1 /* ssl/s3_lib.c */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <stdio.h> 60 #include <openssl/md5.h> 61 #include <openssl/sha.h> 62 #include <openssl/objects.h> 63 #include "ssl_locl.h" 64 65 const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT; 66 67 #define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER)) 68 69 static long ssl3_default_timeout(void ); 70 71 OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={ 72 /* The RSA ciphers */ 73 /* Cipher 01 */ 74 { 75 1, 76 SSL3_TXT_RSA_NULL_MD5, 77 SSL3_CK_RSA_NULL_MD5, 78 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3, 79 SSL_NOT_EXP, 80 0, 81 0, 82 0, 83 SSL_ALL_CIPHERS, 84 SSL_ALL_STRENGTHS, 85 }, 86 /* Cipher 02 */ 87 { 88 1, 89 SSL3_TXT_RSA_NULL_SHA, 90 SSL3_CK_RSA_NULL_SHA, 91 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3, 92 SSL_NOT_EXP, 93 0, 94 0, 95 0, 96 SSL_ALL_CIPHERS, 97 SSL_ALL_STRENGTHS, 98 }, 99 100 /* anon DH */ 101 /* Cipher 17 */ 102 { 103 1, 104 SSL3_TXT_ADH_RC4_40_MD5, 105 SSL3_CK_ADH_RC4_40_MD5, 106 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 107 SSL_EXPORT|SSL_EXP40, 108 0, 109 40, 110 128, 111 SSL_ALL_CIPHERS, 112 SSL_ALL_STRENGTHS, 113 }, 114 /* Cipher 18 */ 115 { 116 1, 117 SSL3_TXT_ADH_RC4_128_MD5, 118 SSL3_CK_ADH_RC4_128_MD5, 119 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 120 SSL_NOT_EXP, 121 0, 122 128, 123 128, 124 SSL_ALL_CIPHERS, 125 SSL_ALL_STRENGTHS, 126 }, 127 /* Cipher 19 */ 128 { 129 1, 130 SSL3_TXT_ADH_DES_40_CBC_SHA, 131 SSL3_CK_ADH_DES_40_CBC_SHA, 132 SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3, 133 SSL_EXPORT|SSL_EXP40, 134 0, 135 40, 136 128, 137 SSL_ALL_CIPHERS, 138 SSL_ALL_STRENGTHS, 139 }, 140 /* Cipher 1A */ 141 { 142 1, 143 SSL3_TXT_ADH_DES_64_CBC_SHA, 144 SSL3_CK_ADH_DES_64_CBC_SHA, 145 SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3, 146 SSL_NOT_EXP, 147 0, 148 56, 149 56, 150 SSL_ALL_CIPHERS, 151 SSL_ALL_STRENGTHS, 152 }, 153 /* Cipher 1B */ 154 { 155 1, 156 SSL3_TXT_ADH_DES_192_CBC_SHA, 157 SSL3_CK_ADH_DES_192_CBC_SHA, 158 SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3, 159 SSL_NOT_EXP, 160 0, 161 168, 162 168, 163 SSL_ALL_CIPHERS, 164 SSL_ALL_STRENGTHS, 165 }, 166 167 /* RSA again */ 168 /* Cipher 03 */ 169 { 170 1, 171 SSL3_TXT_RSA_RC4_40_MD5, 172 SSL3_CK_RSA_RC4_40_MD5, 173 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 174 SSL_EXPORT|SSL_EXP40, 175 0, 176 40, 177 128, 178 SSL_ALL_CIPHERS, 179 SSL_ALL_STRENGTHS, 180 }, 181 /* Cipher 04 */ 182 { 183 1, 184 SSL3_TXT_RSA_RC4_128_MD5, 185 SSL3_CK_RSA_RC4_128_MD5, 186 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_SSLV3, 187 SSL_NOT_EXP|SSL_MEDIUM, 188 0, 189 128, 190 128, 191 SSL_ALL_CIPHERS, 192 SSL_ALL_STRENGTHS, 193 }, 194 /* Cipher 05 */ 195 { 196 1, 197 SSL3_TXT_RSA_RC4_128_SHA, 198 SSL3_CK_RSA_RC4_128_SHA, 199 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_SSLV3, 200 SSL_NOT_EXP|SSL_MEDIUM, 201 0, 202 128, 203 128, 204 SSL_ALL_CIPHERS, 205 SSL_ALL_STRENGTHS, 206 }, 207 /* Cipher 06 */ 208 { 209 1, 210 SSL3_TXT_RSA_RC2_40_MD5, 211 SSL3_CK_RSA_RC2_40_MD5, 212 SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_SSLV3, 213 SSL_EXPORT|SSL_EXP40, 214 0, 215 40, 216 128, 217 SSL_ALL_CIPHERS, 218 SSL_ALL_STRENGTHS, 219 }, 220 /* Cipher 07 */ 221 { 222 1, 223 SSL3_TXT_RSA_IDEA_128_SHA, 224 SSL3_CK_RSA_IDEA_128_SHA, 225 SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3, 226 SSL_NOT_EXP|SSL_MEDIUM, 227 0, 228 128, 229 128, 230 SSL_ALL_CIPHERS, 231 SSL_ALL_STRENGTHS, 232 }, 233 /* Cipher 08 */ 234 { 235 1, 236 SSL3_TXT_RSA_DES_40_CBC_SHA, 237 SSL3_CK_RSA_DES_40_CBC_SHA, 238 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, 239 SSL_EXPORT|SSL_EXP40, 240 0, 241 40, 242 56, 243 SSL_ALL_CIPHERS, 244 SSL_ALL_STRENGTHS, 245 }, 246 /* Cipher 09 */ 247 { 248 1, 249 SSL3_TXT_RSA_DES_64_CBC_SHA, 250 SSL3_CK_RSA_DES_64_CBC_SHA, 251 SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, 252 SSL_NOT_EXP|SSL_LOW, 253 0, 254 56, 255 56, 256 SSL_ALL_CIPHERS, 257 SSL_ALL_STRENGTHS, 258 }, 259 /* Cipher 0A */ 260 { 261 1, 262 SSL3_TXT_RSA_DES_192_CBC3_SHA, 263 SSL3_CK_RSA_DES_192_CBC3_SHA, 264 SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, 265 SSL_NOT_EXP|SSL_HIGH, 266 0, 267 168, 268 168, 269 SSL_ALL_CIPHERS, 270 SSL_ALL_STRENGTHS, 271 }, 272 273 /* The DH ciphers */ 274 /* Cipher 0B */ 275 { 276 0, 277 SSL3_TXT_DH_DSS_DES_40_CBC_SHA, 278 SSL3_CK_DH_DSS_DES_40_CBC_SHA, 279 SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, 280 SSL_EXPORT|SSL_EXP40, 281 0, 282 40, 283 56, 284 SSL_ALL_CIPHERS, 285 SSL_ALL_STRENGTHS, 286 }, 287 /* Cipher 0C */ 288 { 289 0, 290 SSL3_TXT_DH_DSS_DES_64_CBC_SHA, 291 SSL3_CK_DH_DSS_DES_64_CBC_SHA, 292 SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, 293 SSL_NOT_EXP|SSL_LOW, 294 0, 295 56, 296 56, 297 SSL_ALL_CIPHERS, 298 SSL_ALL_STRENGTHS, 299 }, 300 /* Cipher 0D */ 301 { 302 0, 303 SSL3_TXT_DH_DSS_DES_192_CBC3_SHA, 304 SSL3_CK_DH_DSS_DES_192_CBC3_SHA, 305 SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, 306 SSL_NOT_EXP|SSL_HIGH, 307 0, 308 168, 309 168, 310 SSL_ALL_CIPHERS, 311 SSL_ALL_STRENGTHS, 312 }, 313 /* Cipher 0E */ 314 { 315 0, 316 SSL3_TXT_DH_RSA_DES_40_CBC_SHA, 317 SSL3_CK_DH_RSA_DES_40_CBC_SHA, 318 SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, 319 SSL_EXPORT|SSL_EXP40, 320 0, 321 40, 322 56, 323 SSL_ALL_CIPHERS, 324 SSL_ALL_STRENGTHS, 325 }, 326 /* Cipher 0F */ 327 { 328 0, 329 SSL3_TXT_DH_RSA_DES_64_CBC_SHA, 330 SSL3_CK_DH_RSA_DES_64_CBC_SHA, 331 SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, 332 SSL_NOT_EXP|SSL_LOW, 333 0, 334 56, 335 56, 336 SSL_ALL_CIPHERS, 337 SSL_ALL_STRENGTHS, 338 }, 339 /* Cipher 10 */ 340 { 341 0, 342 SSL3_TXT_DH_RSA_DES_192_CBC3_SHA, 343 SSL3_CK_DH_RSA_DES_192_CBC3_SHA, 344 SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, 345 SSL_NOT_EXP|SSL_HIGH, 346 0, 347 168, 348 168, 349 SSL_ALL_CIPHERS, 350 SSL_ALL_STRENGTHS, 351 }, 352 353 /* The Ephemeral DH ciphers */ 354 /* Cipher 11 */ 355 { 356 1, 357 SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, 358 SSL3_CK_EDH_DSS_DES_40_CBC_SHA, 359 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3, 360 SSL_EXPORT|SSL_EXP40, 361 0, 362 40, 363 56, 364 SSL_ALL_CIPHERS, 365 SSL_ALL_STRENGTHS, 366 }, 367 /* Cipher 12 */ 368 { 369 1, 370 SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, 371 SSL3_CK_EDH_DSS_DES_64_CBC_SHA, 372 SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3, 373 SSL_NOT_EXP|SSL_LOW, 374 0, 375 56, 376 56, 377 SSL_ALL_CIPHERS, 378 SSL_ALL_STRENGTHS, 379 }, 380 /* Cipher 13 */ 381 { 382 1, 383 SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, 384 SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, 385 SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3, 386 SSL_NOT_EXP|SSL_HIGH, 387 0, 388 168, 389 168, 390 SSL_ALL_CIPHERS, 391 SSL_ALL_STRENGTHS, 392 }, 393 /* Cipher 14 */ 394 { 395 1, 396 SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, 397 SSL3_CK_EDH_RSA_DES_40_CBC_SHA, 398 SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, 399 SSL_EXPORT|SSL_EXP40, 