Initial Commit

openssl-1.0.2f/ssl/bio_ssl.c

@@ -0,0 +1,591 @@
+/* ssl/bio_ssl.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <openssl/crypto.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+static int ssl_write(BIO *h, const char *buf, int num);
+static int ssl_read(BIO *h, char *buf, int size);
+static int ssl_puts(BIO *h, const char *str);
+static long ssl_ctrl(BIO *h, int cmd, long arg1, void *arg2);
+static int ssl_new(BIO *h);
+static int ssl_free(BIO *data);
+static long ssl_callback_ctrl(BIO *h, int cmd, bio_info_cb *fp);
+typedef struct bio_ssl_st {
+    SSL *ssl;                   /* The ssl handle :-) */
+    /* re-negotiate every time the total number of bytes is this size */
+    int num_renegotiates;
+    unsigned long renegotiate_count;
+    unsigned long byte_count;
+    unsigned long renegotiate_timeout;
+    unsigned long last_time;
+} BIO_SSL;
+
+static BIO_METHOD methods_sslp = {
+    BIO_TYPE_SSL, "ssl",
+    ssl_write,
+    ssl_read,
+    ssl_puts,
+    NULL,                       /* ssl_gets, */
+    ssl_ctrl,
+    ssl_new,
+    ssl_free,
+    ssl_callback_ctrl,
+};
+
+BIO_METHOD *BIO_f_ssl(void)
+{
+    return (&methods_sslp);
+}
+
+static int ssl_new(BIO *bi)
+{
+    BIO_SSL *bs;
+
+    bs = (BIO_SSL *)OPENSSL_malloc(sizeof(BIO_SSL));
+    if (bs == NULL) {
+        BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
+        return (0);
+    }
+    memset(bs, 0, sizeof(BIO_SSL));
+    bi->init = 0;
+    bi->ptr = (char *)bs;
+    bi->flags = 0;
+    return (1);
+}
+
+static int ssl_free(BIO *a)
+{
+    BIO_SSL *bs;
+
+    if (a == NULL)
+        return (0);
+    bs = (BIO_SSL *)a->ptr;
+    if (bs->ssl != NULL)
+        SSL_shutdown(bs->ssl);
+    if (a->shutdown) {
+        if (a->init && (bs->ssl != NULL))
+            SSL_free(bs->ssl);
+        a->init = 0;
+        a->flags = 0;
+    }
+    if (a->ptr != NULL)
+        OPENSSL_free(a->ptr);
+    return (1);
+}
+
+static int ssl_read(BIO *b, char *out, int outl)
+{
+    int ret = 1;
+    BIO_SSL *sb;
+    SSL *ssl;
+    int retry_reason = 0;
+    int r = 0;
+
+    if (out == NULL)
+        return (0);
+    sb = (BIO_SSL *)b->ptr;
+    ssl = sb->ssl;
+
+    BIO_clear_retry_flags(b);
+
+#if 0
+    if (!SSL_is_init_finished(ssl)) {
+/*              ret=SSL_do_handshake(ssl); */
+        if (ret > 0) {
+
+            outflags = (BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
+            ret = -1;
+            goto end;
+        }
+    }
+#endif
+/*      if (ret > 0) */
+    ret = SSL_read(ssl, out, outl);
+
+    switch (SSL_get_error(ssl, ret)) {
+    case SSL_ERROR_NONE:
+        if (ret <= 0)
+            break;
+        if (sb->renegotiate_count > 0) {
+            sb->byte_count += ret;
+            if (sb->byte_count > sb->renegotiate_count) {
+                sb->byte_count = 0;
+                sb->num_renegotiates++;
+                SSL_renegotiate(ssl);
+                r = 1;
+            }
+        }
+        if ((sb->renegotiate_timeout > 0) && (!r)) {
+            unsigned long tm;
+
+            tm = (unsigned long)time(NULL);
+            if (tm > sb->last_time + sb->renegotiate_timeout) {
+                sb->last_time = tm;
+                sb->num_renegotiates++;
+                SSL_renegotiate(ssl);
+            }
+        }
+
+        break;
+    case SSL_ERROR_WANT_READ:
+        BIO_set_retry_read(b);
+        break;
+    case SSL_ERROR_WANT_WRITE:
+        BIO_set_retry_write(b);
+        break;
+    case SSL_ERROR_WANT_X509_LOOKUP:
+        BIO_set_retry_special(b);
+        retry_reason = BIO_RR_SSL_X509_LOOKUP;
+        break;
+    case SSL_ERROR_WANT_ACCEPT:
+        BIO_set_retry_special(b);
+        retry_reason = BIO_RR_ACCEPT;
+        break;
+    case SSL_ERROR_WANT_CONNECT:
+        BIO_set_retry_special(b);
+        retry_reason = BIO_RR_CONNECT;
+        break;
+    case SSL_ERROR_SYSCALL:
+    case SSL_ERROR_SSL:
+    case SSL_ERROR_ZERO_RETURN:
+    default:
+        break;
+    }
+
+    b->retry_reason = retry_reason;
+    return (ret);
+}
+
+static int ssl_write(BIO *b, const char *out, int outl)
+{
+    int ret, r = 0;
+    int retry_reason = 0;
+    SSL *ssl;
+    BIO_SSL *bs;
+
+    if (out == NULL)
+        return (0);
+    bs = (BIO_SSL *)b->ptr;
+    ssl = bs->ssl;
+
+    BIO_clear_retry_flags(b);
+
+    /*
+     * ret=SSL_do_handshake(ssl); if (ret > 0)
+     */
+    ret = SSL_write(ssl, out, outl);
+
+    switch (SSL_get_error(ssl, ret)) {
+    case SSL_ERROR_NONE:
+        if (ret <= 0)
+            break;
+        if (bs->renegotiate_count > 0) {
+            bs->byte_count += ret;
+            if (bs->byte_count > bs->renegotiate_count) {
+                bs->byte_count = 0;
+                bs->num_renegotiates++;
+                SSL_renegotiate(ssl);
+                r = 1;
+            }
+        }
+        if ((bs->renegotiate_timeout > 0) && (!r)) {
+            unsigned long tm;
+
+            tm = (unsigned long)time(NULL);
+            if (tm > bs->last_time + bs->renegotiate_timeout) {
+                bs->last_time = tm;
+                bs->num_renegotiates++;
+                SSL_renegotiate(ssl);
+            }
+        }
+        break;
+    case SSL_ERROR_WANT_WRITE:
+        BIO_set_retry_write(b);
+        break;
+    case SSL_ERROR_WANT_READ:
+        BIO_set_retry_read(b);
+        break;
+    case SSL_ERROR_WANT_X509_LOOKUP:
+        BIO_set_retry_special(b);
+        retry_reason = BIO_RR_SSL_X509_LOOKUP;
+        break;
+    case SSL_ERROR_WANT_CONNECT:
+        BIO_set_retry_special(b);
+        retry_reason = BIO_RR_CONNECT;
+    case SSL_ERROR_SYSCALL:
+    case SSL_ERROR_SSL:
+    default:
+        break;
+    }
+
+    b->retry_reason = retry_reason;
+    return (ret);
+}
+
+static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
+{
+    SSL **sslp, *ssl;
+    BIO_SSL *bs;
+    BIO *dbio, *bio;
+    long ret = 1;
+
+    bs = (BIO_SSL *)b->ptr;
+    ssl = bs->ssl;
+    if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))
+        return (0);
+    switch (cmd) {
+    case BIO_CTRL_RESET:
+        SSL_shutdown(ssl);
+
+        if (ssl->handshake_func == ssl->method->ssl_connect)
+            SSL_set_connect_state(ssl);
+        else if (ssl->handshake_func == ssl->method->ssl_accept)
+            SSL_set_accept_state(ssl);
+
+        SSL_clear(ssl);
+
+        if (b->next_bio != NULL)
+            ret = BIO_ctrl(b->next_bio, cmd, num, ptr);
+        else if (ssl->rbio != NULL)
+            ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
+        else
+            ret = 1;
+        break;
+    case BIO_CTRL_INFO:
+        ret = 0;
+        break;
+    case BIO_C_SSL_MODE:
+        if (num)                /* client mode */
+            SSL_set_connect_state(ssl);
+        else
+            SSL_set_accept_state(ssl);
+        break;
+    case BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT:
+        ret = bs->renegotiate_timeout;
+        if (num < 60)
+            num = 5;
+        bs->renegotiate_timeout = (unsigned long)num;
+        bs->last_time = (unsigned long)time(NULL);
+        break;
+    case BIO_C_SET_SSL_RENEGOTIATE_BYTES:
+        ret = bs->renegotiate_count;
+        if ((long)num >= 512)
+            bs->renegotiate_count = (unsigned long)num;
+        break;
+    case BIO_C_GET_SSL_NUM_RENEGOTIATES:
+        ret = bs->num_renegotiates;
+        break;
+    case BIO_C_SET_SSL:
+        if (ssl != NULL) {
+            ssl_free(b);
+            if (!ssl_new(b))
+                return 0;
+        }
+        b->shutdown = (int)num;
+        ssl = (SSL *)ptr;
+        ((BIO_SSL *)b->ptr)->ssl = ssl;
+        bio = SSL_get_rbio(ssl);
+        if (bio != NULL) {
+            if (b->next_bio != NULL)
+                BIO_push(bio, b->next_bio);
+            b->next_bio = bio;
+            CRYPTO_add(&bio->references, 1, CRYPTO_LOCK_BIO);
+        }
+        b->init = 1;
+        break;
+    case BIO_C_GET_SSL:
+        if (ptr != NULL) {
+            sslp = (SSL **)ptr;
+            *sslp = ssl;
+        } else
+            ret = 0;
+        break;
+    case BIO_CTRL_GET_CLOSE:
+        ret = b->shutdown;
+        break;
+    case BIO_CTRL_SET_CLOSE:
+        b->shutdown = (int)num;
+        break;
+    case BIO_CTRL_WPENDING:
+        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
+        break;
+    case BIO_CTRL_PENDING:
+        ret = SSL_pending(ssl);
+        if (ret == 0)
+            ret = BIO_pending(ssl->rbio);
+        break;
+    case BIO_CTRL_FLUSH:
+        BIO_clear_retry_flags(b);
+        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
+        BIO_copy_next_retry(b);
+        break;
+    case BIO_CTRL_PUSH:
+        if ((b->next_bio != NULL) && (b->next_bio != ssl->rbio)) {
+            SSL_set_bio(ssl, b->next_bio, b->next_bio);
+            CRYPTO_add(&b->next_bio->references, 1, CRYPTO_LOCK_BIO);
+        }
+        break;
+    case BIO_CTRL_POP:
+        /* Only detach if we are the BIO explicitly being popped */
+        if (b == ptr) {
+            /*
+             * Shouldn't happen in practice because the rbio and wbio are the
+             * same when pushed.
+             */
+            if (ssl->rbio != ssl->wbio)
+                BIO_free_all(ssl->wbio);
+            if (b->next_bio != NULL)
+                CRYPTO_add(&b->next_bio->references, -1, CRYPTO_LOCK_BIO);
+            ssl->wbio = NULL;
+            ssl->rbio = NULL;
+        }
+        break;
+    case BIO_C_DO_STATE_MACHINE:
+        BIO_clear_retry_flags(b);
+
+        b->retry_reason = 0;
+        ret = (int)SSL_do_handshake(ssl);
+
+        switch (SSL_get_error(ssl, (int)ret)) {
+        case SSL_ERROR_WANT_READ:
+            BIO_set_flags(b, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
+            break;
+        case SSL_ERROR_WANT_WRITE:
+            BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
+            break;
+        case SSL_ERROR_WANT_CONNECT:
+            BIO_set_flags(b, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);
+            b->retry_reason = b->next_bio->retry_reason;
+            break;
+        case SSL_ERROR_WANT_X509_LOOKUP:
+            BIO_set_retry_special(b);
+            b->retry_reason = BIO_RR_SSL_X509_LOOKUP;
+            break;
+        default:
+            break;
+        }
+        break;
+    case BIO_CTRL_DUP:
+        dbio = (BIO *)ptr;
+        if (((BIO_SSL *)dbio->ptr)->ssl != NULL)
+            SSL_free(((BIO_SSL *)dbio->ptr)->ssl);
+        ((BIO_SSL *)dbio->ptr)->ssl = SSL_dup(ssl);
+        ((BIO_SSL *)dbio->ptr)->renegotiate_count =
+            ((BIO_SSL *)b->ptr)->renegotiate_count;
+        ((BIO_SSL *)dbio->ptr)->byte_count = ((BIO_SSL *)b->ptr)->byte_count;
+        ((BIO_SSL *)dbio->ptr)->renegotiate_timeout =
+            ((BIO_SSL *)b->ptr)->renegotiate_timeout;
+        ((BIO_SSL *)dbio->ptr)->last_time = ((BIO_SSL *)b->ptr)->last_time;
+        ret = (((BIO_SSL *)dbio->ptr)->ssl != NULL);
+        break;
+    case BIO_C_GET_FD:
+        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
+        break;
+    case BIO_CTRL_SET_CALLBACK:
+        {
+#if 0                           /* FIXME: Should this be used? -- Richard
+                                 * Levitte */
+            SSLerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+            ret = -1;
+#else
+            ret = 0;
+#endif
+        }
+        break;
+    case BIO_CTRL_GET_CALLBACK:
+        {
+            void (**fptr) (const SSL *xssl, int type, int val);
+
+            fptr = (void (**)(const SSL *xssl, int type, int val))ptr;
+            *fptr = SSL_get_info_callback(ssl);
+        }
+        break;
+    default:
+        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
+        break;
+    }
+    return (ret);
+}
+
+static long ssl_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp)
+{
+    SSL *ssl;
+    BIO_SSL *bs;
+    long ret = 1;
+
+    bs = (BIO_SSL *)b->ptr;
+    ssl = bs->ssl;
+    switch (cmd) {
+    case BIO_CTRL_SET_CALLBACK:
+        {
+            /*
+             * FIXME: setting this via a completely different prototype seems
+             * like a crap idea
+             */
+            SSL_set_info_callback(ssl, (void (*)(const SSL *, int, int))fp);
+        }
+        break;
+    default:
+        ret = BIO_callback_ctrl(ssl->rbio, cmd, fp);
+        break;
+    }
+    return (ret);
+}
+
+static int ssl_puts(BIO *bp, const char *str)
+{
+    int n, ret;
+
+    n = strlen(str);
+    ret = BIO_write(bp, str, n);
+    return (ret);
+}
+
+BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx)
+{
+#ifndef OPENSSL_NO_SOCK
+    BIO *ret = NULL, *buf = NULL, *ssl = NULL;
+
+    if ((buf = BIO_new(BIO_f_buffer())) == NULL)
+        return (NULL);
+    if ((ssl = BIO_new_ssl_connect(ctx)) == NULL)
+        goto err;
+    if ((ret = BIO_push(buf, ssl)) == NULL)
+        goto err;
+    return (ret);
+ err:
+    if (buf != NULL)
+        BIO_free(buf);
+    if (ssl != NULL)
+        BIO_free(ssl);
+#endif
+    return (NULL);
+}
+
+BIO *BIO_new_ssl_connect(SSL_CTX *ctx)
+{
+#ifndef OPENSSL_NO_SOCK
+    BIO *ret = NULL, *con = NULL, *ssl = NULL;
+
+    if ((con = BIO_new(BIO_s_connect())) == NULL)
+        return (NULL);
+    if ((ssl = BIO_new_ssl(ctx, 1)) == NULL)
+        goto err;
+    if ((ret = BIO_push(ssl, con)) == NULL)
+        goto err;
+    return (ret);
+ err:
+    if (con != NULL)
+        BIO_free(con);
+#endif
+    return (NULL);
+}
+
+BIO *BIO_new_ssl(SSL_CTX *ctx, int client)
+{
+    BIO *ret;
+    SSL *ssl;
+
+    if ((ret = BIO_new(BIO_f_ssl())) == NULL)
+        return (NULL);
+    if ((ssl = SSL_new(ctx)) == NULL) {
+        BIO_free(ret);
+        return (NULL);
+    }
+    if (client)
+        SSL_set_connect_state(ssl);
+    else
+        SSL_set_accept_state(ssl);
+
+    BIO_set_ssl(ret, ssl, BIO_CLOSE);
+    return (ret);
+}
+
+int BIO_ssl_copy_session_id(BIO *t, BIO *f)
+{
+    t = BIO_find_type(t, BIO_TYPE_SSL);
+    f = BIO_find_type(f, BIO_TYPE_SSL);
+    if ((t == NULL) || (f == NULL))
+        return (0);
+    if ((((BIO_SSL *)t->ptr)->ssl == NULL) ||
+        (((BIO_SSL *)f->ptr)->ssl == NULL))
+        return (0);
+    SSL_copy_session_id(((BIO_SSL *)t->ptr)->ssl, ((BIO_SSL *)f->ptr)->ssl);
+    return (1);
+}
+
+void BIO_ssl_shutdown(BIO *b)
+{
+    SSL *s;
+
+    while (b != NULL) {
+        if (b->method->type == BIO_TYPE_SSL) {
+            s = ((BIO_SSL *)b->ptr)->ssl;
+            SSL_shutdown(s);
+            break;
+        }
+        b = b->next_bio;
+    }
+}

openssl-1.0.2f/ssl/clienthellotest.c

@@ -0,0 +1,219 @@
+/* Written by Matt Caswell for the OpenSSL Project */
+/* ====================================================================
+ * Copyright (c) 1998-2015 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <string.h>
+
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/evp.h>
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+
+
+#define CLIENT_VERSION_LEN      2
+#define SESSION_ID_LEN_LEN      1
+#define CIPHERS_LEN_LEN         2
+#define COMPRESSION_LEN_LEN     1
+#define EXTENSIONS_LEN_LEN      2
+#define EXTENSION_TYPE_LEN      2
+#define EXTENSION_SIZE_LEN      2
+
+
+#define TOTAL_NUM_TESTS                         2
+
+/*
+ * Test that explicitly setting ticket data results in it appearing in the
+ * ClientHello for TLS1.2
+ */
+#define TEST_SET_SESSION_TICK_DATA_TLS_1_2      0
+
+/*
+ * Test that explicitly setting ticket data results in it appearing in the
+ * ClientHello for a negotiated SSL/TLS version
+ */
+#define TEST_SET_SESSION_TICK_DATA_VER_NEG      1
+
+int main(int argc, char *argv[])
+{
+    SSL_CTX *ctx;
+    SSL *con;
+    BIO *rbio;
+    BIO *wbio;
+    BIO *err;
+    long len;
+    unsigned char *data;
+    unsigned char *dataend;
+    char *dummytick = "Hello World!";
+    unsigned int tmplen;
+    unsigned int type;
+    unsigned int size;
+    int testresult = 0;
+    int currtest = 0;
+
+    SSL_library_init();
+    SSL_load_error_strings();
+
+    err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+
+    CRYPTO_malloc_debug_init();
+    CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
+    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+
+    /*
+     * For each test set up an SSL_CTX and SSL and see what ClientHello gets
+     * produced when we try to connect
+     */
+    for (; currtest < TOTAL_NUM_TESTS; currtest++) {
+        testresult = 0;
+        if (currtest == TEST_SET_SESSION_TICK_DATA_TLS_1_2) {
+            ctx = SSL_CTX_new(TLSv1_2_method());
+        } else {
+            ctx = SSL_CTX_new(SSLv23_method());
+        }
+        con = SSL_new(ctx);
+
+        rbio = BIO_new(BIO_s_mem());
+        wbio = BIO_new(BIO_s_mem());
+        SSL_set_bio(con, rbio, wbio);
+        SSL_set_connect_state(con);
+
+        if (currtest == TEST_SET_SESSION_TICK_DATA_TLS_1_2
+                || currtest == TEST_SET_SESSION_TICK_DATA_VER_NEG) {
+            if (!SSL_set_session_ticket_ext(con, dummytick, strlen(dummytick)))
+                goto end;
+        }
+
+        if (SSL_connect(con) > 0) {
+            /* This shouldn't succeed because we don't have a server! */
+            goto end;
+        }
+
+        len = BIO_get_mem_data(wbio, (char **)&data);
+        dataend = data + len;
+
+        /* Skip the record header */
+        data += SSL3_RT_HEADER_LENGTH;
+        /* Skip the handshake message header */
+        data += SSL3_HM_HEADER_LENGTH;
+        /* Skip client version and random */
+        data += CLIENT_VERSION_LEN + SSL3_RANDOM_SIZE;
+        if (data + SESSION_ID_LEN_LEN > dataend)
+            goto end;
+        /* Skip session id */
+        tmplen = *data;
+        data += SESSION_ID_LEN_LEN + tmplen;
+        if (data + CIPHERS_LEN_LEN > dataend)
+            goto end;
+        /* Skip ciphers */
+        tmplen = ((*data) << 8) | *(data + 1);
+        data += CIPHERS_LEN_LEN + tmplen;
+        if (data + COMPRESSION_LEN_LEN > dataend)
+            goto end;
+        /* Skip compression */
+        tmplen = *data;
+        data += COMPRESSION_LEN_LEN + tmplen;
+        if (data + EXTENSIONS_LEN_LEN > dataend)
+            goto end;
+        /* Extensions len */
+        tmplen = ((*data) << 8) | *(data + 1);
+        data += EXTENSIONS_LEN_LEN;
+        if (data + tmplen > dataend)
+            goto end;
+
+        /* Loop through all extensions */
+        while (tmplen > EXTENSION_TYPE_LEN + EXTENSION_SIZE_LEN) {
+            type = ((*data) << 8) | *(data + 1);
+            data += EXTENSION_TYPE_LEN;
+            size = ((*data) << 8) | *(data + 1);
+            data += EXTENSION_SIZE_LEN;
+            if (data + size > dataend)
+                goto end;
+
+            if (type == TLSEXT_TYPE_session_ticket) {
+                if (currtest == TEST_SET_SESSION_TICK_DATA_TLS_1_2
+                        || currtest == TEST_SET_SESSION_TICK_DATA_VER_NEG) {
+                    if (size == strlen(dummytick)
+                            && memcmp(data, dummytick, size) == 0) {
+                        /* Ticket data is as we expected */
+                        testresult = 1;
+                    } else {
+                        printf("Received session ticket is not as expected\n");
+                    }
+                    break;
+                }
+            }
+
+            tmplen -= EXTENSION_TYPE_LEN + EXTENSION_SIZE_LEN + size;
+            data += size;
+        }
+
+ end:
+        SSL_free(con);
+        SSL_CTX_free(ctx);
+        if (!testresult) {
+            printf("ClientHello test: FAILED (Test %d)\n", currtest);
+            break;
+        }
+    }
+
+    ERR_free_strings();
+    ERR_remove_thread_state(NULL);
+    EVP_cleanup();
+    CRYPTO_cleanup_all_ex_data();
+    CRYPTO_mem_leaks(err);
+    BIO_free(err);
+
+    return testresult?0:1;
+}

openssl-1.0.2f/ssl/d1_clnt.c

@@ -0,0 +1,869 @@
+/* ssl/d1_clnt.c */
+/*
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#ifndef OPENSSL_NO_KRB5
+# include "kssl_lcl.h"
+#endif
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/md5.h>
+#include <openssl/bn.h>
+#ifndef OPENSSL_NO_DH
+# include <openssl/dh.h>
+#endif
+
+static const SSL_METHOD *dtls1_get_client_method(int ver);
+static int dtls1_get_hello_verify(SSL *s);
+
+static const SSL_METHOD *dtls1_get_client_method(int ver)
+{
+    if (ver == DTLS_ANY_VERSION)
+        return DTLS_client_method();
+    else if (ver == DTLS1_VERSION || ver == DTLS1_BAD_VER)
+        return DTLSv1_client_method();
+    else if (ver == DTLS1_2_VERSION)
+        return DTLSv1_2_client_method();
+    else
+        return NULL;
+}
+
+IMPLEMENT_dtls1_meth_func(DTLS1_VERSION,
+                          DTLSv1_client_method,
+                          ssl_undefined_function,
+                          dtls1_connect,
+                          dtls1_get_client_method, DTLSv1_enc_data)
+
+IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION,
+                          DTLSv1_2_client_method,
+                          ssl_undefined_function,
+                          dtls1_connect,
+                          dtls1_get_client_method, DTLSv1_2_enc_data)
+
+IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION,
+                          DTLS_client_method,
+                          ssl_undefined_function,
+                          dtls1_connect,
+                          dtls1_get_client_method, DTLSv1_2_enc_data)
+
+int dtls1_connect(SSL *s)
+{
+    BUF_MEM *buf = NULL;
+    unsigned long Time = (unsigned long)time(NULL);
+    void (*cb) (const SSL *ssl, int type, int val) = NULL;
+    int ret = -1;
+    int new_state, state, skip = 0;
+#ifndef OPENSSL_NO_SCTP
+    unsigned char sctpauthkey[64];
+    char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
+#endif
+
+    RAND_add(&Time, sizeof(Time), 0);
+    ERR_clear_error();
+    clear_sys_error();
+
+    if (s->info_callback != NULL)
+        cb = s->info_callback;
+    else if (s->ctx->info_callback != NULL)
+        cb = s->ctx->info_callback;
+
+    s->in_handshake++;
+    if (!SSL_in_init(s) || SSL_in_before(s))
+        SSL_clear(s);
+
+#ifndef OPENSSL_NO_SCTP
+    /*
+     * Notify SCTP BIO socket to enter handshake mode and prevent stream
+     * identifier other than 0. Will be ignored if no SCTP is used.
+     */
+    BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
+             s->in_handshake, NULL);
+#endif
+
+#ifndef OPENSSL_NO_HEARTBEATS
+    /*
+     * If we're awaiting a HeartbeatResponse, pretend we already got and
+     * don't await it anymore, because Heartbeats don't make sense during
+     * handshakes anyway.
+     */
+    if (s->tlsext_hb_pending) {
+        dtls1_stop_timer(s);
+        s->tlsext_hb_pending = 0;
+        s->tlsext_hb_seq++;
+    }
+#endif
+
+    for (;;) {
+        state = s->state;
+
+        switch (s->state) {
+        case SSL_ST_RENEGOTIATE:
+            s->renegotiate = 1;
+            s->state = SSL_ST_CONNECT;
+            s->ctx->stats.sess_connect_renegotiate++;
+            /* break */
+        case SSL_ST_BEFORE:
+        case SSL_ST_CONNECT:
+        case SSL_ST_BEFORE | SSL_ST_CONNECT:
+        case SSL_ST_OK | SSL_ST_CONNECT:
+
+            s->server = 0;
+            if (cb != NULL)
+                cb(s, SSL_CB_HANDSHAKE_START, 1);
+
+            if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
+                (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00)) {
+                SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            /* s->version=SSL3_VERSION; */
+            s->type = SSL_ST_CONNECT;
+
+            if (s->init_buf == NULL) {
+                if ((buf = BUF_MEM_new()) == NULL) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+                s->init_buf = buf;
+                buf = NULL;
+            }
+
+            if (!ssl3_setup_buffers(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            /* setup buffing BIO */
+            if (!ssl_init_wbio_buffer(s, 0)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            /* don't push the buffering BIO quite yet */
+
+            s->state = SSL3_ST_CW_CLNT_HELLO_A;
+            s->ctx->stats.sess_connect++;
+            s->init_num = 0;
+            /* mark client_random uninitialized */
+            memset(s->s3->client_random, 0, sizeof(s->s3->client_random));
+            s->d1->send_cookie = 0;
+            s->hit = 0;
+            s->d1->change_cipher_spec_ok = 0;
+            /*
+             * Should have been reset by ssl3_get_finished, too.
+             */
+            s->s3->change_cipher_spec = 0;
+            break;
+
+#ifndef OPENSSL_NO_SCTP
+        case DTLS1_SCTP_ST_CR_READ_SOCK:
+
+            if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
+                s->s3->in_read_app_data = 2;
+                s->rwstate = SSL_READING;
+                BIO_clear_retry_flags(SSL_get_rbio(s));
+                BIO_set_retry_read(SSL_get_rbio(s));
+                ret = -1;
+                goto end;
+            }
+
+            s->state = s->s3->tmp.next_state;
+            break;
+
+        case DTLS1_SCTP_ST_CW_WRITE_SOCK:
+            /* read app data until dry event */
+
+            ret = BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s));
+            if (ret < 0)
+                goto end;
+
+            if (ret == 0) {
+                s->s3->in_read_app_data = 2;
+                s->rwstate = SSL_READING;
+                BIO_clear_retry_flags(SSL_get_rbio(s));
+                BIO_set_retry_read(SSL_get_rbio(s));
+                ret = -1;
+                goto end;
+            }
+
+            s->state = s->d1->next_state;
+            break;
+#endif
+
+        case SSL3_ST_CW_CLNT_HELLO_A:
+            s->shutdown = 0;
+
+            /* every DTLS ClientHello resets Finished MAC */
+            ssl3_init_finished_mac(s);
+
+        case SSL3_ST_CW_CLNT_HELLO_B:
+            dtls1_start_timer(s);
+            ret = ssl3_client_hello(s);
+            if (ret <= 0)
+                goto end;
+
+            if (s->d1->send_cookie) {
+                s->state = SSL3_ST_CW_FLUSH;
+                s->s3->tmp.next_state = SSL3_ST_CR_SRVR_HELLO_A;
+            } else
+                s->state = SSL3_ST_CR_SRVR_HELLO_A;
+
+            s->init_num = 0;
+
+#ifndef OPENSSL_NO_SCTP
+            /* Disable buffering for SCTP */
+            if (!BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+#endif
+                /*
+                 * turn on buffering for the next lot of output
+                 */
+                if (s->bbio != s->wbio)
+                    s->wbio = BIO_push(s->bbio, s->wbio);
+#ifndef OPENSSL_NO_SCTP
+            }
+#endif
+
+            break;
+
+        case SSL3_ST_CR_SRVR_HELLO_A:
+        case SSL3_ST_CR_SRVR_HELLO_B:
+            ret = ssl3_get_server_hello(s);
+            if (ret <= 0)
+                goto end;
+            else {
+                if (s->hit) {
+#ifndef OPENSSL_NO_SCTP
+                    /*
+                     * Add new shared key for SCTP-Auth, will be ignored if
+                     * no SCTP used.
+                     */
+                    snprintf((char *)labelbuffer,
+                             sizeof(DTLS1_SCTP_AUTH_LABEL),
+                             DTLS1_SCTP_AUTH_LABEL);
+
+                    if (SSL_export_keying_material(s, sctpauthkey,
+                                               sizeof(sctpauthkey),
+                                               labelbuffer,
+                                               sizeof(labelbuffer), NULL, 0,
+                                               0) <= 0) {
+                        ret = -1;
+                        s->state = SSL_ST_ERR;
+                        goto end;
+                    }
+
+                    BIO_ctrl(SSL_get_wbio(s),
+                             BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
+                             sizeof(sctpauthkey), sctpauthkey);
+#endif
+
+                    s->state = SSL3_ST_CR_FINISHED_A;
+                    if (s->tlsext_ticket_expected) {
+                        /* receive renewed session ticket */
+                        s->state = SSL3_ST_CR_SESSION_TICKET_A;
+                    }
+                } else
+                    s->state = DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A;
+            }
+            s->init_num = 0;
+            break;
+
+        case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
+        case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
+
+            ret = dtls1_get_hello_verify(s);
+            if (ret <= 0)
+                goto end;
+            dtls1_stop_timer(s);
+            if (s->d1->send_cookie) /* start again, with a cookie */
+                s->state = SSL3_ST_CW_CLNT_HELLO_A;
+            else
+                s->state = SSL3_ST_CR_CERT_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CR_CERT_A:
+        case SSL3_ST_CR_CERT_B:
+            /* Check if it is anon DH or PSK */
+            if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
+                !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                ret = ssl3_get_server_certificate(s);
+                if (ret <= 0)
+                    goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                if (s->tlsext_status_expected)
+                    s->state = SSL3_ST_CR_CERT_STATUS_A;
+                else
+                    s->state = SSL3_ST_CR_KEY_EXCH_A;
+            } else {
+                skip = 1;
+                s->state = SSL3_ST_CR_KEY_EXCH_A;
+            }
+#else
+            } else
+                skip = 1;
+
+            s->state = SSL3_ST_CR_KEY_EXCH_A;
+#endif
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CR_KEY_EXCH_A:
+        case SSL3_ST_CR_KEY_EXCH_B:
+            ret = ssl3_get_key_exchange(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_CR_CERT_REQ_A;
+            s->init_num = 0;
+
+            /*
+             * at this point we check that we have the required stuff from
+             * the server
+             */
+            if (!ssl3_check_cert_and_algorithm(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+            break;
+
+        case SSL3_ST_CR_CERT_REQ_A:
+        case SSL3_ST_CR_CERT_REQ_B:
+            ret = ssl3_get_certificate_request(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_CR_SRVR_DONE_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CR_SRVR_DONE_A:
+        case SSL3_ST_CR_SRVR_DONE_B:
+            ret = ssl3_get_server_done(s);
+            if (ret <= 0)
+                goto end;
+            dtls1_stop_timer(s);
+            if (s->s3->tmp.cert_req)
+                s->s3->tmp.next_state = SSL3_ST_CW_CERT_A;
+            else
+                s->s3->tmp.next_state = SSL3_ST_CW_KEY_EXCH_A;
+            s->init_num = 0;
+
+#ifndef OPENSSL_NO_SCTP
+            if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
+                state == SSL_ST_RENEGOTIATE)
+                s->state = DTLS1_SCTP_ST_CR_READ_SOCK;
+            else
+#endif
+                s->state = s->s3->tmp.next_state;
+            break;
+
+        case SSL3_ST_CW_CERT_A:
+        case SSL3_ST_CW_CERT_B:
+        case SSL3_ST_CW_CERT_C:
+        case SSL3_ST_CW_CERT_D:
+            dtls1_start_timer(s);
+            ret = ssl3_send_client_certificate(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_CW_KEY_EXCH_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CW_KEY_EXCH_A:
+        case SSL3_ST_CW_KEY_EXCH_B:
+            dtls1_start_timer(s);
+            ret = ssl3_send_client_key_exchange(s);
+            if (ret <= 0)
+                goto end;
+
+#ifndef OPENSSL_NO_SCTP
+            /*
+             * Add new shared key for SCTP-Auth, will be ignored if no SCTP
+             * used.
+             */
+            snprintf((char *)labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL),
+                     DTLS1_SCTP_AUTH_LABEL);
+
+            if (SSL_export_keying_material(s, sctpauthkey,
+                                       sizeof(sctpauthkey), labelbuffer,
+                                       sizeof(labelbuffer), NULL, 0, 0) <= 0) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
+                     sizeof(sctpauthkey), sctpauthkey);
+#endif
+
+            /*
+             * EAY EAY EAY need to check for DH fix cert sent back
+             */
+            /*
+             * For TLS, cert_req is set to 2, so a cert chain of nothing is
+             * sent, but no verify packet is sent
+             */
+            if (s->s3->tmp.cert_req == 1) {
+                s->state = SSL3_ST_CW_CERT_VRFY_A;
+            } else {
+#ifndef OPENSSL_NO_SCTP
+                if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                    s->d1->next_state = SSL3_ST_CW_CHANGE_A;
+                    s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
+                } else
+#endif
+                    s->state = SSL3_ST_CW_CHANGE_A;
+            }
+
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CW_CERT_VRFY_A:
+        case SSL3_ST_CW_CERT_VRFY_B:
+            dtls1_start_timer(s);
+            ret = ssl3_send_client_verify(s);
+            if (ret <= 0)
+                goto end;
+#ifndef OPENSSL_NO_SCTP
+            if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                s->d1->next_state = SSL3_ST_CW_CHANGE_A;
+                s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
+            } else
+#endif
+                s->state = SSL3_ST_CW_CHANGE_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CW_CHANGE_A:
+        case SSL3_ST_CW_CHANGE_B:
+            if (!s->hit)
+                dtls1_start_timer(s);
+            ret = dtls1_send_change_cipher_spec(s,
+                                                SSL3_ST_CW_CHANGE_A,
+                                                SSL3_ST_CW_CHANGE_B);
+            if (ret <= 0)
+                goto end;
+
+            s->state = SSL3_ST_CW_FINISHED_A;
+            s->init_num = 0;
+
+            s->session->cipher = s->s3->tmp.new_cipher;
+#ifdef OPENSSL_NO_COMP
+            s->session->compress_meth = 0;
+#else
+            if (s->s3->tmp.new_compression == NULL)
+                s->session->compress_meth = 0;
+            else
+                s->session->compress_meth = s->s3->tmp.new_compression->id;
+#endif
+            if (!s->method->ssl3_enc->setup_key_block(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            if (!s->method->ssl3_enc->change_cipher_state(s,
+                                                          SSL3_CHANGE_CIPHER_CLIENT_WRITE))
+            {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+#ifndef OPENSSL_NO_SCTP
+            if (s->hit) {
+                /*
+                 * Change to new shared key of SCTP-Auth, will be ignored if
+                 * no SCTP used.
+                 */
+                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
+                         0, NULL);
+            }
+#endif
+
+            dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
+            break;
+
+        case SSL3_ST_CW_FINISHED_A:
+        case SSL3_ST_CW_FINISHED_B:
+            if (!s->hit)
+                dtls1_start_timer(s);
+            ret = ssl3_send_finished(s,
+                                     SSL3_ST_CW_FINISHED_A,
+                                     SSL3_ST_CW_FINISHED_B,
+                                     s->method->
+                                     ssl3_enc->client_finished_label,
+                                     s->method->
+                                     ssl3_enc->client_finished_label_len);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_CW_FLUSH;
+
+            /* clear flags */
+            s->s3->flags &= ~SSL3_FLAGS_POP_BUFFER;
+            if (s->hit) {
+                s->s3->tmp.next_state = SSL_ST_OK;
+#ifndef OPENSSL_NO_SCTP
+                if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                    s->d1->next_state = s->s3->tmp.next_state;
+                    s->s3->tmp.next_state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
+                }
+#endif
+                if (s->s3->flags & SSL3_FLAGS_DELAY_CLIENT_FINISHED) {
+                    s->state = SSL_ST_OK;
+#ifndef OPENSSL_NO_SCTP
+                    if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                        s->d1->next_state = SSL_ST_OK;
+                        s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
+                    }
+#endif
+                    s->s3->flags |= SSL3_FLAGS_POP_BUFFER;
+                    s->s3->delay_buf_pop_ret = 0;
+                }
+            } else {
+#ifndef OPENSSL_NO_SCTP
+                /*
+                 * Change to new shared key of SCTP-Auth, will be ignored if
+                 * no SCTP used.
+                 */
+                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
+                         0, NULL);
+#endif
+
+#ifndef OPENSSL_NO_TLSEXT
+                /*
+                 * Allow NewSessionTicket if ticket expected
+                 */
+                if (s->tlsext_ticket_expected)
+                    s->s3->tmp.next_state = SSL3_ST_CR_SESSION_TICKET_A;
+                else
+#endif
+
+                    s->s3->tmp.next_state = SSL3_ST_CR_FINISHED_A;
+            }
+            s->init_num = 0;
+            break;
+
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL3_ST_CR_SESSION_TICKET_A:
+        case SSL3_ST_CR_SESSION_TICKET_B:
+            ret = ssl3_get_new_session_ticket(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_CR_FINISHED_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CR_CERT_STATUS_A:
+        case SSL3_ST_CR_CERT_STATUS_B:
+            ret = ssl3_get_cert_status(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_CR_KEY_EXCH_A;
+            s->init_num = 0;
+            break;
+#endif
+
+        case SSL3_ST_CR_FINISHED_A:
+        case SSL3_ST_CR_FINISHED_B:
+            s->d1->change_cipher_spec_ok = 1;
+            ret = ssl3_get_finished(s, SSL3_ST_CR_FINISHED_A,
+                                    SSL3_ST_CR_FINISHED_B);
+            if (ret <= 0)
+                goto end;
+            dtls1_stop_timer(s);
+
+            if (s->hit)
+                s->state = SSL3_ST_CW_CHANGE_A;
+            else
+                s->state = SSL_ST_OK;
+
+#ifndef OPENSSL_NO_SCTP
+            if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
+                state == SSL_ST_RENEGOTIATE) {
+                s->d1->next_state = s->state;
+                s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
+            }
+#endif
+
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_CW_FLUSH:
+            s->rwstate = SSL_WRITING;
+            if (BIO_flush(s->wbio) <= 0) {
+                /*
+                 * If the write error was fatal, stop trying
+                 */
+                if (!BIO_should_retry(s->wbio)) {
+                    s->rwstate = SSL_NOTHING;
+                    s->state = s->s3->tmp.next_state;
+                }
+
+                ret = -1;
+                goto end;
+            }
+            s->rwstate = SSL_NOTHING;
+            s->state = s->s3->tmp.next_state;
+            break;
+
+        case SSL_ST_OK:
+            /* clean a few things up */
+            ssl3_cleanup_key_block(s);
+
+#if 0
+            if (s->init_buf != NULL) {
+                BUF_MEM_free(s->init_buf);
+                s->init_buf = NULL;
+            }
+#endif
+
+            /*
+             * If we are not 'joining' the last two packets, remove the
+             * buffering now
+             */
+            if (!(s->s3->flags & SSL3_FLAGS_POP_BUFFER))
+                ssl_free_wbio_buffer(s);
+            /* else do it later in ssl3_write */
+
+            s->init_num = 0;
+            s->renegotiate = 0;
+            s->new_session = 0;
+
+            ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
+            if (s->hit)
+                s->ctx->stats.sess_hit++;
+
+            ret = 1;
+            /* s->server=0; */
+            s->handshake_func = dtls1_connect;
+            s->ctx->stats.sess_connect_good++;
+
+            if (cb != NULL)
+                cb(s, SSL_CB_HANDSHAKE_DONE, 1);
+
+            /* done with handshaking */
+            s->d1->handshake_read_seq = 0;
+            s->d1->next_handshake_write_seq = 0;
+            goto end;
+            /* break; */
+
+        case SSL_ST_ERR:
+        default:
+            SSLerr(SSL_F_DTLS1_CONNECT, SSL_R_UNKNOWN_STATE);
+            ret = -1;
+            goto end;
+            /* break; */
+        }
+
+        /* did we do anything */
+        if (!s->s3->tmp.reuse_message && !skip) {
+            if (s->debug) {
+                if ((ret = BIO_flush(s->wbio)) <= 0)
+                    goto end;
+            }
+
+            if ((cb != NULL) && (s->state != state)) {
+                new_state = s->state;
+                s->state = state;
+                cb(s, SSL_CB_CONNECT_LOOP, 1);
+                s->state = new_state;
+            }
+        }
+        skip = 0;
+    }
+ end:
+    s->in_handshake--;
+
+#ifndef OPENSSL_NO_SCTP
+    /*
+     * Notify SCTP BIO socket to leave handshake mode and allow stream
+     * identifier other than 0. Will be ignored if no SCTP is used.
+     */
+    BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
+             s->in_handshake, NULL);
+#endif
+
+    if (buf != NULL)
+        BUF_MEM_free(buf);
+    if (cb != NULL)
+        cb(s, SSL_CB_CONNECT_EXIT, ret);
+    return (ret);
+}
+
+static int dtls1_get_hello_verify(SSL *s)
+{
+    int n, al, ok = 0;
+    unsigned char *data;
+    unsigned int cookie_len;
+
+    s->first_packet = 1;
+    n = s->method->ssl_get_message(s,
+                                   DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
+                                   DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
+                                   -1, s->max_cert_list, &ok);
+    s->first_packet = 0;
+
+    if (!ok)
+        return ((int)n);
+
+    if (s->s3->tmp.message_type != DTLS1_MT_HELLO_VERIFY_REQUEST) {
+        s->d1->send_cookie = 0;
+        s->s3->tmp.reuse_message = 1;
+        return (1);
+    }
+
+    data = (unsigned char *)s->init_msg;
+#if 0
+    if (s->method->version != DTLS_ANY_VERSION &&
+        ((data[0] != (s->version >> 8)) || (data[1] != (s->version & 0xff))))
+    {
+        SSLerr(SSL_F_DTLS1_GET_HELLO_VERIFY, SSL_R_WRONG_SSL_VERSION);
+        s->version = (s->version & 0xff00) | data[1];
+        al = SSL_AD_PROTOCOL_VERSION;
+        goto f_err;
+    }
+#endif
+    data += 2;
+
+    cookie_len = *(data++);
+    if (cookie_len > sizeof(s->d1->cookie)) {
+        al = SSL_AD_ILLEGAL_PARAMETER;
+        goto f_err;
+    }
+
+    memcpy(s->d1->cookie, data, cookie_len);
+    s->d1->cookie_len = cookie_len;
+
+    s->d1->send_cookie = 1;
+    return 1;
+
+ f_err:
+    ssl3_send_alert(s, SSL3_AL_FATAL, al);
+    s->state = SSL_ST_ERR;
+    return -1;
+}

openssl-1.0.2f/ssl/d1_lib.c

@@ -0,0 +1,573 @@
+/* ssl/d1_lib.c */
+/*
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#define USE_SOCKETS
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+#if defined(OPENSSL_SYS_VMS)
+# include <sys/timeb.h>
+#endif
+
+static void get_current_time(struct timeval *t);
+static void dtls1_set_handshake_header(SSL *s, int type, unsigned long len);
+static int dtls1_handshake_write(SSL *s);
+const char dtls1_version_str[] = "DTLSv1" OPENSSL_VERSION_PTEXT;
+int dtls1_listen(SSL *s, struct sockaddr *client);
+
+SSL3_ENC_METHOD DTLSv1_enc_data = {
+    tls1_enc,
+    tls1_mac,
+    tls1_setup_key_block,
+    tls1_generate_master_secret,
+    tls1_change_cipher_state,
+    tls1_final_finish_mac,
+    TLS1_FINISH_MAC_LENGTH,
+    tls1_cert_verify_mac,
+    TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
+    TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
+    tls1_alert_code,
+    tls1_export_keying_material,
+    SSL_ENC_FLAG_DTLS | SSL_ENC_FLAG_EXPLICIT_IV,
+    DTLS1_HM_HEADER_LENGTH,
+    dtls1_set_handshake_header,
+    dtls1_handshake_write
+};
+
+SSL3_ENC_METHOD DTLSv1_2_enc_data = {
+    tls1_enc,
+    tls1_mac,
+    tls1_setup_key_block,
+    tls1_generate_master_secret,
+    tls1_change_cipher_state,
+    tls1_final_finish_mac,
+    TLS1_FINISH_MAC_LENGTH,
+    tls1_cert_verify_mac,
+    TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
+    TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
+    tls1_alert_code,
+    tls1_export_keying_material,
+    SSL_ENC_FLAG_DTLS | SSL_ENC_FLAG_EXPLICIT_IV | SSL_ENC_FLAG_SIGALGS
+        | SSL_ENC_FLAG_SHA256_PRF | SSL_ENC_FLAG_TLS1_2_CIPHERS,
+    DTLS1_HM_HEADER_LENGTH,
+    dtls1_set_handshake_header,
+    dtls1_handshake_write
+};
+
+long dtls1_default_timeout(void)
+{
+    /*
+     * 2 hours, the 24 hours mentioned in the DTLSv1 spec is way too long for
+     * http, the cache would over fill
+     */
+    return (60 * 60 * 2);
+}
+
+int dtls1_new(SSL *s)
+{
+    DTLS1_STATE *d1;
+
+    if (!ssl3_new(s))
+        return (0);
+    if ((d1 = OPENSSL_malloc(sizeof *d1)) == NULL)
+        return (0);
+    memset(d1, 0, sizeof *d1);
+
+    /* d1->handshake_epoch=0; */
+
+    d1->unprocessed_rcds.q = pqueue_new();
+    d1->processed_rcds.q = pqueue_new();
+    d1->buffered_messages = pqueue_new();
+    d1->sent_messages = pqueue_new();
+    d1->buffered_app_data.q = pqueue_new();
+
+    if (s->server) {
+        d1->cookie_len = sizeof(s->d1->cookie);
+    }
+
+    d1->link_mtu = 0;
+    d1->mtu = 0;
+
+    if (!d1->unprocessed_rcds.q || !d1->processed_rcds.q
+        || !d1->buffered_messages || !d1->sent_messages
+        || !d1->buffered_app_data.q) {
+        if (d1->unprocessed_rcds.q)
+            pqueue_free(d1->unprocessed_rcds.q);
+        if (d1->processed_rcds.q)
+            pqueue_free(d1->processed_rcds.q);
+        if (d1->buffered_messages)
+            pqueue_free(d1->buffered_messages);
+        if (d1->sent_messages)
+            pqueue_free(d1->sent_messages);
+        if (d1->buffered_app_data.q)
+            pqueue_free(d1->buffered_app_data.q);
+        OPENSSL_free(d1);
+        return (0);
+    }
+
+    s->d1 = d1;
+    s->method->ssl_clear(s);
+    return (1);
+}
+
+static void dtls1_clear_queues(SSL *s)
+{
+    pitem *item = NULL;
+    hm_fragment *frag = NULL;
+    DTLS1_RECORD_DATA *rdata;
+
+    while ((item = pqueue_pop(s->d1->unprocessed_rcds.q)) != NULL) {
+        rdata = (DTLS1_RECORD_DATA *)item->data;
+        if (rdata->rbuf.buf) {
+            OPENSSL_free(rdata->rbuf.buf);
+        }
+        OPENSSL_free(item->data);
+        pitem_free(item);
+    }
+
+    while ((item = pqueue_pop(s->d1->processed_rcds.q)) != NULL) {
+        rdata = (DTLS1_RECORD_DATA *)item->data;
+        if (rdata->rbuf.buf) {
+            OPENSSL_free(rdata->rbuf.buf);
+        }
+        OPENSSL_free(item->data);
+        pitem_free(item);
+    }
+
+    while ((item = pqueue_pop(s->d1->buffered_messages)) != NULL) {
+        frag = (hm_fragment *)item->data;
+        dtls1_hm_fragment_free(frag);
+        pitem_free(item);
+    }
+
+    while ((item = pqueue_pop(s->d1->sent_messages)) != NULL) {
+        frag = (hm_fragment *)item->data;
+        dtls1_hm_fragment_free(frag);
+        pitem_free(item);
+    }
+
+    while ((item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL) {
+        rdata = (DTLS1_RECORD_DATA *)item->data;
+        if (rdata->rbuf.buf) {
+            OPENSSL_free(rdata->rbuf.buf);
+        }
+        OPENSSL_free(item->data);
+        pitem_free(item);
+    }
+}
+
+void dtls1_free(SSL *s)
+{
+    ssl3_free(s);
+
+    dtls1_clear_queues(s);
+
+    pqueue_free(s->d1->unprocessed_rcds.q);
+    pqueue_free(s->d1->processed_rcds.q);
+    pqueue_free(s->d1->buffered_messages);
+    pqueue_free(s->d1->sent_messages);
+    pqueue_free(s->d1->buffered_app_data.q);
+
+    OPENSSL_free(s->d1);
+    s->d1 = NULL;
+}
+
+void dtls1_clear(SSL *s)
+{
+    pqueue unprocessed_rcds;
+    pqueue processed_rcds;
+    pqueue buffered_messages;
+    pqueue sent_messages;
+    pqueue buffered_app_data;
+    unsigned int mtu;
+    unsigned int link_mtu;
+
+    if (s->d1) {
+        unprocessed_rcds = s->d1->unprocessed_rcds.q;
+        processed_rcds = s->d1->processed_rcds.q;
+        buffered_messages = s->d1->buffered_messages;
+        sent_messages = s->d1->sent_messages;
+        buffered_app_data = s->d1->buffered_app_data.q;
+        mtu = s->d1->mtu;
+        link_mtu = s->d1->link_mtu;
+
+        dtls1_clear_queues(s);
+
+        memset(s->d1, 0, sizeof(*(s->d1)));
+
+        if (s->server) {
+            s->d1->cookie_len = sizeof(s->d1->cookie);
+        }
+
+        if (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU) {
+            s->d1->mtu = mtu;
+            s->d1->link_mtu = link_mtu;
+        }
+
+        s->d1->unprocessed_rcds.q = unprocessed_rcds;
+        s->d1->processed_rcds.q = processed_rcds;
+        s->d1->buffered_messages = buffered_messages;
+        s->d1->sent_messages = sent_messages;
+        s->d1->buffered_app_data.q = buffered_app_data;
+    }
+
+    ssl3_clear(s);
+    if (s->options & SSL_OP_CISCO_ANYCONNECT)
+        s->client_version = s->version = DTLS1_BAD_VER;
+    else if (s->method->version == DTLS_ANY_VERSION)
+        s->version = DTLS1_2_VERSION;
+    else
+        s->version = s->method->version;
+}
+
+long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg)
+{
+    int ret = 0;
+
+    switch (cmd) {
+    case DTLS_CTRL_GET_TIMEOUT:
+        if (dtls1_get_timeout(s, (struct timeval *)parg) != NULL) {
+            ret = 1;
+        }
+        break;
+    case DTLS_CTRL_HANDLE_TIMEOUT:
+        ret = dtls1_handle_timeout(s);
+        break;
+    case DTLS_CTRL_LISTEN:
+        ret = dtls1_listen(s, parg);
+        break;
+    case SSL_CTRL_CHECK_PROTO_VERSION:
+        /*
+         * For library-internal use; checks that the current protocol is the
+         * highest enabled version (according to s->ctx->method, as version
+         * negotiation may have changed s->method).
+         */
+        if (s->version == s->ctx->method->version)
+            return 1;
+        /*
+         * Apparently we're using a version-flexible SSL_METHOD (not at its
+         * highest protocol version).
+         */
+        if (s->ctx->method->version == DTLS_method()->version) {
+#if DTLS_MAX_VERSION != DTLS1_2_VERSION
+# error Code needs update for DTLS_method() support beyond DTLS1_2_VERSION.
+#endif
+            if (!(s->options & SSL_OP_NO_DTLSv1_2))
+                return s->version == DTLS1_2_VERSION;
+            if (!(s->options & SSL_OP_NO_DTLSv1))
+                return s->version == DTLS1_VERSION;
+        }
+        return 0;               /* Unexpected state; fail closed. */
+    case DTLS_CTRL_SET_LINK_MTU:
+        if (larg < (long)dtls1_link_min_mtu())
+            return 0;
+        s->d1->link_mtu = larg;
+        return 1;
+    case DTLS_CTRL_GET_LINK_MIN_MTU:
+        return (long)dtls1_link_min_mtu();
+    case SSL_CTRL_SET_MTU:
+        /*
+         *  We may not have a BIO set yet so can't call dtls1_min_mtu()
+         *  We'll have to make do with dtls1_link_min_mtu() and max overhead
+         */
+        if (larg < (long)dtls1_link_min_mtu() - DTLS1_MAX_MTU_OVERHEAD)
+            return 0;
+        s->d1->mtu = larg;
+        return larg;
+    default:
+        ret = ssl3_ctrl(s, cmd, larg, parg);
+        break;
+    }
+    return (ret);
+}
+
+/*
+ * As it's impossible to use stream ciphers in "datagram" mode, this
+ * simple filter is designed to disengage them in DTLS. Unfortunately
+ * there is no universal way to identify stream SSL_CIPHER, so we have
+ * to explicitly list their SSL_* codes. Currently RC4 is the only one
+ * available, but if new ones emerge, they will have to be added...
+ */
+const SSL_CIPHER *dtls1_get_cipher(unsigned int u)
+{
+    const SSL_CIPHER *ciph = ssl3_get_cipher(u);
+
+    if (ciph != NULL) {
+        if (ciph->algorithm_enc == SSL_RC4)
+            return NULL;
+    }
+
+    return ciph;
+}
+
+void dtls1_start_timer(SSL *s)
+{
+#ifndef OPENSSL_NO_SCTP
+    /* Disable timer for SCTP */
+    if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+        memset(&(s->d1->next_timeout), 0, sizeof(struct timeval));
+        return;
+    }
+#endif
+
+    /* If timer is not set, initialize duration with 1 second */
+    if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) {
+        s->d1->timeout_duration = 1;
+    }
+
+    /* Set timeout to current time */
+    get_current_time(&(s->d1->next_timeout));
+
+    /* Add duration to current time */
+    s->d1->next_timeout.tv_sec += s->d1->timeout_duration;
+    BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0,
+             &(s->d1->next_timeout));
+}
+
+struct timeval *dtls1_get_timeout(SSL *s, struct timeval *timeleft)
+{
+    struct timeval timenow;
+
+    /* If no timeout is set, just return NULL */
+    if (s->d1->next_timeout.tv_sec == 0 && s->d1->next_timeout.tv_usec == 0) {
+        return NULL;
+    }
+
+    /* Get current time */
+    get_current_time(&timenow);
+
+    /* If timer already expired, set remaining time to 0 */
+    if (s->d1->next_timeout.tv_sec < timenow.tv_sec ||
+        (s->d1->next_timeout.tv_sec == timenow.tv_sec &&
+         s->d1->next_timeout.tv_usec <= timenow.tv_usec)) {
+        memset(timeleft, 0, sizeof(struct timeval));
+        return timeleft;
+    }
+
+    /* Calculate time left until timer expires */
+    memcpy(timeleft, &(s->d1->next_timeout), sizeof(struct timeval));
+    timeleft->tv_sec -= timenow.tv_sec;
+    timeleft->tv_usec -= timenow.tv_usec;
+    if (timeleft->tv_usec < 0) {
+        timeleft->tv_sec--;
+        timeleft->tv_usec += 1000000;
+    }
+
+    /*
+     * If remaining time is less than 15 ms, set it to 0 to prevent issues
+     * because of small devergences with socket timeouts.
+     */
+    if (timeleft->tv_sec == 0 && timeleft->tv_usec < 15000) {
+        memset(timeleft, 0, sizeof(struct timeval));
+    }
+
+    return timeleft;
+}
+
+int dtls1_is_timer_expired(SSL *s)
+{
+    struct timeval timeleft;
+
+    /* Get time left until timeout, return false if no timer running */
+    if (dtls1_get_timeout(s, &timeleft) == NULL) {
+        return 0;
+    }
+
+    /* Return false if timer is not expired yet */
+    if (timeleft.tv_sec > 0 || timeleft.tv_usec > 0) {
+        return 0;
+    }
+
+    /* Timer expired, so return true */
+    return 1;
+}
+
+void dtls1_double_timeout(SSL *s)
+{
+    s->d1->timeout_duration *= 2;
+    if (s->d1->timeout_duration > 60)
+        s->d1->timeout_duration = 60;
+    dtls1_start_timer(s);
+}
+
+void dtls1_stop_timer(SSL *s)
+{
+    /* Reset everything */
+    memset(&(s->d1->timeout), 0, sizeof(struct dtls1_timeout_st));
+    memset(&(s->d1->next_timeout), 0, sizeof(struct timeval));
+    s->d1->timeout_duration = 1;
+    BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT, 0,
+             &(s->d1->next_timeout));
+    /* Clear retransmission buffer */
+    dtls1_clear_record_buffer(s);
+}
+
+int dtls1_check_timeout_num(SSL *s)
+{
+    unsigned int mtu;
+
+    s->d1->timeout.num_alerts++;
+
+    /* Reduce MTU after 2 unsuccessful retransmissions */
+    if (s->d1->timeout.num_alerts > 2
+        && !(SSL_get_options(s) & SSL_OP_NO_QUERY_MTU)) {
+        mtu =
+            BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_GET_FALLBACK_MTU, 0,
+                     NULL);
+        if (mtu < s->d1->mtu)
+            s->d1->mtu = mtu;
+    }
+
+    if (s->d1->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) {
+        /* fail the connection, enough alerts have been sent */
+        SSLerr(SSL_F_DTLS1_CHECK_TIMEOUT_NUM, SSL_R_READ_TIMEOUT_EXPIRED);
+        return -1;
+    }
+
+    return 0;
+}
+
+int dtls1_handle_timeout(SSL *s)
+{
+    /* if no timer is expired, don't do anything */
+    if (!dtls1_is_timer_expired(s)) {
+        return 0;
+    }
+
+    dtls1_double_timeout(s);
+
+    if (dtls1_check_timeout_num(s) < 0)
+        return -1;
+
+    s->d1->timeout.read_timeouts++;
+    if (s->d1->timeout.read_timeouts > DTLS1_TMO_READ_COUNT) {
+        s->d1->timeout.read_timeouts = 1;
+    }
+#ifndef OPENSSL_NO_HEARTBEATS
+    if (s->tlsext_hb_pending) {
+        s->tlsext_hb_pending = 0;
+        return dtls1_heartbeat(s);
+    }
+#endif
+
+    dtls1_start_timer(s);
+    return dtls1_retransmit_buffered_messages(s);
+}
+
+static void get_current_time(struct timeval *t)
+{
+#if defined(_WIN32)
+    SYSTEMTIME st;
+    union {
+        unsigned __int64 ul;
+        FILETIME ft;
+    } now;
+
+    GetSystemTime(&st);
+    SystemTimeToFileTime(&st, &now.ft);
+# ifdef  __MINGW32__
+    now.ul -= 116444736000000000ULL;
+# else
+    now.ul -= 116444736000000000UI64; /* re-bias to 1/1/1970 */
+# endif
+    t->tv_sec = (long)(now.ul / 10000000);
+    t->tv_usec = ((int)(now.ul % 10000000)) / 10;
+#elif defined(OPENSSL_SYS_VMS)
+    struct timeb tb;
+    ftime(&tb);
+    t->tv_sec = (long)tb.time;
+    t->tv_usec = (long)tb.millitm * 1000;
+#else
+    gettimeofday(t, NULL);
+#endif
+}
+
+int dtls1_listen(SSL *s, struct sockaddr *client)
+{
+    int ret;
+
+    /* Ensure there is no state left over from a previous invocation */
+    SSL_clear(s);
+
+    SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);
+    s->d1->listen = 1;
+
+    ret = SSL_accept(s);
+    if (ret <= 0)
+        return ret;
+
+    (void)BIO_dgram_get_peer(SSL_get_rbio(s), client);
+    return 1;
+}
+
+static void dtls1_set_handshake_header(SSL *s, int htype, unsigned long len)
+{
+    unsigned char *p = (unsigned char *)s->init_buf->data;
+    dtls1_set_message_header(s, p, htype, len, 0, len);
+    s->init_num = (int)len + DTLS1_HM_HEADER_LENGTH;
+    s->init_off = 0;
+    /* Buffer the message to handle re-xmits */
+    dtls1_buffer_message(s, 0);
+}
+
+static int dtls1_handshake_write(SSL *s)
+{
+    return dtls1_do_write(s, SSL3_RT_HANDSHAKE);
+}

