Bug#13706621 : UNIFY THE YASSL VERSIONS THAT WE USE BY BACKPORTING 5.1
AND 5.5 YASSL FIXES. Took the 5.5 yassl code and applied it to the 5.0 codebase, keeping the compilation files.
This commit is contained in:
parent
12376c17b3
commit
a25adb1cc8
@ -1,5 +1,6 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005-2007 MySQL AB, 2008 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -34,6 +35,7 @@
|
||||
#include "yassl_types.hpp" // SignatureAlgorithm
|
||||
#include "buffer.hpp" // input_buffer
|
||||
#include "asn.hpp" // SignerList
|
||||
#include "openssl/ssl.h" // internal and external use
|
||||
#include STL_LIST_FILE
|
||||
#include STL_ALGORITHM_FILE
|
||||
|
||||
@ -87,6 +89,7 @@ class CertManager {
|
||||
bool verifyNone_; // no error if verify fails
|
||||
bool failNoCert_;
|
||||
bool sendVerify_;
|
||||
VerifyCallback verifyCallback_; // user verify callback
|
||||
public:
|
||||
CertManager();
|
||||
~CertManager();
|
||||
@ -118,6 +121,7 @@ public:
|
||||
void setFailNoCert();
|
||||
void setSendVerify();
|
||||
void setPeerX509(X509*);
|
||||
void setVerifyCallback(VerifyCallback);
|
||||
private:
|
||||
CertManager(const CertManager&); // hide copy
|
||||
CertManager& operator=(const CertManager&); // and assign
|
||||
|
@ -1,5 +1,6 @@
|
||||
/*
|
||||
Copyright (C) 2006, 2007 MySQL AB
|
||||
Copyright (c) 2006, 2007 MySQL AB, 2008 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -70,6 +71,7 @@
|
||||
#define SSL_load_error_strings yaSSL_load_error_strings
|
||||
#define SSL_set_session yaSSL_set_session
|
||||
#define SSL_get_session yaSSL_get_session
|
||||
#define SSL_flush_sessions yaSSL_flush_sessions
|
||||
#define SSL_SESSION_set_timeout yaSSL_SESSION_set_timeout
|
||||
#define SSL_CTX_set_session_cache_mode yaSSL_CTX_set_session_cache_mode
|
||||
#define SSL_get_peer_certificate yaSSL_get_peer_certificate
|
||||
|
@ -1,5 +1,6 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005-2007 MySQL AB, 2008 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -170,8 +171,9 @@ enum { /* X509 Constants */
|
||||
X509_V_ERR_CRL_SIGNATURE_FAILURE = 10,
|
||||
X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD = 11,
|
||||
X509_V_ERR_CRL_HAS_EXPIRED = 12,
|
||||
X509_V_ERR_CERT_REVOKED = 13
|
||||
|
||||
X509_V_ERR_CERT_REVOKED = 13,
|
||||
X509_V_FLAG_CRL_CHECK = 14,
|
||||
X509_V_FLAG_CRL_CHECK_ALL = 15
|
||||
};
|
||||
|
||||
|
||||
@ -202,7 +204,8 @@ SSL_CTX* SSL_CTX_new(SSL_METHOD*);
|
||||
SSL* SSL_new(SSL_CTX*);
|
||||
int SSL_set_fd (SSL*, YASSL_SOCKET_T);
|
||||
YASSL_SOCKET_T SSL_get_fd(const SSL*);
|
||||
int SSL_connect(SSL*);
|
||||
int SSL_connect(SSL*); /* if you get an error from connect
|
||||
see note at top of REAMDE */
|
||||
int SSL_write(SSL*, const void*, int);
|
||||
int SSL_read(SSL*, void*, int);
|
||||
int SSL_accept(SSL*);
|
||||
@ -227,6 +230,7 @@ void SSL_load_error_strings(void);
|
||||
|
||||
int SSL_set_session(SSL *ssl, SSL_SESSION *session);
|
||||
SSL_SESSION* SSL_get_session(SSL* ssl);
|
||||
void SSL_flush_sessions(SSL_CTX *ctx, long tm);
|
||||
long SSL_SESSION_set_timeout(SSL_SESSION*, long);
|
||||
long SSL_CTX_set_session_cache_mode(SSL_CTX* ctx, long mode);
|
||||
X509* SSL_get_peer_certificate(SSL*);
|
||||
|
@ -1,5 +1,6 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005-2007 MySQL AB, 2010 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -64,7 +65,7 @@ enum YasslError {
|
||||
enum Library { yaSSL_Lib = 0, CryptoLib, SocketLib };
|
||||
enum { MAX_ERROR_SZ = 80 };
|
||||
|
||||
void SetErrorString(YasslError, char*);
|
||||
void SetErrorString(unsigned long, char*);
|
||||
|
||||
/* remove for now, if go back to exceptions use this wrapper
|
||||
// Base class for all yaSSL exceptions
|
||||
|
@ -1,5 +1,6 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005-2007 MySQL AB, 2008 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -667,10 +668,12 @@ struct Parameters {
|
||||
Cipher suites_[MAX_SUITE_SZ];
|
||||
char cipher_name_[MAX_SUITE_NAME];
|
||||
char cipher_list_[MAX_CIPHERS][MAX_SUITE_NAME];
|
||||
bool removeDH_; // for server's later use
|
||||
|
||||
Parameters(ConnectionEnd, const Ciphers&, ProtocolVersion, bool haveDH);
|
||||
|
||||
void SetSuites(ProtocolVersion pv, bool removeDH = false);
|
||||
void SetSuites(ProtocolVersion pv, bool removeDH = false,
|
||||
bool removeRSA = false, bool removeDSA = false);
|
||||
void SetCipherNames();
|
||||
private:
|
||||
Parameters(const Parameters&); // hide copy
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -34,9 +34,8 @@
|
||||
#include "openssl/ssl.h" // ASN1_STRING and DH
|
||||
|
||||
// Check if _POSIX_THREADS should be forced
|
||||
#if !defined(_POSIX_THREADS) && (defined(__NETWARE__) || defined(__hpux))
|
||||
#if !defined(_POSIX_THREADS) && defined(__hpux)
|
||||
// HPUX does not define _POSIX_THREADS as it's not _fully_ implemented
|
||||
// Netware supports pthreads but does not announce it
|
||||
#define _POSIX_THREADS
|
||||
#endif
|
||||
|
||||
@ -268,12 +267,14 @@ class Sessions {
|
||||
STL::list<SSL_SESSION*> list_;
|
||||
RandomPool random_; // for session cleaning
|
||||
Mutex mutex_; // no-op for single threaded
|
||||
int count_; // flush counter
|
||||
|
||||
Sessions() {} // only GetSessions can create
|
||||
Sessions() : count_(0) {} // only GetSessions can create
|
||||
public:
|
||||
SSL_SESSION* lookup(const opaque*, SSL_SESSION* copy = 0);
|
||||
void add(const SSL&);
|
||||
void remove(const opaque*);
|
||||
void Flush();
|
||||
|
||||
~Sessions();
|
||||
|
||||
@ -425,8 +426,10 @@ private:
|
||||
pem_password_cb passwordCb_;
|
||||
void* userData_;
|
||||
bool sessionCacheOff_;
|
||||
bool sessionCacheFlushOff_;
|
||||
Stats stats_;
|
||||
Mutex mutex_; // for Stats
|
||||
VerifyCallback verifyCallback_;
|
||||
public:
|
||||
explicit SSL_CTX(SSL_METHOD* meth);
|
||||
~SSL_CTX();
|
||||
@ -437,18 +440,22 @@ public:
|
||||
const Ciphers& GetCiphers() const;
|
||||
const DH_Parms& GetDH_Parms() const;
|
||||
