1*0Sstevel@tonic-gate /* ssl/ssl_asn1.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate #include <stdio.h> 60*0Sstevel@tonic-gate #include <stdlib.h> 61*0Sstevel@tonic-gate #include "ssl_locl.h" 62*0Sstevel@tonic-gate #include <openssl/asn1_mac.h> 63*0Sstevel@tonic-gate #include <openssl/objects.h> 64*0Sstevel@tonic-gate #include <openssl/x509.h> 65*0Sstevel@tonic-gate 66*0Sstevel@tonic-gate typedef struct ssl_session_asn1_st 67*0Sstevel@tonic-gate { 68*0Sstevel@tonic-gate ASN1_INTEGER version; 69*0Sstevel@tonic-gate ASN1_INTEGER ssl_version; 70*0Sstevel@tonic-gate ASN1_OCTET_STRING cipher; 71*0Sstevel@tonic-gate ASN1_OCTET_STRING master_key; 72*0Sstevel@tonic-gate ASN1_OCTET_STRING session_id; 73*0Sstevel@tonic-gate ASN1_OCTET_STRING session_id_context; 74*0Sstevel@tonic-gate ASN1_OCTET_STRING key_arg; 75*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 76*0Sstevel@tonic-gate ASN1_OCTET_STRING krb5_princ; 77*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 78*0Sstevel@tonic-gate ASN1_INTEGER time; 79*0Sstevel@tonic-gate ASN1_INTEGER timeout; 80*0Sstevel@tonic-gate ASN1_INTEGER verify_result; 81*0Sstevel@tonic-gate } SSL_SESSION_ASN1; 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp) 84*0Sstevel@tonic-gate { 85*0Sstevel@tonic-gate #define LSIZE2 (sizeof(long)*2) 86*0Sstevel@tonic-gate int v1=0,v2=0,v3=0,v4=0,v5=0; 87*0Sstevel@tonic-gate unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2]; 88*0Sstevel@tonic-gate unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2]; 89*0Sstevel@tonic-gate long l; 90*0Sstevel@tonic-gate SSL_SESSION_ASN1 a; 91*0Sstevel@tonic-gate M_ASN1_I2D_vars(in); 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0))) 94*0Sstevel@tonic-gate return(0); 95*0Sstevel@tonic-gate 96*0Sstevel@tonic-gate /* Note that I cheat in the following 2 assignments. I know 97*0Sstevel@tonic-gate * that if the ASN1_INTEGER passed to ASN1_INTEGER_set 98*0Sstevel@tonic-gate * is > sizeof(long)+1, the buffer will not be re-OPENSSL_malloc()ed. 99*0Sstevel@tonic-gate * This is a bit evil but makes things simple, no dynamic allocation 100*0Sstevel@tonic-gate * to clean up :-) */ 101*0Sstevel@tonic-gate a.version.length=LSIZE2; 102*0Sstevel@tonic-gate a.version.type=V_ASN1_INTEGER; 103*0Sstevel@tonic-gate a.version.data=ibuf1; 104*0Sstevel@tonic-gate ASN1_INTEGER_set(&(a.version),SSL_SESSION_ASN1_VERSION); 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate a.ssl_version.length=LSIZE2; 107*0Sstevel@tonic-gate a.ssl_version.type=V_ASN1_INTEGER; 108*0Sstevel@tonic-gate a.ssl_version.data=ibuf2; 109*0Sstevel@tonic-gate ASN1_INTEGER_set(&(a.ssl_version),in->ssl_version); 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate a.cipher.type=V_ASN1_OCTET_STRING; 112*0Sstevel@tonic-gate a.cipher.data=buf; 113*0Sstevel@tonic-gate 114*0Sstevel@tonic-gate if (in->cipher == NULL) 115*0Sstevel@tonic-gate l=in->cipher_id; 116*0Sstevel@tonic-gate else 117*0Sstevel@tonic-gate l=in->cipher->id; 118*0Sstevel@tonic-gate if (in->ssl_version == SSL2_VERSION) 119*0Sstevel@tonic-gate { 120*0Sstevel@tonic-gate a.cipher.length=3; 121*0Sstevel@tonic-gate buf[0]=((unsigned char)(l>>16L))&0xff; 122*0Sstevel@tonic-gate buf[1]=((unsigned char)(l>> 8L))&0xff; 123*0Sstevel@tonic-gate buf[2]=((unsigned char)(l ))&0xff; 124*0Sstevel@tonic-gate } 125*0Sstevel@tonic-gate else 126*0Sstevel@tonic-gate { 127*0Sstevel@tonic-gate a.cipher.length=2; 128*0Sstevel@tonic-gate buf[0]=((unsigned char)(l>>8L))&0xff; 129*0Sstevel@tonic-gate buf[1]=((unsigned char)(l ))&0xff; 130*0Sstevel@tonic-gate } 131*0Sstevel@tonic-gate 132*0Sstevel@tonic-gate a.master_key.length=in->master_key_length; 133*0Sstevel@tonic-gate a.master_key.type=V_ASN1_OCTET_STRING; 134*0Sstevel@tonic-gate a.master_key.data=in->master_key; 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate a.session_id.length=in->session_id_length; 137*0Sstevel@tonic-gate a.session_id.type=V_ASN1_OCTET_STRING; 138*0Sstevel@tonic-gate a.session_id.data=in->session_id; 139*0Sstevel@tonic-gate 140*0Sstevel@tonic-gate a.session_id_context.length=in->sid_ctx_length; 141*0Sstevel@tonic-gate a.session_id_context.type=V_ASN1_OCTET_STRING; 142*0Sstevel@tonic-gate a.session_id_context.data=in->sid_ctx; 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate a.key_arg.length=in->key_arg_length; 145*0Sstevel@tonic-gate a.key_arg.type=V_ASN1_OCTET_STRING; 146*0Sstevel@tonic-gate a.key_arg.data=in->key_arg; 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 149*0Sstevel@tonic-gate if (in->krb5_client_princ_len) 150*0Sstevel@tonic-gate { 151*0Sstevel@tonic-gate a.krb5_princ.length=in->krb5_client_princ_len; 152*0Sstevel@tonic-gate a.krb5_princ.type=V_ASN1_OCTET_STRING; 153*0Sstevel@tonic-gate a.krb5_princ.data=in->krb5_client_princ; 154*0Sstevel@tonic-gate } 155*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate if (in->time != 0L) 158*0Sstevel@tonic-gate { 159*0Sstevel@tonic-gate a.time.length=LSIZE2; 160*0Sstevel@tonic-gate a.time.type=V_ASN1_INTEGER; 161*0Sstevel@tonic-gate a.time.data=ibuf3; 162*0Sstevel@tonic-gate ASN1_INTEGER_set(&(a.time),in->time); 163*0Sstevel@tonic-gate } 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate if (in->timeout != 0L) 166*0Sstevel@tonic-gate { 167*0Sstevel@tonic-gate a.timeout.length=LSIZE2; 168*0Sstevel@tonic-gate a.timeout.type=V_ASN1_INTEGER; 169*0Sstevel@tonic-gate a.timeout.data=ibuf4; 170*0Sstevel@tonic-gate ASN1_INTEGER_set(&(a.timeout),in->timeout); 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate if (in->verify_result != X509_V_OK) 174*0Sstevel@tonic-gate { 175*0Sstevel@tonic-gate a.verify_result.length=LSIZE2; 176*0Sstevel@tonic-gate a.verify_result.type=V_ASN1_INTEGER; 177*0Sstevel@tonic-gate a.verify_result.data=ibuf5; 178*0Sstevel@tonic-gate ASN1_INTEGER_set(&a.verify_result,in->verify_result); 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER); 183*0Sstevel@tonic-gate M_ASN1_I2D_len(&(a.ssl_version), i2d_ASN1_INTEGER); 184*0Sstevel@tonic-gate M_ASN1_I2D_len(&(a.cipher), i2d_ASN1_OCTET_STRING); 185*0Sstevel@tonic-gate M_ASN1_I2D_len(&(a.session_id), i2d_ASN1_OCTET_STRING); 186*0Sstevel@tonic-gate M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING); 187*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 188*0Sstevel@tonic-gate if (in->krb5_client_princ_len) 189*0Sstevel@tonic-gate M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING); 190*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 191*0Sstevel@tonic-gate if (in->key_arg_length > 0) 192*0Sstevel@tonic-gate M_ASN1_I2D_len_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING); 193*0Sstevel@tonic-gate if (in->time != 0L) 194*0Sstevel@tonic-gate M_ASN1_I2D_len_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); 