]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/s3_lib.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Modify libssl to discover supported groups based on available providers
[thirdparty/openssl.git] / ssl / s3_lib.c
CommitLineData
846e33c7 1/*
98278b96 2 * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
aa8f3d76 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
c80149d9 4 * Copyright 2005 Nokia. All rights reserved.
5a4fbc69 5 *
2c18d164 6 * Licensed under the Apache License 2.0 (the "License"). You may not use
846e33c7
RS		 7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
5a4fbc69 10 */
846e33c7 11
d02b48c6 12#include <stdio.h>
ec577822 13#include <openssl/objects.h>
677963e5 14#include "internal/nelem.h"
706457b7 15#include "ssl_local.h"
dbad1690 16#include <openssl/md5.h>
3c27208f 17#include <openssl/dh.h>
a3680c8f 18#include <openssl/rand.h>
77359d22 19#include <openssl/trace.h>
9f0f53b7 20#include <openssl/x509v3.h>
5f8dd0f8 21#include "internal/cryptlib.h"
d02b48c6 22
852c2ed2
RS		 23DEFINE_STACK_OF(X509_NAME)
24DEFINE_STACK_OF(X509)
25DEFINE_STACK_OF_CONST(SSL_CIPHER)
26
f865b081 27#define TLS13_NUM_CIPHERS OSSL_NELEM(tls13_ciphers)
b6eb9827 28#define SSL3_NUM_CIPHERS OSSL_NELEM(ssl3_ciphers)
650c6e41 29#define SSL3_NUM_SCSVS OSSL_NELEM(ssl3_scsvs)
d02b48c6 30
643a3580
MC		 31/* TLSv1.3 downgrade protection sentinel values */
32const unsigned char tls11downgrade[] = {
33 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x00
34};
35const unsigned char tls12downgrade[] = {
36 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x01
37};
38
f865b081
MC		 39/* The list of available TLSv1.3 ciphers */
40static SSL_CIPHER tls13_ciphers[] = {
41 {
42 1,
43 TLS1_3_RFC_AES_128_GCM_SHA256,
44 TLS1_3_RFC_AES_128_GCM_SHA256,
45 TLS1_3_CK_AES_128_GCM_SHA256,
f80c8643
MC		 46 SSL_kANY,
47 SSL_aANY,
f865b081
MC		 48 SSL_AES128GCM,
49 SSL_AEAD,
50 TLS1_3_VERSION, TLS1_3_VERSION,
f80c8643 51 0, 0,
f865b081
MC		 52 SSL_HIGH,
53 SSL_HANDSHAKE_MAC_SHA256,
54 128,
55 128,
56 }, {
57 1,
58 TLS1_3_RFC_AES_256_GCM_SHA384,
59 TLS1_3_RFC_AES_256_GCM_SHA384,
60 TLS1_3_CK_AES_256_GCM_SHA384,
61 SSL_kANY,
62 SSL_aANY,
63 SSL_AES256GCM,
64 SSL_AEAD,
65 TLS1_3_VERSION, TLS1_3_VERSION,
66 0, 0,
67 SSL_HIGH,
68 SSL_HANDSHAKE_MAC_SHA384,
69 256,
70 256,
71 },
72#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
73 {
74 1,
75 TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
76 TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
77 TLS1_3_CK_CHACHA20_POLY1305_SHA256,
78 SSL_kANY,
79 SSL_aANY,
80 SSL_CHACHA20POLY1305,
81 SSL_AEAD,
82 TLS1_3_VERSION, TLS1_3_VERSION,
83 0, 0,
84 SSL_HIGH,
85 SSL_HANDSHAKE_MAC_SHA256,
86 256,
87 256,
88 },
89#endif
90 {
91 1,
92 TLS1_3_RFC_AES_128_CCM_SHA256,
93 TLS1_3_RFC_AES_128_CCM_SHA256,
94 TLS1_3_CK_AES_128_CCM_SHA256,
95 SSL_kANY,
96 SSL_aANY,
97 SSL_AES128CCM,
98 SSL_AEAD,
99 TLS1_3_VERSION, TLS1_3_VERSION,
100 0, 0,
101 SSL_NOT_DEFAULT | SSL_HIGH,
102 SSL_HANDSHAKE_MAC_SHA256,
103 128,
104 128,
105 }, {
106 1,
107 TLS1_3_RFC_AES_128_CCM_8_SHA256,
108 TLS1_3_RFC_AES_128_CCM_8_SHA256,
109 TLS1_3_CK_AES_128_CCM_8_SHA256,
110 SSL_kANY,
111 SSL_aANY,
112 SSL_AES128CCM8,
113 SSL_AEAD,
114 TLS1_3_VERSION, TLS1_3_VERSION,
115 0, 0,
116 SSL_NOT_DEFAULT | SSL_HIGH,
117 SSL_HANDSHAKE_MAC_SHA256,
118 128,
119 128,
120 }
121};
122
748f2546 123/*
ef28891b 124 * The list of available ciphers, mostly organized into the following
748f2546
RS		 125 * groups:
126 * Always there
127 * EC
128 * PSK
129 * SRP (within that: RSA EC PSK)
9bb6f829 130 * Cipher families: Chacha/poly, Camellia, Gost, IDEA, SEED
748f2546
RS		 131 * Weak ciphers
132 */
a230b26e 133static SSL_CIPHER ssl3_ciphers[] = {
0f113f3e
MC		 134 {
135 1,
136 SSL3_TXT_RSA_NULL_MD5,
bbb4ceb8 137 SSL3_RFC_RSA_NULL_MD5,
0f113f3e
MC		 138 SSL3_CK_RSA_NULL_MD5,
139 SSL_kRSA,
140 SSL_aRSA,
141 SSL_eNULL,
142 SSL_MD5,
3eb2aff4 143 SSL3_VERSION, TLS1_2_VERSION,
387cf213 144 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 145 SSL_STRONG_NONE,
0f113f3e
MC		 146 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
147 0,
148 0,
149 },
0f113f3e
MC		 150 {
151 1,
152 SSL3_TXT_RSA_NULL_SHA,
bbb4ceb8 153 SSL3_RFC_RSA_NULL_SHA,
0f113f3e
MC		 154 SSL3_CK_RSA_NULL_SHA,
155 SSL_kRSA,
156 SSL_aRSA,
157 SSL_eNULL,
158 SSL_SHA1,
3eb2aff4 159 SSL3_VERSION, TLS1_2_VERSION,
387cf213 160 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 161 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e
MC		 162 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
163 0,
164 0,
165 },
d33726b9 166#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
0f113f3e
MC		 167 {
168 1,
169 SSL3_TXT_RSA_DES_192_CBC3_SHA,
bbb4ceb8 170 SSL3_RFC_RSA_DES_192_CBC3_SHA,
0f113f3e
MC		 171 SSL3_CK_RSA_DES_192_CBC3_SHA,
172 SSL_kRSA,
173 SSL_aRSA,
174 SSL_3DES,
175 SSL_SHA1,
3eb2aff4 176 SSL3_VERSION, TLS1_2_VERSION,
387cf213 177 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 178 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e
MC		 179 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
180 112,
181 168,
182 },
0f113f3e
MC		 183 {
184 1,
185 SSL3_TXT_DHE_DSS_DES_192_CBC3_SHA,
bbb4ceb8 186 SSL3_RFC_DHE_DSS_DES_192_CBC3_SHA,
0f113f3e
MC		 187 SSL3_CK_DHE_DSS_DES_192_CBC3_SHA,
188 SSL_kDHE,
189 SSL_aDSS,
190 SSL_3DES,
191 SSL_SHA1,
3eb2aff4 192 SSL3_VERSION, TLS1_2_VERSION,
387cf213 193 DTLS1_BAD_VER, DTLS1_2_VERSION,
4a8e9c22 194 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e
MC		 195 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
196 112,
197 168,
198 },
0f113f3e
MC		 199 {
200 1,
201 SSL3_TXT_DHE_RSA_DES_192_CBC3_SHA,
bbb4ceb8 202 SSL3_RFC_DHE_RSA_DES_192_CBC3_SHA,
0f113f3e
MC		 203 SSL3_CK_DHE_RSA_DES_192_CBC3_SHA,
204 SSL_kDHE,
205 SSL_aRSA,
206 SSL_3DES,
207 SSL_SHA1,
3eb2aff4 208 SSL3_VERSION, TLS1_2_VERSION,
387cf213 209 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 210 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e
MC		 211 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
212 112,
213 168,
214 },
0f113f3e
MC		 215 {
216 1,
217 SSL3_TXT_ADH_DES_192_CBC_SHA,
bbb4ceb8 218 SSL3_RFC_ADH_DES_192_CBC_SHA,
0f113f3e
MC		 219 SSL3_CK_ADH_DES_192_CBC_SHA,
220 SSL_kDHE,
221 SSL_aNULL,
222 SSL_3DES,
223 SSL_SHA1,
3eb2aff4 224 SSL3_VERSION, TLS1_2_VERSION,
387cf213 225 DTLS1_BAD_VER, DTLS1_2_VERSION,
4a8e9c22 226 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e
MC		 227 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
228 112,
229 168,
230 },
d33726b9 231#endif
0f113f3e
MC		 232 {
233 1,
234 TLS1_TXT_RSA_WITH_AES_128_SHA,
bbb4ceb8 235 TLS1_RFC_RSA_WITH_AES_128_SHA,
0f113f3e
MC		 236 TLS1_CK_RSA_WITH_AES_128_SHA,
237 SSL_kRSA,
238 SSL_aRSA,
239 SSL_AES128,
240 SSL_SHA1,
3eb2aff4 241 SSL3_VERSION, TLS1_2_VERSION,
387cf213 242 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 243 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 244 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
245 128,
246 128,
247 },
0f113f3e
MC		 248 {
249 1,
250 TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
bbb4ceb8 251 TLS1_RFC_DHE_DSS_WITH_AES_128_SHA,
0f113f3e
MC		 252 TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
253 SSL_kDHE,
254 SSL_aDSS,
255 SSL_AES128,
256 SSL_SHA1,
3eb2aff4 257 SSL3_VERSION, TLS1_2_VERSION,
387cf213 258 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 259 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 260 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
261 128,
262 128,
263 },
0f113f3e
MC		 264 {
265 1,
266 TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
bbb4ceb8 267 TLS1_RFC_DHE_RSA_WITH_AES_128_SHA,
0f113f3e
MC		 268 TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
269 SSL_kDHE,
270 SSL_aRSA,
271 SSL_AES128,
272 SSL_SHA1,
3eb2aff4 273 SSL3_VERSION, TLS1_2_VERSION,
387cf213 274 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 275 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 276 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
277 128,
278 128,
279 },
0f113f3e
MC		 280 {
281 1,
282 TLS1_TXT_ADH_WITH_AES_128_SHA,
bbb4ceb8 283 TLS1_RFC_ADH_WITH_AES_128_SHA,
0f113f3e
MC		 284 TLS1_CK_ADH_WITH_AES_128_SHA,
285 SSL_kDHE,
286 SSL_aNULL,
287 SSL_AES128,
288 SSL_SHA1,
3eb2aff4 289 SSL3_VERSION, TLS1_2_VERSION,
387cf213 290 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 291 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 292 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
293 128,
294 128,
295 },
0f113f3e
MC		 296 {
297 1,
298 TLS1_TXT_RSA_WITH_AES_256_SHA,
bbb4ceb8 299 TLS1_RFC_RSA_WITH_AES_256_SHA,
0f113f3e
MC		 300 TLS1_CK_RSA_WITH_AES_256_SHA,
301 SSL_kRSA,
302 SSL_aRSA,
303 SSL_AES256,
304 SSL_SHA1,
3eb2aff4 305 SSL3_VERSION, TLS1_2_VERSION,
387cf213 306 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 307 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 308 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
309 256,
310 256,
311 },
0f113f3e
MC		 312 {
313 1,
314 TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
bbb4ceb8 315 TLS1_RFC_DHE_DSS_WITH_AES_256_SHA,
0f113f3e
MC		 316 TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
317 SSL_kDHE,
318 SSL_aDSS,
319 SSL_AES256,
320 SSL_SHA1,
3eb2aff4 321 SSL3_VERSION, TLS1_2_VERSION,
387cf213 322 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 323 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 324 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
325 256,
326 256,
327 },
0f113f3e
MC		 328 {
329 1,
330 TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
bbb4ceb8 331 TLS1_RFC_DHE_RSA_WITH_AES_256_SHA,
0f113f3e
MC		 332 TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
333 SSL_kDHE,
334 SSL_aRSA,
335 SSL_AES256,
336 SSL_SHA1,
3eb2aff4 337 SSL3_VERSION, TLS1_2_VERSION,
387cf213 338 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 339 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 340 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
341 256,
342 256,
343 },
0f113f3e
MC		 344 {
345 1,
346 TLS1_TXT_ADH_WITH_AES_256_SHA,
bbb4ceb8 347 TLS1_RFC_ADH_WITH_AES_256_SHA,
0f113f3e
MC		 348 TLS1_CK_ADH_WITH_AES_256_SHA,
349 SSL_kDHE,
350 SSL_aNULL,
351 SSL_AES256,
352 SSL_SHA1,
3eb2aff4 353 SSL3_VERSION, TLS1_2_VERSION,
387cf213 354 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 355 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 356 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
357 256,
358 256,
359 },
0f113f3e
MC		 360 {
361 1,
362 TLS1_TXT_RSA_WITH_NULL_SHA256,
bbb4ceb8 363 TLS1_RFC_RSA_WITH_NULL_SHA256,
0f113f3e
MC		 364 TLS1_CK_RSA_WITH_NULL_SHA256,
365 SSL_kRSA,
366 SSL_aRSA,
367 SSL_eNULL,
368 SSL_SHA256,
3eb2aff4
KR		 369 TLS1_2_VERSION, TLS1_2_VERSION,
370 DTLS1_2_VERSION, DTLS1_2_VERSION,
1510b5f7 371 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e
MC		 372 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
373 0,
374 0,
375 },
0f113f3e
MC		 376 {
377 1,
378 TLS1_TXT_RSA_WITH_AES_128_SHA256,
bbb4ceb8 379 TLS1_RFC_RSA_WITH_AES_128_SHA256,
0f113f3e
MC		 380 TLS1_CK_RSA_WITH_AES_128_SHA256,
381 SSL_kRSA,
382 SSL_aRSA,
383 SSL_AES128,
384 SSL_SHA256,
3eb2aff4
KR		 385 TLS1_2_VERSION, TLS1_2_VERSION,
386 DTLS1_2_VERSION, DTLS1_2_VERSION,
361a1191 387 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 388 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
389 128,
390 128,
391 },
0f113f3e
MC		 392 {
393 1,
394 TLS1_TXT_RSA_WITH_AES_256_SHA256,
bbb4ceb8 395 TLS1_RFC_RSA_WITH_AES_256_SHA256,
0f113f3e
MC		 396 TLS1_CK_RSA_WITH_AES_256_SHA256,
397 SSL_kRSA,
398 SSL_aRSA,
399 SSL_AES256,
400 SSL_SHA256,
3eb2aff4
KR		 401 TLS1_2_VERSION, TLS1_2_VERSION,
402 DTLS1_2_VERSION, DTLS1_2_VERSION,
361a1191 403 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 404 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
405 256,
406 256,
407 },
0f113f3e
MC		 408 {
409 1,
410 TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
bbb4ceb8 411 TLS1_RFC_DHE_DSS_WITH_AES_128_SHA256,
0f113f3e
MC		 412 TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
413 SSL_kDHE,
414 SSL_aDSS,
415 SSL_AES128,
416 SSL_SHA256,
3eb2aff4
KR		 417 TLS1_2_VERSION, TLS1_2_VERSION,
418 DTLS1_2_VERSION, DTLS1_2_VERSION,
a556f342 419 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 420 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
421 128,
422 128,
423 },
0f113f3e
MC		 424 {
425 1,
426 TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
bbb4ceb8 427 TLS1_RFC_DHE_RSA_WITH_AES_128_SHA256,
0f113f3e
MC		 428 TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
429 SSL_kDHE,
430 SSL_aRSA,
431 SSL_AES128,
432 SSL_SHA256,
3eb2aff4
KR		 433 TLS1_2_VERSION, TLS1_2_VERSION,
434 DTLS1_2_VERSION, DTLS1_2_VERSION,
361a1191 435 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 436 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
437 128,
438 128,
439 },
0f113f3e
MC		 440 {
441 1,
442 TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
bbb4ceb8 443 TLS1_RFC_DHE_DSS_WITH_AES_256_SHA256,
0f113f3e
MC		 444 TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
445 SSL_kDHE,
446 SSL_aDSS,
447 SSL_AES256,
448 SSL_SHA256,
3eb2aff4
KR		 449 TLS1_2_VERSION, TLS1_2_VERSION,
450 DTLS1_2_VERSION, DTLS1_2_VERSION,
a556f342 451 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 452 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
453 256,
454 256,
455 },
0f113f3e
MC		 456 {
457 1,
458 TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
bbb4ceb8 459 TLS1_RFC_DHE_RSA_WITH_AES_256_SHA256,
0f113f3e
MC		 460 TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
461 SSL_kDHE,
462 SSL_aRSA,
463 SSL_AES256,
464 SSL_SHA256,
3eb2aff4
KR		 465 TLS1_2_VERSION, TLS1_2_VERSION,
466 DTLS1_2_VERSION, DTLS1_2_VERSION,
361a1191 467 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 468 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
469 256,
470 256,
471 },
0f113f3e
MC		 472 {
473 1,
474 TLS1_TXT_ADH_WITH_AES_128_SHA256,
bbb4ceb8 475 TLS1_RFC_ADH_WITH_AES_128_SHA256,
0f113f3e
MC		 476 TLS1_CK_ADH_WITH_AES_128_SHA256,
477 SSL_kDHE,
478 SSL_aNULL,
479 SSL_AES128,
480 SSL_SHA256,
3eb2aff4
KR		 481 TLS1_2_VERSION, TLS1_2_VERSION,
482 DTLS1_2_VERSION, DTLS1_2_VERSION,
361a1191 483 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 484 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
485 128,
486 128,
487 },
0f113f3e
MC		 488 {
489 1,
490 TLS1_TXT_ADH_WITH_AES_256_SHA256,
bbb4ceb8 491 TLS1_RFC_ADH_WITH_AES_256_SHA256,
0f113f3e
MC		 492 TLS1_CK_ADH_WITH_AES_256_SHA256,
493 SSL_kDHE,
494 SSL_aNULL,
495 SSL_AES256,
496 SSL_SHA256,
3eb2aff4
KR		 497 TLS1_2_VERSION, TLS1_2_VERSION,
498 DTLS1_2_VERSION, DTLS1_2_VERSION,
361a1191 499 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 500 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
501 256,
502 256,
503 },
0f113f3e
MC		 504 {
505 1,
748f2546 506 TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
bbb4ceb8 507 TLS1_RFC_RSA_WITH_AES_128_GCM_SHA256,
748f2546
RS		 508 TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
509 SSL_kRSA,
510 SSL_aRSA,
511 SSL_AES128GCM,
512 SSL_AEAD,
513 TLS1_2_VERSION, TLS1_2_VERSION,
514 DTLS1_2_VERSION, DTLS1_2_VERSION,
515 SSL_HIGH | SSL_FIPS,
516 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
517 128,
518 128,
519 },
0f113f3e
MC		 520 {
521 1,
748f2546 522 TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
bbb4ceb8 523 TLS1_RFC_RSA_WITH_AES_256_GCM_SHA384,
748f2546 524 TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
0f113f3e
MC		 525 SSL_kRSA,
526 SSL_aRSA,
748f2546
RS		 527 SSL_AES256GCM,
528 SSL_AEAD,
529 TLS1_2_VERSION, TLS1_2_VERSION,
530 DTLS1_2_VERSION, DTLS1_2_VERSION,
531 SSL_HIGH | SSL_FIPS,
532 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 533 256,
534 256,
535 },
0f113f3e
MC		 536 {
537 1,
748f2546 538 TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
bbb4ceb8 539 TLS1_RFC_DHE_RSA_WITH_AES_128_GCM_SHA256,
748f2546 540 TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
0f113f3e 541 SSL_kDHE,
748f2546
RS		 542 SSL_aRSA,
543 SSL_AES128GCM,
544 SSL_AEAD,
545 TLS1_2_VERSION, TLS1_2_VERSION,
546 DTLS1_2_VERSION, DTLS1_2_VERSION,
547 SSL_HIGH | SSL_FIPS,
548 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
549 128,
550 128,
0f113f3e 551 },
0f113f3e
MC		 552 {
553 1,
748f2546 554 TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
bbb4ceb8 555 TLS1_RFC_DHE_RSA_WITH_AES_256_GCM_SHA384,
748f2546 556 TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
0f113f3e
MC		 557 SSL_kDHE,
558 SSL_aRSA,
748f2546
RS		 559 SSL_AES256GCM,
560 SSL_AEAD,
561 TLS1_2_VERSION, TLS1_2_VERSION,
562 DTLS1_2_VERSION, DTLS1_2_VERSION,
563 SSL_HIGH | SSL_FIPS,
564 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 565 256,
566 256,
567 },
0f113f3e
MC		 568 {
569 1,
748f2546 570 TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
bbb4ceb8 571 TLS1_RFC_DHE_DSS_WITH_AES_128_GCM_SHA256,
748f2546 572 TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
0f113f3e 573 SSL_kDHE,
748f2546
RS		 574 SSL_aDSS,
575 SSL_AES128GCM,
576 SSL_AEAD,
577 TLS1_2_VERSION, TLS1_2_VERSION,
578 DTLS1_2_VERSION, DTLS1_2_VERSION,
579 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
580 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 581 128,
582 128,
583 },
0f113f3e
MC		 584 {
585 1,
748f2546 586 TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
bbb4ceb8 587 TLS1_RFC_DHE_DSS_WITH_AES_256_GCM_SHA384,
748f2546
RS		 588 TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
589 SSL_kDHE,
590 SSL_aDSS,
591 SSL_AES256GCM,
592 SSL_AEAD,
593 TLS1_2_VERSION, TLS1_2_VERSION,
594 DTLS1_2_VERSION, DTLS1_2_VERSION,
595 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
596 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
597 256,
598 256,
0f113f3e 599 },
0f113f3e
MC		 600 {
601 1,
748f2546 602 TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
bbb4ceb8 603 TLS1_RFC_ADH_WITH_AES_128_GCM_SHA256,
748f2546
RS		 604 TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
605 SSL_kDHE,
606 SSL_aNULL,
607 SSL_AES128GCM,
608 SSL_AEAD,
609 TLS1_2_VERSION, TLS1_2_VERSION,
610 DTLS1_2_VERSION, DTLS1_2_VERSION,
611 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
612 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 613 128,
614 128,
615 },
0f113f3e
MC		 616 {
617 1,
748f2546 618 TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
bbb4ceb8 619 TLS1_RFC_ADH_WITH_AES_256_GCM_SHA384,
748f2546
RS		 620 TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
621 SSL_kDHE,
622 SSL_aNULL,
623 SSL_AES256GCM,
624 SSL_AEAD,
625 TLS1_2_VERSION, TLS1_2_VERSION,
626 DTLS1_2_VERSION, DTLS1_2_VERSION,
627 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
628 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 629 256,
630 256,
631 },
ea6114c6
DSH		 632 {
633 1,
748f2546 634 TLS1_TXT_RSA_WITH_AES_128_CCM,
bbb4ceb8 635 TLS1_RFC_RSA_WITH_AES_128_CCM,
748f2546
RS		 636 TLS1_CK_RSA_WITH_AES_128_CCM,
637 SSL_kRSA,
638 SSL_aRSA,
639 SSL_AES128CCM,
640 SSL_AEAD,
641 TLS1_2_VERSION, TLS1_2_VERSION,
642 DTLS1_2_VERSION, DTLS1_2_VERSION,
643 SSL_NOT_DEFAULT | SSL_HIGH,
644 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 645 128,
646 128,
647 },
ea6114c6
DSH		 648 {
649 1,
748f2546 650 TLS1_TXT_RSA_WITH_AES_256_CCM,
bbb4ceb8 651 TLS1_RFC_RSA_WITH_AES_256_CCM,
748f2546
RS		 652 TLS1_CK_RSA_WITH_AES_256_CCM,
653 SSL_kRSA,
654 SSL_aRSA,
655 SSL_AES256CCM,
656 SSL_AEAD,
657 TLS1_2_VERSION, TLS1_2_VERSION,
658 DTLS1_2_VERSION, DTLS1_2_VERSION,
659 SSL_NOT_DEFAULT | SSL_HIGH,
660 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
661 256,
662 256,
ea6114c6 663 },
ea6114c6
DSH		 664 {
665 1,
748f2546 666 TLS1_TXT_DHE_RSA_WITH_AES_128_CCM,
bbb4ceb8 667 TLS1_RFC_DHE_RSA_WITH_AES_128_CCM,
748f2546
RS		 668 TLS1_CK_DHE_RSA_WITH_AES_128_CCM,
669 SSL_kDHE,
670 SSL_aRSA,
671 SSL_AES128CCM,
672 SSL_AEAD,
673 TLS1_2_VERSION, TLS1_2_VERSION,
674 DTLS1_2_VERSION, DTLS1_2_VERSION,
675 SSL_NOT_DEFAULT | SSL_HIGH,
676 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 677 128,
678 128,
679 },
ea6114c6
DSH		 680 {
681 1,
748f2546 682 TLS1_TXT_DHE_RSA_WITH_AES_256_CCM,
bbb4ceb8 683 TLS1_RFC_DHE_RSA_WITH_AES_256_CCM,
748f2546
RS		 684 TLS1_CK_DHE_RSA_WITH_AES_256_CCM,
685 SSL_kDHE,
686 SSL_aRSA,
687 SSL_AES256CCM,
688 SSL_AEAD,
689 TLS1_2_VERSION, TLS1_2_VERSION,
