Line data Source code
1 : /* ssl/ssl_asn1.c */
2 : /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 : * All rights reserved.
4 : *
5 : * This package is an SSL implementation written
6 : * by Eric Young (eay@cryptsoft.com).
7 : * The implementation was written so as to conform with Netscapes SSL.
8 : *
9 : * This library is free for commercial and non-commercial use as long as
10 : * the following conditions are aheared to. The following conditions
11 : * apply to all code found in this distribution, be it the RC4, RSA,
12 : * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 : * included with this distribution is covered by the same copyright terms
14 : * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 : *
16 : * Copyright remains Eric Young's, and as such any Copyright notices in
17 : * the code are not to be removed.
18 : * If this package is used in a product, Eric Young should be given attribution
19 : * as the author of the parts of the library used.
20 : * This can be in the form of a textual message at program startup or
21 : * in documentation (online or textual) provided with the package.
22 : *
23 : * Redistribution and use in source and binary forms, with or without
24 : * modification, are permitted provided that the following conditions
25 : * are met:
26 : * 1. Redistributions of source code must retain the copyright
27 : * notice, this list of conditions and the following disclaimer.
28 : * 2. Redistributions in binary form must reproduce the above copyright
29 : * notice, this list of conditions and the following disclaimer in the
30 : * documentation and/or other materials provided with the distribution.
31 : * 3. All advertising materials mentioning features or use of this software
32 : * must display the following acknowledgement:
33 : * "This product includes cryptographic software written by
34 : * Eric Young (eay@cryptsoft.com)"
35 : * The word 'cryptographic' can be left out if the rouines from the library
36 : * being used are not cryptographic related :-).
37 : * 4. If you include any Windows specific code (or a derivative thereof) from
38 : * the apps directory (application code) you must include an acknowledgement:
39 : * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 : *
41 : * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 : * SUCH DAMAGE.
52 : *
53 : * The licence and distribution terms for any publically available version or
54 : * derivative of this code cannot be changed. i.e. this code cannot simply be
55 : * copied and put under another distribution licence
56 : * [including the GNU Public Licence.]
57 : */
58 : /* ====================================================================
59 : * Copyright 2005 Nokia. All rights reserved.
60 : *
61 : * The portions of the attached software ("Contribution") is developed by
62 : * Nokia Corporation and is licensed pursuant to the OpenSSL open source
63 : * license.
64 : *
65 : * The Contribution, originally written by Mika Kousa and Pasi Eronen of
66 : * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
67 : * support (see RFC 4279) to OpenSSL.
68 : *
69 : * No patent licenses or other rights except those expressly stated in
70 : * the OpenSSL open source license shall be deemed granted or received
71 : * expressly, by implication, estoppel, or otherwise.
72 : *
73 : * No assurances are provided by Nokia that the Contribution does not
74 : * infringe the patent or other intellectual property rights of any third
75 : * party or that the license provides you with all the necessary rights
76 : * to make use of the Contribution.
77 : *
78 : * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
79 : * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
80 : * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
81 : * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
82 : * OTHERWISE.
