mirror of
https://github.com/ossrs/srs.git
synced 2025-03-09 15:49:59 +00:00
AppleM1: Update openssl to v1.1.1l
This commit is contained in:
winlin
parent
1fe12b8e8c
commit
b787656eea
990 changed files with 13406 additions and 18710 deletions
208
trunk/3rdparty/openssl-1.1-fit/ssl/ssl_lib.c
vendored
208
trunk/3rdparty/openssl-1.1-fit/ssl/ssl_lib.c
vendored
|
|
@ -1,5 +1,5 @@
|
|||
/*
|
||||
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
|
||||
* Copyright 2005 Nokia. All rights reserved.
|
||||
*
|
||||
|
|
@ -10,7 +10,7 @@
|
|||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include "ssl_locl.h"
|
||||
#include "ssl_local.h"
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/x509v3.h>
|
||||
#include <openssl/rand.h>
|
||||
|
|
@ -628,6 +628,11 @@ int SSL_clear(SSL *s)
|
|||
/* Clear the verification result peername */
|
||||
X509_VERIFY_PARAM_move_peername(s->param, NULL);
|
||||
|
||||
/* Clear any shared connection state */
|
||||
OPENSSL_free(s->shared_sigalgs);
|
||||
s->shared_sigalgs = NULL;
|
||||
s->shared_sigalgslen = 0;
|
||||
|
||||
/*
|
||||
* Check to see if we were changed into a different method, if so, revert
|
||||
* back.
|
||||
|
|
@ -774,8 +779,10 @@ SSL *SSL_new(SSL_CTX *ctx)
|
|||
s->ext.ecpointformats =
|
||||
OPENSSL_memdup(ctx->ext.ecpointformats,
|
||||
ctx->ext.ecpointformats_len);
|
||||
if (!s->ext.ecpointformats)
|
||||
if (!s->ext.ecpointformats) {
|
||||
s->ext.ecpointformats_len = 0;
|
||||
goto err;
|
||||
}
|
||||
s->ext.ecpointformats_len =
|
||||
ctx->ext.ecpointformats_len;
|
||||
}
|
||||
|
|
@ -784,8 +791,10 @@ SSL *SSL_new(SSL_CTX *ctx)
|
|||
OPENSSL_memdup(ctx->ext.supportedgroups,
|
||||
ctx->ext.supportedgroups_len
|
||||
* sizeof(*ctx->ext.supportedgroups));
|
||||
if (!s->ext.supportedgroups)
|
||||
if (!s->ext.supportedgroups) {
|
||||
s->ext.supportedgroups_len = 0;
|
||||
goto err;
|
||||
}
|
||||
s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
|
||||
}
|
||||
#endif
|
||||
|
|
@ -795,8 +804,10 @@ SSL *SSL_new(SSL_CTX *ctx)
|
|||
|
||||
if (s->ctx->ext.alpn) {
|
||||
s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len);
|
||||
if (s->ext.alpn == NULL)
|
||||
if (s->ext.alpn == NULL) {
|
||||
s->ext.alpn_len = 0;
|
||||
goto err;
|
||||
}
|
||||
memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len);
|
||||
s->ext.alpn_len = s->ctx->ext.alpn_len;
|
||||
}
|
||||
|
|
@ -867,7 +878,7 @@ int SSL_up_ref(SSL *s)
|
|||
int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
|
||||
unsigned int sid_ctx_len)
|
||||
{
|
||||
if (sid_ctx_len > sizeof(ctx->sid_ctx)) {
|
||||
if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
|
||||
SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,
|
||||
SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
|
||||
return 0;
|
||||
|
|
@ -1160,6 +1171,7 @@ void SSL_free(SSL *s)
|
|||
sk_SSL_CIPHER_free(s->cipher_list);
|
||||
sk_SSL_CIPHER_free(s->cipher_list_by_id);
|
||||
sk_SSL_CIPHER_free(s->tls13_ciphersuites);
|
||||
sk_SSL_CIPHER_free(s->peer_ciphers);
|
||||
|
||||
/* Make the next call work :-) */
|
||||
if (s->session != NULL) {
|
||||
|
|
@ -1172,13 +1184,16 @@ void SSL_free(SSL *s)
|
|||
clear_ciphers(s);
|
||||
|
||||
ssl_cert_free(s->cert);
|
||||
OPENSSL_free(s->shared_sigalgs);
|
||||
/* Free up if allocated */
|
||||
|
||||
OPENSSL_free(s->ext.hostname);
|
||||
SSL_CTX_free(s->session_ctx);
