summaryrefslogtreecommitdiffstats
path: root/lib/libssl/src/ssl/tls_srp.c
diff options
context:
space:
mode:
authorjsing <jsing@openbsd.org>2014-04-14 14:59:47 +0000
committerjsing <jsing@openbsd.org>2014-04-14 14:59:47 +0000
commit7c408a0868fbcc7733ea48d1a7de8769964192b6 (patch)
treea714d5f1a8a4f05018ffe886ad8f0b9e5369d092 /lib/libssl/src/ssl/tls_srp.c
parentRemove the CAPI engine: It is a backend for the Windows CryptoAPI and (diff)
downloadwireguard-openbsd-7c408a0868fbcc7733ea48d1a7de8769964192b6.tar.xz
wireguard-openbsd-7c408a0868fbcc7733ea48d1a7de8769964192b6.zip
First pass at applying KNF to the OpenSSL code, which almost makes it
readable. This pass is whitespace only and can readily be verified using tr and md5.
Diffstat (limited to 'lib/libssl/src/ssl/tls_srp.c')
-rw-r--r--lib/libssl/src/ssl/tls_srp.c388
1 files changed, 196 insertions, 192 deletions
diff --git a/lib/libssl/src/ssl/tls_srp.c b/lib/libssl/src/ssl/tls_srp.c
index 2315a7c0a2e..25ab73af9db 100644
--- a/lib/libssl/src/ssl/tls_srp.c
+++ b/lib/libssl/src/ssl/tls_srp.c
@@ -63,8 +63,8 @@
#include <openssl/srp.h>
#include <openssl/err.h>
-int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
- {
+int
+SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx) {
if (ctx == NULL)
return 0;
OPENSSL_free(ctx->srp_ctx.login);
@@ -93,10 +93,10 @@ int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
ctx->srp_ctx.strength = SRP_MINIMAL_N;
ctx->srp_ctx.srp_Mask = 0;
return (1);
- }
+}
-int SSL_SRP_CTX_free(struct ssl_st *s)
- {
+int
+SSL_SRP_CTX_free(struct ssl_st *s) {
if (s == NULL)
return 0;
OPENSSL_free(s->srp_ctx.login);
@@ -125,10 +125,10 @@ int SSL_SRP_CTX_free(struct ssl_st *s)
s->srp_ctx.strength = SRP_MINIMAL_N;
s->srp_ctx.srp_Mask = 0;
return (1);
- }
+}
-int SSL_SRP_CTX_init(struct ssl_st *s)
- {
+int
+SSL_SRP_CTX_init(struct ssl_st *s) {
SSL_CTX *ctx;
if ((s == NULL) || ((ctx = s->ctx) == NULL))
@@ -154,31 +154,29 @@ int SSL_SRP_CTX_init(struct ssl_st *s)
s->srp_ctx.strength = ctx->srp_ctx.strength;
if (((ctx->srp_ctx.N != NULL) &&
- ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) ||
- ((ctx->srp_ctx.g != NULL) &&
- ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) ||
- ((ctx->srp_ctx.s != NULL) &&
- ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) ||
- ((ctx->srp_ctx.B != NULL) &&
- ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) ||
- ((ctx->srp_ctx.A != NULL) &&
- ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) ||
- ((ctx->srp_ctx.a != NULL) &&
- ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) ||
- ((ctx->srp_ctx.v != NULL) &&
- ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) ||
- ((ctx->srp_ctx.b != NULL) &&
- ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL)))
- {
- SSLerr(SSL_F_SSL_SRP_CTX_INIT,ERR_R_BN_LIB);
+ ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) ||
+ ((ctx->srp_ctx.g != NULL) &&
+ ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) ||
+ ((ctx->srp_ctx.s != NULL) &&
+ ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) ||
+ ((ctx->srp_ctx.B != NULL) &&
+ ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) ||
+ ((ctx->srp_ctx.A != NULL) &&
+ ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) ||
+ ((ctx->srp_ctx.a != NULL) &&
+ ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) ||
+ ((ctx->srp_ctx.v != NULL) &&
+ ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) ||
+ ((ctx->srp_ctx.b != NULL) &&
+ ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
+ SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
goto err;
- }
- if ((ctx->srp_ctx.login != NULL) &&
- ((s->srp_ctx.login = BUF_strdup(ctx->srp_ctx.login)) == NULL))
- {
- SSLerr(SSL_F_SSL_SRP_CTX_INIT,ERR_R_INTERNAL_ERROR);
+ }
+ if ((ctx->srp_ctx.login != NULL) &&
+ ((s->srp_ctx.login = BUF_strdup(ctx->srp_ctx.login)) == NULL)) {
+ SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
goto err;
- }
+ }
s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;
return (1);
@@ -193,10 +191,10 @@ err:
BN_free(s->srp_ctx.b);
BN_free(s->srp_ctx.v);
return (0);
- }
+}
-int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
- {
+int
+SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx) {
if (ctx == NULL)
return 0;
@@ -222,134 +220,119 @@ int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
ctx->srp_ctx.strength = SRP_MINIMAL_N;
return (1);
- }
+}
/* server side */
-int SSL_srp_server_param_with_username(SSL *s, int *ad)
- {
+int
+SSL_srp_server_param_with_username(SSL *s, int *ad)
+{
unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
int al;
*ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
if ((s->srp_ctx.TLS_ext_srp_username_callback !=NULL) &&
- ((al = s->srp_ctx.TLS_ext_srp_username_callback(s, ad, s->srp_ctx.SRP_cb_arg))!=SSL_ERROR_NONE))
- return al;
+ ((al = s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
+ s->srp_ctx.SRP_cb_arg)) != SSL_ERROR_NONE))
+ return al;
*ad = SSL_AD_INTERNAL_ERROR;
- if ((s->srp_ctx.N == NULL) ||
- (s->srp_ctx.g == NULL) ||
- (s->srp_ctx.s == NULL) ||
- (s->srp_ctx.v == NULL))
+ if ((s->srp_ctx.N == NULL) || (s->srp_ctx.g == NULL) ||
+ (s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL))
return SSL3_AL_FATAL;
if (RAND_bytes(b, sizeof(b)) <= 0)
return SSL3_AL_FATAL;
- s->srp_ctx.b = BN_bin2bn(b,sizeof(b),NULL);
- OPENSSL_cleanse(b,sizeof(b));
+ s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
+ OPENSSL_cleanse(b, sizeof(b));
/* Calculate: B = (kv + g^b) % N */
- return ((s->srp_ctx.B = SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g, s->srp_ctx.v)) != NULL)?
- SSL_ERROR_NONE:SSL3_AL_FATAL;
- }
+ return ((s->srp_ctx.B = SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g, s->srp_ctx.v)) != NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
+}
/* If the server just has the raw password, make up a verifier entry on the fly */
-int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass, const char *grp)
- {
+int
+SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass, const char *grp)
+{
SRP_gN *GN = SRP_get_default_gN(grp);
- if(GN == NULL) return -1;
+ if (GN == NULL)
+ return -1;
s->srp_ctx.N = BN_dup(GN->N);
s->srp_ctx.g = BN_dup(GN->g);
- if(s->srp_ctx.v != NULL)
- {
+ if (s->srp_ctx.v != NULL) {
BN_clear_free(s->srp_ctx.v);
s->srp_ctx.v = NULL;
- }
- if(s->srp_ctx.s != NULL)
- {
+ }
+ if (s->srp_ctx.s != NULL) {
BN_clear_free(s->srp_ctx.s);
s->srp_ctx.s = NULL;
- }
- if(!SRP_create_verifier_BN(user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g)) return -1;
-
- return 1;
}
+ if (!SRP_create_verifier_BN(user, pass, &s->srp_ctx.s, &s->srp_ctx.v,
+ GN->N, GN->g))
+ return -1;
-int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
- BIGNUM *sa, BIGNUM *v, char *info)
- {
- if (N!= NULL)
- {
- if (s->srp_ctx.N != NULL)
- {
- if (!BN_copy(s->srp_ctx.N,N))
- {
+ return 1;
+}
+
+int
+SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
+ BIGNUM *sa, BIGNUM *v, char *info)
+{
+ if (N != NULL) {
+ if (s->srp_ctx.N != NULL) {
+ if (!BN_copy(s->srp_ctx.N, N)) {
BN_free(s->srp_ctx.N);
s->srp_ctx.N = NULL;
- }
}
- else
+ } else
s->srp_ctx.N = BN_dup(N);
- }
- if (g!= NULL)
- {
- if (s->srp_ctx.g != NULL)
- {
- if (!BN_copy(s->srp_ctx.g,g))
- {
+ }
+ if (g != NULL) {
+ if (s->srp_ctx.g != NULL) {
+ if (!BN_copy(s->srp_ctx.g, g)) {
BN_free(s->srp_ctx.g);
s->srp_ctx.g = NULL;
- }
}
- else
+ } else
s->srp_ctx.g = BN_dup(g);
- }
- if (sa!= NULL)
- {
- if (s->srp_ctx.s != NULL)
- {
- if (!BN_copy(s->srp_ctx.s,sa))
- {
+ }
+ if (sa != NULL) {
+ if (s->srp_ctx.s != NULL) {
+ if (!BN_copy(s->srp_ctx.s, sa)) {
BN_free(s->srp_ctx.s);
s->srp_ctx.s = NULL;
- }
}
- else
+ } else
s->srp_ctx.s = BN_dup(sa);