400 0, 401 40, 402 56, 403 SSL_ALL_CIPHERS, 404 SSL_ALL_STRENGTHS, 405 }, 406 /* Cipher 15 */ 407 { 408 1, 409 SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, 410 SSL3_CK_EDH_RSA_DES_64_CBC_SHA, 411 SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, 412 SSL_NOT_EXP|SSL_LOW, 413 0, 414 56, 415 56, 416 SSL_ALL_CIPHERS, 417 SSL_ALL_STRENGTHS, 418 }, 419 /* Cipher 16 */ 420 { 421 1, 422 SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, 423 SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, 424 SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, 425 SSL_NOT_EXP|SSL_HIGH, 426 0, 427 168, 428 168, 429 SSL_ALL_CIPHERS, 430 SSL_ALL_STRENGTHS, 431 }, 432 433 /* Fortezza */ 434 /* Cipher 1C */ 435 { 436 0, 437 SSL3_TXT_FZA_DMS_NULL_SHA, 438 SSL3_CK_FZA_DMS_NULL_SHA, 439 SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3, 440 SSL_NOT_EXP, 441 0, 442 0, 443 0, 444 SSL_ALL_CIPHERS, 445 SSL_ALL_STRENGTHS, 446 }, 447 448 /* Cipher 1D */ 449 { 450 0, 451 SSL3_TXT_FZA_DMS_FZA_SHA, 452 SSL3_CK_FZA_DMS_FZA_SHA, 453 SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3, 454 SSL_NOT_EXP, 455 0, 456 0, 457 0, 458 SSL_ALL_CIPHERS, 459 SSL_ALL_STRENGTHS, 460 }, 461 462 /* Cipher 1E */ 463 { 464 0, 465 SSL3_TXT_FZA_DMS_RC4_SHA, 466 SSL3_CK_FZA_DMS_RC4_SHA, 467 SSL_kFZA|SSL_aFZA |SSL_RC4 |SSL_SHA1|SSL_SSLV3, 468 SSL_NOT_EXP, 469 0, 470 128, 471 128, 472 SSL_ALL_CIPHERS, 473 SSL_ALL_STRENGTHS, 474 }, 475 476 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 477 /* New TLS Export CipherSuites */ 478 /* Cipher 60 */ 479 { 480 1, 481 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5, 482 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5, 483 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1, 484 SSL_EXPORT|SSL_EXP56, 485 0, 486 56, 487 128, 488 SSL_ALL_CIPHERS, 489 SSL_ALL_STRENGTHS, 490 }, 491 /* Cipher 61 */ 492 { 493 1, 494 TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 495 TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 496 SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1, 497 SSL_EXPORT|SSL_EXP56, 498 0, 499 56, 500 128, 501 SSL_ALL_CIPHERS, 502 SSL_ALL_STRENGTHS, 503 }, 504 /* Cipher 62 */ 505 { 506 1, 507 TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA, 508 TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA, 509 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1, 510 SSL_EXPORT|SSL_EXP56, 511 0, 512 56, 513 56, 514 SSL_ALL_CIPHERS, 515 SSL_ALL_STRENGTHS, 516 }, 517 /* Cipher 63 */ 518 { 519 1, 520 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 521 TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 522 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1, 523 SSL_EXPORT|SSL_EXP56, 524 0, 525 56, 526 56, 527 SSL_ALL_CIPHERS, 528 SSL_ALL_STRENGTHS, 529 }, 530 /* Cipher 64 */ 531 { 532 1, 533 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA, 534 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA, 535 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 536 SSL_EXPORT|SSL_EXP56, 537 0, 538 56, 539 128, 540 SSL_ALL_CIPHERS, 541 SSL_ALL_STRENGTHS, 542 }, 543 /* Cipher 65 */ 544 { 545 1, 546 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 547 TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 548 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, 549 SSL_EXPORT|SSL_EXP56, 550 0, 551 56, 552 128, 553 SSL_ALL_CIPHERS, 554 SSL_ALL_STRENGTHS, 555 }, 556 /* Cipher 66 */ 557 { 558 1, 559 TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA, 560 TLS1_CK_DHE_DSS_WITH_RC4_128_SHA, 