_MD5 "MD5", ssl_mac_md5, 128 - -static const SSLCipherSuiteInfo suiteInfo[] = { -/* <------ Cipher suite --------------------> <auth> <KEA> <bulk cipher> <MAC> <FIPS> */ -{0,CS(TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA), S_RSA, K_DHE, C_CAMELLIA, B_256, M_SHA, 0, 0, 0, }, -{0,CS(TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA), S_DSA, K_DHE, C_CAMELLIA, B_256, M_SHA, 0, 0, 0, }, -{0,CS(TLS_DHE_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_DHE, C_AES, B_256, M_SHA, 1, 0, 0, }, -{0,CS(TLS_DHE_DSS_WITH_AES_256_CBC_SHA), S_DSA, K_DHE, C_AES, B_256, M_SHA, 1, 0, 0, }, -{0,CS(TLS_RSA_WITH_CAMELLIA_256_CBC_SHA), S_RSA, K_RSA, C_CAMELLIA, B_256, M_SHA, 0, 0, 0, }, -{0,CS(TLS_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_RSA, C_AES, B_256, M_SHA, 1, 0, 0, }, - -{0,CS(TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA), S_RSA, K_DHE, C_CAMELLIA, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA), S_DSA, K_DHE, C_CAMELLIA, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_DHE_DSS_WITH_RC4_128_SHA), S_DSA, K_DHE, C_RC4, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_DHE_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_DHE, C_AES, B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_DHE_DSS_WITH_AES_128_CBC_SHA), S_DSA, K_DHE, C_AES, B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_RSA_WITH_SEED_CBC_SHA), S_RSA, K_RSA, C_SEED,B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_RSA_WITH_CAMELLIA_128_CBC_SHA), S_RSA, K_RSA, C_CAMELLIA, B_128, M_SHA, 0, 0, 0, }, -{0,CS(SSL_RSA_WITH_RC4_128_MD5), S_RSA, K_RSA, C_RC4, B_128, M_MD5, 0, 0, 0, }, -{0,CS(SSL_RSA_WITH_RC4_128_SHA), S_RSA, K_RSA, C_RC4, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_RSA, C_AES, B_128, M_SHA, 1, 0, 0, }, - -{0,CS(SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_DHE, C_3DES,B_3DES,M_SHA, 1, 0, 0, }, -{0,CS(SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA), S_DSA, K_DHE, C_3DES,B_3DES,M_SHA, 1, 0, 0, }, -{0,CS(SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA), S_RSA, K_RSA, C_3DES,B_3DES,M_SHA, 1, 0, 1, }, -{0,CS(SSL_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_RSA, C_3DES,B_3DES,M_SHA, 1, 0, 0, }, - -{0,CS(SSL_DHE_RSA_WITH_DES_CBC_SHA), S_RSA, K_DHE, C_DES, B_DES, M_SHA, 0, 0, 0, }, -{0,CS(SSL_DHE_DSS_WITH_DES_CBC_SHA), S_DSA, K_DHE, C_DES, B_DES, M_SHA, 0, 0, 0, }, -{0,CS(SSL_RSA_FIPS_WITH_DES_CBC_SHA), S_RSA, K_RSA, C_DES, B_DES, M_SHA, 0, 0, 1, }, -{0,CS(SSL_RSA_WITH_DES_CBC_SHA), S_RSA, K_RSA, C_DES, B_DES, M_SHA, 0, 0, 0, }, - -{0,CS(TLS_RSA_EXPORT1024_WITH_RC4_56_SHA), S_RSA, K_RSA, C_RC4, B_56, M_SHA, 0, 1, 0, }, -{0,CS(TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA), S_RSA, K_RSA, C_DES, B_DES, M_SHA, 0, 1, 0, }, -{0,CS(SSL_RSA_EXPORT_WITH_RC4_40_MD5), S_RSA, K_RSA, C_RC4, B_40, M_MD5, 0, 1, 0, }, -{0,CS(SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5), S_RSA, K_RSA, C_RC2, B_40, M_MD5, 0, 1, 0, }, -{0,CS(SSL_RSA_WITH_NULL_SHA), S_RSA, K_RSA, C_NULL,B_0, M_SHA, 0, 1, 0, }, -{0,CS(SSL_RSA_WITH_NULL_MD5), S_RSA, K_RSA, C_NULL,B_0, M_MD5, 0, 1, 0, }, - -#ifdef NSS_ENABLE_ECC -/* ECC cipher suites */ -{0,CS(TLS_ECDH_ECDSA_WITH_NULL_SHA), S_ECDSA, K_ECDH, C_NULL, B_0, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDH_ECDSA_WITH_RC4_128_SHA), S_ECDSA, K_ECDH, C_RC4, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA), S_ECDSA, K_ECDH, C_3DES, B_3DES, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA), S_ECDSA, K_ECDH, C_AES, B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA), S_ECDSA, K_ECDH, C_AES, B_256, M_SHA, 1, 0, 0, }, - -{0,CS(TLS_ECDHE_ECDSA_WITH_NULL_SHA), S_ECDSA, K_ECDHE, C_NULL, B_0, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA), S_ECDSA, K_ECDHE, C_RC4, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA), S_ECDSA, K_ECDHE, C_3DES, B_3DES, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA), S_ECDSA, K_ECDHE, C_AES, B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA), S_ECDSA, K_ECDHE, C_AES, B_256, M_SHA, 1, 0, 0, }, - -{0,CS(TLS_ECDH_RSA_WITH_NULL_SHA), S_RSA, K_ECDH, C_NULL, B_0, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDH_RSA_WITH_RC4_128_SHA), S_RSA, K_ECDH, C_RC4, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_ECDH, C_3DES, B_3DES, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_ECDH, C_AES, B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_ECDH, C_AES, B_256, M_SHA, 1, 0, 0, }, - -{0,CS(TLS_ECDHE_RSA_WITH_NULL_SHA), S_RSA, K_ECDHE, C_NULL, B_0, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDHE_RSA_WITH_RC4_128_SHA), S_RSA, K_ECDHE, C_RC4, B_128, M_SHA, 0, 0, 0, }, -{0,CS(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_ECDHE, C_3DES, B_3DES, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_ECDHE, C_AES, B_128, M_SHA, 1, 0, 0, }, -{0,CS(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_ECDHE, C_AES, B_256, M_SHA, 1, 0, 0, }, -#endif /* NSS_ENABLE_ECC */ - -/* SSL 2 table */ -{0,CK(SSL_CK_RC4_128_WITH_MD5), S_RSA, K_RSA, C_RC4, B_128, M_MD5, 0, 0, 0, }, -{0,CK(SSL_CK_RC2_128_CBC_WITH_MD5), S_RSA, K_RSA, C_RC2, B_128, M_MD5, 0, 0, 0, }, -{0,CK(SSL_CK_DES_192_EDE3_CBC_WITH_MD5), S_RSA, K_RSA, C_3DES,B_3DES,M_MD5, 0, 0, 0, }, -{0,CK(SSL_CK_DES_64_CBC_WITH_MD5), S_RSA, K_RSA, C_DES, B_DES, M_MD5, 0, 0, 0, }, -{0,CK(SSL_CK_RC4_128_EXPORT40_WITH_MD5), S_RSA, K_RSA, C_RC4, B_40, M_MD5, 0, 1, 0, }, -{0,CK(SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5), S_RSA, K_RSA, C_RC2, B_40, M_MD5, 0, 1, 0, } -}; - -#define NUM_SUITEINFOS ((sizeof suiteInfo) / (sizeof suiteInfo[0])) - - -SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, - SSLCipherSuiteInfo *info, PRUintn len) -{ - unsigned int i; - - len = PR_MIN(len, sizeof suiteInfo[0]); - if (!info || len < sizeof suiteInfo[0].length) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - for (i = 0; i < NUM_SUITEINFOS; i++) { - if (suiteInfo[i].cipherSuite == cipherSuite) { - memcpy(info, &suiteInfo[i], len); - info->length = len; - return SECSuccess; - } - } - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; -} - -/* This function might be a candidate to be public. - * Disables all export ciphers in the default set of enabled ciphers. - */ -SECStatus -SSL_DisableDefaultExportCipherSuites(void) -{ - const SSLCipherSuiteInfo * pInfo = suiteInfo; - unsigned int i; - SECStatus rv; - - for (i = 0; i < NUM_SUITEINFOS; ++i, ++pInfo) { - if (pInfo->isExportable) { - rv = SSL_CipherPrefSetDefault(pInfo->cipherSuite, PR_FALSE); - PORT_Assert(rv == SECSuccess); - } - } - return SECSuccess; -} - -/* This function might be a candidate to be public, - * except that it takes an sslSocket pointer as an argument. - * A Public version would take a PRFileDesc pointer. - * Disables all export ciphers in the default set of enabled ciphers. - */ -SECStatus -SSL_DisableExportCipherSuites(PRFileDesc * fd) -{ - const SSLCipherSuiteInfo * pInfo = suiteInfo; - unsigned int i; - SECStatus rv; - - for (i = 0; i < NUM_SUITEINFOS; ++i, ++pInfo) { - if (pInfo->isExportable) { - rv = SSL_CipherPrefSet(fd, pInfo->cipherSuite, PR_FALSE); - PORT_Assert(rv == SECSuccess); - } - } - return SECSuccess; -} - -/* Tells us if the named suite is exportable - * returns false for unknown suites. - */ -PRBool -SSL_IsExportCipherSuite(PRUint16 cipherSuite) -{ - unsigned int i; - for (i = 0; i < NUM_SUITEINFOS; i++) { - if (suiteInfo[i].cipherSuite == cipherSuite) { - return (PRBool)(suiteInfo[i].isExportable); - } - } - return PR_FALSE; -} diff --git a/security/nss/lib/ssl/sslmutex.c b/security/nss/lib/ssl/sslmutex.c deleted file mode 100644 index 067bc0eda..000000000 --- a/security/nss/lib/ssl/sslmutex.c +++ /dev/null @@ -1,663 +0,0 @@ -/* ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 2001 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "seccomon.h" -/* This ifdef should match the one in sslsnce.c */ -#if defined(XP_UNIX) || defined(XP_WIN32) || defined (XP_OS2) || defined(XP_BEOS) - -#include "sslmutex.h" -#include "prerr.h" - -static SECStatus single_process_sslMutex_Init(sslMutex* pMutex) -{ - PR_ASSERT(pMutex != 0 && pMutex->u.sslLock == 0 ); - - pMutex->u.sslLock = PR_NewLock(); - if (!pMutex->u.sslLock) { - return SECFailure; - } - return SECSuccess; -} - -static SECStatus single_process_sslMutex_Destroy(sslMutex* pMutex) -{ - PR_ASSERT(pMutex != 0); - PR_ASSERT(pMutex->u.sslLock!= 0); - if (!pMutex->u.sslLock) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - PR_DestroyLock(pMutex->u.sslLock); - return SECSuccess; -} - -static SECStatus single_process_sslMutex_Unlock(sslMutex* pMutex) -{ - PR_ASSERT(pMutex != 0 ); - PR_ASSERT(pMutex->u.sslLock !=0); - if (!pMutex->u.sslLock) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - PR_Unlock(pMutex->u.sslLock); - return SECSuccess; -} - -static SECStatus single_process_sslMutex_Lock(sslMutex* pMutex) -{ - PR_ASSERT(pMutex != 0); - PR_ASSERT(pMutex->u.sslLock != 0 ); - if (!pMutex->u.sslLock) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - PR_Lock(pMutex->u.sslLock); - return SECSuccess; -} - -#if defined(LINUX) || defined(AIX) || defined(VMS) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) - -#include <unistd.h> -#include <fcntl.h> -#include <string.h> -#include <errno.h> -#include "unix_err.h" -#include "pratom.h" - -#define SSL_MUTEX_MAGIC 0xfeedfd -#define NONBLOCKING_POSTS 1 /* maybe this is faster */ - -#if NONBLOCKING_POSTS - -#ifndef FNONBLOCK -#define FNONBLOCK O_NONBLOCK -#endif - -static int -setNonBlocking(int fd, int nonBlocking) -{ - int flags; - int err; - - flags = fcntl(fd, F_GETFL, 0); - if (0 > flags) - return flags; - if (nonBlocking) - flags |= FNONBLOCK; - else - flags &= ~FNONBLOCK; - err = fcntl(fd, F_SETFL, flags); - return err; -} -#endif - -SECStatus -sslMutex_Init(sslMutex *pMutex, int shared) -{ - int err; - PR_ASSERT(pMutex); - pMutex->isMultiProcess = (PRBool)(shared != 0); - if (!shared) { - return single_process_sslMutex_Init(pMutex); - } - pMutex->u.pipeStr.mPipes[0] = -1; - pMutex->u.pipeStr.mPipes[1] = -1; - pMutex->u.pipeStr.mPipes[2] = -1; - pMutex->u.pipeStr.nWaiters = 0; - - err = pipe(pMutex->u.pipeStr.mPipes); - if (err) { - nss_MD_unix_map_default_error(errno); - return err; - } -#if NONBLOCKING_POSTS - err = setNonBlocking(pMutex->u.pipeStr.mPipes[1], 1); - if (err) - goto loser; -#endif - - pMutex->u.pipeStr.mPipes[2] = SSL_MUTEX_MAGIC; - -#if defined(LINUX) && defined(i386) - /* Pipe starts out empty */ - return SECSuccess; -#else - /* Pipe starts with one byte. */ - return sslMutex_Unlock(pMutex); -#endif - -loser: - nss_MD_unix_map_default_error(errno); - close(pMutex->u.pipeStr.mPipes[0]); - close(pMutex->u.pipeStr.mPipes[1]); - return SECFailure; -} - -SECStatus -sslMutex_Destroy(sslMutex *pMutex) -{ - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Destroy(pMutex); - } - if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - close(pMutex->u.pipeStr.mPipes[0]); - close(pMutex->u.pipeStr.mPipes[1]); - - pMutex->u.pipeStr.mPipes[0] = -1; - pMutex->u.pipeStr.mPipes[1] = -1; - pMutex->u.pipeStr.mPipes[2] = -1; - pMutex->u.pipeStr.nWaiters = 0; - - return SECSuccess; -} - -#if defined(LINUX) && defined(i386) -/* No memory barrier needed for this platform */ - -/* nWaiters includes the holder of the lock (if any) and the number -** threads waiting for it. After incrementing nWaiters, if the count -** is exactly 1, then you have the lock and may proceed. If the -** count is greater than 1, then you must wait on the pipe. -*/ - - -SECStatus -sslMutex_Unlock(sslMutex *pMutex) -{ - PRInt32 newValue; - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Unlock(pMutex); - } - - if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - /* Do Memory Barrier here. */ - newValue = PR_AtomicDecrement(&pMutex->u.pipeStr.nWaiters); - if (newValue > 0) { - int cc; - char c = 1; - do { - cc = write(pMutex->u.pipeStr.mPipes[1], &c, 1); - } while (cc < 0 && (errno == EINTR || errno == EAGAIN)); - if (cc != 1) { - if (cc < 0) - nss_MD_unix_map_default_error(errno); - else - PORT_SetError(PR_UNKNOWN_ERROR); - return SECFailure; - } - } - return SECSuccess; -} - -SECStatus -sslMutex_Lock(sslMutex *pMutex) -{ - PRInt32 newValue; - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Lock(pMutex); - } - - if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - newValue = PR_AtomicIncrement(&pMutex->u.pipeStr.nWaiters); - /* Do Memory Barrier here. */ - if (newValue > 1) { - int cc; - char c; - do { - cc = read(pMutex->u.pipeStr.mPipes[0], &c, 1); - } while (cc < 0 && errno == EINTR); - if (cc != 1) { - if (cc < 0) - nss_MD_unix_map_default_error(errno); - else - PORT_SetError(PR_UNKNOWN_ERROR); - return SECFailure; - } - } - return SECSuccess; -} - -#else - -/* Using Atomic operations requires the use of a memory barrier instruction -** on PowerPC, Sparc, and Alpha. NSPR's PR_Atomic functions do not perform -** them, and NSPR does not provide a function that does them (e.g. PR_Barrier). -** So, we don't use them on those platforms. -*/ - -SECStatus -sslMutex_Unlock(sslMutex *pMutex) -{ - int cc; - char c = 1; - - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Unlock(pMutex); - } - - if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - do { - cc = write(pMutex->u.pipeStr.mPipes[1], &c, 1); - } while (cc < 0 && (errno == EINTR || errno == EAGAIN)); - if (cc != 1) { - if (cc < 0) - nss_MD_unix_map_default_error(errno); - else - PORT_SetError(PR_UNKNOWN_ERROR); - return SECFailure; - } - - return SECSuccess; -} - -SECStatus -sslMutex_Lock(sslMutex *pMutex) -{ - int cc; - char c; - - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Lock(pMutex); - } - - if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - - do { - cc = read(pMutex->u.pipeStr.mPipes[0], &c, 1); - } while (cc < 0 && errno == EINTR); - if (cc != 1) { - if (cc < 0) - nss_MD_unix_map_default_error(errno); - else - PORT_SetError(PR_UNKNOWN_ERROR); - return SECFailure; - } - - return SECSuccess; -} - -#endif - -#elif defined(WIN32) - -#include "win32err.h" - -/* on Windows, we need to find the optimal type of locking mechanism to use - for the sslMutex. - - There are 3 cases : - 1) single-process, use a PRLock, as for all other platforms - 2) Win95 multi-process, use a Win32 mutex - 3) on WINNT multi-process, use a PRLock + a Win32 mutex - -*/ - -#ifdef WINNT - -SECStatus sslMutex_2LevelInit(sslMutex *sem) -{ - /* the following adds a PRLock to sslMutex . This is done in each - process of a multi-process server and is only needed on WINNT, if - using fibers. We can't tell if native threads or fibers are used, so - we always do it on WINNT - */ - PR_ASSERT(sem); - if (sem) { - /* we need to reset the sslLock in the children or the single_process init - function below will assert */ - sem->u.sslLock = NULL; - } - return single_process_sslMutex_Init(sem); -} - -static SECStatus sslMutex_2LevelDestroy(sslMutex *sem) -{ - return single_process_sslMutex_Destroy(sem); -} - -#endif - -SECStatus -sslMutex_Init(sslMutex *pMutex, int shared) -{ -#ifdef WINNT - SECStatus retvalue; -#endif - HANDLE hMutex; - SECURITY_ATTRIBUTES attributes = - { sizeof(SECURITY_ATTRIBUTES), NULL, TRUE }; - - PR_ASSERT(pMutex != 0 && (pMutex->u.sslMutx == 0 || - pMutex->u.sslMutx == INVALID_HANDLE_VALUE) ); - - pMutex->isMultiProcess = (PRBool)(shared != 0); - - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Init(pMutex); - } - -#ifdef WINNT - /* we need a lock on WINNT for fibers in the parent process */ - retvalue = sslMutex_2LevelInit(pMutex); - if (SECSuccess != retvalue) - return SECFailure; -#endif - - if (!pMutex || ((hMutex = pMutex->u.sslMutx) != 0 && - hMutex != INVALID_HANDLE_VALUE)) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - attributes.bInheritHandle = (shared ? TRUE : FALSE); - hMutex = CreateMutex(&attributes, FALSE, NULL); - if (hMutex == NULL) { - hMutex = INVALID_HANDLE_VALUE; - nss_MD_win32_map_default_error(GetLastError()); - return SECFailure; - } - pMutex->u.sslMutx = hMutex; - return SECSuccess; -} - -SECStatus -sslMutex_Destroy(sslMutex *pMutex) -{ - HANDLE hMutex; - int rv; - int retvalue = SECSuccess; - - PR_ASSERT(pMutex != 0); - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Destroy(pMutex); - } - - /* multi-process mode */ -#ifdef WINNT - /* on NT, get rid of the PRLock used for fibers within a process */ - retvalue = sslMutex_2LevelDestroy(pMutex); -#endif - - PR_ASSERT( pMutex->u.sslMutx != 0 && - pMutex->u.sslMutx != INVALID_HANDLE_VALUE); - if (!pMutex || (hMutex = pMutex->u.sslMutx) == 0 - || hMutex == INVALID_HANDLE_VALUE) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - - rv = CloseHandle(hMutex); /* ignore error */ - if (rv) { - pMutex->u.sslMutx = hMutex = INVALID_HANDLE_VALUE; - } else { - nss_MD_win32_map_default_error(GetLastError()); - retvalue = SECFailure; - } - return retvalue; -} - -int -sslMutex_Unlock(sslMutex *pMutex) -{ - BOOL success = FALSE; - HANDLE hMutex; - - PR_ASSERT(pMutex != 0 ); - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Unlock(pMutex); - } - - PR_ASSERT(pMutex->u.sslMutx != 0 && - pMutex->u.sslMutx != INVALID_HANDLE_VALUE); - if (!pMutex || (hMutex = pMutex->u.sslMutx) == 0 || - hMutex == INVALID_HANDLE_VALUE) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; - } - success = ReleaseMutex(hMutex); - if (!success) { - nss_MD_win32_map_default_error(GetLastError()); - return SECFailure; - } -#ifdef WINNT - return single_process_sslMutex_Unlock(pMutex); - /* release PRLock for other fibers in the process */ -#else - return SECSuccess; -#endif -} - -int -sslMutex_Lock(sslMutex *pMutex) -{ - HANDLE hMutex; - DWORD event; - DWORD lastError; - SECStatus rv; - SECStatus retvalue = SECSuccess; - PR_ASSERT(pMutex != 0); - - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Lock(pMutex); - } -#ifdef WINNT - /* lock first to preserve from other threads/fibers - in the same process */ - retvalue = single_process_sslMutex_Lock(pMutex); -#endif - PR_ASSERT(pMutex->u.sslMutx != 0 && - pMutex->u.sslMutx != INVALID_HANDLE_VALUE); - if (!pMutex || (hMutex = pMutex->u.sslMutx) == 0 || - hMutex == INVALID_HANDLE_VALUE) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return SECFailure; /* what else ? */ - } - /* acquire the mutex to be the only owner accross all other processes */ - event = WaitForSingleObject(hMutex, INFINITE); - switch (event) { - case WAIT_OBJECT_0: - case WAIT_ABANDONED: - rv = SECSuccess; - break; - - case WAIT_TIMEOUT: -#if defined(WAIT_IO_COMPLETION) - case WAIT_IO_COMPLETION: -#endif - default: /* should never happen. nothing we can do. */ - PR_ASSERT(!("WaitForSingleObject returned invalid value.")); - PORT_SetError(PR_UNKNOWN_ERROR); - rv = SECFailure; - break; - - case WAIT_FAILED: /* failure returns this */ - rv = SECFailure; - lastError = GetLastError(); /* for debugging */ - nss_MD_win32_map_default_error(lastError); - break; - } - - if (! (SECSuccess == retvalue && SECSuccess == rv)) { - return SECFailure; - } - - return SECSuccess; -} - -#elif defined(XP_UNIX) - -#include <errno.h> -#include "unix_err.h" - -SECStatus -sslMutex_Init(sslMutex *pMutex, int shared) -{ - int rv; - PR_ASSERT(pMutex); - pMutex->isMultiProcess = (PRBool)(shared != 0); - if (!shared) { - return single_process_sslMutex_Init(pMutex); - } - do { - rv = sem_init(&pMutex->u.sem, shared, 1); - } while (rv < 0 && errno == EINTR); - if (rv < 0) { - nss_MD_unix_map_default_error(errno); - return SECFailure; - } - return SECSuccess; -} - -SECStatus -sslMutex_Destroy(sslMutex *pMutex) -{ - int rv; - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Destroy(pMutex); - } - do { - rv = sem_destroy(&pMutex->u.sem); - } while (rv < 0 && errno == EINTR); - if (rv < 0) { - nss_MD_unix_map_default_error(errno); - return SECFailure; - } - return SECSuccess; -} - -SECStatus -sslMutex_Unlock(sslMutex *pMutex) -{ - int rv; - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Unlock(pMutex); - } - do { - rv = sem_post(&pMutex->u.sem); - } while (rv < 0 && errno == EINTR); - if (rv < 0) { - nss_MD_unix_map_default_error(errno); - return SECFailure; - } - return SECSuccess; -} - -SECStatus -sslMutex_Lock(sslMutex *pMutex) -{ - int rv; - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Lock(pMutex); - } - do { - rv = sem_wait(&pMutex->u.sem); - } while (rv < 0 && errno == EINTR); - if (rv < 0) { - nss_MD_unix_map_default_error(errno); - return SECFailure; - } - return SECSuccess; -} - -#else - -SECStatus -sslMutex_Init(sslMutex *pMutex, int shared) -{ - PR_ASSERT(pMutex); - pMutex->isMultiProcess = (PRBool)(shared != 0); - if (!shared) { - return single_process_sslMutex_Init(pMutex); - } - PORT_Assert(!("sslMutex_Init not implemented for multi-process applications !")); - PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); - return SECFailure; -} - -SECStatus -sslMutex_Destroy(sslMutex *pMutex) -{ - PR_ASSERT(pMutex); - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Destroy(pMutex); - } - PORT_Assert(!("sslMutex_Destroy not implemented for multi-process applications !")); - PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); - return SECFailure; -} - -SECStatus -sslMutex_Unlock(sslMutex *pMutex) -{ - PR_ASSERT(pMutex); - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Unlock(pMutex); - } - PORT_Assert(!("sslMutex_Unlock not implemented for multi-process applications !")); - PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); - return SECFailure; -} - -SECStatus -sslMutex_Lock(sslMutex *pMutex) -{ - PR_ASSERT(pMutex); - if (PR_FALSE == pMutex->isMultiProcess) { - return single_process_sslMutex_Lock(pMutex); - } - PORT_Assert(!("sslMutex_Lock not implemented for multi-process applications !")); - PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); - return SECFailure; -} - -#endif - -#endif diff --git a/security/nss/lib/ssl/sslmutex.h b/security/nss/lib/ssl/sslmutex.h deleted file mode 100644 index 46eaa9f18..000000000 --- a/security/nss/lib/ssl/sslmutex.h +++ /dev/null @@ -1,155 +0,0 @@ -/* ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 2001 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#ifndef __SSLMUTEX_H_ -#define __SSLMUTEX_H_ 1 - -/* What SSL really wants is portable process-shared unnamed mutexes in - * shared memory, that have the property that if the process that holds - * them dies, they are released automatically, and that (unlike fcntl - * record locking) lock to the thread, not to the process. - * NSPR doesn't provide that. - * Windows has mutexes that meet that description, but they're not portable. - * POSIX mutexes are not automatically released when the holder dies, - * and other processes/threads cannot release the mutex on behalf of the - * dead holder. - * POSIX semaphores can be used to accomplish this on systems that implement - * process-shared unnamed POSIX semaphores, because a watchdog thread can - * discover and release semaphores that were held by a dead process. - * On systems that do not support process-shared POSIX unnamed semaphores, - * they can be emulated using pipes. - * The performance cost of doing that is not yet measured. - * - * So, this API looks a lot like POSIX pthread mutexes. - */ - -#include "prtypes.h" -#include "prlock.h" - -#if defined(NETBSD) -#include <sys/param.h> /* for __NetBSD_Version__ */ -#endif - -#if defined(WIN32) - -#include <wtypes.h> - -typedef struct -{ - PRBool isMultiProcess; -#ifdef WINNT - /* on WINNT we need both the PRLock and the Win32 mutex for fibers */ - struct { -#else - union { -#endif - PRLock* sslLock; - HANDLE sslMutx; - } u; -} sslMutex; - -typedef int sslPID; - -#elif defined(LINUX) || defined(AIX) || defined(VMS) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) - -#include <sys/types.h> -#include "prtypes.h" - -typedef struct { - PRBool isMultiProcess; - union { - PRLock* sslLock; - struct { - int mPipes[3]; - PRInt32 nWaiters; - } pipeStr; - } u; -} sslMutex; -typedef pid_t sslPID; - -#elif defined(XP_UNIX) /* other types of Unix */ - -#include <sys/types.h> /* for pid_t */ -#include <semaphore.h> /* for sem_t, and sem_* functions */ - -typedef struct -{ - PRBool isMultiProcess; - union { - PRLock* sslLock; - sem_t sem; - } u; -} sslMutex; - -typedef pid_t sslPID; - -#else - -/* what platform is this ?? */ - -typedef struct { - PRBool isMultiProcess; - union { - PRLock* sslLock; - /* include cross-process locking mechanism here */ - } u; -} sslMutex; - -typedef int sslPID; - -#endif - -#include "seccomon.h" - -SEC_BEGIN_PROTOS - -extern SECStatus sslMutex_Init(sslMutex *sem, int shared); - -extern SECStatus sslMutex_Destroy(sslMutex *sem); - -extern SECStatus sslMutex_Unlock(sslMutex *sem); - -extern SECStatus sslMutex_Lock(sslMutex *sem); - -#ifdef WINNT - -extern SECStatus sslMutex_2LevelInit(sslMutex *sem); - -#endif - -SEC_END_PROTOS - -#endif diff --git a/security/nss/lib/ssl/sslnonce.c b/security/nss/lib/ssl/sslnonce.c deleted file mode 100644 index 8c097f8d4..000000000 --- a/security/nss/lib/ssl/sslnonce.c +++ /dev/null @@ -1,530 +0,0 @@ -/* - * This file implements the CLIENT Session ID cache. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "pk11pub.h" -#include "secitem.h" -#include "ssl.h" -#include "nss.h" - -#include "sslimpl.h" -#include "sslproto.h" -#include "nssilock.h" -#if (defined(XP_UNIX) || defined(XP_WIN) || defined(_WINDOWS) || defined(XP_BEOS)) && !defined(_WIN32_WCE) -#include <time.h> -#endif - -PRUint32 ssl_sid_timeout = 100; -PRUint32 ssl3_sid_timeout = 86400L; /* 24 hours */ - -static sslSessionID *cache = NULL; -static PZLock * cacheLock = NULL; - -/* sids can be in one of 4 states: - * - * never_cached, created, but not yet put into cache. - * in_client_cache, in the client cache's linked list. - * in_server_cache, entry came from the server's cache file. - * invalid_cache has been removed from the cache. - */ - -#define LOCK_CACHE lock_cache() -#define UNLOCK_CACHE PZ_Unlock(cacheLock) - -static SECStatus -ssl_InitClientSessionCacheLock(void) -{ - cacheLock = PZ_NewLock(nssILockCache); - return cacheLock ? SECSuccess : SECFailure; -} - -static SECStatus -ssl_FreeClientSessionCacheLock(void) -{ - if (cacheLock) { - PZ_DestroyLock(cacheLock); - cacheLock = NULL; - return SECSuccess; - } - PORT_SetError(SEC_ERROR_NOT_INITIALIZED); - return SECFailure; -} - -static PRBool LocksInitializedEarly = PR_FALSE; - -static SECStatus -FreeSessionCacheLocks() -{ - SECStatus rv1, rv2; - rv1 = ssl_FreeSymWrapKeysLock(); - rv2 = ssl_FreeClientSessionCacheLock(); - if ( (SECSuccess == rv1) && (SECSuccess == rv2) ) { - return SECSuccess; - } - return SECFailure; -} - -static SECStatus -InitSessionCacheLocks(void) -{ - SECStatus rv1, rv2; - PRErrorCode rc; - rv1 = ssl_InitSymWrapKeysLock(); - rv2 = ssl_InitClientSessionCacheLock(); - if ( (SECSuccess == rv1) && (SECSuccess == rv2) ) { - return SECSuccess; - } - rc = PORT_GetError(); - FreeSessionCacheLocks(); - PORT_SetError(rc); - return SECFailure; -} - -/* free the session cache locks if they were initialized early */ -SECStatus -ssl_FreeSessionCacheLocks() -{ - PORT_Assert(PR_TRUE == LocksInitializedEarly); - if (!LocksInitializedEarly) { - PORT_SetError(SEC_ERROR_NOT_INITIALIZED); - return SECFailure; - } - FreeSessionCacheLocks(); - LocksInitializedEarly = PR_FALSE; - return SECSuccess; -} - -static PRCallOnceType lockOnce; - -/* free the session cache locks if they were initialized lazily */ -static SECStatus ssl_ShutdownLocks(void* appData, void* nssData) -{ - PORT_Assert(PR_FALSE == LocksInitializedEarly); - if (LocksInitializedEarly) { - PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); - return SECFailure; - } - FreeSessionCacheLocks(); - memset(&lockOnce, 0, sizeof(lockOnce)); - return SECSuccess; -} - -static PRStatus initSessionCacheLocksLazily(void) -{ - SECStatus rv = InitSessionCacheLocks(); - if (SECSuccess != rv) { - return PR_FAILURE; - } - rv = NSS_RegisterShutdown(ssl_ShutdownLocks, NULL); - PORT_Assert(SECSuccess == rv); - if (SECSuccess != rv) { - return PR_FAILURE; - } - return PR_SUCCESS; -} - -/* lazyInit means that the call is not happening during a 1-time - * initialization function, but rather during dynamic, lazy initialization - */ -SECStatus -ssl_InitSessionCacheLocks(PRBool lazyInit) -{ - if (LocksInitializedEarly) { - return SECSuccess; - } - - if (lazyInit) { - return (PR_SUCCESS == - PR_CallOnce(&lockOnce, initSessionCacheLocksLazily)) ? - SECSuccess : SECFailure; - } - - if (SECSuccess == InitSessionCacheLocks()) { - LocksInitializedEarly = PR_TRUE; - return SECSuccess; - } - - return SECFailure; -} - -static void -lock_cache(void) -{ - ssl_InitSessionCacheLocks(PR_TRUE); - PZ_Lock(cacheLock); -} - -/* BEWARE: This function gets called for both client and server SIDs !! - * If the unreferenced sid is not in the cache, Free sid and its contents. - */ -static void -ssl_DestroySID(sslSessionID *sid) -{ - SSL_TRC(8, ("SSL: destroy sid: sid=0x%x cached=%d", sid, sid->cached)); - PORT_Assert((sid->references == 0)); - - if (sid->cached == in_client_cache) - return; /* it will get taken care of next time cache is traversed. */ - - if (sid->version < SSL_LIBRARY_VERSION_3_0) { - SECITEM_ZfreeItem(&sid->u.ssl2.masterKey, PR_FALSE); - SECITEM_ZfreeItem(&sid->u.ssl2.cipherArg, PR_FALSE); - } - if (sid->peerID != NULL) - PORT_Free((void *)sid->peerID); /* CONST */ - - if (sid->urlSvrName != NULL) - PORT_Free((void *)sid->urlSvrName); /* CONST */ - - if ( sid->peerCert ) { - CERT_DestroyCertificate(sid->peerCert); - } - if ( sid->localCert ) { - CERT_DestroyCertificate(sid->localCert); - } - if (sid->u.ssl3.sessionTicket.ticket.data) { - SECITEM_FreeItem(&sid->u.ssl3.sessionTicket.ticket, PR_FALSE); - } - - PORT_ZFree(sid, sizeof(sslSessionID)); -} - -/* BEWARE: This function gets called for both client and server SIDs !! - * Decrement reference count, and - * free sid if ref count is zero, and sid is not in the cache. - * Does NOT remove from the cache first. - * If the sid is still in the cache, it is left there until next time - * the cache list is traversed. - */ -static void -ssl_FreeLockedSID(sslSessionID *sid) -{ - PORT_Assert(sid->references >= 1); - if (--sid->references == 0) { - ssl_DestroySID(sid); - } -} - -/* BEWARE: This function gets called for both client and server SIDs !! - * Decrement reference count, and - * free sid if ref count is zero, and sid is not in the cache. - * Does NOT remove from the cache first. - * These locks are necessary because the sid _might_ be in the cache list. - */ -void -ssl_FreeSID(sslSessionID *sid) -{ - LOCK_CACHE; - ssl_FreeLockedSID(sid); - UNLOCK_CACHE; -} - -/************************************************************************/ - -/* -** Lookup sid entry in cache by Address, port, and peerID string. -** If found, Increment reference count, and return pointer to caller. -** If it has timed out or ref count is zero, remove from list and free it. -*/ - -sslSessionID * -ssl_LookupSID(const PRIPv6Addr *addr, PRUint16 port, const char *peerID, - const char * urlSvrName) -{ - sslSessionID **sidp; - sslSessionID * sid; - PRUint32 now; - - if (!urlSvrName) - return NULL; - now = ssl_Time(); - LOCK_CACHE; - sidp = &cache; - while ((sid = *sidp) != 0) { - PORT_Assert(sid->cached == in_client_cache); - PORT_Assert(sid->references >= 1); - - SSL_TRC(8, ("SSL: Lookup1: sid=0x%x", sid)); - - if (sid->expirationTime < now || !sid->references) { - /* - ** This session-id timed out, or was orphaned. - ** Don't even care who it belongs to, blow it out of our cache. - */ - SSL_TRC(7, ("SSL: lookup1, throwing sid out, age=%d refs=%d", - now - sid->creationTime, sid->references)); - - *sidp = sid->next; /* delink it from the list. */ - sid->cached = invalid_cache; /* mark not on list. */ - if (!sid->references) - ssl_DestroySID(sid); - else - ssl_FreeLockedSID(sid); /* drop ref count, free. */ - - } else if (!memcmp(&sid->addr, addr, sizeof(PRIPv6Addr)) && /* server IP addr matches */ - (sid->port == port) && /* server port matches */ - /* proxy (peerID) matches */ - (((peerID == NULL) && (sid->peerID == NULL)) || - ((peerID != NULL) && (sid->peerID != NULL) && - PORT_Strcmp(sid->peerID, peerID) == 0)) && - /* is cacheable */ - (sid->version < SSL_LIBRARY_VERSION_3_0 || - sid->u.ssl3.keys.resumable) && - /* server hostname matches. */ - (sid->urlSvrName != NULL) && - ((0 == PORT_Strcmp(urlSvrName, sid->urlSvrName)) || - ((sid->peerCert != NULL) && (SECSuccess == - CERT_VerifyCertName(sid->peerCert, urlSvrName))) ) - ) { - /* Hit */ - sid->lastAccessTime = now; - sid->references++; - break; - } else { - sidp = &sid->next; - } - } - UNLOCK_CACHE; - return sid; -} - -/* -** Add an sid to the cache or return a previously cached entry to the cache. -** Although this is static, it is called via ss->sec.cache(). -*/ -static void -CacheSID(sslSessionID *sid) -{ - PRUint32 expirationPeriod; - SSL_TRC(8, ("SSL: Cache: sid=0x%x cached=%d addr=0x%08x%08x%08x%08x port=0x%04x " - "time=%x cached=%d", - sid, sid->cached, sid->addr.pr_s6_addr32[0], - sid->addr.pr_s6_addr32[1], sid->addr.pr_s6_addr32[2], - sid->addr.pr_s6_addr32[3], sid->port, sid->creationTime, - sid->cached)); - - if (sid->cached == in_client_cache) - return; - - if (!sid->urlSvrName) { - /* don't cache this SID because it can never be matched */ - return; - } - - /* XXX should be different trace for version 2 vs. version 3 */ - if (sid->version < SSL_LIBRARY_VERSION_3_0) { - expirationPeriod = ssl_sid_timeout; - PRINT_BUF(8, (0, "sessionID:", - sid->u.ssl2.sessionID, sizeof(sid->u.ssl2.sessionID))); - PRINT_BUF(8, (0, "masterKey:", - sid->u.ssl2.masterKey.data, sid->u.ssl2.masterKey.len)); - PRINT_BUF(8, (0, "cipherArg:", - sid->u.ssl2.cipherArg.data, sid->u.ssl2.cipherArg.len)); - } else { - if (sid->u.ssl3.sessionIDLength == 0 && - sid->u.ssl3.sessionTicket.ticket.data == NULL) - return; - /* Client generates the SessionID if this was a stateless resume. */ - if (sid->u.ssl3.sessionIDLength == 0) { - SECStatus rv; - rv = PK11_GenerateRandom(sid->u.ssl3.sessionID, - SSL3_SESSIONID_BYTES); - if (rv != SECSuccess) - return; - sid->u.ssl3.sessionIDLength = SSL3_SESSIONID_BYTES; - } - expirationPeriod = ssl3_sid_timeout; - PRINT_BUF(8, (0, "sessionID:", - sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength)); - } - PORT_Assert(sid->creationTime != 0 && sid->expirationTime != 0); - if (!sid->creationTime) - sid->lastAccessTime = sid->creationTime = ssl_Time(); - if (!sid->expirationTime) - sid->expirationTime = sid->creationTime + expirationPeriod; - - /* - * Put sid into the cache. Bump reference count to indicate that - * cache is holding a reference. Uncache will reduce the cache - * reference. - */ - LOCK_CACHE; - sid->references++; - sid->cached = in_client_cache; - sid->next = cache; - cache = sid; - UNLOCK_CACHE; -} - -/* - * If sid "zap" is in the cache, - * removes sid from cache, and decrements reference count. - * Caller must hold cache lock. - */ -static void -UncacheSID(sslSessionID *zap) -{ - sslSessionID **sidp = &cache; - sslSessionID *sid; - - if (zap->cached != in_client_cache) { - return; - } - - SSL_TRC(8,("SSL: Uncache: zap=0x%x cached=%d addr=0x%08x%08x%08x%08x port=0x%04x " - "time=%x cipher=%d", - zap, zap->cached, zap->addr.pr_s6_addr32[0], - zap->addr.pr_s6_addr32[1], zap->addr.pr_s6_addr32[2], - zap->addr.pr_s6_addr32[3], zap->port, zap->creationTime, - zap->u.ssl2.cipherType)); - if (zap->version < SSL_LIBRARY_VERSION_3_0) { - PRINT_BUF(8, (0, "sessionID:", - zap->u.ssl2.sessionID, sizeof(zap->u.ssl2.sessionID))); - PRINT_BUF(8, (0, "masterKey:", - zap->u.ssl2.masterKey.data, zap->u.ssl2.masterKey.len)); - PRINT_BUF(8, (0, "cipherArg:", - zap->u.ssl2.cipherArg.data, zap->u.ssl2.cipherArg.len)); - } - - /* See if it's in the cache, if so nuke it */ - while ((sid = *sidp) != 0) { - if (sid == zap) { - /* - ** Bingo. Reduce reference count by one so that when - ** everyone is done with the sid we can free it up. - */ - *sidp = zap->next; - zap->cached = invalid_cache; - ssl_FreeLockedSID(zap); - return; - } - sidp = &sid->next; - } -} - -/* If sid "zap" is in the cache, - * removes sid from cache, and decrements reference count. - * Although this function is static, it is called externally via - * ss->sec.uncache(). - */ -static void -LockAndUncacheSID(sslSessionID *zap) -{ - LOCK_CACHE; - UncacheSID(zap); - UNLOCK_CACHE; - -} - -/* choose client or server cache functions for this sslsocket. */ -void -ssl_ChooseSessionIDProcs(sslSecurityInfo *sec) -{ - if (sec->isServer) { - sec->cache = ssl_sid_cache; - sec->uncache = ssl_sid_uncache; - } else { - sec->cache = CacheSID; - sec->uncache = LockAndUncacheSID; - } -} - -/* wipe out the entire client session cache. */ -void -SSL_ClearSessionCache(void) -{ - LOCK_CACHE; - while(cache != NULL) - UncacheSID(cache); - UNLOCK_CACHE; -} - -/* returns an unsigned int containing the number of seconds in PR_Now() */ -PRUint32 -ssl_Time(void) -{ - PRUint32 myTime; -#if (defined(XP_UNIX) || defined(XP_WIN) || defined(_WINDOWS) || defined(XP_BEOS)) && !defined(_WIN32_WCE) - myTime = time(NULL); /* accurate until the year 2038. */ -#else - /* portable, but possibly slower */ - PRTime now; - PRInt64 ll; - - now = PR_Now(); - LL_I2L(ll, 1000000L); - LL_DIV(now, now, ll); - LL_L2UI(myTime, now); -#endif - return myTime; -} - -SECStatus -ssl3_SetSIDSessionTicket(sslSessionID *sid, NewSessionTicket *session_ticket) -{ - SECStatus rv; - - /* We need to lock the cache, as this sid might already be in the cache. */ - LOCK_CACHE; - - /* A server might have sent us an empty ticket, which has the - * effect of clearing the previously known ticket. - */ - if (sid->u.ssl3.sessionTicket.ticket.data) - SECITEM_FreeItem(&sid->u.ssl3.sessionTicket.ticket, PR_FALSE); - if (session_ticket->ticket.len > 0) { - rv = SECITEM_CopyItem(NULL, &sid->u.ssl3.sessionTicket.ticket, - &session_ticket->ticket); - if (rv != SECSuccess) { - UNLOCK_CACHE; - return rv; - } - } else { - sid->u.ssl3.sessionTicket.ticket.data = NULL; - sid->u.ssl3.sessionTicket.ticket.len = 0; - } - sid->u.ssl3.sessionTicket.received_timestamp = - session_ticket->received_timestamp; - sid->u.ssl3.sessionTicket.ticket_lifetime_hint = - session_ticket->ticket_lifetime_hint; - - UNLOCK_CACHE; - return SECSuccess; -} diff --git a/security/nss/lib/ssl/sslproto.h b/security/nss/lib/ssl/sslproto.h deleted file mode 100644 index 74dead8fa..000000000 --- a/security/nss/lib/ssl/sslproto.h +++ /dev/null @@ -1,222 +0,0 @@ -/* - * Various and sundry protocol constants. DON'T CHANGE THESE. These values - * are mostly defined by the SSL2, SSL3, or TLS protocol specifications. - * Cipher kinds and ciphersuites are part of the public API. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#ifndef __sslproto_h_ -#define __sslproto_h_ - -/* All versions less than 3_0 are treated as SSL version 2 */ -#define SSL_LIBRARY_VERSION_2 0x0002 -#define SSL_LIBRARY_VERSION_3_0 0x0300 -#define SSL_LIBRARY_VERSION_3_1_TLS 0x0301 - -/* Header lengths of some of the messages */ -#define SSL_HL_ERROR_HBYTES 3 -#define SSL_HL_CLIENT_HELLO_HBYTES 9 -#define SSL_HL_CLIENT_MASTER_KEY_HBYTES 10 -#define SSL_HL_CLIENT_FINISHED_HBYTES 1 -#define SSL_HL_SERVER_HELLO_HBYTES 11 -#define SSL_HL_SERVER_VERIFY_HBYTES 1 -#define SSL_HL_SERVER_FINISHED_HBYTES 1 -#define SSL_HL_REQUEST_CERTIFICATE_HBYTES 2 -#define SSL_HL_CLIENT_CERTIFICATE_HBYTES 6 - -/* Security handshake protocol codes */ -#define SSL_MT_ERROR 0 -#define SSL_MT_CLIENT_HELLO 1 -#define SSL_MT_CLIENT_MASTER_KEY 2 -#define SSL_MT_CLIENT_FINISHED 3 -#define SSL_MT_SERVER_HELLO 4 -#define SSL_MT_SERVER_VERIFY 5 -#define SSL_MT_SERVER_FINISHED 6 -#define SSL_MT_REQUEST_CERTIFICATE 7 -#define SSL_MT_CLIENT_CERTIFICATE 8 - -/* Certificate types */ -#define SSL_CT_X509_CERTIFICATE 0x01 -#if 0 /* XXX Not implemented yet */ -#define SSL_PKCS6_CERTIFICATE 0x02 -#endif -#define SSL_AT_MD5_WITH_RSA_ENCRYPTION 0x01 - -/* Error codes */ -#define SSL_PE_NO_CYPHERS 0x0001 -#define SSL_PE_NO_CERTIFICATE 0x0002 -#define SSL_PE_BAD_CERTIFICATE 0x0004 -#define SSL_PE_UNSUPPORTED_CERTIFICATE_TYPE 0x0006 - -/* Cypher kinds (not the spec version!) */ -#define SSL_CK_RC4_128_WITH_MD5 0x01 -#define SSL_CK_RC4_128_EXPORT40_WITH_MD5 0x02 -#define SSL_CK_RC2_128_CBC_WITH_MD5 0x03 -#define SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 0x04 -#define SSL_CK_IDEA_128_CBC_WITH_MD5 0x05 -#define SSL_CK_DES_64_CBC_WITH_MD5 0x06 -#define SSL_CK_DES_192_EDE3_CBC_WITH_MD5 0x07 - -/* Cipher enables. These are used only for SSL_EnableCipher - * These values define the SSL2 suites, and do not colide with the - * SSL3 Cipher suites defined below. - */ -#define SSL_EN_RC4_128_WITH_MD5 0xFF01 -#define SSL_EN_RC4_128_EXPORT40_WITH_MD5 0xFF02 -#define SSL_EN_RC2_128_CBC_WITH_MD5 0xFF03 -#define SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5 0xFF04 -#define SSL_EN_IDEA_128_CBC_WITH_MD5 0xFF05 -#define SSL_EN_DES_64_CBC_WITH_MD5 0xFF06 -#define SSL_EN_DES_192_EDE3_CBC_WITH_MD5 0xFF07 - -/* SSL v3 Cipher Suites */ -#define SSL_NULL_WITH_NULL_NULL 0x0000 - -#define SSL_RSA_WITH_NULL_MD5 0x0001 -#define SSL_RSA_WITH_NULL_SHA 0x0002 -#define SSL_RSA_EXPORT_WITH_RC4_40_MD5 0x0003 -#define SSL_RSA_WITH_RC4_128_MD5 0x0004 -#define SSL_RSA_WITH_RC4_128_SHA 0x0005 -#define SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 0x0006 -#define SSL_RSA_WITH_IDEA_CBC_SHA 0x0007 -#define SSL_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0008 -#define SSL_RSA_WITH_DES_CBC_SHA 0x0009 -#define SSL_RSA_WITH_3DES_EDE_CBC_SHA 0x000a - -#define SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA 0x000b -#define SSL_DH_DSS_WITH_DES_CBC_SHA 0x000c -#define SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA 0x000d -#define SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA 0x000e -#define SSL_DH_RSA_WITH_DES_CBC_SHA 0x000f -#define SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA 0x0010 - -#define SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA 0x0011 -#define SSL_DHE_DSS_WITH_DES_CBC_SHA 0x0012 -#define SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA 0x0013 -#define SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0014 -#define SSL_DHE_RSA_WITH_DES_CBC_SHA 0x0015 -#define SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x0016 - -#define SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5 0x0017 -#define SSL_DH_ANON_WITH_RC4_128_MD5 0x0018 -#define SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA 0x0019 -#define SSL_DH_ANON_WITH_DES_CBC_SHA 0x001a -#define SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA 0x001b - -#define SSL_FORTEZZA_DMS_WITH_NULL_SHA 0x001c /* deprecated */ -#define SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA 0x001d /* deprecated */ -#define SSL_FORTEZZA_DMS_WITH_RC4_128_SHA 0x001e /* deprecated */ - -/* New TLS cipher suites */ -#define TLS_RSA_WITH_AES_128_CBC_SHA 0x002F -#define TLS_DH_DSS_WITH_AES_128_CBC_SHA 0x0030 -#define TLS_DH_RSA_WITH_AES_128_CBC_SHA 0x0031 -#define TLS_DHE_DSS_WITH_AES_128_CBC_SHA 0x0032 -#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x0033 -#define TLS_DH_ANON_WITH_AES_128_CBC_SHA 0x0034 - -#define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035 -#define TLS_DH_DSS_WITH_AES_256_CBC_SHA 0x0036 -#define TLS_DH_RSA_WITH_AES_256_CBC_SHA 0x0037 -#define TLS_DHE_DSS_WITH_AES_256_CBC_SHA 0x0038 -#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x0039 -#define TLS_DH_ANON_WITH_AES_256_CBC_SHA 0x003A - -#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0041 -#define TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x0042 -#define TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0043 -#define TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x0044 -#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0045 -#define TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA 0x0046 - -#define TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x0062 -#define TLS_RSA_EXPORT1024_WITH_RC4_56_SHA 0x0064 - -#define TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x0063 -#define TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x0065 -#define TLS_DHE_DSS_WITH_RC4_128_SHA 0x0066 - -#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0084 -#define TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x0085 -#define TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0086 -#define TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x0087 -#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0088 -#define TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA 0x0089 - -#define TLS_RSA_WITH_SEED_CBC_SHA 0x0096 - -#define TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 -#define TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 -#define TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 -#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 -#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 - -#define TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 -#define TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 -#define TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 -#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 -#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A - -#define TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B -#define TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C -#define TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D -#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E -#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F - -#define TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 -#define TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 -#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 -#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 -#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 - -#define TLS_ECDH_anon_WITH_NULL_SHA 0xC015 -#define TLS_ECDH_anon_WITH_RC4_128_SHA 0xC016 -#define TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA 0xC017 -#define TLS_ECDH_anon_WITH_AES_128_CBC_SHA 0xC018 -#define TLS_ECDH_anon_WITH_AES_256_CBC_SHA 0xC019 - -/* Netscape "experimental" cipher suites. */ -#define SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA 0xffe0 -#define SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA 0xffe1 - -/* New non-experimental openly spec'ed versions of those cipher suites. */ -#define SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA 0xfeff -#define SSL_RSA_FIPS_WITH_DES_CBC_SHA 0xfefe - -#endif /* __sslproto_h_ */ diff --git a/security/nss/lib/ssl/sslreveal.c b/security/nss/lib/ssl/sslreveal.c deleted file mode 100644 index 09d20d496..000000000 --- a/security/nss/lib/ssl/sslreveal.c +++ /dev/null @@ -1,100 +0,0 @@ -/* - * Accessor functions for SSLSocket private members. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "cert.h" -#include "ssl.h" -#include "certt.h" -#include "sslimpl.h" - -/* given PRFileDesc, returns a copy of certificate associated with the socket - * the caller should delete the cert when done with SSL_DestroyCertificate - */ -CERTCertificate * -SSL_RevealCert(PRFileDesc * fd) -{ - CERTCertificate * cert = NULL; - sslSocket * sslsocket = NULL; - - sslsocket = ssl_FindSocket(fd); - - /* CERT_DupCertificate increases reference count and returns pointer to - * the same cert - */ - if (sslsocket && sslsocket->sec.peerCert) - cert = CERT_DupCertificate(sslsocket->sec.peerCert); - - return cert; -} - -/* given PRFileDesc, returns a pointer to PinArg associated with the socket - */ -void * -SSL_RevealPinArg(PRFileDesc * fd) -{ - sslSocket * sslsocket = NULL; - void * PinArg = NULL; - - sslsocket = ssl_FindSocket(fd); - - /* is pkcs11PinArg part of the sslSocket or sslSecurityInfo ? */ - if (sslsocket) - PinArg = sslsocket->pkcs11PinArg; - - return PinArg; -} - - -/* given PRFileDesc, returns a pointer to the URL associated with the socket - * the caller should free url when done - */ -char * -SSL_RevealURL(PRFileDesc * fd) -{ - sslSocket * sslsocket = NULL; - char * url = NULL; - - sslsocket = ssl_FindSocket(fd); - - if (sslsocket && sslsocket->url) - url = PL_strdup(sslsocket->url); - - return url; -} - diff --git a/security/nss/lib/ssl/sslsecur.c b/security/nss/lib/ssl/sslsecur.c deleted file mode 100644 index c2bbadbc2..000000000 --- a/security/nss/lib/ssl/sslsecur.c +++ /dev/null @@ -1,1442 +0,0 @@ -/* - * Various SSL functions. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#include "cert.h" -#include "secitem.h" -#include "keyhi.h" -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" -#include "secoid.h" /* for SECOID_GetALgorithmTag */ -#include "pk11func.h" /* for PK11_GenerateRandom */ -#include "nss.h" /* for NSS_RegisterShutdown */ -#include "prinit.h" /* for PR_CallOnceWithArg */ - -#define MAX_BLOCK_CYPHER_SIZE 32 - -#define TEST_FOR_FAILURE /* reminder */ -#define SET_ERROR_CODE /* reminder */ - -/* Returns a SECStatus: SECSuccess or SECFailure, NOT SECWouldBlock. - * - * Currently, the list of functions called through ss->handshake is: - * - * In sslsocks.c: - * SocksGatherRecord - * SocksHandleReply - * SocksStartGather - * - * In sslcon.c: - * ssl_GatherRecord1stHandshake - * ssl2_HandleClientSessionKeyMessage - * ssl2_HandleMessage - * ssl2_HandleVerifyMessage - * ssl2_BeginClientHandshake - * ssl2_BeginServerHandshake - * ssl2_HandleClientHelloMessage - * ssl2_HandleServerHelloMessage - * - * The ss->handshake function returns SECWouldBlock under these conditions: - * 1. ssl_GatherRecord1stHandshake called ssl2_GatherData which read in - * the beginning of an SSL v3 hello message and returned SECWouldBlock - * to switch to SSL v3 handshake processing. - * - * 2. ssl2_HandleClientHelloMessage discovered version 3.0 in the incoming - * v2 client hello msg, and called ssl3_HandleV2ClientHello which - * returned SECWouldBlock. - * - * 3. SECWouldBlock was returned by one of the callback functions, via - * one of these paths: - * - ssl2_HandleMessage() -> ssl2_HandleRequestCertificate() -> ss->getClientAuthData() - * - * - ssl2_HandleServerHelloMessage() -> ss->handleBadCert() - * - * - ssl_GatherRecord1stHandshake() -> ssl3_GatherCompleteHandshake() -> - * ssl3_HandleRecord() -> ssl3_HandleHandshake() -> - * ssl3_HandleHandshakeMessage() -> ssl3_HandleCertificate() -> - * ss->handleBadCert() - * - * - ssl_GatherRecord1stHandshake() -> ssl3_GatherCompleteHandshake() -> - * ssl3_HandleRecord() -> ssl3_HandleHandshake() -> - * ssl3_HandleHandshakeMessage() -> ssl3_HandleCertificateRequest() -> - * ss->getClientAuthData() - * - * Called from: SSL_ForceHandshake (below), - * ssl_SecureRecv (below) and - * ssl_SecureSend (below) - * from: WaitForResponse in sslsocks.c - * ssl_SocksRecv in sslsocks.c - * ssl_SocksSend in sslsocks.c - * - * Caller must hold the (write) handshakeLock. - */ -int -ssl_Do1stHandshake(sslSocket *ss) -{ - int rv = SECSuccess; - int loopCount = 0; - - do { - PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) ); - PORT_Assert(ss->opt.noLocks || !ssl_HaveRecvBufLock(ss)); - PORT_Assert(ss->opt.noLocks || !ssl_HaveXmitBufLock(ss)); - - if (ss->handshake == 0) { - /* Previous handshake finished. Switch to next one */ - ss->handshake = ss->nextHandshake; - ss->nextHandshake = 0; - } - if (ss->handshake == 0) { - /* Previous handshake finished. Switch to security handshake */ - ss->handshake = ss->securityHandshake; - ss->securityHandshake = 0; - } - if (ss->handshake == 0) { - ssl_GetRecvBufLock(ss); - ss->gs.recordLen = 0; - ssl_ReleaseRecvBufLock(ss); - - SSL_TRC(3, ("%d: SSL[%d]: handshake is completed", - SSL_GETPID(), ss->fd)); - /* call handshake callback for ssl v2 */ - /* for v3 this is done in ssl3_HandleFinished() */ - if ((ss->handshakeCallback != NULL) && /* has callback */ - (!ss->firstHsDone) && /* only first time */ - (ss->version < SSL_LIBRARY_VERSION_3_0)) { /* not ssl3 */ - ss->firstHsDone = PR_TRUE; - (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData); - } - ss->firstHsDone = PR_TRUE; - ss->gs.writeOffset = 0; - ss->gs.readOffset = 0; - break; - } - rv = (*ss->handshake)(ss); - ++loopCount; - /* This code must continue to loop on SECWouldBlock, - * or any positive value. See XXX_1 comments. - */ - } while (rv != SECFailure); /* was (rv >= 0); XXX_1 */ - - PORT_Assert(ss->opt.noLocks || !ssl_HaveRecvBufLock(ss)); - PORT_Assert(ss->opt.noLocks || !ssl_HaveXmitBufLock(ss)); - - if (rv == SECWouldBlock) { - PORT_SetError(PR_WOULD_BLOCK_ERROR); - rv = SECFailure; - } - return rv; -} - -/* - * Handshake function that blocks. Used to force a - * retry on a connection on the next read/write. - */ -static SECStatus -AlwaysBlock(sslSocket *ss) -{ - PORT_SetError(PR_WOULD_BLOCK_ERROR); /* perhaps redundant. */ - return SECWouldBlock; -} - -/* - * set the initial handshake state machine to block - */ -void -ssl_SetAlwaysBlock(sslSocket *ss) -{ - if (!ss->firstHsDone) { - ss->handshake = AlwaysBlock; - ss->nextHandshake = 0; - } -} - -static SECStatus -ssl_SetTimeout(PRFileDesc *fd, PRIntervalTime timeout) -{ - sslSocket *ss; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SetTimeout", SSL_GETPID(), fd)); - return SECFailure; - } - SSL_LOCK_READER(ss); - ss->rTimeout = timeout; - if (ss->opt.fdx) { - SSL_LOCK_WRITER(ss); - } - ss->wTimeout = timeout; - if (ss->opt.fdx) { - SSL_UNLOCK_WRITER(ss); - } - SSL_UNLOCK_READER(ss); - return SECSuccess; -} - -/* Acquires and releases HandshakeLock. -*/ -SECStatus -SSL_ResetHandshake(PRFileDesc *s, PRBool asServer) -{ - sslSocket *ss; - SECStatus status; - PRNetAddr addr; - - ss = ssl_FindSocket(s); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in ResetHandshake", SSL_GETPID(), s)); - return SECFailure; - } - - /* Don't waste my time */ - if (!ss->opt.useSecurity) - return SECSuccess; - - SSL_LOCK_READER(ss); - SSL_LOCK_WRITER(ss); - - /* Reset handshake state */ - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - ss->firstHsDone = PR_FALSE; - if ( asServer ) { - ss->handshake = ssl2_BeginServerHandshake; - ss->handshaking = sslHandshakingAsServer; - } else { - ss->handshake = ssl2_BeginClientHandshake; - ss->handshaking = sslHandshakingAsClient; - } - ss->nextHandshake = 0; - ss->securityHandshake = 0; - - ssl_GetRecvBufLock(ss); - status = ssl_InitGather(&ss->gs); - ssl_ReleaseRecvBufLock(ss); - - /* - ** Blow away old security state and get a fresh setup. - */ - ssl_GetXmitBufLock(ss); - ssl_ResetSecurityInfo(&ss->sec, PR_TRUE); - status = ssl_CreateSecurityInfo(ss); - ssl_ReleaseXmitBufLock(ss); - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - - if (!ss->TCPconnected) - ss->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ss, &addr)); - - SSL_UNLOCK_WRITER(ss); - SSL_UNLOCK_READER(ss); - - return status; -} - -/* For SSLv2, does nothing but return an error. -** For SSLv3, flushes SID cache entry (if requested), -** and then starts new client hello or hello request. -** Acquires and releases HandshakeLock. -*/ -SECStatus -SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache) -{ - sslSocket *ss; - SECStatus rv; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in RedoHandshake", SSL_GETPID(), fd)); - return SECFailure; - } - - if (!ss->opt.useSecurity) - return SECSuccess; - - ssl_Get1stHandshakeLock(ss); - - /* SSL v2 protocol does not support subsequent handshakes. */ - if (ss->version < SSL_LIBRARY_VERSION_3_0) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } else { - ssl_GetSSL3HandshakeLock(ss); - rv = ssl3_RedoHandshake(ss, flushCache); /* force full handshake. */ - ssl_ReleaseSSL3HandshakeLock(ss); - } - - ssl_Release1stHandshakeLock(ss); - - return rv; -} - -/* -** Same as above, but with an I/O timeout. - */ -SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, - PRBool flushCache, - PRIntervalTime timeout) -{ - if (SECSuccess != ssl_SetTimeout(fd, timeout)) { - return SECFailure; - } - return SSL_ReHandshake(fd, flushCache); -} - -SECStatus -SSL_RedoHandshake(PRFileDesc *fd) -{ - return SSL_ReHandshake(fd, PR_TRUE); -} - -/* Register an application callback to be called when SSL handshake completes. -** Acquires and releases HandshakeLock. -*/ -SECStatus -SSL_HandshakeCallback(PRFileDesc *fd, SSLHandshakeCallback cb, - void *client_data) -{ - sslSocket *ss; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in HandshakeCallback", - SSL_GETPID(), fd)); - return SECFailure; - } - - if (!ss->opt.useSecurity) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - ss->handshakeCallback = cb; - ss->handshakeCallbackData = client_data; - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - - return SECSuccess; -} - -/* Try to make progress on an SSL handshake by attempting to read the -** next handshake from the peer, and sending any responses. -** For non-blocking sockets, returns PR_ERROR_WOULD_BLOCK if it cannot -** read the next handshake from the underlying socket. -** For SSLv2, returns when handshake is complete or fatal error occurs. -** For SSLv3, returns when handshake is complete, or application data has -** arrived that must be taken by application before handshake can continue, -** or a fatal error occurs. -** Application should use handshake completion callback to tell which. -*/ -SECStatus -SSL_ForceHandshake(PRFileDesc *fd) -{ - sslSocket *ss; - SECStatus rv = SECFailure; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in ForceHandshake", - SSL_GETPID(), fd)); - return rv; - } - - /* Don't waste my time */ - if (!ss->opt.useSecurity) - return SECSuccess; - - ssl_Get1stHandshakeLock(ss); - - if (ss->version >= SSL_LIBRARY_VERSION_3_0) { - int gatherResult; - - ssl_GetRecvBufLock(ss); - gatherResult = ssl3_GatherCompleteHandshake(ss, 0); - ssl_ReleaseRecvBufLock(ss); - if (gatherResult > 0) { - rv = SECSuccess; - } else if (gatherResult == 0) { - PORT_SetError(PR_END_OF_FILE_ERROR); - } else if (gatherResult == SECWouldBlock) { - PORT_SetError(PR_WOULD_BLOCK_ERROR); - } - } else if (!ss->firstHsDone) { - rv = ssl_Do1stHandshake(ss); - } else { - /* tried to force handshake on an SSL 2 socket that has - ** already completed the handshake. */ - rv = SECSuccess; /* just pretend we did it. */ - } - - ssl_Release1stHandshakeLock(ss); - - return rv; -} - -/* - ** Same as above, but with an I/O