ssl/s3_srvr.c

   1 /* ssl/s3_srvr.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #define REUSE_CIPHER_BUG
 113 #define NETSCAPE_HANG_BUG
 114
 115
 116 #include <stdio.h>
 117 #include <openssl/buffer.h>
 118 #include <openssl/rand.h>
 119 #include <openssl/objects.h>
 120 #include <openssl/md5.h>
 121 #include <openssl/sha.h>
 122 #include <openssl/evp.h>
 123 #include <openssl/x509.h>
 124 #include "ssl_locl.h"
 125
 126 static SSL_METHOD *ssl3_get_server_method(int ver);
 127 static int ssl3_get_client_hello(SSL *s);
 128 static int ssl3_check_client_hello(SSL *s);
 129 static int ssl3_send_server_hello(SSL *s);
 130 static int ssl3_send_server_key_exchange(SSL *s);
 131 static int ssl3_send_certificate_request(SSL *s);
 132 static int ssl3_send_server_done(SSL *s);
 133 static int ssl3_get_client_key_exchange(SSL *s);
 134 static int ssl3_get_client_certificate(SSL *s);
 135 static int ssl3_get_cert_verify(SSL *s);
 136 static int ssl3_send_hello_request(SSL *s);
 137
 138 static SSL_METHOD *ssl3_get_server_method(int ver)
 139         {
 140         if (ver == SSL3_VERSION)
 141                 return(SSLv3_server_method());
 142         else
 143                 return(NULL);
 144         }
 145
 146 SSL_METHOD *SSLv3_server_method(void)
 147         {
 148         static int init=1;
 149         static SSL_METHOD SSLv3_server_data;
 150
 151         if (init)
 152                 {
 153                 memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(),
 154                         sizeof(SSL_METHOD));
 155                 SSLv3_server_data.ssl_accept=ssl3_accept;
 156                 SSLv3_server_data.get_ssl_method=ssl3_get_server_method;
 157                 init=0;
 158                 }
 159         return(&SSLv3_server_data);
 160         }
 161
 162 int ssl3_accept(SSL *s)
 163         {
 164         BUF_MEM *buf;
 165         unsigned long l,Time=time(NULL);
 166         void (*cb)()=NULL;
 167         long num1;
 168         int ret= -1;
 169         int new_state,state,skip=0;
 170
 171         RAND_add(&Time,sizeof(Time),0);
 172         ERR_clear_error();
 173         clear_sys_error();
 174
 175         if (s->info_callback != NULL)
 176                 cb=s->info_callback;
 177         else if (s->ctx->info_callback != NULL)
 178                 cb=s->ctx->info_callback;
 179
 180         /* init things to blank */
 181         s->in_handshake++;
 182         if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
 183
 184         if (s->cert == NULL)
 185                 {
 186                 SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_NO_CERTIFICATE_SET);
 187                 return(-1);
 188                 }
 189
 190         for (;;)
 191                 {
 192                 state=s->state;
 193
 194                 switch (s->state)
 195                         {
 196                 case SSL_ST_RENEGOTIATE:
 197                         s->new_session=1;
 198                         /* s->state=SSL_ST_ACCEPT; */
 199
 200                 case SSL_ST_BEFORE:
 201                 case SSL_ST_ACCEPT:
 202                 case SSL_ST_BEFORE|SSL_ST_ACCEPT:
 203                 case SSL_ST_OK|SSL_ST_ACCEPT:
 204
 205                         s->server=1;
 206                         if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
 207
 208                         if ((s->version>>8) != 3)
 209                                 {
 210                                 SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_INTERNAL_ERROR);
 211                                 return -1;
 212                                 }
 213                         s->type=SSL_ST_ACCEPT;
 214
 215                         if (s->init_buf == NULL)
 216                                 {
 217                                 if ((buf=BUF_MEM_new()) == NULL)
 218                                         {
 219                                         ret= -1;
 220                                         goto end;
 221                                         }
 222                                 if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
 223                                         {
 224                                         ret= -1;
 225                                         goto end;
 226                                         }
 227                                 s->init_buf=buf;
 228                                 }
 229
 230                         if (!ssl3_setup_buffers(s))
 231                                 {
 232                                 ret= -1;
 233                                 goto end;
 234                                 }
 235
 236                         s->init_num=0;
 237
 238                         if (s->state != SSL_ST_RENEGOTIATE)
 239                                 {
 240                                 /* Ok, we now need to push on a buffering BIO so that
 241                                  * the output is sent in a way that TCP likes :-)
 242                                  */
 243                                 if (!ssl_init_wbio_buffer(s,1)) { ret= -1; goto end; }
 244
 245                                 ssl3_init_finished_mac(s);
 246                                 s->state=SSL3_ST_SR_CLNT_HELLO_A;
 247                                 s->ctx->stats.sess_accept++;
 248                                 }
 249                         else
 250                                 {
 251                                 /* s->state == SSL_ST_RENEGOTIATE,
 252                                  * we will just send a HelloRequest */
 253                                 s->ctx->stats.sess_accept_renegotiate++;
 254                                 s->state=SSL3_ST_SW_HELLO_REQ_A;
 255                                 }
 256                         break;
 257
 258                 case SSL3_ST_SW_HELLO_REQ_A:
 259                 case SSL3_ST_SW_HELLO_REQ_B:
 260
 261                         s->shutdown=0;
 262                         ret=ssl3_send_hello_request(s);
 263                         if (ret <= 0) goto end;
 264                         s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C;
 265                         s->state=SSL3_ST_SW_FLUSH;
 266                         s->init_num=0;
 267
 268                         ssl3_init_finished_mac(s);
 269                         break;
 270
 271                 case SSL3_ST_SW_HELLO_REQ_C:
 272                         s->state=SSL_ST_OK;
 273                         break;
 274
 275                 case SSL3_ST_SR_CLNT_HELLO_A:
 276                 case SSL3_ST_SR_CLNT_HELLO_B:
 277                 case SSL3_ST_SR_CLNT_HELLO_C:
 278
 279                         s->shutdown=0;
 280                         ret=ssl3_get_client_hello(s);
 281                         if (ret <= 0) goto end;
 282                         s->new_session = 2;
 283                         s->state=SSL3_ST_SW_SRVR_HELLO_A;
 284                         s->init_num=0;
 285                         break;
 286
 287                 case SSL3_ST_SW_SRVR_HELLO_A:
 288                 case SSL3_ST_SW_SRVR_HELLO_B:
 289                         ret=ssl3_send_server_hello(s);
 290                         if (ret <= 0) goto end;
 291
 292                         if (s->hit)
 293                                 s->state=SSL3_ST_SW_CHANGE_A;
 294                         else
 295                                 s->state=SSL3_ST_SW_CERT_A;
 296                         s->init_num=0;
 297                         break;
 298
 299                 case SSL3_ST_SW_CERT_A:
 300                 case SSL3_ST_SW_CERT_B:
 301                         /* Check if it is anon DH */
 302                         if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
 303                                 {
 304                                 ret=ssl3_send_server_certificate(s);
 305                                 if (ret <= 0) goto end;
 306                                 }
 307                         else
 308                                 skip=1;
 309                         s->state=SSL3_ST_SW_KEY_EXCH_A;
 310                         s->init_num=0;
 311                         break;
 312
 313                 case SSL3_ST_SW_KEY_EXCH_A:
 314                 case SSL3_ST_SW_KEY_EXCH_B:
 315                         l=s->s3->tmp.new_cipher->algorithms;
 316
 317                         /* clear this, it may get reset by
 318                          * send_server_key_exchange */
 319                         if (s->options & SSL_OP_EPHEMERAL_RSA)
 320                                 s->s3->tmp.use_rsa_tmp=1;
 321                         else
 322                                 s->s3->tmp.use_rsa_tmp=0;
 323
 324                         /* only send if a DH key exchange, fortezza or
 325                          * RSA but we have a sign only certificate */
