Todd Ouska
CyaSSL is an SSL library for devices like mbed.
Dependents: cyassl-client Sync
ssl.c
- Committer:
- toddouska
- Date:
- 2011-02-05
- Revision:
- 0:5045d2638c29
File content as of revision 0:5045d2638c29:
/* ssl.c
*
* Copyright (C) 2006-2009 Sawtooth Consulting Ltd.
*
* This file is part of CyaSSL.
*
* CyaSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* CyaSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
*/
#include "ssl.h"
#include "cyassl_int.h"
#include "cyassl_error.h"
#include "coding.h"
#ifdef OPENSSL_EXTRA
/* openssl headers begin */
#include "evp.h"
#include "hmac.h"
#include "crypto.h"
#include "des.h"
/* openssl headers end, cyassl internal headers next */
#include "ctc_hmac.h"
#include "random.h"
#include "des3.h"
#include "ctc_md4.h"
#include "coding.h"
#endif
#ifdef HAVE_ERRNO_H
#include <errno.h>
#endif
#define TRUE 1
#define FALSE 0
#ifndef min
static INLINE word32 min(word32 a, word32 b)
{
return a > b ? b : a;
}
#endif /* min */
SSL_CTX* SSL_CTX_new(SSL_METHOD* method)
{
SSL_CTX* ctx = (SSL_CTX*) XMALLOC(sizeof(SSL_CTX), 0, DYNAMIC_TYPE_CTX);
if (ctx)
InitSSL_Ctx(ctx, method);
return ctx;
}
void SSL_CTX_free(SSL_CTX* ctx)
{
if (ctx)
FreeSSL_Ctx(ctx);
}
SSL* SSL_new(SSL_CTX* ctx)
{
SSL* ssl = (SSL*) XMALLOC(sizeof(SSL), ctx->heap, DYNAMIC_TYPE_SSL);
if (ssl)
if (InitSSL(ssl, ctx) < 0) {
FreeSSL(ssl);
ssl = 0;
}
return ssl;
}
void SSL_free(SSL* ssl)
{
CYASSL_ENTER("SSL_free");
if (ssl)
FreeSSL(ssl);
CYASSL_LEAVE("SSL_free", 0);
}
int SSL_set_fd(SSL* ssl, int fd)
{
ssl->rfd = fd; /* not used directly to allow IO callbacks */
ssl->wfd = fd;
ssl->IOCB_ReadCtx = &ssl->rfd;
ssl->IOCB_WriteCtx = &ssl->wfd;
return SSL_SUCCESS;
}
int SSL_get_fd(const SSL* ssl)
{
return ssl->rfd;
}
int CyaSSL_negotiate(SSL* ssl)
{
int err = -1;
#ifndef NO_CYASSL_SERVER
if (ssl->options.side == SERVER_END)
err = SSL_accept(ssl);
#endif
#ifndef NO_CYASSL_CLIENT
if (ssl->options.side == CLIENT_END)
err = SSL_connect(ssl);
#endif
if (err == SSL_SUCCESS)
return 0;
else
return err;
}
int SSL_write(SSL* ssl, const void* buffer, int sz)
{
int ret;
CYASSL_ENTER("SSL_write()");
#ifdef HAVE_ERRNO_H
errno = 0;
#endif
ret = SendData(ssl, buffer, sz);
CYASSL_LEAVE("SSL_write()", ret);
if (ret < 0)
return SSL_FATAL_ERROR;
else
return ret;
}
int SSL_read(SSL* ssl, void* buffer, int sz)
{
int ret;
CYASSL_ENTER("SSL_read()");
#ifdef HAVE_ERRNO_H
errno = 0;
#endif
ret = ReceiveData(ssl, (byte*)buffer, min(sz, OUTPUT_RECORD_SIZE));
CYASSL_LEAVE("SSL_read()", ret);
if (ret < 0)
return SSL_FATAL_ERROR;
else
return ret;
}
int SSL_shutdown(SSL* ssl)
{
CYASSL_ENTER("SSL_shutdown()");
if (ssl->options.quietShutdown) {
CYASSL_MSG("quiet shutdown, no close notify sent");
return 0;
}
/* try to send close notify, not an error if can't */
if (!ssl->options.isClosed && !ssl->options.connReset &&
!ssl->options.sentNotify) {
ssl->error = SendAlert(ssl, alert_warning, close_notify);
if (ssl->error < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.sentNotify = 1; /* don't send close_notify twice */
}
CYASSL_LEAVE("SSL_shutdown()", ssl->error);
ssl->error = SSL_ERROR_SYSCALL; /* simulate OpenSSL behavior */
return 0;
}
int SSL_get_error(SSL* ssl, int dummy)
{
if (ssl->error == WANT_READ)
return SSL_ERROR_WANT_READ; /* convert to OpenSSL type */
else if (ssl->error == WANT_WRITE)
return SSL_ERROR_WANT_WRITE; /* convert to OpenSSL type */
else if (ssl->error == ZERO_RETURN)
return SSL_ERROR_ZERO_RETURN; /* convert to OpenSSL type */
return ssl->error;
}
int SSL_want_read(SSL* ssl)
{
if (ssl->error == WANT_READ)
return 1;
return 0;
}
int SSL_want_write(SSL* ssl)
{
if (ssl->error == WANT_WRITE)
return 1;
return 0;
}
char* ERR_error_string(unsigned long errNumber, char* buffer)
{
static char* msg = "Please supply a buffer for error string";
if (buffer) {
SetErrorString(errNumber, buffer);
return buffer;
}
return msg;
}
void ERR_error_string_n(unsigned long e, char* buf, size_t len)
{
if (len) ERR_error_string(e, buf);
}
#ifndef NO_FILESYSTEM
void ERR_print_errors_fp(FILE* fp, int err)
{
char buffer[MAX_ERROR_SZ + 1];
SetErrorString(err, buffer);
fprintf(fp, "%s", buffer);
}
#endif
int SSL_pending(SSL* ssl)
{
return ssl->buffers.clearOutputBuffer.length;
}
/* owns der */
static int AddCA(SSL_CTX* ctx, buffer der)
{
word32 ret;
DecodedCert cert;
Signer* signer = 0;
InitDecodedCert(&cert, der.buffer, ctx->heap);
ret = ParseCert(&cert, der.length, CA_TYPE, ctx->verifyPeer, 0);
if (ret == 0) {
/* take over signer parts */
signer = MakeSigner(ctx->heap);
if (!signer)
ret = MEMORY_ERROR;
else {
signer->keyOID = cert.keyOID;
signer->publicKey = cert.publicKey;
signer->pubKeySize = cert.pubKeySize;
signer->name = cert.subjectCN;
XMEMCPY(signer->hash, cert.subjectHash, SHA_DIGEST_SIZE);
cert.publicKey = 0; /* don't free here */
cert.subjectCN = 0;
signer->next = ctx->caList;
ctx->caList = signer; /* takes ownership */
}
}
FreeDecodedCert(&cert);
XFREE(der.buffer, ctx->heap, DYNAMIC_TYPE_CA);
if (ret == 0) return SSL_SUCCESS;
return ret;
}
#ifndef NO_SESSION_CACHE
/* basic config gives a cache with 33 sessions, adequate for clients and
embedded servers
BIG_SESSION_CACHE allows 1055 sessions, adequate for servers that aren't
under heavy load, basically allows 200 new sessions per minute
HUGE_SESSION_CACHE yields 65,791 sessions, for servers under heavy load,
allows over 13,000 new sessions per minute or over 200 new sessions per
second
*/
#ifdef HUGE_SESSION_CACHE
#define SESSIONS_PER_ROW 11
#define SESSION_ROWS 5981
#elif defined(BIG_SESSION_CACHE)
#define SESSIONS_PER_ROW 5
#define SESSION_ROWS 211
#else
#define SESSIONS_PER_ROW 3
#define SESSION_ROWS 11
#endif
typedef struct SessionRow {
int nextIdx; /* where to place next one */
int totalCount; /* sessions ever on this row */
SSL_SESSION Sessions[SESSIONS_PER_ROW];
} SessionRow;
static SessionRow SessionCache[SESSION_ROWS];
static CyaSSL_Mutex mutex; /* SessionCache mutex */
#endif /* NO_SESSION_CACHE */
static int PemToDer(const unsigned char* buff, long sz, int type,
buffer* der, void* heap, EncryptedInfo* info)
{
char header[PEM_LINE_LEN];
char footer[PEM_LINE_LEN];
char* headerEnd;
char* footerEnd;
long neededSz;
int pkcs8 = 0;
int dynamicType;
if (type == CERT_TYPE || type == CA_TYPE) {
XSTRNCPY(header, "-----BEGIN CERTIFICATE-----", sizeof(header));
XSTRNCPY(footer, "-----END CERTIFICATE-----", sizeof(footer));
dynamicType = (type == CA_TYPE) ? DYNAMIC_TYPE_CA :
DYNAMIC_TYPE_CERT;
} else {
XSTRNCPY(header, "-----BEGIN RSA PRIVATE KEY-----", sizeof(header));
XSTRNCPY(footer, "-----END RSA PRIVATE KEY-----", sizeof(footer));
dynamicType = DYNAMIC_TYPE_KEY;
}
/* find header */
headerEnd = XSTRSTR((char*)buff, header);
if (!headerEnd && type == PRIVATEKEY_TYPE) { /* may be pkcs8 */
XSTRNCPY(header, "-----BEGIN PRIVATE KEY-----", sizeof(header));
XSTRNCPY(footer, "-----END PRIVATE KEY-----", sizeof(footer));
headerEnd = XSTRSTR((char*)buff, header);
if (headerEnd)
pkcs8 = 1;
/*
else
maybe encrypted "-----BEGIN ENCRYPTED PRIVATE KEY-----"
*/
}
if (!headerEnd)
return SSL_BAD_FILE;
headerEnd += XSTRLEN(header);
/* get next line */
if (headerEnd[0] == '\n')
headerEnd++;
else if (headerEnd[1] == '\n')
headerEnd += 2;
else
return SSL_BAD_FILE;
#ifdef OPENSSL_EXTRA
{
/* remove encrypted header if there */
char encHeader[] = "Proc-Type";
char* line = XSTRSTR((char*)buff, encHeader);
if (line) {
char* newline;
char* finish;
char* start = XSTRSTR(line, "DES");
if (!start)
start = XSTRSTR(line, "AES");
if (!start) return SSL_BAD_FILE;
if (!info) return SSL_BAD_FILE;
finish = XSTRSTR(start, ",");
if (start && finish && (start < finish)) {