561 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, 562 SSL_NOT_EXP, 563 0, 564 128, 565 128, 566 SSL_ALL_CIPHERS, 567 SSL_ALL_STRENGTHS 568 }, 569 #endif 570 571 /* end of list */ 572 }; 573 574 static SSL3_ENC_METHOD SSLv3_enc_data={ 575 ssl3_enc, 576 ssl3_mac, 577 ssl3_setup_key_block, 578 ssl3_generate_master_secret, 579 ssl3_change_cipher_state, 580 ssl3_final_finish_mac, 581 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, 582 ssl3_cert_verify_mac, 583 SSL3_MD_CLIENT_FINISHED_CONST,4, 584 SSL3_MD_SERVER_FINISHED_CONST,4, 585 ssl3_alert_code, 586 }; 587 588 static SSL_METHOD SSLv3_data= { 589 SSL3_VERSION, 590 ssl3_new, 591 ssl3_clear, 592 ssl3_free, 593 ssl_undefined_function, 594 ssl_undefined_function, 595 ssl3_read, 596 ssl3_peek, 597 ssl3_write, 598 ssl3_shutdown, 599 ssl3_renegotiate, 600 ssl3_renegotiate_check, 601 ssl3_ctrl, 602 ssl3_ctx_ctrl, 603 ssl3_get_cipher_by_char, 604 ssl3_put_cipher_by_char, 605 ssl3_pending, 606 ssl3_num_ciphers, 607 ssl3_get_cipher, 608 ssl_bad_method, 609 ssl3_default_timeout, 610 &SSLv3_enc_data, 611 ssl_undefined_function, 612 ssl3_callback_ctrl, 613 ssl3_ctx_callback_ctrl, 614 }; 615 616 static long ssl3_default_timeout(void) 617 { 618 /* 2 hours, the 24 hours mentioned in the SSLv3 spec 619 * is way too long for http, the cache would over fill */ 620 return(60*60*2); 621 } 622 623 SSL_METHOD *sslv3_base_method(void) 624 { 625 return(&SSLv3_data); 626 } 627 628 int ssl3_num_ciphers(void) 629 { 630 return(SSL3_NUM_CIPHERS); 631 } 632 633 SSL_CIPHER *ssl3_get_cipher(unsigned int u) 634 { 635 if (u < SSL3_NUM_CIPHERS) 636 return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u])); 637 else 638 return(NULL); 639 } 640 641 /* The problem is that it may not be the correct record type */ 642 int ssl3_pending(SSL *s) 643 { 644 return(s->s3->rrec.length); 645 } 646 647 int ssl3_new(SSL *s) 648 { 649 SSL3_STATE *s3; 650 651 if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err; 652 memset(s3,0,sizeof *s3); 653 654 s->s3=s3; 655 656 s->method->ssl_clear(s); 657 return(1); 658 err: 659 return(0); 660 } 661 662 void ssl3_free(SSL *s) 663 { 664 if(s == NULL) 665 return; 666 667 ssl3_cleanup_key_block(s); 668 if (s->s3->rbuf.buf != NULL) 669 OPENSSL_free(s->s3->rbuf.buf); 670 if (s->s3->wbuf.buf != NULL) 671 OPENSSL_free(s->s3->wbuf.buf); 672 if (s->s3->rrec.comp != NULL) 673 OPENSSL_free(s->s3->rrec.comp); 674 #ifndef NO_DH 675 if (s->s3->tmp.dh != NULL) 676 DH_free(s->s3->tmp.dh); 677 #endif 678 if (s->s3->tmp.ca_names != NULL) 679 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 680 memset(s->s3,0,sizeof *s->s3); 681 OPENSSL_free(s->s3); 682 s->s3=NULL; 683 } 684 685 void ssl3_clear(SSL *s) 686 { 687 unsigned char *rp,*wp; 688 689 ssl3_cleanup_key_block(s); 690 if (s->s3->tmp.ca_names != NULL) 691 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 692 693 if (s->s3->rrec.comp != NULL) 694 { 695 OPENSSL_free(s->s3->rrec.comp); 696 s->s3->rrec.comp=NULL; 697 } 698 #ifndef NO_DH 699 if (s->s3->tmp.dh != NULL) 700 DH_free(s->s3->tmp.dh); 701 #endif 702 703 rp=s->s3->rbuf.buf; 704 wp=s->s3->wbuf.buf; 705 706 memset(s->s3,0,sizeof *s->s3); 707 if (rp != NULL) s->s3->rbuf.buf=rp; 708 if (wp != NULL) s->s3->wbuf.buf=wp; 709 710 ssl_free_wbio_buffer(s); 711 712 s->packet_length=0; 713 s->s3->renegotiate=0; 714 s->s3->total_renegotiations=0; 715 s->s3->num_renegotiations=0; 716 s->s3->in_read_app_data=0; 717 s->version=SSL3_VERSION; 718 } 719 720 long ssl3_ctrl(SSL *s, int cmd, long larg, char *parg) 