/src/openssl/ssl/tls_srp.c

Source (jump to first uncovered line)
/*
 * Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright (c) 2004, EdelKey Project. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 *
 * Originally written by Christophe Renou and Peter Sylvester,
 * for the EdelKey project.
 */

#include <openssl/crypto.h>
#include <openssl/rand.h>
#include <openssl/err.h>
#include "ssl_locl.h"

#ifndef OPENSSL_NO_SRP
# include <openssl/srp.h>

int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
{
    if (ctx == NULL)
        return 0;
    OPENSSL_free(ctx->srp_ctx.login);
    OPENSSL_free(ctx->srp_ctx.info);
    BN_free(ctx->srp_ctx.N);
    BN_free(ctx->srp_ctx.g);
    BN_free(ctx->srp_ctx.s);
    BN_free(ctx->srp_ctx.B);
    BN_free(ctx->srp_ctx.A);
    BN_free(ctx->srp_ctx.a);
    BN_free(ctx->srp_ctx.b);
    BN_free(ctx->srp_ctx.v);
    memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
    ctx->srp_ctx.strength = SRP_MINIMAL_N;
    return 1;
}

int SSL_SRP_CTX_free(struct ssl_st *s)
{
    if (s == NULL)
        return 0;
    OPENSSL_free(s->srp_ctx.login);
    OPENSSL_free(s->srp_ctx.info);
    BN_free(s->srp_ctx.N);
    BN_free(s->srp_ctx.g);
    BN_free(s->srp_ctx.s);
    BN_free(s->srp_ctx.B);
    BN_free(s->srp_ctx.A);
    BN_free(s->srp_ctx.a);
    BN_free(s->srp_ctx.b);
    BN_free(s->srp_ctx.v);
    memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
    s->srp_ctx.strength = SRP_MINIMAL_N;
    return 1;
}

int SSL_SRP_CTX_init(struct ssl_st *s)
{
    SSL_CTX *ctx;

    if ((s == NULL) || ((ctx = s->ctx) == NULL))
        return 0;

    memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));

    s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg;
    /* set client Hello login callback */
    s->srp_ctx.TLS_ext_srp_username_callback =
        ctx->srp_ctx.TLS_ext_srp_username_callback;
    /* set SRP N/g param callback for verification */
    s->srp_ctx.SRP_verify_param_callback =
        ctx->srp_ctx.SRP_verify_param_callback;
    /* set SRP client passwd callback */
    s->srp_ctx.SRP_give_srp_client_pwd_callback =
        ctx->srp_ctx.SRP_give_srp_client_pwd_callback;

    s->srp_ctx.strength = ctx->srp_ctx.strength;

    if (((ctx->srp_ctx.N != NULL) &&
         ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) ||
        ((ctx->srp_ctx.g != NULL) &&
         ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) ||
        ((ctx->srp_ctx.s != NULL) &&
         ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) ||
        ((ctx->srp_ctx.B != NULL) &&
         ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) ||
        ((ctx->srp_ctx.A != NULL) &&
         ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) ||
        ((ctx->srp_ctx.a != NULL) &&
         ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) ||
        ((ctx->srp_ctx.v != NULL) &&
         ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) ||
        ((ctx->srp_ctx.b != NULL) &&
         ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
        SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
        goto err;
    }
    if ((ctx->srp_ctx.login != NULL) &&
        ((s->srp_ctx.login = OPENSSL_strdup(ctx->srp_ctx.login)) == NULL)) {
        SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    if ((ctx->srp_ctx.info != NULL) &&
        ((s->srp_ctx.info = BUF_strdup(ctx->srp_ctx.info)) == NULL)) {
        SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;

    return 1;
 err:
    OPENSSL_free(s->srp_ctx.login);
    OPENSSL_free(s->srp_ctx.info);
    BN_free(s->srp_ctx.N);
    BN_free(s->srp_ctx.g);
    BN_free(s->srp_ctx.s);
    BN_free(s->srp_ctx.B);
    BN_free(s->srp_ctx.A);
    BN_free(s->srp_ctx.a);
    BN_free(s->srp_ctx.b);
    BN_free(s->srp_ctx.v);
    memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
    return 0;
}

int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
{
    if (ctx == NULL)
        return 0;

    memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
    ctx->srp_ctx.strength = SRP_MINIMAL_N;

    return 1;
}

/* server side */
int SSL_srp_server_param_with_username(SSL *s, int *ad)
{
    unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
    int al;