const Stats& GetStats() const;
|
||||
VerifyCallback getVerifyCallback() const;
|
||||
pem_password_cb GetPasswordCb() const;
|
||||
void* GetUserData() const;
|
||||
bool GetSessionCacheOff() const;
|
||||
bool GetSessionCacheFlushOff() const;
|
||||
|
||||
void setVerifyPeer();
|
||||
void setVerifyNone();
|
||||
void setFailNoCert();
|
||||
void setVerifyCallback(VerifyCallback);
|
||||
bool SetCipherList(const char*);
|
||||
bool SetDH(const DH&);
|
||||
void SetPasswordCb(pem_password_cb cb);
|
||||
void SetUserData(void*);
|
||||
void SetSessionCacheOff();
|
||||
void SetSessionCacheFlushOff();
|
||||
|
||||
void IncrementStats(StatsField);
|
||||
void AddCA(x509* ca);
|
||||
|
@ -1,5 +1,6 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005-2007 MySQL AB, 2008 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -29,6 +30,13 @@
|
||||
#include "type_traits.hpp"
|
||||
|
||||
|
||||
#ifdef _MSC_VER
|
||||
// disable conversion warning
|
||||
// 4996 warning to use MS extensions e.g., strcpy_s instead of strncpy
|
||||
#pragma warning(disable:4244 4996)
|
||||
#endif
|
||||
|
||||
|
||||
namespace yaSSL {
|
||||
|
||||
#define YASSL_LIB
|
||||
@ -163,7 +171,7 @@ const int RMD_LEN = 20; // RIPEMD-160 digest length
|
||||
const int PREFIX = 3; // up to 3 prefix letters for secret rounds
|
||||
const int KEY_PREFIX = 7; // up to 7 prefix letters for key rounds
|
||||
const int FORTEZZA_MAX = 128; // Maximum Fortezza Key length
|
||||
const int MAX_SUITE_SZ = 64; // 32 max suites * sizeof(suite)
|
||||
const int MAX_SUITE_SZ = 128; // 64 max suites * sizeof(suite)
|
||||
const int MAX_SUITE_NAME = 48; // max length of suite name
|
||||
const int MAX_CIPHERS = 32; // max supported ciphers for cipher list
|
||||
const int SIZEOF_ENUM = 1; // SSL considers an enum 1 byte, not 4
|
||||
@ -205,6 +213,7 @@ const int SEED_LEN = RAN_LEN * 2; // TLS seed, client + server random
|
||||
const int DEFAULT_TIMEOUT = 500; // Default Session timeout in seconds
|
||||
const int MAX_RECORD_SIZE = 16384; // 2^14, max size by standard
|
||||
const int COMPRESS_EXTRA = 1024; // extra compression possible addition
|
||||
const int SESSION_FLUSH_COUNT = 256; // when to flush session cache
|
||||
|
||||
|
||||
typedef uint8 Cipher; // first byte is always 0x00 for SSLv3 & TLS
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (c) 2005-2007 MySQL AB, 2009 Sun Microsystems, Inc.
|
||||
Copyright (c) 2005-2007 MySQL AB, 2008, 2009 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
@ -25,6 +25,7 @@
|
||||
#include "runtime.hpp"
|
||||
#include "cert_wrapper.hpp"
|
||||
#include "yassl_int.hpp"
|
||||
#include "error.hpp"
|
||||
|
||||
#if defined(USE_CML_LIB)
|
||||
#include "cmapi_cpp.h"
|
||||
@ -91,7 +92,7 @@ opaque* x509::use_buffer()
|
||||
//CertManager
|
||||
CertManager::CertManager()
|
||||
: peerX509_(0), verifyPeer_(false), verifyNone_(false), failNoCert_(false),
|
||||
sendVerify_(false)
|
||||
sendVerify_(false), verifyCallback_(0)
|
||||
{}
|
||||
|
||||
|
||||
@ -155,6 +156,12 @@ void CertManager::setSendVerify()
|
||||
}
|
||||
|
||||
|
||||
void CertManager::setVerifyCallback(VerifyCallback vc)
|
||||
{
|
||||
verifyCallback_ = vc;
|
||||
}
|
||||
|
||||
|
||||
void CertManager::AddPeerCert(x509* x)
|
||||
{
|
||||
peerList_.push_back(x); // take ownership
|
||||
@ -237,7 +244,7 @@ uint CertManager::get_privateKeyLength() const
|
||||
int CertManager::Validate()
|
||||
{
|
||||
CertList::reverse_iterator last = peerList_.rbegin();
|
||||
size_t count= peerList_.size();
|
||||
size_t count = peerList_.size();
|
||||
|
||||
while ( count > 1 ) {
|
||||
TaoCrypt::Source source((*last)->get_buffer(), (*last)->get_length());
|
||||
@ -258,7 +265,8 @@ int CertManager::Validate()
|
||||
TaoCrypt::Source source((*last)->get_buffer(), (*last)->get_length());
|
||||
TaoCrypt::CertDecoder cert(source, true, &signers_, verifyNone_);
|
||||
|
||||
if (int err = cert.GetError().What())
|
||||
int err = cert.GetError().What();
|
||||
if ( err )
|
||||
return err;
|
||||
|
||||
uint sz = cert.GetPublicKey().size();
|
||||
@ -270,13 +278,25 @@ int CertManager::Validate()
|
||||
else
|
||||
peerKeyType_ = dsa_sa_algo;
|
||||
|
||||
size_t iSz= strlen(cert.GetIssuer()) + 1;
|
||||
size_t sSz= strlen(cert.GetCommonName()) + 1;
|
||||
size_t bSz= strlen(cert.GetBeforeDate()) + 1;
|
||||
size_t aSz= strlen(cert.GetAfterDate()) + 1;
|
||||
size_t iSz = strlen(cert.GetIssuer()) + 1;
|
||||
size_t sSz = strlen(cert.GetCommonName()) + 1;
|
||||
int bSz = (int)strlen(cert.GetBeforeDate()) + 1;
|
||||
int aSz = (int)strlen(cert.GetAfterDate()) + 1;
|
||||
peerX509_ = NEW_YS X509(cert.GetIssuer(), iSz, cert.GetCommonName(),
|
||||
sSz, cert.GetBeforeDate(), (int) bSz,
|
||||
cert.GetAfterDate(), (int) aSz);
|
||||
sSz, cert.GetBeforeDate(), bSz,
|
||||
cert.GetAfterDate(), aSz);
|
||||
|
||||
if (err == TaoCrypt::SIG_OTHER_E && verifyCallback_) {
|
||||
X509_STORE_CTX store;
|
||||
store.error = err;
|
||||
store.error_depth = static_cast<int>(count) - 1;
|
||||
store.current_cert = peerX509_;
|
||||
|
||||
int ok = verifyCallback_(0, &store);
|
||||
if (ok) return 0;
|
||||
}
|
||||
|
||||
if (err == TaoCrypt::SIG_OTHER_E) return err;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -953,8 +953,9 @@ x509* PemToDer(FILE* file, CertType type, EncryptedInfo* info)
|
||||
info->set = true;
|
||||
}
|
||||
}
|
||||
fgets(line,sizeof(line), file); // get blank line
|
||||
begin = ftell(file);
|
||||
// get blank line
|
||||
if (fgets(line, sizeof(line), file))
|
||||
begin = ftell(file);
|
||||
}
|
||||
|
||||
}
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -37,7 +37,7 @@
|
||||
#include <fcntl.h>
|
||||
#endif // _WIN32
|
||||
|
||||
#if defined(__sun) || defined(__SCO_VERSION__) || defined(__NETWARE__)
|
||||
#if defined(__sun) || defined(__SCO_VERSION__)
|
||||
#include <sys/filio.h>
|
||||
#endif
|
||||
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (c) 2005-2007 MySQL AB, 2009 Sun Microsystems, Inc.