83 : */
84 :
85 : #include <stdio.h>
86 : #include <stdlib.h>
87 : #include "ssl_locl.h"
88 : #include <openssl/asn1_mac.h>
89 : #include <openssl/objects.h>
90 : #include <openssl/x509.h>
91 :
92 : typedef struct ssl_session_asn1_st {
93 : ASN1_INTEGER version;
94 : ASN1_INTEGER ssl_version;
95 : ASN1_OCTET_STRING cipher;
96 : ASN1_OCTET_STRING comp_id;
97 : ASN1_OCTET_STRING master_key;
98 : ASN1_OCTET_STRING session_id;
99 : ASN1_OCTET_STRING session_id_context;
100 : ASN1_OCTET_STRING key_arg;
101 : #ifndef OPENSSL_NO_KRB5
102 : ASN1_OCTET_STRING krb5_princ;
103 : #endif /* OPENSSL_NO_KRB5 */
104 : ASN1_INTEGER time;
105 : ASN1_INTEGER timeout;
106 : ASN1_INTEGER verify_result;
107 : #ifndef OPENSSL_NO_TLSEXT
108 : ASN1_OCTET_STRING tlsext_hostname;
109 : ASN1_INTEGER tlsext_tick_lifetime;
110 : ASN1_OCTET_STRING tlsext_tick;
111 : #endif /* OPENSSL_NO_TLSEXT */
112 : #ifndef OPENSSL_NO_PSK
113 : ASN1_OCTET_STRING psk_identity_hint;
114 : ASN1_OCTET_STRING psk_identity;
115 : #endif /* OPENSSL_NO_PSK */
116 : #ifndef OPENSSL_NO_SRP
117 : ASN1_OCTET_STRING srp_username;
118 : #endif /* OPENSSL_NO_SRP */
119 : } SSL_SESSION_ASN1;
120 :
121 1468 : int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
122 : {
123 : #define LSIZE2 (sizeof(long)*2)
124 : int v1 = 0, v2 = 0, v3 = 0, v4 = 0, v5 = 0, v7 = 0, v8 = 0;
125 : unsigned char buf[4], ibuf1[LSIZE2], ibuf2[LSIZE2];
126 : unsigned char ibuf3[LSIZE2], ibuf4[LSIZE2], ibuf5[LSIZE2];
127 : #ifndef OPENSSL_NO_TLSEXT
128 : int v6 = 0, v9 = 0, v10 = 0;
129 : unsigned char ibuf6[LSIZE2];
130 : #endif
131 : #ifndef OPENSSL_NO_COMP
132 : unsigned char cbuf;
133 : int v11 = 0;
134 : #endif
135 : #ifndef OPENSSL_NO_SRP
136 : int v12 = 0;
137 : #endif
138 : long l;
139 : SSL_SESSION_ASN1 a;
140 1468 : M_ASN1_I2D_vars(in);
141 :
142 1468 : if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
143 : return (0);
144 :
145 : /*
146 : * Note that I cheat in the following 2 assignments. I know that if the
147 : * ASN1_INTEGER passed to ASN1_INTEGER_set is > sizeof(long)+1, the
148 : * buffer will not be re-OPENSSL_malloc()ed. This is a bit evil but makes
149 : * things simple, no dynamic allocation to clean up :-)
150 : */
151 1468 : a.version.length = LSIZE2;
152 1468 : a.version.type = V_ASN1_INTEGER;
153 1468 : a.version.data = ibuf1;
154 1468 : ASN1_INTEGER_set(&(a.version), SSL_SESSION_ASN1_VERSION);
155 :
156 1468 : a.ssl_version.length = LSIZE2;
157 1468 : a.ssl_version.type = V_ASN1_INTEGER;
158 1468 : a.ssl_version.data = ibuf2;
159 1468 : ASN1_INTEGER_set(&(a.ssl_version), in->ssl_version);
160 :
161 1468 : a.cipher.type = V_ASN1_OCTET_STRING;
162 1468 : a.cipher.data = buf;
163 :
164 1468 : if (in->cipher == NULL)
165 734 : l = in->cipher_id;
166 : else
167 734 : l = in->cipher->id;
168 1468 : if (in->ssl_version == SSL2_VERSION) {
169 0 : a.cipher.length = 3;
170 0 : buf[0] = ((unsigned char)(l >> 16L)) & 0xff;
171 0 : buf[1] = ((unsigned char)(l >> 8L)) & 0xff;
172 0 : buf[2] = ((unsigned char)(l)) & 0xff;
173 : } else {
174 1468 : a.cipher.length = 2;
175 1468 : buf[0] = ((unsigned char)(l >> 8L)) & 0xff;
176 1468 : buf[1] = ((unsigned char)(l)) & 0xff;
177 : }
178 :
179 : #ifndef OPENSSL_NO_COMP
180 1468 : if (in->compress_meth) {