    *ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
    if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) &&
        ((al =
          s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
                                                   s->srp_ctx.SRP_cb_arg)) !=
         SSL_ERROR_NONE))
        return al;

    *ad = SSL_AD_INTERNAL_ERROR;
    if ((s->srp_ctx.N == NULL) ||
        (s->srp_ctx.g == NULL) ||
        (s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL))
        return SSL3_AL_FATAL;

    if (RAND_priv_bytes(b, sizeof(b)) <= 0)
        return SSL3_AL_FATAL;
    s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
    OPENSSL_cleanse(b, sizeof(b));

    /* Calculate:  B = (kv + g^b) % N  */

    return ((s->srp_ctx.B =
             SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
                        s->srp_ctx.v)) !=
            NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
}

/*
 * If the server just has the raw password, make up a verifier entry on the
 * fly
 */
int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,
                                const char *grp)
{
    SRP_gN *GN = SRP_get_default_gN(grp);
    if (GN == NULL)
        return -1;
    s->srp_ctx.N = BN_dup(GN->N);
    s->srp_ctx.g = BN_dup(GN->g);
    BN_clear_free(s->srp_ctx.v);
    s->srp_ctx.v = NULL;
    BN_clear_free(s->srp_ctx.s);
    s->srp_ctx.s = NULL;
    if (!SRP_create_verifier_BN
        (user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g))
        return -1;

    return 1;
}

int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
                             BIGNUM *sa, BIGNUM *v, char *info)
{
    if (N != NULL) {
        if (s->srp_ctx.N != NULL) {
            if (!BN_copy(s->srp_ctx.N, N)) {
                BN_free(s->srp_ctx.N);
                s->srp_ctx.N = NULL;
            }
        } else
            s->srp_ctx.N = BN_dup(N);
    }
    if (g != NULL) {
        if (s->srp_ctx.g != NULL) {
            if (!BN_copy(s->srp_ctx.g, g)) {
                BN_free(s->srp_ctx.g);
                s->srp_ctx.g = NULL;
            }
        } else
            s->srp_ctx.g = BN_dup(g);
    }
    if (sa != NULL) {
        if (s->srp_ctx.s != NULL) {
            if (!BN_copy(s->srp_ctx.s, sa)) {
                BN_free(s->srp_ctx.s);
                s->srp_ctx.s = NULL;
            }
        } else
            s->srp_ctx.s = BN_dup(sa);
    }
    if (v != NULL) {
        if (s->srp_ctx.v != NULL) {
            if (!BN_copy(s->srp_ctx.v, v)) {
                BN_free(s->srp_ctx.v);
                s->srp_ctx.v = NULL;
            }
        } else
            s->srp_ctx.v = BN_dup(v);
    }
    if (info != NULL) {
        if (s->srp_ctx.info)
            OPENSSL_free(s->srp_ctx.info);
        if ((s->srp_ctx.info = BUF_strdup(info)) == NULL)
            return -1;
    }

    if (!(s->srp_ctx.N) ||
        !(s->srp_ctx.g) || !(s->srp_ctx.s) || !(s->srp_ctx.v))
        return -1;

    return 1;
}

int srp_generate_server_master_secret(SSL *s)
{
    BIGNUM *K = NULL, *u = NULL;
    int ret = -1, tmp_len = 0;
    unsigned char *tmp = NULL;

    if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
        goto err;
    if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
        goto err;
    if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
                                 s->srp_ctx.N)) == NULL)
        goto err;

    tmp_len = BN_num_bytes(K);
    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                 SSL_F_SRP_GENERATE_SERVER_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    BN_bn2bin(K, tmp);
    /* Calls SSLfatal() as required */
    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
 err:
    BN_clear_free(K);
    BN_clear_free(u);
    return ret;
}