newline = XSTRSTR(finish, "\r");
XMEMCPY(info->name, start, finish - start);
info->name[finish - start] = 0;
XMEMCPY(info->iv, finish + 1, sizeof(info->iv));
if (!newline) newline = XSTRSTR(finish, "\n");
if (newline && (newline > finish)) {
info->ivSz = (word32)(newline - (finish + 1));
info->set = 1;
}
else
return SSL_BAD_FILE;
}
else
return SSL_BAD_FILE;
/* eat blank line */
while (*newline == '\r' || *newline == '\n')
newline++;
headerEnd = newline;
}
}
#endif /* OPENSSL_EXTRA */
/* find footer */
footerEnd = XSTRSTR((char*)buff, footer);
if (!footerEnd) return SSL_BAD_FILE;
/* set up der buffer */
neededSz = (long)(footerEnd - headerEnd);
if (neededSz > sz || neededSz < 0) return SSL_BAD_FILE;
der->buffer = (byte*) XMALLOC(neededSz, heap, dynamicType);
if (!der->buffer) return MEMORY_ERROR;
der->length = neededSz;
if (Base64Decode((byte*)headerEnd, neededSz, der->buffer,
&der->length) < 0)
return SSL_BAD_FILE;
if (pkcs8)
return ToTraditional(der->buffer, der->length);
/* not full support yet
if (pkcs8Enc)
return ToTraditionalEnc(der->buffer, der->length);
*/
return 0;
}
static int ProcessBuffer(SSL_CTX* ctx, const unsigned char* buff,
long sz, int format, int type)
{
EncryptedInfo info;
buffer der; /* holds DER or RAW (for NTRU */
int dynamicType;
info.set = 0;
der.buffer = 0;
if (format != SSL_FILETYPE_ASN1 && format != SSL_FILETYPE_PEM
&& format != SSL_FILETYPE_RAW)
return SSL_BAD_FILETYPE;
if (type == CA_TYPE)
dynamicType = DYNAMIC_TYPE_CA;
else if (type == CERT_TYPE)
dynamicType = DYNAMIC_TYPE_CERT;
else
dynamicType = DYNAMIC_TYPE_KEY;
if (format == SSL_FILETYPE_PEM) {
if (PemToDer(buff, sz, type, &der, ctx->heap, &info) < 0) {
XFREE(der.buffer, ctx->heap, dynamicType);
return SSL_BAD_FILE;
}
}
else { /* ASN1 (DER) or RAW (NTRU) */
der.buffer = (byte*) XMALLOC(sz, ctx->heap, dynamicType);
if (!der.buffer) return MEMORY_ERROR;
XMEMCPY(der.buffer, buff, sz);
der.length = sz;
}
#ifdef OPENSSL_EXTRA
if (info.set) {
/* decrypt */
char password[80];
int passwordSz;
byte key[AES_256_KEY_SIZE];
byte iv[AES_IV_SIZE];
if (!ctx->passwd_cb) return -1;
/* use file's salt for key derivation, hex decode first */
if (Base16Decode(info.iv, info.ivSz, info.iv, &info.ivSz) != 0)
return -1;
passwordSz = ctx->passwd_cb(password, sizeof(password), 0,
ctx->userdata);
if (EVP_BytesToKey(info.name, "MD5", info.iv, (byte*)password,
passwordSz, 1, key, iv) <= 0)
return -1;
if (XSTRNCMP(info.name, "DES-CBC", 7) == 0) {
Des des;
Des_SetKey(&des, key, info.iv, DES_DECRYPTION);
Des_CbcDecrypt(&des, der.buffer, der.buffer, der.length);
}
else if (XSTRNCMP(info.name, "DES-EDE3-CBC", 13) == 0) {
Des3 des;
Des3_SetKey(&des, key, info.iv, DES_DECRYPTION);
Des3_CbcDecrypt(&des, der.buffer, der.buffer, der.length);
}
else if (XSTRNCMP(info.name, "AES-128-CBC", 13) == 0) {
Aes aes;
AesSetKey(&aes, key, AES_128_KEY_SIZE, info.iv, AES_DECRYPTION);
AesCbcDecrypt(&aes, der.buffer, der.buffer, der.length);
}
else if (XSTRNCMP(info.name, "AES-192-CBC", 13) == 0) {
Aes aes;
AesSetKey(&aes, key, AES_192_KEY_SIZE, info.iv, AES_DECRYPTION);
AesCbcDecrypt(&aes, der.buffer, der.buffer, der.length);
}
else if (XSTRNCMP(info.name, "AES-256-CBC", 13) == 0) {
Aes aes;
AesSetKey(&aes, key, AES_256_KEY_SIZE, info.iv, AES_DECRYPTION);
AesCbcDecrypt(&aes, der.buffer, der.buffer, der.length);
}
else
return SSL_BAD_FILE;
}
#endif /* OPENSSL_EXTRA */
if (type == CA_TYPE)
return AddCA(ctx, der); /* takes der over */
else if (type == CERT_TYPE) {
if (ctx->certificate.buffer)
XFREE(ctx->certificate.buffer, ctx->heap, dynamicType);
ctx->certificate = der; /* takes der over */
}
else if (type == PRIVATEKEY_TYPE) {
if (ctx->privateKey.buffer)
XFREE(ctx->privateKey.buffer, ctx->heap, dynamicType);
ctx->privateKey = der; /* takes der over */
}
else {
XFREE(der.buffer, ctx->heap, dynamicType);
return SSL_BAD_CERTTYPE;
}
if (type == PRIVATEKEY_TYPE && format != SSL_FILETYPE_RAW) {
/* make sure RSA key can be used */
RsaKey key;
word32 idx = 0;
InitRsaKey(&key, 0);
if (RsaPrivateKeyDecode(der.buffer, &idx, &key, der.length) != 0) {
FreeRsaKey(&key);
return SSL_BAD_FILE;
}
FreeRsaKey(&key);
}
return SSL_SUCCESS;
}
#ifndef NO_FILESYSTEM
#ifndef MICRIUM
#define XFILE FILE
#define XFOPEN fopen
#define XFSEEK fseek
#define XFTELL ftell
#define XREWIND rewind
#define XFREAD fread
#define XFCLOSE fclose
#define XSEEK_END SEEK_END
#else
#include <fs.h>
#define XFILE FS_FILE
#define XFOPEN fs_fopen
#define XFSEEK fs_fseek
#define XFTELL fs_ftell
#define XREWIND fs_rewind
#define XFREAD fs_fread
#define XFCLOSE fs_fclose
#define XSEEK_END FS_SEEK_END
#endif
static int ProcessFile(SSL_CTX* ctx, const char* fname, int format, int type)
{
byte staticBuffer[FILE_BUFFER_SIZE];
byte* buffer = staticBuffer;
int dynamic = 0;
int ret;
long sz = 0;
XFILE* file = XFOPEN(fname, "rb");
if (!file) return SSL_BAD_FILE;
XFSEEK(file, 0, XSEEK_END);
sz = XFTELL(file);
XREWIND(file);
if (sz > sizeof(staticBuffer)) {
buffer = (byte*) XMALLOC(sz, ctx->heap, DYNAMIC_TYPE_FILE);
if (buffer == NULL) {
XFCLOSE(file);
return SSL_BAD_FILE;
}
dynamic = 1;
}
if ( (ret = XFREAD(buffer, sz, 1, file)) < 0)
ret = SSL_BAD_FILE;
else
ret = ProcessBuffer(ctx, buffer, sz, format, type);
XFCLOSE(file);
if (dynamic) XFREE(buffer, ctx->heap, DYNAMIC_TYPE_FILE);
return ret;
}
/* just one for now TODO: add dir support from path */
int SSL_CTX_load_verify_locations(SSL_CTX* ctx, const char* file,
const char* path)
{
if (ProcessFile(ctx, file, SSL_FILETYPE_PEM, CA_TYPE) == SSL_SUCCESS)
return SSL_SUCCESS;
return SSL_FAILURE;
}
#ifdef CYASSL_DER_LOAD
/* Add format parameter to allow DER load of CA files */
int CyaSSL_CTX_load_verify_locations(SSL_CTX* ctx, const char* file, int format)
{
if (ProcessFile(ctx, file, format, CA_TYPE) == SSL_SUCCESS)
return SSL_SUCCESS;
return SSL_FAILURE;
}
#endif /* CYASSL_DER_LOAD */
#ifdef CYASSL_CERT_GEN
/* load pem cert from file into der buffer, return der size or error */
int CyaSSL_PemCertToDer(const char* fileName, unsigned char* derBuf, int derSz)
{
byte staticBuffer[FILE_BUFFER_SIZE];
byte* fileBuf = staticBuffer;
int dynamic = 0;
int ret;
long sz = 0;
XFILE* file = XFOPEN(fileName, "rb");
EncryptedInfo info;
buffer converted;
converted.buffer = 0;
if (!file) return SSL_BAD_FILE;
XFSEEK(file, 0, XSEEK_END);
sz = XFTELL(file);
XREWIND(file);
if (sz > sizeof(staticBuffer)) {
fileBuf = (byte*) XMALLOC(sz, 0, DYNAMIC_TYPE_FILE);
if (fileBuf == NULL) {
XFCLOSE(file);
return SSL_BAD_FILE;
}
dynamic = 1;
}
if ( (ret = XFREAD(fileBuf, sz, 1, file)) < 0)
ret = SSL_BAD_FILE;
else
ret = PemToDer(fileBuf, sz, CA_TYPE, &converted, 0, &info);
if (ret == 0) {
if (converted.length < derSz) {
memcpy(derBuf, converted.buffer, converted.length);
ret = converted.length;
}
else
ret = BUFFER_E;
}
XFREE(converted.buffer, 0, DYNAMIC_TYPE_CA);
if (dynamic)
XFREE(fileBuf, 0, DYNAMIC_TYPE_FILE);
XFCLOSE(file);
return ret;
}
#endif /* CYASSL_CERT_GEN */
int SSL_CTX_use_certificate_file(SSL_CTX* ctx, const char* file, int format)
{
if (ProcessFile(ctx, file, format, CERT_TYPE) == SSL_SUCCESS)
return SSL_SUCCESS;
return SSL_FAILURE;
}
int SSL_CTX_use_PrivateKey_file(SSL_CTX* ctx, const char* file, int format)
{
if (ProcessFile(ctx, file, format, PRIVATEKEY_TYPE) == SSL_SUCCESS)
return SSL_SUCCESS;
return SSL_FAILURE;
}
int SSL_CTX_use_certificate_chain_file(SSL_CTX* ctx, const char* file)
{
/* add first to ctx, all tested implementations support this */
if (ProcessFile(ctx, file, SSL_FILETYPE_PEM, CERT_TYPE) == SSL_SUCCESS)
return SSL_SUCCESS;
return SSL_FAILURE;
}
#ifdef HAVE_NTRU