181 0 : cbuf = (unsigned char)in->compress_meth;
182 0 : a.comp_id.length = 1;
183 0 : a.comp_id.type = V_ASN1_OCTET_STRING;
184 0 : a.comp_id.data = &cbuf;
185 : }
186 : #endif
187 :
188 1468 : a.master_key.length = in->master_key_length;
189 1468 : a.master_key.type = V_ASN1_OCTET_STRING;
190 1468 : a.master_key.data = in->master_key;
191 :
192 1468 : a.session_id.length = in->session_id_length;
193 1468 : a.session_id.type = V_ASN1_OCTET_STRING;
194 1468 : a.session_id.data = in->session_id;
195 :
196 1468 : a.session_id_context.length = in->sid_ctx_length;
197 1468 : a.session_id_context.type = V_ASN1_OCTET_STRING;
198 1468 : a.session_id_context.data = in->sid_ctx;
199 :
200 1468 : a.key_arg.length = in->key_arg_length;
201 1468 : a.key_arg.type = V_ASN1_OCTET_STRING;
202 1468 : a.key_arg.data = in->key_arg;
203 :
204 : #ifndef OPENSSL_NO_KRB5
205 : if (in->krb5_client_princ_len) {
206 : a.krb5_princ.length = in->krb5_client_princ_len;
207 : a.krb5_princ.type = V_ASN1_OCTET_STRING;
208 : a.krb5_princ.data = in->krb5_client_princ;
209 : }
210 : #endif /* OPENSSL_NO_KRB5 */
211 :
212 1468 : if (in->time != 0L) {
213 1468 : a.time.length = LSIZE2;
214 1468 : a.time.type = V_ASN1_INTEGER;
215 1468 : a.time.data = ibuf3;
216 1468 : ASN1_INTEGER_set(&(a.time), in->time);
217 : }
218 :
219 1468 : if (in->timeout != 0L) {
220 1468 : a.timeout.length = LSIZE2;
221 1468 : a.timeout.type = V_ASN1_INTEGER;
222 1468 : a.timeout.data = ibuf4;
223 1468 : ASN1_INTEGER_set(&(a.timeout), in->timeout);
224 : }
225 :
226 1468 : if (in->verify_result != X509_V_OK) {
227 0 : a.verify_result.length = LSIZE2;
228 0 : a.verify_result.type = V_ASN1_INTEGER;
229 0 : a.verify_result.data = ibuf5;
230 0 : ASN1_INTEGER_set(&a.verify_result, in->verify_result);
231 : }
232 : #ifndef OPENSSL_NO_TLSEXT
233 1468 : if (in->tlsext_hostname) {
234 1468 : a.tlsext_hostname.length = strlen(in->tlsext_hostname);
235 1468 : a.tlsext_hostname.type = V_ASN1_OCTET_STRING;
236 1468 : a.tlsext_hostname.data = (unsigned char *)in->tlsext_hostname;
237 : }
238 1468 : if (in->tlsext_tick) {
239 0 : a.tlsext_tick.length = in->tlsext_ticklen;
240 0 : a.tlsext_tick.type = V_ASN1_OCTET_STRING;
241 0 : a.tlsext_tick.data = (unsigned char *)in->tlsext_tick;
242 : }
243 1468 : if (in->tlsext_tick_lifetime_hint > 0) {
244 0 : a.tlsext_tick_lifetime.length = LSIZE2;
245 0 : a.tlsext_tick_lifetime.type = V_ASN1_INTEGER;
246 0 : a.tlsext_tick_lifetime.data = ibuf6;
247 0 : ASN1_INTEGER_set(&a.tlsext_tick_lifetime,
248 : in->tlsext_tick_lifetime_hint);
249 : }
250 : #endif /* OPENSSL_NO_TLSEXT */
251 : #ifndef OPENSSL_NO_PSK
252 1468 : if (in->psk_identity_hint) {
253 0 : a.psk_identity_hint.length = strlen(in->psk_identity_hint);
254 0 : a.psk_identity_hint.type = V_ASN1_OCTET_STRING;
255 0 : a.psk_identity_hint.data = (unsigned char *)(in->psk_identity_hint);
256 : }
257 1468 : if (in->psk_identity) {
258 0 : a.psk_identity.length = strlen(in->psk_identity);
259 0 : a.psk_identity.type = V_ASN1_OCTET_STRING;
260 0 : a.psk_identity.data = (unsigned char *)(in->psk_identity);
261 : }
262 : #endif /* OPENSSL_NO_PSK */
263 : #ifndef OPENSSL_NO_SRP
264 1468 : if (in->srp_username) {
265 0 : a.srp_username.length = strlen(in->srp_username);
266 0 : a.srp_username.type = V_ASN1_OCTET_STRING;