/* client side */
int srp_generate_client_master_secret(SSL *s)
{
    BIGNUM *x = NULL, *u = NULL, *K = NULL;
    int ret = -1, tmp_len = 0;
    char *passwd = NULL;
    unsigned char *tmp = NULL;

    /*
     * Checks if b % n == 0
     */
    if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0
            || (u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N))
               == NULL
            || s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                 SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    if ((passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
                                                      s->srp_ctx.SRP_cb_arg))
            == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                 SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET,
                 SSL_R_CALLBACK_FAILED);
        goto err;
    }
    if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL
            || (K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B,
                                        s->srp_ctx.g, x,
                                        s->srp_ctx.a, u)) == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                 SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
        goto err;
    }

    tmp_len = BN_num_bytes(K);
    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                 SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    BN_bn2bin(K, tmp);
    /* Calls SSLfatal() as required */
    ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
 err:
    BN_clear_free(K);
    BN_clear_free(x);
    if (passwd != NULL)
        OPENSSL_clear_free(passwd, strlen(passwd));
    BN_clear_free(u);
    return ret;
}

int srp_verify_server_param(SSL *s)
{
    SRP_CTX *srp = &s->srp_ctx;
    /*
     * Sanity check parameters: we can quickly check B % N == 0 by checking B
     * != 0 since B < N
     */
    if (BN_ucmp(srp->g, srp->N) >= 0 || BN_ucmp(srp->B, srp->N) >= 0
        || BN_is_zero(srp->B)) {
        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SRP_VERIFY_SERVER_PARAM,
                 SSL_R_BAD_DATA);
        return 0;
    }

    if (BN_num_bits(srp->N) < srp->strength) {
        SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
                 SSL_R_INSUFFICIENT_SECURITY);
        return 0;
    }

    if (srp->SRP_verify_param_callback) {
        if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) {
            SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY,
                     SSL_F_SRP_VERIFY_SERVER_PARAM,
                     SSL_R_CALLBACK_FAILED);
            return 0;
        }
    } else if (!SRP_check_known_gN_param(srp->g, srp->N)) {
        SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
                 SSL_R_INSUFFICIENT_SECURITY);
        return 0;
    }

    return 1;
}

int SRP_Calc_A_param(SSL *s)
{
    unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];

    if (RAND_priv_bytes(rnd, sizeof(rnd)) <= 0)
        return 0;
    s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
    OPENSSL_cleanse(rnd, sizeof(rnd));

    if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g)))
        return 0;

    return 1;
}

BIGNUM *SSL_get_srp_g(SSL *s)
{
    if (s->srp_ctx.g != NULL)
        return s->srp_ctx.g;
    return s->ctx->srp_ctx.g;
}

BIGNUM *SSL_get_srp_N(SSL *s)
{
    if (s->srp_ctx.N != NULL)
        return s->srp_ctx.N;
    return s->ctx->srp_ctx.N;
}

char *SSL_get_srp_username(SSL *s)
{
    if (s->srp_ctx.login != NULL)
        return s->srp_ctx.login;
    return s->ctx->srp_ctx.login;
}

char *SSL_get_srp_userinfo(SSL *s)
{
    if (s->srp_ctx.info != NULL)
        return s->srp_ctx.info;
    return s->ctx->srp_ctx.info;
}

# define tls1_ctx_ctrl ssl3_ctx_ctrl
# define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl

int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
}

int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
}

int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
                         NULL);
}

int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,
                                          int (*cb) (SSL *, void *))
{
    return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
                                  (void (*)(void))cb);
}

int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
}

int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
                                      int (*cb) (SSL *, int *, void *))
{
    return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
                                  (void (*)(void))cb);
}

int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,
                                        char *(*cb) (SSL *, void *))
{
    return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
                                  (void (*)(void))cb);
}

