1 /* ssl/s2_srvr.c */

     2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     3  * All rights reserved.

     4  *

     5  * This package is an SSL implementation written

     6  * by Eric Young (eay@cryptsoft.com).

     7  * The implementation was written so as to conform with Netscapes SSL.

     8  * 

     9  * This library is free for commercial and non-commercial use as long as

    10  * the following conditions are aheared to.  The following conditions

    11  * apply to all code found in this distribution, be it the RC4, RSA,

    12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    13  * included with this distribution is covered by the same copyright terms

    14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    15  * 

    16  * Copyright remains Eric Young's, and as such any Copyright notices in

    17  * the code are not to be removed.

    18  * If this package is used in a product, Eric Young should be given attribution

    19  * as the author of the parts of the library used.

    20  * This can be in the form of a textual message at program startup or

    21  * in documentation (online or textual) provided with the package.

    22  * 

    23  * Redistribution and use in source and binary forms, with or without

    24  * modification, are permitted provided that the following conditions

    25  * are met:

    26  * 1. Redistributions of source code must retain the copyright

    27  *    notice, this list of conditions and the following disclaimer.

    28  * 2. Redistributions in binary form must reproduce the above copyright

    29  *    notice, this list of conditions and the following disclaimer in the

    30  *    documentation and/or other materials provided with the distribution.

    31  * 3. All advertising materials mentioning features or use of this software

    32  *    must display the following acknowledgement:

    33  *    "This product includes cryptographic software written by

    34  *     Eric Young (eay@cryptsoft.com)"

    35  *    The word 'cryptographic' can be left out if the rouines from the library

    36  *    being used are not cryptographic related :-).

    37  * 4. If you include any Windows specific code (or a derivative thereof) from 

    38  *    the apps directory (application code) you must include an acknowledgement:

    39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    40  * 

    41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    51  * SUCH DAMAGE.

    52  * 

    53  * The licence and distribution terms for any publically available version or

    54  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    55  * copied and put under another distribution licence

    56  * [including the GNU Public Licence.]

    57  */

    58 /* ====================================================================

    59  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.

    60  *

    61  * Redistribution and use in source and binary forms, with or without

    62  * modification, are permitted provided that the following conditions

    63  * are met:

    64  *

    65  * 1. Redistributions of source code must retain the above copyright

    66  *    notice, this list of conditions and the following disclaimer. 

    67  *

    68  * 2. Redistributions in binary form must reproduce the above copyright

    69  *    notice, this list of conditions and the following disclaimer in

    70  *    the documentation and/or other materials provided with the

    71  *    distribution.

    72  *

    73  * 3. All advertising materials mentioning features or use of this

    74  *    software must display the following acknowledgment:

    75  *    "This product includes software developed by the OpenSSL Project

    76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

    77  *

    78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

    79  *    endorse or promote products derived from this software without

    80  *    prior written permission. For written permission, please contact

    81  *    openssl-core@openssl.org.

    82  *

    83  * 5. Products derived from this software may not be called "OpenSSL"

    84  *    nor may "OpenSSL" appear in their names without prior written

    85  *    permission of the OpenSSL Project.

    86  *

    87  * 6. Redistributions of any form whatsoever must retain the following

    88  *    acknowledgment:

    89  *    "This product includes software developed by the OpenSSL Project

    90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

    91  *

    92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

    93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

    95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

    96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

    97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

    98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

    99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   103  * OF THE POSSIBILITY OF SUCH DAMAGE.

   104  * ====================================================================

   105  *

   106  * This product includes cryptographic software written by Eric Young

   107  * (eay@cryptsoft.com).  This product includes software written by Tim

   108  * Hudson (tjh@cryptsoft.com).

   109  *

   110  */

   111 /*

   112  © Portions copyright (c) 2006 Nokia Corporation.  All rights reserved.

   113  */

   114  

   115 #include "ssl_locl.h"

   116 #ifndef OPENSSL_NO_SSL2

   117 #include <stdio.h>

   118 #include <openssl/bio.h>

   119 #include <openssl/rand.h>

   120 #include <openssl/objects.h>

   121 #include <openssl/evp.h>

   122 

   123 #if (defined(SYMBIAN) && (defined(__WINSCW__) || defined(__WINS__)))

   124 #include "libssl_wsd.h"

   125 #endif

   126 

   127 #ifdef EMULATOR

   128 

   129 	GET_STATIC_VAR_FROM_TLS(SSLv2_server_method_data,s2_srvr,SSL_METHOD)

   130 	

   131 	#define SSLv2_server_method_data (*GET_WSD_VAR_NAME(SSLv2_server_method_data,s2_srvr,s)())

   132 	

   133 #endif

   134 static SSL_METHOD *ssl2_get_server_method(int ver);

   135 static int get_client_master_key(SSL *s);

   136 static int get_client_hello(SSL *s);

   137 static int server_hello(SSL *s); 

   138 static int get_client_finished(SSL *s);

   139 static int server_verify(SSL *s);

   140 static int server_finish(SSL *s);

   141 static int request_certificate(SSL *s);

   142 static int ssl_rsa_private_decrypt(CERT *c, int len, unsigned char *from,

   143 	unsigned char *to,int padding);

   144 #define BREAK	break

   145 

   146 static SSL_METHOD *ssl2_get_server_method(int ver)

   147 	{

   148 	if (ver == SSL2_VERSION)

   149 		return(SSLv2_server_method());

   150 	else

   151 		return(NULL);

   152 	}

   153 

   154 EXPORT_C IMPLEMENT_ssl2_meth_func(SSLv2_server_method,

   155 			ssl2_accept,

   156 			ssl_undefined_function,

   157 			ssl2_get_server_method)