- }
- if (v!= NULL)
- {
- if (s->srp_ctx.v != NULL)
- {
- if (!BN_copy(s->srp_ctx.v,v))
- {
+ }
+ if (v != NULL) {
+ if (s->srp_ctx.v != NULL) {
+ if (!BN_copy(s->srp_ctx.v, v)) {
BN_free(s->srp_ctx.v);
s->srp_ctx.v = NULL;
- }
}
- else
+ } else
s->srp_ctx.v = BN_dup(v);
- }
+ }
s->srp_ctx.info = info;
- if (!(s->srp_ctx.N) ||
- !(s->srp_ctx.g) ||
- !(s->srp_ctx.s) ||
- !(s->srp_ctx.v))
+ if (!(s->srp_ctx.N) || !(s->srp_ctx.g) ||
+ !(s->srp_ctx.s) || !(s->srp_ctx.v))
return -1;
return 1;
- }
+}
-int SRP_generate_server_master_secret(SSL *s,unsigned char *master_key)
- {
+int
+SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
+{
BIGNUM *K = NULL, *u = NULL;
int ret = -1, tmp_len;
unsigned char *tmp = NULL;
- if (!SRP_Verify_A_mod_N(s->srp_ctx.A,s->srp_ctx.N))
+ if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
goto err;
- if (!(u = SRP_Calc_u(s->srp_ctx.A,s->srp_ctx.B,s->srp_ctx.N)))
+ if (!(u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)))
goto err;
if (!(K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b, s->srp_ctx.N)))
goto err;
@@ -358,21 +341,21 @@ int SRP_generate_server_master_secret(SSL *s,unsigned char *master_key)
if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
goto err;
BN_bn2bin(K, tmp);
- ret = s->method->ssl3_enc->generate_master_secret(s,master_key,tmp,tmp_len);
+ ret = s->method->ssl3_enc->generate_master_secret(s, master_key, tmp, tmp_len);
err:
- if (tmp)
- {
- OPENSSL_cleanse(tmp,tmp_len) ;
+ if (tmp) {
+ OPENSSL_cleanse(tmp, tmp_len);
OPENSSL_free(tmp);
- }
+ }
BN_clear_free(K);
BN_clear_free(u);
return ret;
- }
+}
/* client side */
-int SRP_generate_client_master_secret(SSL *s,unsigned char *master_key)
- {
+int
+SRP_generate_client_master_secret(SSL *s, unsigned char *master_key)
+{
BIGNUM *x = NULL, *u = NULL, *K = NULL;
int ret = -1, tmp_len;
char *passwd = NULL;
@@ -380,128 +363,149 @@ int SRP_generate_client_master_secret(SSL *s,unsigned char *master_key)
/* Checks if b % n == 0
*/
- if (SRP_Verify_B_mod_N(s->srp_ctx.B,s->srp_ctx.N)==0) goto err;
- if (!(u = SRP_Calc_u(s->srp_ctx.A,s->srp_ctx.B,s->srp_ctx.N))) goto err;
- if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) goto err;
- if (!(passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s, s->srp_ctx.SRP_cb_arg))) goto err;
- if (!(x = SRP_Calc_x(s->srp_ctx.s,s->srp_ctx.login,passwd))) goto err;
- if (!(K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x, s->srp_ctx.a, u))) goto err;
+ if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)
+ goto err;
+ if (!(u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)))
+ goto err;
+ if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL)
+ goto err;
+ if (!(passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
+ s->srp_ctx.SRP_cb_arg)))
+ goto err;
+ if (!(x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)))
+ goto err;
+ if (!(K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g,
+ x, s->srp_ctx.a, u)))
+ goto err;
tmp_len = BN_num_bytes(K);
if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) goto err;
- BN_bn2bin(K, tmp);
- ret = s->method->ssl3_enc->generate_master_secret(s,master_key,tmp,tmp_len);
+ BN_bn2bin(K, tmp);
+ ret = s->method->ssl3_enc->generate_master_secret(s, master_key,
+ tmp, tmp_len);
err:
- if (tmp)
- {
- OPENSSL_cleanse(tmp,tmp_len) ;
+ if (tmp) {
+ OPENSSL_cleanse(tmp, tmp_len);
OPENSSL_free(tmp);
- }
+ }
BN_clear_free(K);
BN_clear_free(x);
- if (passwd)
- {
- OPENSSL_cleanse(passwd,strlen(passwd)) ;
+ if (passwd) {
+ OPENSSL_cleanse(passwd, strlen(passwd));
OPENSSL_free(passwd);
- }
+ }
BN_clear_free(u);
return ret;
- }
+}
-int SRP_Calc_A_param(SSL *s)
- {
+int
+SRP_Calc_A_param(SSL *s)
+{
unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
if (BN_num_bits(s->srp_ctx.N) < s->srp_ctx.strength)
return -1;