690 DTLS1_2_VERSION, DTLS1_2_VERSION,
691 SSL_NOT_DEFAULT | SSL_HIGH,
692 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 693 256,
694 256,
695 },
ea6114c6
DSH		 696 {
697 1,
748f2546 698 TLS1_TXT_RSA_WITH_AES_128_CCM_8,
bbb4ceb8 699 TLS1_RFC_RSA_WITH_AES_128_CCM_8,
748f2546
RS		 700 TLS1_CK_RSA_WITH_AES_128_CCM_8,
701 SSL_kRSA,
ea6114c6 702 SSL_aRSA,
748f2546 703 SSL_AES128CCM8,
0f113f3e 704 SSL_AEAD,
3eb2aff4
KR		 705 TLS1_2_VERSION, TLS1_2_VERSION,
706 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 707 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 708 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
709 128,
710 128,
711 },
0f113f3e
MC		 712 {
713 1,
748f2546 714 TLS1_TXT_RSA_WITH_AES_256_CCM_8,
bbb4ceb8 715 TLS1_RFC_RSA_WITH_AES_256_CCM_8,
748f2546 716 TLS1_CK_RSA_WITH_AES_256_CCM_8,
0f113f3e
MC		 717 SSL_kRSA,
718 SSL_aRSA,
748f2546 719 SSL_AES256CCM8,
0f113f3e 720 SSL_AEAD,
3eb2aff4
KR		 721 TLS1_2_VERSION, TLS1_2_VERSION,
722 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 723 SSL_NOT_DEFAULT | SSL_HIGH,
724 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 725 256,
726 256,
727 },
0f113f3e
MC		 728 {
729 1,
748f2546 730 TLS1_TXT_DHE_RSA_WITH_AES_128_CCM_8,
bbb4ceb8 731 TLS1_RFC_DHE_RSA_WITH_AES_128_CCM_8,
748f2546 732 TLS1_CK_DHE_RSA_WITH_AES_128_CCM_8,
0f113f3e
MC		 733 SSL_kDHE,
734 SSL_aRSA,
748f2546 735 SSL_AES128CCM8,
0f113f3e 736 SSL_AEAD,
3eb2aff4
KR		 737 TLS1_2_VERSION, TLS1_2_VERSION,
738 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 739 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 740 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
741 128,
742 128,
743 },
0f113f3e
MC		 744 {
745 1,
748f2546 746 TLS1_TXT_DHE_RSA_WITH_AES_256_CCM_8,
bbb4ceb8 747 TLS1_RFC_DHE_RSA_WITH_AES_256_CCM_8,
748f2546 748 TLS1_CK_DHE_RSA_WITH_AES_256_CCM_8,
0f113f3e
MC		 749 SSL_kDHE,
750 SSL_aRSA,
748f2546 751 SSL_AES256CCM8,
0f113f3e 752 SSL_AEAD,
3eb2aff4
KR		 753 TLS1_2_VERSION, TLS1_2_VERSION,
754 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 755 SSL_NOT_DEFAULT | SSL_HIGH,
756 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 757 256,
758 256,
759 },
0f113f3e
MC		 760 {
761 1,
748f2546 762 TLS1_TXT_PSK_WITH_AES_128_CCM,
bbb4ceb8 763 TLS1_RFC_PSK_WITH_AES_128_CCM,
748f2546
RS		 764 TLS1_CK_PSK_WITH_AES_128_CCM,
765 SSL_kPSK,
766 SSL_aPSK,
767 SSL_AES128CCM,
0f113f3e 768 SSL_AEAD,
3eb2aff4
KR		 769 TLS1_2_VERSION, TLS1_2_VERSION,
770 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 771 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 772 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
773 128,
774 128,
775 },
0f113f3e
MC		 776 {
777 1,
748f2546 778 TLS1_TXT_PSK_WITH_AES_256_CCM,
bbb4ceb8 779 TLS1_RFC_PSK_WITH_AES_256_CCM,
748f2546
RS		 780 TLS1_CK_PSK_WITH_AES_256_CCM,
781 SSL_kPSK,
782 SSL_aPSK,
783 SSL_AES256CCM,
0f113f3e 784 SSL_AEAD,
3eb2aff4
KR		 785 TLS1_2_VERSION, TLS1_2_VERSION,
786 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 787 SSL_NOT_DEFAULT | SSL_HIGH,
788 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 789 256,
790 256,
791 },
0f113f3e
MC		 792 {
793 1,
748f2546 794 TLS1_TXT_DHE_PSK_WITH_AES_128_CCM,
bbb4ceb8 795 TLS1_RFC_DHE_PSK_WITH_AES_128_CCM,
748f2546
RS		 796 TLS1_CK_DHE_PSK_WITH_AES_128_CCM,
797 SSL_kDHEPSK,
798 SSL_aPSK,
799 SSL_AES128CCM,
0f113f3e 800 SSL_AEAD,
3eb2aff4
KR		 801 TLS1_2_VERSION, TLS1_2_VERSION,
802 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 803 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 804 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
805 128,
806 128,
807 },
0f113f3e
MC		 808 {
809 1,
748f2546 810 TLS1_TXT_DHE_PSK_WITH_AES_256_CCM,
bbb4ceb8 811 TLS1_RFC_DHE_PSK_WITH_AES_256_CCM,
748f2546
RS		 812 TLS1_CK_DHE_PSK_WITH_AES_256_CCM,
813 SSL_kDHEPSK,
814 SSL_aPSK,
815 SSL_AES256CCM,
0f113f3e 816 SSL_AEAD,
3eb2aff4
KR		 817 TLS1_2_VERSION, TLS1_2_VERSION,
818 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 819 SSL_NOT_DEFAULT | SSL_HIGH,
820 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 821 256,
822 256,
823 },
547dba74
DSH		 824 {
825 1,
748f2546 826 TLS1_TXT_PSK_WITH_AES_128_CCM_8,
bbb4ceb8 827 TLS1_RFC_PSK_WITH_AES_128_CCM_8,
748f2546 828 TLS1_CK_PSK_WITH_AES_128_CCM_8,
547dba74
DSH		 829 SSL_kPSK,
830 SSL_aPSK,
748f2546 831 SSL_AES128CCM8,
547dba74 832 SSL_AEAD,
3eb2aff4
KR		 833 TLS1_2_VERSION, TLS1_2_VERSION,
834 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 835 SSL_NOT_DEFAULT | SSL_HIGH,
547dba74
DSH		 836 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
837 128,
838 128,
839 },
547dba74
DSH		 840 {
841 1,
748f2546 842 TLS1_TXT_PSK_WITH_AES_256_CCM_8,
bbb4ceb8 843 TLS1_RFC_PSK_WITH_AES_256_CCM_8,
748f2546 844 TLS1_CK_PSK_WITH_AES_256_CCM_8,
547dba74
DSH		 845 SSL_kPSK,
846 SSL_aPSK,
748f2546 847 SSL_AES256CCM8,
547dba74 848 SSL_AEAD,
3eb2aff4
KR		 849 TLS1_2_VERSION, TLS1_2_VERSION,
850 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 851 SSL_NOT_DEFAULT | SSL_HIGH,
852 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
547dba74
DSH		 853 256,
854 256,
855 },
ea6114c6
DSH		 856 {
857 1,
748f2546 858 TLS1_TXT_DHE_PSK_WITH_AES_128_CCM_8,
bbb4ceb8 859 TLS1_RFC_DHE_PSK_WITH_AES_128_CCM_8,
748f2546 860 TLS1_CK_DHE_PSK_WITH_AES_128_CCM_8,
ea6114c6
DSH		 861 SSL_kDHEPSK,
862 SSL_aPSK,
748f2546 863 SSL_AES128CCM8,
ea6114c6 864 SSL_AEAD,
3eb2aff4
KR		 865 TLS1_2_VERSION, TLS1_2_VERSION,
866 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 867 SSL_NOT_DEFAULT | SSL_HIGH,
ea6114c6
DSH		 868 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
869 128,
870 128,
871 },
ea6114c6
DSH		 872 {
873 1,
748f2546 874 TLS1_TXT_DHE_PSK_WITH_AES_256_CCM_8,
bbb4ceb8 875 TLS1_RFC_DHE_PSK_WITH_AES_256_CCM_8,
748f2546
RS		 876 TLS1_CK_DHE_PSK_WITH_AES_256_CCM_8,
877 SSL_kDHEPSK,
ea6114c6 878 SSL_aPSK,
748f2546 879 SSL_AES256CCM8,
ea6114c6 880 SSL_AEAD,
3eb2aff4
KR		 881 TLS1_2_VERSION, TLS1_2_VERSION,
882 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 883 SSL_NOT_DEFAULT | SSL_HIGH,
884 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 885 256,
886 256,
887 },
ea6114c6
DSH		 888 {
889 1,
748f2546 890 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM,
bbb4ceb8 891 TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM,
748f2546
RS		 892 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM,
893 SSL_kECDHE,
894 SSL_aECDSA,
895 SSL_AES128CCM,
ea6114c6 896 SSL_AEAD,
3eb2aff4
KR		 897 TLS1_2_VERSION, TLS1_2_VERSION,
898 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 899 SSL_NOT_DEFAULT | SSL_HIGH,
ea6114c6
DSH		 900 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
901 128,
902 128,
903 },
ea6114c6
DSH		 904 {
905 1,
748f2546 906 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM,
bbb4ceb8 907 TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM,
748f2546
RS		 908 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM,
909 SSL_kECDHE,
910 SSL_aECDSA,
911 SSL_AES256CCM,
ea6114c6 912 SSL_AEAD,
3eb2aff4
KR		 913 TLS1_2_VERSION, TLS1_2_VERSION,
914 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 915 SSL_NOT_DEFAULT | SSL_HIGH,
916 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 917 256,
918 256,
919 },
ea6114c6
DSH		 920 {
921 1,
748f2546 922 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM_8,
bbb4ceb8 923 TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM_8,
748f2546
RS		 924 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM_8,
925 SSL_kECDHE,
926 SSL_aECDSA,
927 SSL_AES128CCM8,
928 SSL_AEAD,
929 TLS1_2_VERSION, TLS1_2_VERSION,
930 DTLS1_2_VERSION, DTLS1_2_VERSION,
931 SSL_NOT_DEFAULT | SSL_HIGH,
932 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 933 128,
934 128,
935 },
ea6114c6
DSH		 936 {
937 1,
748f2546 938 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM_8,
bbb4ceb8 939 TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM_8,
748f2546
RS		 940 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM_8,
941 SSL_kECDHE,
942 SSL_aECDSA,
943 SSL_AES256CCM8,
944 SSL_AEAD,
945 TLS1_2_VERSION, TLS1_2_VERSION,
946 DTLS1_2_VERSION, DTLS1_2_VERSION,
947 SSL_NOT_DEFAULT | SSL_HIGH,
948 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
ea6114c6
DSH		 949 256,
950 256,
951 },
ea6114c6
DSH		 952 {
953 1,
748f2546 954 TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
bbb4ceb8 955 TLS1_RFC_ECDHE_ECDSA_WITH_NULL_SHA,
748f2546
RS		 956 TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
957 SSL_kECDHE,
958 SSL_aECDSA,
ea6114c6 959 SSL_eNULL,
748f2546 960 SSL_SHA1,
fe55c4a2 961 TLS1_VERSION, TLS1_2_VERSION,
387cf213 962 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 963 SSL_STRONG_NONE | SSL_FIPS,
ea6114c6
DSH		 964 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
965 0,
966 0,
967 },
d33726b9 968# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
ea6114c6
DSH		 969 {
970 1,
748f2546 971 TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
bbb4ceb8 972 TLS1_RFC_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
748f2546
RS		 973 TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
974 SSL_kECDHE,
975 SSL_aECDSA,
976 SSL_3DES,
977 SSL_SHA1,
fe55c4a2 978 TLS1_VERSION, TLS1_2_VERSION,
387cf213 979 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 980 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
748f2546
RS		 981 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
982 112,
983 168,
ea6114c6 984 },
d33726b9 985# endif
ea6114c6
DSH		 986 {
987 1,
748f2546 988 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
bbb4ceb8 989 TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
748f2546
RS		 990 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
991 SSL_kECDHE,
992 SSL_aECDSA,
ea6114c6 993 SSL_AES128,
748f2546 994 SSL_SHA1,
fe55c4a2 995 TLS1_VERSION, TLS1_2_VERSION,
387cf213 996 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 997 SSL_HIGH | SSL_FIPS,
ea6114c6
DSH		 998 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
999 128,
1000 128,
1001 },
ea6114c6
DSH		 1002 {
1003 1,
748f2546 1004 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
bbb4ceb8 1005 TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
748f2546
RS		 1006 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
1007 SSL_kECDHE,
1008 SSL_aECDSA,
ea6114c6 1009 SSL_AES256,
748f2546 1010 SSL_SHA1,
fe55c4a2 1011 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1012 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1013 SSL_HIGH | SSL_FIPS,
748f2546 1014 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
ea6114c6
DSH		 1015 256,
1016 256,
1017 },
ea6114c6
DSH		 1018 {
1019 1,
748f2546 1020 TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
bbb4ceb8 1021 TLS1_RFC_ECDHE_RSA_WITH_NULL_SHA,
748f2546
RS		 1022 TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
1023 SSL_kECDHE,
1024 SSL_aRSA,
ea6114c6 1025 SSL_eNULL,
748f2546 1026 SSL_SHA1,
fe55c4a2 1027 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1028 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 1029 SSL_STRONG_NONE | SSL_FIPS,
ea6114c6
DSH		 1030 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1031 0,
1032 0,
1033 },
d33726b9 1034# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
ea6114c6
DSH		 1035 {
1036 1,
748f2546 1037 TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
bbb4ceb8 1038 TLS1_RFC_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
748f2546
RS		 1039 TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1040 SSL_kECDHE,
1041 SSL_aRSA,
1042 SSL_3DES,
1043 SSL_SHA1,
fe55c4a2 1044 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1045 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1046 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
748f2546
RS		 1047 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1048 112,
1049 168,
ea6114c6 1050 },
d33726b9 1051# endif
ea6114c6
DSH		 1052 {
1053 1,
748f2546 1054 TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
bbb4ceb8 1055 TLS1_RFC_ECDHE_RSA_WITH_AES_128_CBC_SHA,
748f2546
RS		 1056 TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1057 SSL_kECDHE,
ea6114c6
DSH		 1058 SSL_aRSA,
1059 SSL_AES128,
748f2546 1060 SSL_SHA1,
fe55c4a2 1061 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1062 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1063 SSL_HIGH | SSL_FIPS,
ea6114c6
DSH		 1064 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1065 128,
1066 128,
1067 },
ea6114c6
DSH		 1068 {
1069 1,
748f2546 1070 TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
bbb4ceb8 1071 TLS1_RFC_ECDHE_RSA_WITH_AES_256_CBC_SHA,
748f2546
RS		 1072 TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1073 SSL_kECDHE,
ea6114c6
DSH		 1074 SSL_aRSA,
1075 SSL_AES256,
748f2546 1076 SSL_SHA1,
fe55c4a2 1077 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1078 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1079 SSL_HIGH | SSL_FIPS,
748f2546 1080 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
ea6114c6
DSH		 1081 256,
1082 256,
1083 },
ea6114c6
DSH		 1084 {
1085 1,
748f2546 1086 TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
bbb4ceb8 1087 TLS1_RFC_ECDH_anon_WITH_NULL_SHA,
748f2546
RS		 1088 TLS1_CK_ECDH_anon_WITH_NULL_SHA,
1089 SSL_kECDHE,
1090 SSL_aNULL,
ea6114c6 1091 SSL_eNULL,
748f2546 1092 SSL_SHA1,
fe55c4a2 1093 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1094 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 1095 SSL_STRONG_NONE | SSL_FIPS,
ea6114c6
DSH		 1096 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1097 0,
1098 0,
1099 },
d33726b9 1100# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
ea6114c6
DSH		 1101 {
1102 1,
748f2546 1103 TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
bbb4ceb8 1104 TLS1_RFC_ECDH_anon_WITH_DES_192_CBC3_SHA,
748f2546
RS		 1105 TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
1106 SSL_kECDHE,
1107 SSL_aNULL,
1108 SSL_3DES,
1109 SSL_SHA1,
fe55c4a2 1110 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1111 DTLS1_BAD_VER, DTLS1_2_VERSION,
4a8e9c22 1112 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
748f2546
RS		 1113 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1114 112,
1115 168,
ea6114c6 1116 },
d33726b9 1117# endif
0f113f3e
MC		 1118 {
1119 1,
748f2546 1120 TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
bbb4ceb8 1121 TLS1_RFC_ECDH_anon_WITH_AES_128_CBC_SHA,
748f2546
RS		 1122 TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
1123 SSL_kECDHE,
1124 SSL_aNULL,
1125 SSL_AES128,
1126 SSL_SHA1,
fe55c4a2 1127 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1128 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1129 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
1130 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1131 128,
1132 128,
1133 },
0f113f3e
MC		 1134 {
1135 1,
748f2546 1136 TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
bbb4ceb8 1137 TLS1_RFC_ECDH_anon_WITH_AES_256_CBC_SHA,
748f2546
RS		 1138 TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
1139 SSL_kECDHE,
1140 SSL_aNULL,
1141 SSL_AES256,
1142 SSL_SHA1,
fe55c4a2 1143 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1144 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1145 SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
1146 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1147 256,
1148 256,
1149 },
1150 {
1151 1,
1152 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
bbb4ceb8 1153 TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_SHA256,
748f2546
RS		 1154 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
1155 SSL_kECDHE,
1156 SSL_aECDSA,
1157 SSL_AES128,
0f113f3e 1158 SSL_SHA256,
3eb2aff4
KR		 1159 TLS1_2_VERSION, TLS1_2_VERSION,
1160 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 1161 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1162 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
1163 128,
1164 128,
1165 },
0f113f3e
MC		 1166 {
1167 1,
748f2546 1168 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
bbb4ceb8 1169 TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_SHA384,
748f2546
RS		 1170 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
1171 SSL_kECDHE,
1172 SSL_aECDSA,
1173 SSL_AES256,
1174 SSL_SHA384,
3eb2aff4
KR		 1175 TLS1_2_VERSION, TLS1_2_VERSION,
1176 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 1177 SSL_HIGH | SSL_FIPS,
1178 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1179 256,
1180 256,
0f113f3e 1181 },
0f113f3e
MC		 1182 {
1183 1,
748f2546 1184 TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
bbb4ceb8 1185 TLS1_RFC_ECDHE_RSA_WITH_AES_128_SHA256,
748f2546
RS		 1186 TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
1187 SSL_kECDHE,
1188 SSL_aRSA,
1189 SSL_AES128,
0f113f3e 1190 SSL_SHA256,
3eb2aff4
KR		 1191 TLS1_2_VERSION, TLS1_2_VERSION,
1192 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 1193 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1194 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
1195 128,
1196 128,
1197 },
0f113f3e
MC		 1198 {
1199 1,
748f2546 1200 TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
bbb4ceb8 1201 TLS1_RFC_ECDHE_RSA_WITH_AES_256_SHA384,
748f2546
RS		 1202 TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
1203 SSL_kECDHE,
0f113f3e 1204 SSL_aRSA,
748f2546
RS		 1205 SSL_AES256,
1206 SSL_SHA384,
3eb2aff4
KR		 1207 TLS1_2_VERSION, TLS1_2_VERSION,
1208 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 1209 SSL_HIGH | SSL_FIPS,
1210 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 1211 256,
1212 256,
1213 },
0f113f3e
MC		 1214 {
1215 1,
748f2546 1216 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
bbb4ceb8 1217 TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
748f2546
RS		 1218 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1219 SSL_kECDHE,
1220 SSL_aECDSA,
1221 SSL_AES128GCM,
1222 SSL_AEAD,
3eb2aff4
KR		 1223 TLS1_2_VERSION, TLS1_2_VERSION,
1224 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 1225 SSL_HIGH | SSL_FIPS,
0f113f3e 1226 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
748f2546
RS		 1227 128,
1228 128,
1229 },
1230 {
1231 1,
1232 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
bbb4ceb8 1233 TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
748f2546
RS		 1234 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1235 SSL_kECDHE,
1236 SSL_aECDSA,
1237 SSL_AES256GCM,
1238 SSL_AEAD,
1239 TLS1_2_VERSION, TLS1_2_VERSION,
1240 DTLS1_2_VERSION, DTLS1_2_VERSION,
1241 SSL_HIGH | SSL_FIPS,
1242 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 1243 256,
1244 256,
1245 },
0f113f3e
MC		 1246 {
1247 1,
748f2546 1248 TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
bbb4ceb8 1249 TLS1_RFC_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
748f2546
RS		 1250 TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1251 SSL_kECDHE,
0f113f3e 1252 SSL_aRSA,
748f2546
RS		 1253 SSL_AES128GCM,
1254 SSL_AEAD,
3eb2aff4
KR		 1255 TLS1_2_VERSION, TLS1_2_VERSION,
1256 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546 1257 SSL_HIGH | SSL_FIPS,
0f113f3e 1258 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
748f2546
RS		 1259 128,
1260 128,
0f113f3e 1261 },
0f113f3e
MC		 1262 {
1263 1,
748f2546 1264 TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
bbb4ceb8 1265 TLS1_RFC_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
748f2546
RS		 1266 TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1267 SSL_kECDHE,
1268 SSL_aRSA,
1269 SSL_AES256GCM,
1270 SSL_AEAD,
3eb2aff4
KR		 1271 TLS1_2_VERSION, TLS1_2_VERSION,
1272 DTLS1_2_VERSION, DTLS1_2_VERSION,
748f2546
RS		 1273 SSL_HIGH | SSL_FIPS,
1274 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 1275 256,
1276 256,
1277 },
0f113f3e
MC		 1278 {
1279 1,
748f2546 1280 TLS1_TXT_PSK_WITH_NULL_SHA,
bbb4ceb8 1281 TLS1_RFC_PSK_WITH_NULL_SHA,
748f2546
RS		 1282 TLS1_CK_PSK_WITH_NULL_SHA,
1283 SSL_kPSK,
1284 SSL_aPSK,
0f113f3e
MC		 1285 SSL_eNULL,
1286 SSL_SHA1,
3eb2aff4 1287 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1288 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 1289 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e
MC		 1290 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1291 0,
1292 0,
1293 },
0f113f3e
MC		 1294 {
1295 1,
748f2546 1296 TLS1_TXT_DHE_PSK_WITH_NULL_SHA,
bbb4ceb8 1297 TLS1_RFC_DHE_PSK_WITH_NULL_SHA,
748f2546