   158 

   159 int ssl2_accept(SSL *s)

   160 	{

   161 	unsigned long l=(unsigned long)time(NULL);

   162 	BUF_MEM *buf=NULL;

   163 	int ret= -1;

   164 	long num1;

   165 	void (*cb)(const SSL *ssl,int type,int val)=NULL;

   166 	int new_state,state;

   167 

   168 	RAND_add(&l,sizeof(l),0);

   169 	ERR_clear_error();

   170 	clear_sys_error();

   171 

   172 	if (s->info_callback != NULL)

   173 		cb=s->info_callback;

   174 	else if (s->ctx->info_callback != NULL)

   175 		cb=s->ctx->info_callback;

   176 

   177 	/* init things to blank */

   178 	s->in_handshake++;

   179 	if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);

   180 

   181 	if (s->cert == NULL)

   182 		{

   183 		SSLerr(SSL_F_SSL2_ACCEPT,SSL_R_NO_CERTIFICATE_SET);

   184 		return(-1);

   185 		}

   186 

   187 	clear_sys_error();

   188 	for (;;)

   189 		{

   190 		state=s->state;

   191 

   192 		switch (s->state)

   193 			{

   194 		case SSL_ST_BEFORE:

   195 		case SSL_ST_ACCEPT:

   196 		case SSL_ST_BEFORE|SSL_ST_ACCEPT:

   197 		case SSL_ST_OK|SSL_ST_ACCEPT:

   198 

   199 			s->server=1;

   200 			if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);

   201 

   202 			s->version=SSL2_VERSION;

   203 			s->type=SSL_ST_ACCEPT;

   204 

   205 			buf=s->init_buf;

   206 			if ((buf == NULL) && ((buf=BUF_MEM_new()) == NULL))

   207 				{ ret= -1; goto end; }

   208 			if (!BUF_MEM_grow(buf,(int)

   209 				SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))

   210 				{ ret= -1; goto end; }

   211 			s->init_buf=buf;

   212 			s->init_num=0;

   213 			s->ctx->stats.sess_accept++;

   214 			s->handshake_func=ssl2_accept;

   215 			s->state=SSL2_ST_GET_CLIENT_HELLO_A;

   216 			BREAK;

   217 

   218 		case SSL2_ST_GET_CLIENT_HELLO_A:

   219 		case SSL2_ST_GET_CLIENT_HELLO_B:

   220 		case SSL2_ST_GET_CLIENT_HELLO_C:

   221 			s->shutdown=0;

   222 			ret=get_client_hello(s);

   223 			if (ret <= 0) goto end;

   224 			s->init_num=0;

   225 			s->state=SSL2_ST_SEND_SERVER_HELLO_A;

   226 			BREAK;

   227 

   228 		case SSL2_ST_SEND_SERVER_HELLO_A:

   229 		case SSL2_ST_SEND_SERVER_HELLO_B:

   230 			ret=server_hello(s);

   231 			if (ret <= 0) goto end;

   232 			s->init_num=0;

   233 			if (!s->hit)

   234 				{

   235 				s->state=SSL2_ST_GET_CLIENT_MASTER_KEY_A;

   236 				BREAK;

   237 				}

   238 			else

   239 				{

   240 				s->state=SSL2_ST_SERVER_START_ENCRYPTION;

   241 				BREAK;

   242 				}

   243 		case SSL2_ST_GET_CLIENT_MASTER_KEY_A:

   244 		case SSL2_ST_GET_CLIENT_MASTER_KEY_B:

   245 			ret=get_client_master_key(s);

   246 			if (ret <= 0) goto end;

   247 			s->init_num=0;

   248 			s->state=SSL2_ST_SERVER_START_ENCRYPTION;

   249 			BREAK;

   250 

   251 		case SSL2_ST_SERVER_START_ENCRYPTION:

   252 			/* Ok we how have sent all the stuff needed to

   253 			 * start encrypting, the next packet back will

   254 			 * be encrypted. */

   255 			if (!ssl2_enc_init(s,0))

   256 				{ ret= -1; goto end; }

   257 			s->s2->clear_text=0;

   258 			s->state=SSL2_ST_SEND_SERVER_VERIFY_A;

   259 			BREAK;

   260 

   261 		case SSL2_ST_SEND_SERVER_VERIFY_A:

   262 		case SSL2_ST_SEND_SERVER_VERIFY_B:

   263 			ret=server_verify(s);

   264 			if (ret <= 0) goto end;

   265 			s->init_num=0;

   266 			if (s->hit)

   267 				{

   268 				/* If we are in here, we have been

   269 				 * buffering the output, so we need to

   270 				 * flush it and remove buffering from

   271 				 * future traffic */

   272 				s->state=SSL2_ST_SEND_SERVER_VERIFY_C;

   273 				BREAK;

   274 				}

   275 			else

   276 				{

   277 				s->state=SSL2_ST_GET_CLIENT_FINISHED_A;

   278 				break;

   279 				}

   280 

   281  		case SSL2_ST_SEND_SERVER_VERIFY_C:

   282  			/* get the number of bytes to write */

   283  			num1=BIO_ctrl(s->wbio,BIO_CTRL_INFO,0,NULL);

   284  			if (num1 != 0)

   285  				{

   286 				s->rwstate=SSL_WRITING;

   287  				num1=BIO_flush(s->wbio);

   288  				if (num1 <= 0) { ret= -1; goto end; }

   289 				s->rwstate=SSL_NOTHING;

   290 				}

   291 

   292  			/* flushed and now remove buffering */

   293  			s->wbio=BIO_pop(s->wbio);

   294 

   295  			s->state=SSL2_ST_GET_CLIENT_FINISHED_A;

   296   			BREAK;

   297 

   298 		case SSL2_ST_GET_CLIENT_FINISHED_A:

   299 		case SSL2_ST_GET_CLIENT_FINISHED_B:

   300 			ret=get_client_finished(s);

   301 			if (ret <= 0)

   302 				goto end;

   303 			s->init_num=0;

   304 			s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_A;

   305 			BREAK;

   306 

   307 		case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:

   308 		case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:

   309 		case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:

   310 		case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:

   311 			/* don't do a 'request certificate' if we

   312 			 * don't want to, or we already have one, and

   313 			 * we only want to do it once. */

   314 			if (!(s->verify_mode & SSL_VERIFY_PEER) ||

   315 				((s->session->peer != NULL) &&

   316 				(s->verify_mode & SSL_VERIFY_CLIENT_ONCE)))

   317 				{

   318 				s->state=SSL2_ST_SEND_SERVER_FINISHED_A;

   319 				break;

   320 				}

   321 			else

   322 				{

   323 				ret=request_certificate(s);

   324 				if (ret <= 0) goto end;

   325 				s->init_num=0;

   326 				s->state=SSL2_ST_SEND_SERVER_FINISHED_A;

   327 				}

   328 			BREAK;

   329 

   330 		case SSL2_ST_SEND_SERVER_FINISHED_A:

   331 		case SSL2_ST_SEND_SERVER_FINISHED_B:

   332 			ret=server_finish(s);

   333 			if (ret <= 0) goto end;

   334 			s->init_num=0;

   335 			s->state=SSL_ST_OK;

   336 			break;

   337 

   338 		case SSL_ST_OK:

   339 			BUF_MEM_free(s->init_buf);

   340 			ssl_free_wbio_buffer(s);

   341 			s->init_buf=NULL;

   342 			s->init_num=0;

   343 		/*	ERR_clear_error();*/

   344 

   345 			ssl_update_cache(s,SSL_SESS_CACHE_SERVER);

   346 

   347 			s->ctx->stats.sess_accept_good++;

   348 			/* s->server=1; */

   349 			ret=1;

   350 

   351 			if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);

   352 

   353 			goto end;

   354 			/* BREAK; */

   355 

   356 		default:

   357 			SSLerr(SSL_F_SSL2_ACCEPT,SSL_R_UNKNOWN_STATE);

   358 			ret= -1;

   359 			goto end;

   360 			/* BREAK; */

   361 			}

   362 		

   363 		if ((cb != NULL) && (s->state != state))

   364 			{

   365 			new_state=s->state;

   366 			s->state=state;

   367 			cb(s,SSL_CB_ACCEPT_LOOP,1);

   368 			s->state=new_state;

   369 			}

   370 		}

   371 end:

   372 	s->in_handshake--;

   373 	if (cb != NULL)

   374 		cb(s,SSL_CB_ACCEPT_EXIT,ret);

   375 	return(ret);

   376 	}

   377 

   378 static int get_client_master_key(SSL *s)

   379 	{

   380 	int is_export,i,n,keya,ek;

   381 	unsigned long len;

   382 	unsigned char *p;

   383 	SSL_CIPHER *cp;

   384 	const EVP_CIPHER *c;

   385 	const EVP_MD *md;

   386 

   387 	p=(unsigned char *)s->init_buf->data;

   388 	if (s->state == SSL2_ST_GET_CLIENT_MASTER_KEY_A)

   389 		{

   390 		i=ssl2_read(s,(char *)&(p[s->init_num]),10-s->init_num);

   391 

   392 		if (i < (10-s->init_num))

   393 			return(ssl2_part_read(s,SSL_F_GET_CLIENT_MASTER_KEY,i));

   394 		s->init_num = 10;

   395 

   396 		if (*(p++) != SSL2_MT_CLIENT_MASTER_KEY)

   397 			{

   398 			if (p[-1] != SSL2_MT_ERROR)

   399 				{

   400 				ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   401 				SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_READ_WRONG_PACKET_TYPE);

   402 				}

   403 			else

   404 				SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_PEER_ERROR);

   405 			return(-1);

   406 			}

   407 

   408 		cp=ssl2_get_cipher_by_char(p);

   409 		if (cp == NULL)

   410 			{

   411 			ssl2_return_error(s,SSL2_PE_NO_CIPHER);

   412 			SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_CIPHER_MATCH);

   413 			return(-1);

   414 			}

   415 		s->session->cipher= cp;

   416 

   417 		p+=3;

   418 		n2s(p,i); s->s2->tmp.clear=i;

   419 		n2s(p,i); s->s2->tmp.enc=i;

   420 		n2s(p,i); s->session->key_arg_length=i;

   421 		if(s->session->key_arg_length > SSL_MAX_KEY_ARG_LENGTH)

   422 			{

   423 			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   424 			SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_KEY_ARG_TOO_LONG);

   425 			return -1;

   426 			}

   427 		s->state=SSL2_ST_GET_CLIENT_MASTER_KEY_B;

   428 		}

   429 

   430 	/* SSL2_ST_GET_CLIENT_MASTER_KEY_B */

   431 	p=(unsigned char *)s->init_buf->data;

   432 	if (s->init_buf->length < SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)

   433 		{

   434 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   435 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);

   436 		return -1;

   437 		}

   438 	keya=s->session->key_arg_length;

   439 	len = 10 + (unsigned long)s->s2->tmp.clear + (unsigned long)s->s2->tmp.enc + (unsigned long)keya;

   440 	if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)

