From 4e3458a565da5bccf30fe598e87ad7da1ee9daa7 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 12 Aug 2015 19:58:29 +0100 Subject: [PATCH] Delete unused functions Remove all the functions and dead code that is now no longer required as a result of the DTLS client move into the new state machine code. Reviewed-by: Tim Hudson Reviewed-by: Richard Levitte --- ssl/d1_clnt.c | 654 ------------------------------------------------- ssl/s3_clnt.c | 329 ------------------------- ssl/ssl_locl.h | 15 -- 3 files changed, 998 deletions(-) diff --git a/ssl/d1_clnt.c b/ssl/d1_clnt.c index ef8f25bbe6..47b1f252de 100644 --- a/ssl/d1_clnt.c +++ b/ssl/d1_clnt.c @@ -126,9 +126,6 @@ #endif static const SSL_METHOD *dtls1_get_client_method(int ver); -#if 0 -static int dtls1_get_hello_verify(SSL *s); -#endif static const SSL_METHOD *dtls1_get_client_method(int ver) { @@ -158,657 +155,6 @@ IMPLEMENT_dtls1_meth_func(DTLS1_VERSION, dtls1_connect, dtls1_get_client_method, DTLSv1_2_enc_data) -#if 0 -int dtls1_connect(SSL *s) -{ - BUF_MEM *buf = NULL; - unsigned long Time = (unsigned long)time(NULL); - void (*cb) (const SSL *ssl, int type, int val) = NULL; - int ret = -1; - int new_state, state, skip = 0; -#ifndef OPENSSL_NO_SCTP - unsigned char sctpauthkey[64]; - char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; -#endif - - RAND_add(&Time, sizeof(Time), 0); - ERR_clear_error(); - clear_sys_error(); - - if (s->info_callback != NULL) - cb = s->info_callback; - else if (s->ctx->info_callback != NULL) - cb = s->ctx->info_callback; - - s->in_handshake++; - if (!SSL_in_init(s) || SSL_in_before(s)) { - if (!SSL_clear(s)) - return -1; - } - -#ifndef OPENSSL_NO_SCTP - /* - * Notify SCTP BIO socket to enter handshake mode and prevent stream - * identifier other than 0. Will be ignored if no SCTP is used. - */ - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE, - s->in_handshake, NULL); -#endif - -#ifndef OPENSSL_NO_HEARTBEATS - /* - * If we're awaiting a HeartbeatResponse, pretend we already got and - * don't await it anymore, because Heartbeats don't make sense during - * handshakes anyway. - */ - if (s->tlsext_hb_pending) { - dtls1_stop_timer(s); - s->tlsext_hb_pending = 0; - s->tlsext_hb_seq++; - } -#endif - - for (;;) { - state = s->state; - - switch (s->state) { - case SSL_ST_RENEGOTIATE: - s->renegotiate = 1; - s->state = SSL_ST_CONNECT; - s->ctx->stats.sess_connect_renegotiate++; - /* break */ - case SSL_ST_BEFORE: - case SSL_ST_CONNECT: - case SSL_ST_BEFORE | SSL_ST_CONNECT: - case SSL_ST_OK | SSL_ST_CONNECT: - - s->server = 0; - if (cb != NULL) - cb(s, SSL_CB_HANDSHAKE_START, 1); - - if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) && - (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00)) { - SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR); - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - - /* s->version=SSL3_VERSION; */ - s->type = SSL_ST_CONNECT; - - if (s->init_buf == NULL) { - if ((buf = BUF_MEM_new()) == NULL) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - s->init_buf = buf; - buf = NULL; - } - - if (!ssl3_setup_buffers(s)) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - - /* setup buffing BIO */ - if (!ssl_init_wbio_buffer(s, 0)) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - - /* don't push the buffering BIO quite yet */ - - s->state = SSL3_ST_CW_CLNT_HELLO_A; - s->ctx->stats.sess_connect++; - s->init_num = 0; - /* mark client_random uninitialized */ - memset(s->s3->client_random, 0, sizeof(s->s3->client_random)); - s->d1->send_cookie = 0; - s->hit = 0; - /* - * Should have been reset by ssl3_get_finished, too. - */ - s->s3->change_cipher_spec = 0; - break; - -#ifndef OPENSSL_NO_SCTP - case DTLS1_SCTP_ST_CR_READ_SOCK: - - if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) { - s->s3->in_read_app_data = 2; - s->rwstate = SSL_READING; - BIO_clear_retry_flags(SSL_get_rbio(s)); - BIO_set_retry_read(SSL_get_rbio(s)); - ret = -1; - goto end; - } - - s->state = s->s3->tmp.next_state; - break; - - case DTLS1_SCTP_ST_CW_WRITE_SOCK: - /* read app data until dry event */ - - ret = BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s)); - if (ret < 0) - goto end; - - if (ret == 0) { - s->s3->in_read_app_data = 2; - s->rwstate = SSL_READING; - BIO_clear_retry_flags(SSL_get_rbio(s)); - BIO_set_retry_read(SSL_get_rbio(s)); - ret = -1; - goto end; - } - - s->state = s->d1->next_state; - break; -#endif - - case SSL3_ST_CW_CLNT_HELLO_A: - case SSL3_ST_CW_CLNT_HELLO_B: - - s->shutdown = 0; - - /* every DTLS ClientHello resets Finished MAC */ - ssl3_init_finished_mac(s); - - dtls1_start_timer(s); - ret = ssl3_client_hello(s); - if (ret <= 0) - goto end; - - if (s->d1->send_cookie) { - s->state = SSL3_ST_CW_FLUSH; - s->s3->tmp.next_state = SSL3_ST_CR_SRVR_HELLO_A; - } else - s->state = SSL3_ST_CR_SRVR_HELLO_A; - - s->init_num = 0; - -#ifndef OPENSSL_NO_SCTP - /* Disable buffering for SCTP */ - if (!BIO_dgram_is_sctp(SSL_get_wbio(s))) { -#endif - /* - * turn on buffering for the next lot of output - */ - if (s->bbio != s->wbio) - s->wbio = BIO_push(s->bbio, s->wbio); -#ifndef OPENSSL_NO_SCTP - } -#endif - - break; - - case SSL3_ST_CR_SRVR_HELLO_A: - case SSL3_ST_CR_SRVR_HELLO_B: - ret = ssl3_get_server_hello(s); - if (ret <= 0) - goto end; - else { - if (s->hit) { -#ifndef OPENSSL_NO_SCTP - /* - * Add new shared key for SCTP-Auth, will be ignored if - * no SCTP used. - */ - snprintf((char *)labelbuffer, - sizeof(DTLS1_SCTP_AUTH_LABEL), - DTLS1_SCTP_AUTH_LABEL); - - if (SSL_export_keying_material(s, sctpauthkey, - sizeof(sctpauthkey), - labelbuffer, - sizeof(labelbuffer), NULL, 0, - 0) <= 0) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - - BIO_ctrl(SSL_get_wbio(s), - BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, - sizeof(sctpauthkey), sctpauthkey); -#endif - - s->state = SSL3_ST_CR_CHANGE_A; - if (s->tlsext_ticket_expected) { - /* receive renewed session ticket */ - s->state = SSL3_ST_CR_SESSION_TICKET_A; - } - } else - s->state = DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A; - } - s->init_num = 0; - break; - - case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A: - case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B: - - ret = dtls1_get_hello_verify(s); - if (ret <= 0) - goto end; - dtls1_stop_timer(s); - if (s->d1->send_cookie) /* start again, with a cookie */ - s->state = SSL3_ST_CW_CLNT_HELLO_A; - else - s->state = SSL3_ST_CR_CERT_A; - s->init_num = 0; - break; - - case SSL3_ST_CR_CERT_A: - case SSL3_ST_CR_CERT_B: - /* Check if it is anon DH or PSK */ - if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) && - !