openssl-1.0.2f/ssl/d1_meth.c

@@ -0,0 +1,90 @@
+/* ssl/d1_meth.h */
+/*
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+static const SSL_METHOD *dtls1_get_method(int ver);
+static const SSL_METHOD *dtls1_get_method(int ver)
+{
+    if (ver == DTLS_ANY_VERSION)
+        return DTLS_method();
+    else if (ver == DTLS1_VERSION)
+        return DTLSv1_method();
+    else if (ver == DTLS1_2_VERSION)
+        return DTLSv1_2_method();
+    else
+        return NULL;
+}
+
+IMPLEMENT_dtls1_meth_func(DTLS1_VERSION,
+                          DTLSv1_method,
+                          dtls1_accept,
+                          dtls1_connect, dtls1_get_method, DTLSv1_enc_data)
+
+IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION,
+                          DTLSv1_2_method,
+                          dtls1_accept,
+                          dtls1_connect, dtls1_get_method, DTLSv1_2_enc_data)
+
+IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION,
+                          DTLS_method,
+                          dtls1_accept,
+                          dtls1_connect, dtls1_get_method, DTLSv1_2_enc_data)

openssl-1.0.2f/ssl/d1_srtp.c

@@ -0,0 +1,448 @@
+/* ssl/t1_lib.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/*
+ * DTLS code by Eric Rescorla <ekr@rtfm.com>
+ *
+ * Copyright (C) 2006, Network Resonance, Inc. Copyright (C) 2011, RTFM, Inc.
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+#include "srtp.h"
+
+#ifndef OPENSSL_NO_SRTP
+
+static SRTP_PROTECTION_PROFILE srtp_known_profiles[] = {
+    {
+     "SRTP_AES128_CM_SHA1_80",
+     SRTP_AES128_CM_SHA1_80,
+     },
+    {
+     "SRTP_AES128_CM_SHA1_32",
+     SRTP_AES128_CM_SHA1_32,
+     },
+# if 0
+    {
+     "SRTP_NULL_SHA1_80",
+     SRTP_NULL_SHA1_80,
+     },
+    {
+     "SRTP_NULL_SHA1_32",
+     SRTP_NULL_SHA1_32,
+     },
+# endif
+    {0}
+};
+
+static int find_profile_by_name(char *profile_name,
+                                SRTP_PROTECTION_PROFILE **pptr, unsigned len)
+{
+    SRTP_PROTECTION_PROFILE *p;
+
+    p = srtp_known_profiles;
+    while (p->name) {
+        if ((len == strlen(p->name)) && !strncmp(p->name, profile_name, len)) {
+            *pptr = p;
+            return 0;
+        }
+
+        p++;
+    }
+
+    return 1;
+}
+
+static int ssl_ctx_make_profiles(const char *profiles_string,
+                                 STACK_OF(SRTP_PROTECTION_PROFILE) **out)
+{
+    STACK_OF(SRTP_PROTECTION_PROFILE) *profiles;
+
+    char *col;
+    char *ptr = (char *)profiles_string;
+
+    SRTP_PROTECTION_PROFILE *p;
+
+    if (!(profiles = sk_SRTP_PROTECTION_PROFILE_new_null())) {
+        SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,
+               SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES);
+        return 1;
+    }
+
+    do {
+        col = strchr(ptr, ':');
+
+        if (!find_profile_by_name(ptr, &p,
+                                  col ? col - ptr : (int)strlen(ptr))) {
+            if (sk_SRTP_PROTECTION_PROFILE_find(profiles, p) >= 0) {
+                SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,
+                       SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+                sk_SRTP_PROTECTION_PROFILE_free(profiles);
+                return 1;
+            }
+
+            sk_SRTP_PROTECTION_PROFILE_push(profiles, p);
+        } else {
+            SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,
+                   SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE);
+            sk_SRTP_PROTECTION_PROFILE_free(profiles);
+            return 1;
+        }
+
+        if (col)
+            ptr = col + 1;
+    } while (col);
+
+    *out = profiles;
+
+    return 0;
+}
+
+int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles)
+{
+    return ssl_ctx_make_profiles(profiles, &ctx->srtp_profiles);
+}
+
+int SSL_set_tlsext_use_srtp(SSL *s, const char *profiles)
+{
+    return ssl_ctx_make_profiles(profiles, &s->srtp_profiles);
+}
+
+STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *s)
+{
+    if (s != NULL) {
+        if (s->srtp_profiles != NULL) {
+            return s->srtp_profiles;
+        } else if ((s->ctx != NULL) && (s->ctx->srtp_profiles != NULL)) {
+            return s->ctx->srtp_profiles;
+        }
+    }
+
+    return NULL;
+}
+
+SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s)
+{
+    return s->srtp_profile;
+}
+
+/*
+ * Note: this function returns 0 length if there are no profiles specified
+ */
+int ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len,
+                                     int maxlen)
+{
+    int ct = 0;
+    int i;
+    STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = 0;
+    SRTP_PROTECTION_PROFILE *prof;
+
+    clnt = SSL_get_srtp_profiles(s);
+    ct = sk_SRTP_PROTECTION_PROFILE_num(clnt); /* -1 if clnt == 0 */
+
+    if (p) {
+        if (ct == 0) {
+            SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT,
+                   SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST);
+            return 1;
+        }
+
+        if ((2 + ct * 2 + 1) > maxlen) {
+            SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT,
+                   SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
+            return 1;
+        }
+
+        /* Add the length */
+        s2n(ct * 2, p);
+        for (i = 0; i < ct; i++) {
+            prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
+            s2n(prof->id, p);
+        }
+
+        /* Add an empty use_mki value */
+        *p++ = 0;
+    }
+
+    *len = 2 + ct * 2 + 1;
+
+    return 0;
+}
+
+int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,
+                                       int *al)
+{
+    SRTP_PROTECTION_PROFILE *sprof;
+    STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
+    int ct;
+    int mki_len;
+    int i, srtp_pref;
+    unsigned int id;
+
+    /* Length value + the MKI length */
+    if (len < 3) {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    /* Pull off the length of the cipher suite list */
+    n2s(d, ct);
+    len -= 2;
+
+    /* Check that it is even */
+    if (ct % 2) {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    /* Check that lengths are consistent */
+    if (len < (ct + 1)) {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    srvr = SSL_get_srtp_profiles(s);
+    s->srtp_profile = NULL;
+    /* Search all profiles for a match initially */
+    srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
+
+    while (ct) {
+        n2s(d, id);
+        ct -= 2;
+        len -= 2;
+
+        /*
+         * Only look for match in profiles of higher preference than
+         * current match.
+         * If no profiles have been have been configured then this
+         * does nothing.
+         */
+        for (i = 0; i < srtp_pref; i++) {
+            sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
+            if (sprof->id == id) {
+                s->srtp_profile = sprof;
+                srtp_pref = i;
+                break;
+            }
+        }
+    }
+
+    /*
+     * Now extract the MKI value as a sanity check, but discard it for now
+     */
+    mki_len = *d;
+    d++;
+    len--;
+
+    if (mki_len != len) {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_MKI_VALUE);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    return 0;
+}
+
+int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len,
+                                     int maxlen)
+{
+    if (p) {
+        if (maxlen < 5) {
+            SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT,
+                   SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
+            return 1;
+        }
+
+        if (s->srtp_profile == 0) {
+            SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT,
+                   SSL_R_USE_SRTP_NOT_NEGOTIATED);
+            return 1;
+        }
+        s2n(2, p);
+        s2n(s->srtp_profile->id, p);
+        *p++ = 0;
+    }
+    *len = 5;
+
+    return 0;
+}
+
+int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len,
+                                       int *al)
+{
+    unsigned id;
+    int i;
+    int ct;
+
+    STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
+    SRTP_PROTECTION_PROFILE *prof;
+
+    if (len != 5) {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    n2s(d, ct);
+    if (ct != 2) {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    n2s(d, id);
+    if (*d) {                   /* Must be no MKI, since we never offer one */
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,
+               SSL_R_BAD_SRTP_MKI_VALUE);
+        *al = SSL_AD_ILLEGAL_PARAMETER;
+        return 1;
+    }
+
+    clnt = SSL_get_srtp_profiles(s);
+
+    /* Throw an error if the server gave us an unsolicited extension */
+    if (clnt == NULL) {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,
+               SSL_R_NO_SRTP_PROFILES);
+        *al = SSL_AD_DECODE_ERROR;
+        return 1;
+    }
+
+    /*
+     * Check to see if the server gave us something we support (and
+     * presumably offered)
+     */
+    for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
+        prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
+
+        if (prof->id == id) {
+            s->srtp_profile = prof;
+            *al = 0;
+            return 0;
+        }
+    }
+
+    SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT,
+           SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
+    *al = SSL_AD_DECODE_ERROR;
+    return 1;
+}
+
+#endif

openssl-1.0.2f/ssl/d1_srvr.c

@@ -0,0 +1,980 @@
+/* ssl/d1_srvr.c */
+/*
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/md5.h>
+#include <openssl/bn.h>
+#ifndef OPENSSL_NO_DH
+# include <openssl/dh.h>
+#endif
+
+static const SSL_METHOD *dtls1_get_server_method(int ver);
+static int dtls1_send_hello_verify_request(SSL *s);
+
+static const SSL_METHOD *dtls1_get_server_method(int ver)
+{
+    if (ver == DTLS_ANY_VERSION)
+        return DTLS_server_method();
+    else if (ver == DTLS1_VERSION)
+        return DTLSv1_server_method();
+    else if (ver == DTLS1_2_VERSION)
+        return DTLSv1_2_server_method();
+    else
+        return NULL;
+}
+
+IMPLEMENT_dtls1_meth_func(DTLS1_VERSION,
+                          DTLSv1_server_method,
+                          dtls1_accept,
+                          ssl_undefined_function,
+                          dtls1_get_server_method, DTLSv1_enc_data)
+
+IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION,
+                          DTLSv1_2_server_method,
+                          dtls1_accept,
+                          ssl_undefined_function,
+                          dtls1_get_server_method, DTLSv1_2_enc_data)
+
+IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION,
+                          DTLS_server_method,
+                          dtls1_accept,
+                          ssl_undefined_function,
+                          dtls1_get_server_method, DTLSv1_2_enc_data)
+
+int dtls1_accept(SSL *s)
+{
+    BUF_MEM *buf;
+    unsigned long Time = (unsigned long)time(NULL);
+    void (*cb) (const SSL *ssl, int type, int val) = NULL;
+    unsigned long alg_k;
+    int ret = -1;
+    int new_state, state, skip = 0;
+    int listen;
+#ifndef OPENSSL_NO_SCTP
+    unsigned char sctpauthkey[64];
+    char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
+#endif
+
+    RAND_add(&Time, sizeof(Time), 0);
+    ERR_clear_error();
+    clear_sys_error();
+
+    if (s->info_callback != NULL)
+        cb = s->info_callback;
+    else if (s->ctx->info_callback != NULL)
+        cb = s->ctx->info_callback;
+
+    listen = s->d1->listen;
+
+    /* init things to blank */
+    s->in_handshake++;
+    if (!SSL_in_init(s) || SSL_in_before(s))
+        SSL_clear(s);
+
+    s->d1->listen = listen;
+#ifndef OPENSSL_NO_SCTP
+    /*
+     * Notify SCTP BIO socket to enter handshake mode and prevent stream
+     * identifier other than 0. Will be ignored if no SCTP is used.
+     */
+    BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
+             s->in_handshake, NULL);
+#endif
+
+    if (s->cert == NULL) {
+        SSLerr(SSL_F_DTLS1_ACCEPT, SSL_R_NO_CERTIFICATE_SET);
+        return (-1);
+    }
+#ifndef OPENSSL_NO_HEARTBEATS
+    /*
+     * If we're awaiting a HeartbeatResponse, pretend we already got and
+     * don't await it anymore, because Heartbeats don't make sense during
+     * handshakes anyway.
+     */
+    if (s->tlsext_hb_pending) {
+        dtls1_stop_timer(s);
+        s->tlsext_hb_pending = 0;
+        s->tlsext_hb_seq++;
+    }
+#endif
+
+    for (;;) {
+        state = s->state;
+
+        switch (s->state) {
+        case SSL_ST_RENEGOTIATE:
+            s->renegotiate = 1;
+            /* s->state=SSL_ST_ACCEPT; */
+
+        case SSL_ST_BEFORE:
+        case SSL_ST_ACCEPT:
+        case SSL_ST_BEFORE | SSL_ST_ACCEPT:
+        case SSL_ST_OK | SSL_ST_ACCEPT:
+
+            s->server = 1;
+            if (cb != NULL)
+                cb(s, SSL_CB_HANDSHAKE_START, 1);
+
+            if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00)) {
+                SSLerr(SSL_F_DTLS1_ACCEPT, ERR_R_INTERNAL_ERROR);
+                return -1;
+            }
+            s->type = SSL_ST_ACCEPT;
+
+            if (s->init_buf == NULL) {
+                if ((buf = BUF_MEM_new()) == NULL) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
+                    BUF_MEM_free(buf);
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+                s->init_buf = buf;
+            }
+
+            if (!ssl3_setup_buffers(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            s->init_num = 0;
+            s->d1->change_cipher_spec_ok = 0;
+            /*
+             * Should have been reset by ssl3_get_finished, too.
+             */
+            s->s3->change_cipher_spec = 0;
+
+            if (s->state != SSL_ST_RENEGOTIATE) {
+                /*
+                 * Ok, we now need to push on a buffering BIO so that the
+                 * output is sent in a way that TCP likes :-) ...but not with
+                 * SCTP :-)
+                 */
+#ifndef OPENSSL_NO_SCTP
+                if (!BIO_dgram_is_sctp(SSL_get_wbio(s)))
+#endif
+                    if (!ssl_init_wbio_buffer(s, 1)) {
+                        ret = -1;
+                        s->state = SSL_ST_ERR;
+                        goto end;
+                    }
+
+                ssl3_init_finished_mac(s);
+                s->state = SSL3_ST_SR_CLNT_HELLO_A;
+                s->ctx->stats.sess_accept++;
+            } else if (!s->s3->send_connection_binding &&
+                       !(s->options &
+                         SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
+                /*
+                 * Server attempting to renegotiate with client that doesn't
+                 * support secure renegotiation.
+                 */
+                SSLerr(SSL_F_DTLS1_ACCEPT,
+                       SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            } else {
+                /*
+                 * s->state == SSL_ST_RENEGOTIATE, we will just send a
+                 * HelloRequest
+                 */
+                s->ctx->stats.sess_accept_renegotiate++;
+                s->state = SSL3_ST_SW_HELLO_REQ_A;
+            }
+
+            break;
+
+        case SSL3_ST_SW_HELLO_REQ_A:
+        case SSL3_ST_SW_HELLO_REQ_B:
+
+            s->shutdown = 0;
+            dtls1_clear_record_buffer(s);
+            dtls1_start_timer(s);
+            ret = ssl3_send_hello_request(s);
+            if (ret <= 0)
+                goto end;
+            s->s3->tmp.next_state = SSL3_ST_SR_CLNT_HELLO_A;
+            s->state = SSL3_ST_SW_FLUSH;
+            s->init_num = 0;
+
+            ssl3_init_finished_mac(s);
+            break;
+
+        case SSL3_ST_SW_HELLO_REQ_C:
+            s->state = SSL_ST_OK;
+            break;
+
+        case SSL3_ST_SR_CLNT_HELLO_A:
+        case SSL3_ST_SR_CLNT_HELLO_B:
+        case SSL3_ST_SR_CLNT_HELLO_C:
+
+            s->shutdown = 0;
+            ret = ssl3_get_client_hello(s);
+            if (ret <= 0)
+                goto end;
+            dtls1_stop_timer(s);
+
+            if (ret == 1 && (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE))
+                s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A;
+            else
+                s->state = SSL3_ST_SW_SRVR_HELLO_A;
+
+            s->init_num = 0;
+
+            /*
+             * Reflect ClientHello sequence to remain stateless while
+             * listening
+             */
+            if (listen) {
+                memcpy(s->s3->write_sequence, s->s3->read_sequence,
+                       sizeof(s->s3->write_sequence));
+            }
+
+            /* If we're just listening, stop here */
+            if (listen && s->state == SSL3_ST_SW_SRVR_HELLO_A) {
+                ret = 2;
+                s->d1->listen = 0;
+                /*
+                 * Set expected sequence numbers to continue the handshake.
+                 */
+                s->d1->handshake_read_seq = 2;
+                s->d1->handshake_write_seq = 1;
+                s->d1->next_handshake_write_seq = 1;
+                goto end;
+            }
+
+            break;
+
+        case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A:
+        case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B:
+
+            ret = dtls1_send_hello_verify_request(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_SW_FLUSH;
+            s->s3->tmp.next_state = SSL3_ST_SR_CLNT_HELLO_A;
+
+            /* HelloVerifyRequest resets Finished MAC */
+            if (s->version != DTLS1_BAD_VER)
+                ssl3_init_finished_mac(s);
+            break;
+
+#ifndef OPENSSL_NO_SCTP
+        case DTLS1_SCTP_ST_SR_READ_SOCK:
+
+            if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
+                s->s3->in_read_app_data = 2;
+                s->rwstate = SSL_READING;
+                BIO_clear_retry_flags(SSL_get_rbio(s));
+                BIO_set_retry_read(SSL_get_rbio(s));
+                ret = -1;
+                goto end;
+            }
+
+            s->state = SSL3_ST_SR_FINISHED_A;
+            break;
+
+        case DTLS1_SCTP_ST_SW_WRITE_SOCK:
+            ret = BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s));
+            if (ret < 0)
+                goto end;
+
+            if (ret == 0) {
+                if (s->d1->next_state != SSL_ST_OK) {
+                    s->s3->in_read_app_data = 2;
+                    s->rwstate = SSL_READING;
+                    BIO_clear_retry_flags(SSL_get_rbio(s));
+                    BIO_set_retry_read(SSL_get_rbio(s));
+                    ret = -1;
+                    goto end;
+                }
+            }
+
+            s->state = s->d1->next_state;
+            break;
+#endif
+
+        case SSL3_ST_SW_SRVR_HELLO_A:
+        case SSL3_ST_SW_SRVR_HELLO_B:
+            s->renegotiate = 2;
+            dtls1_start_timer(s);
+            ret = ssl3_send_server_hello(s);
+            if (ret <= 0)
+                goto end;
+
+            if (s->hit) {
+#ifndef OPENSSL_NO_SCTP
+                /*
+                 * Add new shared key for SCTP-Auth, will be ignored if no
+                 * SCTP used.
+                 */
+                snprintf((char *)labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL),
+                         DTLS1_SCTP_AUTH_LABEL);
+
+                if (SSL_export_keying_material(s, sctpauthkey,
+                        sizeof(sctpauthkey), labelbuffer,
+                        sizeof(labelbuffer), NULL, 0, 0) <= 0) {
+                    ret = -1;
+                    s->state = SSL_ST_ERR;
+                    goto end;
+                }
+
+                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
+                         sizeof(sctpauthkey), sctpauthkey);
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+                if (s->tlsext_ticket_expected)
+                    s->state = SSL3_ST_SW_SESSION_TICKET_A;
+                else
+                    s->state = SSL3_ST_SW_CHANGE_A;
+#else
+                s->state = SSL3_ST_SW_CHANGE_A;
+#endif
+            } else
+                s->state = SSL3_ST_SW_CERT_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_SW_CERT_A:
+        case SSL3_ST_SW_CERT_B:
+            /* Check if it is anon DH or normal PSK */
+            if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
+                && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                dtls1_start_timer(s);
+                ret = ssl3_send_server_certificate(s);
+                if (ret <= 0)
+                    goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                if (s->tlsext_status_expected)
+                    s->state = SSL3_ST_SW_CERT_STATUS_A;
+                else
+                    s->state = SSL3_ST_SW_KEY_EXCH_A;
+            } else {
+                skip = 1;
+                s->state = SSL3_ST_SW_KEY_EXCH_A;
+            }
+#else
+            } else
+                skip = 1;
+
+            s->state = SSL3_ST_SW_KEY_EXCH_A;
+#endif
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_SW_KEY_EXCH_A:
+        case SSL3_ST_SW_KEY_EXCH_B:
+            alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
+
+            /*
+             * clear this, it may get reset by
+             * send_server_key_exchange
+             */
+            s->s3->tmp.use_rsa_tmp = 0;
+
+            /*
+             * only send if a DH key exchange or RSA but we have a sign only
+             * certificate
+             */
+            if (0
+                /*
+                 * PSK: send ServerKeyExchange if PSK identity hint if
+                 * provided
+                 */
+#ifndef OPENSSL_NO_PSK
+                || ((alg_k & SSL_kPSK) && s->ctx->psk_identity_hint)
+#endif
+                || (alg_k & SSL_kDHE)
+                || (alg_k & SSL_kEECDH)
+                || ((alg_k & SSL_kRSA)
+                    && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
+                        || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
+                            && EVP_PKEY_size(s->cert->pkeys
+                                             [SSL_PKEY_RSA_ENC].privatekey) *
+                            8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
+                        )
+                    )
+                )
+                ) {
+                dtls1_start_timer(s);
+                ret = ssl3_send_server_key_exchange(s);
+                if (ret <= 0)
+                    goto end;
+            } else
+                skip = 1;
+
+            s->state = SSL3_ST_SW_CERT_REQ_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_SW_CERT_REQ_A:
+        case SSL3_ST_SW_CERT_REQ_B:
+            if (                /* don't request cert unless asked for it: */
+                   !(s->verify_mode & SSL_VERIFY_PEER) ||
+                   /*
+                    * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert
+                    * during re-negotiation:
+                    */
+                   ((s->session->peer != NULL) &&
+                    (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
+                   /*
+                    * never request cert in anonymous ciphersuites (see
+                    * section "Certificate request" in SSL 3 drafts and in
+                    * RFC 2246):
+                    */
+                   ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
+                    /*
+                     * ... except when the application insists on
+                     * verification (against the specs, but s3_clnt.c accepts
+                     * this for SSL 3)
+                     */
+                    !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
+                   /*
+                    * never request cert in Kerberos ciphersuites
+                    */
+                   (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5)
+                   /*
+                    * With normal PSK Certificates and Certificate Requests
+                    * are omitted
+                    */
+                   || (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                /* no cert request */
+                skip = 1;
+                s->s3->tmp.cert_request = 0;
+                s->state = SSL3_ST_SW_SRVR_DONE_A;
+#ifndef OPENSSL_NO_SCTP
+                if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                    s->d1->next_state = SSL3_ST_SW_SRVR_DONE_A;
+                    s->state = DTLS1_SCTP_ST_SW_WRITE_SOCK;
+                }
+#endif
+            } else {
+                s->s3->tmp.cert_request = 1;
+                dtls1_start_timer(s);
+                ret = ssl3_send_certificate_request(s);
+                if (ret <= 0)
+                    goto end;
+#ifndef NETSCAPE_HANG_BUG
+                s->state = SSL3_ST_SW_SRVR_DONE_A;
+# ifndef OPENSSL_NO_SCTP
+                if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                    s->d1->next_state = SSL3_ST_SW_SRVR_DONE_A;
+                    s->state = DTLS1_SCTP_ST_SW_WRITE_SOCK;
+                }
+# endif
+#else
+                s->state = SSL3_ST_SW_FLUSH;
+                s->s3->tmp.next_state = SSL3_ST_SR_CERT_A;
+# ifndef OPENSSL_NO_SCTP
+                if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                    s->d1->next_state = s->s3->tmp.next_state;
+                    s->s3->tmp.next_state = DTLS1_SCTP_ST_SW_WRITE_SOCK;
+                }
+# endif
+#endif
+                s->init_num = 0;
+            }
+            break;
+
+        case SSL3_ST_SW_SRVR_DONE_A:
+        case SSL3_ST_SW_SRVR_DONE_B:
+            dtls1_start_timer(s);
+            ret = ssl3_send_server_done(s);
+            if (ret <= 0)
+                goto end;
+            s->s3->tmp.next_state = SSL3_ST_SR_CERT_A;
+            s->state = SSL3_ST_SW_FLUSH;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_SW_FLUSH:
+            s->rwstate = SSL_WRITING;
+            if (BIO_flush(s->wbio) <= 0) {
+                /*
+                 * If the write error was fatal, stop trying
+                 */
+                if (!BIO_should_retry(s->wbio)) {
+                    s->rwstate = SSL_NOTHING;
+                    s->state = s->s3->tmp.next_state;
+                }
+
+                ret = -1;
+                goto end;
+            }
+            s->rwstate = SSL_NOTHING;
+            s->state = s->s3->tmp.next_state;
+            break;
+
+        case SSL3_ST_SR_CERT_A:
+        case SSL3_ST_SR_CERT_B:
+            if (s->s3->tmp.cert_request) {
+                ret = ssl3_get_client_certificate(s);
+                if (ret <= 0)
+                    goto end;
+            }
+            s->init_num = 0;
+            s->state = SSL3_ST_SR_KEY_EXCH_A;
+            break;
+
+        case SSL3_ST_SR_KEY_EXCH_A:
+        case SSL3_ST_SR_KEY_EXCH_B:
+            ret = ssl3_get_client_key_exchange(s);
+            if (ret <= 0)
+                goto end;
+#ifndef OPENSSL_NO_SCTP
+            /*
+             * Add new shared key for SCTP-Auth, will be ignored if no SCTP
+             * used.
+             */
+            snprintf((char *)labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL),
+                     DTLS1_SCTP_AUTH_LABEL);
+
+            if (SSL_export_keying_material(s, sctpauthkey,
+                                       sizeof(sctpauthkey), labelbuffer,
+                                       sizeof(labelbuffer), NULL, 0, 0) <= 0) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
+                     sizeof(sctpauthkey), sctpauthkey);
+#endif
+
+            s->state = SSL3_ST_SR_CERT_VRFY_A;
+            s->init_num = 0;
+
+            if (ret == 2) {
+                /*
+                 * For the ECDH ciphersuites when the client sends its ECDH
+                 * pub key in a certificate, the CertificateVerify message is
+                 * not sent.
+                 */
+                s->state = SSL3_ST_SR_FINISHED_A;
+                s->init_num = 0;
+            } else if (SSL_USE_SIGALGS(s)) {
+                s->state = SSL3_ST_SR_CERT_VRFY_A;
+                s->init_num = 0;
+                if (!s->session->peer)
+                    break;
+                /*
+                 * For sigalgs freeze the handshake buffer at this point and
+                 * digest cached records.
+                 */
+                if (!s->s3->handshake_buffer) {
+                    SSLerr(SSL_F_DTLS1_ACCEPT, ERR_R_INTERNAL_ERROR);
+                    s->state = SSL_ST_ERR;
+                    return -1;
+                }
+                s->s3->flags |= TLS1_FLAGS_KEEP_HANDSHAKE;
+                if (!ssl3_digest_cached_records(s)) {
+                    s->state = SSL_ST_ERR;
+                    return -1;
+                }
+            } else {
+                s->state = SSL3_ST_SR_CERT_VRFY_A;
+                s->init_num = 0;
+
+                /*
+                 * We need to get hashes here so if there is a client cert,
+                 * it can be verified
+                 */
+                s->method->ssl3_enc->cert_verify_mac(s,
+                                                     NID_md5,
+                                                     &(s->s3->
+                                                       tmp.cert_verify_md
+                                                       [0]));
+                s->method->ssl3_enc->cert_verify_mac(s, NID_sha1,
+                                                     &(s->s3->
+                                                       tmp.cert_verify_md
+                                                       [MD5_DIGEST_LENGTH]));
+            }
+            break;
+
+        case SSL3_ST_SR_CERT_VRFY_A:
+        case SSL3_ST_SR_CERT_VRFY_B:
+            ret = ssl3_get_cert_verify(s);
+            if (ret <= 0)
+                goto end;
+#ifndef OPENSSL_NO_SCTP
+            if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
+                state == SSL_ST_RENEGOTIATE)
+                s->state = DTLS1_SCTP_ST_SR_READ_SOCK;
+            else
+#endif
+                s->state = SSL3_ST_SR_FINISHED_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_SR_FINISHED_A:
+        case SSL3_ST_SR_FINISHED_B:
+            /*
+             * Enable CCS. Receiving a CCS clears the flag, so make
+             * sure not to re-enable it to ban duplicates. This *should* be the
+             * first time we have received one - but we check anyway to be
+             * cautious.
+             * s->s3->change_cipher_spec is set when a CCS is
+             * processed in d1_pkt.c, and remains set until
+             * the client's Finished message is read.
+             */
+            if (!s->s3->change_cipher_spec)
+                s->d1->change_cipher_spec_ok = 1;
+            ret = ssl3_get_finished(s, SSL3_ST_SR_FINISHED_A,
+                                    SSL3_ST_SR_FINISHED_B);
+            if (ret <= 0)
+                goto end;
+            dtls1_stop_timer(s);
+            if (s->hit)
+                s->state = SSL_ST_OK;
+#ifndef OPENSSL_NO_TLSEXT
+            else if (s->tlsext_ticket_expected)
+                s->state = SSL3_ST_SW_SESSION_TICKET_A;
+#endif
+            else
+                s->state = SSL3_ST_SW_CHANGE_A;
+            s->init_num = 0;
+            break;
+
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL3_ST_SW_SESSION_TICKET_A:
+        case SSL3_ST_SW_SESSION_TICKET_B:
+            ret = ssl3_send_newsession_ticket(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_SW_CHANGE_A;
+            s->init_num = 0;
+            break;
+
+        case SSL3_ST_SW_CERT_STATUS_A:
+        case SSL3_ST_SW_CERT_STATUS_B:
+            ret = ssl3_send_cert_status(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_SW_KEY_EXCH_A;
+            s->init_num = 0;
+            break;
+
+#endif
+
+        case SSL3_ST_SW_CHANGE_A:
+        case SSL3_ST_SW_CHANGE_B:
+
+            s->session->cipher = s->s3->tmp.new_cipher;
+            if (!s->method->ssl3_enc->setup_key_block(s)) {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            ret = dtls1_send_change_cipher_spec(s,
+                                                SSL3_ST_SW_CHANGE_A,
+                                                SSL3_ST_SW_CHANGE_B);
+
+            if (ret <= 0)
+                goto end;
+
+#ifndef OPENSSL_NO_SCTP
+            if (!s->hit) {
+                /*
+                 * Change to new shared key of SCTP-Auth, will be ignored if
+                 * no SCTP used.
+                 */
+                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
+                         0, NULL);
+            }
+#endif
+
+            s->state = SSL3_ST_SW_FINISHED_A;
+            s->init_num = 0;
+
+            if (!s->method->ssl3_enc->change_cipher_state(s,
+                                                          SSL3_CHANGE_CIPHER_SERVER_WRITE))
+            {
+                ret = -1;
+                s->state = SSL_ST_ERR;
+                goto end;
+            }
+
+            dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
+            break;
+
+        case SSL3_ST_SW_FINISHED_A:
+        case SSL3_ST_SW_FINISHED_B:
+            ret = ssl3_send_finished(s,
+                                     SSL3_ST_SW_FINISHED_A,
+                                     SSL3_ST_SW_FINISHED_B,
+                                     s->method->
+                                     ssl3_enc->server_finished_label,
+                                     s->method->
+                                     ssl3_enc->server_finished_label_len);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL3_ST_SW_FLUSH;
+            if (s->hit) {
+                s->s3->tmp.next_state = SSL3_ST_SR_FINISHED_A;
+
+#ifndef OPENSSL_NO_SCTP
+                /*
+                 * Change to new shared key of SCTP-Auth, will be ignored if
+                 * no SCTP used.
+                 */
+                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
+                         0, NULL);
+#endif
+            } else {
+                s->s3->tmp.next_state = SSL_ST_OK;
+#ifndef OPENSSL_NO_SCTP
+                if (BIO_dgram_is_sctp(SSL_get_wbio(s))) {
+                    s->d1->next_state = s->s3->tmp.next_state;
+                    s->s3->tmp.next_state = DTLS1_SCTP_ST_SW_WRITE_SOCK;
+                }
+#endif
+            }
+            s->init_num = 0;
+            break;
+
+        case SSL_ST_OK:
+            /* clean a few things up */
+            ssl3_cleanup_key_block(s);
+
+#if 0
+            BUF_MEM_free(s->init_buf);
+            s->init_buf = NULL;
+#endif
+
+            /* remove buffering on output */
+            ssl_free_wbio_buffer(s);
+
+            s->init_num = 0;
+
+            if (s->renegotiate == 2) { /* skipped if we just sent a
+                                        * HelloRequest */
+                s->renegotiate = 0;
+                s->new_session = 0;
+
+                ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
+
+                s->ctx->stats.sess_accept_good++;
+                /* s->server=1; */
+                s->handshake_func = dtls1_accept;
+
+                if (cb != NULL)
+                    cb(s, SSL_CB_HANDSHAKE_DONE, 1);
+            }
+
+            ret = 1;
+
+            /* done handshaking, next message is client hello */
+            s->d1->handshake_read_seq = 0;
+            /* next message is server hello */
+            s->d1->handshake_write_seq = 0;
+            s->d1->next_handshake_write_seq = 0;
+            goto end;
+            /* break; */
+
+        case SSL_ST_ERR:
+        default:
+            SSLerr(SSL_F_DTLS1_ACCEPT, SSL_R_UNKNOWN_STATE);
+            ret = -1;
+            goto end;
+            /* break; */
+        }
+
+        if (!s->s3->tmp.reuse_message && !skip) {
+            if (s->debug) {
+                if ((ret = BIO_flush(s->wbio)) <= 0)
+                    goto end;
+            }
+
+            if ((cb != NULL) && (s->state != state)) {
+                new_state = s->state;
+                s->state = state;
+                cb(s, SSL_CB_ACCEPT_LOOP, 1);
+                s->state = new_state;
+            }
+        }
+        skip = 0;
+    }
+ end:
+    /* BIO_flush(s->wbio); */
+
+    s->in_handshake--;
+#ifndef OPENSSL_NO_SCTP
+    /*
+     * Notify SCTP BIO socket to leave handshake mode and prevent stream
+     * identifier other than 0. Will be ignored if no SCTP is used.
+     */
+    BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
+             s->in_handshake, NULL);
+#endif
+
+    if (cb != NULL)
+        cb(s, SSL_CB_ACCEPT_EXIT, ret);
+    return (ret);
+}
+
+int dtls1_send_hello_verify_request(SSL *s)
+{
+    unsigned int msg_len;
+    unsigned char *msg, *buf, *p;
+
+    if (s->state == DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A) {
+        buf = (unsigned char *)s->init_buf->data;
+
+        msg = p = &(buf[DTLS1_HM_HEADER_LENGTH]);
+        /* Always use DTLS 1.0 version: see RFC 6347 */
+        *(p++) = DTLS1_VERSION >> 8;
+        *(p++) = DTLS1_VERSION & 0xFF;
+
+        if (s->ctx->app_gen_cookie_cb == NULL ||
+            s->ctx->app_gen_cookie_cb(s, s->d1->cookie,
+                                      &(s->d1->cookie_len)) == 0) {
+            SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST,
+                   ERR_R_INTERNAL_ERROR);
+            s->state = SSL_ST_ERR;
+            return 0;
+        }
+
+        *(p++) = (unsigned char)s->d1->cookie_len;
+        memcpy(p, s->d1->cookie, s->d1->cookie_len);
+        p += s->d1->cookie_len;
+        msg_len = p - msg;
+
+        dtls1_set_message_header(s, buf,
+                                 DTLS1_MT_HELLO_VERIFY_REQUEST, msg_len, 0,
+                                 msg_len);
+
+        s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B;
+        /* number of bytes to write */
+        s->init_num = p - buf;
+        s->init_off = 0;
+    }
+
+    /* s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B */
+    return (dtls1_do_write(s, SSL3_RT_HANDSHAKE));
+}

openssl-1.0.2f/ssl/dtls1.h

@@ -0,0 +1,272 @@
+/* ssl/dtls1.h */
+/*
+ * DTLS implementation written by Nagendra Modadugu
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_DTLS1_H
+# define HEADER_DTLS1_H
+
+# include <openssl/buffer.h>
+# include <openssl/pqueue.h>
+# ifdef OPENSSL_SYS_VMS
+#  include <resource.h>
+#  include <sys/timeb.h>
+# endif
+# ifdef OPENSSL_SYS_WIN32
+/* Needed for struct timeval */
+#  include <winsock.h>
+# elif defined(OPENSSL_SYS_NETWARE) && !defined(_WINSOCK2API_)
+#  include <sys/timeval.h>
+# else
+#  if defined(OPENSSL_SYS_VXWORKS)
+#   include <sys/times.h>
+#  else
+#   include <sys/time.h>
+#  endif
+# endif
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+# define DTLS1_VERSION                   0xFEFF
+# define DTLS1_2_VERSION                 0xFEFD
+# define DTLS_MAX_VERSION                DTLS1_2_VERSION
+# define DTLS1_VERSION_MAJOR             0xFE
+
+# define DTLS1_BAD_VER                   0x0100
+
+/* Special value for method supporting multiple versions */
+# define DTLS_ANY_VERSION                0x1FFFF
+
+# if 0
+/* this alert description is not specified anywhere... */
+#  define DTLS1_AD_MISSING_HANDSHAKE_MESSAGE    110
+# endif
+
+/* lengths of messages */
+# define DTLS1_COOKIE_LENGTH                     256
+
+# define DTLS1_RT_HEADER_LENGTH                  13
+
+# define DTLS1_HM_HEADER_LENGTH                  12
+
+# define DTLS1_HM_BAD_FRAGMENT                   -2
+# define DTLS1_HM_FRAGMENT_RETRY                 -3
+
+# define DTLS1_CCS_HEADER_LENGTH                  1
+
+# ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE
+#  define DTLS1_AL_HEADER_LENGTH                   7
+# else
+#  define DTLS1_AL_HEADER_LENGTH                   2
+# endif
+
+# ifndef OPENSSL_NO_SSL_INTERN
+
+#  ifndef OPENSSL_NO_SCTP
+#   define DTLS1_SCTP_AUTH_LABEL   "EXPORTER_DTLS_OVER_SCTP"
+#  endif
+
+/* Max MTU overhead we know about so far is 40 for IPv6 + 8 for UDP */
+#  define DTLS1_MAX_MTU_OVERHEAD                   48
+
+typedef struct dtls1_bitmap_st {
+    unsigned long map;          /* track 32 packets on 32-bit systems and 64
+                                 * - on 64-bit systems */
+    unsigned char max_seq_num[8]; /* max record number seen so far, 64-bit
+                                   * value in big-endian encoding */
+} DTLS1_BITMAP;
+
+struct dtls1_retransmit_state {
+    EVP_CIPHER_CTX *enc_write_ctx; /* cryptographic state */
+    EVP_MD_CTX *write_hash;     /* used for mac generation */
+#  ifndef OPENSSL_NO_COMP
+    COMP_CTX *compress;         /* compression */
+#  else
+    char *compress;
+#  endif
+    SSL_SESSION *session;
+    unsigned short epoch;
+};
+
+struct hm_header_st {
+    unsigned char type;
+    unsigned long msg_len;
+    unsigned short seq;
+    unsigned long frag_off;
+    unsigned long frag_len;
+    unsigned int is_ccs;
+    struct dtls1_retransmit_state saved_retransmit_state;
+};
+
+struct ccs_header_st {
+    unsigned char type;
+    unsigned short seq;
+};
+
+struct dtls1_timeout_st {
+    /* Number of read timeouts so far */
+    unsigned int read_timeouts;
+    /* Number of write timeouts so far */
+    unsigned int write_timeouts;
+    /* Number of alerts received so far */
+    unsigned int num_alerts;
+};
+
+typedef struct record_pqueue_st {
+    unsigned short epoch;
+    pqueue q;
+} record_pqueue;
+
+typedef struct hm_fragment_st {
+    struct hm_header_st msg_header;
+    unsigned char *fragment;
+    unsigned char *reassembly;
+} hm_fragment;
+
+typedef struct dtls1_state_st {
+    unsigned int send_cookie;
+    unsigned char cookie[DTLS1_COOKIE_LENGTH];
+    unsigned char rcvd_cookie[DTLS1_COOKIE_LENGTH];
+    unsigned int cookie_len;
+    /*
+     * The current data and handshake epoch.  This is initially
+     * undefined, and starts at zero once the initial handshake is
+     * completed
+     */
+    unsigned short r_epoch;
+    unsigned short w_epoch;
+    /* records being received in the current epoch */
+    DTLS1_BITMAP bitmap;
+    /* renegotiation starts a new set of sequence numbers */
+    DTLS1_BITMAP next_bitmap;
+    /* handshake message numbers */
+    unsigned short handshake_write_seq;
+    unsigned short next_handshake_write_seq;
+    unsigned short handshake_read_seq;
+    /* save last sequence number for retransmissions */
+    unsigned char last_write_sequence[8];
+    /* Received handshake records (processed and unprocessed) */
+    record_pqueue unprocessed_rcds;
+    record_pqueue processed_rcds;
+    /* Buffered handshake messages */
+    pqueue buffered_messages;
+    /* Buffered (sent) handshake records */
+    pqueue sent_messages;
+    /*
+     * Buffered application records. Only for records between CCS and
+     * Finished to prevent either protocol violation or unnecessary message
+     * loss.
+     */
+    record_pqueue buffered_app_data;
+    /* Is set when listening for new connections with dtls1_listen() */
+    unsigned int listen;
+    unsigned int link_mtu;      /* max on-the-wire DTLS packet size */
+    unsigned int mtu;           /* max DTLS packet size */
+    struct hm_header_st w_msg_hdr;
+    struct hm_header_st r_msg_hdr;
+    struct dtls1_timeout_st timeout;
+    /*
+     * Indicates when the last handshake msg or heartbeat sent will timeout
+     */
+    struct timeval next_timeout;
+    /* Timeout duration */
+    unsigned short timeout_duration;
+    /*
+     * storage for Alert/Handshake protocol data received but not yet
+     * processed by ssl3_read_bytes:
+     */
+    unsigned char alert_fragment[DTLS1_AL_HEADER_LENGTH];
+    unsigned int alert_fragment_len;
+    unsigned char handshake_fragment[DTLS1_HM_HEADER_LENGTH];
+    unsigned int handshake_fragment_len;
+    unsigned int retransmitting;
+    /*
+     * Set when the handshake is ready to process peer's ChangeCipherSpec message.
+     * Cleared after the message has been processed.
+     */
+    unsigned int change_cipher_spec_ok;
+#  ifndef OPENSSL_NO_SCTP
+    /* used when SSL_ST_XX_FLUSH is entered */
+    int next_state;
+    int shutdown_received;
+#  endif
+} DTLS1_STATE;
+
+typedef struct dtls1_record_data_st {
+    unsigned char *packet;
+    unsigned int packet_length;
+    SSL3_BUFFER rbuf;
+    SSL3_RECORD rrec;
+#  ifndef OPENSSL_NO_SCTP
+    struct bio_dgram_sctp_rcvinfo recordinfo;
+#  endif
+} DTLS1_RECORD_DATA;
+
+# endif
+
+/* Timeout multipliers (timeout slice is defined in apps/timeouts.h */
+# define DTLS1_TMO_READ_COUNT                      2
+# define DTLS1_TMO_WRITE_COUNT                     2
+
+# define DTLS1_TMO_ALERT_COUNT                     12
+
+#ifdef  __cplusplus
+}
+#endif
+#endif

openssl-1.0.2f/ssl/heartbeat_test.c

@@ -0,0 +1,474 @@
+/* test/heartbeat_test.c */
+/*-
+ * Unit test for TLS heartbeats.
+ *
+ * Acts as a regression test against the Heartbleed bug (CVE-2014-0160).
+ *
+ * Author:  Mike Bland (mbland@acm.org, http://mike-bland.com/)
+ * Date:    2014-04-12
+ * License: Creative Commons Attribution 4.0 International (CC By 4.0)
+ *          http://creativecommons.org/licenses/by/4.0/deed.en_US
+ *
+ * OUTPUT
+ * ------
+ * The program returns zero on success. It will print a message with a count
+ * of the number of failed tests and return nonzero if any tests fail.
+ *
+ * It will print the contents of the request and response buffers for each
+ * failing test. In a "fixed" version, all the tests should pass and there
+ * should be no output.
+ *
+ * In a "bleeding" version, you'll see:
+ *
+ *   test_dtls1_heartbleed failed:
+ *     expected payload len: 0
+ *     received: 1024
+ *   sent 26 characters
+ *     "HEARTBLEED                "
+ *   received 1024 characters
+ *     "HEARTBLEED                \xde\xad\xbe\xef..."
+ *   ** test_dtls1_heartbleed failed **
+ *
+ * The contents of the returned buffer in the failing test will depend on the
+ * contents of memory on your machine.
+ *
+ * MORE INFORMATION
+ * ----------------
+ * http://mike-bland.com/2014/04/12/heartbleed.html
+ * http://mike-bland.com/tags/heartbleed.html
+ */
+
+#define OPENSSL_UNIT_TEST
+
+#include "../test/testutil.h"
+
+#include "../ssl/ssl_locl.h"
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#if !defined(OPENSSL_NO_HEARTBEATS) && !defined(OPENSSL_NO_UNIT_TEST)
+
+/* As per https://tools.ietf.org/html/rfc6520#section-4 */
+# define MIN_PADDING_SIZE        16
+
+/* Maximum number of payload characters to print as test output */
+# define MAX_PRINTABLE_CHARACTERS        1024
+
+typedef struct heartbeat_test_fixture {
+    SSL_CTX *ctx;
+    SSL *s;
+    const char *test_case_name;
+    int (*process_heartbeat) (SSL *s);
+    unsigned char *payload;
+    int sent_payload_len;
+    int expected_return_value;
+    int return_payload_offset;
+    int expected_payload_len;
+    const char *expected_return_payload;
+} HEARTBEAT_TEST_FIXTURE;
+
+static HEARTBEAT_TEST_FIXTURE set_up(const char *const test_case_name,
+                                     const SSL_METHOD *meth)
+{
+    HEARTBEAT_TEST_FIXTURE fixture;
+    int setup_ok = 1;
+    memset(&fixture, 0, sizeof(fixture));
+    fixture.test_case_name = test_case_name;
+
+    fixture.ctx = SSL_CTX_new(meth);
+    if (!fixture.ctx) {
+        fprintf(stderr, "Failed to allocate SSL_CTX for test: %s\n",
+                test_case_name);
+        setup_ok = 0;
+        goto fail;
+    }
+
+    fixture.s = SSL_new(fixture.ctx);
+    if (!fixture.s) {
+        fprintf(stderr, "Failed to allocate SSL for test: %s\n",
+                test_case_name);
+        setup_ok = 0;
+        goto fail;
+    }
+
+    if (!ssl_init_wbio_buffer(fixture.s, 1)) {
+        fprintf(stderr, "Failed to set up wbio buffer for test: %s\n",
+                test_case_name);
+        setup_ok = 0;
+        goto fail;
+    }
+
+    if (!ssl3_setup_buffers(fixture.s)) {
+        fprintf(stderr, "Failed to setup buffers for test: %s\n",
+                test_case_name);
+        setup_ok = 0;
+        goto fail;
+    }
+
+    /*
+     * Clear the memory for the return buffer, since this isn't automatically
+     * zeroed in opt mode and will cause spurious test failures that will
+     * change with each execution.
+     */
+    memset(fixture.s->s3->wbuf.buf, 0, fixture.s->s3->wbuf.len);
+
+ fail:
+    if (!setup_ok) {
+        ERR_print_errors_fp(stderr);
+        exit(EXIT_FAILURE);
+    }
+    return fixture;
+}
+
+static HEARTBEAT_TEST_FIXTURE set_up_dtls(const char *const test_case_name)
+{
+    HEARTBEAT_TEST_FIXTURE fixture = set_up(test_case_name,
+                                            DTLSv1_server_method());
+    fixture.process_heartbeat = dtls1_process_heartbeat;
+
+    /*
+     * As per dtls1_get_record(), skipping the following from the beginning
+     * of the returned heartbeat message: type-1 byte; version-2 bytes;
+     * sequence number-8 bytes; length-2 bytes And then skipping the 1-byte
+     * type encoded by process_heartbeat for a total of 14 bytes, at which
+     * point we can grab the length and the payload we seek.
+     */
+    fixture.return_payload_offset = 14;
+    return fixture;
+}
+
+/* Needed by ssl3_write_bytes() */
+static int dummy_handshake(SSL *s)
+{
+    return 1;
+}
+
+static HEARTBEAT_TEST_FIXTURE set_up_tls(const char *const test_case_name)
+{
+    HEARTBEAT_TEST_FIXTURE fixture = set_up(test_case_name,
+                                            TLSv1_server_method());
+    fixture.process_heartbeat = tls1_process_heartbeat;
+    fixture.s->handshake_func = dummy_handshake;
+
+    /*
+     * As per do_ssl3_write(), skipping the following from the beginning of
+     * the returned heartbeat message: type-1 byte; version-2 bytes; length-2
+     * bytes And then skipping the 1-byte type encoded by process_heartbeat
+     * for a total of 6 bytes, at which point we can grab the length and the
+     * payload we seek.
+     */
+    fixture.return_payload_offset = 6;
+    return fixture;
+}
+
+static void tear_down(HEARTBEAT_TEST_FIXTURE fixture)
+{
+    ERR_print_errors_fp(stderr);
+    SSL_free(fixture.s);
+    SSL_CTX_free(fixture.ctx);
+}
+
+static void print_payload(const char *const prefix,
+                          const unsigned char *payload, const int n)
+{
+    const int end = n < MAX_PRINTABLE_CHARACTERS ? n
+        : MAX_PRINTABLE_CHARACTERS;
+    int i = 0;
+
+    printf("%s %d character%s", prefix, n, n == 1 ? "" : "s");
+    if (end != n)
+        printf(" (first %d shown)", end);
+    printf("\n  \"");
+
+    for (; i != end; ++i) {
+        const unsigned char c = payload[i];
+        if (isprint(c))
+            fputc(c, stdout);
+        else
+            printf("\\x%02x", c);
+    }
+    printf("\"\n");
+}
+
+static int execute_heartbeat(HEARTBEAT_TEST_FIXTURE fixture)
+{
+    int result = 0;
+    SSL *s = fixture.s;
+    unsigned char *payload = fixture.payload;
+    unsigned char sent_buf[MAX_PRINTABLE_CHARACTERS + 1];
+    int return_value;
+    unsigned const char *p;
+    int actual_payload_len;
+
+    s->s3->rrec.data = payload;
+    s->s3->rrec.length = strlen((const char *)payload);
+    *payload++ = TLS1_HB_REQUEST;
+    s2n(fixture.sent_payload_len, payload);
+
+    /*
+     * Make a local copy of the request, since it gets overwritten at some
+     * point
+     */
+    memcpy((char *)sent_buf, (const char *)payload, sizeof(sent_buf));
+
+    return_value = fixture.process_heartbeat(s);
+
+    if (return_value != fixture.expected_return_value) {
+        printf("%s failed: expected return value %d, received %d\n",
+               fixture.test_case_name, fixture.expected_return_value,
+               return_value);
+        result = 1;
+    }
+
+    /*
+     * If there is any byte alignment, it will be stored in wbuf.offset.
+     */
+    p = &(s->s3->
+          wbuf.buf[fixture.return_payload_offset + s->s3->wbuf.offset]);
+    actual_payload_len = 0;
+    n2s(p, actual_payload_len);
+
+    if (actual_payload_len != fixture.expected_payload_len) {
+        printf("%s failed:\n  expected payload len: %d\n  received: %d\n",
+               fixture.test_case_name, fixture.expected_payload_len,
+               actual_payload_len);
+        print_payload("sent", sent_buf, strlen((const char *)sent_buf));
+        print_payload("received", p, actual_payload_len);
+        result = 1;
+    } else {
+        char *actual_payload =
+            BUF_strndup((const char *)p, actual_payload_len);
+        if (strcmp(actual_payload, fixture.expected_return_payload) != 0) {
+            printf
+                ("%s failed:\n  expected payload: \"%s\"\n  received: \"%s\"\n",
+                 fixture.test_case_name, fixture.expected_return_payload,
+                 actual_payload);
+            result = 1;
+        }
+        OPENSSL_free(actual_payload);
+    }
+
+    if (result != 0) {
+        printf("** %s failed **\n--------\n", fixture.test_case_name);
+    }
+    return result;
+}
+
+static int honest_payload_size(unsigned char payload_buf[])
+{
+    /* Omit three-byte pad at the beginning for type and payload length */
+    return strlen((const char *)&payload_buf[3]) - MIN_PADDING_SIZE;
+}
+
+# define SETUP_HEARTBEAT_TEST_FIXTURE(type)\
+  SETUP_TEST_FIXTURE(HEARTBEAT_TEST_FIXTURE, set_up_##type)
+
+# define EXECUTE_HEARTBEAT_TEST()\
+  EXECUTE_TEST(execute_heartbeat, tear_down)
+
+static int test_dtls1_not_bleeding()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(dtls);
+    /* Three-byte pad at the beginning for type and payload length */
+    unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4] =
+        "   Not bleeding, sixteen spaces of padding" "                ";
+    const int payload_buf_len = honest_payload_size(payload_buf);
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = payload_buf_len;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = payload_buf_len;
+    fixture.expected_return_payload =
+        "Not bleeding, sixteen spaces of padding";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_dtls1_not_bleeding_empty_payload()
+{
+    int payload_buf_len;
+
+    SETUP_HEARTBEAT_TEST_FIXTURE(dtls);
+    /*
+     * Three-byte pad at the beginning for type and payload length, plus a
+     * NUL at the end
+     */
+    unsigned char payload_buf[4 + MAX_PRINTABLE_CHARACTERS];
+    memset(payload_buf, ' ', MIN_PADDING_SIZE + 3);
+    payload_buf[MIN_PADDING_SIZE + 3] = '\0';
+    payload_buf_len = honest_payload_size(payload_buf);
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = payload_buf_len;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = payload_buf_len;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_dtls1_heartbleed()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(dtls);
+    /* Three-byte pad at the beginning for type and payload length */
+    unsigned char payload_buf[4 + MAX_PRINTABLE_CHARACTERS] =
+        "   HEARTBLEED                ";
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = 0;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_dtls1_heartbleed_empty_payload()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(dtls);
+    /*
+     * Excluding the NUL at the end, one byte short of type + payload length
+     * + minimum padding
+     */
+    unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4];
+    memset(payload_buf, ' ', MIN_PADDING_SIZE + 2);
+    payload_buf[MIN_PADDING_SIZE + 2] = '\0';
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = 0;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_dtls1_heartbleed_excessive_plaintext_length()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(dtls);
+    /*
+     * Excluding the NUL at the end, one byte in excess of maximum allowed
+     * heartbeat message length
+     */
+    unsigned char payload_buf[SSL3_RT_MAX_PLAIN_LENGTH + 2];
+    memset(payload_buf, ' ', sizeof(payload_buf));
+    payload_buf[sizeof(payload_buf) - 1] = '\0';
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = honest_payload_size(payload_buf);
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = 0;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_tls1_not_bleeding()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(tls);
+    /* Three-byte pad at the beginning for type and payload length */
+    unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4] =
+        "   Not bleeding, sixteen spaces of padding" "                ";
+    const int payload_buf_len = honest_payload_size(payload_buf);
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = payload_buf_len;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = payload_buf_len;
+    fixture.expected_return_payload =
+        "Not bleeding, sixteen spaces of padding";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_tls1_not_bleeding_empty_payload()
+{
+    int payload_buf_len;
+
+    SETUP_HEARTBEAT_TEST_FIXTURE(tls);
+    /*
+     * Three-byte pad at the beginning for type and payload length, plus a
+     * NUL at the end
+     */
+    unsigned char payload_buf[4 + MAX_PRINTABLE_CHARACTERS];
+    memset(payload_buf, ' ', MIN_PADDING_SIZE + 3);
+    payload_buf[MIN_PADDING_SIZE + 3] = '\0';
+    payload_buf_len = honest_payload_size(payload_buf);
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = payload_buf_len;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = payload_buf_len;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_tls1_heartbleed()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(tls);
+    /* Three-byte pad at the beginning for type and payload length */
+    unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4] =
+        "   HEARTBLEED                ";
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = 0;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+static int test_tls1_heartbleed_empty_payload()
+{
+    SETUP_HEARTBEAT_TEST_FIXTURE(tls);
+    /*
+     * Excluding the NUL at the end, one byte short of type + payload length
+     * + minimum padding
+     */
+    unsigned char payload_buf[MAX_PRINTABLE_CHARACTERS + 4];
+    memset(payload_buf, ' ', MIN_PADDING_SIZE + 2);
+    payload_buf[MIN_PADDING_SIZE + 2] = '\0';
+
+    fixture.payload = &payload_buf[0];
+    fixture.sent_payload_len = MAX_PRINTABLE_CHARACTERS;
+    fixture.expected_return_value = 0;
+    fixture.expected_payload_len = 0;
+    fixture.expected_return_payload = "";
+    EXECUTE_HEARTBEAT_TEST();
+}
+
+# undef EXECUTE_HEARTBEAT_TEST
+# undef SETUP_HEARTBEAT_TEST_FIXTURE
+
+int main(int argc, char *argv[])
+{
+    int num_failed;
+
+    SSL_library_init();
+    SSL_load_error_strings();
+
+    num_failed = test_dtls1_not_bleeding() +
+        test_dtls1_not_bleeding_empty_payload() +
+        test_dtls1_heartbleed() + test_dtls1_heartbleed_empty_payload() +
+        /*
+         * The following test causes an assertion failure at
+         * ssl/d1_pkt.c:dtls1_write_bytes() in versions prior to 1.0.1g:
+         */
+        (OPENSSL_VERSION_NUMBER >= 0x1000107fL ?
+         test_dtls1_heartbleed_excessive_plaintext_length() : 0) +
+        test_tls1_not_bleeding() +
+        test_tls1_not_bleeding_empty_payload() +
+        test_tls1_heartbleed() + test_tls1_heartbleed_empty_payload() + 0;
+
+    ERR_print_errors_fp(stderr);
+
+    if (num_failed != 0) {
+        printf("%d test%s failed\n", num_failed, num_failed != 1 ? "s" : "");
+        return EXIT_FAILURE;
+    }
+    return EXIT_SUCCESS;
+}
+
+#else                           /* OPENSSL_NO_HEARTBEATS */
+
+int main(int argc, char *argv[])
+{
+    return EXIT_SUCCESS;
+}
+#endif                          /* OPENSSL_NO_HEARTBEATS */

