feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Fixed merge conflict with stashed code

Browse Source
This commit is contained in:
John Safranek
2013-02-12 14:57:39 -08:00
parent 5f7359be7e
commit afb0cb3e20
1 changed files with 61 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
src/internal.c
View File

@@ -4374,7 +4374,10 @@ static void BuildCertHashes(CYASSL* ssl, Hashes* hashes)
if (ssl->options.tls) { if (ssl->options.tls) {
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha_mac) {
ShaFinal(&ssl->hashSha, hashes->hash);
}
else if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
Sha256Final(&ssl->hashSha256, hashes->hash); Sha256Final(&ssl->hashSha256, hashes->hash);
#endif #endif
@@ -6081,11 +6084,9 @@ int SetCipherList(Suites* s, const char* list)
+ ssl->suites->suiteSz + SUITE_LEN + ssl->suites->suiteSz + SUITE_LEN
+ COMP_LEN + ENUM_LEN; + COMP_LEN + ENUM_LEN;
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl) && ssl->suites->hashSigAlgoSz) {
if (ssl->suites->hashSigAlgoSz) {
length += ssl->suites->hashSigAlgoSz + HELLO_EXT_SZ; length += ssl->suites->hashSigAlgoSz + HELLO_EXT_SZ;
} }
}
sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ; sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
#ifdef CYASSL_DTLS #ifdef CYASSL_DTLS
@@ -6169,14 +6170,11 @@ int SetCipherList(Suites* s, const char* list)
idx += 2; idx += 2;
c16toa(HELLO_EXT_SIGALGO_SZ+ssl->suites->hashSigAlgoSz, output+idx); c16toa(HELLO_EXT_SIGALGO_SZ+ssl->suites->hashSigAlgoSz, output+idx);
idx += 2; idx += 2;
/* This is a lazy list setup. Eventually, we'll need to support
* using other hash types or even other extensions. */
c16toa(ssl->suites->hashSigAlgoSz, output + idx); c16toa(ssl->suites->hashSigAlgoSz, output + idx);
idx += 2; idx += 2;
for (i = 0; i < ssl->suites->hashSigAlgoSz; i++, idx++) { for (i = 0; i < ssl->suites->hashSigAlgoSz; i++, idx++) {
output[idx] = ssl->suites->hashSigAlgo[i]; output[idx] = ssl->suites->hashSigAlgo[i];
} }
idx += i;
} }
#ifdef CYASSL_DTLS #ifdef CYASSL_DTLS
@@ -6514,6 +6512,8 @@ int SetCipherList(Suites* s, const char* list)
byte hash384[SHA384_DIGEST_SIZE]; byte hash384[SHA384_DIGEST_SIZE];
#endif #endif
byte messageVerify[MAX_DH_SZ]; byte messageVerify[MAX_DH_SZ];
byte sigAlgo = ssl->specs.sig_algo;
byte hashAlgo = ssl->specs.mac_algorithm;
/* adjust from start idx */ /* adjust from start idx */
verifySz = (word16)(*inOutIdx - verifySz); verifySz = (word16)(*inOutIdx - verifySz);
@@ -6525,7 +6525,14 @@ int SetCipherList(Suites* s, const char* list)
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
/* just advance for now TODO: validate hash algo params */ /* just advance for now TODO: validate hash algo params */
*inOutIdx += LENGTH_SZ; /* XXX This is where we look at the signature algorithm,
* which should match what is in ssl->specs.sig_algo. We
* check that the hash is in our list of available hashes,
* and just use it and only it. */
hashAlgo = input[*inOutIdx];
*inOutIdx += 1;
sigAlgo = input[*inOutIdx];
*inOutIdx += 1;
} }
/* signature */ /* signature */
@@ -6569,7 +6576,7 @@ int SetCipherList(Suites* s, const char* list)
#endif #endif
/* rsa */ /* rsa */
if (ssl->specs.sig_algo == rsa_sa_algo) if (sigAlgo == rsa_sa_algo)
{ {
int ret; int ret;
byte* out; byte* out;
@@ -6586,14 +6593,14 @@ int SetCipherList(Suites* s, const char* list)
int typeH = SHAh; int typeH = SHAh;
int digestSz = SHA_DIGEST_SIZE; int digestSz = SHA_DIGEST_SIZE;
if (ssl->specs.mac_algorithm <= sha256_mac) { if (hashAlgo == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digest = hash256; digest = hash256;
typeH = SHA256h; typeH = SHA256h;
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
#endif #endif
} }
else if (ssl->specs.mac_algorithm == sha384_mac) { else if (hashAlgo == sha384_mac) {
#ifdef CYASSL_SHA384 #ifdef CYASSL_SHA384
digest = hash384; digest = hash384;
typeH = SHA384h; typeH = SHA384h;
@@ -6614,7 +6621,7 @@ int SetCipherList(Suites* s, const char* list)
} }
#ifdef HAVE_ECC #ifdef HAVE_ECC
/* ecdsa */ /* ecdsa */
else if (ssl->specs.sig_algo == ecc_dsa_sa_algo) { else if (sigAlgo == ecc_dsa_sa_algo) {
int verify = 0, ret; int verify = 0, ret;
byte* digest = &hash[MD5_DIGEST_SIZE]; byte* digest = &hash[MD5_DIGEST_SIZE];
word32 digestSz = SHA_DIGEST_SIZE; word32 digestSz = SHA_DIGEST_SIZE;