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) { - ret = ssl3_get_server_certificate(s); - if (ret <= 0) - goto end; - - if (s->tlsext_status_expected) - s->state = SSL3_ST_CR_CERT_STATUS_A; - else - s->state = SSL3_ST_CR_KEY_EXCH_A; - } else { - skip = 1; - s->state = SSL3_ST_CR_KEY_EXCH_A; - } - - s->init_num = 0; - break; - - case SSL3_ST_CR_KEY_EXCH_A: - case SSL3_ST_CR_KEY_EXCH_B: - ret = ssl3_get_key_exchange(s); - if (ret <= 0) - goto end; - s->state = SSL3_ST_CR_CERT_REQ_A; - s->init_num = 0; - - /* - * at this point we check that we have the required stuff from - * the server - */ - if (!ssl3_check_cert_and_algorithm(s)) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - break; - - case SSL3_ST_CR_CERT_REQ_A: - case SSL3_ST_CR_CERT_REQ_B: - ret = ssl3_get_certificate_request(s); - if (ret <= 0) - goto end; - s->state = SSL3_ST_CR_SRVR_DONE_A; - s->init_num = 0; - break; - - case SSL3_ST_CR_SRVR_DONE_A: - case SSL3_ST_CR_SRVR_DONE_B: - ret = ssl3_get_server_done(s); - if (ret <= 0) - goto end; - dtls1_stop_timer(s); - if (s->s3->tmp.cert_req) - s->s3->tmp.next_state = SSL3_ST_CW_CERT_A; - else - s->s3->tmp.next_state = SSL3_ST_CW_KEY_EXCH_A; - s->init_num = 0; - -#ifndef OPENSSL_NO_SCTP - if (BIO_dgram_is_sctp(SSL_get_wbio(s)) && - state == SSL_ST_RENEGOTIATE) - s->state = DTLS1_SCTP_ST_CR_READ_SOCK; - else -#endif - s->state = s->s3->tmp.next_state; - break; - - case SSL3_ST_CW_CERT_A: - case SSL3_ST_CW_CERT_B: - case SSL3_ST_CW_CERT_C: - case SSL3_ST_CW_CERT_D: - dtls1_start_timer(s); - ret = ssl3_send_client_certificate(s); - if (ret <= 0) - goto end; - s->state = SSL3_ST_CW_KEY_EXCH_A; - s->init_num = 0; - break; - - case SSL3_ST_CW_KEY_EXCH_A: - case SSL3_ST_CW_KEY_EXCH_B: - dtls1_start_timer(s); - ret = ssl3_send_client_key_exchange(s); - if (ret <= 0) - goto end; - -#ifndef OPENSSL_NO_SCTP - /* - * Add new shared key for SCTP-Auth, will be ignored if no SCTP - * used. - */ - snprintf((char *)labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL), - DTLS1_SCTP_AUTH_LABEL); - - if (SSL_export_keying_material(s, sctpauthkey, - sizeof(sctpauthkey), labelbuffer, - sizeof(labelbuffer), NULL, 0, 0) <= 0) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, - sizeof(sctpauthkey), sctpauthkey); -#endif - - /* - * EAY EAY EAY need to check for DH fix cert sent back - */ - /* - * For TLS, cert_req is set to 2, so a cert chain of nothing is - * sent, but no verify packet is sent - */ - if (s->s3->tmp.cert_req == 1) { - s->state = SSL3_ST_CW_CERT_VRFY_A; - } else { -#ifndef OPENSSL_NO_SCTP - if (BIO_dgram_is_sctp(SSL_get_wbio(s))) { - s->d1->next_state = SSL3_ST_CW_CHANGE_A; - s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK; - } else -#endif - s->state = SSL3_ST_CW_CHANGE_A; - } - - s->init_num = 0; - break; - - case SSL3_ST_CW_CERT_VRFY_A: - case SSL3_ST_CW_CERT_VRFY_B: - dtls1_start_timer(s); - ret = ssl3_send_client_verify(s); - if (ret <= 0) - goto end; -#ifndef OPENSSL_NO_SCTP - if (BIO_dgram_is_sctp(SSL_get_wbio(s))) { - s->d1->next_state = SSL3_ST_CW_CHANGE_A; - s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK; - } else -#endif - s->state = SSL3_ST_CW_CHANGE_A; - s->init_num = 0; - break; - - case SSL3_ST_CW_CHANGE_A: - case SSL3_ST_CW_CHANGE_B: - if (!s->hit) - dtls1_start_timer(s); - ret = dtls1_send_change_cipher_spec(s, - SSL3_ST_CW_CHANGE_A, - SSL3_ST_CW_CHANGE_B); - if (ret <= 0) - goto end; - - s->state = SSL3_ST_CW_FINISHED_A; - s->init_num = 0; - - s->session->cipher = s->s3->tmp.new_cipher; -#ifdef