#endif

Coverage Report

Created: 2018-08-29 13:53

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
3		* Copyright (c) 2004, EdelKey Project. All Rights Reserved.
4		*
5		* Licensed under the OpenSSL license (the "License"). You may not use
6		* this file except in compliance with the License. You can obtain a copy
7		* in the file LICENSE in the source distribution or at
8		* https://www.openssl.org/source/license.html
9		*
10		* Originally written by Christophe Renou and Peter Sylvester,
11		* for the EdelKey project.
12		*/
13
14		#include <openssl/crypto.h>
15		#include <openssl/rand.h>
16		#include <openssl/err.h>
17		#include "ssl_locl.h"
18
19		#ifndef OPENSSL_NO_SRP
20		# include <openssl/srp.h>
21
22		int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
23	0	{
24	0	if (ctx == NULL)
25	0	return 0;
26	0	OPENSSL_free(ctx->srp_ctx.login);
27	0	OPENSSL_free(ctx->srp_ctx.info);
28	0	BN_free(ctx->srp_ctx.N);
29	0	BN_free(ctx->srp_ctx.g);
30	0	BN_free(ctx->srp_ctx.s);
31	0	BN_free(ctx->srp_ctx.B);
32	0	BN_free(ctx->srp_ctx.A);
33	0	BN_free(ctx->srp_ctx.a);
34	0	BN_free(ctx->srp_ctx.b);
35	0	BN_free(ctx->srp_ctx.v);
36	0	memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
37	0	ctx->srp_ctx.strength = SRP_MINIMAL_N;
38	0	return 1;
39	0	}
40
41		int SSL_SRP_CTX_free(struct ssl_st *s)
42	0	{
43	0	if (s == NULL)
44	0	return 0;
45	0	OPENSSL_free(s->srp_ctx.login);
46	0	OPENSSL_free(s->srp_ctx.info);
47	0	BN_free(s->srp_ctx.N);
48	0	BN_free(s->srp_ctx.g);
49	0	BN_free(s->srp_ctx.s);
50	0	BN_free(s->srp_ctx.B);
51	0	BN_free(s->srp_ctx.A);
52	0	BN_free(s->srp_ctx.a);
53	0	BN_free(s->srp_ctx.b);
54	0	BN_free(s->srp_ctx.v);
55	0	memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
56	0	s->srp_ctx.strength = SRP_MINIMAL_N;
57	0	return 1;
58	0	}
59
60		int SSL_SRP_CTX_init(struct ssl_st *s)
61	0	{
62	0	SSL_CTX *ctx;
63	0
64	0	if ((s == NULL) \|\| ((ctx = s->ctx) == NULL))
65	0	return 0;
66	0
67	0	memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
68	0
69	0	s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg;
70	0	/* set client Hello login callback */
71	0	s->srp_ctx.TLS_ext_srp_username_callback =
72	0	ctx->srp_ctx.TLS_ext_srp_username_callback;
73	0	/* set SRP N/g param callback for verification */
74	0	s->srp_ctx.SRP_verify_param_callback =
75	0	ctx->srp_ctx.SRP_verify_param_callback;
76	0	/* set SRP client passwd callback */
77	0	s->srp_ctx.SRP_give_srp_client_pwd_callback =
78	0	ctx->srp_ctx.SRP_give_srp_client_pwd_callback;
79	0
80	0	s->srp_ctx.strength = ctx->srp_ctx.strength;
81	0
82	0	if (((ctx->srp_ctx.N != NULL) &&
83	0	((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) \|\|
84	0	((ctx->srp_ctx.g != NULL) &&
85	0	((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) \|\|
86	0	((ctx->srp_ctx.s != NULL) &&
87	0	((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) \|\|
88	0	((ctx->srp_ctx.B != NULL) &&
89	0	((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) \|\|
90	0	((ctx->srp_ctx.A != NULL) &&
91	0	((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) \|\|
92	0	((ctx->srp_ctx.a != NULL) &&
93	0	((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) \|\|
94	0	((ctx->srp_ctx.v != NULL) &&
95	0	((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) \|\|
96	0	((ctx->srp_ctx.b != NULL) &&
97	0	((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
98	0	SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
99	0	goto err;
100	0	}
