From 8d92c1f8a381a3be7fe5b3a2c2aa9bfce22f5c72 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sun, 21 Jun 2015 16:26:08 +0100 Subject: [PATCH] Remove peer temp keys from SESS_CERT Reviewed-by: Richard Levitte --- ssl/s3_clnt.c | 42 +++++++++++++++++++++--------------------- ssl/s3_lib.c | 31 ++++++++++++++++++++++--------- ssl/ssl_cert.c | 10 ---------- ssl/ssl_locl.h | 21 ++++++++++++--------- 4 files changed, 55 insertions(+), 49 deletions(-) diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 935a621e6d..524842f6ec 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -1464,22 +1464,22 @@ int ssl3_get_key_exchange(SSL *s) } param = p = (unsigned char *)s->init_msg; - if (s->session->sess_cert != NULL) { + #ifndef OPENSSL_NO_RSA - RSA_free(s->session->sess_cert->peer_rsa_tmp); - s->session->sess_cert->peer_rsa_tmp = NULL; + RSA_free(s->s3->peer_rsa_tmp); + s->s3->peer_rsa_tmp = NULL; #endif #ifndef OPENSSL_NO_DH - DH_free(s->session->sess_cert->peer_dh_tmp); - s->session->sess_cert->peer_dh_tmp = NULL; + DH_free(s->s3->peer_dh_tmp); + s->s3->peer_dh_tmp = NULL; #endif #ifndef OPENSSL_NO_EC - EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp); - s->session->sess_cert->peer_ecdh_tmp = NULL; + EC_KEY_free(s->s3->peer_ecdh_tmp); + s->s3->peer_ecdh_tmp = NULL; #endif - } else { + + if (s->session->sess_cert == NULL) s->session->sess_cert = ssl_sess_cert_new(); - } /* Total length of the parameters including the length prefix */ param_len = 0; @@ -1711,7 +1711,7 @@ int ssl3_get_key_exchange(SSL *s) goto f_err; } - s->session->sess_cert->peer_rsa_tmp = rsa; + s->s3->peer_rsa_tmp = rsa; rsa = NULL; } #else /* OPENSSL_NO_RSA */ @@ -1806,7 +1806,7 @@ int ssl3_get_key_exchange(SSL *s) # endif /* else anonymous DH, so no certificate or pkey. */ - s->session->sess_cert->peer_dh_tmp = dh; + s->s3->peer_dh_tmp = dh; dh = NULL; } #endif /* !OPENSSL_NO_DH */ @@ -1917,7 +1917,7 @@ int ssl3_get_key_exchange(SSL *s) # endif /* else anonymous ECDH, so no certificate or pkey. */ EC_KEY_set_public_key(ecdh, srvr_ecpoint); - s->session->sess_cert->peer_ecdh_tmp = ecdh; + s->s3->peer_ecdh_tmp = ecdh; ecdh = NULL; BN_CTX_free(bn_ctx); bn_ctx = NULL; @@ -2446,8 +2446,8 @@ int ssl3_send_client_key_exchange(SSL *s) goto err; } - if (s->session->sess_cert->peer_rsa_tmp != NULL) - rsa = s->session->sess_cert->peer_rsa_tmp; + if (s->s3->peer_rsa_tmp != NULL) + rsa = s->s3->peer_rsa_tmp; else { pkey = X509_get_pubkey(s->session-> @@ -2504,8 +2504,8 @@ int ssl3_send_client_key_exchange(SSL *s) goto err; } - if (scert->peer_dh_tmp != NULL) - dh_srvr = scert->peer_dh_tmp; + if (s->s3->peer_dh_tmp != NULL) + dh_srvr = s->s3->peer_dh_tmp; else { /* we get them from the cert */ int idx = scert->peer_cert_type; @@ -2558,7 +2558,7 @@ int ssl3_send_client_key_exchange(SSL *s) */ n = DH_compute_key(pms, dh_srvr->pub_key, dh_clnt); - if (scert->peer_dh_tmp == NULL) + if (s->s3->peer_dh_tmp == NULL) DH_free(dh_srvr); if (n <= 0) { @@ -2624,8 +2624,8 @@ int ssl3_send_client_key_exchange(SSL *s) */ } - if (s->session->sess_cert->peer_ecdh_tmp != NULL) { - tkey = s->session->sess_cert->peer_ecdh_tmp; + if (s->s3->peer_ecdh_tmp != NULL) { + tkey = s->s3->peer_ecdh_tmp; } else { /* Get the Server Public Key from Cert */ srvr_pub_pkey = @@ -3357,10 +3357,10 @@ int ssl3_check_cert_and_algorithm(SSL *s) goto err; } #ifndef OPENSSL_NO_RSA - rsa = s->session->sess_cert->peer_rsa_tmp; + rsa = s->s3->peer_rsa_tmp; #endif #ifndef OPENSSL_NO_DH - dh = s->session->sess_cert->peer_dh_tmp; + dh = s->s3->peer_dh_tmp; #endif /* This is the passed certificate */ diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index 03078016e6..ad413aa702 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -2894,11 +2894,17 @@ void ssl3_free(SSL *s) return; ssl3_cleanup_key_block(s); + +#ifndef OPENSSL_NO_RSA + RSA_free(s->s3->peer_rsa_tmp); +#endif #ifndef OPENSSL_NO_DH DH_free(s->s3->tmp.dh); + DH_free(s->s3->peer_dh_tmp); #endif #ifndef OPENSSL_NO_EC EC_KEY_free(s->s3->tmp.ecdh); + EC_KEY_free(s->s3->peer_ecdh_tmp); #endif sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free); @@ -2929,13 +2935,22 @@ void ssl3_clear(SSL *s) OPENSSL_free(s->s3->tmp.peer_sigalgs); s->s3->tmp.peer_sigalgs = NULL; +#ifndef OPENSSL_NO_RSA + RSA_free(s->s3->peer_rsa_tmp); + s->s3->peer_rsa_tmp = NULL; +#endif + #ifndef OPENSSL_NO_DH DH_free(s->s3->tmp.dh); s->s3->tmp.dh = NULL; + DH_free(s->s3->peer_dh_tmp); + s->s3->peer_dh_tmp = NULL; #endif #ifndef OPENSSL_NO_EC EC_KEY_free(s->s3->tmp.ecdh); s->s3->tmp.ecdh = NULL; + EC_KEY_free(s->s3->peer_ecdh_tmp); + s->s3->peer_ecdh_tmp = NULL; s->s3->is_probably_safari = 0; #endif /* !OPENSSL_NO_EC */ @@ -3330,28 +3345,26 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) if (s->server || !s->session || !s->session->sess_cert) return 0; else { - SESS_CERT *sc; EVP_PKEY *ptmp; int rv = 0; - sc = s->session->sess_cert; #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC) - if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp && !sc->peer_ecdh_tmp) + if (!s->s3->peer_rsa_tmp && !s->s3->peer_dh_tmp && !s->s3->peer_ecdh_tmp) return 0; #endif ptmp = EVP_PKEY_new(); if (!ptmp) return 0; #ifndef OPENSSL_NO_RSA - else if (sc->peer_rsa_tmp) - rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp); + else if (s->s3->peer_rsa_tmp) + rv = EVP_PKEY_set1_RSA(ptmp, s->s3->peer_rsa_tmp); #endif #ifndef OPENSSL_NO_DH - else if (sc->peer_dh_tmp) - rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp); + else if (s->s3->peer_dh_tmp) + rv = EVP_PKEY_set1_DH(ptmp, s->s3->peer_dh_tmp); #endif #ifndef OPENSSL_NO_EC - else if (sc->peer_ecdh_tmp) - rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp); + else if (s->s3->peer_ecdh_tmp) + rv = EVP_PKEY_set1_EC_KEY(ptmp, s->s3->peer_ecdh_tmp); #endif if (rv) { *(EVP_PKEY **)parg = ptmp; diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 6b39e25813..badcc2d147 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -570,16 +570,6 @@ void ssl_sess_cert_free(SESS_CERT *sc) #endif } -#ifndef OPENSSL_NO_RSA - RSA_free(sc->peer_rsa_tmp); -#endif -#ifndef OPENSSL_NO_DH - DH_free(sc->peer_dh_tmp); -#endif -#ifndef OPENSSL_NO_EC - EC_KEY_free(sc->peer_ecdh_tmp); -#endif - OPENSSL_free(sc); } diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 3252631e1c..b3fabf7341 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -1340,6 +1340,18 @@ typedef struct ssl3_state_st { */ char is_probably_safari; # endif /* !OPENSSL_NO_EC */ + + /* For clients: peer temporary key */ +# ifndef OPENSSL_NO_RSA + RSA *peer_rsa_tmp; +# endif +# ifndef OPENSSL_NO_DH + DH *peer_dh_tmp; +# endif +# ifndef OPENSSL_NO_EC + EC_KEY *peer_ecdh_tmp; +# endif + } SSL3_STATE; @@ -1589,15 +1601,6 @@ typedef struct sess_cert_st { * Obviously we don't have the private keys of these, so maybe we * shouldn't even use the CERT_PKEY type here. */ -# ifndef OPENSSL_NO_RSA - RSA *peer_rsa_tmp; /* not used for SSL 2 */ -# endif -# ifndef OPENSSL_NO_DH - DH *peer_dh_tmp; /* not used for SSL 2 */ -# endif -# ifndef OPENSSL_NO_EC - EC_KEY *peer_ecdh_tmp; -# endif int references; /* actually always 1 at the moment */ } SESS_CERT; /* Structure containing decoded values of signature algorithms extension */ -- 2.25.1