RS		 1298 TLS1_CK_DHE_PSK_WITH_NULL_SHA,
1299 SSL_kDHEPSK,
1300 SSL_aPSK,
1301 SSL_eNULL,
0f113f3e 1302 SSL_SHA1,
3eb2aff4 1303 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1304 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1305 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e 1306 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
748f2546
RS		 1307 0,
1308 0,
0f113f3e 1309 },
0f113f3e
MC		 1310 {
1311 1,
748f2546 1312 TLS1_TXT_RSA_PSK_WITH_NULL_SHA,
bbb4ceb8 1313 TLS1_RFC_RSA_PSK_WITH_NULL_SHA,
748f2546
RS		 1314 TLS1_CK_RSA_PSK_WITH_NULL_SHA,
1315 SSL_kRSAPSK,
1316 SSL_aRSA,
1317 SSL_eNULL,
1318 SSL_SHA1,
1319 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1320 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1321 SSL_STRONG_NONE | SSL_FIPS,
1322 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1323 0,
1324 0,
1325 },
d33726b9 1326# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
748f2546
RS		 1327 {
1328 1,
1329 TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1330 TLS1_RFC_PSK_WITH_3DES_EDE_CBC_SHA,
748f2546
RS		 1331 TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
1332 SSL_kPSK,
1333 SSL_aPSK,
0f113f3e
MC		 1334 SSL_3DES,
1335 SSL_SHA1,
3eb2aff4 1336 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1337 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1338 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e
MC		 1339 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1340 112,
1341 168,
1342 },
d33726b9 1343# endif
0f113f3e
MC		 1344 {
1345 1,
748f2546 1346 TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
bbb4ceb8 1347 TLS1_RFC_PSK_WITH_AES_128_CBC_SHA,
748f2546
RS		 1348 TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
1349 SSL_kPSK,
1350 SSL_aPSK,
0f113f3e
MC		 1351 SSL_AES128,
1352 SSL_SHA1,
3eb2aff4 1353 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1354 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1355 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1356 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1357 128,
1358 128,
1359 },
0f113f3e
MC		 1360 {
1361 1,
748f2546 1362 TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
bbb4ceb8 1363 TLS1_RFC_PSK_WITH_AES_256_CBC_SHA,
748f2546
RS		 1364 TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
1365 SSL_kPSK,
1366 SSL_aPSK,
0f113f3e
MC		 1367 SSL_AES256,
1368 SSL_SHA1,
3eb2aff4 1369 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1370 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1371 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1372 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1373 256,
1374 256,
1375 },
d33726b9 1376# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
0f113f3e
MC		 1377 {
1378 1,
748f2546 1379 TLS1_TXT_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1380 TLS1_RFC_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
748f2546
RS		 1381 TLS1_CK_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
1382 SSL_kDHEPSK,
1383 SSL_aPSK,
1384 SSL_3DES,
0f113f3e 1385 SSL_SHA1,
3eb2aff4 1386 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1387 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1388 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e 1389 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
748f2546
RS		 1390 112,
1391 168,
0f113f3e 1392 },
d33726b9 1393# endif
0f113f3e
MC		 1394 {
1395 1,
748f2546 1396 TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA,
bbb4ceb8 1397 TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA,
748f2546
RS		 1398 TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA,
1399 SSL_kDHEPSK,
1400 SSL_aPSK,
1401 SSL_AES128,
1402 SSL_SHA1,
1403 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1404 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1405 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1406 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1407 128,
1408 128,
1409 },
0f113f3e
MC		 1410 {
1411 1,
748f2546 1412 TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA,
bbb4ceb8 1413 TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA,
748f2546
RS		 1414 TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA,
1415 SSL_kDHEPSK,
1416 SSL_aPSK,
1417 SSL_AES256,
1418 SSL_SHA1,
1419 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1420 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1421 SSL_HIGH | SSL_FIPS,
1422 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1423 256,
1424 256,
1425 },
d33726b9 1426# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
748f2546
RS		 1427 {
1428 1,
1429 TLS1_TXT_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1430 TLS1_RFC_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
748f2546
RS		 1431 TLS1_CK_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
1432 SSL_kRSAPSK,
0f113f3e
MC		 1433 SSL_aRSA,
1434 SSL_3DES,
1435 SSL_SHA1,
3eb2aff4 1436 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1437 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1438 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
0f113f3e
MC		 1439 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1440 112,
1441 168,
1442 },
d33726b9 1443# endif
0f113f3e
MC		 1444 {
1445 1,
748f2546 1446 TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA,
bbb4ceb8 1447 TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA,
748f2546
RS		 1448 TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA,
1449 SSL_kRSAPSK,
0f113f3e
MC		 1450 SSL_aRSA,
1451 SSL_AES128,
1452 SSL_SHA1,
3eb2aff4 1453 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1454 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1455 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1456 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1457 128,
1458 128,
1459 },
0f113f3e
MC		 1460 {
1461 1,
748f2546 1462 TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA,
bbb4ceb8 1463 TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA,
748f2546
RS		 1464 TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA,
1465 SSL_kRSAPSK,
0f113f3e
MC		 1466 SSL_aRSA,
1467 SSL_AES256,
1468 SSL_SHA1,
3eb2aff4 1469 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1470 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1471 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1472 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1473 256,
1474 256,
1475 },
0f113f3e
MC		 1476 {
1477 1,
748f2546 1478 TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256,
bbb4ceb8 1479 TLS1_RFC_PSK_WITH_AES_128_GCM_SHA256,
748f2546
RS		 1480 TLS1_CK_PSK_WITH_AES_128_GCM_SHA256,
1481 SSL_kPSK,
1482 SSL_aPSK,
1483 SSL_AES128GCM,
1484 SSL_AEAD,
1485 TLS1_2_VERSION, TLS1_2_VERSION,
1486 DTLS1_2_VERSION, DTLS1_2_VERSION,
1487 SSL_HIGH | SSL_FIPS,
1488 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 1489 128,
1490 128,
1491 },
0f113f3e
MC		 1492 {
1493 1,
748f2546 1494 TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384,
bbb4ceb8 1495 TLS1_RFC_PSK_WITH_AES_256_GCM_SHA384,
748f2546
RS		 1496 TLS1_CK_PSK_WITH_AES_256_GCM_SHA384,
1497 SSL_kPSK,
1498 SSL_aPSK,
1499 SSL_AES256GCM,
1500 SSL_AEAD,
1501 TLS1_2_VERSION, TLS1_2_VERSION,
1502 DTLS1_2_VERSION, DTLS1_2_VERSION,
1503 SSL_HIGH | SSL_FIPS,
1504 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1505 256,
1506 256,
0f113f3e 1507 },
0f113f3e
MC		 1508 {
1509 1,
748f2546 1510 TLS1_TXT_DHE_PSK_WITH_AES_128_GCM_SHA256,
bbb4ceb8 1511 TLS1_RFC_DHE_PSK_WITH_AES_128_GCM_SHA256,
748f2546
RS		 1512 TLS1_CK_DHE_PSK_WITH_AES_128_GCM_SHA256,
1513 SSL_kDHEPSK,
1514 SSL_aPSK,
1515 SSL_AES128GCM,
1516 SSL_AEAD,
1517 TLS1_2_VERSION, TLS1_2_VERSION,
1518 DTLS1_2_VERSION, DTLS1_2_VERSION,
1519 SSL_HIGH | SSL_FIPS,
1520 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
0f113f3e
MC		 1521 128,
1522 128,
1523 },
0f113f3e
MC		 1524 {
1525 1,
748f2546 1526 TLS1_TXT_DHE_PSK_WITH_AES_256_GCM_SHA384,
bbb4ceb8 1527 TLS1_RFC_DHE_PSK_WITH_AES_256_GCM_SHA384,
748f2546
RS		 1528 TLS1_CK_DHE_PSK_WITH_AES_256_GCM_SHA384,
1529 SSL_kDHEPSK,
1530 SSL_aPSK,
1531 SSL_AES256GCM,
1532 SSL_AEAD,
1533 TLS1_2_VERSION, TLS1_2_VERSION,
1534 DTLS1_2_VERSION, DTLS1_2_VERSION,
1535 SSL_HIGH | SSL_FIPS,
1536 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 1537 256,
1538 256,
1539 },
0f113f3e
MC		 1540 {
1541 1,
748f2546 1542 TLS1_TXT_RSA_PSK_WITH_AES_128_GCM_SHA256,
bbb4ceb8 1543 TLS1_RFC_RSA_PSK_WITH_AES_128_GCM_SHA256,
748f2546
RS		 1544 TLS1_CK_RSA_PSK_WITH_AES_128_GCM_SHA256,
1545 SSL_kRSAPSK,
0f113f3e 1546 SSL_aRSA,
748f2546
RS		 1547 SSL_AES128GCM,
1548 SSL_AEAD,
1549 TLS1_2_VERSION, TLS1_2_VERSION,
1550 DTLS1_2_VERSION, DTLS1_2_VERSION,
1551 SSL_HIGH | SSL_FIPS,
1552 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
1553 128,
1554 128,
0f113f3e 1555 },
0f113f3e
MC		 1556 {
1557 1,
748f2546 1558 TLS1_TXT_RSA_PSK_WITH_AES_256_GCM_SHA384,
bbb4ceb8 1559 TLS1_RFC_RSA_PSK_WITH_AES_256_GCM_SHA384,
748f2546
RS		 1560 TLS1_CK_RSA_PSK_WITH_AES_256_GCM_SHA384,
1561 SSL_kRSAPSK,
1562 SSL_aRSA,
1563 SSL_AES256GCM,
1564 SSL_AEAD,
1565 TLS1_2_VERSION, TLS1_2_VERSION,
1566 DTLS1_2_VERSION, DTLS1_2_VERSION,
1567 SSL_HIGH | SSL_FIPS,
1568 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1569 256,
1570 256,
0f113f3e 1571 },
0f113f3e
MC		 1572 {
1573 1,
748f2546 1574 TLS1_TXT_PSK_WITH_AES_128_CBC_SHA256,
bbb4ceb8 1575 TLS1_RFC_PSK_WITH_AES_128_CBC_SHA256,
748f2546
RS		 1576 TLS1_CK_PSK_WITH_AES_128_CBC_SHA256,
1577 SSL_kPSK,
1578 SSL_aPSK,
0f113f3e 1579 SSL_AES128,
748f2546
RS		 1580 SSL_SHA256,
1581 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1582 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1583 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1584 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1585 128,
1586 128,
1587 },
0f113f3e
MC		 1588 {
1589 1,
748f2546 1590 TLS1_TXT_PSK_WITH_AES_256_CBC_SHA384,
bbb4ceb8 1591 TLS1_RFC_PSK_WITH_AES_256_CBC_SHA384,
748f2546
RS		 1592 TLS1_CK_PSK_WITH_AES_256_CBC_SHA384,
1593 SSL_kPSK,
1594 SSL_aPSK,
1595 SSL_AES256,
1596 SSL_SHA384,
1597 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1598 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1599 SSL_HIGH | SSL_FIPS,
1600 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1601 256,
1602 256,
0f113f3e 1603 },
0f113f3e
MC		 1604 {
1605 1,
748f2546 1606 TLS1_TXT_PSK_WITH_NULL_SHA256,
bbb4ceb8 1607 TLS1_RFC_PSK_WITH_NULL_SHA256,
748f2546
RS		 1608 TLS1_CK_PSK_WITH_NULL_SHA256,
1609 SSL_kPSK,
1610 SSL_aPSK,
1611 SSL_eNULL,
1612 SSL_SHA256,
1613 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1614 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1615 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e 1616 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
748f2546
RS		 1617 0,
1618 0,
0f113f3e 1619 },
0f113f3e
MC		 1620 {
1621 1,
748f2546 1622 TLS1_TXT_PSK_WITH_NULL_SHA384,
bbb4ceb8 1623 TLS1_RFC_PSK_WITH_NULL_SHA384,
748f2546
RS		 1624 TLS1_CK_PSK_WITH_NULL_SHA384,
1625 SSL_kPSK,
1626 SSL_aPSK,
1627 SSL_eNULL,
1628 SSL_SHA384,
1629 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1630 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1631 SSL_STRONG_NONE | SSL_FIPS,
1632 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1633 0,
1634 0,
0f113f3e 1635 },
0f113f3e
MC		 1636 {
1637 1,
748f2546 1638 TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA256,
bbb4ceb8 1639 TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA256,
748f2546
RS		 1640 TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA256,
1641 SSL_kDHEPSK,
1642 SSL_aPSK,
1643 SSL_AES128,
1644 SSL_SHA256,
1645 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1646 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1647 SSL_HIGH | SSL_FIPS,
0f113f3e 1648 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
748f2546
RS		 1649 128,
1650 128,
0f113f3e 1651 },
0f113f3e
MC		 1652 {
1653 1,
748f2546 1654 TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA384,
bbb4ceb8 1655 TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA384,
748f2546
RS		 1656 TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA384,
1657 SSL_kDHEPSK,
1658 SSL_aPSK,
0f113f3e 1659 SSL_AES256,
748f2546
RS		 1660 SSL_SHA384,
1661 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1662 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1663 SSL_HIGH | SSL_FIPS,
1664 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0f113f3e
MC		 1665 256,
1666 256,
1667 },
0f113f3e
MC		 1668 {
1669 1,
748f2546 1670 TLS1_TXT_DHE_PSK_WITH_NULL_SHA256,
bbb4ceb8 1671 TLS1_RFC_DHE_PSK_WITH_NULL_SHA256,
748f2546
RS		 1672 TLS1_CK_DHE_PSK_WITH_NULL_SHA256,
1673 SSL_kDHEPSK,
1674 SSL_aPSK,
1675 SSL_eNULL,
0f113f3e 1676 SSL_SHA256,
748f2546 1677 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1678 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1679 SSL_STRONG_NONE | SSL_FIPS,
1680 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1681 0,
1682 0,
0f113f3e 1683 },
0f113f3e
MC		 1684 {
1685 1,
748f2546 1686 TLS1_TXT_DHE_PSK_WITH_NULL_SHA384,
bbb4ceb8 1687 TLS1_RFC_DHE_PSK_WITH_NULL_SHA384,
748f2546
RS		 1688 TLS1_CK_DHE_PSK_WITH_NULL_SHA384,
1689 SSL_kDHEPSK,
1690 SSL_aPSK,
1691 SSL_eNULL,
0f113f3e 1692 SSL_SHA384,
748f2546 1693 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1694 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1695 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e 1696 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
748f2546
RS		 1697 0,
1698 0,
0f113f3e 1699 },
0f113f3e
MC		 1700 {
1701 1,
748f2546 1702 TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA256,
bbb4ceb8 1703 TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA256,
748f2546
RS		 1704 TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA256,
1705 SSL_kRSAPSK,
0f113f3e
MC		 1706 SSL_aRSA,
1707 SSL_AES128,
1708 SSL_SHA256,
748f2546 1709 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1710 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1711 SSL_HIGH | SSL_FIPS,
748f2546 1712 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0f113f3e
MC		 1713 128,
1714 128,
1715 },
0f113f3e
MC		 1716 {
1717 1,
748f2546 1718 TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA384,
bbb4ceb8 1719 TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA384,
748f2546
RS		 1720 TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA384,
1721 SSL_kRSAPSK,
0f113f3e
MC		 1722 SSL_aRSA,
1723 SSL_AES256,
1724 SSL_SHA384,
748f2546 1725 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1726 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1727 SSL_HIGH | SSL_FIPS,
0f113f3e
MC		 1728 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1729 256,
1730 256,
1731 },
0f113f3e
MC		 1732 {
1733 1,
748f2546 1734 TLS1_TXT_RSA_PSK_WITH_NULL_SHA256,
bbb4ceb8 1735 TLS1_RFC_RSA_PSK_WITH_NULL_SHA256,
748f2546
RS		 1736 TLS1_CK_RSA_PSK_WITH_NULL_SHA256,
1737 SSL_kRSAPSK,
0f113f3e 1738 SSL_aRSA,
748f2546
RS		 1739 SSL_eNULL,
1740 SSL_SHA256,
1741 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1742 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1743 SSL_STRONG_NONE | SSL_FIPS,
1744 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1745 0,
1746 0,
0f113f3e 1747 },
0f113f3e
MC		 1748 {
1749 1,
748f2546 1750 TLS1_TXT_RSA_PSK_WITH_NULL_SHA384,
bbb4ceb8 1751 TLS1_RFC_RSA_PSK_WITH_NULL_SHA384,
748f2546
RS		 1752 TLS1_CK_RSA_PSK_WITH_NULL_SHA384,
1753 SSL_kRSAPSK,
0f113f3e 1754 SSL_aRSA,
748f2546
RS		 1755 SSL_eNULL,
1756 SSL_SHA384,
1757 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1758 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546 1759 SSL_STRONG_NONE | SSL_FIPS,
0f113f3e 1760 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
748f2546
RS		 1761 0,
1762 0,
ea6114c6 1763 },
d33726b9 1764# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
ea6114c6
DSH		 1765 {
1766 1,
1767 TLS1_TXT_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1768 TLS1_RFC_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
ea6114c6
DSH		 1769 TLS1_CK_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
1770 SSL_kECDHEPSK,
1771 SSL_aPSK,
1772 SSL_3DES,
1773 SSL_SHA1,
fe55c4a2 1774 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1775 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1776 SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS,
ea6114c6
DSH		 1777 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1778 112,
1779 168,
1780 },
d33726b9 1781# endif
ea6114c6
DSH		 1782 {
1783 1,
1784 TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA,
bbb4ceb8 1785 TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA,
ea6114c6
DSH		 1786 TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA,
1787 SSL_kECDHEPSK,
1788 SSL_aPSK,
1789 SSL_AES128,
1790 SSL_SHA1,
fe55c4a2 1791 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1792 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1793 SSL_HIGH | SSL_FIPS,
ea6114c6
DSH		 1794 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1795 128,
1796 128,
1797 },
ea6114c6
DSH		 1798 {
1799 1,
1800 TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA,
bbb4ceb8 1801 TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA,
ea6114c6
DSH		 1802 TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA,
1803 SSL_kECDHEPSK,
1804 SSL_aPSK,
1805 SSL_AES256,
1806 SSL_SHA1,
fe55c4a2 1807 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1808 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1809 SSL_HIGH | SSL_FIPS,
ea6114c6
DSH		 1810 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1811 256,
1812 256,
1813 },
ea6114c6
DSH		 1814 {
1815 1,
1816 TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
bbb4ceb8 1817 TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
ea6114c6
DSH		 1818 TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
1819 SSL_kECDHEPSK,
1820 SSL_aPSK,
1821 SSL_AES128,
1822 SSL_SHA256,
3eb2aff4 1823 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1824 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1825 SSL_HIGH | SSL_FIPS,
ea6114c6
DSH		 1826 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1827 128,
1828 128,
1829 },
ea6114c6
DSH		 1830 {
1831 1,
1832 TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
bbb4ceb8 1833 TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
ea6114c6
DSH		 1834 TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
1835 SSL_kECDHEPSK,
1836 SSL_aPSK,
1837 SSL_AES256,
1838 SSL_SHA384,
3eb2aff4 1839 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1840 DTLS1_BAD_VER, DTLS1_2_VERSION,
361a1191 1841 SSL_HIGH | SSL_FIPS,
ea6114c6
DSH		 1842 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1843 256,
1844 256,
1845 },
ea6114c6
DSH		 1846 {
1847 1,
1848 TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA,
bbb4ceb8 1849 TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA,
ea6114c6
DSH		 1850 TLS1_CK_ECDHE_PSK_WITH_NULL_SHA,
1851 SSL_kECDHEPSK,
1852 SSL_aPSK,
1853 SSL_eNULL,
1854 SSL_SHA1,
fe55c4a2 1855 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1856 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 1857 SSL_STRONG_NONE | SSL_FIPS,
ea6114c6
DSH		 1858 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1859 0,
1860 0,
1861 },
ea6114c6
DSH		 1862 {
1863 1,
1864 TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA256,
bbb4ceb8 1865 TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA256,
ea6114c6
DSH		 1866 TLS1_CK_ECDHE_PSK_WITH_NULL_SHA256,
1867 SSL_kECDHEPSK,
1868 SSL_aPSK,
1869 SSL_eNULL,
1870 SSL_SHA256,
3eb2aff4 1871 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1872 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 1873 SSL_STRONG_NONE | SSL_FIPS,
ea6114c6
DSH		 1874 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1875 0,
1876 0,
1877 },
ea6114c6
DSH		 1878 {
1879 1,
1880 TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA384,
bbb4ceb8 1881 TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA384,
ea6114c6
DSH		 1882 TLS1_CK_ECDHE_PSK_WITH_NULL_SHA384,
1883 SSL_kECDHEPSK,
1884 SSL_aPSK,
1885 SSL_eNULL,
1886 SSL_SHA384,
3eb2aff4 1887 TLS1_VERSION, TLS1_2_VERSION,
387cf213 1888 DTLS1_BAD_VER, DTLS1_2_VERSION,
1510b5f7 1889 SSL_STRONG_NONE | SSL_FIPS,
ea6114c6
DSH		 1890 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
1891 0,
1892 0,
1893 },
1894
d33726b9 1895# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
748f2546