|
||||
Copyright (c) 2005-2007 MySQL AB, 2008-2010 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
@ -246,6 +246,7 @@ YASSL_SOCKET_T SSL_get_fd(const SSL* ssl)
|
||||
}
|
||||
|
||||
|
||||
// if you get an error from connect see note at top of README
|
||||
int SSL_connect(SSL* ssl)
|
||||
{
|
||||
if (ssl->GetError() == YasslError(SSL_ERROR_WANT_READ))
|
||||
@ -448,6 +449,9 @@ long SSL_CTX_set_session_cache_mode(SSL_CTX* ctx, long mode)
|
||||
if (mode == SSL_SESS_CACHE_OFF)
|
||||
ctx->SetSessionCacheOff();
|
||||
|
||||
if (mode == SSL_SESS_CACHE_NO_AUTO_CLEAR)
|
||||
ctx->SetSessionCacheFlushOff();
|
||||
|
||||
return SSL_SUCCESS;
|
||||
}
|
||||
|
||||
@ -494,6 +498,15 @@ long SSL_get_default_timeout(SSL* /*ssl*/)
|
||||
}
|
||||
|
||||
|
||||
void SSL_flush_sessions(SSL_CTX *ctx, long /* tm */)
|
||||
{
|
||||
if (ctx->GetSessionCacheOff())
|
||||
return;
|
||||
|
||||
GetSessions().Flush();
|
||||
}
|
||||
|
||||
|
||||
const char* SSL_get_cipher_name(SSL* ssl)
|
||||
{
|
||||
return SSL_get_cipher(ssl);
|
||||
@ -561,7 +574,7 @@ int SSL_get_error(SSL* ssl, int /*previous*/)
|
||||
only need to turn on for client, becuase server on by default if built in
|
||||
but calling for server will tell you whether it's available or not
|
||||
*/
|
||||
int SSL_set_compression(SSL* ssl)
|
||||
int SSL_set_compression(SSL* ssl) /* Chad didn't rename to ya~ because it is prob. bug. */
|
||||
{
|
||||
return ssl->SetCompression();
|
||||
}
|
||||
@ -605,13 +618,13 @@ char* X509_NAME_oneline(X509_NAME* name, char* buffer, int sz)
|
||||
{
|
||||
if (!name->GetName()) return buffer;
|
||||
|
||||
size_t len= strlen(name->GetName()) + 1;
|
||||
int copySz = min((int) len, sz);
|
||||
int len = (int)strlen(name->GetName()) + 1;
|
||||
int copySz = min(len, sz);
|
||||
|
||||
if (!buffer) {
|
||||
buffer = (char*)malloc(len);
|
||||
if (!buffer) return buffer;
|
||||
copySz = (int) len;
|
||||
copySz = len;
|
||||
}
|
||||
|
||||
if (copySz == 0)
|
||||
@ -694,7 +707,7 @@ int SSL_CTX_use_PrivateKey_file(SSL_CTX* ctx, const char* file, int format)
|
||||
}
|
||||
|
||||
|
||||
void SSL_CTX_set_verify(SSL_CTX* ctx, int mode, VerifyCallback /*vc*/)
|
||||
void SSL_CTX_set_verify(SSL_CTX* ctx, int mode, VerifyCallback vc)
|
||||
{
|
||||
if (mode & SSL_VERIFY_PEER)
|
||||
ctx->setVerifyPeer();
|
||||
@ -704,6 +717,8 @@ void SSL_CTX_set_verify(SSL_CTX* ctx, int mode, VerifyCallback /*vc*/)
|
||||
|
||||
if (mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
|
||||
ctx->setFailNoCert();
|
||||
|
||||
ctx->setVerifyCallback(vc);
|
||||
}
|
||||
|
||||
|
||||
@ -977,7 +992,7 @@ char* ERR_error_string(unsigned long errNumber, char* buffer)
|
||||
static char* msg = (char*)"Please supply a buffer for error string";
|
||||
|
||||
if (buffer) {
|
||||
SetErrorString(YasslError(errNumber), buffer);
|
||||
SetErrorString(errNumber, buffer);
|
||||
return buffer;
|
||||
}
|
||||
|
||||
@ -1451,6 +1466,8 @@ unsigned long err_helper(bool peek = false)
|
||||
default :
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 0; // shut up compiler
|
||||
}
|
||||
|
||||
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -26,6 +26,11 @@
|
||||
#include "openssl/ssl.h" // SSL_ERROR_WANT_READ
|
||||
#include <string.h> // strncpy
|
||||
|
||||
#ifdef _MSC_VER
|
||||
// 4996 warning to use MS extensions e.g., strcpy_s instead of strncpy
|
||||
#pragma warning(disable: 4996)
|
||||
#endif
|
||||
|
||||
namespace yaSSL {
|
||||
|
||||
|
||||
@ -50,7 +55,7 @@ Library Error::get_lib() const
|
||||
*/
|
||||
|
||||
|
||||
void SetErrorString(YasslError error, char* buffer)
|
||||
void SetErrorString(unsigned long error, char* buffer)
|
||||
{
|
||||
using namespace TaoCrypt;
|
||||
const int max = MAX_ERROR_SZ; // shorthand
|
||||
@ -123,7 +128,7 @@ void SetErrorString(YasslError error, char* buffer)
|
||||
break;
|
||||
|
||||
case badVersion_error :
|
||||
strncpy(buffer, "protocl version mismatch", max);
|
||||
strncpy(buffer, "protocol version mismatch", max);
|
||||
break;
|
||||
|
||||
case compress_error :
|
||||
|
@ -1,6 +1,5 @@
|
||||
/*
|
||||
Copyright (c) 2005-2008 MySQL AB, 2009 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -137,9 +136,19 @@ void DH_Server::build(SSL& ssl)
|
||||
const CertManager& cert = ssl.getCrypto().get_certManager();
|
||||
|
||||
if (ssl.getSecurity().get_parms().sig_algo_ == rsa_sa_algo)
|
||||
{
|
||||
if (cert.get_keyType() != rsa_sa_algo) {
|
||||
ssl.SetError(privateKey_error);
|
||||
return;
|
||||
}
|
||||
auth.reset(NEW_YS RSA(cert.get_privateKey(),
|
||||
cert.get_privateKeyLength(), false));
|
||||
}
|
||||
else {
|
||||
if (cert.get_keyType() != dsa_sa_algo) {
|
||||
ssl.SetError(privateKey_error);
|
||||
return;
|
||||
}
|
||||
auth.reset(NEW_YS DSS(cert.get_privateKey(),
|
||||
cert.get_privateKeyLength(), false));
|
||||
sigSz += DSS_ENCODED_EXTRA;
|
||||
@ -437,18 +446,21 @@ Parameters::Parameters(ConnectionEnd ce, const Ciphers& ciphers,
|
||||
pending_ = true; // suite not set yet
|
||||
strncpy(cipher_name_, "NONE", 5);
|
||||
|
||||