 326                         if (s->s3->tmp.use_rsa_tmp
 327                             || (l & (SSL_DH|SSL_kFZA))
 328                             || ((l & SSL_kRSA)
 329                                 && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
 330                                     || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
 331                                         && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
 332                                         )
 333                                     )
 334                                 )
 335                             )
 336                                 {
 337                                 ret=ssl3_send_server_key_exchange(s);
 338                                 if (ret <= 0) goto end;
 339                                 }
 340                         else
 341                                 skip=1;
 342
 343                         s->state=SSL3_ST_SW_CERT_REQ_A;
 344                         s->init_num=0;
 345                         break;
 346
 347                 case SSL3_ST_SW_CERT_REQ_A:
 348                 case SSL3_ST_SW_CERT_REQ_B:
 349                         if (/* don't request cert unless asked for it: */
 350                                 !(s->verify_mode & SSL_VERIFY_PEER) ||
 351                                 /* if SSL_VERIFY_CLIENT_ONCE is set,
 352                                  * don't request cert during re-negotiation: */
 353                                 ((s->session->peer != NULL) &&
 354                                  (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
 355                                 /* never request cert in anonymous ciphersuites
 356                                  * (see section "Certificate request" in SSL 3 drafts
 357                                  * and in RFC 2246): */
 358                                 ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) &&
 359                                  /* ... except when the application insists on verification
 360                                   * (against the specs, but s3_clnt.c accepts this for SSL 3) */
 361                                  !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
 362                                 {
 363                                 /* no cert request */
 364                                 skip=1;
 365                                 s->s3->tmp.cert_request=0;
 366                                 s->state=SSL3_ST_SW_SRVR_DONE_A;
 367                                 }
 368                         else
 369                                 {
 370                                 s->s3->tmp.cert_request=1;
 371                                 ret=ssl3_send_certificate_request(s);
 372                                 if (ret <= 0) goto end;
 373 #ifndef NETSCAPE_HANG_BUG
 374                                 s->state=SSL3_ST_SW_SRVR_DONE_A;
 375 #else
 376                                 s->state=SSL3_ST_SW_FLUSH;
 377                                 s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
 378 #endif
 379                                 s->init_num=0;
 380                                 }
 381                         break;
 382
 383                 case SSL3_ST_SW_SRVR_DONE_A:
 384                 case SSL3_ST_SW_SRVR_DONE_B:
 385                         ret=ssl3_send_server_done(s);
 386                         if (ret <= 0) goto end;
 387                         s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
 388                         s->state=SSL3_ST_SW_FLUSH;
 389                         s->init_num=0;
 390                         break;
 391
 392                 case SSL3_ST_SW_FLUSH:
 393                         /* number of bytes to be flushed */
 394                         num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);
 395                         if (num1 > 0)
 396                                 {
 397                                 s->rwstate=SSL_WRITING;
 398                                 num1=BIO_flush(s->wbio);
 399                                 if (num1 <= 0) { ret= -1; goto end; }
 400                                 s->rwstate=SSL_NOTHING;
 401                                 }
 402
 403                         s->state=s->s3->tmp.next_state;
 404                         break;
 405
 406                 case SSL3_ST_SR_CERT_A:
 407                 case SSL3_ST_SR_CERT_B:
 408                         /* Check for second client hello (MS SGC) */
 409                         ret = ssl3_check_client_hello(s);
 410                         if (ret <= 0)
 411                                 goto end;
 412                         if (ret == 2)
 413                                 s->state = SSL3_ST_SR_CLNT_HELLO_C;
 414                         else {
 415                                 /* could be sent for a DH cert, even if we
 416                                  * have not asked for it :-) */
 417                                 ret=ssl3_get_client_certificate(s);
 418                                 if (ret <= 0) goto end;
 419                                 s->init_num=0;
 420                                 s->state=SSL3_ST_SR_KEY_EXCH_A;
 421                         }
 422                         break;
 423
 424                 case SSL3_ST_SR_KEY_EXCH_A:
 425                 case SSL3_ST_SR_KEY_EXCH_B:
 426                         ret=ssl3_get_client_key_exchange(s);
 427                         if (ret <= 0) goto end;
 428                         s->state=SSL3_ST_SR_CERT_VRFY_A;
 429                         s->init_num=0;
 430
 431                         /* We need to get hashes here so if there is
 432                          * a client cert, it can be verified */
 433                         s->method->ssl3_enc->cert_verify_mac(s,
 434                                 &(s->s3->finish_dgst1),
 435                                 &(s->s3->tmp.cert_verify_md[0]));
 436                         s->method->ssl3_enc->cert_verify_mac(s,
 437                                 &(s->s3->finish_dgst2),
 438                                 &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
 439
 440                         break;
 441
 442                 case SSL3_ST_SR_CERT_VRFY_A:
 443                 case SSL3_ST_SR_CERT_VRFY_B:
 444
 445                         /* we should decide if we expected this one */
 446                         ret=ssl3_get_cert_verify(s);
 447                         if (ret <= 0) goto end;
 448
 449                         s->state=SSL3_ST_SR_FINISHED_A;
 450                         s->init_num=0;
 451                         break;
 452
 453                 case SSL3_ST_SR_FINISHED_A:
 454                 case SSL3_ST_SR_FINISHED_B:
 455                         ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
 456                                 SSL3_ST_SR_FINISHED_B);
 457                         if (ret <= 0) goto end;
 458                         if (s->hit)
 459                                 s->state=SSL_ST_OK;
 460                         else
 461                                 s->state=SSL3_ST_SW_CHANGE_A;
 462                         s->init_num=0;
 463                         break;
 464
 465                 case SSL3_ST_SW_CHANGE_A:
 466                 case SSL3_ST_SW_CHANGE_B:
 467
 468                         s->session->cipher=s->s3->tmp.new_cipher;
 469                         if (!s->method->ssl3_enc->setup_key_block(s))
 470                                 { ret= -1; goto end; }
 471
 472                         ret=ssl3_send_change_cipher_spec(s,
 473                                 SSL3_ST_SW_CHANGE_A,SSL3_ST_SW_CHANGE_B);
 474
 475                         if (ret <= 0) goto end;
 476                         s->state=SSL3_ST_SW_FINISHED_A;
 477                         s->init_num=0;
 478
 479                         if (!s->method->ssl3_enc->change_cipher_state(s,
 480                                 SSL3_CHANGE_CIPHER_SERVER_WRITE))
 481                                 {
 482                                 ret= -1;
 483                                 goto end;
 484                                 }
 485
 486                         break;
 487
 488                 case SSL3_ST_SW_FINISHED_A:
 489                 case SSL3_ST_SW_FINISHED_B:
 490                         ret=ssl3_send_finished(s,
 491                                 SSL3_ST_SW_FINISHED_A,SSL3_ST_SW_FINISHED_B,
 492                                 s->method->ssl3_enc->server_finished_label,
 493                                 s->method->ssl3_enc->server_finished_label_len);
 494                         if (ret <= 0) goto end;
 495                         s->state=SSL3_ST_SW_FLUSH;
 496                         if (s->hit)
 497                                 s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
