]> git.ipfire.org Git - thirdparty/openssl.git/blob - ssl/s3_lib.c
projects / thirdparty / openssl.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
When processing ClientHello.cipher_suites, don't ignore cipher suites
[thirdparty/openssl.git] / ssl / s3_lib.c
1 /* ssl/s3_lib.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58 /* ====================================================================
59 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
111 /* ====================================================================
112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113 *
114 * Portions of the attached software ("Contribution") are developed by
115 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
116 *
117 * The Contribution is licensed pursuant to the OpenSSL open source
118 * license provided above.
119 *
120 * ECC cipher suite support in OpenSSL originally written by
121 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
122 *
123 */
124
125 #include <stdio.h>
126 #include <openssl/objects.h>
127 #include "ssl_locl.h"
128 #include "kssl_lcl.h"
129 #include <openssl/md5.h>
130 #ifndef OPENSSL_NO_DH
131 #include <openssl/dh.h>
132 #endif
133 #include <openssl/pq_compat.h>
134
135 const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
136
137 #define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
138
139 /* list of available SSLv3 ciphers (sorted by id) */
140 OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
141 /* The RSA ciphers */
142 /* Cipher 01 */
143 {
144 1,
145 SSL3_TXT_RSA_NULL_MD5,
146 SSL3_CK_RSA_NULL_MD5,
147 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3,
148 SSL_NOT_EXP|SSL_STRONG_NONE,
149 0,
150 0,
151 0,
152 SSL_ALL_CIPHERS,
153 SSL_ALL_STRENGTHS,
154 },
155 /* Cipher 02 */
156 {
157 1,
158 SSL3_TXT_RSA_NULL_SHA,
159 SSL3_CK_RSA_NULL_SHA,
160 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
161 SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
162 0,
163 0,
164 0,
165 SSL_ALL_CIPHERS,
166 SSL_ALL_STRENGTHS,
167 },
168 /* Cipher 03 */
169 {
170 1,
171 SSL3_TXT_RSA_RC4_40_MD5,
172 SSL3_CK_RSA_RC4_40_MD5,
173 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_SSLV3,
174 SSL_EXPORT|SSL_EXP40,
175 0,
176 40,
177 128,
178 SSL_ALL_CIPHERS,
179 SSL_ALL_STRENGTHS,
180 },
181 /* Cipher 04 */
182 {
183 1,
184 SSL3_TXT_RSA_RC4_128_MD5,
185 SSL3_CK_RSA_RC4_128_MD5,
186 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_SSLV3,
187 SSL_NOT_EXP|SSL_MEDIUM,
188 0,
189 128,
190 128,
191 SSL_ALL_CIPHERS,
192 SSL_ALL_STRENGTHS,
193 },
194 /* Cipher 05 */
195 {
196 1,
197 SSL3_TXT_RSA_RC4_128_SHA,
198 SSL3_CK_RSA_RC4_128_SHA,
199 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_SSLV3,
200 SSL_NOT_EXP|SSL_MEDIUM,
201 0,
202 128,
203 128,
204 SSL_ALL_CIPHERS,
205 SSL_ALL_STRENGTHS,
206 },
207 /* Cipher 06 */
208 {
209 1,
210 SSL3_TXT_RSA_RC2_40_MD5,
211 SSL3_CK_RSA_RC2_40_MD5,
212 SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_SSLV3,
213 SSL_EXPORT|SSL_EXP40,
214 0,
215 40,
216 128,
217 SSL_ALL_CIPHERS,
218 SSL_ALL_STRENGTHS,
219 },
220 /* Cipher 07 */
221 #ifndef OPENSSL_NO_IDEA
222 {
223 1,
224 SSL3_TXT_RSA_IDEA_128_SHA,
225 SSL3_CK_RSA_IDEA_128_SHA,
226 SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3,
227 SSL_NOT_EXP|SSL_MEDIUM,
228 0,
229 128,
230 128,
231 SSL_ALL_CIPHERS,
232 SSL_ALL_STRENGTHS,
233 },
234 #endif
235 /* Cipher 08 */
236 {
237 1,
238 SSL3_TXT_RSA_DES_40_CBC_SHA,
239 SSL3_CK_RSA_DES_40_CBC_SHA,
240 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
241 SSL_EXPORT|SSL_EXP40,
242 0,
243 40,
244 56,
245 SSL_ALL_CIPHERS,
246 SSL_ALL_STRENGTHS,
247 },
248 /* Cipher 09 */
249 {
250 1,
251 SSL3_TXT_RSA_DES_64_CBC_SHA,
252 SSL3_CK_RSA_DES_64_CBC_SHA,
253 SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3,
254 SSL_NOT_EXP|SSL_LOW,
255 0,
256 56,
257 56,
258 SSL_ALL_CIPHERS,
259 SSL_ALL_STRENGTHS,
260 },
261 /* Cipher 0A */
262 {
263 1,
264 SSL3_TXT_RSA_DES_192_CBC3_SHA,
265 SSL3_CK_RSA_DES_192_CBC3_SHA,
266 SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
267 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
268 0,
269 168,
270 168,
271 SSL_ALL_CIPHERS,
272 SSL_ALL_STRENGTHS,
273 },
274 /* The DH ciphers */
275 /* Cipher 0B */
276 {
277 0,
278 SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
279 SSL3_CK_DH_DSS_DES_40_CBC_SHA,
280 SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
281 SSL_EXPORT|SSL_EXP40,
282 0,
283 40,
284 56,
285 SSL_ALL_CIPHERS,
286 SSL_ALL_STRENGTHS,
287 },
288 /* Cipher 0C */
289 {
290 0,
291 SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
292 SSL3_CK_DH_DSS_DES_64_CBC_SHA,
293 SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3,
294 SSL_NOT_EXP|SSL_LOW,
295 0,
296 56,
297 56,
298 SSL_ALL_CIPHERS,
299 SSL_ALL_STRENGTHS,
300 },
301 /* Cipher 0D */
302 {
303 0,
304 SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
305 SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
306 SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
307 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
308 0,
309 168,
310 168,
311 SSL_ALL_CIPHERS,
312 SSL_ALL_STRENGTHS,
313 },
314 /* Cipher 0E */
315 {
316 0,
317 SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
318 SSL3_CK_DH_RSA_DES_40_CBC_SHA,
319 SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
320 SSL_EXPORT|SSL_EXP40,
321 0,
322 40,
323 56,
324 SSL_ALL_CIPHERS,
325 SSL_ALL_STRENGTHS,
326 },
327 /* Cipher 0F */
328 {
329 0,
330 SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
331 SSL3_CK_DH_RSA_DES_64_CBC_SHA,
332 SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3,
333 SSL_NOT_EXP|SSL_LOW,
334 0,
335 56,
336 56,
337 SSL_ALL_CIPHERS,
338 SSL_ALL_STRENGTHS,
339 },
340 /* Cipher 10 */
341 {
342 0,
343 SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
344 SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
345 SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
346 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
347 0,
348 168,
349 168,
350 SSL_ALL_CIPHERS,
351 SSL_ALL_STRENGTHS,
352 },
353
354 /* The Ephemeral DH ciphers */
355 /* Cipher 11 */
356 {
357 1,
358 SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
359 SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
360 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
361 SSL_EXPORT|SSL_EXP40,
362 0,
363 40,
364 56,
365 SSL_ALL_CIPHERS,
366 SSL_ALL_STRENGTHS,
367 },
368 /* Cipher 12 */
369 {
370 1,
371 SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
372 SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
373 SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3,
374 SSL_NOT_EXP|SSL_LOW,
375 0,
376 56,
377 56,
378 SSL_ALL_CIPHERS,
379 SSL_ALL_STRENGTHS,
380 },
381 /* Cipher 13 */
382 {
383 1,
384 SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
385 SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
386 SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
387 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
388 0,
389 168,
390 168,
391 SSL_ALL_CIPHERS,
392 SSL_ALL_STRENGTHS,
393 },
394 /* Cipher 14 */
395 {
396 1,
397 SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
398 SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
399 SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
400 SSL_EXPORT|SSL_EXP40,
401 0,
402 40,
403 56,
404 SSL_ALL_CIPHERS,
405 SSL_ALL_STRENGTHS,
406 },
407 /* Cipher 15 */
408 {
409 1,
410 SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
411 SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