openssl-1.0.2f/ssl/install-ssl.com

@@ -0,0 +1,136 @@
+$! INSTALL-SSL.COM -- Installs the files in a given directory tree
+$!
+$! Author: Richard Levitte <richard@levitte.org>
+$! Time of creation: 22-MAY-1998 10:13
+$!
+$! P1  root of the directory tree
+$! P2  "64" for 64-bit pointers.
+$!
+$!
+$! Announce/identify.
+$!
+$ proc = f$environment( "procedure")
+$ write sys$output "@@@ "+ -
+   f$parse( proc, , , "name")+ f$parse( proc, , , "type")
+$!
+$ on error then goto tidy
+$ on control_c then goto tidy
+$!
+$ if p1 .eqs. ""
+$ then
+$   write sys$output "First argument missing."
+$   write sys$output -
+     "It should be the directory where you want things installed."
+$   exit
+$ endif
+$!
+$ if (f$getsyi( "cpu") .lt. 128)
+$ then
+$     arch = "VAX"
+$ else
+$     arch = f$edit( f$getsyi( "arch_name"), "upcase")
+$     if (arch .eqs. "") then arch = "UNK"
+$ endif
+$!
+$ archd = arch
+$ lib32 = "32"
+$ shr = "_SHR32"
+$!
+$ if (p2 .nes. "")
+$ then
+$   if (p2 .eqs. "64")
+$   then
+$     archd = arch+ "_64"
+$     lib32 = ""
+$     shr = "_SHR"
+$   else
+$     if (p2 .nes. "32")
+$     then
+$       write sys$output "Second argument invalid."
+$       write sys$output "It should be "32", "64", or nothing."
+$       exit
+$     endif
+$   endif
+$ endif
+$!
+$ root = f$parse( p1, "[]A.;0", , , "syntax_only, no_conceal") - "A.;0"
+$ root_dev = f$parse(root,,,"device","syntax_only")
+$ root_dir = f$parse(root,,,"directory","syntax_only") - -
+   "[000000." - "][" - "[" - "]"
+$ root = root_dev + "[" + root_dir
+$!
+$ define /nolog wrk_sslroot 'root'.] /trans=conc
+$ define /nolog wrk_sslinclude wrk_sslroot:[include]
+$ define /nolog wrk_sslxexe wrk_sslroot:['archd'_exe]
+$ define /nolog wrk_sslxlib wrk_sslroot:['arch'_lib]
+$!
+$ if f$parse("wrk_sslroot:[000000]") .eqs. "" then -
+   create /directory /log wrk_sslroot:[000000]
+$ if f$parse("wrk_sslinclude:") .eqs. "" then -
+   create /directory /log wrk_sslinclude:
+$ if f$parse("wrk_sslxexe:") .eqs. "" then -
+   create /directory /log wrk_sslxexe:
+$ if f$parse("wrk_sslxlib:") .eqs. "" then -
+   create /directory /log wrk_sslxlib:
+$!
+$ exheader := ssl.h, ssl2.h, ssl3.h, ssl23.h, tls1.h, dtls1.h, kssl.h, srtp.h
+$ e_exe := ssl_task
+$ libs := ssl_libssl
+$!
+$ xexe_dir := [-.'archd'.exe.ssl]
+$!
+$ copy /protection = w:re 'exheader' wrk_sslinclude: /log
+$!
+$ i = 0
+$ loop_exe:
+$   e = f$edit( f$element( i, ",", e_exe), "trim")
+$   i = i + 1
+$   if e .eqs. "," then goto loop_exe_end
+$   set noon
+$   file = xexe_dir+ e+ ".exe"
+$   if f$search( file) .nes. ""
+$   then
+$     copy /protection = w:re 'file' wrk_sslxexe: /log
+$   endif
+$   set on
+$ goto loop_exe
+$ loop_exe_end:
+$!
+$ i = 0
+$ loop_lib: 
+$   e = f$edit(f$element(i, ",", libs),"trim")
+$   i = i + 1
+$   if e .eqs. "," then goto loop_lib_end
+$   set noon
+$! Object library.
+$   file = xexe_dir+ e+ lib32+ ".olb"
+$   if f$search( file) .nes. ""
+$   then
+$     copy /protection = w:re 'file' wrk_sslxlib: /log
+$   endif
+$! Shareable image.
+$   file = xexe_dir+ e+ shr+ ".exe"
+$   if f$search( file) .nes. ""
+$   then
+$     copy /protection = w:re 'file' wrk_sslxlib: /log
+$   endif
+$   set on
+$ goto loop_lib
+$ loop_lib_end:
+$!
+$ tidy:
+$!
+$ call deass wrk_sslroot
+$ call deass wrk_sslinclude
+$ call deass wrk_sslxexe
+$ call deass wrk_sslxlib
+$!
+$ exit
+$!
+$ deass: subroutine
+$ if (f$trnlnm( p1, "LNM$PROCESS") .nes. "")
+$ then
+$   deassign /process 'p1'
+$ endif
+$ endsubroutine
+$!

openssl-1.0.2f/ssl/kssl.h

@@ -0,0 +1,197 @@
+/* ssl/kssl.h */
+/*
+ * Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project
+ * 2000. project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/*
+ **      19990701        VRS     Started.
+ */
+
+#ifndef KSSL_H
+# define KSSL_H
+
+# include <openssl/opensslconf.h>
+
+# ifndef OPENSSL_NO_KRB5
+
+#  include <stdio.h>
+#  include <ctype.h>
+#  include <krb5.h>
+#  ifdef OPENSSL_SYS_WIN32
+/*
+ * These can sometimes get redefined indirectly by krb5 header files after
+ * they get undefed in ossl_typ.h
+ */
+#   undef X509_NAME
+#   undef X509_EXTENSIONS
+#   undef OCSP_REQUEST
+#   undef OCSP_RESPONSE
+#  endif
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/*
+ *      Depending on which KRB5 implementation used, some types from
+ *      the other may be missing.  Resolve that here and now
+ */
+#  ifdef KRB5_HEIMDAL
+typedef unsigned char krb5_octet;
+#   define FAR
+#  else
+
+#   ifndef FAR
+#    define FAR
+#   endif
+
+#  endif
+
+/*-
+ *      Uncomment this to debug kssl problems or
+ *      to trace usage of the Kerberos session key
+ *
+ *      #define         KSSL_DEBUG
+ */
+
+#  ifndef KRB5SVC
+#   define KRB5SVC "host"
+#  endif
+
+#  ifndef KRB5KEYTAB
+#   define KRB5KEYTAB      "/etc/krb5.keytab"
+#  endif
+
+#  ifndef KRB5SENDAUTH
+#   define KRB5SENDAUTH    1
+#  endif
+
+#  ifndef KRB5CHECKAUTH
+#   define KRB5CHECKAUTH   1
+#  endif
+
+#  ifndef KSSL_CLOCKSKEW
+#   define KSSL_CLOCKSKEW  300;
+#  endif
+
+#  define KSSL_ERR_MAX    255
+typedef struct kssl_err_st {
+    int reason;
+    char text[KSSL_ERR_MAX + 1];
+} KSSL_ERR;
+
+/*-     Context for passing
+ *              (1) Kerberos session key to SSL, and
+ *              (2)     Config data between application and SSL lib
+ */
+typedef struct kssl_ctx_st {
+    /*      used by:    disposition:            */
+    char *service_name;         /* C,S default ok (kssl) */
+    char *service_host;         /* C input, REQUIRED */
+    char *client_princ;         /* S output from krb5 ticket */
+    char *keytab_file;          /* S NULL (/etc/krb5.keytab) */
+    char *cred_cache;           /* C NULL (default) */
+    krb5_enctype enctype;
+    int length;
+    krb5_octet FAR *key;
+} KSSL_CTX;
+
+#  define KSSL_CLIENT     1
+#  define KSSL_SERVER     2
+#  define KSSL_SERVICE    3
+#  define KSSL_KEYTAB     4
+
+#  define KSSL_CTX_OK     0
+#  define KSSL_CTX_ERR    1
+#  define KSSL_NOMEM      2
+
+/* Public (for use by applications that use OpenSSL with Kerberos 5 support */
+krb5_error_code kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text);
+KSSL_CTX *kssl_ctx_new(void);
+KSSL_CTX *kssl_ctx_free(KSSL_CTX *kssl_ctx);
+void kssl_ctx_show(KSSL_CTX *kssl_ctx);
+krb5_error_code kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
+                                  krb5_data *realm, krb5_data *entity,
+                                  int nentities);
+krb5_error_code kssl_cget_tkt(KSSL_CTX *kssl_ctx, krb5_data **enc_tktp,
+                              krb5_data *authenp, KSSL_ERR *kssl_err);
+krb5_error_code kssl_sget_tkt(KSSL_CTX *kssl_ctx, krb5_data *indata,
+                              krb5_ticket_times *ttimes, KSSL_ERR *kssl_err);
+krb5_error_code kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session);
+void kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text);
+void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data);
+krb5_error_code kssl_build_principal_2(krb5_context context,
+                                       krb5_principal *princ, int rlen,
+                                       const char *realm, int slen,
+                                       const char *svc, int hlen,
+                                       const char *host);
+krb5_error_code kssl_validate_times(krb5_timestamp atime,
+                                    krb5_ticket_times *ttimes);
+krb5_error_code kssl_check_authent(KSSL_CTX *kssl_ctx, krb5_data *authentp,
+                                   krb5_timestamp *atimep,
+                                   KSSL_ERR *kssl_err);
+unsigned char *kssl_skip_confound(krb5_enctype enctype, unsigned char *authn);
+
+void SSL_set0_kssl_ctx(SSL *s, KSSL_CTX *kctx);
+KSSL_CTX *SSL_get0_kssl_ctx(SSL *s);
+char *kssl_ctx_get0_client_princ(KSSL_CTX *kctx);
+
+#ifdef  __cplusplus
+}
+#endif
+# endif                         /* OPENSSL_NO_KRB5 */
+#endif                          /* KSSL_H */

openssl-1.0.2f/ssl/kssl_lcl.h

@@ -0,0 +1,88 @@
+/* ssl/kssl.h */
+/*
+ * Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project
+ * 2000. project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef KSSL_LCL_H
+# define KSSL_LCL_H
+
+# include <openssl/kssl.h>
+
+# ifndef OPENSSL_NO_KRB5
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* Private (internal to OpenSSL) */
+void print_krb5_data(char *label, krb5_data *kdata);
+void print_krb5_authdata(char *label, krb5_authdata **adata);
+void print_krb5_keyblock(char *label, krb5_keyblock *keyblk);
+
+char *kstring(char *string);
+char *knumber(int len, krb5_octet *contents);
+
+const EVP_CIPHER *kssl_map_enc(krb5_enctype enctype);
+
+int kssl_keytab_is_available(KSSL_CTX *kssl_ctx);
+int kssl_tgt_is_available(KSSL_CTX *kssl_ctx);
+
+#ifdef  __cplusplus
+}
+#endif
+# endif                         /* OPENSSL_NO_KRB5 */
+#endif                          /* KSSL_LCL_H */

openssl-1.0.2f/ssl/s23_clnt.c

@@ -0,0 +1,802 @@
+/* ssl/s23_clnt.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+
+static const SSL_METHOD *ssl23_get_client_method(int ver);
+static int ssl23_client_hello(SSL *s);
+static int ssl23_get_server_hello(SSL *s);
+static const SSL_METHOD *ssl23_get_client_method(int ver)
+{
+#ifndef OPENSSL_NO_SSL2
+    if (ver == SSL2_VERSION)
+        return (SSLv2_client_method());
+#endif
+#ifndef OPENSSL_NO_SSL3
+    if (ver == SSL3_VERSION)
+        return (SSLv3_client_method());
+#endif
+    if (ver == TLS1_VERSION)
+        return (TLSv1_client_method());
+    else if (ver == TLS1_1_VERSION)
+        return (TLSv1_1_client_method());
+    else if (ver == TLS1_2_VERSION)
+        return (TLSv1_2_client_method());
+    else
+        return (NULL);
+}
+
+IMPLEMENT_ssl23_meth_func(SSLv23_client_method,
+                          ssl_undefined_function,
+                          ssl23_connect, ssl23_get_client_method)
+
+int ssl23_connect(SSL *s)
+{
+    BUF_MEM *buf = NULL;
+    unsigned long Time = (unsigned long)time(NULL);
+    void (*cb) (const SSL *ssl, int type, int val) = NULL;
+    int ret = -1;
+    int new_state, state;
+
+    RAND_add(&Time, sizeof(Time), 0);
+    ERR_clear_error();
+    clear_sys_error();
+
+    if (s->info_callback != NULL)
+        cb = s->info_callback;
+    else if (s->ctx->info_callback != NULL)
+        cb = s->ctx->info_callback;
+
+    s->in_handshake++;
+    if (!SSL_in_init(s) || SSL_in_before(s))
+        SSL_clear(s);
+
+    for (;;) {
+        state = s->state;
+
+        switch (s->state) {
+        case SSL_ST_BEFORE:
+        case SSL_ST_CONNECT:
+        case SSL_ST_BEFORE | SSL_ST_CONNECT:
+        case SSL_ST_OK | SSL_ST_CONNECT:
+
+            if (s->session != NULL) {
+                SSLerr(SSL_F_SSL23_CONNECT,
+                       SSL_R_SSL23_DOING_SESSION_ID_REUSE);
+                ret = -1;
+                goto end;
+            }
+            s->server = 0;
+            if (cb != NULL)
+                cb(s, SSL_CB_HANDSHAKE_START, 1);
+
+            /* s->version=TLS1_VERSION; */
+            s->type = SSL_ST_CONNECT;
+
+            if (s->init_buf == NULL) {
+                if ((buf = BUF_MEM_new()) == NULL) {
+                    ret = -1;
+                    goto end;
+                }
+                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
+                    ret = -1;
+                    goto end;
+                }
+                s->init_buf = buf;
+                buf = NULL;
+            }
+
+            if (!ssl3_setup_buffers(s)) {
+                ret = -1;
+                goto end;
+            }
+
+            ssl3_init_finished_mac(s);
+
+            s->state = SSL23_ST_CW_CLNT_HELLO_A;
+            s->ctx->stats.sess_connect++;
+            s->init_num = 0;
+            break;
+
+        case SSL23_ST_CW_CLNT_HELLO_A:
+        case SSL23_ST_CW_CLNT_HELLO_B:
+
+            s->shutdown = 0;
+            ret = ssl23_client_hello(s);
+            if (ret <= 0)
+                goto end;
+            s->state = SSL23_ST_CR_SRVR_HELLO_A;
+            s->init_num = 0;
+
+            break;
+
+        case SSL23_ST_CR_SRVR_HELLO_A:
+        case SSL23_ST_CR_SRVR_HELLO_B:
+            ret = ssl23_get_server_hello(s);
+            if (ret >= 0)
+                cb = NULL;
+            goto end;
+            /* break; */
+
+        default:
+            SSLerr(SSL_F_SSL23_CONNECT, SSL_R_UNKNOWN_STATE);
+            ret = -1;
+            goto end;
+            /* break; */
+        }
+
+        if (s->debug) {
+            (void)BIO_flush(s->wbio);
+        }
+
+        if ((cb != NULL) && (s->state != state)) {
+            new_state = s->state;
+            s->state = state;
+            cb(s, SSL_CB_CONNECT_LOOP, 1);
+            s->state = new_state;
+        }
+    }
+ end:
+    s->in_handshake--;
+    if (buf != NULL)
+        BUF_MEM_free(buf);
+    if (cb != NULL)
+        cb(s, SSL_CB_CONNECT_EXIT, ret);
+    return (ret);
+}
+
+static int ssl23_no_ssl2_ciphers(SSL *s)
+{
+    SSL_CIPHER *cipher;
+    STACK_OF(SSL_CIPHER) *ciphers;
+    int i;
+    ciphers = SSL_get_ciphers(s);
+    for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
+        cipher = sk_SSL_CIPHER_value(ciphers, i);
+        if (cipher->algorithm_ssl == SSL_SSLV2)
+            return 0;
+    }
+    return 1;
+}
+
+/*
+ * Fill a ClientRandom or ServerRandom field of length len. Returns <= 0 on
+ * failure, 1 on success.
+ */
+int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, int len)
+{
+    int send_time = 0;
+    if (len < 4)
+        return 0;
+    if (server)
+        send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;
+    else
+        send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;
+    if (send_time) {
+        unsigned long Time = (unsigned long)time(NULL);
+        unsigned char *p = result;
+        l2n(Time, p);
+        return RAND_pseudo_bytes(p, len - 4);
+    } else
+        return RAND_pseudo_bytes(result, len);
+}
+
+static int ssl23_client_hello(SSL *s)
+{
+    unsigned char *buf;
+    unsigned char *p, *d;
+    int i, ch_len;
+    unsigned long l;
+    int ssl2_compat;
+    int version = 0, version_major, version_minor;
+    int al = 0;
+#ifndef OPENSSL_NO_COMP
+    int j;
+    SSL_COMP *comp;
+#endif
+    int ret;
+    unsigned long mask, options = s->options;
+
+    ssl2_compat = (options & SSL_OP_NO_SSLv2) ? 0 : 1;
+
+    if (ssl2_compat && ssl23_no_ssl2_ciphers(s))
+        ssl2_compat = 0;
+
+    /*
+     * SSL_OP_NO_X disables all protocols above X *if* there are
+     * some protocols below X enabled. This is required in order
+     * to maintain "version capability" vector contiguous. So
+     * that if application wants to disable TLS1.0 in favour of
+     * TLS1>=1, it would be insufficient to pass SSL_NO_TLSv1, the
+     * answer is SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2.
+     */
+    mask = SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1
+#if !defined(OPENSSL_NO_SSL3)
+        | SSL_OP_NO_SSLv3
+#endif
+#if !defined(OPENSSL_NO_SSL2)
+        | (ssl2_compat ? SSL_OP_NO_SSLv2 : 0)
+#endif
+        ;
+#if !defined(OPENSSL_NO_TLS1_2_CLIENT)
+    version = TLS1_2_VERSION;
+
+    if ((options & SSL_OP_NO_TLSv1_2) && (options & mask) != mask)
+        version = TLS1_1_VERSION;
+#else
+    version = TLS1_1_VERSION;
+#endif
+    mask &= ~SSL_OP_NO_TLSv1_1;
+    if ((options & SSL_OP_NO_TLSv1_1) && (options & mask) != mask)
+        version = TLS1_VERSION;
+    mask &= ~SSL_OP_NO_TLSv1;
+#if !defined(OPENSSL_NO_SSL3)
+    if ((options & SSL_OP_NO_TLSv1) && (options & mask) != mask)
+        version = SSL3_VERSION;
+    mask &= ~SSL_OP_NO_SSLv3;
+#endif
+#if !defined(OPENSSL_NO_SSL2)
+    if ((options & SSL_OP_NO_SSLv3) && (options & mask) != mask)
+        version = SSL2_VERSION;
+#endif
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (version != SSL2_VERSION) {
+        /*
+         * have to disable SSL 2.0 compatibility if we need TLS extensions
+         */
+
+        if (s->tlsext_hostname != NULL)
+            ssl2_compat = 0;
+        if (s->tlsext_status_type != -1)
+            ssl2_compat = 0;
+# ifdef TLSEXT_TYPE_opaque_prf_input
+        if (s->ctx->tlsext_opaque_prf_input_callback != 0
+            || s->tlsext_opaque_prf_input != NULL)
+            ssl2_compat = 0;
+# endif
+        if (s->cert->cli_ext.meths_count != 0)
+            ssl2_compat = 0;
+    }
+#endif
+
+    buf = (unsigned char *)s->init_buf->data;
+    if (s->state == SSL23_ST_CW_CLNT_HELLO_A) {
+        /*
+         * Since we're sending s23 client hello, we're not reusing a session, as
+         * we'd be using the method from the saved session instead
+         */
+        if (!ssl_get_new_session(s, 0)) {
+            return -1;
+        }
+
+        p = s->s3->client_random;
+        if (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)
+            return -1;
+
+        if (version == TLS1_2_VERSION) {
+            version_major = TLS1_2_VERSION_MAJOR;
+            version_minor = TLS1_2_VERSION_MINOR;
+        } else if (tls1_suiteb(s)) {
+            SSLerr(SSL_F_SSL23_CLIENT_HELLO,
+                   SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);
+            return -1;
+        } else if (version == TLS1_1_VERSION) {
+            version_major = TLS1_1_VERSION_MAJOR;
+            version_minor = TLS1_1_VERSION_MINOR;
+        } else if (version == TLS1_VERSION) {
+            version_major = TLS1_VERSION_MAJOR;
+            version_minor = TLS1_VERSION_MINOR;
+        }
+#ifdef OPENSSL_FIPS
+        else if (FIPS_mode()) {
+            SSLerr(SSL_F_SSL23_CLIENT_HELLO,
+                   SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
+            return -1;
+        }
+#endif
+        else if (version == SSL3_VERSION) {
+            version_major = SSL3_VERSION_MAJOR;
+            version_minor = SSL3_VERSION_MINOR;
+        } else if (version == SSL2_VERSION) {
+            version_major = SSL2_VERSION_MAJOR;
+            version_minor = SSL2_VERSION_MINOR;
+        } else {
+            SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_PROTOCOLS_AVAILABLE);
+            return (-1);
+        }
+
+        s->client_version = version;
+
+        if (ssl2_compat) {
+            /* create SSL 2.0 compatible Client Hello */
+
+            /* two byte record header will be written last */
+            d = &(buf[2]);
+            p = d + 9;          /* leave space for message type, version,
+                                 * individual length fields */
+
+            *(d++) = SSL2_MT_CLIENT_HELLO;
+            *(d++) = version_major;
+            *(d++) = version_minor;
+
+            /* Ciphers supported */
+            i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), p, 0);
+            if (i == 0) {
+                /* no ciphers */
+                SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_CIPHERS_AVAILABLE);
+                return -1;
+            }
+            s2n(i, d);
+            p += i;
+
+            /*
+             * put in the session-id length (zero since there is no reuse)
+             */
+            s2n(0, d);
+
+            if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)
+                ch_len = SSL2_CHALLENGE_LENGTH;
+            else
+                ch_len = SSL2_MAX_CHALLENGE_LENGTH;
+
+            /* write out sslv2 challenge */
+            /*
+             * Note that ch_len must be <= SSL3_RANDOM_SIZE (32), because it
+             * is one of SSL2_MAX_CHALLENGE_LENGTH (32) or
+             * SSL2_MAX_CHALLENGE_LENGTH (16), but leave the check in for
+             * futurproofing
+             */
+            if (SSL3_RANDOM_SIZE < ch_len)
+                i = SSL3_RANDOM_SIZE;
+            else
+                i = ch_len;
+            s2n(i, d);
+            memset(&(s->s3->client_random[0]), 0, SSL3_RANDOM_SIZE);
+            if (RAND_pseudo_bytes
+                (&(s->s3->client_random[SSL3_RANDOM_SIZE - i]), i) <= 0)
+                return -1;
+
+            memcpy(p, &(s->s3->client_random[SSL3_RANDOM_SIZE - i]), i);
+            p += i;
+
+            i = p - &(buf[2]);
+            buf[0] = ((i >> 8) & 0xff) | 0x80;
+            buf[1] = (i & 0xff);
+
+            /* number of bytes to write */
+            s->init_num = i + 2;
+            s->init_off = 0;
+
+            ssl3_finish_mac(s, &(buf[2]), i);
+        } else {
+            /* create Client Hello in SSL 3.0/TLS 1.0 format */
+
+            /*
+             * do the record header (5 bytes) and handshake message header (4
+             * bytes) last
+             */
+            d = p = &(buf[9]);
+
+            *(p++) = version_major;
+            *(p++) = version_minor;
+
+            /* Random stuff */
+            memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE);
+            p += SSL3_RANDOM_SIZE;
+
+            /* Session ID (zero since there is no reuse) */
+            *(p++) = 0;
+
+            /* Ciphers supported (using SSL 3.0/TLS 1.0 format) */
+            i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &(p[2]),
+                                         ssl3_put_cipher_by_char);
+            if (i == 0) {
+                SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_CIPHERS_AVAILABLE);
+                return -1;
+            }
+#ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH
+            /*
+             * Some servers hang if client hello > 256 bytes as hack
+             * workaround chop number of supported ciphers to keep it well
+             * below this if we use TLS v1.2
+             */
+            if (TLS1_get_version(s) >= TLS1_2_VERSION
+                && i > OPENSSL_MAX_TLS1_2_CIPHER_LENGTH)
+                i = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;
+#endif
+            s2n(i, p);
+            p += i;
+
+            /* COMPRESSION */
+#ifdef OPENSSL_NO_COMP
+            *(p++) = 1;
+#else
+            if ((s->options & SSL_OP_NO_COMPRESSION)
+                || !s->ctx->comp_methods)
+                j = 0;
+            else
+                j = sk_SSL_COMP_num(s->ctx->comp_methods);
+            *(p++) = 1 + j;
+            for (i = 0; i < j; i++) {
+                comp = sk_SSL_COMP_value(s->ctx->comp_methods, i);
+                *(p++) = comp->id;
+            }
+#endif
+            *(p++) = 0;         /* Add the NULL method */
+
+#ifndef OPENSSL_NO_TLSEXT
+            /* TLS extensions */
+            if (ssl_prepare_clienthello_tlsext(s) <= 0) {
+                SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
+                return -1;
+            }
+            if ((p =
+                 ssl_add_clienthello_tlsext(s, p,
+                                            buf + SSL3_RT_MAX_PLAIN_LENGTH,
+                                            &al)) == NULL) {
+                ssl3_send_alert(s, SSL3_AL_FATAL, al);
+                SSLerr(SSL_F_SSL23_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                return -1;
+            }
+#endif
+
+            l = p - d;
+
+            /* fill in 4-byte handshake header */
+            d = &(buf[5]);
+            *(d++) = SSL3_MT_CLIENT_HELLO;
+            l2n3(l, d);
+
+            l += 4;
+
+            if (l > SSL3_RT_MAX_PLAIN_LENGTH) {
+                SSLerr(SSL_F_SSL23_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                return -1;
+            }
+
+            /* fill in 5-byte record header */
+            d = buf;
+            *(d++) = SSL3_RT_HANDSHAKE;
+            *(d++) = version_major;
+            /*
+             * Some servers hang if we use long client hellos and a record
+             * number > TLS 1.0.
+             */
+            if (TLS1_get_client_version(s) > TLS1_VERSION)
+                *(d++) = 1;
+            else
+                *(d++) = version_minor;
+            s2n((int)l, d);
+
+            /* number of bytes to write */
+            s->init_num = p - buf;
+            s->init_off = 0;
+
+            ssl3_finish_mac(s, &(buf[5]), s->init_num - 5);
+        }
+
+        s->state = SSL23_ST_CW_CLNT_HELLO_B;
+        s->init_off = 0;
+    }
+
+    /* SSL3_ST_CW_CLNT_HELLO_B */
+    ret = ssl23_write_bytes(s);
+
+    if ((ret >= 2) && s->msg_callback) {
+        /* Client Hello has been sent; tell msg_callback */
+
+        if (ssl2_compat)
+            s->msg_callback(1, SSL2_VERSION, 0, s->init_buf->data + 2,
+                            ret - 2, s, s->msg_callback_arg);
+        else {
+            s->msg_callback(1, version, SSL3_RT_HEADER, s->init_buf->data, 5,
+                            s, s->msg_callback_arg);
+            s->msg_callback(1, version, SSL3_RT_HANDSHAKE,
+                            s->init_buf->data + 5, ret - 5, s,
+                            s->msg_callback_arg);
+        }
+    }
+
+    return ret;
+}
+
+static int ssl23_get_server_hello(SSL *s)
+{
+    char buf[8];
+    unsigned char *p;
+    int i;
+    int n;
+
+    n = ssl23_read_bytes(s, 7);
+
+    if (n != 7)
+        return (n);
+    p = s->packet;
+
+    memcpy(buf, p, n);
+
+    if ((p[0] & 0x80) && (p[2] == SSL2_MT_SERVER_HELLO) &&
+        (p[5] == 0x00) && (p[6] == 0x02)) {
+#ifdef OPENSSL_NO_SSL2
+        SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
+        goto err;
+#else
+        /* we are talking sslv2 */
+        /*
+         * we need to clean up the SSLv3 setup and put in the sslv2 stuff.
+         */
+        int ch_len;
+
+        if (s->options & SSL_OP_NO_SSLv2) {
+            SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
+            goto err;
+        }
+        if (s->s2 == NULL) {
+            if (!ssl2_new(s))
+                goto err;
+        } else
+            ssl2_clear(s);
+
+        if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)
+            ch_len = SSL2_CHALLENGE_LENGTH;
+        else
+            ch_len = SSL2_MAX_CHALLENGE_LENGTH;
+
+        /* write out sslv2 challenge */
+        /*
+         * Note that ch_len must be <= SSL3_RANDOM_SIZE (32), because it is
+         * one of SSL2_MAX_CHALLENGE_LENGTH (32) or SSL2_MAX_CHALLENGE_LENGTH
+         * (16), but leave the check in for futurproofing
+         */
+        i = (SSL3_RANDOM_SIZE < ch_len)
+            ? SSL3_RANDOM_SIZE : ch_len;
+        s->s2->challenge_length = i;
+        memcpy(s->s2->challenge,
+               &(s->s3->client_random[SSL3_RANDOM_SIZE - i]), i);
+
+        if (s->s3 != NULL)
+            ssl3_free(s);
+
+        if (!BUF_MEM_grow_clean(s->init_buf,
+                                SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)) {
+            SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, ERR_R_BUF_LIB);
+            goto err;
+        }
+
+        s->state = SSL2_ST_GET_SERVER_HELLO_A;
+        if (!(s->client_version == SSL2_VERSION))
+            /*
+             * use special padding (SSL 3.0 draft/RFC 2246, App. E.2)
+             */
+            s->s2->ssl2_rollback = 1;
+
+        /*
+         * setup the 7 bytes we have read so we get them from the sslv2
+         * buffer
+         */
+        s->rstate = SSL_ST_READ_HEADER;
+        s->packet_length = n;
+        s->packet = &(s->s2->rbuf[0]);
+        memcpy(s->packet, buf, n);
+        s->s2->rbuf_left = n;
+        s->s2->rbuf_offs = 0;
+
+        /* we have already written one */
+        s->s2->write_sequence = 1;
+
+        s->method = SSLv2_client_method();
+        s->handshake_func = s->method->ssl_connect;
+#endif
+    } else if (p[1] == SSL3_VERSION_MAJOR &&
+               p[2] <= TLS1_2_VERSION_MINOR &&
+               ((p[0] == SSL3_RT_HANDSHAKE && p[5] == SSL3_MT_SERVER_HELLO) ||
+                (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2))) {
+        /* we have sslv3 or tls1 (server hello or alert) */
+
+#ifndef OPENSSL_NO_SSL3
+        if ((p[2] == SSL3_VERSION_MINOR) && !(s->options & SSL_OP_NO_SSLv3)) {
+# ifdef OPENSSL_FIPS
+            if (FIPS_mode()) {
+                SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
+                       SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
+                goto err;
+            }
+# endif
+            s->version = SSL3_VERSION;
+            s->method = SSLv3_client_method();
+        } else
+#endif
+        if ((p[2] == TLS1_VERSION_MINOR) && !(s->options & SSL_OP_NO_TLSv1)) {
+            s->version = TLS1_VERSION;
+            s->method = TLSv1_client_method();
+        } else if ((p[2] == TLS1_1_VERSION_MINOR) &&
+                   !(s->options & SSL_OP_NO_TLSv1_1)) {
+            s->version = TLS1_1_VERSION;
+            s->method = TLSv1_1_client_method();
+        } else if ((p[2] == TLS1_2_VERSION_MINOR) &&
+                   !(s->options & SSL_OP_NO_TLSv1_2)) {
+            s->version = TLS1_2_VERSION;
+            s->method = TLSv1_2_client_method();
+        } else {
+            SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
+            goto err;
+        }
+
+        s->session->ssl_version = s->version;
+
+        /* ensure that TLS_MAX_VERSION is up-to-date */
+        OPENSSL_assert(s->version <= TLS_MAX_VERSION);
+
+        if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING) {
+            /* fatal alert */
+
+            void (*cb) (const SSL *ssl, int type, int val) = NULL;
+            int j;
+
+            if (s->info_callback != NULL)
+                cb = s->info_callback;
+            else if (s->ctx->info_callback != NULL)
+                cb = s->ctx->info_callback;
+
+            i = p[5];
+            if (cb != NULL) {
+                j = (i << 8) | p[6];
+                cb(s, SSL_CB_READ_ALERT, j);
+            }
+
+            if (s->msg_callback) {
+                s->msg_callback(0, s->version, SSL3_RT_HEADER, p, 5, s,
+                                s->msg_callback_arg);
+                s->msg_callback(0, s->version, SSL3_RT_ALERT, p + 5, 2, s,
+                                s->msg_callback_arg);
+            }
+
+            s->rwstate = SSL_NOTHING;
+            SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, SSL_AD_REASON_OFFSET + p[6]);
+            goto err;
+        }
+
+        if (!ssl_init_wbio_buffer(s, 1))
+            goto err;
+
+        /* we are in this state */
+        s->state = SSL3_ST_CR_SRVR_HELLO_A;
+
+        /*
+         * put the 7 bytes we have read into the input buffer for SSLv3
+         */
+        s->rstate = SSL_ST_READ_HEADER;
+        s->packet_length = n;
+        if (s->s3->rbuf.buf == NULL)
+            if (!ssl3_setup_read_buffer(s))
+                goto err;
+        s->packet = &(s->s3->rbuf.buf[0]);
+        memcpy(s->packet, buf, n);
+        s->s3->rbuf.left = n;
+        s->s3->rbuf.offset = 0;
+
+        s->handshake_func = s->method->ssl_connect;
+    } else {
+        SSLerr(SSL_F_SSL23_GET_SERVER_HELLO, SSL_R_UNKNOWN_PROTOCOL);
+        goto err;
+    }
+    s->init_num = 0;
+
+    return (SSL_connect(s));
+ err:
+    return (-1);
+}

openssl-1.0.2f/ssl/s23_lib.c

@@ -0,0 +1,185 @@
+/* ssl/s23_lib.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+long ssl23_default_timeout(void)
+{
+    return (300);
+}
+
+int ssl23_num_ciphers(void)
+{
+    return (ssl3_num_ciphers()
+#ifndef OPENSSL_NO_SSL2
+            + ssl2_num_ciphers()
+#endif
+        );
+}
+
+const SSL_CIPHER *ssl23_get_cipher(unsigned int u)
+{
+    unsigned int uu = ssl3_num_ciphers();
+
+    if (u < uu)
+        return (ssl3_get_cipher(u));
+    else
+#ifndef OPENSSL_NO_SSL2
+        return (ssl2_get_cipher(u - uu));
+#else
+        return (NULL);
+#endif
+}
+
+/*
+ * This function needs to check if the ciphers required are actually
+ * available
+ */
+const SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
+{
+    const SSL_CIPHER *cp;
+
+    cp = ssl3_get_cipher_by_char(p);
+#ifndef OPENSSL_NO_SSL2
+    if (cp == NULL)
+        cp = ssl2_get_cipher_by_char(p);
+#endif
+    return (cp);
+}
+
+int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
+{
+    long l;
+
+    /* We can write SSLv2 and SSLv3 ciphers */
+    /* but no ECC ciphers */
+    if (c->algorithm_mkey == SSL_kECDHr ||
+        c->algorithm_mkey == SSL_kECDHe ||
+        c->algorithm_mkey == SSL_kEECDH ||
+        c->algorithm_auth == SSL_aECDH || c->algorithm_auth == SSL_aECDSA)
+        return 0;
+    if (p != NULL) {
+        l = c->id;
+        p[0] = ((unsigned char)(l >> 16L)) & 0xFF;
+        p[1] = ((unsigned char)(l >> 8L)) & 0xFF;
+        p[2] = ((unsigned char)(l)) & 0xFF;
+    }
+    return (3);
+}
+
+int ssl23_read(SSL *s, void *buf, int len)
+{
+    int n;
+
+    clear_sys_error();
+    if (SSL_in_init(s) && (!s->in_handshake)) {
+        n = s->handshake_func(s);
+        if (n < 0)
+            return (n);
+        if (n == 0) {
+            SSLerr(SSL_F_SSL23_READ, SSL_R_SSL_HANDSHAKE_FAILURE);
+            return (-1);
+        }
+        return (SSL_read(s, buf, len));
+    } else {
+        ssl_undefined_function(s);
+        return (-1);
+    }
+}
+
+int ssl23_peek(SSL *s, void *buf, int len)
+{
+    int n;
+
+    clear_sys_error();
+    if (SSL_in_init(s) && (!s->in_handshake)) {
+        n = s->handshake_func(s);
+        if (n < 0)
+            return (n);
+        if (n == 0) {
+            SSLerr(SSL_F_SSL23_PEEK, SSL_R_SSL_HANDSHAKE_FAILURE);
+            return (-1);
+        }
+        return (SSL_peek(s, buf, len));
+    } else {
+        ssl_undefined_function(s);
+        return (-1);
+    }
+}
+
+int ssl23_write(SSL *s, const void *buf, int len)
+{
+    int n;
+
+    clear_sys_error();
+    if (SSL_in_init(s) && (!s->in_handshake)) {
+        n = s->handshake_func(s);
+        if (n < 0)
+            return (n);
+        if (n == 0) {
+            SSLerr(SSL_F_SSL23_WRITE, SSL_R_SSL_HANDSHAKE_FAILURE);
+            return (-1);
+        }
+        return (SSL_write(s, buf, len));
+    } else {
+        ssl_undefined_function(s);
+        return (-1);
+    }
+}

openssl-1.0.2f/ssl/s23_meth.c

@@ -0,0 +1,89 @@
+/* ssl/s23_meth.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+static const SSL_METHOD *ssl23_get_method(int ver);
+static const SSL_METHOD *ssl23_get_method(int ver)
+{
+#ifndef OPENSSL_NO_SSL2
+    if (ver == SSL2_VERSION)
+        return (SSLv2_method());
+    else
+#endif
+#ifndef OPENSSL_NO_SSL3
+    if (ver == SSL3_VERSION)
+        return (SSLv3_method());
+    else
+#endif
+#ifndef OPENSSL_NO_TLS1
+    if (ver == TLS1_VERSION)
+        return (TLSv1_method());
+    else if (ver == TLS1_1_VERSION)
+        return (TLSv1_1_method());
+    else if (ver == TLS1_2_VERSION)
+        return (TLSv1_2_method());
+    else
+#endif
+        return (NULL);
+}
+
+IMPLEMENT_ssl23_meth_func(SSLv23_method,
+                          ssl23_accept, ssl23_connect, ssl23_get_method)

openssl-1.0.2f/ssl/s23_pkt.c

@@ -0,0 +1,113 @@
+/* ssl/s23_pkt.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#define USE_SOCKETS
+#include "ssl_locl.h"
+#include <openssl/evp.h>
+#include <openssl/buffer.h>
+
+int ssl23_write_bytes(SSL *s)
+{
+    int i, num, tot;
+    char *buf;
+
+    buf = s->init_buf->data;
+    tot = s->init_off;
+    num = s->init_num;
+    for (;;) {
+        s->rwstate = SSL_WRITING;
+        i = BIO_write(s->wbio, &(buf[tot]), num);
+        if (i <= 0) {
+            s->init_off = tot;
+            s->init_num = num;
+            return (i);
+        }
+        s->rwstate = SSL_NOTHING;
+        if (i == num)
+            return (tot + i);
+
+        num -= i;
+        tot += i;
+    }
+}
+
+/* return regularly only when we have read (at least) 'n' bytes */
+int ssl23_read_bytes(SSL *s, int n)
+{
+    unsigned char *p;
+    int j;
+
+    if (s->packet_length < (unsigned int)n) {
+        p = s->packet;
+
+        for (;;) {
+            s->rwstate = SSL_READING;
+            j = BIO_read(s->rbio, (char *)&(p[s->packet_length]),
+                         n - s->packet_length);
+            if (j <= 0)
+                return (j);
+            s->rwstate = SSL_NOTHING;
+            s->packet_length += j;
+            if (s->packet_length >= (unsigned int)n)
+                return (s->packet_length);
+        }
+    }
+    return (n);
+}

openssl-1.0.2f/ssl/s23_srvr.c

@@ -0,0 +1,652 @@
+/* ssl/s23_srvr.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#ifdef OPENSSL_FIPS
+# include <openssl/fips.h>
+#endif
+
+static const SSL_METHOD *ssl23_get_server_method(int ver);
+int ssl23_get_client_hello(SSL *s);
+static const SSL_METHOD *ssl23_get_server_method(int ver)
+{
+#ifndef OPENSSL_NO_SSL2
+    if (ver == SSL2_VERSION)
+        return (SSLv2_server_method());
+#endif
+#ifndef OPENSSL_NO_SSL3
+    if (ver == SSL3_VERSION)
+        return (SSLv3_server_method());
+#endif
+    if (ver == TLS1_VERSION)
+        return (TLSv1_server_method());
+    else if (ver == TLS1_1_VERSION)
+        return (TLSv1_1_server_method());
+    else if (ver == TLS1_2_VERSION)
+        return (TLSv1_2_server_method());
+    else
+        return (NULL);
+}
+
+IMPLEMENT_ssl23_meth_func(SSLv23_server_method,
+                          ssl23_accept,
+                          ssl_undefined_function, ssl23_get_server_method)
+
+int ssl23_accept(SSL *s)
+{
+    BUF_MEM *buf;
+    unsigned long Time = (unsigned long)time(NULL);
+    void (*cb) (const SSL *ssl, int type, int val) = NULL;
+    int ret = -1;
+    int new_state, state;
+
+    RAND_add(&Time, sizeof(Time), 0);
+    ERR_clear_error();
+    clear_sys_error();
+
+    if (s->info_callback != NULL)
+        cb = s->info_callback;
+    else if (s->ctx->info_callback != NULL)
+        cb = s->ctx->info_callback;
+
+    s->in_handshake++;
+    if (!SSL_in_init(s) || SSL_in_before(s))
+        SSL_clear(s);
+
+    for (;;) {
+        state = s->state;
+
+        switch (s->state) {
+        case SSL_ST_BEFORE:
+        case SSL_ST_ACCEPT:
+        case SSL_ST_BEFORE | SSL_ST_ACCEPT:
+        case SSL_ST_OK | SSL_ST_ACCEPT:
+
+            s->server = 1;
+            if (cb != NULL)
+                cb(s, SSL_CB_HANDSHAKE_START, 1);
+
+            /* s->version=SSL3_VERSION; */
+            s->type = SSL_ST_ACCEPT;
+
+            if (s->init_buf == NULL) {
+                if ((buf = BUF_MEM_new()) == NULL) {
+                    ret = -1;
+                    goto end;
+                }
+                if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
+                    BUF_MEM_free(buf);
+                    ret = -1;
+                    goto end;
+                }
+                s->init_buf = buf;
+            }
+
+            ssl3_init_finished_mac(s);
+
+            s->state = SSL23_ST_SR_CLNT_HELLO_A;
+            s->ctx->stats.sess_accept++;
+            s->init_num = 0;
+            break;
+
+        case SSL23_ST_SR_CLNT_HELLO_A:
+        case SSL23_ST_SR_CLNT_HELLO_B:
+
+            s->shutdown = 0;
+            ret = ssl23_get_client_hello(s);
+            if (ret >= 0)
+                cb = NULL;
+            goto end;
+            /* break; */
+
+        default:
+            SSLerr(SSL_F_SSL23_ACCEPT, SSL_R_UNKNOWN_STATE);
+            ret = -1;
+            goto end;
+            /* break; */
+        }
+
+        if ((cb != NULL) && (s->state != state)) {
+            new_state = s->state;
+            s->state = state;
+            cb(s, SSL_CB_ACCEPT_LOOP, 1);
+            s->state = new_state;
+        }
+    }
+ end:
+    s->in_handshake--;
+    if (cb != NULL)
+        cb(s, SSL_CB_ACCEPT_EXIT, ret);
+    return (ret);
+}
+
+int ssl23_get_client_hello(SSL *s)
+{
+    /*-
+     * Request this many bytes in initial read.
+     * We can detect SSL 3.0/TLS 1.0 Client Hellos
+     * ('type == 3') correctly only when the following
+     * is in a single record, which is not guaranteed by
+     * the protocol specification:
+     * Byte  Content
+     *  0     type            \
+     *  1/2   version          > record header
+     *  3/4   length          /
+     *  5     msg_type        \
+     *  6-8   length           > Client Hello message
+     *  9/10  client_version  /
+     */
+    char buf_space[11];
+    char *buf = &(buf_space[0]);
+    unsigned char *p, *d, *d_len, *dd;
+    unsigned int i;
+    unsigned int csl, sil, cl;
+    int n = 0, j;
+    int type = 0;
+    int v[2];
+
+    if (s->state == SSL23_ST_SR_CLNT_HELLO_A) {
+        /* read the initial header */
+        v[0] = v[1] = 0;
+
+        if (!ssl3_setup_buffers(s))
+            goto err;
+
+        n = ssl23_read_bytes(s, sizeof buf_space);
+        if (n != sizeof buf_space)
+            return (n);         /* n == -1 || n == 0 */
+
+        p = s->packet;
+
+        memcpy(buf, p, n);
+
+        if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {
+            /*
+             * SSLv2 header
+             */
+            if ((p[3] == 0x00) && (p[4] == 0x02)) {
+                v[0] = p[3];
+                v[1] = p[4];
+                /* SSLv2 */
+                if (!(s->options & SSL_OP_NO_SSLv2))
+                    type = 1;
+            } else if (p[3] == SSL3_VERSION_MAJOR) {
+                v[0] = p[3];
+                v[1] = p[4];
+                /* SSLv3/TLSv1 */
+                if (p[4] >= TLS1_VERSION_MINOR) {
+                    if (p[4] >= TLS1_2_VERSION_MINOR &&
+                        !(s->options & SSL_OP_NO_TLSv1_2)) {
+                        s->version = TLS1_2_VERSION;
+                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
+                    } else if (p[4] >= TLS1_1_VERSION_MINOR &&
+                               !(s->options & SSL_OP_NO_TLSv1_1)) {
+                        s->version = TLS1_1_VERSION;
+                        /*
+                         * type=2;
+                         *//*
+                         * done later to survive restarts
+                         */
+                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
+                    } else if (!(s->options & SSL_OP_NO_TLSv1)) {
+                        s->version = TLS1_VERSION;
+                        /*
+                         * type=2;
+                         *//*
+                         * done later to survive restarts
+                         */
+                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
+                    } else if (!(s->options & SSL_OP_NO_SSLv3)) {
+                        s->version = SSL3_VERSION;
+                        /* type=2; */
+                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
+                    } else if (!(s->options & SSL_OP_NO_SSLv2)) {
+                        type = 1;
+                    }
+                } else if (!(s->options & SSL_OP_NO_SSLv3)) {
+                    s->version = SSL3_VERSION;
+                    /* type=2; */
+                    s->state = SSL23_ST_SR_CLNT_HELLO_B;
+                } else if (!(s->options & SSL_OP_NO_SSLv2))
+                    type = 1;
+
+            }
+        }
+        /* p[4] < 5 ... silly record length? */
+        else if ((p[0] == SSL3_RT_HANDSHAKE) &&
+                 (p[1] == SSL3_VERSION_MAJOR) &&
+                 (p[5] == SSL3_MT_CLIENT_HELLO) && ((p[3] == 0 && p[4] < 5)
+                                                    || (p[9] >= p[1]))) {
+            /*
+             * SSLv3 or tls1 header
+             */
+
+            v[0] = p[1];        /* major version (= SSL3_VERSION_MAJOR) */
+            /*
+             * We must look at client_version inside the Client Hello message
+             * to get the correct minor version. However if we have only a
+             * pathologically small fragment of the Client Hello message, this
+             * would be difficult, and we'd have to read more records to find
+             * out. No known SSL 3.0 client fragments ClientHello like this,
+             * so we simply reject such connections to avoid protocol version
+             * downgrade attacks.
+             */
+            if (p[3] == 0 && p[4] < 6) {
+                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_SMALL);
+                goto err;
+            }
+            /*
+             * if major version number > 3 set minor to a value which will
+             * use the highest version 3 we support. If TLS 2.0 ever appears
+             * we will need to revise this....
+             */
+            if (p[9] > SSL3_VERSION_MAJOR)
+                v[1] = 0xff;
+            else
+                v[1] = p[10];   /* minor version according to client_version */
+            if (v[1] >= TLS1_VERSION_MINOR) {
+                if (v[1] >= TLS1_2_VERSION_MINOR &&
+                    !(s->options & SSL_OP_NO_TLSv1_2)) {
+                    s->version = TLS1_2_VERSION;
+                    type = 3;
+                } else if (v[1] >= TLS1_1_VERSION_MINOR &&
+                           !(s->options & SSL_OP_NO_TLSv1_1)) {
+                    s->version = TLS1_1_VERSION;
+                    type = 3;
+                } else if (!(s->options & SSL_OP_NO_TLSv1)) {
+                    s->version = TLS1_VERSION;
+                    type = 3;
+                } else if (!(s->options & SSL_OP_NO_SSLv3)) {
+                    s->version = SSL3_VERSION;
+                    type = 3;
+                }
+            } else {
+                /* client requests SSL 3.0 */
+                if (!(s->options & SSL_OP_NO_SSLv3)) {
+                    s->version = SSL3_VERSION;
+                    type = 3;
+                } else if (!(s->options & SSL_OP_NO_TLSv1)) {
+                    /*
+                     * we won't be able to use TLS of course, but this will
+                     * send an appropriate alert
+                     */
+                    s->version = TLS1_VERSION;
+                    type = 3;
+                }
+            }
+        } else if ((strncmp("GET ", (char *)p, 4) == 0) ||
+                   (strncmp("POST ", (char *)p, 5) == 0) ||
+                   (strncmp("HEAD ", (char *)p, 5) == 0) ||
+                   (strncmp("PUT ", (char *)p, 4) == 0)) {
+            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTP_REQUEST);
+            goto err;
+        } else if (strncmp("CONNECT", (char *)p, 7) == 0) {
+            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTPS_PROXY_REQUEST);
+            goto err;
+        }
+    }
+
+    /* ensure that TLS_MAX_VERSION is up-to-date */
+    OPENSSL_assert(s->version <= TLS_MAX_VERSION);
+
+    if (s->version < TLS1_2_VERSION && tls1_suiteb(s)) {
+        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
+               SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);
+        goto err;
+    }
+#ifdef OPENSSL_FIPS
+    if (FIPS_mode() && (s->version < TLS1_VERSION)) {
+        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
+               SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
+        goto err;
+    }
+#endif
+
+    if (s->state == SSL23_ST_SR_CLNT_HELLO_B) {
+        /*
+         * we have SSLv3/TLSv1 in an SSLv2 header (other cases skip this
+         * state)
+         */
+
+        type = 2;
+        p = s->packet;
+        v[0] = p[3];            /* == SSL3_VERSION_MAJOR */
+        v[1] = p[4];
+
+        /*-
+         * An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2
+         * header is sent directly on the wire, not wrapped as a TLS
+         * record. It's format is:
+         * Byte  Content
+         * 0-1   msg_length
+         * 2     msg_type
+         * 3-4   version
+         * 5-6   cipher_spec_length
+         * 7-8   session_id_length
+         * 9-10  challenge_length
+         * ...   ...
+         */
+        n = ((p[0] & 0x7f) << 8) | p[1];
+        if (n > (1024 * 4)) {
+            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_LARGE);
+            goto err;
+        }
+        if (n < 9) {
+            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
+                   SSL_R_RECORD_LENGTH_MISMATCH);
+            goto err;
+        }
+
+        j = ssl23_read_bytes(s, n + 2);
+        /*
+         * We previously read 11 bytes, so if j > 0, we must have j == n+2 ==
+         * s->packet_length. We have at least 11 valid packet bytes.
+         */
+        if (j <= 0)
+            return (j);
+
+        ssl3_finish_mac(s, s->packet + 2, s->packet_length - 2);
+
+        /* CLIENT-HELLO */
+        if (s->msg_callback)
+            s->msg_callback(0, SSL2_VERSION, 0, s->packet + 2,
+                            s->packet_length - 2, s, s->msg_callback_arg);
+
+        p = s->packet;
+        p += 5;
+        n2s(p, csl);
+        n2s(p, sil);
+        n2s(p, cl);
+        d = (unsigned char *)s->init_buf->data;
+        if ((csl + sil + cl + 11) != s->packet_length) { /* We can't have TLS
+                                                          * extensions in SSL
+                                                          * 2.0 format *
+                                                          * Client Hello, can
+                                                          * we? Error
+                                                          * condition should
+                                                          * be * '>'
+                                                          * otherweise */
+            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
+                   SSL_R_RECORD_LENGTH_MISMATCH);
+            goto err;
+        }
+
+        /* record header: msg_type ... */
+        *(d++) = SSL3_MT_CLIENT_HELLO;
+        /* ... and length (actual value will be written later) */
+        d_len = d;
+        d += 3;
+
+        /* client_version */
+        *(d++) = SSL3_VERSION_MAJOR; /* == v[0] */
+        *(d++) = v[1];
+
+        /* lets populate the random area */
+        /* get the challenge_length */
+        i = (cl > SSL3_RANDOM_SIZE) ? SSL3_RANDOM_SIZE : cl;
+        memset(d, 0, SSL3_RANDOM_SIZE);
+        memcpy(&(d[SSL3_RANDOM_SIZE - i]), &(p[csl + sil]), i);
+        d += SSL3_RANDOM_SIZE;
+
+        /* no session-id reuse */
+        *(d++) = 0;
+
+        /* ciphers */
+        j = 0;
+        dd = d;
+        d += 2;
+        for (i = 0; i < csl; i += 3) {
+            if (p[i] != 0)
+                continue;
+            *(d++) = p[i + 1];
+            *(d++) = p[i + 2];
+            j += 2;
+        }
+        s2n(j, dd);
+
+        /* COMPRESSION */
+        *(d++) = 1;
+        *(d++) = 0;
+
+#if 0
+        /* copy any remaining data with may be extensions */
+        p = p + csl + sil + cl;
+        while (p < s->packet + s->packet_length) {
+            *(d++) = *(p++);
+        }
+#endif
+
+        i = (d - (unsigned char *)s->init_buf->data) - 4;
+        l2n3((long)i, d_len);
+
+        /* get the data reused from the init_buf */
+        s->s3->tmp.reuse_message = 1;
+        s->s3->tmp.message_type = SSL3_MT_CLIENT_HELLO;
+        s->s3->tmp.message_size = i;
+    }
+
+    /* imaginary new state (for program structure): */
+    /* s->state = SSL23_SR_CLNT_HELLO_C */
+
+    if (type == 1) {
+#ifdef OPENSSL_NO_SSL2
+        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
+        goto err;
+#else
+        /* we are talking sslv2 */
+        /*
+         * we need to clean up the SSLv3/TLSv1 setup and put in the sslv2
+         * stuff.
+         */
+
+        if (s->s2 == NULL) {
+            if (!ssl2_new(s))
+                goto err;
+        } else
+            ssl2_clear(s);
+
+        if (s->s3 != NULL)
+            ssl3_free(s);
+
+        if (!BUF_MEM_grow_clean(s->init_buf,
+                                SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)) {
+            goto err;
+        }
+
+        s->state = SSL2_ST_GET_CLIENT_HELLO_A;
+        if (s->options & SSL_OP_NO_TLSv1 && s->options & SSL_OP_NO_SSLv3)
+            s->s2->ssl2_rollback = 0;
+        else
+            /*
+             * reject SSL 2.0 session if client supports SSL 3.0 or TLS 1.0
+             * (SSL 3.0 draft/RFC 2246, App. E.2)
+             */
+            s->s2->ssl2_rollback = 1;
+
+        /*
+         * setup the n bytes we have read so we get them from the sslv2
+         * buffer
+         */
+        s->rstate = SSL_ST_READ_HEADER;
+        s->packet_length = n;
+        s->packet = &(s->s2->rbuf[0]);
+        memcpy(s->packet, buf, n);
+        s->s2->rbuf_left = n;
+        s->s2->rbuf_offs = 0;
+
+        s->method = SSLv2_server_method();
+        s->handshake_func = s->method->ssl_accept;
+#endif
+    }
+
+    if ((type == 2) || (type == 3)) {
+        /*
+         * we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style)
+         */
+        const SSL_METHOD *new_method;
+        new_method = ssl23_get_server_method(s->version);
+        if (new_method == NULL) {
+            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
+            goto err;
+        }
+        s->method = new_method;
+
+        if (!ssl_init_wbio_buffer(s, 1))
+            goto err;
+
+        /* we are in this state */
+        s->state = SSL3_ST_SR_CLNT_HELLO_A;
+
+        if (type == 3) {
+            /*
+             * put the 'n' bytes we have read into the input buffer for SSLv3
+             */
+            s->rstate = SSL_ST_READ_HEADER;
+            s->packet_length = n;
+            if (s->s3->rbuf.buf == NULL)
+                if (!ssl3_setup_read_buffer(s))
+                    goto err;
+
+            s->packet = &(s->s3->rbuf.buf[0]);
+            memcpy(s->packet, buf, n);
+            s->s3->rbuf.left = n;
+            s->s3->rbuf.offset = 0;
+        } else {
+            s->packet_length = 0;
+            s->s3->rbuf.left = 0;
+            s->s3->rbuf.offset = 0;
+        }
+#if 0                           /* ssl3_get_client_hello does this */
+        s->client_version = (v[0] << 8) | v[1];
+#endif
+        s->handshake_func = s->method->ssl_accept;
+    }
+
+    if ((type < 1) || (type > 3)) {
+        /* bad, very bad */
+        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
+        goto err;
+    }
+    s->init_num = 0;
+
+    if (buf != buf_space)
+        OPENSSL_free(buf);
+    return (SSL_accept(s));
+ err:
+    if (buf != buf_space)
+        OPENSSL_free(buf);
+    return (-1);
+}