removeDH_ = !haveDH; // only use on server side for set suites
|
||||
|
||||
if (ciphers.setSuites_) { // use user set list
|
||||
suites_size_ = ciphers.suiteSz_;
|
||||
memcpy(suites_, ciphers.suites_, ciphers.suiteSz_);
|
||||
SetCipherNames();
|
||||
}
|
||||
else
|
||||
SetSuites(pv, ce == server_end && !haveDH); // defaults
|
||||
SetSuites(pv, ce == server_end && removeDH_); // defaults
|
||||
|
||||
}
|
||||
|
||||
|
||||
void Parameters::SetSuites(ProtocolVersion pv, bool removeDH)
|
||||
void Parameters::SetSuites(ProtocolVersion pv, bool removeDH, bool removeRSA,
|
||||
bool removeDSA)
|
||||
{
|
||||
int i = 0;
|
||||
// available suites, best first
|
||||
@ -457,67 +469,87 @@ void Parameters::SetSuites(ProtocolVersion pv, bool removeDH)
|
||||
|
||||
if (isTLS(pv)) {
|
||||
if (!removeDH) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
|
||||
}
|
||||
if (!removeDSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
|
||||
}
|
||||
}
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_256_CBC_SHA;
|
||||
|
||||
if (!removeDH) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_128_CBC_SHA;
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_256_CBC_SHA;
|
||||
}
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_128_CBC_SHA;
|
||||
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_256_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_128_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_3DES_EDE_CBC_RMD160;
|
||||
|
||||
if (!removeDH) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_256_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_128_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD160;
|
||||
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_256_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_128_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD160;
|
||||
}
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
|
||||
}
|
||||
if (!removeDSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_128_CBC_SHA;
|
||||
}
|
||||
}
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_128_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_256_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_AES_128_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_RSA_WITH_3DES_EDE_CBC_RMD160;
|
||||
}
|
||||
if (!removeDH) {
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_256_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_AES_128_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD160;
|
||||
}
|
||||
if (!removeDSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_256_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_AES_128_CBC_RMD160;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD160;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_RC4_128_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_RC4_128_MD5;
|
||||
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_3DES_EDE_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_DES_CBC_SHA;
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_RC4_128_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_RC4_128_MD5;
|
||||
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_3DES_EDE_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_RSA_WITH_DES_CBC_SHA;
|
||||
}
|
||||
if (!removeDH) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
|
||||
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_RSA_WITH_DES_CBC_SHA;
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_DSS_WITH_DES_CBC_SHA;
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA;
|
||||
}
|
||||
if (!removeDSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
|
||||
}
|
||||
if (!removeRSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_RSA_WITH_DES_CBC_SHA;
|
||||
}
|
||||
if (!removeDSA) {
|
||||
suites_[i++] = 0x00;
|
||||
suites_[i++] = SSL_DHE_DSS_WITH_DES_CBC_SHA;
|
||||
}
|
||||
}
|
||||
|
||||
suites_size_ = i;
|
||||
@ -852,21 +884,19 @@ void Alert::Process(input_buffer& input, SSL& ssl)
|
||||
else
|
||||
hmac(ssl, verify, data, aSz, alert, true);
|
||||
|
||||
// read mac and fill
|
||||
// read mac and skip fill
|
||||
int digestSz = ssl.getCrypto().get_digest().get_digestSize();
|
||||
opaque mac[SHA_LEN];
|
||||
input.read(mac, digestSz);
|
||||
|
||||
if (ssl.getSecurity().get_parms().cipher_type_ == block) {
|
||||
int ivExtra = 0;
|
||||
opaque fill;
|
||||
|
||||
if (ssl.isTLSv1_1())
|
||||
ivExtra = ssl.getCrypto().get_cipher().get_blockSize();
|
||||
int padSz = ssl.getSecurity().get_parms().encrypt_size_ - ivExtra -
|
||||
aSz - digestSz;
|
||||
for (int i = 0; i < padSz; i++)
|
||||
fill = input[AUTO];
|
||||
input.set_current(input.get_current() + padSz);
|
||||
}
|
||||
|
||||
// verify
|
||||
@ -949,17 +979,17 @@ output_buffer& operator<<(output_buffer& output, const Data& data)
|
||||
void Data::Process(input_buffer& input, SSL& ssl)
|
||||
{
|
||||
int msgSz = ssl.getSecurity().get_parms().encrypt_size_;
|
||||
int pad = 0, padByte = 0;
|
||||
int pad = 0, padSz = 0;
|
||||
int ivExtra = 0;
|
||||
|
||||
if (ssl.getSecurity().get_parms().cipher_type_ == block) {
|
||||
if (ssl.isTLSv1_1()) // IV
|
||||
ivExtra = ssl.getCrypto().get_cipher().get_blockSize();
|
||||
pad = *(input.get_buffer() + input.get_current() + msgSz -ivExtra - 1);
|
||||
padByte = 1;
|
||||
padSz = 1;
|
||||
}
|
||||
int digestSz = ssl.getCrypto().get_digest().get_digestSize();
|
||||
int dataSz = msgSz - ivExtra - digestSz - pad - padByte;
|
||||
int dataSz = msgSz - ivExtra - digestSz - pad - padSz;
|
||||
opaque verify[SHA_LEN];
|
||||
|
||||
const byte* rawData = input.get_buffer() + input.get_current();
|
||||
@ -988,14 +1018,10 @@ void Data::Process(input_buffer& input, SSL& ssl)
|
||||
hmac(ssl, verify, rawData, dataSz, application_data, true);
|
||||
}
|
||||
|
||||
// read mac and fill
|
||||
// read mac and skip fill
|
||||
opaque mac[SHA_LEN];
|
||||
opaque fill;
|
||||
input.read(mac, digestSz);
|
||||
for (int i = 0; i < pad; i++)
|
||||
fill = input[AUTO];
|
||||
if (padByte)
|
||||
fill = input[AUTO];
|
||||
input.set_current(input.get_current() + pad + padSz);
|
||||
|
||||
// verify
|
||||
if (dataSz) {
|
||||
@ -1472,7 +1498,19 @@ void ClientHello::Process(input_buffer&, SSL& ssl)
|
||||
// downgrade to SSLv3
|
||||
ssl.useSecurity().use_connection().TurnOffTLS();
|
||||
ProtocolVersion pv = ssl.getSecurity().get_connection().version_;
|
||||
ssl.useSecurity().use_parms().SetSuites(pv); // reset w/ SSL suites
|
||||
bool removeDH = ssl.getSecurity().get_parms().removeDH_;
|
||||
bool removeRSA = false;
|
||||
bool removeDSA = false;
|
||||
|
||||
const CertManager& cm = ssl.getCrypto().get_certManager();
|
||||
if (cm.get_keyType() == rsa_sa_algo)
|
||||
removeDSA = true;
|
||||
else
|
||||
removeRSA = true;
|
||||
|
||||
// reset w/ SSL suites
|
||||
ssl.useSecurity().use_parms().SetSuites(pv, removeDH, removeRSA,
|
||||
removeDSA);
|
||||
}
|
||||
else if (ssl.isTLSv1_1() && client_version_.minor_ == 1)
|
||||
// downgrade to TLSv1, but use same suites
|
||||
@ -1518,6 +1556,7 @@ void ClientHello::Process(input_buffer&, SSL& ssl)
|
||||
return;
|
||||
}
|
||||
ssl.matchSuite(cipher_suites_, suite_len_);
|
||||
if (ssl.GetError()) return;
|
||||
ssl.set_pending(ssl.getSecurity().get_parms().suite_[1]);
|
||||
|
||||
if (compression_methods_ == zlib)
|
||||
@ -2028,11 +2067,9 @@ void Finished::Process(input_buffer& input, SSL& ssl)
|
||||
if (ssl.isTLSv1_1())
|
||||
ivExtra = ssl.getCrypto().get_cipher().get_blockSize();
|
||||
|
||||
opaque fill;
|
||||
int padSz = ssl.getSecurity().get_parms().encrypt_size_ - ivExtra -
|
||||
HANDSHAKE_HEADER - finishedSz - digestSz;
|
||||
for (int i = 0; i < padSz; i++)
|
||||
fill = input[AUTO];
|
||||
input.set_current(input.get_current() + padSz);
|
||||
|
||||
// verify mac
|
||||
if (memcmp(mac, verifyMAC, digestSz)) {
|
||||
|
@ -1,6 +1,5 @@
|
||||
/*
|
||||
Copyright (c) 2005-2007 MySQL AB, 2009 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -41,28 +40,28 @@
|
||||
|
||||
void* operator new(size_t sz, yaSSL::new_t)
|
||||
{
|
||||
void* ptr = malloc(sz ? sz : 1);
|
||||
if (!ptr) abort();
|
||||
void* ptr = malloc(sz ? sz : 1);
|
||||
if (!ptr) abort();
|
||||
|
||||
return ptr;
|
||||
return ptr;
|
||||
}
|
||||
|
||||
|
||||
void operator delete(void* ptr, yaSSL::new_t)
|
||||
{
|
||||
if (ptr) free(ptr);
|
||||
if (ptr) free(ptr);
|
||||
}
|
||||
|
||||
|
||||
void* operator new[](size_t sz, yaSSL::new_t nt)
|
||||
{
|
||||
return ::operator new(sz, nt);
|
||||
return ::operator new(sz, nt);
|
||||
}
|
||||
|
||||
|
||||
void operator delete[](void* ptr, yaSSL::new_t nt)
|
||||
{
|
||||
::operator delete(ptr, nt);
|
||||
::operator delete(ptr, nt);
|
||||
}
|
||||
|
||||
namespace yaSSL {
|
||||
@ -309,6 +308,20 @@ SSL::SSL(SSL_CTX* ctx)
|
||||
SetError(YasslError(err));
|
||||
return;
|
||||
}
|
||||
else if (serverSide && !(ctx->GetCiphers().setSuites_)) {
|
||||
// remove RSA or DSA suites depending on cert key type
|
||||
ProtocolVersion pv = secure_.get_connection().version_;
|
||||
|
||||
bool removeDH = secure_.use_parms().removeDH_;
|
||||
bool removeRSA = false;
|
||||
bool removeDSA = false;
|
||||
|
||||
if (cm.get_keyType() == rsa_sa_algo)
|
||||
removeDSA = true;
|
||||
else
|
||||
removeRSA = true;
|
||||
secure_.use_parms().SetSuites(pv, removeDH, removeRSA, removeDSA);
|
||||
}
|
||||
}
|
||||
else if (serverSide) {
|
||||
SetError(no_key_file);
|
||||
@ -321,6 +334,7 @@ SSL::SSL(SSL_CTX* ctx)
|
||||
cm.setVerifyNone();
|
||||
if (ctx->getMethod()->failNoCert())
|
||||
cm.setFailNoCert();
|
||||
cm.setVerifyCallback(ctx->getVerifyCallback());
|
||||
|
||||
if (serverSide)
|
||||
crypto_.SetDH(ctx->GetDH_Parms());
|
||||
@ -1040,7 +1054,7 @@ void SSL::fillData(Data& data)
|
||||
data.set_length(0); // output, actual data filled
|
||||
dataSz = min(dataSz, bufferedData());
|
||||
|
||||
for (uint i = 0; i < elements; i++) {
|
||||
for (size_t i = 0; i < elements; i++) {
|
||||
input_buffer* front = buffers_.getData().front();
|
||||
uint frontSz = front->get_remaining();
|
||||
uint readSz = min(dataSz - data.get_length(), frontSz);
|
||||
@ -1064,7 +1078,7 @@ void SSL::fillData(Data& data)
|
||||
void SSL::PeekData(Data& data)