412 SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3,
413 SSL_NOT_EXP|SSL_LOW,
414 0,
415 56,
416 56,
417 SSL_ALL_CIPHERS,
418 SSL_ALL_STRENGTHS,
419 },
420 /* Cipher 16 */
421 {
422 1,
423 SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
424 SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
425 SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
426 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
427 0,
428 168,
429 168,
430 SSL_ALL_CIPHERS,
431 SSL_ALL_STRENGTHS,
432 },
433 /* Cipher 17 */
434 {
435 1,
436 SSL3_TXT_ADH_RC4_40_MD5,
437 SSL3_CK_ADH_RC4_40_MD5,
438 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3,
439 SSL_EXPORT|SSL_EXP40,
440 0,
441 40,
442 128,
443 SSL_ALL_CIPHERS,
444 SSL_ALL_STRENGTHS,
445 },
446 /* Cipher 18 */
447 {
448 1,
449 SSL3_TXT_ADH_RC4_128_MD5,
450 SSL3_CK_ADH_RC4_128_MD5,
451 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3,
452 SSL_NOT_EXP|SSL_MEDIUM,
453 0,
454 128,
455 128,
456 SSL_ALL_CIPHERS,
457 SSL_ALL_STRENGTHS,
458 },
459 /* Cipher 19 */
460 {
461 1,
462 SSL3_TXT_ADH_DES_40_CBC_SHA,
463 SSL3_CK_ADH_DES_40_CBC_SHA,
464 SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
465 SSL_EXPORT|SSL_EXP40,
466 0,
467 40,
468 128,
469 SSL_ALL_CIPHERS,
470 SSL_ALL_STRENGTHS,
471 },
472 /* Cipher 1A */
473 {
474 1,
475 SSL3_TXT_ADH_DES_64_CBC_SHA,
476 SSL3_CK_ADH_DES_64_CBC_SHA,
477 SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3,
478 SSL_NOT_EXP|SSL_LOW,
479 0,
480 56,
481 56,
482 SSL_ALL_CIPHERS,
483 SSL_ALL_STRENGTHS,
484 },
485 /* Cipher 1B */
486 {
487 1,
488 SSL3_TXT_ADH_DES_192_CBC_SHA,
489 SSL3_CK_ADH_DES_192_CBC_SHA,
490 SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
491 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
492 0,
493 168,
494 168,
495 SSL_ALL_CIPHERS,
496 SSL_ALL_STRENGTHS,
497 },
498
499 /* Fortezza */
500 /* Cipher 1C */
501 {
502 0,
503 SSL3_TXT_FZA_DMS_NULL_SHA,
504 SSL3_CK_FZA_DMS_NULL_SHA,
505 SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3,
506 SSL_NOT_EXP|SSL_STRONG_NONE,
507 0,
508 0,
509 0,
510 SSL_ALL_CIPHERS,
511 SSL_ALL_STRENGTHS,
512 },
513
514 /* Cipher 1D */
515 {
516 0,
517 SSL3_TXT_FZA_DMS_FZA_SHA,
518 SSL3_CK_FZA_DMS_FZA_SHA,
519 SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3,
520 SSL_NOT_EXP|SSL_STRONG_NONE,
521 0,
522 0,
523 0,
524 SSL_ALL_CIPHERS,
525 SSL_ALL_STRENGTHS,
526 },
527
528 #if 0
529 /* Cipher 1E */
530 {
531 0,
532 SSL3_TXT_FZA_DMS_RC4_SHA,
533 SSL3_CK_FZA_DMS_RC4_SHA,
534 SSL_kFZA|SSL_aFZA |SSL_RC4 |SSL_SHA1|SSL_SSLV3,
535 SSL_NOT_EXP|SSL_MEDIUM,
536 0,
537 128,
538 128,
539 SSL_ALL_CIPHERS,
540 SSL_ALL_STRENGTHS,
541 },
542 #endif
543
544 #ifndef OPENSSL_NO_KRB5
545 /* The Kerberos ciphers */
546 /* Cipher 1E */
547 {
548 1,
549 SSL3_TXT_KRB5_DES_64_CBC_SHA,
550 SSL3_CK_KRB5_DES_64_CBC_SHA,
551 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3,
552 SSL_NOT_EXP|SSL_LOW,
553 0,
554 56,
555 56,
556 SSL_ALL_CIPHERS,
557 SSL_ALL_STRENGTHS,
558 },
559
560 /* Cipher 1F */
561 {
562 1,
563 SSL3_TXT_KRB5_DES_192_CBC3_SHA,
564 SSL3_CK_KRB5_DES_192_CBC3_SHA,
565 SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_SHA1 |SSL_SSLV3,
566 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
567 0,
568 168,
569 168,
570 SSL_ALL_CIPHERS,
571 SSL_ALL_STRENGTHS,
572 },
573
574 /* Cipher 20 */
575 {
576 1,
577 SSL3_TXT_KRB5_RC4_128_SHA,
578 SSL3_CK_KRB5_RC4_128_SHA,
579 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3,
580 SSL_NOT_EXP|SSL_MEDIUM,
581 0,
582 128,
583 128,
584 SSL_ALL_CIPHERS,
585 SSL_ALL_STRENGTHS,
586 },
587
588 /* Cipher 21 */
589 {
590 1,
591 SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
592 SSL3_CK_KRB5_IDEA_128_CBC_SHA,
593 SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_SHA1 |SSL_SSLV3,
594 SSL_NOT_EXP|SSL_MEDIUM,
595 0,
596 128,
597 128,
598 SSL_ALL_CIPHERS,
599 SSL_ALL_STRENGTHS,
600 },
601
602 /* Cipher 22 */
603 {
604 1,
605 SSL3_TXT_KRB5_DES_64_CBC_MD5,
606 SSL3_CK_KRB5_DES_64_CBC_MD5,
607 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3,
608 SSL_NOT_EXP|SSL_LOW,
609 0,
610 56,
611 56,
612 SSL_ALL_CIPHERS,
613 SSL_ALL_STRENGTHS,
614 },
615
616 /* Cipher 23 */
617 {
618 1,
619 SSL3_TXT_KRB5_DES_192_CBC3_MD5,
620 SSL3_CK_KRB5_DES_192_CBC3_MD5,
621 SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_MD5 |SSL_SSLV3,
622 SSL_NOT_EXP|SSL_HIGH,
623 0,
624 168,
625 168,
626 SSL_ALL_CIPHERS,
627 SSL_ALL_STRENGTHS,
628 },
629
630 /* Cipher 24 */
631 {
632 1,
633 SSL3_TXT_KRB5_RC4_128_MD5,
634 SSL3_CK_KRB5_RC4_128_MD5,
635 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3,
636 SSL_NOT_EXP|SSL_MEDIUM,
637 0,
638 128,
639 128,
640 SSL_ALL_CIPHERS,
641 SSL_ALL_STRENGTHS,
642 },
643
644 /* Cipher 25 */
645 {
646 1,
647 SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
648 SSL3_CK_KRB5_IDEA_128_CBC_MD5,
649 SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_MD5 |SSL_SSLV3,
650 SSL_NOT_EXP|SSL_MEDIUM,
651 0,
652 128,
653 128,
654 SSL_ALL_CIPHERS,
655 SSL_ALL_STRENGTHS,
656 },
657
658 /* Cipher 26 */
659 {
660 1,
661 SSL3_TXT_KRB5_DES_40_CBC_SHA,
662 SSL3_CK_KRB5_DES_40_CBC_SHA,
663 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3,
664 SSL_EXPORT|SSL_EXP40,
665 0,
666 40,
667 56,
668 SSL_ALL_CIPHERS,
669 SSL_ALL_STRENGTHS,
670 },
671
672 /* Cipher 27 */
673 {
674 1,
675 SSL3_TXT_KRB5_RC2_40_CBC_SHA,
676 SSL3_CK_KRB5_RC2_40_CBC_SHA,
677 SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_SHA1 |SSL_SSLV3,
678 SSL_EXPORT|SSL_EXP40,
679 0,
680 40,
681 128,
682 SSL_ALL_CIPHERS,
683 SSL_ALL_STRENGTHS,
684 },
685
686 /* Cipher 28 */
687 {
688 1,
689 SSL3_TXT_KRB5_RC4_40_SHA,
690 SSL3_CK_KRB5_RC4_40_SHA,
691 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3,
692 SSL_EXPORT|SSL_EXP40,
693 0,
694 40,
695 128,
696 SSL_ALL_CIPHERS,
697 SSL_ALL_STRENGTHS,
698 },
699
700 /* Cipher 29 */
701 {
702 1,
703 SSL3_TXT_KRB5_DES_40_CBC_MD5,
704 SSL3_CK_KRB5_DES_40_CBC_MD5,
705 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3,
706 SSL_EXPORT|SSL_EXP40,
707 0,
708 40,
709 56,
710 SSL_ALL_CIPHERS,
711 SSL_ALL_STRENGTHS,
712 },
713
714 /* Cipher 2A */
715 {
716 1,
717 SSL3_TXT_KRB5_RC2_40_CBC_MD5,
718 SSL3_CK_KRB5_RC2_40_CBC_MD5,
719 SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_MD5 |SSL_SSLV3,
720 SSL_EXPORT|SSL_EXP40,
721 0,
722 40,
723 128,
724 SSL_ALL_CIPHERS,
725 SSL_ALL_STRENGTHS,
726 },
727
728 /* Cipher 2B */
729 {
730 1,
731 SSL3_TXT_KRB5_RC4_40_MD5,
732 SSL3_CK_KRB5_RC4_40_MD5,
733 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3,
734 SSL_EXPORT|SSL_EXP40,
735 0,
736 40,
737 128,
738 SSL_ALL_CIPHERS,
739 SSL_ALL_STRENGTHS,
740 },
741 #endif /* OPENSSL_NO_KRB5 */
742
743 /* New AES ciphersuites */
744 /* Cipher 2F */
745 {
746 1,
747 TLS1_TXT_RSA_WITH_AES_128_SHA,
748 TLS1_CK_RSA_WITH_AES_128_SHA,
749 SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
750 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
751 0,
752 128,
753 128,
754 SSL_ALL_CIPHERS,
755 SSL_ALL_STRENGTHS,
756 },
757 /* Cipher 30 */
758 {
759 0,
760 TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
761 TLS1_CK_DH_DSS_WITH_AES_128_SHA,
762 SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
763 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
764 0,
765 128,
766 128,
767 SSL_ALL_CIPHERS,
768 SSL_ALL_STRENGTHS,
769 },
770 /* Cipher 31 */
771 {
772 0,
773 TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
774 TLS1_CK_DH_RSA_WITH_AES_128_SHA,
775 SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
776 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
777 0,
778 128,
779 128,