int CyaSSL_CTX_use_NTRUPrivateKey_file(SSL_CTX* ctx, const char* file)
{
if (ProcessFile(ctx, file, SSL_FILETYPE_RAW, PRIVATEKEY_TYPE)
== SSL_SUCCESS) {
ctx->haveNTRU = 1;
return SSL_SUCCESS;
}
return SSL_FAILURE;
}
#endif /* HAVE_NTRU */
#ifdef OPENSSL_EXTRA
int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX* ctx,const char* file,int format)
{
if (ProcessFile(ctx, file, format, PRIVATEKEY_TYPE) == SSL_SUCCESS)
return SSL_SUCCESS;
return SSL_FAILURE;
}
#endif /* OPENSSL_EXTRA */
#endif /* NO_FILESYSTEM */
void SSL_CTX_set_verify(SSL_CTX* ctx, int mode, VerifyCallback vc)
{
if (mode & SSL_VERIFY_PEER) {
ctx->verifyPeer = 1;
ctx->verifyNone = 0; /* in case perviously set */
}
if (mode == SSL_VERIFY_NONE) {
ctx->verifyNone = 1;
ctx->verifyPeer = 0; /* in case previously set */
}
if (mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
ctx->failNoCert = 1;
ctx->verifyCallback = vc;
}
#ifndef NO_SESSION_CACHE
SSL_SESSION* SSL_get_session(SSL* ssl)
{
return GetSession(ssl, 0);
}
int SSL_set_session(SSL* ssl, SSL_SESSION* session)
{
if (session)
return SetSession(ssl, session);
return SSL_FAILURE;
}
#endif /* NO_SESSION_CACHE */
void SSL_load_error_strings(void) /* compatibility only */
{}
int SSL_library_init(void)
{
if (InitCyaSSL() == 0)
return SSL_SUCCESS;
else
return -1;
}
#ifndef NO_SESSION_CACHE
/* on by default if built in but allow user to turn off */
long SSL_CTX_set_session_cache_mode(SSL_CTX* ctx, long mode)
{
if (mode == SSL_SESS_CACHE_OFF)
ctx->sessionCacheOff = 1;
if (mode == SSL_SESS_CACHE_NO_AUTO_CLEAR)
ctx->sessionCacheFlushOff = 1;
return SSL_SUCCESS;
}
#endif /* NO_SESSION_CACHE */
int SSL_CTX_set_cipher_list(SSL_CTX* ctx, const char* list)
{
if (SetCipherList(ctx, list))
return SSL_SUCCESS;
else
return SSL_FAILURE;
}
/* client only parts */
#ifndef NO_CYASSL_CLIENT
SSL_METHOD* SSLv3_client_method(void)
{
SSL_METHOD* method = (SSL_METHOD*) XMALLOC(sizeof(SSL_METHOD), 0,
DYNAMIC_TYPE_METHOD);
if (method)
InitSSL_Method(method, MakeSSLv3());
return method;
}
#ifdef CYASSL_DTLS
SSL_METHOD* DTLSv1_client_method(void)
{
SSL_METHOD* method = (SSL_METHOD*) XMALLOC(sizeof(SSL_METHOD), 0,
DYNAMIC_TYPE_METHOD);
if (method)
InitSSL_Method(method, MakeDTLSv1());
return method;
}
#endif
/* please see note at top of README if you get an error from connect */
int SSL_connect(SSL* ssl)
{
int neededState;
CYASSL_ENTER("SSL_connect()");
#ifdef HAVE_ERRNO_H
errno = 0;
#endif
if (ssl->options.side != CLIENT_END) {
CYASSL_ERROR(ssl->error = SIDE_ERROR);
return SSL_FATAL_ERROR;
}
#ifdef CYASSL_DTLS
if (ssl->version.major == DTLS_MAJOR &&
ssl->version.minor == DTLS_MINOR) {
ssl->options.dtls = 1;
ssl->options.tls = 1;
ssl->options.tls1_1 = 1;
}
#endif
if (ssl->buffers.outputBuffer.length > 0) {
if ( (ssl->error = SendBuffered(ssl)) == 0) {
ssl->options.connectState++;
CYASSL_MSG("connect state: Advanced from buffered send");
}
else {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
}
switch (ssl->options.connectState) {
case CONNECT_BEGIN :
/* always send client hello first */
if ( (ssl->error = SendClientHello(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = CLIENT_HELLO_SENT;
CYASSL_MSG("connect state: CLIENT_HELLO_SENT");
case CLIENT_HELLO_SENT :
neededState = ssl->options.resuming ? SERVER_FINISHED_COMPLETE :
SERVER_HELLODONE_COMPLETE;
#ifdef CYASSL_DTLS
if (ssl->options.dtls && !ssl->options.resuming)
neededState = SERVER_HELLOVERIFYREQUEST_COMPLETE;
#endif
/* get response */
while (ssl->options.serverState < neededState) {
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
/* if resumption failed, reset needed state */
else if (neededState == SERVER_FINISHED_COMPLETE)
if (!ssl->options.resuming) {
if (!ssl->options.dtls)
neededState = SERVER_HELLODONE_COMPLETE;
else
neededState = SERVER_HELLOVERIFYREQUEST_COMPLETE;
}
}
ssl->options.connectState = HELLO_AGAIN;
CYASSL_MSG("connect state: HELLO_AGAIN");
case HELLO_AGAIN :
#ifdef CYASSL_DTLS
if (ssl->options.dtls && !ssl->options.resuming) {
/* re-init hashes, exclude first hello and verify request */
InitMd5(&ssl->hashMd5);
InitSha(&ssl->hashSha);
if ( (ssl->error = SendClientHello(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
}
#endif
ssl->options.connectState = HELLO_AGAIN_REPLY;
CYASSL_MSG("connect state: HELLO_AGAIN_REPLY");
case HELLO_AGAIN_REPLY :
#ifdef CYASSL_DTLS
if (ssl->options.dtls) {
neededState = ssl->options.resuming ?
SERVER_FINISHED_COMPLETE : SERVER_HELLODONE_COMPLETE;
/* get response */
while (ssl->options.serverState < neededState) {
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
/* if resumption failed, reset needed state */
else if (neededState == SERVER_FINISHED_COMPLETE)
if (!ssl->options.resuming)
neededState = SERVER_HELLODONE_COMPLETE;
}
}
#endif
ssl->options.connectState = FIRST_REPLY_DONE;
CYASSL_MSG("connect state: FIRST_REPLY_DONE");
case FIRST_REPLY_DONE :
if (ssl->options.sendVerify)
if ( (ssl->error = SendCertificate(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = FIRST_REPLY_FIRST;
CYASSL_MSG("connect state: FIRST_REPLY_FIRST");
case FIRST_REPLY_FIRST :
if (!ssl->options.resuming)
if ( (ssl->error = SendClientKeyExchange(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = FIRST_REPLY_SECOND;
CYASSL_MSG("connect state: FIRST_REPLY_SECOND");
case FIRST_REPLY_SECOND :
if (ssl->options.sendVerify)
if ( (ssl->error = SendCertificateVerify(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = FIRST_REPLY_THIRD;
CYASSL_MSG("connect state: FIRST_REPLY_THIRD");
case FIRST_REPLY_THIRD :
if ( (ssl->error = SendChangeCipher(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = FIRST_REPLY_FOURTH;
CYASSL_MSG("connect state: FIRST_REPLY_FOURTH");
case FIRST_REPLY_FOURTH :
if ( (ssl->error = SendFinished(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = FINISHED_DONE;
CYASSL_MSG("connect state: FINISHED_DONE");
case FINISHED_DONE :
/* get response */
while (ssl->options.serverState < SERVER_FINISHED_COMPLETE)
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.connectState = SECOND_REPLY_DONE;
CYASSL_MSG("connect state: SECOND_REPLY_DONE");
case SECOND_REPLY_DONE:
if (ssl->buffers.inputBuffer.dynamicFlag)
ShrinkInputBuffer(ssl, NO_FORCED_FREE);
CYASSL_LEAVE("SSL_connect()", SSL_SUCCESS);
return SSL_SUCCESS;
default:
CYASSL_MSG("Unknown connect state ERROR");
return SSL_FATAL_ERROR; /* unknown connect state */
}
}
#endif /* NO_CYASSL_CLIENT */
/* server only parts */
#ifndef NO_CYASSL_SERVER
SSL_METHOD* SSLv3_server_method(void)
{
SSL_METHOD* method = (SSL_METHOD*) XMALLOC(sizeof(SSL_METHOD), 0,
DYNAMIC_TYPE_METHOD);
if (method) {
InitSSL_Method(method, MakeSSLv3());
method->side = SERVER_END;
}
return method;
}
#ifdef CYASSL_DTLS
SSL_METHOD* DTLSv1_server_method(void)
{
SSL_METHOD* method = (SSL_METHOD*) XMALLOC(sizeof(SSL_METHOD), 0,
DYNAMIC_TYPE_METHOD);
if (method) {
InitSSL_Method(method, MakeDTLSv1());
method->side = SERVER_END;
}
return method;
}
#endif
int SSL_accept(SSL* ssl)
{
CYASSL_ENTER("SSL_accept()");
#ifdef HAVE_ERRNO_H
errno = 0;
#endif
if (ssl->options.side != SERVER_END) {
CYASSL_ERROR(ssl->error = SIDE_ERROR);
return SSL_FATAL_ERROR;
}
#ifdef CYASSL_DTLS
if (ssl->version.major == DTLS_MAJOR &&
ssl->version.minor == DTLS_MINOR) {
ssl->options.dtls = 1;
ssl->options.tls = 1;
ssl->options.tls1_1 = 1;
}
#endif
if (ssl->buffers.outputBuffer.length > 0) {
if ( (ssl->error = SendBuffered(ssl)) == 0) {
ssl->options.acceptState++;
CYASSL_MSG("accept state: Advanced from buffered send");
}
else {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
}
switch (ssl->options.acceptState) {
case ACCEPT_BEGIN :
/* get response */