RS		 1896 {
1897 1,
1898 TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1899 TLS1_RFC_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
748f2546
RS		 1900 TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
1901 SSL_kSRP,
1902 SSL_aSRP,
1903 SSL_3DES,
1904 SSL_SHA1,
1905 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1906 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1907 SSL_NOT_DEFAULT | SSL_MEDIUM,
748f2546
RS		 1908 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1909 112,
1910 168,
1911 },
1912 {
1913 1,
1914 TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1915 TLS1_RFC_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
748f2546
RS		 1916 TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
1917 SSL_kSRP,
1918 SSL_aRSA,
1919 SSL_3DES,
1920 SSL_SHA1,
1921 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1922 DTLS1_BAD_VER, DTLS1_2_VERSION,
ef28891b 1923 SSL_NOT_DEFAULT | SSL_MEDIUM,
748f2546
RS		 1924 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1925 112,
1926 168,
1927 },
1928 {
1929 1,
1930 TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
bbb4ceb8 1931 TLS1_RFC_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
748f2546
RS		 1932 TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
1933 SSL_kSRP,
1934 SSL_aDSS,
1935 SSL_3DES,
1936 SSL_SHA1,
1937 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1938 DTLS1_BAD_VER, DTLS1_2_VERSION,
4a8e9c22 1939 SSL_NOT_DEFAULT | SSL_MEDIUM,
748f2546
RS		 1940 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1941 112,
1942 168,
1943 },
d33726b9 1944# endif
748f2546
RS		 1945 {
1946 1,
1947 TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
bbb4ceb8 1948 TLS1_RFC_SRP_SHA_WITH_AES_128_CBC_SHA,
748f2546
RS		 1949 TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
1950 SSL_kSRP,
1951 SSL_aSRP,
1952 SSL_AES128,
1953 SSL_SHA1,
1954 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1955 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1956 SSL_HIGH,
1957 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1958 128,
1959 128,
1960 },
1961 {
1962 1,
1963 TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
bbb4ceb8 1964 TLS1_RFC_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
748f2546
RS		 1965 TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
1966 SSL_kSRP,
1967 SSL_aRSA,
1968 SSL_AES128,
1969 SSL_SHA1,
1970 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1971 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1972 SSL_HIGH,
1973 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1974 128,
1975 128,
1976 },
1977 {
1978 1,
1979 TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
bbb4ceb8 1980 TLS1_RFC_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
748f2546
RS		 1981 TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
1982 SSL_kSRP,
1983 SSL_aDSS,
1984 SSL_AES128,
1985 SSL_SHA1,
1986 SSL3_VERSION, TLS1_2_VERSION,
387cf213 1987 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 1988 SSL_NOT_DEFAULT | SSL_HIGH,
1989 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
1990 128,
1991 128,
1992 },
1993 {
1994 1,
1995 TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
bbb4ceb8 1996 TLS1_RFC_SRP_SHA_WITH_AES_256_CBC_SHA,
748f2546
RS		 1997 TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
1998 SSL_kSRP,
1999 SSL_aSRP,
2000 SSL_AES256,
2001 SSL_SHA1,
2002 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2003 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2004 SSL_HIGH,
2005 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2006 256,
2007 256,
2008 },
2009 {
2010 1,
2011 TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
bbb4ceb8 2012 TLS1_RFC_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
748f2546
RS		 2013 TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
2014 SSL_kSRP,
2015 SSL_aRSA,
2016 SSL_AES256,
2017 SSL_SHA1,
2018 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2019 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2020 SSL_HIGH,
2021 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2022 256,
2023 256,
2024 },
2025 {
2026 1,
2027 TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
bbb4ceb8 2028 TLS1_RFC_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
748f2546
RS		 2029 TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
2030 SSL_kSRP,
2031 SSL_aDSS,
2032 SSL_AES256,
2033 SSL_SHA1,
2034 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2035 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2036 SSL_NOT_DEFAULT | SSL_HIGH,
2037 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2038 256,
2039 256,
2040 },
748f2546
RS		 2041
2042#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
748f2546
RS		 2043 {
2044 1,
2045 TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
bbb4ceb8 2046 TLS1_RFC_DHE_RSA_WITH_CHACHA20_POLY1305,
748f2546
RS		 2047 TLS1_CK_DHE_RSA_WITH_CHACHA20_POLY1305,
2048 SSL_kDHE,
2049 SSL_aRSA,
2050 SSL_CHACHA20POLY1305,
2051 SSL_AEAD,
2052 TLS1_2_VERSION, TLS1_2_VERSION,
2053 DTLS1_2_VERSION, DTLS1_2_VERSION,
2054 SSL_HIGH,
2055 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2056 256,
2057 256,
2058 },
748f2546
RS		 2059 {
2060 1,
2061 TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
bbb4ceb8 2062 TLS1_RFC_ECDHE_RSA_WITH_CHACHA20_POLY1305,
748f2546
RS		 2063 TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305,
2064 SSL_kECDHE,
2065 SSL_aRSA,
2066 SSL_CHACHA20POLY1305,
2067 SSL_AEAD,
2068 TLS1_2_VERSION, TLS1_2_VERSION,
2069 DTLS1_2_VERSION, DTLS1_2_VERSION,
2070 SSL_HIGH,
2071 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2072 256,
2073 256,
2074 },
2075 {
2076 1,
2077 TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
bbb4ceb8 2078 TLS1_RFC_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
748f2546
RS		 2079 TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
2080 SSL_kECDHE,
2081 SSL_aECDSA,
2082 SSL_CHACHA20POLY1305,
2083 SSL_AEAD,
2084 TLS1_2_VERSION, TLS1_2_VERSION,
2085 DTLS1_2_VERSION, DTLS1_2_VERSION,
2086 SSL_HIGH,
2087 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2088 256,
2089 256,
2090 },
748f2546
RS		 2091 {
2092 1,
2093 TLS1_TXT_PSK_WITH_CHACHA20_POLY1305,
bbb4ceb8 2094 TLS1_RFC_PSK_WITH_CHACHA20_POLY1305,
748f2546
RS		 2095 TLS1_CK_PSK_WITH_CHACHA20_POLY1305,
2096 SSL_kPSK,
2097 SSL_aPSK,
2098 SSL_CHACHA20POLY1305,
2099 SSL_AEAD,
2100 TLS1_2_VERSION, TLS1_2_VERSION,
2101 DTLS1_2_VERSION, DTLS1_2_VERSION,
2102 SSL_HIGH,
2103 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2104 256,
2105 256,
2106 },
2107 {
2108 1,
2109 TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305,
bbb4ceb8 2110 TLS1_RFC_ECDHE_PSK_WITH_CHACHA20_POLY1305,
748f2546
RS		 2111 TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305,
2112 SSL_kECDHEPSK,
2113 SSL_aPSK,
2114 SSL_CHACHA20POLY1305,
2115 SSL_AEAD,
2116 TLS1_2_VERSION, TLS1_2_VERSION,
2117 DTLS1_2_VERSION, DTLS1_2_VERSION,
2118 SSL_HIGH,
2119 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2120 256,
2121 256,
2122 },
2123 {
2124 1,
2125 TLS1_TXT_DHE_PSK_WITH_CHACHA20_POLY1305,
bbb4ceb8 2126 TLS1_RFC_DHE_PSK_WITH_CHACHA20_POLY1305,
748f2546
RS		 2127 TLS1_CK_DHE_PSK_WITH_CHACHA20_POLY1305,
2128 SSL_kDHEPSK,
2129 SSL_aPSK,
2130 SSL_CHACHA20POLY1305,
2131 SSL_AEAD,
2132 TLS1_2_VERSION, TLS1_2_VERSION,
2133 DTLS1_2_VERSION, DTLS1_2_VERSION,
2134 SSL_HIGH,
2135 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2136 256,
2137 256,
2138 },
2139 {
2140 1,
2141 TLS1_TXT_RSA_PSK_WITH_CHACHA20_POLY1305,
bbb4ceb8 2142 TLS1_RFC_RSA_PSK_WITH_CHACHA20_POLY1305,
748f2546
RS		 2143 TLS1_CK_RSA_PSK_WITH_CHACHA20_POLY1305,
2144 SSL_kRSAPSK,
2145 SSL_aRSA,
2146 SSL_CHACHA20POLY1305,
2147 SSL_AEAD,
2148 TLS1_2_VERSION, TLS1_2_VERSION,
2149 DTLS1_2_VERSION, DTLS1_2_VERSION,
2150 SSL_HIGH,
2151 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2152 256,
2153 256,
2154 },
a230b26e
EK		 2155#endif /* !defined(OPENSSL_NO_CHACHA) &&
2156 * !defined(OPENSSL_NO_POLY1305) */
748f2546
RS		 2157
2158#ifndef OPENSSL_NO_CAMELLIA
2159 {
2160 1,
2161 TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2162 TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA256,
748f2546
RS		 2163 TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2164 SSL_kRSA,
2165 SSL_aRSA,
2166 SSL_CAMELLIA128,
2167 SSL_SHA256,
2168 TLS1_2_VERSION, TLS1_2_VERSION,
2169 DTLS1_2_VERSION, DTLS1_2_VERSION,
2170 SSL_NOT_DEFAULT | SSL_HIGH,
2171 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2172 128,
2173 128,
2174 },
2175 {
2176 1,
2177 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2178 TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
748f2546
RS		 2179 TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
2180 SSL_kEDH,
2181 SSL_aDSS,
2182 SSL_CAMELLIA128,
2183 SSL_SHA256,
2184 TLS1_2_VERSION, TLS1_2_VERSION,
2185 DTLS1_2_VERSION, DTLS1_2_VERSION,
2186 SSL_NOT_DEFAULT | SSL_HIGH,
2187 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2188 128,
2189 128,
2190 },
2191 {
2192 1,
2193 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2194 TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
748f2546
RS		 2195 TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2196 SSL_kEDH,
2197 SSL_aRSA,
2198 SSL_CAMELLIA128,
2199 SSL_SHA256,
2200 TLS1_2_VERSION, TLS1_2_VERSION,
2201 DTLS1_2_VERSION, DTLS1_2_VERSION,
2202 SSL_NOT_DEFAULT | SSL_HIGH,
2203 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2204 128,
2205 128,
2206 },
2207 {
2208 1,
2209 TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2210 TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA256,
748f2546
RS		 2211 TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256,
2212 SSL_kEDH,
2213 SSL_aNULL,
2214 SSL_CAMELLIA128,
2215 SSL_SHA256,
2216 TLS1_2_VERSION, TLS1_2_VERSION,
2217 DTLS1_2_VERSION, DTLS1_2_VERSION,
2218 SSL_NOT_DEFAULT | SSL_HIGH,
2219 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2220 128,
2221 128,
2222 },
2223 {
2224 1,
2225 TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256,
bbb4ceb8 2226 TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA256,
748f2546
RS		 2227 TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2228 SSL_kRSA,
2229 SSL_aRSA,
2230 SSL_CAMELLIA256,
2231 SSL_SHA256,
2232 TLS1_2_VERSION, TLS1_2_VERSION,
2233 DTLS1_2_VERSION, DTLS1_2_VERSION,
2234 SSL_NOT_DEFAULT | SSL_HIGH,
2235 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2236 256,
2237 256,
2238 },
2239 {
2240 1,
2241 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
bbb4ceb8 2242 TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
748f2546
RS		 2243 TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
2244 SSL_kEDH,
2245 SSL_aDSS,
2246 SSL_CAMELLIA256,
2247 SSL_SHA256,
2248 TLS1_2_VERSION, TLS1_2_VERSION,
2249 DTLS1_2_VERSION, DTLS1_2_VERSION,
2250 SSL_NOT_DEFAULT | SSL_HIGH,
2251 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2252 256,
2253 256,
2254 },
2255 {
2256 1,
2257 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
bbb4ceb8 2258 TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
748f2546
RS		 2259 TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2260 SSL_kEDH,
2261 SSL_aRSA,
2262 SSL_CAMELLIA256,
2263 SSL_SHA256,
2264 TLS1_2_VERSION, TLS1_2_VERSION,
2265 DTLS1_2_VERSION, DTLS1_2_VERSION,
2266 SSL_NOT_DEFAULT | SSL_HIGH,
2267 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2268 256,
2269 256,
2270 },
2271 {
2272 1,
2273 TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256,
bbb4ceb8 2274 TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA256,
748f2546
RS		 2275 TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256,
2276 SSL_kEDH,
2277 SSL_aNULL,
2278 SSL_CAMELLIA256,
2279 SSL_SHA256,
2280 TLS1_2_VERSION, TLS1_2_VERSION,
2281 DTLS1_2_VERSION, DTLS1_2_VERSION,
2282 SSL_NOT_DEFAULT | SSL_HIGH,
2283 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2284 256,
2285 256,
2286 },
2287 {
2288 1,
2289 TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
bbb4ceb8 2290 TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA,
748f2546
RS		 2291 TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
2292 SSL_kRSA,
2293 SSL_aRSA,
2294 SSL_CAMELLIA256,
2295 SSL_SHA1,
2296 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2297 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2298 SSL_NOT_DEFAULT | SSL_HIGH,
2299 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2300 256,
2301 256,
2302 },
2303 {
2304 1,
2305 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
bbb4ceb8 2306 TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
748f2546
RS		 2307 TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
2308 SSL_kDHE,
2309 SSL_aDSS,
2310 SSL_CAMELLIA256,
2311 SSL_SHA1,
2312 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2313 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2314 SSL_NOT_DEFAULT | SSL_HIGH,
2315 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2316 256,
2317 256,
2318 },
2319 {
2320 1,
2321 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
bbb4ceb8 2322 TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
748f2546
RS		 2323 TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
2324 SSL_kDHE,
2325 SSL_aRSA,
2326 SSL_CAMELLIA256,
2327 SSL_SHA1,
2328 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2329 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2330 SSL_NOT_DEFAULT | SSL_HIGH,
2331 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2332 256,
2333 256,
2334 },
2335 {
2336 1,
2337 TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
bbb4ceb8 2338 TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA,
748f2546
RS		 2339 TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
2340 SSL_kDHE,
2341 SSL_aNULL,
2342 SSL_CAMELLIA256,
2343 SSL_SHA1,
2344 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2345 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2346 SSL_NOT_DEFAULT | SSL_HIGH,
2347 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2348 256,
2349 256,
2350 },
2351 {
2352 1,
2353 TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
bbb4ceb8 2354 TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA,
748f2546
RS		 2355 TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
2356 SSL_kRSA,
2357 SSL_aRSA,
2358 SSL_CAMELLIA128,
2359 SSL_SHA1,
2360 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2361 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2362 SSL_NOT_DEFAULT | SSL_HIGH,
2363 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2364 128,
2365 128,
2366 },
2367 {
2368 1,
2369 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
bbb4ceb8 2370 TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
748f2546
RS		 2371 TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
2372 SSL_kDHE,
2373 SSL_aDSS,
2374 SSL_CAMELLIA128,
2375 SSL_SHA1,
2376 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2377 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2378 SSL_NOT_DEFAULT | SSL_HIGH,
2379 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2380 128,
2381 128,
2382 },
2383 {
2384 1,
2385 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
bbb4ceb8 2386 TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
748f2546
RS		 2387 TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
2388 SSL_kDHE,
2389 SSL_aRSA,
2390 SSL_CAMELLIA128,
2391 SSL_SHA1,
2392 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2393 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2394 SSL_NOT_DEFAULT | SSL_HIGH,
2395 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2396 128,
2397 128,
2398 },
2399 {
2400 1,
2401 TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
bbb4ceb8 2402 TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA,
748f2546
RS		 2403 TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
2404 SSL_kDHE,
2405 SSL_aNULL,
2406 SSL_CAMELLIA128,
2407 SSL_SHA1,
2408 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2409 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2410 SSL_NOT_DEFAULT | SSL_HIGH,
2411 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2412 128,
2413 128,
2414 },
748f2546 2415 {
0f113f3e
MC		 2416 1,
2417 TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2418 TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
0f113f3e
MC		 2419 TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
2420 SSL_kECDHE,
2421 SSL_aECDSA,
2422 SSL_CAMELLIA128,
2423 SSL_SHA256,
3eb2aff4
KR		 2424 TLS1_2_VERSION, TLS1_2_VERSION,
2425 DTLS1_2_VERSION, DTLS1_2_VERSION,
a556f342 2426 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 2427 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2428 128,
a230b26e
EK		 2429 128,
2430 },
748f2546 2431 {
0f113f3e
MC		 2432 1,
2433 TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
bbb4ceb8 2434 TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
0f113f3e
MC		 2435 TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
2436 SSL_kECDHE,
2437 SSL_aECDSA,
2438 SSL_CAMELLIA256,
2439 SSL_SHA384,
3eb2aff4
KR		 2440 TLS1_2_VERSION, TLS1_2_VERSION,
2441 DTLS1_2_VERSION, DTLS1_2_VERSION,
a556f342 2442 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 2443 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
2444 256,
a230b26e
EK		 2445 256,
2446 },
748f2546 2447 {
0f113f3e
MC		 2448 1,
2449 TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2450 TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
0f113f3e
MC		 2451 TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2452 SSL_kECDHE,
2453 SSL_aRSA,
2454 SSL_CAMELLIA128,
2455 SSL_SHA256,
3eb2aff4
KR		 2456 TLS1_2_VERSION, TLS1_2_VERSION,
2457 DTLS1_2_VERSION, DTLS1_2_VERSION,
a556f342 2458 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 2459 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2460 128,
a230b26e
EK		 2461 128,
2462 },
748f2546 2463 {
0f113f3e
MC		 2464 1,
2465 TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
bbb4ceb8 2466 TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
0f113f3e
MC		 2467 TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
2468 SSL_kECDHE,
2469 SSL_aRSA,
2470 SSL_CAMELLIA256,
2471 SSL_SHA384,
3eb2aff4
KR		 2472 TLS1_2_VERSION, TLS1_2_VERSION,
2473 DTLS1_2_VERSION, DTLS1_2_VERSION,
a556f342 2474 SSL_NOT_DEFAULT | SSL_HIGH,
0f113f3e
MC		 2475 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
2476 256,
a230b26e
EK		 2477 256,
2478 },
748f2546 2479 {
69a3a9f5
DSH		 2480 1,
2481 TLS1_TXT_PSK_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2482 TLS1_RFC_PSK_WITH_CAMELLIA_128_CBC_SHA256,
69a3a9f5
DSH		 2483 TLS1_CK_PSK_WITH_CAMELLIA_128_CBC_SHA256,
2484 SSL_kPSK,
2485 SSL_aPSK,
2486 SSL_CAMELLIA128,
2487 SSL_SHA256,
3eb2aff4 2488 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2489 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2490 SSL_NOT_DEFAULT | SSL_HIGH,
69a3a9f5
DSH		 2491 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2492 128,
a230b26e
EK		 2493 128,
2494 },
748f2546 2495 {
69a3a9f5
DSH		 2496 1,
2497 TLS1_TXT_PSK_WITH_CAMELLIA_256_CBC_SHA384,
bbb4ceb8 2498 TLS1_RFC_PSK_WITH_CAMELLIA_256_CBC_SHA384,
69a3a9f5
DSH		 2499 TLS1_CK_PSK_WITH_CAMELLIA_256_CBC_SHA384,
2500 SSL_kPSK,
2501 SSL_aPSK,
2502 SSL_CAMELLIA256,
2503 SSL_SHA384,
3eb2aff4 2504 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2505 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2506 SSL_NOT_DEFAULT | SSL_HIGH,
69a3a9f5
DSH		 2507 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
2508 256,
a230b26e
EK		 2509 256,
2510 },
748f2546 2511 {
69a3a9f5
DSH		 2512 1,
2513 TLS1_TXT_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2514 TLS1_RFC_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
69a3a9f5
DSH		 2515 TLS1_CK_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
2516 SSL_kDHEPSK,
2517 SSL_aPSK,
2518 SSL_CAMELLIA128,
2519 SSL_SHA256,
3eb2aff4 2520 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2521 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2522 SSL_NOT_DEFAULT | SSL_HIGH,
69a3a9f5
DSH		 2523 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2524 128,
a230b26e
EK		 2525 128,
2526 },
748f2546 2527 {
69a3a9f5
DSH		 2528 1,
2529 TLS1_TXT_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
bbb4ceb8 2530 TLS1_RFC_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
69a3a9f5
DSH		 2531 TLS1_CK_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