780 SSL_ALL_CIPHERS,
781 SSL_ALL_STRENGTHS,
782 },
783 /* Cipher 32 */
784 {
785 1,
786 TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
787 TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
788 SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
789 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
790 0,
791 128,
792 128,
793 SSL_ALL_CIPHERS,
794 SSL_ALL_STRENGTHS,
795 },
796 /* Cipher 33 */
797 {
798 1,
799 TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
800 TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
801 SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
802 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
803 0,
804 128,
805 128,
806 SSL_ALL_CIPHERS,
807 SSL_ALL_STRENGTHS,
808 },
809 /* Cipher 34 */
810 {
811 1,
812 TLS1_TXT_ADH_WITH_AES_128_SHA,
813 TLS1_CK_ADH_WITH_AES_128_SHA,
814 SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
815 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
816 0,
817 128,
818 128,
819 SSL_ALL_CIPHERS,
820 SSL_ALL_STRENGTHS,
821 },
822
823 /* Cipher 35 */
824 {
825 1,
826 TLS1_TXT_RSA_WITH_AES_256_SHA,
827 TLS1_CK_RSA_WITH_AES_256_SHA,
828 SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
829 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
830 0,
831 256,
832 256,
833 SSL_ALL_CIPHERS,
834 SSL_ALL_STRENGTHS,
835 },
836 /* Cipher 36 */
837 {
838 0,
839 TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
840 TLS1_CK_DH_DSS_WITH_AES_256_SHA,
841 SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
842 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
843 0,
844 256,
845 256,
846 SSL_ALL_CIPHERS,
847 SSL_ALL_STRENGTHS,
848 },
849 /* Cipher 37 */
850 {
851 0,
852 TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
853 TLS1_CK_DH_RSA_WITH_AES_256_SHA,
854 SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
855 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
856 0,
857 256,
858 256,
859 SSL_ALL_CIPHERS,
860 SSL_ALL_STRENGTHS,
861 },
862 /* Cipher 38 */
863 {
864 1,
865 TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
866 TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
867 SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
868 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
869 0,
870 256,
871 256,
872 SSL_ALL_CIPHERS,
873 SSL_ALL_STRENGTHS,
874 },
875 /* Cipher 39 */
876 {
877 1,
878 TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
879 TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
880 SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
881 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
882 0,
883 256,
884 256,
885 SSL_ALL_CIPHERS,
886 SSL_ALL_STRENGTHS,
887 },
888 /* Cipher 3A */
889 {
890 1,
891 TLS1_TXT_ADH_WITH_AES_256_SHA,
892 TLS1_CK_ADH_WITH_AES_256_SHA,
893 SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
894 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
895 0,
896 256,
897 256,
898 SSL_ALL_CIPHERS,
899 SSL_ALL_STRENGTHS,
900 },
901
902 #ifndef OPENSSL_NO_CAMELLIA
903 /* Camellia ciphersuites from RFC4132 (128-bit portion) */
904
905 /* Cipher 41 */
906 {
907 1,
908 TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
909 TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
910 SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
911 SSL_NOT_EXP|SSL_HIGH,
912 0,
913 128,
914 128,
915 SSL_ALL_CIPHERS,
916 SSL_ALL_STRENGTHS
917 },
918 /* Cipher 42 */
919 {
920 0, /* not implemented (non-ephemeral DH) */
921 TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
922 TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
923 SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
924 SSL_NOT_EXP|SSL_HIGH,
925 0,
926 128,
927 128,
928 SSL_ALL_CIPHERS,
929 SSL_ALL_STRENGTHS
930 },
931 /* Cipher 43 */
932 {
933 0, /* not implemented (non-ephemeral DH) */
934 TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
935 TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
936 SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
937 SSL_NOT_EXP|SSL_HIGH,
938 0,
939 128,
940 128,
941 SSL_ALL_CIPHERS,
942 SSL_ALL_STRENGTHS
943 },
944 /* Cipher 44 */
945 {
946 1,
947 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
948 TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
949 SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
950 SSL_NOT_EXP|SSL_HIGH,
951 0,
952 128,
953 128,
954 SSL_ALL_CIPHERS,
955 SSL_ALL_STRENGTHS
956 },
957 /* Cipher 45 */
958 {
959 1,
960 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
961 TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
962 SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
963 SSL_NOT_EXP|SSL_HIGH,
964 0,
965 128,
966 128,
967 SSL_ALL_CIPHERS,
968 SSL_ALL_STRENGTHS
969 },
970 /* Cipher 46 */
971 {
972 1,
973 TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
974 TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
975 SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
976 SSL_NOT_EXP|SSL_HIGH,
977 0,
978 128,
979 128,
980 SSL_ALL_CIPHERS,
981 SSL_ALL_STRENGTHS
982 },
983 #endif /* OPENSSL_NO_CAMELLIA */
984
985 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
986 /* New TLS Export CipherSuites from expired ID */
987 #if 0
988 /* Cipher 60 */
989 {
990 1,
991 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
992 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
993 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1,
994 SSL_EXPORT|SSL_EXP56,
995 0,
996 56,
997 128,
998 SSL_ALL_CIPHERS,
999 SSL_ALL_STRENGTHS,
1000 },
1001 /* Cipher 61 */
1002 {
1003 1,
1004 TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1005 TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1006 SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1,
1007 SSL_EXPORT|SSL_EXP56,
1008 0,
1009 56,
1010 128,
1011 SSL_ALL_CIPHERS,
1012 SSL_ALL_STRENGTHS,
1013 },
1014 #endif
1015 /* Cipher 62 */
1016 {
1017 1,
1018 TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1019 TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1020 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
1021 SSL_EXPORT|SSL_EXP56,
1022 0,
1023 56,
1024 56,
1025 SSL_ALL_CIPHERS,
1026 SSL_ALL_STRENGTHS,
1027 },
1028 /* Cipher 63 */
1029 {
1030 1,
1031 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1032 TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1033 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
1034 SSL_EXPORT|SSL_EXP56,
1035 0,
1036 56,
1037 56,
1038 SSL_ALL_CIPHERS,
1039 SSL_ALL_STRENGTHS,
1040 },
1041 /* Cipher 64 */
1042 {
1043 1,
1044 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
1045 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
1046 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
1047 SSL_EXPORT|SSL_EXP56,
1048 0,
1049 56,
1050 128,
1051 SSL_ALL_CIPHERS,
1052 SSL_ALL_STRENGTHS,
1053 },
1054 /* Cipher 65 */
1055 {
1056 1,
1057 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1058 TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1059 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
1060 SSL_EXPORT|SSL_EXP56,
1061 0,
1062 56,
1063 128,
1064 SSL_ALL_CIPHERS,
1065 SSL_ALL_STRENGTHS,
1066 },
1067 /* Cipher 66 */
1068 {
1069 1,
1070 TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
1071 TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
1072 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
1073 SSL_NOT_EXP|SSL_MEDIUM,
1074 0,
1075 128,
1076 128,
1077 SSL_ALL_CIPHERS,
1078 SSL_ALL_STRENGTHS
1079 },
1080 #endif
1081
1082 #ifndef OPENSSL_NO_CAMELLIA
1083 /* Camellia ciphersuites from RFC4132 (256-bit portion) */