101	0	if ((ctx->srp_ctx.login != NULL) &&
102	0	((s->srp_ctx.login = OPENSSL_strdup(ctx->srp_ctx.login)) == NULL)) {
103	0	SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
104	0	goto err;
105	0	}
106	0	if ((ctx->srp_ctx.info != NULL) &&
107	0	((s->srp_ctx.info = BUF_strdup(ctx->srp_ctx.info)) == NULL)) {
108	0	SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
109	0	goto err;
110	0	}
111	0	s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;
112	0
113	0	return 1;
114	0	err:
115	0	OPENSSL_free(s->srp_ctx.login);
116	0	OPENSSL_free(s->srp_ctx.info);
117	0	BN_free(s->srp_ctx.N);
118	0	BN_free(s->srp_ctx.g);
119	0	BN_free(s->srp_ctx.s);
120	0	BN_free(s->srp_ctx.B);
121	0	BN_free(s->srp_ctx.A);
122	0	BN_free(s->srp_ctx.a);
123	0	BN_free(s->srp_ctx.b);
124	0	BN_free(s->srp_ctx.v);
125	0	memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
126	0	return 0;
127	0	}
128
129		int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
130	0	{
131	0	if (ctx == NULL)
132	0	return 0;
133	0
134	0	memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
135	0	ctx->srp_ctx.strength = SRP_MINIMAL_N;
136	0
137	0	return 1;
138	0	}
139
140		/* server side */
141		int SSL_srp_server_param_with_username(SSL s, int ad)
142	0	{
143	0	unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
144	0	int al;
145	0
146	0	*ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
147	0	if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) &&
148	0	((al =
149	0	s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
150	0	s->srp_ctx.SRP_cb_arg)) !=
151	0	SSL_ERROR_NONE))
152	0	return al;
153	0
154	0	*ad = SSL_AD_INTERNAL_ERROR;
155	0	if ((s->srp_ctx.N == NULL) \|\|
156	0	(s->srp_ctx.g == NULL) \|\|
157	0	(s->srp_ctx.s == NULL) \|\| (s->srp_ctx.v == NULL))
158	0	return SSL3_AL_FATAL;
159	0
160	0	if (RAND_priv_bytes(b, sizeof(b)) <= 0)
161	0	return SSL3_AL_FATAL;
162	0	s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
163	0	OPENSSL_cleanse(b, sizeof(b));
164	0
165	0	/* Calculate: B = (kv + g^b) % N */
166	0
167	0	return ((s->srp_ctx.B =
168	0	SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
169	0	s->srp_ctx.v)) !=
170	0	NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
171	0	}
172
173		/*
174		* If the server just has the raw password, make up a verifier entry on the
175		* fly
176		*/
177		int SSL_set_srp_server_param_pw(SSL s, const char user, const char *pass,
178		const char *grp)
179	0	{
180	0	SRP_gN *GN = SRP_get_default_gN(grp);
181	0	if (GN == NULL)
182	0	return -1;
183	0	s->srp_ctx.N = BN_dup(GN->N);
184	0	s->srp_ctx.g = BN_dup(GN->g);
185	0	BN_clear_free(s->srp_ctx.v);
186	0	s->srp_ctx.v = NULL;
187	0	BN_clear_free(s->srp_ctx.s);
188	0	s->srp_ctx.s = NULL;
189	0	if (!SRP_create_verifier_BN
190	0	(user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g))
191	0	return -1;
192	0
193	0	return 1;
194	0	}
195
196		int SSL_set_srp_server_param(SSL s, const BIGNUM N, const BIGNUM *g,
197		BIGNUM sa, BIGNUM v, char *info)
198	0	{
199	0	if (N != NULL) {
200	0	if (s->srp_ctx.N != NULL) {
201	0	if (!BN_copy(s->srp_ctx.N, N)) {
202	0	BN_free(s->srp_ctx.N);
203	0	s->srp_ctx.N = NULL;
204	0	}
205	0	} else
206	0	s->srp_ctx.N = BN_dup(N);
207	0	}
208	0	if (g != NULL) {
209	0	if (s->srp_ctx.g != NULL) {
210	0	if (!BN_copy(s->srp_ctx.g, g)) {
211	0	BN_free(s->srp_ctx.g);
212	0	s->srp_ctx.g = NULL;
213	0	}
214	0	} else
215	0	s->srp_ctx.g = BN_dup(g);
216	0	}
217	0	if (sa != NULL) {