195*0Sstevel@tonic-gate if (in->timeout != 0L) 196*0Sstevel@tonic-gate M_ASN1_I2D_len_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); 197*0Sstevel@tonic-gate if (in->peer != NULL) 198*0Sstevel@tonic-gate M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3); 199*0Sstevel@tonic-gate M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4); 200*0Sstevel@tonic-gate if (in->verify_result != X509_V_OK) 201*0Sstevel@tonic-gate M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5); 202*0Sstevel@tonic-gate 203*0Sstevel@tonic-gate M_ASN1_I2D_seq_total(); 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate M_ASN1_I2D_put(&(a.version), i2d_ASN1_INTEGER); 206*0Sstevel@tonic-gate M_ASN1_I2D_put(&(a.ssl_version), i2d_ASN1_INTEGER); 207*0Sstevel@tonic-gate M_ASN1_I2D_put(&(a.cipher), i2d_ASN1_OCTET_STRING); 208*0Sstevel@tonic-gate M_ASN1_I2D_put(&(a.session_id), i2d_ASN1_OCTET_STRING); 209*0Sstevel@tonic-gate M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING); 210*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 211*0Sstevel@tonic-gate if (in->krb5_client_princ_len) 212*0Sstevel@tonic-gate M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING); 213*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 214*0Sstevel@tonic-gate if (in->key_arg_length > 0) 215*0Sstevel@tonic-gate M_ASN1_I2D_put_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING,0); 216*0Sstevel@tonic-gate if (in->time != 0L) 217*0Sstevel@tonic-gate M_ASN1_I2D_put_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); 218*0Sstevel@tonic-gate if (in->timeout != 0L) 219*0Sstevel@tonic-gate M_ASN1_I2D_put_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); 220*0Sstevel@tonic-gate if (in->peer != NULL) 221*0Sstevel@tonic-gate M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3); 222*0Sstevel@tonic-gate M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4, 223*0Sstevel@tonic-gate v4); 224*0Sstevel@tonic-gate if (in->verify_result != X509_V_OK) 225*0Sstevel@tonic-gate M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5); 226*0Sstevel@tonic-gate M_ASN1_I2D_finish(); 227*0Sstevel@tonic-gate } 228*0Sstevel@tonic-gate 229*0Sstevel@tonic-gate SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp, 230*0Sstevel@tonic-gate long length) 231*0Sstevel@tonic-gate { 232*0Sstevel@tonic-gate int version,ssl_version=0,i; 233*0Sstevel@tonic-gate long id; 234*0Sstevel@tonic-gate ASN1_INTEGER ai,*aip; 235*0Sstevel@tonic-gate ASN1_OCTET_STRING os,*osp; 236*0Sstevel@tonic-gate M_ASN1_D2I_vars(a,SSL_SESSION *,SSL_SESSION_new); 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate aip= &ai; 239*0Sstevel@tonic-gate osp= &os; 240*0Sstevel@tonic-gate 241*0Sstevel@tonic-gate M_ASN1_D2I_Init(); 242*0Sstevel@tonic-gate M_ASN1_D2I_start_sequence(); 243*0Sstevel@tonic-gate 244*0Sstevel@tonic-gate ai.data=NULL; ai.length=0; 245*0Sstevel@tonic-gate M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER); 246*0Sstevel@tonic-gate version=(int)ASN1_INTEGER_get(aip); 247*0Sstevel@tonic-gate if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate /* we don't care about the version right now :-) */ 250*0Sstevel@tonic-gate M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER); 251*0Sstevel@tonic-gate ssl_version=(int)ASN1_INTEGER_get(aip); 252*0Sstevel@tonic-gate ret->ssl_version=ssl_version; 253*0Sstevel@tonic-gate if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate os.data=NULL; os.length=0; 256*0Sstevel@tonic-gate M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); 257*0Sstevel@tonic-gate if (ssl_version == SSL2_VERSION) 258*0Sstevel@tonic-gate { 259*0Sstevel@tonic-gate if (os.length != 3) 260*0Sstevel@tonic-gate { 261*0Sstevel@tonic-gate c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; 262*0Sstevel@tonic-gate goto err; 263*0Sstevel@tonic-gate } 264*0Sstevel@tonic-gate id=0x02000000L| 265*0Sstevel@tonic-gate ((unsigned long)os.data[0]<<16L)| 266*0Sstevel@tonic-gate ((unsigned long)os.data[1]<< 8L)| 267*0Sstevel@tonic-gate (unsigned long)os.data[2]; 268*0Sstevel@tonic-gate } 269*0Sstevel@tonic-gate else if ((ssl_version>>8) == 3) 270*0Sstevel@tonic-gate { 271*0Sstevel@tonic-gate if (os.length != 2) 272*0Sstevel@tonic-gate { 273*0Sstevel@tonic-gate c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; 274*0Sstevel@tonic-gate goto err; 275*0Sstevel@tonic-gate } 276*0Sstevel@tonic-gate id=0x03000000L| 277*0Sstevel@tonic-gate ((unsigned long)os.data[0]<<8L)| 278*0Sstevel@tonic-gate (unsigned long)os.data[1]; 279*0Sstevel@tonic-gate } 280*0Sstevel@tonic-gate else 281*0Sstevel@tonic-gate { 282*0Sstevel@tonic-gate SSLerr(SSL_F_D2I_SSL_SESSION,SSL_R_UNKNOWN_SSL_VERSION); 283*0Sstevel@tonic-gate return(NULL); 284*0Sstevel@tonic-gate } 285*0Sstevel@tonic-gate 286*0Sstevel@tonic-gate ret->cipher=NULL; 287*0Sstevel@tonic-gate ret->cipher_id=id; 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); 290*0Sstevel@tonic-gate if ((ssl_version>>8) == SSL3_VERSION) 291*0Sstevel@tonic-gate i=SSL3_MAX_SSL_SESSION_ID_LENGTH; 292*0Sstevel@tonic-gate else /* if (ssl_version == SSL2_VERSION) */ 293*0Sstevel@tonic-gate i=SSL2_MAX_SSL_SESSION_ID_LENGTH; 294*0Sstevel@tonic-gate 295*0Sstevel@tonic-gate if (os.length > i) 296*0Sstevel@tonic-gate os.length = i; 297*0Sstevel@tonic-gate if (os.length > sizeof ret->session_id) /* can't happen */ 298*0Sstevel@tonic-gate os.length = sizeof ret->session_id; 299*0Sstevel@tonic-gate 300*0Sstevel@tonic-gate ret->session_id_length=os.length; 301*0Sstevel@tonic-gate OPENSSL_assert(os.length <= sizeof ret->session_id); 302*0Sstevel@tonic-gate memcpy(ret->session_id,os.data,os.length); 303*0Sstevel@tonic-gate 304*0Sstevel@tonic-gate M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING); 305*0Sstevel@tonic-gate if (ret->master_key_length > SSL_MAX_MASTER_KEY_LENGTH) 306*0Sstevel@tonic-gate ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; 307*0Sstevel@tonic-gate else 308*0Sstevel@tonic-gate ret->master_key_length=os.length; 309*0Sstevel@tonic-gate memcpy(ret->master_key,os.data,ret->master_key_length); 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate os.length=0; 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 314*0Sstevel@tonic-gate os.length=0; 315*0Sstevel@tonic-gate M_ASN1_D2I_get_opt(osp,d2i_ASN1_OCTET_STRING,V_ASN1_OCTET_STRING); 316*0Sstevel@tonic-gate if (os.data) 317*0Sstevel@tonic-gate { 318*0Sstevel@tonic-gate if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH) 319*0Sstevel@tonic-gate ret->krb5_client_princ_len=0; 320*0Sstevel@tonic-gate else 321*0Sstevel@tonic-gate ret->krb5_client_princ_len=os.length; 322*0Sstevel@tonic-gate memcpy(ret->krb5_client_princ,os.data,ret->krb5_client_princ_len); 323*0Sstevel@tonic-gate OPENSSL_free(os.data); 324*0Sstevel@tonic-gate os.data = NULL; 325*0Sstevel@tonic-gate os.length = 0; 326*0Sstevel@tonic-gate } 327*0Sstevel@tonic-gate else 328*0Sstevel@tonic-gate ret->krb5_client_princ_len=0; 329*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 330*0Sstevel@tonic-gate 331*0Sstevel@tonic-gate M_ASN1_D2I_get_IMP_opt(osp,d2i_ASN1_OCTET_STRING,0,V_ASN1_OCTET_STRING); 332*0Sstevel@tonic-gate if (os.length > SSL_MAX_KEY_ARG_LENGTH) 333*0Sstevel@tonic-gate ret->key_arg_length=SSL_MAX_KEY_ARG_LENGTH; 334*0Sstevel@tonic-gate else 335*0Sstevel@tonic-gate ret->key_arg_length=os.length; 336*0Sstevel@tonic-gate memcpy(ret->key_arg,os.data,ret->key_arg_length); 337*0Sstevel@tonic-gate if (os.data != NULL) OPENSSL_free(os.data); 338*0Sstevel@tonic-gate 339*0Sstevel@tonic-gate ai.length=0; 340*0Sstevel@tonic-gate M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,1); 341*0Sstevel@tonic-gate if (ai.data != NULL) 342*0Sstevel@tonic-gate { 343*0Sstevel@tonic-gate ret->time=ASN1_INTEGER_get(aip); 344*0Sstevel@tonic-gate OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; 345*0Sstevel@tonic-gate } 346*0Sstevel@tonic-gate else 347*0Sstevel@tonic-gate ret->time=time(NULL); 348*0Sstevel@tonic-gate 349*0Sstevel@tonic-gate ai.length=0; 350*0Sstevel@tonic-gate M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,2); 351*0Sstevel@tonic-gate if (ai.data != NULL) 352*0Sstevel@tonic-gate { 353*0Sstevel@tonic-gate ret->timeout=ASN1_INTEGER_get(aip); 354*0Sstevel@tonic-gate OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate else 357*0Sstevel@tonic-gate ret->timeout=3; 358*0Sstevel@tonic-gate 359*0Sstevel@tonic-gate if (ret->peer != NULL) 360*0Sstevel@tonic-gate { 361*0Sstevel@tonic-gate X509_free(ret->peer); 362*0Sstevel@tonic-gate ret->peer=NULL; 363*0Sstevel@tonic-gate } 364*0Sstevel@tonic-gate M_ASN1_D2I_get_EXP_opt(ret->peer,d2i_X509,3); 365*0Sstevel@tonic-gate 366*0Sstevel@tonic-gate os.length=0; 367*0Sstevel@tonic-gate os.data=NULL; 368*0Sstevel@tonic-gate M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,4); 369*0Sstevel@tonic-gate 370*0Sstevel@tonic-gate if(os.data != NULL) 371*0Sstevel@tonic-gate { 372*0Sstevel@tonic-gate if (os.length > SSL_MAX_SID_CTX_LENGTH) 373*0Sstevel@tonic-gate { 374*0Sstevel@tonic-gate ret->sid_ctx_length=os.length; 375*0Sstevel@tonic-gate SSLerr(SSL_F_D2I_SSL_SESSION,SSL_R_BAD_LENGTH); 376*0Sstevel@tonic-gate } 377*0Sstevel@tonic-gate else 378*0Sstevel@tonic-gate { 379*0Sstevel@tonic-gate ret->sid_ctx_length=os.length; 380*0Sstevel@tonic-gate memcpy(ret->sid_ctx,os.data,os.length); 381*0Sstevel@tonic-gate } 382*0Sstevel@tonic-gate OPENSSL_free(os.data); os.data=NULL; os.length=0; 383*0Sstevel@tonic-gate } 384*0Sstevel@tonic-gate else 385*0Sstevel@tonic-gate ret->sid_ctx_length=0; 386*0Sstevel@tonic-gate 387*0Sstevel@tonic-gate ai.length=0; 388*0Sstevel@tonic-gate M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,5); 389*0Sstevel@tonic-gate if (ai.data != NULL) 390*0Sstevel@tonic-gate { 391*0Sstevel@tonic-gate ret->verify_result=ASN1_INTEGER_get(aip); 392*0Sstevel@tonic-gate OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; 393*0Sstevel@tonic-gate } 394*0Sstevel@tonic-gate else 395*0Sstevel@tonic-gate ret->verify_result=X509_V_OK; 396*0Sstevel@tonic-gate 397*0Sstevel@tonic-gate M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION); 398*0Sstevel@tonic-gate } 399