while (ssl->options.clientState < CLIENT_HELLO_COMPLETE)
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = ACCEPT_CLIENT_HELLO_DONE;
CYASSL_MSG("accept state ACCEPT_CLIENT_HELLO_DONE");
case ACCEPT_CLIENT_HELLO_DONE :
#ifdef CYASSL_DTLS
if (ssl->options.dtls && !ssl->options.resuming)
if ( (ssl->error = SendHelloVerifyRequest(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
#endif
ssl->options.acceptState = HELLO_VERIFY_SENT;
CYASSL_MSG("accept state HELLO_VERIFY_SENT");
case HELLO_VERIFY_SENT:
#ifdef CYASSL_DTLS
if (ssl->options.dtls && !ssl->options.resuming) {
ssl->options.clientState = NULL_STATE; /* get again */
/* re-init hashes, exclude first hello and verify request */
InitMd5(&ssl->hashMd5);
InitSha(&ssl->hashSha);
while (ssl->options.clientState < CLIENT_HELLO_COMPLETE)
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
}
#endif
ssl->options.acceptState = ACCEPT_FIRST_REPLY_DONE;
CYASSL_MSG("accept state ACCEPT_FIRST_REPLY_DONE");
case ACCEPT_FIRST_REPLY_DONE :
if ( (ssl->error = SendServerHello(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = SERVER_HELLO_SENT;
CYASSL_MSG("accept state SERVER_HELLO_SENT");
case SERVER_HELLO_SENT :
if (!ssl->options.resuming)
if ( (ssl->error = SendCertificate(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = CERT_SENT;
CYASSL_MSG("accept state CERT_SENT");
case CERT_SENT :
if (!ssl->options.resuming)
if ( (ssl->error = SendServerKeyExchange(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = KEY_EXCHANGE_SENT;
CYASSL_MSG("accept state KEY_EXCHANGE_SENT");
case KEY_EXCHANGE_SENT :
if (!ssl->options.resuming)
if (ssl->options.verifyPeer)
if ( (ssl->error = SendCertificateRequest(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = CERT_REQ_SENT;
CYASSL_MSG("accept state CERT_REQ_SENT");
case CERT_REQ_SENT :
if (!ssl->options.resuming)
if ( (ssl->error = SendServerHelloDone(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = SERVER_HELLO_DONE;
CYASSL_MSG("accept state SERVER_HELLO_DONE");
case SERVER_HELLO_DONE :
if (!ssl->options.resuming) {
while (ssl->options.clientState < CLIENT_FINISHED_COMPLETE)
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
}
ssl->options.acceptState = ACCEPT_SECOND_REPLY_DONE;
CYASSL_MSG("accept state ACCEPT_SECOND_REPLY_DONE");
case ACCEPT_SECOND_REPLY_DONE :
if ( (ssl->error = SendChangeCipher(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = CHANGE_CIPHER_SENT;
CYASSL_MSG("accept state CHANGE_CIPHER_SENT");
case CHANGE_CIPHER_SENT :
if ( (ssl->error = SendFinished(ssl)) != 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = ACCEPT_FINISHED_DONE;
CYASSL_MSG("accept state ACCEPT_FINISHED_DONE");
case ACCEPT_FINISHED_DONE :
if (ssl->options.resuming)
while (ssl->options.clientState < CLIENT_FINISHED_COMPLETE)
if ( (ssl->error = ProcessReply(ssl)) < 0) {
CYASSL_ERROR(ssl->error);
return SSL_FATAL_ERROR;
}
ssl->options.acceptState = ACCEPT_THIRD_REPLY_DONE;
CYASSL_MSG("accept state ACCEPT_THIRD_REPLY_DONE");
case ACCEPT_THIRD_REPLY_DONE :
if (ssl->buffers.inputBuffer.dynamicFlag)
ShrinkInputBuffer(ssl, NO_FORCED_FREE);
CYASSL_LEAVE("SSL_accept()", SSL_SUCCESS);
return SSL_SUCCESS;
default :
CYASSL_MSG("Unknown accept state ERROR");
return SSL_FATAL_ERROR;
}
}
#endif /* NO_CYASSL_SERVER */
int InitCyaSSL(void)
{
if (InitMutex(&mutex) == 0)
return 0;
else
return -1;
}
int FreeCyaSSL(void)
{
if (FreeMutex(&mutex) == 0)
return 0;
else
return -1;
}
#ifndef NO_SESSION_CACHE
static INLINE word32 HashSession(const byte* sessionID)
{
/* id is random, just make 32 bit number from first 4 bytes for now */
return (sessionID[0] << 24) | (sessionID[1] << 16) | (sessionID[2] << 8) |
sessionID[3];
}
void SSL_flush_sessions(SSL_CTX* ctx, long tm)
{
/* static table now, no flusing needed */
}
SSL_SESSION* GetSession(SSL* ssl, byte* masterSecret)
{
SSL_SESSION* ret = 0;
const byte* id = ssl->arrays.sessionID;
word32 row;
int idx;
if (ssl->options.sessionCacheOff)
return 0;
row = HashSession(id) % SESSION_ROWS;
if (LockMutex(&mutex) != 0)
return 0;
if (SessionCache[row].totalCount >= SESSIONS_PER_ROW)
idx = SESSIONS_PER_ROW - 1;
else
idx = SessionCache[row].nextIdx - 1;
for (; idx >= 0; idx--) {
SSL_SESSION* current;
if (idx >= SESSIONS_PER_ROW) /* server could have restarted, idx */
break; /* would be word32(-1) and seg fault */
current = &SessionCache[row].Sessions[idx];
if (XMEMCMP(current->sessionID, id, ID_LEN) == 0) {
if (LowResTimer() < (current->bornOn + current->timeout)) {
ret = current;
if (masterSecret)
XMEMCPY(masterSecret, current->masterSecret, SECRET_LEN);
}
break;
}
}
UnLockMutex(&mutex);
return ret;
}
int SetSession(SSL* ssl, SSL_SESSION* session)
{
if (ssl->options.sessionCacheOff)
return SSL_FAILURE;
if (LowResTimer() < (session->bornOn + session->timeout)) {
ssl->session = *session;
ssl->options.resuming = 1;
#ifdef SESSION_CERTS
ssl->version = session->version;
ssl->options.cipherSuite = session->cipherSuite;
#endif
return SSL_SUCCESS;
}
return SSL_FAILURE; /* session timed out */
}
int AddSession(SSL* ssl)
{
word32 row, idx;
if (ssl->options.sessionCacheOff)
return 0;
row = HashSession(ssl->arrays.sessionID) % SESSION_ROWS;
if (LockMutex(&mutex) != 0)
return -1;
idx = SessionCache[row].nextIdx++;
XMEMCPY(SessionCache[row].Sessions[idx].masterSecret,
ssl->arrays.masterSecret, SECRET_LEN);
XMEMCPY(SessionCache[row].Sessions[idx].sessionID, ssl->arrays.sessionID,
ID_LEN);
SessionCache[row].Sessions[idx].timeout = DEFAULT_TIMEOUT;
SessionCache[row].Sessions[idx].bornOn = LowResTimer();
#ifdef SESSION_CERTS
SessionCache[row].Sessions[idx].chain.count = ssl->session.chain.count;
XMEMCPY(SessionCache[row].Sessions[idx].chain.certs,
ssl->session.chain.certs, sizeof(x509_buffer) * MAX_CHAIN_DEPTH);
SessionCache[row].Sessions[idx].version = ssl->version;
SessionCache[row].Sessions[idx].cipherSuite = ssl->options.cipherSuite;
#endif
SessionCache[row].totalCount++;
if (SessionCache[row].nextIdx == SESSIONS_PER_ROW)
SessionCache[row].nextIdx = 0;
if (UnLockMutex(&mutex) != 0)
return -1;
return 0;
}
#ifdef SESSION_STATS
void PrintSessionStats(void)
{
word32 totalSessionsSeen = 0;
word32 totalSessionsNow = 0;
word32 rowNow;
int i;
double E; /* expected freq */
double chiSquare = 0;
for (i = 0; i < SESSION_ROWS; i++) {
totalSessionsSeen += SessionCache[i].totalCount;
if (SessionCache[i].totalCount >= SESSIONS_PER_ROW)
rowNow = SESSIONS_PER_ROW;
else if (SessionCache[i].nextIdx == 0)
rowNow = 0;
else
rowNow = SessionCache[i].nextIdx;
totalSessionsNow += rowNow;
}
printf("Total Sessions Seen = %d\n", totalSessionsSeen);
printf("Total Sessions Now = %d\n", totalSessionsNow);
E = (double)totalSessionsSeen / SESSION_ROWS;
for (i = 0; i < SESSION_ROWS; i++) {
double diff = SessionCache[i].totalCount - E;
diff *= diff; /* sqaure */
diff /= E; /* normalize */
chiSquare += diff;
}
printf(" chi-square = %5.1f, d.f. = %d\n", chiSquare,
SESSION_ROWS - 1);
if (SESSION_ROWS == 11)
printf(" .05 p value = 18.3, chi-square should be less\n");
else if (SESSION_ROWS == 211)
printf(".05 p value = 244.8, chi-square should be less\n");
else if (SESSION_ROWS == 5981)
printf(".05 p value = 6161.0, chi-square should be less\n");
printf("\n");
}
#endif /* SESSION_STATS */
#endif /* NO_SESSION_CACHE */
/* call before SSL_connect, if verifying will add name check to
date check and signature check */
int CyaSSL_check_domain_name(SSL* ssl, const char* dn)
{
if (ssl->buffers.domainName.buffer)
XFREE(ssl->buffers.domainName.buffer, ssl->heap, DYNAMIC_TYPE_DOMAIN);
ssl->buffers.domainName.length = (word32)XSTRLEN(dn) + 1;
ssl->buffers.domainName.buffer = (byte*) XMALLOC(