|
||||
#ifndef OPENSSL_NO_EC
|
||||
OPENSSL_free(s->ext.ecpointformats);
|
||||
OPENSSL_free(s->ext.peer_ecpointformats);
|
||||
OPENSSL_free(s->ext.supportedgroups);
|
||||
OPENSSL_free(s->ext.peer_supportedgroups);
|
||||
#endif /* OPENSSL_NO_EC */
|
||||
sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
|
||||
#ifndef OPENSSL_NO_OCSP
|
||||
|
|
@ -1191,6 +1206,8 @@ void SSL_free(SSL *s)
|
|||
OPENSSL_free(s->ext.ocsp.resp);
|
||||
OPENSSL_free(s->ext.alpn);
|
||||
OPENSSL_free(s->ext.tls13_cookie);
|
||||
if (s->clienthello != NULL)
|
||||
OPENSSL_free(s->clienthello->pre_proc_exts);
|
||||
OPENSSL_free(s->clienthello);
|
||||
OPENSSL_free(s->pha_context);
|
||||
EVP_MD_CTX_free(s->pha_dgst);
|
||||
|
|
@ -2102,6 +2119,11 @@ int SSL_key_update(SSL *s, int updatetype)
|
|||
return 0;
|
||||
}
|
||||
|
||||
if (RECORD_LAYER_write_pending(&s->rlayer)) {
|
||||
SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_BAD_WRITE_RETRY);
|
||||
return 0;
|
||||
}
|
||||
|
||||
ossl_statem_set_in_init(s, 1);
|
||||
s->key_update = updatetype;
|
||||
return 1;
|
||||
|
|
@ -2437,9 +2459,9 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
|
|||
|
||||
STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s)
|
||||
{
|
||||
if ((s == NULL) || (s->session == NULL) || !s->server)
|
||||
if ((s == NULL) || !s->server)
|
||||
return NULL;
|
||||
return s->session->ciphers;
|
||||
return s->peer_ciphers;
|
||||
}
|
||||
|
||||
STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s)
|
||||
|
|
@ -2578,13 +2600,12 @@ char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
|
|||
int i;
|
||||
|
||||
if (!s->server
|
||||
|| s->session == NULL
|
||||
|| s->session->ciphers == NULL
|
||||
|| s->peer_ciphers == NULL
|
||||
|| size < 2)
|
||||
return NULL;
|
||||
|
||||
p = buf;
|
||||
clntsk = s->session->ciphers;
|
||||
clntsk = s->peer_ciphers;
|
||||
srvrsk = SSL_get_ciphers(s);
|
||||
if (clntsk == NULL || srvrsk == NULL)
|
||||
return NULL;
|
||||
|
|
@ -2615,31 +2636,85 @@ char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
|
|||
return buf;
|
||||
}
|
||||
|
||||
/** return a servername extension value if provided in Client Hello, or NULL.
|
||||
* So far, only host_name types are defined (RFC 3546).
|
||||
/**
|
||||
* Return the requested servername (SNI) value. Note that the behaviour varies
|
||||
* depending on:
|
||||
* - whether this is called by the client or the server,
|
||||
* - if we are before or during/after the handshake,
|
||||
* - if a resumption or normal handshake is being attempted/has occurred
|
||||
* - whether we have negotiated TLSv1.2 (or below) or TLSv1.3
|
||||
*
|
||||
* Note that only the host_name type is defined (RFC 3546).
|
||||
*/
|
||||
|
||||
const char *SSL_get_servername(const SSL *s, const int type)
|
||||
{
|
||||
/*
|
||||
* If we don't know if we are the client or the server yet then we assume
|
||||
* client.
|
||||
*/
|
||||
int server = s->handshake_func == NULL ? 0 : s->server;
|
||||
if (type != TLSEXT_NAMETYPE_host_name)
|
||||
return NULL;
|
||||
|
||||
/*
|
||||
* SNI is not negotiated in pre-TLS-1.3 resumption flows, so fake up an
|
||||
* SNI value to return if we are resuming/resumed. N.B. that we still
|
||||
* call the relevant callbacks for such resumption flows, and callbacks
|
||||
* might error out if there is not a SNI value available.