2532 SSL_kDHEPSK,
2533 SSL_aPSK,
2534 SSL_CAMELLIA256,
2535 SSL_SHA384,
3eb2aff4 2536 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2537 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2538 SSL_NOT_DEFAULT | SSL_HIGH,
69a3a9f5
DSH		 2539 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
2540 256,
a230b26e
EK		 2541 256,
2542 },
748f2546 2543 {
69a3a9f5
DSH		 2544 1,
2545 TLS1_TXT_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2546 TLS1_RFC_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
69a3a9f5
DSH		 2547 TLS1_CK_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
2548 SSL_kRSAPSK,
2549 SSL_aRSA,
2550 SSL_CAMELLIA128,
2551 SSL_SHA256,
3eb2aff4 2552 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2553 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2554 SSL_NOT_DEFAULT | SSL_HIGH,
69a3a9f5
DSH		 2555 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2556 128,
a230b26e
EK		 2557 128,
2558 },
748f2546 2559 {
69a3a9f5
DSH		 2560 1,
2561 TLS1_TXT_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
bbb4ceb8 2562 TLS1_RFC_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
69a3a9f5
DSH		 2563 TLS1_CK_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
2564 SSL_kRSAPSK,
2565 SSL_aRSA,
2566 SSL_CAMELLIA256,
2567 SSL_SHA384,
3eb2aff4 2568 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2569 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2570 SSL_NOT_DEFAULT | SSL_HIGH,
69a3a9f5
DSH		 2571 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
2572 256,
a230b26e
EK		 2573 256,
2574 },
176f85a2
DSH		 2575 {
2576 1,
748f2546 2577 TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
bbb4ceb8 2578 TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
748f2546
RS		 2579 TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
2580 SSL_kECDHEPSK,
176f85a2 2581 SSL_aPSK,
748f2546
RS		 2582 SSL_CAMELLIA128,
2583 SSL_SHA256,
2584 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2585 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2586 SSL_NOT_DEFAULT | SSL_HIGH,
748f2546 2587 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
176f85a2 2588 128,
a230b26e
EK		 2589 128,
2590 },
176f85a2
DSH		 2591 {
2592 1,
748f2546 2593 TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
bbb4ceb8 2594 TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
748f2546
RS		 2595 TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
2596 SSL_kECDHEPSK,
176f85a2 2597 SSL_aPSK,
748f2546
RS		 2598 SSL_CAMELLIA256,
2599 SSL_SHA384,
2600 TLS1_VERSION, TLS1_2_VERSION,
387cf213 2601 DTLS1_BAD_VER, DTLS1_2_VERSION,
a556f342 2602 SSL_NOT_DEFAULT | SSL_HIGH,
748f2546 2603 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
176f85a2 2604 256,
a230b26e
EK		 2605 256,
2606 },
a230b26e 2607#endif /* OPENSSL_NO_CAMELLIA */
176f85a2 2608
580731af 2609#ifndef OPENSSL_NO_GOST
176f85a2
DSH		 2610 {
2611 1,
748f2546 2612 "GOST2001-GOST89-GOST89",
bbb4ceb8 2613 "TLS_GOSTR341001_WITH_28147_CNT_IMIT",
748f2546
RS		 2614 0x3000081,
2615 SSL_kGOST,
2616 SSL_aGOST01,
2617 SSL_eGOST2814789CNT,
2618 SSL_GOST89MAC,
2619 TLS1_VERSION, TLS1_2_VERSION,
48c16012 2620 0, 0,
748f2546
RS		 2621 SSL_HIGH,
2622 SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC,
176f85a2 2623 256,
a230b26e
EK		 2624 256,
2625 },
748f2546
RS		 2626 {
2627 1,
2628 "GOST2001-NULL-GOST94",
bbb4ceb8 2629 "TLS_GOSTR341001_WITH_NULL_GOSTR3411",
748f2546
RS		 2630 0x3000083,
2631 SSL_kGOST,
2632 SSL_aGOST01,
2633 SSL_eNULL,
2634 SSL_GOST94,
2635 TLS1_VERSION, TLS1_2_VERSION,
48c16012 2636 0, 0,
748f2546
RS		 2637 SSL_STRONG_NONE,
2638 SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94,
2639 0,
a230b26e
EK		 2640 0,
2641 },
748f2546
RS		 2642 {
2643 1,
98278b96
NM		 2644 "IANA-GOST2012-GOST8912-GOST8912",
2645 NULL,
2646 0x0300c102,
2647 SSL_kGOST,
2648 SSL_aGOST12 | SSL_aGOST01,
2649 SSL_eGOST2814789CNT12,
2650 SSL_GOST89MAC12,
2651 TLS1_VERSION, TLS1_2_VERSION,
2652 0, 0,
2653 SSL_HIGH,
2654 SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
2655 256,
2656 256,
2657 },
2658 {
2659 1,
2660 "LEGACY-GOST2012-GOST8912-GOST8912",
bbb4ceb8 2661 NULL,
748f2546
RS		 2662 0x0300ff85,
2663 SSL_kGOST,
2664 SSL_aGOST12 | SSL_aGOST01,
2665 SSL_eGOST2814789CNT12,
2666 SSL_GOST89MAC12,
2667 TLS1_VERSION, TLS1_2_VERSION,
48c16012 2668 0, 0,
748f2546
RS		 2669 SSL_HIGH,
2670 SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
176f85a2 2671 256,
a230b26e
EK		 2672 256,
2673 },
748f2546
RS		 2674 {
2675 1,
2676 "GOST2012-NULL-GOST12",
bbb4ceb8 2677 NULL,
748f2546
RS		 2678 0x0300ff87,
2679 SSL_kGOST,
2680 SSL_aGOST12 | SSL_aGOST01,
2681 SSL_eNULL,
2682 SSL_GOST12_256,
2683 TLS1_VERSION, TLS1_2_VERSION,
48c16012 2684 0, 0,
748f2546
RS		 2685 SSL_STRONG_NONE,
2686 SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
2687 0,
a230b26e
EK		 2688 0,
2689 },
5a5530a2
DB		 2690 {
2691 1,
2692 "GOST2012-KUZNYECHIK-KUZNYECHIKOMAC",
2693 NULL,
2694 0x0300C100,
2695 SSL_kGOST18,
2696 SSL_aGOST12,
2697 SSL_KUZNYECHIK,
2698 SSL_KUZNYECHIKOMAC,
2699 TLS1_2_VERSION, TLS1_2_VERSION,
2700 0, 0,
2701 SSL_HIGH,
2702 SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_TLSTREE,
2703 256,
2704 256,
2705 },
2706 {
2707 1,
2708 "GOST2012-MAGMA-MAGMAOMAC",
2709 NULL,
2710 0x0300C101,
2711 SSL_kGOST18,
2712 SSL_aGOST12,
2713 SSL_MAGMA,
2714 SSL_MAGMAOMAC,
2715 TLS1_2_VERSION, TLS1_2_VERSION,
2716 0, 0,
2717 SSL_HIGH,
2718 SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_TLSTREE,
2719 256,
2720 256,
2721 },
a230b26e 2722#endif /* OPENSSL_NO_GOST */
176f85a2 2723
748f2546 2724#ifndef OPENSSL_NO_IDEA
176f85a2
DSH		 2725 {
2726 1,
748f2546 2727 SSL3_TXT_RSA_IDEA_128_SHA,
bbb4ceb8 2728 SSL3_RFC_RSA_IDEA_128_SHA,
748f2546
RS		 2729 SSL3_CK_RSA_IDEA_128_SHA,
2730 SSL_kRSA,
2731 SSL_aRSA,
2732 SSL_IDEA,
2733 SSL_SHA1,
2734 SSL3_VERSION, TLS1_1_VERSION,
387cf213 2735 DTLS1_BAD_VER, DTLS1_VERSION,
748f2546
RS		 2736 SSL_NOT_DEFAULT | SSL_MEDIUM,
2737 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
176f85a2
DSH		 2738 128,
2739 128,
2740 },
748f2546 2741#endif
176f85a2 2742
748f2546 2743#ifndef OPENSSL_NO_SEED
176f85a2
DSH		 2744 {
2745 1,
748f2546 2746 TLS1_TXT_RSA_WITH_SEED_SHA,
bbb4ceb8 2747 TLS1_RFC_RSA_WITH_SEED_SHA,
748f2546
RS		 2748 TLS1_CK_RSA_WITH_SEED_SHA,
2749 SSL_kRSA,
2750 SSL_aRSA,
2751 SSL_SEED,
2752 SSL_SHA1,
2753 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2754 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2755 SSL_NOT_DEFAULT | SSL_MEDIUM,
2756 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2757 128,
2758 128,
176f85a2 2759 },
176f85a2
DSH		 2760 {
2761 1,
748f2546 2762 TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
bbb4ceb8 2763 TLS1_RFC_DHE_DSS_WITH_SEED_SHA,
748f2546
RS		 2764 TLS1_CK_DHE_DSS_WITH_SEED_SHA,
2765 SSL_kDHE,
2766 SSL_aDSS,
2767 SSL_SEED,
2768 SSL_SHA1,
2769 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2770 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2771 SSL_NOT_DEFAULT | SSL_MEDIUM,
2772 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
176f85a2
DSH		 2773 128,
2774 128,
2775 },
176f85a2
DSH		 2776 {
2777 1,
748f2546 2778 TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
bbb4ceb8 2779 TLS1_RFC_DHE_RSA_WITH_SEED_SHA,
748f2546
RS		 2780 TLS1_CK_DHE_RSA_WITH_SEED_SHA,
2781 SSL_kDHE,
2782 SSL_aRSA,
2783 SSL_SEED,
2784 SSL_SHA1,
2785 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2786 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2787 SSL_NOT_DEFAULT | SSL_MEDIUM,
2788 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2789 128,
2790 128,
176f85a2 2791 },
176f85a2
DSH		 2792 {
2793 1,
748f2546 2794 TLS1_TXT_ADH_WITH_SEED_SHA,
bbb4ceb8 2795 TLS1_RFC_ADH_WITH_SEED_SHA,
748f2546
RS		 2796 TLS1_CK_ADH_WITH_SEED_SHA,
2797 SSL_kDHE,
2798 SSL_aNULL,
2799 SSL_SEED,
2800 SSL_SHA1,
2801 SSL3_VERSION, TLS1_2_VERSION,
387cf213 2802 DTLS1_BAD_VER, DTLS1_2_VERSION,
748f2546
RS		 2803 SSL_NOT_DEFAULT | SSL_MEDIUM,
2804 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
176f85a2
DSH		 2805 128,
2806 128,
2807 },
a230b26e 2808#endif /* OPENSSL_NO_SEED */
176f85a2 2809
748f2546
RS		 2810#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
2811 {
2812 1,
2813 SSL3_TXT_RSA_RC4_128_MD5,
bbb4ceb8 2814 SSL3_RFC_RSA_RC4_128_MD5,
748f2546
RS		 2815 SSL3_CK_RSA_RC4_128_MD5,
2816 SSL_kRSA,
2817 SSL_aRSA,
2818 SSL_RC4,
2819 SSL_MD5,
2820 SSL3_VERSION, TLS1_2_VERSION,
2821 0, 0,
2822 SSL_NOT_DEFAULT | SSL_MEDIUM,
2823 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2824 128,
2825 128,
2826 },
176f85a2
DSH		 2827 {
2828 1,
748f2546 2829 SSL3_TXT_RSA_RC4_128_SHA,
bbb4ceb8 2830 SSL3_RFC_RSA_RC4_128_SHA,
748f2546
RS		 2831 SSL3_CK_RSA_RC4_128_SHA,
2832 SSL_kRSA,
2833 SSL_aRSA,
2834 SSL_RC4,
2835 SSL_SHA1,
2836 SSL3_VERSION, TLS1_2_VERSION,
2837 0, 0,
2838 SSL_NOT_DEFAULT | SSL_MEDIUM,
2839 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2840 128,
2841 128,
176f85a2 2842 },
176f85a2
DSH		 2843 {
2844 1,
748f2546 2845 SSL3_TXT_ADH_RC4_128_MD5,
bbb4ceb8 2846 SSL3_RFC_ADH_RC4_128_MD5,
748f2546
RS		 2847 SSL3_CK_ADH_RC4_128_MD5,
2848 SSL_kDHE,
2849 SSL_aNULL,
2850 SSL_RC4,
2851 SSL_MD5,
2852 SSL3_VERSION, TLS1_2_VERSION,
2853 0, 0,
2854 SSL_NOT_DEFAULT | SSL_MEDIUM,
2855 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
176f85a2
DSH		 2856 128,
2857 128,
2858 },
176f85a2
DSH		 2859 {
2860 1,
748f2546 2861 TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA,
bbb4ceb8 2862 TLS1_RFC_ECDHE_PSK_WITH_RC4_128_SHA,
748f2546
RS		 2863 TLS1_CK_ECDHE_PSK_WITH_RC4_128_SHA,
2864 SSL_kECDHEPSK,
2865 SSL_aPSK,
2866 SSL_RC4,
2867 SSL_SHA1,
fe55c4a2 2868 TLS1_VERSION, TLS1_2_VERSION,
748f2546
RS		 2869 0, 0,
2870 SSL_NOT_DEFAULT | SSL_MEDIUM,
2871 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2872 128,
2873 128,
176f85a2 2874 },
a76ba82c
AP		 2875 {
2876 1,
748f2546 2877 TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
bbb4ceb8 2878 TLS1_RFC_ECDH_anon_WITH_RC4_128_SHA,
748f2546 2879 TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
a76ba82c 2880 SSL_kECDHE,
748f2546
RS		 2881 SSL_aNULL,
2882 SSL_RC4,
2883 SSL_SHA1,
fe55c4a2 2884 TLS1_VERSION, TLS1_2_VERSION,
748f2546
RS		 2885 0, 0,
2886 SSL_NOT_DEFAULT | SSL_MEDIUM,
2887 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2888 128,
2889 128,
a76ba82c 2890 },
a76ba82c
AP		 2891 {
2892 1,
748f2546 2893 TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
bbb4ceb8 2894 TLS1_RFC_ECDHE_ECDSA_WITH_RC4_128_SHA,
748f2546 2895 TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
a76ba82c
AP		 2896 SSL_kECDHE,
2897 SSL_aECDSA,
748f2546
RS		 2898 SSL_RC4,
2899 SSL_SHA1,
fe55c4a2 2900 TLS1_VERSION, TLS1_2_VERSION,
748f2546
RS		 2901 0, 0,
2902 SSL_NOT_DEFAULT | SSL_MEDIUM,
2903 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2904 128,
2905 128,
a76ba82c 2906 },
a76ba82c
AP		 2907 {
2908 1,
748f2546 2909 TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
bbb4ceb8 2910 TLS1_RFC_ECDHE_RSA_WITH_RC4_128_SHA,
748f2546
RS		 2911 TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
2912 SSL_kECDHE,
a76ba82c 2913 SSL_aRSA,
748f2546
RS		 2914 SSL_RC4,
2915 SSL_SHA1,
fe55c4a2 2916 TLS1_VERSION, TLS1_2_VERSION,
748f2546
RS		 2917 0, 0,
2918 SSL_NOT_DEFAULT | SSL_MEDIUM,
2919 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2920 128,
2921 128,
a76ba82c 2922 },
a76ba82c
AP		 2923 {
2924 1,
748f2546 2925 TLS1_TXT_PSK_WITH_RC4_128_SHA,
bbb4ceb8 2926 TLS1_RFC_PSK_WITH_RC4_128_SHA,
748f2546 2927 TLS1_CK_PSK_WITH_RC4_128_SHA,
a76ba82c
AP		 2928 SSL_kPSK,
2929 SSL_aPSK,
748f2546
RS		 2930 SSL_RC4,
2931 SSL_SHA1,
2932 SSL3_VERSION, TLS1_2_VERSION,
2933 0, 0,
2934 SSL_NOT_DEFAULT | SSL_MEDIUM,
2935 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2936 128,
2937 128,
a76ba82c 2938 },
a76ba82c
AP		 2939 {
2940 1,
748f2546 2941 TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA,
bbb4ceb8 2942 TLS1_RFC_RSA_PSK_WITH_RC4_128_SHA,
748f2546
RS		 2943 TLS1_CK_RSA_PSK_WITH_RC4_128_SHA,
2944 SSL_kRSAPSK,
2945 SSL_aRSA,
2946 SSL_RC4,
2947 SSL_SHA1,
2948 SSL3_VERSION, TLS1_2_VERSION,
2949 0, 0,
2950 SSL_NOT_DEFAULT | SSL_MEDIUM,
2951 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2952 128,
2953 128,
a76ba82c 2954 },
a76ba82c
AP		 2955 {
2956 1,
748f2546 2957 TLS1_TXT_DHE_PSK_WITH_RC4_128_SHA,
bbb4ceb8 2958 TLS1_RFC_DHE_PSK_WITH_RC4_128_SHA,
748f2546 2959 TLS1_CK_DHE_PSK_WITH_RC4_128_SHA,
a76ba82c
AP		 2960 SSL_kDHEPSK,
2961 SSL_aPSK,
748f2546
RS		 2962 SSL_RC4,
2963 SSL_SHA1,
2964 SSL3_VERSION, TLS1_2_VERSION,
2965 0, 0,
2966 SSL_NOT_DEFAULT | SSL_MEDIUM,
2967 SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
2968 128,
2969 128,
a76ba82c 2970 },
a230b26e 2971#endif /* OPENSSL_NO_WEAK_SSL_CIPHERS */
e44380a9 2972
bc326738
JS		 2973#ifndef OPENSSL_NO_ARIA
2974 {
2975 1,
2976 TLS1_TXT_RSA_WITH_ARIA_128_GCM_SHA256,
2977 TLS1_RFC_RSA_WITH_ARIA_128_GCM_SHA256,
2978 TLS1_CK_RSA_WITH_ARIA_128_GCM_SHA256,
2979 SSL_kRSA,
2980 SSL_aRSA,
2981 SSL_ARIA128GCM,
2982 SSL_AEAD,
2983 TLS1_2_VERSION, TLS1_2_VERSION,
2984 DTLS1_2_VERSION, DTLS1_2_VERSION,
2985 SSL_NOT_DEFAULT | SSL_HIGH,
2986 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
2987 128,
2988 128,
2989 },
2990 {
2991 1,
2992 TLS1_TXT_RSA_WITH_ARIA_256_GCM_SHA384,
2993 TLS1_RFC_RSA_WITH_ARIA_256_GCM_SHA384,
2994 TLS1_CK_RSA_WITH_ARIA_256_GCM_SHA384,
2995 SSL_kRSA,
2996 SSL_aRSA,
2997 SSL_ARIA256GCM,
2998 SSL_AEAD,
2999 TLS1_2_VERSION, TLS1_2_VERSION,
3000 DTLS1_2_VERSION, DTLS1_2_VERSION,
3001 SSL_NOT_DEFAULT | SSL_HIGH,
3002 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3003 256,
3004 256,
3005 },
3006 {
3007 1,
3008 TLS1_TXT_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
3009 TLS1_RFC_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
3010 TLS1_CK_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
3011 SSL_kDHE,
3012 SSL_aRSA,
3013 SSL_ARIA128GCM,
3014 SSL_AEAD,
3015 TLS1_2_VERSION, TLS1_2_VERSION,
3016 DTLS1_2_VERSION, DTLS1_2_VERSION,
3017 SSL_NOT_DEFAULT | SSL_HIGH,
3018 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3019 128,
3020 128,
3021 },
3022 {
3023 1,
3024 TLS1_TXT_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
3025 TLS1_RFC_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
3026 TLS1_CK_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
3027 SSL_kDHE,
3028 SSL_aRSA,
3029 SSL_ARIA256GCM,
3030 SSL_AEAD,
3031 TLS1_2_VERSION, TLS1_2_VERSION,
3032 DTLS1_2_VERSION, DTLS1_2_VERSION,
3033 SSL_NOT_DEFAULT | SSL_HIGH,
3034 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3035 256,
3036 256,
3037 },
3038 {
3039 1,
3040 TLS1_TXT_DHE_DSS_WITH_ARIA_128_GCM_SHA256,
3041 TLS1_RFC_DHE_DSS_WITH_ARIA_128_GCM_SHA256,
3042 TLS1_CK_DHE_DSS_WITH_ARIA_128_GCM_SHA256,
3043 SSL_kDHE,
3044 SSL_aDSS,
3045 SSL_ARIA128GCM,
3046 SSL_AEAD,
3047 TLS1_2_VERSION, TLS1_2_VERSION,
3048 DTLS1_2_VERSION, DTLS1_2_VERSION,
3049 SSL_NOT_DEFAULT | SSL_HIGH,
3050 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3051 128,
3052 128,
3053 },
3054 {
3055 1,
3056 TLS1_TXT_DHE_DSS_WITH_ARIA_256_GCM_SHA384,
3057 TLS1_RFC_DHE_DSS_WITH_ARIA_256_GCM_SHA384,
3058 TLS1_CK_DHE_DSS_WITH_ARIA_256_GCM_SHA384,
3059 SSL_kDHE,
3060 SSL_aDSS,
3061 SSL_ARIA256GCM,
3062 SSL_AEAD,
3063 TLS1_2_VERSION, TLS1_2_VERSION,
3064 DTLS1_2_VERSION, DTLS1_2_VERSION,
3065 SSL_NOT_DEFAULT | SSL_HIGH,
3066 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3067 256,
3068 256,
3069 },
3070 {
3071 1,
3072 TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
3073 TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
3074 TLS1_CK_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
3075 SSL_kECDHE,
3076 SSL_aECDSA,
3077 SSL_ARIA128GCM,
3078 SSL_AEAD,
3079 TLS1_2_VERSION, TLS1_2_VERSION,
3080 DTLS1_2_VERSION, DTLS1_2_VERSION,
3081 SSL_NOT_DEFAULT | SSL_HIGH,
3082 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3083 128,
3084 128,
3085 },
3086 {
3087 1,
3088 TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
3089 TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
3090 TLS1_CK_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
3091 SSL_kECDHE,
3092 SSL_aECDSA,
3093 SSL_ARIA256GCM,
3094 SSL_AEAD,
3095 TLS1_2_VERSION, TLS1_2_VERSION,
3096 DTLS1_2_VERSION, DTLS1_2_VERSION,
3097 SSL_NOT_DEFAULT | SSL_HIGH,
3098 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3099 256,
3100 256,
3101 },
bc326738
JS		 3102 {
3103 1,
3104 TLS1_TXT_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
3105 TLS1_RFC_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
3106 TLS1_CK_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
3107 SSL_kECDHE,
3108 SSL_aRSA,
3109 SSL_ARIA128GCM,
3110 SSL_AEAD,
3111 TLS1_2_VERSION, TLS1_2_VERSION,
3112 DTLS1_2_VERSION, DTLS1_2_VERSION,
3113 SSL_NOT_DEFAULT | SSL_HIGH,
3114 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3115 128,
3116 128,
3117 },
3118 {
3119 1,
3120 TLS1_TXT_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
3121 TLS1_RFC_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
3122 TLS1_CK_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
3123 SSL_kECDHE,
3124 SSL_aRSA,
3125 SSL_ARIA256GCM,
3126 SSL_AEAD,
3127 TLS1_2_VERSION, TLS1_2_VERSION,
3128 DTLS1_2_VERSION, DTLS1_2_VERSION,
3129 SSL_NOT_DEFAULT | SSL_HIGH,
3130 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3131 256,
3132 256,
3133 },
3134 {
3135 1,
3136 TLS1_TXT_PSK_WITH_ARIA_128_GCM_SHA256,
3137 TLS1_RFC_PSK_WITH_ARIA_128_GCM_SHA256,
3138 TLS1_CK_PSK_WITH_ARIA_128_GCM_SHA256,
3139 SSL_kPSK,
3140 SSL_aPSK,
3141 SSL_ARIA128GCM,
3142 SSL_AEAD,
3143 TLS1_2_VERSION, TLS1_2_VERSION,
3144 DTLS1_2_VERSION, DTLS1_2_VERSION,
3145 SSL_NOT_DEFAULT | SSL_HIGH,
3146 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3147 128,
3148 128,
3149 },
3150 {
3151 1,
3152 TLS1_TXT_PSK_WITH_ARIA_256_GCM_SHA384,
3153 TLS1_RFC_PSK_WITH_ARIA_256_GCM_SHA384,
3154 TLS1_CK_PSK_WITH_ARIA_256_GCM_SHA384,
3155 SSL_kPSK,
3156 SSL_aPSK,
3157 SSL_ARIA256GCM,
3158 SSL_AEAD,
3159 TLS1_2_VERSION, TLS1_2_VERSION,
3160 DTLS1_2_VERSION, DTLS1_2_VERSION,
3161 SSL_NOT_DEFAULT | SSL_HIGH,
3162 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3163 256,
3164 256,
3165 },
3166 {
3167 1,
3168 TLS1_TXT_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
3169 TLS1_RFC_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
3170 TLS1_CK_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
3171 SSL_kDHEPSK,
3172 SSL_aPSK,
3173 SSL_ARIA128GCM,
3174 SSL_AEAD,
3175 TLS1_2_VERSION, TLS1_2_VERSION,
3176 DTLS1_2_VERSION, DTLS1_2_VERSION,
3177 SSL_NOT_DEFAULT | SSL_HIGH,
3178 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3179 128,
3180 128,
3181 },
3182 {
3183 1,
3184 TLS1_TXT_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
3185 TLS1_RFC_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
3186 TLS1_CK_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
3187 SSL_kDHEPSK,
3188 SSL_aPSK,
3189 SSL_ARIA256GCM,
3190 SSL_AEAD,
3191 TLS1_2_VERSION, TLS1_2_VERSION,
3192 DTLS1_2_VERSION, DTLS1_2_VERSION,
3193 SSL_NOT_DEFAULT | SSL_HIGH,
3194 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3195 256,
3196 256,
3197 },
bc326738
JS		 3198 {
3199 1,
3200 TLS1_TXT_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
3201 TLS1_RFC_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
3202 TLS1_CK_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
3203 SSL_kRSAPSK,
3204 SSL_aRSA,
3205 SSL_ARIA128GCM,
3206 SSL_AEAD,
3207 TLS1_2_VERSION, TLS1_2_VERSION,
3208 DTLS1_2_VERSION, DTLS1_2_VERSION,
3209 SSL_NOT_DEFAULT | SSL_HIGH,
3210 SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
3211 128,
3212 128,
3213 },
3214 {
3215 1,
3216 TLS1_TXT_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
3217 TLS1_RFC_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
3218 TLS1_CK_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
3219 SSL_kRSAPSK,
3220 SSL_aRSA,
3221 SSL_ARIA256GCM,
3222 SSL_AEAD,
3223 TLS1_2_VERSION, TLS1_2_VERSION,
3224 DTLS1_2_VERSION, DTLS1_2_VERSION,
3225 SSL_NOT_DEFAULT | SSL_HIGH,
3226 SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
3227 256,
3228 256,
3229 },
3230#endif /* OPENSSL_NO_ARIA */
0f113f3e
MC		 3231};
3232
650c6e41
BK		 3233/*
3234 * The list of known Signalling Cipher-Suite Value "ciphers", non-valid
3235 * values stuffed into the ciphers field of the wire protocol for signalling
3236 * purposes.