267 0 : a.srp_username.data = (unsigned char *)(in->srp_username);
268 : }
269 : #endif /* OPENSSL_NO_SRP */
270 :
271 1468 : M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER);
272 1468 : M_ASN1_I2D_len(&(a.ssl_version), i2d_ASN1_INTEGER);
273 1468 : M_ASN1_I2D_len(&(a.cipher), i2d_ASN1_OCTET_STRING);
274 1468 : M_ASN1_I2D_len(&(a.session_id), i2d_ASN1_OCTET_STRING);
275 1468 : M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING);
276 : #ifndef OPENSSL_NO_KRB5
277 : if (in->krb5_client_princ_len)
278 : M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
279 : #endif /* OPENSSL_NO_KRB5 */
280 1468 : if (in->key_arg_length > 0)
281 0 : M_ASN1_I2D_len_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING);
282 1468 : if (in->time != 0L)
283 1468 : M_ASN1_I2D_len_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
284 1468 : if (in->timeout != 0L)
285 1468 : M_ASN1_I2D_len_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
286 1468 : if (in->peer != NULL)
287 0 : M_ASN1_I2D_len_EXP_opt(in->peer, i2d_X509, 3, v3);
288 1468 : M_ASN1_I2D_len_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4,
289 : v4);
290 1468 : if (in->verify_result != X509_V_OK)
291 0 : M_ASN1_I2D_len_EXP_opt(&(a.verify_result), i2d_ASN1_INTEGER, 5, v5);
292 :
293 : #ifndef OPENSSL_NO_TLSEXT
294 1468 : if (in->tlsext_tick_lifetime_hint > 0)
295 0 : M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9,
296 : v9);
297 1468 : if (in->tlsext_tick)
298 0 : M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10,
299 : v10);
300 1468 : if (in->tlsext_hostname)
301 1468 : M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6,
302 : v6);
303 : # ifndef OPENSSL_NO_COMP
304 1468 : if (in->compress_meth)
305 0 : M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
306 : # endif
307 : #endif /* OPENSSL_NO_TLSEXT */
308 : #ifndef OPENSSL_NO_PSK
309 1468 : if (in->psk_identity_hint)
310 0 : M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,
311 : 7, v7);
312 1468 : if (in->psk_identity)
313 0 : M_ASN1_I2D_len_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8,
314 : v8);
315 : #endif /* OPENSSL_NO_PSK */
316 : #ifndef OPENSSL_NO_SRP
317 1468 : if (in->srp_username)
318 0 : M_ASN1_I2D_len_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12,
319 : v12);
320 : #endif /* OPENSSL_NO_SRP */
321 :
322 1468 : M_ASN1_I2D_seq_total();
323 :
324 734 : M_ASN1_I2D_put(&(a.version), i2d_ASN1_INTEGER);
325 734 : M_ASN1_I2D_put(&(a.ssl_version), i2d_ASN1_INTEGER);
326 734 : M_ASN1_I2D_put(&(a.cipher), i2d_ASN1_OCTET_STRING);
327 734 : M_ASN1_I2D_put(&(a.session_id), i2d_ASN1_OCTET_STRING);
328 734 : M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING);
329 : #ifndef OPENSSL_NO_KRB5
330 : if (in->krb5_client_princ_len)
331 : M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
332 : #endif /* OPENSSL_NO_KRB5 */
333 734 : if (in->key_arg_length > 0)
334 0 : M_ASN1_I2D_put_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING, 0);
335 734 : if (in->time != 0L)
336 734 : M_ASN1_I2D_put_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
337 734 : if (in->timeout != 0L)
338 734 : M_ASN1_I2D_put_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
339 734 : if (in->peer != NULL)