OPENSSL_NO_COMP - s->session->compress_meth = 0; -#else - if (s->s3->tmp.new_compression == NULL) - s->session->compress_meth = 0; - else - s->session->compress_meth = s->s3->tmp.new_compression->id; -#endif - if (!s->method->ssl3_enc->setup_key_block(s)) { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } - - if (!s->method->ssl3_enc->change_cipher_state(s, - SSL3_CHANGE_CIPHER_CLIENT_WRITE)) - { - ret = -1; - s->state = SSL_ST_ERR; - goto end; - } -#ifndef OPENSSL_NO_SCTP - if (s->hit) { - /* - * Change to new shared key of SCTP-Auth, will be ignored if - * no SCTP used. - */ - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, - 0, NULL); - } -#endif - - dtls1_reset_seq_numbers(s, SSL3_CC_WRITE); - break; - - case SSL3_ST_CW_FINISHED_A: - case SSL3_ST_CW_FINISHED_B: - if (!s->hit) - dtls1_start_timer(s); - ret = ssl3_send_finished(s, - SSL3_ST_CW_FINISHED_A, - SSL3_ST_CW_FINISHED_B, - s->method-> - ssl3_enc->client_finished_label, - s->method-> - ssl3_enc->client_finished_label_len); - if (ret <= 0) - goto end; - s->state = SSL3_ST_CW_FLUSH; - - if (s->hit) { - s->s3->tmp.next_state = SSL_ST_OK; -#ifndef OPENSSL_NO_SCTP - if (BIO_dgram_is_sctp(SSL_get_wbio(s))) { - s->d1->next_state = s->s3->tmp.next_state; - s->s3->tmp.next_state = DTLS1_SCTP_ST_CW_WRITE_SOCK; - } -#endif - } else { -#ifndef OPENSSL_NO_SCTP - /* - * Change to new shared key of SCTP-Auth, will be ignored if - * no SCTP used. - */ - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, - 0, NULL); -#endif - - /* - * Allow NewSessionTicket if ticket expected - */ - if (s->tlsext_ticket_expected) - s->s3->tmp.next_state = SSL3_ST_CR_SESSION_TICKET_A; - else - s->s3->tmp.next_state = SSL3_ST_CR_CHANGE_A; - } - s->init_num = 0; - break; - - case SSL3_ST_CR_SESSION_TICKET_A: - case SSL3_ST_CR_SESSION_TICKET_B: - ret = ssl3_get_new_session_ticket(s); - if (ret <= 0) - goto end; - s->state = SSL3_ST_CR_CHANGE_A; - s->init_num = 0; - break; - - case SSL3_ST_CR_CERT_STATUS_A: - case SSL3_ST_CR_CERT_STATUS_B: - ret = ssl3_get_cert_status(s); - if (ret <= 0) - goto end; - s->state = SSL3_ST_CR_KEY_EXCH_A; - s->init_num = 0; - break; - - case SSL3_ST_CR_CHANGE_A: - case SSL3_ST_CR_CHANGE_B: - ret = ssl3_get_change_cipher_spec(s, SSL3_ST_CR_CHANGE_A, - SSL3_ST_CR_CHANGE_B); - if (ret <= 0) - goto end; - - s->state = SSL3_ST_CR_FINISHED_A; - s->init_num = 0; - break; - - case SSL3_ST_CR_FINISHED_A: - case SSL3_ST_CR_FINISHED_B: - ret = ssl3_get_finished(s, SSL3_ST_CR_FINISHED_A, - SSL3_ST_CR_FINISHED_B); - if (ret <= 0) - goto end; - dtls1_stop_timer(s); - - if (s->hit) - s->state = SSL3_ST_CW_CHANGE_A; - else - s->state = SSL_ST_OK; - -#ifndef OPENSSL_NO_SCTP - if (BIO_dgram_is_sctp(SSL_get_wbio(s)) && - state == SSL_ST_RENEGOTIATE) { - s->d1->next_state = s->state; - s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK; - } -#endif - - s->init_num = 0; - break; - - case SSL3_ST_CW_FLUSH: - s->rwstate = SSL_WRITING; - if (BIO_flush(s->wbio) <= 0) { - /* - * If the write error was fatal, stop trying - */ - if (!BIO_should_retry(s->wbio)) { - s->rwstate = SSL_NOTHING; - s->state = s->s3->tmp.next_state; - } - - ret = -1; - goto end; - } - s->rwstate = SSL_NOTHING; - s->state = s->s3->tmp.next_state; - break; - - case SSL_ST_OK: - /* clean a few things up */ - ssl3_cleanup_key_block(s); - - /* Remove the buffering */ - ssl_free_wbio_buffer(s); - - s->init_num = 0; - s->renegotiate = 0; - s->new_session = 0; - - ssl_update_cache(s, SSL_SESS_CACHE_CLIENT); - if (s->hit) - s->ctx->stats.sess_hit++; - - ret = 1; - /* s->server=0; */ - s->handshake_func = dtls1_connect; - s->ctx->stats.sess_connect_good++; - - if (cb != NULL) - cb(s, SSL_CB_HANDSHAKE_DONE, 1); - - /* done with handshaking */ - s->d1->handshake_read_seq = 0; - s->d1->next_handshake_write_seq = 0; - goto end; - /* break; */ - - case SSL_ST_ERR: - default: - SSLerr(SSL_F_DTLS1_CONNECT, SSL_R_UNKNOWN_STATE); - ret = -1; - goto end; - /* break; */ - } - - /* did we do anything */ - if (!s->s3->tmp.reuse_message && !skip) { - if (s->debug) { - if ((ret = BIO_flush(s->wbio)) <= 0) - goto end; - } - - if ((cb != NULL) && (s->state != state)) { - new_state = s->state; - s->state = state; - cb(s, SSL_CB_CONNECT_LOOP, 1); - s->state = new_state; - } - } - skip = 0; - } - end: - s->in_handshake--; - -#ifndef OPENSSL_NO_SCTP - /* - * Notify SCTP BIO socket to leave handshake mode and allow stream - * identifier other than 0. Will be ignored if no SCTP is used. - */ - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE, - s->in_handshake, NULL); -#endif - - BUF_MEM_free(buf); - if (cb != NULL) - cb(s, SSL_CB_CONNECT_EXIT, ret); - return (ret); -} -#endif - -#if 0 -static int dtls1_get_hello_verify(SSL *s) -{ - int n, al, ok = 0; - unsigned char *data; - unsigned int cookie_len; - - /* TODO: CHECK first_packet handling!!! */ - s->first_packet = 1; - n = s->method->ssl_get_message(s, - DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A, - DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B, - -1, s->max_cert_list, &ok); - s->first_packet = 0; - - if (!ok) - return ((int)n); -} -#endif enum MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, unsigned long n) { diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 715f08bbfa..9e5165c53b 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -267,23 +267,6 @@ static int ssl_set_version(SSL *s) return 1; } -int ssl3_client_hello(SSL *s) -{ - if (s->state == SSL3_ST_CW_CLNT_HELLO_A) { - if(tls_construct_client_hello(s) == 0) - goto err; - - s->state = SSL3_ST_CW_CLNT_HELLO_B; - } - - /* SSL3_ST_CW_CLNT_HELLO_B */ - return ssl_do_write(s); - err: - s->state = SSL_ST_ERR; - return -1; - -} - int tls_construct_client_hello(SSL *s) { unsigned char *buf; @@ -465,53 +448,6 @@ int tls_construct_client_hello(SSL *s) return 0; } -#if 0 -int ssl3_get_server_hello(SSL *s) -{ - int ok, al; - long n; - /* - * Hello verify request and/or server hello version may not match so set - * first packet if we're negotiating version. - */ - s->first_packet = 1; - - n = s->method->ssl_get_message(s, - SSL3_ST_CR_SRVR_HELLO_A, - SSL3_ST_CR_SRVR_HELLO_B, -1, 20000, &ok); - - if (!ok) - return ((int)n); - - s->first_packet = 0; - if (SSL_IS_DTLS(s)) { - if (s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST) { - if (s->d1->send_cookie == 0) { - s->s3->tmp.reuse_message = 1; - return 1; - } else { /* already sent a cookie */ - - al = SSL_AD_UNEXPECTED_MESSAGE; - SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_BAD_MESSAGE_TYPE); - goto f_err; - } - } - } - - if (s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO) { - al = SSL_AD_UNEXPECTED_MESSAGE; - SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_BAD_MESSAGE_TYPE); - goto f_err; - } - - return