1084
1085 /* Cipher 84 */
1086 {
1087 1,
1088 TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
1089 TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
1090 SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
1091 SSL_NOT_EXP|SSL_HIGH,
1092 0,
1093 256,
1094 256,
1095 SSL_ALL_CIPHERS,
1096 SSL_ALL_STRENGTHS
1097 },
1098 /* Cipher 85 */
1099 {
1100 0, /* not implemented (non-ephemeral DH) */
1101 TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
1102 TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
1103 SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
1104 SSL_NOT_EXP|SSL_HIGH,
1105 0,
1106 256,
1107 256,
1108 SSL_ALL_CIPHERS,
1109 SSL_ALL_STRENGTHS
1110 },
1111 /* Cipher 86 */
1112 {
1113 0, /* not implemented (non-ephemeral DH) */
1114 TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
1115 TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
1116 SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
1117 SSL_NOT_EXP|SSL_HIGH,
1118 0,
1119 256,
1120 256,
1121 SSL_ALL_CIPHERS,
1122 SSL_ALL_STRENGTHS
1123 },
1124 /* Cipher 87 */
1125 {
1126 1,
1127 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
1128 TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
1129 SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
1130 SSL_NOT_EXP|SSL_HIGH,
1131 0,
1132 256,
1133 256,
1134 SSL_ALL_CIPHERS,
1135 SSL_ALL_STRENGTHS
1136 },
1137 /* Cipher 88 */
1138 {
1139 1,
1140 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
1141 TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
1142 SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
1143 SSL_NOT_EXP|SSL_HIGH,
1144 0,
1145 256,
1146 256,
1147 SSL_ALL_CIPHERS,
1148 SSL_ALL_STRENGTHS
1149 },
1150 /* Cipher 89 */
1151 {
1152 1,
1153 TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
1154 TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
1155 SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
1156 SSL_NOT_EXP|SSL_HIGH,
1157 0,
1158 256,
1159 256,
1160 SSL_ALL_CIPHERS,
1161 SSL_ALL_STRENGTHS
1162 },
1163 #endif /* OPENSSL_NO_CAMELLIA */
1164
1165 #ifndef OPENSSL_NO_SEED
1166 /* SEED ciphersuites from RFC4162 */
1167
1168 /* Cipher 96 */
1169 {
1170 1,
1171 TLS1_TXT_RSA_WITH_SEED_SHA,
1172 TLS1_CK_RSA_WITH_SEED_SHA,
1173 SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1,
1174 SSL_NOT_EXP|SSL_MEDIUM,
1175 0,
1176 128,
1177 128,
1178 SSL_ALL_CIPHERS,
1179 SSL_ALL_STRENGTHS,
1180 },
1181
1182 /* Cipher 97 */
1183 {
1184 0, /* not implemented (non-ephemeral DH) */
1185 TLS1_TXT_DH_DSS_WITH_SEED_SHA,
1186 TLS1_CK_DH_DSS_WITH_SEED_SHA,
1187 SSL_kDHd|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1,
1188 SSL_NOT_EXP|SSL_MEDIUM,
1189 0,
1190 128,
1191 128,
1192 SSL_ALL_CIPHERS,
1193 SSL_ALL_STRENGTHS,
1194 },
1195
1196 /* Cipher 98 */
1197 {
1198 0, /* not implemented (non-ephemeral DH) */
1199 TLS1_TXT_DH_RSA_WITH_SEED_SHA,
1200 TLS1_CK_DH_RSA_WITH_SEED_SHA,
1201 SSL_kDHr|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1,
1202 SSL_NOT_EXP|SSL_MEDIUM,
1203 0,
1204 128,
1205 128,
1206 SSL_ALL_CIPHERS,
1207 SSL_ALL_STRENGTHS,
1208 },
1209
1210 /* Cipher 99 */
1211 {
1212 1,
1213 TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
1214 TLS1_CK_DHE_DSS_WITH_SEED_SHA,
1215 SSL_kEDH|SSL_aDSS|SSL_SEED|SSL_SHA1|SSL_TLSV1,
1216 SSL_NOT_EXP|SSL_MEDIUM,
1217 0,
1218 128,
1219 128,
1220 SSL_ALL_CIPHERS,
1221 SSL_ALL_STRENGTHS,
1222 },
1223
1224 /* Cipher 9A */
1225 {
1226 1,
1227 TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
1228 TLS1_CK_DHE_RSA_WITH_SEED_SHA,
1229 SSL_kEDH|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1,
1230 SSL_NOT_EXP|SSL_MEDIUM,
1231 0,
1232 128,
1233 128,
1234 SSL_ALL_CIPHERS,
1235 SSL_ALL_STRENGTHS,
1236 },
1237
1238 /* Cipher 9B */
1239 {
1240 1,
1241 TLS1_TXT_ADH_WITH_SEED_SHA,
1242 TLS1_CK_ADH_WITH_SEED_SHA,
1243 SSL_kEDH|SSL_aNULL|SSL_SEED|SSL_SHA1|SSL_TLSV1,
1244 SSL_NOT_EXP|SSL_MEDIUM,
1245 0,
1246 128,
1247 128,
1248 SSL_ALL_CIPHERS,
1249 SSL_ALL_STRENGTHS,
1250 },
1251
1252 #endif /* OPENSSL_NO_SEED */
1253
1254 #ifndef OPENSSL_NO_ECDH
1255 /* Cipher C001 */
1256 {
1257 1,
1258 TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
1259 TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
1260 SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
1261 SSL_NOT_EXP,
1262 0,
1263 0,
1264 0,
1265 SSL_ALL_CIPHERS,
1266 SSL_ALL_STRENGTHS,
1267 },
1268
1269 /* Cipher C002 */
1270 {
1271 1,
1272 TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
1273 TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
1274 SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
1275 SSL_NOT_EXP,
1276 0,
1277 128,
1278 128,
1279 SSL_ALL_CIPHERS,
1280 SSL_ALL_STRENGTHS,
1281 },
1282
1283 /* Cipher C003 */
1284 {
1285 1,
1286 TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
1287 TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
1288 SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
1289 SSL_NOT_EXP|SSL_HIGH,
1290 0,
1291 168,
1292 168,
1293 SSL_ALL_CIPHERS,
1294 SSL_ALL_STRENGTHS,
1295 },
1296
1297 /* Cipher C004 */
1298 {
1299 1,
1300 TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
1301 TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
1302 SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1303 SSL_NOT_EXP|SSL_HIGH,
1304 0,
1305 128,
1306 128,
1307 SSL_ALL_CIPHERS,
1308 SSL_ALL_STRENGTHS,
1309 },
1310
1311 /* Cipher C005 */
1312 {
1313 1,
1314 TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
1315 TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
1316 SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1317 SSL_NOT_EXP|SSL_HIGH,
1318 0,
1319 256,
1320 256,
1321 SSL_ALL_CIPHERS,
1322 SSL_ALL_STRENGTHS,
1323 },
1324
1325 /* Cipher C006 */
1326 {
1327 1,
1328 TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
1329 TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
1330 SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
1331 SSL_NOT_EXP,
1332 0,
1333 0,
1334 0,
1335 SSL_ALL_CIPHERS,
1336 SSL_ALL_STRENGTHS,
1337 },
1338
1339 /* Cipher C007 */
1340 {
1341 1,
1342 TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
1343 TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
1344 SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
1345 SSL_NOT_EXP,
1346 0,
1347 128,
1348 128,
1349 SSL_ALL_CIPHERS,
1350 SSL_ALL_STRENGTHS,
1351 },
1352
1353 /* Cipher C008 */
1354 {
1355 1,
1356 TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
1357 TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
1358 SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
1359 SSL_NOT_EXP|SSL_HIGH,
1360 0,
1361 168,
1362 168,
1363 SSL_ALL_CIPHERS,
1364 SSL_ALL_STRENGTHS,
1365 },
1366
1367 /* Cipher C009 */
1368 {
1369 1,
1370 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
1371 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
1372 SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1373 SSL_NOT_EXP|SSL_HIGH,
1374 0,
1375 128,
1376 128,
1377 SSL_ALL_CIPHERS,
1378 SSL_ALL_STRENGTHS,
1379 },
1380
1381 /* Cipher C00A */
1382 {
1383 1,
1384 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
1385 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
1386 SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1387 SSL_NOT_EXP|SSL_HIGH,
1388 0,
1389 256,
1390 256,
1391 SSL_ALL_CIPHERS,
1392 SSL_ALL_STRENGTHS,
1393 },
1394
1395 /* Cipher C00B */
1396 {
1397 1,
1398 TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
1399 TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