timeout. - */ -SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, - PRIntervalTime timeout) -{ - if (SECSuccess != ssl_SetTimeout(fd, timeout)) { - return SECFailure; - } - return SSL_ForceHandshake(fd); -} - - -/************************************************************************/ - -/* -** Grow a buffer to hold newLen bytes of data. -** Called for both recv buffers and xmit buffers. -** Caller must hold xmitBufLock or recvBufLock, as appropriate. -*/ -SECStatus -sslBuffer_Grow(sslBuffer *b, unsigned int newLen) -{ - newLen = PR_MAX(newLen, MAX_FRAGMENT_LENGTH + 2048); - if (newLen > b->space) { - unsigned char *newBuf; - if (b->buf) { - newBuf = (unsigned char *) PORT_Realloc(b->buf, newLen); - } else { - newBuf = (unsigned char *) PORT_Alloc(newLen); - } - if (!newBuf) { - return SECFailure; - } - SSL_TRC(10, ("%d: SSL: grow buffer from %d to %d", - SSL_GETPID(), b->space, newLen)); - b->buf = newBuf; - b->space = newLen; - } - return SECSuccess; -} - -SECStatus -sslBuffer_Append(sslBuffer *b, const void * data, unsigned int len) -{ - unsigned int newLen = b->len + len; - SECStatus rv; - - rv = sslBuffer_Grow(b, newLen); - if (rv != SECSuccess) - return rv; - PORT_Memcpy(b->buf + b->len, data, len); - b->len += len; - return SECSuccess; -} - -/* -** Save away write data that is trying to be written before the security -** handshake has been completed. When the handshake is completed, we will -** flush this data out. -** Caller must hold xmitBufLock -*/ -SECStatus -ssl_SaveWriteData(sslSocket *ss, const void *data, unsigned int len) -{ - SECStatus rv; - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - rv = sslBuffer_Append(&ss->pendingBuf, data, len); - SSL_TRC(5, ("%d: SSL[%d]: saving %u bytes of data (%u total saved so far)", - SSL_GETPID(), ss->fd, len, ss->pendingBuf.len)); - return rv; -} - -/* -** Send saved write data. This will flush out data sent prior to a -** complete security handshake. Hopefully there won't be too much of it. -** Returns count of the bytes sent, NOT a SECStatus. -** Caller must hold xmitBufLock -*/ -int -ssl_SendSavedWriteData(sslSocket *ss) -{ - int rv = 0; - - PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) ); - if (ss->pendingBuf.len != 0) { - SSL_TRC(5, ("%d: SSL[%d]: sending %d bytes of saved data", - SSL_GETPID(), ss->fd, ss->pendingBuf.len)); - rv = ssl_DefSend(ss, ss->pendingBuf.buf, ss->pendingBuf.len, 0); - if (rv < 0) { - return rv; - } - ss->pendingBuf.len -= rv; - if (ss->pendingBuf.len > 0 && rv > 0) { - /* UGH !! This shifts the whole buffer down by copying it */ - PORT_Memmove(ss->pendingBuf.buf, ss->pendingBuf.buf + rv, - ss->pendingBuf.len); - } - } - return rv; -} - -/************************************************************************/ - -/* -** Receive some application data on a socket. Reads SSL records from the input -** stream, decrypts them and then copies them to the output buffer. -** Called from ssl_SecureRecv() below. -** -** Caller does NOT hold 1stHandshakeLock because that handshake is over. -** Caller doesn't call this until initial handshake is complete. -** For SSLv2, there is no subsequent handshake. -** For SSLv3, the call to ssl3_GatherAppDataRecord may encounter handshake -** messages from a subsequent handshake. -** -** This code is similar to, and easily confused with, -** ssl_GatherRecord1stHandshake() in sslcon.c -*/ -static int -DoRecv(sslSocket *ss, unsigned char *out, int len, int flags) -{ - int rv; - int amount; - int available; - - ssl_GetRecvBufLock(ss); - - available = ss->gs.writeOffset - ss->gs.readOffset; - if (available == 0) { - /* Get some more data */ - if (ss->version >= SSL_LIBRARY_VERSION_3_0) { - /* Wait for application data to arrive. */ - rv = ssl3_GatherAppDataRecord(ss, 0); - } else { - /* See if we have a complete record */ - rv = ssl2_GatherRecord(ss, 0); - } - if (rv <= 0) { - if (rv == 0) { - /* EOF */ - SSL_TRC(10, ("%d: SSL[%d]: ssl_recv EOF", - SSL_GETPID(), ss->fd)); - goto done; - } - if ((rv != SECWouldBlock) && - (PR_GetError() != PR_WOULD_BLOCK_ERROR)) { - /* Some random error */ - goto done; - } - - /* - ** Gather record is blocked waiting for more record data to - ** arrive. Try to process what we have already received - */ - } else { - /* Gather record has finished getting a complete record */ - } - - /* See if any clear data is now available */ - available = ss->gs.writeOffset - ss->gs.readOffset; - if (available == 0) { - /* - ** No partial data is available. Force error code to - ** EWOULDBLOCK so that caller will try again later. Note - ** that the error code is probably EWOULDBLOCK already, - ** but if it isn't (for example, if we received a zero - ** length record) then this will force it to be correct. - */ - PORT_SetError(PR_WOULD_BLOCK_ERROR); - rv = SECFailure; - goto done; - } - SSL_TRC(30, ("%d: SSL[%d]: partial data ready, available=%d", - SSL_GETPID(), ss->fd, available)); - } - - /* Dole out clear data to reader */ - amount = PR_MIN(len, available); - PORT_Memcpy(out, ss->gs.buf.buf + ss->gs.readOffset, amount); - if (!(flags & PR_MSG_PEEK)) { - ss->gs.readOffset += amount; - } - rv = amount; - - SSL_TRC(30, ("%d: SSL[%d]: amount=%d available=%d", - SSL_GETPID(), ss->fd, amount, available)); - PRINT_BUF(4, (ss, "DoRecv receiving plaintext:", out, amount)); - -done: - ssl_ReleaseRecvBufLock(ss); - return rv; -} - -/************************************************************************/ - -SSLKEAType -ssl_FindCertKEAType(CERTCertificate * cert) -{ - SSLKEAType keaType = kt_null; - int tag; - - if (!cert) goto loser; - - tag = SECOID_GetAlgorithmTag(&(cert->subjectPublicKeyInfo.algorithm)); - - switch (tag) { - case SEC_OID_X500_RSA_ENCRYPTION: - case SEC_OID_PKCS1_RSA_ENCRYPTION: - keaType = kt_rsa; - break; - - case SEC_OID_X942_DIFFIE_HELMAN_KEY: - keaType = kt_dh; - break; -#ifdef NSS_ENABLE_ECC - case SEC_OID_ANSIX962_EC_PUBLIC_KEY: - keaType = kt_ecdh; - break; -#endif /* NSS_ENABLE_ECC */ - default: - keaType = kt_null; - } - - loser: - - return keaType; - -} - -static const PRCallOnceType pristineCallOnce; -static PRCallOnceType setupServerCAListOnce; - -static SECStatus serverCAListShutdown(void* appData, void* nssData) -{ - PORT_Assert(ssl3_server_ca_list); - if (ssl3_server_ca_list) { - CERT_FreeDistNames(ssl3_server_ca_list); - ssl3_server_ca_list = NULL; - } - setupServerCAListOnce = pristineCallOnce; - return SECSuccess; -} - -static PRStatus serverCAListSetup(void *arg) -{ - CERTCertDBHandle *dbHandle = (CERTCertDBHandle *)arg; - SECStatus rv = NSS_RegisterShutdown(serverCAListShutdown, NULL); - PORT_Assert(SECSuccess == rv); - if (SECSuccess == rv) { - ssl3_server_ca_list = CERT_GetSSLCACerts(dbHandle); - return PR_SUCCESS; - } - return PR_FAILURE; -} - - -/* XXX need to protect the data that gets changed here.!! */ - -SECStatus -SSL_ConfigSecureServer(PRFileDesc *fd, CERTCertificate *cert, - SECKEYPrivateKey *key, SSL3KEAType kea) -{ - SECStatus rv; - sslSocket *ss; - sslServerCerts *sc; - SECKEYPublicKey * pubKey = NULL; - - ss = ssl_FindSocket(fd); - if (!ss) { - return SECFailure; - } - - /* Both key and cert must have a value or be NULL */ - /* Passing a value of NULL will turn off key exchange algorithms that were - * previously turned on */ - if (!cert != !key) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - - /* make sure the key exchange is recognized */ - if ((kea >= kt_kea_size) || (kea < kt_null)) { - PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); - return SECFailure; - } - - if (kea != ssl_FindCertKEAType(cert)) { - PORT_SetError(SSL_ERROR_CERT_KEA_MISMATCH); - return SECFailure; - } - - sc = ss->serverCerts + kea; - /* load the server certificate */ - if (sc->serverCert != NULL) { - CERT_DestroyCertificate(sc->serverCert); - sc->serverCert = NULL; - } - if (cert) { - sc->serverCert = CERT_DupCertificate(cert); - if (!sc->serverCert) - goto loser; - /* get the size of the cert's public key, and remember it */ - pubKey = CERT_ExtractPublicKey(cert); - if (!pubKey) - goto loser; - sc->serverKeyBits = SECKEY_PublicKeyStrengthInBits(pubKey); - } - - - /* load the server cert chain */ - if (sc->serverCertChain != NULL) { - CERT_DestroyCertificateList(sc->serverCertChain); - sc->serverCertChain = NULL; - } - if (cert) { - sc->serverCertChain = CERT_CertChainFromCert( - sc->serverCert, certUsageSSLServer, PR_TRUE); - if (sc->serverCertChain == NULL) - goto loser; - } - - /* load the private key */ - if (sc->serverKeyPair != NULL) { - ssl3_FreeKeyPair(sc->serverKeyPair); - sc->serverKeyPair = NULL; - } - if (key) { - SECKEYPrivateKey * keyCopy = NULL; - CK_MECHANISM_TYPE keyMech = CKM_INVALID_MECHANISM; - - if (key->pkcs11Slot) { - PK11SlotInfo * bestSlot; - bestSlot = PK11_ReferenceSlot(key->pkcs11Slot); - if (bestSlot) { - keyCopy = PK11_CopyTokenPrivKeyToSessionPrivKey(bestSlot, key); - PK11_FreeSlot(bestSlot); - } - } - if (keyCopy == NULL) - keyMech = PK11_MapSignKeyType(key->keyType); - if (keyMech != CKM_INVALID_MECHANISM) { - PK11SlotInfo * bestSlot; - /* XXX Maybe should be bestSlotMultiple? */ - bestSlot = PK11_GetBestSlot(keyMech, NULL /* wincx */); - if (bestSlot) { - keyCopy = PK11_CopyTokenPrivKeyToSessionPrivKey(bestSlot, key); - PK11_FreeSlot(bestSlot); - } - } - if (keyCopy == NULL) - keyCopy = SECKEY_CopyPrivateKey(key); - if (keyCopy == NULL) - goto loser; - SECKEY_CacheStaticFlags(keyCopy); - sc->serverKeyPair = ssl3_NewKeyPair(keyCopy, pubKey); - if (sc->serverKeyPair == NULL) { - SECKEY_DestroyPrivateKey(keyCopy); - goto loser; - } - pubKey = NULL; /* adopted by serverKeyPair */ - } - - if (kea == kt_rsa && cert && sc->serverKeyBits > 512) { - if (ss->opt.noStepDown) { - /* disable all export ciphersuites */ - } else { - rv = ssl3_CreateRSAStepDownKeys(ss); - if (rv != SECSuccess) { - return SECFailure; /* err set by ssl3_CreateRSAStepDownKeys */ - } - } - } - - /* Only do this once because it's global. */ - if (PR_SUCCESS == PR_CallOnceWithArg(&setupServerCAListOnce, - &serverCAListSetup, - (void *)(ss->dbHandle))) { - return SECSuccess; - } - -loser: - if (pubKey) { - SECKEY_DestroyPublicKey(pubKey); - pubKey = NULL; - } - if (sc->serverCert != NULL) { - CERT_DestroyCertificate(sc->serverCert); - sc->serverCert = NULL; - } - if (sc->serverCertChain != NULL) { - CERT_DestroyCertificateList(sc->serverCertChain); - sc->serverCertChain = NULL; - } - if (sc->serverKeyPair != NULL) { - ssl3_FreeKeyPair(sc->serverKeyPair); - sc->serverKeyPair = NULL; - } - return SECFailure; -} - -/************************************************************************/ - -SECStatus -ssl_CreateSecurityInfo(sslSocket *ss) -{ - SECStatus status; - - /* initialize sslv2 socket to send data in the clear. */ - ssl2_UseClearSendFunc(ss); - - ss->sec.blockSize = 1; - ss->sec.blockShift = 0; - - ssl_GetXmitBufLock(ss); - status = sslBuffer_Grow(&ss->sec.writeBuf, 4096); - ssl_ReleaseXmitBufLock(ss); - - return status; -} - -SECStatus -ssl_CopySecurityInfo(sslSocket *ss, sslSocket *os) -{ - ss->sec.send = os->sec.send; - ss->sec.isServer = os->sec.isServer; - ss->sec.keyBits = os->sec.keyBits; - ss->sec.secretKeyBits = os->sec.secretKeyBits; - - ss->sec.peerCert = CERT_DupCertificate(os->sec.peerCert); - if (os->sec.peerCert && !ss->sec.peerCert) - goto loser; - - ss->sec.cache = os->sec.cache; - ss->sec.uncache = os->sec.uncache; - - /* we don't dup the connection info. */ - - ss->sec.sendSequence = os->sec.sendSequence; - ss->sec.rcvSequence = os->sec.rcvSequence; - - if (os->sec.hash && os->sec.hashcx) { - ss->sec.hash = os->sec.hash; - ss->sec.hashcx = os->sec.hash->clone(os->sec.hashcx); - if (os->sec.hashcx && !ss->sec.hashcx) - goto loser; - } else { - ss->sec.hash = NULL; - ss->sec.hashcx = NULL; - } - - SECITEM_CopyItem(0, &ss->sec.sendSecret, &os->sec.sendSecret); - if (os->sec.sendSecret.data && !ss->sec.sendSecret.data) - goto loser; - SECITEM_CopyItem(0, &ss->sec.rcvSecret, &os->sec.rcvSecret); - if (os->sec.rcvSecret.data && !ss->sec.rcvSecret.data) - goto loser; - - /* XXX following code is wrong if either cx != 0 */ - PORT_Assert(os->sec.readcx == 0); - PORT_Assert(os->sec.writecx == 0); - ss->sec.readcx = os->sec.readcx; - ss->sec.writecx = os->sec.writecx; - ss->sec.destroy = 0; - - ss->sec.enc = os->sec.enc; - ss->sec.dec = os->sec.dec; - - ss->sec.blockShift = os->sec.blockShift; - ss->sec.blockSize = os->sec.blockSize; - - return SECSuccess; - -loser: - return SECFailure; -} - -/* Reset sec back to its initial state. -** Caller holds any relevant locks. -*/ -void -ssl_ResetSecurityInfo(sslSecurityInfo *sec, PRBool doMemset) -{ - /* Destroy MAC */ - if (sec->hash && sec->hashcx) { - (*sec->hash->destroy)(sec->hashcx, PR_TRUE); - sec->hashcx = NULL; - sec->hash = NULL; - } - SECITEM_ZfreeItem(&sec->sendSecret, PR_FALSE); - SECITEM_ZfreeItem(&sec->rcvSecret, PR_FALSE); - - /* Destroy ciphers */ - if (sec->destroy) { - (*sec->destroy)(sec->readcx, PR_TRUE); - (*sec->destroy)(sec->writecx, PR_TRUE); - sec->readcx = NULL; - sec->writecx = NULL; - } else { - PORT_Assert(sec->readcx == 0); - PORT_Assert(sec->writecx == 0); - } - sec->readcx = 0; - sec->writecx = 0; - - if (sec->localCert) { - CERT_DestroyCertificate(sec->localCert); - sec->localCert = NULL; - } - if (sec->peerCert) { - CERT_DestroyCertificate(sec->peerCert); - sec->peerCert = NULL; - } - if (sec->peerKey) { - SECKEY_DestroyPublicKey(sec->peerKey); - sec->peerKey = NULL; - } - - /* cleanup the ci */ - if (sec->ci.sid != NULL) { - ssl_FreeSID(sec->ci.sid); - } - PORT_ZFree(sec->ci.sendBuf.buf, sec->ci.sendBuf.space); - if (doMemset) { - memset(&sec->ci, 0, sizeof sec->ci); - } - -} - -/* -** Called from SSL_ResetHandshake (above), and -** from ssl_FreeSocket in sslsock.c -** Caller should hold relevant locks (e.g. XmitBufLock) -*/ -void -ssl_DestroySecurityInfo(sslSecurityInfo *sec) -{ - ssl_ResetSecurityInfo(sec, PR_FALSE); - - PORT_ZFree(sec->writeBuf.buf, sec->writeBuf.space); - sec->writeBuf.buf = 0; - - memset(sec, 0, sizeof *sec); -} - -/************************************************************************/ - -int -ssl_SecureConnect(sslSocket *ss, const PRNetAddr *sa) -{ - PRFileDesc *osfd = ss->fd->lower; - int rv; - - if ( ss->opt.handshakeAsServer ) { - ss->securityHandshake = ssl2_BeginServerHandshake; - ss->handshaking = sslHandshakingAsServer; - } else { - ss->securityHandshake = ssl2_BeginClientHandshake; - ss->handshaking = sslHandshakingAsClient; - } - - /* connect to server */ - rv = osfd->methods->connect(osfd, sa, ss->cTimeout); - if (rv == PR_SUCCESS) { - ss->TCPconnected = 1; - } else { - int err = PR_GetError(); - SSL_DBG(("%d: SSL[%d]: connect failed, errno=%d", - SSL_GETPID(), ss->fd, err)); - if (err == PR_IS_CONNECTED_ERROR) { - ss->TCPconnected = 1; - } - } - - SSL_TRC(5, ("%d: SSL[%d]: secure connect completed, rv == %d", - SSL_GETPID(), ss->fd, rv)); - return rv; -} - -/* - * The TLS 1.2 RFC 5246, Section 7.2.1 says: - * - * Unless some other fatal alert has been transmitted, each party is - * required to send a close_notify alert before closing the write side - * of the connection. The other party MUST respond with a close_notify - * alert of its own and close down the connection immediately, - * discarding any pending writes. It is not required for the initiator - * of the close to wait for the responding close_notify alert before - * closing the read side of the connection. - * - * The second sentence requires that we send a close_notify alert when we - * have received a close_notify alert. In practice, all SSL implementations - * close the socket immediately after sending a close_notify alert (which is - * allowed by the third sentence), so responding with a close_notify alert - * would result in a write failure with the ECONNRESET error. This is why - * we don't respond with a close_notify alert. - * - * Also, in the unlikely event that the TCP pipe is full and the peer stops - * reading, the SSL3_SendAlert call in ssl_SecureClose and ssl_SecureShutdown - * may block indefinitely in blocking mode, and may fail (without retrying) - * in non-blocking mode. - */ - -int -ssl_SecureClose(sslSocket *ss) -{ - int rv; - - if (ss->version >= SSL_LIBRARY_VERSION_3_0 && - !(ss->shutdownHow & ssl_SHUTDOWN_SEND) && - ss->firstHsDone && - !ss->recvdCloseNotify && - ss->ssl3.initialized) { - - /* We don't want the final alert to be Nagle delayed. */ - if (!ss->delayDisabled) { - ssl_EnableNagleDelay(ss, PR_FALSE); - ss->delayDisabled = 1; - } - - (void) SSL3_SendAlert(ss, alert_warning, close_notify); - } - rv = ssl_DefClose(ss); - return rv; -} - -/* Caller handles all locking */ -int -ssl_SecureShutdown(sslSocket *ss, int nsprHow) -{ - PRFileDesc *osfd = ss->fd->lower; - int rv; - PRIntn sslHow = nsprHow + 1; - - if ((unsigned)nsprHow > PR_SHUTDOWN_BOTH) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return PR_FAILURE; - } - - if ((sslHow & ssl_SHUTDOWN_SEND) != 0 && - ss->version >= SSL_LIBRARY_VERSION_3_0 && - !(ss->shutdownHow & ssl_SHUTDOWN_SEND) && - ss->firstHsDone && - !ss->recvdCloseNotify && - ss->ssl3.initialized) { - - (void) SSL3_SendAlert(ss, alert_warning, close_notify); - } - - rv = osfd->methods->shutdown(osfd, nsprHow); - - ss->shutdownHow |= sslHow; - - return rv; -} - -/************************************************************************/ - - -int -ssl_SecureRecv(sslSocket *ss, unsigned char *buf, int len, int flags) -{ - sslSecurityInfo *sec; - int rv = 0; - - sec = &ss->sec; - - if (ss->shutdownHow & ssl_SHUTDOWN_RCV) { - PORT_SetError(PR_SOCKET_SHUTDOWN_ERROR); - return PR_FAILURE; - } - if (flags & ~PR_MSG_PEEK) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - return PR_FAILURE; - } - - if (!ssl_SocketIsBlocking(ss) && !ss->opt.fdx) { - ssl_GetXmitBufLock(ss); - if (ss->pendingBuf.len != 0) { - rv = ssl_SendSavedWriteData(ss); - if ((rv < 0) && (PORT_GetError() != PR_WOULD_BLOCK_ERROR)) { - ssl_ReleaseXmitBufLock(ss); - return SECFailure; - } - /* XXX short write? */ - } - ssl_ReleaseXmitBufLock(ss); - } - - rv = 0; - /* If any of these is non-zero, the initial handshake is not done. */ - if (!ss->firstHsDone) { - ssl_Get1stHandshakeLock(ss); - if (ss->handshake || ss->nextHandshake || ss->securityHandshake) { - rv = ssl_Do1stHandshake(ss); - } - ssl_Release1stHandshakeLock(ss); - } - if (rv < 0) { - return rv; - } - - if (len == 0) return 0; - - rv = DoRecv(ss, (unsigned char*) buf, len, flags); - SSL_TRC(2, ("%d: SSL[%d]: recving %d bytes securely (errno=%d)", - SSL_GETPID(), ss->fd, rv, PORT_GetError())); - return rv; -} - -int -ssl_SecureRead(sslSocket *ss, unsigned char *buf, int len) -{ - return ssl_SecureRecv(ss, buf, len, 0); -} - -/* Caller holds the SSL Socket's write lock. SSL_LOCK_WRITER(ss) */ -int -ssl_SecureSend(sslSocket *ss, const unsigned char *buf, int len, int flags) -{ - int rv = 0; - - SSL_TRC(2, ("%d: SSL[%d]: SecureSend: sending %d bytes", - SSL_GETPID(), ss->fd, len)); - - if (ss->shutdownHow & ssl_SHUTDOWN_SEND) { - PORT_SetError(PR_SOCKET_SHUTDOWN_ERROR); - rv = PR_FAILURE; - goto done; - } - if (flags) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - rv = PR_FAILURE; - goto done; - } - - ssl_GetXmitBufLock(ss); - if (ss->pendingBuf.len != 0) { - PORT_Assert(ss->pendingBuf.len > 0); - rv = ssl_SendSavedWriteData(ss); - if (rv >= 0 && ss->pendingBuf.len != 0) { - PORT_Assert(ss->pendingBuf.len > 0); - PORT_SetError(PR_WOULD_BLOCK_ERROR); - rv = SECFailure; - } - } - ssl_ReleaseXmitBufLock(ss); - if (rv < 0) { - goto done; - } - - if (len > 0) - ss->writerThread = PR_GetCurrentThread(); - /* If any of these is non-zero, the initial handshake is not done. */ - if (!ss->firstHsDone) { - ssl_Get1stHandshakeLock(ss); - if (ss->handshake || ss->nextHandshake || ss->securityHandshake) { - rv = ssl_Do1stHandshake(ss); - } - ssl_Release1stHandshakeLock(ss); - } - if (rv < 0) { - ss->writerThread = NULL; - goto done; - } - - /* Check for zero length writes after we do housekeeping so we make forward - * progress. - */ - if (len == 0) { - rv = 0; - goto done; - } - PORT_Assert(buf != NULL); - if (!buf) { - PORT_SetError(PR_INVALID_ARGUMENT_ERROR); - rv = PR_FAILURE; - goto done; - } - - /* Send out the data using one of these functions: - * ssl2_SendClear, ssl2_SendStream, ssl2_SendBlock, - * ssl3_SendApplicationData - */ - ssl_GetXmitBufLock(ss); - rv = (*ss->sec.send)(ss, buf, len, flags); - ssl_ReleaseXmitBufLock(ss); - ss->writerThread = NULL; -done: - if (rv < 0) { - SSL_TRC(2, ("%d: SSL[%d]: SecureSend: returning %d count, error %d", - SSL_GETPID(), ss->fd, rv, PORT_GetError())); - } else { - SSL_TRC(2, ("%d: SSL[%d]: SecureSend: returning %d count", - SSL_GETPID(), ss->fd, rv)); - } - return rv; -} - -int -ssl_SecureWrite(sslSocket *ss, const unsigned char *buf, int len) -{ - return ssl_SecureSend(ss, buf, len, 0); -} - -SECStatus -SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, void *arg) -{ - sslSocket *ss; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SSLBadCertHook", - SSL_GETPID(), fd)); - return SECFailure; - } - - ss->handleBadCert = f; - ss->badCertArg = arg; - - return SECSuccess; -} - -/* - * Allow the application to pass the url or hostname into the SSL library - * so that we can do some checking on it. - */ -SECStatus -SSL_SetURL(PRFileDesc *fd, const char *url) -{ - sslSocket * ss = ssl_FindSocket(fd); - SECStatus rv = SECSuccess; - - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SSLSetURL", - SSL_GETPID(), fd)); - return SECFailure; - } - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - if ( ss->url ) { - PORT_Free((void *)ss->url); /* CONST */ - } - - ss->url = (const char *)PORT_Strdup(url); - if ( ss->url == NULL ) { - rv = SECFailure; - } - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - - return rv; -} - -/* -** Returns Negative number on error, zero or greater on success. -** Returns the amount of data immediately available to be read. -*/ -int -SSL_DataPending(PRFileDesc *fd) -{ - sslSocket *ss; - int rv = 0; - - ss = ssl_FindSocket(fd); - - if (ss && ss->opt.useSecurity) { - - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - ssl_GetRecvBufLock(ss); - rv = ss->gs.writeOffset - ss->gs.readOffset; - ssl_ReleaseRecvBufLock(ss); - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - } - - return rv; -} - -SECStatus -SSL_InvalidateSession(PRFileDesc *fd) -{ - sslSocket * ss = ssl_FindSocket(fd); - SECStatus rv = SECFailure; - - if (ss) { - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - if (ss->sec.ci.sid) { - ss->sec.uncache(ss->sec.ci.sid); - rv = SECSuccess; - } - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - } - return rv; -} - -SECItem * -SSL_GetSessionID(PRFileDesc *fd) -{ - sslSocket * ss; - SECItem * item = NULL; - - ss = ssl_FindSocket(fd); - if (ss) { - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - if (ss->opt.useSecurity && ss->firstHsDone && ss->sec.ci.sid) { - item = (SECItem *)PORT_Alloc(sizeof(SECItem)); - if (item) { - sslSessionID * sid = ss->sec.ci.sid; - if (sid->version < SSL_LIBRARY_VERSION_3_0) { - item->len = SSL2_SESSIONID_BYTES; - item->data = (unsigned char*)PORT_Alloc(item->len); - PORT_Memcpy(item->data, sid->u.ssl2.sessionID, item->len); - } else { - item->len = sid->u.ssl3.sessionIDLength; - item->data = (unsigned char*)PORT_Alloc(item->len); - PORT_Memcpy(item->data, sid->u.ssl3.sessionID, item->len); - } - } - } - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - } - return item; -} - -SECStatus -SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle) -{ - sslSocket * ss; - - ss = ssl_FindSocket(fd); - if (!ss) - return SECFailure; - if (!dbHandle) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - ss->dbHandle = dbHandle; - return SECSuccess; -} - -/* - * attempt to restart the handshake after asynchronously handling - * a request for the client's certificate. - * - * inputs: - * cert Client cert chosen by application. - * Note: ssl takes this reference, and does not bump the - * reference count. The caller should drop its reference - * without calling CERT_DestroyCert after calling this function. - * - * key Private key associated with cert. This function makes a - * copy of the private key, so the caller remains responsible - * for destroying its copy after this function returns. - * - * certChain Chain of signers for cert. - * Note: ssl takes this reference, and does not copy the chain. - * The caller should drop its reference without destroying the - * chain. SSL will free the chain when it is done with it. - * - * Return value: XXX - * - * XXX This code only works on the initial handshake on a connection, XXX - * It does not work on a subsequent handshake (redo). - */ -int -SSL_RestartHandshakeAfterCertReq(sslSocket * ss, - CERTCertificate * cert, - SECKEYPrivateKey * key, - CERTCertificateList *certChain) -{ - int ret; - - ssl_Get1stHandshakeLock(ss); /************************************/ - - if (ss->version >= SSL_LIBRARY_VERSION_3_0) { - ret = ssl3_RestartHandshakeAfterCertReq(ss, cert, key, certChain); - } else { - ret = ssl2_RestartHandshakeAfterCertReq(ss, cert, key); - } - - ssl_Release1stHandshakeLock(ss); /************************************/ - return ret; -} - - -/* restart an SSL connection that we stopped to run certificate dialogs -** XXX Need to document here how an application marks a cert to show that -** the application has accepted it (overridden CERT_VerifyCert). - * - * XXX This code only works on the initial handshake on a connection, XXX - * It does not work on a subsequent handshake (redo). - * - * Return value: XXX -*/ -int -SSL_RestartHandshakeAfterServerCert(sslSocket *ss) -{ - int rv = SECSuccess; - - ssl_Get1stHandshakeLock(ss); - - if (ss->version >= SSL_LIBRARY_VERSION_3_0) { - rv = ssl3_RestartHandshakeAfterServerCert(ss); - } else { - rv = ssl2_RestartHandshakeAfterServerCert(ss); - } - - ssl_Release1stHandshakeLock(ss); - return rv; -} diff --git a/security/nss/lib/ssl/sslsnce.c b/security/nss/lib/ssl/sslsnce.c deleted file mode 100644 index eebc5ca01..000000000 --- a/security/nss/lib/ssl/sslsnce.c +++ /dev/null @@ -1,1952 +0,0 @@ -/* This file implements the SERVER Session ID cache. - * NOTE: The contents of this file are NOT used by the client. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -/* Note: ssl_FreeSID() in sslnonce.c gets used for both client and server - * cache sids! - * - * About record locking among different server processes: - * - * All processes that are part of the same conceptual server (serving on - * the same address and port) MUST share a common SSL session cache. - * This code makes the content of the shared cache accessible to all - * processes on the same "server". This code works on Unix and Win32 only. - * - * We use NSPR anonymous shared memory and move data to & from shared memory. - * We must do explicit locking of the records for all reads and writes. - * The set of Cache entries are divided up into "sets" of 128 entries. - * Each set is protected by a lock. There may be one or more sets protected - * by each lock. That is, locks to sets are 1:N. - * There is one lock for the entire cert cache. - * There is one lock for the set of wrapped sym wrap keys. - * - * The anonymous shared memory is laid out as if it were declared like this: - * - * struct { - * cacheDescriptor desc; - * sidCacheLock sidCacheLocks[ numSIDCacheLocks]; - * sidCacheLock keyCacheLock; - * sidCacheLock certCacheLock; - * sidCacheSet sidCacheSets[ numSIDCacheSets ]; - * sidCacheEntry sidCacheData[ numSIDCacheEntries]; - * certCacheEntry certCacheData[numCertCacheEntries]; - * SSLWrappedSymWrappingKey keyCacheData[kt_kea_size][SSL_NUM_WRAP_MECHS]; - * uint8 keyNameSuffix[SESS_TICKET_KEY_VAR_NAME_LEN] - * encKeyCacheEntry ticketEncKey; // Wrapped in non-bypass mode - * encKeyCacheEntry ticketMacKey; // Wrapped in non-bypass mode - * PRBool ticketKeysValid; - * } cacheMemCacheData; - */ -#include "seccomon.h" - -#if defined(XP_UNIX) || defined(XP_WIN32) || defined (XP_OS2) || defined(XP_BEOS) - -#include "cert.h" -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" -#include "pk11func.h" -#include "base64.h" -#include "keyhi.h" - -#include <stdio.h> - -#if defined(XP_UNIX) || defined(XP_BEOS) - -#include <syslog.h> -#include <fcntl.h> -#include <unistd.h> -#include <errno.h> -#include <signal.h> -#include "unix_err.h" - -#else - -#ifdef XP_WIN32 -#include <wtypes.h> -#include "win32err.h" -#endif - -#endif -#include <sys/types.h> - -#define SET_ERROR_CODE /* reminder */ - -#include "nspr.h" -#include "sslmutex.h" - -/* -** Format of a cache entry in the shared memory. -*/ -struct sidCacheEntryStr { -/* 16 */ PRIPv6Addr addr; /* client's IP address */ -/* 4 */ PRUint32 creationTime; -/* 4 */ PRUint32 lastAccessTime; -/* 4 */ PRUint32 expirationTime; -/* 2 */ PRUint16 version; -/* 1 */ PRUint8 valid; -/* 1 */ PRUint8 sessionIDLength; -/* 32 */ PRUint8 sessionID[SSL3_SESSIONID_BYTES]; -/* 2 */ PRUint16 authAlgorithm; -/* 2 */ PRUint16 authKeyBits; -/* 2 */ PRUint16 keaType; -/* 2 */ PRUint16 keaKeyBits; -/* 72 - common header total */ - - union { - struct { -/* 64 */ PRUint8 masterKey[SSL_MAX_MASTER_KEY_BYTES]; -/* 32 */ PRUint8 cipherArg[SSL_MAX_CYPHER_ARG_BYTES]; - -/* 1 */ PRUint8 cipherType; -/* 1 */ PRUint8 masterKeyLen; -/* 1 */ PRUint8 keyBits; -/* 1 */ PRUint8 secretKeyBits; -/* 1 */ PRUint8 cipherArgLen; -/*101 */} ssl2; - - struct { -/* 2 */ ssl3CipherSuite cipherSuite; -/* 2 */ PRUint16 compression; /* SSL3CompressionMethod */ - -/*100 */ ssl3SidKeys keys; /* keys and ivs, wrapped as needed. */ - -/* 4 */ PRUint32 masterWrapMech; -/* 4 */ SSL3KEAType exchKeyType; -/* 4 */ PRInt32 certIndex; -/*116 */} ssl3; -/* force sizeof(sidCacheEntry) to be a multiple of cache line size */ - struct { -/*120 */ PRUint8 filler[120]; /* 72+120==196, a multiple of 16 */ - } forceSize; - } u; -}; -typedef struct sidCacheEntryStr sidCacheEntry; - -/* The length of this struct is supposed to be a power of 2, e.g. 4KB */ -struct certCacheEntryStr { - PRUint16 certLength; /* 2 */ - PRUint16 sessionIDLength; /* 2 */ - PRUint8 sessionID[SSL3_SESSIONID_BYTES]; /* 32 */ - PRUint8 cert[SSL_MAX_CACHED_CERT_LEN]; /* 4060 */ -}; /* total 4096 */ -typedef struct certCacheEntryStr certCacheEntry; - -struct sidCacheLockStr { - PRUint32 timeStamp; - sslMutex mutex; - sslPID pid; -}; -typedef struct sidCacheLockStr sidCacheLock; - -struct sidCacheSetStr { - PRIntn next; -}; -typedef struct sidCacheSetStr sidCacheSet; - -struct encKeyCacheEntryStr { - PRUint8 bytes[512]; - PRInt32 length; -}; -typedef struct encKeyCacheEntryStr encKeyCacheEntry; - -struct cacheDescStr { - - PRUint32 cacheMemSize; - - PRUint32 numSIDCacheLocks; - PRUint32 numSIDCacheSets; - PRUint32 numSIDCacheSetsPerLock; - - PRUint32 numSIDCacheEntries; - PRUint32 sidCacheSize; - - PRUint32 numCertCacheEntries; - PRUint32 certCacheSize; - - PRUint32 numKeyCacheEntries; - PRUint32 keyCacheSize; - - PRUint32 ssl2Timeout; - PRUint32 ssl3Timeout; - - PRUint32 numSIDCacheLocksInitialized; - - /* These values are volatile, and are accessed through sharedCache-> */ - PRUint32 nextCertCacheEntry; /* certCacheLock protects */ - PRBool stopPolling; - PRBool everInherited; - - /* The private copies of these values are pointers into shared mem */ - /* The copies of these values in shared memory are merely offsets */ - sidCacheLock * sidCacheLocks; - sidCacheLock * keyCacheLock; - sidCacheLock * certCacheLock; - sidCacheSet * sidCacheSets; - sidCacheEntry * sidCacheData; - certCacheEntry * certCacheData; - SSLWrappedSymWrappingKey * keyCacheData; - uint8 * ticketKeyNameSuffix; - encKeyCacheEntry * ticketEncKey; - encKeyCacheEntry * ticketMacKey; - PRUint32 * ticketKeysValid; - - /* Only the private copies of these pointers are valid */ - char * cacheMem; - struct cacheDescStr * sharedCache; /* shared copy of this struct */ - PRFileMap * cacheMemMap; - PRThread * poller; - PRUint32 mutexTimeout; - PRBool shared; -}; -typedef struct cacheDescStr cacheDesc; - -static cacheDesc globalCache; - -static const char envVarName[] = { SSL_ENV_VAR_NAME }; - -static PRBool isMultiProcess = PR_FALSE; - - -#define DEF_SID_CACHE_ENTRIES 10000 -#define DEF_CERT_CACHE_ENTRIES 250 -#define MIN_CERT_CACHE_ENTRIES 125 /* the effective size in old releases. */ -#define DEF_KEY_CACHE_ENTRIES 250 - -#define SID_CACHE_ENTRIES_PER_SET 128 -#define SID_ALIGNMENT 16 - -#define DEF_SSL2_TIMEOUT 100 /* seconds */ -#define MAX_SSL2_TIMEOUT 100 /* seconds */ -#define MIN_SSL2_TIMEOUT 5 /* seconds */ - -#define DEF_SSL3_TIMEOUT 86400L /* 24 hours */ -#define MAX_SSL3_TIMEOUT 86400L /* 24 hours */ -#define MIN_SSL3_TIMEOUT 5 /* seconds */ - -#if defined(AIX) || defined(LINUX) || defined(VMS) || defined(NETBSD) || defined(OPENBSD) -#define MAX_SID_CACHE_LOCKS 8 /* two FDs per lock */ -#elif defined(OSF1) -#define MAX_SID_CACHE_LOCKS 16 /* one FD per lock */ -#else -#define MAX_SID_CACHE_LOCKS 256 -#endif - -#define SID_HOWMANY(val, size) (((val) + ((size) - 1)) / (size)) -#define SID_ROUNDUP(val, size) ((size) * SID_HOWMANY((val), (size))) - - -static sslPID myPid; -static PRUint32 ssl_max_sid_cache_locks = MAX_SID_CACHE_LOCKS; - -/* forward static function declarations */ -static PRUint32 SIDindex(cacheDesc *cache, const PRIPv6Addr *addr, PRUint8 *s, - unsigned nl); -static SECStatus LaunchLockPoller(cacheDesc *cache); -static SECStatus StopLockPoller(cacheDesc *cache); - - -struct inheritanceStr { - PRUint32 cacheMemSize; - PRUint32 fmStrLen; -}; - -typedef struct inheritanceStr inheritance; - -#if defined(_WIN32) || defined(XP_OS2) - -#define DEFAULT_CACHE_DIRECTORY "\\temp" - -#endif /* _win32 */ - -#if defined(XP_UNIX) || defined(XP_BEOS) - -#define DEFAULT_CACHE_DIRECTORY "/tmp" - -#endif /* XP_UNIX || XP_BEOS */ - - -/************************************************************************/ - -static PRUint32 -LockSidCacheLock(sidCacheLock *lock, PRUint32 now) -{ - SECStatus rv = sslMutex_Lock(&lock->mutex); - if (rv != SECSuccess) - return 0; - if (!now) - now = ssl_Time(); - lock->timeStamp = now; - lock->pid = myPid; - return now; -} - -static SECStatus -UnlockSidCacheLock(sidCacheLock *lock) -{ - SECStatus rv; - - lock->pid = 0; - rv = sslMutex_Unlock(&lock->mutex); - return rv; -} - -/* returns the value of ssl_Time on success, zero on failure. */ -static PRUint32 -LockSet(cacheDesc *cache, PRUint32 set, PRUint32 now) -{ - PRUint32 lockNum = set % cache->numSIDCacheLocks; - sidCacheLock * lock = cache->sidCacheLocks + lockNum; - - return LockSidCacheLock(lock, now); -} - -static SECStatus -UnlockSet(cacheDesc *cache, PRUint32 set) -{ - PRUint32 lockNum = set % cache->numSIDCacheLocks; - sidCacheLock * lock = cache->sidCacheLocks + lockNum; - - return UnlockSidCacheLock(lock); -} - -/************************************************************************/ - - -/* Put a certificate in the cache. Update the cert index in the sce. -*/ -static PRUint32 -CacheCert(cacheDesc * cache, CERTCertificate *cert, sidCacheEntry *sce) -{ - PRUint32 now; - certCacheEntry cce; - - if ((cert->derCert.len > SSL_MAX_CACHED_CERT_LEN) || - (cert->derCert.len <= 0) || - (cert->derCert.data == NULL)) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return 0; - } - - cce.sessionIDLength = sce->sessionIDLength; - PORT_Memcpy(cce.sessionID, sce->sessionID, cce.sessionIDLength); - - cce.certLength = cert->derCert.len; - PORT_Memcpy(cce.cert, cert->derCert.data, cce.certLength); - - /* get lock on cert cache */ - now = LockSidCacheLock(cache->certCacheLock, 0); - if (now) { - - /* Find where to place the next cert cache entry. */ - cacheDesc * sharedCache = cache->sharedCache; - PRUint32 ndx = sharedCache->nextCertCacheEntry; - - /* write the entry */ - cache->certCacheData[ndx] = cce; - - /* remember where we put it. */ - sce->u.ssl3.certIndex = ndx; - - /* update the "next" cache entry index */ - sharedCache->nextCertCacheEntry = - (ndx + 1) % cache->numCertCacheEntries; - - UnlockSidCacheLock(cache->certCacheLock); - } - return now; - -} - -/* -** Convert local SID to shared memory one -*/ -static void -ConvertFromSID(sidCacheEntry *to, sslSessionID *from) -{ - to->valid = 1; - to->version = from->version; - to->addr = from->addr; - to->creationTime = from->creationTime; - to->lastAccessTime = from->lastAccessTime; - to->expirationTime = from->expirationTime; - to->authAlgorithm = from->authAlgorithm; - to->authKeyBits = from->authKeyBits; - to->keaType = from->keaType; - to->keaKeyBits = from->keaKeyBits; - - if (from->version < SSL_LIBRARY_VERSION_3_0) { - if ((from->u.ssl2.masterKey.len > SSL_MAX_MASTER_KEY_BYTES) || - (from->u.ssl2.cipherArg.len > SSL_MAX_CYPHER_ARG_BYTES)) { - SSL_DBG(("%d: SSL: masterKeyLen=%d cipherArgLen=%d", - myPid, from->u.ssl2.masterKey.len, - from->u.ssl2.cipherArg.len)); - to->valid = 0; - return; - } - - to->u.ssl2.cipherType = from->u.ssl2.cipherType; - to->u.ssl2.masterKeyLen = from->u.ssl2.masterKey.len; - to->u.ssl2.cipherArgLen = from->u.ssl2.cipherArg.len; - to->u.ssl2.keyBits = from->u.ssl2.keyBits; - to->u.ssl2.secretKeyBits = from->u.ssl2.secretKeyBits; - to->sessionIDLength = SSL2_SESSIONID_BYTES; - PORT_Memcpy(to->sessionID, from->u.ssl2.sessionID, SSL2_SESSIONID_BYTES); - PORT_Memcpy(to->u.ssl2.masterKey, from->u.ssl2.masterKey.data, - from->u.ssl2.masterKey.len); - PORT_Memcpy(to->u.ssl2.cipherArg, from->u.ssl2.cipherArg.data, - from->u.ssl2.cipherArg.len); -#ifdef DEBUG - PORT_Memset(to->u.ssl2.masterKey+from->u.ssl2.masterKey.len, 0, - sizeof(to->u.ssl2.masterKey) - from->u.ssl2.masterKey.len); - PORT_Memset(to->u.ssl2.cipherArg+from->u.ssl2.cipherArg.len, 0, - sizeof(to->u.ssl2.cipherArg) - from->u.ssl2.cipherArg.len); -#endif - SSL_TRC(8, ("%d: SSL: ConvertSID: masterKeyLen=%d cipherArgLen=%d " - "time=%d addr=0x%08x%08x%08x%08x cipherType=%d", myPid, - to->u.ssl2.masterKeyLen, to->u.ssl2.cipherArgLen, - to->creationTime, to->addr.pr_s6_addr32[0], - to->addr.pr_s6_addr32[1], to->addr.pr_s6_addr32[2], - to->addr.pr_s6_addr32[3], to->u.ssl2.cipherType)); - } else { - /* This is an SSL v3 session */ - - to->u.ssl3.cipherSuite = from->u.ssl3.cipherSuite; - to->u.ssl3.compression = (uint16)from->u.ssl3.compression; - to->u.ssl3.keys = from->u.ssl3.keys; - to->u.ssl3.masterWrapMech = from->u.ssl3.masterWrapMech; - to->u.ssl3.exchKeyType = from->u.ssl3.exchKeyType; - to->sessionIDLength = from->u.ssl3.sessionIDLength; - to->u.ssl3.certIndex = -1; - - PORT_Memcpy(to->sessionID, from->u.ssl3.sessionID, - to->sessionIDLength); - - SSL_TRC(8, ("%d: SSL3: ConvertSID: time=%d addr=0x%08x%08x%08x%08x " - "cipherSuite=%d", - myPid, to->creationTime, to->addr.pr_s6_addr32[0], - to->addr.pr_s6_addr32[1], to->addr.pr_s6_addr32[2], - to->addr.pr_s6_addr32[3], to->u.ssl3.cipherSuite)); - } -} - -/* -** Convert shared memory cache-entry to local memory based one -** This is only called from ServerSessionIDLookup(). -** Caller must hold cache lock when calling this. -*/ -static sslSessionID * -ConvertToSID(sidCacheEntry *from, certCacheEntry *pcce, - CERTCertDBHandle * dbHandle) -{ - sslSessionID *to; - uint16 version = from->version; - - to = (sslSessionID*) PORT_ZAlloc(sizeof(sslSessionID)); - if (!to) { - return 0; - } - - if (version < SSL_LIBRARY_VERSION_3_0) { - /* This is an SSL v2 session */ - to->u.ssl2.masterKey.data = - (unsigned char*) PORT_Alloc(from->u.ssl2.masterKeyLen); - if (!to->u.ssl2.masterKey.data) { - goto loser; - } - if (from->u.ssl2.cipherArgLen) { - to->u.ssl2.cipherArg.data = - (unsigned char*)PORT_Alloc(from->u.ssl2.cipherArgLen); - if (!to->u.ssl2.cipherArg.data) { - goto loser; - } - PORT_Memcpy(to->u.ssl2.cipherArg.data, from->u.ssl2.cipherArg, - from->u.ssl2.cipherArgLen); - } - - to->u.ssl2.cipherType = from->u.ssl2.cipherType; - to->u.ssl2.masterKey.len = from->u.ssl2.masterKeyLen; - to->u.ssl2.cipherArg.len = from->u.ssl2.cipherArgLen; - to->u.ssl2.keyBits = from->u.ssl2.keyBits; - to->u.ssl2.secretKeyBits = from->u.ssl2.secretKeyBits; -/* to->sessionIDLength = SSL2_SESSIONID_BYTES; */ - PORT_Memcpy(to->u.ssl2.sessionID, from->sessionID, SSL2_SESSIONID_BYTES); - PORT_Memcpy(to->u.ssl2.masterKey.data, from->u.ssl2.masterKey, - from->u.ssl2.masterKeyLen); - - SSL_TRC(8, ("%d: SSL: ConvertToSID: masterKeyLen=%d cipherArgLen=%d " - "time=%d addr=0x%08x%08x%08x%08x cipherType=%d", - myPid, to->u.ssl2.masterKey.len, - to->u.ssl2.cipherArg.len, to->creationTime, - to->addr.pr_s6_addr32[0], to->addr.pr_s6_addr32[1], - to->addr.pr_s6_addr32[2], to->addr.pr_s6_addr32[3], - to->u.ssl2.cipherType)); - } else { - /* This is an SSL v3 session */ - - to->u.ssl3.sessionIDLength = from->sessionIDLength; - to->u.ssl3.cipherSuite = from->u.ssl3.cipherSuite; - to->u.ssl3.compression = (SSL3CompressionMethod)from->u.ssl3.compression; - to->u.ssl3.keys = from->u.ssl3.keys; - to->u.ssl3.masterWrapMech = from->u.ssl3.masterWrapMech; - to->u.ssl3.exchKeyType = from->u.ssl3.exchKeyType; - - PORT_Memcpy(to->u.ssl3.sessionID, from->sessionID, from->sessionIDLength); - - /* the portions of the SID that are only restored on the client - * are set to invalid values on the server. - */ - to->u.ssl3.clientWriteKey = NULL; - to->u.ssl3.serverWriteKey = NULL; - - to->urlSvrName = NULL; - - to->u.ssl3.masterModuleID = (SECMODModuleID)-1; /* invalid value */ - to->u.ssl3.masterSlotID = (CK_SLOT_ID)-1; /* invalid value */ - to->u.ssl3.masterWrapIndex = 0; - to->u.ssl3.masterWrapSeries = 0; - to->u.ssl3.masterValid = PR_FALSE; - - to->u.ssl3.clAuthModuleID = (SECMODModuleID)-1; /* invalid value */ - to->u.ssl3.clAuthSlotID = (CK_SLOT_ID)-1; /* invalid value */ - to->u.ssl3.clAuthSeries = 0; - to->u.ssl3.clAuthValid = PR_FALSE; - - if (from->u.ssl3.certIndex != -1 && pcce) { - SECItem derCert; - - derCert.len = pcce->certLength; - derCert.data = pcce->cert; - - to->peerCert = CERT_NewTempCertificate(dbHandle, &derCert, NULL, - PR_FALSE, PR_TRUE); - if (to->peerCert == NULL) - goto loser; - } - } - - to->version = from->version; - to->creationTime = from->creationTime; - to->lastAccessTime = from->lastAccessTime; - to->expirationTime = from->expirationTime; - to->cached = in_server_cache; - to->addr = from->addr; - to->references = 1; - to->authAlgorithm = from->authAlgorithm; - to->authKeyBits = from->authKeyBits; - to->keaType = from->keaType; - to->keaKeyBits = from->keaKeyBits; - - return to; - - loser: - if (to) { - if (version < SSL_LIBRARY_VERSION_3_0) { - if (to->u.ssl2.masterKey.data) - PORT_Free(to->u.ssl2.masterKey.data); - if (to->u.ssl2.cipherArg.data) - PORT_Free(to->u.ssl2.cipherArg.data); - } - PORT_Free(to); - } - return NULL; -} - - - -/* -** Perform some mumbo jumbo on the ip-address and the session-id value to -** compute a hash value. -*/ -static PRUint32 -SIDindex(cacheDesc *cache, const PRIPv6Addr *addr, PRUint8 *s, unsigned nl) -{ - PRUint32 rv; - PRUint32 x[8]; - - memset(x, 0, sizeof x); - if (nl > sizeof x) - nl = sizeof x; - memcpy(x, s, nl); - - rv = (addr->pr_s6_addr32[0] ^ addr->pr_s6_addr32[1] ^ - addr->pr_s6_addr32[2] ^ addr->pr_s6_addr32[3] ^ - x[0] ^ x[1] ^ x[2] ^ x[3] ^ x[4] ^ x[5] ^ x[6] ^ x[7]) - % cache->numSIDCacheSets; - return rv; -} - - - -/* -** Look something up in the cache. This will invalidate old entries -** in the process. Caller has locked the cache set! -** Returns PR_TRUE if found a valid match. PR_FALSE otherwise. -*/ -static sidCacheEntry * -FindSID(cacheDesc *cache, PRUint32 setNum, PRUint32 now, - const PRIPv6Addr *addr, unsigned char *sessionID, - unsigned sessionIDLength) -{ - PRUint32 ndx = cache->sidCacheSets[setNum].next; - int i; - - sidCacheEntry * set = cache->sidCacheData + - (setNum * SID_CACHE_ENTRIES_PER_SET); - - for (i = SID_CACHE_ENTRIES_PER_SET; i > 0; --i) { - sidCacheEntry * sce; - - ndx = (ndx - 1) % SID_CACHE_ENTRIES_PER_SET; - sce = set + ndx; - - if (!sce->valid) - continue; - - if (now > sce->expirationTime) { - /* SessionID has timed out. Invalidate the entry. */ - SSL_TRC(7, ("%d: timed out sid entry addr=%08x%08x%08x%08x now=%x " - "time+=%x", - myPid, sce->addr.pr_s6_addr32[0], - sce->addr.pr_s6_addr32[1], sce->addr.pr_s6_addr32[2], - sce->addr.pr_s6_addr32[3], now, - sce->expirationTime )); - sce->valid = 0; - continue; - } - - /* - ** Next, examine specific session-id/addr data to see if the cache - ** entry matches our addr+session-id value - */ - if (sessionIDLength == sce->sessionIDLength && - !memcmp(&sce->addr, addr, sizeof(PRIPv6Addr)) && - !memcmp(sce->sessionID, sessionID, sessionIDLength)) { - /* Found it */ - return sce; - } - } - - PORT_SetError(SSL_ERROR_SESSION_NOT_FOUND); - return NULL; -} - -/************************************************************************/ - -/* This is the primary function for finding entries in the server's sid cache. - * Although it is static, this function is called via the global function - * pointer ssl_sid_lookup. - */ -static sslSessionID * -ServerSessionIDLookup(const PRIPv6Addr *addr, - unsigned char *sessionID, - unsigned int sessionIDLength, - CERTCertDBHandle * dbHandle) -{ - sslSessionID * sid = 0; - sidCacheEntry * psce; - certCacheEntry *pcce = 0; - cacheDesc * cache = &globalCache; - PRUint32 now; - PRUint32 set; - PRInt32 cndx; - sidCacheEntry sce; - certCacheEntry cce; - - set = SIDindex(cache, addr, sessionID, sessionIDLength); - now = LockSet(cache, set, 0); - if (!now) - return NULL; - - psce = FindSID(cache, set, now, addr, sessionID, sessionIDLength); - if (psce) { - if (psce->version >= SSL_LIBRARY_VERSION_3_0 && - (cndx = psce->u.ssl3.certIndex) != -1) { - - PRUint32 gotLock = LockSidCacheLock(cache->certCacheLock, now); - if (gotLock) { - pcce = &cache->certCacheData[cndx]; - - /* See if the cert's session ID matches the sce cache. */ - if ((pcce->sessionIDLength == psce->sessionIDLength) && - !PORT_Memcmp(pcce->sessionID, psce->sessionID, - pcce->sessionIDLength)) { - cce = *pcce; - } else { - /* The cert doesen't match the SID cache entry, - ** so invalidate the SID cache entry. - */ - psce->valid = 0; - psce = 0; - pcce = 0; - } - UnlockSidCacheLock(cache->certCacheLock); - } else { - /* what the ??. Didn't get the cert cache lock. - ** Don't invalidate the SID cache entry, but don't find it. - */ - PORT_Assert(!("Didn't get cert Cache Lock!")); - psce = 0; - pcce = 0; - } - } - if (psce) { - psce->lastAccessTime = now; - sce = *psce; /* grab a copy while holding the lock */ - } - } - UnlockSet(cache, set); - if (psce) { - /* sce conains a copy of the cache entry. - ** Convert shared memory format to local format - */ - sid = ConvertToSID(&sce, pcce ? &cce : 0, dbHandle); - } - return sid; -} - -/* -** Place a sid into the cache, if it isn't already there. -*/ -static void -ServerSessionIDCache(sslSessionID *sid) -{ - sidCacheEntry sce; - PRUint32 now = 0; - uint16 version = sid->version; - cacheDesc * cache = &globalCache; - - if ((version >= SSL_LIBRARY_VERSION_3_0) && - (sid->u.ssl3.sessionIDLength == 0)) { - return; - } - - if (sid->cached == never_cached || sid->cached == invalid_cache) { - PRUint32 set; - - PORT_Assert(sid->creationTime != 0); - if (!sid->creationTime) - sid->lastAccessTime = sid->creationTime = ssl_Time(); - if (version < SSL_LIBRARY_VERSION_3_0) { - /* override caller's expiration time, which uses client timeout - * duration, not server timeout duration. - */ - sid->expirationTime = sid->creationTime + cache->ssl2Timeout; - SSL_TRC(8, ("%d: SSL: CacheMT: cached=%d addr=0x%08x%08x%08x%08x time=%x " - "cipher=%d", myPid, sid->cached, - sid->addr.pr_s6_addr32[0], sid->addr.pr_s6_addr32[1], - sid->addr.pr_s6_addr32[2], sid->addr.pr_s6_addr32[3], - sid->creationTime, sid->u.ssl2.cipherType)); - PRINT_BUF(8, (0, "sessionID:", sid->u.ssl2.sessionID, - SSL2_SESSIONID_BYTES)); - PRINT_BUF(8, (0, "masterKey:", sid->u.ssl2.masterKey.data, - sid->u.ssl2.masterKey.len)); - PRINT_BUF(8, (0, "cipherArg:", sid->u.ssl2.cipherArg.data, - sid->u.ssl2.cipherArg.len)); - - } else { - /* override caller's expiration time, which uses client timeout - * duration, not server timeout duration. - */ - sid->expirationTime = sid->creationTime + cache->ssl3Timeout; - SSL_TRC(8, ("%d: SSL: CacheMT: cached=%d addr=0x%08x%08x%08x%08x time=%x " - "cipherSuite=%d", myPid, sid->cached, - sid->addr.pr_s6_addr32[0], sid->addr.pr_s6_addr32[1], - sid->addr.pr_s6_addr32[2], sid->addr.pr_s6_addr32[3], - sid->creationTime, sid->u.ssl3.cipherSuite)); - PRINT_BUF(8, (0, "sessionID:", sid->u.ssl3.sessionID, - sid->u.ssl3.sessionIDLength)); - } - - ConvertFromSID(&sce, sid); - - if ((version >= SSL_LIBRARY_VERSION_3_0) && - (sid->peerCert != NULL)) { - now = CacheCert(cache, sid->peerCert, &sce); - } - - set = SIDindex(cache, &sce.addr, sce.sessionID, sce.sessionIDLength); - now = LockSet(cache, set, now); - if (now) { - PRUint32 next = cache->sidCacheSets[set].next; - PRUint32 ndx = set * SID_CACHE_ENTRIES_PER_SET + next; - - /* Write out new cache entry */ - cache->sidCacheData[ndx] = sce; - - cache->sidCacheSets[set].next = - (next + 1) % SID_CACHE_ENTRIES_PER_SET; - - UnlockSet(cache, set); - sid->cached = in_server_cache; - } - } -} - -/* -** Although this is static, it is called from ssl via global function pointer -** ssl_sid_uncache. This invalidates the referenced cache entry. -*/ -static void -ServerSessionIDUncache(sslSessionID *sid) -{ - cacheDesc * cache = &globalCache; - PRUint8 * sessionID; - unsigned int sessionIDLength; - PRErrorCode err; - PRUint32 set; - PRUint32 now; - sidCacheEntry *psce; - - if (sid == NULL) - return; - - /* Uncaching a SID should never change the error code. - ** So save it here and restore it before exiting. - */ - err = PR_GetError(); - - if (sid->version < SSL_LIBRARY_VERSION_3_0) { - sessionID = sid->u.ssl2.sessionID; - sessionIDLength = SSL2_SESSIONID_BYTES; - SSL_TRC(8, ("%d: SSL: UncacheMT: valid=%d addr=0x%08x%08x%08x%08x time=%x " - "cipher=%d", myPid, sid->cached, - sid->addr.pr_s6_addr32[0], sid->addr.pr_s6_addr32[1], - sid->addr.pr_s6_addr32[2], sid->addr.pr_s6_addr32[3], - sid->creationTime, sid->u.ssl2.cipherType)); - PRINT_BUF(8, (0, "sessionID:", sessionID, sessionIDLength)); - PRINT_BUF(8, (0, "masterKey:", sid->u.ssl2.masterKey.data, - sid->u.ssl2.masterKey.len)); - PRINT_BUF(8, (0, "cipherArg:", sid->u.ssl2.cipherArg.data, - sid->u.ssl2.cipherArg.len)); - } else { - sessionID = sid->u.ssl3.sessionID; - sessionIDLength = sid->u.ssl3.sessionIDLength; - SSL_TRC(8, ("%d: SSL3: UncacheMT: valid=%d addr=0x%08x%08x%08x%08x time=%x " - "cipherSuite=%d", myPid, sid->cached, - sid->addr.pr_s6_addr32[0], sid->addr.pr_s6_addr32[1], - sid->addr.pr_s6_addr32[2], sid->addr.pr_s6_addr32[3], - sid->creationTime, sid->u.ssl3.cipherSuite)); - PRINT_BUF(8, (0, "sessionID:", sessionID, sessionIDLength)); - } - set = SIDindex(cache, &sid->addr, sessionID, sessionIDLength); - now = LockSet(cache, set, 0); - if (now) { - psce = FindSID(cache, set, now, &sid->addr, sessionID, sessionIDLength); - if (psce) { - psce->valid = 0; - } - UnlockSet(cache, set); - } - sid->cached = invalid_cache; - PORT_SetError(err); -} - -#ifdef XP_OS2 - -#define INCL_DOSPROCESS -#include <os2.h> - -long gettid(void) -{ - PTIB ptib; - PPIB ppib; - DosGetInfoBlocks(&ptib, &ppib); - return ((long)ptib->tib_ordinal); /* thread id */ -} -#endif - -static void -CloseCache(cacheDesc *cache) -{ - int locks_initialized = cache->numSIDCacheLocksInitialized; - - if (cache->cacheMem) { - /* If everInherited is true, this shared cache was (and may still - ** be) in use by multiple processes. We do not wish to destroy - ** the mutexes while they are still in use. - */ - if (cache->sharedCache && - PR_FALSE == cache->sharedCache->everInherited) { - sidCacheLock *pLock = cache->sidCacheLocks; - for (; locks_initialized > 0; --locks_initialized, ++pLock ) { - sslMutex_Destroy(&pLock->mutex); - } - } - if (cache->shared) { - PR_MemUnmap(cache->cacheMem, cache->cacheMemSize); - } else { - PORT_Free(cache->cacheMem); - } - cache->cacheMem = NULL; - } - if (cache->cacheMemMap) { - PR_CloseFileMap(cache->cacheMemMap); - cache->cacheMemMap = NULL; - } - memset(cache, 0, sizeof *cache); -} - -static SECStatus -InitCache(cacheDesc *cache, int maxCacheEntries, PRUint32 ssl2_timeout, - PRUint32 ssl3_timeout, const char *directory, PRBool shared) -{ - ptrdiff_t ptr; - sidCacheLock *pLock; - char * cacheMem; - PRFileMap * cacheMemMap; - char * cfn = NULL; /* cache file name */ - int locks_initialized = 0; - int locks_to_initialize = 0; - PRUint32 init_time; - - if ( (!cache) || (maxCacheEntries < 0) || (!directory) ) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - - if (cache->cacheMem) { - /* Already done */ - return SECSuccess; - } - - /* make sure loser can clean up properly */ - cache->shared = shared; - cache->cacheMem = cacheMem = NULL; - cache->cacheMemMap = cacheMemMap = NULL; - cache->sharedCache = (cacheDesc *)0; - - cache->numSIDCacheLocksInitialized = 0; - cache->nextCertCacheEntry = 0; - cache->stopPolling = PR_FALSE; - cache->everInherited = PR_FALSE; - cache->poller = NULL; - cache->mutexTimeout = 0; - - cache->numSIDCacheEntries = maxCacheEntries ? maxCacheEntries - : DEF_SID_CACHE_ENTRIES; - cache->numSIDCacheSets = - SID_HOWMANY(cache->numSIDCacheEntries, SID_CACHE_ENTRIES_PER_SET); - - cache->numSIDCacheEntries = - cache->numSIDCacheSets * SID_CACHE_ENTRIES_PER_SET; - - cache->numSIDCacheLocks = - PR_MIN(cache->numSIDCacheSets, ssl_max_sid_cache_locks); - - cache->numSIDCacheSetsPerLock = - SID_HOWMANY(cache->numSIDCacheSets, cache->numSIDCacheLocks); - - /* compute size of shared memory, and offsets of all pointers */ - ptr = 0; - cache->cacheMem = (char *)ptr; - ptr += SID_ROUNDUP(sizeof(cacheDesc), SID_ALIGNMENT); - - cache->sidCacheLocks = (sidCacheLock *)ptr; - cache->keyCacheLock = cache->sidCacheLocks + cache->numSIDCacheLocks; - cache->certCacheLock = cache->keyCacheLock + 1; - ptr = (ptrdiff_t)(cache->certCacheLock + 1); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->sidCacheSets = (sidCacheSet *)ptr; - ptr = (ptrdiff_t)(cache->sidCacheSets + cache->numSIDCacheSets); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->sidCacheData = (sidCacheEntry *)ptr; - ptr = (ptrdiff_t)(cache->sidCacheData + cache->numSIDCacheEntries); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->certCacheData = (certCacheEntry *)ptr; - cache->sidCacheSize = - (char *)cache->certCacheData - (char *)cache->sidCacheData; - - /* This is really a poor way to computer this! */ - cache->numCertCacheEntries = cache->sidCacheSize / sizeof(certCacheEntry); - if (cache->numCertCacheEntries < MIN_CERT_CACHE_ENTRIES) - cache->numCertCacheEntries = MIN_CERT_CACHE_ENTRIES; - ptr = (ptrdiff_t)(cache->certCacheData + cache->numCertCacheEntries); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->keyCacheData = (SSLWrappedSymWrappingKey *)ptr; - cache->certCacheSize = - (char *)cache->keyCacheData - (char *)cache->certCacheData; - - cache->numKeyCacheEntries = kt_kea_size * SSL_NUM_WRAP_MECHS; - ptr = (ptrdiff_t)(cache->keyCacheData + cache->numKeyCacheEntries); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->keyCacheSize = (char *)ptr - (char *)cache->keyCacheData; - - cache->ticketKeyNameSuffix = (uint8 *)ptr; - ptr = (ptrdiff_t)(cache->ticketKeyNameSuffix + - SESS_TICKET_KEY_VAR_NAME_LEN); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->ticketEncKey = (encKeyCacheEntry *)ptr; - ptr = (ptrdiff_t)(cache->ticketEncKey + 1); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->ticketMacKey = (encKeyCacheEntry *)ptr; - ptr = (ptrdiff_t)(cache->ticketMacKey + 1); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->ticketKeysValid = (PRUint32 *)ptr; - ptr = (ptrdiff_t)(cache->ticketKeysValid + 1); - ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); - - cache->cacheMemSize = ptr; - - if (ssl2_timeout) { - if (ssl2_timeout > MAX_SSL2_TIMEOUT) { - ssl2_timeout = MAX_SSL2_TIMEOUT; - } - if (ssl2_timeout < MIN_SSL2_TIMEOUT) { - ssl2_timeout = MIN_SSL2_TIMEOUT; - } - cache->ssl2Timeout = ssl2_timeout; - } else { - cache->ssl2Timeout = DEF_SSL2_TIMEOUT; - } - - if (ssl3_timeout) { - if (ssl3_timeout > MAX_SSL3_TIMEOUT) { - ssl3_timeout = MAX_SSL3_TIMEOUT; - } - if (ssl3_timeout < MIN_SSL3_TIMEOUT) { - ssl3_timeout = MIN_SSL3_TIMEOUT; - } - cache->ssl3Timeout = ssl3_timeout; - } else { - cache->ssl3Timeout = DEF_SSL3_TIMEOUT; - } - - if (shared) { - /* Create file names */ -#if defined(XP_UNIX) || defined(XP_BEOS) - /* there's some confusion here about whether PR_OpenAnonFileMap wants - ** a directory name or a file name for its first argument. - cfn = PR_smprintf("%s/.sslsvrcache.