218	0	if (s->srp_ctx.s != NULL) {
219	0	if (!BN_copy(s->srp_ctx.s, sa)) {
220	0	BN_free(s->srp_ctx.s);
221	0	s->srp_ctx.s = NULL;
222	0	}
223	0	} else
224	0	s->srp_ctx.s = BN_dup(sa);
225	0	}
226	0	if (v != NULL) {
227	0	if (s->srp_ctx.v != NULL) {
228	0	if (!BN_copy(s->srp_ctx.v, v)) {
229	0	BN_free(s->srp_ctx.v);
230	0	s->srp_ctx.v = NULL;
231	0	}
232	0	} else
233	0	s->srp_ctx.v = BN_dup(v);
234	0	}
235	0	if (info != NULL) {
236	0	if (s->srp_ctx.info)
237	0	OPENSSL_free(s->srp_ctx.info);
238	0	if ((s->srp_ctx.info = BUF_strdup(info)) == NULL)
239	0	return -1;
240	0	}
241	0
242	0	if (!(s->srp_ctx.N) \|\|
243	0	!(s->srp_ctx.g) \|\| !(s->srp_ctx.s) \|\| !(s->srp_ctx.v))
244	0	return -1;
245	0
246	0	return 1;
247	0	}
248
249		int srp_generate_server_master_secret(SSL *s)
250	0	{
251	0	BIGNUM K = NULL, u = NULL;
252	0	int ret = -1, tmp_len = 0;
253	0	unsigned char *tmp = NULL;
254	0
255	0	if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
256	0	goto err;
257	0	if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL)
258	0	goto err;
259	0	if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
260	0	s->srp_ctx.N)) == NULL)
261	0	goto err;
262	0
263	0	tmp_len = BN_num_bytes(K);
264	0	if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
265	0	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
266	0	SSL_F_SRP_GENERATE_SERVER_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
267	0	goto err;
268	0	}
269	0	BN_bn2bin(K, tmp);
270	0	/* Calls SSLfatal() as required */
271	0	ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
272	0	err:
273	0	BN_clear_free(K);
274	0	BN_clear_free(u);
275	0	return ret;
276	0	}
277
278		/* client side */
279		int srp_generate_client_master_secret(SSL *s)
280	0	{
281	0	BIGNUM x = NULL, u = NULL, *K = NULL;
282	0	int ret = -1, tmp_len = 0;
283	0	char *passwd = NULL;
284	0	unsigned char *tmp = NULL;
285	0
286	0	/*
287	0	* Checks if b % n == 0
288	0	*/
289	0	if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0
290	0	\|\| (u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N))
291	0	== NULL
292	0	\|\| s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) {
293	0	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
294	0	SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
295	0	goto err;
296	0	}
297	0	if ((passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
298	0	s->srp_ctx.SRP_cb_arg))
299	0	== NULL) {
300	0	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
301	0	SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET,
302	0	SSL_R_CALLBACK_FAILED);
303	0	goto err;
304	0	}
305	0	if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL
306	0	\|\| (K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B,
307	0	s->srp_ctx.g, x,
308	0	s->srp_ctx.a, u)) == NULL) {
309	0	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
310	0	SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
311	0	goto err;
312	0	}
313	0
314	0	tmp_len = BN_num_bytes(K);
315	0	if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
316	0	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
317	0	SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
318	0	goto err;
319	0	}
320	0	BN_bn2bin(K, tmp);
321	0	/* Calls SSLfatal() as required */
322	0	ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
323	0	err:
324	0	BN_clear_free(K);
325	0	BN_clear_free(x);
326	0	if (passwd != NULL)
327	0	OPENSSL_clear_free(passwd, strlen(passwd));
328	0	BN_clear_free(u);
329	0	return ret;