1400 SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
1401 SSL_NOT_EXP,
1402 0,
1403 0,
1404 0,
1405 SSL_ALL_CIPHERS,
1406 SSL_ALL_STRENGTHS,
1407 },
1408
1409 /* Cipher C00C */
1410 {
1411 1,
1412 TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
1413 TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
1414 SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
1415 SSL_NOT_EXP,
1416 0,
1417 128,
1418 128,
1419 SSL_ALL_CIPHERS,
1420 SSL_ALL_STRENGTHS,
1421 },
1422
1423 /* Cipher C00D */
1424 {
1425 1,
1426 TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
1427 TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
1428 SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
1429 SSL_NOT_EXP|SSL_HIGH,
1430 0,
1431 168,
1432 168,
1433 SSL_ALL_CIPHERS,
1434 SSL_ALL_STRENGTHS,
1435 },
1436
1437 /* Cipher C00E */
1438 {
1439 1,
1440 TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
1441 TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
1442 SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1443 SSL_NOT_EXP|SSL_HIGH,
1444 0,
1445 128,
1446 128,
1447 SSL_ALL_CIPHERS,
1448 SSL_ALL_STRENGTHS,
1449 },
1450
1451 /* Cipher C00F */
1452 {
1453 1,
1454 TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
1455 TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
1456 SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1457 SSL_NOT_EXP|SSL_HIGH,
1458 0,
1459 256,
1460 256,
1461 SSL_ALL_CIPHERS,
1462 SSL_ALL_STRENGTHS,
1463 },
1464
1465 /* Cipher C010 */
1466 {
1467 1,
1468 TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
1469 TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
1470 SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
1471 SSL_NOT_EXP,
1472 0,
1473 0,
1474 0,
1475 SSL_ALL_CIPHERS,
1476 SSL_ALL_STRENGTHS,
1477 },
1478
1479 /* Cipher C011 */
1480 {
1481 1,
1482 TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
1483 TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
1484 SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
1485 SSL_NOT_EXP,
1486 0,
1487 128,
1488 128,
1489 SSL_ALL_CIPHERS,
1490 SSL_ALL_STRENGTHS,
1491 },
1492
1493 /* Cipher C012 */
1494 {
1495 1,
1496 TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1497 TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1498 SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
1499 SSL_NOT_EXP|SSL_HIGH,
1500 0,
1501 168,
1502 168,
1503 SSL_ALL_CIPHERS,
1504 SSL_ALL_STRENGTHS,
1505 },
1506
1507 /* Cipher C013 */
1508 {
1509 1,
1510 TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1511 TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1512 SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1513 SSL_NOT_EXP|SSL_HIGH,
1514 0,
1515 128,
1516 128,
1517 SSL_ALL_CIPHERS,
1518 SSL_ALL_STRENGTHS,
1519 },
1520
1521 /* Cipher C014 */
1522 {
1523 1,
1524 TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1525 TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1526 SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
1527 SSL_NOT_EXP|SSL_HIGH,
1528 0,
1529 256,
1530 256,
1531 SSL_ALL_CIPHERS,
1532 SSL_ALL_STRENGTHS,
1533 },
1534
1535 /* Cipher C015 */
1536 {
1537 1,
1538 TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
1539 TLS1_CK_ECDH_anon_WITH_NULL_SHA,
1540 SSL_kECDHE|SSL_aNULL|SSL_eNULL|SSL_SHA|SSL_TLSV1,
1541 SSL_NOT_EXP,
1542 0,
1543 0,
1544 0,
1545 SSL_ALL_CIPHERS,
1546 SSL_ALL_STRENGTHS,
1547 },
1548
1549 /* Cipher C016 */
1550 {
1551 1,
1552 TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
1553 TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
1554 SSL_kECDHE|SSL_aNULL|SSL_RC4|SSL_SHA|SSL_TLSV1,
1555 SSL_NOT_EXP,
1556 0,
1557 128,
1558 128,
1559 SSL_ALL_CIPHERS,
1560 SSL_ALL_STRENGTHS,
1561 },
1562
1563 /* Cipher C017 */
1564 {
1565 1,
1566 TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
1567 TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
1568 SSL_kECDHE|SSL_aNULL|SSL_3DES|SSL_SHA|SSL_TLSV1,
1569 SSL_NOT_EXP|SSL_HIGH,
1570 0,
1571 168,
1572 168,
1573 SSL_ALL_CIPHERS,
1574 SSL_ALL_STRENGTHS,
1575 },
1576
1577 /* Cipher C018 */
1578 {
1579 1,
1580 TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
1581 TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
1582 SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
1583 SSL_NOT_EXP|SSL_HIGH,
1584 0,
1585 128,
1586 128,
1587 SSL_ALL_CIPHERS,
1588 SSL_ALL_STRENGTHS,
1589 },
1590
1591 /* Cipher C019 */
1592 {
1593 1,
1594 TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
1595 TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
1596 SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
1597 SSL_NOT_EXP|SSL_HIGH,
1598 0,
1599 256,
1600 256,
1601 SSL_ALL_CIPHERS,
1602 SSL_ALL_STRENGTHS,
1603 },
1604 #endif /* OPENSSL_NO_ECDH */
1605
1606
1607 /* end of list */
1608 };
1609
1610 SSL3_ENC_METHOD SSLv3_enc_data={
1611 ssl3_enc,
1612 ssl3_mac,
1613 ssl3_setup_key_block,
1614 ssl3_generate_master_secret,
1615 ssl3_change_cipher_state,
1616 ssl3_final_finish_mac,
1617 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
1618 ssl3_cert_verify_mac,
1619 SSL3_MD_CLIENT_FINISHED_CONST,4,
1620 SSL3_MD_SERVER_FINISHED_CONST,4,
1621 ssl3_alert_code,
1622 };
1623
1624 long ssl3_default_timeout(void)
1625 {
1626 /* 2 hours, the 24 hours mentioned in the SSLv3 spec
1627 * is way too long for http, the cache would over fill */
1628 return(60*60*2);
1629 }
1630
1631 IMPLEMENT_ssl3_meth_func(sslv3_base_method,
1632 ssl_undefined_function,
1633 ssl_undefined_function,
1634 ssl_bad_method)
1635
1636 int ssl3_num_ciphers(void)
1637 {
1638 return(SSL3_NUM_CIPHERS);
1639 }
1640
1641 SSL_CIPHER *ssl3_get_cipher(unsigned int u)
1642 {
1643 if (u < SSL3_NUM_CIPHERS)
1644 return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
1645 else
1646 return(NULL);
1647 }
1648
1649 int ssl3_pending(const SSL *s)
1650 {
1651 if (s->rstate == SSL_ST_READ_BODY)
1652 return 0;
1653
1654 return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0;
1655 }
1656
1657 int ssl3_new(SSL *s)
1658 {
1659 SSL3_STATE *s3;
1660
1661 if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
1662 memset(s3,0,sizeof *s3);
1663 EVP_MD_CTX_init(&s3->finish_dgst1);
1664 EVP_MD_CTX_init(&s3->finish_dgst2);
1665 pq_64bit_init(&(s3->rrec.seq_num));
1666 pq_64bit_init(&(s3->wrec.seq_num));
1667
1668 s->s3=s3;
1669
1670 s->method->ssl_clear(s);
1671 return(1);
1672 err:
1673 return(0);
1674 }
1675
1676 void ssl3_free(SSL *s)
1677 {
1678 if(s == NULL)
1679 return;
1680
1681 ssl3_cleanup_key_block(s);
1682 if (s->s3->rbuf.buf != NULL)
1683 OPENSSL_free(s->s3->rbuf.buf);
1684 if (s->s3->wbuf.buf != NULL)
1685 OPENSSL_free(s->s3->wbuf.buf);
1686 if (s->s3->rrec.comp != NULL)
1687 OPENSSL_free(s->s3->rrec.comp);
1688 #ifndef OPENSSL_NO_DH
1689 if (s->s3->tmp.dh != NULL)
1690 DH_free(s->s3->tmp.dh);
1691 #endif
1692 #ifndef OPENSSL_NO_ECDH
1693 if (s->s3->tmp.ecdh != NULL)
1694 EC_KEY_free(s->s3->tmp.ecdh);
1695 #endif
1696
1697 if (s->s3->tmp.ca_names != NULL)
1698 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
1699 EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
1700 EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
1701 pq_64bit_free(&(s->s3->rrec.seq_num));
1702 pq_64bit_free(&(s->s3->wrec.seq_num));
1703
1704 OPENSSL_cleanse(s->s3,sizeof *s->s3);
1705 OPENSSL_free(s->s3);
1706 s->s3=NULL;
1707 }
1708
1709 void ssl3_clear(SSL *s)
1710 {
1711 unsigned char *rp,*wp;
1712 size_t rlen, wlen;
1713
1714 ssl3_cleanup_key_block(s);
1715 if (s->s3->tmp.ca_names != NULL)
1716 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