   441 		{

   442 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   443 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_MESSAGE_TOO_LONG);

   444 		return -1;

   445 		}

   446 	n = (int)len - s->init_num;

   447 	i = ssl2_read(s,(char *)&(p[s->init_num]),n);

   448 	if (i != n) return(ssl2_part_read(s,SSL_F_GET_CLIENT_MASTER_KEY,i));

   449 	if (s->msg_callback)

   450 		s->msg_callback(0, s->version, 0, p, (size_t)len, s, s->msg_callback_arg); /* CLIENT-MASTER-KEY */

   451 	p += 10;

   452 

   453 	memcpy(s->session->key_arg,&(p[s->s2->tmp.clear+s->s2->tmp.enc]),

   454 		(unsigned int)keya);

   455 

   456 	if (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL)

   457 		{

   458 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   459 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_NO_PRIVATEKEY);

   460 		return(-1);

   461 		}

   462 	i=ssl_rsa_private_decrypt(s->cert,s->s2->tmp.enc,

   463 		&(p[s->s2->tmp.clear]),&(p[s->s2->tmp.clear]),

   464 		(s->s2->ssl2_rollback)?RSA_SSLV23_PADDING:RSA_PKCS1_PADDING);

   465 

   466 	is_export=SSL_C_IS_EXPORT(s->session->cipher);

   467 	

   468 	if (!ssl_cipher_get_evp(s->session,&c,&md,NULL))

   469 		{

   470 		ssl2_return_error(s,SSL2_PE_NO_CIPHER);

   471 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);

   472 		return(0);

   473 		}

   474 

   475 	if (s->session->cipher->algorithm2 & SSL2_CF_8_BYTE_ENC)

   476 		{

   477 		is_export=1;

   478 		ek=8;

   479 		}

   480 	else

   481 		ek=5;

   482 

   483 	/* bad decrypt */

   484 #if 1

   485 	/* If a bad decrypt, continue with protocol but with a

   486 	 * random master secret (Bleichenbacher attack) */

   487 	if ((i < 0) ||

   488 		((!is_export && (i != EVP_CIPHER_key_length(c)))

   489 		|| (is_export && ((i != ek) || (s->s2->tmp.clear+(unsigned int)i !=

   490 			(unsigned int)EVP_CIPHER_key_length(c))))))

   491 		{

   492 		ERR_clear_error();

   493 		if (is_export)

   494 			i=ek;

   495 		else

   496 			i=EVP_CIPHER_key_length(c);

   497 		if (RAND_pseudo_bytes(p,i) <= 0)

   498 			return 0;

   499 		}

   500 #else

   501 	if (i < 0)

   502 		{

   503 		error=1;

   504 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_BAD_RSA_DECRYPT);

   505 		}

   506 	/* incorrect number of key bytes for non export cipher */

   507 	else if ((!is_export && (i != EVP_CIPHER_key_length(c)))

   508 		|| (is_export && ((i != ek) || (s->s2->tmp.clear+i !=

   509 			EVP_CIPHER_key_length(c)))))

   510 		{

   511 		error=1;

   512 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_WRONG_NUMBER_OF_KEY_BITS);

   513 		}

   514 	if (error)

   515 		{

   516 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   517 		return(-1);

   518 		}

   519 #endif

   520 

   521 	if (is_export) i+=s->s2->tmp.clear;

   522 

   523 	if (i > SSL_MAX_MASTER_KEY_LENGTH)

   524 		{

   525 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   526 		SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);

   527 		return -1;

   528 		}

   529 	s->session->master_key_length=i;

   530 	memcpy(s->session->master_key,p,(unsigned int)i);

   531 	return(1);

   532 	}

   533 

   534 static int get_client_hello(SSL *s)

   535 	{

   536 	int i,n;

   537 	unsigned long len;

   538 	unsigned char *p;

   539 	STACK_OF(SSL_CIPHER) *cs; /* a stack of SSL_CIPHERS */

   540 	STACK_OF(SSL_CIPHER) *cl; /* the ones we want to use */

   541 	STACK_OF(SSL_CIPHER) *prio, *allow;

   542 	int z;

   543 

   544 	/* This is a bit of a hack to check for the correct packet

   545 	 * type the first time round. */

   546 	if (s->state == SSL2_ST_GET_CLIENT_HELLO_A)

   547 		{

   548 		s->first_packet=1;

   549 		s->state=SSL2_ST_GET_CLIENT_HELLO_B;

   550 		}

   551 

   552 	p=(unsigned char *)s->init_buf->data;

   553 	if (s->state == SSL2_ST_GET_CLIENT_HELLO_B)

   554 		{

   555 		i=ssl2_read(s,(char *)&(p[s->init_num]),9-s->init_num);

   556 		if (i < (9-s->init_num)) 

   557 			return(ssl2_part_read(s,SSL_F_GET_CLIENT_HELLO,i));

   558 		s->init_num = 9;

   559 	

   560 		if (*(p++) != SSL2_MT_CLIENT_HELLO)

   561 			{

   562 			if (p[-1] != SSL2_MT_ERROR)

   563 				{

   564 				ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   565 				SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_READ_WRONG_PACKET_TYPE);

   566 				}

   567 			else

   568 				SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_PEER_ERROR);

   569 			return(-1);

   570 			}

   571 		n2s(p,i);

   572 		if (i < s->version) s->version=i;

   573 		n2s(p,i); s->s2->tmp.cipher_spec_length=i;

   574 		n2s(p,i); s->s2->tmp.session_id_length=i;

   575 		n2s(p,i); s->s2->challenge_length=i;

   576 		if (	(i < SSL2_MIN_CHALLENGE_LENGTH) ||

   577 			(i > SSL2_MAX_CHALLENGE_LENGTH))

   578 			{

   579 			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   580 			SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_INVALID_CHALLENGE_LENGTH);

   581 			return(-1);

   582 			}

   583 		s->state=SSL2_ST_GET_CLIENT_HELLO_C;

   584 		}

   585 

   586 	/* SSL2_ST_GET_CLIENT_HELLO_C */

   587 	p=(unsigned char *)s->init_buf->data;

   588 	len = 9 + (unsigned long)s->s2->tmp.cipher_spec_length + (unsigned long)s->s2->challenge_length + (unsigned long)s->s2->tmp.session_id_length;

   589 	if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)

   590 		{

   591 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   592 		SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_MESSAGE_TOO_LONG);

   593 		return -1;

   594 		}

   595 	n = (int)len - s->init_num;

   596 	i = ssl2_read(s,(char *)&(p[s->init_num]),n);

   597 	if (i != n) return(ssl2_part_read(s,SSL_F_GET_CLIENT_HELLO,i));

   598 	if (s->msg_callback)

   599 		s->msg_callback(0, s->version, 0, p, (size_t)len, s, s->msg_callback_arg); /* CLIENT-HELLO */

   600 	p += 9;

   601 

   602 	/* get session-id before cipher stuff so we can get out session

   603 	 * structure if it is cached */

   604 	/* session-id */

   605 	if ((s->s2->tmp.session_id_length != 0) && 

   606 		(s->s2->tmp.session_id_length != SSL2_SSL_SESSION_ID_LENGTH))

   607 		{

   608 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   609 		SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_BAD_SSL_SESSION_ID_LENGTH);

   610 		return(-1);

   611 		}

   612 

   613 	if (s->s2->tmp.session_id_length == 0)

   614 		{

   615 		if (!ssl_get_new_session(s,1))

   616 			{

   617 			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   618 			return(-1);

   619 			}

   620 		}

   621 	else

   622 		{

   623 		i=ssl_get_prev_session(s,&(p[s->s2->tmp.cipher_spec_length]),

   624 			s->s2->tmp.session_id_length, NULL);

   625 		if (i == 1)

   626 			{ /* previous session */

   627 			s->hit=1;

   628 			}

   629 		else if (i == -1)

   630 			{

   631 			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   632 			return(-1);

   633 			}

   634 		else

   635 			{

   636 			if (s->cert == NULL)

   637 				{

   638 				ssl2_return_error(s,SSL2_PE_NO_CERTIFICATE);

   639 				SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_NO_CERTIFICATE_SET);

   640 				return(-1);

   641 				}

   642 

   643 			if (!ssl_get_new_session(s,1))

   644 				{

   645 				ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   646 				return(-1);

   647 				}

   648 			}

   649 		}

   650 

   651 	if (!s->hit)

   652 		{

   653 		cs=ssl_bytes_to_cipher_list(s,p,s->s2->tmp.cipher_spec_length,

   654 			&s->session->ciphers);

   655 		if (cs == NULL) goto mem_err;

   656 

   657 		cl=SSL_get_ciphers(s);

   658 

   659 		if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)

   660 		    {

   661 		    prio=sk_SSL_CIPHER_dup(cl);

   662 		    if (prio == NULL) goto mem_err;

   663 		    allow = cs;

   664 		    }

   665 		else

   666 		    {

   667 		    prio = cs;

   668 		    allow = cl;

   669 		    }

   670 		for (z=0; z<sk_SSL_CIPHER_num(prio); z++)

   671 			{

   672 			if (sk_SSL_CIPHER_find(allow,sk_SSL_CIPHER_value(prio,z)) < 0)

   673 				{

   674 				(void)sk_SSL_CIPHER_delete(prio,z);

   675 				z--;

   676 				}

   677 			}

   678 		if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)

   679 		    {

   680 		    sk_SSL_CIPHER_free(s->session->ciphers);

   681 		    s->session->ciphers = prio;

   682 		    }

   683 		/* s->session->ciphers should now have a list of

   684 		 * ciphers that are on both the client and server.

   685 		 * This list is ordered by the order the client sent

   686 		 * the ciphers or in the order of the server's preference

   687 		 * if SSL_OP_CIPHER_SERVER_PREFERENCE was set.

   688 		 */

   689 		}

   690 	p+=s->s2->tmp.cipher_spec_length;

   691 	/* done cipher selection */

   692 

   693 	/* session id extracted already */

   694 	p+=s->s2->tmp.session_id_length;

   695 

   696 	/* challenge */

   697 	if (s->s2->challenge_length > sizeof s->s2->challenge)

   698 		{

   699 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   700 		SSLerr(SSL_F_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);

   701 		return -1;

   702 		}

   703 	memcpy(s->s2->challenge,p,(unsigned int)s->s2->challenge_length);

   704 	return(1);

   705 mem_err:

   706 	SSLerr(SSL_F_GET_CLIENT_HELLO,ERR_R_MALLOC_FAILURE);

   707 	return(0);

   708 	}

   709 

   710 static int server_hello(SSL *s)

   711 	{

   712 	unsigned char *p,*d;

   713 	int n,hit;

   714 	STACK_OF(SSL_CIPHER) *sk;

   715 

   716 	p=(unsigned char *)s->init_buf->data;

   717 	if (s->state == SSL2_ST_SEND_SERVER_HELLO_A)

   718 		{

   719 		d=p+11;

   720 		*(p++)=SSL2_MT_SERVER_HELLO;		/* type */

   721 		hit=s->hit;

   722 		*(p++)=(unsigned char)hit;

   723 #if 1

   724 		if (!hit)

   725 			{

   726 			if (s->session->sess_cert != NULL)

   727 				/* This can't really happen because get_client_hello

   728 				 * has called ssl_get_new_session, which does not set

   729 				 * sess_cert. */

   730 				ssl_sess_cert_free(s->session->sess_cert);

   731 			s->session->sess_cert = ssl_sess_cert_new();

   732 			if (s->session->sess_cert == NULL)

   733 				{

   734 				SSLerr(SSL_F_SERVER_HELLO, ERR_R_MALLOC_FAILURE);

   735 				return(-1);

   736 				}

   737 			}

   738 		/* If 'hit' is set, then s->sess_cert may be non-NULL or NULL,

   739 		 * depending on whether it survived in the internal cache

   740 		 * or was retrieved from an external cache.

   741 		 * If it is NULL, we cannot put any useful data in it anyway,

   742 		 * so we don't touch it.

   743 		 */

   744 

   745 #else /* That's what used to be done when cert_st and sess_cert_st were

   746 	   * the same. */

   747 		if (!hit)

   748 			{			/* else add cert to session */

   749 			CRYPTO_add(&s->cert->references,1,CRYPTO_LOCK_SSL_CERT);

   750 			if (s->session->sess_cert != NULL)

   751 				ssl_cert_free(s->session->sess_cert);

   752 			s->session->sess_cert=s->cert;		

   753 			}

   754 		else	/* We have a session id-cache hit, if the

   755 			 * session-id has no certificate listed against

   756 			 * the 'cert' structure, grab the 'old' one

   757 			 * listed against the SSL connection */

   758 			{

   759 			if (s->session->sess_cert == NULL)

   760 				{

   761 				CRYPTO_add(&s->cert->references,1,

   762 					CRYPTO_LOCK_SSL_CERT);

   763 				s->session->sess_cert=s->cert;

   764 				}

   765 			}

   766 #endif

   767 

   768 		if (s->cert == NULL)

   769 			{

   770 			ssl2_return_error(s,SSL2_PE_NO_CERTIFICATE);

   771 			SSLerr(SSL_F_SERVER_HELLO,SSL_R_NO_CERTIFICATE_SPECIFIED);

   772 			return(-1);

   773 			}

   774 

   775 		if (hit)

   776 			{

   777 			*(p++)=0;		/* no certificate type */

   778 			s2n(s->version,p);	/* version */

   779 			s2n(0,p);		/* cert len */

   780 			s2n(0,p);		/* ciphers len */

   781 			}

   782 		else

   783 			{

   784 			/* EAY EAY */

   785 			/* put certificate type */

   786 			*(p++)=SSL2_CT_X509_CERTIFICATE;

   787 			s2n(s->version,p);	/* version */

   788 			n=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);

   789 			s2n(n,p);		/* certificate length */

   790 			i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&d);

   791 			n=0;

   792 			

   793 			/* lets send out the ciphers we like in the

   794 			 * prefered order */

   795 			sk= s->session->ciphers;

   796 			n=ssl_cipher_list_to_bytes(s,s->session->ciphers,d,0);

   797 			d+=n;

   798 			s2n(n,p);		/* add cipher length */

   799 			}

   800 

   801 		/* make and send conn_id */

   802 		s2n(SSL2_CONNECTION_ID_LENGTH,p);	/* add conn_id length */

   803 		s->s2->conn_id_length=SSL2_CONNECTION_ID_LENGTH;

   804 		if (RAND_pseudo_bytes(s->s2->conn_id,(int)s->s2->conn_id_length) <= 0)

   805 			return -1;

   806 		memcpy(d,s->s2->conn_id,SSL2_CONNECTION_ID_LENGTH);

   807 		d+=SSL2_CONNECTION_ID_LENGTH;

   808 

   809 		s->state=SSL2_ST_SEND_SERVER_HELLO_B;

   810 		s->init_num=d-(unsigned char *)s->init_buf->data;

   811 		s->init_off=0;

   812 		}

   813 	/* SSL2_ST_SEND_SERVER_HELLO_B */

   814  	/* If we are using TCP/IP, the performance is bad if we do 2

   815  	 * writes without a read between them.  This occurs when

   816  	 * Session-id reuse is used, so I will put in a buffering module

   817  	 */

   818  	if (s->hit)

   819  		{

   820 		if (!ssl_init_wbio_buffer(s,1)) return(-1);

   821  		}

   822  

   823 	return(ssl2_do_write(s));

   824 	}

   825 

   826 static int get_client_finished(SSL *s)

   827 	{

   828 	unsigned char *p;

   829 	int i, n;

   830 	unsigned long len;

   831 

   832 	p=(unsigned char *)s->init_buf->data;

   833 	if (s->state == SSL2_ST_GET_CLIENT_FINISHED_A)

   834 		{

   835 		i=ssl2_read(s,(char *)&(p[s->init_num]),1-s->init_num);

   836 		if (i < 1-s->init_num)

   837 			return(ssl2_part_read(s,SSL_F_GET_CLIENT_FINISHED,i));

   838 		s->init_num += i;

   839 

   840 		if (*p != SSL2_MT_CLIENT_FINISHED)

   841 			{

   842 			if (*p != SSL2_MT_ERROR)

   843 				{

   844 				ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   845 				SSLerr(SSL_F_GET_CLIENT_FINISHED,SSL_R_READ_WRONG_PACKET_TYPE);

   846 				}

   847 			else

   848 				{

   849 				SSLerr(SSL_F_GET_CLIENT_FINISHED,SSL_R_PEER_ERROR);

   850 				/* try to read the error message */

   851 				i=ssl2_read(s,(char *)&(p[s->init_num]),3-s->init_num);

   852 				return ssl2_part_read(s,SSL_F_GET_SERVER_VERIFY,i);

   853 				}

   854 			return(-1);

   855 			}

   856 		s->state=SSL2_ST_GET_CLIENT_FINISHED_B;

   857 		}

   858 

   859 	/* SSL2_ST_GET_CLIENT_FINISHED_B */

   860 	if (s->s2->conn_id_length > sizeof s->s2->conn_id)

   861 		{

   862 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   863 		SSLerr(SSL_F_GET_CLIENT_FINISHED, ERR_R_INTERNAL_ERROR);

   864 		return -1;

   865 		}

   866 	len = 1 + (unsigned long)s->s2->conn_id_length;

   867 	n = (int)len - s->init_num;

   868 	i = ssl2_read(s,(char *)&(p[s->init_num]),n);

   869 	if (i < n)

   870 		{

   871 		return(ssl2_part_read(s,SSL_F_GET_CLIENT_FINISHED,i));

   872 		}

   873 	if (s->msg_callback)

   874 		s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* CLIENT-FINISHED */

   875 	p += 1;

   876 	if (memcmp(p,s->s2->conn_id,s->s2->conn_id_length) != 0)

   877 		{

   878 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

   879 		SSLerr(SSL_F_GET_CLIENT_FINISHED,SSL_R_CONNECTION_ID_IS_DIFFERENT);

   880 		return(-1);

   881 		}

   882 	return(1);

   883 	}

   884 

   885 static int server_verify(SSL *s)

   886 	{

   887 	unsigned char *p;

   888 

   889 	if (s->state == SSL2_ST_SEND_SERVER_VERIFY_A)

   890 		{

   891 		p=(unsigned char *)s->init_buf->data;

   892 		*(p++)=SSL2_MT_SERVER_VERIFY;

   893 		if (s->s2->challenge_length > sizeof s->s2->challenge)

   894 			{

   895 			SSLerr(SSL_F_SERVER_VERIFY, ERR_R_INTERNAL_ERROR);

   896 			return -1;

   897 			}

   898 		memcpy(p,s->s2->challenge,(unsigned int)s->s2->challenge_length);

   899 		/* p+=s->s2->challenge_length; */

   900 

   901 		s->state=SSL2_ST_SEND_SERVER_VERIFY_B;

   902 		s->init_num=s->s2->challenge_length+1;

   903 		s->init_off=0;

   904 		}

   905 	return(ssl2_do_write(s));

   906 	}

   907 

   908 static int server_finish(SSL *s)

   909 	{

   910 	unsigned char *p;

   911 

   912 	if (s->state == SSL2_ST_SEND_SERVER_FINISHED_A)

   913 		{

   914 		p=(unsigned char *)s->init_buf->data;

   915 		*(p++)=SSL2_MT_SERVER_FINISHED;

   916 

   917 		if (s->session->session_id_length > sizeof s->session->session_id)

   918 			{

   919 			SSLerr(SSL_F_SERVER_FINISH, ERR_R_INTERNAL_ERROR);

   920 			return -1;

   921 			}

   922 		memcpy(p,s->session->session_id, (unsigned int)s->session->session_id_length);

   923 		/* p+=s->session->session_id_length; */

   924 

   925 		s->state=SSL2_ST_SEND_SERVER_FINISHED_B;

   926 		s->init_num=s->session->session_id_length+1;

   927 		s->init_off=0;

   928 		}

   929 

   930 	/* SSL2_ST_SEND_SERVER_FINISHED_B */

   931 	return(ssl2_do_write(s));

   932 	}

   933 

   934 /* send the request and check the response */

   935 static int request_certificate(SSL *s)

   936 	{

   937 	const unsigned char *cp;

   938 	unsigned char *p,*p2,*buf2;

   939 	unsigned char *ccd;

   940 	int i,j,ctype,ret= -1;

   941 	unsigned long len;

   942 	X509 *x509=NULL;

   943 	STACK_OF(X509) *sk=NULL;

   944 

   945 	ccd=s->s2->tmp.ccl;

   946 	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A)

   947 		{

   948 		p=(unsigned char *)s->init_buf->data;

   949 		*(p++)=SSL2_MT_REQUEST_CERTIFICATE;

   950 		*(p++)=SSL2_AT_MD5_WITH_RSA_ENCRYPTION;

   951 		if (RAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH) <= 0)

   952 			return -1;

   953 		memcpy(p,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);

   954 

   955 		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_B;

   956 		s->init_num=SSL2_MIN_CERT_CHALLENGE_LENGTH+2;

   957 		s->init_off=0;

   958 		}

   959 

   960 	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B)

   961 		{

   962 		i=ssl2_do_write(s);

   963 		if (i <= 0)

   964 			{

   965 			ret=i;

   966 			goto end;

   967 			}

   968 

   969 		s->init_num=0;

   970 		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_C;

   971 		}

   972 

   973 	if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C)

   974 		{

   975 		p=(unsigned char *)s->init_buf->data;

   976 		i=ssl2_read(s,(char *)&(p[s->init_num]),6-s->init_num); /* try to read 6 octets ... */

   977 		if (i < 3-s->init_num) /* ... but don't call ssl2_part_read now if we got at least 3

   978 		                        * (probably NO-CERTIFICATE-ERROR) */

   979 			{

   980 			ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);

   981 			goto end;

   982 			}

   983 		s->init_num += i;

   984 

   985 		if ((s->init_num >= 3) && (p[0] == SSL2_MT_ERROR))

   986 			{

   987 			n2s(p,i);