340 0 : M_ASN1_I2D_put_EXP_opt(in->peer, i2d_X509, 3, v3);
341 734 : M_ASN1_I2D_put_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4,
342 : v4);
343 734 : if (in->verify_result != X509_V_OK)
344 0 : M_ASN1_I2D_put_EXP_opt(&a.verify_result, i2d_ASN1_INTEGER, 5, v5);
345 : #ifndef OPENSSL_NO_TLSEXT
346 734 : if (in->tlsext_hostname)
347 734 : M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6,
348 : v6);
349 : #endif /* OPENSSL_NO_TLSEXT */
350 : #ifndef OPENSSL_NO_PSK
351 734 : if (in->psk_identity_hint)
352 0 : M_ASN1_I2D_put_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,
353 : 7, v7);
354 734 : if (in->psk_identity)
355 0 : M_ASN1_I2D_put_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8,
356 : v8);
357 : #endif /* OPENSSL_NO_PSK */
358 : #ifndef OPENSSL_NO_TLSEXT
359 734 : if (in->tlsext_tick_lifetime_hint > 0)
360 0 : M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9,
361 : v9);
362 734 : if (in->tlsext_tick)
363 0 : M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10,
364 : v10);
365 : #endif /* OPENSSL_NO_TLSEXT */
366 : #ifndef OPENSSL_NO_COMP
367 734 : if (in->compress_meth)
368 0 : M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
369 : #endif
370 : #ifndef OPENSSL_NO_SRP
371 734 : if (in->srp_username)
372 0 : M_ASN1_I2D_put_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12,
373 : v12);
374 : #endif /* OPENSSL_NO_SRP */
375 734 : M_ASN1_I2D_finish();
376 : }
377 :
378 367 : SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
379 : long length)
380 : {
381 : int ssl_version = 0, i;
382 : long id;
383 : ASN1_INTEGER ai, *aip;
384 : ASN1_OCTET_STRING os, *osp;
385 367 : M_ASN1_D2I_vars(a, SSL_SESSION *, SSL_SESSION_new);
386 :
387 367 : aip = &ai;
388 367 : osp = &os;
389 :
390 367 : M_ASN1_D2I_Init();
391 367 : M_ASN1_D2I_start_sequence();
392 :
393 367 : ai.data = NULL;
394 367 : ai.length = 0;
395 367 : M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
396 367 : if (ai.data != NULL) {
397 367 : OPENSSL_free(ai.data);
398 367 : ai.data = NULL;
399 367 : ai.length = 0;
400 : }
401 :
402 : /* we don't care about the version right now :-) */
403 367 : M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
404 367 : ssl_version = (int)ASN1_INTEGER_get(aip);
405 367 : ret->ssl_version = ssl_version;
406 367 : if (ai.data != NULL) {
407 367 : OPENSSL_free(ai.data);
408 367 : ai.data = NULL;
409 367 : ai.length = 0;
410 : }
411 :
412 367 : os.data = NULL;
413 367 : os.length = 0;
414 367 : M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
415 367 : if (ssl_version == SSL2_VERSION) {
416 0 : if (os.length != 3) {
417 0 : c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
418 0 : c.line = __LINE__;
419 0 : goto err;
420 : }
421 0 : id = 0x02000000L |
422 0 : ((unsigned long)os.data[0] << 16L) |
423 0 : ((unsigned long)os.data[1] << 8L) | (unsigned long)os.data[2];
424 734 : } else if ((ssl_version >> 8) == SSL3_VERSION_MAJOR
425 367 : || (ssl_version >> 8) == DTLS1_VERSION_MAJOR
426 0 : || ssl_version == DTLS1_BAD_VER) {
427 367 : if (os.length != 2) {
428 0 : c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
429 0 : c.line = __LINE__;
430 0 : goto err;
431 : }
432 367 : id = 0x03000000L |
433 367 : ((unsigned long)os.data[0] << 8L) | (unsigned long)os.data[1];