721 { 722 int ret=0; 723 724 #if !defined(NO_DSA) || !defined(NO_RSA) 725 if ( 726 #ifndef NO_RSA 727 cmd == SSL_CTRL_SET_TMP_RSA || 728 cmd == SSL_CTRL_SET_TMP_RSA_CB || 729 #endif 730 #ifndef NO_DSA 731 cmd == SSL_CTRL_SET_TMP_DH || 732 cmd == SSL_CTRL_SET_TMP_DH_CB || 733 #endif 734 0) 735 { 736 if (!ssl_cert_inst(&s->cert)) 737 { 738 SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE); 739 return(0); 740 } 741 } 742 #endif 743 744 switch (cmd) 745 { 746 case SSL_CTRL_GET_SESSION_REUSED: 747 ret=s->hit; 748 break; 749 case SSL_CTRL_GET_CLIENT_CERT_REQUEST: 750 break; 751 case SSL_CTRL_GET_NUM_RENEGOTIATIONS: 752 ret=s->s3->num_renegotiations; 753 break; 754 case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS: 755 ret=s->s3->num_renegotiations; 756 s->s3->num_renegotiations=0; 757 break; 758 case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS: 759 ret=s->s3->total_renegotiations; 760 break; 761 case SSL_CTRL_GET_FLAGS: 762 ret=(int)(s->s3->flags); 763 break; 764 #ifndef NO_RSA 765 case SSL_CTRL_NEED_TMP_RSA: 766 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) && 767 ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 768 (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))) 769 ret = 1; 770 break; 771 case SSL_CTRL_SET_TMP_RSA: 772 { 773 RSA *rsa = (RSA *)parg; 774 if (rsa == NULL) 775 { 776 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 777 return(ret); 778 } 779 if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) 780 { 781 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB); 782 return(ret); 783 } 784 if (s->cert->rsa_tmp != NULL) 785 RSA_free(s->cert->rsa_tmp); 786 s->cert->rsa_tmp = rsa; 787 ret = 1; 788 } 789 break; 790 case SSL_CTRL_SET_TMP_RSA_CB: 791 { 792 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 793 return(ret); 794 } 795 break; 796 #endif 797 #ifndef NO_DH 798 case SSL_CTRL_SET_TMP_DH: 799 { 800 DH *dh = (DH *)parg; 801 if (dh == NULL) 802 { 803 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 804 return(ret); 805 } 806 if ((dh = DHparams_dup(dh)) == NULL) 807 { 808 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 809 return(ret); 810 } 811 if (!(s->options & SSL_OP_SINGLE_DH_USE)) 812 { 813 if (!DH_generate_key(dh)) 814 { 815 DH_free(dh); 816 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 817 return(ret); 818 } 819 } 820 if (s->cert->dh_tmp != NULL) 821 DH_free(s->cert->dh_tmp); 822 s->cert->dh_tmp = dh; 823 ret = 1; 824 } 825 break; 826 case SSL_CTRL_SET_TMP_DH_CB: 827 { 828 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 829 return(ret); 830 } 831 break; 832 #endif 833 default: 834 break; 835 } 836 return(ret); 837 } 838 839 long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)()) 840 { 841 int ret=0; 842 843 #if !defined(NO_DSA) || !defined(NO_RSA) 844 if ( 845 #ifndef NO_RSA 846 cmd == SSL_CTRL_SET_TMP_RSA_CB || 847 #endif 848 #ifndef NO_DSA 849 cmd == SSL_CTRL_SET_TMP_DH_CB || 850 #endif 851 0) 852 { 853 if (!ssl_cert_inst(&s->cert)) 854 { 855 SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE); 856 return(0); 857 } 858 } 859 #endif 860 861 switch (cmd) 862 { 863 #ifndef NO_RSA 864 case SSL_CTRL_SET_TMP_RSA_CB: 865 { 866 s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 867 } 868 break; 869 #endif 870 #ifndef NO_DH 871 case SSL_CTRL_SET_TMP_DH_CB: 872 { 873 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 874 } 875 break; 876 #endif 877 default: 878 break; 879 } 880 return(ret); 881 } 882 883 long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg) 