openssl-1.0.2f/ssl/s2_enc.c

@@ -0,0 +1,197 @@
+/* ssl/s2_enc.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include "ssl_locl.h"
+#ifndef OPENSSL_NO_SSL2
+# include <stdio.h>
+
+int ssl2_enc_init(SSL *s, int client)
+{
+    /* Max number of bytes needed */
+    EVP_CIPHER_CTX *rs, *ws;
+    const EVP_CIPHER *c;
+    const EVP_MD *md;
+    int num;
+
+    if (!ssl_cipher_get_evp(s->session, &c, &md, NULL, NULL, NULL)) {
+        ssl2_return_error(s, SSL2_PE_NO_CIPHER);
+        SSLerr(SSL_F_SSL2_ENC_INIT, SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);
+        return (0);
+    }
+    ssl_replace_hash(&s->read_hash, md);
+    ssl_replace_hash(&s->write_hash, md);
+
+    if ((s->enc_read_ctx == NULL) && ((s->enc_read_ctx = (EVP_CIPHER_CTX *)
+                                       OPENSSL_malloc(sizeof(EVP_CIPHER_CTX)))
+                                      == NULL))
+        goto err;
+
+    /*
+     * make sure it's intialized in case the malloc for enc_write_ctx fails
+     * and we exit with an error
+     */
+    rs = s->enc_read_ctx;
+    EVP_CIPHER_CTX_init(rs);
+
+    if ((s->enc_write_ctx == NULL) && ((s->enc_write_ctx = (EVP_CIPHER_CTX *)
+                                        OPENSSL_malloc(sizeof
+                                                       (EVP_CIPHER_CTX))) ==
+                                       NULL))
+        goto err;
+
+    ws = s->enc_write_ctx;
+    EVP_CIPHER_CTX_init(ws);
+
+    num = c->key_len;
+    s->s2->key_material_length = num * 2;
+    OPENSSL_assert(s->s2->key_material_length <= sizeof s->s2->key_material);
+
+    if (ssl2_generate_key_material(s) <= 0)
+        return 0;
+
+    OPENSSL_assert(c->iv_len <= (int)sizeof(s->session->key_arg));
+    EVP_EncryptInit_ex(ws, c, NULL,
+                       &(s->s2->key_material[(client) ? num : 0]),
+                       s->session->key_arg);
+    EVP_DecryptInit_ex(rs, c, NULL,
+                       &(s->s2->key_material[(client) ? 0 : num]),
+                       s->session->key_arg);
+    s->s2->read_key = &(s->s2->key_material[(client) ? 0 : num]);
+    s->s2->write_key = &(s->s2->key_material[(client) ? num : 0]);
+    return (1);
+ err:
+    SSLerr(SSL_F_SSL2_ENC_INIT, ERR_R_MALLOC_FAILURE);
+    return (0);
+}
+
+/*
+ * read/writes from s->s2->mac_data using length for encrypt and decrypt.
+ * It sets s->s2->padding and s->[rw]length if we are encrypting Returns 0 on
+ * error and 1 on success
+ */
+int ssl2_enc(SSL *s, int send)
+{
+    EVP_CIPHER_CTX *ds;
+    unsigned long l;
+    int bs;
+
+    if (send) {
+        ds = s->enc_write_ctx;
+        l = s->s2->wlength;
+    } else {
+        ds = s->enc_read_ctx;
+        l = s->s2->rlength;
+    }
+
+    /* check for NULL cipher */
+    if (ds == NULL)
+        return 1;
+
+    bs = ds->cipher->block_size;
+    /*
+     * This should be using (bs-1) and bs instead of 7 and 8, but what the
+     * hell.
+     */
+    if (bs == 8)
+        l = (l + 7) / 8 * 8;
+
+    if (EVP_Cipher(ds, s->s2->mac_data, s->s2->mac_data, l) < 1)
+        return 0;
+
+    return 1;
+}
+
+void ssl2_mac(SSL *s, unsigned char *md, int send)
+{
+    EVP_MD_CTX c;
+    unsigned char sequence[4], *p, *sec, *act;
+    unsigned long seq;
+    unsigned int len;
+
+    if (send) {
+        seq = s->s2->write_sequence;
+        sec = s->s2->write_key;
+        len = s->s2->wact_data_length;
+        act = s->s2->wact_data;
+    } else {
+        seq = s->s2->read_sequence;
+        sec = s->s2->read_key;
+        len = s->s2->ract_data_length;
+        act = s->s2->ract_data;
+    }
+
+    p = &(sequence[0]);
+    l2n(seq, p);
+
+    /* There has to be a MAC algorithm. */
+    EVP_MD_CTX_init(&c);
+    EVP_MD_CTX_copy(&c, s->read_hash);
+    EVP_DigestUpdate(&c, sec, EVP_CIPHER_CTX_key_length(s->enc_read_ctx));
+    EVP_DigestUpdate(&c, act, len);
+    /* the above line also does the pad data */
+    EVP_DigestUpdate(&c, sequence, 4);
+    EVP_DigestFinal_ex(&c, md, NULL);
+    EVP_MD_CTX_cleanup(&c);
+}
+#else                           /* !OPENSSL_NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy = &dummy;
+# endif
+
+#endif

openssl-1.0.2f/ssl/s2_lib.c

@@ -0,0 +1,564 @@
+/* ssl/s2_lib.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ssl_locl.h"
+#ifndef OPENSSL_NO_SSL2
+# include <stdio.h>
+# include <openssl/objects.h>
+# include <openssl/evp.h>
+# include <openssl/md5.h>
+
+const char ssl2_version_str[] = "SSLv2" OPENSSL_VERSION_PTEXT;
+
+# define SSL2_NUM_CIPHERS (sizeof(ssl2_ciphers)/sizeof(SSL_CIPHER))
+
+/* list of available SSLv2 ciphers (sorted by id) */
+OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
+# if 0
+/* NULL_WITH_MD5 v3 */
+    {
+     1,
+     SSL2_TXT_NULL_WITH_MD5,
+     SSL2_CK_NULL_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_eNULL,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_EXPORT | SSL_EXP40 | SSL_STRONG_NONE,
+     0,
+     0,
+     0,
+     },
+# endif
+
+/* RC4_128_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_RC4_128_WITH_MD5,
+     SSL2_CK_RC4_128_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_RC4,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_NOT_EXP | SSL_MEDIUM,
+     0,
+     128,
+     128,
+     },
+
+/* RC4_128_EXPORT40_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_RC4_128_EXPORT40_WITH_MD5,
+     SSL2_CK_RC4_128_EXPORT40_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_RC4,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_EXPORT | SSL_EXP40,
+     SSL2_CF_5_BYTE_ENC,
+     40,
+     128,
+     },
+
+/* RC2_128_CBC_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_RC2_128_CBC_WITH_MD5,
+     SSL2_CK_RC2_128_CBC_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_RC2,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_NOT_EXP | SSL_MEDIUM,
+     0,
+     128,
+     128,
+     },
+
+/* RC2_128_CBC_EXPORT40_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5,
+     SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_RC2,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_EXPORT | SSL_EXP40,
+     SSL2_CF_5_BYTE_ENC,
+     40,
+     128,
+     },
+
+# ifndef OPENSSL_NO_IDEA
+/* IDEA_128_CBC_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_IDEA_128_CBC_WITH_MD5,
+     SSL2_CK_IDEA_128_CBC_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_IDEA,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_NOT_EXP | SSL_MEDIUM,
+     0,
+     128,
+     128,
+     },
+# endif
+
+/* DES_64_CBC_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_DES_64_CBC_WITH_MD5,
+     SSL2_CK_DES_64_CBC_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_DES,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_NOT_EXP | SSL_LOW,
+     0,
+     56,
+     56,
+     },
+
+/* DES_192_EDE3_CBC_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5,
+     SSL2_CK_DES_192_EDE3_CBC_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_3DES,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_NOT_EXP | SSL_HIGH,
+     0,
+     112,
+     168,
+     },
+
+# if 0
+/* RC4_64_WITH_MD5 */
+    {
+     1,
+     SSL2_TXT_RC4_64_WITH_MD5,
+     SSL2_CK_RC4_64_WITH_MD5,
+     SSL_kRSA,
+     SSL_aRSA,
+     SSL_RC4,
+     SSL_MD5,
+     SSL_SSLV2,
+     SSL_NOT_EXP | SSL_LOW,
+     SSL2_CF_8_BYTE_ENC,
+     64,
+     64,
+     },
+# endif
+
+# if 0
+/* NULL SSLeay (testing) */
+    {
+     0,
+     SSL2_TXT_NULL,
+     SSL2_CK_NULL,
+     0,
+     0,
+     0,
+     0,
+     SSL_SSLV2,
+     SSL_STRONG_NONE,
+     0,
+     0,
+     0,
+     },
+# endif
+
+/* end of list :-) */
+};
+
+long ssl2_default_timeout(void)
+{
+    return (300);
+}
+
+int ssl2_num_ciphers(void)
+{
+    return (SSL2_NUM_CIPHERS);
+}
+
+const SSL_CIPHER *ssl2_get_cipher(unsigned int u)
+{
+    if (u < SSL2_NUM_CIPHERS)
+        return (&(ssl2_ciphers[SSL2_NUM_CIPHERS - 1 - u]));
+    else
+        return (NULL);
+}
+
+int ssl2_pending(const SSL *s)
+{
+    return SSL_in_init(s) ? 0 : s->s2->ract_data_length;
+}
+
+int ssl2_new(SSL *s)
+{
+    SSL2_STATE *s2;
+
+    if ((s2 = OPENSSL_malloc(sizeof *s2)) == NULL)
+        goto err;
+    memset(s2, 0, sizeof *s2);
+
+# if SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER + 3 > SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 2
+#  error "assertion failed"
+# endif
+
+    if ((s2->rbuf =
+         OPENSSL_malloc(SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 2)) == NULL)
+        goto err;
+    /*
+     * wbuf needs one byte more because when using two-byte headers, we leave
+     * the first byte unused in do_ssl_write (s2_pkt.c)
+     */
+    if ((s2->wbuf =
+         OPENSSL_malloc(SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 3)) == NULL)
+        goto err;
+    s->s2 = s2;
+
+    ssl2_clear(s);
+    return (1);
+ err:
+    if (s2 != NULL) {
+        if (s2->wbuf != NULL)
+            OPENSSL_free(s2->wbuf);
+        if (s2->rbuf != NULL)
+            OPENSSL_free(s2->rbuf);
+        OPENSSL_free(s2);
+    }
+    return (0);
+}
+
+void ssl2_free(SSL *s)
+{
+    SSL2_STATE *s2;
+
+    if (s == NULL)
+        return;
+
+    s2 = s->s2;
+    if (s2->rbuf != NULL)
+        OPENSSL_free(s2->rbuf);
+    if (s2->wbuf != NULL)
+        OPENSSL_free(s2->wbuf);
+    OPENSSL_cleanse(s2, sizeof *s2);
+    OPENSSL_free(s2);
+    s->s2 = NULL;
+}
+
+void ssl2_clear(SSL *s)
+{
+    SSL2_STATE *s2;
+    unsigned char *rbuf, *wbuf;
+
+    s2 = s->s2;
+
+    rbuf = s2->rbuf;
+    wbuf = s2->wbuf;
+
+    memset(s2, 0, sizeof *s2);
+
+    s2->rbuf = rbuf;
+    s2->wbuf = wbuf;
+    s2->clear_text = 1;
+    s->packet = s2->rbuf;
+    s->version = SSL2_VERSION;
+    s->packet_length = 0;
+}
+
+long ssl2_ctrl(SSL *s, int cmd, long larg, void *parg)
+{
+    int ret = 0;
+
+    switch (cmd) {
+    case SSL_CTRL_GET_SESSION_REUSED:
+        ret = s->hit;
+        break;
+    case SSL_CTRL_CHECK_PROTO_VERSION:
+        return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg);
+    default:
+        break;
+    }
+    return (ret);
+}
+
+long ssl2_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
+{
+    return (0);
+}
+
+long ssl2_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
+{
+    return (0);
+}
+
+long ssl2_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
+{
+    return (0);
+}
+
+/*
+ * This function needs to check if the ciphers required are actually
+ * available
+ */
+const SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p)
+{
+    SSL_CIPHER c;
+    const SSL_CIPHER *cp;
+    unsigned long id;
+
+    id = 0x02000000L | ((unsigned long)p[0] << 16L) |
+        ((unsigned long)p[1] << 8L) | (unsigned long)p[2];
+    c.id = id;
+    cp = OBJ_bsearch_ssl_cipher_id(&c, ssl2_ciphers, SSL2_NUM_CIPHERS);
+    return cp;
+}
+
+int ssl2_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
+{
+    long l;
+
+    if (p != NULL) {
+        l = c->id;
+        if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV)
+            return (0);
+        p[0] = ((unsigned char)(l >> 16L)) & 0xFF;
+        p[1] = ((unsigned char)(l >> 8L)) & 0xFF;
+        p[2] = ((unsigned char)(l)) & 0xFF;
+    }
+    return (3);
+}
+
+int ssl2_generate_key_material(SSL *s)
+{
+    unsigned int i;
+    EVP_MD_CTX ctx;
+    unsigned char *km;
+    unsigned char c = '0';
+    const EVP_MD *md5;
+    int md_size;
+
+    md5 = EVP_md5();
+
+# ifdef CHARSET_EBCDIC
+    c = os_toascii['0'];        /* Must be an ASCII '0', not EBCDIC '0', see
+                                 * SSLv2 docu */
+# endif
+    EVP_MD_CTX_init(&ctx);
+    km = s->s2->key_material;
+
+    if (s->session->master_key_length < 0 ||
+        s->session->master_key_length > (int)sizeof(s->session->master_key)) {
+        SSLerr(SSL_F_SSL2_GENERATE_KEY_MATERIAL, ERR_R_INTERNAL_ERROR);
+        return 0;
+    }
+    md_size = EVP_MD_size(md5);
+    if (md_size < 0)
+        return 0;
+    for (i = 0; i < s->s2->key_material_length; i += md_size) {
+        if (((km - s->s2->key_material) + md_size) >
+            (int)sizeof(s->s2->key_material)) {
+            /*
+             * EVP_DigestFinal_ex() below would write beyond buffer
+             */
+            SSLerr(SSL_F_SSL2_GENERATE_KEY_MATERIAL, ERR_R_INTERNAL_ERROR);
+            return 0;
+        }
+
+        EVP_DigestInit_ex(&ctx, md5, NULL);
+
+        OPENSSL_assert(s->session->master_key_length >= 0
+                       && s->session->master_key_length
+                       <= (int)sizeof(s->session->master_key));
+        EVP_DigestUpdate(&ctx, s->session->master_key,
+                         s->session->master_key_length);
+        EVP_DigestUpdate(&ctx, &c, 1);
+        c++;
+        EVP_DigestUpdate(&ctx, s->s2->challenge, s->s2->challenge_length);
+        EVP_DigestUpdate(&ctx, s->s2->conn_id, s->s2->conn_id_length);
+        EVP_DigestFinal_ex(&ctx, km, NULL);
+        km += md_size;
+    }
+
+    EVP_MD_CTX_cleanup(&ctx);
+    return 1;
+}
+
+void ssl2_return_error(SSL *s, int err)
+{
+    if (!s->error) {
+        s->error = 3;
+        s->error_code = err;
+
+        ssl2_write_error(s);
+    }
+}
+
+void ssl2_write_error(SSL *s)
+{
+    unsigned char buf[3];
+    int i, error;
+
+    buf[0] = SSL2_MT_ERROR;
+    buf[1] = (s->error_code >> 8) & 0xff;
+    buf[2] = (s->error_code) & 0xff;
+
+/*      state=s->rwstate;*/
+
+    error = s->error;           /* number of bytes left to write */
+    s->error = 0;
+    OPENSSL_assert(error >= 0 && error <= (int)sizeof(buf));
+    i = ssl2_write(s, &(buf[3 - error]), error);
+
+/*      if (i == error) s->rwstate=state; */
+
+    if (i < 0)
+        s->error = error;
+    else {
+        s->error = error - i;
+
+        if (s->error == 0)
+            if (s->msg_callback) {
+                /* ERROR */
+                s->msg_callback(1, s->version, 0, buf, 3, s,
+                                s->msg_callback_arg);
+            }
+    }
+}
+
+int ssl2_shutdown(SSL *s)
+{
+    s->shutdown = (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
+    return (1);
+}
+#else                           /* !OPENSSL_NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy = &dummy;
+# endif
+
+#endif

openssl-1.0.2f/ssl/s2_meth.c

@@ -0,0 +1,81 @@
+/* ssl/s2_meth.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include "ssl_locl.h"
+#ifndef OPENSSL_NO_SSL2
+# include <stdio.h>
+# include <openssl/objects.h>
+
+static const SSL_METHOD *ssl2_get_method(int ver);
+static const SSL_METHOD *ssl2_get_method(int ver)
+{
+    if (ver == SSL2_VERSION)
+        return (SSLv2_method());
+    else
+        return (NULL);
+}
+
+IMPLEMENT_ssl2_meth_func(SSLv2_method,
+                         ssl2_accept, ssl2_connect, ssl2_get_method)
+#else                           /* !OPENSSL_NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy = &dummy;
+# endif
+
+#endif

openssl-1.0.2f/ssl/s2_pkt.c

@@ -0,0 +1,725 @@
+/* ssl/s2_pkt.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "ssl_locl.h"
+#ifndef OPENSSL_NO_SSL2
+# include <stdio.h>
+# include <errno.h>
+# define USE_SOCKETS
+
+static int read_n(SSL *s, unsigned int n, unsigned int max,
+                  unsigned int extend);
+static int n_do_ssl_write(SSL *s, const unsigned char *buf, unsigned int len);
+static int write_pending(SSL *s, const unsigned char *buf, unsigned int len);
+static int ssl_mt_error(int n);
+
+/*
+ * SSL 2.0 imlementation for SSL_read/SSL_peek - This routine will return 0
+ * to len bytes, decrypted etc if required.
+ */
+static int ssl2_read_internal(SSL *s, void *buf, int len, int peek)
+{
+    int n;
+    unsigned char mac[MAX_MAC_SIZE];
+    unsigned char *p;
+    int i;
+    int mac_size;
+
+ ssl2_read_again:
+    if (SSL_in_init(s) && !s->in_handshake) {
+        n = s->handshake_func(s);
+        if (n < 0)
+            return (n);
+        if (n == 0) {
+            SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_SSL_HANDSHAKE_FAILURE);
+            return (-1);
+        }
+    }
+
+    clear_sys_error();
+    s->rwstate = SSL_NOTHING;
+    if (len <= 0)
+        return (len);
+
+    if (s->s2->ract_data_length != 0) { /* read from buffer */
+        if (len > s->s2->ract_data_length)
+            n = s->s2->ract_data_length;
+        else
+            n = len;
+
+        memcpy(buf, s->s2->ract_data, (unsigned int)n);
+        if (!peek) {
+            s->s2->ract_data_length -= n;
+            s->s2->ract_data += n;
+            if (s->s2->ract_data_length == 0)
+                s->rstate = SSL_ST_READ_HEADER;
+        }
+
+        return (n);
+    }
+
+    /*
+     * s->s2->ract_data_length == 0 Fill the buffer, then goto
+     * ssl2_read_again.
+     */
+
+    if (s->rstate == SSL_ST_READ_HEADER) {
+        if (s->first_packet) {
+            n = read_n(s, 5, SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 2, 0);
+            if (n <= 0)
+                return (n);     /* error or non-blocking */
+            s->first_packet = 0;
+            p = s->packet;
+            if (!((p[0] & 0x80) && ((p[2] == SSL2_MT_CLIENT_HELLO) ||
+                                    (p[2] == SSL2_MT_SERVER_HELLO)))) {
+                SSLerr(SSL_F_SSL2_READ_INTERNAL,
+                       SSL_R_NON_SSLV2_INITIAL_PACKET);
+                return (-1);
+            }
+        } else {
+            n = read_n(s, 2, SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 2, 0);
+            if (n <= 0)
+                return (n);     /* error or non-blocking */
+        }
+        /* part read stuff */
+
+        s->rstate = SSL_ST_READ_BODY;
+        p = s->packet;
+        /* Do header */
+        /*
+         * s->s2->padding=0;
+         */
+        s->s2->escape = 0;
+        s->s2->rlength = (((unsigned int)p[0]) << 8) | ((unsigned int)p[1]);
+        if ((p[0] & TWO_BYTE_BIT)) { /* Two byte header? */
+            s->s2->three_byte_header = 0;
+            s->s2->rlength &= TWO_BYTE_MASK;
+        } else {
+            s->s2->three_byte_header = 1;
+            s->s2->rlength &= THREE_BYTE_MASK;
+
+            /* security >s2->escape */
+            s->s2->escape = ((p[0] & SEC_ESC_BIT)) ? 1 : 0;
+        }
+    }
+
+    if (s->rstate == SSL_ST_READ_BODY) {
+        n = s->s2->rlength + 2 + s->s2->three_byte_header;
+        if (n > (int)s->packet_length) {
+            n -= s->packet_length;
+            i = read_n(s, (unsigned int)n, (unsigned int)n, 1);
+            if (i <= 0)
+                return (i);     /* ERROR */
+        }
+
+        p = &(s->packet[2]);
+        s->rstate = SSL_ST_READ_HEADER;
+        if (s->s2->three_byte_header)
+            s->s2->padding = *(p++);
+        else
+            s->s2->padding = 0;
+
+        /* Data portion */
+        if (s->s2->clear_text) {
+            mac_size = 0;
+            s->s2->mac_data = p;
+            s->s2->ract_data = p;
+            if (s->s2->padding) {
+                SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_ILLEGAL_PADDING);
+                return (-1);
+            }
+        } else {
+            mac_size = EVP_MD_CTX_size(s->read_hash);
+            if (mac_size < 0)
+                return -1;
+            OPENSSL_assert(mac_size <= MAX_MAC_SIZE);
+            s->s2->mac_data = p;
+            s->s2->ract_data = &p[mac_size];
+            if (s->s2->padding + mac_size > s->s2->rlength) {
+                SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_ILLEGAL_PADDING);
+                return (-1);
+            }
+        }
+
+        s->s2->ract_data_length = s->s2->rlength;
+        /*
+         * added a check for length > max_size in case encryption was not
+         * turned on yet due to an error
+         */
+        if ((!s->s2->clear_text) &&
+            (s->s2->rlength >= (unsigned int)mac_size)) {
+            if (!ssl2_enc(s, 0)) {
+                SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_DECRYPTION_FAILED);
+                return (-1);
+            }
+            s->s2->ract_data_length -= mac_size;
+            ssl2_mac(s, mac, 0);
+            s->s2->ract_data_length -= s->s2->padding;
+            if ((CRYPTO_memcmp(mac, s->s2->mac_data, mac_size) != 0) ||
+                (s->s2->rlength %
+                 EVP_CIPHER_CTX_block_size(s->enc_read_ctx) != 0)) {
+                SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_BAD_MAC_DECODE);
+                return (-1);
+            }
+        }
+        INC32(s->s2->read_sequence); /* expect next number */
+        /* s->s2->ract_data is now available for processing */
+
+        /*
+         * Possibly the packet that we just read had 0 actual data bytes.
+         * (SSLeay/OpenSSL itself never sends such packets; see ssl2_write.)
+         * In this case, returning 0 would be interpreted by the caller as
+         * indicating EOF, so it's not a good idea.  Instead, we just
+         * continue reading; thus ssl2_read_internal may have to process
+         * multiple packets before it can return. [Note that using select()
+         * for blocking sockets *never* guarantees that the next SSL_read
+         * will not block -- the available data may contain incomplete
+         * packets, and except for SSL 2, renegotiation can confuse things
+         * even more.]
+         */
+
+        goto ssl2_read_again;   /* This should really be "return
+                                 * ssl2_read(s,buf,len)", but that would
+                                 * allow for denial-of-service attacks if a C
+                                 * compiler is used that does not recognize
+                                 * end-recursion. */
+    } else {
+        SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_BAD_STATE);
+        return (-1);
+    }
+}
+
+int ssl2_read(SSL *s, void *buf, int len)
+{
+    return ssl2_read_internal(s, buf, len, 0);
+}
+
+int ssl2_peek(SSL *s, void *buf, int len)
+{
+    return ssl2_read_internal(s, buf, len, 1);
+}
+
+static int read_n(SSL *s, unsigned int n, unsigned int max,
+                  unsigned int extend)
+{
+    int i, off, newb;
+
+    /*
+     * if there is stuff still in the buffer from a previous read, and there
+     * is more than we want, take some.
+     */
+    if (s->s2->rbuf_left >= (int)n) {
+        if (extend)
+            s->packet_length += n;
+        else {
+            s->packet = &(s->s2->rbuf[s->s2->rbuf_offs]);
+            s->packet_length = n;
+        }
+        s->s2->rbuf_left -= n;
+        s->s2->rbuf_offs += n;
+        return (n);
+    }
+
+    if (!s->read_ahead)
+        max = n;
+    if (max > (unsigned int)(SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 2))
+        max = SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER + 2;
+
+    /*
+     * Else we want more than we have. First, if there is some left or we
+     * want to extend
+     */
+    off = 0;
+    if ((s->s2->rbuf_left != 0) || ((s->packet_length != 0) && extend)) {
+        newb = s->s2->rbuf_left;
+        if (extend) {
+            off = s->packet_length;
+            if (s->packet != s->s2->rbuf)
+                memcpy(s->s2->rbuf, s->packet, (unsigned int)newb + off);
+        } else if (s->s2->rbuf_offs != 0) {
+            memcpy(s->s2->rbuf, &(s->s2->rbuf[s->s2->rbuf_offs]),
+                   (unsigned int)newb);
+            s->s2->rbuf_offs = 0;
+        }
+        s->s2->rbuf_left = 0;
+    } else
+        newb = 0;
+
+    /*
+     * off is the offset to start writing too. r->s2->rbuf_offs is the
+     * 'unread data', now 0. newb is the number of new bytes so far
+     */
+    s->packet = s->s2->rbuf;
+    while (newb < (int)n) {
+        clear_sys_error();
+        if (s->rbio != NULL) {
+            s->rwstate = SSL_READING;
+            i = BIO_read(s->rbio, (char *)&(s->s2->rbuf[off + newb]),
+                         max - newb);
+        } else {
+            SSLerr(SSL_F_READ_N, SSL_R_READ_BIO_NOT_SET);
+            i = -1;
+        }
+# ifdef PKT_DEBUG
+        if (s->debug & 0x01)
+            sleep(1);
+# endif
+        if (i <= 0) {
+            s->s2->rbuf_left += newb;
+            return (i);
+        }
+        newb += i;
+    }
+
+    /* record unread data */
+    if (newb > (int)n) {
+        s->s2->rbuf_offs = n + off;
+        s->s2->rbuf_left = newb - n;
+    } else {
+        s->s2->rbuf_offs = 0;
+        s->s2->rbuf_left = 0;
+    }
+    if (extend)
+        s->packet_length += n;
+    else
+        s->packet_length = n;
+    s->rwstate = SSL_NOTHING;
+    return (n);
+}
+
+int ssl2_write(SSL *s, const void *_buf, int len)
+{
+    const unsigned char *buf = _buf;
+    unsigned int n, tot;
+    int i;
+
+    if (SSL_in_init(s) && !s->in_handshake) {
+        i = s->handshake_func(s);
+        if (i < 0)
+            return (i);
+        if (i == 0) {
+            SSLerr(SSL_F_SSL2_WRITE, SSL_R_SSL_HANDSHAKE_FAILURE);
+            return (-1);
+        }
+    }
+
+    if (s->error) {
+        ssl2_write_error(s);
+        if (s->error)
+            return (-1);
+    }
+
+    clear_sys_error();
+    s->rwstate = SSL_NOTHING;
+    if (len <= 0)
+        return (len);
+
+    tot = s->s2->wnum;
+    s->s2->wnum = 0;
+
+    n = (len - tot);
+    for (;;) {
+        i = n_do_ssl_write(s, &(buf[tot]), n);
+        if (i <= 0) {
+            s->s2->wnum = tot;
+            return (i);
+        }
+        if ((i == (int)n) || (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)) {
+            return (tot + i);
+        }
+
+        n -= i;
+        tot += i;
+    }
+}
+
+static int write_pending(SSL *s, const unsigned char *buf, unsigned int len)
+{
+    int i;
+
+    /* s->s2->wpend_len != 0 MUST be true. */
+
+    /*
+     * check that they have given us the same buffer to write
+     */
+    if ((s->s2->wpend_tot > (int)len) ||
+        ((s->s2->wpend_buf != buf) &&
+         !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER))) {
+        SSLerr(SSL_F_WRITE_PENDING, SSL_R_BAD_WRITE_RETRY);
+        return (-1);
+    }
+
+    for (;;) {
+        clear_sys_error();
+        if (s->wbio != NULL) {
+            s->rwstate = SSL_WRITING;
+            i = BIO_write(s->wbio,
+                          (char *)&(s->s2->write_ptr[s->s2->wpend_off]),
+                          (unsigned int)s->s2->wpend_len);
+        } else {
+            SSLerr(SSL_F_WRITE_PENDING, SSL_R_WRITE_BIO_NOT_SET);
+            i = -1;
+        }
+# ifdef PKT_DEBUG
+        if (s->debug & 0x01)
+            sleep(1);
+# endif
+        if (i == s->s2->wpend_len) {
+            s->s2->wpend_len = 0;
+            s->rwstate = SSL_NOTHING;
+            return (s->s2->wpend_ret);
+        } else if (i <= 0)
+            return (i);
+        s->s2->wpend_off += i;
+        s->s2->wpend_len -= i;
+    }
+}
+
+static int n_do_ssl_write(SSL *s, const unsigned char *buf, unsigned int len)
+{
+    unsigned int j, k, olen, p, bs;
+    int mac_size;
+    register unsigned char *pp;
+
+    olen = len;
+
+    /*
+     * first check if there is data from an encryption waiting to be sent -
+     * it must be sent because the other end is waiting. This will happen
+     * with non-blocking IO.  We print it and then return.
+     */
+    if (s->s2->wpend_len != 0)
+        return (write_pending(s, buf, len));
+
+    /* set mac_size to mac size */
+    if (s->s2->clear_text)
+        mac_size = 0;
+    else {
+        mac_size = EVP_MD_CTX_size(s->write_hash);
+        if (mac_size < 0)
+            return -1;
+    }
+
+    /* lets set the pad p */
+    if (s->s2->clear_text) {
+        if (len > SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER)
+            len = SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER;
+        p = 0;
+        s->s2->three_byte_header = 0;
+        /* len=len; */
+    } else {
+        bs = EVP_CIPHER_CTX_block_size(s->enc_read_ctx);
+        j = len + mac_size;
+        /*
+         * Two-byte headers allow for a larger record length than three-byte
+         * headers, but we can't use them if we need padding or if we have to
+         * set the escape bit.
+         */
+        if ((j > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER) && (!s->s2->escape)) {
+            if (j > SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER)
+                j = SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER;
+            /*
+             * set k to the max number of bytes with 2 byte header
+             */
+            k = j - (j % bs);
+            /* how many data bytes? */
+            len = k - mac_size;
+            s->s2->three_byte_header = 0;
+            p = 0;
+        } else if ((bs <= 1) && (!s->s2->escape)) {
+            /*-
+             * j <= SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER, thus
+             * j < SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER
+             */
+            s->s2->three_byte_header = 0;
+            p = 0;
+        } else {                /* we may have to use a 3 byte header */
+
+            /*-
+             * If s->s2->escape is not set, then
+             * j <= SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER, and thus
+             * j < SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER.
+             */
+            p = (j % bs);
+            p = (p == 0) ? 0 : (bs - p);
+            if (s->s2->escape) {
+                s->s2->three_byte_header = 1;
+                if (j > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
+                    j = SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER;
+            } else
+                s->s2->three_byte_header = (p == 0) ? 0 : 1;
+        }
+    }
+
+    /*-
+     * Now
+     *      j <= SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER
+     * holds, and if s->s2->three_byte_header is set, then even
+     *      j <= SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER.
+     */
+
+    /*
+     * mac_size is the number of MAC bytes len is the number of data bytes we
+     * are going to send p is the number of padding bytes (if it is a
+     * two-byte header, then p == 0)
+     */
+
+    s->s2->wlength = len;
+    s->s2->padding = p;
+    s->s2->mac_data = &(s->s2->wbuf[3]);
+    s->s2->wact_data = &(s->s2->wbuf[3 + mac_size]);
+
+    /*
+     * It would be clearer to write this as follows:
+     *     if (mac_size + len + p > SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER)
+     * However |len| is user input that could in theory be very large. We
+     * know |mac_size| and |p| are small, so to avoid any possibility of
+     * overflow we write it like this.
+     *
+     * In theory this should never fail because the logic above should have
+     * modified |len| if it is too big. But we are being cautious.
+     */
+    if (len > (SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER - (mac_size + p))) {
+        return -1;
+    }
+    /* we copy the data into s->s2->wbuf */
+    memcpy(s->s2->wact_data, buf, len);
+    if (p)
+        memset(&(s->s2->wact_data[len]), 0, p); /* arbitrary padding */
+
+    if (!s->s2->clear_text) {
+        s->s2->wact_data_length = len + p;
+        ssl2_mac(s, s->s2->mac_data, 1);
+        s->s2->wlength += p + mac_size;
+        if (ssl2_enc(s, 1) < 1)
+            return -1;
+    }
+
+    /* package up the header */
+    s->s2->wpend_len = s->s2->wlength;
+    if (s->s2->three_byte_header) { /* 3 byte header */
+        pp = s->s2->mac_data;
+        pp -= 3;
+        pp[0] = (s->s2->wlength >> 8) & (THREE_BYTE_MASK >> 8);
+        if (s->s2->escape)
+            pp[0] |= SEC_ESC_BIT;
+        pp[1] = s->s2->wlength & 0xff;
+        pp[2] = s->s2->padding;
+        s->s2->wpend_len += 3;
+    } else {
+        pp = s->s2->mac_data;
+        pp -= 2;
+        pp[0] = ((s->s2->wlength >> 8) & (TWO_BYTE_MASK >> 8)) | TWO_BYTE_BIT;
+        pp[1] = s->s2->wlength & 0xff;
+        s->s2->wpend_len += 2;
+    }
+    s->s2->write_ptr = pp;
+
+    INC32(s->s2->write_sequence); /* expect next number */
+
+    /* lets try to actually write the data */
+    s->s2->wpend_tot = olen;
+    s->s2->wpend_buf = buf;
+
+    s->s2->wpend_ret = len;
+
+    s->s2->wpend_off = 0;
+    return (write_pending(s, buf, olen));
+}
+
+int ssl2_part_read(SSL *s, unsigned long f, int i)
+{
+    unsigned char *p;
+    int j;
+
+    if (i < 0) {
+        /* ssl2_return_error(s); */
+        /*
+         * for non-blocking io, this is not necessarily fatal
+         */
+        return (i);
+    } else {
+        s->init_num += i;
+
+        /*
+         * Check for error.  While there are recoverable errors, this
+         * function is not called when those must be expected; any error
+         * detected here is fatal.
+         */
+        if (s->init_num >= 3) {
+            p = (unsigned char *)s->init_buf->data;
+            if (p[0] == SSL2_MT_ERROR) {
+                j = (p[1] << 8) | p[2];
+                SSLerr((int)f, ssl_mt_error(j));
+                s->init_num -= 3;
+                if (s->init_num > 0)
+                    memmove(p, p + 3, s->init_num);
+            }
+        }
+
+        /*
+         * If it's not an error message, we have some error anyway -- the
+         * message was shorter than expected.  This too is treated as fatal
+         * (at least if SSL_get_error is asked for its opinion).
+         */
+        return (0);
+    }
+}
+
+int ssl2_do_write(SSL *s)
+{
+    int ret;
+
+    ret = ssl2_write(s, &s->init_buf->data[s->init_off], s->init_num);
+    if (ret == s->init_num) {
+        if (s->msg_callback)
+            s->msg_callback(1, s->version, 0, s->init_buf->data,
+                            (size_t)(s->init_off + s->init_num), s,
+                            s->msg_callback_arg);
+        return (1);
+    }
+    if (ret < 0)
+        return (-1);
+    s->init_off += ret;
+    s->init_num -= ret;
+    return (0);
+}
+
+static int ssl_mt_error(int n)
+{
+    int ret;
+
+    switch (n) {
+    case SSL2_PE_NO_CIPHER:
+        ret = SSL_R_PEER_ERROR_NO_CIPHER;
+        break;
+    case SSL2_PE_NO_CERTIFICATE:
+        ret = SSL_R_PEER_ERROR_NO_CERTIFICATE;
+        break;
+    case SSL2_PE_BAD_CERTIFICATE:
+        ret = SSL_R_PEER_ERROR_CERTIFICATE;
+        break;
+    case SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE:
+        ret = SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE;
+        break;
+    default:
+        ret = SSL_R_UNKNOWN_REMOTE_ERROR_TYPE;
+        break;
+    }
+    return (ret);
+}
+#else                           /* !OPENSSL_NO_SSL2 */
+
+# if PEDANTIC
+static void *dummy = &dummy;
+# endif
+
+#endif

openssl-1.0.2f/ssl/s3_both.c

@@ -0,0 +1,747 @@
+/* ssl/s3_both.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+#include <limits.h>
+#include <string.h>
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+
+/*
+ * send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
+ * SSL3_RT_CHANGE_CIPHER_SPEC)
+ */
+int ssl3_do_write(SSL *s, int type)
+{
+    int ret;
+
+    ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
+                           s->init_num);
+    if (ret < 0)
+        return (-1);
+    if (type == SSL3_RT_HANDSHAKE)
+        /*
+         * should not be done for 'Hello Request's, but in that case we'll
+         * ignore the result anyway
+         */
+        ssl3_finish_mac(s, (unsigned char *)&s->init_buf->data[s->init_off],
+                        ret);
+
+    if (ret == s->init_num) {
+        if (s->msg_callback)
+            s->msg_callback(1, s->version, type, s->init_buf->data,
+                            (size_t)(s->init_off + s->init_num), s,
+                            s->msg_callback_arg);
+        return (1);
+    }
+    s->init_off += ret;
+    s->init_num -= ret;
+    return (0);
+}
+
+int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
+{
+    unsigned char *p;
+    int i;
+    unsigned long l;
+
+    if (s->state == a) {
+        p = ssl_handshake_start(s);
+
+        i = s->method->ssl3_enc->final_finish_mac(s,
+                                                  sender, slen,
+                                                  s->s3->tmp.finish_md);
+        if (i <= 0)
+            return 0;
+        s->s3->tmp.finish_md_len = i;
+        memcpy(p, s->s3->tmp.finish_md, i);
+        l = i;
+
+        /*
+         * Copy the finished so we can use it for renegotiation checks
+         */
+        if (s->type == SSL_ST_CONNECT) {
+            OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+            memcpy(s->s3->previous_client_finished, s->s3->tmp.finish_md, i);
+            s->s3->previous_client_finished_len = i;
+        } else {
+            OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+            memcpy(s->s3->previous_server_finished, s->s3->tmp.finish_md, i);
+            s->s3->previous_server_finished_len = i;
+        }
+
+#ifdef OPENSSL_SYS_WIN16
+        /*
+         * MSVC 1.5 does not clear the top bytes of the word unless I do
+         * this.
+         */
+        l &= 0xffff;
+#endif
+        ssl_set_handshake_header(s, SSL3_MT_FINISHED, l);
+        s->state = b;
+    }
+
+    /* SSL3_ST_SEND_xxxxxx_HELLO_B */
+    return ssl_do_write(s);
+}
+
+#ifndef OPENSSL_NO_NEXTPROTONEG
+/*
+ * ssl3_take_mac calculates the Finished MAC for the handshakes messages seen
+ * to far.
+ */
+static void ssl3_take_mac(SSL *s)
+{
+    const char *sender;
+    int slen;
+    /*
+     * If no new cipher setup return immediately: other functions will set
+     * the appropriate error.
+     */
+    if (s->s3->tmp.new_cipher == NULL)
+        return;
+    if (s->state & SSL_ST_CONNECT) {
+        sender = s->method->ssl3_enc->server_finished_label;
+        slen = s->method->ssl3_enc->server_finished_label_len;
+    } else {
+        sender = s->method->ssl3_enc->client_finished_label;
+        slen = s->method->ssl3_enc->client_finished_label_len;
+    }
+
+    s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
+                                                                          sender,
+                                                                          slen,
+                                                                          s->s3->tmp.peer_finish_md);
+}
+#endif
+
+int ssl3_get_finished(SSL *s, int a, int b)
+{
+    int al, i, ok;
+    long n;
+    unsigned char *p;
+
+#ifdef OPENSSL_NO_NEXTPROTONEG
+    /*
+     * the mac has already been generated when we received the change cipher
+     * spec message and is in s->s3->tmp.peer_finish_md
+     */
+#endif
+
+    /* 64 argument should actually be 36+4 :-) */
+    n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED, 64, &ok);
+
+    if (!ok)
+        return ((int)n);
+
+    /* If this occurs, we have missed a message */
+    if (!s->s3->change_cipher_spec) {
+        al = SSL_AD_UNEXPECTED_MESSAGE;
+        SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_GOT_A_FIN_BEFORE_A_CCS);
+        goto f_err;
+    }
+    s->s3->change_cipher_spec = 0;
+
+    p = (unsigned char *)s->init_msg;
+    i = s->s3->tmp.peer_finish_md_len;
+
+    if (i != n) {
+        al = SSL_AD_DECODE_ERROR;
+        SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_BAD_DIGEST_LENGTH);
+        goto f_err;
+    }
+
+    if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0) {
+        al = SSL_AD_DECRYPT_ERROR;
+        SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_DIGEST_CHECK_FAILED);
+        goto f_err;
+    }
+
+    /*
+     * Copy the finished so we can use it for renegotiation checks
+     */
+    if (s->type == SSL_ST_ACCEPT) {
+        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+        memcpy(s->s3->previous_client_finished, s->s3->tmp.peer_finish_md, i);
+        s->s3->previous_client_finished_len = i;
+    } else {
+        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+        memcpy(s->s3->previous_server_finished, s->s3->tmp.peer_finish_md, i);
+        s->s3->previous_server_finished_len = i;
+    }
+
+    return (1);
+ f_err:
+    ssl3_send_alert(s, SSL3_AL_FATAL, al);
+    return (0);
+}
+
+/*-
+ * for these 2 messages, we need to
+ * ssl->enc_read_ctx                    re-init
+ * ssl->s3->read_sequence               zero
+ * ssl->s3->read_mac_secret             re-init
+ * ssl->session->read_sym_enc           assign
+ * ssl->session->read_compression       assign
+ * ssl->session->read_hash              assign
+ */
+int ssl3_send_change_cipher_spec(SSL *s, int a, int b)
+{
+    unsigned char *p;
+
+    if (s->state == a) {
+        p = (unsigned char *)s->init_buf->data;
+        *p = SSL3_MT_CCS;
+        s->init_num = 1;
+        s->init_off = 0;
+
+        s->state = b;
+    }
+
+    /* SSL3_ST_CW_CHANGE_B */
+    return (ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC));
+}
+
+unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
+{
+    unsigned char *p;
+    unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
+
+    if (!ssl_add_cert_chain(s, cpk, &l))
+        return 0;
+
+    l -= 3 + SSL_HM_HEADER_LENGTH(s);
+    p = ssl_handshake_start(s);
+    l2n3(l, p);
+    l += 3;
+    ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE, l);
+    return l + SSL_HM_HEADER_LENGTH(s);
+}
+
+/*
+ * Obtain handshake message of message type 'mt' (any if mt == -1), maximum
+ * acceptable body length 'max'. The first four bytes (msg_type and length)
+ * are read in state 'st1', the body is read in state 'stn'.
+ */
+long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
+{
+    unsigned char *p;
+    unsigned long l;
+    long n;
+    int i, al;
+
+    if (s->s3->tmp.reuse_message) {
+        s->s3->tmp.reuse_message = 0;
+        if ((mt >= 0) && (s->s3->tmp.message_type != mt)) {
+            al = SSL_AD_UNEXPECTED_MESSAGE;
+            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto f_err;
+        }
+        *ok = 1;
+        s->state = stn;
+        s->init_msg = s->init_buf->data + 4;
+        s->init_num = (int)s->s3->tmp.message_size;
+        return s->init_num;
+    }
+
+    p = (unsigned char *)s->init_buf->data;
+
+    if (s->state == st1) {      /* s->init_num < 4 */
+        int skip_message;
+
+        do {
+            while (s->init_num < 4) {
+                i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
+                                              &p[s->init_num],
+                                              4 - s->init_num, 0);
+                if (i <= 0) {
+                    s->rwstate = SSL_READING;
+                    *ok = 0;
+                    return i;
+                }
+                s->init_num += i;
+            }
+
+            skip_message = 0;
+            if (!s->server)
+                if (p[0] == SSL3_MT_HELLO_REQUEST)
+                    /*
+                     * The server may always send 'Hello Request' messages --
+                     * we are doing a handshake anyway now, so ignore them if
+                     * their format is correct. Does not count for 'Finished'
+                     * MAC.
+                     */
+                    if (p[1] == 0 && p[2] == 0 && p[3] == 0) {
+                        s->init_num = 0;
+                        skip_message = 1;
+
+                        if (s->msg_callback)
+                            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
+                                            p, 4, s, s->msg_callback_arg);
+                    }
+        }
+        while (skip_message);
+
+        /* s->init_num == 4 */
+
+        if ((mt >= 0) && (*p != mt)) {
+            al = SSL_AD_UNEXPECTED_MESSAGE;
+            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto f_err;
+        }
+
+        s->s3->tmp.message_type = *(p++);
+
+        n2l3(p, l);
+        if (l > (unsigned long)max) {
+            al = SSL_AD_ILLEGAL_PARAMETER;
+            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
+            goto f_err;
+        }
+        if (l > (INT_MAX - 4)) { /* BUF_MEM_grow takes an 'int' parameter */
+            al = SSL_AD_ILLEGAL_PARAMETER;
+            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
+            goto f_err;
+        }
+        if (l && !BUF_MEM_grow_clean(s->init_buf, (int)l + 4)) {
+            SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB);
+            goto err;
+        }
+        s->s3->tmp.message_size = l;
+        s->state = stn;
+
+        s->init_msg = s->init_buf->data + 4;
+        s->init_num = 0;
+    }
+
+    /* next state (stn) */
+    p = s->init_msg;
+    n = s->s3->tmp.message_size - s->init_num;
+    while (n > 0) {
+        i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &p[s->init_num],
+                                      n, 0);
+        if (i <= 0) {
+            s->rwstate = SSL_READING;
+            *ok = 0;
+            return i;
+        }
+        s->init_num += i;
+        n -= i;
+    }
+
+#ifndef OPENSSL_NO_NEXTPROTONEG
+    /*
+     * If receiving Finished, record MAC of prior handshake messages for
+     * Finished verification.
+     */
+    if (*s->init_buf->data == SSL3_MT_FINISHED)
+        ssl3_take_mac(s);
+#endif
+
+    /* Feed this message into MAC computation. */
+    ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);
+    if (s->msg_callback)
+        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,
+                        (size_t)s->init_num + 4, s, s->msg_callback_arg);
+    *ok = 1;
+    return s->init_num;
+ f_err:
+    ssl3_send_alert(s, SSL3_AL_FATAL, al);
+ err:
+    *ok = 0;
+    return (-1);
+}
+
+int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
+{
+    EVP_PKEY *pk;
+    int ret = -1, i;
+
+    if (pkey == NULL)
+        pk = X509_get_pubkey(x);
+    else
+        pk = pkey;
+    if (pk == NULL)
+        goto err;
+
+    i = pk->type;
+    if (i == EVP_PKEY_RSA) {
+        ret = SSL_PKEY_RSA_ENC;
+    } else if (i == EVP_PKEY_DSA) {
+        ret = SSL_PKEY_DSA_SIGN;
+    }
+#ifndef OPENSSL_NO_EC
+    else if (i == EVP_PKEY_EC) {
+        ret = SSL_PKEY_ECC;
+    }
+#endif
+    else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc) {
+        ret = SSL_PKEY_GOST94;
+    } else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc) {
+        ret = SSL_PKEY_GOST01;
+    } else if (x && (i == EVP_PKEY_DH || i == EVP_PKEY_DHX)) {
+        /*
+         * For DH two cases: DH certificate signed with RSA and DH
+         * certificate signed with DSA.
+         */
+        i = X509_certificate_type(x, pk);
+        if (i & EVP_PKS_RSA)
+            ret = SSL_PKEY_DH_RSA;
+        else if (i & EVP_PKS_DSA)
+            ret = SSL_PKEY_DH_DSA;
+    }
+
+ err:
+    if (!pkey)
+        EVP_PKEY_free(pk);
+    return (ret);
+}
+
+int ssl_verify_alarm_type(long type)
+{
+    int al;
+
+    switch (type) {
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+    case X509_V_ERR_UNABLE_TO_GET_CRL:
+    case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
+        al = SSL_AD_UNKNOWN_CA;
+        break;
+    case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
+    case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
+    case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+    case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
+    case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+    case X509_V_ERR_CRL_NOT_YET_VALID:
+    case X509_V_ERR_CERT_UNTRUSTED:
+    case X509_V_ERR_CERT_REJECTED:
+        al = SSL_AD_BAD_CERTIFICATE;
+        break;
+    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
+    case X509_V_ERR_CRL_SIGNATURE_FAILURE:
+        al = SSL_AD_DECRYPT_ERROR;
+        break;
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+    case X509_V_ERR_CRL_HAS_EXPIRED:
+        al = SSL_AD_CERTIFICATE_EXPIRED;
+        break;
+    case X509_V_ERR_CERT_REVOKED:
+        al = SSL_AD_CERTIFICATE_REVOKED;
+        break;
+    case X509_V_ERR_OUT_OF_MEM:
+        al = SSL_AD_INTERNAL_ERROR;
+        break;
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
+    case X509_V_ERR_CERT_CHAIN_TOO_LONG:
+    case X509_V_ERR_PATH_LENGTH_EXCEEDED:
+    case X509_V_ERR_INVALID_CA:
+        al = SSL_AD_UNKNOWN_CA;
+        break;
+    case X509_V_ERR_APPLICATION_VERIFICATION:
+        al = SSL_AD_HANDSHAKE_FAILURE;
+        break;
+    case X509_V_ERR_INVALID_PURPOSE:
+        al = SSL_AD_UNSUPPORTED_CERTIFICATE;
+        break;
+    default:
+        al = SSL_AD_CERTIFICATE_UNKNOWN;
+        break;
+    }
+    return (al);
+}
+
+#ifndef OPENSSL_NO_BUF_FREELISTS
+/*-
+ * On some platforms, malloc() performance is bad enough that you can't just
+ * free() and malloc() buffers all the time, so we need to use freelists from
+ * unused buffers.  Currently, each freelist holds memory chunks of only a
+ * given size (list->chunklen); other sized chunks are freed and malloced.
+ * This doesn't help much if you're using many different SSL option settings
+ * with a given context.  (The options affecting buffer size are
+ * max_send_fragment, read buffer vs write buffer,
+ * SSL_OP_MICROSOFT_BIG_WRITE_BUFFER, SSL_OP_NO_COMPRESSION, and
+ * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS.)  Using a separate freelist for every
+ * possible size is not an option, since max_send_fragment can take on many
+ * different values.
+ *
+ * If you are on a platform with a slow malloc(), and you're using SSL
+ * connections with many different settings for these options, and you need to
+ * use the SSL_MOD_RELEASE_BUFFERS feature, you have a few options:
+ *    - Link against a faster malloc implementation.
+ *    - Use a separate SSL_CTX for each option set.
+ *    - Improve this code.
+ */
+static void *freelist_extract(SSL_CTX *ctx, int for_read, int sz)
+{
+    SSL3_BUF_FREELIST *list;
+    SSL3_BUF_FREELIST_ENTRY *ent = NULL;
+    void *result = NULL;
+
+    CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+    list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
+    if (list != NULL && sz == (int)list->chunklen)
+        ent = list->head;
+    if (ent != NULL) {
+        list->head = ent->next;
+        result = ent;
+        if (--list->len == 0)
+            list->chunklen = 0;
+    }
+    CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+    if (!result)
+        result = OPENSSL_malloc(sz);
+    return result;
+}
+
+static void freelist_insert(SSL_CTX *ctx, int for_read, size_t sz, void *mem)
+{
+    SSL3_BUF_FREELIST *list;
+    SSL3_BUF_FREELIST_ENTRY *ent;
+
+    CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+    list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
+    if (list != NULL &&
+        (sz == list->chunklen || list->chunklen == 0) &&
+        list->len < ctx->freelist_max_len && sz >= sizeof(*ent)) {
+        list->chunklen = sz;
+        ent = mem;
+        ent->next = list->head;
+        list->head = ent;
+        ++list->len;
+        mem = NULL;
+    }
+
+    CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+    if (mem)
+        OPENSSL_free(mem);
+}
+#else
+# define freelist_extract(c,fr,sz) OPENSSL_malloc(sz)
+# define freelist_insert(c,fr,sz,m) OPENSSL_free(m)
+#endif
+
+int ssl3_setup_read_buffer(SSL *s)
+{
+    unsigned char *p;
+    size_t len, align = 0, headerlen;
+
+    if (SSL_IS_DTLS(s))
+        headerlen = DTLS1_RT_HEADER_LENGTH;
+    else
+        headerlen = SSL3_RT_HEADER_LENGTH;
+
+#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
+    align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1);
+#endif
+
+    if (s->s3->rbuf.buf == NULL) {
+        len = SSL3_RT_MAX_PLAIN_LENGTH
+            + SSL3_RT_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
+        if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) {
+            s->s3->init_extra = 1;
+            len += SSL3_RT_MAX_EXTRA;
+        }
+#ifndef OPENSSL_NO_COMP
+        if (!(s->options & SSL_OP_NO_COMPRESSION))
+            len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+#endif
+        if ((p = freelist_extract(s->ctx, 1, len)) == NULL)
+            goto err;
+        s->s3->rbuf.buf = p;
+        s->s3->rbuf.len = len;
+    }
+
+    s->packet = &(s->s3->rbuf.buf[0]);
+    return 1;
+
+ err:
+    SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER, ERR_R_MALLOC_FAILURE);
+    return 0;
+}
+
+int ssl3_setup_write_buffer(SSL *s)
+{
+    unsigned char *p;
+    size_t len, align = 0, headerlen;
+
+    if (SSL_IS_DTLS(s))
+        headerlen = DTLS1_RT_HEADER_LENGTH + 1;
+    else
+        headerlen = SSL3_RT_HEADER_LENGTH;
+
+#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
+    align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1);
+#endif
+
+    if (s->s3->wbuf.buf == NULL) {
+        len = s->max_send_fragment
+            + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
+#ifndef OPENSSL_NO_COMP
+        if (!(s->options & SSL_OP_NO_COMPRESSION))
+            len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+#endif
+        if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+            len += headerlen + align + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
+
+        if ((p = freelist_extract(s->ctx, 0, len)) == NULL)
+            goto err;
+        s->s3->wbuf.buf = p;
+        s->s3->wbuf.len = len;
+    }
+
+    return 1;
+
+ err:
+    SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
+    return 0;
+}
+
+int ssl3_setup_buffers(SSL *s)
+{
+    if (!ssl3_setup_read_buffer(s))
+        return 0;
+    if (!ssl3_setup_write_buffer(s))
+        return 0;
+    return 1;
+}
+
+int ssl3_release_write_buffer(SSL *s)
+{
+    if (s->s3->wbuf.buf != NULL) {
+        freelist_insert(s->ctx, 0, s->s3->wbuf.len, s->s3->wbuf.buf);
+        s->s3->wbuf.buf = NULL;
+    }
+    return 1;
+}
+
+int ssl3_release_read_buffer(SSL *s)
+{
+    if (s->s3->rbuf.buf != NULL) {
+        freelist_insert(s->ctx, 1, s->s3->rbuf.len, s->s3->rbuf.buf);
+        s->s3->rbuf.buf = NULL;
+    }
+    return 1;
+}