- if (s->srp_ctx.SRP_verify_param_callback ==NULL &&
- !SRP_check_known_gN_param(s->srp_ctx.g,s->srp_ctx.N))
- return -1 ;
+ if (s->srp_ctx.SRP_verify_param_callback ==NULL &&
+ !SRP_check_known_gN_param(s->srp_ctx.g, s->srp_ctx.N))
+ return -1;
RAND_bytes(rnd, sizeof(rnd));
s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
OPENSSL_cleanse(rnd, sizeof(rnd));
- if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a,s->srp_ctx.N,s->srp_ctx.g)))
+ if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N,
+ s->srp_ctx.g)))
return -1;
/* We can have a callback to verify SRP param!! */
- if (s->srp_ctx.SRP_verify_param_callback !=NULL)
- return s->srp_ctx.SRP_verify_param_callback(s,s->srp_ctx.SRP_cb_arg);
+ if (s->srp_ctx.SRP_verify_param_callback !=NULL)
+ return s->srp_ctx.SRP_verify_param_callback(s,
+ s->srp_ctx.SRP_cb_arg);
return 1;
- }
+}
-BIGNUM *SSL_get_srp_g(SSL *s)
- {
+BIGNUM
+*SSL_get_srp_g(SSL *s)
+{
if (s->srp_ctx.g != NULL)
return s->srp_ctx.g;
return s->ctx->srp_ctx.g;
- }
+}
-BIGNUM *SSL_get_srp_N(SSL *s)
- {
+BIGNUM
+*SSL_get_srp_N(SSL *s)
+{
if (s->srp_ctx.N != NULL)
return s->srp_ctx.N;
return s->ctx->srp_ctx.N;
- }
+}
-char *SSL_get_srp_username(SSL *s)
- {
+char
+*SSL_get_srp_username(SSL *s)
+{
if (s->srp_ctx.login != NULL)
return s->srp_ctx.login;
return s->ctx->srp_ctx.login;
- }
+}
-char *SSL_get_srp_userinfo(SSL *s)
- {
+char
+*SSL_get_srp_userinfo(SSL *s)
+{
if (s->srp_ctx.info != NULL)
return s->srp_ctx.info;
return s->ctx->srp_ctx.info;
- }
+}
#define tls1_ctx_ctrl ssl3_ctx_ctrl
#define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl
-int SSL_CTX_set_srp_username(SSL_CTX *ctx,char *name)
- {
- return tls1_ctx_ctrl(ctx,SSL_CTRL_SET_TLS_EXT_SRP_USERNAME,0,name);
- }
-
-int SSL_CTX_set_srp_password(SSL_CTX *ctx,char *password)
- {
- return tls1_ctx_ctrl(ctx,SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD,0,password);
- }
-
-int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
- {
+int
+SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name)
+{
+ return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
+}
+
+int
+SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password)
+{
+ return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
+}
+
+int
+SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
+{
return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
- NULL);
- }
-
-int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx, int (*cb)(SSL *,void *))
- {
- return tls1_ctx_callback_ctrl(ctx,SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
- (void (*)(void))cb);
- }
-
-int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg)
- {
- return tls1_ctx_ctrl(ctx,SSL_CTRL_SET_SRP_ARG,0,arg);
- }
-
-int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
- int (*cb)(SSL *,int *,void *))
- {
- return tls1_ctx_callback_ctrl(ctx,SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
- (void (*)(void))cb);
- }
-
-int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx, char *(*cb)(SSL *,void *))
- {
- return tls1_ctx_callback_ctrl(ctx,SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
- (void (*)(void))cb);
- }
+ NULL);
+}
+
+int
+SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx, int (*cb)(SSL *, void *))
+{
+ return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
+ (void (*)(void))cb);
+}
+
+int
+SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg)
+{
+ return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
+}
+
+int
+SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
+ int (*cb)(SSL *, int *, void *))
+{
+ return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
+ (void (*)(void))cb);
+}
+
+int
+SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx, char *(*cb)(SSL *, void *))
+{
+ return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
+ (void (*)(void))cb);
+}
#endif