   988 			if (i != SSL2_PE_NO_CERTIFICATE)

   989 				{

   990 				/* not the error message we expected -- let ssl2_part_read handle it */

   991 				s->init_num -= 3;

   992 				ret = ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE, 3);

   993 				goto end;

   994 				}

   995 

   996 			if (s->msg_callback)

   997 				s->msg_callback(0, s->version, 0, p, 3, s, s->msg_callback_arg); /* ERROR */

   998 

   999 			/* this is the one place where we can recover from an SSL 2.0 error */

  1000 

  1001 			if (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)

  1002 				{

  1003 				ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);

  1004 				SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);

  1005 				goto end;

  1006 				}

  1007 			ret=1;

  1008 			goto end;

  1009 			}

  1010 		if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (s->init_num < 6))

  1011 			{

  1012 			ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);

  1013 			SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_SHORT_READ);

  1014 			goto end;

  1015 			}

  1016 		if (s->init_num != 6)

  1017 			{

  1018 			SSLerr(SSL_F_REQUEST_CERTIFICATE, ERR_R_INTERNAL_ERROR);

  1019 			goto end;

  1020 			}

  1021 		

  1022 		/* ok we have a response */

  1023 		/* certificate type, there is only one right now. */

  1024 		ctype= *(p++);

  1025 		if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION)

  1026 			{

  1027 			ssl2_return_error(s,SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);

  1028 			SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_RESPONSE_ARGUMENT);

  1029 			goto end;

  1030 			}

  1031 		n2s(p,i); s->s2->tmp.clen=i;

  1032 		n2s(p,i); s->s2->tmp.rlen=i;

  1033 		s->state=SSL2_ST_SEND_REQUEST_CERTIFICATE_D;

  1034 		}

  1035 

  1036 	/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */

  1037 	p=(unsigned char *)s->init_buf->data;

  1038 	len = 6 + (unsigned long)s->s2->tmp.clen + (unsigned long)s->s2->tmp.rlen;

  1039 	if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)

  1040 		{

  1041 		SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_MESSAGE_TOO_LONG);

  1042 		goto end;

  1043 		}

  1044 	j = (int)len - s->init_num;

  1045 	i = ssl2_read(s,(char *)&(p[s->init_num]),j);

  1046 	if (i < j) 

  1047 		{

  1048 		ret=ssl2_part_read(s,SSL_F_REQUEST_CERTIFICATE,i);

  1049 		goto end;

  1050 		}

  1051 	if (s->msg_callback)

  1052 		s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* CLIENT-CERTIFICATE */

  1053 	p += 6;

  1054 

  1055 	cp = p;

  1056 	x509=(X509 *)d2i_X509(NULL,&cp,(long)s->s2->tmp.clen);

  1057 	if (x509 == NULL)

  1058 		{

  1059 		SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_X509_LIB);

  1060 		goto msg_end;

  1061 		}

  1062 

  1063 	if (((sk=sk_X509_new_null()) == NULL) || (!sk_X509_push(sk,x509)))

  1064 		{

  1065 		SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);

  1066 		goto msg_end;

  1067 		}

  1068 

  1069 	i=ssl_verify_cert_chain(s,sk);

  1070 

  1071 	if (i)	/* we like the packet, now check the chksum */

  1072 		{

  1073 		EVP_MD_CTX ctx;

  1074 		EVP_PKEY *pkey=NULL;

  1075 

  1076 		EVP_MD_CTX_init(&ctx);

  1077 		EVP_VerifyInit_ex(&ctx,s->ctx->rsa_md5, NULL);

  1078 		EVP_VerifyUpdate(&ctx,s->s2->key_material,

  1079 				 s->s2->key_material_length);

  1080 		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);

  1081 

  1082 		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);

  1083 		buf2=OPENSSL_malloc((unsigned int)i);

  1084 		if (buf2 == NULL)

  1085 			{

  1086 			SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_MALLOC_FAILURE);

  1087 			goto msg_end;

  1088 			}

  1089 		p2=buf2;

  1090 		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);

  1091 		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);

  1092 		OPENSSL_free(buf2);

  1093 

  1094 		pkey=X509_get_pubkey(x509);

  1095 		if (pkey == NULL) goto end;

  1096 		i=EVP_VerifyFinal(&ctx,cp,s->s2->tmp.rlen,pkey);

  1097 		EVP_PKEY_free(pkey);

  1098 		EVP_MD_CTX_cleanup(&ctx);

  1099 

  1100 		if (i) 

  1101 			{

  1102 			if (s->session->peer != NULL)

  1103 				X509_free(s->session->peer);

  1104 			s->session->peer=x509;

  1105 			CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);

  1106 			s->session->verify_result = s->verify_result;

  1107 			ret=1;

  1108 			goto end;

  1109 			}

  1110 		else

  1111 			{

  1112 			SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_BAD_CHECKSUM);

  1113 			goto msg_end;

  1114 			}

  1115 		}

  1116 	else

  1117 		{

  1118 msg_end:

  1119 		ssl2_return_error(s,SSL2_PE_BAD_CERTIFICATE);

  1120 		}

  1121 end:

  1122 	sk_X509_free(sk);

  1123 	X509_free(x509);

  1124 	return(ret);

  1125 	}

  1126 

  1127 static int ssl_rsa_private_decrypt(CERT *c, int len, unsigned char *from,

  1128 	     unsigned char *to, int padding)

  1129 	{

  1130 	RSA *rsa;

  1131 	int i;

  1132 

  1133 	if ((c == NULL) || (c->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL))

  1134 		{

  1135 		SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT,SSL_R_NO_PRIVATEKEY);