@@ -6622,13 +6629,13 @@ int SetCipherList(Suites* s, const char* list)
return NO_PEER_KEY; return NO_PEER_KEY;
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
if (ssl->specs.mac_algorithm <= sha256_mac) { if (hashAlgo == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digest = hash256; digest = hash256;
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
#endif #endif
} }
else if (ssl->specs.mac_algorithm == sha384_mac) { else if (hashAlgo == sha384_mac) {
#ifdef CYASSL_SHA384 #ifdef CYASSL_SHA384
digest = hash384; digest = hash384;
digestSz = SHA384_DIGEST_SIZE; digestSz = SHA384_DIGEST_SIZE;
@@ -6964,7 +6971,7 @@ int SetCipherList(Suites* s, const char* list)
length = sigOutSz; length = sigOutSz;
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
verify[0] = ssl->specs.mac_algorithm; verify[0] = ssl->specs.mac_algorithm;
verify[1] = usingEcc ? ecc_dsa_sa_algo : rsa_sa_algo; verify[1] = ssl->specs.sig_algo;
extraSz = HASH_SIG_SIZE; extraSz = HASH_SIG_SIZE;
} }
c16toa((word16)length, verify + extraSz); /* prepend verify header*/ c16toa((word16)length, verify + extraSz); /* prepend verify header*/
@@ -6977,7 +6984,7 @@ int SetCipherList(Suites* s, const char* list)
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
digest = ssl->certHashes.hash; digest = ssl->certHashes.hash;
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
#endif #endif
@@ -7000,7 +7007,7 @@ int SetCipherList(Suites* s, const char* list)
int digestSz = SHA_DIGEST_SIZE; int digestSz = SHA_DIGEST_SIZE;
int typeH = SHAh; int typeH = SHAh;
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
typeH = SHA256h; typeH = SHA256h;
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
@@ -7409,7 +7416,7 @@ int SetCipherList(Suites* s, const char* list)
int typeH = SHAh; int typeH = SHAh;
int digestSz = SHA_DIGEST_SIZE; int digestSz = SHA_DIGEST_SIZE;
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digest = hash256; digest = hash256;
typeH = SHA256h; typeH = SHA256h;
@@ -7443,7 +7450,7 @@ int SetCipherList(Suites* s, const char* list)
word32 sz = sigSz; word32 sz = sigSz;
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digest = hash256; digest = hash256;
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
@@ -7662,7 +7669,7 @@ int SetCipherList(Suites* s, const char* list)
int typeH = SHAh; int typeH = SHAh;
int digestSz = SHA_DIGEST_SIZE; int digestSz = SHA_DIGEST_SIZE;
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digest = hash256; digest = hash256;
typeH = SHA256h; typeH = SHA256h;
@@ -8489,8 +8496,37 @@ int SetCipherList(Suites* s, const char* list)
ssl->options.clientState = CLIENT_HELLO_COMPLETE; ssl->options.clientState = CLIENT_HELLO_COMPLETE;
*inOutIdx = i; *inOutIdx = i;
if ( (i - begin) < helloSz) if ( (i - begin) < helloSz) {
if (IsAtLeastTLSv1_2(ssl)) {
word16 totalExtSz, extId, extSz;
ato16(&input[i], &totalExtSz);
i += 2;
ato16(&input[i], &extId);
i += 2;
ato16(&input[i], &extSz);
i += 2;
ato16(&input[i], &clSuites.hashSigAlgoSz);
i += 2;
if (i + clSuites.hashSigAlgoSz > totalSz)
return INCOMPLETE_DATA;
if (clSuites.hashSigAlgoSz > HELLO_EXT_SIGALGO_MAX)
return BUFFER_ERROR;
XMEMCPY(clSuites.hashSigAlgo, input+i, clSuites.hashSigAlgoSz);
i += clSuites.hashSigAlgoSz;
*inOutIdx = i;
}
else
*inOutIdx = begin + helloSz; /* skip extensions */ *inOutIdx = begin + helloSz; /* skip extensions */
}
else {
if (IsAtLeastTLSv1_2(ssl)) {
clSuites.hashSigAlgoSz = 0;
}
}
ssl->options.haveSessionId = 1; ssl->options.haveSessionId = 1;
/* ProcessOld uses same resume code */ /* ProcessOld uses same resume code */
@@ -8571,7 +8607,7 @@ int SetCipherList(Suites* s, const char* list)
int typeH = SHAh; int typeH = SHAh;
int digestSz = SHA_DIGEST_SIZE; int digestSz = SHA_DIGEST_SIZE;
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
typeH = SHA256h; typeH = SHA256h;
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
@@ -8607,7 +8643,7 @@ int SetCipherList(Suites* s, const char* list)
CYASSL_MSG("Doing ECC peer cert verify"); CYASSL_MSG("Doing ECC peer cert verify");
if (IsAtLeastTLSv1_2(ssl)) { if (IsAtLeastTLSv1_2(ssl)) {
if (ssl->specs.mac_algorithm <= sha256_mac) { if (ssl->specs.mac_algorithm == sha256_mac) {
#ifndef NO_SHA256 #ifndef NO_SHA256
digestSz = SHA256_DIGEST_SIZE; digestSz = SHA256_DIGEST_SIZE;
#endif #endif