884 { 885 CERT *cert; 886 887 cert=ctx->cert; 888 889 switch (cmd) 890 { 891 #ifndef NO_RSA 892 case SSL_CTRL_NEED_TMP_RSA: 893 if ( (cert->rsa_tmp == NULL) && 894 ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 895 (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))) 896 ) 897 return(1); 898 else 899 return(0); 900 /* break; */ 901 case SSL_CTRL_SET_TMP_RSA: 902 { 903 RSA *rsa; 904 int i; 905 906 rsa=(RSA *)parg; 907 i=1; 908 if (rsa == NULL) 909 i=0; 910 else 911 { 912 if ((rsa=RSAPrivateKey_dup(rsa)) == NULL) 913 i=0; 914 } 915 if (!i) 916 { 917 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB); 918 return(0); 919 } 920 else 921 { 922 if (cert->rsa_tmp != NULL) 923 RSA_free(cert->rsa_tmp); 924 cert->rsa_tmp=rsa; 925 return(1); 926 } 927 } 928 /* break; */ 929 case SSL_CTRL_SET_TMP_RSA_CB: 930 { 931 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 932 return(0); 933 } 934 break; 935 #endif 936 #ifndef NO_DH 937 case SSL_CTRL_SET_TMP_DH: 938 { 939 DH *new=NULL,*dh; 940 941 dh=(DH *)parg; 942 if ((new=DHparams_dup(dh)) == NULL) 943 { 944 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); 945 return 0; 946 } 947 if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) 948 { 949 if (!DH_generate_key(new)) 950 { 951 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); 952 DH_free(new); 953 return 0; 954 } 955 } 956 if (cert->dh_tmp != NULL) 957 DH_free(cert->dh_tmp); 958 cert->dh_tmp=new; 959 return 1; 960 } 961 /*break; */ 962 case SSL_CTRL_SET_TMP_DH_CB: 963 { 964 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 965 return(0); 966 } 967 break; 968 #endif 969 /* A Thawte special :-) */ 970 case SSL_CTRL_EXTRA_CHAIN_CERT: 971 if (ctx->extra_certs == NULL) 972 { 973 if ((ctx->extra_certs=sk_X509_new_null()) == NULL) 974 return(0); 975 } 976 sk_X509_push(ctx->extra_certs,(X509 *)parg); 977 break; 978 979 default: 980 return(0); 981 } 982 return(1); 983 } 984 985 long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)()) 986 { 987 CERT *cert; 988 989 cert=ctx->cert; 990 991 switch (cmd) 992 { 993 #ifndef NO_RSA 994 case SSL_CTRL_SET_TMP_RSA_CB: 995 { 996 cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 997 } 998 break; 999 #endif 1000 #ifndef NO_DH 1001 case SSL_CTRL_SET_TMP_DH_CB: 1002 { 1003 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 1004 } 1005 break; 1006 #endif 1007 default: 1008 return(0); 1009 } 1010 return(1); 1011 } 1012 1013 /* This function needs to check if the ciphers required are actually 1014 * available */ 1015 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p) 1016 { 1017 static int init=1; 1018 static SSL_CIPHER *sorted[SSL3_NUM_CIPHERS]; 1019 SSL_CIPHER c,*cp= &c,**cpp; 1020 unsigned long id; 1021 int i; 1022 1023 if (init) 1024 { 1025 CRYPTO_w_lock(CRYPTO_LOCK_SSL); 1026 1027 for (i=0; i<SSL3_NUM_CIPHERS; i++) 1028 sorted[i]= &(ssl3_ciphers[i]); 1029 1030 qsort( (char *)sorted, 1031 SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *), 1032 FP_ICC ssl_cipher_ptr_id_cmp); 1033 1034 CRYPTO_w_unlock(CRYPTO_LOCK_SSL); 1035 1036 init=0; 1037 } 1038 1039 id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1]; 1040 c.id=id; 1041 cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp, 1042 (char *)sorted, 1043 SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *), 1044 FP_ICC ssl_cipher_ptr_id_cmp); 1045 if ((cpp == NULL) || !