 498                         else
 499                                 s->s3->tmp.next_state=SSL_ST_OK;
 500                         s->init_num=0;
 501                         break;
 502
 503                 case SSL_ST_OK:
 504                         /* clean a few things up */
 505                         ssl3_cleanup_key_block(s);
 506
 507                         BUF_MEM_free(s->init_buf);
 508                         s->init_buf=NULL;
 509
 510                         /* remove buffering on output */
 511                         ssl_free_wbio_buffer(s);
 512
 513                         s->init_num=0;
 514
 515                         if (s->new_session == 2) /* skipped if we just sent a HelloRequest */
 516                                 {
 517                                 /* actually not necessarily a 'new' session  */
 518
 519                                 s->new_session=0;
 520
 521                                 ssl_update_cache(s,SSL_SESS_CACHE_SERVER);
 522
 523                                 s->ctx->stats.sess_accept_good++;
 524                                 /* s->server=1; */
 525                                 s->handshake_func=ssl3_accept;
 526
 527                                 if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
 528                                 }
 529
 530                         ret = 1;
 531                         goto end;
 532                         /* break; */
 533
 534                 default:
 535                         SSLerr(SSL_F_SSL3_ACCEPT,SSL_R_UNKNOWN_STATE);
 536                         ret= -1;
 537                         goto end;
 538                         /* break; */
 539                         }
 540
 541                 if (!s->s3->tmp.reuse_message && !skip)
 542                         {
 543                         if (s->debug)
 544                                 {
 545                                 if ((ret=BIO_flush(s->wbio)) <= 0)
 546                                         goto end;
 547                                 }
 548
 549
 550                         if ((cb != NULL) && (s->state != state))
 551                                 {
 552                                 new_state=s->state;
 553                                 s->state=state;
 554                                 cb(s,SSL_CB_ACCEPT_LOOP,1);
 555                                 s->state=new_state;
 556                                 }
 557                         }
 558                 skip=0;
 559                 }
 560 end:
 561         /* BIO_flush(s->wbio); */
 562
 563         s->in_handshake--;
 564         if (cb != NULL)
 565                 cb(s,SSL_CB_ACCEPT_EXIT,ret);
 566         return(ret);
 567         }
 568
 569 static int ssl3_send_hello_request(SSL *s)
 570         {
 571         unsigned char *p;
 572
 573         if (s->state == SSL3_ST_SW_HELLO_REQ_A)
 574                 {
 575                 p=(unsigned char *)s->init_buf->data;
 576                 *(p++)=SSL3_MT_HELLO_REQUEST;
 577                 *(p++)=0;
 578                 *(p++)=0;
 579                 *(p++)=0;
 580
 581                 s->state=SSL3_ST_SW_HELLO_REQ_B;
 582                 /* number of bytes to write */
 583                 s->init_num=4;
 584                 s->init_off=0;
 585                 }
 586
 587         /* SSL3_ST_SW_HELLO_REQ_B */
 588         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 589         }
 590
 591 static int ssl3_check_client_hello(SSL *s)
 592         {
 593         int ok;
 594         long n;
 595
 596         /* this function is called when we really expect a Certificate message,
 597          * so permit appropriate message length */
 598         n=ssl3_get_message(s,
 599                 SSL3_ST_SR_CERT_A,
 600                 SSL3_ST_SR_CERT_B,
 601                 -1,
 602 #if defined(MSDOS) && !defined(WIN32)
 603                 1024*30, /* 30k max cert list :-) */
 604 #else
 605                 1024*100, /* 100k max cert list :-) */
 606 #endif
 607                 &ok);
 608         if (!ok) return((int)n);
 609         s->s3->tmp.reuse_message = 1;
 610         if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
 611                 {
 612                 /* Throw away what we have done so far in the current handshake,
 613                  * which will now be aborted. (A full SSL_clear would be too much.)
 614                  * I hope that tmp.dh is the only thing that may need to be cleared
 615                  * when a handshake is not completed ... */
 616 #ifndef NO_DH
 617                 if (s->s3->tmp.dh != NULL)
 618                         {
 619                         DH_free(s->s3->tmp.dh);
 620                         s->s3->tmp.dh = NULL;
 621                         }
 622 #endif
 623                 return 2;
 624                 }
 625         return 1;
 626 }
 627
 628 static int ssl3_get_client_hello(SSL *s)
 629         {
 630         int i,j,ok,al,ret= -1;
 631         long n;
 632         unsigned long id;
 633         unsigned char *p,*d,*q;
 634         SSL_CIPHER *c;
 635         SSL_COMP *comp=NULL;
 636         STACK_OF(SSL_CIPHER) *ciphers=NULL;
 637
 638         /* We do this so that we will respond with our native type.
 639          * If we are TLSv1 and we get SSLv3, we will respond with TLSv1,
 640          * This down switching should be handled by a different method.
 641          * If we are SSLv3, we will respond with SSLv3, even if prompted with
 642          * TLSv1.
 643          */
 644         if (s->state == SSL3_ST_SR_CLNT_HELLO_A)
 645                 {
 646                 s->first_packet=1;
 647                 s->state=SSL3_ST_SR_CLNT_HELLO_B;
 648                 }
 649         n=ssl3_get_message(s,
 650                 SSL3_ST_SR_CLNT_HELLO_B,
 651                 SSL3_ST_SR_CLNT_HELLO_C,
 652                 SSL3_MT_CLIENT_HELLO,
 653                 SSL3_RT_MAX_PLAIN_LENGTH,
 654                 &ok);
 655
 656         if (!ok) return((int)n);
 657         d=p=(unsigned char *)s->init_buf->data;
 658
 659         /* use version from inside client hello, not from record header
 660          * (may differ: see RFC 2246, Appendix E, second paragraph) */
 661         s->client_version=(((int)p[0])<<8)|(int)p[1];
 662         p+=2;
 663
 664         if (s->client_version < s->version)
 665                 {
 666                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
 667                 if ((s->client_version>>8) == SSL3_VERSION_MAJOR)
 668                         {
 669                         /* similar to ssl3_get_record, send alert using remote version number */
 670                         s->version = s->client_version;
 671                         }
 672                 al = SSL_AD_PROTOCOL_VERSION;
 673                 goto f_err;
 674                 }
 675
 676         /* load the client random */
 677         memcpy(s->s3->client_random,p,SSL3_RANDOM_SIZE);
 678         p+=SSL3_RANDOM_SIZE;
 679
 680         /* get the session-id */
 681         j= *(p++);
 682
 683         s->hit=0;
 684         if (j == 0)
 685                 {
 686                 if (!ssl_get_new_session(s,1))
 687                         goto err;
 688                 }
 689         else
 690                 {
 691                 i=ssl_get_prev_session(s,p,j);
 692                 if (i == 1)
 693                         { /* previous session */
 694                         s->hit=1;
 695                         }
 696                 else if (i == -1)
 697                         goto err;
 698                 else /* i == 0 */
 699                         {
 700                         if (!ssl_get_new_session(s,1))
 701                                 goto err;
 702                         }
 703                 }
 704
 705         p+=j;
 706         n2s(p,i);
 707         if ((i == 0) && (j != 0))
 708                 {
 709                 /* we need a cipher if we are not resuming a session */
 710                 al=SSL_AD_ILLEGAL_PARAMETER;
 711                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_SPECIFIED);
 712                 goto f_err;
 713                 }
 714         if ((i+p) > (d+n))
 715                 {
 716                 /* not enough data */
 717                 al=SSL_AD_DECODE_ERROR;
 718                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH);
 719                 goto f_err;
 720                 }
 721         if ((i > 0) && (ssl_bytes_to_cipher_list(s,p,i,&(ciphers))
 722                 == NULL))
 723                 {
 724                 goto err;
 725                 }
 726         p+=i;
 727
 728         /* If it is a hit, check that the cipher is in the list */
 729         if ((s->hit) && (i > 0))
 730                 {
 731                 j=0;