3237 */
3238static SSL_CIPHER ssl3_scsvs[] = {
3239 {
3240 0,
3241 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
bbb4ceb8 3242 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
650c6e41
BK		 3243 SSL3_CK_SCSV,
3244 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
3245 },
3246 {
3247 0,
3248 "TLS_FALLBACK_SCSV",
bbb4ceb8 3249 "TLS_FALLBACK_SCSV",
650c6e41
BK		 3250 SSL3_CK_FALLBACK_SCSV,
3251 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
3252 },
3253};
3254
748f2546
RS		 3255static int cipher_compare(const void *a, const void *b)
3256{
3257 const SSL_CIPHER *ap = (const SSL_CIPHER *)a;
3258 const SSL_CIPHER *bp = (const SSL_CIPHER *)b;
3259
a7ff5796
RL		 3260 if (ap->id == bp->id)
3261 return 0;
3262 return ap->id < bp->id ? -1 : 1;
748f2546
RS		 3263}
3264
3265void ssl_sort_cipher_list(void)
3266{
f865b081
MC		 3267 qsort(tls13_ciphers, TLS13_NUM_CIPHERS, sizeof(tls13_ciphers[0]),
3268 cipher_compare);
cbe29648 3269 qsort(ssl3_ciphers, SSL3_NUM_CIPHERS, sizeof(ssl3_ciphers[0]),
748f2546 3270 cipher_compare);
cbe29648 3271 qsort(ssl3_scsvs, SSL3_NUM_SCSVS, sizeof(ssl3_scsvs[0]), cipher_compare);
748f2546
RS		 3272}
3273
fce78bd4
BE		 3274static int ssl_undefined_function_1(SSL *ssl, unsigned char *r, size_t s,
3275 const char * t, size_t u,
3276 const unsigned char * v, size_t w, int x)
3277{
3278 (void)r;
3279 (void)s;
3280 (void)t;
3281 (void)u;
3282 (void)v;
3283 (void)w;
3284 (void)x;
3285 return ssl_undefined_function(ssl);
3286}
3287
0f113f3e
MC		 3288const SSL3_ENC_METHOD SSLv3_enc_data = {
3289 ssl3_enc,
3290 n_ssl3_mac,
3291 ssl3_setup_key_block,
3292 ssl3_generate_master_secret,
3293 ssl3_change_cipher_state,
3294 ssl3_final_finish_mac,
0f113f3e
MC		 3295 SSL3_MD_CLIENT_FINISHED_CONST, 4,
3296 SSL3_MD_SERVER_FINISHED_CONST, 4,
3297 ssl3_alert_code,
fce78bd4 3298 ssl_undefined_function_1,
0f113f3e 3299 0,
a29fa98c 3300 ssl3_set_handshake_header,
2c7b4dbc 3301 tls_close_construct_packet,
0f113f3e
MC		 3302 ssl3_handshake_write
3303};
58964a49 3304
f3b656b2 3305long ssl3_default_timeout(void)
0f113f3e
MC		 3306{
3307 /*
3308 * 2 hours, the 24 hours mentioned in the SSLv3 spec is way too long for
3309 * http, the cache would over fill
3310 */
3311 return (60 * 60 * 2);
3312}
d02b48c6 3313
6b691a5c 3314int ssl3_num_ciphers(void)
0f113f3e 3315{
26a7d938 3316 return SSL3_NUM_CIPHERS;
0f113f3e 3317}
d02b48c6 3318
babb3798 3319const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
0f113f3e
MC		 3320{
3321 if (u < SSL3_NUM_CIPHERS)
26a7d938 3322 return &(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]);
0f113f3e 3323 else
26a7d938 3324 return NULL;
0f113f3e 3325}
d02b48c6 3326
a29fa98c 3327int ssl3_set_handshake_header(SSL *s, WPACKET *pkt, int htype)
2c7b4dbc 3328{
4a01c59f
MC		 3329 /* No header in the event of a CCS */
3330 if (htype == SSL3_MT_CHANGE_CIPHER_SPEC)
3331 return 1;
3332
2c7b4dbc 3333 /* Set the content type and 3 bytes for the message len */
08029dfa 3334 if (!WPACKET_put_bytes_u8(pkt, htype)
de451856 3335 || !WPACKET_start_sub_packet_u24(pkt))
2c7b4dbc
MC		 3336 return 0;
3337
3338 return 1;
3339}
3340
173e72e6 3341int ssl3_handshake_write(SSL *s)
0f113f3e
MC		 3342{
3343 return ssl3_do_write(s, SSL3_RT_HANDSHAKE);
3344}
173e72e6 3345
6b691a5c 3346int ssl3_new(SSL *s)
0f113f3e 3347{
edc032b5 3348#ifndef OPENSSL_NO_SRP
61986d32 3349 if (!SSL_SRP_CTX_init(s))
e8fb288c 3350 return 0;
edc032b5 3351#endif
b77f3ed1
MC		 3352
3353 if (!s->method->ssl_clear(s))
3354 return 0;
3355
a89325e4 3356 return 1;
0f113f3e 3357}
d02b48c6 3358
6b691a5c 3359void ssl3_free(SSL *s)
0f113f3e 3360{
555cbb32 3361 if (s == NULL)
0f113f3e 3362 return;
e03ddfae 3363
0f113f3e 3364 ssl3_cleanup_key_block(s);
8d92c1f8 3365
fb79abe3 3366#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
555cbb32
TS		 3367 EVP_PKEY_free(s->s3.peer_tmp);
3368 s->s3.peer_tmp = NULL;
3369 EVP_PKEY_free(s->s3.tmp.pkey);
3370 s->s3.tmp.pkey = NULL;
ea262260
BM		 3371#endif
3372
c8f6c28a
MC		 3373 ssl_evp_cipher_free(s->s3.tmp.new_sym_enc);
3374 ssl_evp_md_free(s->s3.tmp.new_hash);
3375
555cbb32
TS		 3376 OPENSSL_free(s->s3.tmp.ctype);
3377 sk_X509_NAME_pop_free(s->s3.tmp.peer_ca_names, X509_NAME_free);
3378 OPENSSL_free(s->s3.tmp.ciphers_raw);
3379 OPENSSL_clear_free(s->s3.tmp.pms, s->s3.tmp.pmslen);
3380 OPENSSL_free(s->s3.tmp.peer_sigalgs);
3381 OPENSSL_free(s->s3.tmp.peer_cert_sigalgs);
85fb6fda 3382 ssl3_free_digest_list(s);
555cbb32
TS		 3383 OPENSSL_free(s->s3.alpn_selected);
3384 OPENSSL_free(s->s3.alpn_proposed);
6f017a8f 3385
edc032b5 3386#ifndef OPENSSL_NO_SRP
0f113f3e 3387 SSL_SRP_CTX_free(s);
edc032b5 3388#endif
555cbb32 3389 memset(&s->s3, 0, sizeof(s->s3));
0f113f3e 3390}
d02b48c6 3391
b77f3ed1 3392int ssl3_clear(SSL *s)
0f113f3e 3393{
0f113f3e 3394 ssl3_cleanup_key_block(s);
555cbb32
TS		 3395 OPENSSL_free(s->s3.tmp.ctype);
3396 sk_X509_NAME_pop_free(s->s3.tmp.peer_ca_names, X509_NAME_free);
3397 OPENSSL_free(s->s3.tmp.ciphers_raw);
3398 OPENSSL_clear_free(s->s3.tmp.pms, s->s3.tmp.pmslen);
3399 OPENSSL_free(s->s3.tmp.peer_sigalgs);
3400 OPENSSL_free(s->s3.tmp.peer_cert_sigalgs);
d02b48c6 3401
fb79abe3 3402#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
555cbb32
TS		 3403 EVP_PKEY_free(s->s3.tmp.pkey);
3404 EVP_PKEY_free(s->s3.peer_tmp);
a230b26e 3405#endif /* !OPENSSL_NO_EC */
0f113f3e 3406
85fb6fda 3407 ssl3_free_digest_list(s);
e481f9b9 3408
555cbb32
TS		 3409 OPENSSL_free(s->s3.alpn_selected);
3410 OPENSSL_free(s->s3.alpn_proposed);
e481f9b9 3411
817cd0d5 3412 /* NULL/zero-out everything in the s3 struct */
555cbb32 3413 memset(&s->s3, 0, sizeof(s->s3));
0f113f3e 3414
b77f3ed1
MC		 3415 if (!ssl_free_wbio_buffer(s))
3416 return 0;
0f113f3e 3417
0f113f3e 3418 s->version = SSL3_VERSION;
ee2ffc27 3419
e481f9b9 3420#if !defined(OPENSSL_NO_NEXTPROTONEG)
aff8c126
RS		 3421 OPENSSL_free(s->ext.npn);
3422 s->ext.npn = NULL;
3423 s->ext.npn_len = 0;
ee2ffc27 3424#endif
b77f3ed1
MC		 3425
3426 return 1;
0f113f3e 3427}
d02b48c6 3428
edc032b5 3429#ifndef OPENSSL_NO_SRP
0f113f3e
MC		 3430static char *srp_password_from_info_cb(SSL *s, void *arg)
3431{
7644a9ae 3432 return OPENSSL_strdup(s->srp_ctx.info);
0f113f3e 3433}
edc032b5
BL		 3434#endif
3435
a230b26e 3436static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len);
9f27b1ee 3437
a661b653 3438long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
0f113f3e
MC		 3439{
3440 int ret = 0;
58964a49 3441
0f113f3e 3442 switch (cmd) {
0f113f3e
MC		 3443 case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
3444 break;
3445 case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
555cbb32 3446 ret = s->s3.num_renegotiations;
0f113f3e
MC		 3447 break;
3448 case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
555cbb32
TS		 3449 ret = s->s3.num_renegotiations;
3450 s->s3.num_renegotiations = 0;
0f113f3e
MC		 3451 break;
3452 case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
555cbb32 3453 ret = s->s3.total_renegotiations;
0f113f3e
MC		 3454 break;
3455 case SSL_CTRL_GET_FLAGS:
555cbb32 3456 ret = (int)(s->s3.flags);
0f113f3e 3457 break;
bc36ee62 3458#ifndef OPENSSL_NO_DH
0f113f3e
MC		 3459 case SSL_CTRL_SET_TMP_DH:
3460 {
3461 DH *dh = (DH *)parg;
e2b420fd 3462 EVP_PKEY *pkdh = NULL;
0f113f3e
MC		 3463 if (dh == NULL) {
3464 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
d9720a59 3465 return 0;
0f113f3e 3466 }
e2b420fd
DSH		 3467 pkdh = ssl_dh_to_pkey(dh);
3468 if (pkdh == NULL) {
3469 SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
3470 return 0;
3471 }
0f113f3e 3472 if (!ssl_security(s, SSL_SECOP_TMP_DH,
e2b420fd 3473 EVP_PKEY_security_bits(pkdh), 0, pkdh)) {
0f113f3e 3474 SSLerr(SSL_F_SSL3_CTRL, SSL_R_DH_KEY_TOO_SMALL);
e2b420fd 3475 EVP_PKEY_free(pkdh);
d9720a59 3476 return 0;
0f113f3e 3477 }
e2b420fd
DSH		 3478 EVP_PKEY_free(s->cert->dh_tmp);
3479 s->cert->dh_tmp = pkdh;
d9720a59 3480 return 1;
0f113f3e
MC		 3481 }
3482 break;
3483 case SSL_CTRL_SET_TMP_DH_CB:
3484 {
3485 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
26a7d938 3486 return ret;
0f113f3e 3487 }
0f113f3e
MC		 3488 case SSL_CTRL_SET_DH_AUTO:
3489 s->cert->dh_tmp_auto = larg;
3490 return 1;
d3442bc7 3491#endif
10bf4fc2 3492#ifndef OPENSSL_NO_EC
0f113f3e
MC		 3493 case SSL_CTRL_SET_TMP_ECDH:
3494 {
6977e8ee
KR		 3495 const EC_GROUP *group = NULL;
3496 int nid;
0f113f3e
MC		 3497
3498 if (parg == NULL) {
3499 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
6977e8ee 3500 return 0;
0f113f3e 3501 }
6977e8ee
KR		 3502 group = EC_KEY_get0_group((const EC_KEY *)parg);
3503 if (group == NULL) {
3504 SSLerr(SSL_F_SSL3_CTRL, EC_R_MISSING_PARAMETERS);
3505 return 0;
0f113f3e 3506 }
6977e8ee
KR		 3507 nid = EC_GROUP_get_curve_name(group);
3508 if (nid == NID_undef)
3509 return 0;
aff8c126
RS		 3510 return tls1_set_groups(&s->ext.supportedgroups,
3511 &s->ext.supportedgroups_len,
6977e8ee 3512 &nid, 1);
0f113f3e
MC		 3513 }
3514 break;
10bf4fc2 3515#endif /* !OPENSSL_NO_EC */
0f113f3e 3516 case SSL_CTRL_SET_TLSEXT_HOSTNAME:
c5d1fb78
BK		 3517 /*
3518 * TODO(OpenSSL1.2)
3519 * This API is only used for a client to set what SNI it will request
3520 * from the server, but we currently allow it to be used on servers
3521 * as well, which is a programming error. Currently we just clear
3522 * the field in SSL_do_handshake() for server SSLs, but when we can
3523 * make ABI-breaking changes, we may want to make use of this API
3524 * an error on server SSLs.
3525 */
0f113f3e 3526 if (larg == TLSEXT_NAMETYPE_host_name) {
0982ecaa
VD		 3527 size_t len;
3528
aff8c126
RS		 3529 OPENSSL_free(s->ext.hostname);
3530 s->ext.hostname = NULL;
0f113f3e
MC		 3531
3532 ret = 1;
3533 if (parg == NULL)
3534 break;
0982ecaa
VD		 3535 len = strlen((char *)parg);
3536 if (len == 0 || len > TLSEXT_MAXLEN_host_name) {
0f113f3e
MC		 3537 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
3538 return 0;
3539 }
aff8c126 3540 if ((s->ext.hostname = OPENSSL_strdup((char *)parg)) == NULL) {
0f113f3e
MC		 3541 SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
3542 return 0;
3543 }
3544 } else {
3545 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
3546 return 0;
3547 }
3548 break;
3549 case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
aff8c126 3550 s->ext.debug_arg = parg;
0f113f3e
MC		 3551 ret = 1;
3552 break;
3553
4300aaf3 3554 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE:
aff8c126 3555 ret = s->ext.status_type;
4300aaf3
AG		 3556 break;
3557
0f113f3e 3558 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
aff8c126 3559 s->ext.status_type = larg;
0f113f3e
MC		 3560 ret = 1;
3561 break;
3562
3563 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
aff8c126 3564 *(STACK_OF(X509_EXTENSION) **)parg = s->ext.ocsp.exts;
0f113f3e
MC		 3565 ret = 1;
3566 break;
3567
3568 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
aff8c126 3569 s->ext.ocsp.exts = parg;
0f113f3e
MC		 3570 ret = 1;
3571 break;
3572
3573 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
aff8c126 3574 *(STACK_OF(OCSP_RESPID) **)parg = s->ext.ocsp.ids;
0f113f3e
MC		 3575 ret = 1;
3576 break;
3577
3578 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
aff8c126 3579 s->ext.ocsp.ids = parg;
0f113f3e
MC		 3580 ret = 1;
3581 break;
3582
3583 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
aff8c126
RS		 3584 *(unsigned char **)parg = s->ext.ocsp.resp;
3585 if (s->ext.ocsp.resp_len == 0
3586 || s->ext.ocsp.resp_len > LONG_MAX)
8b0e934a 3587 return -1;
aff8c126 3588 return (long)s->ext.ocsp.resp_len;
0f113f3e
MC		 3589
3590 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
aff8c126
RS		 3591 OPENSSL_free(s->ext.ocsp.resp);
3592 s->ext.ocsp.resp = parg;
3593 s->ext.ocsp.resp_len = larg;
0f113f3e
MC		 3594 ret = 1;
3595 break;
3596
0f113f3e
MC		 3597 case SSL_CTRL_CHAIN:
3598 if (larg)
3599 return ssl_cert_set1_chain(s, NULL, (STACK_OF(X509) *)parg);
3600 else
3601 return ssl_cert_set0_chain(s, NULL, (STACK_OF(X509) *)parg);
3602
3603 case SSL_CTRL_CHAIN_CERT:
3604 if (larg)
3605 return ssl_cert_add1_chain_cert(s, NULL, (X509 *)parg);
3606 else
3607 return ssl_cert_add0_chain_cert(s, NULL, (X509 *)parg);
3608
3609 case SSL_CTRL_GET_CHAIN_CERTS:
3610 *(STACK_OF(X509) **)parg = s->cert->key->chain;
7bc82358 3611 ret = 1;
0f113f3e
MC		 3612 break;
3613
3614 case SSL_CTRL_SELECT_CURRENT_CERT:
3615 return ssl_cert_select_current(s->cert, (X509 *)parg);
3616
3617 case SSL_CTRL_SET_CURRENT_CERT:
3618 if (larg == SSL_CERT_SET_SERVER) {
0f113f3e
MC		 3619 const SSL_CIPHER *cipher;
3620 if (!s->server)
3621 return 0;
555cbb32 3622 cipher = s->s3.tmp.new_cipher;
f365a3e2 3623 if (cipher == NULL)
0f113f3e
MC		 3624 return 0;
3625 /*
3626 * No certificate for unauthenticated ciphersuites or using SRP
3627 * authentication
3628 */
3629 if (cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
3630 return 2;
555cbb32 3631 if (s->s3.tmp.cert == NULL)
0f113f3e 3632 return 0;
555cbb32 3633 s->cert->key = s->s3.tmp.cert;
0f113f3e
MC		 3634 return 1;
3635 }
3636 return ssl_cert_set_current(s->cert, larg);
0f78819c 3637
65dc5c3c 3638#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
de4d764e 3639 case SSL_CTRL_GET_GROUPS:
0f113f3e 3640 {
9e84a42d 3641 uint16_t *clist;
0f113f3e 3642 size_t clistlen;
aff8c126 3643
0f113f3e
MC		 3644 if (!s->session)
3645 return 0;
45436e61
MC		 3646 clist = s->ext.peer_supportedgroups;
3647 clistlen = s->ext.peer_supportedgroups_len;
0f113f3e
MC		 3648 if (parg) {
3649 size_t i;
3650 int *cptr = parg;
43b95d73 3651
0f113f3e 3652 for (i = 0; i < clistlen; i++) {
9d2d857f
MC		 3653 const TLS_GROUP_INFO *cinf
3654 = tls1_group_id_lookup(s->ctx, clist[i]);
3655
3656 if (cinf != NULL) {
3657 cptr[i] = tls1_group_id2nid(cinf->group_id);
3658 if (cptr[i] == NID_undef)
3659 cptr[i] = TLSEXT_nid_unknown | clist[i];
3660 } else {
9e84a42d 3661 cptr[i] = TLSEXT_nid_unknown | clist[i];
9d2d857f 3662 }
0f113f3e
MC		 3663 }
3664 }
3665 return (int)clistlen;
3666 }
3667
de4d764e 3668 case SSL_CTRL_SET_GROUPS:
aff8c126
RS		 3669 return tls1_set_groups(&s->ext.supportedgroups,
3670 &s->ext.supportedgroups_len, parg, larg);
0f113f3e 3671
de4d764e 3672 case SSL_CTRL_SET_GROUPS_LIST:
aff8c126
RS		 3673 return tls1_set_groups_list(&s->ext.supportedgroups,
3674 &s->ext.supportedgroups_len, parg);
0f113f3e 3675
de4d764e 3676 case SSL_CTRL_GET_SHARED_GROUP:
43b95d73
DSH		 3677 {
3678 uint16_t id = tls1_shared_group(s, larg);
0f113f3e 3679
84d4b9e3 3680 if (larg != -1)
3681 return tls1_group_id2nid(id);
43b95d73
DSH		 3682 return id;
3683 }
84d4b9e3 3684 case SSL_CTRL_GET_NEGOTIATED_GROUP:
3685 ret = tls1_group_id2nid(s->s3.group_id);
3686 break;
65dc5c3c 3687#endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */
dbc6268f 3688
0f113f3e
MC		 3689 case SSL_CTRL_SET_SIGALGS:
3690 return tls1_set_sigalgs(s->cert, parg, larg, 0);
3691
3692 case SSL_CTRL_SET_SIGALGS_LIST:
3693 return tls1_set_sigalgs_list(s->cert, parg, 0);
3694
3695 case SSL_CTRL_SET_CLIENT_SIGALGS:
3696 return tls1_set_sigalgs(s->cert, parg, larg, 1);
3697
3698 case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
3699 return tls1_set_sigalgs_list(s->cert, parg, 1);
3700
3701 case SSL_CTRL_GET_CLIENT_CERT_TYPES:
3702 {
3703 const unsigned char **pctype = parg;
555cbb32 3704 if (s->server || !s->s3.tmp.cert_req)
0f113f3e 3705 return 0;
0f113f3e 3706 if (pctype)
555cbb32
TS		 3707 *pctype = s->s3.tmp.ctype;
3708 return s->s3.tmp.ctype_len;
0f113f3e
MC		 3709 }
3710
3711 case SSL_CTRL_SET_CLIENT_CERT_TYPES:
3712 if (!s->server)
3713 return 0;
3714 return ssl3_set_req_cert_type(s->cert, parg, larg);
3715
3716 case SSL_CTRL_BUILD_CERT_CHAIN:
3717 return ssl_build_cert_chain(s, NULL, larg);
3718
3719 case SSL_CTRL_SET_VERIFY_CERT_STORE:
3720 return ssl_cert_set_cert_store(s->cert, parg, 0, larg);
3721
3722 case SSL_CTRL_SET_CHAIN_CERT_STORE:
3723 return ssl_cert_set_cert_store(s->cert, parg, 1, larg);
3724
3725 case SSL_CTRL_GET_PEER_SIGNATURE_NID:
555cbb32 3726 if (s->s3.tmp.peer_sigalg == NULL)
0f113f3e 3727 return 0;
555cbb32 3728 *(int *)parg = s->s3.tmp.peer_sigalg->hash;
f742cda8 3729 return 1;
0f113f3e 3730
a51c9f63 3731 case SSL_CTRL_GET_SIGNATURE_NID:
555cbb32 3732 if (s->s3.tmp.sigalg == NULL)
a51c9f63 3733 return 0;
555cbb32 3734 *(int *)parg = s->s3.tmp.sigalg->hash;
a51c9f63
VD		 3735 return 1;
3736
3737 case SSL_CTRL_GET_PEER_TMP_KEY:
fb79abe3 3738#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
555cbb32 3739 if (s->session == NULL || s->s3.peer_tmp == NULL) {
0f113f3e 3740 return 0;
fb79abe3 3741 } else {
555cbb32
TS		 3742 EVP_PKEY_up_ref(s->s3.peer_tmp);
3743 *(EVP_PKEY **)parg = s->s3.peer_tmp;
fb79abe3 3744 return 1;
0f113f3e 3745 }
fb79abe3
DSH		 3746#else
3747 return 0;
3748#endif
a51c9f63
VD		 3749
3750 case SSL_CTRL_GET_TMP_KEY:
3751#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
555cbb32 3752 if (s->session == NULL || s->s3.tmp.pkey == NULL) {
a51c9f63
VD		 3753 return 0;
3754 } else {
555cbb32
TS		 3755 EVP_PKEY_up_ref(s->s3.tmp.pkey);
3756 *(EVP_PKEY **)parg = s->s3.tmp.pkey;
a51c9f63
VD		 3757 return 1;
3758 }
3759#else
3760 return 0;
3761#endif
3762
14536c8c 3763#ifndef OPENSSL_NO_EC
0f113f3e
MC		 3764 case SSL_CTRL_GET_EC_POINT_FORMATS:
3765 {
0f113f3e 3766 const unsigned char **pformat = parg;
aff8c126 3767
cd0fb43c 3768 if (s->ext.peer_ecpointformats == NULL)
0f113f3e 3769 return 0;
cd0fb43c
MC		 3770 *pformat = s->ext.peer_ecpointformats;
3771 return (int)s->ext.peer_ecpointformats_len;
0f113f3e 3772 }
14536c8c 3773#endif
cf6da053 3774
0f113f3e
MC		 3775 default:
3776 break;
3777 }
26a7d938 3778 return ret;
0f113f3e
MC		 3779}
3780
3781long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
3782{
3783 int ret = 0;
d3442bc7 3784
0f113f3e 3785 switch (cmd) {
bc36ee62 3786#ifndef OPENSSL_NO_DH
0f113f3e
MC		 3787 case SSL_CTRL_SET_TMP_DH_CB:
3788 {
3789 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
3790 }
3791 break;
6434abbf 3792#endif
0f113f3e 3793 case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
aff8c126 3794 s->ext.debug_cb = (void (*)(SSL *, int, int,
1ed327f7 3795 const unsigned char *, int, void *))fp;
0f113f3e 3796 break;
e481f9b9 3797
0f113f3e
MC		 3798 case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
3799 {
3800 s->not_resumable_session_cb = (int (*)(SSL *, int))fp;
3801 }
3802 break;
3803 default:
3804 break;
3805 }
26a7d938 3806 return ret;
0f113f3e 3807}
d02b48c6 3808
a661b653 3809long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
0f113f3e 3810{
0f113f3e 3811 switch (cmd) {
bc36ee62 3812#ifndef OPENSSL_NO_DH
0f113f3e
MC		 3813 case SSL_CTRL_SET_TMP_DH:
3814 {
e2b420fd
DSH		 3815 DH *dh = (DH *)parg;
3816 EVP_PKEY *pkdh = NULL;
3817 if (dh == NULL) {
3818 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_PASSED_NULL_PARAMETER);
0f113f3e
MC		 3819 return 0;
3820 }
e2b420fd
DSH		 3821 pkdh = ssl_dh_to_pkey(dh);
3822 if (pkdh == NULL) {
3823 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);
0f113f3e
MC		 3824 return 0;
3825 }
e2b420fd
DSH		 3826 if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH,
3827 EVP_PKEY_security_bits(pkdh), 0, pkdh)) {
3828 SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_DH_KEY_TOO_SMALL);
3829 EVP_PKEY_free(pkdh);
d9720a59 3830 return 0;
0f113f3e 3831 }
e2b420fd
DSH		 3832 EVP_PKEY_free(ctx->cert->dh_tmp);
3833 ctx->cert->dh_tmp = pkdh;
0f113f3e
MC		 3834 return 1;
3835 }
0f113f3e
MC		 3836 case SSL_CTRL_SET_TMP_DH_CB:
3837 {
3838 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
26a7d938 3839 return 0;
0f113f3e 3840 }
0f113f3e
MC		 3841 case SSL_CTRL_SET_DH_AUTO:
3842 ctx->cert->dh_tmp_auto = larg;
3843 return 1;
d02b48c6 3844#endif
10bf4fc2 3845#ifndef OPENSSL_NO_EC
0f113f3e
MC		 3846 case SSL_CTRL_SET_TMP_ECDH:
3847 {
6977e8ee
KR		 3848 const EC_GROUP *group = NULL;
3849 int nid;
0f113f3e
MC		 3850
3851 if (parg == NULL) {
6977e8ee 3852 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_PASSED_NULL_PARAMETER);
0f113f3e
MC		 3853 return 0;
3854 }
6977e8ee
KR		 3855 group = EC_KEY_get0_group((const EC_KEY *)parg);
3856 if (group == NULL) {
3857 SSLerr(SSL_F_SSL3_CTX_CTRL, EC_R_MISSING_PARAMETERS);
0f113f3e
MC		 3858 return 0;
3859 }
6977e8ee
KR		 3860 nid = EC_GROUP_get_curve_name(group);
3861 if (nid == NID_undef)
3862 return 0;
aff8c126
RS		 3863 return tls1_set_groups(&ctx->ext.supportedgroups,
3864 &ctx->ext.supportedgroups_len,
6977e8ee 3865 &nid, 1);
0f113f3e 3866 }
10bf4fc2 3867#endif /* !OPENSSL_NO_EC */
0f113f3e 3868 case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
aff8c126 3869 ctx->ext.servername_arg = parg;
0f113f3e
MC		 3870 break;
3871 case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
3872 case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
3873 {
3874 unsigned char *keys = parg;
aff8c126 3875 long tick_keylen = (sizeof(ctx->ext.tick_key_name) +
4bfb96f2
TS		 3876 sizeof(ctx->ext.secure->tick_hmac_key) +
3877 sizeof(ctx->ext.secure->tick_aes_key));
d139723b 3878 if (keys == NULL)
aff8c126
RS		 3879 return tick_keylen;
3880 if (larg != tick_keylen) {
0f113f3e
MC		 3881 SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
3882 return 0;
3883 }
3884 if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) {
aff8c126
RS		 3885 memcpy(ctx->ext.tick_key_name, keys,
3886 sizeof(ctx->ext.tick_key_name));
4bfb96f2 3887 memcpy(ctx->ext.secure->tick_hmac_key,
aff8c126 3888 keys + sizeof(ctx->ext.tick_key_name),
4bfb96f2
TS		 3889 sizeof(ctx->ext.secure->tick_hmac_key));
3890 memcpy(ctx->ext.secure->tick_aes_key,
aff8c126 3891 keys + sizeof(ctx->ext.tick_key_name) +
4bfb96f2
TS		 3892 sizeof(ctx->ext.secure->tick_hmac_key),
3893 sizeof(ctx->ext.secure->tick_aes_key));
0f113f3e 3894 } else {
aff8c126
RS		 3895 memcpy(keys, ctx->ext.tick_key_name,
3896 sizeof(ctx->ext.tick_key_name));
3897 memcpy(keys + sizeof(ctx->ext.tick_key_name),
4bfb96f2
TS		 3898 ctx->ext.secure->tick_hmac_key,
3899 sizeof(ctx->ext.secure->tick_hmac_key));
aff8c126 3900 memcpy(keys + sizeof(ctx->ext.tick_key_name) +
4bfb96f2
TS		 3901 sizeof(ctx->ext.secure->tick_hmac_key),
3902 ctx->ext.secure->tick_aes_key,
3903 sizeof(ctx->ext.secure->tick_aes_key));
0f113f3e
MC		 3904 }
3905 return 1;
3906 }
3907
30b96765 3908 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE:
aff8c126 3909 return ctx->ext.status_type;
30b96765 3910
ba261f71 3911 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
aff8c126 3912 ctx->ext.status_type = larg;
ba261f71 3913 break;
3914
0f113f3e 3915 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
aff8c126 3916 ctx->ext.status_arg = parg;
0f113f3e 3917 return 1;
0f113f3e 3918
fddfc0af 3919 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG:
aff8c126 3920 *(void**)parg = ctx->ext.status_arg;
fddfc0af
RG		 3921 break;
3922
3923 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB:
aff8c126 3924 *(int (**)(SSL*, void*))parg = ctx->ext.status_cb;
fddfc0af
RG		 3925 break;
3926
e481f9b9 3927#ifndef OPENSSL_NO_SRP
0f113f3e
MC		 3928 case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME:
3929 ctx->srp_ctx.srp_Mask |= SSL_kSRP;
b548a1f1 3930 OPENSSL_free(ctx->srp_ctx.login);
0f113f3e
MC		 3931 ctx->srp_ctx.login = NULL;
3932 if (parg == NULL)
3933 break;
a230b26e 3934 if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1) {
0f113f3e
MC		 3935 SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);
3936 return 0;
3937 }
7644a9ae 3938 if ((ctx->srp_ctx.login = OPENSSL_strdup((char *)parg)) == NULL) {
0f113f3e
MC		 3939 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);
3940 return 0;
3941 }
3942 break;
3943 case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:
3944 ctx->srp_ctx.SRP_give_srp_client_pwd_callback =
3945 srp_password_from_info_cb;
e655f549
DSC		 3946 if (ctx->srp_ctx.info != NULL)
3947 OPENSSL_free(ctx->srp_ctx.info);
3d484574 3948 if ((ctx->srp_ctx.info = OPENSSL_strdup((char *)parg)) == NULL) {
e655f549
DSC		 3949 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);
3950 return 0;
3951 }
0f113f3e
MC		 3952 break;
3953 case SSL_CTRL_SET_SRP_ARG:
3954 ctx->srp_ctx.srp_Mask |= SSL_kSRP;
3955 ctx->srp_ctx.SRP_cb_arg = parg;
3956 break;
3957
3958 case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:
3959 ctx->srp_ctx.strength = larg;
3960 break;
e481f9b9 3961#endif
0f113f3e 3962
65dc5c3c 3963#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
de4d764e 3964 case SSL_CTRL_SET_GROUPS:
aff8c126
RS		 3965 return tls1_set_groups(&ctx->ext.supportedgroups,
3966 &ctx->ext.supportedgroups_len,
0f113f3e
MC		 3967 parg, larg);
3968
de4d764e 3969 case SSL_CTRL_SET_GROUPS_LIST:
aff8c126
RS		 3970 return tls1_set_groups_list(&ctx->ext.supportedgroups,
3971 &ctx->ext.supportedgroups_len,
0f113f3e 3972 parg);
65dc5c3c 3973#endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */
dbc6268f 3974
0f113f3e
MC		 3975 case SSL_CTRL_SET_SIGALGS:
3976 return tls1_set_sigalgs(ctx->cert, parg, larg, 0);
3977
3978 case SSL_CTRL_SET_SIGALGS_LIST:
3979 return tls1_set_sigalgs_list(ctx->cert, parg, 0);
3980
3981 case SSL_CTRL_SET_CLIENT_SIGALGS:
3982 return tls1_set_sigalgs(ctx->cert, parg, larg, 1);
3983
3984 case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
3985 return tls1_set_sigalgs_list(ctx->cert, parg, 1);
3986
3987 case SSL_CTRL_SET_CLIENT_CERT_TYPES:
3988 return ssl3_set_req_cert_type(ctx->cert, parg, larg);
3989
3990 case SSL_CTRL_BUILD_CERT_CHAIN:
3991 return ssl_build_cert_chain(NULL, ctx, larg);
3992
3993 case SSL_CTRL_SET_VERIFY_CERT_STORE:
3994 return ssl_cert_set_cert_store(ctx->cert, parg, 0, larg);
3995
3996 case SSL_CTRL_SET_CHAIN_CERT_STORE:
3997 return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg);
3998
0f113f3e
MC		 3999 /* A Thawte special :-) */
4000 case SSL_CTRL_EXTRA_CHAIN_CERT:
4001 if (ctx->extra_certs == NULL) {
3c82e437
F		 4002 if ((ctx->extra_certs = sk_X509_new_null()) == NULL) {
4003 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);
4004 return 0;
4005 }
4006 }
9f0f53b7
MC		 4007 if (!X509v3_cache_extensions((X509 *)parg, ctx->libctx, ctx->propq)) {
4008 SSLerr(0, ERR_LIB_X509);
4009 return 0;
4010 }
3c82e437
F		 4011 if (!sk_X509_push(ctx->extra_certs, (X509 *)parg)) {
4012 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);
4013 return 0;
0f113f3e 4014 }
0f113f3e
MC		 4015 break;
4016
4017 case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
4018 if (ctx->extra_certs == NULL && larg == 0)
4019 *(STACK_OF(X509) **)parg = ctx->cert->key->chain;
4020 else
4021 *(STACK_OF(X509) **)parg = ctx->extra_certs;
4022 break;
4023
4024 case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
222561fe
RS		 4025 sk_X509_pop_free(ctx->extra_certs, X509_free);
4026 ctx->extra_certs = NULL;
0f113f3e
MC		 4027 break;
4028
4029 case SSL_CTRL_CHAIN:
4030 if (larg)
4031 return ssl_cert_set1_chain(NULL, ctx, (STACK_OF(X509) *)parg);
4032 else
4033 return ssl_cert_set0_chain(NULL, ctx, (STACK_OF(X509) *)parg);
4034
4035 case SSL_CTRL_CHAIN_CERT:
4036 if (larg)
4037 return ssl_cert_add1_chain_cert(NULL, ctx, (X509 *)parg);
4038 else
4039 return ssl_cert_add0_chain_cert(NULL, ctx, (X509 *)parg);
4040
4041 case SSL_CTRL_GET_CHAIN_CERTS:
4042 *(STACK_OF(X509) **)parg = ctx->cert->key->chain;
4043 break;
4044
4045 case SSL_CTRL_SELECT_CURRENT_CERT:
4046 return ssl_cert_select_current(ctx->cert, (X509 *)parg);
4047
4048 case SSL_CTRL_SET_CURRENT_CERT:
4049 return ssl_cert_set_current(ctx->cert, larg);
4050
4051 default:
26a7d938 4052 return 0;
0f113f3e 4053 }
208fb891 4054 return 1;
0f113f3e
MC		 4055}
4056
4057long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
4058{
0f113f3e 4059 switch (cmd) {
bc36ee62 4060#ifndef OPENSSL_NO_DH
0f113f3e
MC		 4061 case SSL_CTRL_SET_TMP_DH_CB:
4062 {
8ca8fc48 4063 ctx->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
0f113f3e
MC		 4064 }
4065 break;
ed3883d2 4066#endif
0f113f3e 4067 case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
aff8c126 4068 ctx->ext.servername_cb = (int (*)(SSL *, int *, void *))fp;
0f113f3e
MC		 4069 break;
4070
0f113f3e 4071 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
aff8c126 4072 ctx->ext.status_cb = (int (*)(SSL *, void *))fp;
0f113f3e
MC		 4073 break;
4074
a76ce286 4075# ifndef OPENSSL_NO_DEPRECATED_3_0
0f113f3e 4076 case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
aff8c126 4077 ctx->ext.ticket_key_cb = (int (*)(SSL *, unsigned char *,
0f113f3e
MC		 4078 unsigned char *,
4079 EVP_CIPHER_CTX *,
4080 HMAC_CTX *, int))fp;
4081 break;
a76ce286 4082#endif
0f113f3e 4083
e481f9b9 4084#ifndef OPENSSL_NO_SRP
0f113f3e
MC		 4085 case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB:
4086 ctx->srp_ctx.srp_Mask |= SSL_kSRP;
4087 ctx->srp_ctx.SRP_verify_param_callback = (int (*)(SSL *, void *))fp;
4088 break;
4089 case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB:
4090 ctx->srp_ctx.srp_Mask |= SSL_kSRP;
4091 ctx->srp_ctx.TLS_ext_srp_username_callback =
4092 (int (*)(SSL *, int *, void *))fp;
4093 break;
4094 case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB:
4095 ctx->srp_ctx.srp_Mask |= SSL_kSRP;
4096 ctx->srp_ctx.SRP_give_srp_client_pwd_callback =
4097 (char *(*)(SSL *, void *))fp;
4098 break;
761772d7 4099#endif
0f113f3e
MC		 4100 case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
4101 {
4102 ctx->not_resumable_session_cb = (int (*)(SSL *, int))fp;
4103 }
4104 break;
4105 default:
26a7d938 4106 return 0;
0f113f3e 4107 }
208fb891 4108 return 1;
0f113f3e 4109}
761772d7 4110
a76ce286
P		 4111int SSL_CTX_set_tlsext_ticket_key_evp_cb
4112 (SSL_CTX *ctx, int (*fp)(SSL *, unsigned char *, unsigned char *,
4113 EVP_CIPHER_CTX *, EVP_MAC_CTX *, int))
4114{
4115 ctx->ext.ticket_key_evp_cb = fp;
4116 return 1;
4117}
4118
ec15acb6
MC		 4119const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id)
4120{
4121 SSL_CIPHER c;
650c6e41 4122 const SSL_CIPHER *cp;
ec15acb6
MC		 4123
4124 c.id = id;
f865b081
MC		 4125 cp = OBJ_bsearch_ssl_cipher_id(&c, tls13_ciphers, TLS13_NUM_CIPHERS);
4126 if (cp != NULL)
4127 return cp;
650c6e41
BK		 4128 cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
4129 if (cp != NULL)
4130 return cp;
4131 return OBJ_bsearch_ssl_cipher_id(&c, ssl3_scsvs, SSL3_NUM_SCSVS);
ec15acb6
MC		 4132}
4133
bbb4ceb8
PY		 4134const SSL_CIPHER *ssl3_get_cipher_by_std_name(const char *stdname)
4135{
f865b081
MC		 4136 SSL_CIPHER *c = NULL, *tbl;
4137 SSL_CIPHER *alltabs[] = {tls13_ciphers, ssl3_ciphers};
4138 size_t i, j, tblsize[] = {TLS13_NUM_CIPHERS, SSL3_NUM_CIPHERS};
bbb4ceb8 4139
3519bae5 4140 /* this is not efficient, necessary to optimize this? */
f865b081
MC		 4141 for (j = 0; j < OSSL_NELEM(alltabs); j++) {
4142 for (i = 0, tbl = alltabs[j]; i < tblsize[j]; i++, tbl++) {
4143 if (tbl->stdname == NULL)
4144 continue;
4145 if (strcmp(stdname, tbl->stdname) == 0) {
4146 c = tbl;
4147 break;
4148 }
bbb4ceb8
PY		 4149 }
4150 }
4151 if (c == NULL) {
4152 tbl = ssl3_scsvs;
4153 for (i = 0; i < SSL3_NUM_SCSVS; i++, tbl++) {
4154 if (strcmp(stdname, tbl->stdname) == 0) {
4155 c = tbl;
4156 break;
4157 }
4158 }
4159 }
4160 return c;
4161}
4162
0f113f3e
MC		 4163/*
4164 * This function needs to check if the ciphers required are actually
4165 * available
4166 */
babb3798 4167const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
0f113f3e 4168{
1f5b44e9 4169 return ssl3_get_cipher_by_id(SSL3_CK_CIPHERSUITE_FLAG
ec15acb6
MC		 4170 | ((uint32_t)p[0] << 8L)
4171 | (uint32_t)p[1]);
0f113f3e 4172}
d02b48c6 4173
ae2f7b37 4174int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
2c7b4dbc 4175{
34f7245b 4176 if ((c->id & 0xff000000) != SSL3_CK_CIPHERSUITE_FLAG) {
2c7b4dbc
MC		 4177 *len = 0;
4178 return 1;
4179 }
4180
08029dfa 4181 if (!WPACKET_put_bytes_u16(pkt, c->id & 0xffff))
2c7b4dbc
MC		 4182 return 0;
4183
4184 *len = 2;
4185 return 1;
4186}
4187
3eb2aff4
KR		 4188/*
4189 * ssl3_choose_cipher - choose a cipher from those offered by the client
4190 * @s: SSL connection
4191 * @clnt: ciphers offered by the client
4192 * @srvr: ciphers enabled on the server?
4193 *
4194 * Returns the selected cipher or NULL when no common ciphers.
4195 */
4a640fb6 4196const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
a230b26e 4197 STACK_OF(SSL_CIPHER) *srvr)
0f113f3e 4198{
4a640fb6 4199 const SSL_CIPHER *c, *ret = NULL;
0f113f3e 4200 STACK_OF(SSL_CIPHER) *prio, *allow;
48a03162 4201 int i, ii, ok, prefer_sha256 = 0;
0de6d66d 4202 unsigned long alg_k = 0, alg_a = 0, mask_k = 0, mask_a = 0;
e1c7871d
TS		 4203#ifndef OPENSSL_NO_CHACHA
4204 STACK_OF(SSL_CIPHER) *prio_chacha = NULL;
4205#endif
d02b48c6 4206
0f113f3e 4207 /* Let's see which ciphers we can support */
d02b48c6 4208
0f113f3e
MC		 4209 /*
4210 * Do not set the compare functions, because this may lead to a
4211 * reordering by "id". We want to keep the original ordering. We may pay
4212 * a price in performance during sk_SSL_CIPHER_find(), but would have to
4213 * pay with the price of sk_SSL_CIPHER_dup().
4214 */
d02b48c6 4215
77359d22
RL		 4216 OSSL_TRACE_BEGIN(TLS_CIPHER) {
4217 BIO_printf(trc_out, "Server has %d from %p:\n",
4218 sk_SSL_CIPHER_num(srvr), (void *)srvr);
4219 for (i = 0; i < sk_SSL_CIPHER_num(srvr); ++i) {
4220 c = sk_SSL_CIPHER_value(srvr, i);
4221 BIO_printf(trc_out, "%p:%s\n", (void *)c, c->name);
4222 }
4223 BIO_printf(trc_out, "Client sent %d from %p:\n",
4224 sk_SSL_CIPHER_num(clnt), (void *)clnt);
4225 for (i = 0; i < sk_SSL_CIPHER_num(clnt); ++i) {
4226 c = sk_SSL_CIPHER_value(clnt, i);
4227 BIO_printf(trc_out, "%p:%s\n", (void *)c, c->name);
4228 }
4229 } OSSL_TRACE_END(TLS_CIPHER);
f415fa32 4230
e1c7871d
TS		 4231 /* SUITE-B takes precedence over server preference and ChaCha priortiy */
4232 if (tls1_suiteb(s)) {
4233 prio = srvr;
4234 allow = clnt;
4235 } else if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
0f113f3e
MC		 4236 prio = srvr;
4237 allow = clnt;
e1c7871d
TS		 4238#ifndef OPENSSL_NO_CHACHA
4239 /* If ChaCha20 is at the top of the client preference list,
4240 and there are ChaCha20 ciphers in the server list, then
4241 temporarily prioritize all ChaCha20 ciphers in the servers list. */
4242 if (s->options & SSL_OP_PRIORITIZE_CHACHA && sk_SSL_CIPHER_num(clnt) > 0) {
4243 c = sk_SSL_CIPHER_value(clnt, 0);
4244 if (c->algorithm_enc == SSL_CHACHA20POLY1305) {
4245 /* ChaCha20 is client preferred, check server... */
4246 int num = sk_SSL_CIPHER_num(srvr);
4247 int found = 0;
4248 for (i = 0; i < num; i++) {
4249 c = sk_SSL_CIPHER_value(srvr, i);
4250 if (c->algorithm_enc == SSL_CHACHA20POLY1305) {
4251 found = 1;
4252 break;
4253 }
4254 }
4255 if (found) {
e670e903 4256 prio_chacha = sk_SSL_CIPHER_new_reserve(NULL, num);
e1c7871d
TS		 4257 /* if reserve fails, then there's likely a memory issue */
4258 if (prio_chacha != NULL) {
4259 /* Put all ChaCha20 at the top, starting with the one we just found */
4260 sk_SSL_CIPHER_push(prio_chacha, c);
4261 for (i++; i < num; i++) {
4262 c = sk_SSL_CIPHER_value(srvr, i);
4263 if (c->algorithm_enc == SSL_CHACHA20POLY1305)
4264 sk_SSL_CIPHER_push(prio_chacha, c);
4265 }
4266 /* Pull in the rest */
4267 for (i = 0; i < num; i++) {
4268 c = sk_SSL_CIPHER_value(srvr, i);
4269 if (c->algorithm_enc != SSL_CHACHA20POLY1305)
4270 sk_SSL_CIPHER_push(prio_chacha, c);
4271 }
4272 prio = prio_chacha;
4273 }
4274 }
4275 }
4276 }
4277# endif
0f113f3e
MC		 4278 } else {
4279 prio = clnt;
4280 allow = srvr;
4281 }
4282
48a03162 4283 if (SSL_IS_TLS13(s)) {
199dc0d3 4284#ifndef OPENSSL_NO_PSK
48a03162
MC		 4285 int j;
4286
4287 /*
4288 * If we allow "old" style PSK callbacks, and we have no certificate (so
4289 * we're not going to succeed without a PSK anyway), and we're in
4290 * TLSv1.3 then the default hash for a PSK is SHA-256 (as per the
4291 * TLSv1.3 spec). Therefore we should prioritise ciphersuites using
4292 * that.
4293 */
4294 if (s->psk_server_callback != NULL) {
4295 for (j = 0; j < SSL_PKEY_NUM && !ssl_has_cert(s, j); j++);
4296 if (j == SSL_PKEY_NUM) {
4297 /* There are no certificates */
4298 prefer_sha256 = 1;
4299 }
4300 }
199dc0d3 4301#endif
48a03162 4302 } else {
0de6d66d
MC		 4303 tls1_set_cert_validity(s);
4304 ssl_set_masks(s);
4305 }
0f113f3e
MC		 4306
4307 for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
4308 c = sk_SSL_CIPHER_value(prio, i);
4309
3eb2aff4
KR		 4310 /* Skip ciphers not supported by the protocol version */
4311 if (!SSL_IS_DTLS(s) &&
a230b26e 4312 ((s->version < c->min_tls) || (s->version > c->max_tls)))
0f113f3e 4313 continue;
3eb2aff4 4314 if (SSL_IS_DTLS(s) &&
a230b26e
EK		 4315 (DTLS_VERSION_LT(s->version, c->min_dtls) ||
4316 DTLS_VERSION_GT(s->version, c->max_dtls)))
2b573382 4317 continue;
a055a881 4318
0de6d66d
MC		 4319 /*
4320 * Since TLS 1.3 ciphersuites can be used with any auth or
4321 * key exchange scheme skip tests.