|
||||
{
|
||||
if (GetError()) return;
|
||||
uint dataSz = data.get_length(); // input, data size to fill
|
||||
uint dataSz = data.get_length(); // input, data size to fill
|
||||
size_t elements = buffers_.getData().size();
|
||||
|
||||
data.set_length(0); // output, actual data filled
|
||||
@ -1101,7 +1115,7 @@ void SSL::flushBuffer()
|
||||
output_buffer out(sz);
|
||||
size_t elements = buffers_.getHandShake().size();
|
||||
|
||||
for (uint i = 0; i < elements; i++) {
|
||||
for (size_t i = 0; i < elements; i++) {
|
||||
output_buffer* front = buffers_.getHandShake().front();
|
||||
out.write(front->get_buffer(), front->get_size());
|
||||
|
||||
@ -1277,6 +1291,7 @@ void SSL::matchSuite(const opaque* peer, uint length)
|
||||
if (secure_.use_parms().suites_[i] == peer[j]) {
|
||||
secure_.use_parms().suite_[0] = 0x00;
|
||||
secure_.use_parms().suite_[1] = peer[j];
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
@ -1285,7 +1300,7 @@ void SSL::matchSuite(const opaque* peer, uint length)
|
||||
|
||||
|
||||
void SSL::set_session(SSL_SESSION* s)
|
||||
{
|
||||
{
|
||||
if (getSecurity().GetContext()->GetSessionCacheOff())
|
||||
return;
|
||||
|
||||
@ -1566,13 +1581,19 @@ Errors& GetErrors()
|
||||
|
||||
typedef Mutex::Lock Lock;
|
||||
|
||||
|
||||
|
||||
void Sessions::add(const SSL& ssl)
|
||||
{
|
||||
if (ssl.getSecurity().get_connection().sessionID_Set_) {
|
||||
Lock guard(mutex_);
|
||||
list_.push_back(NEW_YS SSL_SESSION(ssl, random_));
|
||||
Lock guard(mutex_);
|
||||
list_.push_back(NEW_YS SSL_SESSION(ssl, random_));
|
||||
count_++;
|
||||
}
|
||||
|
||||
if (count_ > SESSION_FLUSH_COUNT)
|
||||
if (!ssl.getSecurity().GetContext()->GetSessionCacheFlushOff())
|
||||
Flush();
|
||||
}
|
||||
|
||||
|
||||
@ -1661,6 +1682,25 @@ void Sessions::remove(const opaque* id)
|
||||
}
|
||||
|
||||
|
||||
// flush expired sessions from cache
|
||||
void Sessions::Flush()
|
||||
{
|
||||
Lock guard(mutex_);
|
||||
sess_iterator next = list_.begin();
|
||||
uint current = lowResTimer();
|
||||
|
||||
while (next != list_.end()) {
|
||||
sess_iterator si = next;
|
||||
++next;
|
||||
if ( ((*si)->GetBornOn() + (*si)->GetTimeOut()) < current) {
|
||||
del_ptr_zero()(*si);
|
||||
list_.erase(si);
|
||||
}
|
||||
}
|
||||
count_ = 0; // reset flush counter
|
||||
}
|
||||
|
||||
|
||||
// remove a self thread error
|
||||
void Errors::Remove()
|
||||
{
|
||||
@ -1765,7 +1805,8 @@ bool SSL_METHOD::multipleProtocol() const
|
||||
|
||||
SSL_CTX::SSL_CTX(SSL_METHOD* meth)
|
||||
: method_(meth), certificate_(0), privateKey_(0), passwordCb_(0),
|
||||
userData_(0), sessionCacheOff_(false)
|
||||
userData_(0), sessionCacheOff_(false), sessionCacheFlushOff_(false),
|
||||
verifyCallback_(0)
|
||||
{}
|
||||
|
||||
|
||||
@ -1792,6 +1833,12 @@ SSL_CTX::GetCA_List() const
|
||||
}
|
||||
|
||||
|
||||
VerifyCallback SSL_CTX::getVerifyCallback() const
|
||||
{
|
||||
return verifyCallback_;
|
||||
}
|
||||
|
||||
|
||||
const x509* SSL_CTX::getCert() const
|
||||
{
|
||||
return certificate_;
|
||||
@ -1852,6 +1899,12 @@ bool SSL_CTX::GetSessionCacheOff() const
|
||||
}
|
||||
|
||||
|
||||
bool SSL_CTX::GetSessionCacheFlushOff() const
|
||||
{
|
||||
return sessionCacheFlushOff_;
|
||||
}
|
||||
|
||||
|
||||
void SSL_CTX::SetUserData(void* data)
|
||||
{
|
||||
userData_ = data;
|
||||
@ -1864,6 +1917,12 @@ void SSL_CTX::SetSessionCacheOff()
|
||||
}
|
||||
|
||||
|
||||
void SSL_CTX::SetSessionCacheFlushOff()
|
||||
{
|
||||
sessionCacheFlushOff_ = true;
|
||||
}
|
||||
|
||||
|
||||
void SSL_CTX::setVerifyPeer()
|
||||
{
|
||||
method_->setVerifyPeer();
|
||||
@ -1882,6 +1941,12 @@ void SSL_CTX::setFailNoCert()
|
||||
}
|
||||
|
||||
|
||||
void SSL_CTX::setVerifyCallback(VerifyCallback vc)
|
||||
{
|
||||
verifyCallback_ = vc;
|
||||
}
|
||||
|
||||
|
||||
bool SSL_CTX::SetDH(const DH& dh)
|
||||
{
|
||||
dhParms_.p_ = dh.p->int_;
|
||||
@ -2317,7 +2382,7 @@ X509::X509(const char* i, size_t iSz, const char* s, size_t sSz,
|
||||
: issuer_(i, iSz), subject_(s, sSz),
|
||||
beforeDate_(b, bSz), afterDate_(a, aSz)
|
||||
{}
|
||||
|
||||
|
||||
|
||||
X509_NAME* X509::GetIssuer()
|
||||
{
|
||||
@ -2355,10 +2420,10 @@ ASN1_STRING* X509_NAME::GetEntry(int i)
|
||||
memcpy(entry_.data, &name_[i], sz_ - i);
|
||||
if (entry_.data[sz_ -i - 1]) {
|
||||
entry_.data[sz_ - i] = 0;
|
||||
entry_.length = (int) (sz_ - i);
|
||||
entry_.length = int(sz_) - i;
|
||||
}
|
||||
else
|
||||
entry_.length = (int) (sz_ - i - 1);
|
||||
entry_.length = int(sz_) - i - 1;
|
||||
entry_.type = 0;
|
||||
|
||||
return &entry_;
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -51,7 +51,7 @@ public:
|
||||
enum { BLOCK_SIZE = BLOWFISH_BLOCK_SIZE, ROUNDS = 16 };
|
||||
|
||||
Blowfish(CipherDir DIR, Mode MODE)
|
||||
: Mode_BASE(BLOCK_SIZE, DIR, MODE) {}
|
||||
: Mode_BASE(BLOCK_SIZE, DIR, MODE), sbox_(pbox_ + ROUNDS + 2) {}
|
||||
|
||||
#ifdef DO_BLOWFISH_ASM
|
||||
void Process(byte*, const byte*, word32);
|
||||
@ -62,8 +62,8 @@ private:
|
||||
static const word32 p_init_[ROUNDS + 2];
|
||||