%d", directory, myPid); - */ - cfn = PR_smprintf("%s", directory); -#elif defined(XP_WIN32) - cfn = PR_smprintf("%s/svrcache_%d_%x.ssl", directory, myPid, - GetCurrentThreadId()); -#elif defined(XP_OS2) - cfn = PR_smprintf("%s/svrcache_%d_%x.ssl", directory, myPid, - gettid()); -#else -#error "Don't know how to create file name for this platform!" -#endif - if (!cfn) { - goto loser; - } - - /* Create cache */ - cacheMemMap = PR_OpenAnonFileMap(cfn, cache->cacheMemSize, - PR_PROT_READWRITE); - - PR_smprintf_free(cfn); - if(!cacheMemMap) { - goto loser; - } - - cacheMem = PR_MemMap(cacheMemMap, 0, cache->cacheMemSize); - } else { - cacheMem = PORT_Alloc(cache->cacheMemSize); - } - - if (! cacheMem) { - goto loser; - } - - /* Initialize shared memory. This may not be necessary on all platforms */ - memset(cacheMem, 0, cache->cacheMemSize); - - /* Copy cache descriptor header into shared memory */ - memcpy(cacheMem, cache, sizeof *cache); - - /* save private copies of these values */ - cache->cacheMemMap = cacheMemMap; - cache->cacheMem = cacheMem; - cache->sharedCache = (cacheDesc *)cacheMem; - - /* Fix pointers in our private copy of cache descriptor to point to - ** spaces in shared memory - */ - ptr = (ptrdiff_t)cache->cacheMem; - *(ptrdiff_t *)(&cache->sidCacheLocks) += ptr; - *(ptrdiff_t *)(&cache->keyCacheLock ) += ptr; - *(ptrdiff_t *)(&cache->certCacheLock) += ptr; - *(ptrdiff_t *)(&cache->sidCacheSets ) += ptr; - *(ptrdiff_t *)(&cache->sidCacheData ) += ptr; - *(ptrdiff_t *)(&cache->certCacheData) += ptr; - *(ptrdiff_t *)(&cache->keyCacheData ) += ptr; - *(ptrdiff_t *)(&cache->ticketKeyNameSuffix) += ptr; - *(ptrdiff_t *)(&cache->ticketEncKey ) += ptr; - *(ptrdiff_t *)(&cache->ticketMacKey ) += ptr; - *(ptrdiff_t *)(&cache->ticketKeysValid) += ptr; - - /* initialize the locks */ - init_time = ssl_Time(); - pLock = cache->sidCacheLocks; - for (locks_to_initialize = cache->numSIDCacheLocks + 2; - locks_initialized < locks_to_initialize; - ++locks_initialized, ++pLock ) { - - SECStatus err = sslMutex_Init(&pLock->mutex, shared); - if (err) { - cache->numSIDCacheLocksInitialized = locks_initialized; - goto loser; - } - pLock->timeStamp = init_time; - pLock->pid = 0; - } - cache->numSIDCacheLocksInitialized = locks_initialized; - - return SECSuccess; - -loser: - CloseCache(cache); - return SECFailure; -} - -PRUint32 -SSL_GetMaxServerCacheLocks(void) -{ - return ssl_max_sid_cache_locks + 2; - /* The extra two are the cert cache lock and the key cache lock. */ -} - -SECStatus -SSL_SetMaxServerCacheLocks(PRUint32 maxLocks) -{ - /* Minimum is 1 sid cache lock, 1 cert cache lock and 1 key cache lock. - ** We'd like to test for a maximum value, but not all platforms' header - ** files provide a symbol or function or other means of determining - ** the maximum, other than trial and error. - */ - if (maxLocks < 3) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - ssl_max_sid_cache_locks = maxLocks - 2; - /* The extra two are the cert cache lock and the key cache lock. */ - return SECSuccess; -} - -SECStatus -SSL_ConfigServerSessionIDCacheInstance( cacheDesc *cache, - int maxCacheEntries, - PRUint32 ssl2_timeout, - PRUint32 ssl3_timeout, - const char * directory, PRBool shared) -{ - SECStatus rv; - - PORT_Assert(sizeof(sidCacheEntry) == 192); - PORT_Assert(sizeof(certCacheEntry) == 4096); - - myPid = SSL_GETPID(); - if (!directory) { - directory = DEFAULT_CACHE_DIRECTORY; - } - rv = InitCache(cache, maxCacheEntries, ssl2_timeout, ssl3_timeout, - directory, shared); - if (rv) { - SET_ERROR_CODE - return SECFailure; - } - - ssl_sid_lookup = ServerSessionIDLookup; - ssl_sid_cache = ServerSessionIDCache; - ssl_sid_uncache = ServerSessionIDUncache; - return SECSuccess; -} - -SECStatus -SSL_ConfigServerSessionIDCache( int maxCacheEntries, - PRUint32 ssl2_timeout, - PRUint32 ssl3_timeout, - const char * directory) -{ - ssl_InitSessionCacheLocks(PR_FALSE); - return SSL_ConfigServerSessionIDCacheInstance(&globalCache, - maxCacheEntries, ssl2_timeout, ssl3_timeout, directory, PR_FALSE); -} - -SECStatus -SSL_ShutdownServerSessionIDCacheInstance(cacheDesc *cache) -{ - CloseCache(cache); - return SECSuccess; -} - -SECStatus -SSL_ShutdownServerSessionIDCache(void) -{ -#if defined(XP_UNIX) || defined(XP_BEOS) - /* Stop the thread that polls cache for expired locks on Unix */ - StopLockPoller(&globalCache); -#endif - SSL3_ShutdownServerCache(); - return SSL_ShutdownServerSessionIDCacheInstance(&globalCache); -} - -/* Use this function, instead of SSL_ConfigServerSessionIDCache, - * if the cache will be shared by multiple processes. - */ -SECStatus -SSL_ConfigMPServerSIDCache( int maxCacheEntries, - PRUint32 ssl2_timeout, - PRUint32 ssl3_timeout, - const char * directory) -{ - char * envValue; - char * inhValue; - cacheDesc * cache = &globalCache; - PRUint32 fmStrLen; - SECStatus result; - PRStatus prStatus; - SECStatus putEnvFailed; - inheritance inherit; - char fmString[PR_FILEMAP_STRING_BUFSIZE]; - - isMultiProcess = PR_TRUE; - result = SSL_ConfigServerSessionIDCacheInstance(cache, maxCacheEntries, - ssl2_timeout, ssl3_timeout, directory, PR_TRUE); - if (result != SECSuccess) - return result; - - prStatus = PR_ExportFileMapAsString(cache->cacheMemMap, - sizeof fmString, fmString); - if ((prStatus != PR_SUCCESS) || !(fmStrLen = strlen(fmString))) { - SET_ERROR_CODE - return SECFailure; - } - - inherit.cacheMemSize = cache->cacheMemSize; - inherit.fmStrLen = fmStrLen; - - inhValue = BTOA_DataToAscii((unsigned char *)&inherit, sizeof inherit); - if (!inhValue || !strlen(inhValue)) { - SET_ERROR_CODE - return SECFailure; - } - envValue = PR_smprintf("%s,%s", inhValue, fmString); - if (!envValue || !strlen(envValue)) { - SET_ERROR_CODE - return SECFailure; - } - PORT_Free(inhValue); - - putEnvFailed = (SECStatus)NSS_PutEnv(envVarName, envValue); - PR_smprintf_free(envValue); - if (putEnvFailed) { - SET_ERROR_CODE - result = SECFailure; - } - -#if defined(XP_UNIX) || defined(XP_BEOS) - /* Launch thread to poll cache for expired locks on Unix */ - LaunchLockPoller(cache); -#endif - return result; -} - -SECStatus -SSL_InheritMPServerSIDCacheInstance(cacheDesc *cache, const char * envString) -{ - unsigned char * decoString = NULL; - char * fmString = NULL; - char * myEnvString = NULL; - unsigned int decoLen; - ptrdiff_t ptr; - inheritance inherit; - cacheDesc my; -#ifdef WINNT - sidCacheLock* newLocks; - int locks_initialized = 0; - int locks_to_initialize = 0; -#endif - - myPid = SSL_GETPID(); - - /* If this child was created by fork(), and not by exec() on unix, - ** then isMultiProcess will already be set. - ** If not, we'll set it below. - */ - if (isMultiProcess) { - if (cache && cache->sharedCache) { - cache->sharedCache->everInherited = PR_TRUE; - } - return SECSuccess; /* already done. */ - } - - ssl_InitSessionCacheLocks(PR_FALSE); - - ssl_sid_lookup = ServerSessionIDLookup; - ssl_sid_cache = ServerSessionIDCache; - ssl_sid_uncache = ServerSessionIDUncache; - - if (!envString) { - envString = getenv(envVarName); - if (!envString) { - SET_ERROR_CODE - return SECFailure; - } - } - myEnvString = PORT_Strdup(envString); - if (!myEnvString) - return SECFailure; - fmString = strchr(myEnvString, ','); - if (!fmString) - goto loser; - *fmString++ = 0; - - decoString = ATOB_AsciiToData(myEnvString, &decoLen); - if (!decoString) { - SET_ERROR_CODE - goto loser; - } - if (decoLen != sizeof inherit) { - SET_ERROR_CODE - goto loser; - } - - PORT_Memcpy(&inherit, decoString, sizeof inherit); - - if (strlen(fmString) != inherit.fmStrLen ) { - goto loser; - } - - memset(cache, 0, sizeof *cache); - cache->cacheMemSize = inherit.cacheMemSize; - - /* Create cache */ - cache->cacheMemMap = PR_ImportFileMapFromString(fmString); - if(! cache->cacheMemMap) { - goto loser; - } - cache->cacheMem = PR_MemMap(cache->cacheMemMap, 0, cache->cacheMemSize); - if (! cache->cacheMem) { - goto loser; - } - cache->sharedCache = (cacheDesc *)cache->cacheMem; - - if (cache->sharedCache->cacheMemSize != cache->cacheMemSize) { - SET_ERROR_CODE - goto loser; - } - - /* We're now going to overwrite the local cache instance with the - ** shared copy of the cache struct, then update several values in - ** the local cache using the values for cache->cacheMemMap and - ** cache->cacheMem computed just above. So, we copy cache into - ** the automatic variable "my", to preserve the variables while - ** cache is overwritten. - */ - my = *cache; /* save values computed above. */ - memcpy(cache, cache->sharedCache, sizeof *cache); /* overwrite */ - - /* Fix pointers in our private copy of cache descriptor to point to - ** spaces in shared memory, whose address is now in "my". - */ - ptr = (ptrdiff_t)my.cacheMem; - *(ptrdiff_t *)(&cache->sidCacheLocks) += ptr; - *(ptrdiff_t *)(&cache->keyCacheLock ) += ptr; - *(ptrdiff_t *)(&cache->certCacheLock) += ptr; - *(ptrdiff_t *)(&cache->sidCacheSets ) += ptr; - *(ptrdiff_t *)(&cache->sidCacheData ) += ptr; - *(ptrdiff_t *)(&cache->certCacheData) += ptr; - *(ptrdiff_t *)(&cache->keyCacheData ) += ptr; - *(ptrdiff_t *)(&cache->ticketKeyNameSuffix) += ptr; - *(ptrdiff_t *)(&cache->ticketEncKey ) += ptr; - *(ptrdiff_t *)(&cache->ticketMacKey ) += ptr; - *(ptrdiff_t *)(&cache->ticketKeysValid) += ptr; - - cache->cacheMemMap = my.cacheMemMap; - cache->cacheMem = my.cacheMem; - cache->sharedCache = (cacheDesc *)cache->cacheMem; - -#ifdef WINNT - /* On Windows NT we need to "fix" the sidCacheLocks here to support fibers - ** When NT fibers are used in a multi-process server, a second level of - ** locking is needed to prevent a deadlock, in case a fiber acquires the - ** cross-process mutex, yields, and another fiber is later scheduled on - ** the same native thread and tries to acquire the cross-process mutex. - ** We do this by using a PRLock in the sslMutex. However, it is stored in - ** shared memory as part of sidCacheLocks, and we don't want to overwrite - ** the PRLock of the parent process. So we need to make new, private - ** copies of sidCacheLocks before modifying the sslMutex with our own - ** PRLock - */ - - /* note from jpierre : this should be free'd in child processes when - ** a function is added to delete the SSL session cache in the future. - */ - locks_to_initialize = cache->numSIDCacheLocks + 2; - newLocks = PORT_NewArray(sidCacheLock, locks_to_initialize); - if (!newLocks) - goto loser; - /* copy the old locks */ - memcpy(newLocks, cache->sidCacheLocks, - locks_to_initialize * sizeof(sidCacheLock)); - cache->sidCacheLocks = newLocks; - /* fix the locks */ - for (; locks_initialized < locks_to_initialize; ++locks_initialized) { - /* now, make a local PRLock in this sslMutex for this child process */ - SECStatus err; - err = sslMutex_2LevelInit(&newLocks[locks_initialized].mutex); - if (err != SECSuccess) { - cache->numSIDCacheLocksInitialized = locks_initialized; - goto loser; - } - } - cache->numSIDCacheLocksInitialized = locks_initialized; - - /* also fix the key and cert cache which use the last 2 lock entries */ - cache->keyCacheLock = cache->sidCacheLocks + cache->numSIDCacheLocks; - cache->certCacheLock = cache->keyCacheLock + 1; -#endif - - PORT_Free(myEnvString); - PORT_Free(decoString); - - /* mark that we have inherited this. */ - cache->sharedCache->everInherited = PR_TRUE; - isMultiProcess = PR_TRUE; - - return SECSuccess; - -loser: - PORT_Free(myEnvString); - if (decoString) - PORT_Free(decoString); - CloseCache(cache); - return SECFailure; -} - -SECStatus -SSL_InheritMPServerSIDCache(const char * envString) -{ - return SSL_InheritMPServerSIDCacheInstance(&globalCache, envString); -} - -#if defined(XP_UNIX) || defined(XP_BEOS) - -#define SID_LOCK_EXPIRATION_TIMEOUT 30 /* seconds */ - -static void -LockPoller(void * arg) -{ - cacheDesc * cache = (cacheDesc *)arg; - cacheDesc * sharedCache = cache->sharedCache; - sidCacheLock * pLock; - PRIntervalTime timeout; - PRUint32 now; - PRUint32 then; - int locks_polled = 0; - int locks_to_poll = cache->numSIDCacheLocks + 2; - PRUint32 expiration = cache->mutexTimeout; - - timeout = PR_SecondsToInterval(expiration); - while(!sharedCache->stopPolling) { - PR_Sleep(timeout); - if (sharedCache->stopPolling) - break; - - now = ssl_Time(); - then = now - expiration; - for (pLock = cache->sidCacheLocks, locks_polled = 0; - locks_to_poll > locks_polled && !sharedCache->stopPolling; - ++locks_polled, ++pLock ) { - pid_t pid; - - if (pLock->timeStamp < then && - pLock->timeStamp != 0 && - (pid = pLock->pid) != 0) { - - /* maybe we should try the lock? */ - int result = kill(pid, 0); - if (result < 0 && errno == ESRCH) { - SECStatus rv; - /* No process exists by that pid any more. - ** Treat this mutex as abandoned. - */ - pLock->timeStamp = now; - pLock->pid = 0; - rv = sslMutex_Unlock(&pLock->mutex); - if (rv != SECSuccess) { - /* Now what? */ - } - } - } - } /* end of loop over locks */ - } /* end of entire polling loop */ -} - -/* Launch thread to poll cache for expired locks */ -static SECStatus -LaunchLockPoller(cacheDesc *cache) -{ - const char * timeoutString; - PRThread * pollerThread; - - cache->mutexTimeout = SID_LOCK_EXPIRATION_TIMEOUT; - timeoutString = getenv("NSS_SSL_SERVER_CACHE_MUTEX_TIMEOUT"); - if (timeoutString) { - long newTime = strtol(timeoutString, 0, 0); - if (newTime == 0) - return SECSuccess; /* application doesn't want poller thread */ - if (newTime > 0) - cache->mutexTimeout = (PRUint32)newTime; - /* if error (newTime < 0) ignore it and use default */ - } - - pollerThread = - PR_CreateThread(PR_USER_THREAD, LockPoller, cache, PR_PRIORITY_NORMAL, - PR_GLOBAL_THREAD, PR_JOINABLE_THREAD, 0); - if (!pollerThread) { - return SECFailure; - } - cache->poller = pollerThread; - return SECSuccess; -} - -/* Stop the thread that polls cache for expired locks */ -static SECStatus -StopLockPoller(cacheDesc *cache) -{ - if (!cache->poller) { - return SECSuccess; - } - cache->sharedCache->stopPolling = PR_TRUE; - if (PR_Interrupt(cache->poller) != PR_SUCCESS) { - return SECFailure; - } - if (PR_JoinThread(cache->poller) != PR_SUCCESS) { - return SECFailure; - } - cache->poller = NULL; - return SECSuccess; -} -#endif - -/************************************************************************ - * Code dealing with shared wrapped symmetric wrapping keys below * - ************************************************************************/ - -/* If now is zero, it implies that the lock is not held, and must be -** aquired here. -*/ -static PRBool -getSvrWrappingKey(PRInt32 symWrapMechIndex, - SSL3KEAType exchKeyType, - SSLWrappedSymWrappingKey *wswk, - cacheDesc * cache, - PRUint32 lockTime) -{ - PRUint32 ndx = (exchKeyType * SSL_NUM_WRAP_MECHS) + symWrapMechIndex; - SSLWrappedSymWrappingKey * pwswk = cache->keyCacheData + ndx; - PRUint32 now = 0; - PRBool rv = PR_FALSE; - - if (!cache->cacheMem) { /* cache is uninitialized */ - PORT_SetError(SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED); - return rv; - } - if (!lockTime) { - lockTime = now = LockSidCacheLock(cache->keyCacheLock, now); - if (!lockTime) { - return rv; - } - } - if (pwswk->exchKeyType == exchKeyType && - pwswk->symWrapMechIndex == symWrapMechIndex && - pwswk->wrappedSymKeyLen != 0) { - *wswk = *pwswk; - rv = PR_TRUE; - } - if (now) { - UnlockSidCacheLock(cache->keyCacheLock); - } - return rv; -} - -PRBool -ssl_GetWrappingKey( PRInt32 symWrapMechIndex, - SSL3KEAType exchKeyType, - SSLWrappedSymWrappingKey *wswk) -{ - PRBool rv; - - PORT_Assert( (unsigned)exchKeyType < kt_kea_size); - PORT_Assert( (unsigned)symWrapMechIndex < SSL_NUM_WRAP_MECHS); - if ((unsigned)exchKeyType < kt_kea_size && - (unsigned)symWrapMechIndex < SSL_NUM_WRAP_MECHS) { - rv = getSvrWrappingKey(symWrapMechIndex, exchKeyType, wswk, - &globalCache, 0); - } else { - rv = PR_FALSE; - } - - return rv; -} - -/* Wrap and cache a session ticket key. */ -static PRBool -WrapTicketKey(SECKEYPublicKey *svrPubKey, PK11SymKey *symKey, - const char *keyName, encKeyCacheEntry* cacheEntry) -{ - SECItem wrappedKey = {siBuffer, NULL, 0}; - - wrappedKey.len = SECKEY_PublicKeyStrength(svrPubKey); - PORT_Assert(wrappedKey.len <= sizeof(cacheEntry->bytes)); - if (wrappedKey.len > sizeof(cacheEntry->bytes)) - return PR_FALSE; - wrappedKey.data = cacheEntry->bytes; - - if (PK11_PubWrapSymKey(CKM_RSA_PKCS, svrPubKey, symKey, &wrappedKey) - != SECSuccess) { - SSL_DBG(("%d: SSL[%s]: Unable to wrap session ticket %s.", - SSL_GETPID(), "unknown", keyName)); - return PR_FALSE; - } - cacheEntry->length = wrappedKey.len; - return PR_TRUE; -} - -static PRBool -GenerateAndWrapTicketKeys(SECKEYPublicKey *svrPubKey, void *pwArg, - unsigned char *keyName, PK11SymKey **aesKey, - PK11SymKey **macKey) -{ - PK11SlotInfo *slot; - CK_MECHANISM_TYPE mechanismArray[2]; - PK11SymKey *aesKeyTmp = NULL; - PK11SymKey *macKeyTmp = NULL; - cacheDesc *cache = &globalCache; - - if (PK11_GenerateRandom(cache->ticketKeyNameSuffix, - SESS_TICKET_KEY_VAR_NAME_LEN) != SECSuccess) { - SSL_DBG(("%d: SSL[%s]: Unable to generate random key name bytes.", - SSL_GETPID(), "unknown")); - goto loser; - } - - mechanismArray[0] = CKM_AES_CBC; - mechanismArray[1] = CKM_SHA256_HMAC; - - slot = PK11_GetBestSlotMultiple(mechanismArray, 2, pwArg); - if (slot) { - aesKeyTmp = PK11_KeyGen(slot, mechanismArray[0], NULL, 32, pwArg); - macKeyTmp = PK11_KeyGen(slot, mechanismArray[1], NULL, SHA256_LENGTH, - pwArg); - PK11_FreeSlot(slot); - } - - if (aesKeyTmp == NULL || macKeyTmp == NULL) { - SSL_DBG(("%d: SSL[%s]: Unable to generate session ticket keys.", - SSL_GETPID(), "unknown")); - goto loser; - } - - /* Export the keys to the shared cache in wrapped form. */ - if (!WrapTicketKey(svrPubKey, aesKeyTmp, "enc key", cache->ticketEncKey)) - goto loser; - if (!WrapTicketKey(svrPubKey, macKeyTmp, "mac key", cache->ticketMacKey)) - goto loser; - - PORT_Memcpy(keyName, cache->ticketKeyNameSuffix, - SESS_TICKET_KEY_VAR_NAME_LEN); - *aesKey = aesKeyTmp; - *macKey = macKeyTmp; - return PR_TRUE; - -loser: - if (aesKeyTmp) - PK11_FreeSymKey(aesKeyTmp); - if (macKeyTmp) - PK11_FreeSymKey(macKeyTmp); - return PR_FALSE; -} - -static PRBool -UnwrapCachedTicketKeys(SECKEYPrivateKey *svrPrivKey, unsigned char *keyName, - PK11SymKey **aesKey, PK11SymKey **macKey) -{ - SECItem wrappedKey = {siBuffer, NULL, 0}; - PK11SymKey *aesKeyTmp = NULL; - PK11SymKey *macKeyTmp = NULL; - cacheDesc *cache = &globalCache; - - wrappedKey.data = cache->ticketEncKey->bytes; - wrappedKey.len = cache->ticketEncKey->length; - PORT_Assert(wrappedKey.len <= sizeof(cache->ticketEncKey->bytes)); - aesKeyTmp = PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey, - CKM_AES_CBC, CKA_DECRYPT, 0); - - wrappedKey.data = cache->ticketMacKey->bytes; - wrappedKey.len = cache->ticketMacKey->length; - PORT_Assert(wrappedKey.len <= sizeof(cache->ticketMacKey->bytes)); - macKeyTmp = PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey, - CKM_SHA256_HMAC, CKA_SIGN, 0); - - if (aesKeyTmp == NULL || macKeyTmp == NULL) { - SSL_DBG(("%d: SSL[%s]: Unable to unwrap session ticket keys.", - SSL_GETPID(), "unknown")); - goto loser; - } - SSL_DBG(("%d: SSL[%s]: Successfully unwrapped session ticket keys.", - SSL_GETPID(), "unknown")); - - PORT_Memcpy(keyName, cache->ticketKeyNameSuffix, - SESS_TICKET_KEY_VAR_NAME_LEN); - *aesKey = aesKeyTmp; - *macKey = macKeyTmp; - return PR_TRUE; - -loser: - if (aesKeyTmp) - PK11_FreeSymKey(aesKeyTmp); - if (macKeyTmp) - PK11_FreeSymKey(macKeyTmp); - return PR_FALSE; -} - -PRBool -ssl_GetSessionTicketKeysPKCS11(SECKEYPrivateKey *svrPrivKey, - SECKEYPublicKey *svrPubKey, void *pwArg, - unsigned char *keyName, PK11SymKey **aesKey, - PK11SymKey **macKey) -{ - PRUint32 now = 0; - PRBool rv = PR_FALSE; - PRBool keysGenerated = PR_FALSE; - cacheDesc *cache = &globalCache; - - now = LockSidCacheLock(cache->keyCacheLock, now); - if (!now) - return rv; - - if (!*(cache->ticketKeysValid)) { - /* Keys do not exist, create them. */ - if (!GenerateAndWrapTicketKeys(svrPubKey, pwArg, keyName, - aesKey, macKey)) - goto loser; - keysGenerated = PR_TRUE; - *(cache->ticketKeysValid) = 1; - } - - rv = PR_TRUE; - - loser: - UnlockSidCacheLock(cache->keyCacheLock); - if (rv && !keysGenerated) - rv = UnwrapCachedTicketKeys(svrPrivKey, keyName, aesKey, macKey); - return rv; -} - -PRBool -ssl_GetSessionTicketKeys(unsigned char *keyName, unsigned char *encKey, - unsigned char *macKey) -{ - PRBool rv = PR_FALSE; - PRUint32 now = 0; - cacheDesc *cache = &globalCache; - - /* Grab lock. */ - now = LockSidCacheLock(cache->keyCacheLock, now); - if (!now) - return rv; - - if (!*(cache->ticketKeysValid)) { - if (PK11_GenerateRandom(cache->ticketKeyNameSuffix, - SESS_TICKET_KEY_VAR_NAME_LEN) != SECSuccess) - goto loser; - if (PK11_GenerateRandom(cache->ticketEncKey->bytes, 32) != SECSuccess) - goto loser; - if (PK11_GenerateRandom(cache->ticketMacKey->bytes, - SHA256_LENGTH) != SECSuccess) - goto loser; - *(cache->ticketKeysValid) = 1; - } - - rv = PR_TRUE; - - loser: - UnlockSidCacheLock(cache->keyCacheLock); - if (rv) { - PORT_Memcpy(keyName, cache->ticketKeyNameSuffix, - SESS_TICKET_KEY_VAR_NAME_LEN); - PORT_Memcpy(encKey, cache->ticketEncKey->bytes, 32); - PORT_Memcpy(macKey, cache->ticketMacKey->bytes, SHA256_LENGTH); - } - return rv; -} - -/* The caller passes in the new value it wants - * to set. This code tests the wrapped sym key entry in the shared memory. - * If it is uninitialized, this function writes the caller's value into - * the disk entry, and returns false. - * Otherwise, it overwrites the caller's wswk with the value obtained from - * the disk, and returns PR_TRUE. - * This is all done while holding the locks/mutexes necessary to make - * the operation atomic. - */ -PRBool -ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk) -{ - cacheDesc * cache = &globalCache; - PRBool rv = PR_FALSE; - SSL3KEAType exchKeyType = wswk->exchKeyType; - /* type of keys used to wrap SymWrapKey*/ - PRInt32 symWrapMechIndex = wswk->symWrapMechIndex; - PRUint32 ndx; - PRUint32 now = 0; - SSLWrappedSymWrappingKey myWswk; - - if (!cache->cacheMem) { /* cache is uninitialized */ - PORT_SetError(SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED); - return 0; - } - - PORT_Assert( (unsigned)exchKeyType < kt_kea_size); - if ((unsigned)exchKeyType >= kt_kea_size) - return 0; - - PORT_Assert( (unsigned)symWrapMechIndex < SSL_NUM_WRAP_MECHS); - if ((unsigned)symWrapMechIndex >= SSL_NUM_WRAP_MECHS) - return 0; - - ndx = (exchKeyType * SSL_NUM_WRAP_MECHS) + symWrapMechIndex; - PORT_Memset(&myWswk, 0, sizeof myWswk); /* eliminate UMRs. */ - - now = LockSidCacheLock(cache->keyCacheLock, now); - if (now) { - rv = getSvrWrappingKey(wswk->symWrapMechIndex, wswk->exchKeyType, - &myWswk, cache, now); - if (rv) { - /* we found it on disk, copy it out to the caller. */ - PORT_Memcpy(wswk, &myWswk, sizeof *wswk); - } else { - /* Wasn't on disk, and we're still holding the lock, so write it. */ - cache->keyCacheData[ndx] = *wswk; - } - UnlockSidCacheLock(cache->keyCacheLock); - } - return rv; -} - -#else /* MAC version or other platform */ - -#include "seccomon.h" -#include "cert.h" -#include "ssl.h" -#include "sslimpl.h" - -SECStatus -SSL_ConfigServerSessionIDCache( int maxCacheEntries, - PRUint32 ssl2_timeout, - PRUint32 ssl3_timeout, - const char * directory) -{ - PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_ConfigServerSessionIDCache)"); - return SECFailure; -} - -SECStatus -SSL_ConfigMPServerSIDCache( int maxCacheEntries, - PRUint32 ssl2_timeout, - PRUint32 ssl3_timeout, - const char * directory) -{ - PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_ConfigMPServerSIDCache)"); - return SECFailure; -} - -SECStatus -SSL_InheritMPServerSIDCache(const char * envString) -{ - PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_InheritMPServerSIDCache)"); - return SECFailure; -} - -PRBool -ssl_GetWrappingKey( PRInt32 symWrapMechIndex, - SSL3KEAType exchKeyType, - SSLWrappedSymWrappingKey *wswk) -{ - PRBool rv = PR_FALSE; - PR_ASSERT(!"SSL servers are not supported on this platform. (ssl_GetWrappingKey)"); - return rv; -} - -/* This is a kind of test-and-set. The caller passes in the new value it wants - * to set. This code tests the wrapped sym key entry in the shared memory. - * If it is uninitialized, this function writes the caller's value into - * the disk entry, and returns false. - * Otherwise, it overwrites the caller's wswk with the value obtained from - * the disk, and returns PR_TRUE. - * This is all done while holding the locks/mutexes necessary to make - * the operation atomic. - */ -PRBool -ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk) -{ - PRBool rv = PR_FALSE; - PR_ASSERT(!"SSL servers are not supported on this platform. (ssl_SetWrappingKey)"); - return rv; -} - -PRUint32 -SSL_GetMaxServerCacheLocks(void) -{ - PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_GetMaxServerCacheLocks)"); - return -1; -} - -SECStatus -SSL_SetMaxServerCacheLocks(PRUint32 maxLocks) -{ - PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_SetMaxServerCacheLocks)"); - return SECFailure; -} - -#endif /* XP_UNIX || XP_WIN32 */ diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c deleted file mode 100644 index 2f959a351..000000000 --- a/security/nss/lib/ssl/sslsock.c +++ /dev/null @@ -1,2200 +0,0 @@ -/* - * vtables (and methods that call through them) for the 4 types of - * SSLSockets supported. Only one type is still supported. - * Various other functions. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Stephen Henson <stephen.henson@gemplus.com> - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#include "seccomon.h" -#include "cert.h" -#include "keyhi.h" -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" -#include "nspr.h" -#include "private/pprio.h" -#include "blapi.h" -#include "nss.h" - -#define SET_ERROR_CODE /* reminder */ - -struct cipherPolicyStr { - int cipher; - unsigned char export; /* policy value for export policy */ - unsigned char france; /* policy value for france policy */ -}; - -typedef struct cipherPolicyStr cipherPolicy; - -/* This table contains two preconfigured policies: Export and France. -** It is used only by the functions SSL_SetDomesticPolicy, -** SSL_SetExportPolicy, and SSL_SetFrancyPolicy. -** Order of entries is not important. -*/ -static cipherPolicy ssl_ciphers[] = { /* Export France */ - { SSL_EN_RC4_128_WITH_MD5, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL_ALLOWED, SSL_ALLOWED }, - { SSL_EN_RC2_128_CBC_WITH_MD5, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL_ALLOWED, SSL_ALLOWED }, - { SSL_EN_DES_64_CBC_WITH_MD5, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_RSA_WITH_RC4_128_MD5, SSL_RESTRICTED, SSL_NOT_ALLOWED }, - { SSL_RSA_WITH_RC4_128_SHA, SSL_RESTRICTED, SSL_NOT_ALLOWED }, - { SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RESTRICTED, SSL_NOT_ALLOWED }, - { SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_ALLOWED, SSL_ALLOWED }, - { SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL_ALLOWED, SSL_ALLOWED }, - { SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { SSL_RSA_WITH_NULL_SHA, SSL_ALLOWED, SSL_ALLOWED }, - { SSL_RSA_WITH_NULL_MD5, SSL_ALLOWED, SSL_ALLOWED }, - { TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_WITH_SEED_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_ALLOWED, SSL_NOT_ALLOWED }, -#ifdef NSS_ENABLE_ECC - { TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_ALLOWED, SSL_ALLOWED }, - { TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_ALLOWED, SSL_ALLOWED }, - { TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_RSA_WITH_NULL_SHA, SSL_ALLOWED, SSL_ALLOWED }, - { TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_ALLOWED, SSL_ALLOWED }, - { TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, - { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED }, -#endif /* NSS_ENABLE_ECC */ - { 0, SSL_NOT_ALLOWED, SSL_NOT_ALLOWED } -}; - -static const sslSocketOps ssl_default_ops = { /* No SSL. */ - ssl_DefConnect, - NULL, - ssl_DefBind, - ssl_DefListen, - ssl_DefShutdown, - ssl_DefClose, - ssl_DefRecv, - ssl_DefSend, - ssl_DefRead, - ssl_DefWrite, - ssl_DefGetpeername, - ssl_DefGetsockname -}; - -static const sslSocketOps ssl_secure_ops = { /* SSL. */ - ssl_SecureConnect, - NULL, - ssl_DefBind, - ssl_DefListen, - ssl_SecureShutdown, - ssl_SecureClose, - ssl_SecureRecv, - ssl_SecureSend, - ssl_SecureRead, - ssl_SecureWrite, - ssl_DefGetpeername, - ssl_DefGetsockname -}; - -/* -** default settings for socket enables -*/ -static sslOptions ssl_defaults = { - PR_TRUE, /* useSecurity */ - PR_FALSE, /* useSocks */ - PR_FALSE, /* requestCertificate */ - 2, /* requireCertificate */ - PR_FALSE, /* handshakeAsClient */ - PR_FALSE, /* handshakeAsServer */ - PR_TRUE, /* enableSSL2 */ - PR_TRUE, /* enableSSL3 */ - PR_TRUE, /* enableTLS */ /* now defaults to on in NSS 3.0 */ - PR_FALSE, /* noCache */ - PR_FALSE, /* fdx */ - PR_TRUE, /* v2CompatibleHello */ - PR_TRUE, /* detectRollBack */ - PR_FALSE, /* noStepDown */ - PR_FALSE, /* bypassPKCS11 */ - PR_FALSE, /* noLocks */ - PR_FALSE, /* enableSessionTickets */ -}; - -sslSessionIDLookupFunc ssl_sid_lookup; -sslSessionIDCacheFunc ssl_sid_cache; -sslSessionIDUncacheFunc ssl_sid_uncache; - -static PRBool ssl_inited = PR_FALSE; -static PRDescIdentity ssl_layer_id; - -PRBool locksEverDisabled; /* implicitly PR_FALSE */ -PRBool ssl_force_locks; /* implicitly PR_FALSE */ -int ssl_lock_readers = 1; /* default true. */ -char ssl_debug; -char ssl_trace; -FILE * ssl_trace_iob; -char lockStatus[] = "Locks are ENABLED. "; -#define LOCKSTATUS_OFFSET 10 /* offset of ENABLED */ - -/* forward declarations. */ -static sslSocket *ssl_NewSocket(PRBool makeLocks); -static SECStatus ssl_MakeLocks(sslSocket *ss); -static PRStatus ssl_PushIOLayer(sslSocket *ns, PRFileDesc *stack, - PRDescIdentity id); - -/************************************************************************/ - -/* -** Lookup a socket structure from a file descriptor. -** Only functions called through the PRIOMethods table should use this. -** Other app-callable functions should use ssl_FindSocket. -*/ -static sslSocket * -ssl_GetPrivate(PRFileDesc *fd) -{ - sslSocket *ss; - - PORT_Assert(fd != NULL); - PORT_Assert(fd->methods->file_type == PR_DESC_LAYERED); - PORT_Assert(fd->identity == ssl_layer_id); - - if (fd->methods->file_type != PR_DESC_LAYERED || - fd->identity != ssl_layer_id) { - PORT_SetError(PR_BAD_DESCRIPTOR_ERROR); - return NULL; - } - - ss = (sslSocket *)fd->secret; - ss->fd = fd; - return ss; -} - -/* This function tries to find the SSL layer in the stack. - * It searches for the first SSL layer at or below the argument fd, - * and failing that, it searches for the nearest SSL layer above the - * argument fd. It returns the private sslSocket from the found