ssl->buffers.domainName.length, ssl->heap, DYNAMIC_TYPE_DOMAIN);
if (ssl->buffers.domainName.buffer) {
XSTRNCPY((char*)ssl->buffers.domainName.buffer, dn,
ssl->buffers.domainName.length);
return SSL_SUCCESS;
}
else {
ssl->error = MEMORY_ERROR;
return SSL_FAILURE;
}
}
/* turn on CyaSSL zlib compression
returns 0 for success, else error (not built in)
*/
int CyaSSL_set_compression(SSL* ssl)
{
#ifdef HAVE_LIBZ
ssl->options.usingCompression = 1;
return 0;
#else
return -1;
#endif
}
#ifndef USE_WINDOWS_API
#ifndef NO_WRITEV
/* simulate writev semantics, doesn't actually do block at a time though
because of SSL_write behavior and because front adds may be small */
int CyaSSL_writev(SSL* ssl, const struct iovec* iov, int iovcnt)
{
byte tmp[OUTPUT_RECORD_SIZE];
byte* buffer = tmp;
int send = 0;
int newBuffer = 0;
int idx = 0;
int i;
int ret;
for (i = 0; i < iovcnt; i++)
send += iov[i].iov_len;
if (send > sizeof(tmp)) {
byte* tmp2 = (byte*) XMALLOC(send, ssl->heap,
DYNAMIC_TYPE_WRITEV);
if (!tmp2)
return MEMORY_ERROR;
buffer = tmp2;
newBuffer = 1;
}
for (i = 0; i < iovcnt; i++) {
XMEMCPY(&buffer[idx], iov[i].iov_base, iov[i].iov_len);
idx += iov[i].iov_len;
}
ret = SSL_write(ssl, buffer, send);
if (newBuffer) XFREE(buffer, ssl->heap, DYNAMIC_TYPE_WRITEV);
return ret;
}
#endif
#endif
#ifdef CYASSL_CALLBACKS
typedef struct itimerval Itimerval;
/* don't keep calling simple functions while setting up timer and singals
if no inlining these are the next best */
#define AddTimes(a, b, c) \
do { \
c.tv_sec = a.tv_sec + b.tv_sec; \
c.tv_usec = a.tv_usec + b.tv_usec; \
if (c.tv_sec >= 1000000) { \
c.tv_sec++; \
c.tv_usec -= 1000000; \
} \
} while (0)
#define SubtractTimes(a, b, c) \
do { \
c.tv_sec = a.tv_sec - b.tv_sec; \
c.tv_usec = a.tv_usec - b.tv_usec; \
if (c.tv_sec < 0) { \
c.tv_sec--; \
c.tv_usec += 1000000; \
} \
} while (0)
#define CmpTimes(a, b, cmp) \
((a.tv_sec == b.tv_sec) ? \
(a.tv_usec cmp b.tv_usec) : \
(a.tv_sec cmp b.tv_sec)) \
/* do nothing handler */
static void myHandler(int signo)
{
return;
}
static int CyaSSL_ex_wrapper(SSL* ssl, HandShakeCallBack hsCb,
TimeoutCallBack toCb, Timeval timeout)
{
int ret = -1;
int oldTimerOn = 0; /* was timer already on */
Timeval startTime;
Timeval endTime;
Timeval totalTime;
Itimerval myTimeout;
Itimerval oldTimeout; /* if old timer adjust from total time to reset */
struct sigaction act, oact;
#define ERR_OUT(x) { ssl->hsInfoOn = 0; ssl->toInfoOn = 0; return x; }
if (hsCb) {
ssl->hsInfoOn = 1;
InitHandShakeInfo(&ssl->handShakeInfo);
}
if (toCb) {
ssl->toInfoOn = 1;
InitTimeoutInfo(&ssl->timeoutInfo);
if (gettimeofday(&startTime, 0) < 0)
ERR_OUT(GETTIME_ERROR);
/* use setitimer to simulate getitimer, init 0 myTimeout */
myTimeout.it_interval.tv_sec = 0;
myTimeout.it_interval.tv_usec = 0;
myTimeout.it_value.tv_sec = 0;
myTimeout.it_value.tv_usec = 0;
if (setitimer(ITIMER_REAL, &myTimeout, &oldTimeout) < 0)
ERR_OUT(SETITIMER_ERROR);
if (oldTimeout.it_value.tv_sec || oldTimeout.it_value.tv_usec) {
oldTimerOn = 1;
/* is old timer going to expire before ours */
if (CmpTimes(oldTimeout.it_value, timeout, <)) {
timeout.tv_sec = oldTimeout.it_value.tv_sec;
timeout.tv_usec = oldTimeout.it_value.tv_usec;
}
}
myTimeout.it_value.tv_sec = timeout.tv_sec;
myTimeout.it_value.tv_usec = timeout.tv_usec;
/* set up signal handler, don't restart socket send/recv */
act.sa_handler = myHandler;
sigemptyset(&act.sa_mask);
act.sa_flags = 0;
#ifdef SA_INTERRUPT
act.sa_flags |= SA_INTERRUPT;
#endif
if (sigaction(SIGALRM, &act, &oact) < 0)
ERR_OUT(SIGACT_ERROR);
if (setitimer(ITIMER_REAL, &myTimeout, 0) < 0)
ERR_OUT(SETITIMER_ERROR);
}
/* do main work */
#ifndef NO_CYASSL_CLIENT
if (ssl->options.side == CLIENT_END)
ret = SSL_connect(ssl);
#endif
#ifndef NO_CYASSL_SERVER
if (ssl->options.side == SERVER_END)
ret = SSL_accept(ssl);
#endif
/* do callbacks */
if (toCb) {
if (oldTimerOn) {
gettimeofday(&endTime, 0);
SubtractTimes(endTime, startTime, totalTime);
/* adjust old timer for elapsed time */
if (CmpTimes(totalTime, oldTimeout.it_value, <))
SubtractTimes(oldTimeout.it_value, totalTime,
oldTimeout.it_value);
else {
/* reset value to interval, may be off */
oldTimeout.it_value.tv_sec = oldTimeout.it_interval.tv_sec;
oldTimeout.it_value.tv_usec =oldTimeout.it_interval.tv_usec;
}
/* keep iter the same whether there or not */
}
/* restore old handler */
if (sigaction(SIGALRM, &oact, 0) < 0)
ret = SIGACT_ERROR; /* more pressing error, stomp */
else
/* use old settings which may turn off (expired or not there) */
if (setitimer(ITIMER_REAL, &oldTimeout, 0) < 0)
ret = SETITIMER_ERROR;
/* if we had a timeout call callback */
if (ssl->timeoutInfo.timeoutName[0]) {
ssl->timeoutInfo.timeoutValue.tv_sec = timeout.tv_sec;
ssl->timeoutInfo.timeoutValue.tv_usec = timeout.tv_usec;
(toCb)(&ssl->timeoutInfo);
}
/* clean up */
FreeTimeoutInfo(&ssl->timeoutInfo, ssl->heap);
ssl->toInfoOn = 0;
}
if (hsCb) {
FinishHandShakeInfo(&ssl->handShakeInfo, ssl);
(hsCb)(&ssl->handShakeInfo);
ssl->hsInfoOn = 0;
}
return ret;
}
#ifndef NO_CYASSL_CLIENT
int CyaSSL_connect_ex(SSL* ssl, HandShakeCallBack hsCb,
TimeoutCallBack toCb, Timeval timeout)
{
return CyaSSL_ex_wrapper(ssl, hsCb, toCb, timeout);
}
#endif
#ifndef NO_CYASSL_SERVER
int CyaSSL_accept_ex(SSL* ssl, HandShakeCallBack hsCb,
TimeoutCallBack toCb,Timeval timeout)
{
return CyaSSL_ex_wrapper(ssl, hsCb, toCb, timeout);
}
#endif
#endif /* CYASSL_CALLBACKS */
#ifndef NO_PSK
void SSL_CTX_set_psk_client_callback(SSL_CTX* ctx, psk_client_callback cb)
{
ctx->havePSK = 1;
ctx->client_psk_cb = cb;
}
void SSL_set_psk_client_callback(SSL* ssl, psk_client_callback cb)
{
ssl->options.havePSK = 1;
ssl->options.client_psk_cb = cb;
InitSuites(&ssl->suites, ssl->version,TRUE,TRUE, ssl->options.haveNTRU);
}
void SSL_CTX_set_psk_server_callback(SSL_CTX* ctx, psk_server_callback cb)
{
ctx->havePSK = 1;
ctx->server_psk_cb = cb;
}
void SSL_set_psk_server_callback(SSL* ssl, psk_server_callback cb)
{
ssl->options.havePSK = 1;
ssl->options.server_psk_cb = cb;
InitSuites(&ssl->suites, ssl->version, ssl->options.haveDH, TRUE,
ssl->options.haveNTRU);
}
const char* SSL_get_psk_identity_hint(const SSL* ssl)
{
return ssl->arrays.server_hint;
}
const char* SSL_get_psk_identity(const SSL* ssl)
{
return ssl->arrays.client_identity;
}
int SSL_CTX_use_psk_identity_hint(SSL_CTX* ctx, const char* hint)
{
if (hint == 0)
ctx->server_hint[0] = 0;
else
XSTRNCPY(ctx->server_hint, hint, MAX_PSK_ID_LEN);
return SSL_SUCCESS;
}
int SSL_use_psk_identity_hint(SSL* ssl, const char* hint)
{
if (hint == 0)
ssl->arrays.server_hint[0] = 0;
else
XSTRNCPY(ssl->arrays.server_hint, hint, MAX_PSK_ID_LEN);
return SSL_SUCCESS;
}
#endif /* NO_PSK */
#if defined(NO_FILESYSTEM) || defined(MICRIUM)
/* CyaSSL extension allows DER files to be loaded from buffers as well */
int CyaSSL_CTX_load_verify_buffer(SSL_CTX* ctx, const unsigned char* buffer,
long sz, int format)
{
return ProcessBuffer(ctx, buffer, sz, format, CA_TYPE);
}
int CyaSSL_CTX_use_certificate_buffer(SSL_CTX* ctx,
const unsigned char* buffer,long sz,int format)
{
return ProcessBuffer(ctx, buffer, sz, format, CERT_TYPE);
}
int CyaSSL_CTX_use_PrivateKey_buffer(SSL_CTX* ctx,
const unsigned char* buffer,long sz,int format)
{
return ProcessBuffer(ctx, buffer, sz, format, PRIVATEKEY_TYPE);
}
int CyaSSL_CTX_use_certificate_chain_buffer(SSL_CTX* ctx,
const unsigned char* buffer, long sz)
{
/* add first to ctx, all tested implementations support this */
return ProcessBuffer(ctx, buffer, sz, SSL_FILETYPE_PEM, CA_TYPE);
}
#endif /* NO_FILESYSTEM || MICRIUM */
#if defined(OPENSSL_EXTRA) || defined(GOAHEAD_WS)