openssl-1.0.2f/ssl/s3_cbc.c

@@ -0,0 +1,820 @@
+/* ssl/s3_cbc.c */
+/* ====================================================================
+ * Copyright (c) 2012 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "../crypto/constant_time_locl.h"
+#include "ssl_locl.h"
+
+#include <openssl/md5.h>
+#include <openssl/sha.h>
+
+/*
+ * MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's
+ * length field. (SHA-384/512 have 128-bit length.)
+ */
+#define MAX_HASH_BIT_COUNT_BYTES 16
+
+/*
+ * MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support.
+ * Currently SHA-384/512 has a 128-byte block size and that's the largest
+ * supported by TLS.)
+ */
+#define MAX_HASH_BLOCK_SIZE 128
+
+/*-
+ * ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
+ * record in |rec| by updating |rec->length| in constant time.
+ *
+ * block_size: the block size of the cipher used to encrypt the record.
+ * returns:
+ *   0: (in non-constant time) if the record is publicly invalid.
+ *   1: if the padding was valid
+ *  -1: otherwise.
+ */
+int ssl3_cbc_remove_padding(const SSL *s,
+                            SSL3_RECORD *rec,
+                            unsigned block_size, unsigned mac_size)
+{
+    unsigned padding_length, good;
+    const unsigned overhead = 1 /* padding length byte */  + mac_size;
+
+    /*
+     * These lengths are all public so we can test them in non-constant time.
+     */
+    if (overhead > rec->length)
+        return 0;
+
+    padding_length = rec->data[rec->length - 1];
+    good = constant_time_ge(rec->length, padding_length + overhead);
+    /* SSLv3 requires that the padding is minimal. */
+    good &= constant_time_ge(block_size, padding_length + 1);
+    padding_length = good & (padding_length + 1);
+    rec->length -= padding_length;
+    rec->type |= padding_length << 8; /* kludge: pass padding length */
+    return constant_time_select_int(good, 1, -1);
+}
+
+/*-
+ * tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
+ * record in |rec| in constant time and returns 1 if the padding is valid and
+ * -1 otherwise. It also removes any explicit IV from the start of the record
+ * without leaking any timing about whether there was enough space after the
+ * padding was removed.
+ *
+ * block_size: the block size of the cipher used to encrypt the record.
+ * returns:
+ *   0: (in non-constant time) if the record is publicly invalid.
+ *   1: if the padding was valid
+ *  -1: otherwise.
+ */
+int tls1_cbc_remove_padding(const SSL *s,
+                            SSL3_RECORD *rec,
+                            unsigned block_size, unsigned mac_size)
+{
+    unsigned padding_length, good, to_check, i;
+    const unsigned overhead = 1 /* padding length byte */  + mac_size;
+    /* Check if version requires explicit IV */
+    if (SSL_USE_EXPLICIT_IV(s)) {
+        /*
+         * These lengths are all public so we can test them in non-constant
+         * time.
+         */
+        if (overhead + block_size > rec->length)
+            return 0;
+        /* We can now safely skip explicit IV */
+        rec->data += block_size;
+        rec->input += block_size;
+        rec->length -= block_size;
+    } else if (overhead > rec->length)
+        return 0;
+
+    padding_length = rec->data[rec->length - 1];
+
+    /*
+     * NB: if compression is in operation the first packet may not be of even
+     * length so the padding bug check cannot be performed. This bug
+     * workaround has been around since SSLeay so hopefully it is either
+     * fixed now or no buggy implementation supports compression [steve]
+     */
+    if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
+        /* First packet is even in size, so check */
+        if ((CRYPTO_memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+            !(padding_length & 1)) {
+            s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
+        }
+        if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) && padding_length > 0) {
+            padding_length--;
+        }
+    }
+
+    if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
+        /* padding is already verified */
+        rec->length -= padding_length + 1;
+        return 1;
+    }
+
+    good = constant_time_ge(rec->length, overhead + padding_length);
+    /*
+     * The padding consists of a length byte at the end of the record and
+     * then that many bytes of padding, all with the same value as the length
+     * byte. Thus, with the length byte included, there are i+1 bytes of
+     * padding. We can't check just |padding_length+1| bytes because that
+     * leaks decrypted information. Therefore we always have to check the
+     * maximum amount of padding possible. (Again, the length of the record
+     * is public information so we can use it.)
+     */
+    to_check = 255;             /* maximum amount of padding. */
+    if (to_check > rec->length - 1)
+        to_check = rec->length - 1;
+
+    for (i = 0; i < to_check; i++) {
+        unsigned char mask = constant_time_ge_8(padding_length, i);
+        unsigned char b = rec->data[rec->length - 1 - i];
+        /*
+         * The final |padding_length+1| bytes should all have the value
+         * |padding_length|. Therefore the XOR should be zero.
+         */
+        good &= ~(mask & (padding_length ^ b));
+    }
+
+    /*
+     * If any of the final |padding_length+1| bytes had the wrong value, one
+     * or more of the lower eight bits of |good| will be cleared.
+     */
+    good = constant_time_eq(0xff, good & 0xff);
+    padding_length = good & (padding_length + 1);
+    rec->length -= padding_length;
+    rec->type |= padding_length << 8; /* kludge: pass padding length */
+
+    return constant_time_select_int(good, 1, -1);
+}
+
+/*-
+ * ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
+ * constant time (independent of the concrete value of rec->length, which may
+ * vary within a 256-byte window).
+ *
+ * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
+ * this function.
+ *
+ * On entry:
+ *   rec->orig_len >= md_size
+ *   md_size <= EVP_MAX_MD_SIZE
+ *
+ * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
+ * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
+ * a single or pair of cache-lines, then the variable memory accesses don't
+ * actually affect the timing. CPUs with smaller cache-lines [if any] are
+ * not multi-core and are not considered vulnerable to cache-timing attacks.
+ */
+#define CBC_MAC_ROTATE_IN_PLACE
+
+void ssl3_cbc_copy_mac(unsigned char *out,
+                       const SSL3_RECORD *rec,
+                       unsigned md_size, unsigned orig_len)
+{
+#if defined(CBC_MAC_ROTATE_IN_PLACE)
+    unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
+    unsigned char *rotated_mac;
+#else
+    unsigned char rotated_mac[EVP_MAX_MD_SIZE];
+#endif
+
+    /*
+     * mac_end is the index of |rec->data| just after the end of the MAC.
+     */
+    unsigned mac_end = rec->length;
+    unsigned mac_start = mac_end - md_size;
+    /*
+     * scan_start contains the number of bytes that we can ignore because the
+     * MAC's position can only vary by 255 bytes.
+     */
+    unsigned scan_start = 0;
+    unsigned i, j;
+    unsigned div_spoiler;
+    unsigned rotate_offset;
+
+    OPENSSL_assert(orig_len >= md_size);
+    OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
+
+#if defined(CBC_MAC_ROTATE_IN_PLACE)
+    rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
+#endif
+
+    /* This information is public so it's safe to branch based on it. */
+    if (orig_len > md_size + 255 + 1)
+        scan_start = orig_len - (md_size + 255 + 1);
+    /*
+     * div_spoiler contains a multiple of md_size that is used to cause the
+     * modulo operation to be constant time. Without this, the time varies
+     * based on the amount of padding when running on Intel chips at least.
+     * The aim of right-shifting md_size is so that the compiler doesn't
+     * figure out that it can remove div_spoiler as that would require it to
+     * prove that md_size is always even, which I hope is beyond it.
+     */
+    div_spoiler = md_size >> 1;
+    div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
+    rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
+
+    memset(rotated_mac, 0, md_size);
+    for (i = scan_start, j = 0; i < orig_len; i++) {
+        unsigned char mac_started = constant_time_ge_8(i, mac_start);
+        unsigned char mac_ended = constant_time_ge_8(i, mac_end);
+        unsigned char b = rec->data[i];
+        rotated_mac[j++] |= b & mac_started & ~mac_ended;
+        j &= constant_time_lt(j, md_size);
+    }
+
+    /* Now rotate the MAC */
+#if defined(CBC_MAC_ROTATE_IN_PLACE)
+    j = 0;
+    for (i = 0; i < md_size; i++) {
+        /* in case cache-line is 32 bytes, touch second line */
+        ((volatile unsigned char *)rotated_mac)[rotate_offset ^ 32];
+        out[j++] = rotated_mac[rotate_offset++];
+        rotate_offset &= constant_time_lt(rotate_offset, md_size);
+    }
+#else
+    memset(out, 0, md_size);
+    rotate_offset = md_size - rotate_offset;
+    rotate_offset &= constant_time_lt(rotate_offset, md_size);
+    for (i = 0; i < md_size; i++) {
+        for (j = 0; j < md_size; j++)
+            out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
+        rotate_offset++;
+        rotate_offset &= constant_time_lt(rotate_offset, md_size);
+    }
+#endif
+}
+
+/*
+ * u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
+ * little-endian order. The value of p is advanced by four.
+ */
+#define u32toLE(n, p) \
+        (*((p)++)=(unsigned char)(n), \
+         *((p)++)=(unsigned char)(n>>8), \
+         *((p)++)=(unsigned char)(n>>16), \
+         *((p)++)=(unsigned char)(n>>24))
+
+/*
+ * These functions serialize the state of a hash and thus perform the
+ * standard "final" operation without adding the padding and length that such
+ * a function typically does.
+ */
+static void tls1_md5_final_raw(void *ctx, unsigned char *md_out)
+{
+    MD5_CTX *md5 = ctx;
+    u32toLE(md5->A, md_out);
+    u32toLE(md5->B, md_out);
+    u32toLE(md5->C, md_out);
+    u32toLE(md5->D, md_out);
+}
+
+static void tls1_sha1_final_raw(void *ctx, unsigned char *md_out)
+{
+    SHA_CTX *sha1 = ctx;
+    l2n(sha1->h0, md_out);
+    l2n(sha1->h1, md_out);
+    l2n(sha1->h2, md_out);
+    l2n(sha1->h3, md_out);
+    l2n(sha1->h4, md_out);
+}
+
+#define LARGEST_DIGEST_CTX SHA_CTX
+
+#ifndef OPENSSL_NO_SHA256
+static void tls1_sha256_final_raw(void *ctx, unsigned char *md_out)
+{
+    SHA256_CTX *sha256 = ctx;
+    unsigned i;
+
+    for (i = 0; i < 8; i++) {
+        l2n(sha256->h[i], md_out);
+    }
+}
+
+# undef  LARGEST_DIGEST_CTX
+# define LARGEST_DIGEST_CTX SHA256_CTX
+#endif
+
+#ifndef OPENSSL_NO_SHA512
+static void tls1_sha512_final_raw(void *ctx, unsigned char *md_out)
+{
+    SHA512_CTX *sha512 = ctx;
+    unsigned i;
+
+    for (i = 0; i < 8; i++) {
+        l2n8(sha512->h[i], md_out);
+    }
+}
+
+# undef  LARGEST_DIGEST_CTX
+# define LARGEST_DIGEST_CTX SHA512_CTX
+#endif
+
+/*
+ * ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
+ * which ssl3_cbc_digest_record supports.
+ */
+char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
+{
+#ifdef OPENSSL_FIPS
+    if (FIPS_mode())
+        return 0;
+#endif
+    switch (EVP_MD_CTX_type(ctx)) {
+    case NID_md5:
+    case NID_sha1:
+#ifndef OPENSSL_NO_SHA256
+    case NID_sha224:
+    case NID_sha256:
+#endif
+#ifndef OPENSSL_NO_SHA512
+    case NID_sha384:
+    case NID_sha512:
+#endif
+        return 1;
+    default:
+        return 0;
+    }
+}
+
+/*-
+ * ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
+ * record.
+ *
+ *   ctx: the EVP_MD_CTX from which we take the hash function.
+ *     ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX.
+ *   md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written.
+ *   md_out_size: if non-NULL, the number of output bytes is written here.
+ *   header: the 13-byte, TLS record header.
+ *   data: the record data itself, less any preceeding explicit IV.
+ *   data_plus_mac_size: the secret, reported length of the data and MAC
+ *     once the padding has been removed.
+ *   data_plus_mac_plus_padding_size: the public length of the whole
+ *     record, including padding.
+ *   is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS.
+ *
+ * On entry: by virtue of having been through one of the remove_padding
+ * functions, above, we know that data_plus_mac_size is large enough to contain
+ * a padding byte and MAC. (If the padding was invalid, it might contain the
+ * padding too. )
+ * Returns 1 on success or 0 on error
+ */
+int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
+                            unsigned char *md_out,
+                            size_t *md_out_size,
+                            const unsigned char header[13],
+                            const unsigned char *data,
+                            size_t data_plus_mac_size,
+                            size_t data_plus_mac_plus_padding_size,
+                            const unsigned char *mac_secret,
+                            unsigned mac_secret_length, char is_sslv3)
+{
+    union {
+        double align;
+        unsigned char c[sizeof(LARGEST_DIGEST_CTX)];
+    } md_state;
+    void (*md_final_raw) (void *ctx, unsigned char *md_out);
+    void (*md_transform) (void *ctx, const unsigned char *block);
+    unsigned md_size, md_block_size = 64;
+    unsigned sslv3_pad_length = 40, header_length, variance_blocks,
+        len, max_mac_bytes, num_blocks,
+        num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
+    unsigned int bits;          /* at most 18 bits */
+    unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
+    /* hmac_pad is the masked HMAC key. */
+    unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE];
+    unsigned char first_block[MAX_HASH_BLOCK_SIZE];
+    unsigned char mac_out[EVP_MAX_MD_SIZE];
+    unsigned i, j, md_out_size_u;
+    EVP_MD_CTX md_ctx;
+    /*
+     * mdLengthSize is the number of bytes in the length field that
+     * terminates * the hash.
+     */
+    unsigned md_length_size = 8;
+    char length_is_big_endian = 1;
+
+    /*
+     * This is a, hopefully redundant, check that allows us to forget about
+     * many possible overflows later in this function.
+     */
+    OPENSSL_assert(data_plus_mac_plus_padding_size < 1024 * 1024);
+
+    switch (EVP_MD_CTX_type(ctx)) {
+    case NID_md5:
+        if (MD5_Init((MD5_CTX *)md_state.c) <= 0)
+            return 0;
+        md_final_raw = tls1_md5_final_raw;
+        md_transform =
+            (void (*)(void *ctx, const unsigned char *block))MD5_Transform;
+        md_size = 16;
+        sslv3_pad_length = 48;
+        length_is_big_endian = 0;
+        break;
+    case NID_sha1:
+        if (SHA1_Init((SHA_CTX *)md_state.c) <= 0)
+            return 0;
+        md_final_raw = tls1_sha1_final_raw;
+        md_transform =
+            (void (*)(void *ctx, const unsigned char *block))SHA1_Transform;
+        md_size = 20;
+        break;
+#ifndef OPENSSL_NO_SHA256
+    case NID_sha224:
+        if (SHA224_Init((SHA256_CTX *)md_state.c) <= 0)
+            return 0;
+        md_final_raw = tls1_sha256_final_raw;
+        md_transform =
+            (void (*)(void *ctx, const unsigned char *block))SHA256_Transform;
+        md_size = 224 / 8;
+        break;
+    case NID_sha256:
+        if (SHA256_Init((SHA256_CTX *)md_state.c) <= 0)
+            return 0;
+        md_final_raw = tls1_sha256_final_raw;
+        md_transform =
+            (void (*)(void *ctx, const unsigned char *block))SHA256_Transform;
+        md_size = 32;
+        break;
+#endif
+#ifndef OPENSSL_NO_SHA512
+    case NID_sha384:
+        if (SHA384_Init((SHA512_CTX *)md_state.c) <= 0)
+            return 0;
+        md_final_raw = tls1_sha512_final_raw;
+        md_transform =
+            (void (*)(void *ctx, const unsigned char *block))SHA512_Transform;
+        md_size = 384 / 8;
+        md_block_size = 128;
+        md_length_size = 16;
+        break;
+    case NID_sha512:
+        if (SHA512_Init((SHA512_CTX *)md_state.c) <= 0)
+            return 0;
+        md_final_raw = tls1_sha512_final_raw;
+        md_transform =
+            (void (*)(void *ctx, const unsigned char *block))SHA512_Transform;
+        md_size = 64;
+        md_block_size = 128;
+        md_length_size = 16;
+        break;
+#endif
+    default:
+        /*
+         * ssl3_cbc_record_digest_supported should have been called first to
+         * check that the hash function is supported.
+         */
+        OPENSSL_assert(0);
+        if (md_out_size)
+            *md_out_size = 0;
+        return 0;
+    }
+
+    OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
+    OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
+    OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
+
+    header_length = 13;
+    if (is_sslv3) {
+        header_length = mac_secret_length + sslv3_pad_length + 8 /* sequence
+                                                                  * number */  +
+            1 /* record type */  +
+            2 /* record length */ ;
+    }
+
+    /*
+     * variance_blocks is the number of blocks of the hash that we have to
+     * calculate in constant time because they could be altered by the
+     * padding value. In SSLv3, the padding must be minimal so the end of
+     * the plaintext varies by, at most, 15+20 = 35 bytes. (We conservatively
+     * assume that the MAC size varies from 0..20 bytes.) In case the 9 bytes
+     * of hash termination (0x80 + 64-bit length) don't fit in the final
+     * block, we say that the final two blocks can vary based on the padding.
+     * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not
+     * required to be minimal. Therefore we say that the final six blocks can
+     * vary based on the padding. Later in the function, if the message is
+     * short and there obviously cannot be this many blocks then
+     * variance_blocks can be reduced.
+     */
+    variance_blocks = is_sslv3 ? 2 : 6;
+    /*
+     * From now on we're dealing with the MAC, which conceptually has 13
+     * bytes of `header' before the start of the data (TLS) or 71/75 bytes
+     * (SSLv3)
+     */
+    len = data_plus_mac_plus_padding_size + header_length;
+    /*
+     * max_mac_bytes contains the maximum bytes of bytes in the MAC,
+     * including * |header|, assuming that there's no padding.
+     */
+    max_mac_bytes = len - md_size - 1;
+    /* num_blocks is the maximum number of hash blocks. */
+    num_blocks =
+        (max_mac_bytes + 1 + md_length_size + md_block_size -
+         1) / md_block_size;
+    /*
+     * In order to calculate the MAC in constant time we have to handle the
+     * final blocks specially because the padding value could cause the end
+     * to appear somewhere in the final |variance_blocks| blocks and we can't
+     * leak where. However, |num_starting_blocks| worth of data can be hashed
+     * right away because no padding value can affect whether they are
+     * plaintext.
+     */
+    num_starting_blocks = 0;
+    /*
+     * k is the starting byte offset into the conceptual header||data where
+     * we start processing.
+     */
+    k = 0;
+    /*
+     * mac_end_offset is the index just past the end of the data to be MACed.
+     */
+    mac_end_offset = data_plus_mac_size + header_length - md_size;
+    /*
+     * c is the index of the 0x80 byte in the final hash block that contains
+     * application data.
+     */
+    c = mac_end_offset % md_block_size;
+    /*
+     * index_a is the hash block number that contains the 0x80 terminating
+     * value.
+     */
+    index_a = mac_end_offset / md_block_size;
+    /*
+     * index_b is the hash block number that contains the 64-bit hash length,
+     * in bits.
+     */
+    index_b = (mac_end_offset + md_length_size) / md_block_size;
+    /*
+     * bits is the hash-length in bits. It includes the additional hash block
+     * for the masked HMAC key, or whole of |header| in the case of SSLv3.
+     */
+
+    /*
+     * For SSLv3, if we're going to have any starting blocks then we need at
+     * least two because the header is larger than a single block.
+     */
+    if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) {
+        num_starting_blocks = num_blocks - variance_blocks;
+        k = md_block_size * num_starting_blocks;
+    }
+
+    bits = 8 * mac_end_offset;
+    if (!is_sslv3) {
+        /*
+         * Compute the initial HMAC block. For SSLv3, the padding and secret
+         * bytes are included in |header| because they take more than a
+         * single block.
+         */
+        bits += 8 * md_block_size;
+        memset(hmac_pad, 0, md_block_size);
+        OPENSSL_assert(mac_secret_length <= sizeof(hmac_pad));
+        memcpy(hmac_pad, mac_secret, mac_secret_length);
+        for (i = 0; i < md_block_size; i++)
+            hmac_pad[i] ^= 0x36;
+
+        md_transform(md_state.c, hmac_pad);
+    }
+
+    if (length_is_big_endian) {
+        memset(length_bytes, 0, md_length_size - 4);
+        length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24);
+        length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16);
+        length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8);
+        length_bytes[md_length_size - 1] = (unsigned char)bits;
+    } else {
+        memset(length_bytes, 0, md_length_size);
+        length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24);
+        length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16);
+        length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8);
+        length_bytes[md_length_size - 8] = (unsigned char)bits;
+    }
+
+    if (k > 0) {
+        if (is_sslv3) {
+            unsigned overhang;
+
+            /*
+             * The SSLv3 header is larger than a single block. overhang is
+             * the number of bytes beyond a single block that the header
+             * consumes: either 7 bytes (SHA1) or 11 bytes (MD5). There are no
+             * ciphersuites in SSLv3 that are not SHA1 or MD5 based and
+             * therefore we can be confident that the header_length will be
+             * greater than |md_block_size|. However we add a sanity check just
+             * in case
+             */
+            if (header_length <= md_block_size) {
+                /* Should never happen */
+                return 0;
+            }
+            overhang = header_length - md_block_size;
+            md_transform(md_state.c, header);
+            memcpy(first_block, header + md_block_size, overhang);
+            memcpy(first_block + overhang, data, md_block_size - overhang);
+            md_transform(md_state.c, first_block);
+            for (i = 1; i < k / md_block_size - 1; i++)
+                md_transform(md_state.c, data + md_block_size * i - overhang);
+        } else {
+            /* k is a multiple of md_block_size. */
+            memcpy(first_block, header, 13);
+            memcpy(first_block + 13, data, md_block_size - 13);
+            md_transform(md_state.c, first_block);
+            for (i = 1; i < k / md_block_size; i++)
+                md_transform(md_state.c, data + md_block_size * i - 13);
+        }
+    }
+
+    memset(mac_out, 0, sizeof(mac_out));
+
+    /*
+     * We now process the final hash blocks. For each block, we construct it
+     * in constant time. If the |i==index_a| then we'll include the 0x80
+     * bytes and zero pad etc. For each block we selectively copy it, in
+     * constant time, to |mac_out|.
+     */
+    for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks;
+         i++) {
+        unsigned char block[MAX_HASH_BLOCK_SIZE];
+        unsigned char is_block_a = constant_time_eq_8(i, index_a);
+        unsigned char is_block_b = constant_time_eq_8(i, index_b);
+        for (j = 0; j < md_block_size; j++) {
+            unsigned char b = 0, is_past_c, is_past_cp1;
+            if (k < header_length)
+                b = header[k];
+            else if (k < data_plus_mac_plus_padding_size + header_length)
+                b = data[k - header_length];
+            k++;
+
+            is_past_c = is_block_a & constant_time_ge_8(j, c);
+            is_past_cp1 = is_block_a & constant_time_ge_8(j, c + 1);
+            /*
+             * If this is the block containing the end of the application
+             * data, and we are at the offset for the 0x80 value, then
+             * overwrite b with 0x80.
+             */
+            b = constant_time_select_8(is_past_c, 0x80, b);
+            /*
+             * If this the the block containing the end of the application
+             * data and we're past the 0x80 value then just write zero.
+             */
+            b = b & ~is_past_cp1;
+            /*
+             * If this is index_b (the final block), but not index_a (the end
+             * of the data), then the 64-bit length didn't fit into index_a
+             * and we're having to add an extra block of zeros.
+             */
+            b &= ~is_block_b | is_block_a;
+
+            /*
+             * The final bytes of one of the blocks contains the length.
+             */
+            if (j >= md_block_size - md_length_size) {
+                /* If this is index_b, write a length byte. */
+                b = constant_time_select_8(is_block_b,
+                                           length_bytes[j -
+                                                        (md_block_size -
+                                                         md_length_size)], b);
+            }
+            block[j] = b;
+        }
+
+        md_transform(md_state.c, block);
+        md_final_raw(md_state.c, block);
+        /* If this is index_b, copy the hash value to |mac_out|. */
+        for (j = 0; j < md_size; j++)
+            mac_out[j] |= block[j] & is_block_b;
+    }
+
+    EVP_MD_CTX_init(&md_ctx);
+    if (EVP_DigestInit_ex(&md_ctx, ctx->digest, NULL /* engine */ ) <= 0)
+        goto err;
+    if (is_sslv3) {
+        /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
+        memset(hmac_pad, 0x5c, sslv3_pad_length);
+
+        if (EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length) <= 0
+                || EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length) <= 0
+                || EVP_DigestUpdate(&md_ctx, mac_out, md_size) <= 0)
+            goto err;
+    } else {
+        /* Complete the HMAC in the standard manner. */
+        for (i = 0; i < md_block_size; i++)
+            hmac_pad[i] ^= 0x6a;
+
+        if (EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size) <= 0
+                || EVP_DigestUpdate(&md_ctx, mac_out, md_size) <= 0)
+            goto err;
+    }
+    EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
+    if (md_out_size)
+        *md_out_size = md_out_size_u;
+    EVP_MD_CTX_cleanup(&md_ctx);
+
+    return 1;
+err:
+    EVP_MD_CTX_cleanup(&md_ctx);
+    return 0;
+}
+
+#ifdef OPENSSL_FIPS
+
+/*
+ * Due to the need to use EVP in FIPS mode we can't reimplement digests but
+ * we can ensure the number of blocks processed is equal for all cases by
+ * digesting additional data.
+ */
+
+void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
+                           EVP_MD_CTX *mac_ctx, const unsigned char *data,
+                           size_t data_len, size_t orig_len)
+{
+    size_t block_size, digest_pad, blocks_data, blocks_orig;
+    if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
+        return;
+    block_size = EVP_MD_CTX_block_size(mac_ctx);
+    /*-
+     * We are in FIPS mode if we get this far so we know we have only SHA*
+     * digests and TLS to deal with.
+     * Minimum digest padding length is 17 for SHA384/SHA512 and 9
+     * otherwise.
+     * Additional header is 13 bytes. To get the number of digest blocks
+     * processed round up the amount of data plus padding to the nearest
+     * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
+     * So we have:
+     * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
+     * equivalently:
+     * blocks = (payload_len + digest_pad + 12)/block_size + 1
+     * HMAC adds a constant overhead.
+     * We're ultimately only interested in differences so this becomes
+     * blocks = (payload_len + 29)/128
+     * for SHA384/SHA512 and
+     * blocks = (payload_len + 21)/64
+     * otherwise.
+     */
+    digest_pad = block_size == 64 ? 21 : 29;
+    blocks_orig = (orig_len + digest_pad) / block_size;
+    blocks_data = (data_len + digest_pad) / block_size;
+    /*
+     * MAC enough blocks to make up the difference between the original and
+     * actual lengths plus one extra block to ensure this is never a no op.
+     * The "data" pointer should always have enough space to perform this
+     * operation as it is large enough for a maximum length TLS buffer.
+     */
+    EVP_DigestSignUpdate(mac_ctx, data,
+                         (blocks_orig - blocks_data + 1) * block_size);
+}
+#endif

openssl-1.0.2f/ssl/s3_enc.c

@@ -0,0 +1,970 @@
+/* ssl/s3_enc.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2005 Nokia. All rights reserved.
+ *
+ * The portions of the attached software ("Contribution") is developed by
+ * Nokia Corporation and is licensed pursuant to the OpenSSL open source
+ * license.
+ *
+ * The Contribution, originally written by Mika Kousa and Pasi Eronen of
+ * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
+ * support (see RFC 4279) to OpenSSL.
+ *
+ * No patent licenses or other rights except those expressly stated in
+ * the OpenSSL open source license shall be deemed granted or received
+ * expressly, by implication, estoppel, or otherwise.
+ *
+ * No assurances are provided by Nokia that the Contribution does not
+ * infringe the patent or other intellectual property rights of any third
+ * party or that the license provides you with all the necessary rights
+ * to make use of the Contribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
+ * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
+ * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
+ * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
+ * OTHERWISE.
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/evp.h>
+#include <openssl/md5.h>
+
+static unsigned char ssl3_pad_1[48] = {
+    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
+};
+
+static unsigned char ssl3_pad_2[48] = {
+    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
+};
+
+static int ssl3_handshake_mac(SSL *s, int md_nid,
+                              const char *sender, int len, unsigned char *p);
+static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
+{
+    EVP_MD_CTX m5;
+    EVP_MD_CTX s1;
+    unsigned char buf[16], smd[SHA_DIGEST_LENGTH];
+    unsigned char c = 'A';
+    unsigned int i, j, k;
+
+#ifdef CHARSET_EBCDIC
+    c = os_toascii[c];          /* 'A' in ASCII */
+#endif
+    k = 0;
+    EVP_MD_CTX_init(&m5);
+    EVP_MD_CTX_set_flags(&m5, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+    EVP_MD_CTX_init(&s1);
+    for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
+        k++;
+        if (k > sizeof buf) {
+            /* bug: 'buf' is too small for this ciphersuite */
+            SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
+            return 0;
+        }
+
+        for (j = 0; j < k; j++)
+            buf[j] = c;
+        c++;
+        EVP_DigestInit_ex(&s1, EVP_sha1(), NULL);
+        EVP_DigestUpdate(&s1, buf, k);
+        EVP_DigestUpdate(&s1, s->session->master_key,
+                         s->session->master_key_length);
+        EVP_DigestUpdate(&s1, s->s3->server_random, SSL3_RANDOM_SIZE);
+        EVP_DigestUpdate(&s1, s->s3->client_random, SSL3_RANDOM_SIZE);
+        EVP_DigestFinal_ex(&s1, smd, NULL);
+
+        EVP_DigestInit_ex(&m5, EVP_md5(), NULL);
+        EVP_DigestUpdate(&m5, s->session->master_key,
+                         s->session->master_key_length);
+        EVP_DigestUpdate(&m5, smd, SHA_DIGEST_LENGTH);
+        if ((int)(i + MD5_DIGEST_LENGTH) > num) {
+            EVP_DigestFinal_ex(&m5, smd, NULL);
+            memcpy(km, smd, (num - i));
+        } else
+            EVP_DigestFinal_ex(&m5, km, NULL);
+
+        km += MD5_DIGEST_LENGTH;
+    }
+    OPENSSL_cleanse(smd, SHA_DIGEST_LENGTH);
+    EVP_MD_CTX_cleanup(&m5);
+    EVP_MD_CTX_cleanup(&s1);
+    return 1;
+}
+
+int ssl3_change_cipher_state(SSL *s, int which)
+{
+    unsigned char *p, *mac_secret;
+    unsigned char exp_key[EVP_MAX_KEY_LENGTH];
+    unsigned char exp_iv[EVP_MAX_IV_LENGTH];
+    unsigned char *ms, *key, *iv, *er1, *er2;
+    EVP_CIPHER_CTX *dd;
+    const EVP_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
+    COMP_METHOD *comp;
+#endif
+    const EVP_MD *m;
+    EVP_MD_CTX md;
+    int is_exp, n, i, j, k, cl;
+    int reuse_dd = 0;
+
+    is_exp = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
+    c = s->s3->tmp.new_sym_enc;
+    m = s->s3->tmp.new_hash;
+    /* m == NULL will lead to a crash later */
+    OPENSSL_assert(m);
+#ifndef OPENSSL_NO_COMP
+    if (s->s3->tmp.new_compression == NULL)
+        comp = NULL;
+    else
+        comp = s->s3->tmp.new_compression->method;
+#endif
+
+    if (which & SSL3_CC_READ) {
+        if (s->enc_read_ctx != NULL)
+            reuse_dd = 1;
+        else if ((s->enc_read_ctx =
+                  OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+            goto err;
+        else
+            /*
+             * make sure it's intialized in case we exit later with an error
+             */
+            EVP_CIPHER_CTX_init(s->enc_read_ctx);
+        dd = s->enc_read_ctx;
+
+        if (ssl_replace_hash(&s->read_hash, m) == NULL) {
+                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+                goto err2;
+        }
+#ifndef OPENSSL_NO_COMP
+        /* COMPRESS */
+        if (s->expand != NULL) {
+            COMP_CTX_free(s->expand);
+            s->expand = NULL;
+        }
+        if (comp != NULL) {
+            s->expand = COMP_CTX_new(comp);
+            if (s->expand == NULL) {
+                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
+                       SSL_R_COMPRESSION_LIBRARY_ERROR);
+                goto err2;
+            }
+            if (s->s3->rrec.comp == NULL)
+                s->s3->rrec.comp = (unsigned char *)
+                    OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH);
+            if (s->s3->rrec.comp == NULL)
+                goto err;
+        }
+#endif
+        memset(&(s->s3->read_sequence[0]), 0, 8);
+        mac_secret = &(s->s3->read_mac_secret[0]);
+    } else {
+        if (s->enc_write_ctx != NULL)
+            reuse_dd = 1;
+        else if ((s->enc_write_ctx =
+                  OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+            goto err;
+        else
+            /*
+             * make sure it's intialized in case we exit later with an error
+             */
+            EVP_CIPHER_CTX_init(s->enc_write_ctx);
+        dd = s->enc_write_ctx;
+        if (ssl_replace_hash(&s->write_hash, m) == NULL) {
+                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+                goto err2;
+        }
+#ifndef OPENSSL_NO_COMP
+        /* COMPRESS */
+        if (s->compress != NULL) {
+            COMP_CTX_free(s->compress);
+            s->compress = NULL;
+        }
+        if (comp != NULL) {
+            s->compress = COMP_CTX_new(comp);
+            if (s->compress == NULL) {
+                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
+                       SSL_R_COMPRESSION_LIBRARY_ERROR);
+                goto err2;
+            }
+        }
+#endif
+        memset(&(s->s3->write_sequence[0]), 0, 8);
+        mac_secret = &(s->s3->write_mac_secret[0]);
+    }
+
+    if (reuse_dd)
+        EVP_CIPHER_CTX_cleanup(dd);
+
+    p = s->s3->tmp.key_block;
+    i = EVP_MD_size(m);
+    if (i < 0)
+        goto err2;
+    cl = EVP_CIPHER_key_length(c);
+    j = is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
+                  cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
+    /* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */
+    k = EVP_CIPHER_iv_length(c);
+    if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
+        (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
+        ms = &(p[0]);
+        n = i + i;
+        key = &(p[n]);
+        n += j + j;
+        iv = &(p[n]);
+        n += k + k;
+        er1 = &(s->s3->client_random[0]);
+        er2 = &(s->s3->server_random[0]);
+    } else {
+        n = i;
+        ms = &(p[n]);
+        n += i + j;
+        key = &(p[n]);
+        n += j + k;
+        iv = &(p[n]);
+        n += k;
+        er1 = &(s->s3->server_random[0]);
+        er2 = &(s->s3->client_random[0]);
+    }
+
+    if (n > s->s3->tmp.key_block_length) {
+        SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+        goto err2;
+    }
+
+    EVP_MD_CTX_init(&md);
+    memcpy(mac_secret, ms, i);
+    if (is_exp) {
+        /*
+         * In here I set both the read and write key/iv to the same value
+         * since only the correct one will be used :-).
+         */
+        EVP_DigestInit_ex(&md, EVP_md5(), NULL);
+        EVP_DigestUpdate(&md, key, j);
+        EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
+        EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
+        EVP_DigestFinal_ex(&md, &(exp_key[0]), NULL);
+        key = &(exp_key[0]);
+
+        if (k > 0) {
+            EVP_DigestInit_ex(&md, EVP_md5(), NULL);
+            EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
+            EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
+            EVP_DigestFinal_ex(&md, &(exp_iv[0]), NULL);
+            iv = &(exp_iv[0]);
+        }
+    }
+
+    s->session->key_arg_length = 0;
+
+    EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE));
+
+#ifdef OPENSSL_SSL_TRACE_CRYPTO
+    if (s->msg_callback) {
+
+        int wh = which & SSL3_CC_WRITE ?
+            TLS1_RT_CRYPTO_WRITE : TLS1_RT_CRYPTO_READ;
+        s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,
+                        mac_secret, EVP_MD_size(m), s, s->msg_callback_arg);
+        if (c->key_len)
+            s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,
+                            key, c->key_len, s, s->msg_callback_arg);
+        if (k) {
+            s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_IV,
+                            iv, k, s, s->msg_callback_arg);
+        }
+    }
+#endif
+
+    OPENSSL_cleanse(&(exp_key[0]), sizeof(exp_key));
+    OPENSSL_cleanse(&(exp_iv[0]), sizeof(exp_iv));
+    EVP_MD_CTX_cleanup(&md);
+    return (1);
+ err:
+    SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
+ err2:
+    return (0);
+}
+
+int ssl3_setup_key_block(SSL *s)
+{
+    unsigned char *p;
+    const EVP_CIPHER *c;
+    const EVP_MD *hash;
+    int num;
+    int ret = 0;
+    SSL_COMP *comp;
+
+    if (s->s3->tmp.key_block_length != 0)
+        return (1);
+
+    if (!ssl_cipher_get_evp(s->session, &c, &hash, NULL, NULL, &comp)) {
+        SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
+        return (0);
+    }
+
+    s->s3->tmp.new_sym_enc = c;
+    s->s3->tmp.new_hash = hash;
+#ifdef OPENSSL_NO_COMP
+    s->s3->tmp.new_compression = NULL;
+#else
+    s->s3->tmp.new_compression = comp;
+#endif
+
+    num = EVP_MD_size(hash);
+    if (num < 0)
+        return 0;
+
+    num = EVP_CIPHER_key_length(c) + num + EVP_CIPHER_iv_length(c);
+    num *= 2;
+
+    ssl3_cleanup_key_block(s);
+
+    if ((p = OPENSSL_malloc(num)) == NULL)
+        goto err;
+
+    s->s3->tmp.key_block_length = num;
+    s->s3->tmp.key_block = p;
+
+    ret = ssl3_generate_key_block(s, p, num);
+
+    if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) {
+        /*
+         * enable vulnerability countermeasure for CBC ciphers with known-IV
+         * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
+         */
+        s->s3->need_empty_fragments = 1;
+
+        if (s->session->cipher != NULL) {
+            if (s->session->cipher->algorithm_enc == SSL_eNULL)
+                s->s3->need_empty_fragments = 0;
+
+#ifndef OPENSSL_NO_RC4
+            if (s->session->cipher->algorithm_enc == SSL_RC4)
+                s->s3->need_empty_fragments = 0;
+#endif
+        }
+    }
+
+    return ret;
+
+ err:
+    SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
+    return (0);
+}
+
+void ssl3_cleanup_key_block(SSL *s)
+{
+    if (s->s3->tmp.key_block != NULL) {
+        OPENSSL_cleanse(s->s3->tmp.key_block, s->s3->tmp.key_block_length);
+        OPENSSL_free(s->s3->tmp.key_block);
+        s->s3->tmp.key_block = NULL;
+    }
+    s->s3->tmp.key_block_length = 0;
+}
+
+/*-
+ * ssl3_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
+ *
+ * Returns:
+ *   0: (in non-constant time) if the record is publically invalid (i.e. too
+ *       short etc).
+ *   1: if the record's padding is valid / the encryption was successful.
+ *   -1: if the record's padding is invalid or, if sending, an internal error
+ *       occured.
+ */
+int ssl3_enc(SSL *s, int send)
+{
+    SSL3_RECORD *rec;
+    EVP_CIPHER_CTX *ds;
+    unsigned long l;
+    int bs, i, mac_size = 0;
+    const EVP_CIPHER *enc;
+
+    if (send) {
+        ds = s->enc_write_ctx;
+        rec = &(s->s3->wrec);
+        if (s->enc_write_ctx == NULL)
+            enc = NULL;
+        else
+            enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
+    } else {
+        ds = s->enc_read_ctx;
+        rec = &(s->s3->rrec);
+        if (s->enc_read_ctx == NULL)
+            enc = NULL;
+        else
+            enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
+    }
+
+    if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
+        memmove(rec->data, rec->input, rec->length);
+        rec->input = rec->data;
+    } else {
+        l = rec->length;
+        bs = EVP_CIPHER_block_size(ds->cipher);
+
+        /* COMPRESS */
+
+        if ((bs != 1) && send) {
+            i = bs - ((int)l % bs);
+
+            /* we need to add 'i-1' padding bytes */
+            l += i;
+            /*
+             * the last of these zero bytes will be overwritten with the
+             * padding length.
+             */
+            memset(&rec->input[rec->length], 0, i);
+            rec->length += i;
+            rec->input[l - 1] = (i - 1);
+        }
+
+        if (!send) {
+            if (l == 0 || l % bs != 0)
+                return 0;
+            /* otherwise, rec->length >= bs */
+        }
+
+        if (EVP_Cipher(ds, rec->data, rec->input, l) < 1)
+            return -1;
+
+        if (EVP_MD_CTX_md(s->read_hash) != NULL)
+            mac_size = EVP_MD_CTX_size(s->read_hash);
+        if ((bs != 1) && !send)
+            return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
+    }
+    return (1);
+}
+
+void ssl3_init_finished_mac(SSL *s)
+{
+    if (s->s3->handshake_buffer)
+        BIO_free(s->s3->handshake_buffer);
+    if (s->s3->handshake_dgst)
+        ssl3_free_digest_list(s);
+    s->s3->handshake_buffer = BIO_new(BIO_s_mem());
+    (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
+}
+
+void ssl3_free_digest_list(SSL *s)
+{
+    int i;
+    if (!s->s3->handshake_dgst)
+        return;
+    for (i = 0; i < SSL_MAX_DIGEST; i++) {
+        if (s->s3->handshake_dgst[i])
+            EVP_MD_CTX_destroy(s->s3->handshake_dgst[i]);
+    }
+    OPENSSL_free(s->s3->handshake_dgst);
+    s->s3->handshake_dgst = NULL;
+}
+
+void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
+{
+    if (s->s3->handshake_buffer
+        && !(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) {
+        BIO_write(s->s3->handshake_buffer, (void *)buf, len);
+    } else {
+        int i;
+        for (i = 0; i < SSL_MAX_DIGEST; i++) {
+            if (s->s3->handshake_dgst[i] != NULL)
+                EVP_DigestUpdate(s->s3->handshake_dgst[i], buf, len);
+        }
+    }
+}
+
+int ssl3_digest_cached_records(SSL *s)
+{
+    int i;
+    long mask;
+    const EVP_MD *md;
+    long hdatalen;
+    void *hdata;
+
+    /* Allocate handshake_dgst array */
+    ssl3_free_digest_list(s);
+    s->s3->handshake_dgst =
+        OPENSSL_malloc(SSL_MAX_DIGEST * sizeof(EVP_MD_CTX *));
+    memset(s->s3->handshake_dgst, 0, SSL_MAX_DIGEST * sizeof(EVP_MD_CTX *));
+    hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
+    if (hdatalen <= 0) {
+        SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, SSL_R_BAD_HANDSHAKE_LENGTH);
+        return 0;
+    }
+
+    /* Loop through bitso of algorithm2 field and create MD_CTX-es */
+    for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
+        if ((mask & ssl_get_algorithm2(s)) && md) {
+            s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
+#ifdef OPENSSL_FIPS
+            if (EVP_MD_nid(md) == NID_md5) {
+                EVP_MD_CTX_set_flags(s->s3->handshake_dgst[i],
+                                     EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+            }
+#endif
+            EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
+            EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
+        } else {
+            s->s3->handshake_dgst[i] = NULL;
+        }
+    }
+    if (!(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) {
+        /* Free handshake_buffer BIO */
+        BIO_free(s->s3->handshake_buffer);
+        s->s3->handshake_buffer = NULL;
+    }
+
+    return 1;
+}
+
+int ssl3_cert_verify_mac(SSL *s, int md_nid, unsigned char *p)
+{
+    return (ssl3_handshake_mac(s, md_nid, NULL, 0, p));
+}
+
+int ssl3_final_finish_mac(SSL *s,
+                          const char *sender, int len, unsigned char *p)
+{
+    int ret, sha1len;
+    ret = ssl3_handshake_mac(s, NID_md5, sender, len, p);
+    if (ret == 0)
+        return 0;
+
+    p += ret;
+
+    sha1len = ssl3_handshake_mac(s, NID_sha1, sender, len, p);
+    if (sha1len == 0)
+        return 0;
+
+    ret += sha1len;
+    return (ret);
+}
+
+static int ssl3_handshake_mac(SSL *s, int md_nid,
+                              const char *sender, int len, unsigned char *p)
+{
+    unsigned int ret;
+    int npad, n;
+    unsigned int i;
+    unsigned char md_buf[EVP_MAX_MD_SIZE];
+    EVP_MD_CTX ctx, *d = NULL;
+
+    if (s->s3->handshake_buffer)
+        if (!ssl3_digest_cached_records(s))
+            return 0;
+
+    /*
+     * Search for digest of specified type in the handshake_dgst array
+     */
+    for (i = 0; i < SSL_MAX_DIGEST; i++) {
+        if (s->s3->handshake_dgst[i]
+            && EVP_MD_CTX_type(s->s3->handshake_dgst[i]) == md_nid) {
+            d = s->s3->handshake_dgst[i];
+            break;
+        }
+    }
+    if (!d) {
+        SSLerr(SSL_F_SSL3_HANDSHAKE_MAC, SSL_R_NO_REQUIRED_DIGEST);
+        return 0;
+    }
+    EVP_MD_CTX_init(&ctx);
+    EVP_MD_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+    EVP_MD_CTX_copy_ex(&ctx, d);
+    n = EVP_MD_CTX_size(&ctx);
+    if (n < 0)
+        return 0;
+
+    npad = (48 / n) * n;
+    if ((sender != NULL && EVP_DigestUpdate(&ctx, sender, len) <= 0)
+            || EVP_DigestUpdate(&ctx, s->session->master_key,
+                                s->session->master_key_length) <= 0
+            || EVP_DigestUpdate(&ctx, ssl3_pad_1, npad) <= 0
+            || EVP_DigestFinal_ex(&ctx, md_buf, &i) <= 0
+
+            || EVP_DigestInit_ex(&ctx, EVP_MD_CTX_md(&ctx), NULL) <= 0
+            || EVP_DigestUpdate(&ctx, s->session->master_key,
+                                s->session->master_key_length) <= 0
+            || EVP_DigestUpdate(&ctx, ssl3_pad_2, npad) <= 0
+            || EVP_DigestUpdate(&ctx, md_buf, i) <= 0
+            || EVP_DigestFinal_ex(&ctx, p, &ret) <= 0) {
+        SSLerr(SSL_F_SSL3_HANDSHAKE_MAC, ERR_R_INTERNAL_ERROR);
+        ret = 0;
+    }
+
+    EVP_MD_CTX_cleanup(&ctx);
+
+    return ((int)ret);
+}
+
+int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
+{
+    SSL3_RECORD *rec;
+    unsigned char *mac_sec, *seq;
+    EVP_MD_CTX md_ctx;
+    const EVP_MD_CTX *hash;
+    unsigned char *p, rec_char;
+    size_t md_size, orig_len;
+    int npad;
+    int t;
+
+    if (send) {
+        rec = &(ssl->s3->wrec);
+        mac_sec = &(ssl->s3->write_mac_secret[0]);
+        seq = &(ssl->s3->write_sequence[0]);
+        hash = ssl->write_hash;
+    } else {
+        rec = &(ssl->s3->rrec);
+        mac_sec = &(ssl->s3->read_mac_secret[0]);
+        seq = &(ssl->s3->read_sequence[0]);
+        hash = ssl->read_hash;
+    }
+
+    t = EVP_MD_CTX_size(hash);
+    if (t < 0)
+        return -1;
+    md_size = t;
+    npad = (48 / md_size) * md_size;
+
+    /*
+     * kludge: ssl3_cbc_remove_padding passes padding length in rec->type
+     */
+    orig_len = rec->length + md_size + ((unsigned int)rec->type >> 8);
+    rec->type &= 0xff;
+
+    if (!send &&
+        EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
+        ssl3_cbc_record_digest_supported(hash)) {
+        /*
+         * This is a CBC-encrypted record. We must avoid leaking any
+         * timing-side channel information about how many blocks of data we
+         * are hashing because that gives an attacker a timing-oracle.
+         */
+
+        /*-
+         * npad is, at most, 48 bytes and that's with MD5:
+         *   16 + 48 + 8 (sequence bytes) + 1 + 2 = 75.
+         *
+         * With SHA-1 (the largest hash speced for SSLv3) the hash size
+         * goes up 4, but npad goes down by 8, resulting in a smaller
+         * total size.
+         */
+        unsigned char header[75];
+        unsigned j = 0;
+        memcpy(header + j, mac_sec, md_size);
+        j += md_size;
+        memcpy(header + j, ssl3_pad_1, npad);
+        j += npad;
+        memcpy(header + j, seq, 8);
+        j += 8;
+        header[j++] = rec->type;
+        header[j++] = rec->length >> 8;
+        header[j++] = rec->length & 0xff;
+
+        /* Final param == is SSLv3 */
+        if (ssl3_cbc_digest_record(hash,
+                                   md, &md_size,
+                                   header, rec->input,
+                                   rec->length + md_size, orig_len,
+                                   mac_sec, md_size, 1) <= 0)
+            return -1;
+    } else {
+        unsigned int md_size_u;
+        /* Chop the digest off the end :-) */
+        EVP_MD_CTX_init(&md_ctx);
+
+        rec_char = rec->type;
+        p = md;
+        s2n(rec->length, p);
+        if (EVP_MD_CTX_copy_ex(&md_ctx, hash) <= 0
+                || EVP_DigestUpdate(&md_ctx, mac_sec, md_size) <= 0
+                || EVP_DigestUpdate(&md_ctx, ssl3_pad_1, npad) <= 0
+                || EVP_DigestUpdate(&md_ctx, seq, 8) <= 0
+                || EVP_DigestUpdate(&md_ctx, &rec_char, 1) <= 0
+                || EVP_DigestUpdate(&md_ctx, md, 2) <= 0
+                || EVP_DigestUpdate(&md_ctx, rec->input, rec->length) <= 0
+                || EVP_DigestFinal_ex(&md_ctx, md, NULL) <= 0
+                || EVP_MD_CTX_copy_ex(&md_ctx, hash) <= 0
+                || EVP_DigestUpdate(&md_ctx, mac_sec, md_size) <= 0
+                || EVP_DigestUpdate(&md_ctx, ssl3_pad_2, npad) <= 0
+                || EVP_DigestUpdate(&md_ctx, md, md_size) <= 0
+                || EVP_DigestFinal_ex(&md_ctx, md, &md_size_u) <= 0) {
+            EVP_MD_CTX_cleanup(&md_ctx);
+            return -1;
+        }
+        md_size = md_size_u;
+
+        EVP_MD_CTX_cleanup(&md_ctx);
+    }
+
+    ssl3_record_sequence_update(seq);
+    return (md_size);
+}
+
+void ssl3_record_sequence_update(unsigned char *seq)
+{
+    int i;
+
+    for (i = 7; i >= 0; i--) {
+        ++seq[i];
+        if (seq[i] != 0)
+            break;
+    }
+}
+
+int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
+                                int len)
+{
+    static const unsigned char *salt[3] = {
+#ifndef CHARSET_EBCDIC
+        (const unsigned char *)"A",
+        (const unsigned char *)"BB",
+        (const unsigned char *)"CCC",
+#else
+        (const unsigned char *)"\x41",
+        (const unsigned char *)"\x42\x42",
+        (const unsigned char *)"\x43\x43\x43",
+#endif
+    };
+    unsigned char buf[EVP_MAX_MD_SIZE];
+    EVP_MD_CTX ctx;
+    int i, ret = 0;
+    unsigned int n;
+#ifdef OPENSSL_SSL_TRACE_CRYPTO
+    unsigned char *tmpout = out;
+#endif
+
+    EVP_MD_CTX_init(&ctx);
+    for (i = 0; i < 3; i++) {
+        if (EVP_DigestInit_ex(&ctx, s->ctx->sha1, NULL) <= 0
+                || EVP_DigestUpdate(&ctx, salt[i],
+                                    strlen((const char *)salt[i])) <= 0
+                || EVP_DigestUpdate(&ctx, p, len) <= 0
+                || EVP_DigestUpdate(&ctx, &(s->s3->client_random[0]),
+                                    SSL3_RANDOM_SIZE) <= 0
+                || EVP_DigestUpdate(&ctx, &(s->s3->server_random[0]),
+                                    SSL3_RANDOM_SIZE) <= 0
+                || EVP_DigestFinal_ex(&ctx, buf, &n) <= 0
+
+                || EVP_DigestInit_ex(&ctx, s->ctx->md5, NULL) <= 0
+                || EVP_DigestUpdate(&ctx, p, len) <= 0
+                || EVP_DigestUpdate(&ctx, buf, n) <= 0
+                || EVP_DigestFinal_ex(&ctx, out, &n) <= 0) {
+            SSLerr(SSL_F_SSL3_GENERATE_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
+            ret = 0;
+            break;
+        }
+        out += n;
+        ret += n;
+    }
+    EVP_MD_CTX_cleanup(&ctx);
+
+#ifdef OPENSSL_SSL_TRACE_CRYPTO
+    if (ret > 0 && s->msg_callback) {
+        s->msg_callback(2, s->version, TLS1_RT_CRYPTO_PREMASTER,
+                        p, len, s, s->msg_callback_arg);
+        s->msg_callback(2, s->version, TLS1_RT_CRYPTO_CLIENT_RANDOM,
+                        s->s3->client_random, SSL3_RANDOM_SIZE,
+                        s, s->msg_callback_arg);
+        s->msg_callback(2, s->version, TLS1_RT_CRYPTO_SERVER_RANDOM,
+                        s->s3->server_random, SSL3_RANDOM_SIZE,
+                        s, s->msg_callback_arg);
+        s->msg_callback(2, s->version, TLS1_RT_CRYPTO_MASTER,
+                        tmpout, SSL3_MASTER_SECRET_SIZE,
+                        s, s->msg_callback_arg);
+    }
+#endif
+    OPENSSL_cleanse(buf, sizeof buf);
+    return (ret);
+}
+
+int ssl3_alert_code(int code)
+{
+    switch (code) {
+    case SSL_AD_CLOSE_NOTIFY:
+        return (SSL3_AD_CLOSE_NOTIFY);
+    case SSL_AD_UNEXPECTED_MESSAGE:
+        return (SSL3_AD_UNEXPECTED_MESSAGE);
+    case SSL_AD_BAD_RECORD_MAC:
+        return (SSL3_AD_BAD_RECORD_MAC);
+    case SSL_AD_DECRYPTION_FAILED:
+        return (SSL3_AD_BAD_RECORD_MAC);
+    case SSL_AD_RECORD_OVERFLOW:
+        return (SSL3_AD_BAD_RECORD_MAC);
+    case SSL_AD_DECOMPRESSION_FAILURE:
+        return (SSL3_AD_DECOMPRESSION_FAILURE);
+    case SSL_AD_HANDSHAKE_FAILURE:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_NO_CERTIFICATE:
+        return (SSL3_AD_NO_CERTIFICATE);
+    case SSL_AD_BAD_CERTIFICATE:
+        return (SSL3_AD_BAD_CERTIFICATE);
+    case SSL_AD_UNSUPPORTED_CERTIFICATE:
+        return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
+    case SSL_AD_CERTIFICATE_REVOKED:
+        return (SSL3_AD_CERTIFICATE_REVOKED);
+    case SSL_AD_CERTIFICATE_EXPIRED:
+        return (SSL3_AD_CERTIFICATE_EXPIRED);
+    case SSL_AD_CERTIFICATE_UNKNOWN:
+        return (SSL3_AD_CERTIFICATE_UNKNOWN);
+    case SSL_AD_ILLEGAL_PARAMETER:
+        return (SSL3_AD_ILLEGAL_PARAMETER);
+    case SSL_AD_UNKNOWN_CA:
+        return (SSL3_AD_BAD_CERTIFICATE);
+    case SSL_AD_ACCESS_DENIED:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_DECODE_ERROR:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_DECRYPT_ERROR:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_EXPORT_RESTRICTION:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_PROTOCOL_VERSION:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_INSUFFICIENT_SECURITY:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_INTERNAL_ERROR:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_USER_CANCELLED:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_NO_RENEGOTIATION:
+        return (-1);            /* Don't send it :-) */
+    case SSL_AD_UNSUPPORTED_EXTENSION:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_CERTIFICATE_UNOBTAINABLE:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_UNRECOGNIZED_NAME:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
+        return (SSL3_AD_HANDSHAKE_FAILURE);
+    case SSL_AD_UNKNOWN_PSK_IDENTITY:
+        return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
+    case SSL_AD_INAPPROPRIATE_FALLBACK:
+        return (TLS1_AD_INAPPROPRIATE_FALLBACK);
+    default:
+        return (-1);
+    }
+}