|
||||
*/
|
||||
if (s->hit)
|
||||
return s->session->ext.hostname;
|
||||
if (server) {
|
||||
/**
|
||||
* Server side
|
||||
* In TLSv1.3 on the server SNI is not associated with the session
|
||||
* but in TLSv1.2 or below it is.
|
||||
*
|
||||
* Before the handshake:
|
||||
* - return NULL
|
||||
*
|
||||
* During/after the handshake (TLSv1.2 or below resumption occurred):
|
||||
* - If a servername was accepted by the server in the original
|
||||
* handshake then it will return that servername, or NULL otherwise.
|
||||
*
|
||||
* During/after the handshake (TLSv1.2 or below resumption did not occur):
|
||||
* - The function will return the servername requested by the client in
|
||||
* this handshake or NULL if none was requested.
|
||||
*/
|
||||
if (s->hit && !SSL_IS_TLS13(s))
|
||||
return s->session->ext.hostname;
|
||||
} else {
|
||||
/**
|
||||
* Client side
|
||||
*
|
||||
* Before the handshake:
|
||||
* - If a servername has been set via a call to
|
||||
* SSL_set_tlsext_host_name() then it will return that servername
|
||||
* - If one has not been set, but a TLSv1.2 resumption is being
|
||||
* attempted and the session from the original handshake had a
|
||||
* servername accepted by the server then it will return that
|
||||
* servername
|
||||
* - Otherwise it returns NULL
|
||||
*
|
||||
* During/after the handshake (TLSv1.2 or below resumption occurred):
|
||||
* - If the session from the original handshake had a servername accepted
|
||||
* by the server then it will return that servername.
|
||||
* - Otherwise it returns the servername set via
|
||||
* SSL_set_tlsext_host_name() (or NULL if it was not called).
|
||||
*
|
||||
* During/after the handshake (TLSv1.2 or below resumption did not occur):
|
||||
* - It will return the servername set via SSL_set_tlsext_host_name()
|
||||
* (or NULL if it was not called).
|
||||
*/
|
||||
if (SSL_in_before(s)) {
|
||||
if (s->ext.hostname == NULL
|
||||
&& s->session != NULL
|
||||
&& s->session->ssl_version != TLS1_3_VERSION)
|
||||
return s->session->ext.hostname;
|
||||
} else {
|
||||
if (!SSL_IS_TLS13(s) && s->hit && s->session->ext.hostname != NULL)
|
||||
return s->session->ext.hostname;
|
||||
}
|
||||
}
|
||||
|
||||
return s->ext.hostname;
|
||||
}
|
||||
|
||||
int SSL_get_servername_type(const SSL *s)
|
||||
{
|
||||
if (s->session
|
||||
&& (!s->ext.hostname ? s->session->
|
||||
ext.hostname : s->ext.hostname))
|
||||
if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL)
|
||||
return TLSEXT_NAMETYPE_host_name;
|
||||
return -1;
|
||||
}
|
||||
|
|
@ -2759,6 +2834,19 @@ void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
|
|||
}
|
||||
#endif
|
||||
|
||||
static int alpn_value_ok(const unsigned char *protos, unsigned int protos_len)
|
||||
{
|
||||
unsigned int idx;
|
||||
|
||||
if (protos_len < 2 || protos == NULL)
|
||||
return 0;
|
||||
|
||||
for (idx = 0; idx < protos_len; idx += protos[idx] + 1) {
|
||||
if (protos[idx] == 0)
|
||||
return 0;
|
||||
}
|
||||
return idx == protos_len;
|
||||
}
|
||||
/*
|
||||
* SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|.