int SSLeay_add_ssl_algorithms(void)
{
OpenSSL_add_all_algorithms();
return SSL_SUCCESS;
}
long SSL_CTX_sess_set_cache_size(SSL_CTX* ctx, long sz)
{
/* cache size fixed at compile time in CyaSSL */
return 0;
}
void SSL_CTX_set_quiet_shutdown(SSL_CTX* ctx, int mode)
{
if (mode)
ctx->quietShutdown = 1;
}
int SSL_CTX_check_private_key(SSL_CTX* ctx)
{
/* TODO: check private against public for RSA match */
return SSL_SUCCESS;
}
void SSL_set_bio(SSL* ssl, BIO* rd, BIO* wr)
{
SSL_set_rfd(ssl, rd->fd);
SSL_set_wfd(ssl, wr->fd);
ssl->biord = rd;
ssl->biowr = wr;
}
void SSL_CTX_set_client_CA_list(SSL_CTX* ctx, STACK_OF(X509_NAME)* names)
{
}
STACK_OF(X509_NAME)* SSL_load_client_CA_file(const char* fname)
{
return 0;
}
int SSL_CTX_set_default_verify_paths(SSL_CTX* ctx)
{
/* TODO:, not needed in goahead */
return SSL_NOT_IMPLEMENTED;
}
void SSL_set_accept_state(SSL* ssl)
{
byte havePSK = 0;
ssl->options.side = SERVER_END;
/* reset suites in case user switched */
#ifndef NO_PSK
havePSK = ssl->options.havePSK;
#endif
InitSuites(&ssl->suites, ssl->version, ssl->options.haveDH, havePSK,
ssl->options.haveNTRU);
}
void OpenSSL_add_all_algorithms(void)
{
InitCyaSSL();
}
int SSLeay_add_all_algorithms(void)
{
OpenSSL_add_all_algorithms();
return SSL_SUCCESS;
}
void SSL_CTX_set_tmp_rsa_callback(SSL_CTX* ctx, RSA*(*f)(SSL*, int, int))
{
/* CyaSSL verifies all these internally */
}
void SSL_set_shutdown(SSL* ssl, int opt)
{
}
long SSL_CTX_set_options(SSL_CTX* ctx, long opt)
{
/* goahead calls with 0, do nothing */
return opt;
}
int SSL_set_rfd(SSL* ssl, int rfd)
{
ssl->rfd = rfd; /* not used directly to allow IO callbacks */
ssl->IOCB_ReadCtx = &ssl->rfd;
return SSL_SUCCESS;
}
int SSL_set_wfd(SSL* ssl, int wfd)
{
ssl->wfd = wfd; /* not used directly to allow IO callbacks */
ssl->IOCB_WriteCtx = &ssl->wfd;
return SSL_SUCCESS;
}
RSA* RSA_generate_key(int len, unsigned long bits, void(*f)(int,
int, void*), void* data)
{
/* no tmp key needed, actual generation not supported */
return 0;
}
X509_NAME* X509_get_issuer_name(X509* cert)
{
return &cert->issuer;
}
X509_NAME* X509_get_subject_name(X509* cert)
{
return &cert->subject;
}
/* copy name into buffer, at most sz bytes, if buffer is null will
malloc buffer, call responsible for freeing */
char* X509_NAME_oneline(X509_NAME* name, char* buffer, int sz)
{
int copySz = min(sz, name->sz);
if (!name->sz) return buffer;
if (!buffer) {
buffer = (char*)XMALLOC(name->sz, 0, DYNAMIC_TYPE_OPENSSL);
if (!buffer) return buffer;
copySz = name->sz;
}
if (copySz == 0)
return buffer;
XMEMCPY(buffer, name->name, copySz - 1);
buffer[copySz - 1] = 0;
return buffer;
}
X509* X509_STORE_CTX_get_current_cert(X509_STORE_CTX* ctx)
{
return 0;
}
int X509_STORE_CTX_get_error(X509_STORE_CTX* ctx)
{
return 0;
}
int X509_STORE_CTX_get_error_depth(X509_STORE_CTX* ctx)
{
return 0;
}
BIO_METHOD* BIO_f_buffer(void)
{
static BIO_METHOD meth;
meth.type = BIO_BUFFER;
return &meth;
}
long BIO_set_write_buffer_size(BIO* bio, long size)
{
/* CyaSSL has internal buffer, compatibility only */
return size;
}
BIO_METHOD* BIO_f_ssl(void)
{
static BIO_METHOD meth;
meth.type = BIO_SSL;
return &meth;
}
BIO* BIO_new_socket(int sfd, int close)
{
BIO* bio = (BIO*) XMALLOC(sizeof(BIO), 0, DYNAMIC_TYPE_OPENSSL);
if (bio) {
bio->type = BIO_SOCKET;
bio->close = close;
bio->eof = 0;
bio->ssl = 0;
bio->fd = sfd;
bio->prev = 0;
bio->next = 0;
}
return bio;
}
int BIO_eof(BIO* b)
{
if (b->eof)
return 1;
return 0;
}
long BIO_set_ssl(BIO* b, SSL* ssl, int close)
{
b->ssl = ssl;
b->close = close;
/* add to ssl for bio free if SSL_free called before/instead of free_all? */
return 0;
}
BIO* BIO_new(BIO_METHOD* method)
{
BIO* bio = (BIO*) XMALLOC(sizeof(BIO), 0, DYNAMIC_TYPE_OPENSSL);
if (bio) {
bio->type = method->type;
bio->close = 0;
bio->eof = 0;
bio->ssl = 0;
bio->fd = 0;
bio->prev = 0;
bio->next = 0;
}
return bio;
}
#ifdef USE_WINDOWS_API
#define CloseSocket(s) closesocket(s)
#else
#define CloseSocket(s) close(s)
#endif
int BIO_free(BIO* bio)
{
/* unchain?, doesn't matter in goahead since from free all */
if (bio) {
if (bio->close) {
if (bio->ssl)
SSL_free(bio->ssl);
if (bio->fd)
CloseSocket(bio->fd);
}
XFREE(bio, 0, DYNAMIC_TYPE_OPENSSL);
}
return 0;
}
int BIO_free_all(BIO* bio)
{
BIO* next = bio;
while ( (bio = next) ) {
next = bio->next;
BIO_free(bio);
}
return 0;
}
int BIO_read(BIO* bio, void* buf, int len)
{
int ret;
SSL* ssl = 0;
BIO* front = bio;
/* already got eof, again is error */
if (front->eof)
return -1;
while(bio && ((ssl = bio->ssl) == 0) )
bio = bio->next;
if (ssl == 0) return -1;
ret = SSL_read(ssl, buf, len);
if (ret == 0)
front->eof = 1;
else if (ret < 0) {
int err = SSL_get_error(ssl, 0);
if ( !(err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) )
front->eof = 1;
}
return ret;
}
int BIO_write(BIO* bio, const void* data, int len)
{
int ret;
SSL* ssl = 0;
BIO* front = bio;
/* already got eof, again is error */
if (front->eof)
return -1;
while(bio && ((ssl = bio->ssl) == 0) )
bio = bio->next;
if (ssl == 0) return -1;
ret = SSL_write(ssl, data, len);
if (ret == 0)
front->eof = 1;
else if (ret < 0) {
int err = SSL_get_error(ssl, 0);
if ( !(err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) )
front->eof = 1;
}
return ret;
}
BIO* BIO_push(BIO* top, BIO* append)
{
top->next = append;
append->prev = top;
return top;
}
int BIO_flush(BIO* bio)
{
/* for CyaSSL no flushing needed */
return 1;
}
#endif /* OPENSSL_EXTRA || GOAHEAD_WS */
#ifdef OPENSSL_EXTRA
unsigned long SSLeay(void)
{
return SSLEAY_VERSION_NUMBER;
}
const char* SSLeay_version(int type)
{
static const char* version = "SSLeay CyaSSL compatibility";
return version;
}
void MD5_Init(MD5_CTX* md5)
{
typedef char md5_test[sizeof(MD5_CTX) >= sizeof(Md5) ? 1 : -1];
(void)sizeof(md5_test);
InitMd5((Md5*)md5);
}
void MD5_Update(MD5_CTX* md5, const void* input, unsigned long sz)
{
Md5Update((Md5*)md5, (const byte*)input, sz);
}
void MD5_Final(byte* input, MD5_CTX* md5)
{
Md5Final((Md5*)md5, input);
}
void SHA_Init(SHA_CTX* sha)
{
typedef char sha_test[sizeof(SHA_CTX) >= sizeof(Sha) ? 1 : -1];
(void)sizeof(sha_test);
InitSha((Sha*)sha);
}
void SHA_Update(SHA_CTX* sha, const void* input, unsigned long sz)
{
ShaUpdate((Sha*)sha, (const byte*)input, sz);
}
void SHA_Final(byte* input, SHA_CTX* sha)
{
ShaFinal((Sha*)sha, input);
}
const EVP_MD* EVP_md5(void)
{
static const char* type = "MD5";
return type;
}
const EVP_MD* EVP_sha1(void)
{
static const char* type = "SHA";
return type;
}
void EVP_MD_CTX_init(EVP_MD_CTX* ctx)
{
/* do nothing */
}
int EVP_MD_CTX_cleanup(EVP_MD_CTX* ctx)
{
return 0;
}
int EVP_DigestInit(EVP_MD_CTX* ctx, const EVP_MD* type)
{
if (XSTRNCMP(type, "MD5", 3) == 0) {
ctx->macType = MD5;
MD5_Init((MD5_CTX*)&ctx->hash);
}
else if (XSTRNCMP(type, "SHA", 3) == 0) {
ctx->macType = SHA;
SHA_Init((SHA_CTX*)&ctx->hash);
}
else
return -1;
return 0;
}
int EVP_DigestUpdate(EVP_MD_CTX* ctx, const void* data, size_t sz)
{
if (ctx->macType == MD5)
MD5_Update((MD5_CTX*)&ctx->hash, data, (unsigned long)sz);
else if (ctx->macType == SHA)
SHA_Update((SHA_CTX*)&ctx->hash, data, (unsigned long)sz);
else
return -1;
return 0;
}
int EVP_DigestFinal(EVP_MD_CTX* ctx, unsigned char* md, unsigned int* s)
{
if (ctx->macType == MD5) {
MD5_Final(md, (MD5_CTX*)&ctx->hash);
if (s) *s = MD5_DIGEST_SIZE;
}
else if (ctx->macType == SHA) {
SHA_Final(md, (SHA_CTX*)&ctx->hash);
if (s) *s = SHA_DIGEST_SIZE;
}
else
return -1;
return 0;
}
int EVP_DigestFinal_ex(EVP_MD_CTX* ctx, unsigned char* md, unsigned int* s)
{
return EVP_DigestFinal(ctx, md, s);
}
unsigned char* HMAC(const EVP_MD* evp_md, const void* key, int key_len,
const unsigned char* d, int n, unsigned char* md, unsigned int* md_len)
{
Hmac hmac;
if (!md) return 0; /* no static buffer support */
if (XSTRNCMP(evp_md, "MD5", 3) == 0) {
HmacSetKey(&hmac, MD5, key, key_len);
if (md_len) *md_len = MD5_DIGEST_SIZE;
}
else if (XSTRNCMP(evp_md, "SHA", 3) == 0) {
HmacSetKey(&hmac, SHA, key, key_len);
if (md_len) *md_len = SHA_DIGEST_SIZE;
}
else
return 0;
HmacUpdate(&hmac, d, n);
HmacFinal(&hmac, md);
return md;
}
unsigned long ERR_get_error(void)
{
/* TODO: */
return 0;
}
void ERR_clear_error(void)
{
/* TODO: */
}
int RAND_status(void)
{
return 1; /* CTaoCrypt provides enough seed internally */
}
int RAND_bytes(unsigned char* buf, int num)
{
RNG rng;
if (InitRng(&rng))
return 0;
RNG_GenerateBlock(&rng, buf, num);
return 1;
}
int DES_key_sched(const_DES_cblock* key, DES_key_schedule* schedule)
{
XMEMCPY(schedule, key, sizeof(const_DES_cblock));
return 0;
}
void DES_cbc_encrypt(const unsigned char* input, unsigned char* output,
long length, DES_key_schedule* schedule, DES_cblock* ivec,
int enc)
{
Des des;
Des_SetKey(&des, (const byte*)schedule, (const byte*)ivec, !enc);
if (enc)
Des_CbcEncrypt(&des, output, input, length);
else
Des_CbcDecrypt(&des, output, input, length);
}
/* correctly sets ivec for next call */
void DES_ncbc_encrypt(const unsigned char* input, unsigned char* output,
long length, DES_key_schedule* schedule, DES_cblock* ivec,
int enc)
{
Des des;
Des_SetKey(&des, (const byte*)schedule, (const byte*)ivec, !enc);
if (enc)
Des_CbcEncrypt(&des, output, input, length);
else
Des_CbcDecrypt(&des, output, input, length);
XMEMCPY(ivec, output + length - sizeof(DES_cblock), sizeof(DES_cblock));
}
void ERR_free_strings(void)
{
/* handled internally */
}
void ERR_remove_state(unsigned long state)
{
/* TODO: GetErrors().Remove(); */
}
void EVP_cleanup(void)
{
/* nothing to do here */
}
void CRYPTO_cleanup_all_ex_data(void)
{
/* nothing to do here */
}
long SSL_CTX_set_mode(SSL_CTX* ctx, long mode)
{
/* SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER is CyaSSL default mode */
if (mode == SSL_MODE_ENABLE_PARTIAL_WRITE)
ctx->partialWrite = 1;
return mode;
}
long SSL_CTX_get_mode(SSL_CTX* ctx)
{
/* TODO: */
return 0;
}
void SSL_CTX_set_default_read_ahead(SSL_CTX* ctx, int m)
{
/* TODO: maybe? */
}
int SSL_CTX_set_session_id_context(SSL_CTX* ctx,
const unsigned char* sid_ctx,
unsigned int sid_ctx_len)
{
/* No application specific context needed for cyaSSL */
return SSL_SUCCESS;
}
long SSL_CTX_sess_get_cache_size(SSL_CTX* ctx)
{
/* TODO: maybe? */
return (~0);
}
unsigned long ERR_get_error_line_data(const char** file, int* line,
const char** data, int *flags)
{
/* Not implemented */
return 0;
}
X509* SSL_get_peer_certificate(SSL* ssl)
{
if (ssl->peerCert.issuer.sz)
return &ssl->peerCert;
else
return 0;
}
int SSL_set_ex_data(SSL* ssl, int idx, void* data)
{
return 0;
}
int SSL_get_shutdown(const SSL* ssl)
{
return 0;
}
int SSL_set_session_id_context(SSL* ssl, const unsigned char* id,
unsigned int len)
{
return 0;
}
void SSL_set_connect_state(SSL* ssl)
{
/* client by default */
}
int SSL_session_reused(SSL* ssl)
{
return ssl->options.resuming;
}
void SSL_SESSION_free(SSL_SESSION* session)
{
}
const char* SSL_get_version(SSL* ssl)
{
if (ssl->version.major == 3) {
switch (ssl->version.minor) {
case 0 :
return "SSLv3";
case 1 :
return "TLSv1";
case 2 :
return "TLSv1.1";
case 3 :
return "TLSv1.2";
}
}
return "unknown";
}
SSL_CIPHER* SSL_get_current_cipher(SSL* ssl)
{
return &ssl->cipher;
}
const char* SSL_CIPHER_get_name(const SSL_CIPHER* cipher)
{
if (cipher) {
switch (cipher->ssl->options.cipherSuite) {
case SSL_RSA_WITH_RC4_128_SHA :
return "SSL_RSA_WITH_RC4_128_SHA";
case SSL_RSA_WITH_RC4_128_MD5 :
return "SSL_RSA_WITH_RC4_128_MD5";
case SSL_RSA_WITH_3DES_EDE_CBC_SHA :
return "SSL_RSA_WITH_3DES_EDE_CBC_SHA";
case TLS_RSA_WITH_AES_128_CBC_SHA :
return "TLS_RSA_WITH_AES_128_CBC_SHA";
case TLS_RSA_WITH_AES_256_CBC_SHA :
return "TLS_RSA_WITH_AES_256_CBC_SHA";
case TLS_PSK_WITH_AES_128_CBC_SHA :
return "TLS_PSK_WITH_AES_128_CBC_SHA";
case TLS_PSK_WITH_AES_256_CBC_SHA :
return "TLS_PSK_WITH_AES_256_CBC_SHA";
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
case TLS_RSA_WITH_HC_128_CBC_MD5 :
return "TLS_RSA_WITH_HC_128_CBC_MD5";
case TLS_RSA_WITH_HC_128_CBC_SHA :
return "TLS_RSA_WITH_HC_128_CBC_SHA";
case TLS_RSA_WITH_RABBIT_CBC_SHA :
return "TLS_RSA_WITH_RABBIT_CBC_SHA";
case TLS_NTRU_RSA_WITH_RC4_128_SHA :
return "TLS_NTRU_RSA_WITH_RC4_128_SHA";
case TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA :
return "TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA";
case TLS_NTRU_RSA_WITH_AES_128_CBC_SHA :
return "TLS_NTRU_RSA_WITH_AES_128_CBC_SHA";
case TLS_NTRU_RSA_WITH_AES_256_CBC_SHA :
return "TLS_NTRU_RSA_WITH_AES_256_CBC_SHA";
}
}
return "NONE";
}
char* SSL_CIPHER_description(SSL_CIPHER* cipher, char* buffer, int len)
{
return 0;
}
SSL_SESSION* SSL_get1_session(SSL* ssl) /* what's ref count */
{
return 0;
}
void X509_free(X509* buf)
{
}
void OPENSSL_free(void* buf)
{
}
int OCSP_parse_url(char* url, char** host, char** port, char** path,
int* ssl)
{
return 0;
}
SSL_METHOD* SSLv2_client_method(void)
{
return 0;
}
SSL_METHOD* SSLv2_server_method(void)
{
return 0;
}
#ifndef NO_MD4
void MD4_Init(MD4_CTX* md4)
{
/* make sure we have a big enough buffer */
typedef char ok[sizeof(md4->buffer) >= sizeof(Md4) ? 1 : -1];
(void) sizeof(ok);
InitMd4((Md4*)md4);
}
void MD4_Update(MD4_CTX* md4, const void* data, size_t len)
{
Md4Update((Md4*)md4, (const byte*)data, (word32)len);
}
void MD4_Final(unsigned char* digest, MD4_CTX* md4)
{
Md4Final((Md4*)md4, digest);
}
#endif /* NO_MD4 */
BIO* BIO_pop(BIO* top)
{
return 0;
}
int BIO_pending(BIO* bio)
{
return 0;
}
BIO_METHOD* BIO_s_mem(void)
{
return 0;
}
BIO_METHOD* BIO_f_base64(void)
{
return 0;
}
void BIO_set_flags(BIO* bio, int flags)
{
}
void RAND_screen(void)
{
}
const char* RAND_file_name(char* fname, size_t len)
{
return 0;
}
int RAND_write_file(const char* fname)
{
return 0;
}
int RAND_load_file(const char* fname, long len)
{
/* CTaoCrypt provides enough entropy internally or will report error */
if (len == -1)
return 1024;
else
return (int)len;
}
int RAND_egd(const char* path)
{
return 0;
}
COMP_METHOD* COMP_zlib(void)
{
return 0;
}
COMP_METHOD* COMP_rle(void)
{
return 0;
}
int SSL_COMP_add_compression_method(int method, void* data)
{
return 0;
}
int SSL_get_ex_new_index(long idx, void* data, void* cb1, void* cb2,
void* cb3)
{
return 0;
}
int CRYPTO_num_locks(void)
{
return 0;
}
void CRYPTO_set_id_callback(unsigned long (*f)(void))
{
}
void CRYPTO_set_locking_callback(void (*f)(int, int, const char*, int))
{
}
void CRYPTO_set_dynlock_create_callback(CRYPTO_dynlock_value* (*f)(
const char*, int))
{
}
void CRYPTO_set_dynlock_lock_callback(void (*f)(int, CRYPTO_dynlock_value*,
const char*, int))
{
}
void CRYPTO_set_dynlock_destroy_callback(void (*f)(CRYPTO_dynlock_value*,
const char*, int))
{
}
const char* X509_verify_cert_error_string(long err)
{
return 0;
}
int X509_LOOKUP_add_dir(X509_LOOKUP* lookup, const char* dir, long len)
{
return 0;
}
int X509_LOOKUP_load_file(X509_LOOKUP* lookup, const char* file, long len)
{
return 0;
}
X509_LOOKUP_METHOD* X509_LOOKUP_hash_dir(void)
{
return 0;
}
X509_LOOKUP_METHOD* X509_LOOKUP_file(void)
{
return 0;
}
X509_LOOKUP* X509_STORE_add_lookup(X509_STORE* store, X509_LOOKUP_METHOD* m)
{
return 0;
}
X509_STORE* X509_STORE_new(void)
{
return 0;
}
int X509_STORE_get_by_subject(X509_STORE_CTX* ctx, int idx, X509_NAME* name,
X509_OBJECT* obj)
{
return 0;
}