openssl-1.0.2f/ssl/s3_meth.c

@@ -0,0 +1,74 @@
+/* ssl/s3_meth.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+#ifndef OPENSSL_NO_SSL3_METHOD
+static const SSL_METHOD *ssl3_get_method(int ver)
+{
+    if (ver == SSL3_VERSION)
+        return (SSLv3_method());
+    else
+        return (NULL);
+}
+
+IMPLEMENT_ssl3_meth_func(SSLv3_method,
+                         ssl3_accept, ssl3_connect, ssl3_get_method)
+#endif

openssl-1.0.2f/ssl/srtp.h

@@ -0,0 +1,147 @@
+/* ssl/srtp.h */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/*
+ * DTLS code by Eric Rescorla <ekr@rtfm.com>
+ *
+ * Copyright (C) 2006, Network Resonance, Inc. Copyright (C) 2011, RTFM, Inc.
+ */
+
+#ifndef HEADER_D1_SRTP_H
+# define HEADER_D1_SRTP_H
+
+# include <openssl/ssl.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+# define SRTP_AES128_CM_SHA1_80 0x0001
+# define SRTP_AES128_CM_SHA1_32 0x0002
+# define SRTP_AES128_F8_SHA1_80 0x0003
+# define SRTP_AES128_F8_SHA1_32 0x0004
+# define SRTP_NULL_SHA1_80      0x0005
+# define SRTP_NULL_SHA1_32      0x0006
+
+# ifndef OPENSSL_NO_SRTP
+
+int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles);
+int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles);
+
+STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl);
+SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s);
+
+# endif
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif

openssl-1.0.2f/ssl/ssl2.h

@@ -0,0 +1,265 @@
+/* ssl/ssl2.h */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef HEADER_SSL2_H
+# define HEADER_SSL2_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/* Protocol Version Codes */
+# define SSL2_VERSION            0x0002
+# define SSL2_VERSION_MAJOR      0x00
+# define SSL2_VERSION_MINOR      0x02
+/* #define SSL2_CLIENT_VERSION  0x0002 */
+/* #define SSL2_SERVER_VERSION  0x0002 */
+
+/* Protocol Message Codes */
+# define SSL2_MT_ERROR                   0
+# define SSL2_MT_CLIENT_HELLO            1
+# define SSL2_MT_CLIENT_MASTER_KEY       2
+# define SSL2_MT_CLIENT_FINISHED         3
+# define SSL2_MT_SERVER_HELLO            4
+# define SSL2_MT_SERVER_VERIFY           5
+# define SSL2_MT_SERVER_FINISHED         6
+# define SSL2_MT_REQUEST_CERTIFICATE     7
+# define SSL2_MT_CLIENT_CERTIFICATE      8
+
+/* Error Message Codes */
+# define SSL2_PE_UNDEFINED_ERROR         0x0000
+# define SSL2_PE_NO_CIPHER               0x0001
+# define SSL2_PE_NO_CERTIFICATE          0x0002
+# define SSL2_PE_BAD_CERTIFICATE         0x0004
+# define SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE 0x0006
+
+/* Cipher Kind Values */
+# define SSL2_CK_NULL_WITH_MD5                   0x02000000/* v3 */
+# define SSL2_CK_RC4_128_WITH_MD5                0x02010080
+# define SSL2_CK_RC4_128_EXPORT40_WITH_MD5       0x02020080
+# define SSL2_CK_RC2_128_CBC_WITH_MD5            0x02030080
+# define SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5   0x02040080
+# define SSL2_CK_IDEA_128_CBC_WITH_MD5           0x02050080
+# define SSL2_CK_DES_64_CBC_WITH_MD5             0x02060040
+# define SSL2_CK_DES_64_CBC_WITH_SHA             0x02060140/* v3 */
+# define SSL2_CK_DES_192_EDE3_CBC_WITH_MD5       0x020700c0
+# define SSL2_CK_DES_192_EDE3_CBC_WITH_SHA       0x020701c0/* v3 */
+# define SSL2_CK_RC4_64_WITH_MD5                 0x02080080/* MS hack */
+
+# define SSL2_CK_DES_64_CFB64_WITH_MD5_1         0x02ff0800/* SSLeay */
+# define SSL2_CK_NULL                            0x02ff0810/* SSLeay */
+
+# define SSL2_TXT_DES_64_CFB64_WITH_MD5_1        "DES-CFB-M1"
+# define SSL2_TXT_NULL_WITH_MD5                  "NULL-MD5"
+# define SSL2_TXT_RC4_128_WITH_MD5               "RC4-MD5"
+# define SSL2_TXT_RC4_128_EXPORT40_WITH_MD5      "EXP-RC4-MD5"
+# define SSL2_TXT_RC2_128_CBC_WITH_MD5           "RC2-CBC-MD5"
+# define SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5  "EXP-RC2-CBC-MD5"
+# define SSL2_TXT_IDEA_128_CBC_WITH_MD5          "IDEA-CBC-MD5"
+# define SSL2_TXT_DES_64_CBC_WITH_MD5            "DES-CBC-MD5"
+# define SSL2_TXT_DES_64_CBC_WITH_SHA            "DES-CBC-SHA"
+# define SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5      "DES-CBC3-MD5"
+# define SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA      "DES-CBC3-SHA"
+# define SSL2_TXT_RC4_64_WITH_MD5                "RC4-64-MD5"
+
+# define SSL2_TXT_NULL                           "NULL"
+
+/* Flags for the SSL_CIPHER.algorithm2 field */
+# define SSL2_CF_5_BYTE_ENC                      0x01
+# define SSL2_CF_8_BYTE_ENC                      0x02
+
+/* Certificate Type Codes */
+# define SSL2_CT_X509_CERTIFICATE                0x01
+
+/* Authentication Type Code */
+# define SSL2_AT_MD5_WITH_RSA_ENCRYPTION         0x01
+
+# define SSL2_MAX_SSL_SESSION_ID_LENGTH          32
+
+/* Upper/Lower Bounds */
+# define SSL2_MAX_MASTER_KEY_LENGTH_IN_BITS      256
+# ifdef OPENSSL_SYS_MPE
+#  define SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER    29998u
+# else
+#  define SSL2_MAX_RECORD_LENGTH_2_BYTE_HEADER    32767u
+                                                       /* 2^15-1 */
+# endif
+# define SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER    16383/* 2^14-1 */
+
+# define SSL2_CHALLENGE_LENGTH   16
+/*
+ * #define SSL2_CHALLENGE_LENGTH 32
+ */
+# define SSL2_MIN_CHALLENGE_LENGTH       16
+# define SSL2_MAX_CHALLENGE_LENGTH       32
+# define SSL2_CONNECTION_ID_LENGTH       16
+# define SSL2_MAX_CONNECTION_ID_LENGTH   16
+# define SSL2_SSL_SESSION_ID_LENGTH      16
+# define SSL2_MAX_CERT_CHALLENGE_LENGTH  32
+# define SSL2_MIN_CERT_CHALLENGE_LENGTH  16
+# define SSL2_MAX_KEY_MATERIAL_LENGTH    24
+
+# ifndef HEADER_SSL_LOCL_H
+#  define  CERT           char
+# endif
+
+# ifndef OPENSSL_NO_SSL_INTERN
+
+typedef struct ssl2_state_st {
+    int three_byte_header;
+    int clear_text;             /* clear text */
+    int escape;                 /* not used in SSLv2 */
+    int ssl2_rollback;          /* used if SSLv23 rolled back to SSLv2 */
+    /*
+     * non-blocking io info, used to make sure the same args were passwd
+     */
+    unsigned int wnum;          /* number of bytes sent so far */
+    int wpend_tot;
+    const unsigned char *wpend_buf;
+    int wpend_off;              /* offset to data to write */
+    int wpend_len;              /* number of bytes passwd to write */
+    int wpend_ret;              /* number of bytes to return to caller */
+    /* buffer raw data */
+    int rbuf_left;
+    int rbuf_offs;
+    unsigned char *rbuf;
+    unsigned char *wbuf;
+    unsigned char *write_ptr;   /* used to point to the start due to 2/3 byte
+                                 * header. */
+    unsigned int padding;
+    unsigned int rlength;       /* passed to ssl2_enc */
+    int ract_data_length;       /* Set when things are encrypted. */
+    unsigned int wlength;       /* passed to ssl2_enc */
+    int wact_data_length;       /* Set when things are decrypted. */
+    unsigned char *ract_data;
+    unsigned char *wact_data;
+    unsigned char *mac_data;
+    unsigned char *read_key;
+    unsigned char *write_key;
+    /* Stuff specifically to do with this SSL session */
+    unsigned int challenge_length;
+    unsigned char challenge[SSL2_MAX_CHALLENGE_LENGTH];
+    unsigned int conn_id_length;
+    unsigned char conn_id[SSL2_MAX_CONNECTION_ID_LENGTH];
+    unsigned int key_material_length;
+    unsigned char key_material[SSL2_MAX_KEY_MATERIAL_LENGTH * 2];
+    unsigned long read_sequence;
+    unsigned long write_sequence;
+    struct {
+        unsigned int conn_id_length;
+        unsigned int cert_type;
+        unsigned int cert_length;
+        unsigned int csl;
+        unsigned int clear;
+        unsigned int enc;
+        unsigned char ccl[SSL2_MAX_CERT_CHALLENGE_LENGTH];
+        unsigned int cipher_spec_length;
+        unsigned int session_id_length;
+        unsigned int clen;
+        unsigned int rlen;
+    } tmp;
+} SSL2_STATE;
+
+# endif
+
+/* SSLv2 */
+/* client */
+# define SSL2_ST_SEND_CLIENT_HELLO_A             (0x10|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_HELLO_B             (0x11|SSL_ST_CONNECT)
+# define SSL2_ST_GET_SERVER_HELLO_A              (0x20|SSL_ST_CONNECT)
+# define SSL2_ST_GET_SERVER_HELLO_B              (0x21|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_MASTER_KEY_A        (0x30|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_MASTER_KEY_B        (0x31|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_FINISHED_A          (0x40|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_FINISHED_B          (0x41|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_CERTIFICATE_A       (0x50|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_CERTIFICATE_B       (0x51|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_CERTIFICATE_C       (0x52|SSL_ST_CONNECT)
+# define SSL2_ST_SEND_CLIENT_CERTIFICATE_D       (0x53|SSL_ST_CONNECT)
+# define SSL2_ST_GET_SERVER_VERIFY_A             (0x60|SSL_ST_CONNECT)
+# define SSL2_ST_GET_SERVER_VERIFY_B             (0x61|SSL_ST_CONNECT)
+# define SSL2_ST_GET_SERVER_FINISHED_A           (0x70|SSL_ST_CONNECT)
+# define SSL2_ST_GET_SERVER_FINISHED_B           (0x71|SSL_ST_CONNECT)
+# define SSL2_ST_CLIENT_START_ENCRYPTION         (0x80|SSL_ST_CONNECT)
+# define SSL2_ST_X509_GET_CLIENT_CERTIFICATE     (0x90|SSL_ST_CONNECT)
+/* server */
+# define SSL2_ST_GET_CLIENT_HELLO_A              (0x10|SSL_ST_ACCEPT)
+# define SSL2_ST_GET_CLIENT_HELLO_B              (0x11|SSL_ST_ACCEPT)
+# define SSL2_ST_GET_CLIENT_HELLO_C              (0x12|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_HELLO_A             (0x20|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_HELLO_B             (0x21|SSL_ST_ACCEPT)
+# define SSL2_ST_GET_CLIENT_MASTER_KEY_A         (0x30|SSL_ST_ACCEPT)
+# define SSL2_ST_GET_CLIENT_MASTER_KEY_B         (0x31|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_VERIFY_A            (0x40|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_VERIFY_B            (0x41|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_VERIFY_C            (0x42|SSL_ST_ACCEPT)
+# define SSL2_ST_GET_CLIENT_FINISHED_A           (0x50|SSL_ST_ACCEPT)
+# define SSL2_ST_GET_CLIENT_FINISHED_B           (0x51|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_FINISHED_A          (0x60|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_SERVER_FINISHED_B          (0x61|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_REQUEST_CERTIFICATE_A      (0x70|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_REQUEST_CERTIFICATE_B      (0x71|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_REQUEST_CERTIFICATE_C      (0x72|SSL_ST_ACCEPT)
+# define SSL2_ST_SEND_REQUEST_CERTIFICATE_D      (0x73|SSL_ST_ACCEPT)
+# define SSL2_ST_SERVER_START_ENCRYPTION         (0x80|SSL_ST_ACCEPT)
+# define SSL2_ST_X509_GET_SERVER_CERTIFICATE     (0x90|SSL_ST_ACCEPT)
+
+#ifdef  __cplusplus
+}
+#endif
+#endif

openssl-1.0.2f/ssl/ssl23.h

@@ -0,0 +1,84 @@
+/* ssl/ssl23.h */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef HEADER_SSL23_H
+# define HEADER_SSL23_H
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/*
+ * client
+ */
+/* write to server */
+# define SSL23_ST_CW_CLNT_HELLO_A        (0x210|SSL_ST_CONNECT)
+# define SSL23_ST_CW_CLNT_HELLO_B        (0x211|SSL_ST_CONNECT)
+/* read from server */
+# define SSL23_ST_CR_SRVR_HELLO_A        (0x220|SSL_ST_CONNECT)
+# define SSL23_ST_CR_SRVR_HELLO_B        (0x221|SSL_ST_CONNECT)
+
+/* server */
+/* read from client */
+# define SSL23_ST_SR_CLNT_HELLO_A        (0x210|SSL_ST_ACCEPT)
+# define SSL23_ST_SR_CLNT_HELLO_B        (0x211|SSL_ST_ACCEPT)
+
+#ifdef  __cplusplus
+}
+#endif
+#endif

openssl-1.0.2f/ssl/ssl3.h

@@ -0,0 +1,774 @@
+/* ssl/ssl3.h */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+#ifndef HEADER_SSL3_H
+# define HEADER_SSL3_H
+
+# ifndef OPENSSL_NO_COMP
+#  include <openssl/comp.h>
+# endif
+# include <openssl/buffer.h>
+# include <openssl/evp.h>
+# include <openssl/ssl.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Signalling cipher suite value from RFC 5746
+ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV)
+ */
+# define SSL3_CK_SCSV                            0x030000FF
+
+/*
+ * Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00
+ * (TLS_FALLBACK_SCSV)
+ */
+# define SSL3_CK_FALLBACK_SCSV                   0x03005600
+
+# define SSL3_CK_RSA_NULL_MD5                    0x03000001
+# define SSL3_CK_RSA_NULL_SHA                    0x03000002
+# define SSL3_CK_RSA_RC4_40_MD5                  0x03000003
+# define SSL3_CK_RSA_RC4_128_MD5                 0x03000004
+# define SSL3_CK_RSA_RC4_128_SHA                 0x03000005
+# define SSL3_CK_RSA_RC2_40_MD5                  0x03000006
+# define SSL3_CK_RSA_IDEA_128_SHA                0x03000007
+# define SSL3_CK_RSA_DES_40_CBC_SHA              0x03000008
+# define SSL3_CK_RSA_DES_64_CBC_SHA              0x03000009
+# define SSL3_CK_RSA_DES_192_CBC3_SHA            0x0300000A
+
+# define SSL3_CK_DH_DSS_DES_40_CBC_SHA           0x0300000B
+# define SSL3_CK_DH_DSS_DES_64_CBC_SHA           0x0300000C
+# define SSL3_CK_DH_DSS_DES_192_CBC3_SHA         0x0300000D
+# define SSL3_CK_DH_RSA_DES_40_CBC_SHA           0x0300000E
+# define SSL3_CK_DH_RSA_DES_64_CBC_SHA           0x0300000F
+# define SSL3_CK_DH_RSA_DES_192_CBC3_SHA         0x03000010
+
+# define SSL3_CK_EDH_DSS_DES_40_CBC_SHA          0x03000011
+# define SSL3_CK_DHE_DSS_DES_40_CBC_SHA          SSL3_CK_EDH_DSS_DES_40_CBC_SHA
+# define SSL3_CK_EDH_DSS_DES_64_CBC_SHA          0x03000012
+# define SSL3_CK_DHE_DSS_DES_64_CBC_SHA          SSL3_CK_EDH_DSS_DES_64_CBC_SHA
+# define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA        0x03000013
+# define SSL3_CK_DHE_DSS_DES_192_CBC3_SHA        SSL3_CK_EDH_DSS_DES_192_CBC3_SHA
+# define SSL3_CK_EDH_RSA_DES_40_CBC_SHA          0x03000014
+# define SSL3_CK_DHE_RSA_DES_40_CBC_SHA          SSL3_CK_EDH_RSA_DES_40_CBC_SHA
+# define SSL3_CK_EDH_RSA_DES_64_CBC_SHA          0x03000015
+# define SSL3_CK_DHE_RSA_DES_64_CBC_SHA          SSL3_CK_EDH_RSA_DES_64_CBC_SHA
+# define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA        0x03000016
+# define SSL3_CK_DHE_RSA_DES_192_CBC3_SHA        SSL3_CK_EDH_RSA_DES_192_CBC3_SHA
+
+# define SSL3_CK_ADH_RC4_40_MD5                  0x03000017
+# define SSL3_CK_ADH_RC4_128_MD5                 0x03000018
+# define SSL3_CK_ADH_DES_40_CBC_SHA              0x03000019
+# define SSL3_CK_ADH_DES_64_CBC_SHA              0x0300001A
+# define SSL3_CK_ADH_DES_192_CBC_SHA             0x0300001B
+
+# if 0
+#  define SSL3_CK_FZA_DMS_NULL_SHA                0x0300001C
+#  define SSL3_CK_FZA_DMS_FZA_SHA                 0x0300001D
+#  if 0                         /* Because it clashes with KRB5, is never
+                                 * used any more, and is safe to remove
+                                 * according to David Hopwood
+                                 * <david.hopwood@zetnet.co.uk> of the
+                                 * ietf-tls list */
+#   define SSL3_CK_FZA_DMS_RC4_SHA                 0x0300001E
+#  endif
+# endif
+
+/*
+ * VRS Additional Kerberos5 entries
+ */
+# define SSL3_CK_KRB5_DES_64_CBC_SHA             0x0300001E
+# define SSL3_CK_KRB5_DES_192_CBC3_SHA           0x0300001F
+# define SSL3_CK_KRB5_RC4_128_SHA                0x03000020
+# define SSL3_CK_KRB5_IDEA_128_CBC_SHA           0x03000021
+# define SSL3_CK_KRB5_DES_64_CBC_MD5             0x03000022
+# define SSL3_CK_KRB5_DES_192_CBC3_MD5           0x03000023
+# define SSL3_CK_KRB5_RC4_128_MD5                0x03000024
+# define SSL3_CK_KRB5_IDEA_128_CBC_MD5           0x03000025
+
+# define SSL3_CK_KRB5_DES_40_CBC_SHA             0x03000026
+# define SSL3_CK_KRB5_RC2_40_CBC_SHA             0x03000027
+# define SSL3_CK_KRB5_RC4_40_SHA                 0x03000028
+# define SSL3_CK_KRB5_DES_40_CBC_MD5             0x03000029
+# define SSL3_CK_KRB5_RC2_40_CBC_MD5             0x0300002A
+# define SSL3_CK_KRB5_RC4_40_MD5                 0x0300002B
+
+# define SSL3_TXT_RSA_NULL_MD5                   "NULL-MD5"
+# define SSL3_TXT_RSA_NULL_SHA                   "NULL-SHA"
+# define SSL3_TXT_RSA_RC4_40_MD5                 "EXP-RC4-MD5"
+# define SSL3_TXT_RSA_RC4_128_MD5                "RC4-MD5"
+# define SSL3_TXT_RSA_RC4_128_SHA                "RC4-SHA"
+# define SSL3_TXT_RSA_RC2_40_MD5                 "EXP-RC2-CBC-MD5"
+# define SSL3_TXT_RSA_IDEA_128_SHA               "IDEA-CBC-SHA"
+# define SSL3_TXT_RSA_DES_40_CBC_SHA             "EXP-DES-CBC-SHA"
+# define SSL3_TXT_RSA_DES_64_CBC_SHA             "DES-CBC-SHA"
+# define SSL3_TXT_RSA_DES_192_CBC3_SHA           "DES-CBC3-SHA"
+
+# define SSL3_TXT_DH_DSS_DES_40_CBC_SHA          "EXP-DH-DSS-DES-CBC-SHA"
+# define SSL3_TXT_DH_DSS_DES_64_CBC_SHA          "DH-DSS-DES-CBC-SHA"
+# define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA        "DH-DSS-DES-CBC3-SHA"
+# define SSL3_TXT_DH_RSA_DES_40_CBC_SHA          "EXP-DH-RSA-DES-CBC-SHA"
+# define SSL3_TXT_DH_RSA_DES_64_CBC_SHA          "DH-RSA-DES-CBC-SHA"
+# define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA        "DH-RSA-DES-CBC3-SHA"
+
+# define SSL3_TXT_DHE_DSS_DES_40_CBC_SHA         "EXP-DHE-DSS-DES-CBC-SHA"
+# define SSL3_TXT_DHE_DSS_DES_64_CBC_SHA         "DHE-DSS-DES-CBC-SHA"
+# define SSL3_TXT_DHE_DSS_DES_192_CBC3_SHA       "DHE-DSS-DES-CBC3-SHA"
+# define SSL3_TXT_DHE_RSA_DES_40_CBC_SHA         "EXP-DHE-RSA-DES-CBC-SHA"
+# define SSL3_TXT_DHE_RSA_DES_64_CBC_SHA         "DHE-RSA-DES-CBC-SHA"
+# define SSL3_TXT_DHE_RSA_DES_192_CBC3_SHA       "DHE-RSA-DES-CBC3-SHA"
+
+/*
+ * This next block of six "EDH" labels is for backward compatibility with
+ * older versions of OpenSSL.  New code should use the six "DHE" labels above
+ * instead:
+ */
+# define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA         "EXP-EDH-DSS-DES-CBC-SHA"
+# define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA         "EDH-DSS-DES-CBC-SHA"
+# define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA       "EDH-DSS-DES-CBC3-SHA"
+# define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA         "EXP-EDH-RSA-DES-CBC-SHA"
+# define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA         "EDH-RSA-DES-CBC-SHA"
+# define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA       "EDH-RSA-DES-CBC3-SHA"
+
+# define SSL3_TXT_ADH_RC4_40_MD5                 "EXP-ADH-RC4-MD5"
+# define SSL3_TXT_ADH_RC4_128_MD5                "ADH-RC4-MD5"
+# define SSL3_TXT_ADH_DES_40_CBC_SHA             "EXP-ADH-DES-CBC-SHA"
+# define SSL3_TXT_ADH_DES_64_CBC_SHA             "ADH-DES-CBC-SHA"
+# define SSL3_TXT_ADH_DES_192_CBC_SHA            "ADH-DES-CBC3-SHA"
+
+# if 0
+#  define SSL3_TXT_FZA_DMS_NULL_SHA               "FZA-NULL-SHA"
+#  define SSL3_TXT_FZA_DMS_FZA_SHA                "FZA-FZA-CBC-SHA"
+#  define SSL3_TXT_FZA_DMS_RC4_SHA                "FZA-RC4-SHA"
+# endif
+
+# define SSL3_TXT_KRB5_DES_64_CBC_SHA            "KRB5-DES-CBC-SHA"
+# define SSL3_TXT_KRB5_DES_192_CBC3_SHA          "KRB5-DES-CBC3-SHA"
+# define SSL3_TXT_KRB5_RC4_128_SHA               "KRB5-RC4-SHA"
+# define SSL3_TXT_KRB5_IDEA_128_CBC_SHA          "KRB5-IDEA-CBC-SHA"
+# define SSL3_TXT_KRB5_DES_64_CBC_MD5            "KRB5-DES-CBC-MD5"
+# define SSL3_TXT_KRB5_DES_192_CBC3_MD5          "KRB5-DES-CBC3-MD5"
+# define SSL3_TXT_KRB5_RC4_128_MD5               "KRB5-RC4-MD5"
+# define SSL3_TXT_KRB5_IDEA_128_CBC_MD5          "KRB5-IDEA-CBC-MD5"
+
+# define SSL3_TXT_KRB5_DES_40_CBC_SHA            "EXP-KRB5-DES-CBC-SHA"
+# define SSL3_TXT_KRB5_RC2_40_CBC_SHA            "EXP-KRB5-RC2-CBC-SHA"
+# define SSL3_TXT_KRB5_RC4_40_SHA                "EXP-KRB5-RC4-SHA"
+# define SSL3_TXT_KRB5_DES_40_CBC_MD5            "EXP-KRB5-DES-CBC-MD5"
+# define SSL3_TXT_KRB5_RC2_40_CBC_MD5            "EXP-KRB5-RC2-CBC-MD5"
+# define SSL3_TXT_KRB5_RC4_40_MD5                "EXP-KRB5-RC4-MD5"
+
+# define SSL3_SSL_SESSION_ID_LENGTH              32
+# define SSL3_MAX_SSL_SESSION_ID_LENGTH          32
+
+# define SSL3_MASTER_SECRET_SIZE                 48
+# define SSL3_RANDOM_SIZE                        32
+# define SSL3_SESSION_ID_SIZE                    32
+# define SSL3_RT_HEADER_LENGTH                   5
+
+# define SSL3_HM_HEADER_LENGTH                  4
+
+# ifndef SSL3_ALIGN_PAYLOAD
+ /*
+  * Some will argue that this increases memory footprint, but it's not
+  * actually true. Point is that malloc has to return at least 64-bit aligned
+  * pointers, meaning that allocating 5 bytes wastes 3 bytes in either case.
+  * Suggested pre-gaping simply moves these wasted bytes from the end of
+  * allocated region to its front, but makes data payload aligned, which
+  * improves performance:-)
+  */
+#  define SSL3_ALIGN_PAYLOAD                     8
+# else
+#  if (SSL3_ALIGN_PAYLOAD&(SSL3_ALIGN_PAYLOAD-1))!=0
+#   error "insane SSL3_ALIGN_PAYLOAD"
+#   undef SSL3_ALIGN_PAYLOAD
+#  endif
+# endif
+
+/*
+ * This is the maximum MAC (digest) size used by the SSL library. Currently
+ * maximum of 20 is used by SHA1, but we reserve for future extension for
+ * 512-bit hashes.
+ */
+
+# define SSL3_RT_MAX_MD_SIZE                     64
+
+/*
+ * Maximum block size used in all ciphersuites. Currently 16 for AES.
+ */
+
+# define SSL_RT_MAX_CIPHER_BLOCK_SIZE            16
+
+# define SSL3_RT_MAX_EXTRA                       (16384)
+
+/* Maximum plaintext length: defined by SSL/TLS standards */
+# define SSL3_RT_MAX_PLAIN_LENGTH                16384
+/* Maximum compression overhead: defined by SSL/TLS standards */
+# define SSL3_RT_MAX_COMPRESSED_OVERHEAD         1024
+
+/*
+ * The standards give a maximum encryption overhead of 1024 bytes. In
+ * practice the value is lower than this. The overhead is the maximum number
+ * of padding bytes (256) plus the mac size.
+ */
+# define SSL3_RT_MAX_ENCRYPTED_OVERHEAD  (256 + SSL3_RT_MAX_MD_SIZE)
+
+/*
+ * OpenSSL currently only uses a padding length of at most one block so the
+ * send overhead is smaller.
+ */
+
+# define SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD \
+                        (SSL_RT_MAX_CIPHER_BLOCK_SIZE + SSL3_RT_MAX_MD_SIZE)
+
+/* If compression isn't used don't include the compression overhead */
+
+# ifdef OPENSSL_NO_COMP
+#  define SSL3_RT_MAX_COMPRESSED_LENGTH           SSL3_RT_MAX_PLAIN_LENGTH
+# else
+#  define SSL3_RT_MAX_COMPRESSED_LENGTH   \
+                (SSL3_RT_MAX_PLAIN_LENGTH+SSL3_RT_MAX_COMPRESSED_OVERHEAD)
+# endif
+# define SSL3_RT_MAX_ENCRYPTED_LENGTH    \
+                (SSL3_RT_MAX_ENCRYPTED_OVERHEAD+SSL3_RT_MAX_COMPRESSED_LENGTH)
+# define SSL3_RT_MAX_PACKET_SIZE         \
+                (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
+
+# define SSL3_MD_CLIENT_FINISHED_CONST   "\x43\x4C\x4E\x54"
+# define SSL3_MD_SERVER_FINISHED_CONST   "\x53\x52\x56\x52"
+
+# define SSL3_VERSION                    0x0300
+# define SSL3_VERSION_MAJOR              0x03
+# define SSL3_VERSION_MINOR              0x00
+
+# define SSL3_RT_CHANGE_CIPHER_SPEC      20
+# define SSL3_RT_ALERT                   21
+# define SSL3_RT_HANDSHAKE               22
+# define SSL3_RT_APPLICATION_DATA        23
+# define TLS1_RT_HEARTBEAT               24
+
+/* Pseudo content types to indicate additional parameters */
+# define TLS1_RT_CRYPTO                  0x1000
+# define TLS1_RT_CRYPTO_PREMASTER        (TLS1_RT_CRYPTO | 0x1)
+# define TLS1_RT_CRYPTO_CLIENT_RANDOM    (TLS1_RT_CRYPTO | 0x2)
+# define TLS1_RT_CRYPTO_SERVER_RANDOM    (TLS1_RT_CRYPTO | 0x3)
+# define TLS1_RT_CRYPTO_MASTER           (TLS1_RT_CRYPTO | 0x4)
+
+# define TLS1_RT_CRYPTO_READ             0x0000
+# define TLS1_RT_CRYPTO_WRITE            0x0100
+# define TLS1_RT_CRYPTO_MAC              (TLS1_RT_CRYPTO | 0x5)
+# define TLS1_RT_CRYPTO_KEY              (TLS1_RT_CRYPTO | 0x6)
+# define TLS1_RT_CRYPTO_IV               (TLS1_RT_CRYPTO | 0x7)
+# define TLS1_RT_CRYPTO_FIXED_IV         (TLS1_RT_CRYPTO | 0x8)
+
+/* Pseudo content type for SSL/TLS header info */
+# define SSL3_RT_HEADER                  0x100
+
+# define SSL3_AL_WARNING                 1
+# define SSL3_AL_FATAL                   2
+
+# define SSL3_AD_CLOSE_NOTIFY             0
+# define SSL3_AD_UNEXPECTED_MESSAGE      10/* fatal */
+# define SSL3_AD_BAD_RECORD_MAC          20/* fatal */
+# define SSL3_AD_DECOMPRESSION_FAILURE   30/* fatal */
+# define SSL3_AD_HANDSHAKE_FAILURE       40/* fatal */
+# define SSL3_AD_NO_CERTIFICATE          41
+# define SSL3_AD_BAD_CERTIFICATE         42
+# define SSL3_AD_UNSUPPORTED_CERTIFICATE 43
+# define SSL3_AD_CERTIFICATE_REVOKED     44
+# define SSL3_AD_CERTIFICATE_EXPIRED     45
+# define SSL3_AD_CERTIFICATE_UNKNOWN     46
+# define SSL3_AD_ILLEGAL_PARAMETER       47/* fatal */
+
+# define TLS1_HB_REQUEST         1
+# define TLS1_HB_RESPONSE        2
+
+# ifndef OPENSSL_NO_SSL_INTERN
+
+typedef struct ssl3_record_st {
+    /* type of record */
+    /*
+     * r
+     */ int type;
+    /* How many bytes available */
+    /*
+     * rw
+     */ unsigned int length;
+    /* read/write offset into 'buf' */
+    /*
+     * r
+     */ unsigned int off;
+    /* pointer to the record data */
+    /*
+     * rw
+     */ unsigned char *data;
+    /* where the decode bytes are */
+    /*
+     * rw
+     */ unsigned char *input;
+    /* only used with decompression - malloc()ed */
+    /*
+     * r
+     */ unsigned char *comp;
+    /* epoch number, needed by DTLS1 */
+    /*
+     * r
+     */ unsigned long epoch;
+    /* sequence number, needed by DTLS1 */
+    /*
+     * r
+     */ unsigned char seq_num[8];
+} SSL3_RECORD;
+
+typedef struct ssl3_buffer_st {
+    /* at least SSL3_RT_MAX_PACKET_SIZE bytes, see ssl3_setup_buffers() */
+    unsigned char *buf;
+    /* buffer size */
+    size_t len;
+    /* where to 'copy from' */
+    int offset;
+    /* how many bytes left */
+    int left;
+} SSL3_BUFFER;
+
+# endif
+
+# define SSL3_CT_RSA_SIGN                        1
+# define SSL3_CT_DSS_SIGN                        2
+# define SSL3_CT_RSA_FIXED_DH                    3
+# define SSL3_CT_DSS_FIXED_DH                    4
+# define SSL3_CT_RSA_EPHEMERAL_DH                5
+# define SSL3_CT_DSS_EPHEMERAL_DH                6
+# define SSL3_CT_FORTEZZA_DMS                    20
+/*
+ * SSL3_CT_NUMBER is used to size arrays and it must be large enough to
+ * contain all of the cert types defined either for SSLv3 and TLSv1.
+ */
+# define SSL3_CT_NUMBER                  9
+
+# define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS       0x0001
+# define SSL3_FLAGS_DELAY_CLIENT_FINISHED        0x0002
+# define SSL3_FLAGS_POP_BUFFER                   0x0004
+# define TLS1_FLAGS_TLS_PADDING_BUG              0x0008
+# define TLS1_FLAGS_SKIP_CERT_VERIFY             0x0010
+# define TLS1_FLAGS_KEEP_HANDSHAKE               0x0020
+/*
+ * Set when the handshake is ready to process peer's ChangeCipherSpec message.
+ * Cleared after the message has been processed.
+ */
+# define SSL3_FLAGS_CCS_OK                       0x0080
+
+/* SSL3_FLAGS_SGC_RESTART_DONE is no longer used */
+# define SSL3_FLAGS_SGC_RESTART_DONE             0x0040
+
+# ifndef OPENSSL_NO_SSL_INTERN
+
+typedef struct ssl3_state_st {
+    long flags;
+    int delay_buf_pop_ret;
+    unsigned char read_sequence[8];
+    int read_mac_secret_size;
+    unsigned char read_mac_secret[EVP_MAX_MD_SIZE];
+    unsigned char write_sequence[8];
+    int write_mac_secret_size;
+    unsigned char write_mac_secret[EVP_MAX_MD_SIZE];
+    unsigned char server_random[SSL3_RANDOM_SIZE];
+    unsigned char client_random[SSL3_RANDOM_SIZE];
+    /* flags for countermeasure against known-IV weakness */
+    int need_empty_fragments;
+    int empty_fragment_done;
+    /* The value of 'extra' when the buffers were initialized */
+    int init_extra;
+    SSL3_BUFFER rbuf;           /* read IO goes into here */
+    SSL3_BUFFER wbuf;           /* write IO goes into here */
+    SSL3_RECORD rrec;           /* each decoded record goes in here */
+    SSL3_RECORD wrec;           /* goes out from here */
+    /*
+     * storage for Alert/Handshake protocol data received but not yet
+     * processed by ssl3_read_bytes:
+     */
+    unsigned char alert_fragment[2];
+    unsigned int alert_fragment_len;
+    unsigned char handshake_fragment[4];
+    unsigned int handshake_fragment_len;
+    /* partial write - check the numbers match */
+    unsigned int wnum;          /* number of bytes sent so far */
+    int wpend_tot;              /* number bytes written */
+    int wpend_type;
+    int wpend_ret;              /* number of bytes submitted */
+    const unsigned char *wpend_buf;
+    /* used during startup, digest all incoming/outgoing packets */
+    BIO *handshake_buffer;
+    /*
+     * When set of handshake digests is determined, buffer is hashed and
+     * freed and MD_CTX-es for all required digests are stored in this array
+     */
+    EVP_MD_CTX **handshake_dgst;
+    /*
+     * Set whenever an expected ChangeCipherSpec message is processed.
+     * Unset when the peer's Finished message is received.
+     * Unexpected ChangeCipherSpec messages trigger a fatal alert.
+     */
+    int change_cipher_spec;
+    int warn_alert;
+    int fatal_alert;
+    /*
+     * we allow one fatal and one warning alert to be outstanding, send close
+     * alert via the warning alert
+     */
+    int alert_dispatch;
+    unsigned char send_alert[2];
+    /*
+     * This flag is set when we should renegotiate ASAP, basically when there
+     * is no more data in the read or write buffers
+     */
+    int renegotiate;
+    int total_renegotiations;
+    int num_renegotiations;
+    int in_read_app_data;
+    /*
+     * Opaque PRF input as used for the current handshake. These fields are
+     * used only if TLSEXT_TYPE_opaque_prf_input is defined (otherwise, they
+     * are merely present to improve binary compatibility)
+     */
+    void *client_opaque_prf_input;
+    size_t client_opaque_prf_input_len;
+    void *server_opaque_prf_input;
+    size_t server_opaque_prf_input_len;
+    struct {
+        /* actually only needs to be 16+20 */
+        unsigned char cert_verify_md[EVP_MAX_MD_SIZE * 2];
+        /* actually only need to be 16+20 for SSLv3 and 12 for TLS */
+        unsigned char finish_md[EVP_MAX_MD_SIZE * 2];
+        int finish_md_len;
+        unsigned char peer_finish_md[EVP_MAX_MD_SIZE * 2];
+        int peer_finish_md_len;
+        unsigned long message_size;
+        int message_type;
+        /* used to hold the new cipher we are going to use */
+        const SSL_CIPHER *new_cipher;
+#  ifndef OPENSSL_NO_DH
+        DH *dh;
+#  endif
+#  ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh;           /* holds short lived ECDH key */
+#  endif
+        /* used when SSL_ST_FLUSH_DATA is entered */
+        int next_state;
+        int reuse_message;
+        /* used for certificate requests */
+        int cert_req;
+        int ctype_num;
+        char ctype[SSL3_CT_NUMBER];
+        STACK_OF(X509_NAME) *ca_names;
+        int use_rsa_tmp;
+        int key_block_length;
+        unsigned char *key_block;
+        const EVP_CIPHER *new_sym_enc;
+        const EVP_MD *new_hash;
+        int new_mac_pkey_type;
+        int new_mac_secret_size;
+#  ifndef OPENSSL_NO_COMP
+        const SSL_COMP *new_compression;
+#  else
+        char *new_compression;
+#  endif
+        int cert_request;
+    } tmp;
+
+    /* Connection binding to prevent renegotiation attacks */
+    unsigned char previous_client_finished[EVP_MAX_MD_SIZE];
+    unsigned char previous_client_finished_len;
+    unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
+    unsigned char previous_server_finished_len;
+    int send_connection_binding; /* TODOEKR */
+
+#  ifndef OPENSSL_NO_NEXTPROTONEG
+    /*
+     * Set if we saw the Next Protocol Negotiation extension from our peer.
+     */
+    int next_proto_neg_seen;
+#  endif
+
+#  ifndef OPENSSL_NO_TLSEXT
+#   ifndef OPENSSL_NO_EC
+    /*
+     * This is set to true if we believe that this is a version of Safari
+     * running on OS X 10.6 or newer. We wish to know this because Safari on
+     * 10.8 .. 10.8.3 has broken ECDHE-ECDSA support.
+     */
+    char is_probably_safari;
+#   endif                       /* !OPENSSL_NO_EC */
+
+    /*
+     * ALPN information (we are in the process of transitioning from NPN to
+     * ALPN.)
+     */
+
+    /*
+     * In a server these point to the selected ALPN protocol after the
+     * ClientHello has been processed. In a client these contain the protocol
+     * that the server selected once the ServerHello has been processed.
+     */
+    unsigned char *alpn_selected;
+    unsigned alpn_selected_len;
+#  endif                        /* OPENSSL_NO_TLSEXT */
+} SSL3_STATE;
+
+# endif
+
+/* SSLv3 */
+/*
+ * client
+ */
+/* extra state */
+# define SSL3_ST_CW_FLUSH                (0x100|SSL_ST_CONNECT)
+# ifndef OPENSSL_NO_SCTP
+#  define DTLS1_SCTP_ST_CW_WRITE_SOCK                     (0x310|SSL_ST_CONNECT)
+#  define DTLS1_SCTP_ST_CR_READ_SOCK                      (0x320|SSL_ST_CONNECT)
+# endif
+/* write to server */
+# define SSL3_ST_CW_CLNT_HELLO_A         (0x110|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CLNT_HELLO_B         (0x111|SSL_ST_CONNECT)
+/* read from server */
+# define SSL3_ST_CR_SRVR_HELLO_A         (0x120|SSL_ST_CONNECT)
+# define SSL3_ST_CR_SRVR_HELLO_B         (0x121|SSL_ST_CONNECT)
+# define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT)
+# define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CERT_A               (0x130|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CERT_B               (0x131|SSL_ST_CONNECT)
+# define SSL3_ST_CR_KEY_EXCH_A           (0x140|SSL_ST_CONNECT)
+# define SSL3_ST_CR_KEY_EXCH_B           (0x141|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CERT_REQ_A           (0x150|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CERT_REQ_B           (0x151|SSL_ST_CONNECT)
+# define SSL3_ST_CR_SRVR_DONE_A          (0x160|SSL_ST_CONNECT)
+# define SSL3_ST_CR_SRVR_DONE_B          (0x161|SSL_ST_CONNECT)
+/* write to server */
+# define SSL3_ST_CW_CERT_A               (0x170|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CERT_B               (0x171|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CERT_C               (0x172|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CERT_D               (0x173|SSL_ST_CONNECT)
+# define SSL3_ST_CW_KEY_EXCH_A           (0x180|SSL_ST_CONNECT)
+# define SSL3_ST_CW_KEY_EXCH_B           (0x181|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CERT_VRFY_A          (0x190|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CERT_VRFY_B          (0x191|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CHANGE_A             (0x1A0|SSL_ST_CONNECT)
+# define SSL3_ST_CW_CHANGE_B             (0x1A1|SSL_ST_CONNECT)
+# ifndef OPENSSL_NO_NEXTPROTONEG
+#  define SSL3_ST_CW_NEXT_PROTO_A         (0x200|SSL_ST_CONNECT)
+#  define SSL3_ST_CW_NEXT_PROTO_B         (0x201|SSL_ST_CONNECT)
+# endif
+# define SSL3_ST_CW_FINISHED_A           (0x1B0|SSL_ST_CONNECT)
+# define SSL3_ST_CW_FINISHED_B           (0x1B1|SSL_ST_CONNECT)
+/* read from server */
+# define SSL3_ST_CR_CHANGE_A             (0x1C0|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CHANGE_B             (0x1C1|SSL_ST_CONNECT)
+# define SSL3_ST_CR_FINISHED_A           (0x1D0|SSL_ST_CONNECT)
+# define SSL3_ST_CR_FINISHED_B           (0x1D1|SSL_ST_CONNECT)
+# define SSL3_ST_CR_SESSION_TICKET_A     (0x1E0|SSL_ST_CONNECT)
+# define SSL3_ST_CR_SESSION_TICKET_B     (0x1E1|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CERT_STATUS_A        (0x1F0|SSL_ST_CONNECT)
+# define SSL3_ST_CR_CERT_STATUS_B        (0x1F1|SSL_ST_CONNECT)
+
+/* server */
+/* extra state */
+# define SSL3_ST_SW_FLUSH                (0x100|SSL_ST_ACCEPT)
+# ifndef OPENSSL_NO_SCTP
+#  define DTLS1_SCTP_ST_SW_WRITE_SOCK                     (0x310|SSL_ST_ACCEPT)
+#  define DTLS1_SCTP_ST_SR_READ_SOCK                      (0x320|SSL_ST_ACCEPT)
+# endif
+/* read from client */
+/* Do not change the number values, they do matter */
+# define SSL3_ST_SR_CLNT_HELLO_A         (0x110|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CLNT_HELLO_B         (0x111|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CLNT_HELLO_C         (0x112|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CLNT_HELLO_D         (0x115|SSL_ST_ACCEPT)
+/* write to client */
+# define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT)
+# define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_HELLO_REQ_A          (0x120|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_HELLO_REQ_B          (0x121|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_HELLO_REQ_C          (0x122|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_SRVR_HELLO_A         (0x130|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_SRVR_HELLO_B         (0x131|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CERT_A               (0x140|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CERT_B               (0x141|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_KEY_EXCH_A           (0x150|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_KEY_EXCH_B           (0x151|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CERT_REQ_A           (0x160|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CERT_REQ_B           (0x161|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_SRVR_DONE_A          (0x170|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_SRVR_DONE_B          (0x171|SSL_ST_ACCEPT)
+/* read from client */
+# define SSL3_ST_SR_CERT_A               (0x180|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CERT_B               (0x181|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_KEY_EXCH_A           (0x190|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_KEY_EXCH_B           (0x191|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CERT_VRFY_A          (0x1A0|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CERT_VRFY_B          (0x1A1|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CHANGE_A             (0x1B0|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_CHANGE_B             (0x1B1|SSL_ST_ACCEPT)
+# ifndef OPENSSL_NO_NEXTPROTONEG
+#  define SSL3_ST_SR_NEXT_PROTO_A         (0x210|SSL_ST_ACCEPT)
+#  define SSL3_ST_SR_NEXT_PROTO_B         (0x211|SSL_ST_ACCEPT)
+# endif
+# define SSL3_ST_SR_FINISHED_A           (0x1C0|SSL_ST_ACCEPT)
+# define SSL3_ST_SR_FINISHED_B           (0x1C1|SSL_ST_ACCEPT)
+/* write to client */
+# define SSL3_ST_SW_CHANGE_A             (0x1D0|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CHANGE_B             (0x1D1|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_FINISHED_A           (0x1E0|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_FINISHED_B           (0x1E1|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_SESSION_TICKET_A     (0x1F0|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_SESSION_TICKET_B     (0x1F1|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CERT_STATUS_A        (0x200|SSL_ST_ACCEPT)
+# define SSL3_ST_SW_CERT_STATUS_B        (0x201|SSL_ST_ACCEPT)
+
+# define SSL3_MT_HELLO_REQUEST                   0
+# define SSL3_MT_CLIENT_HELLO                    1
+# define SSL3_MT_SERVER_HELLO                    2
+# define SSL3_MT_NEWSESSION_TICKET               4
+# define SSL3_MT_CERTIFICATE                     11
+# define SSL3_MT_SERVER_KEY_EXCHANGE             12
+# define SSL3_MT_CERTIFICATE_REQUEST             13
+# define SSL3_MT_SERVER_DONE                     14
+# define SSL3_MT_CERTIFICATE_VERIFY              15
+# define SSL3_MT_CLIENT_KEY_EXCHANGE             16
+# define SSL3_MT_FINISHED                        20
+# define SSL3_MT_CERTIFICATE_STATUS              22
+# ifndef OPENSSL_NO_NEXTPROTONEG
+#  define SSL3_MT_NEXT_PROTO                      67
+# endif
+# define DTLS1_MT_HELLO_VERIFY_REQUEST    3
+
+# define SSL3_MT_CCS                             1
+
+/* These are used when changing over to a new cipher */
+# define SSL3_CC_READ            0x01
+# define SSL3_CC_WRITE           0x02
+# define SSL3_CC_CLIENT          0x10
+# define SSL3_CC_SERVER          0x20
+# define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE)
+# define SSL3_CHANGE_CIPHER_SERVER_READ  (SSL3_CC_SERVER|SSL3_CC_READ)
+# define SSL3_CHANGE_CIPHER_CLIENT_READ  (SSL3_CC_CLIENT|SSL3_CC_READ)
+# define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE)
+
+#ifdef  __cplusplus
+}
+#endif
+#endif

openssl-1.0.2f/ssl/ssl_algs.c

@@ -0,0 +1,155 @@
+/* ssl/ssl_algs.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include <openssl/lhash.h>
+#include "ssl_locl.h"
+
+int SSL_library_init(void)
+{
+
+#ifndef OPENSSL_NO_DES
+    EVP_add_cipher(EVP_des_cbc());
+    EVP_add_cipher(EVP_des_ede3_cbc());
+#endif
+#ifndef OPENSSL_NO_IDEA
+    EVP_add_cipher(EVP_idea_cbc());
+#endif
+#ifndef OPENSSL_NO_RC4
+    EVP_add_cipher(EVP_rc4());
+# if !defined(OPENSSL_NO_MD5) && (defined(__x86_64) || defined(__x86_64__))
+    EVP_add_cipher(EVP_rc4_hmac_md5());
+# endif
+#endif
+#ifndef OPENSSL_NO_RC2
+    EVP_add_cipher(EVP_rc2_cbc());
+    /*
+     * Not actually used for SSL/TLS but this makes PKCS#12 work if an
+     * application only calls SSL_library_init().
+     */
+    EVP_add_cipher(EVP_rc2_40_cbc());
+#endif
+#ifndef OPENSSL_NO_AES
+    EVP_add_cipher(EVP_aes_128_cbc());
+    EVP_add_cipher(EVP_aes_192_cbc());
+    EVP_add_cipher(EVP_aes_256_cbc());
+    EVP_add_cipher(EVP_aes_128_gcm());
+    EVP_add_cipher(EVP_aes_256_gcm());
+# if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+    EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
+    EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
+# endif
+# if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA256)
+    EVP_add_cipher(EVP_aes_128_cbc_hmac_sha256());
+    EVP_add_cipher(EVP_aes_256_cbc_hmac_sha256());
+# endif
+
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+    EVP_add_cipher(EVP_camellia_128_cbc());
+    EVP_add_cipher(EVP_camellia_256_cbc());
+#endif
+
+#ifndef OPENSSL_NO_SEED
+    EVP_add_cipher(EVP_seed_cbc());
+#endif
+
+#ifndef OPENSSL_NO_MD5
+    EVP_add_digest(EVP_md5());
+    EVP_add_digest_alias(SN_md5, "ssl2-md5");
+    EVP_add_digest_alias(SN_md5, "ssl3-md5");
+#endif
+#ifndef OPENSSL_NO_SHA
+    EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
+    EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
+    EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
+#endif
+#ifndef OPENSSL_NO_SHA256
+    EVP_add_digest(EVP_sha224());
+    EVP_add_digest(EVP_sha256());
+#endif
+#ifndef OPENSSL_NO_SHA512
+    EVP_add_digest(EVP_sha384());
+    EVP_add_digest(EVP_sha512());
+#endif
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_DSA)
+    EVP_add_digest(EVP_dss1()); /* DSA with sha1 */
+    EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
+    EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
+    EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
+#endif
+#ifndef OPENSSL_NO_ECDSA
+    EVP_add_digest(EVP_ecdsa());
+#endif
+    /* If you want support for phased out ciphers, add the following */
+#if 0
+    EVP_add_digest(EVP_sha());
+    EVP_add_digest(EVP_dss());
+#endif
+#ifndef OPENSSL_NO_COMP
+    /*
+     * This will initialise the built-in compression algorithms. The value
+     * returned is a STACK_OF(SSL_COMP), but that can be discarded safely
+     */
+    (void)SSL_COMP_get_compression_methods();
+#endif
+    /* initialize cipher/digest methods table */
+    ssl_load_ciphers();
+    return (1);
+}