(*cpp)->valid) 1046 return(NULL); 1047 else 1048 return(*cpp); 1049 } 1050 1051 int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p) 1052 { 1053 long l; 1054 1055 if (p != NULL) 1056 { 1057 l=c->id; 1058 if ((l & 0xff000000) != 0x03000000) return(0); 1059 p[0]=((unsigned char)(l>> 8L))&0xFF; 1060 p[1]=((unsigned char)(l ))&0xFF; 1061 } 1062 return(2); 1063 } 1064 1065 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *have, 1066 STACK_OF(SSL_CIPHER) *pref) 1067 { 1068 SSL_CIPHER *c,*ret=NULL; 1069 int i,j,ok; 1070 CERT *cert; 1071 unsigned long alg,mask,emask; 1072 1073 /* Let's see which ciphers we can support */ 1074 cert=s->cert; 1075 1076 sk_SSL_CIPHER_set_cmp_func(pref,ssl_cipher_ptr_id_cmp); 1077 1078 #ifdef CIPHER_DEBUG 1079 printf("Have:\n"); 1080 for(i=0 ; i < sk_num(pref) ; ++i) 1081 { 1082 c=(SSL_CIPHER *)sk_value(pref,i); 1083 printf("%p:%s\n",c,c->name); 1084 } 1085 #endif 1086 1087 for (i=0; i<sk_SSL_CIPHER_num(have); i++) 1088 { 1089 c=sk_SSL_CIPHER_value(have,i); 1090 1091 ssl_set_cert_masks(cert,c); 1092 mask=cert->mask; 1093 emask=cert->export_mask; 1094 1095 alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK); 1096 if (SSL_C_IS_EXPORT(c)) 1097 { 1098 ok=((alg & emask) == alg)?1:0; 1099 #ifdef CIPHER_DEBUG 1100 printf("%d:[%08lX:%08lX]%p:%s (export)\n",ok,alg,emask, 1101 c,c->name); 1102 #endif 1103 } 1104 else 1105 { 1106 ok=((alg & mask) == alg)?1:0; 1107 #ifdef CIPHER_DEBUG 1108 printf("%d:[%08lX:%08lX]%p:%s\n",ok,alg,mask,c, 1109 c->name); 1110 #endif 1111 } 1112 1113 if (!ok) continue; 1114 1115 j=sk_SSL_CIPHER_find(pref,c); 1116 if (j >= 0) 1117 { 1118 ret=sk_SSL_CIPHER_value(pref,j); 1119 break; 1120 } 1121 } 1122 return(ret); 1123 } 1124 1125 int ssl3_get_req_cert_type(SSL *s, unsigned char *p) 1126 { 1127 int ret=0; 1128 unsigned long alg; 1129 1130 alg=s->s3->tmp.new_cipher->algorithms; 1131 1132 #ifndef NO_DH 1133 if (alg & (SSL_kDHr|SSL_kEDH)) 1134 { 1135 # ifndef NO_RSA 1136 p[ret++]=SSL3_CT_RSA_FIXED_DH; 1137 # endif 1138 # ifndef NO_DSA 1139 p[ret++]=SSL3_CT_DSS_FIXED_DH; 1140 # endif 1141 } 1142 if ((s->version == SSL3_VERSION) && 1143 (alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) 1144 { 1145 # ifndef NO_RSA 1146 p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH; 1147 # endif 1148 # ifndef NO_DSA 1149 p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH; 1150 # endif 1151 } 1152 #endif /* !NO_DH */ 1153 #ifndef NO_RSA 1154 p[ret++]=SSL3_CT_RSA_SIGN; 1155 #endif 1156 #ifndef NO_DSA 1157 p[ret++]=SSL3_CT_DSS_SIGN; 1158 #endif 1159 return(ret); 1160 } 1161 1162 int ssl3_shutdown(SSL *s) 1163 { 1164 1165 /* Don't do anything much if we have not done the handshake or 1166 * we don't want to send messages :-) */ 1167 if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) 1168 { 1169 s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); 1170 return(1); 1171 } 1172 1173 if (!(s->shutdown & SSL_SENT_SHUTDOWN)) 1174 { 1175 s->shutdown|=SSL_SENT_SHUTDOWN; 1176 #if 1 1177 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY); 1178 #endif 1179 /* our shutdown alert has been sent now, and if it still needs 1180 * to be written, s->s3->alert_dispatch will be true */ 1181 } 1182 else if (s->s3->alert_dispatch) 1183 { 1184 /* resend it if not sent */ 1185 #if 1 1186 ssl3_dispatch_alert(s); 1187 #endif 1188 } 1189 else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) 1190 { 1191 /* If we are waiting for a close from our peer, we are closed */ 1192 ssl3_read_bytes(s,0,NULL,0); 1193 } 1194 1195 if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) && 1196 !s->s3->alert_dispatch) 1197 return(1); 1198 else 1199 return(0); 1200 } 1201 1202 int