tls_process_server_hello(s, (unsigned long)n); - f_err: - ssl3_send_alert(s, SSL3_AL_FATAL, al); - s->state = SSL_ST_ERR; - return (-1); -} -#endif - enum MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, unsigned long n) { STACK_OF(SSL_CIPHER) *sk; @@ -858,37 +794,6 @@ enum MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, unsigned long n) return MSG_PROCESS_ERROR; } -int ssl3_get_server_certificate(SSL *s) -{ - long n; - int ok, al; - - n = s->method->ssl_get_message(s, - SSL3_ST_CR_CERT_A, - SSL3_ST_CR_CERT_B, - -1, s->max_cert_list, &ok); - - if (!ok) - return ((int)n); - - if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) { - s->s3->tmp.reuse_message = 1; - return (1); - } - - if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE) { - al = SSL_AD_UNEXPECTED_MESSAGE; - SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, SSL_R_BAD_MESSAGE_TYPE); - goto f_err; - } - - return tls_process_server_certificate(s, (unsigned long)n); - f_err: - ssl3_send_alert(s, SSL3_AL_FATAL, al); - s->state = SSL_ST_ERR; - return -1; -} - enum MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, unsigned long n) { int al, i, ret = MSG_PROCESS_ERROR, exp_idx; @@ -1019,43 +924,6 @@ enum MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, unsigned long n) return ret; } -int ssl3_get_key_exchange(SSL *s) -{ - long n; - int ok; - long alg_k; - - /* - * use same message size as in ssl3_get_certificate_request() as - * ServerKeyExchange message may be skipped - */ - n = s->method->ssl_get_message(s, - SSL3_ST_CR_KEY_EXCH_A, - SSL3_ST_CR_KEY_EXCH_B, - -1, s->max_cert_list, &ok); - if (!ok) - return ((int)n); - - alg_k = s->s3->tmp.new_cipher->algorithm_mkey; - - if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE) { - /* - * Can't skip server key exchange if this is an ephemeral - * ciphersuite. - */ - if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK)) { - SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE); - ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); - return -1; - } - - s->s3->tmp.reuse_message = 1; - return 1; - } - - return tls_process_key_exchange(s, (unsigned long)n); -} - enum MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, unsigned long n) { #ifndef OPENSSL_NO_RSA @@ -1522,55 +1390,6 @@ enum MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, unsigned long n) return MSG_PROCESS_ERROR; } -int ssl3_get_certificate_request(SSL *s) -{ - long n; - int ok; - - n = s->method->ssl_get_message(s, - SSL3_ST_CR_CERT_REQ_A, - SSL3_ST_CR_CERT_REQ_B, - -1, s->max_cert_list, &ok); - - if (!ok) - return ((int)n); - - s->s3->tmp.cert_req = 0; - - if (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE) { - s->s3->tmp.reuse_message = 1; - /* - * If we get here we don't need any cached handshake records as we - * wont be doing client auth. - */ - if (!ssl3_digest_cached_records(s, 0)) - goto err; - return (1); - } - - if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST) { - ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); - SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, SSL_R_WRONG_MESSAGE_TYPE); - goto err; - } - - /* TLS does not like anon-DH with client cert */ - if (s->version > SSL3_VERSION) { - if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) { - ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); - SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, - SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER); - goto err; - } - } - - return tls_process_certificate_request(s, (unsigned long)n); - err: - s->state = SSL_ST_ERR; - return -1; -} - - enum MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, unsigned long n) { int ret = MSG_PROCESS_ERROR; @@ -1701,22 +1520,6 @@ static int ca_dn_cmp(const X509_NAME *const *a, const X509_NAME *const *b) return (X509_NAME_cmp(*a, *b)); } -int ssl3_get_new_session_ticket(SSL *s) -{ - long n; - int ok; - - n = s->method->ssl_get_message(s, - SSL3_ST_CR_SESSION_TICKET_A, - SSL3_ST_CR_SESSION_TICKET_B, - SSL3_MT_NEWSESSION_TICKET, 16384, &ok); - - if (!ok) - return ((int)n); - - return tls_process_new_session_ticket(s, (unsigned long)n); -} - enum MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, unsigned long n) { int al; @@ -1811,22 +1614,6 @@ enum MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, unsigned long n) return MSG_PROCESS_ERROR; } -int ssl3_get_cert_status(SSL *s) -{ - long n; - int ok; - - n = s->method->ssl_get_message(s, - SSL3_ST_CR_CERT_STATUS_A, - SSL3_ST_CR_CERT_STATUS_B, - SSL3_MT_CERTIFICATE_STATUS, 16384, &ok); - - if (!ok) - return ((int)n); - - return tls_process_cert_status(s, (unsigned long)n); -} - enum MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, unsigned long n) { int al; @@ -1885,23 +1672,6 @@ enum MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, unsigned long n) return MSG_PROCESS_ERROR; } -int ssl3_get_server_done(SSL *s) -{ - long n; - int ok; - - /* Second to last param should be very small, like 0 :-) */ - n = s->method->ssl_get_message(s, - SSL3_ST_CR_SRVR_DONE_A, - SSL3_ST_CR_SRVR_DONE_B, - SSL3_MT_SERVER_DONE, 30, &ok); - - if (!ok) - return ((int)n); - - return tls_process_server_done(s, (unsigned long)n); -} - enum MSG_PROCESS_RETURN tls_process_server_done(SSL *s, unsigned long n) { if (n > 0) { @@ -1933,32 +1703,6 @@ enum MSG_PROCESS_RETURN tls_process_server_done(SSL *s, unsigned long n) return MSG_PROCESS_FINISHED_READING; } -int ssl3_send_client_key_exchange(SSL *s) -{ - int n; - - if (s->state == SSL3_ST_CW_KEY_EXCH_A) { - if(tls_construct_client_key_exchange(s) == 0) - goto err; - - s->state = SSL3_ST_CW_KEY_EXCH_B; - } - - /* SSL3_ST_CW_KEY_EXCH_B */ - n = ssl_do_write(s); - - if (n > 0) { - if (tls_client_key_exchange_post_work(s) == 0) - goto err; - } - - return n; - err: - s->state = SSL_ST_ERR; - return -1; - -} - int tls_construct_client_key_exchange(SSL *s) { unsigned char *p; @@ -2593,23 +2337,6 @@ int tls_client_key_exchange_post_work(SSL *s) return 0; } -int ssl3_send_client_verify(SSL *s) -{ - if (s->state == SSL3_ST_CW_CERT_VRFY_A) { - if(tls_construct_client_verify(s) == 0) - goto err; - - s->state = SSL3_ST_CW_CERT_VRFY_B; - } - - /* SSL3_ST_CW_CERT_VRFY_B */ - return ssl_do_write(s); - err: - s->state = SSL_ST_ERR; - return -1; - -} - int tls_construct_client_verify(SSL *s) { unsigned char *p; @@ -2782,49 +2509,6 @@ static int ssl3_check_client_certificate(SSL *s) return 1; } - -int ssl3_send_client_certificate(SSL *s) -{ - enum WORK_STATE wst; - - if (s->state == SSL3_ST_CW_CERT_A || s->state == SSL3_ST_CW_CERT_B) { - if (s->state == SSL3_ST_CW_CERT_A) - wst = tls_prepare_client_certificate(s, WORK_MORE_A); - else - wst = tls_prepare_client_certificate(s, WORK_MORE_B); - if (wst == WORK_ERROR) - goto