4322 */
4323 if (!SSL_IS_TLS13(s)) {
555cbb32
TS		 4324 mask_k = s->s3.tmp.mask_k;
4325 mask_a = s->s3.tmp.mask_a;
edc032b5 4326#ifndef OPENSSL_NO_SRP
612ca806
DSH		 4327 if (s->srp_ctx.srp_Mask & SSL_kSRP) {
4328 mask_k |= SSL_kSRP;
4329 mask_a |= SSL_aSRP;
4330 }
edc032b5 4331#endif
0f113f3e 4332
612ca806
DSH		 4333 alg_k = c->algorithm_mkey;
4334 alg_a = c->algorithm_auth;
52b8dad8 4335
ddac1974 4336#ifndef OPENSSL_NO_PSK
612ca806
DSH		 4337 /* with PSK there must be server callback set */
4338 if ((alg_k & SSL_PSK) && s->psk_server_callback == NULL)
4339 continue;
0f113f3e
MC		 4340#endif /* OPENSSL_NO_PSK */
4341
612ca806 4342 ok = (alg_k & mask_k) && (alg_a & mask_a);
77359d22
RL		 4343 OSSL_TRACE7(TLS_CIPHER,
4344 "%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",
4345 ok, alg_k, alg_a, mask_k, mask_a, (void *)c, c->name);
d02b48c6 4346
a230b26e 4347#ifndef OPENSSL_NO_EC
612ca806
DSH		 4348 /*
4349 * if we are considering an ECC cipher suite that uses an ephemeral
4350 * EC key check it
4351 */
4352 if (alg_k & SSL_kECDHE)
4353 ok = ok && tls1_check_ec_tmp_key(s, c->id);
a230b26e 4354#endif /* OPENSSL_NO_EC */
0f113f3e 4355
612ca806
DSH		 4356 if (!ok)
4357 continue;
4358 }
0f113f3e
MC		 4359 ii = sk_SSL_CIPHER_find(allow, c);
4360 if (ii >= 0) {
4361 /* Check security callback permits this cipher */
4362 if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED,
4a640fb6 4363 c->strength_bits, 0, (void *)c))
0f113f3e 4364 continue;
e481f9b9 4365#if !defined(OPENSSL_NO_EC)
0f113f3e 4366 if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA)
555cbb32 4367 && s->s3.is_probably_safari) {
0f113f3e
MC		 4368 if (!ret)
4369 ret = sk_SSL_CIPHER_value(allow, ii);
4370 continue;
4371 }
d89cd382 4372#endif
48a03162
MC		 4373 if (prefer_sha256) {
4374 const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, ii);
4375
c8f6c28a
MC		 4376 /*
4377 * TODO: When there are no more legacy digests we can just use
4378 * OSSL_DIGEST_NAME_SHA2_256 instead of calling OBJ_nid2sn
4379 */
4380 if (EVP_MD_is_a(ssl_md(s->ctx, tmp->algorithm2),
4381 OBJ_nid2sn(NID_sha256))) {
48a03162
MC		 4382 ret = tmp;
4383 break;
4384 }
4385 if (ret == NULL)
4386 ret = tmp;
4387 continue;
4388 }
0f113f3e
MC		 4389 ret = sk_SSL_CIPHER_value(allow, ii);
4390 break;
4391 }
4392 }
e1c7871d
TS		 4393#ifndef OPENSSL_NO_CHACHA
4394 sk_SSL_CIPHER_free(prio_chacha);
4395#endif
26a7d938 4396 return ret;
0f113f3e 4397}
d02b48c6 4398
28ff8ef3 4399int ssl3_get_req_cert_type(SSL *s, WPACKET *pkt)
0f113f3e 4400{
90d9e49a 4401 uint32_t alg_k, alg_a = 0;
0f113f3e
MC		 4402
4403 /* If we have custom certificate types set, use them */
75c13e78
DSH		 4404 if (s->cert->ctype)
4405 return WPACKET_memcpy(pkt, s->cert->ctype, s->cert->ctype_len);
0f113f3e
MC		 4406 /* Get mask of algorithms disabled by signature list */
4407 ssl_set_sig_mask(&alg_a, s, SSL_SECOP_SIGALG_MASK);
0f113f3e 4408
555cbb32 4409 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
d02b48c6 4410
caa97ef1 4411#ifndef OPENSSL_NO_GOST
28ff8ef3 4412 if (s->version >= TLS1_VERSION && (alg_k & SSL_kGOST))
5a5530a2
DB		 4413 if (!WPACKET_put_bytes_u8(pkt, TLS_CT_GOST01_SIGN)
4414 || !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_SIGN)
4415 || !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_512_SIGN)
4416 || !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_LEGACY_SIGN)
4417 || !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_LEGACY_512_SIGN))
4418 return 0;
4419
4420 if (s->version >= TLS1_2_VERSION && (alg_k & SSL_kGOST18))
4421 if (!WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_SIGN)
4422 || !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_512_SIGN))
4423 return 0;
caa97ef1
DSH		 4424#endif
4425
bc71f910 4426 if ((s->version == SSL3_VERSION) && (alg_k & SSL_kDHE)) {
bc36ee62 4427#ifndef OPENSSL_NO_DH
0f113f3e 4428# ifndef OPENSSL_NO_RSA
28ff8ef3
MC		 4429 if (!WPACKET_put_bytes_u8(pkt, SSL3_CT_RSA_EPHEMERAL_DH))
4430 return 0;
0f113f3e
MC		 4431# endif
4432# ifndef OPENSSL_NO_DSA
28ff8ef3
MC		 4433 if (!WPACKET_put_bytes_u8(pkt, SSL3_CT_DSS_EPHEMERAL_DH))
4434 return 0;
0f113f3e 4435# endif
0f113f3e 4436#endif /* !OPENSSL_NO_DH */
1e0784ff 4437 }
bc36ee62 4438#ifndef OPENSSL_NO_RSA
28ff8ef3
MC		 4439 if (!(alg_a & SSL_aRSA) && !WPACKET_put_bytes_u8(pkt, SSL3_CT_RSA_SIGN))
4440 return 0;
d02b48c6 4441#endif
bc36ee62 4442#ifndef OPENSSL_NO_DSA
28ff8ef3
MC		 4443 if (!(alg_a & SSL_aDSS) && !WPACKET_put_bytes_u8(pkt, SSL3_CT_DSS_SIGN))
4444 return 0;
dfeab068 4445#endif
10bf4fc2 4446#ifndef OPENSSL_NO_EC
0f113f3e 4447 /*
c66ce5eb 4448 * ECDSA certs can be used with RSA cipher suites too so we don't
0f113f3e
MC		 4449 * need to check for SSL_kECDH or SSL_kECDHE
4450 */
28ff8ef3
MC		 4451 if (s->version >= TLS1_VERSION
4452 && !(alg_a & SSL_aECDSA)
4453 && !WPACKET_put_bytes_u8(pkt, TLS_CT_ECDSA_SIGN))
4454 return 0;
0f113f3e 4455#endif
28ff8ef3 4456 return 1;
0f113f3e 4457}
d02b48c6 4458
9f27b1ee 4459static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len)
0f113f3e 4460{
75c13e78
DSH		 4461 OPENSSL_free(c->ctype);
4462 c->ctype = NULL;
4463 c->ctype_len = 0;
4464 if (p == NULL || len == 0)
0f113f3e
MC		 4465 return 1;
4466 if (len > 0xff)
4467 return 0;
75c13e78
DSH		 4468 c->ctype = OPENSSL_memdup(p, len);
4469 if (c->ctype == NULL)
0f113f3e 4470 return 0;
75c13e78 4471 c->ctype_len = len;
0f113f3e
MC		 4472 return 1;
4473}
9f27b1ee 4474
6b691a5c 4475int ssl3_shutdown(SSL *s)
0f113f3e
MC		 4476{
4477 int ret;
4478
4479 /*
4480 * Don't do anything much if we have not done the handshake or we don't
4481 * want to send messages :-)
4482 */
c874def6 4483 if (s->quiet_shutdown || SSL_in_before(s)) {
0f113f3e 4484 s->shutdown = (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
208fb891 4485 return 1;
0f113f3e
MC		 4486 }
4487
4488 if (!(s->shutdown & SSL_SENT_SHUTDOWN)) {
4489 s->shutdown |= SSL_SENT_SHUTDOWN;
0f113f3e 4490 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
0f113f3e
MC		 4491 /*
4492 * our shutdown alert has been sent now, and if it still needs to be
555cbb32 4493 * written, s->s3.alert_dispatch will be true
0f113f3e 4494 */
555cbb32 4495 if (s->s3.alert_dispatch)
26a7d938 4496 return -1; /* return WANT_WRITE */
555cbb32 4497 } else if (s->s3.alert_dispatch) {
0f113f3e 4498 /* resend it if not sent */
0f113f3e
MC		 4499 ret = s->method->ssl_dispatch_alert(s);
4500 if (ret == -1) {
4501 /*
4502 * we only get to return -1 here the 2nd/Nth invocation, we must
8483a003 4503 * have already signalled return 0 upon a previous invocation,
0f113f3e
MC		 4504 * return WANT_WRITE
4505 */
26a7d938 4506 return ret;
0f113f3e 4507 }
0f113f3e 4508 } else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
54105ddd 4509 size_t readbytes;
0f113f3e
MC		 4510 /*
4511 * If we are waiting for a close from our peer, we are closed
4512 */
54105ddd 4513 s->method->ssl_read_bytes(s, 0, NULL, NULL, 0, 0, &readbytes);
0f113f3e 4514 if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
eda75751 4515 return -1; /* return WANT_READ */
0f113f3e
MC		 4516 }
4517 }
4518
4519 if ((s->shutdown == (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN)) &&
555cbb32 4520 !s->s3.alert_dispatch)
208fb891 4521 return 1;
0f113f3e 4522 else
26a7d938 4523 return 0;
0f113f3e 4524}
d02b48c6 4525
7ee8627f 4526int ssl3_write(SSL *s, const void *buf, size_t len, size_t *written)
0f113f3e 4527{
0f113f3e 4528 clear_sys_error();
555cbb32 4529 if (s->s3.renegotiate)
c7f47786 4530 ssl3_renegotiate_check(s, 0);
0f113f3e 4531
7ee8627f
MC		 4532 return s->method->ssl_write_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len,
4533 written);
0f113f3e 4534}
d02b48c6 4535
eda75751 4536static int ssl3_read_internal(SSL *s, void *buf, size_t len, int peek,
54105ddd 4537 size_t *readbytes)
0f113f3e
MC		 4538{
4539 int ret;
4540
4541 clear_sys_error();
555cbb32 4542 if (s->s3.renegotiate)
c7f47786 4543 ssl3_renegotiate_check(s, 0);
555cbb32 4544 s->s3.in_read_app_data = 1;
0f113f3e 4545 ret =
657da85e 4546 s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, NULL, buf, len,
54105ddd 4547 peek, readbytes);
555cbb32 4548 if ((ret == -1) && (s->s3.in_read_app_data == 2)) {
0f113f3e
MC		 4549 /*
4550 * ssl3_read_bytes decided to call s->handshake_func, which called
4551 * ssl3_read_bytes to read handshake data. However, ssl3_read_bytes
4552 * actually found application data and thinks that application data
4553 * makes sense here; so disable handshake processing and try to read
4554 * application data again.
4555 */
024f543c 4556 ossl_statem_set_in_handshake(s, 1);
0f113f3e 4557 ret =
657da85e 4558 s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, NULL, buf,
54105ddd 4559 len, peek, readbytes);
024f543c 4560 ossl_statem_set_in_handshake(s, 0);
0f113f3e 4561 } else
555cbb32 4562 s->s3.in_read_app_data = 0;
0f113f3e 4563
eda75751 4564 return ret;
0f113f3e 4565}
d02b48c6 4566
54105ddd 4567int ssl3_read(SSL *s, void *buf, size_t len, size_t *readbytes)
0f113f3e 4568{
54105ddd 4569 return ssl3_read_internal(s, buf, len, 0, readbytes);
0f113f3e 4570}
d02b48c6 4571
54105ddd 4572int ssl3_peek(SSL *s, void *buf, size_t len, size_t *readbytes)
0f113f3e 4573{
54105ddd 4574 return ssl3_read_internal(s, buf, len, 1, readbytes);
0f113f3e 4575}
d02b48c6 4576
6b691a5c 4577int ssl3_renegotiate(SSL *s)
0f113f3e
MC		 4578{
4579 if (s->handshake_func == NULL)
208fb891 4580 return 1;
d02b48c6 4581
555cbb32 4582 s->s3.renegotiate = 1;
208fb891 4583 return 1;
0f113f3e 4584}
d02b48c6 4585
c7f47786
MC		 4586/*
4587 * Check if we are waiting to do a renegotiation and if so whether now is a
4588 * good time to do it. If |initok| is true then we are being called from inside
4589 * the state machine so ignore the result of SSL_in_init(s). Otherwise we
4590 * should not do a renegotiation if SSL_in_init(s) is true. Returns 1 if we
4591 * should do a renegotiation now and sets up the state machine for it. Otherwise
4592 * returns 0.
4593 */
4594int ssl3_renegotiate_check(SSL *s, int initok)
0f113f3e
MC		 4595{
4596 int ret = 0;
4597
555cbb32 4598 if (s->s3.renegotiate) {
f161995e
MC		 4599 if (!RECORD_LAYER_read_pending(&s->rlayer)
4600 && !RECORD_LAYER_write_pending(&s->rlayer)
c7f47786 4601 && (initok || !SSL_in_init(s))) {
0f113f3e
MC		 4602 /*
4603 * if we are the server, and we have sent a 'RENEGOTIATE'
49ae7423
MC		 4604 * message, we need to set the state machine into the renegotiate
4605 * state.
0f113f3e 4606 */
fe3a3291 4607 ossl_statem_set_renegotiate(s);
555cbb32
TS		 4608 s->s3.renegotiate = 0;
4609 s->s3.num_renegotiations++;
4610 s->s3.total_renegotiations++;
0f113f3e
MC		 4611 ret = 1;
4612 }
4613 }
c7f47786 4614 return ret;
0f113f3e
MC		 4615}
4616
58964a49 4617/*
0f113f3e
MC		 4618 * If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF and
4619 * handshake macs if required.
12053a81
DSH		 4620 *
4621 * If PSK and using SHA384 for TLS < 1.2 switch to default.
7409d7ad
DSH		 4622 */
4623long ssl_get_algorithm2(SSL *s)
0f113f3e 4624{
52eede5a 4625 long alg2;
555cbb32 4626 if (s->s3.tmp.new_cipher == NULL)
52eede5a 4627 return -1;
555cbb32 4628 alg2 = s->s3.tmp.new_cipher->algorithm2;
12053a81
DSH		 4629 if (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF) {
4630 if (alg2 == (SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF))
4631 return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
555cbb32 4632 } else if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK) {
12053a81
DSH		 4633 if (alg2 == (SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384))
4634 return SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF;
4635 }
0f113f3e
MC		 4636 return alg2;
4637}
a3680c8f
MC		 4638
4639/*
4640 * Fill a ClientRandom or ServerRandom field of length len. Returns <= 0 on
4641 * failure, 1 on success.
4642 */
f7f2a01d
MC		 4643int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, size_t len,
4644 DOWNGRADE dgrd)
a3680c8f 4645{
f7f2a01d 4646 int send_time = 0, ret;
a3680c8f
MC		 4647
4648 if (len < 4)
4649 return 0;
4650 if (server)
4651 send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;
4652 else
4653 send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;
4654 if (send_time) {
4655 unsigned long Time = (unsigned long)time(NULL);
4656 unsigned char *p = result;
ae3947de 4657
a3680c8f 4658 l2n(Time, p);
8f21260b 4659 ret = RAND_bytes_ex(s->ctx->libctx, p, len - 4);
f7f2a01d 4660 } else {
8f21260b 4661 ret = RAND_bytes_ex(s->ctx->libctx, result, len);
f7f2a01d 4662 }
9f22c527 4663
16cfc2c9 4664 if (ret > 0) {
b77f3ed1
MC		 4665 if (!ossl_assert(sizeof(tls11downgrade) < len)
4666 || !ossl_assert(sizeof(tls12downgrade) < len))
4667 return 0;
f7f2a01d
MC		 4668 if (dgrd == DOWNGRADE_TO_1_2)
4669 memcpy(result + len - sizeof(tls12downgrade), tls12downgrade,
4670 sizeof(tls12downgrade));
4671 else if (dgrd == DOWNGRADE_TO_1_1)
4672 memcpy(result + len - sizeof(tls11downgrade), tls11downgrade,
4673 sizeof(tls11downgrade));
4674 }
9f22c527 4675
f7f2a01d 4676 return ret;
a3680c8f 4677}
57b272b0
DSH		 4678
4679int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen,
4680 int free_pms)
4681{
555cbb32 4682 unsigned long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
8c1a5343
MC		 4683 int ret = 0;
4684
8a0a12e5 4685 if (alg_k & SSL_PSK) {
0907d710 4686#ifndef OPENSSL_NO_PSK
8a0a12e5 4687 unsigned char *pskpms, *t;
555cbb32 4688 size_t psklen = s->s3.tmp.psklen;
8a0a12e5
DSH		 4689 size_t pskpmslen;
4690
4691 /* create PSK premaster_secret */
4692
4693 /* For plain PSK "other_secret" is psklen zeroes */
4694 if (alg_k & SSL_kPSK)
4695 pmslen = psklen;
4696
4697 pskpmslen = 4 + pmslen + psklen;
4698 pskpms = OPENSSL_malloc(pskpmslen);
8c1a5343 4699 if (pskpms == NULL)
a784665e 4700 goto err;
8a0a12e5
DSH		 4701 t = pskpms;
4702 s2n(pmslen, t);
4703 if (alg_k & SSL_kPSK)
4704 memset(t, 0, pmslen);
4705 else
4706 memcpy(t, pms, pmslen);
4707 t += pmslen;
4708 s2n(psklen, t);
555cbb32 4709 memcpy(t, s->s3.tmp.psk, psklen);
8a0a12e5 4710
555cbb32
TS		 4711 OPENSSL_clear_free(s->s3.tmp.psk, psklen);
4712 s->s3.tmp.psk = NULL;
8c1a5343 4713 if (!s->method->ssl3_enc->generate_master_secret(s,
1866a0d3 4714 s->session->master_key, pskpms, pskpmslen,
f63a17d6 4715 &s->session->master_key_length)) {
c2cb1a18 4716 OPENSSL_clear_free(pskpms, pskpmslen);
f63a17d6 4717 /* SSLfatal() already called */
8c1a5343 4718 goto err;
f63a17d6 4719 }
8a0a12e5 4720 OPENSSL_clear_free(pskpms, pskpmslen);
0907d710
MC		 4721#else
4722 /* Should never happen */
0907d710 4723 goto err;
8a0a12e5 4724#endif
0907d710 4725 } else {
8c1a5343
MC		 4726 if (!s->method->ssl3_enc->generate_master_secret(s,
4727 s->session->master_key, pms, pmslen,
f63a17d6
MC		 4728 &s->session->master_key_length)) {
4729 /* SSLfatal() already called */
8c1a5343 4730 goto err;
f63a17d6 4731 }
0907d710
MC		 4732 }
4733
8c1a5343 4734 ret = 1;
0907d710 4735 err:
8a0a12e5
DSH		 4736 if (pms) {
4737 if (free_pms)
4738 OPENSSL_clear_free(pms, pmslen);
4739 else
4740 OPENSSL_cleanse(pms, pmslen);
4741 }
57b272b0 4742 if (s->server == 0)
555cbb32 4743 s->s3.tmp.pms = NULL;
8c1a5343 4744 return ret;
57b272b0 4745}
3f3504bd 4746
0a699a07 4747/* Generate a private key from parameters */
0f00ed77 4748EVP_PKEY *ssl_generate_pkey(SSL *s, EVP_PKEY *pm)
3f3504bd
DSH		 4749{
4750 EVP_PKEY_CTX *pctx = NULL;
4751 EVP_PKEY *pkey = NULL;
0a699a07
DSH		 4752
4753 if (pm == NULL)
4754 return NULL;
0f00ed77 4755 pctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, pm, s->ctx->propq);
0a699a07
DSH		 4756 if (pctx == NULL)
4757 goto err;
4758 if (EVP_PKEY_keygen_init(pctx) <= 0)
4759 goto err;
4760 if (EVP_PKEY_keygen(pctx, &pkey) <= 0) {
4761 EVP_PKEY_free(pkey);
4762 pkey = NULL;
4763 }
4764
4765 err:
4766 EVP_PKEY_CTX_free(pctx);
4767 return pkey;
4768}
9aaecbfc 4769
43b95d73 4770/* Generate a private key from a group ID */
f63a17d6 4771EVP_PKEY *ssl_generate_pkey_group(SSL *s, uint16_t id)
0a699a07 4772{
9d2d857f 4773 const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(s->ctx, id);
0a699a07
DSH		 4774 EVP_PKEY_CTX *pctx = NULL;
4775 EVP_PKEY *pkey = NULL;
0a699a07 4776
f63a17d6
MC		 4777 if (ginf == NULL) {
4778 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
4779 ERR_R_INTERNAL_ERROR);
0a699a07 4780 goto err;
f63a17d6 4781 }
d882e4ce 4782
9d2d857f 4783 pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, ginf->algorithm,
c0bfc473
MC		 4784 s->ctx->propq);
4785
f63a17d6
MC		 4786 if (pctx == NULL) {
4787 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
4788 ERR_R_MALLOC_FAILURE);
3f3504bd 4789 goto err;
f63a17d6
MC		 4790 }
4791 if (EVP_PKEY_keygen_init(pctx) <= 0) {
4792 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
4793 ERR_R_EVP_LIB);
3f3504bd 4794 goto err;
f63a17d6 4795 }
9d2d857f
MC		 4796 if (!EVP_PKEY_CTX_set_group_name(pctx, ginf->realname)) {
4797 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
4798 ERR_R_EVP_LIB);
4799 goto err;
f63a17d6 4800 }
3f3504bd 4801 if (EVP_PKEY_keygen(pctx, &pkey) <= 0) {
f63a17d6
MC		 4802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
4803 ERR_R_EVP_LIB);
3f3504bd
DSH		 4804 EVP_PKEY_free(pkey);
4805 pkey = NULL;
4806 }
4807
a230b26e 4808 err:
3f3504bd
DSH		 4809 EVP_PKEY_CTX_free(pctx);
4810 return pkey;
4811}
612f9d22
DSH		 4812
4813/*
4814 * Generate parameters from a group ID
4815 */
ada66e78 4816EVP_PKEY *ssl_generate_param_group(SSL *s, uint16_t id)
612f9d22
DSH		 4817{
4818 EVP_PKEY_CTX *pctx = NULL;
4819 EVP_PKEY *pkey = NULL;
9d2d857f 4820 const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(s->ctx, id);
612f9d22
DSH		 4821
4822 if (ginf == NULL)
4823 goto err;
4824
9d2d857f 4825 pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, ginf->algorithm,
d882e4ce 4826 s->ctx->propq);
d882e4ce 4827
612f9d22
DSH		 4828 if (pctx == NULL)
4829 goto err;
4830 if (EVP_PKEY_paramgen_init(pctx) <= 0)
4831 goto err;
9d2d857f
MC		 4832 if (!EVP_PKEY_CTX_set_group_name(pctx, ginf->realname)) {
4833 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP,
4834 ERR_R_EVP_LIB);
4835 goto err;
9aaecbfc 4836 }
612f9d22
DSH		 4837 if (EVP_PKEY_paramgen(pctx, &pkey) <= 0) {
4838 EVP_PKEY_free(pkey);
4839 pkey = NULL;
4840 }
4841
4842 err:
4843 EVP_PKEY_CTX_free(pctx);
4844 return pkey;
4845}
a230b26e 4846
92760c21
MC		 4847/* Derive secrets for ECDH/DH */
4848int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey, int gensecret)
3f3504bd
DSH		 4849{
4850 int rv = 0;
4851 unsigned char *pms = NULL;
4852 size_t pmslen = 0;
4853 EVP_PKEY_CTX *pctx;
4854
f63a17d6
MC		 4855 if (privkey == NULL || pubkey == NULL) {
4856 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE,
4857 ERR_R_INTERNAL_ERROR);
3f3504bd 4858 return 0;
f63a17d6 4859 }
3f3504bd 4860
0f00ed77 4861 pctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, privkey, s->ctx->propq);
3f3504bd
DSH		 4862
4863 if (EVP_PKEY_derive_init(pctx) <= 0
4864 || EVP_PKEY_derive_set_peer(pctx, pubkey) <= 0
4865 || EVP_PKEY_derive(pctx, NULL, &pmslen) <= 0) {
f63a17d6
MC		 4866 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE,
4867 ERR_R_INTERNAL_ERROR);
3f3504bd
DSH		 4868 goto err;
4869 }
4870
6597d62b 4871#ifndef OPENSSL_NO_DH
9aaecbfc 4872 if (SSL_IS_TLS13(s) && EVP_PKEY_id(privkey) == EVP_PKEY_DH)
4873 EVP_PKEY_CTX_set_dh_pad(pctx, 1);
6597d62b 4874#endif
9aaecbfc 4875
3f3504bd 4876 pms = OPENSSL_malloc(pmslen);
f63a17d6
MC		 4877 if (pms == NULL) {
4878 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE,
4879 ERR_R_MALLOC_FAILURE);
3f3504bd 4880 goto err;
f63a17d6 4881 }
3f3504bd 4882
f63a17d6
MC		 4883 if (EVP_PKEY_derive(pctx, pms, &pmslen) <= 0) {
4884 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE,
4885 ERR_R_INTERNAL_ERROR);
3f3504bd 4886 goto err;
f63a17d6 4887 }
3f3504bd 4888
92760c21 4889 if (gensecret) {
f63a17d6 4890 /* SSLfatal() called as appropriate in the below functions */
92760c21
MC		 4891 if (SSL_IS_TLS13(s)) {
4892 /*
ec15acb6
MC		 4893 * If we are resuming then we already generated the early secret
4894 * when we created the ClientHello, so don't recreate it.
92760c21 4895 */
ec15acb6
MC		 4896 if (!s->hit)
4897 rv = tls13_generate_secret(s, ssl_handshake_md(s), NULL, NULL,
4898 0,
4899 (unsigned char *)&s->early_secret);
0247086d
MC		 4900 else
4901 rv = 1;
4902
ec15acb6 4903 rv = rv && tls13_generate_handshake_secret(s, pms, pmslen);
92760c21 4904 } else {
c8ab3a46 4905 rv = ssl_generate_master_secret(s, pms, pmslen, 0);
92760c21 4906 }
3f3504bd 4907 } else {
0f1e51ea 4908 /* Save premaster secret */
555cbb32
TS		 4909 s->s3.tmp.pms = pms;
4910 s->s3.tmp.pmslen = pmslen;
3f3504bd
DSH		 4911 pms = NULL;
4912 rv = 1;
4913 }
4914
a230b26e 4915 err:
3f3504bd
DSH		 4916 OPENSSL_clear_free(pms, pmslen);
4917 EVP_PKEY_CTX_free(pctx);
4918 return rv;
4919}
6c4e6670 4920
1e0784ff 4921#ifndef OPENSSL_NO_DH
6c4e6670
DSH		 4922EVP_PKEY *ssl_dh_to_pkey(DH *dh)
4923{
4924 EVP_PKEY *ret;
4925 if (dh == NULL)
4926 return NULL;
4927 ret = EVP_PKEY_new();
4928 if (EVP_PKEY_set1_DH(ret, dh) <= 0) {
4929 EVP_PKEY_free(ret);
4930 return NULL;
4931 }
4932 return ret;
4933}
1e0784ff 4934#endif
A mirror of the official openssl repository