static const word32 s_init_[4 * 256];
|
||||
|
||||
word32 pbox_[ROUNDS + 2];
|
||||
word32 sbox_[4 * 256];
|
||||
word32 pbox_[ROUNDS + 2 + 4 * 256];
|
||||
word32* sbox_;
|
||||
|
||||
void crypt_block(const word32 in[2], word32 out[2]) const;
|
||||
void AsmProcess(const byte* in, byte* out) const;
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -125,7 +125,7 @@ void CleanUp();
|
||||
|
||||
|
||||
// no gas on these systems ?, disable for now
|
||||
#if defined(__sun__) || defined (__QNX__) || defined (__APPLE__)
|
||||
#if defined(__sun__) || defined (__APPLE__)
|
||||
#define TAOCRYPT_DISABLE_X86ASM
|
||||
#endif
|
||||
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -35,10 +35,7 @@
|
||||
|
||||
// Handler for pure virtual functions
|
||||
namespace __Crun {
|
||||
static void pure_error(void)
|
||||
{
|
||||
assert("Pure virtual method called." == "Aborted");
|
||||
}
|
||||
void pure_error(void);
|
||||
} // namespace __Crun
|
||||
|
||||
#endif // __sun
|
||||
@ -54,16 +51,7 @@ extern "C" {
|
||||
#else
|
||||
#include "kernelc.hpp"
|
||||
#endif
|
||||
|
||||
/* Disallow inline __cxa_pure_virtual() */
|
||||
static int __cxa_pure_virtual() __attribute__((noinline, used));
|
||||
static int __cxa_pure_virtual()
|
||||
{
|
||||
// oops, pure virtual called!
|
||||
assert("Pure virtual method called." == "Aborted");
|
||||
return 0;
|
||||
}
|
||||
|
||||
int __cxa_pure_virtual () __attribute__ ((weak));
|
||||
} // extern "C"
|
||||
|
||||
#endif // __GNUC__ > 2
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -51,7 +51,7 @@ void AES::Process(byte* out, const byte* in, word32 sz)
|
||||
out += BLOCK_SIZE;
|
||||
in += BLOCK_SIZE;
|
||||
}
|
||||
else if (mode_ == CBC)
|
||||
else if (mode_ == CBC) {
|
||||
if (dir_ == ENCRYPTION)
|
||||
while (blocks--) {
|
||||
r_[0] ^= *(word32*)in;
|
||||
@ -78,6 +78,7 @@ void AES::Process(byte* out, const byte* in, word32 sz)
|
||||
out += BLOCK_SIZE;
|
||||
in += BLOCK_SIZE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#endif // DO_AES_ASM
|
||||
|
@ -1,6 +1,5 @@
|
||||
/*
|
||||
Copyright (c) 2005-2007 MySQL AB, 2009 Sun Microsystems, Inc.
|
||||
Use is subject to license terms.
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -187,10 +186,10 @@ Integer AbstractGroup::CascadeScalarMultiply(const Element &x,
|
||||
|
||||
struct WindowSlider
|
||||
{
|
||||
WindowSlider(const Integer &exp, bool fastNegate,
|
||||
WindowSlider(const Integer &expIn, bool fastNegateIn,
|
||||
unsigned int windowSizeIn=0)
|
||||
: exp(exp), windowModulus(Integer::One()), windowSize(windowSizeIn),
|
||||
windowBegin(0), fastNegate(fastNegate), firstTime(true),
|
||||
: exp(expIn), windowModulus(Integer::One()), windowSize(windowSizeIn),
|
||||
windowBegin(0), fastNegate(fastNegateIn), firstTime(true),
|
||||
finished(false)
|
||||
{
|
||||
if (windowSize == 0)
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -53,7 +53,7 @@ void Blowfish::Process(byte* out, const byte* in, word32 sz)
|
||||
out += BLOCK_SIZE;
|
||||
in += BLOCK_SIZE;
|
||||
}
|
||||
else if (mode_ == CBC)
|
||||
else if (mode_ == CBC) {
|
||||
if (dir_ == ENCRYPTION)
|
||||
while (blocks--) {
|
||||
r_[0] ^= *(word32*)in;
|
||||
@ -78,6 +78,7 @@ void Blowfish::Process(byte* out, const byte* in, word32 sz)
|
||||
out += BLOCK_SIZE;
|
||||
in += BLOCK_SIZE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#endif // DO_BLOWFISH_ASM
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -185,7 +185,7 @@ void Base64Decoder::Decode()
|
||||
{
|
||||
word32 bytes = coded_.size();
|
||||
word32 plainSz = bytes - ((bytes + (pemLineSz - 1)) / pemLineSz);
|
||||
plainSz = (plainSz * 3 + 3) / 4;
|
||||
plainSz = ((plainSz * 3) / 4) + 3;
|
||||
decoded_.New(plainSz);
|
||||
|
||||
word32 i = 0;
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -283,21 +283,23 @@ DWord() {}
|
||||
word GetHighHalfAsBorrow() const {return 0-halfs_.high;}
|
||||
|
||||
private:
|
||||
struct dword_struct
|
||||
{
|
||||
#ifdef LITTLE_ENDIAN_ORDER
|
||||
word low;
|
||||
word high;
|
||||
#else
|
||||
word high;
|
||||
word low;
|
||||
#endif
|
||||
};
|
||||
|
||||
union
|
||||
{
|
||||
#ifdef TAOCRYPT_NATIVE_DWORD_AVAILABLE
|
||||
dword whole_;
|
||||
#endif
|
||||
struct
|
||||
{
|
||||
#ifdef LITTLE_ENDIAN_ORDER
|
||||
word low;
|
||||
word high;
|
||||
#else
|
||||
word high;
|
||||
word low;
|
||||
#endif
|
||||
} halfs_;
|
||||
struct dword_struct halfs_;
|
||||
};
|
||||
};
|
||||
|
||||
@ -1214,20 +1216,24 @@ public:
|
||||
#define AS1(x) #x ";"
|
||||
#define AS2(x, y) #x ", " #y ";"
|
||||
#define AddPrologue \
|
||||
word res; \
|
||||
__asm__ __volatile__ \
|
||||
( \
|
||||
"push %%ebx;" /* save this manually, in case of -fPIC */ \
|
||||
"mov %2, %%ebx;" \
|
||||
"mov %3, %%ebx;" \
|
||||
".intel_syntax noprefix;" \
|
||||
"push ebp;"
|
||||
#define AddEpilogue \
|
||||
"pop ebp;" \
|
||||
".att_syntax prefix;" \
|
||||
"pop %%ebx;" \
|
||||
: \
|
||||
"mov %%eax, %0;" \
|
||||
: "=g" (res) \
|
||||
: "c" (C), "d" (A), "m" (B), "S" (N) \
|
||||
: "%edi", "memory", "cc" \
|
||||
);
|
||||
); \
|
||||