int X509_STORE_CTX_init(X509_STORE_CTX* ctx, X509_STORE* store, X509* x509,
STACK_OF(X509)* sk)
{
return 0;
}
void X509_STORE_CTX_cleanup(X509_STORE_CTX* ctx)
{
}
ASN1_TIME* X509_CRL_get_lastUpdate(X509_CRL* crl)
{
return 0;
}
ASN1_TIME* X509_CRL_get_nextUpdate(X509_CRL* crl)
{
return 0;
}
EVP_PKEY* X509_get_pubkey(X509* x509)
{
return 0;
}
int X509_CRL_verify(X509_CRL* crl, EVP_PKEY* key)
{
return 0;
}
void X509_STORE_CTX_set_error(X509_STORE_CTX* ctx, int err)
{
}
void X509_OBJECT_free_contents(X509_OBJECT* obj)
{
}
void EVP_PKEY_free(EVP_PKEY* key)
{
}
int X509_cmp_current_time(const ASN1_TIME* time)
{
return 0;
}
int sk_X509_REVOKED_num(X509_REVOKED* revoked)
{
return 0;
}
X509_REVOKED* X509_CRL_get_REVOKED(X509_CRL* crl)
{
return 0;
}
X509_REVOKED* sk_X509_REVOKED_value(X509_REVOKED* revoked, int value)
{
return 0;
}
ASN1_INTEGER* X509_get_serialNumber(X509* x509)
{
return 0;
}
int ASN1_TIME_print(BIO* bio, const ASN1_TIME* time)
{
return 0;
}
int ASN1_INTEGER_cmp(const ASN1_INTEGER* a, const ASN1_INTEGER* b)
{
return 0;
}
long ASN1_INTEGER_get(const ASN1_INTEGER* i)
{
return 0;
}
void* X509_STORE_CTX_get_ex_data(X509_STORE_CTX* ctx, int idx)
{
return 0;
}
int SSL_get_ex_data_X509_STORE_CTX_idx(void)
{
return 0;
}
void* SSL_get_ex_data(const SSL* ssl, int idx)
{
return 0;
}
void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX* ctx, void* userdata)
{
ctx->userdata = userdata;
}
void SSL_CTX_set_default_passwd_cb(SSL_CTX* ctx, pem_password_cb cb)
{
ctx->passwd_cb = cb;
}
long SSL_CTX_set_timeout(SSL_CTX* ctx, long to)
{
return 0;
}
void SSL_CTX_set_info_callback(SSL_CTX* ctx, void (*f)())
{
}
unsigned long ERR_peek_error(void)
{
return 0;
}
int ERR_GET_REASON(int err)
{
return 0;
}
char* SSL_alert_type_string_long(int alert)
{
return 0;
}
char* SSL_alert_desc_string_long(int alert)
{
return 0;
}
char* SSL_state_string_long(SSL* ssl)
{
return 0;
}
void RSA_free(RSA* rsa)
{
}
int PEM_def_callback(char* name, int num, int w, void* key)
{
return 0;
}
long SSL_CTX_sess_accept(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_connect(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_accept_good(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_connect_good(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_accept_renegotiate(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_connect_renegotiate(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_hits(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_cb_hits(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_cache_full(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_misses(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_timeouts(SSL_CTX* ctx)
{
return 0;
}
long SSL_CTX_sess_number(SSL_CTX* ctx)
{
return 0;
}
void DES_set_key_unchecked(const_DES_cblock* des, DES_key_schedule* key)
{
}
void DES_set_odd_parity(DES_cblock* des)
{
}
void DES_ecb_encrypt(DES_cblock* desa, DES_cblock* desb,
DES_key_schedule* key, int len)
{
}
int BIO_printf(BIO* bio, const char* format, ...)
{
return 0;
}
int ASN1_UTCTIME_print(BIO* bio, const ASN1_UTCTIME* a)
{
return 0;
}
int sk_num(X509_REVOKED* rev)
{
return 0;
}
void* sk_value(X509_REVOKED* rev, int i)
{
return 0;
}
int EVP_BytesToKey(const EVP_CIPHER* type, const EVP_MD* md,
const byte* salt, const byte* data, int sz, int count,
byte* key, byte* iv)
{
int keyLen = 0;
int ivLen = 0;
Md5 myMD;
byte digest[MD5_DIGEST_SIZE];
int j;
int keyLeft;
int ivLeft;
int keyOutput = 0;
InitMd5(&myMD);
/* only support MD5 for now */
if (XSTRNCMP(md, "MD5", 3)) return 0;
/* only support CBC DES and AES for now */
if (XSTRNCMP(type, "DES-CBC", 7) == 0) {
keyLen = DES_KEY_SIZE;
ivLen = DES_IV_SIZE;
}
else if (XSTRNCMP(type, "DES-EDE3-CBC", 12) == 0) {
keyLen = DES3_KEY_SIZE;
ivLen = DES_IV_SIZE;
}
else if (XSTRNCMP(type, "AES-128-CBC", 11) == 0) {
keyLen = AES_128_KEY_SIZE;
ivLen = AES_IV_SIZE;
}
else if (XSTRNCMP(type, "AES-192-CBC", 11) == 0) {
keyLen = AES_192_KEY_SIZE;
ivLen = AES_IV_SIZE;
}
else if (XSTRNCMP(type, "AES-256-CBC", 11) == 0) {
keyLen = AES_256_KEY_SIZE;
ivLen = AES_IV_SIZE;
}
else
return 0;
keyLeft = keyLen;
ivLeft = ivLen;
while (keyOutput < (keyLen + ivLen)) {
int digestLeft = MD5_DIGEST_SIZE;
/* D_(i - 1) */
if (keyOutput) /* first time D_0 is empty */
Md5Update(&myMD, digest, MD5_DIGEST_SIZE);
/* data */
Md5Update(&myMD, data, sz);
/* salt */
if (salt)
Md5Update(&myMD, salt, EVP_SALT_SIZE);
Md5Final(&myMD, digest);
/* count */
for (j = 1; j < count; j++) {
Md5Update(&myMD, digest, MD5_DIGEST_SIZE);
Md5Final(&myMD, digest);
}
if (keyLeft) {
int store = min(keyLeft, MD5_DIGEST_SIZE);
XMEMCPY(&key[keyLen - keyLeft], digest, store);
keyOutput += store;
keyLeft -= store;
digestLeft -= store;
}
if (ivLeft && digestLeft) {
int store = min(ivLeft, digestLeft);
XMEMCPY(&iv[ivLen - ivLeft], &digest[MD5_DIGEST_SIZE -
digestLeft], store);
keyOutput += store;
ivLeft -= store;
}
}
if (keyOutput != (keyLen + ivLen))
return 0;
return keyOutput;
}
/* stunnel 4.28 needs */
void* SSL_CTX_get_ex_data(const SSL_CTX* ctx, int d)
{
return 0;
}
int SSL_CTX_set_ex_data(SSL_CTX* ctx, int d, void* p)
{
return SSL_SUCCESS;
}
void SSL_CTX_sess_set_get_cb(SSL_CTX* ctx, SSL_SESSION*(*f)(SSL*,
unsigned char*, int, int*))
{
}
void SSL_CTX_sess_set_new_cb(SSL_CTX* ctx, int (*f)(SSL*, SSL_SESSION*))
{
}
void SSL_CTX_sess_set_remove_cb(SSL_CTX* ctx, void (*f)(SSL_CTX*,
SSL_SESSION*))
{
}
int i2d_SSL_SESSION(SSL_SESSION* sess, unsigned char** p)
{
return sizeof(SSL_SESSION);
}
SSL_SESSION* d2i_SSL_SESSION(SSL_SESSION** sess, const unsigned char** p,
long i)
{
return *sess;
}
long SSL_SESSION_get_timeout(const SSL_SESSION* sess)
{
return sess->timeout;
}
long SSL_SESSION_get_time(const SSL_SESSION* sess)
{
return sess->bornOn;
}
int SSL_CTX_get_ex_new_index(long idx, void* arg, void* a, void* b, void* c)
{
return 0;
}
#endif /* OPENSSL_EXTRA */
#ifdef SESSION_CERTS
/* Get peer's certificate chain */
X509_CHAIN* CyaSSL_get_peer_chain(SSL* ssl)
{
if (ssl)
return &ssl->session.chain;
return 0;
}
/* Get peer's certificate chain total count */
int CyaSSL_get_chain_count(X509_CHAIN* chain)
{
if (chain)
return chain->count;
return 0;
}
/* Get peer's ASN.1 DER ceritifcate at index (idx) length in bytes */
int CyaSSL_get_chain_length(X509_CHAIN* chain, int idx)
{
if (chain)
return chain->certs[idx].length;
return 0;
}
/* Get peer's ASN.1 DER ceritifcate at index (idx) */
byte* CyaSSL_get_chain_cert(X509_CHAIN* chain, int idx)
{
if (chain)
return chain->certs[idx].buffer;
return 0;
}
/* Get peer's PEM ceritifcate at index (idx), output to buffer if inLen big
enough else return error (-1), output length is in *outLen */
int CyaSSL_get_chain_cert_pem(X509_CHAIN* chain, int idx,
unsigned char* buffer, int inLen, int* outLen)
{
const char header[] = "-----BEGIN CERTIFICATE-----\n";
const char footer[] = "-----END CERTIFICATE-----\n";
int headerLen = sizeof(header) - 1;
int footerLen = sizeof(footer) - 1;
int i;
if (!chain || !outLen || !buffer)
return -1;
/* don't even try if inLen too short */
if (inLen < headerLen + footerLen + chain->certs[idx].length)
return -1;
/* header */
XMEMCPY(buffer, header, headerLen);
i = headerLen;
/* body */
*outLen = inLen; /* input to Base64Encode */
if (Base64Encode(chain->certs[idx].buffer, chain->certs[idx].length,
buffer + i, (word32*)outLen) < 0)
return -1;
i += *outLen;
/* footer */
if ( (i + footerLen) > inLen)
return -1;
XMEMCPY(buffer + i, footer, footerLen);
*outLen += headerLen + footerLen;
return 0;
}
/* get session ID */
const byte* CyaSSL_get_sessionID(const SSL_SESSION* session)
{
return session->sessionID;
}
#endif /* SESSION_CERTS */