ssl3_write(SSL *s, const void *buf, int len) 1203 { 1204 int ret,n; 1205 1206 #if 0 1207 if (s->shutdown & SSL_SEND_SHUTDOWN) 1208 { 1209 s->rwstate=SSL_NOTHING; 1210 return(0); 1211 } 1212 #endif 1213 clear_sys_error(); 1214 if (s->s3->renegotiate) ssl3_renegotiate_check(s); 1215 1216 /* This is an experimental flag that sends the 1217 * last handshake message in the same packet as the first 1218 * use data - used to see if it helps the TCP protocol during 1219 * session-id reuse */ 1220 /* The second test is because the buffer may have been removed */ 1221 if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) 1222 { 1223 /* First time through, we write into the buffer */ 1224 if (s->s3->delay_buf_pop_ret == 0) 1225 { 1226 ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, 1227 buf,len); 1228 if (ret <= 0) return(ret); 1229 1230 s->s3->delay_buf_pop_ret=ret; 1231 } 1232 1233 s->rwstate=SSL_WRITING; 1234 n=BIO_flush(s->wbio); 1235 if (n <= 0) return(n); 1236 s->rwstate=SSL_NOTHING; 1237 1238 /* We have flushed the buffer, so remove it */ 1239 ssl_free_wbio_buffer(s); 1240 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; 1241 1242 ret=s->s3->delay_buf_pop_ret; 1243 s->s3->delay_buf_pop_ret=0; 1244 } 1245 else 1246 { 1247 ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, 1248 buf,len); 1249 if (ret <= 0) return(ret); 1250 } 1251 1252 return(ret); 1253 } 1254 1255 int ssl3_read(SSL *s, void *buf, int len) 1256 { 1257 int ret; 1258 1259 clear_sys_error(); 1260 if (s->s3->renegotiate) ssl3_renegotiate_check(s); 1261 s->s3->in_read_app_data=1; 1262 ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len); 1263 if ((ret == -1) && (s->s3->in_read_app_data == 0)) 1264 { 1265 /* ssl3_read_bytes decided to call s->handshake_func, which 1266 * called ssl3_read_bytes to read handshake data. 1267 * However, ssl3_read_bytes actually found application data 1268 * and thinks that application data makes sense here (signalled 1269 * by resetting 'in_read_app_data', strangely); so disable 1270 * handshake processing and try to read application data again. */ 1271 s->in_handshake++; 1272 ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len); 1273 s->in_handshake--; 1274 } 1275 else 1276 s->s3->in_read_app_data=0; 1277 1278 return(ret); 1279 } 1280 1281 int ssl3_peek(SSL *s, char *buf, int len) 1282 { 1283 SSL3_RECORD *rr; 1284 int n; 1285 1286 rr= &(s->s3->rrec); 1287 if ((rr->length == 0) || (rr->type != SSL3_RT_APPLICATION_DATA)) 1288 { 1289 n=ssl3_read(s,buf,1); 1290 if (n <= 0) return(n); 1291 rr->length++; 1292 rr->off--; 1293 } 1294 1295 if ((unsigned int)len > rr->length) 1296 n=rr->length; 1297 else 1298 n=len; 1299 memcpy(buf,&(rr->data[rr->off]),(unsigned int)n); 1300 return(n); 1301 } 1302 1303 int ssl3_renegotiate(SSL *s) 1304 { 1305 if (s->handshake_func == NULL) 1306 return(1); 1307 1308 if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) 1309 return(0); 1310 1311 s->s3->renegotiate=1; 1312 return(1); 1313 } 1314 1315 int ssl3_renegotiate_check(SSL *s) 1316 { 1317 int ret=0; 1318 1319 if (s->s3->renegotiate) 1320 { 1321 if ( (s->s3->rbuf.left == 0) && 1322 (s->s3->wbuf.left == 0) && 1323 !SSL_in_init(s)) 1324 { 1325 /* 1326 if we are the server, and we have sent a 'RENEGOTIATE' message, we 1327 need to go to SSL_ST_ACCEPT. 1328 */ 1329 /* SSL_ST_ACCEPT */ 1330 s->state=SSL_ST_RENEGOTIATE; 1331 s->s3->renegotiate=0; 1332 s->s3->num_renegotiations++; 1333 s->s3->total_renegotiations++; 1334 ret=1; 1335 } 1336 } 1337 return(ret); 1338 } 1339 1340