330	0	}
331
332		int srp_verify_server_param(SSL *s)
333	0	{
334	0	SRP_CTX *srp = &s->srp_ctx;
335	0	/*
336	0	* Sanity check parameters: we can quickly check B % N == 0 by checking B
337	0	* != 0 since B < N
338	0	*/
339	0	if (BN_ucmp(srp->g, srp->N) >= 0 \|\| BN_ucmp(srp->B, srp->N) >= 0
340	0	\|\| BN_is_zero(srp->B)) {
341	0	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SRP_VERIFY_SERVER_PARAM,
342	0	SSL_R_BAD_DATA);
343	0	return 0;
344	0	}
345	0
346	0	if (BN_num_bits(srp->N) < srp->strength) {
347	0	SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
348	0	SSL_R_INSUFFICIENT_SECURITY);
349	0	return 0;
350	0	}
351	0
352	0	if (srp->SRP_verify_param_callback) {
353	0	if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) {
354	0	SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY,
355	0	SSL_F_SRP_VERIFY_SERVER_PARAM,
356	0	SSL_R_CALLBACK_FAILED);
357	0	return 0;
358	0	}
359	0	} else if (!SRP_check_known_gN_param(srp->g, srp->N)) {
360	0	SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
361	0	SSL_R_INSUFFICIENT_SECURITY);
362	0	return 0;
363	0	}
364	0
365	0	return 1;
366	0	}
367
368		int SRP_Calc_A_param(SSL *s)
369	0	{
370	0	unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
371	0
372	0	if (RAND_priv_bytes(rnd, sizeof(rnd)) <= 0)
373	0	return 0;
374	0	s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
375	0	OPENSSL_cleanse(rnd, sizeof(rnd));
376	0
377	0	if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g)))
378	0	return 0;
379	0
380	0	return 1;
381	0	}
382
383		BIGNUM SSL_get_srp_g(SSL s)
384	0	{
385	0	if (s->srp_ctx.g != NULL)
386	0	return s->srp_ctx.g;
387	0	return s->ctx->srp_ctx.g;
388	0	}
389
390		BIGNUM SSL_get_srp_N(SSL s)
391	0	{
392	0	if (s->srp_ctx.N != NULL)
393	0	return s->srp_ctx.N;
394	0	return s->ctx->srp_ctx.N;
395	0	}
396
397		char SSL_get_srp_username(SSL s)
398	0	{
399	0	if (s->srp_ctx.login != NULL)
400	0	return s->srp_ctx.login;
401	0	return s->ctx->srp_ctx.login;
402	0	}
403
404		char SSL_get_srp_userinfo(SSL s)
405	0	{
406	0	if (s->srp_ctx.info != NULL)
407	0	return s->srp_ctx.info;
408	0	return s->ctx->srp_ctx.info;
409	0	}
410
411	0	# define tls1_ctx_ctrl ssl3_ctx_ctrl
412	0	# define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl
413
414		int SSL_CTX_set_srp_username(SSL_CTX ctx, char name)
415	0	{
416	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
417	0	}
418
419		int SSL_CTX_set_srp_password(SSL_CTX ctx, char password)
420	0	{
421	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
422	0	}
423
424		int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
425	0	{
426	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
427	0	NULL);
428	0	}
429
430		int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,
431		int (cb) (SSL , void *))
432	0	{
433	0	return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
434	0	(void (*)(void))cb);
435	0	}
436
437		int SSL_CTX_set_srp_cb_arg(SSL_CTX ctx, void arg)
438	0	{
439	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
440	0	}
441
442		int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
443		int (cb) (SSL , int , void ))
444	0	{
445	0	return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
446	0	(void (*)(void))cb);
447	0	}
448
449		int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,
450		char (cb) (SSL , void ))
451	0	{
452	0	return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
453	0	(void (*)(void))cb);
454	0	}
455
456		#endif