return res;
|
||||
|
||||
#define MulPrologue \
|
||||
__asm__ __volatile__ \
|
||||
( \
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -84,12 +84,23 @@ namespace STL = STL_NAMESPACE;
|
||||
|
||||
}
|
||||
|
||||
#if defined(__ICC) || defined(__INTEL_COMPILER)
|
||||
#ifdef __sun
|
||||
|
||||
// Handler for pure virtual functions
|
||||
namespace __Crun {
|
||||
void pure_error() {
|
||||
assert(!"Aborted: pure virtual method called.");
|
||||
}
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
#if defined(__ICC) || defined(__INTEL_COMPILER) || (__GNUC__ > 2)
|
||||
|
||||
extern "C" {
|
||||
|
||||
int __cxa_pure_virtual() {
|
||||
assert("Pure virtual method called." == "Aborted");
|
||||
assert(!"Aborted: pure virtual method called.");
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -166,14 +177,6 @@ word Crop(word value, unsigned int size)
|
||||
|
||||
#ifdef TAOCRYPT_X86ASM_AVAILABLE
|
||||
|
||||
#ifndef _MSC_VER
|
||||
static jmp_buf s_env;
|
||||
static void SigIllHandler(int)
|
||||
{
|
||||
longjmp(s_env, 1);
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
bool HaveCpuId()
|
||||
{
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -27,7 +27,6 @@
|
||||
#include <time.h>
|
||||
|
||||
#if defined(_WIN32)
|
||||
#define _WIN32_WINNT 0x0400
|
||||
#include <windows.h>
|
||||
#include <wincrypt.h>
|
||||
#else
|
||||
@ -93,67 +92,6 @@ void OS_Seed::GenerateSeed(byte* output, word32 sz)
|
||||
}
|
||||
|
||||
|
||||
#elif defined(__NETWARE__)
|
||||
|
||||
/* The OS_Seed implementation for Netware */
|
||||
|
||||
#include <nks/thread.h>
|
||||
#include <nks/plat.h>
|
||||
|
||||
// Loop on high resulution Read Time Stamp Counter
|
||||
static void NetwareSeed(byte* output, word32 sz)
|
||||
{
|
||||
word32 tscResult;
|
||||
|
||||
for (word32 i = 0; i < sz; i += sizeof(tscResult)) {
|
||||
#if defined(__GNUC__)
|
||||
asm volatile("rdtsc" : "=A" (tscResult));
|
||||
#else
|
||||
#ifdef __MWERKS__
|
||||
asm {
|
||||
#else
|
||||
__asm {
|
||||
#endif
|
||||
rdtsc
|
||||
mov tscResult, eax
|
||||
}
|
||||
#endif
|
||||
|
||||
memcpy(output, &tscResult, sizeof(tscResult));
|
||||
output += sizeof(tscResult);
|
||||
|
||||
NXThreadYield(); // induce more variance
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
OS_Seed::OS_Seed()
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
OS_Seed::~OS_Seed()
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
void OS_Seed::GenerateSeed(byte* output, word32 sz)
|
||||
{
|
||||
/*
|
||||
Try to use NXSeedRandom as it will generate a strong
|
||||
seed using the onboard 82802 chip
|
||||
|
||||
As it's not always supported, fallback to default
|
||||
implementation if an error is returned
|
||||
*/
|
||||
|
||||
if (NXSeedRandom(sz, output) != 0)
|
||||
{
|
||||
NetwareSeed(output, sz);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#else
|
||||
|
||||
/* The default OS_Seed implementation */
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2000-2007 MySQL AB
|
||||
Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -54,7 +54,7 @@ void Twofish::Process(byte* out, const byte* in, word32 sz)
|
||||
out += BLOCK_SIZE;
|
||||
in += BLOCK_SIZE;
|
||||
}
|
||||
else if (mode_ == CBC)
|
||||
else if (mode_ == CBC) {
|
||||
if (dir_ == ENCRYPTION)
|
||||
while (blocks--) {
|
||||
r_[0] ^= *(word32*)in;
|
||||
@ -82,6 +82,7 @@ void Twofish::Process(byte* out, const byte* in, word32 sz)
|
||||
out += BLOCK_SIZE;
|
||||
in += BLOCK_SIZE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#endif // DO_TWOFISH_ASM
|
||||
|
@ -1,5 +1,5 @@
|
||||
/*
|
||||
Copyright (C) 2006, 2007 MySQL AB
|
||||
Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -50,8 +50,7 @@
|
||||
#endif /* _WIN32 */
|
||||
|
||||
|
||||
#if !defined(_SOCKLEN_T) && \
|
||||
(defined(_WIN32) || defined(__NETWARE__) || defined(__APPLE__))
|
||||
#if !defined(_SOCKLEN_T) && (defined(_WIN32) || defined(__APPLE__))
|
||||
typedef int socklen_t;
|
||||
#endif
|
||||
|
||||
@ -60,18 +59,14 @@
|
||||
#if defined(__hpux)
|
||||
// HPUX uses int* for third parameter to accept
|
||||
typedef int* ACCEPT_THIRD_T;
|
||||
#elif defined(__NETWARE__)
|
||||
// NetWare uses size_t* for third parameter to accept
|
||||
typedef size_t* ACCEPT_THIRD_T;
|
||||
#else
|
||||
typedef socklen_t* ACCEPT_THIRD_T;
|
||||
#endif
|
||||
|
||||
|
||||
// Check if _POSIX_THREADS should be forced
|
||||
#if !defined(_POSIX_THREADS) && (defined(__NETWARE__) || defined(__hpux))
|
||||
#if !defined(_POSIX_THREADS) && defined(__hpux)
|
||||
// HPUX does not define _POSIX_THREADS as it's not _fully_ implemented
|
||||
// Netware supports pthreads but does not announce it
|
||||
#define _POSIX_THREADS
|
||||
#endif
|
||||
|
||||
@ -178,6 +173,11 @@ inline void err_sys(const char* msg)
|
||||
}
|
||||
|
||||
|
||||
extern "C" {
|
||||
static int PasswordCallBack(char*, int, int, void*);
|
||||
}
|
||||
|
||||
|
||||
static int PasswordCallBack(char* passwd, int sz, int rw, void* userdata)
|
||||
{
|
||||
strncpy(passwd, "12345678", sz);
|
||||
|
Loading…
x
Reference in New Issue
Block a user