1717
1718 if (s->s3->rrec.comp != NULL)
1719 {
1720 OPENSSL_free(s->s3->rrec.comp);
1721 s->s3->rrec.comp=NULL;
1722 }
1723 #ifndef OPENSSL_NO_DH
1724 if (s->s3->tmp.dh != NULL)
1725 {
1726 DH_free(s->s3->tmp.dh);
1727 s->s3->tmp.dh = NULL;
1728 }
1729 #endif
1730 #ifndef OPENSSL_NO_ECDH
1731 if (s->s3->tmp.ecdh != NULL)
1732 {
1733 EC_KEY_free(s->s3->tmp.ecdh);
1734 s->s3->tmp.ecdh = NULL;
1735 }
1736 #endif
1737 #ifndef OPENSSL_NO_TLSEXT
1738 #ifndef OPENSSL_NO_EC
1739 s->s3->is_probably_safari = 0;
1740 #endif /* !OPENSSL_NO_EC */
1741 #endif /* !OPENSSL_NO_TLSEXT */
1742
1743 rp = s->s3->rbuf.buf;
1744 wp = s->s3->wbuf.buf;
1745 rlen = s->s3->rbuf.len;
1746 wlen = s->s3->wbuf.len;
1747
1748 EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
1749 EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
1750
1751 memset(s->s3,0,sizeof *s->s3);
1752 s->s3->rbuf.buf = rp;
1753 s->s3->wbuf.buf = wp;
1754 s->s3->rbuf.len = rlen;
1755 s->s3->wbuf.len = wlen;
1756
1757 ssl_free_wbio_buffer(s);
1758
1759 s->packet_length=0;
1760 s->s3->renegotiate=0;
1761 s->s3->total_renegotiations=0;
1762 s->s3->num_renegotiations=0;
1763 s->s3->in_read_app_data=0;
1764 s->version=SSL3_VERSION;
1765 }
1766
1767 long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
1768 {
1769 int ret=0;
1770
1771 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
1772 if (
1773 #ifndef OPENSSL_NO_RSA
1774 cmd == SSL_CTRL_SET_TMP_RSA ||
1775 cmd == SSL_CTRL_SET_TMP_RSA_CB ||
1776 #endif
1777 #ifndef OPENSSL_NO_DSA
1778 cmd == SSL_CTRL_SET_TMP_DH ||
1779 cmd == SSL_CTRL_SET_TMP_DH_CB ||
1780 #endif
1781 0)
1782 {
1783 if (!ssl_cert_inst(&s->cert))
1784 {
1785 SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
1786 return(0);
1787 }
1788 }
1789 #endif
1790
1791 switch (cmd)
1792 {
1793 case SSL_CTRL_GET_SESSION_REUSED:
1794 ret=s->hit;
1795 break;
1796 case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
1797 break;
1798 case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
1799 ret=s->s3->num_renegotiations;
1800 break;
1801 case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
1802 ret=s->s3->num_renegotiations;
1803 s->s3->num_renegotiations=0;
1804 break;
1805 case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
1806 ret=s->s3->total_renegotiations;
1807 break;
1808 case SSL_CTRL_GET_FLAGS:
1809 ret=(int)(s->s3->flags);
1810 break;
1811 #ifndef OPENSSL_NO_RSA
1812 case SSL_CTRL_NEED_TMP_RSA:
1813 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) &&
1814 ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
1815 (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))))
1816 ret = 1;
1817 break;
1818 case SSL_CTRL_SET_TMP_RSA:
1819 {
1820 RSA *rsa = (RSA *)parg;
1821 if (rsa == NULL)
1822 {
1823 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
1824 return(ret);
1825 }
1826 if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
1827 {
1828 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB);
1829 return(ret);
1830 }
1831 if (s->cert->rsa_tmp != NULL)
1832 RSA_free(s->cert->rsa_tmp);
1833 s->cert->rsa_tmp = rsa;
1834 ret = 1;
1835 }
1836 break;
1837 case SSL_CTRL_SET_TMP_RSA_CB:
1838 {
1839 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1840 return(ret);
1841 }
1842 break;
1843 #endif
1844 #ifndef OPENSSL_NO_DH
1845 case SSL_CTRL_SET_TMP_DH:
1846 {
1847 DH *dh = (DH *)parg;
1848 if (dh == NULL)
1849 {
1850 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
1851 return(ret);
1852 }
1853 if ((dh = DHparams_dup(dh)) == NULL)
1854 {
1855 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
1856 return(ret);
1857 }
1858 if (!(s->options & SSL_OP_SINGLE_DH_USE))
1859 {
1860 if (!DH_generate_key(dh))
1861 {
1862 DH_free(dh);
1863 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
1864 return(ret);
1865 }
1866 }
1867 if (s->cert->dh_tmp != NULL)
1868 DH_free(s->cert->dh_tmp);
1869 s->cert->dh_tmp = dh;
1870 ret = 1;
1871 }
1872 break;
1873 case SSL_CTRL_SET_TMP_DH_CB:
1874 {
1875 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1876 return(ret);
1877 }
1878 break;
1879 #endif
1880 #ifndef OPENSSL_NO_ECDH
1881 case SSL_CTRL_SET_TMP_ECDH:
1882 {
1883 EC_KEY *ecdh = NULL;
1884
1885 if (parg == NULL)
1886 {
1887 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
1888 return(ret);
1889 }
1890 if (!EC_KEY_up_ref((EC_KEY *)parg))
1891 {
1892 SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
1893 return(ret);
1894 }
1895 ecdh = (EC_KEY *)parg;
1896 if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
1897 {
1898 if (!EC_KEY_generate_key(ecdh))
1899 {
1900 EC_KEY_free(ecdh);
1901 SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
1902 return(ret);
1903 }
1904 }
1905 if (s->cert->ecdh_tmp != NULL)
1906 EC_KEY_free(s->cert->ecdh_tmp);
1907 s->cert->ecdh_tmp = ecdh;
1908 ret = 1;
1909 }
1910 break;
1911 case SSL_CTRL_SET_TMP_ECDH_CB:
1912 {
1913 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1914 return(ret);
1915 }
1916 break;
1917 #endif /* !OPENSSL_NO_ECDH */
1918 #ifndef OPENSSL_NO_TLSEXT
1919 case SSL_CTRL_SET_TLSEXT_HOSTNAME:
1920 if (larg == TLSEXT_NAMETYPE_host_name)
1921 {
1922 if (s->tlsext_hostname != NULL)
1923 OPENSSL_free(s->tlsext_hostname);
1924 s->tlsext_hostname = NULL;
1925
1926 ret = 1;
1927 if (parg == NULL)
1928 break;
1929 if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
1930 {
1931 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
1932 return 0;
1933 }
1934 if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
1935 {
1936 SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
1937 return 0;
1938 }
1939 }
1940 else
1941 {
1942 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
1943 return 0;
1944 }
1945 break;
1946 case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
1947 s->tlsext_debug_arg=parg;
1948 ret = 1;
1949 break;
1950
1951 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
1952 s->tlsext_status_type=larg;
1953 ret = 1;
1954 break;
1955
1956 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
1957 *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts;
1958 ret = 1;
1959 break;
1960
1961 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
1962 s->tlsext_ocsp_exts = parg;
1963 ret = 1;
1964 break;
1965
1966 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
1967 *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids;
1968 ret = 1;
1969 break;
1970
1971 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
1972 s->tlsext_ocsp_ids = parg;
1973 ret = 1;
1974 break;
1975
1976 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
1977 *(unsigned char **)parg = s->tlsext_ocsp_resp;
1978 return s->tlsext_ocsp_resplen;
1979
1980 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
1981 if (s->tlsext_ocsp_resp)
1982 OPENSSL_free(s->tlsext_ocsp_resp);
1983 s->tlsext_ocsp_resp = parg;
1984 s->tlsext_ocsp_resplen = larg;
1985 ret = 1;
1986 break;
1987
1988 #endif /* !OPENSSL_NO_TLSEXT */
1989
1990 case SSL_CTRL_CHECK_PROTO_VERSION:
1991 /* For library-internal use; checks that the current protocol
1992 * is the highest enabled version (according to s->ctx->method,
1993 * as version negotiation may have changed s->method). */
1994 if (s->version == s->ctx->method->version)
1995 return 1;
1996 /* Apparently we're using a version-flexible SSL_METHOD
1997 * (not at its highest protocol version). */
1998 if (s->ctx->method->version == SSLv23_method()->version)
1999 {
2000 #if TLS_MAX_VERSION != TLS1_VERSION
2001 # error Code needs update for SSLv23_method() support beyond TLS1_VERSION.