err; - if (wst == WORK_MORE_A) - return -1; - if (wst == WORK_MORE_B) { - s->state = SSL3_ST_CW_CERT_B; - return -1; - } - - s->state = SSL3_ST_CW_CERT_C; - } - - if (s->state == SSL3_ST_CW_CERT_B) { - wst = tls_prepare_client_certificate(s, WORK_MORE_B); - if (wst == WORK_ERROR) - goto err; - if (wst == WORK_MORE_A) - return -1; - - /* Skip state C...it was entirely temporary in the original code */ - s->state = SSL3_ST_CW_CERT_D; - } - - if (tls_construct_client_certificate(s) == 0) - goto err; - - return ssl_do_write(s); - err: - s->state = SSL_ST_ERR; - return -1; - -} - enum WORK_STATE tls_prepare_client_certificate(SSL *s, enum WORK_STATE wst) { X509 *x509 = NULL; @@ -3076,19 +2760,6 @@ int ssl3_check_cert_and_algorithm(SSL *s) } #ifndef OPENSSL_NO_NEXTPROTONEG -int ssl3_send_next_proto(SSL *s) -{ - if (s->state == SSL3_ST_CW_NEXT_PROTO_A) { - if (tls_construct_next_proto(s) == 0) { - s->state = SSL_ST_ERR; - return -1; - } - s->state = SSL3_ST_CW_NEXT_PROTO_B; - } - - return ssl3_do_write(s, SSL3_RT_HANDSHAKE); -} - int tls_construct_next_proto(SSL *s) { unsigned int len, padding_len; diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index feed7e42a0..eed11985c6 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -2158,13 +2158,7 @@ __owur unsigned int dtls1_link_min_mtu(void); void dtls1_hm_fragment_free(hm_fragment *frag); /* some client-only functions */ -__owur int ssl3_client_hello(SSL *s); __owur int tls_construct_client_hello(SSL *s); -__owur int ssl3_get_server_hello(SSL *s); -__owur int ssl3_get_certificate_request(SSL *s); -__owur int ssl3_get_new_session_ticket(SSL *s); -__owur int ssl3_get_cert_status(SSL *s); -__owur int ssl3_get_server_done(SSL *s); __owur enum MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, unsigned long n); __owur enum MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, @@ -2173,33 +2167,24 @@ __owur enum MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, unsigned long n); __owur enum MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, unsigned long n); __owur enum MSG_PROCESS_RETURN tls_process_server_done(SSL *s, unsigned long n); -__owur int ssl3_send_client_verify(SSL *s); __owur int tls_construct_client_verify(SSL *s); -__owur int tls_construct_client_verify(SSL *s); -int ssl3_send_client_certificate(SSL *s); __owur enum WORK_STATE tls_prepare_client_certificate(SSL *s, enum WORK_STATE wst); __owur int tls_construct_client_certificate(SSL *s); __owur int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey); -__owur int ssl3_send_client_key_exchange(SSL *s); __owur int tls_construct_client_key_exchange(SSL *s); __owur int tls_client_key_exchange_post_work(SSL *s); -__owur int ssl3_get_key_exchange(SSL *s); -__owur int ssl3_get_server_certificate(SSL *s); __owur enum MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, unsigned long n); __owur enum MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, unsigned long n); __owur int ssl3_check_cert_and_algorithm(SSL *s); # ifndef OPENSSL_NO_NEXTPROTONEG -__owur int ssl3_send_next_proto(SSL *s); __owur int tls_construct_next_proto(SSL *s); # endif __owur enum MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, unsigned long n); -int dtls1_client_hello(SSL *s); - /* some server-only functions */ __owur int ssl3_get_client_hello(SSL *s); __owur int ssl3_send_server_hello(SSL *s); -- 2.40.0