openssl-1.0.2f/ssl/ssl_asn1.c

@@ -0,0 +1,636 @@
+/* ssl/ssl_asn1.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright 2005 Nokia. All rights reserved.
+ *
+ * The portions of the attached software ("Contribution") is developed by
+ * Nokia Corporation and is licensed pursuant to the OpenSSL open source
+ * license.
+ *
+ * The Contribution, originally written by Mika Kousa and Pasi Eronen of
+ * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
+ * support (see RFC 4279) to OpenSSL.
+ *
+ * No patent licenses or other rights except those expressly stated in
+ * the OpenSSL open source license shall be deemed granted or received
+ * expressly, by implication, estoppel, or otherwise.
+ *
+ * No assurances are provided by Nokia that the Contribution does not
+ * infringe the patent or other intellectual property rights of any third
+ * party or that the license provides you with all the necessary rights
+ * to make use of the Contribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
+ * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
+ * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
+ * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
+ * OTHERWISE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include "ssl_locl.h"
+#include <openssl/asn1_mac.h>
+#include <openssl/objects.h>
+#include <openssl/x509.h>
+
+typedef struct ssl_session_asn1_st {
+    ASN1_INTEGER version;
+    ASN1_INTEGER ssl_version;
+    ASN1_OCTET_STRING cipher;
+    ASN1_OCTET_STRING comp_id;
+    ASN1_OCTET_STRING master_key;
+    ASN1_OCTET_STRING session_id;
+    ASN1_OCTET_STRING session_id_context;
+    ASN1_OCTET_STRING key_arg;
+#ifndef OPENSSL_NO_KRB5
+    ASN1_OCTET_STRING krb5_princ;
+#endif                          /* OPENSSL_NO_KRB5 */
+    ASN1_INTEGER time;
+    ASN1_INTEGER timeout;
+    ASN1_INTEGER verify_result;
+#ifndef OPENSSL_NO_TLSEXT
+    ASN1_OCTET_STRING tlsext_hostname;
+    ASN1_INTEGER tlsext_tick_lifetime;
+    ASN1_OCTET_STRING tlsext_tick;
+#endif                          /* OPENSSL_NO_TLSEXT */
+#ifndef OPENSSL_NO_PSK
+    ASN1_OCTET_STRING psk_identity_hint;
+    ASN1_OCTET_STRING psk_identity;
+#endif                          /* OPENSSL_NO_PSK */
+#ifndef OPENSSL_NO_SRP
+    ASN1_OCTET_STRING srp_username;
+#endif                          /* OPENSSL_NO_SRP */
+} SSL_SESSION_ASN1;
+
+int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
+{
+#define LSIZE2 (sizeof(long)*2)
+    int v1 = 0, v2 = 0, v3 = 0, v4 = 0, v5 = 0;
+    unsigned char buf[4], ibuf1[LSIZE2], ibuf2[LSIZE2];
+    unsigned char ibuf3[LSIZE2], ibuf4[LSIZE2], ibuf5[LSIZE2];
+#ifndef OPENSSL_NO_TLSEXT
+    int v6 = 0, v9 = 0, v10 = 0;
+    unsigned char ibuf6[LSIZE2];
+#endif
+#ifndef OPENSSL_NO_PSK
+    int v7 = 0, v8 = 0;
+#endif
+#ifndef OPENSSL_NO_COMP
+    unsigned char cbuf;
+    int v11 = 0;
+#endif
+#ifndef OPENSSL_NO_SRP
+    int v12 = 0;
+#endif
+    long l;
+    SSL_SESSION_ASN1 a;
+    M_ASN1_I2D_vars(in);
+
+    if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
+        return (0);
+
+    /*
+     * Note that I cheat in the following 2 assignments.  I know that if the
+     * ASN1_INTEGER passed to ASN1_INTEGER_set is > sizeof(long)+1, the
+     * buffer will not be re-OPENSSL_malloc()ed. This is a bit evil but makes
+     * things simple, no dynamic allocation to clean up :-)
+     */
+    a.version.length = LSIZE2;
+    a.version.type = V_ASN1_INTEGER;
+    a.version.data = ibuf1;
+    ASN1_INTEGER_set(&(a.version), SSL_SESSION_ASN1_VERSION);
+
+    a.ssl_version.length = LSIZE2;
+    a.ssl_version.type = V_ASN1_INTEGER;
+    a.ssl_version.data = ibuf2;
+    ASN1_INTEGER_set(&(a.ssl_version), in->ssl_version);
+
+    a.cipher.type = V_ASN1_OCTET_STRING;
+    a.cipher.data = buf;
+
+    if (in->cipher == NULL)
+        l = in->cipher_id;
+    else
+        l = in->cipher->id;
+    if (in->ssl_version == SSL2_VERSION) {
+        a.cipher.length = 3;
+        buf[0] = ((unsigned char)(l >> 16L)) & 0xff;
+        buf[1] = ((unsigned char)(l >> 8L)) & 0xff;
+        buf[2] = ((unsigned char)(l)) & 0xff;
+    } else {
+        a.cipher.length = 2;
+        buf[0] = ((unsigned char)(l >> 8L)) & 0xff;
+        buf[1] = ((unsigned char)(l)) & 0xff;
+    }
+
+#ifndef OPENSSL_NO_COMP
+    if (in->compress_meth) {
+        cbuf = (unsigned char)in->compress_meth;
+        a.comp_id.length = 1;
+        a.comp_id.type = V_ASN1_OCTET_STRING;
+        a.comp_id.data = &cbuf;
+    }
+#endif
+
+    a.master_key.length = in->master_key_length;
+    a.master_key.type = V_ASN1_OCTET_STRING;
+    a.master_key.data = in->master_key;
+
+    a.session_id.length = in->session_id_length;
+    a.session_id.type = V_ASN1_OCTET_STRING;
+    a.session_id.data = in->session_id;
+
+    a.session_id_context.length = in->sid_ctx_length;
+    a.session_id_context.type = V_ASN1_OCTET_STRING;
+    a.session_id_context.data = in->sid_ctx;
+
+    a.key_arg.length = in->key_arg_length;
+    a.key_arg.type = V_ASN1_OCTET_STRING;
+    a.key_arg.data = in->key_arg;
+
+#ifndef OPENSSL_NO_KRB5
+    if (in->krb5_client_princ_len) {
+        a.krb5_princ.length = in->krb5_client_princ_len;
+        a.krb5_princ.type = V_ASN1_OCTET_STRING;
+        a.krb5_princ.data = in->krb5_client_princ;
+    }
+#endif                          /* OPENSSL_NO_KRB5 */
+
+    if (in->time != 0L) {
+        a.time.length = LSIZE2;
+        a.time.type = V_ASN1_INTEGER;
+        a.time.data = ibuf3;
+        ASN1_INTEGER_set(&(a.time), in->time);
+    }
+
+    if (in->timeout != 0L) {
+        a.timeout.length = LSIZE2;
+        a.timeout.type = V_ASN1_INTEGER;
+        a.timeout.data = ibuf4;
+        ASN1_INTEGER_set(&(a.timeout), in->timeout);
+    }
+
+    if (in->verify_result != X509_V_OK) {
+        a.verify_result.length = LSIZE2;
+        a.verify_result.type = V_ASN1_INTEGER;
+        a.verify_result.data = ibuf5;
+        ASN1_INTEGER_set(&a.verify_result, in->verify_result);
+    }
+#ifndef OPENSSL_NO_TLSEXT
+    if (in->tlsext_hostname) {
+        a.tlsext_hostname.length = strlen(in->tlsext_hostname);
+        a.tlsext_hostname.type = V_ASN1_OCTET_STRING;
+        a.tlsext_hostname.data = (unsigned char *)in->tlsext_hostname;
+    }
+    if (in->tlsext_tick) {
+        a.tlsext_tick.length = in->tlsext_ticklen;
+        a.tlsext_tick.type = V_ASN1_OCTET_STRING;
+        a.tlsext_tick.data = (unsigned char *)in->tlsext_tick;
+    }
+    if (in->tlsext_tick_lifetime_hint > 0) {
+        a.tlsext_tick_lifetime.length = LSIZE2;
+        a.tlsext_tick_lifetime.type = V_ASN1_INTEGER;
+        a.tlsext_tick_lifetime.data = ibuf6;
+        ASN1_INTEGER_set(&a.tlsext_tick_lifetime,
+                         in->tlsext_tick_lifetime_hint);
+    }
+#endif                          /* OPENSSL_NO_TLSEXT */
+#ifndef OPENSSL_NO_PSK
+    if (in->psk_identity_hint) {
+        a.psk_identity_hint.length = strlen(in->psk_identity_hint);
+        a.psk_identity_hint.type = V_ASN1_OCTET_STRING;
+        a.psk_identity_hint.data = (unsigned char *)(in->psk_identity_hint);
+    }
+    if (in->psk_identity) {
+        a.psk_identity.length = strlen(in->psk_identity);
+        a.psk_identity.type = V_ASN1_OCTET_STRING;
+        a.psk_identity.data = (unsigned char *)(in->psk_identity);
+    }
+#endif                          /* OPENSSL_NO_PSK */
+#ifndef OPENSSL_NO_SRP
+    if (in->srp_username) {
+        a.srp_username.length = strlen(in->srp_username);
+        a.srp_username.type = V_ASN1_OCTET_STRING;
+        a.srp_username.data = (unsigned char *)(in->srp_username);
+    }
+#endif                          /* OPENSSL_NO_SRP */
+
+    M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER);
+    M_ASN1_I2D_len(&(a.ssl_version), i2d_ASN1_INTEGER);
+    M_ASN1_I2D_len(&(a.cipher), i2d_ASN1_OCTET_STRING);
+    M_ASN1_I2D_len(&(a.session_id), i2d_ASN1_OCTET_STRING);
+    M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING);
+#ifndef OPENSSL_NO_KRB5
+    if (in->krb5_client_princ_len)
+        M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
+#endif                          /* OPENSSL_NO_KRB5 */
+    if (in->key_arg_length > 0)
+        M_ASN1_I2D_len_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING);
+    if (in->time != 0L)
+        M_ASN1_I2D_len_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
+    if (in->timeout != 0L)
+        M_ASN1_I2D_len_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
+    if (in->peer != NULL)
+        M_ASN1_I2D_len_EXP_opt(in->peer, i2d_X509, 3, v3);
+    M_ASN1_I2D_len_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4,
+                           v4);
+    if (in->verify_result != X509_V_OK)
+        M_ASN1_I2D_len_EXP_opt(&(a.verify_result), i2d_ASN1_INTEGER, 5, v5);
+
+#ifndef OPENSSL_NO_TLSEXT
+    if (in->tlsext_tick_lifetime_hint > 0)
+        M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9,
+                               v9);
+    if (in->tlsext_tick)
+        M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10,
+                               v10);
+    if (in->tlsext_hostname)
+        M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6,
+                               v6);
+# ifndef OPENSSL_NO_COMP
+    if (in->compress_meth)
+        M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
+# endif
+#endif                          /* OPENSSL_NO_TLSEXT */
+#ifndef OPENSSL_NO_PSK
+    if (in->psk_identity_hint)
+        M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,
+                               7, v7);
+    if (in->psk_identity)
+        M_ASN1_I2D_len_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8,
+                               v8);
+#endif                          /* OPENSSL_NO_PSK */
+#ifndef OPENSSL_NO_SRP
+    if (in->srp_username)
+        M_ASN1_I2D_len_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12,
+                               v12);
+#endif                          /* OPENSSL_NO_SRP */
+
+    M_ASN1_I2D_seq_total();
+
+    M_ASN1_I2D_put(&(a.version), i2d_ASN1_INTEGER);
+    M_ASN1_I2D_put(&(a.ssl_version), i2d_ASN1_INTEGER);
+    M_ASN1_I2D_put(&(a.cipher), i2d_ASN1_OCTET_STRING);
+    M_ASN1_I2D_put(&(a.session_id), i2d_ASN1_OCTET_STRING);
+    M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING);
+#ifndef OPENSSL_NO_KRB5
+    if (in->krb5_client_princ_len)
+        M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
+#endif                          /* OPENSSL_NO_KRB5 */
+    if (in->key_arg_length > 0)
+        M_ASN1_I2D_put_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING, 0);
+    if (in->time != 0L)
+        M_ASN1_I2D_put_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
+    if (in->timeout != 0L)
+        M_ASN1_I2D_put_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
+    if (in->peer != NULL)
+        M_ASN1_I2D_put_EXP_opt(in->peer, i2d_X509, 3, v3);
+    M_ASN1_I2D_put_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4,
+                           v4);
+    if (in->verify_result != X509_V_OK)
+        M_ASN1_I2D_put_EXP_opt(&a.verify_result, i2d_ASN1_INTEGER, 5, v5);
+#ifndef OPENSSL_NO_TLSEXT
+    if (in->tlsext_hostname)
+        M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6,
+                               v6);
+#endif                          /* OPENSSL_NO_TLSEXT */
+#ifndef OPENSSL_NO_PSK
+    if (in->psk_identity_hint)
+        M_ASN1_I2D_put_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,
+                               7, v7);
+    if (in->psk_identity)
+        M_ASN1_I2D_put_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8,
+                               v8);
+#endif                          /* OPENSSL_NO_PSK */
+#ifndef OPENSSL_NO_TLSEXT
+    if (in->tlsext_tick_lifetime_hint > 0)
+        M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9,
+                               v9);
+    if (in->tlsext_tick)
+        M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10,
+                               v10);
+#endif                          /* OPENSSL_NO_TLSEXT */
+#ifndef OPENSSL_NO_COMP
+    if (in->compress_meth)
+        M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
+#endif
+#ifndef OPENSSL_NO_SRP
+    if (in->srp_username)
+        M_ASN1_I2D_put_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12,
+                               v12);
+#endif                          /* OPENSSL_NO_SRP */
+    M_ASN1_I2D_finish();
+}
+
+SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
+                             long length)
+{
+    int ssl_version = 0, i;
+    long id;
+    ASN1_INTEGER ai, *aip;
+    ASN1_OCTET_STRING os, *osp;
+    M_ASN1_D2I_vars(a, SSL_SESSION *, SSL_SESSION_new);
+
+    aip = &ai;
+    osp = &os;
+
+    M_ASN1_D2I_Init();
+    M_ASN1_D2I_start_sequence();
+
+    ai.data = NULL;
+    ai.length = 0;
+    M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
+    if (ai.data != NULL) {
+        OPENSSL_free(ai.data);
+        ai.data = NULL;
+        ai.length = 0;
+    }
+
+    /* we don't care about the version right now :-) */
+    M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
+    ssl_version = (int)ASN1_INTEGER_get(aip);
+    ret->ssl_version = ssl_version;
+    if (ai.data != NULL) {
+        OPENSSL_free(ai.data);
+        ai.data = NULL;
+        ai.length = 0;
+    }
+
+    os.data = NULL;
+    os.length = 0;
+    M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
+    if (ssl_version == SSL2_VERSION) {
+        if (os.length != 3) {
+            c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
+            c.line = __LINE__;
+            goto err;
+        }
+        id = 0x02000000L |
+            ((unsigned long)os.data[0] << 16L) |
+            ((unsigned long)os.data[1] << 8L) | (unsigned long)os.data[2];
+    } else if ((ssl_version >> 8) == SSL3_VERSION_MAJOR
+        || (ssl_version >> 8) == DTLS1_VERSION_MAJOR
+        || ssl_version == DTLS1_BAD_VER) {
+        if (os.length != 2) {
+            c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
+            c.line = __LINE__;
+            goto err;
+        }
+        id = 0x03000000L |
+            ((unsigned long)os.data[0] << 8L) | (unsigned long)os.data[1];
+    } else {
+        c.error = SSL_R_UNKNOWN_SSL_VERSION;
+        c.line = __LINE__;
+        goto err;
+    }
+
+    ret->cipher = NULL;
+    ret->cipher_id = id;
+
+    M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
+    if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR)
+        i = SSL3_MAX_SSL_SESSION_ID_LENGTH;
+    else                        /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */
+        i = SSL2_MAX_SSL_SESSION_ID_LENGTH;
+
+    if (os.length > i)
+        os.length = i;
+    if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
+        os.length = sizeof(ret->session_id);
+
+    ret->session_id_length = os.length;
+    OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
+    memcpy(ret->session_id, os.data, os.length);
+
+    M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
+    if (os.length > SSL_MAX_MASTER_KEY_LENGTH)
+        ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH;
+    else
+        ret->master_key_length = os.length;
+    memcpy(ret->master_key, os.data, ret->master_key_length);
+
+    os.length = 0;
+
+#ifndef OPENSSL_NO_KRB5
+    os.length = 0;
+    M_ASN1_D2I_get_opt(osp, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
+    if (os.data) {
+        if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH)
+            ret->krb5_client_princ_len = 0;
+        else
+            ret->krb5_client_princ_len = os.length;
+        memcpy(ret->krb5_client_princ, os.data, ret->krb5_client_princ_len);
+        OPENSSL_free(os.data);
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->krb5_client_princ_len = 0;
+#endif                          /* OPENSSL_NO_KRB5 */
+
+    M_ASN1_D2I_get_IMP_opt(osp, d2i_ASN1_OCTET_STRING, 0,
+                           V_ASN1_OCTET_STRING);
+    if (os.length > SSL_MAX_KEY_ARG_LENGTH)
+        ret->key_arg_length = SSL_MAX_KEY_ARG_LENGTH;
+    else
+        ret->key_arg_length = os.length;
+    memcpy(ret->key_arg, os.data, ret->key_arg_length);
+    if (os.data != NULL)
+        OPENSSL_free(os.data);
+
+    ai.length = 0;
+    M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 1);
+    if (ai.data != NULL) {
+        ret->time = ASN1_INTEGER_get(aip);
+        OPENSSL_free(ai.data);
+        ai.data = NULL;
+        ai.length = 0;
+    } else
+        ret->time = (unsigned long)time(NULL);
+
+    ai.length = 0;
+    M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 2);
+    if (ai.data != NULL) {
+        ret->timeout = ASN1_INTEGER_get(aip);
+        OPENSSL_free(ai.data);
+        ai.data = NULL;
+        ai.length = 0;
+    } else
+        ret->timeout = 3;
+
+    if (ret->peer != NULL) {
+        X509_free(ret->peer);
+        ret->peer = NULL;
+    }
+    M_ASN1_D2I_get_EXP_opt(ret->peer, d2i_X509, 3);
+
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 4);
+
+    if (os.data != NULL) {
+        if (os.length > SSL_MAX_SID_CTX_LENGTH) {
+            c.error = SSL_R_BAD_LENGTH;
+            c.line = __LINE__;
+            goto err;
+        } else {
+            ret->sid_ctx_length = os.length;
+            memcpy(ret->sid_ctx, os.data, os.length);
+        }
+        OPENSSL_free(os.data);
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->sid_ctx_length = 0;
+
+    ai.length = 0;
+    M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 5);
+    if (ai.data != NULL) {
+        ret->verify_result = ASN1_INTEGER_get(aip);
+        OPENSSL_free(ai.data);
+        ai.data = NULL;
+        ai.length = 0;
+    } else
+        ret->verify_result = X509_V_OK;
+
+#ifndef OPENSSL_NO_TLSEXT
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 6);
+    if (os.data) {
+        ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
+        OPENSSL_free(os.data);
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->tlsext_hostname = NULL;
+#endif                          /* OPENSSL_NO_TLSEXT */
+
+#ifndef OPENSSL_NO_PSK
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 7);
+    if (os.data) {
+        ret->psk_identity_hint = BUF_strndup((char *)os.data, os.length);
+        OPENSSL_free(os.data);
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->psk_identity_hint = NULL;
+
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 8);
+    if (os.data) {
+        ret->psk_identity = BUF_strndup((char *)os.data, os.length);
+        OPENSSL_free(os.data);
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->psk_identity = NULL;
+#endif                          /* OPENSSL_NO_PSK */
+
+#ifndef OPENSSL_NO_TLSEXT
+    ai.length = 0;
+    M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 9);
+    if (ai.data != NULL) {
+        ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip);
+        OPENSSL_free(ai.data);
+        ai.data = NULL;
+        ai.length = 0;
+    } else if (ret->tlsext_ticklen && ret->session_id_length)
+        ret->tlsext_tick_lifetime_hint = -1;
+    else
+        ret->tlsext_tick_lifetime_hint = 0;
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 10);
+    if (os.data) {
+        ret->tlsext_tick = os.data;
+        ret->tlsext_ticklen = os.length;
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->tlsext_tick = NULL;
+#endif                          /* OPENSSL_NO_TLSEXT */
+#ifndef OPENSSL_NO_COMP
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 11);
+    if (os.data) {
+        ret->compress_meth = os.data[0];
+        OPENSSL_free(os.data);
+        os.data = NULL;
+    }
+#endif
+
+#ifndef OPENSSL_NO_SRP
+    os.length = 0;
+    os.data = NULL;
+    M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 12);
+    if (os.data) {
+        ret->srp_username = BUF_strndup((char *)os.data, os.length);
+        OPENSSL_free(os.data);
+        os.data = NULL;
+        os.length = 0;
+    } else
+        ret->srp_username = NULL;
+#endif                          /* OPENSSL_NO_SRP */
+
+    M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION);
+}

openssl-1.0.2f/ssl/ssl_conf.c

@@ -0,0 +1,683 @@
+/*
+ * ! \file ssl/ssl_conf.c \brief SSL configuration functions
+ */
+/* ====================================================================
+ * Copyright (c) 2012 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifdef REF_CHECK
+# include <assert.h>
+#endif
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/conf.h>
+#include <openssl/objects.h>
+#ifndef OPENSSL_NO_DH
+# include <openssl/dh.h>
+#endif
+
+/*
+ * structure holding name tables. This is used for pemitted elements in lists
+ * such as TLSv1 and single command line switches such as no_tls1
+ */
+
+typedef struct {
+    const char *name;
+    int namelen;
+    unsigned int name_flags;
+    unsigned long option_value;
+} ssl_flag_tbl;
+
+/* Sense of name is inverted e.g. "TLSv1" will clear SSL_OP_NO_TLSv1 */
+#define SSL_TFLAG_INV   0x1
+/* Flags refers to cert_flags not options */
+#define SSL_TFLAG_CERT  0x2
+/* Option can only be used for clients */
+#define SSL_TFLAG_CLIENT SSL_CONF_FLAG_CLIENT
+/* Option can only be used for servers */
+#define SSL_TFLAG_SERVER SSL_CONF_FLAG_SERVER
+#define SSL_TFLAG_BOTH (SSL_TFLAG_CLIENT|SSL_TFLAG_SERVER)
+
+#define SSL_FLAG_TBL(str, flag) \
+        {str, (int)(sizeof(str) - 1), SSL_TFLAG_BOTH, flag}
+#define SSL_FLAG_TBL_SRV(str, flag) \
+        {str, (int)(sizeof(str) - 1), SSL_TFLAG_SERVER, flag}
+#define SSL_FLAG_TBL_CLI(str, flag) \
+        {str, (int)(sizeof(str) - 1), SSL_TFLAG_CLIENT, flag}
+#define SSL_FLAG_TBL_INV(str, flag) \
+        {str, (int)(sizeof(str) - 1), SSL_TFLAG_INV|SSL_TFLAG_BOTH, flag}
+#define SSL_FLAG_TBL_SRV_INV(str, flag) \
+        {str, (int)(sizeof(str) - 1), SSL_TFLAG_INV|SSL_TFLAG_SERVER, flag}
+#define SSL_FLAG_TBL_CERT(str, flag) \
+        {str, (int)(sizeof(str) - 1), SSL_TFLAG_CERT|SSL_TFLAG_BOTH, flag}
+
+/*
+ * Opaque structure containing SSL configuration context.
+ */
+
+struct ssl_conf_ctx_st {
+    /*
+     * Various flags indicating (among other things) which options we will
+     * recognise.
+     */
+    unsigned int flags;
+    /* Prefix and length of commands */
+    char *prefix;
+    size_t prefixlen;
+    /* SSL_CTX or SSL structure to perform operations on */
+    SSL_CTX *ctx;
+    SSL *ssl;
+    /* Pointer to SSL or SSL_CTX options field or NULL if none */
+    unsigned long *poptions;
+    /* Pointer to SSL or SSL_CTX cert_flags or NULL if none */
+    unsigned int *pcert_flags;
+    /* Current flag table being worked on */
+    const ssl_flag_tbl *tbl;
+    /* Size of table */
+    size_t ntbl;
+};
+
+static int ssl_match_option(SSL_CONF_CTX *cctx, const ssl_flag_tbl *tbl,
+                            const char *name, int namelen, int onoff)
+{
+    /* If name not relevant for context skip */
+    if (!(cctx->flags & tbl->name_flags & SSL_TFLAG_BOTH))
+        return 0;
+    if (namelen == -1) {
+        if (strcmp(tbl->name, name))
+            return 0;
+    } else if (tbl->namelen != namelen
+               || strncasecmp(tbl->name, name, namelen))
+        return 0;
+    if (cctx->poptions) {
+        if (tbl->name_flags & SSL_TFLAG_INV)
+            onoff ^= 1;
+        if (tbl->name_flags & SSL_TFLAG_CERT) {
+            if (onoff)
+                *cctx->pcert_flags |= tbl->option_value;
+            else
+                *cctx->pcert_flags &= ~tbl->option_value;
+        } else {
+            if (onoff)
+                *cctx->poptions |= tbl->option_value;
+            else
+                *cctx->poptions &= ~tbl->option_value;
+        }
+    }
+    return 1;
+}
+
+static int ssl_set_option_list(const char *elem, int len, void *usr)
+{
+    SSL_CONF_CTX *cctx = usr;
+    size_t i;
+    const ssl_flag_tbl *tbl;
+    int onoff = 1;
+    /*
+     * len == -1 indicates not being called in list context, just for single
+     * command line switches, so don't allow +, -.
+     */
+    if (elem == NULL)
+        return 0;
+    if (len != -1) {
+        if (*elem == '+') {
+            elem++;
+            len--;
+            onoff = 1;
+        } else if (*elem == '-') {
+            elem++;
+            len--;
+            onoff = 0;
+        }
+    }
+    for (i = 0, tbl = cctx->tbl; i < cctx->ntbl; i++, tbl++) {
+        if (ssl_match_option(cctx, tbl, elem, len, onoff))
+            return 1;
+    }
+    return 0;
+}
+
+/* Single command line switches with no argument e.g. -no_ssl3 */
+static int ctrl_str_option(SSL_CONF_CTX *cctx, const char *cmd)
+{
+    static const ssl_flag_tbl ssl_option_single[] = {
+        SSL_FLAG_TBL("no_ssl2", SSL_OP_NO_SSLv2),
+        SSL_FLAG_TBL("no_ssl3", SSL_OP_NO_SSLv3),
+        SSL_FLAG_TBL("no_tls1", SSL_OP_NO_TLSv1),
+        SSL_FLAG_TBL("no_tls1_1", SSL_OP_NO_TLSv1_1),
+        SSL_FLAG_TBL("no_tls1_2", SSL_OP_NO_TLSv1_2),
+        SSL_FLAG_TBL("bugs", SSL_OP_ALL),
+        SSL_FLAG_TBL("no_comp", SSL_OP_NO_COMPRESSION),
+        SSL_FLAG_TBL_SRV("ecdh_single", SSL_OP_SINGLE_ECDH_USE),
+#ifndef OPENSSL_NO_TLSEXT
+        SSL_FLAG_TBL("no_ticket", SSL_OP_NO_TICKET),
+#endif
+        SSL_FLAG_TBL_SRV("serverpref", SSL_OP_CIPHER_SERVER_PREFERENCE),
+        SSL_FLAG_TBL("legacy_renegotiation",
+                     SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION),
+        SSL_FLAG_TBL_SRV("legacy_server_connect",
+                         SSL_OP_LEGACY_SERVER_CONNECT),
+        SSL_FLAG_TBL_SRV("no_resumption_on_reneg",
+                         SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION),
+        SSL_FLAG_TBL_SRV_INV("no_legacy_server_connect",
+                             SSL_OP_LEGACY_SERVER_CONNECT),
+        SSL_FLAG_TBL_CERT("strict", SSL_CERT_FLAG_TLS_STRICT),
+#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
+        SSL_FLAG_TBL_CERT("debug_broken_protocol",
+                          SSL_CERT_FLAG_BROKEN_PROTOCOL),
+#endif
+    };
+    cctx->tbl = ssl_option_single;
+    cctx->ntbl = sizeof(ssl_option_single) / sizeof(ssl_flag_tbl);
+    return ssl_set_option_list(cmd, -1, cctx);
+}
+
+/* Set supported signature algorithms */
+static int cmd_SignatureAlgorithms(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv;
+    if (cctx->ssl)
+        rv = SSL_set1_sigalgs_list(cctx->ssl, value);
+    /* NB: ctx == NULL performs syntax checking only */
+    else
+        rv = SSL_CTX_set1_sigalgs_list(cctx->ctx, value);
+    return rv > 0;
+}
+
+/* Set supported client signature algorithms */
+static int cmd_ClientSignatureAlgorithms(SSL_CONF_CTX *cctx,
+                                         const char *value)
+{
+    int rv;
+    if (cctx->ssl)
+        rv = SSL_set1_client_sigalgs_list(cctx->ssl, value);
+    /* NB: ctx == NULL performs syntax checking only */
+    else
+        rv = SSL_CTX_set1_client_sigalgs_list(cctx->ctx, value);
+    return rv > 0;
+}
+
+static int cmd_Curves(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv;
+    if (cctx->ssl)
+        rv = SSL_set1_curves_list(cctx->ssl, value);
+    /* NB: ctx == NULL performs syntax checking only */
+    else
+        rv = SSL_CTX_set1_curves_list(cctx->ctx, value);
+    return rv > 0;
+}
+
+#ifndef OPENSSL_NO_ECDH
+/* ECDH temporary parameters */
+static int cmd_ECDHParameters(SSL_CONF_CTX *cctx, const char *value)
+{
+    int onoff = -1, rv = 1;
+    if (!(cctx->flags & SSL_CONF_FLAG_SERVER))
+        return -2;
+    if (cctx->flags & SSL_CONF_FLAG_FILE) {
+        if (*value == '+') {
+            onoff = 1;
+            value++;
+        }
+        if (*value == '-') {
+            onoff = 0;
+            value++;
+        }
+        if (!strcasecmp(value, "automatic")) {
+            if (onoff == -1)
+                onoff = 1;
+        } else if (onoff != -1)
+            return 0;
+    } else if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
+        if (!strcmp(value, "auto"))
+            onoff = 1;
+    }
+
+    if (onoff != -1) {
+        if (cctx->ctx)
+            rv = SSL_CTX_set_ecdh_auto(cctx->ctx, onoff);
+        else if (cctx->ssl)
+            rv = SSL_set_ecdh_auto(cctx->ssl, onoff);
+    } else {
+        EC_KEY *ecdh;
+        int nid;
+        nid = EC_curve_nist2nid(value);
+        if (nid == NID_undef)
+            nid = OBJ_sn2nid(value);
+        if (nid == 0)
+            return 0;
+        ecdh = EC_KEY_new_by_curve_name(nid);
+        if (!ecdh)
+            return 0;
+        if (cctx->ctx)
+            rv = SSL_CTX_set_tmp_ecdh(cctx->ctx, ecdh);
+        else if (cctx->ssl)
+            rv = SSL_set_tmp_ecdh(cctx->ssl, ecdh);
+        EC_KEY_free(ecdh);
+    }
+
+    return rv > 0;
+}
+#endif
+static int cmd_CipherString(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv = 1;
+    if (cctx->ctx)
+        rv = SSL_CTX_set_cipher_list(cctx->ctx, value);
+    if (cctx->ssl)
+        rv = SSL_set_cipher_list(cctx->ssl, value);
+    return rv > 0;
+}
+
+static int cmd_Protocol(SSL_CONF_CTX *cctx, const char *value)
+{
+    static const ssl_flag_tbl ssl_protocol_list[] = {
+        SSL_FLAG_TBL_INV("ALL", SSL_OP_NO_SSL_MASK),
+        SSL_FLAG_TBL_INV("SSLv2", SSL_OP_NO_SSLv2),
+        SSL_FLAG_TBL_INV("SSLv3", SSL_OP_NO_SSLv3),
+        SSL_FLAG_TBL_INV("TLSv1", SSL_OP_NO_TLSv1),
+        SSL_FLAG_TBL_INV("TLSv1.1", SSL_OP_NO_TLSv1_1),
+        SSL_FLAG_TBL_INV("TLSv1.2", SSL_OP_NO_TLSv1_2)
+    };
+    if (!(cctx->flags & SSL_CONF_FLAG_FILE))
+        return -2;
+    cctx->tbl = ssl_protocol_list;
+    cctx->ntbl = sizeof(ssl_protocol_list) / sizeof(ssl_flag_tbl);
+    return CONF_parse_list(value, ',', 1, ssl_set_option_list, cctx);
+}
+
+static int cmd_Options(SSL_CONF_CTX *cctx, const char *value)
+{
+    static const ssl_flag_tbl ssl_option_list[] = {
+        SSL_FLAG_TBL_INV("SessionTicket", SSL_OP_NO_TICKET),
+        SSL_FLAG_TBL_INV("EmptyFragments",
+                         SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS),
+        SSL_FLAG_TBL("Bugs", SSL_OP_ALL),
+        SSL_FLAG_TBL_INV("Compression", SSL_OP_NO_COMPRESSION),
+        SSL_FLAG_TBL_SRV("ServerPreference", SSL_OP_CIPHER_SERVER_PREFERENCE),
+        SSL_FLAG_TBL_SRV("NoResumptionOnRenegotiation",
+                         SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION),
+        SSL_FLAG_TBL_SRV("DHSingle", SSL_OP_SINGLE_DH_USE),
+        SSL_FLAG_TBL_SRV("ECDHSingle", SSL_OP_SINGLE_ECDH_USE),
+        SSL_FLAG_TBL("UnsafeLegacyRenegotiation",
+                     SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION),
+    };
+    if (!(cctx->flags & SSL_CONF_FLAG_FILE))
+        return -2;
+    if (value == NULL)
+        return -3;
+    cctx->tbl = ssl_option_list;
+    cctx->ntbl = sizeof(ssl_option_list) / sizeof(ssl_flag_tbl);
+    return CONF_parse_list(value, ',', 1, ssl_set_option_list, cctx);
+}
+
+static int cmd_Certificate(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv = 1;
+    if (!(cctx->flags & SSL_CONF_FLAG_CERTIFICATE))
+        return -2;
+    if (cctx->ctx)
+        rv = SSL_CTX_use_certificate_chain_file(cctx->ctx, value);
+    if (cctx->ssl)
+        rv = SSL_use_certificate_file(cctx->ssl, value, SSL_FILETYPE_PEM);
+    return rv > 0;
+}
+
+static int cmd_PrivateKey(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv = 1;
+    if (!(cctx->flags & SSL_CONF_FLAG_CERTIFICATE))
+        return -2;
+    if (cctx->ctx)
+        rv = SSL_CTX_use_PrivateKey_file(cctx->ctx, value, SSL_FILETYPE_PEM);
+    if (cctx->ssl)
+        rv = SSL_use_PrivateKey_file(cctx->ssl, value, SSL_FILETYPE_PEM);
+    return rv > 0;
+}
+
+static int cmd_ServerInfoFile(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv = 1;
+    if (!(cctx->flags & SSL_CONF_FLAG_CERTIFICATE))
+        return -2;
+    if (!(cctx->flags & SSL_CONF_FLAG_SERVER))
+        return -2;
+    if (cctx->ctx)
+        rv = SSL_CTX_use_serverinfo_file(cctx->ctx, value);
+    return rv > 0;
+}
+
+#ifndef OPENSSL_NO_DH
+static int cmd_DHParameters(SSL_CONF_CTX *cctx, const char *value)
+{
+    int rv = 0;
+    DH *dh = NULL;
+    BIO *in = NULL;
+    if (!(cctx->flags & SSL_CONF_FLAG_CERTIFICATE))
+        return -2;
+    if (cctx->ctx || cctx->ssl) {
+        in = BIO_new(BIO_s_file_internal());
+        if (!in)
+            goto end;
+        if (BIO_read_filename(in, value) <= 0)
+            goto end;
+        dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
+        if (!dh)
+            goto end;
+    } else
+        return 1;
+    if (cctx->ctx)
+        rv = SSL_CTX_set_tmp_dh(cctx->ctx, dh);
+    if (cctx->ssl)
+        rv = SSL_set_tmp_dh(cctx->ssl, dh);
+ end:
+    if (dh)
+        DH_free(dh);
+    if (in)
+        BIO_free(in);
+    return rv > 0;
+}
+#endif
+typedef struct {
+    int (*cmd) (SSL_CONF_CTX *cctx, const char *value);
+    const char *str_file;
+    const char *str_cmdline;
+    unsigned int value_type;
+} ssl_conf_cmd_tbl;
+
+/* Table of supported parameters */
+
+#define SSL_CONF_CMD(name, cmdopt, type) \
+        {cmd_##name, #name, cmdopt, type}
+
+#define SSL_CONF_CMD_STRING(name, cmdopt) \
+        SSL_CONF_CMD(name, cmdopt, SSL_CONF_TYPE_STRING)
+
+static const ssl_conf_cmd_tbl ssl_conf_cmds[] = {
+    SSL_CONF_CMD_STRING(SignatureAlgorithms, "sigalgs"),
+    SSL_CONF_CMD_STRING(ClientSignatureAlgorithms, "client_sigalgs"),
+    SSL_CONF_CMD_STRING(Curves, "curves"),
+#ifndef OPENSSL_NO_ECDH
+    SSL_CONF_CMD_STRING(ECDHParameters, "named_curve"),
+#endif
+    SSL_CONF_CMD_STRING(CipherString, "cipher"),
+    SSL_CONF_CMD_STRING(Protocol, NULL),
+    SSL_CONF_CMD_STRING(Options, NULL),
+    SSL_CONF_CMD(Certificate, "cert", SSL_CONF_TYPE_FILE),
+    SSL_CONF_CMD(PrivateKey, "key", SSL_CONF_TYPE_FILE),
+    SSL_CONF_CMD(ServerInfoFile, NULL, SSL_CONF_TYPE_FILE),
+#ifndef OPENSSL_NO_DH
+    SSL_CONF_CMD(DHParameters, "dhparam", SSL_CONF_TYPE_FILE)
+#endif
+};
+
+static int ssl_conf_cmd_skip_prefix(SSL_CONF_CTX *cctx, const char **pcmd)
+{
+    if (!pcmd || !*pcmd)
+        return 0;
+    /* If a prefix is set, check and skip */
+    if (cctx->prefix) {
+        if (strlen(*pcmd) <= cctx->prefixlen)
+            return 0;
+        if (cctx->flags & SSL_CONF_FLAG_CMDLINE &&
+            strncmp(*pcmd, cctx->prefix, cctx->prefixlen))
+            return 0;
+        if (cctx->flags & SSL_CONF_FLAG_FILE &&
+            strncasecmp(*pcmd, cctx->prefix, cctx->prefixlen))
+            return 0;
+        *pcmd += cctx->prefixlen;
+    } else if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
+        if (**pcmd != '-' || !(*pcmd)[1])
+            return 0;
+        *pcmd += 1;
+    }
+    return 1;
+}
+
+static const ssl_conf_cmd_tbl *ssl_conf_cmd_lookup(SSL_CONF_CTX *cctx,
+                                                   const char *cmd)
+{
+    const ssl_conf_cmd_tbl *t;
+    size_t i;
+    if (cmd == NULL)
+        return NULL;
+
+    /* Look for matching parameter name in table */
+    for (i = 0, t = ssl_conf_cmds;
+         i < sizeof(ssl_conf_cmds) / sizeof(ssl_conf_cmd_tbl); i++, t++) {
+        if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
+            if (t->str_cmdline && !strcmp(t->str_cmdline, cmd))
+                return t;
+        }
+        if (cctx->flags & SSL_CONF_FLAG_FILE) {
+            if (t->str_file && !strcasecmp(t->str_file, cmd))
+                return t;
+        }
+    }
+    return NULL;
+}
+
+int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value)
+{
+    const ssl_conf_cmd_tbl *runcmd;
+    if (cmd == NULL) {
+        SSLerr(SSL_F_SSL_CONF_CMD, SSL_R_INVALID_NULL_CMD_NAME);
+        return 0;
+    }
+
+    if (!ssl_conf_cmd_skip_prefix(cctx, &cmd))
+        return -2;
+
+    runcmd = ssl_conf_cmd_lookup(cctx, cmd);
+
+    if (runcmd) {
+        int rv;
+        if (value == NULL)
+            return -3;
+        rv = runcmd->cmd(cctx, value);
+        if (rv > 0)
+            return 2;
+        if (rv == -2)
+            return -2;
+        if (cctx->flags & SSL_CONF_FLAG_SHOW_ERRORS) {
+            SSLerr(SSL_F_SSL_CONF_CMD, SSL_R_BAD_VALUE);
+            ERR_add_error_data(4, "cmd=", cmd, ", value=", value);
+        }
+        return 0;
+    }
+
+    if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
+        if (ctrl_str_option(cctx, cmd))
+            return 1;
+    }
+
+    if (cctx->flags & SSL_CONF_FLAG_SHOW_ERRORS) {
+        SSLerr(SSL_F_SSL_CONF_CMD, SSL_R_UNKNOWN_CMD_NAME);
+        ERR_add_error_data(2, "cmd=", cmd);
+    }
+
+    return -2;
+}
+
+int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv)
+{
+    int rv;
+    const char *arg = NULL, *argn;
+    if (pargc && *pargc == 0)
+        return 0;
+    if (!pargc || *pargc > 0)
+        arg = **pargv;
+    if (arg == NULL)
+        return 0;
+    if (!pargc || *pargc > 1)
+        argn = (*pargv)[1];
+    else
+        argn = NULL;
+    cctx->flags &= ~SSL_CONF_FLAG_FILE;
+    cctx->flags |= SSL_CONF_FLAG_CMDLINE;
+    rv = SSL_CONF_cmd(cctx, arg, argn);
+    if (rv > 0) {
+        /* Success: update pargc, pargv */
+        (*pargv) += rv;
+        if (pargc)
+            (*pargc) -= rv;
+        return rv;
+    }
+    /* Unknown switch: indicate no arguments processed */
+    if (rv == -2)
+        return 0;
+    /* Some error occurred processing command, return fatal error */
+    if (rv == 0)
+        return -1;
+    return rv;
+}
+
+int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd)
+{
+    if (ssl_conf_cmd_skip_prefix(cctx, &cmd)) {
+        const ssl_conf_cmd_tbl *runcmd;
+        runcmd = ssl_conf_cmd_lookup(cctx, cmd);
+        if (runcmd)
+            return runcmd->value_type;
+    }
+    return SSL_CONF_TYPE_UNKNOWN;
+}
+
+SSL_CONF_CTX *SSL_CONF_CTX_new(void)
+{
+    SSL_CONF_CTX *ret;
+    ret = OPENSSL_malloc(sizeof(SSL_CONF_CTX));
+    if (ret) {
+        ret->flags = 0;
+        ret->prefix = NULL;
+        ret->prefixlen = 0;
+        ret->ssl = NULL;
+        ret->ctx = NULL;
+        ret->poptions = NULL;
+        ret->pcert_flags = NULL;
+        ret->tbl = NULL;
+        ret->ntbl = 0;
+    }
+    return ret;
+}
+
+int SSL_CONF_CTX_finish(SSL_CONF_CTX *cctx)
+{
+    return 1;
+}
+
+void SSL_CONF_CTX_free(SSL_CONF_CTX *cctx)
+{
+    if (cctx) {
+        if (cctx->prefix)
+            OPENSSL_free(cctx->prefix);
+        OPENSSL_free(cctx);
+    }
+}
+
+unsigned int SSL_CONF_CTX_set_flags(SSL_CONF_CTX *cctx, unsigned int flags)
+{
+    cctx->flags |= flags;
+    return cctx->flags;
+}
+
+unsigned int SSL_CONF_CTX_clear_flags(SSL_CONF_CTX *cctx, unsigned int flags)
+{
+    cctx->flags &= ~flags;
+    return cctx->flags;
+}
+
+int SSL_CONF_CTX_set1_prefix(SSL_CONF_CTX *cctx, const char *pre)
+{
+    char *tmp = NULL;
+    if (pre) {
+        tmp = BUF_strdup(pre);
+        if (tmp == NULL)
+            return 0;
+    }
+    if (cctx->prefix)
+        OPENSSL_free(cctx->prefix);
+    cctx->prefix = tmp;
+    if (tmp)
+        cctx->prefixlen = strlen(tmp);
+    else
+        cctx->prefixlen = 0;
+    return 1;
+}
+
+void SSL_CONF_CTX_set_ssl(SSL_CONF_CTX *cctx, SSL *ssl)
+{
+    cctx->ssl = ssl;
+    cctx->ctx = NULL;
+    if (ssl) {
+        cctx->poptions = &ssl->options;
+        cctx->pcert_flags = &ssl->cert->cert_flags;
+    } else {
+        cctx->poptions = NULL;
+        cctx->pcert_flags = NULL;
+    }
+}
+
+void SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *cctx, SSL_CTX *ctx)
+{
+    cctx->ctx = ctx;
+    cctx->ssl = NULL;
+    if (ctx) {
+        cctx->poptions = &ctx->options;
+        cctx->pcert_flags = &ctx->cert->cert_flags;
+    } else {
+        cctx->poptions = NULL;
+        cctx->pcert_flags = NULL;
+    }
+}

openssl-1.0.2f/ssl/ssl_err.c

@@ -0,0 +1,838 @@
+/* ssl/ssl_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2015 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/*
+ * NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+# define ERR_FUNC(func) ERR_PACK(ERR_LIB_SSL,func,0)
+# define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason)
+
+static ERR_STRING_DATA SSL_str_functs[] = {
+    {ERR_FUNC(SSL_F_CHECK_SUITEB_CIPHER_LIST), "CHECK_SUITEB_CIPHER_LIST"},
+    {ERR_FUNC(SSL_F_CLIENT_CERTIFICATE), "CLIENT_CERTIFICATE"},
+    {ERR_FUNC(SSL_F_CLIENT_FINISHED), "CLIENT_FINISHED"},
+    {ERR_FUNC(SSL_F_CLIENT_HELLO), "CLIENT_HELLO"},
+    {ERR_FUNC(SSL_F_CLIENT_MASTER_KEY), "CLIENT_MASTER_KEY"},
+    {ERR_FUNC(SSL_F_D2I_SSL_SESSION), "d2i_SSL_SESSION"},
+    {ERR_FUNC(SSL_F_DO_DTLS1_WRITE), "do_dtls1_write"},
+    {ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"},
+    {ERR_FUNC(SSL_F_DTLS1_ACCEPT), "dtls1_accept"},
+    {ERR_FUNC(SSL_F_DTLS1_ADD_CERT_TO_BUF), "DTLS1_ADD_CERT_TO_BUF"},
+    {ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD), "DTLS1_BUFFER_RECORD"},
+    {ERR_FUNC(SSL_F_DTLS1_CHECK_TIMEOUT_NUM), "dtls1_check_timeout_num"},
+    {ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO), "dtls1_client_hello"},
+    {ERR_FUNC(SSL_F_DTLS1_CONNECT), "dtls1_connect"},
+    {ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY), "DTLS1_GET_HELLO_VERIFY"},
+    {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE), "dtls1_get_message"},
+    {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT),
+     "DTLS1_GET_MESSAGE_FRAGMENT"},
+    {ERR_FUNC(SSL_F_DTLS1_GET_RECORD), "dtls1_get_record"},
+    {ERR_FUNC(SSL_F_DTLS1_HANDLE_TIMEOUT), "dtls1_handle_timeout"},
+    {ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "dtls1_heartbeat"},
+    {ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN), "dtls1_output_cert_chain"},
+    {ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT), "DTLS1_PREPROCESS_FRAGMENT"},
+    {ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE),
+     "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
+    {ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"},
+    {ERR_FUNC(SSL_F_DTLS1_READ_BYTES), "dtls1_read_bytes"},
+    {ERR_FUNC(SSL_F_DTLS1_READ_FAILED), "dtls1_read_failed"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST),
+     "dtls1_send_certificate_request"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE),
+     "dtls1_send_client_certificate"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE),
+     "dtls1_send_client_key_exchange"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY), "dtls1_send_client_verify"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST),
+     "DTLS1_SEND_HELLO_VERIFY_REQUEST"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE),
+     "dtls1_send_server_certificate"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO), "dtls1_send_server_hello"},
+    {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE),
+     "dtls1_send_server_key_exchange"},
+    {ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES),
+     "dtls1_write_app_data_bytes"},
+    {ERR_FUNC(SSL_F_GET_CLIENT_FINISHED), "GET_CLIENT_FINISHED"},
+    {ERR_FUNC(SSL_F_GET_CLIENT_HELLO), "GET_CLIENT_HELLO"},
+    {ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"},
+    {ERR_FUNC(SSL_F_GET_SERVER_FINISHED), "GET_SERVER_FINISHED"},
+    {ERR_FUNC(SSL_F_GET_SERVER_HELLO), "GET_SERVER_HELLO"},
+    {ERR_FUNC(SSL_F_GET_SERVER_STATIC_DH_KEY), "GET_SERVER_STATIC_DH_KEY"},
+    {ERR_FUNC(SSL_F_GET_SERVER_VERIFY), "GET_SERVER_VERIFY"},
+    {ERR_FUNC(SSL_F_I2D_SSL_SESSION), "i2d_SSL_SESSION"},
+    {ERR_FUNC(SSL_F_READ_N), "READ_N"},
+    {ERR_FUNC(SSL_F_REQUEST_CERTIFICATE), "REQUEST_CERTIFICATE"},
+    {ERR_FUNC(SSL_F_SERVER_FINISH), "SERVER_FINISH"},
+    {ERR_FUNC(SSL_F_SERVER_HELLO), "SERVER_HELLO"},
+    {ERR_FUNC(SSL_F_SERVER_VERIFY), "SERVER_VERIFY"},
+    {ERR_FUNC(SSL_F_SSL23_ACCEPT), "ssl23_accept"},
+    {ERR_FUNC(SSL_F_SSL23_CLIENT_HELLO), "SSL23_CLIENT_HELLO"},
+    {ERR_FUNC(SSL_F_SSL23_CONNECT), "ssl23_connect"},
+    {ERR_FUNC(SSL_F_SSL23_GET_CLIENT_HELLO), "SSL23_GET_CLIENT_HELLO"},
+    {ERR_FUNC(SSL_F_SSL23_GET_SERVER_HELLO), "SSL23_GET_SERVER_HELLO"},
+    {ERR_FUNC(SSL_F_SSL23_PEEK), "ssl23_peek"},
+    {ERR_FUNC(SSL_F_SSL23_READ), "ssl23_read"},
+    {ERR_FUNC(SSL_F_SSL23_WRITE), "ssl23_write"},
+    {ERR_FUNC(SSL_F_SSL2_ACCEPT), "ssl2_accept"},
+    {ERR_FUNC(SSL_F_SSL2_CONNECT), "ssl2_connect"},
+    {ERR_FUNC(SSL_F_SSL2_ENC_INIT), "ssl2_enc_init"},
+    {ERR_FUNC(SSL_F_SSL2_GENERATE_KEY_MATERIAL),
+     "ssl2_generate_key_material"},
+    {ERR_FUNC(SSL_F_SSL2_PEEK), "ssl2_peek"},
+    {ERR_FUNC(SSL_F_SSL2_READ), "ssl2_read"},
+    {ERR_FUNC(SSL_F_SSL2_READ_INTERNAL), "SSL2_READ_INTERNAL"},
+    {ERR_FUNC(SSL_F_SSL2_SET_CERTIFICATE), "ssl2_set_certificate"},
+    {ERR_FUNC(SSL_F_SSL2_WRITE), "ssl2_write"},
+    {ERR_FUNC(SSL_F_SSL3_ACCEPT), "ssl3_accept"},
+    {ERR_FUNC(SSL_F_SSL3_ADD_CERT_TO_BUF), "SSL3_ADD_CERT_TO_BUF"},
+    {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "ssl3_callback_ctrl"},
+    {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "ssl3_change_cipher_state"},
+    {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM),
+     "ssl3_check_cert_and_algorithm"},
+    {ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "ssl3_check_client_hello"},
+    {ERR_FUNC(SSL_F_SSL3_CHECK_FINISHED), "SSL3_CHECK_FINISHED"},
+    {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "ssl3_client_hello"},
+    {ERR_FUNC(SSL_F_SSL3_CONNECT), "ssl3_connect"},
+    {ERR_FUNC(SSL_F_SSL3_CTRL), "ssl3_ctrl"},
+    {ERR_FUNC(SSL_F_SSL3_CTX_CTRL), "ssl3_ctx_ctrl"},
+    {ERR_FUNC(SSL_F_SSL3_DIGEST_CACHED_RECORDS),
+     "ssl3_digest_cached_records"},
+    {ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC),
+     "ssl3_do_change_cipher_spec"},
+    {ERR_FUNC(SSL_F_SSL3_ENC), "ssl3_enc"},
+    {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK), "SSL3_GENERATE_KEY_BLOCK"},
+    {ERR_FUNC(SSL_F_SSL3_GENERATE_MASTER_SECRET),
+     "ssl3_generate_master_secret"},
+    {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST),
+     "ssl3_get_certificate_request"},
+    {ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS), "ssl3_get_cert_status"},
+    {ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY), "ssl3_get_cert_verify"},
+    {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE),
+     "ssl3_get_client_certificate"},
+    {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "ssl3_get_client_hello"},
+    {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE),
+     "ssl3_get_client_key_exchange"},
+    {ERR_FUNC(SSL_F_SSL3_GET_FINISHED), "ssl3_get_finished"},
+    {ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "ssl3_get_key_exchange"},
+    {ERR_FUNC(SSL_F_SSL3_GET_MESSAGE), "ssl3_get_message"},
+    {ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET),
+     "ssl3_get_new_session_ticket"},
+    {ERR_FUNC(SSL_F_SSL3_GET_NEXT_PROTO), "ssl3_get_next_proto"},
+    {ERR_FUNC(SSL_F_SSL3_GET_RECORD), "SSL3_GET_RECORD"},
+    {ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE),
+     "ssl3_get_server_certificate"},
+    {ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE), "ssl3_get_server_done"},
+    {ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "ssl3_get_server_hello"},
+    {ERR_FUNC(SSL_F_SSL3_HANDSHAKE_MAC), "ssl3_handshake_mac"},
+    {ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET), "SSL3_NEW_SESSION_TICKET"},
+    {ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN), "ssl3_output_cert_chain"},
+    {ERR_FUNC(SSL_F_SSL3_PEEK), "ssl3_peek"},
+    {ERR_FUNC(SSL_F_SSL3_READ_BYTES), "ssl3_read_bytes"},
+    {ERR_FUNC(SSL_F_SSL3_READ_N), "ssl3_read_n"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST),
+     "ssl3_send_certificate_request"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE),
+     "ssl3_send_client_certificate"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE),
+     "ssl3_send_client_key_exchange"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_VERIFY), "ssl3_send_client_verify"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_CERTIFICATE),
+     "ssl3_send_server_certificate"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_HELLO), "ssl3_send_server_hello"},
+    {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE),
+     "ssl3_send_server_key_exchange"},
+    {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK), "ssl3_setup_key_block"},
+    {ERR_FUNC(SSL_F_SSL3_SETUP_READ_BUFFER), "ssl3_setup_read_buffer"},
+    {ERR_FUNC(SSL_F_SSL3_SETUP_WRITE_BUFFER), "ssl3_setup_write_buffer"},
+    {ERR_FUNC(SSL_F_SSL3_SHUTDOWN), "ssl3_shutdown"},
+    {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES), "ssl3_write_bytes"},
+    {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING), "ssl3_write_pending"},
+    {ERR_FUNC(SSL_F_SSL_ADD_CERT_CHAIN), "ssl_add_cert_chain"},
+    {ERR_FUNC(SSL_F_SSL_ADD_CERT_TO_BUF), "SSL_ADD_CERT_TO_BUF"},
+    {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT),
+     "ssl_add_clienthello_renegotiate_ext"},
+    {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT),
+     "ssl_add_clienthello_tlsext"},
+    {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT),
+     "ssl_add_clienthello_use_srtp_ext"},
+    {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK),
+     "SSL_add_dir_cert_subjects_to_stack"},
+    {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK),
+     "SSL_add_file_cert_subjects_to_stack"},
+    {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT),
+     "ssl_add_serverhello_renegotiate_ext"},
+    {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT),
+     "ssl_add_serverhello_tlsext"},
+    {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT),
+     "ssl_add_serverhello_use_srtp_ext"},
+    {ERR_FUNC(SSL_F_SSL_BAD_METHOD), "ssl_bad_method"},
+    {ERR_FUNC(SSL_F_SSL_BUILD_CERT_CHAIN), "ssl_build_cert_chain"},
+    {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), "ssl_bytes_to_cipher_list"},
+    {ERR_FUNC(SSL_F_SSL_CERT_DUP), "ssl_cert_dup"},
+    {ERR_FUNC(SSL_F_SSL_CERT_INST), "ssl_cert_inst"},
+    {ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE), "SSL_CERT_INSTANTIATE"},
+    {ERR_FUNC(SSL_F_SSL_CERT_NEW), "ssl_cert_new"},
+    {ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"},
+    {ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT),
+     "SSL_CHECK_SERVERHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG),
+     "ssl_check_srvr_ecc_cert_and_alg"},
+    {ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR),
+     "SSL_CIPHER_PROCESS_RULESTR"},
+    {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT), "SSL_CIPHER_STRENGTH_SORT"},
+    {ERR_FUNC(SSL_F_SSL_CLEAR), "SSL_clear"},
+    {ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD),
+     "SSL_COMP_add_compression_method"},
+    {ERR_FUNC(SSL_F_SSL_CONF_CMD), "SSL_CONF_cmd"},
+    {ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST), "ssl_create_cipher_list"},
+    {ERR_FUNC(SSL_F_SSL_CTRL), "SSL_ctrl"},
+    {ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY), "SSL_CTX_check_private_key"},
+    {ERR_FUNC(SSL_F_SSL_CTX_MAKE_PROFILES), "SSL_CTX_MAKE_PROFILES"},
+    {ERR_FUNC(SSL_F_SSL_CTX_NEW), "SSL_CTX_new"},
+    {ERR_FUNC(SSL_F_SSL_CTX_SET_CIPHER_LIST), "SSL_CTX_set_cipher_list"},
+    {ERR_FUNC(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE),
+     "SSL_CTX_set_client_cert_engine"},
+    {ERR_FUNC(SSL_F_SSL_CTX_SET_PURPOSE), "SSL_CTX_set_purpose"},
+    {ERR_FUNC(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT),
+     "SSL_CTX_set_session_id_context"},
+    {ERR_FUNC(SSL_F_SSL_CTX_SET_SSL_VERSION), "SSL_CTX_set_ssl_version"},
+    {ERR_FUNC(SSL_F_SSL_CTX_SET_TRUST), "SSL_CTX_set_trust"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE), "SSL_CTX_use_certificate"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1),
+     "SSL_CTX_use_certificate_ASN1"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE),
+     "SSL_CTX_use_certificate_chain_file"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE),
+     "SSL_CTX_use_certificate_file"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY), "SSL_CTX_use_PrivateKey"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1),
+     "SSL_CTX_use_PrivateKey_ASN1"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE),
+     "SSL_CTX_use_PrivateKey_file"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT),
+     "SSL_CTX_use_psk_identity_hint"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY), "SSL_CTX_use_RSAPrivateKey"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1),
+     "SSL_CTX_use_RSAPrivateKey_ASN1"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE),
+     "SSL_CTX_use_RSAPrivateKey_file"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_SERVERINFO), "SSL_CTX_use_serverinfo"},
+    {ERR_FUNC(SSL_F_SSL_CTX_USE_SERVERINFO_FILE),
+     "SSL_CTX_use_serverinfo_file"},
+    {ERR_FUNC(SSL_F_SSL_DO_HANDSHAKE), "SSL_do_handshake"},
+    {ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION), "ssl_get_new_session"},
+    {ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION), "ssl_get_prev_session"},
+    {ERR_FUNC(SSL_F_SSL_GET_SERVER_CERT_INDEX), "SSL_GET_SERVER_CERT_INDEX"},
+    {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT), "SSL_GET_SERVER_SEND_CERT"},
+    {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY), "ssl_get_server_send_pkey"},
+    {ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY), "ssl_get_sign_pkey"},
+    {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER), "ssl_init_wbio_buffer"},
+    {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE), "SSL_load_client_CA_file"},
+    {ERR_FUNC(SSL_F_SSL_NEW), "SSL_new"},
+    {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT),
+     "ssl_parse_clienthello_renegotiate_ext"},
+    {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT),
+     "ssl_parse_clienthello_tlsext"},
+    {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT),
+     "ssl_parse_clienthello_use_srtp_ext"},
+    {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT),
+     "ssl_parse_serverhello_renegotiate_ext"},
+    {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT),
+     "ssl_parse_serverhello_tlsext"},
+    {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT),
+     "ssl_parse_serverhello_use_srtp_ext"},
+    {ERR_FUNC(SSL_F_SSL_PEEK), "SSL_peek"},
+    {ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT),
+     "ssl_prepare_clienthello_tlsext"},
+    {ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT),
+     "ssl_prepare_serverhello_tlsext"},
+    {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
+    {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
+    {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
+    {ERR_FUNC(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT),
+     "SSL_SCAN_CLIENTHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT),
+     "SSL_SCAN_SERVERHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_DUP), "ssl_session_dup"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
+    {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT),
+     "SSL_SESSION_set1_id_context"},
+    {ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "ssl_sess_cert_new"},
+    {ERR_FUNC(SSL_F_SSL_SET_CERT), "SSL_SET_CERT"},
+    {ERR_FUNC(SSL_F_SSL_SET_CIPHER_LIST), "SSL_set_cipher_list"},
+    {ERR_FUNC(SSL_F_SSL_SET_FD), "SSL_set_fd"},
+    {ERR_FUNC(SSL_F_SSL_SET_PKEY), "SSL_SET_PKEY"},
+    {ERR_FUNC(SSL_F_SSL_SET_PURPOSE), "SSL_set_purpose"},
+    {ERR_FUNC(SSL_F_SSL_SET_RFD), "SSL_set_rfd"},
+    {ERR_FUNC(SSL_F_SSL_SET_SESSION), "SSL_set_session"},
+    {ERR_FUNC(SSL_F_SSL_SET_SESSION_ID_CONTEXT),
+     "SSL_set_session_id_context"},
+    {ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT),
+     "SSL_set_session_ticket_ext"},
+    {ERR_FUNC(SSL_F_SSL_SET_TRUST), "SSL_set_trust"},
+    {ERR_FUNC(SSL_F_SSL_SET_WFD), "SSL_set_wfd"},
+    {ERR_FUNC(SSL_F_SSL_SHUTDOWN), "SSL_shutdown"},
+    {ERR_FUNC(SSL_F_SSL_SRP_CTX_INIT), "SSL_SRP_CTX_init"},
+    {ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION),
+     "ssl_undefined_const_function"},
+    {ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION), "ssl_undefined_function"},
+    {ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION),
+     "ssl_undefined_void_function"},
+    {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE), "SSL_use_certificate"},
+    {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1), "SSL_use_certificate_ASN1"},
+    {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE), "SSL_use_certificate_file"},
+    {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY), "SSL_use_PrivateKey"},
+    {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_ASN1), "SSL_use_PrivateKey_ASN1"},
+    {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_FILE), "SSL_use_PrivateKey_file"},
+    {ERR_FUNC(SSL_F_SSL_USE_PSK_IDENTITY_HINT), "SSL_use_psk_identity_hint"},
+    {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY), "SSL_use_RSAPrivateKey"},
+    {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1),
+     "SSL_use_RSAPrivateKey_ASN1"},
+    {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE),
+     "SSL_use_RSAPrivateKey_file"},
+    {ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "ssl_verify_cert_chain"},
+    {ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"},
+    {ERR_FUNC(SSL_F_TLS12_CHECK_PEER_SIGALG), "tls12_check_peer_sigalg"},
+    {ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"},
+    {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "tls1_change_cipher_state"},
+    {ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT),
+     "TLS1_CHECK_SERVERHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_TLS1_ENC), "tls1_enc"},
+    {ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL),
+     "tls1_export_keying_material"},
+    {ERR_FUNC(SSL_F_TLS1_GET_CURVELIST), "TLS1_GET_CURVELIST"},
+    {ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "tls1_heartbeat"},
+    {ERR_FUNC(SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT),
+     "TLS1_PREPARE_CLIENTHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT),
+     "TLS1_PREPARE_SERVERHELLO_TLSEXT"},
+    {ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"},
+    {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "tls1_setup_key_block"},
+    {ERR_FUNC(SSL_F_TLS1_SET_SERVER_SIGALGS), "tls1_set_server_sigalgs"},
+    {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
+    {0, NULL}
+};
+
+static ERR_STRING_DATA SSL_str_reasons[] = {
+    {ERR_REASON(SSL_R_APP_DATA_IN_HANDSHAKE), "app data in handshake"},
+    {ERR_REASON(SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT),
+     "attempt to reuse session in different context"},
+    {ERR_REASON(SSL_R_BAD_ALERT_RECORD), "bad alert record"},
+    {ERR_REASON(SSL_R_BAD_AUTHENTICATION_TYPE), "bad authentication type"},
+    {ERR_REASON(SSL_R_BAD_CHANGE_CIPHER_SPEC), "bad change cipher spec"},
+    {ERR_REASON(SSL_R_BAD_CHECKSUM), "bad checksum"},
+    {ERR_REASON(SSL_R_BAD_DATA), "bad data"},
+    {ERR_REASON(SSL_R_BAD_DATA_RETURNED_BY_CALLBACK),
+     "bad data returned by callback"},
+    {ERR_REASON(SSL_R_BAD_DECOMPRESSION), "bad decompression"},
+    {ERR_REASON(SSL_R_BAD_DH_G_LENGTH), "bad dh g length"},
+    {ERR_REASON(SSL_R_BAD_DH_G_VALUE), "bad dh g value"},
+    {ERR_REASON(SSL_R_BAD_DH_PUB_KEY_LENGTH), "bad dh pub key length"},
+    {ERR_REASON(SSL_R_BAD_DH_PUB_KEY_VALUE), "bad dh pub key value"},
+    {ERR_REASON(SSL_R_BAD_DH_P_LENGTH), "bad dh p length"},
+    {ERR_REASON(SSL_R_BAD_DH_P_VALUE), "bad dh p value"},
+    {ERR_REASON(SSL_R_BAD_DIGEST_LENGTH), "bad digest length"},
+    {ERR_REASON(SSL_R_BAD_DSA_SIGNATURE), "bad dsa signature"},
+    {ERR_REASON(SSL_R_BAD_ECC_CERT), "bad ecc cert"},
+    {ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE), "bad ecdsa signature"},
+    {ERR_REASON(SSL_R_BAD_ECPOINT), "bad ecpoint"},
+    {ERR_REASON(SSL_R_BAD_HANDSHAKE_LENGTH), "bad handshake length"},
+    {ERR_REASON(SSL_R_BAD_HELLO_REQUEST), "bad hello request"},
+    {ERR_REASON(SSL_R_BAD_LENGTH), "bad length"},
+    {ERR_REASON(SSL_R_BAD_MAC_DECODE), "bad mac decode"},
+    {ERR_REASON(SSL_R_BAD_MAC_LENGTH), "bad mac length"},
+    {ERR_REASON(SSL_R_BAD_MESSAGE_TYPE), "bad message type"},
+    {ERR_REASON(SSL_R_BAD_PACKET_LENGTH), "bad packet length"},
+    {ERR_REASON(SSL_R_BAD_PROTOCOL_VERSION_NUMBER),
+     "bad protocol version number"},
+    {ERR_REASON(SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH),
+     "bad psk identity hint length"},
+    {ERR_REASON(SSL_R_BAD_RESPONSE_ARGUMENT), "bad response argument"},
+    {ERR_REASON(SSL_R_BAD_RSA_DECRYPT), "bad rsa decrypt"},
+    {ERR_REASON(SSL_R_BAD_RSA_ENCRYPT), "bad rsa encrypt"},
+    {ERR_REASON(SSL_R_BAD_RSA_E_LENGTH), "bad rsa e length"},
+    {ERR_REASON(SSL_R_BAD_RSA_MODULUS_LENGTH), "bad rsa modulus length"},
+    {ERR_REASON(SSL_R_BAD_RSA_SIGNATURE), "bad rsa signature"},
+    {ERR_REASON(SSL_R_BAD_SIGNATURE), "bad signature"},
+    {ERR_REASON(SSL_R_BAD_SRP_A_LENGTH), "bad srp a length"},
+    {ERR_REASON(SSL_R_BAD_SRP_B_LENGTH), "bad srp b length"},
+    {ERR_REASON(SSL_R_BAD_SRP_G_LENGTH), "bad srp g length"},
+    {ERR_REASON(SSL_R_BAD_SRP_N_LENGTH), "bad srp n length"},
+    {ERR_REASON(SSL_R_BAD_SRP_PARAMETERS), "bad srp parameters"},
+    {ERR_REASON(SSL_R_BAD_SRP_S_LENGTH), "bad srp s length"},
+    {ERR_REASON(SSL_R_BAD_SRTP_MKI_VALUE), "bad srtp mki value"},
+    {ERR_REASON(SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST),
+     "bad srtp protection profile list"},
+    {ERR_REASON(SSL_R_BAD_SSL_FILETYPE), "bad ssl filetype"},
+    {ERR_REASON(SSL_R_BAD_SSL_SESSION_ID_LENGTH),
+     "bad ssl session id length"},
+    {ERR_REASON(SSL_R_BAD_STATE), "bad state"},
+    {ERR_REASON(SSL_R_BAD_VALUE), "bad value"},
+    {ERR_REASON(SSL_R_BAD_WRITE_RETRY), "bad write retry"},
+    {ERR_REASON(SSL_R_BIO_NOT_SET), "bio not set"},
+    {ERR_REASON(SSL_R_BLOCK_CIPHER_PAD_IS_WRONG),
+     "block cipher pad is wrong"},
+    {ERR_REASON(SSL_R_BN_LIB), "bn lib"},
+    {ERR_REASON(SSL_R_CA_DN_LENGTH_MISMATCH), "ca dn length mismatch"},
+    {ERR_REASON(SSL_R_CA_DN_TOO_LONG), "ca dn too long"},
+    {ERR_REASON(SSL_R_CCS_RECEIVED_EARLY), "ccs received early"},
+    {ERR_REASON(SSL_R_CERTIFICATE_VERIFY_FAILED),
+     "certificate verify failed"},
+    {ERR_REASON(SSL_R_CERT_CB_ERROR), "cert cb error"},
+    {ERR_REASON(SSL_R_CERT_LENGTH_MISMATCH), "cert length mismatch"},
+    {ERR_REASON(SSL_R_CHALLENGE_IS_DIFFERENT), "challenge is different"},
+    {ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH), "cipher code wrong length"},
+    {ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE),
+     "cipher or hash unavailable"},
+    {ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR), "cipher table src error"},
+    {ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT), "clienthello tlsext"},
+    {ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG),
+     "compressed length too long"},
+    {ERR_REASON(SSL_R_COMPRESSION_DISABLED), "compression disabled"},
+    {ERR_REASON(SSL_R_COMPRESSION_FAILURE), "compression failure"},
+    {ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE),
+     "compression id not within private range"},
+    {ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR),
+     "compression library error"},
+    {ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT),
+     "connection id is different"},
+    {ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET), "connection type not set"},
+    {ERR_REASON(SSL_R_COOKIE_MISMATCH), "cookie mismatch"},
+    {ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED),
+     "data between ccs and finished"},
+    {ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG), "data length too long"},
+    {ERR_REASON(SSL_R_DECRYPTION_FAILED), "decryption failed"},
+    {ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC),
+     "decryption failed or bad record mac"},
+    {ERR_REASON(SSL_R_DH_KEY_TOO_SMALL), "dh key too small"},
+    {ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG),
+     "dh public value length is wrong"},
+    {ERR_REASON(SSL_R_DIGEST_CHECK_FAILED), "digest check failed"},
+    {ERR_REASON(SSL_R_DTLS_MESSAGE_TOO_BIG), "dtls message too big"},
+    {ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID), "duplicate compression id"},
+    {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT),
+     "ecc cert not for key agreement"},
+    {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_SIGNING), "ecc cert not for signing"},
+    {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE),
+     "ecc cert should have rsa signature"},
+    {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE),
+     "ecc cert should have sha1 signature"},
+    {ERR_REASON(SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE),
+     "ecdh required for suiteb mode"},
+    {ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER),
+     "ecgroup too large for cipher"},
+    {ERR_REASON(SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST),
+     "empty srtp protection profile list"},
+    {ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG),
+     "encrypted length too long"},
+    {ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY),
+     "error generating tmp rsa key"},
+    {ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST),
+     "error in received cipher list"},
+    {ERR_REASON(SSL_R_EXCESSIVE_MESSAGE_SIZE), "excessive message size"},
+    {ERR_REASON(SSL_R_EXTRA_DATA_IN_MESSAGE), "extra data in message"},
+    {ERR_REASON(SSL_R_GOT_A_FIN_BEFORE_A_CCS), "got a fin before a ccs"},
+    {ERR_REASON(SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS),
+     "got next proto before a ccs"},
+    {ERR_REASON(SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION),
+     "got next proto without seeing extension"},
+    {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST), "https proxy request"},
+    {ERR_REASON(SSL_R_HTTP_REQUEST), "http request"},
+    {ERR_REASON(SSL_R_ILLEGAL_PADDING), "illegal padding"},
+    {ERR_REASON(SSL_R_ILLEGAL_SUITEB_DIGEST), "illegal Suite B digest"},
+    {ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK), "inappropriate fallback"},
+    {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION), "inconsistent compression"},
+    {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH), "invalid challenge length"},
+    {ERR_REASON(SSL_R_INVALID_COMMAND), "invalid command"},
+    {ERR_REASON(SSL_R_INVALID_COMPRESSION_ALGORITHM),
+     "invalid compression algorithm"},
+    {ERR_REASON(SSL_R_INVALID_NULL_CMD_NAME), "invalid null cmd name"},
+    {ERR_REASON(SSL_R_INVALID_PURPOSE), "invalid purpose"},
+    {ERR_REASON(SSL_R_INVALID_SERVERINFO_DATA), "invalid serverinfo data"},
+    {ERR_REASON(SSL_R_INVALID_SRP_USERNAME), "invalid srp username"},
+    {ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE), "invalid status response"},
+    {ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH),
+     "invalid ticket keys length"},
+    {ERR_REASON(SSL_R_INVALID_TRUST), "invalid trust"},
+    {ERR_REASON(SSL_R_KEY_ARG_TOO_LONG), "key arg too long"},
+    {ERR_REASON(SSL_R_KRB5), "krb5"},
+    {ERR_REASON(SSL_R_KRB5_C_CC_PRINC), "krb5 client cc principal (no tkt?)"},
+    {ERR_REASON(SSL_R_KRB5_C_GET_CRED), "krb5 client get cred"},
+    {ERR_REASON(SSL_R_KRB5_C_INIT), "krb5 client init"},
+    {ERR_REASON(SSL_R_KRB5_C_MK_REQ), "krb5 client mk_req (expired tkt?)"},
+    {ERR_REASON(SSL_R_KRB5_S_BAD_TICKET), "krb5 server bad ticket"},
+    {ERR_REASON(SSL_R_KRB5_S_INIT), "krb5 server init"},
+    {ERR_REASON(SSL_R_KRB5_S_RD_REQ), "krb5 server rd_req (keytab perms?)"},
+    {ERR_REASON(SSL_R_KRB5_S_TKT_EXPIRED), "krb5 server tkt expired"},
+    {ERR_REASON(SSL_R_KRB5_S_TKT_NYV), "krb5 server tkt not yet valid"},
+    {ERR_REASON(SSL_R_KRB5_S_TKT_SKEW), "krb5 server tkt skew"},
+    {ERR_REASON(SSL_R_LENGTH_MISMATCH), "length mismatch"},
+    {ERR_REASON(SSL_R_LENGTH_TOO_SHORT), "length too short"},
+    {ERR_REASON(SSL_R_LIBRARY_BUG), "library bug"},
+    {ERR_REASON(SSL_R_LIBRARY_HAS_NO_CIPHERS), "library has no ciphers"},
+    {ERR_REASON(SSL_R_MESSAGE_TOO_LONG), "message too long"},
+    {ERR_REASON(SSL_R_MISSING_DH_DSA_CERT), "missing dh dsa cert"},
+    {ERR_REASON(SSL_R_MISSING_DH_KEY), "missing dh key"},
+    {ERR_REASON(SSL_R_MISSING_DH_RSA_CERT), "missing dh rsa cert"},
+    {ERR_REASON(SSL_R_MISSING_DSA_SIGNING_CERT), "missing dsa signing cert"},
+    {ERR_REASON(SSL_R_MISSING_ECDH_CERT), "missing ecdh cert"},
+    {ERR_REASON(SSL_R_MISSING_ECDSA_SIGNING_CERT),
+     "missing ecdsa signing cert"},
+    {ERR_REASON(SSL_R_MISSING_EXPORT_TMP_DH_KEY),
+     "missing export tmp dh key"},
+    {ERR_REASON(SSL_R_MISSING_EXPORT_TMP_RSA_KEY),
+     "missing export tmp rsa key"},
+    {ERR_REASON(SSL_R_MISSING_RSA_CERTIFICATE), "missing rsa certificate"},
+    {ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT),
+     "missing rsa encrypting cert"},
+    {ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT), "missing rsa signing cert"},
+    {ERR_REASON(SSL_R_MISSING_SRP_PARAM), "can't find SRP server param"},
+    {ERR_REASON(SSL_R_MISSING_TMP_DH_KEY), "missing tmp dh key"},
+    {ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY), "missing tmp ecdh key"},
+    {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY), "missing tmp rsa key"},
+    {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY), "missing tmp rsa pkey"},
+    {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE), "missing verify message"},
+    {ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS), "multiple sgc restarts"},
+    {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET), "non sslv2 initial packet"},
+    {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED), "no certificates returned"},
+    {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED), "no certificate assigned"},
+    {ERR_REASON(SSL_R_NO_CERTIFICATE_RETURNED), "no certificate returned"},
+    {ERR_REASON(SSL_R_NO_CERTIFICATE_SET), "no certificate set"},
+    {ERR_REASON(SSL_R_NO_CERTIFICATE_SPECIFIED), "no certificate specified"},
+    {ERR_REASON(SSL_R_NO_CIPHERS_AVAILABLE), "no ciphers available"},
+    {ERR_REASON(SSL_R_NO_CIPHERS_PASSED), "no ciphers passed"},
+    {ERR_REASON(SSL_R_NO_CIPHERS_SPECIFIED), "no ciphers specified"},
+    {ERR_REASON(SSL_R_NO_CIPHER_LIST), "no cipher list"},
+    {ERR_REASON(SSL_R_NO_CIPHER_MATCH), "no cipher match"},
+    {ERR_REASON(SSL_R_NO_CLIENT_CERT_METHOD), "no client cert method"},
+    {ERR_REASON(SSL_R_NO_CLIENT_CERT_RECEIVED), "no client cert received"},
+    {ERR_REASON(SSL_R_NO_COMPRESSION_SPECIFIED), "no compression specified"},
+    {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),
+     "Peer haven't sent GOST certificate, required for selected ciphersuite"},
+    {ERR_REASON(SSL_R_NO_METHOD_SPECIFIED), "no method specified"},
+    {ERR_REASON(SSL_R_NO_PEM_EXTENSIONS), "no pem extensions"},
+    {ERR_REASON(SSL_R_NO_PRIVATEKEY), "no privatekey"},
+    {ERR_REASON(SSL_R_NO_PRIVATE_KEY_ASSIGNED), "no private key assigned"},
+    {ERR_REASON(SSL_R_NO_PROTOCOLS_AVAILABLE), "no protocols available"},
+    {ERR_REASON(SSL_R_NO_PUBLICKEY), "no publickey"},
+    {ERR_REASON(SSL_R_NO_RENEGOTIATION), "no renegotiation"},
+    {ERR_REASON(SSL_R_NO_REQUIRED_DIGEST),
+     "digest requred for handshake isn't computed"},
+    {ERR_REASON(SSL_R_NO_SHARED_CIPHER), "no shared cipher"},
+    {ERR_REASON(SSL_R_NO_SHARED_SIGATURE_ALGORITHMS),
+     "no shared sigature algorithms"},
+    {ERR_REASON(SSL_R_NO_SRTP_PROFILES), "no srtp profiles"},
+    {ERR_REASON(SSL_R_NO_VERIFY_CALLBACK), "no verify callback"},
+    {ERR_REASON(SSL_R_NULL_SSL_CTX), "null ssl ctx"},
+    {ERR_REASON(SSL_R_NULL_SSL_METHOD_PASSED), "null ssl method passed"},
+    {ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED),
+     "old session cipher not returned"},
+    {ERR_REASON(SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED),
+     "old session compression algorithm not returned"},
+    {ERR_REASON(SSL_R_ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE),
+     "only DTLS 1.2 allowed in Suite B mode"},
+    {ERR_REASON(SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE),
+     "only TLS 1.2 allowed in Suite B mode"},
+    {ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE),
+     "only tls allowed in fips mode"},
+    {ERR_REASON(SSL_R_OPAQUE_PRF_INPUT_TOO_LONG),
+     "opaque PRF input too long"},
+    {ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG), "packet length too long"},
+    {ERR_REASON(SSL_R_PARSE_TLSEXT), "parse tlsext"},
+    {ERR_REASON(SSL_R_PATH_TOO_LONG), "path too long"},
+    {ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE),
+     "peer did not return a certificate"},
+    {ERR_REASON(SSL_R_PEER_ERROR), "peer error"},
+    {ERR_REASON(SSL_R_PEER_ERROR_CERTIFICATE), "peer error certificate"},
+    {ERR_REASON(SSL_R_PEER_ERROR_NO_CERTIFICATE),
+     "peer error no certificate"},
+    {ERR_REASON(SSL_R_PEER_ERROR_NO_CIPHER), "peer error no cipher"},
+    {ERR_REASON(SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE),
+     "peer error unsupported certificate type"},
+    {ERR_REASON(SSL_R_PEM_NAME_BAD_PREFIX), "pem name bad prefix"},
+    {ERR_REASON(SSL_R_PEM_NAME_TOO_SHORT), "pem name too short"},
+    {ERR_REASON(SSL_R_PRE_MAC_LENGTH_TOO_LONG), "pre mac length too long"},
+    {ERR_REASON(SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS),
+     "problems mapping cipher functions"},
+    {ERR_REASON(SSL_R_PROTOCOL_IS_SHUTDOWN), "protocol is shutdown"},
+    {ERR_REASON(SSL_R_PSK_IDENTITY_NOT_FOUND), "psk identity not found"},
+    {ERR_REASON(SSL_R_PSK_NO_CLIENT_CB), "psk no client cb"},
+    {ERR_REASON(SSL_R_PSK_NO_SERVER_CB), "psk no server cb"},
+    {ERR_REASON(SSL_R_PUBLIC_KEY_ENCRYPT_ERROR), "public key encrypt error"},
+    {ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA), "public key is not rsa"},
+    {ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA), "public key not rsa"},
+    {ERR_REASON(SSL_R_READ_BIO_NOT_SET), "read bio not set"},
+    {ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED), "read timeout expired"},
+    {ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE), "read wrong packet type"},
+    {ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH), "record length mismatch"},
+    {ERR_REASON(SSL_R_RECORD_TOO_LARGE), "record too large"},
+    {ERR_REASON(SSL_R_RECORD_TOO_SMALL), "record too small"},
+    {ERR_REASON(SSL_R_RENEGOTIATE_EXT_TOO_LONG), "renegotiate ext too long"},
+    {ERR_REASON(SSL_R_RENEGOTIATION_ENCODING_ERR),
+     "renegotiation encoding err"},
+    {ERR_REASON(SSL_R_RENEGOTIATION_MISMATCH), "renegotiation mismatch"},
+    {ERR_REASON(SSL_R_REQUIRED_CIPHER_MISSING), "required cipher missing"},
+    {ERR_REASON(SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING),
+     "required compresssion algorithm missing"},
+    {ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO),
+     "reuse cert length not zero"},
+    {ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO), "reuse cert type not zero"},
+    {ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO),
+     "reuse cipher list not zero"},
+    {ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING),
+     "scsv received when renegotiating"},
+    {ERR_REASON(SSL_R_SERVERHELLO_TLSEXT), "serverhello tlsext"},
+    {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),
+     "session id context uninitialized"},
+    {ERR_REASON(SSL_R_SHORT_READ), "short read"},
+    {ERR_REASON(SSL_R_SHUTDOWN_WHILE_IN_INIT), "shutdown while in init"},
+    {ERR_REASON(SSL_R_SIGNATURE_ALGORITHMS_ERROR),
+     "signature algorithms error"},
+    {ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),
+     "signature for non signing certificate"},
+    {ERR_REASON(SSL_R_SRP_A_CALC), "error with the srp params"},
+    {ERR_REASON(SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES),
+     "srtp could not allocate profiles"},
+    {ERR_REASON(SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG),
+     "srtp protection profile list too long"},
+    {ERR_REASON(SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE),
+     "srtp unknown protection profile"},
+    {ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),
+     "ssl23 doing session id reuse"},
+    {ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG),
+     "ssl2 connection id too long"},
+    {ERR_REASON(SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT),
+     "ssl3 ext invalid ecpointformat"},
+    {ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME),
+     "ssl3 ext invalid servername"},
+    {ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE),
+     "ssl3 ext invalid servername type"},
+    {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG), "ssl3 session id too long"},
+    {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT),
+     "ssl3 session id too short"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE),
+     "sslv3 alert bad certificate"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_RECORD_MAC),
+     "sslv3 alert bad record mac"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED),
+     "sslv3 alert certificate expired"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED),
+     "sslv3 alert certificate revoked"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN),
+     "sslv3 alert certificate unknown"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE),
+     "sslv3 alert decompression failure"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE),
+     "sslv3 alert handshake failure"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER),
+     "sslv3 alert illegal parameter"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_NO_CERTIFICATE),
+     "sslv3 alert no certificate"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE),
+     "sslv3 alert unexpected message"},
+    {ERR_REASON(SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE),
+     "sslv3 alert unsupported certificate"},
+    {ERR_REASON(SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION),
+     "ssl ctx has no default ssl version"},
+    {ERR_REASON(SSL_R_SSL_HANDSHAKE_FAILURE), "ssl handshake failure"},
+    {ERR_REASON(SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS),
+     "ssl library has no ciphers"},
+    {ERR_REASON(SSL_R_SSL_SESSION_ID_CALLBACK_FAILED),
+     "ssl session id callback failed"},
+    {ERR_REASON(SSL_R_SSL_SESSION_ID_CONFLICT), "ssl session id conflict"},
+    {ERR_REASON(SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG),
+     "ssl session id context too long"},
+    {ERR_REASON(SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH),
+     "ssl session id has bad length"},
+    {ERR_REASON(SSL_R_SSL_SESSION_ID_IS_DIFFERENT),
+     "ssl session id is different"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_ACCESS_DENIED),
+     "tlsv1 alert access denied"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_DECODE_ERROR), "tlsv1 alert decode error"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),
+     "tlsv1 alert decryption failed"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),
+     "tlsv1 alert decrypt error"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),
+     "tlsv1 alert export restriction"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),
+     "tlsv1 alert inappropriate fallback"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),
+     "tlsv1 alert insufficient security"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),
+     "tlsv1 alert internal error"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),
+     "tlsv1 alert no renegotiation"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_PROTOCOL_VERSION),
+     "tlsv1 alert protocol version"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_RECORD_OVERFLOW),
+     "tlsv1 alert record overflow"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA), "tlsv1 alert unknown ca"},
+    {ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED),
+     "tlsv1 alert user cancelled"},
+    {ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE),
+     "tlsv1 bad certificate hash value"},
+    {ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE),
+     "tlsv1 bad certificate status response"},
+    {ERR_REASON(SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE),
+     "tlsv1 certificate unobtainable"},
+    {ERR_REASON(SSL_R_TLSV1_UNRECOGNIZED_NAME), "tlsv1 unrecognized name"},
+    {ERR_REASON(SSL_R_TLSV1_UNSUPPORTED_EXTENSION),
+     "tlsv1 unsupported extension"},
+    {ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER),
+     "tls client cert req with anon cipher"},
+    {ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),
+     "peer does not accept heartbeats"},
+    {ERR_REASON(SSL_R_TLS_HEARTBEAT_PENDING),
+     "heartbeat request already pending"},
+    {ERR_REASON(SSL_R_TLS_ILLEGAL_EXPORTER_LABEL),
+     "tls illegal exporter label"},
+    {ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),
+     "tls invalid ecpointformat list"},
+    {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),
+     "tls peer did not respond with certificate list"},
+    {ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG),
+     "tls rsa encrypted value length is wrong"},
+    {ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER),
+     "tried to use unsupported cipher"},
+    {ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS),
+     "unable to decode dh certs"},
+    {ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS),
+     "unable to decode ecdh certs"},
+    {ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY),
+     "unable to extract public key"},
+    {ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS),
+     "unable to find dh parameters"},
+    {ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS),
+     "unable to find ecdh parameters"},
+    {ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS),
+     "unable to find public key parameters"},
+    {ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD),
+     "unable to find ssl method"},
+    {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES),
+     "unable to load ssl2 md5 routines"},
+    {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES),
+     "unable to load ssl3 md5 routines"},
+    {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES),
+     "unable to load ssl3 sha1 routines"},
+    {ERR_REASON(SSL_R_UNEXPECTED_MESSAGE), "unexpected message"},
+    {ERR_REASON(SSL_R_UNEXPECTED_RECORD), "unexpected record"},
+    {ERR_REASON(SSL_R_UNINITIALIZED), "uninitialized"},
+    {ERR_REASON(SSL_R_UNKNOWN_ALERT_TYPE), "unknown alert type"},
+    {ERR_REASON(SSL_R_UNKNOWN_CERTIFICATE_TYPE), "unknown certificate type"},
+    {ERR_REASON(SSL_R_UNKNOWN_CIPHER_RETURNED), "unknown cipher returned"},
+    {ERR_REASON(SSL_R_UNKNOWN_CIPHER_TYPE), "unknown cipher type"},
+    {ERR_REASON(SSL_R_UNKNOWN_CMD_NAME), "unknown cmd name"},
+    {ERR_REASON(SSL_R_UNKNOWN_DIGEST), "unknown digest"},
+    {ERR_REASON(SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE),
+     "unknown key exchange type"},
+    {ERR_REASON(SSL_R_UNKNOWN_PKEY_TYPE), "unknown pkey type"},
+    {ERR_REASON(SSL_R_UNKNOWN_PROTOCOL), "unknown protocol"},
+    {ERR_REASON(SSL_R_UNKNOWN_REMOTE_ERROR_TYPE),
+     "unknown remote error type"},
+    {ERR_REASON(SSL_R_UNKNOWN_SSL_VERSION), "unknown ssl version"},
+    {ERR_REASON(SSL_R_UNKNOWN_STATE), "unknown state"},
+    {ERR_REASON(SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED),
+     "unsafe legacy renegotiation disabled"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_CIPHER), "unsupported cipher"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM),
+     "unsupported compression algorithm"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_DIGEST_TYPE), "unsupported digest type"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE),
+     "unsupported elliptic curve"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL), "unsupported protocol"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION), "unsupported ssl version"},
+    {ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE), "unsupported status type"},
+    {ERR_REASON(SSL_R_USE_SRTP_NOT_NEGOTIATED), "use srtp not negotiated"},
+    {ERR_REASON(SSL_R_WRITE_BIO_NOT_SET), "write bio not set"},
+    {ERR_REASON(SSL_R_WRONG_CERTIFICATE_TYPE), "wrong certificate type"},
+    {ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED), "wrong cipher returned"},
+    {ERR_REASON(SSL_R_WRONG_CURVE), "wrong curve"},
+    {ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE), "wrong message type"},
+    {ERR_REASON(SSL_R_WRONG_NUMBER_OF_KEY_BITS), "wrong number of key bits"},
+    {ERR_REASON(SSL_R_WRONG_SIGNATURE_LENGTH), "wrong signature length"},
+    {ERR_REASON(SSL_R_WRONG_SIGNATURE_SIZE), "wrong signature size"},
+    {ERR_REASON(SSL_R_WRONG_SIGNATURE_TYPE), "wrong signature type"},
+    {ERR_REASON(SSL_R_WRONG_SSL_VERSION), "wrong ssl version"},
+    {ERR_REASON(SSL_R_WRONG_VERSION_NUMBER), "wrong version number"},
+    {ERR_REASON(SSL_R_X509_LIB), "x509 lib"},
+    {ERR_REASON(SSL_R_X509_VERIFICATION_SETUP_PROBLEMS),
+     "x509 verification setup problems"},
+    {0, NULL}
+};
+
+#endif
+
+void ERR_load_SSL_strings(void)
+{
+#ifndef OPENSSL_NO_ERR
+
+    if (ERR_func_error_string(SSL_str_functs[0].error) == NULL) {
+        ERR_load_strings(0, SSL_str_functs);
+        ERR_load_strings(0, SSL_str_reasons);
+    }
+#endif
+}

openssl-1.0.2f/ssl/ssl_err2.c

@@ -0,0 +1,69 @@
+/* ssl/ssl_err2.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+void SSL_load_error_strings(void)
+{
+#ifndef OPENSSL_NO_ERR
+    ERR_load_crypto_strings();
+    ERR_load_SSL_strings();
+#endif
+}

openssl-1.0.2f/ssl/ssl_task.c

@@ -0,0 +1,397 @@
+/* ssl/ssl_task.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+/* VMS */
+/*-
+ * DECnet object for servicing SSL.  We accept the inbound and speak a
+ * simple protocol for multiplexing the 2 data streams (application and
+ * ssl data) over this logical link.
+ *
+ * Logical names:
+ *    SSL_CIPHER        Defines a list of cipher specifications the server
+ *                      will support in order of preference.
+ *    SSL_SERVER_CERTIFICATE
+ *                      Points to PEM (privacy enhanced mail) file that
+ *                      contains the server certificate and private password.
+ *    SYS$NET           Logical created by netserver.exe as hook for completing
+ *                      DECnet logical link.
+ *
+ * Each NSP message sent over the DECnet link has the following structure:
+ *    struct rpc_msg {
+ *      char channel;
+ *      char function;
+ *      short length;
+ *      char data[MAX_DATA];
+ *    } msg;
+ *
+ * The channel field designates the virtual data stream this message applies
+ * to and is one of:
+ *   A - Application data (payload).
+ *   R - Remote client connection that initiated the SSL connection.  Encrypted
+ *       data is sent over this connection.
+ *   G - General data, reserved for future use.
+ *
+ * The data streams are half-duplex read/write and have following functions:
+ *   G - Get, requests that up to msg.length bytes of data be returned.  The
+ *       data is returned in the next 'C' function response that matches the
+ *       requesting channel.
+ *   P - Put, requests that the first msg.length bytes of msg.data be appended
+ *       to the designated stream.
+ *   C - Confirms a get or put.  Every get and put will get a confirm response,
+ *       you cannot initiate another function on a channel until the previous
+ *       operation has been confirmed.
+ *
+ *  The 2 channels may interleave their operations, for example:
+ *        Server msg           Client msg
+ *         A, Get, 4092          ---->
+ *                               <----  R, get, 4092
+ *         R, Confirm, {hello}   ---->
+ *                               <----  R, put, {srv hello}
+ *         R, Confirm, 0         ---->
+ *                               .              (SSL handshake completed)
+ *                               .              (read first app data).
+ *                               <----  A, confirm, {http data}
+ *         A, Put, {http data}   ---->
+ *                               <----  A, confirm, 0
+ *
+ *  The length field is not permitted to be larger that 4092 bytes.
+ *
+ * Author: Dave Jones
+ * Date:   22-JUL-1996
+ */
+#include <stdlib.h>
+#include <stdio.h>
+#include <iodef.h>              /* VMS IO$_ definitions */
+#include <descrip.h>            /* VMS string descriptors */
+extern int SYS$QIOW(), SYS$ASSIGN();
+int LIB$INIT_TIMER(), LIB$SHOW_TIMER();
+
+#include <string.h>             /* from ssltest.c */
+#include <errno.h>
+
+#include "e_os.h"
+
+#include <openssl/buffer.h>
+#include <openssl/x509.h>
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+
+int MS_CALLBACK verify_callback(int ok, X509 *xs, X509 *xi, int depth,
+                                int error);
+BIO *bio_err = NULL;
+BIO *bio_stdout = NULL;
+BIO_METHOD *BIO_s_rtcp();
+
+static char *cipher = NULL;
+int verbose = 1;
+#ifdef FIONBIO
+static int s_nbio = 0;
+#endif
+#define TEST_SERVER_CERT "SSL_SERVER_CERTIFICATE"
+/*************************************************************************/
+/* Should have member alignment inhibited */
+struct rpc_msg {
+    /* 'A'-app data. 'R'-remote client 'G'-global */
+    char channel;
+    /* 'G'-get, 'P'-put, 'C'-confirm, 'X'-close */
+    char function;
+    /* Amount of data returned or max to return */
+    unsigned short int length;
+    /* variable data */
+    char data[4092];
+};
+#define RPC_HDR_SIZE (sizeof(struct rpc_msg) - 4092)
+
+static $DESCRIPTOR(sysnet, "SYS$NET");
+typedef unsigned short io_channel;
+
+struct io_status {
+    unsigned short status;
+    unsigned short count;
+    unsigned long stsval;
+};
+int doit(io_channel chan, SSL_CTX *s_ctx);
+/*****************************************************************************/
+/*
+ * Decnet I/O routines.
+ */
+static int get(io_channel chan, char *buffer, int maxlen, int *length)
+{
+    int status;
+    struct io_status iosb;
+    status = SYS$QIOW(0, chan, IO$_READVBLK, &iosb, 0, 0,
+                      buffer, maxlen, 0, 0, 0, 0);
+    if ((status & 1) == 1)
+        status = iosb.status;
+    if ((status & 1) == 1)
+        *length = iosb.count;
+    return status;
+}
+
+static int put(io_channel chan, char *buffer, int length)
+{
+    int status;
+    struct io_status iosb;
+    status = SYS$QIOW(0, chan, IO$_WRITEVBLK, &iosb, 0, 0,
+                      buffer, length, 0, 0, 0, 0);
+    if ((status & 1) == 1)
+        status = iosb.status;
+    return status;
+}
+
+/***************************************************************************/
+/*
+ * Handle operations on the 'G' channel.
+ */
+static int general_request(io_channel chan, struct rpc_msg *msg, int length)
+{
+    return 48;
+}
+
+/***************************************************************************/
+int main(int argc, char **argv)
+{
+    int status, length;
+    io_channel chan;
+    struct rpc_msg msg;
+
+    char *CApath = NULL, *CAfile = NULL;
+    int badop = 0;
+    int ret = 1;
+    int client_auth = 0;
+    int server_auth = 0;
+    SSL_CTX *s_ctx = NULL;
+    /*
+     * Confirm logical link with initiating client.
+     */
+    LIB$INIT_TIMER();
+    status = SYS$ASSIGN(&sysnet, &chan, 0, 0, 0);
+    printf("status of assign to SYS$NET: %d\n", status);
+    /*
+     * Initialize standard out and error files.
+     */
+    if (bio_err == NULL)
+        if ((bio_err = BIO_new(BIO_s_file())) != NULL)
+            BIO_set_fp(bio_err, stderr, BIO_NOCLOSE);
+    if (bio_stdout == NULL)
+        if ((bio_stdout = BIO_new(BIO_s_file())) != NULL)
+            BIO_set_fp(bio_stdout, stdout, BIO_NOCLOSE);
+    /*
+     * get the preferred cipher list and other initialization
+     */
+    if (cipher == NULL)
+        cipher = getenv("SSL_CIPHER");
+    printf("cipher list: %s\n", cipher ? cipher : "{undefined}");
+
+    SSL_load_error_strings();
+    OpenSSL_add_all_algorithms();
+
+    /*
+     * DRM, this was the original, but there is no such thing as SSLv2()
+     * s_ctx=SSL_CTX_new(SSLv2());
+     */
+    s_ctx = SSL_CTX_new(SSLv2_server_method());
+
+    if (s_ctx == NULL)
+        goto end;
+
+    SSL_CTX_use_certificate_file(s_ctx, TEST_SERVER_CERT, SSL_FILETYPE_PEM);
+    SSL_CTX_use_RSAPrivateKey_file(s_ctx, TEST_SERVER_CERT, SSL_FILETYPE_PEM);
+    printf("Loaded server certificate: '%s'\n", TEST_SERVER_CERT);
+
+    /*
+     * Take commands from client until bad status.
+     */
+    LIB$SHOW_TIMER();
+    status = doit(chan, s_ctx);
+    LIB$SHOW_TIMER();
+    /*
+     * do final cleanup and exit.
+     */
+ end:
+    if (s_ctx != NULL)
+        SSL_CTX_free(s_ctx);
+    LIB$SHOW_TIMER();
+    return 1;
+}
+
+int doit(io_channel chan, SSL_CTX *s_ctx)
+{
+    int status, length, link_state;
+    struct rpc_msg msg;
+
+    SSL *s_ssl = NULL;
+    BIO *c_to_s = NULL;
+    BIO *s_to_c = NULL;
+    BIO *c_bio = NULL;
+    BIO *s_bio = NULL;
+    int i;
+    int done = 0;
+
+    s_ssl = SSL_new(s_ctx);
+    if (s_ssl == NULL)
+        goto err;
+
+    c_to_s = BIO_new(BIO_s_rtcp());
+    s_to_c = BIO_new(BIO_s_rtcp());
+    if ((s_to_c == NULL) || (c_to_s == NULL))
+        goto err;
+/*- original, DRM 24-SEP-1997
+    BIO_set_fd ( c_to_s, "", chan );
+    BIO_set_fd ( s_to_c, "", chan );
+*/
+    BIO_set_fd(c_to_s, 0, chan);
+    BIO_set_fd(s_to_c, 0, chan);
+
+    c_bio = BIO_new(BIO_f_ssl());
+    s_bio = BIO_new(BIO_f_ssl());
+    if ((c_bio == NULL) || (s_bio == NULL))
+        goto err;
+
+    SSL_set_accept_state(s_ssl);
+    SSL_set_bio(s_ssl, c_to_s, s_to_c);
+    BIO_set_ssl(s_bio, s_ssl, BIO_CLOSE);
+
+    /* We can always do writes */
+    printf("Begin doit main loop\n");
+    /*
+     * Link states: 0-idle, 1-read pending, 2-write pending, 3-closed.
+     */
+    for (link_state = 0; link_state < 3;) {
+        /*
+         * Wait for remote end to request data action on A channel.
+         */
+        while (link_state == 0) {
+            status = get(chan, (char *)&msg, sizeof(msg), &length);
+            if ((status & 1) == 0) {
+                printf("Error in main loop get: %d\n", status);
+                link_state = 3;
+                break;
+            }
+            if (length < RPC_HDR_SIZE) {
+                printf("Error in main loop get size: %d\n", length);
+                break;
+                link_state = 3;
+            }
+            if (msg.channel != 'A') {
+                printf("Error in main loop, unexpected channel: %c\n",
+                       msg.channel);
+                break;
+                link_state = 3;
+            }
+            if (msg.function == 'G') {
+                link_state = 1;
+            } else if (msg.function == 'P') {
+                link_state = 2; /* write pending */
+            } else if (msg.function == 'X') {
+                link_state = 3;
+            } else {
+                link_state = 3;
+            }
+        }
+        if (link_state == 1) {
+            i = BIO_read(s_bio, msg.data, msg.length);
+            if (i < 0)
+                link_state = 3;
+            else {
+                msg.channel = 'A';
+                msg.function = 'C'; /* confirm */
+                msg.length = i;
+                status = put(chan, (char *)&msg, i + RPC_HDR_SIZE);
+                if ((status & 1) == 0)
+                    break;
+                link_state = 0;
+            }
+        } else if (link_state == 2) {
+            i = BIO_write(s_bio, msg.data, msg.length);
+            if (i < 0)
+                link_state = 3;
+            else {
+                msg.channel = 'A';
+                msg.function = 'C'; /* confirm */
+                msg.length = 0;
+                status = put(chan, (char *)&msg, RPC_HDR_SIZE);
+                if ((status & 1) == 0)
+                    break;
+                link_state = 0;
+            }
+        }
+    }
+    fprintf(stdout, "DONE\n");
+ err:
+    /*
+     * We have to set the BIO's to NULL otherwise they will be free()ed
+     * twice.  Once when th s_ssl is SSL_free()ed and again when c_ssl is
+     * SSL_free()ed. This is a hack required because s_ssl and c_ssl are
+     * sharing the same BIO structure and SSL_set_bio() and SSL_free()
+     * automatically BIO_free non NULL entries. You should not normally do
+     * this or be required to do this
+     */
+    s_ssl->rbio = NULL;
+    s_ssl->wbio = NULL;
+
+    if (c_to_s != NULL)
+        BIO_free(c_to_s);
+    if (s_to_c != NULL)
+        BIO_free(s_to_c);
+    if (c_bio != NULL)
+        BIO_free(c_bio);
+    if (s_bio != NULL)
+        BIO_free(s_bio);
+    return (0);
+}

openssl-1.0.2f/ssl/ssl_txt.c

@@ -0,0 +1,262 @@
+/* ssl/ssl_txt.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright 2005 Nokia. All rights reserved.
+ *
+ * The portions of the attached software ("Contribution") is developed by
+ * Nokia Corporation and is licensed pursuant to the OpenSSL open source
+ * license.
+ *
+ * The Contribution, originally written by Mika Kousa and Pasi Eronen of
+ * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
+ * support (see RFC 4279) to OpenSSL.
+ *
+ * No patent licenses or other rights except those expressly stated in
+ * the OpenSSL open source license shall be deemed granted or received
+ * expressly, by implication, estoppel, or otherwise.
+ *
+ * No assurances are provided by Nokia that the Contribution does not
+ * infringe the patent or other intellectual property rights of any third
+ * party or that the license provides you with all the necessary rights
+ * to make use of the Contribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
+ * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
+ * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
+ * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
+ * OTHERWISE.
+ */
+
+#include <stdio.h>
+#include <openssl/buffer.h>
+#include "ssl_locl.h"
+
+#ifndef OPENSSL_NO_FP_API
+int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x)
+{
+    BIO *b;
+    int ret;
+
+    if ((b = BIO_new(BIO_s_file_internal())) == NULL) {
+        SSLerr(SSL_F_SSL_SESSION_PRINT_FP, ERR_R_BUF_LIB);
+        return (0);
+    }
+    BIO_set_fp(b, fp, BIO_NOCLOSE);
+    ret = SSL_SESSION_print(b, x);
+    BIO_free(b);
+    return (ret);
+}
+#endif
+
+int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
+{
+    unsigned int i;
+    const char *s;
+
+    if (x == NULL)
+        goto err;
+    if (BIO_puts(bp, "SSL-Session:\n") <= 0)
+        goto err;
+    if (x->ssl_version == SSL2_VERSION)
+        s = "SSLv2";
+    else if (x->ssl_version == SSL3_VERSION)
+        s = "SSLv3";
+    else if (x->ssl_version == TLS1_2_VERSION)
+        s = "TLSv1.2";
+    else if (x->ssl_version == TLS1_1_VERSION)
+        s = "TLSv1.1";
+    else if (x->ssl_version == TLS1_VERSION)
+        s = "TLSv1";
+    else if (x->ssl_version == DTLS1_VERSION)
+        s = "DTLSv1";
+    else if (x->ssl_version == DTLS1_2_VERSION)
+        s = "DTLSv1.2";
+    else if (x->ssl_version == DTLS1_BAD_VER)
+        s = "DTLSv1-bad";
+    else
+        s = "unknown";
+    if (BIO_printf(bp, "    Protocol  : %s\n", s) <= 0)
+        goto err;
+
+    if (x->cipher == NULL) {
+        if (((x->cipher_id) & 0xff000000) == 0x02000000) {
+            if (BIO_printf
+                (bp, "    Cipher    : %06lX\n", x->cipher_id & 0xffffff) <= 0)
+                goto err;
+        } else {
+            if (BIO_printf
+                (bp, "    Cipher    : %04lX\n", x->cipher_id & 0xffff) <= 0)
+                goto err;
+        }
+    } else {
+        if (BIO_printf
+            (bp, "    Cipher    : %s\n",
+             ((x->cipher == NULL) ? "unknown" : x->cipher->name)) <= 0)
+            goto err;
+    }
+    if (BIO_puts(bp, "    Session-ID: ") <= 0)
+        goto err;
+    for (i = 0; i < x->session_id_length; i++) {
+        if (BIO_printf(bp, "%02X", x->session_id[i]) <= 0)
+            goto err;
+    }
+    if (BIO_puts(bp, "\n    Session-ID-ctx: ") <= 0)
+        goto err;
+    for (i = 0; i < x->sid_ctx_length; i++) {
+        if (BIO_printf(bp, "%02X", x->sid_ctx[i]) <= 0)
+            goto err;
+    }
+    if (BIO_puts(bp, "\n    Master-Key: ") <= 0)
+        goto err;
+    for (i = 0; i < (unsigned int)x->master_key_length; i++) {
+        if (BIO_printf(bp, "%02X", x->master_key[i]) <= 0)
+            goto err;
+    }
+    if (BIO_puts(bp, "\n    Key-Arg   : ") <= 0)
+        goto err;
+    if (x->key_arg_length == 0) {
+        if (BIO_puts(bp, "None") <= 0)
+            goto err;
+    } else
+        for (i = 0; i < x->key_arg_length; i++) {
+            if (BIO_printf(bp, "%02X", x->key_arg[i]) <= 0)
+                goto err;
+        }
+#ifndef OPENSSL_NO_KRB5
+    if (BIO_puts(bp, "\n    Krb5 Principal: ") <= 0)
+        goto err;
+    if (x->krb5_client_princ_len == 0) {
+        if (BIO_puts(bp, "None") <= 0)
+            goto err;
+    } else
+        for (i = 0; i < x->krb5_client_princ_len; i++) {
+            if (BIO_printf(bp, "%02X", x->krb5_client_princ[i]) <= 0)
+                goto err;
+        }
+#endif                          /* OPENSSL_NO_KRB5 */
+#ifndef OPENSSL_NO_PSK
+    if (BIO_puts(bp, "\n    PSK identity: ") <= 0)
+        goto err;
+    if (BIO_printf(bp, "%s", x->psk_identity ? x->psk_identity : "None") <= 0)
+        goto err;
+    if (BIO_puts(bp, "\n    PSK identity hint: ") <= 0)
+        goto err;
+    if (BIO_printf
+        (bp, "%s", x->psk_identity_hint ? x->psk_identity_hint : "None") <= 0)
+        goto err;
+#endif
+#ifndef OPENSSL_NO_SRP
+    if (BIO_puts(bp, "\n    SRP username: ") <= 0)
+        goto err;
+    if (BIO_printf(bp, "%s", x->srp_username ? x->srp_username : "None") <= 0)
+        goto err;
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+    if (x->tlsext_tick_lifetime_hint) {
+        if (BIO_printf(bp,
+                       "\n    TLS session ticket lifetime hint: %ld (seconds)",
+                       x->tlsext_tick_lifetime_hint) <= 0)
+            goto err;
+    }
+    if (x->tlsext_tick) {
+        if (BIO_puts(bp, "\n    TLS session ticket:\n") <= 0)
+            goto err;
+        if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4)
+            <= 0)
+            goto err;
+    }
+#endif
+
+#ifndef OPENSSL_NO_COMP
+    if (x->compress_meth != 0) {
+        SSL_COMP *comp = NULL;
+
+        ssl_cipher_get_evp(x, NULL, NULL, NULL, NULL, &comp);
+        if (comp == NULL) {
+            if (BIO_printf(bp, "\n    Compression: %d", x->compress_meth) <=
+                0)
+                goto err;
+        } else {
+            if (BIO_printf
+                (bp, "\n    Compression: %d (%s)", comp->id,
+                 comp->method->name) <= 0)
+                goto err;
+        }
+    }
+#endif
+    if (x->time != 0L) {
+        if (BIO_printf(bp, "\n    Start Time: %ld", x->time) <= 0)
+            goto err;
+    }
+    if (x->timeout != 0L) {
+        if (BIO_printf(bp, "\n    Timeout   : %ld (sec)", x->timeout) <= 0)
+            goto err;
+    }
+    if (BIO_puts(bp, "\n") <= 0)
+        goto err;
+
+    if (BIO_puts(bp, "    Verify return code: ") <= 0)
+        goto err;
+    if (BIO_printf(bp, "%ld (%s)\n", x->verify_result,
+                   X509_verify_cert_error_string(x->verify_result)) <= 0)
+        goto err;
+
+    return (1);
+ err:
+    return (0);
+}

openssl-1.0.2f/ssl/ssl_utst.c

@@ -0,0 +1,72 @@
+/* ssl_utst.c */
+/*
+ * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2014 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ */
+
+#include "ssl_locl.h"
+
+#ifndef OPENSSL_NO_UNIT_TEST
+
+static const struct openssl_ssl_test_functions ssl_test_functions = {
+    ssl_init_wbio_buffer,
+    ssl3_setup_buffers,
+    tls1_process_heartbeat,
+    dtls1_process_heartbeat
+};
+
+const struct openssl_ssl_test_functions *SSL_test_functions(void)
+{
+    return &ssl_test_functions;
+}
+
+#endif

openssl-1.0.2f/ssl/t1_clnt.c

@@ -0,0 +1,90 @@
+/* ssl/t1_clnt.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#include <stdio.h>
+#include "ssl_locl.h"
+#include <openssl/buffer.h>
+#include <openssl/rand.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+
+static const SSL_METHOD *tls1_get_client_method(int ver);
+static const SSL_METHOD *tls1_get_client_method(int ver)
+{
+    if (ver == TLS1_2_VERSION)
+        return TLSv1_2_client_method();
+    if (ver == TLS1_1_VERSION)
+        return TLSv1_1_client_method();
+    if (ver == TLS1_VERSION)
+        return TLSv1_client_method();
+    return NULL;
+}
+
+IMPLEMENT_tls_meth_func(TLS1_2_VERSION, TLSv1_2_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect,
+                        tls1_get_client_method, TLSv1_2_enc_data)
+
+    IMPLEMENT_tls_meth_func(TLS1_1_VERSION, TLSv1_1_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect,
+                        tls1_get_client_method, TLSv1_1_enc_data)
+
+    IMPLEMENT_tls_meth_func(TLS1_VERSION, TLSv1_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect, tls1_get_client_method, TLSv1_enc_data)