434 : } else {
435 0 : c.error = SSL_R_UNKNOWN_SSL_VERSION;
436 0 : c.line = __LINE__;
437 0 : goto err;
438 : }
439 :
440 367 : ret->cipher = NULL;
441 367 : ret->cipher_id = id;
442 :
443 367 : M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
444 : if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR)
445 : i = SSL3_MAX_SSL_SESSION_ID_LENGTH;
446 : else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */
447 : i = SSL2_MAX_SSL_SESSION_ID_LENGTH;
448 :
449 367 : if (os.length > i)
450 0 : os.length = i;
451 367 : if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
452 0 : os.length = sizeof(ret->session_id);
453 :
454 367 : ret->session_id_length = os.length;
455 367 : OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
456 367 : memcpy(ret->session_id, os.data, os.length);
457 :
458 367 : M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
459 367 : if (os.length > SSL_MAX_MASTER_KEY_LENGTH)
460 0 : ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH;
461 : else
462 367 : ret->master_key_length = os.length;
463 367 : memcpy(ret->master_key, os.data, ret->master_key_length);
464 :
465 367 : os.length = 0;
466 :
467 : #ifndef OPENSSL_NO_KRB5
468 : os.length = 0;
469 : M_ASN1_D2I_get_opt(osp, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
470 : if (os.data) {
471 : if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH)
472 : ret->krb5_client_princ_len = 0;
473 : else
474 : ret->krb5_client_princ_len = os.length;
475 : memcpy(ret->krb5_client_princ, os.data, ret->krb5_client_princ_len);
476 : OPENSSL_free(os.data);
477 : os.data = NULL;
478 : os.length = 0;
479 : } else
480 : ret->krb5_client_princ_len = 0;
481 : #endif /* OPENSSL_NO_KRB5 */
482 :
483 367 : M_ASN1_D2I_get_IMP_opt(osp, d2i_ASN1_OCTET_STRING, 0,
484 : V_ASN1_OCTET_STRING);
485 367 : if (os.length > SSL_MAX_KEY_ARG_LENGTH)
486 0 : ret->key_arg_length = SSL_MAX_KEY_ARG_LENGTH;
487 : else
488 367 : ret->key_arg_length = os.length;
489 367 : memcpy(ret->key_arg, os.data, ret->key_arg_length);
490 367 : if (os.data != NULL)
491 367 : OPENSSL_free(os.data);
492 :
493 367 : ai.length = 0;
494 367 : M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 1);
495 367 : if (ai.data != NULL) {
496 367 : ret->time = ASN1_INTEGER_get(aip);
497 367 : OPENSSL_free(ai.data);
498 367 : ai.data = NULL;
499 367 : ai.length = 0;
500 : } else
501 0 : ret->time = (unsigned long)time(NULL);
502 :
503 367 : ai.length = 0;
504 367 : M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 2);
505 367 : if (ai.data != NULL) {
506 367 : ret->timeout = ASN1_INTEGER_get(aip);
507 367 : OPENSSL_free(ai.data);
508 367 : ai.data = NULL;
509 367 : ai.length = 0;
510 : } else
511 0 : ret->timeout = 3;
512 :
513 367 : if (ret->peer != NULL) {
514 0 : X509_free(ret->peer);
515 0 : ret->peer = NULL;
516 : }
517 367 : M_ASN1_D2I_get_EXP_opt(ret->peer, d2i_X509, 3);
518 :
519 367 : os.length = 0;
520 367 : os.data = NULL;
521 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 4);
522 :
523 367 : if (os.data != NULL) {
524 367 : if (os.length > SSL_MAX_SID_CTX_LENGTH) {
525 0 : c.error = SSL_R_BAD_LENGTH;
526 0 : c.line = __LINE__;
527 0 : goto err;
528 : } else {
529 367 : ret->sid_ctx_length = os.length;