|
||||
* |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
|
||||
|
|
@ -2767,12 +2855,25 @@ void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
|
|||
int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
|
||||
unsigned int protos_len)
|
||||
{
|
||||
OPENSSL_free(ctx->ext.alpn);
|
||||
ctx->ext.alpn = OPENSSL_memdup(protos, protos_len);
|
||||
if (ctx->ext.alpn == NULL) {
|
||||
unsigned char *alpn;
|
||||
|
||||
if (protos_len == 0 || protos == NULL) {
|
||||
OPENSSL_free(ctx->ext.alpn);
|
||||
ctx->ext.alpn = NULL;
|
||||
ctx->ext.alpn_len = 0;
|
||||
return 0;
|
||||
}
|
||||
/* Not valid per RFC */
|
||||
if (!alpn_value_ok(protos, protos_len))
|
||||
return 1;
|
||||
|
||||
alpn = OPENSSL_memdup(protos, protos_len);
|
||||
if (alpn == NULL) {
|
||||
SSLerr(SSL_F_SSL_CTX_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
|
||||
return 1;
|
||||
}
|
||||
OPENSSL_free(ctx->ext.alpn);
|
||||
ctx->ext.alpn = alpn;
|
||||
ctx->ext.alpn_len = protos_len;
|
||||
|
||||
return 0;
|
||||
|
|
@ -2786,12 +2887,25 @@ int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
|
|||
int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
|
||||
unsigned int protos_len)
|
||||
{
|
||||
OPENSSL_free(ssl->ext.alpn);
|
||||
ssl->ext.alpn = OPENSSL_memdup(protos, protos_len);
|
||||
if (ssl->ext.alpn == NULL) {
|
||||
unsigned char *alpn;
|
||||
|
||||
if (protos_len == 0 || protos == NULL) {
|
||||
OPENSSL_free(ssl->ext.alpn);
|
||||
ssl->ext.alpn = NULL;
|
||||
ssl->ext.alpn_len = 0;
|
||||
return 0;
|
||||
}
|
||||
/* Not valid per RFC */
|
||||
if (!alpn_value_ok(protos, protos_len))
|
||||
return 1;
|
||||
|
||||
alpn = OPENSSL_memdup(protos, protos_len);
|
||||
if (alpn == NULL) {
|
||||
SSLerr(SSL_F_SSL_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
|
||||
return 1;
|
||||
}
|
||||
OPENSSL_free(ssl->ext.alpn);
|
||||
ssl->ext.alpn = alpn;
|
||||
ssl->ext.alpn_len = protos_len;
|
||||
|
||||
return 0;
|
||||
|
|
@ -2833,7 +2947,8 @@ int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
|
|||
const unsigned char *context, size_t contextlen,
|
||||
int use_context)
|
||||
{
|
||||
if (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER)
|
||||
if (s->session == NULL
|
||||
|| (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER))
|
||||
return -1;
|
||||
|
||||
return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
|
||||
|
|
@ -3762,6 +3877,8 @@ SSL *SSL_dup(SSL *s)
|
|||
goto err;
|
||||
ret->version = s->version;
|
||||
ret->options = s->options;
|
||||
ret->min_proto_version = s->min_proto_version;
|
||||
ret->max_proto_version = s->max_proto_version;
|
||||
ret->mode = s->mode;
|
||||
SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
|
||||
SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
|
||||
|
|
@ -3777,21 +3894,6 @@ SSL *SSL_dup(SSL *s)
|
|||
if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
|
||||
goto err;
|
||||
|
||||
/* setup rbio, and wbio */
|
||||
if (s->rbio != NULL) {
|
||||
if (!BIO_dup_state(s->rbio, (char *)&ret->rbio))
|
||||
goto err;
|
||||
}
|
||||
if (s->wbio != NULL) {
|
||||
if (s->wbio != s->rbio) {
|
||||
if (!BIO_dup_state(s->wbio, (char *)&ret->wbio))
|
||||
goto err;
|
||||
} else {
|
||||
BIO_up_ref(ret->rbio);
|
||||
ret->wbio = ret->rbio;
|
||||
}
|
||||
}
|
||||
|
||||
ret->server = s->server;
|
||||
if (s->handshake_func) {
|
||||
if (s->server)
|
||||
|
|
@ -4460,8 +4562,11 @@ int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
|
|||
}
|
||||
|
||||
ctx = EVP_MD_CTX_new();
|
||||
if (ctx == NULL)
|
||||
if (ctx == NULL) {
|
||||
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
|
||||
ERR_R_INTERNAL_ERROR);
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
|
||||
|| EVP_DigestFinal_ex(ctx, out, NULL) <= 0) {
|
||||
|
|
@ -4478,7 +4583,7 @@ int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
|
|||
return ret;
|
||||
}
|
||||
|
||||
int SSL_session_reused(SSL *s)
|
||||
int SSL_session_reused(const SSL *s)
|
||||
{
|
||||
return s->hit;
|
||||
}
|
||||
|
|
@ -5070,6 +5175,11 @@ int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
|
|||
if (ext->present)
|
||||
num++;
|
||||
}
|
||||
if (num == 0) {
|
||||
*out = NULL;
|
||||
*outlen = 0;
|
||||
return 1;
|
||||
}
|
||||
if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
|
||||
SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
|
||||
ERR_R_MALLOC_FAILURE);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue