xref: /openbsd-src/lib/libssl/t1_enc.c (revision 097a140d792de8b2bbe59ad827d39eabf9b4280a)
1 /* $OpenBSD: t1_enc.c,v 1.139 2021/04/25 13:15:22 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer.
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2005 Nokia. All rights reserved.
113  *
114  * The portions of the attached software ("Contribution") is developed by
115  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
116  * license.
117  *
118  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120  * support (see RFC 4279) to OpenSSL.
121  *
122  * No patent licenses or other rights except those expressly stated in
123  * the OpenSSL open source license shall be deemed granted or received
124  * expressly, by implication, estoppel, or otherwise.
125  *
126  * No assurances are provided by Nokia that the Contribution does not
127  * infringe the patent or other intellectual property rights of any third
128  * party or that the license provides you with all the necessary rights
129  * to make use of the Contribution.
130  *
131  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
135  * OTHERWISE.
136  */
137 
138 #include <limits.h>
139 #include <stdio.h>
140 
141 #include "ssl_locl.h"
142 
143 #include <openssl/evp.h>
144 #include <openssl/hmac.h>
145 #include <openssl/md5.h>
146 
147 void
148 tls1_cleanup_key_block(SSL *s)
149 {
150 	freezero(S3I(s)->hs.tls12.key_block, S3I(s)->hs.tls12.key_block_len);
151 	S3I(s)->hs.tls12.key_block = NULL;
152 	S3I(s)->hs.tls12.key_block_len = 0;
153 }
154 
155 /*
156  * TLS P_hash() data expansion function - see RFC 5246, section 5.
157  */
158 static int
159 tls1_P_hash(const EVP_MD *md, const unsigned char *secret, size_t secret_len,
160     const void *seed1, size_t seed1_len, const void *seed2, size_t seed2_len,
161     const void *seed3, size_t seed3_len, const void *seed4, size_t seed4_len,
162     const void *seed5, size_t seed5_len, unsigned char *out, size_t out_len)
163 {
164 	unsigned char A1[EVP_MAX_MD_SIZE], hmac[EVP_MAX_MD_SIZE];
165 	size_t A1_len, hmac_len;
166 	EVP_MD_CTX ctx;
167 	EVP_PKEY *mac_key;
168 	int ret = 0;
169 	int chunk;
170 	size_t i;
171 
172 	chunk = EVP_MD_size(md);
173 	OPENSSL_assert(chunk >= 0);
174 
175 	EVP_MD_CTX_init(&ctx);
176 
177 	mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, secret, secret_len);
178 	if (!mac_key)
179 		goto err;
180 	if (!EVP_DigestSignInit(&ctx, NULL, md, NULL, mac_key))
181 		goto err;
182 	if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
183 		goto err;
184 	if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
185 		goto err;
186 	if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
187 		goto err;
188 	if (seed4 && !EVP_DigestSignUpdate(&ctx, seed4, seed4_len))
189 		goto err;
190 	if (seed5 && !EVP_DigestSignUpdate(&ctx, seed5, seed5_len))
191 		goto err;
192 	if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
193 		goto err;
194 
195 	for (;;) {
196 		if (!EVP_DigestSignInit(&ctx, NULL, md, NULL, mac_key))
197 			goto err;
198 		if (!EVP_DigestSignUpdate(&ctx, A1, A1_len))
199 			goto err;
200 		if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
201 			goto err;
202 		if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
203 			goto err;
204 		if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
205 			goto err;
206 		if (seed4 && !EVP_DigestSignUpdate(&ctx, seed4, seed4_len))
207 			goto err;
208 		if (seed5 && !EVP_DigestSignUpdate(&ctx, seed5, seed5_len))
209 			goto err;
210 		if (!EVP_DigestSignFinal(&ctx, hmac, &hmac_len))
211 			goto err;
212 
213 		if (hmac_len > out_len)
214 			hmac_len = out_len;
215 
216 		for (i = 0; i < hmac_len; i++)
217 			out[i] ^= hmac[i];
218 
219 		out += hmac_len;
220 		out_len -= hmac_len;
221 
222 		if (out_len == 0)
223 			break;
224 
225 		if (!EVP_DigestSignInit(&ctx, NULL, md, NULL, mac_key))
226 			goto err;
227 		if (!EVP_DigestSignUpdate(&ctx, A1, A1_len))
228 			goto err;
229 		if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
230 			goto err;
231 	}
232 	ret = 1;
233 
234  err:
235 	EVP_PKEY_free(mac_key);
236 	EVP_MD_CTX_cleanup(&ctx);
237 
238 	explicit_bzero(A1, sizeof(A1));
239 	explicit_bzero(hmac, sizeof(hmac));
240 
241 	return ret;
242 }
243 
244 int
245 tls1_PRF(SSL *s, const unsigned char *secret, size_t secret_len,
246     const void *seed1, size_t seed1_len, const void *seed2, size_t seed2_len,
247     const void *seed3, size_t seed3_len, const void *seed4, size_t seed4_len,
248     const void *seed5, size_t seed5_len, unsigned char *out, size_t out_len)
249 {
250 	const EVP_MD *md;
251 	size_t half_len;
252 
253 	memset(out, 0, out_len);
254 
255 	if (!ssl_get_handshake_evp_md(s, &md))
256 		return (0);
257 
258 	if (md->type == NID_md5_sha1) {
259 		/*
260 		 * Partition secret between MD5 and SHA1, then XOR result.
261 		 * If the secret length is odd, a one byte overlap is used.
262 		 */
263 		half_len = secret_len - (secret_len / 2);
264 		if (!tls1_P_hash(EVP_md5(), secret, half_len, seed1, seed1_len,
265 		    seed2, seed2_len, seed3, seed3_len, seed4, seed4_len,
266 		    seed5, seed5_len, out, out_len))
267 			return (0);
268 
269 		secret += secret_len - half_len;
270 		if (!tls1_P_hash(EVP_sha1(), secret, half_len, seed1, seed1_len,
271 		    seed2, seed2_len, seed3, seed3_len, seed4, seed4_len,
272 		    seed5, seed5_len, out, out_len))
273 			return (0);
274 
275 		return (1);
276 	}
277 
278 	if (!tls1_P_hash(md, secret, secret_len, seed1, seed1_len,
279 	    seed2, seed2_len, seed3, seed3_len, seed4, seed4_len,
280 	    seed5, seed5_len, out, out_len))
281 		return (0);
282 
283 	return (1);
284 }
285 
286 static int
287 tls1_generate_key_block(SSL *s, uint8_t *key_block, size_t key_block_len)
288 {
289 	return tls1_PRF(s,
290 	    s->session->master_key, s->session->master_key_length,
291 	    TLS_MD_KEY_EXPANSION_CONST, TLS_MD_KEY_EXPANSION_CONST_SIZE,
292 	    s->s3->server_random, SSL3_RANDOM_SIZE,
293 	    s->s3->client_random, SSL3_RANDOM_SIZE,
294 	    NULL, 0, NULL, 0, key_block, key_block_len);
295 }
296 
297 int
298 tls1_change_cipher_state(SSL *s, int which)
299 {
300 	const unsigned char *client_write_mac_secret, *server_write_mac_secret;
301 	const unsigned char *client_write_key, *server_write_key;
302 	const unsigned char *client_write_iv, *server_write_iv;
303 	const unsigned char *mac_secret, *key, *iv;
304 	int mac_secret_size, key_len, iv_len;
305 	unsigned char *key_block;
306 	const EVP_CIPHER *cipher;
307 	const EVP_AEAD *aead;
308 	char is_read, use_client_keys;
309 
310 	aead = tls12_record_layer_aead(s->internal->rl);
311 	cipher = tls12_record_layer_cipher(s->internal->rl);
312 
313 	/*
314 	 * is_read is true if we have just read a ChangeCipherSpec message,
315 	 * that is we need to update the read cipherspec. Otherwise we have
316 	 * just written one.
317 	 */
318 	is_read = (which & SSL3_CC_READ) != 0;
319 
320 	/*
321 	 * use_client_keys is true if we wish to use the keys for the "client
322 	 * write" direction. This is the case if we're a client sending a
323 	 * ChangeCipherSpec, or a server reading a client's ChangeCipherSpec.
324 	 */
325 	use_client_keys = ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
326 	    (which == SSL3_CHANGE_CIPHER_SERVER_READ));
327 
328 	if (aead != NULL) {
329 		key_len = EVP_AEAD_key_length(aead);
330 		iv_len = SSL_CIPHER_AEAD_FIXED_NONCE_LEN(S3I(s)->hs.cipher);
331 	} else {
332 		key_len = EVP_CIPHER_key_length(cipher);
333 		iv_len = EVP_CIPHER_iv_length(cipher);
334 	}
335 
336 	mac_secret_size = S3I(s)->hs.tls12.mac_secret_size;
337 
338 	key_block = S3I(s)->hs.tls12.key_block;
339 	client_write_mac_secret = key_block;
340 	key_block += mac_secret_size;
341 	server_write_mac_secret = key_block;
342 	key_block += mac_secret_size;
343 	client_write_key = key_block;
344 	key_block += key_len;
345 	server_write_key = key_block;
346 	key_block += key_len;
347 	client_write_iv = key_block;
348 	key_block += iv_len;
349 	server_write_iv = key_block;
350 	key_block += iv_len;
351 
352 	if (use_client_keys) {
353 		mac_secret = client_write_mac_secret;
354 		key = client_write_key;
355 		iv = client_write_iv;
356 	} else {
357 		mac_secret = server_write_mac_secret;
358 		key = server_write_key;
359 		iv = server_write_iv;
360 	}
361 
362 	if (key_block - S3I(s)->hs.tls12.key_block !=
363 	    S3I(s)->hs.tls12.key_block_len) {
364 		SSLerror(s, ERR_R_INTERNAL_ERROR);
365 		goto err;
366 	}
367 
368 	if (is_read) {
369 		if (!tls12_record_layer_change_read_cipher_state(s->internal->rl,
370 		    mac_secret, mac_secret_size, key, key_len, iv, iv_len))
371 			goto err;
372 		tls12_record_layer_read_cipher_hash(s->internal->rl,
373 		    &s->enc_read_ctx, &s->read_hash);
374 	} else {
375 		if (!tls12_record_layer_change_write_cipher_state(s->internal->rl,
376 		    mac_secret, mac_secret_size, key, key_len, iv, iv_len))
377 			goto err;
378 	}
379 	return (1);
380 
381  err:
382 	return (0);
383 }
384 
385 int
386 tls1_setup_key_block(SSL *s)
387 {
388 	unsigned char *key_block;
389 	int mac_type = NID_undef, mac_secret_size = 0;
390 	size_t key_block_len;
391 	int key_len, iv_len;
392 	const EVP_CIPHER *cipher = NULL;
393 	const EVP_AEAD *aead = NULL;
394 	const EVP_MD *handshake_hash = NULL;
395 	const EVP_MD *mac_hash = NULL;
396 	int ret = 0;
397 
398 	if (S3I(s)->hs.tls12.key_block_len != 0)
399 		return (1);
400 
401 	if (s->session->cipher &&
402 	    (s->session->cipher->algorithm_mac & SSL_AEAD)) {
403 		if (!ssl_cipher_get_evp_aead(s->session, &aead)) {
404 			SSLerror(s, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
405 			return (0);
406 		}
407 		key_len = EVP_AEAD_key_length(aead);
408 		iv_len = SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s->session->cipher);
409 	} else {
410 		if (!ssl_cipher_get_evp(s->session, &cipher, &mac_hash,
411 		    &mac_type, &mac_secret_size)) {
412 			SSLerror(s, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
413 			return (0);
414 		}
415 		key_len = EVP_CIPHER_key_length(cipher);
416 		iv_len = EVP_CIPHER_iv_length(cipher);
417 	}
418 
419 	if (!ssl_get_handshake_evp_md(s, &handshake_hash))
420 		return (0);
421 
422 	S3I(s)->hs.tls12.mac_secret_size = mac_secret_size;
423 
424 	tls12_record_layer_set_aead(s->internal->rl, aead);
425 	tls12_record_layer_set_cipher_hash(s->internal->rl, cipher,
426 	    handshake_hash, mac_hash);
427 
428 	tls1_cleanup_key_block(s);
429 
430 	if ((key_block = reallocarray(NULL, mac_secret_size + key_len + iv_len,
431 	    2)) == NULL) {
432 		SSLerror(s, ERR_R_MALLOC_FAILURE);
433 		goto err;
434 	}
435 	key_block_len = (mac_secret_size + key_len + iv_len) * 2;
436 
437 	S3I(s)->hs.tls12.key_block_len = key_block_len;
438 	S3I(s)->hs.tls12.key_block = key_block;
439 
440 	if (!tls1_generate_key_block(s, key_block, key_block_len))
441 		goto err;
442 
443 	if (!(s->internal->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) &&
444 	    s->method->internal->version <= TLS1_VERSION) {
445 		/*
446 		 * Enable vulnerability countermeasure for CBC ciphers with
447 		 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
448 		 */
449 		S3I(s)->need_empty_fragments = 1;
450 
451 		if (s->session->cipher != NULL) {
452 			if (s->session->cipher->algorithm_enc == SSL_eNULL)
453 				S3I(s)->need_empty_fragments = 0;
454 
455 #ifndef OPENSSL_NO_RC4
456 			if (s->session->cipher->algorithm_enc == SSL_RC4)
457 				S3I(s)->need_empty_fragments = 0;
458 #endif
459 		}
460 	}
461 
462 	ret = 1;
463 
464  err:
465 	return (ret);
466 }
467 
468 int
469 tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
470     int len)
471 {
472 	if (len < 0)
473 		return 0;
474 
475 	if (!tls1_PRF(s, p, len,
476 	    TLS_MD_MASTER_SECRET_CONST, TLS_MD_MASTER_SECRET_CONST_SIZE,
477 	    s->s3->client_random, SSL3_RANDOM_SIZE, NULL, 0,
478 	    s->s3->server_random, SSL3_RANDOM_SIZE, NULL, 0,
479 	    s->session->master_key, SSL_MAX_MASTER_KEY_LENGTH))
480 		return 0;
481 
482 	return (SSL_MAX_MASTER_KEY_LENGTH);
483 }
484 
485 int
486 tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
487     const char *label, size_t llen, const unsigned char *context,
488     size_t contextlen, int use_context)
489 {
490 	unsigned char *val = NULL;
491 	size_t vallen, currentvalpos;
492 	int rv;
493 
494 	if (!SSL_is_init_finished(s)) {
495 		SSLerror(s, SSL_R_BAD_STATE);
496 		return 0;
497 	}
498 
499 	/* construct PRF arguments
500 	 * we construct the PRF argument ourself rather than passing separate
501 	 * values into the TLS PRF to ensure that the concatenation of values
502 	 * does not create a prohibited label.
503 	 */
504 	vallen = llen + SSL3_RANDOM_SIZE * 2;
505 	if (use_context) {
506 		vallen += 2 + contextlen;
507 	}
508 
509 	val = malloc(vallen);
510 	if (val == NULL)
511 		goto err2;
512 	currentvalpos = 0;
513 	memcpy(val + currentvalpos, (unsigned char *) label, llen);
514 	currentvalpos += llen;
515 	memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
516 	currentvalpos += SSL3_RANDOM_SIZE;
517 	memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
518 	currentvalpos += SSL3_RANDOM_SIZE;
519 
520 	if (use_context) {
521 		val[currentvalpos] = (contextlen >> 8) & 0xff;
522 		currentvalpos++;
523 		val[currentvalpos] = contextlen & 0xff;
524 		currentvalpos++;
525 		if ((contextlen > 0) || (context != NULL)) {
526 			memcpy(val + currentvalpos, context, contextlen);
527 		}
528 	}
529 
530 	/* disallow prohibited labels
531 	 * note that SSL3_RANDOM_SIZE > max(prohibited label len) =
532 	 * 15, so size of val > max(prohibited label len) = 15 and the
533 	 * comparisons won't have buffer overflow
534 	 */
535 	if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST,
536 	    TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0)
537 		goto err1;
538 	if (memcmp(val, TLS_MD_SERVER_FINISH_CONST,
539 	    TLS_MD_SERVER_FINISH_CONST_SIZE) == 0)
540 		goto err1;
541 	if (memcmp(val, TLS_MD_MASTER_SECRET_CONST,
542 	    TLS_MD_MASTER_SECRET_CONST_SIZE) == 0)
543 		goto err1;
544 	if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST,
545 	    TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0)
546 		goto err1;
547 
548 	rv = tls1_PRF(s, s->session->master_key, s->session->master_key_length,
549 	    val, vallen, NULL, 0, NULL, 0, NULL, 0, NULL, 0, out, olen);
550 
551 	goto ret;
552 err1:
553 	SSLerror(s, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL);
554 	rv = 0;
555 	goto ret;
556 err2:
557 	SSLerror(s, ERR_R_MALLOC_FAILURE);
558 	rv = 0;
559 ret:
560 	free(val);
561 
562 	return (rv);
563 }
564 
565 int
566 tls1_alert_code(int code)
567 {
568 	switch (code) {
569 	case SSL_AD_CLOSE_NOTIFY:
570 		return (SSL3_AD_CLOSE_NOTIFY);
571 	case SSL_AD_UNEXPECTED_MESSAGE:
572 		return (SSL3_AD_UNEXPECTED_MESSAGE);
573 	case SSL_AD_BAD_RECORD_MAC:
574 		return (SSL3_AD_BAD_RECORD_MAC);
575 	case SSL_AD_DECRYPTION_FAILED:
576 		return (TLS1_AD_DECRYPTION_FAILED);
577 	case SSL_AD_RECORD_OVERFLOW:
578 		return (TLS1_AD_RECORD_OVERFLOW);
579 	case SSL_AD_DECOMPRESSION_FAILURE:
580 		return (SSL3_AD_DECOMPRESSION_FAILURE);
581 	case SSL_AD_HANDSHAKE_FAILURE:
582 		return (SSL3_AD_HANDSHAKE_FAILURE);
583 	case SSL_AD_NO_CERTIFICATE:
584 		return (-1);
585 	case SSL_AD_BAD_CERTIFICATE:
586 		return (SSL3_AD_BAD_CERTIFICATE);
587 	case SSL_AD_UNSUPPORTED_CERTIFICATE:
588 		return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
589 	case SSL_AD_CERTIFICATE_REVOKED:
590 		return (SSL3_AD_CERTIFICATE_REVOKED);
591 	case SSL_AD_CERTIFICATE_EXPIRED:
592 		return (SSL3_AD_CERTIFICATE_EXPIRED);
593 	case SSL_AD_CERTIFICATE_UNKNOWN:
594 		return (SSL3_AD_CERTIFICATE_UNKNOWN);
595 	case SSL_AD_ILLEGAL_PARAMETER:
596 		return (SSL3_AD_ILLEGAL_PARAMETER);
597 	case SSL_AD_UNKNOWN_CA:
598 		return (TLS1_AD_UNKNOWN_CA);
599 	case SSL_AD_ACCESS_DENIED:
600 		return (TLS1_AD_ACCESS_DENIED);
601 	case SSL_AD_DECODE_ERROR:
602 		return (TLS1_AD_DECODE_ERROR);
603 	case SSL_AD_DECRYPT_ERROR:
604 		return (TLS1_AD_DECRYPT_ERROR);
605 	case SSL_AD_EXPORT_RESTRICTION:
606 		return (TLS1_AD_EXPORT_RESTRICTION);
607 	case SSL_AD_PROTOCOL_VERSION:
608 		return (TLS1_AD_PROTOCOL_VERSION);
609 	case SSL_AD_INSUFFICIENT_SECURITY:
610 		return (TLS1_AD_INSUFFICIENT_SECURITY);
611 	case SSL_AD_INTERNAL_ERROR:
612 		return (TLS1_AD_INTERNAL_ERROR);
613 	case SSL_AD_INAPPROPRIATE_FALLBACK:
614 		return(TLS1_AD_INAPPROPRIATE_FALLBACK);
615 	case SSL_AD_USER_CANCELLED:
616 		return (TLS1_AD_USER_CANCELLED);
617 	case SSL_AD_NO_RENEGOTIATION:
618 		return (TLS1_AD_NO_RENEGOTIATION);
619 	case SSL_AD_UNSUPPORTED_EXTENSION:
620 		return (TLS1_AD_UNSUPPORTED_EXTENSION);
621 	case SSL_AD_CERTIFICATE_UNOBTAINABLE:
622 		return (TLS1_AD_CERTIFICATE_UNOBTAINABLE);
623 	case SSL_AD_UNRECOGNIZED_NAME:
624 		return (TLS1_AD_UNRECOGNIZED_NAME);
625 	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
626 		return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
627 	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
628 		return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
629 	case SSL_AD_UNKNOWN_PSK_IDENTITY:
630 		return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
631 	default:
632 		return (-1);
633 	}
634 }
635