 732                 id=s->session->cipher->id;
 733
 734 #ifdef CIPHER_DEBUG
 735                 printf("client sent %d ciphers\n",sk_num(ciphers));
 736 #endif
 737                 for (i=0; i<sk_SSL_CIPHER_num(ciphers); i++)
 738                         {
 739                         c=sk_SSL_CIPHER_value(ciphers,i);
 740 #ifdef CIPHER_DEBUG
 741                         printf("client [%2d of %2d]:%s\n",
 742                                 i,sk_num(ciphers),SSL_CIPHER_get_name(c));
 743 #endif
 744                         if (c->id == id)
 745                                 {
 746                                 j=1;
 747                                 break;
 748                                 }
 749                         }
 750                 if (j == 0)
 751                         {
 752                         if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
 753                                 {
 754                                 /* Very bad for multi-threading.... */
 755                                 s->session->cipher=sk_SSL_CIPHER_value(ciphers,
 756                                                                        0);
 757                                 }
 758                         else
 759                                 {
 760                                 /* we need to have the cipher in the cipher
 761                                  * list if we are asked to reuse it */
 762                                 al=SSL_AD_ILLEGAL_PARAMETER;
 763                                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
 764                                 goto f_err;
 765                                 }
 766                         }
 767                 }
 768
 769         /* compression */
 770         i= *(p++);
 771         q=p;
 772         for (j=0; j<i; j++)
 773                 {
 774                 if (p[j] == 0) break;
 775                 }
 776
 777         p+=i;
 778         if (j >= i)
 779                 {
 780                 /* no compress */
 781                 al=SSL_AD_DECODE_ERROR;
 782                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_COMPRESSION_SPECIFIED);
 783                 goto f_err;
 784                 }
 785
 786         /* Worst case, we will use the NULL compression, but if we have other
 787          * options, we will now look for them.  We have i-1 compression
 788          * algorithms from the client, starting at q. */
 789         s->s3->tmp.new_compression=NULL;
 790         if (s->ctx->comp_methods != NULL)
 791                 { /* See if we have a match */
 792                 int m,nn,o,v,done=0;
 793
 794                 nn=sk_SSL_COMP_num(s->ctx->comp_methods);
 795                 for (m=0; m<nn; m++)
 796                         {
 797                         comp=sk_SSL_COMP_value(s->ctx->comp_methods,m);
 798                         v=comp->id;
 799                         for (o=0; o<i; o++)
 800                                 {
 801                                 if (v == q[o])
 802                                         {
 803                                         done=1;
 804                                         break;
 805                                         }
 806                                 }
 807                         if (done) break;
 808                         }
 809                 if (done)
 810                         s->s3->tmp.new_compression=comp;
 811                 else
 812                         comp=NULL;
 813                 }
 814
 815         /* TLS does not mind if there is extra stuff */
 816         if (s->version == SSL3_VERSION)
 817                 {
 818                 if (p > (d+n))
 819                         {
 820                         /* wrong number of bytes,
 821                          * there could be more to follow */
 822                         al=SSL_AD_DECODE_ERROR;
 823                         SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_LENGTH_MISMATCH);
 824                         goto f_err;
 825                         }
 826                 }
 827
 828         /* Given s->session->ciphers and ssl_get_ciphers_by_id(s), we must
 829          * pick a cipher */
 830
 831         if (!s->hit)
 832                 {
 833                 s->session->compress_meth=(comp == NULL)?0:comp->id;
 834                 if (s->session->ciphers != NULL)
 835                         sk_SSL_CIPHER_free(s->session->ciphers);
 836                 s->session->ciphers=ciphers;
 837                 if (ciphers == NULL)
 838                         {
 839                         al=SSL_AD_ILLEGAL_PARAMETER;
 840                         SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_CIPHERS_PASSED);
 841                         goto f_err;
 842                         }
 843                 ciphers=NULL;
 844                 c=ssl3_choose_cipher(s,s->session->ciphers,
 845                                      ssl_get_ciphers_by_id(s));
 846
 847                 if (c == NULL)
 848                         {
 849                         al=SSL_AD_HANDSHAKE_FAILURE;
 850                         SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER);
 851                         goto f_err;
 852                         }
 853                 s->s3->tmp.new_cipher=c;
 854                 }
 855         else
 856                 {
 857                 /* Session-id reuse */
 858 #ifdef REUSE_CIPHER_BUG
 859                 STACK_OF(SSL_CIPHER) *sk;
 860                 SSL_CIPHER *nc=NULL;
 861                 SSL_CIPHER *ec=NULL;
 862
 863                 if (s->options & SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG)
 864                         {
 865                         sk=s->session->ciphers;
 866                         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
 867                                 {
 868                                 c=sk_SSL_CIPHER_value(sk,i);
 869                                 if (c->algorithms & SSL_eNULL)
 870                                         nc=c;
 871                                 if (SSL_C_IS_EXPORT(c))
 872                                         ec=c;
 873                                 }
 874                         if (nc != NULL)
 875                                 s->s3->tmp.new_cipher=nc;
 876                         else if (ec != NULL)
 877                                 s->s3->tmp.new_cipher=ec;
 878                         else
 879                                 s->s3->tmp.new_cipher=s->session->cipher;
 880                         }
 881                 else
 882 #endif
 883                 s->s3->tmp.new_cipher=s->session->cipher;
 884                 }
 885
 886         /* we now have the following setup.
 887          * client_random
 888          * cipher_list          - our prefered list of ciphers
 889          * ciphers              - the clients prefered list of ciphers
 890          * compression          - basically ignored right now
 891          * ssl version is set   - sslv3
 892          * s->session           - The ssl session has been setup.
 893          * s->hit               - session reuse flag
 894          * s->tmp.new_cipher    - the new cipher to use.
 895          */
 896
 897         ret=1;
 898         if (0)
 899                 {
 900 f_err:
 901                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
 902                 }
 903 err:
 904         if (ciphers != NULL) sk_SSL_CIPHER_free(ciphers);
 905         return(ret);
 906         }
 907
 908 static int ssl3_send_server_hello(SSL *s)
 909         {
 910         unsigned char *buf;
 911         unsigned char *p,*d;
 912         int i,sl;
 913         unsigned long l,Time;
 914
 915         if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
 916                 {
 917                 buf=(unsigned char *)s->init_buf->data;
 918                 p=s->s3->server_random;
 919                 Time=time(NULL);                        /* Time */
 920                 l2n(Time,p);
 921                 RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
 922                 /* Do the message type and length last */
 923                 d=p= &(buf[4]);
 924
 925                 *(p++)=s->version>>8;
 926                 *(p++)=s->version&0xff;
 927
 928                 /* Random stuff */
 929                 memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
 930                 p+=SSL3_RANDOM_SIZE;
 931
 932                 /* now in theory we have 3 options to sending back the
 933                  * session id.  If it is a re-use, we send back the
 934                  * old session-id, if it is a new session, we send
 935                  * back the new session-id or we send back a 0 length
 936                  * session-id if we want it to be single use.
 937                  * Currently I will not implement the '0' length session-id
 938                  * 12-Jan-98 - I'll now support the '0' length stuff.
 939                  */
 940                 if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
 941                         s->session->session_id_length=0;
 942
 943                 sl=s->session->session_id_length;
 944                 *(p++)=sl;
 945                 memcpy(p,s->session->session_id,sl);
 946                 p+=sl;
 947
 948                 /* put the cipher */
 949                 i=ssl3_put_cipher_by_char(s->s3->tmp.new_cipher,p);
 950                 p+=i;
 951
 952                 /* put the compression method */
 953                 if (s->s3->tmp.new_compression == NULL)
 954                         *(p++)=0;
 955                 else
 956                         *(p++)=s->s3->tmp.new_compression->id;
 957
 958                 /* do the header */
 959                 l=(p-d);
 960                 d=buf;
 961                 *(d++)=SSL3_MT_SERVER_HELLO;
 962                 l2n3(l,d);
 963
 964                 s->state=SSL3_ST_CW_CLNT_HELLO_B;
 965                 /* number of bytes to write */
 966                 s->init_num=p-buf;
 967                 s->init_off=0;
 968                 }
 969
 970         /* SSL3_ST_CW_CLNT_HELLO_B */
 971         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 972         }
 973
 974 static int ssl3_send_server_done(SSL *s)
 975         {
 976         unsigned char *p;
 977
 978         if (s->state == SSL3_ST_SW_SRVR_DONE_A)
 979                 {
 980                 p=(unsigned char *)s->init_buf->data;
 981
 982                 /* do the header */
 983                 *(p++)=SSL3_MT_SERVER_DONE;
 984                 *(p++)=0;
 985                 *(p++)=0;
 986                 *(p++)=0;
 987
 988                 s->state=SSL3_ST_SW_SRVR_DONE_B;
 989                 /* number of bytes to write */
 990                 s->init_num=4;
 991                 s->init_off=0;
 992                 }
 993
 994         /* SSL3_ST_CW_CLNT_HELLO_B */
 995         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 996         }
 997
 998 static int ssl3_send_server_key_exchange(SSL *s)
 999         {
1000 #ifndef NO_RSA
1001         unsigned char *q;
1002         int j,num;
1003         RSA *rsa;
1004         unsigned char md_buf[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
1005         unsigned int u;
1006 #endif
1007 #ifndef NO_DH
1008         DH *dh=NULL,*dhp;
1009 #endif
1010         EVP_PKEY *pkey;
1011         unsigned char *p,*d;
1012         int al,i;
1013         unsigned long type;
1014         int n;
1015         CERT *cert;
1016         BIGNUM *r[4];
1017         int nr[4],kn;
1018         BUF_MEM *buf;
1019         EVP_MD_CTX md_ctx;
1020
1021         if (s->state == SSL3_ST_SW_KEY_EXCH_A)
1022                 {
1023                 type=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK;
1024                 cert=s->cert;
1025
1026                 buf=s->init_buf;
1027
1028                 r[0]=r[1]=r[2]=r[3]=NULL;
1029                 n=0;
1030 #ifndef NO_RSA
1031                 if (type & SSL_kRSA)
1032                         {
1033                         rsa=cert->rsa_tmp;
1034                         if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL))
1035                                 {
1036                                 rsa=s->cert->rsa_tmp_cb(s,
1037                                       SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1038                                       SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
1039                                 if(rsa == NULL)
1040                                 {
1041                                         al=SSL_AD_HANDSHAKE_FAILURE;
1042                                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
1043                                         goto f_err;
1044                                 }
1045                                 CRYPTO_add(&rsa->references,1,CRYPTO_LOCK_RSA);
1046                                 cert->rsa_tmp=rsa;
1047                                 }
1048                         if (rsa == NULL)
1049                                 {
1050                                 al=SSL_AD_HANDSHAKE_FAILURE;
1051                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_KEY);
1052                                 goto f_err;
1053                                 }
1054                         r[0]=rsa->n;
1055                         r[1]=rsa->e;
1056                         s->s3->tmp.use_rsa_tmp=1;
1057                         }
1058                 else
1059 #endif
1060 #ifndef NO_DH
1061                         if (type & SSL_kEDH)
1062                         {
1063                         dhp=cert->dh_tmp;
1064                         if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
1065                                 dhp=s->cert->dh_tmp_cb(s,
1066                                       SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
1067                                       SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
1068                         if (dhp == NULL)
1069                                 {
1070                                 al=SSL_AD_HANDSHAKE_FAILURE;
1071                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
1072                                 goto f_err;
1073                                 }
1074
1075                         if (s->s3->tmp.dh != NULL)
1076                                 {
1077                                 DH_free(dh);
1078                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, SSL_R_INTERNAL_ERROR);
1079                                 goto err;
1080                                 }
1081
1082                         if ((dh=DHparams_dup(dhp)) == NULL)
1083                                 {
1084                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
1085                                 goto err;
1086                                 }
1087
1088                         s->s3->tmp.dh=dh;
1089                         if ((dhp->pub_key == NULL ||
1090                              dhp->priv_key == NULL ||
1091                              (s->options & SSL_OP_SINGLE_DH_USE)))
1092                                 {
1093                                 if(!DH_generate_key(dh))
1094                                     {
1095                                     SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
1096                                            ERR_R_DH_LIB);
1097                                     goto err;
1098                                     }
1099                                 }
1100                         else
1101                                 {
1102                                 dh->pub_key=BN_dup(dhp->pub_key);
1103                                 dh->priv_key=BN_dup(dhp->priv_key);
1104                                 if ((dh->pub_key == NULL) ||
1105                                         (dh->priv_key == NULL))
1106                                         {
1107                                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
1108                                         goto err;
1109                                         }
1110                                 }
1111                         r[0]=dh->p;
1112                         r[1]=dh->g;
1113                         r[2]=dh->pub_key;
1114                         }
1115                 else
1116 #endif
1117                         {
1118                         al=SSL_AD_HANDSHAKE_FAILURE;
1119                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
1120                         goto f_err;
1121                         }
1122                 for (i=0; r[i] != NULL; i++)
1123                         {
1124                         nr[i]=BN_num_bytes(r[i]);
1125                         n+=2+nr[i];
1126                         }
1127
1128                 if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
1129                         {
1130                         if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))
1131                                 == NULL)
1132                                 {
1133                                 al=SSL_AD_DECODE_ERROR;
1134                                 goto f_err;
1135                                 }
1136                         kn=EVP_PKEY_size(pkey);
1137                         }
1138                 else
1139                         {
1140                         pkey=NULL;
1141                         kn=0;
1142                         }
1143
1144                 if (!BUF_MEM_grow(buf,n+4+kn))
1145                         {
1146                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_BUF);
1147                         goto err;
1148                         }
1149                 d=(unsigned char *)s->init_buf->data;
1150                 p= &(d[4]);
1151
1152                 for (i=0; r[i] != NULL; i++)
1153                         {
1154                         s2n(nr[i],p);
1155                         BN_bn2bin(r[i],p);
1156                         p+=nr[i];
1157                         }
1158
1159                 /* not anonymous */
1160                 if (pkey != NULL)
1161                         {
1162                         /* n is the length of the params, they start at &(d[4])
1163                          * and p points to the space at the end. */
1164 #ifndef NO_RSA
1165                         if (pkey->type == EVP_PKEY_RSA)
1166                                 {
1167                                 q=md_buf;
1168                                 j=0;
1169                                 for (num=2; num > 0; num--)
1170                                         {
1171                                         EVP_DigestInit(&md_ctx,(num == 2)
1172                                                 ?s->ctx->md5:s->ctx->sha1);
1173                                         EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1174                                         EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1175                                         EVP_DigestUpdate(&md_ctx,&(d[4]),n);
1176                                         EVP_DigestFinal(&md_ctx,q,
1177                                                 (unsigned int *)&i);
1178                                         q+=i;
1179                                         j+=i;
1180                                         }
1181                                 if (RSA_sign(NID_md5_sha1, md_buf, j,
1182                                         &(p[2]), &u, pkey->pkey.rsa) <= 0)
1183                                         {
1184                                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_RSA);
1185                                         goto err;
1186                                         }
1187                                 s2n(u,p);
1188                                 n+=u+2;
1189                                 }
1190                         else
1191 #endif
1192 #if !defined(NO_DSA)
1193                                 if (pkey->type == EVP_PKEY_DSA)
1194                                 {
1195                                 /* lets do DSS */
1196                                 EVP_SignInit(&md_ctx,EVP_dss1());
1197                                 EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1198                                 EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1199                                 EVP_SignUpdate(&md_ctx,&(d[4]),n);
1200                                 if (!EVP_SignFinal(&md_ctx,&(p[2]),
1201                                         (unsigned int *)&i,pkey))
1202                                         {
1203                                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_DSA);
1204                                         goto err;
1205                                         }
1206                                 s2n(i,p);
1207                                 n+=i+2;
1208                                 }
1209                         else
1210 #endif
1211                                 {
1212                                 /* Is this error check actually needed? */
1213                                 al=SSL_AD_HANDSHAKE_FAILURE;
1214                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_PKEY_TYPE);
1215                                 goto f_err;
1216                                 }
1217                         }
1218
1219                 *(d++)=SSL3_MT_SERVER_KEY_EXCHANGE;
1220                 l2n3(n,d);
1221
1222                 /* we should now have things packed up, so lets send
1223                  * it off */
1224                 s->init_num=n+4;
1225                 s->init_off=0;
1226                 }
1227
1228         s->state = SSL3_ST_SW_KEY_EXCH_B;
1229         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1230 f_err:
1231         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1232 err:
1233         return(-1);
1234         }
1235
1236 static int ssl3_send_certificate_request(SSL *s)
1237         {
1238         unsigned char *p,*d;
1239         int i,j,nl,off,n;
1240         STACK_OF(X509_NAME) *sk=NULL;
1241         X509_NAME *name;
1242         BUF_MEM *buf;
1243
1244         if (s->state == SSL3_ST_SW_CERT_REQ_A)
1245                 {
1246                 buf=s->init_buf;
1247
1248                 d=p=(unsigned char *)&(buf->data[4]);
1249
1250                 /* get the list of acceptable cert types */
1251                 p++;
1252                 n=ssl3_get_req_cert_type(s,p);
1253                 d[0]=n;
1254                 p+=n;
1255                 n++;
1256
1257                 off=n;
1258                 p+=2;
1259                 n+=2;
1260
1261                 sk=SSL_get_client_CA_list(s);
1262                 nl=0;
1263                 if (sk != NULL)
1264                         {
1265                         for (i=0; i<sk_X509_NAME_num(sk); i++)
1266                                 {
1267                                 name=sk_X509_NAME_value(sk,i);
1268                                 j=i2d_X509_NAME(name,NULL);
1269                                 if (!BUF_MEM_grow(buf,4+n+j+2))
1270                                         {
1271                                         SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
1272                                         goto err;
1273                                         }
1274                                 p=(unsigned char *)&(buf->data[4+n]);
1275                                 if (!(s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
1276                                         {
1277                                         s2n(j,p);
1278                                         i2d_X509_NAME(name,&p);
1279                                         n+=2+j;
1280                                         nl+=2+j;
1281                                         }
1282                                 else
1283                                         {
1284                                         d=p;
1285                                         i2d_X509_NAME(name,&p);
1286                                         j-=2; s2n(j,d); j+=2;
1287                                         n+=j;
1288                                         nl+=j;
1289                                         }
1290                                 }
1291                         }
1292                 /* else no CA names */
1293                 p=(unsigned char *)&(buf->data[4+off]);
1294                 s2n(nl,p);
1295
1296                 d=(unsigned char *)buf->data;
1297                 *(d++)=SSL3_MT_CERTIFICATE_REQUEST;
1298                 l2n3(n,d);
1299
1300                 /* we should now have things packed up, so lets send
1301                  * it off */
1302
1303                 s->init_num=n+4;
1304                 s->init_off=0;
1305 #ifdef NETSCAPE_HANG_BUG
1306                 p=(unsigned char *)s->init_buf->data + s->init_num;
1307
1308                 /* do the header */
1309                 *(p++)=SSL3_MT_SERVER_DONE;
1310                 *(p++)=0;
1311                 *(p++)=0;
1312                 *(p++)=0;
1313                 s->init_num += 4;
1314 #endif
1315
1316                 }
1317
1318         /* SSL3_ST_SW_CERT_REQ_B */
1319         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1320 err:
1321         return(-1);
1322         }
1323
1324 static int ssl3_get_client_key_exchange(SSL *s)
1325         {
1326         int i,al,ok;
1327         long n;
1328         unsigned long l;
1329         unsigned char *p;
1330 #ifndef NO_RSA
1331         RSA *rsa=NULL;
1332         EVP_PKEY *pkey=NULL;
1333 #endif
1334 #ifndef NO_DH
1335         BIGNUM *pub=NULL;
1336         DH *dh_srvr;
1337 #endif
1338
1339         n=ssl3_get_message(s,
1340                 SSL3_ST_SR_KEY_EXCH_A,
1341                 SSL3_ST_SR_KEY_EXCH_B,
1342                 SSL3_MT_CLIENT_KEY_EXCHANGE,
1343                 2048, /* ???? */
1344                 &ok);
1345
1346         if (!ok) return((int)n);
1347         p=(unsigned char *)s->init_buf->data;
1348
1349         l=s->s3->tmp.new_cipher->algorithms;
1350
1351 #ifndef NO_RSA
1352         if (l & SSL_kRSA)
1353                 {
1354                 /* FIX THIS UP EAY EAY EAY EAY */
1355                 if (s->s3->tmp.use_rsa_tmp)
1356                         {
1357                         if ((s->cert != NULL) && (s->cert->rsa_tmp != NULL))
1358                                 rsa=s->cert->rsa_tmp;
1359                         /* Don't do a callback because rsa_tmp should
1360                          * be sent already */
1361                         if (rsa == NULL)
1362                                 {
1363                                 al=SSL_AD_HANDSHAKE_FAILURE;
1364                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_RSA_PKEY);
1365                                 goto f_err;
1366
1367                                 }
1368                         }
1369                 else
1370                         {
1371                         pkey=s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
1372                         if (    (pkey == NULL) ||
1373                                 (pkey->type != EVP_PKEY_RSA) ||
1374                                 (pkey->pkey.rsa == NULL))
1375                                 {
1376                                 al=SSL_AD_HANDSHAKE_FAILURE;
1377                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_RSA_CERTIFICATE);
1378                                 goto f_err;
1379                                 }
1380                         rsa=pkey->pkey.rsa;
1381                         }
1382
1383                 /* TLS */
1384                 if (s->version > SSL3_VERSION)
1385                         {
1386                         n2s(p,i);
1387                         if (n != i+2)
1388                                 {
1389                                 if (!(s->options & SSL_OP_TLS_D5_BUG))
1390                                         {
1391                                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
1392                                         goto err;
1393                                         }
1394                                 else
1395                                         p-=2;
1396                                 }
1397                         else
1398                                 n=i;
1399                         }
1400
1401                 i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
1402
1403                 al = -1;
1404
1405                 if (i != SSL_MAX_MASTER_KEY_LENGTH)
1406                         {
1407                         al=SSL_AD_DECODE_ERROR;
1408                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
1409                         }
1410
1411                 if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff))))
1412                         {
1413                         /* The premaster secret must contain the same version number as the
1414                          * ClientHello to detect version rollback attacks (strangely, the
1415                          * protocol does not offer such protection for DH ciphersuites).
1416                          * However, buggy clients exist that send the negotiated protocol
1417                          * version instead if the server does not support the requested
1418                          * protocol version.
1419                          * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. */
1420                         if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) &&
1421                                 (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff))))
1422                                 {
1423                                 al=SSL_AD_DECODE_ERROR;
1424                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
1425                                 goto f_err;
1426                                 }
1427                         }
1428
1429                 if (al != -1)
1430                         {
1431 #if 0
1432                         goto f_err;
1433 #else
1434                         /* Some decryption failure -- use random value instead as countermeasure
1435                          * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
1436                          * (see RFC 2246, section 7.4.7.1).
1437                          * But note that due to length and protocol version checking, the
1438                          * attack is impractical anyway (see section 5 in D. Bleichenbacher:
1439                          * "Chosen Ciphertext Attacks Against Protocols Based on the RSA
1440                          * Encryption Standard PKCS #1", CRYPTO '98, LNCS 1462, pp. 1-12).
1441                          */
1442                         ERR_clear_error();
1443                         i = SSL_MAX_MASTER_KEY_LENGTH;
1444                         p[0] = s->client_version >> 8;
1445                         p[1] = s->client_version & 0xff;
1446                         RAND_pseudo_bytes(p+2, i-2); /* should be RAND_bytes, but we cannot work around a failure */
1447 #endif
1448                         }
1449
1450                 s->session->master_key_length=
1451                         s->method->ssl3_enc->generate_master_secret(s,
1452                                 s->session->master_key,
1453                                 p,i);
1454                 memset(p,0,i);
1455                 }
1456         else
1457 #endif
1458 #ifndef NO_DH
1459                 if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
1460                 {
1461                 n2s(p,i);
1462                 if (n != i+2)
1463                         {
1464                         if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG))
1465                                 {
1466                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
1467                                 goto err;
1468                                 }
1469                         else
1470                                 {
1471                                 p-=2;
1472                                 i=(int)n;
1473                                 }
1474                         }
1475
1476                 if (n == 0L) /* the parameters are in the cert */
1477                         {
1478                         al=SSL_AD_HANDSHAKE_FAILURE;
1479                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNABLE_TO_DECODE_DH_CERTS);
1480                         goto f_err;
1481                         }
1482                 else
1483                         {
1484                         if (s->s3->tmp.dh == NULL)
1485                                 {
1486                                 al=SSL_AD_HANDSHAKE_FAILURE;
1487                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
1488                                 goto f_err;
1489                                 }
1490                         else
1491                                 dh_srvr=s->s3->tmp.dh;
1492                         }
1493
1494                 pub=BN_bin2bn(p,i,NULL);
1495                 if (pub == NULL)
1496                         {
1497                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BN_LIB);
1498                         goto err;
1499                         }
1500
1501                 i=DH_compute_key(p,pub,dh_srvr);
1502
1503                 if (i <= 0)
1504                         {
1505                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
1506                         goto err;
1507                         }
1508
1509                 DH_free(s->s3->tmp.dh);
1510                 s->s3->tmp.dh=NULL;
1511
1512                 BN_clear_free(pub);
1513                 pub=NULL;
1514                 s->session->master_key_length=
1515                         s->method->ssl3_enc->generate_master_secret(s,
1516                                 s->session->master_key,p,i);
1517                 memset(p,0,i);
1518                 }
1519         else
1520 #endif
1521                 {
1522                 al=SSL_AD_HANDSHAKE_FAILURE;
1523                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_UNKNOWN_CIPHER_TYPE);
1524                 goto f_err;
1525                 }
1526
1527         return(1);
1528 f_err:
1529         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1530 #if !defined(NO_DH) || !defined(NO_RSA)
1531 err:
1532 #endif
1533         return(-1);
1534         }
1535
1536 static int ssl3_get_cert_verify(SSL *s)
1537         {
1538         EVP_PKEY *pkey=NULL;
1539         unsigned char *p;
1540         int al,ok,ret=0;
1541         long n;
1542         int type=0,i,j;
1543         X509 *peer;
1544
1545         n=ssl3_get_message(s,
1546                 SSL3_ST_SR_CERT_VRFY_A,
1547                 SSL3_ST_SR_CERT_VRFY_B,
1548                 -1,
1549                 512, /* 512? */
1550                 &ok);
1551
1552         if (!ok) return((int)n);
1553
1554         if (s->session->peer != NULL)
1555                 {
1556                 peer=s->session->peer;
1557                 pkey=X509_get_pubkey(peer);
1558                 type=X509_certificate_type(peer,pkey);
1559                 }
1560         else
1561                 {
1562                 peer=NULL;
1563                 pkey=NULL;
1564                 }
1565
1566         if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)
1567                 {
1568                 s->s3->tmp.reuse_message=1;
1569                 if ((peer != NULL) && (type | EVP_PKT_SIGN))
1570                         {
1571                         al=SSL_AD_UNEXPECTED_MESSAGE;
1572                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);
1573                         goto f_err;
1574                         }
1575                 ret=1;
1576                 goto end;
1577                 }
1578
1579         if (peer == NULL)
1580                 {
1581                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);
1582                 al=SSL_AD_UNEXPECTED_MESSAGE;
1583                 goto f_err;
1584                 }
1585
1586         if (!(type & EVP_PKT_SIGN))
1587                 {
1588                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
1589                 al=SSL_AD_ILLEGAL_PARAMETER;
1590                 goto f_err;
1591                 }
1592
1593         if (s->s3->change_cipher_spec)
1594                 {
1595                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
1596                 al=SSL_AD_UNEXPECTED_MESSAGE;
1597                 goto f_err;
1598                 }
1599
1600         /* we now have a signature that we need to verify */
1601         p=(unsigned char *)s->init_buf->data;
1602         n2s(p,i);
1603         n-=2;
1604         if (i > n)
1605                 {
1606                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);
1607                 al=SSL_AD_DECODE_ERROR;
1608                 goto f_err;
1609                 }
1610
1611         j=EVP_PKEY_size(pkey);
1612         if ((i > j) || (n > j) || (n <= 0))
1613                 {
1614                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);
1615                 al=SSL_AD_DECODE_ERROR;
1616                 goto f_err;
1617                 }
1618
1619 #ifndef NO_RSA
1620         if (pkey->type == EVP_PKEY_RSA)
1621                 {
1622                 i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,
1623                         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i,
1624                                                         pkey->pkey.rsa);
1625                 if (i < 0)
1626                         {
1627                         al=SSL_AD_DECRYPT_ERROR;
1628                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);
1629                         goto f_err;
1630                         }
1631                 if (i == 0)