layer. - */ -sslSocket * -ssl_FindSocket(PRFileDesc *fd) -{ - PRFileDesc *layer; - sslSocket *ss; - - PORT_Assert(fd != NULL); - PORT_Assert(ssl_layer_id != 0); - - layer = PR_GetIdentitiesLayer(fd, ssl_layer_id); - if (layer == NULL) { - PORT_SetError(PR_BAD_DESCRIPTOR_ERROR); - return NULL; - } - - ss = (sslSocket *)layer->secret; - ss->fd = layer; - return ss; -} - -sslSocket * -ssl_DupSocket(sslSocket *os) -{ - sslSocket *ss; - SECStatus rv; - - ss = ssl_NewSocket((PRBool)(!os->opt.noLocks)); - if (ss) { - ss->opt = os->opt; - ss->opt.useSocks = PR_FALSE; - - ss->peerID = !os->peerID ? NULL : PORT_Strdup(os->peerID); - ss->url = !os->url ? NULL : PORT_Strdup(os->url); - - ss->ops = os->ops; - ss->rTimeout = os->rTimeout; - ss->wTimeout = os->wTimeout; - ss->cTimeout = os->cTimeout; - ss->dbHandle = os->dbHandle; - - /* copy ssl2&3 policy & prefs, even if it's not selected (yet) */ - ss->allowedByPolicy = os->allowedByPolicy; - ss->maybeAllowedByPolicy= os->maybeAllowedByPolicy; - ss->chosenPreference = os->chosenPreference; - PORT_Memcpy(ss->cipherSuites, os->cipherSuites, sizeof os->cipherSuites); - - if (os->cipherSpecs) { - ss->cipherSpecs = (unsigned char*)PORT_Alloc(os->sizeCipherSpecs); - if (ss->cipherSpecs) - PORT_Memcpy(ss->cipherSpecs, os->cipherSpecs, - os->sizeCipherSpecs); - ss->sizeCipherSpecs = os->sizeCipherSpecs; - ss->preferredCipher = os->preferredCipher; - } else { - ss->cipherSpecs = NULL; /* produced lazily */ - ss->sizeCipherSpecs = 0; - ss->preferredCipher = NULL; - } - if (ss->opt.useSecurity) { - /* This int should be SSLKEAType, but CC on Irix complains, - * during the for loop. - */ - int i; - sslServerCerts * oc = os->serverCerts; - sslServerCerts * sc = ss->serverCerts; - - for (i=kt_null; i < kt_kea_size; i++, oc++, sc++) { - if (oc->serverCert && oc->serverCertChain) { - sc->serverCert = CERT_DupCertificate(oc->serverCert); - sc->serverCertChain = CERT_DupCertList(oc->serverCertChain); - if (!sc->serverCertChain) - goto loser; - } else { - sc->serverCert = NULL; - sc->serverCertChain = NULL; - } - sc->serverKeyPair = oc->serverKeyPair ? - ssl3_GetKeyPairRef(oc->serverKeyPair) : NULL; - if (oc->serverKeyPair && !sc->serverKeyPair) - goto loser; - sc->serverKeyBits = oc->serverKeyBits; - } - ss->stepDownKeyPair = !os->stepDownKeyPair ? NULL : - ssl3_GetKeyPairRef(os->stepDownKeyPair); - ss->ephemeralECDHKeyPair = !os->ephemeralECDHKeyPair ? NULL : - ssl3_GetKeyPairRef(os->ephemeralECDHKeyPair); -/* - * XXX the preceeding CERT_ and SECKEY_ functions can fail and return NULL. - * XXX We should detect this, and not just march on with NULL pointers. - */ - ss->authCertificate = os->authCertificate; - ss->authCertificateArg = os->authCertificateArg; - ss->getClientAuthData = os->getClientAuthData; - ss->getClientAuthDataArg = os->getClientAuthDataArg; - ss->handleBadCert = os->handleBadCert; - ss->badCertArg = os->badCertArg; - ss->handshakeCallback = os->handshakeCallback; - ss->handshakeCallbackData = os->handshakeCallbackData; - ss->pkcs11PinArg = os->pkcs11PinArg; - - /* Create security data */ - rv = ssl_CopySecurityInfo(ss, os); - if (rv != SECSuccess) { - goto loser; - } - } - } - return ss; - -loser: - ssl_FreeSocket(ss); - return NULL; -} - -static void -ssl_DestroyLocks(sslSocket *ss) -{ - /* Destroy locks. */ - if (ss->firstHandshakeLock) { - PZ_DestroyMonitor(ss->firstHandshakeLock); - ss->firstHandshakeLock = NULL; - } - if (ss->ssl3HandshakeLock) { - PZ_DestroyMonitor(ss->ssl3HandshakeLock); - ss->ssl3HandshakeLock = NULL; - } - if (ss->specLock) { - NSSRWLock_Destroy(ss->specLock); - ss->specLock = NULL; - } - - if (ss->recvLock) { - PZ_DestroyLock(ss->recvLock); - ss->recvLock = NULL; - } - if (ss->sendLock) { - PZ_DestroyLock(ss->sendLock); - ss->sendLock = NULL; - } - if (ss->xmitBufLock) { - PZ_DestroyMonitor(ss->xmitBufLock); - ss->xmitBufLock = NULL; - } - if (ss->recvBufLock) { - PZ_DestroyMonitor(ss->recvBufLock); - ss->recvBufLock = NULL; - } -} - -/* Caller holds any relevant locks */ -static void -ssl_DestroySocketContents(sslSocket *ss) -{ - /* "i" should be of type SSLKEAType, but CC on IRIX complains during - * the for loop. - */ - int i; - - /* Free up socket */ - ssl_DestroySecurityInfo(&ss->sec); - - ssl3_DestroySSL3Info(ss); - - PORT_Free(ss->saveBuf.buf); - PORT_Free(ss->pendingBuf.buf); - ssl_DestroyGather(&ss->gs); - - if (ss->peerID != NULL) - PORT_Free(ss->peerID); - if (ss->url != NULL) - PORT_Free((void *)ss->url); /* CONST */ - if (ss->cipherSpecs) { - PORT_Free(ss->cipherSpecs); - ss->cipherSpecs = NULL; - ss->sizeCipherSpecs = 0; - } - - /* Clean up server configuration */ - for (i=kt_null; i < kt_kea_size; i++) { - sslServerCerts * sc = ss->serverCerts + i; - if (sc->serverCert != NULL) - CERT_DestroyCertificate(sc->serverCert); - if (sc->serverCertChain != NULL) - CERT_DestroyCertificateList(sc->serverCertChain); - if (sc->serverKeyPair != NULL) - ssl3_FreeKeyPair(sc->serverKeyPair); - } - if (ss->stepDownKeyPair) { - ssl3_FreeKeyPair(ss->stepDownKeyPair); - ss->stepDownKeyPair = NULL; - } - if (ss->ephemeralECDHKeyPair) { - ssl3_FreeKeyPair(ss->ephemeralECDHKeyPair); - ss->ephemeralECDHKeyPair = NULL; - } -} - -/* - * free an sslSocket struct, and all the stuff that hangs off of it - */ -void -ssl_FreeSocket(sslSocket *ss) -{ -#ifdef DEBUG - sslSocket *fs; - sslSocket lSock; -#endif - -/* Get every lock you can imagine! -** Caller already holds these: -** SSL_LOCK_READER(ss); -** SSL_LOCK_WRITER(ss); -*/ - ssl_Get1stHandshakeLock(ss); - ssl_GetRecvBufLock(ss); - ssl_GetSSL3HandshakeLock(ss); - ssl_GetXmitBufLock(ss); - ssl_GetSpecWriteLock(ss); - -#ifdef DEBUG - fs = &lSock; - *fs = *ss; /* Copy the old socket structure, */ - PORT_Memset(ss, 0x1f, sizeof *ss); /* then blast the old struct ASAP. */ -#else -#define fs ss -#endif - - ssl_DestroySocketContents(fs); - - /* Release all the locks acquired above. */ - SSL_UNLOCK_READER(fs); - SSL_UNLOCK_WRITER(fs); - ssl_Release1stHandshakeLock(fs); - ssl_ReleaseRecvBufLock(fs); - ssl_ReleaseSSL3HandshakeLock(fs); - ssl_ReleaseXmitBufLock(fs); - ssl_ReleaseSpecWriteLock(fs); - - ssl_DestroyLocks(fs); - - PORT_Free(ss); /* free the caller's copy, not ours. */ - return; -} -#undef fs - -/************************************************************************/ -SECStatus -ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled) -{ - PRFileDesc * osfd = ss->fd->lower; - SECStatus rv = SECFailure; - PRSocketOptionData opt; - - opt.option = PR_SockOpt_NoDelay; - opt.value.no_delay = (PRBool)!enabled; - - if (osfd->methods->setsocketoption) { - rv = (SECStatus) osfd->methods->setsocketoption(osfd, &opt); - } else { - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - } - - return rv; -} - -static void -ssl_ChooseOps(sslSocket *ss) -{ - ss->ops = ss->opt.useSecurity ? &ssl_secure_ops : &ssl_default_ops; -} - -/* Called from SSL_Enable (immediately below) */ -static SECStatus -PrepareSocket(sslSocket *ss) -{ - SECStatus rv = SECSuccess; - - ssl_ChooseOps(ss); - return rv; -} - -SECStatus -SSL_Enable(PRFileDesc *fd, int which, PRBool on) -{ - return SSL_OptionSet(fd, which, on); -} - -static const PRCallOnceType pristineCallOnce; -static PRCallOnceType setupBypassOnce; - -static SECStatus SSL_BypassShutdown(void* appData, void* nssData) -{ - /* unload freeBL shared library from memory */ - BL_Unload(); - setupBypassOnce = pristineCallOnce; - return SECSuccess; -} - -static PRStatus SSL_BypassRegisterShutdown(void) -{ - SECStatus rv = NSS_RegisterShutdown(SSL_BypassShutdown, NULL); - PORT_Assert(SECSuccess == rv); - return SECSuccess == rv ? PR_SUCCESS : PR_FAILURE; -} - -static PRStatus SSL_BypassSetup(void) -{ - return PR_CallOnce(&setupBypassOnce, &SSL_BypassRegisterShutdown); -} - -SECStatus -SSL_OptionSet(PRFileDesc *fd, PRInt32 which, PRBool on) -{ - sslSocket *ss = ssl_FindSocket(fd); - SECStatus rv = SECSuccess; - PRBool holdingLocks; - - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in Enable", SSL_GETPID(), fd)); - return SECFailure; - } - - holdingLocks = (!ss->opt.noLocks); - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - switch (which) { - case SSL_SOCKS: - ss->opt.useSocks = PR_FALSE; - rv = PrepareSocket(ss); - if (on) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } - break; - - case SSL_SECURITY: - ss->opt.useSecurity = on; - rv = PrepareSocket(ss); - break; - - case SSL_REQUEST_CERTIFICATE: - ss->opt.requestCertificate = on; - break; - - case SSL_REQUIRE_CERTIFICATE: - ss->opt.requireCertificate = on; - break; - - case SSL_HANDSHAKE_AS_CLIENT: - if ( ss->opt.handshakeAsServer && on ) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - break; - } - ss->opt.handshakeAsClient = on; - break; - - case SSL_HANDSHAKE_AS_SERVER: - if ( ss->opt.handshakeAsClient && on ) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - break; - } - ss->opt.handshakeAsServer = on; - break; - - case SSL_ENABLE_TLS: - ss->opt.enableTLS = on; - ss->preferredCipher = NULL; - if (ss->cipherSpecs) { - PORT_Free(ss->cipherSpecs); - ss->cipherSpecs = NULL; - ss->sizeCipherSpecs = 0; - } - break; - - case SSL_ENABLE_SSL3: - ss->opt.enableSSL3 = on; - ss->preferredCipher = NULL; - if (ss->cipherSpecs) { - PORT_Free(ss->cipherSpecs); - ss->cipherSpecs = NULL; - ss->sizeCipherSpecs = 0; - } - break; - - case SSL_ENABLE_SSL2: - ss->opt.enableSSL2 = on; - if (on) { - ss->opt.v2CompatibleHello = on; - } - ss->preferredCipher = NULL; - if (ss->cipherSpecs) { - PORT_Free(ss->cipherSpecs); - ss->cipherSpecs = NULL; - ss->sizeCipherSpecs = 0; - } - break; - - case SSL_NO_CACHE: - ss->opt.noCache = on; - break; - - case SSL_ENABLE_FDX: - if (on && ss->opt.noLocks) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } - ss->opt.fdx = on; - break; - - case SSL_V2_COMPATIBLE_HELLO: - ss->opt.v2CompatibleHello = on; - if (!on) { - ss->opt.enableSSL2 = on; - } - break; - - case SSL_ROLLBACK_DETECTION: - ss->opt.detectRollBack = on; - break; - - case SSL_NO_STEP_DOWN: - ss->opt.noStepDown = on; - if (on) - SSL_DisableExportCipherSuites(fd); - break; - - case SSL_BYPASS_PKCS11: - if (ss->handshakeBegun) { - PORT_SetError(PR_INVALID_STATE_ERROR); - rv = SECFailure; - } else { - if (PR_FALSE != on) { - if (PR_SUCCESS == SSL_BypassSetup() ) { - ss->opt.bypassPKCS11 = on; - } else { - rv = SECFailure; - } - } else { - ss->opt.bypassPKCS11 = PR_FALSE; - } - } - break; - - case SSL_NO_LOCKS: - if (on && ss->opt.fdx) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } - if (on && ssl_force_locks) - on = PR_FALSE; /* silent override */ - ss->opt.noLocks = on; - if (on) { - locksEverDisabled = PR_TRUE; - strcpy(lockStatus + LOCKSTATUS_OFFSET, "DISABLED."); - } else if (!holdingLocks) { - rv = ssl_MakeLocks(ss); - if (rv != SECSuccess) { - ss->opt.noLocks = PR_TRUE; - } - } - break; - - case SSL_ENABLE_SESSION_TICKETS: - ss->opt.enableSessionTickets = on; - break; - - default: - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } - - /* We can't use the macros for releasing the locks here, - * because ss->opt.noLocks might have changed just above. - * We must release these locks (monitors) here, if we aquired them above, - * regardless of the current value of ss->opt.noLocks. - */ - if (holdingLocks) { - PZ_ExitMonitor((ss)->ssl3HandshakeLock); - PZ_ExitMonitor((ss)->firstHandshakeLock); - } - - return rv; -} - -SECStatus -SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRBool *pOn) -{ - sslSocket *ss = ssl_FindSocket(fd); - SECStatus rv = SECSuccess; - PRBool on = PR_FALSE; - - if (!pOn) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in Enable", SSL_GETPID(), fd)); - *pOn = PR_FALSE; - return SECFailure; - } - - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - switch (which) { - case SSL_SOCKS: on = PR_FALSE; break; - case SSL_SECURITY: on = ss->opt.useSecurity; break; - case SSL_REQUEST_CERTIFICATE: on = ss->opt.requestCertificate; break; - case SSL_REQUIRE_CERTIFICATE: on = ss->opt.requireCertificate; break; - case SSL_HANDSHAKE_AS_CLIENT: on = ss->opt.handshakeAsClient; break; - case SSL_HANDSHAKE_AS_SERVER: on = ss->opt.handshakeAsServer; break; - case SSL_ENABLE_TLS: on = ss->opt.enableTLS; break; - case SSL_ENABLE_SSL3: on = ss->opt.enableSSL3; break; - case SSL_ENABLE_SSL2: on = ss->opt.enableSSL2; break; - case SSL_NO_CACHE: on = ss->opt.noCache; break; - case SSL_ENABLE_FDX: on = ss->opt.fdx; break; - case SSL_V2_COMPATIBLE_HELLO: on = ss->opt.v2CompatibleHello; break; - case SSL_ROLLBACK_DETECTION: on = ss->opt.detectRollBack; break; - case SSL_NO_STEP_DOWN: on = ss->opt.noStepDown; break; - case SSL_BYPASS_PKCS11: on = ss->opt.bypassPKCS11; break; - case SSL_NO_LOCKS: on = ss->opt.noLocks; break; - case SSL_ENABLE_SESSION_TICKETS: - on = ss->opt.enableSessionTickets; - break; - - default: - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - - *pOn = on; - return rv; -} - -SECStatus -SSL_OptionGetDefault(PRInt32 which, PRBool *pOn) -{ - SECStatus rv = SECSuccess; - PRBool on = PR_FALSE; - - if (!pOn) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - - switch (which) { - case SSL_SOCKS: on = PR_FALSE; break; - case SSL_SECURITY: on = ssl_defaults.useSecurity; break; - case SSL_REQUEST_CERTIFICATE: on = ssl_defaults.requestCertificate; break; - case SSL_REQUIRE_CERTIFICATE: on = ssl_defaults.requireCertificate; break; - case SSL_HANDSHAKE_AS_CLIENT: on = ssl_defaults.handshakeAsClient; break; - case SSL_HANDSHAKE_AS_SERVER: on = ssl_defaults.handshakeAsServer; break; - case SSL_ENABLE_TLS: on = ssl_defaults.enableTLS; break; - case SSL_ENABLE_SSL3: on = ssl_defaults.enableSSL3; break; - case SSL_ENABLE_SSL2: on = ssl_defaults.enableSSL2; break; - case SSL_NO_CACHE: on = ssl_defaults.noCache; break; - case SSL_ENABLE_FDX: on = ssl_defaults.fdx; break; - case SSL_V2_COMPATIBLE_HELLO: on = ssl_defaults.v2CompatibleHello; break; - case SSL_ROLLBACK_DETECTION: on = ssl_defaults.detectRollBack; break; - case SSL_NO_STEP_DOWN: on = ssl_defaults.noStepDown; break; - case SSL_BYPASS_PKCS11: on = ssl_defaults.bypassPKCS11; break; - case SSL_NO_LOCKS: on = ssl_defaults.noLocks; break; - case SSL_ENABLE_SESSION_TICKETS: - on = ssl_defaults.enableSessionTickets; - break; - - default: - PORT_SetError(SEC_ERROR_INVALID_ARGS); - rv = SECFailure; - } - - *pOn = on; - return rv; -} - -/* XXX Use Global Lock to protect this stuff. */ -SECStatus -SSL_EnableDefault(int which, PRBool on) -{ - return SSL_OptionSetDefault(which, on); -} - -SECStatus -SSL_OptionSetDefault(PRInt32 which, PRBool on) -{ - switch (which) { - case SSL_SOCKS: - ssl_defaults.useSocks = PR_FALSE; - if (on) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - break; - - case SSL_SECURITY: - ssl_defaults.useSecurity = on; - break; - - case SSL_REQUEST_CERTIFICATE: - ssl_defaults.requestCertificate = on; - break; - - case SSL_REQUIRE_CERTIFICATE: - ssl_defaults.requireCertificate = on; - break; - - case SSL_HANDSHAKE_AS_CLIENT: - if ( ssl_defaults.handshakeAsServer && on ) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - ssl_defaults.handshakeAsClient = on; - break; - - case SSL_HANDSHAKE_AS_SERVER: - if ( ssl_defaults.handshakeAsClient && on ) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - ssl_defaults.handshakeAsServer = on; - break; - - case SSL_ENABLE_TLS: - ssl_defaults.enableTLS = on; - break; - - case SSL_ENABLE_SSL3: - ssl_defaults.enableSSL3 = on; - break; - - case SSL_ENABLE_SSL2: - ssl_defaults.enableSSL2 = on; - if (on) { - ssl_defaults.v2CompatibleHello = on; - } - break; - - case SSL_NO_CACHE: - ssl_defaults.noCache = on; - break; - - case SSL_ENABLE_FDX: - if (on && ssl_defaults.noLocks) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - ssl_defaults.fdx = on; - break; - - case SSL_V2_COMPATIBLE_HELLO: - ssl_defaults.v2CompatibleHello = on; - if (!on) { - ssl_defaults.enableSSL2 = on; - } - break; - - case SSL_ROLLBACK_DETECTION: - ssl_defaults.detectRollBack = on; - break; - - case SSL_NO_STEP_DOWN: - ssl_defaults.noStepDown = on; - if (on) - SSL_DisableDefaultExportCipherSuites(); - break; - - case SSL_BYPASS_PKCS11: - if (PR_FALSE != on) { - if (PR_SUCCESS == SSL_BypassSetup()) { - ssl_defaults.bypassPKCS11 = on; - } else { - return SECFailure; - } - } else { - ssl_defaults.bypassPKCS11 = PR_FALSE; - } - break; - - case SSL_NO_LOCKS: - if (on && ssl_defaults.fdx) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - if (on && ssl_force_locks) - on = PR_FALSE; /* silent override */ - ssl_defaults.noLocks = on; - if (on) { - locksEverDisabled = PR_TRUE; - strcpy(lockStatus + LOCKSTATUS_OFFSET, "DISABLED."); - } - break; - - case SSL_ENABLE_SESSION_TICKETS: - ssl_defaults.enableSessionTickets = on; - break; - - default: - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - return SECSuccess; -} - -/* function tells us if the cipher suite is one that we no longer support. */ -static PRBool -ssl_IsRemovedCipherSuite(PRInt32 suite) -{ - switch (suite) { - case SSL_FORTEZZA_DMS_WITH_NULL_SHA: - case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: - case SSL_FORTEZZA_DMS_WITH_RC4_128_SHA: - return PR_TRUE; - default: - return PR_FALSE; - } -} - -/* Part of the public NSS API. - * Since this is a global (not per-socket) setting, we cannot use the - * HandshakeLock to protect this. Probably want a global lock. - */ -SECStatus -SSL_SetPolicy(long which, int policy) -{ - if ((which & 0xfffe) == SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA) { - /* one of the two old FIPS ciphers */ - if (which == SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA) - which = SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA; - else if (which == SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA) - which = SSL_RSA_FIPS_WITH_DES_CBC_SHA; - } - if (ssl_IsRemovedCipherSuite(which)) - return SECSuccess; - return SSL_CipherPolicySet(which, policy); -} - -SECStatus -SSL_CipherPolicySet(PRInt32 which, PRInt32 policy) -{ - SECStatus rv; - - if (ssl_IsRemovedCipherSuite(which)) { - rv = SECSuccess; - } else if (SSL_IS_SSL2_CIPHER(which)) { - rv = ssl2_SetPolicy(which, policy); - } else { - rv = ssl3_SetPolicy((ssl3CipherSuite)which, policy); - } - return rv; -} - -SECStatus -SSL_CipherPolicyGet(PRInt32 which, PRInt32 *oPolicy) -{ - SECStatus rv; - - if (!oPolicy) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - if (ssl_IsRemovedCipherSuite(which)) { - *oPolicy = SSL_NOT_ALLOWED; - rv = SECSuccess; - } else if (SSL_IS_SSL2_CIPHER(which)) { - rv = ssl2_GetPolicy(which, oPolicy); - } else { - rv = ssl3_GetPolicy((ssl3CipherSuite)which, oPolicy); - } - return rv; -} - -/* Part of the public NSS API. - * Since this is a global (not per-socket) setting, we cannot use the - * HandshakeLock to protect this. Probably want a global lock. - * These changes have no effect on any sslSockets already created. - */ -SECStatus -SSL_EnableCipher(long which, PRBool enabled) -{ - if ((which & 0xfffe) == SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA) { - /* one of the two old FIPS ciphers */ - if (which == SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA) - which = SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA; - else if (which == SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA) - which = SSL_RSA_FIPS_WITH_DES_CBC_SHA; - } - if (ssl_IsRemovedCipherSuite(which)) - return SECSuccess; - return SSL_CipherPrefSetDefault(which, enabled); -} - -SECStatus -SSL_CipherPrefSetDefault(PRInt32 which, PRBool enabled) -{ - SECStatus rv; - - if (ssl_IsRemovedCipherSuite(which)) - return SECSuccess; - if (enabled && ssl_defaults.noStepDown && SSL_IsExportCipherSuite(which)) { - PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); - return SECFailure; - } - if (SSL_IS_SSL2_CIPHER(which)) { - rv = ssl2_CipherPrefSetDefault(which, enabled); - } else { - rv = ssl3_CipherPrefSetDefault((ssl3CipherSuite)which, enabled); - } - return rv; -} - -SECStatus -SSL_CipherPrefGetDefault(PRInt32 which, PRBool *enabled) -{ - SECStatus rv; - - if (!enabled) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - if (ssl_IsRemovedCipherSuite(which)) { - *enabled = PR_FALSE; - rv = SECSuccess; - } else if (SSL_IS_SSL2_CIPHER(which)) { - rv = ssl2_CipherPrefGetDefault(which, enabled); - } else { - rv = ssl3_CipherPrefGetDefault((ssl3CipherSuite)which, enabled); - } - return rv; -} - -SECStatus -SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 which, PRBool enabled) -{ - SECStatus rv; - sslSocket *ss = ssl_FindSocket(fd); - - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in CipherPrefSet", SSL_GETPID(), fd)); - return SECFailure; - } - if (ssl_IsRemovedCipherSuite(which)) - return SECSuccess; - if (enabled && ss->opt.noStepDown && SSL_IsExportCipherSuite(which)) { - PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); - return SECFailure; - } - if (SSL_IS_SSL2_CIPHER(which)) { - rv = ssl2_CipherPrefSet(ss, which, enabled); - } else { - rv = ssl3_CipherPrefSet(ss, (ssl3CipherSuite)which, enabled); - } - return rv; -} - -SECStatus -SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 which, PRBool *enabled) -{ - SECStatus rv; - sslSocket *ss = ssl_FindSocket(fd); - - if (!enabled) { - PORT_SetError(SEC_ERROR_INVALID_ARGS); - return SECFailure; - } - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in CipherPrefGet", SSL_GETPID(), fd)); - *enabled = PR_FALSE; - return SECFailure; - } - if (ssl_IsRemovedCipherSuite(which)) { - *enabled = PR_FALSE; - rv = SECSuccess; - } else if (SSL_IS_SSL2_CIPHER(which)) { - rv = ssl2_CipherPrefGet(ss, which, enabled); - } else { - rv = ssl3_CipherPrefGet(ss, (ssl3CipherSuite)which, enabled); - } - return rv; -} - -SECStatus -NSS_SetDomesticPolicy(void) -{ -#ifndef EXPORT_VERSION - SECStatus status = SECSuccess; - cipherPolicy * policy; - - for (policy = ssl_ciphers; policy->cipher != 0; ++policy) { - status = SSL_SetPolicy(policy->cipher, SSL_ALLOWED); - if (status != SECSuccess) - break; - } - return status; -#else - return NSS_SetExportPolicy(); -#endif -} - -SECStatus -NSS_SetExportPolicy(void) -{ - SECStatus status = SECSuccess; - cipherPolicy * policy; - - for (policy = ssl_ciphers; policy->cipher != 0; ++policy) { - status = SSL_SetPolicy(policy->cipher, policy->export); - if (status != SECSuccess) - break; - } - return status; -} - -SECStatus -NSS_SetFrancePolicy(void) -{ - SECStatus status = SECSuccess; - cipherPolicy * policy; - - for (policy = ssl_ciphers; policy->cipher != 0; ++policy) { - status = SSL_SetPolicy(policy->cipher, policy->france); - if (status != SECSuccess) - break; - } - return status; -} - - - -/* LOCKS ??? XXX */ -PRFileDesc * -SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd) -{ - sslSocket * ns = NULL; - PRStatus rv; - PRNetAddr addr; - - if (model == NULL) { - /* Just create a default socket if we're given NULL for the model */ - ns = ssl_NewSocket((PRBool)(!ssl_defaults.noLocks)); - } else { - sslSocket * ss = ssl_FindSocket(model); - if (ss == NULL) { - SSL_DBG(("%d: SSL[%d]: bad model socket in ssl_ImportFD", - SSL_GETPID(), model)); - return NULL; - } - ns = ssl_DupSocket(ss); - } - if (ns == NULL) - return NULL; - - rv = ssl_PushIOLayer(ns, fd, PR_TOP_IO_LAYER); - if (rv != PR_SUCCESS) { - ssl_FreeSocket(ns); - SET_ERROR_CODE - return NULL; - } -#ifdef _WIN32 - PR_Sleep(PR_INTERVAL_NO_WAIT); /* workaround NT winsock connect bug. */ -#endif - ns = ssl_FindSocket(fd); - PORT_Assert(ns); - if (ns) - ns->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ns, &addr)); - return fd; -} - -/************************************************************************/ -/* The following functions are the TOP LEVEL SSL functions. -** They all get called through the NSPRIOMethods table below. -*/ - -static PRFileDesc * PR_CALLBACK -ssl_Accept(PRFileDesc *fd, PRNetAddr *sockaddr, PRIntervalTime timeout) -{ - sslSocket *ss; - sslSocket *ns = NULL; - PRFileDesc *newfd = NULL; - PRFileDesc *osfd; - PRStatus status; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in accept", SSL_GETPID(), fd)); - return NULL; - } - - /* IF this is a listen socket, there shouldn't be any I/O going on */ - SSL_LOCK_READER(ss); - SSL_LOCK_WRITER(ss); - ssl_Get1stHandshakeLock(ss); - ssl_GetSSL3HandshakeLock(ss); - - ss->cTimeout = timeout; - - osfd = ss->fd->lower; - - /* First accept connection */ - newfd = osfd->methods->accept(osfd, sockaddr, timeout); - if (newfd == NULL) { - SSL_DBG(("%d: SSL[%d]: accept failed, errno=%d", - SSL_GETPID(), ss->fd, PORT_GetError())); - } else { - /* Create ssl module */ - ns = ssl_DupSocket(ss); - } - - ssl_ReleaseSSL3HandshakeLock(ss); - ssl_Release1stHandshakeLock(ss); - SSL_UNLOCK_WRITER(ss); - SSL_UNLOCK_READER(ss); /* ss isn't used below here. */ - - if (ns == NULL) - goto loser; - - /* push ssl module onto the new socket */ - status = ssl_PushIOLayer(ns, newfd, PR_TOP_IO_LAYER); - if (status != PR_SUCCESS) - goto loser; - - /* Now start server connection handshake with client. - ** Don't need locks here because nobody else has a reference to ns yet. - */ - if ( ns->opt.useSecurity ) { - if ( ns->opt.handshakeAsClient ) { - ns->handshake = ssl2_BeginClientHandshake; - ss->handshaking = sslHandshakingAsClient; - } else { - ns->handshake = ssl2_BeginServerHandshake; - ss->handshaking = sslHandshakingAsServer; - } - } - ns->TCPconnected = 1; - return newfd; - -loser: - if (ns != NULL) - ssl_FreeSocket(ns); - if (newfd != NULL) - PR_Close(newfd); - return NULL; -} - -static PRStatus PR_CALLBACK -ssl_Connect(PRFileDesc *fd, const PRNetAddr *sockaddr, PRIntervalTime timeout) -{ - sslSocket *ss; - PRStatus rv; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in connect", SSL_GETPID(), fd)); - return PR_FAILURE; - } - - /* IF this is a listen socket, there shouldn't be any I/O going on */ - SSL_LOCK_READER(ss); - SSL_LOCK_WRITER(ss); - - ss->cTimeout = timeout; - rv = (PRStatus)(*ss->ops->connect)(ss, sockaddr); -#ifdef _WIN32 - PR_Sleep(PR_INTERVAL_NO_WAIT); /* workaround NT winsock connect bug. */ -#endif - - SSL_UNLOCK_WRITER(ss); - SSL_UNLOCK_READER(ss); - - return rv; -} - -static PRStatus PR_CALLBACK -ssl_Bind(PRFileDesc *fd, const PRNetAddr *addr) -{ - sslSocket * ss = ssl_GetPrivate(fd); - PRStatus rv; - - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in bind", SSL_GETPID(), fd)); - return PR_FAILURE; - } - SSL_LOCK_READER(ss); - SSL_LOCK_WRITER(ss); - - rv = (PRStatus)(*ss->ops->bind)(ss, addr); - - SSL_UNLOCK_WRITER(ss); - SSL_UNLOCK_READER(ss); - return rv; -} - -static PRStatus PR_CALLBACK -ssl_Listen(PRFileDesc *fd, PRIntn backlog) -{ - sslSocket * ss = ssl_GetPrivate(fd); - PRStatus rv; - - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in listen", SSL_GETPID(), fd)); - return PR_FAILURE; - } - SSL_LOCK_READER(ss); - SSL_LOCK_WRITER(ss); - - rv = (PRStatus)(*ss->ops->listen)(ss, backlog); - - SSL_UNLOCK_WRITER(ss); - SSL_UNLOCK_READER(ss); - return rv; -} - -static PRStatus PR_CALLBACK -ssl_Shutdown(PRFileDesc *fd, PRIntn how) -{ - sslSocket * ss = ssl_GetPrivate(fd); - PRStatus rv; - - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in shutdown", SSL_GETPID(), fd)); - return PR_FAILURE; - } - if (how == PR_SHUTDOWN_RCV || how == PR_SHUTDOWN_BOTH) { - SSL_LOCK_READER(ss); - } - if (how == PR_SHUTDOWN_SEND || how == PR_SHUTDOWN_BOTH) { - SSL_LOCK_WRITER(ss); - } - - rv = (PRStatus)(*ss->ops->shutdown)(ss, how); - - if (how == PR_SHUTDOWN_SEND || how == PR_SHUTDOWN_BOTH) { - SSL_UNLOCK_WRITER(ss); - } - if (how == PR_SHUTDOWN_RCV || how == PR_SHUTDOWN_BOTH) { - SSL_UNLOCK_READER(ss); - } - return rv; -} - -static PRStatus PR_CALLBACK -ssl_Close(PRFileDesc *fd) -{ - sslSocket *ss; - PRStatus rv; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in close", SSL_GETPID(), fd)); - return PR_FAILURE; - } - - /* There must not be any I/O going on */ - SSL_LOCK_READER(ss); - SSL_LOCK_WRITER(ss); - - /* By the time this function returns, - ** ss is an invalid pointer, and the locks to which it points have - ** been unlocked and freed. So, this is the ONE PLACE in all of SSL - ** where the LOCK calls and the corresponding UNLOCK calls are not in - ** the same function scope. The unlock calls are in ssl_FreeSocket(). - */ - rv = (PRStatus)(*ss->ops->close)(ss); - - return rv; -} - -static int PR_CALLBACK -ssl_Recv(PRFileDesc *fd, void *buf, PRInt32 len, PRIntn flags, - PRIntervalTime timeout) -{ - sslSocket *ss; - int rv; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in recv", SSL_GETPID(), fd)); - return SECFailure; - } - SSL_LOCK_READER(ss); - ss->rTimeout = timeout; - if (!ss->opt.fdx) - ss->wTimeout = timeout; - rv = (*ss->ops->recv)(ss, (unsigned char*)buf, len, flags); - SSL_UNLOCK_READER(ss); - return rv; -} - -static int PR_CALLBACK -ssl_Send(PRFileDesc *fd, const void *buf, PRInt32 len, PRIntn flags, - PRIntervalTime timeout) -{ - sslSocket *ss; - int rv; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in send", SSL_GETPID(), fd)); - return SECFailure; - } - SSL_LOCK_WRITER(ss); - ss->wTimeout = timeout; - if (!ss->opt.fdx) - ss->rTimeout = timeout; - rv = (*ss->ops->send)(ss, (const unsigned char*)buf, len, flags); - SSL_UNLOCK_WRITER(ss); - return rv; -} - -static int PR_CALLBACK -ssl_Read(PRFileDesc *fd, void *buf, PRInt32 len) -{ - sslSocket *ss; - int rv; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in read", SSL_GETPID(), fd)); - return SECFailure; - } - SSL_LOCK_READER(ss); - ss->rTimeout = PR_INTERVAL_NO_TIMEOUT; - if (!ss->opt.fdx) - ss->wTimeout = PR_INTERVAL_NO_TIMEOUT; - rv = (*ss->ops->read)(ss, (unsigned char*)buf, len); - SSL_UNLOCK_READER(ss); - return rv; -} - -static int PR_CALLBACK -ssl_Write(PRFileDesc *fd, const void *buf, PRInt32 len) -{ - sslSocket *ss; - int rv; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in write", SSL_GETPID(), fd)); - return SECFailure; - } - SSL_LOCK_WRITER(ss); - ss->wTimeout = PR_INTERVAL_NO_TIMEOUT; - if (!ss->opt.fdx) - ss->rTimeout = PR_INTERVAL_NO_TIMEOUT; - rv = (*ss->ops->write)(ss, (const unsigned char*)buf, len); - SSL_UNLOCK_WRITER(ss); - return rv; -} - -static PRStatus PR_CALLBACK -ssl_GetPeerName(PRFileDesc *fd, PRNetAddr *addr) -{ - sslSocket *ss; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in getpeername", SSL_GETPID(), fd)); - return PR_FAILURE; - } - return (PRStatus)(*ss->ops->getpeername)(ss, addr); -} - -/* -*/ -SECStatus -ssl_GetPeerInfo(sslSocket *ss) -{ - PRFileDesc * osfd; - int rv; - PRNetAddr sin; - - osfd = ss->fd->lower; - - PORT_Memset(&sin, 0, sizeof(sin)); - rv = osfd->methods->getpeername(osfd, &sin); - if (rv < 0) { - return SECFailure; - } - ss->TCPconnected = 1; - if (sin.inet.family == PR_AF_INET) { - PR_ConvertIPv4AddrToIPv6(sin.inet.ip, &ss->sec.ci.peer); - ss->sec.ci.port = sin.inet.port; - } else if (sin.ipv6.family == PR_AF_INET6) { - ss->sec.ci.peer = sin.ipv6.ip; - ss->sec.ci.port = sin.ipv6.port; - } else { - PORT_SetError(PR_ADDRESS_NOT_SUPPORTED_ERROR); - return SECFailure; - } - return SECSuccess; -} - -static PRStatus PR_CALLBACK -ssl_GetSockName(PRFileDesc *fd, PRNetAddr *name) -{ - sslSocket *ss; - - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in getsockname", SSL_GETPID(), fd)); - return PR_FAILURE; - } - return (PRStatus)(*ss->ops->getsockname)(ss, name); -} - -SECStatus PR_CALLBACK -SSL_SetSockPeerID(PRFileDesc *fd, char *peerID) -{ - sslSocket *ss; - - ss = ssl_FindSocket(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetCacheIndex", - SSL_GETPID(), fd)); - return SECFailure; - } - - if (ss->peerID) { - PORT_Free(ss->peerID); - ss->peerID = NULL; - } - if (peerID) - ss->peerID = PORT_Strdup(peerID); - return (ss->peerID || !peerID) ? SECSuccess : SECFailure; -} - -#define PR_POLL_RW (PR_POLL_WRITE | PR_POLL_READ) - -static PRInt16 PR_CALLBACK -ssl_Poll(PRFileDesc *fd, PRInt16 how_flags, PRInt16 *p_out_flags) -{ - sslSocket *ss; - PRInt16 new_flags = how_flags; /* should select on these flags. */ - PRNetAddr addr; - - *p_out_flags = 0; - ss = ssl_GetPrivate(fd); - if (!ss) { - SSL_DBG(("%d: SSL[%d]: bad socket in SSL_Poll", - SSL_GETPID(), fd)); - return 0; /* don't poll on this socket */ - } - - if (ss->opt.useSecurity && - ss->handshaking != sslHandshakingUndetermined && - !ss->firstHsDone && - (how_flags & PR_POLL_RW)) { - if (!ss->TCPconnected) { - ss->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ss, &addr)); - } - /* If it's not connected, then presumably the application is polling - ** on read or write appropriately, so don't change it. - */ - if (ss->TCPconnected) { - if (!ss->handshakeBegun) { - /* If the handshake has not begun, poll on read or write - ** based on the local application's role in the handshake, - ** not based on what the application requested. - */ - new_flags &= ~PR_POLL_RW; - if (ss->handshaking == sslHandshakingAsClient) { - new_flags |= PR_POLL_WRITE; - } else { /* handshaking as server */ - new_flags |= PR_POLL_READ; - } - } else - /* First handshake is in progress */ - if (ss->lastWriteBlocked) { - if (new_flags & PR_POLL_READ) { - /* The caller is waiting for data to be received, - ** but the initial handshake is blocked on write, or the - ** client's first handshake record has not been written. - ** The code should select on write, not read. - */ - new_flags ^= PR_POLL_READ; /* don't select on read. */ - new_flags |= PR_POLL_WRITE; /* do select on write. */ - } - } else if (new_flags & PR_POLL_WRITE) { - /* The caller is trying to write, but the handshake is - ** blocked waiting for data to read, and the first - ** handshake has been sent. so do NOT to poll on write. - */ - new_flags ^= PR_POLL_WRITE; /* don't select on write. */ - new_flags |= PR_POLL_READ; /* do select on read. */ - } - } - } else if ((new_flags & PR_POLL_READ) && (SSL_DataPending(fd) > 0)) { - *p_out_flags = PR_POLL_READ; /* it's ready already. */ - return new_flags; - } else if ((ss->lastWriteBlocked) && (how_flags & PR_POLL_READ) && - (ss->pendingBuf.len != 0)) { /* write data waiting to be sent */ - new_flags |= PR_POLL_WRITE; /* also select on write. */ - } - if (new_flags && (fd->lower->methods->poll != NULL)) { - PRInt16 lower_out_flags = 0; - PRInt16 lower_new_flags; - lower_new_flags = fd->lower->methods->poll(fd->lower, new_flags, - &lower_out_flags); - if ((lower_new_flags & lower_out_flags) && (how_flags != new_flags)) { - PRInt16 out_flags = lower_out_flags & ~PR_POLL_RW; - if (lower_out_flags & PR_POLL_READ) - out_flags |= PR_POLL_WRITE; - if (lower_out_flags & PR_POLL_WRITE) - out_flags |= PR_POLL_READ; - *p_out_flags = out_flags; - new_flags = how_flags; - } else { - *p_out_flags = lower_out_flags; - new_flags = lower_new_flags; - } - } - - return new_flags; -} - -static PRInt32 PR_CALLBACK -ssl_TransmitFile(PRFileDesc *sd, PRFileDesc *fd, - const void *headers, PRInt32 hlen, - PRTransmitFileFlags flags, PRIntervalTime timeout) -{ - PRSendFileData sfd; - - sfd.fd = fd; - sfd.file_offset = 0; - sfd.file_nbytes = 0; - sfd.header = headers; - sfd.hlen = hlen; - sfd.trailer = NULL; - sfd.tlen = 0; - - return sd->methods->sendfile(sd, &sfd, flags, timeout); -} - - -PRBool -ssl_FdIsBlocking(PRFileDesc *fd) -{ - PRSocketOptionData opt; - PRStatus status; - - opt.option = PR_SockOpt_Nonblocking; - opt.value.non_blocking = PR_FALSE; - status = PR_GetSocketOption(fd, &opt); - if (status != PR_SUCCESS) - return PR_FALSE; - return (PRBool)!opt.value.non_blocking; -} - -PRBool -ssl_SocketIsBlocking(sslSocket *ss) -{ - return ssl_FdIsBlocking(ss->fd); -} - -PRInt32 sslFirstBufSize = 8 * 1024; -PRInt32 sslCopyLimit = 1024; - -static PRInt32 PR_CALLBACK -ssl_WriteV(PRFileDesc *fd, const PRIOVec *iov, PRInt32 vectors, - PRIntervalTime timeout) -{ - PRInt32 bufLen; - PRInt32 left; - PRInt32 rv; - PRInt32 sent = 0; - const PRInt32 first_len = sslFirstBufSize; - const PRInt32 limit = sslCopyLimit; - PRBool blocking; - PRIOVec myIov = { 0, 0 }; - char buf[MAX_FRAGMENT_LENGTH]; - - if (vectors > PR_MAX_IOVECTOR_SIZE) { - PORT_SetError(PR_BUFFER_OVERFLOW_ERROR); - return -1; - } - blocking = ssl_FdIsBlocking(fd); - -#define K16 sizeof(buf) -#define KILL_VECTORS while (vectors && !iov->iov_len) { ++iov; --vectors; } -#define GET_VECTOR do { myIov = *iov++; --vectors; KILL_VECTORS } while (0) -#define HANDLE_ERR(rv, len) \ - if (rv != len) { \ - if (rv < 0) { \ - if (!blocking \ - && (PR_GetError() == PR_WOULD_BLOCK_ERROR) \ - && (sent > 0)) { \ - return sent; \ - } else { \ - return -1; \ - } \ - } \ - /* Only a nonblocking socket can have partial sends */ \ - PR_ASSERT(!blocking); \ - return sent + rv; \ - } -#define SEND(bfr, len) \ - do { \ - rv = ssl_Send(fd, bfr, len, 0, timeout); \ - HANDLE_ERR(rv, len) \ - sent += len; \ - } while (0) - - /* Make sure the first write is at least 8 KB, if possible. */ - KILL_VECTORS - if (!vectors) - return ssl_Send(fd, 0, 0, 0, timeout); - GET_VECTOR; - if (!vectors) { - return ssl_Send(fd, myIov.iov_base, myIov.iov_len, 0, timeout); - } - if (myIov.iov_len < first_len) { - PORT_Memcpy(buf, myIov.iov_base, myIov.iov_len); - bufLen = myIov.iov_len; - left = first_len - bufLen; - while (vectors && left) { - int toCopy; - GET_VECTOR; - toCopy = PR_MIN(left, myIov.iov_len); - PORT_Memcpy(buf + bufLen, myIov.iov_base, toCopy); - bufLen += toCopy; - left -= toCopy; - myIov.iov_base += toCopy; - myIov.iov_len -= toCopy; - } - SEND( buf, bufLen ); - } - - while (vectors || myIov.iov_len) { - PRInt32 addLen; - if (!myIov.iov_len) { - GET_VECTOR; - } - while (myIov.iov_len >= K16) { - SEND(myIov.iov_base, K16); - myIov.iov_base += K16; - myIov.iov_len -= K16; - } - if (!myIov.iov_len) - continue; - - if (!vectors || myIov.iov_len > limit) { - addLen = 0; - } else if ((addLen = iov->iov_len % K16) + myIov.iov_len <= limit) { - /* Addlen is already computed. */; - } else if (vectors > 1 && - iov[1].iov_len % K16 + addLen + myIov.iov_len <= 2 * limit) { - addLen = limit - myIov.iov_len; - } else - addLen = 0; - - if (!addLen) { - SEND( myIov.iov_base, myIov.iov_len ); - myIov.iov_len = 0; - continue; - } - PORT_Memcpy(buf, myIov.iov_base, myIov.iov_len); - bufLen = myIov.iov_len; - do { - GET_VECTOR; - PORT_Memcpy(buf + bufLen, myIov.iov_base, addLen); - myIov.iov_base += addLen; - myIov.iov_len -= addLen; - bufLen += addLen; - - left = PR_MIN( limit, K16 - bufLen); - if (!vectors /* no more left */ - || myIov.iov_len > 0 /* we didn't use that one all up */ - || bufLen >= K16 /* it's full. */ - ) { - addLen = 0; - } else if ((addLen = iov->iov_len % K16) <= left) { - /* Addlen is already computed. */; - } else if (vectors > 1 && - iov[1].iov_len % K16 + addLen <= left + limit) { - addLen = left; - } else - addLen = 0; - - } while (addLen); - SEND( buf, bufLen ); - } - return sent; -} - -/* - * These functions aren't implemented. - */ - -static PRInt32 PR_CALLBACK -ssl_Available(PRFileDesc *fd) -{ - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return SECFailure; -} - -static PRInt64 PR_CALLBACK -ssl_Available64(PRFileDesc *fd) -{ - PRInt64 res; - - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - LL_I2L(res, -1L); - return res; -} - -static PRStatus PR_CALLBACK -ssl_FSync(PRFileDesc *fd) -{ - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return PR_FAILURE; -} - -static PRInt32 PR_CALLBACK -ssl_Seek(PRFileDesc *fd, PRInt32 offset, PRSeekWhence how) { - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return SECFailure; -} - -static PRInt64 PR_CALLBACK -ssl_Seek64(PRFileDesc *fd, PRInt64 offset, PRSeekWhence how) { - PRInt64 res; - - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - LL_I2L(res, -1L); - return res; -} - -static PRStatus PR_CALLBACK -ssl_FileInfo(PRFileDesc *fd, PRFileInfo *info) -{ - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return PR_FAILURE; -} - -static PRStatus PR_CALLBACK -ssl_FileInfo64(PRFileDesc *fd, PRFileInfo64 *info) -{ - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return PR_FAILURE; -} - -static PRInt32 PR_CALLBACK -ssl_RecvFrom(PRFileDesc *fd, void *buf, PRInt32 amount, PRIntn flags, - PRNetAddr *addr, PRIntervalTime timeout) -{ - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return SECFailure; -} - -static PRInt32 PR_CALLBACK -ssl_SendTo(PRFileDesc *fd, const void *buf, PRInt32 amount, PRIntn flags, - const PRNetAddr *addr, PRIntervalTime timeout) -{ - PORT_Assert(0); - PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); - return SECFailure; -} - -static const PRIOMethods ssl_methods = { - PR_DESC_LAYERED, - ssl_Close, /* close */ - ssl_Read, /* read */ - ssl_Write, /* write */ - ssl_Available, /* available */ - ssl_Available64, /* available64 */ - ssl_FSync, /* fsync */ - ssl_Seek, /* seek */ - ssl_Seek64, /* seek64 */ - ssl_FileInfo, /* fileInfo */ - ssl_FileInfo64, /* fileInfo64 */ - ssl_WriteV, /* writev */ - ssl_Connect, /* connect */ - ssl_Accept, /* accept */ - ssl_Bind, /* bind */ - ssl_Listen, /* listen */ - ssl_Shutdown, /* shutdown */ - ssl_Recv, /* recv */ - ssl_Send, /* send */ - ssl_RecvFrom, /* recvfrom */ - ssl_SendTo, /* sendto */ - ssl_Poll, /* poll */ - PR_EmulateAcceptRead, /* acceptread */ - ssl_TransmitFile, /* transmitfile */ - ssl_GetSockName, /* getsockname */ - ssl_GetPeerName, /* getpeername */ - NULL, /* getsockopt OBSOLETE */ - NULL, /* setsockopt OBSOLETE */ - NULL, /* getsocketoption */ - NULL, /* setsocketoption */ - PR_EmulateSendFile, /* Send a (partial) file with header/trailer*/ - NULL, /* reserved for future use */ - NULL, /* reserved for future use */ - NULL, /* reserved for future use */ - NULL, /* reserved for future use */ - NULL /* reserved for future use */ -}; - - -static PRIOMethods combined_methods; - -static void -ssl_SetupIOMethods(void) -{ - PRIOMethods *new_methods = &combined_methods; - const PRIOMethods *nspr_methods = PR_GetDefaultIOMethods(); - const PRIOMethods *my_methods = &ssl_methods; - - *new_methods = *nspr_methods; - - new_methods->file_type = my_methods->file_type; - new_methods->close = my_methods->close; - new_methods->read = my_methods->read; - new_methods->write = my_methods->write; - new_methods->available = my_methods->available; - new_methods->available64 = my_methods->available64; - new_methods->fsync = my_methods->fsync; - new_methods->seek = my_methods->seek; - new_methods->seek64 = my_methods->seek64; - new_methods->fileInfo = my_methods->fileInfo; - new_methods->fileInfo64 = my_methods->fileInfo64; - new_methods->writev = my_methods->writev; - new_methods->connect = my_methods->connect; - new_methods->accept = my_methods->accept; - new_methods->bind = my_methods->bind; - new_methods->listen = my_methods->listen; - new_methods->shutdown = my_methods->shutdown; - new_methods->recv = my_methods->recv; - new_methods->send = my_methods->send; - new_methods->recvfrom = my_methods->recvfrom; - new_methods->sendto = my_methods->sendto; - new_methods->poll = my_methods->poll; - new_methods->acceptread = my_methods->acceptread; - new_methods->transmitfile = my_methods->transmitfile; - new_methods->getsockname = my_methods->getsockname; - new_methods->getpeername = my_methods->getpeername; -/* new_methods->getsocketoption = my_methods->getsocketoption; */ -/* new_methods->setsocketoption = my_methods->setsocketoption; */ - new_methods->sendfile = my_methods->sendfile; - -} - -static PRCallOnceType initIoLayerOnce; - -static PRStatus -ssl_InitIOLayer(void) -{ - ssl_layer_id = PR_GetUniqueIdentity("SSL"); - ssl_SetupIOMethods(); - ssl_inited = PR_TRUE; - return PR_SUCCESS; -} - -static PRStatus -ssl_PushIOLayer(sslSocket *ns, PRFileDesc *stack, PRDescIdentity id) -{ - PRFileDesc *layer = NULL; - PRStatus status; - - if (!ssl_inited) { - PR_CallOnce(&initIoLayerOnce, &ssl_InitIOLayer); - } - - if (ns == NULL) - goto loser; - - layer = PR_CreateIOLayerStub(ssl_layer_id, &combined_methods); - if (layer == NULL) - goto loser; - layer->secret = (PRFilePrivate *)ns; - - /* Here, "stack" points to the PRFileDesc on the top of the stack. - ** "layer" points to a new FD that is to be inserted into the stack. - ** If layer is being pushed onto the top of the stack, then - ** PR_PushIOLayer switches the contents of stack and layer, and then - ** puts stack on top of layer, so that after it is done, the top of - ** stack is the same "stack" as it was before, and layer is now the - ** FD for the former top of stack. - ** After this call, stack always points to the top PRFD on the stack. - ** If this function fails, the contents of stack and layer are as - ** they were before the call. - */ - status = PR_PushIOLayer(stack, id, layer); - if (status != PR_SUCCESS) - goto loser; - - ns->fd = (id == PR_TOP_IO_LAYER) ? stack : layer; - return PR_SUCCESS; - -loser: - if (layer) { - layer->dtor(layer); /* free layer */ - } - return PR_FAILURE; -} - -/* if this fails, caller must destroy socket. */ -static SECStatus -ssl_MakeLocks(sslSocket *ss) -{ - ss->firstHandshakeLock = PZ_NewMonitor(nssILockSSL); - if (!ss->firstHandshakeLock) - goto loser; - ss->ssl3HandshakeLock = PZ_NewMonitor(nssILockSSL); - if (!ss->ssl3HandshakeLock) - goto loser; - ss->specLock = NSSRWLock_New(SSL_LOCK_RANK_SPEC, NULL); - if (!ss->specLock) - goto loser; - ss->recvBufLock = PZ_NewMonitor(nssILockSSL); - if (!ss->recvBufLock) - goto loser; - ss->xmitBufLock = PZ_NewMonitor(nssILockSSL); - if (!ss->xmitBufLock) - goto loser; - ss->writerThread = NULL; - if (ssl_lock_readers) { - ss->recvLock = PZ_NewLock(nssILockSSL); - if (!ss->recvLock) - goto loser; - ss->sendLock = PZ_NewLock(nssILockSSL); - if (!ss->sendLock) - goto loser; - } - return SECSuccess; -loser: - ssl_DestroyLocks(ss); - return SECFailure; -} - -#if (defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS)) && !defined(_WIN32_WCE) -#define NSS_HAVE_GETENV 1 -#endif - -/* -** Create a newsocket structure for a file descriptor. -*/ -static sslSocket * -ssl_NewSocket(PRBool makeLocks) -{ - sslSocket *ss; -#if defined( NSS_HAVE_GETENV ) - static int firsttime = 1; - - if (firsttime) { - char * ev; - firsttime = 0; -#ifdef DEBUG - ev = getenv("SSLDEBUGFILE"); - if (ev && ev[0]) { - ssl_trace_iob = fopen(ev, "w"); - } - if (!ssl_trace_iob) { - ssl_trace_iob = stderr; - } -#ifdef TRACE - ev = getenv("SSLTRACE"); - if (ev && ev[0]) { - ssl_trace = atoi(ev); - SSL_TRACE(("SSL: tracing set to %d", ssl_trace)); - } -#endif /* TRACE */ - ev = getenv("SSLDEBUG"); - if (ev && ev[0]) { - ssl_debug = atoi(ev); - SSL_TRACE(("SSL: debugging set to %d", ssl_debug)); - } -#endif /* DEBUG */ - ev = getenv("SSLBYPASS"); - if (ev && ev[0]) { - ssl_defaults.bypassPKCS11 = (ev[0] == '1'); - SSL_TRACE(("SSL: bypass default set to %d", \ - ssl_defaults.bypassPKCS11)); - } - ev = getenv("SSLFORCELOCKS"); - if (ev && ev[0] == '1') { - ssl_force_locks = PR_TRUE; - ssl_defaults.noLocks = 0; - strcpy(lockStatus + LOCKSTATUS_OFFSET, "FORCED. "); - SSL_TRACE(("SSL: force_locks set to %d", ssl_force_locks)); - } - } -#endif /* NSS_HAVE_GETENV */ - if (ssl_force_locks) - makeLocks = PR_TRUE; - - /* Make a new socket and get it ready */ - ss = (sslSocket*) PORT_ZAlloc(sizeof(sslSocket)); - if (ss) { - /* This should be of type SSLKEAType, but CC on IRIX - * complains during the for loop. - */ - int i; - SECStatus status; - - ss->opt = ssl_defaults; - ss->opt.useSocks = PR_FALSE; - ss->opt.noLocks = !makeLocks; - - ss->peerID = NULL; - ss->rTimeout = PR_INTERVAL_NO_TIMEOUT; - ss->wTimeout = PR_INTERVAL_NO_TIMEOUT; - ss->cTimeout = PR_INTERVAL_NO_TIMEOUT; - ss->cipherSpecs = NULL; - ss->sizeCipherSpecs = 0; /* produced lazily */ - ss->preferredCipher = NULL; - ss->url = NULL; - - for (i=kt_null; i < kt_kea_size; i++) { - sslServerCerts * sc = ss->serverCerts + i; - sc->serverCert = NULL; - sc->serverCertChain = NULL; - sc->serverKeyPair = NULL; - sc->serverKeyBits = 0; - } - ss->stepDownKeyPair = NULL; - ss->dbHandle = CERT_GetDefaultCertDB(); - - /* Provide default implementation of hooks */ - ss->authCertificate = SSL_AuthCertificate; - ss->authCertificateArg = (void *)ss->dbHandle; - ss->getClientAuthData = NULL; - ss->handleBadCert = NULL; - ss->badCertArg = NULL; - ss->pkcs11PinArg = NULL; - - ssl_ChooseOps(ss); - ssl2_InitSocketPolicy(ss); - ssl3_InitSocketPolicy(ss); - - if (makeLocks) { - status = ssl_MakeLocks(ss); - if (status != SECSuccess) - goto loser; - } - status = ssl_CreateSecurityInfo(ss); - if (status != SECSuccess) - goto loser; - status = ssl_InitGather(&ss->gs); - if (status != SECSuccess) { -loser: - ssl_DestroySocketContents(ss); - ssl_DestroyLocks(ss); - PORT_Free(ss); - ss = NULL; - } - } - return ss; -} - diff --git a/security/nss/lib/ssl/sslt.h b/security/nss/lib/ssl/sslt.h deleted file mode 100644 index 210b05304..000000000 --- a/security/nss/lib/ssl/sslt.h +++ /dev/null @@ -1,181 +0,0 @@ -/* - * This file contains prototypes for the public SSL functions. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#ifndef __sslt_h_ -#define __sslt_h_ - -#include "prtypes.h" - -typedef struct SSL3StatisticsStr { - /* statistics from ssl3_SendClientHello (sch) */ - long sch_sid_cache_hits; - long sch_sid_cache_misses; - long sch_sid_cache_not_ok; - - /* statistics from ssl3_HandleServerHello (hsh) */ - long hsh_sid_cache_hits; - long hsh_sid_cache_misses; - long hsh_sid_cache_not_ok; - - /* statistics from ssl3_HandleClientHello (hch) */ - long hch_sid_cache_hits; - long hch_sid_cache_misses; - long hch_sid_cache_not_ok; - - /* statistics related to stateless resume */ - long sch_sid_stateless_resumes; - long hsh_sid_stateless_resumes; - long hch_sid_stateless_resumes; - long hch_sid_ticket_parse_failures; -} SSL3Statistics; - -/* Key Exchange algorithm values */ -typedef enum { - ssl_kea_null = 0, - ssl_kea_rsa = 1, - ssl_kea_dh = 2, - ssl_kea_fortezza = 3, /* deprecated, now unused */ - ssl_kea_ecdh = 4, - ssl_kea_size /* number of ssl_kea_ algorithms */ -} SSLKEAType; - -/* The following defines are for backwards compatibility. -** They will be removed in a forthcoming release to reduce namespace pollution. -** programs that use the kt_ symbols should convert to the ssl_kt_ symbols -** soon. -*/ -#define kt_null ssl_kea_null -#define kt_rsa ssl_kea_rsa -#define kt_dh ssl_kea_dh -#define kt_fortezza ssl_kea_fortezza /* deprecated, now unused */ -#define kt_ecdh ssl_kea_ecdh -#define kt_kea_size ssl_kea_size - -typedef enum { - ssl_sign_null = 0, - ssl_sign_rsa = 1, - ssl_sign_dsa = 2, - ssl_sign_ecdsa = 3 -} SSLSignType; - -typedef enum { - ssl_auth_null = 0, - ssl_auth_rsa = 1, - ssl_auth_dsa = 2, - ssl_auth_kea = 3, - ssl_auth_ecdsa = 4 -} SSLAuthType; - -typedef enum { - ssl_calg_null = 0, - ssl_calg_rc4 = 1, - ssl_calg_rc2 = 2, - ssl_calg_des = 3, - ssl_calg_3des = 4, - ssl_calg_idea = 5, - ssl_calg_fortezza = 6, /* deprecated, now unused */ - ssl_calg_aes = 7, /* coming soon */ - ssl_calg_camellia = 8, - ssl_calg_seed = 9 -} SSLCipherAlgorithm; - -typedef enum { - ssl_mac_null = 0, - ssl_mac_md5 = 1, - ssl_mac_sha = 2, - ssl_hmac_md5 = 3, /* TLS HMAC version of mac_md5 */ - ssl_hmac_sha = 4 /* TLS HMAC version of mac_sha */ -} SSLMACAlgorithm; - -typedef struct SSLChannelInfoStr { - PRUint32 length; - PRUint16 protocolVersion; - PRUint16 cipherSuite; - - /* server authentication info */ - PRUint32 authKeyBits; - - /* key exchange algorithm info */ - PRUint32 keaKeyBits; - - /* session info */ - PRUint32 creationTime; /* seconds since Jan 1, 1970 */ - PRUint32 lastAccessTime; /* seconds since Jan 1, 1970 */ - PRUint32 expirationTime; /* seconds since Jan 1, 1970 */ - PRUint32 sessionIDLength; /* up to 32 */ - PRUint8 sessionID [32]; -} SSLChannelInfo; - -typedef struct SSLCipherSuiteInfoStr { - PRUint16 length; - PRUint16 cipherSuite; - - /* Cipher Suite Name */ - const char * cipherSuiteName; - - /* server authentication info */ - const char * authAlgorithmName; - SSLAuthType authAlgorithm; - - /* key exchange algorithm info */ - const char * keaTypeName; - SSLKEAType keaType; - - /* symmetric encryption info */ - const char * symCipherName; - SSLCipherAlgorithm symCipher; - PRUint16 symKeyBits; - PRUint16 symKeySpace; - PRUint16 effectiveKeyBits; - - /* MAC info */ - const char * macAlgorithmName; - SSLMACAlgorithm macAlgorithm; - PRUint16 macBits; - - PRUintn isFIPS : 1; - PRUintn isExportable : 1; - PRUintn nonStandard : 1; - PRUintn reservedBits :29; - -} SSLCipherSuiteInfo; - -#endif /* __sslt_h_ */ diff --git a/security/nss/lib/ssl/ssltrace.c b/security/nss/lib/ssl/ssltrace.c deleted file mode 100644 index 30d25f2f9..000000000 --- a/security/nss/lib/ssl/ssltrace.c +++ /dev/null @@ -1,276 +0,0 @@ -/* - * Functions to trace SSL protocol behavior in DEBUG builds. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ -#include <stdarg.h> -#include "cert.h" -#include "ssl.h" -#include "sslimpl.h" -#include "sslproto.h" -#include "prprf.h" - -#if defined(DEBUG) || defined(TRACE) -static const char *hex = "0123456789abcdef"; - -static const char printable[257] = { - "................" /* 0x */ - "................" /* 1x */ - " !\"#$%&'()*+,-./" /* 2x */ - "0123456789:;<=>?" /* 3x */ - "@ABCDEFGHIJKLMNO" /* 4x */ - "PQRSTUVWXYZ[\\]^_" /* 5x */ - "`abcdefghijklmno" /* 6x */ - "pqrstuvwxyz{|}~." /* 7x */ - "................" /* 8x */ - "................" /* 9x */ - "................" /* ax */ - "................" /* bx */ - "................" /* cx */ - "................" /* dx */ - "................" /* ex */ - "................" /* fx */ -}; - -void ssl_PrintBuf(sslSocket *ss, const char *msg, const void *vp, int len) -{ - const unsigned char *cp = (const unsigned char *)vp; - char buf[80]; - char *bp; - char *ap; - - if (ss) { - SSL_TRACE(("%d: SSL[%d]: %s [Len: %d]", SSL_GETPID(), ss->fd, - msg, len)); - } else { - SSL_TRACE(("%d: SSL: %s [Len: %d]", SSL_GETPID(), msg, len)); - } - memset(buf, ' ', sizeof buf); - bp = buf; - ap = buf + 50; - while (--len >= 0) { - unsigned char ch = *cp++; - *bp++ = hex[(ch >> 4) & 0xf]; - *bp++ = hex[ch & 0xf]; - *bp++ = ' '; - *ap++ = printable[ch]; - if (ap - buf >= 66) { - *ap = 0; - SSL_TRACE((" %s", buf)); - memset(buf, ' ', sizeof buf); - bp = buf; - ap = buf + 50; - } - } - if (bp > buf) { - *ap = 0; - SSL_TRACE((" %s", buf)); - } -} - -#define LEN(cp) (((cp)[0] << 8) | ((cp)[1])) - -static void PrintType(sslSocket *ss, char *msg) -{ - if (ss) { - SSL_TRACE(("%d: SSL[%d]: dump-msg: %s", SSL_GETPID(), ss->fd, - msg)); - } else { - SSL_TRACE(("%d: SSL: dump-msg: %s", SSL_GETPID(), msg)); - } -} - -static void PrintInt(sslSocket *ss, char *msg, unsigned v) -{ - if (ss) { - SSL_TRACE(("%d: SSL[%d]: %s=%u", SSL_GETPID(), ss->fd, - msg, v)); - } else { - SSL_TRACE(("%d: SSL: %s=%u", SSL_GETPID(), msg, v)); - } -} - -/* PrintBuf is just like ssl_PrintBuf above, except that: - * a) It prefixes each line of the buffer with "XX: SSL[xxx] " - * b) It dumps only hex, not ASCII. - */ -static void PrintBuf(sslSocket *ss, char *msg, unsigned char *cp, int len) -{ - char buf[80]; - char *bp; - - if (ss) { - SSL_TRACE(("%d: SSL[%d]: %s [Len: %d]", - SSL_GETPID(), ss->fd, msg, len)); - } else { - SSL_TRACE(("%d: SSL: %s [Len: %d]", - SSL_GETPID(), msg, len)); - } - bp = buf; - while (--len >= 0) { - unsigned char ch = *cp++; - *bp++ = hex[(ch >> 4) & 0xf]; - *bp++ = hex[ch & 0xf]; - *bp++ = ' '; - if (bp + 4 > buf + 50) { - *bp = 0; - if (ss) { - SSL_TRACE(("%d: SSL[%d]: %s", - SSL_GETPID(), ss->fd, buf)); - } else { - SSL_TRACE(("%d: SSL: %s", SSL_GETPID(), buf)); - } - bp = buf; - } - } - if (bp > buf) { - *bp = 0; - if (ss) { - SSL_TRACE(("%d: SSL[%d]: %s", - SSL_GETPID(), ss->fd, buf)); - } else { - SSL_TRACE(("%d: SSL: %s", SSL_GETPID(), buf)); - } - } -} - -void ssl_DumpMsg(sslSocket *ss, unsigned char *bp, unsigned len) -{ - switch (bp[0]) { - case SSL_MT_ERROR: - PrintType(ss, "Error"); - PrintInt(ss, "error", LEN(bp+1)); - break; - - case SSL_MT_CLIENT_HELLO: - { - unsigned lcs = LEN(bp+3); - unsigned ls = LEN(bp+5); - unsigned lc = LEN(bp+7); - - PrintType(ss, "Client-Hello"); - - PrintInt(ss, "version (Major)", bp[1]); - PrintInt(ss, "version (minor)", bp[2]); - - PrintBuf(ss, "cipher-specs", bp+9, lcs); - PrintBuf(ss, "session-id", bp+9+lcs, ls); - PrintBuf(ss, "challenge", bp+9+lcs+ls, lc); - } - break; - case SSL_MT_CLIENT_MASTER_KEY: - { - unsigned lck = LEN(bp+4); - unsigned lek = LEN(bp+6); - unsigned lka = LEN(bp+8); - - PrintType(ss, "Client-Master-Key"); - - PrintInt(ss, "cipher-choice", bp[1]); - PrintInt(ss, "key-length", LEN(bp+2)); - - PrintBuf(ss, "clear-key", bp+10, lck); - PrintBuf(ss, "encrypted-key", bp+10+lck, lek); - PrintBuf(ss, "key-arg", bp+10+lck+lek, lka); - } - break; - case SSL_MT_CLIENT_FINISHED: - PrintType(ss, "Client-Finished"); - PrintBuf(ss, "connection-id", bp+1, len-1); - break; - case SSL_MT_SERVER_HELLO: - { - unsigned lc = LEN(bp+5); - unsigned lcs = LEN(bp+7); - unsigned lci = LEN(bp+9); - - PrintType(ss, "Server-Hello"); - - PrintInt(ss, "session-id-hit", bp[1]); - PrintInt(ss, "certificate-type", bp[2]); - PrintInt(ss, "version (Major)", bp[3]); - PrintInt(ss, "version (minor)", bp[3]); - PrintBuf(ss, "certificate", bp+11, lc); - PrintBuf(ss, "cipher-specs", bp+11+lc, lcs); - PrintBuf(ss, "connection-id", bp+11+lc+lcs, lci); - } - break; - case SSL_MT_SERVER_VERIFY: - PrintType(ss, "Server-Verify"); - PrintBuf(ss, "challenge", bp+1, len-1); - break; - case SSL_MT_SERVER_FINISHED: - PrintType(ss, "Server-Finished"); - PrintBuf(ss, "session-id", bp+1, len-1); - break; - case SSL_MT_REQUEST_CERTIFICATE: - PrintType(ss, "Request-Certificate"); - PrintInt(ss, "authentication-type", bp[1]); - PrintBuf(ss, "certificate-challenge", bp+2, len-2); - break; - case SSL_MT_CLIENT_CERTIFICATE: - { - unsigned lc = LEN(bp+2); - unsigned lr = LEN(bp+4); - PrintType(ss, "Client-Certificate"); - PrintInt(ss, "certificate-type", bp[1]); - PrintBuf(ss, "certificate", bp+6, lc); - PrintBuf(ss, "response", bp+6+lc, lr); - } - break; - default: - ssl_PrintBuf(ss, "sending *unknown* message type", bp, len); - return; - } -} - -void -ssl_Trace(const char *format, ... ) -{ - char buf[2000]; - va_list args; - - if (ssl_trace_iob) { - va_start(args, format); - PR_vsnprintf(buf, sizeof(buf), format, args); - va_end(args); - - fputs(buf, ssl_trace_iob); - fputs("\n", ssl_trace_iob); - } -} -#endif diff --git a/security/nss/lib/ssl/sslver.c b/security/nss/lib/ssl/sslver.c deleted file mode 100644 index 782048fd8..000000000 --- a/security/nss/lib/ssl/sslver.c +++ /dev/null @@ -1,56 +0,0 @@ -/* ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 2001 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ - -/* Library identity and versioning */ - -#include "nss.h" - -#if defined(DEBUG) -#define _DEBUG_STRING " (debug)" -#else -#define _DEBUG_STRING "" -#endif - -/* - * Version information for the 'ident' and 'what commands - * - * NOTE: the first component of the concatenated rcsid string - * must not end in a '$' to prevent rcs keyword substitution. - */ -const char __nss_ssl_rcsid[] = "$Header: NSS " NSS_VERSION _DEBUG_STRING - " " __DATE__ " " __TIME__ " $"; -const char __nss_ssl_sccsid[] = "@(#)NSS " NSS_VERSION _DEBUG_STRING - " " __DATE__ " " __TIME__; diff --git a/security/nss/lib/ssl/unix_err.c b/security/nss/lib/ssl/unix_err.c deleted file mode 100644 index 6fb2583ef..000000000 --- a/security/nss/lib/ssl/unix_err.c +++ /dev/null @@ -1,550 +0,0 @@ -/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ -/* - * This file essentially replicates NSPR's source for the functions that - * map system-specific error codes to NSPR error codes. We would use - * NSPR's functions, instead of duplicating them, but they're private. - * As long as SSL's server session cache code must do platform native I/O - * to accomplish its job, and NSPR's error mapping functions remain private, - * this code will continue to need to be replicated. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#if 0 -#include "primpl.h" -#else -#define _PR_POLL_AVAILABLE 1 -#include "prerror.h" -#endif - -#if defined (__bsdi__) || defined(NTO) || defined(DARWIN) || defined(BEOS) -#undef _PR_POLL_AVAILABLE -#endif - -#if defined(_PR_POLL_AVAILABLE) -#include <poll.h> -#endif -#include <errno.h> - -/* forward declarations. */ -void nss_MD_unix_map_default_error(int err); - -void nss_MD_unix_map_opendir_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_closedir_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_BAD_DESCRIPTOR_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_readdir_error(int err) -{ - PRErrorCode prError; - - switch (err) { - case ENOENT: prError = PR_NO_MORE_FILES_ERROR; break; -#ifdef EOVERFLOW - case EOVERFLOW: prError = PR_IO_ERROR; break; -#endif - case EINVAL: prError = PR_IO_ERROR; break; - case ENXIO: prError = PR_IO_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_unlink_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EPERM: prError = PR_IS_DIRECTORY_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_stat_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_fstat_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_rename_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EEXIST: prError = PR_DIRECTORY_NOT_EMPTY_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_access_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_mkdir_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_rmdir_error(int err) -{ - PRErrorCode prError; - - switch (err) { - case EEXIST: prError = PR_DIRECTORY_NOT_EMPTY_ERROR; break; - case EINVAL: prError = PR_DIRECTORY_NOT_EMPTY_ERROR; break; - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_read_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_INVALID_METHOD_ERROR; break; - case ENXIO: prError = PR_INVALID_ARGUMENT_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_write_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_INVALID_METHOD_ERROR; break; - case ENXIO: prError = PR_INVALID_METHOD_ERROR; break; - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_lseek_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_fsync_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - case EINVAL: prError = PR_INVALID_METHOD_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_close_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_socket_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_socketavailable_error(int err) -{ - PR_SetError(PR_BAD_DESCRIPTOR_ERROR, err); -} - -void nss_MD_unix_map_recv_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_recvfrom_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_send_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_sendto_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_writev_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_accept_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ENODEV: prError = PR_NOT_TCP_SOCKET_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_connect_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EACCES: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; -#if defined(UNIXWARE) || defined(SNI) || defined(NEC) - /* - * On some platforms, if we connect to a port on the local host - * (the loopback address) that no process is listening on, we get - * EIO instead of ECONNREFUSED. - */ - case EIO: prError = PR_CONNECT_REFUSED_ERROR; break; -#endif - case ELOOP: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case ENOENT: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case ENXIO: prError = PR_IO_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_bind_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_SOCKET_ADDRESS_IS_BOUND_ERROR; break; - /* - * UNIX domain sockets are not supported in NSPR - */ - case EIO: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case EISDIR: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case ELOOP: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case ENOENT: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case ENOTDIR: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case EROFS: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_listen_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_shutdown_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_socketpair_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_getsockname_error(int err) -{ - PRErrorCode prError; - switch (err) { - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_getpeername_error(int err) -{ - PRErrorCode prError; - - switch (err) { - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_getsockopt_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_BUFFER_OVERFLOW_ERROR; break; - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_setsockopt_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_BUFFER_OVERFLOW_ERROR; break; - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_open_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EAGAIN: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case EBUSY: prError = PR_IO_ERROR; break; - case ENODEV: prError = PR_FILE_NOT_FOUND_ERROR; break; - case ENOMEM: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case ETIMEDOUT: prError = PR_REMOTE_FILE_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_mmap_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EAGAIN: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case EMFILE: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case ENODEV: prError = PR_OPERATION_NOT_SUPPORTED_ERROR; break; - case ENXIO: prError = PR_INVALID_ARGUMENT_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_gethostname_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -void nss_MD_unix_map_select_error(int err) -{ - nss_MD_unix_map_default_error(err); -} - -#ifdef _PR_POLL_AVAILABLE -void nss_MD_unix_map_poll_error(int err) -{ - PRErrorCode prError; - - switch (err) { - case EAGAIN: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_poll_revents_error(int err) -{ - if (err & POLLNVAL) - PR_SetError(PR_BAD_DESCRIPTOR_ERROR, EBADF); - else if (err & POLLHUP) - PR_SetError(PR_CONNECT_RESET_ERROR, EPIPE); - else if (err & POLLERR) - PR_SetError(PR_IO_ERROR, EIO); - else - PR_SetError(PR_UNKNOWN_ERROR, err); -} -#endif /* _PR_POLL_AVAILABLE */ - - -void nss_MD_unix_map_flock_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EINVAL: prError = PR_BAD_DESCRIPTOR_ERROR; break; - case EWOULDBLOCK: prError = PR_FILE_IS_LOCKED_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_unix_map_lockf_error(int err) -{ - PRErrorCode prError; - switch (err) { - case EACCES: prError = PR_FILE_IS_LOCKED_ERROR; break; - case EDEADLK: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - default: nss_MD_unix_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -#ifdef HPUX11 -void nss_MD_hpux_map_sendfile_error(int err) -{ - nss_MD_unix_map_default_error(err); -} -#endif /* HPUX11 */ - - -void nss_MD_unix_map_default_error(int err) -{ - PRErrorCode prError; - switch (err ) { - case EACCES: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; - case EADDRINUSE: prError = PR_ADDRESS_IN_USE_ERROR; break; - case EADDRNOTAVAIL: prError = PR_ADDRESS_NOT_AVAILABLE_ERROR; break; - case EAFNOSUPPORT: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case EAGAIN: prError = PR_WOULD_BLOCK_ERROR; break; - /* - * On QNX and Neutrino, EALREADY is defined as EBUSY. - */ -#if EALREADY != EBUSY - case EALREADY: prError = PR_ALREADY_INITIATED_ERROR; break; -#endif - case EBADF: prError = PR_BAD_DESCRIPTOR_ERROR; break; -#ifdef EBADMSG - case EBADMSG: prError = PR_IO_ERROR; break; -#endif - case EBUSY: prError = PR_FILESYSTEM_MOUNTED_ERROR; break; - case ECONNREFUSED: prError = PR_CONNECT_REFUSED_ERROR; break; - case ECONNRESET: prError = PR_CONNECT_RESET_ERROR; break; - case EDEADLK: prError = PR_DEADLOCK_ERROR; break; -#ifdef EDIRCORRUPTED - case EDIRCORRUPTED: prError = PR_DIRECTORY_CORRUPTED_ERROR; break; -#endif -#ifdef EDQUOT - case EDQUOT: prError = PR_NO_DEVICE_SPACE_ERROR; break; -#endif - case EEXIST: prError = PR_FILE_EXISTS_ERROR; break; - case EFAULT: prError = PR_ACCESS_FAULT_ERROR; break; - case EFBIG: prError = PR_FILE_TOO_BIG_ERROR; break; - case EINPROGRESS: prError = PR_IN_PROGRESS_ERROR; break; - case EINTR: prError = PR_PENDING_INTERRUPT_ERROR; break; - case EINVAL: prError = PR_INVALID_ARGUMENT_ERROR; break; - case EIO: prError = PR_IO_ERROR; break; - case EISCONN: prError = PR_IS_CONNECTED_ERROR; break; - case EISDIR: prError = PR_IS_DIRECTORY_ERROR; break; - case ELOOP: prError = PR_LOOP_ERROR; break; - case EMFILE: prError = PR_PROC_DESC_TABLE_FULL_ERROR; break; - case EMLINK: prError = PR_MAX_DIRECTORY_ENTRIES_ERROR; break; - case EMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; -#ifdef EMULTIHOP - case EMULTIHOP: prError = PR_REMOTE_FILE_ERROR; break; -#endif - case ENAMETOOLONG: prError = PR_NAME_TOO_LONG_ERROR; break; - case ENETUNREACH: prError = PR_NETWORK_UNREACHABLE_ERROR; break; - case ENFILE: prError = PR_SYS_DESC_TABLE_FULL_ERROR; break; -#if !defined(SCO) - case ENOBUFS: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; -#endif - case ENODEV: prError = PR_FILE_NOT_FOUND_ERROR; break; - case ENOENT: prError = PR_FILE_NOT_FOUND_ERROR; break; - case ENOLCK: prError = PR_FILE_IS_LOCKED_ERROR; break; -#ifdef ENOLINK - case ENOLINK: prError = PR_REMOTE_FILE_ERROR; break; -#endif - case ENOMEM: prError = PR_OUT_OF_MEMORY_ERROR; break; - case ENOPROTOOPT: prError = PR_INVALID_ARGUMENT_ERROR; break; - case ENOSPC: prError = PR_NO_DEVICE_SPACE_ERROR; break; -#ifdef ENOSR - case ENOSR: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; -#endif - case ENOTCONN: prError = PR_NOT_CONNECTED_ERROR; break; - case ENOTDIR: prError = PR_NOT_DIRECTORY_ERROR; break; - case ENOTSOCK: prError = PR_NOT_SOCKET_ERROR; break; - case ENXIO: prError = PR_FILE_NOT_FOUND_ERROR; break; - case EOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; -#ifdef EOVERFLOW - case EOVERFLOW: prError = PR_BUFFER_OVERFLOW_ERROR; break; -#endif - case EPERM: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; - case EPIPE: prError = PR_CONNECT_RESET_ERROR; break; -#ifdef EPROTO - case EPROTO: prError = PR_IO_ERROR; break; -#endif - case EPROTONOSUPPORT: prError = PR_PROTOCOL_NOT_SUPPORTED_ERROR; break; - case EPROTOTYPE: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case ERANGE: prError = PR_INVALID_METHOD_ERROR; break; - case EROFS: prError = PR_READ_ONLY_FILESYSTEM_ERROR; break; - case ESPIPE: prError = PR_INVALID_METHOD_ERROR; break; - case ETIMEDOUT: prError = PR_IO_TIMEOUT_ERROR; break; -#if EWOULDBLOCK != EAGAIN - case EWOULDBLOCK: prError = PR_WOULD_BLOCK_ERROR; break; -#endif - case EXDEV: prError = PR_NOT_SAME_DEVICE_ERROR; break; - - default: prError = PR_UNKNOWN_ERROR; break; - } - PR_SetError(prError, err); -} diff --git a/security/nss/lib/ssl/unix_err.h b/security/nss/lib/ssl/unix_err.h deleted file mode 100644 index 628b856a9..000000000 --- a/security/nss/lib/ssl/unix_err.h +++ /dev/null @@ -1,90 +0,0 @@ -/* - * This file essentially replicates NSPR's source for the functions that - * map system-specific error codes to NSPR error codes. We would use - * NSPR's functions, instead of duplicating them, but they're private. - * As long as SSL's server session cache code must do platform native I/O - * to accomplish its job, and NSPR's error mapping functions remain private, - * this code will continue to need to be replicated. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -/* NSPR doesn't make these functions public, so we have to duplicate -** them in NSS. -*/ -extern void nss_MD_hpux_map_sendfile_error(int err); -extern void nss_MD_unix_map_accept_error(int err); -extern void nss_MD_unix_map_access_error(int err); -extern void nss_MD_unix_map_bind_error(int err); -extern void nss_MD_unix_map_close_error(int err); -extern void nss_MD_unix_map_closedir_error(int err); -extern void nss_MD_unix_map_connect_error(int err); -extern void nss_MD_unix_map_default_error(int err); -extern void nss_MD_unix_map_flock_error(int err); -extern void nss_MD_unix_map_fstat_error(int err); -extern void nss_MD_unix_map_fsync_error(int err); -extern void nss_MD_unix_map_gethostname_error(int err); -extern void nss_MD_unix_map_getpeername_error(int err); -extern void nss_MD_unix_map_getsockname_error(int err); -extern void nss_MD_unix_map_getsockopt_error(int err); -extern void nss_MD_unix_map_listen_error(int err); -extern void nss_MD_unix_map_lockf_error(int err); -extern void nss_MD_unix_map_lseek_error(int err); -extern void nss_MD_unix_map_mkdir_error(int err); -extern void nss_MD_unix_map_mmap_error(int err); -extern void nss_MD_unix_map_open_error(int err); -extern void nss_MD_unix_map_opendir_error(int err); -extern void nss_MD_unix_map_poll_error(int err); -extern void nss_MD_unix_map_poll_revents_error(int err); -extern void nss_MD_unix_map_read_error(int err); -extern void nss_MD_unix_map_readdir_error(int err); -extern void nss_MD_unix_map_recv_error(int err); -extern void nss_MD_unix_map_recvfrom_error(int err); -extern void nss_MD_unix_map_rename_error(int err); -extern void nss_MD_unix_map_rmdir_error(int err); -extern void nss_MD_unix_map_select_error(int err); -extern void nss_MD_unix_map_send_error(int err); -extern void nss_MD_unix_map_sendto_error(int err); -extern void nss_MD_unix_map_setsockopt_error(int err); -extern void nss_MD_unix_map_shutdown_error(int err); -extern void nss_MD_unix_map_socket_error(int err); -extern void nss_MD_unix_map_socketavailable_error(int err); -extern void nss_MD_unix_map_socketpair_error(int err); -extern void nss_MD_unix_map_stat_error(int err); -extern void nss_MD_unix_map_unlink_error(int err); -extern void nss_MD_unix_map_write_error(int err); -extern void nss_MD_unix_map_writev_error(int err); diff --git a/security/nss/lib/ssl/win32err.c b/security/nss/lib/ssl/win32err.c deleted file mode 100644 index 574612d5b..000000000 --- a/security/nss/lib/ssl/win32err.c +++ /dev/null @@ -1,376 +0,0 @@ -/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ -/* - * This file essentially replicates NSPR's source for the functions that - * map system-specific error codes to NSPR error codes. We would use - * NSPR's functions, instead of duplicating them, but they're private. - * As long as SSL's server session cache code must do platform native I/O - * to accomplish its job, and NSPR's error mapping functions remain private, - * this code will continue to need to be replicated. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -#include "prerror.h" -#include "prlog.h" -#include <errno.h> -#include <windows.h> - -/* - * On Win32, we map three kinds of error codes: - * - GetLastError(): for Win32 functions - * - WSAGetLastError(): for Winsock functions - * - errno: for standard C library functions - * - * We do not check for WSAEINPROGRESS and WSAEINTR because we do not - * use blocking Winsock 1.1 calls. - * - * Except for the 'socket' call, we do not check for WSAEINITIALISED. - * It is assumed that if Winsock is not initialized, that fact will - * be detected at the time we create new sockets. - */ - -/* forward declaration. */ -void nss_MD_win32_map_default_error(PRInt32 err); - -void nss_MD_win32_map_opendir_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_closedir_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_readdir_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_delete_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -/* The error code for stat() is in errno. */ -void nss_MD_win32_map_stat_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_fstat_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_rename_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -/* The error code for access() is in errno. */ -void nss_MD_win32_map_access_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_mkdir_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_rmdir_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_read_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_transmitfile_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_write_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_lseek_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_fsync_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -/* - * For both CloseHandle() and closesocket(). - */ -void nss_MD_win32_map_close_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_socket_error(PRInt32 err) -{ - PR_ASSERT(err != WSANOTINITIALISED); - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_recv_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_recvfrom_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_send_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_sendto_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_accept_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; - case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_acceptex_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_connect_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEWOULDBLOCK: prError = PR_IN_PROGRESS_ERROR; break; - case WSAEINVAL: prError = PR_ALREADY_INITIATED_ERROR; break; - case WSAETIMEDOUT: prError = PR_IO_TIMEOUT_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_bind_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEINVAL: prError = PR_SOCKET_ADDRESS_IS_BOUND_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_listen_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; - case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_shutdown_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_getsockname_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_getpeername_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_getsockopt_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_setsockopt_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_open_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -void nss_MD_win32_map_gethostname_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - -/* Win32 select() only works on sockets. So in this -** context, WSAENOTSOCK is equivalent to EBADF on Unix. -*/ -void nss_MD_win32_map_select_error(PRInt32 err) -{ - PRErrorCode prError; - switch (err) { - case WSAENOTSOCK: prError = PR_BAD_DESCRIPTOR_ERROR; break; - default: nss_MD_win32_map_default_error(err); return; - } - PR_SetError(prError, err); -} - -void nss_MD_win32_map_lockf_error(PRInt32 err) -{ - nss_MD_win32_map_default_error(err); -} - - - -void nss_MD_win32_map_default_error(PRInt32 err) -{ - PRErrorCode prError; - - switch (err) { - case EACCES: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; - case ENOENT: prError = PR_FILE_NOT_FOUND_ERROR; break; - case ERROR_ACCESS_DENIED: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; - case ERROR_ALREADY_EXISTS: prError = PR_FILE_EXISTS_ERROR; break; - case ERROR_DISK_CORRUPT: prError = PR_IO_ERROR; break; - case ERROR_DISK_FULL: prError = PR_NO_DEVICE_SPACE_ERROR; break; - case ERROR_DISK_OPERATION_FAILED: prError = PR_IO_ERROR; break; - case ERROR_DRIVE_LOCKED: prError = PR_FILE_IS_LOCKED_ERROR; break; - case ERROR_FILENAME_EXCED_RANGE: prError = PR_NAME_TOO_LONG_ERROR; break; - case ERROR_FILE_CORRUPT: prError = PR_IO_ERROR; break; - case ERROR_FILE_EXISTS: prError = PR_FILE_EXISTS_ERROR; break; - case ERROR_FILE_INVALID: prError = PR_BAD_DESCRIPTOR_ERROR; break; -#if ERROR_FILE_NOT_FOUND != ENOENT - case ERROR_FILE_NOT_FOUND: prError = PR_FILE_NOT_FOUND_ERROR; break; -#endif - case ERROR_HANDLE_DISK_FULL: prError = PR_NO_DEVICE_SPACE_ERROR; break; - case ERROR_INVALID_ADDRESS: prError = PR_ACCESS_FAULT_ERROR; break; - case ERROR_INVALID_HANDLE: prError = PR_BAD_DESCRIPTOR_ERROR; break; - case ERROR_INVALID_NAME: prError = PR_INVALID_ARGUMENT_ERROR; break; - case ERROR_INVALID_PARAMETER: prError = PR_INVALID_ARGUMENT_ERROR; break; - case ERROR_INVALID_USER_BUFFER: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case ERROR_LOCKED: prError = PR_FILE_IS_LOCKED_ERROR; break; - case ERROR_NETNAME_DELETED: prError = PR_CONNECT_RESET_ERROR; break; - case ERROR_NOACCESS: prError = PR_ACCESS_FAULT_ERROR; break; - case ERROR_NOT_ENOUGH_MEMORY: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case ERROR_NOT_ENOUGH_QUOTA: prError = PR_OUT_OF_MEMORY_ERROR; break; - case ERROR_NOT_READY: prError = PR_IO_ERROR; break; - case ERROR_NO_MORE_FILES: prError = PR_NO_MORE_FILES_ERROR; break; - case ERROR_OPEN_FAILED: prError = PR_IO_ERROR; break; - case ERROR_OPEN_FILES: prError = PR_IO_ERROR; break; - case ERROR_OUTOFMEMORY: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case ERROR_PATH_BUSY: prError = PR_IO_ERROR; break; - case ERROR_PATH_NOT_FOUND: prError = PR_FILE_NOT_FOUND_ERROR; break; - case ERROR_SEEK_ON_DEVICE: prError = PR_IO_ERROR; break; - case ERROR_SHARING_VIOLATION: prError = PR_FILE_IS_BUSY_ERROR; break; - case ERROR_STACK_OVERFLOW: prError = PR_ACCESS_FAULT_ERROR; break; - case ERROR_TOO_MANY_OPEN_FILES: prError = PR_SYS_DESC_TABLE_FULL_ERROR; break; - case ERROR_WRITE_PROTECT: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; - case WSAEACCES: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; - case WSAEADDRINUSE: prError = PR_ADDRESS_IN_USE_ERROR; break; - case WSAEADDRNOTAVAIL: prError = PR_ADDRESS_NOT_AVAILABLE_ERROR; break; - case WSAEAFNOSUPPORT: prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; break; - case WSAEALREADY: prError = PR_ALREADY_INITIATED_ERROR; break; - case WSAEBADF: prError = PR_BAD_DESCRIPTOR_ERROR; break; - case WSAECONNABORTED: prError = PR_CONNECT_ABORTED_ERROR; break; - case WSAECONNREFUSED: prError = PR_CONNECT_REFUSED_ERROR; break; - case WSAECONNRESET: prError = PR_CONNECT_RESET_ERROR; break; - case WSAEDESTADDRREQ: prError = PR_INVALID_ARGUMENT_ERROR; break; - case WSAEFAULT: prError = PR_ACCESS_FAULT_ERROR; break; - case WSAEHOSTUNREACH: prError = PR_HOST_UNREACHABLE_ERROR; break; - case WSAEINVAL: prError = PR_INVALID_ARGUMENT_ERROR; break; - case WSAEISCONN: prError = PR_IS_CONNECTED_ERROR; break; - case WSAEMFILE: prError = PR_PROC_DESC_TABLE_FULL_ERROR; break; - case WSAEMSGSIZE: prError = PR_BUFFER_OVERFLOW_ERROR; break; - case WSAENETDOWN: prError = PR_NETWORK_DOWN_ERROR; break; - case WSAENETRESET: prError = PR_CONNECT_ABORTED_ERROR; break; - case WSAENETUNREACH: prError = PR_NETWORK_UNREACHABLE_ERROR; break; - case WSAENOBUFS: prError = PR_INSUFFICIENT_RESOURCES_ERROR; break; - case WSAENOPROTOOPT: prError = PR_INVALID_ARGUMENT_ERROR; break; - case WSAENOTCONN: prError = PR_NOT_CONNECTED_ERROR; break; - case WSAENOTSOCK: prError = PR_NOT_SOCKET_ERROR; break; - case WSAEOPNOTSUPP: prError = PR_OPERATION_NOT_SUPPORTED_ERROR; break; - case WSAEPROTONOSUPPORT: prError = PR_PROTOCOL_NOT_SUPPORTED_ERROR; break; - case WSAEPROTOTYPE: prError = PR_INVALID_ARGUMENT_ERROR; break; - case WSAESHUTDOWN: prError = PR_SOCKET_SHUTDOWN_ERROR; break; - case WSAESOCKTNOSUPPORT: prError = PR_INVALID_ARGUMENT_ERROR; break; - case WSAETIMEDOUT: prError = PR_CONNECT_ABORTED_ERROR; break; - case WSAEWOULDBLOCK: prError = PR_WOULD_BLOCK_ERROR; break; - default: prError = PR_UNKNOWN_ERROR; break; - } - PR_SetError(prError, err); -} - diff --git a/security/nss/lib/ssl/win32err.h b/security/nss/lib/ssl/win32err.h deleted file mode 100644 index 84fa4d6a4..000000000 --- a/security/nss/lib/ssl/win32err.h +++ /dev/null @@ -1,84 +0,0 @@ -/* - * This file essentially replicates NSPR's source for the functions that - * map system-specific error codes to NSPR error codes. We would use - * NSPR's functions, instead of duplicating them, but they're private. - * As long as SSL's server session cache code must do platform native I/O - * to accomplish its job, and NSPR's error mapping functions remain private, - * This code will continue to need to be replicated. - * - * ***** BEGIN LICENSE BLOCK ***** - * Version: MPL 1.1/GPL 2.0/LGPL 2.1 - * - * The contents of this file are subject to the Mozilla Public License Version - * 1.1 (the "License"); you may not use this file except in compliance with - * the License. You may obtain a copy of the License at - * http://www.mozilla.org/MPL/ - * - * Software distributed under the License is distributed on an "AS IS" basis, - * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License - * for the specific language governing rights and limitations under the - * License. - * - * The Original Code is the Netscape security libraries. - * - * The Initial Developer of the Original Code is - * Netscape Communications Corporation. - * Portions created by the Initial Developer are Copyright (C) 1994-2000 - * the Initial Developer. All Rights Reserved. - * - * Contributor(s): - * - * Alternatively, the contents of this file may be used under the terms of - * either the GNU General Public License Version 2 or later (the "GPL"), or - * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), - * in which case the provisions of the GPL or the LGPL are applicable instead - * of those above. If you wish to allow use of your version of this file only - * under the terms of either the GPL or the LGPL, and not to allow others to - * use your version of this file under the terms of the MPL, indicate your - * decision by deleting the provisions above and replace them with the notice - * and other provisions required by the GPL or the LGPL. If you do not delete - * the provisions above, a recipient may use your version of this file under - * the terms of any one of the MPL, the GPL or the LGPL. - * - * ***** END LICENSE BLOCK ***** */ -/* $Id$ */ - -/* NSPR doesn't make these functions public, so we have to duplicate -** them in NSS. -*/ -extern void nss_MD_win32_map_accept_error(PRInt32 err); -extern void nss_MD_win32_map_acceptex_error(PRInt32 err); -extern void nss_MD_win32_map_access_error(PRInt32 err); -extern void nss_MD_win32_map_bind_error(PRInt32 err); -extern void nss_MD_win32_map_close_error(PRInt32 err); -extern void nss_MD_win32_map_closedir_error(PRInt32 err); -extern void nss_MD_win32_map_connect_error(PRInt32 err); -extern void nss_MD_win32_map_default_error(PRInt32 err); -extern void nss_MD_win32_map_delete_error(PRInt32 err); -extern void nss_MD_win32_map_fstat_error(PRInt32 err); -extern void nss_MD_win32_map_fsync_error(PRInt32 err); -extern void nss_MD_win32_map_gethostname_error(PRInt32 err); -extern void nss_MD_win32_map_getpeername_error(PRInt32 err); -extern void nss_MD_win32_map_getsockname_error(PRInt32 err); -extern void nss_MD_win32_map_getsockopt_error(PRInt32 err); -extern void nss_MD_win32_map_listen_error(PRInt32 err); -extern void nss_MD_win32_map_lockf_error(PRInt32 err); -extern void nss_MD_win32_map_lseek_error(PRInt32 err); -extern void nss_MD_win32_map_mkdir_error(PRInt32 err); -extern void nss_MD_win32_map_open_error(PRInt32 err); -extern void nss_MD_win32_map_opendir_error(PRInt32 err); -extern void nss_MD_win32_map_read_error(PRInt32 err); -extern void nss_MD_win32_map_readdir_error(PRInt32 err); -extern void nss_MD_win32_map_recv_error(PRInt32 err); -extern void nss_MD_win32_map_recvfrom_error(PRInt32 err); -extern void nss_MD_win32_map_rename_error(PRInt32 err); -extern void nss_MD_win32_map_rmdir_error(PRInt32 err); -extern void nss_MD_win32_map_select_error(PRInt32 err); -extern void nss_MD_win32_map_send_error(PRInt32 err); -extern void nss_MD_win32_map_sendto_error(PRInt32 err); -extern void nss_MD_win32_map_setsockopt_error(PRInt32 err); -extern void nss_MD_win32_map_shutdown_error(PRInt32 err); -extern void nss_MD_win32_map_socket_error(PRInt32 err); -extern void nss_MD_win32_map_stat_error(PRInt32 err); -extern void nss_MD_win32_map_transmitfile_error(PRInt32 err); -extern void nss_MD_win32_map_write_error(PRInt32 err); |