530 367 : memcpy(ret->sid_ctx, os.data, os.length);
531 : }
532 367 : OPENSSL_free(os.data);
533 367 : os.data = NULL;
534 367 : os.length = 0;
535 : } else
536 0 : ret->sid_ctx_length = 0;
537 :
538 367 : ai.length = 0;
539 367 : M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 5);
540 367 : if (ai.data != NULL) {
541 0 : ret->verify_result = ASN1_INTEGER_get(aip);
542 0 : OPENSSL_free(ai.data);
543 0 : ai.data = NULL;
544 0 : ai.length = 0;
545 : } else
546 367 : ret->verify_result = X509_V_OK;
547 :
548 : #ifndef OPENSSL_NO_TLSEXT
549 367 : os.length = 0;
550 367 : os.data = NULL;
551 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 6);
552 367 : if (os.data) {
553 367 : ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
554 367 : OPENSSL_free(os.data);
555 367 : os.data = NULL;
556 367 : os.length = 0;
557 : } else
558 0 : ret->tlsext_hostname = NULL;
559 : #endif /* OPENSSL_NO_TLSEXT */
560 :
561 : #ifndef OPENSSL_NO_PSK
562 367 : os.length = 0;
563 367 : os.data = NULL;
564 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 7);
565 367 : if (os.data) {
566 0 : ret->psk_identity_hint = BUF_strndup((char *)os.data, os.length);
567 0 : OPENSSL_free(os.data);
568 0 : os.data = NULL;
569 0 : os.length = 0;
570 : } else
571 367 : ret->psk_identity_hint = NULL;
572 :
573 367 : os.length = 0;
574 367 : os.data = NULL;
575 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 8);
576 367 : if (os.data) {
577 0 : ret->psk_identity = BUF_strndup((char *)os.data, os.length);
578 0 : OPENSSL_free(os.data);
579 0 : os.data = NULL;
580 0 : os.length = 0;
581 : } else
582 367 : ret->psk_identity = NULL;
583 : #endif /* OPENSSL_NO_PSK */
584 :
585 : #ifndef OPENSSL_NO_TLSEXT
586 367 : ai.length = 0;
587 367 : M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 9);
588 367 : if (ai.data != NULL) {
589 0 : ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip);
590 0 : OPENSSL_free(ai.data);
591 0 : ai.data = NULL;
592 0 : ai.length = 0;
593 367 : } else if (ret->tlsext_ticklen && ret->session_id_length)
594 0 : ret->tlsext_tick_lifetime_hint = -1;
595 : else
596 367 : ret->tlsext_tick_lifetime_hint = 0;
597 367 : os.length = 0;
598 367 : os.data = NULL;
599 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 10);
600 367 : if (os.data) {
601 0 : ret->tlsext_tick = os.data;
602 0 : ret->tlsext_ticklen = os.length;
603 0 : os.data = NULL;
604 0 : os.length = 0;
605 : } else
606 367 : ret->tlsext_tick = NULL;
607 : #endif /* OPENSSL_NO_TLSEXT */
608 : #ifndef OPENSSL_NO_COMP
609 367 : os.length = 0;
610 367 : os.data = NULL;
611 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 11);
612 367 : if (os.data) {
613 0 : ret->compress_meth = os.data[0];
614 0 : OPENSSL_free(os.data);
615 0 : os.data = NULL;
616 : }
617 : #endif
618 :
619 : #ifndef OPENSSL_NO_SRP
620 367 : os.length = 0;
621 367 : os.data = NULL;
622 367 : M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 12);
623 367 : if (os.data) {
624 0 : ret->srp_username = BUF_strndup((char *)os.data, os.length);
625 0 : OPENSSL_free(os.data);
626 0 : os.data = NULL;
627 0 : os.length = 0;
628 : } else
629 367 : ret->srp_username = NULL;
630 : #endif /* OPENSSL_NO_SRP */
631 :
632 367 : M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION);
633 : }
|