1632                         {
1633                         al=SSL_AD_DECRYPT_ERROR;
1634                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);
1635                         goto f_err;
1636                         }
1637                 }
1638         else
1639 #endif
1640 #ifndef NO_DSA
1641                 if (pkey->type == EVP_PKEY_DSA)
1642                 {
1643                 j=DSA_verify(pkey->save_type,
1644                         &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
1645                         SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);
1646                 if (j <= 0)
1647                         {
1648                         /* bad signature */
1649                         al=SSL_AD_DECRYPT_ERROR;
1650                         SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);
1651                         goto f_err;
1652                         }
1653                 }
1654         else
1655 #endif
1656                 {
1657                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);
1658                 al=SSL_AD_UNSUPPORTED_CERTIFICATE;
1659                 goto f_err;
1660                 }
1661
1662
1663         ret=1;
1664         if (0)
1665                 {
1666 f_err:
1667                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1668                 }
1669 end:
1670         EVP_PKEY_free(pkey);
1671         return(ret);
1672         }
1673
1674 static int ssl3_get_client_certificate(SSL *s)
1675         {
1676         int i,ok,al,ret= -1;
1677         X509 *x=NULL;
1678         unsigned long l,nc,llen,n;
1679         unsigned char *p,*d,*q;
1680         STACK_OF(X509) *sk=NULL;
1681
1682         n=ssl3_get_message(s,
1683                 SSL3_ST_SR_CERT_A,
1684                 SSL3_ST_SR_CERT_B,
1685                 -1,
1686 #if defined(MSDOS) && !defined(WIN32)
1687                 1024*30, /* 30k max cert list :-) */
1688 #else
1689                 1024*100, /* 100k max cert list :-) */
1690 #endif
1691                 &ok);
1692
1693         if (!ok) return((int)n);
1694
1695         if      (s->s3->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE)
1696                 {
1697                 if (    (s->verify_mode & SSL_VERIFY_PEER) &&
1698                         (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
1699                         {
1700                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
1701                         al=SSL_AD_HANDSHAKE_FAILURE;
1702                         goto f_err;
1703                         }
1704                 /* If tls asked for a client cert, the client must return a 0 list */
1705                 if ((s->version > SSL3_VERSION) && s->s3->tmp.cert_request)
1706                         {
1707                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST);
1708                         al=SSL_AD_UNEXPECTED_MESSAGE;
1709                         goto f_err;
1710                         }
1711                 s->s3->tmp.reuse_message=1;
1712                 return(1);
1713                 }
1714
1715         if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE)
1716                 {
1717                 al=SSL_AD_UNEXPECTED_MESSAGE;
1718                 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_WRONG_MESSAGE_TYPE);
1719                 goto f_err;
1720                 }
1721         d=p=(unsigned char *)s->init_buf->data;
1722
1723         if ((sk=sk_X509_new_null()) == NULL)
1724                 {
1725                 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE);
1726                 goto err;
1727                 }
1728
1729         n2l3(p,llen);
1730         if (llen+3 != n)
1731                 {
1732                 al=SSL_AD_DECODE_ERROR;
1733                 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_LENGTH_MISMATCH);
1734                 goto f_err;
1735                 }
1736         for (nc=0; nc<llen; )
1737                 {
1738                 n2l3(p,l);
1739                 if ((l+nc+3) > llen)
1740                         {
1741                         al=SSL_AD_DECODE_ERROR;
1742                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
1743                         goto f_err;
1744                         }
1745
1746                 q=p;
1747                 x=d2i_X509(NULL,&p,l);
1748                 if (x == NULL)
1749                         {
1750                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_ASN1_LIB);
1751                         goto err;
1752                         }
1753                 if (p != (q+l))
1754                         {
1755                         al=SSL_AD_DECODE_ERROR;
1756                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_CERT_LENGTH_MISMATCH);
1757                         goto f_err;
1758                         }
1759                 if (!sk_X509_push(sk,x))
1760                         {
1761                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,ERR_R_MALLOC_FAILURE);
1762                         goto err;
1763                         }
1764                 x=NULL;
1765                 nc+=l+3;
1766                 }
1767
1768         if (sk_X509_num(sk) <= 0)
1769                 {
1770                 /* TLS does not mind 0 certs returned */
1771                 if (s->version == SSL3_VERSION)
1772                         {
1773                         al=SSL_AD_HANDSHAKE_FAILURE;
1774                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATES_RETURNED);
1775                         goto f_err;
1776                         }
1777                 /* Fail for TLS only if we required a certificate */
1778                 else if ((s->verify_mode & SSL_VERIFY_PEER) &&
1779                          (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
1780                         {
1781                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
1782                         al=SSL_AD_HANDSHAKE_FAILURE;
1783                         goto f_err;
1784                         }
1785                 }
1786         else
1787                 {
1788                 i=ssl_verify_cert_chain(s,sk);
1789                 if (!i)
1790                         {
1791                         al=ssl_verify_alarm_type(s->verify_result);
1792                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
1793                         goto f_err;
1794                         }
1795                 }
1796
1797         if (s->session->peer != NULL) /* This should not be needed */
1798                 X509_free(s->session->peer);
1799         s->session->peer=sk_X509_shift(sk);
1800         s->session->verify_result = s->verify_result;
1801
1802         /* With the current implementation, sess_cert will always be NULL
1803          * when we arrive here. */
1804         if (s->session->sess_cert == NULL)
1805                 {
1806                 s->session->sess_cert = ssl_sess_cert_new();
1807                 if (s->session->sess_cert == NULL)
1808                         {
1809                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
1810                         goto err;
1811                         }
1812                 }
1813         if (s->session->sess_cert->cert_chain != NULL)
1814                 sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
1815         s->session->sess_cert->cert_chain=sk;
1816         /* Inconsistency alert: cert_chain does *not* include the
1817          * peer's own certificate, while we do include it in s3_clnt.c */
1818
1819         sk=NULL;
1820
1821         ret=1;
1822         if (0)
1823                 {
1824 f_err:
1825                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1826                 }
1827 err:
1828         if (x != NULL) X509_free(x);
1829         if (sk != NULL) sk_X509_pop_free(sk,X509_free);
1830         return(ret);
1831         }
1832
1833 int ssl3_send_server_certificate(SSL *s)
1834         {
1835         unsigned long l;
1836         X509 *x;
1837
1838         if (s->state == SSL3_ST_SW_CERT_A)
1839                 {
1840                 x=ssl_get_server_send_cert(s);
1841                 if (x == NULL)
1842                         {
1843                         SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,SSL_R_INTERNAL_ERROR);
1844                         return(0);
1845                         }
1846
1847                 l=ssl3_output_cert_chain(s,x);
1848                 s->state=SSL3_ST_SW_CERT_B;
1849                 s->init_num=(int)l;
1850                 s->init_off=0;
1851                 }
1852
1853         /* SSL3_ST_SW_CERT_B */
1854         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
1855         }