2002 #endif
2003 if (!(s->options & SSL_OP_NO_TLSv1))
2004 return s->version == TLS1_VERSION;
2005 if (!(s->options & SSL_OP_NO_SSLv3))
2006 return s->version == SSL3_VERSION;
2007 if (!(s->options & SSL_OP_NO_SSLv2))
2008 return s->version == SSL2_VERSION;
2009 }
2010 return 0; /* Unexpected state; fail closed. */
2011
2012 default:
2013 break;
2014 }
2015 return(ret);
2016 }
2017
2018 long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
2019 {
2020 int ret=0;
2021
2022 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
2023 if (
2024 #ifndef OPENSSL_NO_RSA
2025 cmd == SSL_CTRL_SET_TMP_RSA_CB ||
2026 #endif
2027 #ifndef OPENSSL_NO_DSA
2028 cmd == SSL_CTRL_SET_TMP_DH_CB ||
2029 #endif
2030 0)
2031 {
2032 if (!ssl_cert_inst(&s->cert))
2033 {
2034 SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE);
2035 return(0);
2036 }
2037 }
2038 #endif
2039
2040 switch (cmd)
2041 {
2042 #ifndef OPENSSL_NO_RSA
2043 case SSL_CTRL_SET_TMP_RSA_CB:
2044 {
2045 s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
2046 }
2047 break;
2048 #endif
2049 #ifndef OPENSSL_NO_DH
2050 case SSL_CTRL_SET_TMP_DH_CB:
2051 {
2052 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
2053 }
2054 break;
2055 #endif
2056 #ifndef OPENSSL_NO_ECDH
2057 case SSL_CTRL_SET_TMP_ECDH_CB:
2058 {
2059 s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
2060 }
2061 break;
2062 #endif
2063 #ifndef OPENSSL_NO_TLSEXT
2064 case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
2065 s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
2066 unsigned char *, int, void *))fp;
2067 break;
2068 #endif
2069 default:
2070 break;
2071 }
2072 return(ret);
2073 }
2074
2075 long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2076 {
2077 CERT *cert;
2078
2079 cert=ctx->cert;
2080
2081 switch (cmd)
2082 {
2083 #ifndef OPENSSL_NO_RSA
2084 case SSL_CTRL_NEED_TMP_RSA:
2085 if ( (cert->rsa_tmp == NULL) &&
2086 ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
2087 (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))
2088 )
2089 return(1);
2090 else
2091 return(0);
2092 /* break; */
2093 case SSL_CTRL_SET_TMP_RSA:
2094 {
2095 RSA *rsa;
2096 int i;
2097
2098 rsa=(RSA *)parg;
2099 i=1;
2100 if (rsa == NULL)
2101 i=0;
2102 else
2103 {
2104 if ((rsa=RSAPrivateKey_dup(rsa)) == NULL)
2105 i=0;
2106 }
2107 if (!i)
2108 {
2109 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB);
2110 return(0);
2111 }
2112 else
2113 {
2114 if (cert->rsa_tmp != NULL)
2115 RSA_free(cert->rsa_tmp);
2116 cert->rsa_tmp=rsa;
2117 return(1);
2118 }
2119 }
2120 /* break; */
2121 case SSL_CTRL_SET_TMP_RSA_CB:
2122 {
2123 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2124 return(0);
2125 }
2126 break;
2127 #endif
2128 #ifndef OPENSSL_NO_DH
2129 case SSL_CTRL_SET_TMP_DH:
2130 {
2131 DH *new=NULL,*dh;
2132
2133 dh=(DH *)parg;
2134 if ((new=DHparams_dup(dh)) == NULL)
2135 {
2136 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
2137 return 0;
2138 }
2139 if (!(ctx->options & SSL_OP_SINGLE_DH_USE))
2140 {
2141 if (!DH_generate_key(new))
2142 {
2143 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
2144 DH_free(new);
2145 return 0;
2146 }
2147 }
2148 if (cert->dh_tmp != NULL)
2149 DH_free(cert->dh_tmp);
2150 cert->dh_tmp=new;
2151 return 1;
2152 }
2153 /*break; */
2154 case SSL_CTRL_SET_TMP_DH_CB:
2155 {
2156 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2157 return(0);
2158 }
2159 break;
2160 #endif
2161 #ifndef OPENSSL_NO_ECDH
2162 case SSL_CTRL_SET_TMP_ECDH:
2163 {
2164 EC_KEY *ecdh = NULL;
2165
2166 if (parg == NULL)
2167 {
2168 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
2169 return 0;
2170 }
2171 ecdh = EC_KEY_dup((EC_KEY *)parg);
2172 if (ecdh == NULL)
2173 {
2174 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB);
2175 return 0;
2176 }
2177 if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
2178 {
2179 if (!EC_KEY_generate_key(ecdh))
2180 {
2181 EC_KEY_free(ecdh);
2182 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
2183 return 0;
2184 }
2185 }
2186
2187 if (cert->ecdh_tmp != NULL)
2188 {
2189 EC_KEY_free(cert->ecdh_tmp);
2190 }
2191 cert->ecdh_tmp = ecdh;
2192 return 1;
2193 }
2194 /* break; */
2195 case SSL_CTRL_SET_TMP_ECDH_CB:
2196 {
2197 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2198 return(0);
2199 }
2200 break;
2201 #endif /* !OPENSSL_NO_ECDH */
2202 #ifndef OPENSSL_NO_TLSEXT
2203 case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
2204 ctx->tlsext_servername_arg=parg;
2205 break;
2206 case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
2207 case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
2208 {
2209 unsigned char *keys = parg;
2210 if (!keys)
2211 return 48;
2212 if (larg != 48)
2213 {
2214 SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
2215 return 0;
2216 }
2217 if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
2218 {
2219 memcpy(ctx->tlsext_tick_key_name, keys, 16);
2220 memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
2221 memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
2222 }
2223 else
2224 {
2225 memcpy(keys, ctx->tlsext_tick_key_name, 16);
2226 memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
2227 memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
2228 }
2229 return 1;
2230 }
2231
2232 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
2233 ctx->tlsext_status_arg=parg;
2234 return 1;
2235 break;
2236
2237 #endif /* !OPENSSL_NO_TLSEXT */
2238 /* A Thawte special :-) */
2239 case SSL_CTRL_EXTRA_CHAIN_CERT:
2240 if (ctx->extra_certs == NULL)
2241 {
2242 if ((ctx->extra_certs=sk_X509_new_null()) == NULL)
2243 return(0);
2244 }
2245 sk_X509_push(ctx->extra_certs,(X509 *)parg);
2246 break;
2247
2248 default:
2249 return(0);
2250 }
2251 return(1);
2252 }
2253
2254 long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
2255 {
2256 CERT *cert;
2257
2258 cert=ctx->cert;
2259
2260 switch (cmd)
2261 {
2262 #ifndef OPENSSL_NO_RSA
2263 case SSL_CTRL_SET_TMP_RSA_CB:
2264 {
2265 cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
2266 }
2267 break;
2268 #endif
2269 #ifndef OPENSSL_NO_DH
2270 case SSL_CTRL_SET_TMP_DH_CB:
2271 {
2272 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
2273 }
2274 break;
2275 #endif
2276 #ifndef OPENSSL_NO_ECDH
2277 case SSL_CTRL_SET_TMP_ECDH_CB:
2278 {
2279 cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
2280 }
2281 break;
2282 #endif
2283 #ifndef OPENSSL_NO_TLSEXT
2284 case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
2285 ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
2286 break;
2287
2288 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
2289 ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
2290 break;
2291
2292 case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
2293 ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char *,
2294 unsigned char *,
2295 EVP_CIPHER_CTX *,
2296 HMAC_CTX *, int))fp;
2297 break;
2298
2299 #endif
2300
2301 default:
2302 return(0);
2303 }
2304 return(1);
2305 }
2306
2307 /* This function needs to check if the ciphers required are actually
2308 * available */
2309 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
2310 {
2311 SSL_CIPHER c,*cp;
2312 unsigned long id;
2313
2314 id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
2315 c.id=id;
2316 cp = (SSL_CIPHER *)OBJ_bsearch((char *)&c,
2317 (char *)ssl3_ciphers,
2318 SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER),
2319 FP_ICC ssl_cipher_id_cmp);
2320 if (cp == NULL || cp->valid == 0)
2321 return NULL;
2322 else
2323 return cp;
2324 }
2325
2326 int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
2327 {
2328 long l;
2329
2330 if (p != NULL)
2331 {
2332 l=c->id;
2333 if ((l & 0xff000000) != 0x03000000) return(0);
2334 p[0]=((unsigned char)(l>> 8L))&0xFF;
2335 p[1]=((unsigned char)(l ))&0xFF;
2336 }
2337 return(2);
2338 }
2339
2340 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
2341 STACK_OF(SSL_CIPHER) *srvr)
2342 {
2343 SSL_CIPHER *c,*ret=NULL;
2344 STACK_OF(SSL_CIPHER) *prio, *allow;
2345 int i,j,ok;
2346
2347 CERT *cert;
2348 unsigned long alg,mask,emask;
2349
2350 /* Let's see which ciphers we can support */
2351 cert=s->cert;
2352
2353 #if 0
2354 /* Do not set the compare functions, because this may lead to a
2355 * reordering by "id". We want to keep the original ordering.
2356 * We may pay a price in performance during sk_SSL_CIPHER_find(),
2357 * but would have to pay with the price of sk_SSL_CIPHER_dup().
2358 */
2359 sk_SSL_CIPHER_set_cmp_func(srvr, ssl_cipher_ptr_id_cmp);
2360 sk_SSL_CIPHER_set_cmp_func(clnt, ssl_cipher_ptr_id_cmp);
2361 #endif
2362
2363 #ifdef CIPHER_DEBUG
2364 printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), srvr);
2365 for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
2366 {
2367 c=sk_SSL_CIPHER_value(srvr,i);
2368 printf("%p:%s\n",c,c->name);
2369 }
2370 printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), clnt);
2371 for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
2372 {
2373 c=sk_SSL_CIPHER_value(clnt,i);
2374 printf("%p:%s\n",c,c->name);
2375 }
2376 #endif
2377
2378 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
2379 {
2380 prio = srvr;
2381 allow = clnt;
2382 }
2383 else
2384 {
2385 prio = clnt;
2386 allow = srvr;
2387 }
2388
2389 for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
2390 {
2391 c=sk_SSL_CIPHER_value(prio,i);
2392
2393 ssl_set_cert_masks(cert,c);
2394 mask=cert->mask;
2395 emask=cert->export_mask;
2396
2397 #ifdef KSSL_DEBUG
2398 printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);
2399 #endif /* KSSL_DEBUG */
2400
2401 alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK);
2402 #ifndef OPENSSL_NO_KRB5
2403 if (alg & SSL_KRB5)
2404 {
2405 if ( !kssl_keytab_is_available(s->kssl_ctx) )
2406 continue;
2407 }
2408 #endif /* OPENSSL_NO_KRB5 */
2409 if (SSL_C_IS_EXPORT(c))
2410 {
2411 ok=((alg & emask) == alg)?1:0;
2412 #ifdef CIPHER_DEBUG
2413 printf("%d:[%08lX:%08lX]%p:%s (export)\n",ok,alg,emask,
2414 c,c->name);
2415 #endif
2416 }
2417 else
2418 {
2419 ok=((alg & mask) == alg)?1:0;
2420 #ifdef CIPHER_DEBUG
2421 printf("%d:[%08lX:%08lX]%p:%s\n",ok,alg,mask,c,
2422 c->name);
2423 #endif
2424 }
2425
2426 if (!ok) continue;
2427 j=sk_SSL_CIPHER_find(allow,c);
2428 if (j >= 0)
2429 {
2430 #if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT)
2431 if ((alg & SSL_kECDHE) && (alg & SSL_aECDSA) && s->s3->is_probably_safari)
2432 {
2433 if (!ret) ret=sk_SSL_CIPHER_value(allow,j);
2434 continue;
2435 }
2436 #endif
2437 ret=sk_SSL_CIPHER_value(allow,j);
2438 break;
2439 }
2440 }
2441 return(ret);
2442 }
2443
2444 int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
2445 {
2446 int ret=0;
2447 unsigned long alg;
2448
2449 alg=s->s3->tmp.new_cipher->algorithms;
2450
2451 #ifndef OPENSSL_NO_DH
2452 if (alg & (SSL_kDHr|SSL_kEDH))
2453 {
2454 # ifndef OPENSSL_NO_RSA
2455 p[ret++]=SSL3_CT_RSA_FIXED_DH;
2456 # endif
2457 # ifndef OPENSSL_NO_DSA
2458 p[ret++]=SSL3_CT_DSS_FIXED_DH;
2459 # endif
2460 }
2461 if ((s->version == SSL3_VERSION) &&
2462 (alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr)))
2463 {
2464 # ifndef OPENSSL_NO_RSA
2465 p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
2466 # endif
2467 # ifndef OPENSSL_NO_DSA
2468 p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
2469 # endif
2470 }
2471 #endif /* !OPENSSL_NO_DH */
2472 #ifndef OPENSSL_NO_RSA
2473 p[ret++]=SSL3_CT_RSA_SIGN;
2474 #endif
2475 #ifndef OPENSSL_NO_DSA
2476 p[ret++]=SSL3_CT_DSS_SIGN;
2477 #endif
2478 #ifndef OPENSSL_NO_ECDH
2479 /* We should ask for fixed ECDH certificates only
2480 * for SSL_kECDH (and not SSL_kECDHE)
2481 */
2482 if ((alg & SSL_kECDH) && (s->version >= TLS1_VERSION))
2483 {
2484 p[ret++]=TLS_CT_RSA_FIXED_ECDH;
2485 p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
2486 }
2487 #endif
2488
2489 #ifndef OPENSSL_NO_ECDSA
2490 /* ECDSA certs can be used with RSA cipher suites as well
2491 * so we don't need to check for SSL_kECDH or SSL_kECDHE
2492 */
2493 if (s->version >= TLS1_VERSION)
2494 {
2495 p[ret++]=TLS_CT_ECDSA_SIGN;
2496 }
2497 #endif
2498 return(ret);
2499 }
2500
2501 int ssl3_shutdown(SSL *s)
2502 {
2503 int ret;
2504
2505 /* Don't do anything much if we have not done the handshake or
2506 * we don't want to send messages :-) */
2507 if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE))
2508 {
2509 s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
2510 return(1);
2511 }
2512
2513 if (!(s->shutdown & SSL_SENT_SHUTDOWN))
2514 {
2515 s->shutdown|=SSL_SENT_SHUTDOWN;
2516 #if 1
2517 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY);
2518 #endif
2519 /* our shutdown alert has been sent now, and if it still needs
2520 * to be written, s->s3->alert_dispatch will be true */
2521 if (s->s3->alert_dispatch)
2522 return(-1); /* return WANT_WRITE */
2523 }
2524 else if (s->s3->alert_dispatch)
2525 {
2526 /* resend it if not sent */
2527 #if 1
2528 ret=s->method->ssl_dispatch_alert(s);
2529 if(ret == -1)
2530 {
2531 /* we only get to return -1 here the 2nd/Nth
2532 * invocation, we must have already signalled
2533 * return 0 upon a previous invoation,
2534 * return WANT_WRITE */
2535 return(ret);
2536 }
2537 #endif
2538 }
2539 else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
2540 {
2541 /* If we are waiting for a close from our peer, we are closed */
2542 s->method->ssl_read_bytes(s,0,NULL,0,0);
2543 if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
2544 {
2545 return(-1); /* return WANT_READ */
2546 }
2547 }
2548
2549 if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
2550 !s->s3->alert_dispatch)
2551 return(1);
2552 else
2553 return(0);
2554 }
2555
2556 int ssl3_write(SSL *s, const void *buf, int len)
2557 {
2558 int ret,n;
2559
2560 #if 0
2561 if (s->shutdown & SSL_SEND_SHUTDOWN)
2562 {
2563 s->rwstate=SSL_NOTHING;
2564 return(0);
2565 }
2566 #endif
2567 clear_sys_error();
2568 if (s->s3->renegotiate) ssl3_renegotiate_check(s);
2569
2570 /* This is an experimental flag that sends the
2571 * last handshake message in the same packet as the first
2572 * use data - used to see if it helps the TCP protocol during
2573 * session-id reuse */
2574 /* The second test is because the buffer may have been removed */
2575 if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio))
2576 {
2577 /* First time through, we write into the buffer */
2578 if (s->s3->delay_buf_pop_ret == 0)
2579 {
2580 ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
2581 buf,len);
2582 if (ret <= 0) return(ret);
2583
2584 s->s3->delay_buf_pop_ret=ret;
2585 }
2586
2587 s->rwstate=SSL_WRITING;
2588 n=BIO_flush(s->wbio);
2589 if (n <= 0) return(n);
2590 s->rwstate=SSL_NOTHING;
2591
2592 /* We have flushed the buffer, so remove it */
2593 ssl_free_wbio_buffer(s);
2594 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
2595
2596 ret=s->s3->delay_buf_pop_ret;
2597 s->s3->delay_buf_pop_ret=0;
2598 }
2599 else
2600 {
2601 ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA,
2602 buf,len);
2603 if (ret <= 0) return(ret);
2604 }
2605
2606 return(ret);
2607 }
2608
2609 static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
2610 {
2611 int ret;
2612
2613 clear_sys_error();
2614 if (s->s3->renegotiate) ssl3_renegotiate_check(s);
2615 s->s3->in_read_app_data=1;
2616 ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
2617 if ((ret == -1) && (s->s3->in_read_app_data == 2))
2618 {
2619 /* ssl3_read_bytes decided to call s->handshake_func, which
2620 * called ssl3_read_bytes to read handshake data.
2621 * However, ssl3_read_bytes actually found application data
2622 * and thinks that application data makes sense here; so disable
2623 * handshake processing and try to read application data again. */
2624 s->in_handshake++;
2625 ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
2626 s->in_handshake--;
2627 }
2628 else
2629 s->s3->in_read_app_data=0;
2630
2631 return(ret);
2632 }
2633
2634 int ssl3_read(SSL *s, void *buf, int len)
2635 {
2636 return ssl3_read_internal(s, buf, len, 0);
2637 }
2638
2639 int ssl3_peek(SSL *s, void *buf, int len)
2640 {
2641 return ssl3_read_internal(s, buf, len, 1);
2642 }
2643
2644 int ssl3_renegotiate(SSL *s)
2645 {
2646 if (s->handshake_func == NULL)
2647 return(1);
2648
2649 if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
2650 return(0);
2651
2652 s->s3->renegotiate=1;
2653 return(1);
2654 }
2655
2656 int ssl3_renegotiate_check(SSL *s)
2657 {
2658 int ret=0;
2659
2660 if (s->s3->renegotiate)
2661 {
2662 if ( (s->s3->rbuf.left == 0) &&
2663 (s->s3->wbuf.left == 0) &&
2664 !SSL_in_init(s))
2665 {
2666 /*
2667 if we are the server, and we have sent a 'RENEGOTIATE' message, we
2668 need to go to SSL_ST_ACCEPT.
2669 */
2670 /* SSL_ST_ACCEPT */
2671 s->state=SSL_ST_RENEGOTIATE;
2672 s->s3->renegotiate=0;
2673 s->s3->num_renegotiations++;
2674 s->s3->total_renegotiations++;
2675 ret=1;
2676 }
2677 }
2678 return(ret);
2679 }
A mirror of the official openssl repository