Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04.

diff --git a/NEWS b/NEWS
index de3259067542913f20fb3e2107fe6df09489ef92..df2f6fd4a220e5c6a8dc0829ea19cb649a7cb1d7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 Version 0.9.98
 - The openssl compatibility layer was moved to gnutls-openssl
   library instead of being included in the gnutls-extra library.
+- Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04.
 
 Version 0.9.97 (11/11/2003)
 - The certtool utility can now generate PKCS #12 structures

diff --git a/configure.in b/configure.in
index a95260510d185ab7abe896e0234ca526c45c284c..33c689d6874a0902698a30e316083b1cebfa2fa0 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -12,7 +12,7 @@ AC_DEFINE_UNQUOTED(T_OS, "$target_os", [OS name])
 dnl Gnutls Version
 GNUTLS_MAJOR_VERSION=0
 GNUTLS_MINOR_VERSION=9
-GNUTLS_MICRO_VERSION=97
+GNUTLS_MICRO_VERSION=98
 GNUTLS_VERSION=$GNUTLS_MAJOR_VERSION.$GNUTLS_MINOR_VERSION.$GNUTLS_MICRO_VERSION
 
 AC_DEFINE_UNQUOTED(GNUTLS_VERSION, "$GNUTLS_VERSION", [version of gnutls])

diff --git a/lib/gnutls.h.in.in b/lib/gnutls.h.in.in
index 3494d95b24b122355a5a824f153599143f98e518..1e3aa2480705982dd1ceb98d035a5006f267d299 100644 (file)
--- a/lib/gnutls.h.in.in
+++ b/lib/gnutls.h.in.in
@@ -63,7 +63,9 @@ typedef enum gnutls_kx_algorithm { GNUTLS_KX_RSA=1, GNUTLS_KX_DHE_DSS,
 
 typedef enum gnutls_credentials_type { GNUTLS_CRD_CERTIFICATE=1, GNUTLS_CRD_ANON, GNUTLS_CRD_SRP } gnutls_credentials_type;
 
-typedef enum gnutls_mac_algorithm { GNUTLS_MAC_NULL=1, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA } gnutls_mac_algorithm;
+typedef enum gnutls_mac_algorithm { GNUTLS_MAC_NULL=1, 
+       GNUTLS_MAC_MD5, GNUTLS_MAC_SHA, GNUTLS_MAC_RMD160
+} gnutls_mac_algorithm;
 
 /* The enumerations here should have the same value with gnutls_mac_algorithm.
  */

diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index e7759385d694339c384802e2e20c059133c5fe51..4d02e14fe0fed1bf52f534ea47de5e9fd924f3d2 100644 (file)
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -163,6 +163,7 @@ typedef struct gnutls_hash_entry gnutls_hash_entry;
 static const gnutls_hash_entry hash_algorithms[] = {
        {"SHA", GNUTLS_MAC_SHA, 20},
        {"MD5", GNUTLS_MAC_MD5, 16},
+       {"RIPEMD160", GNUTLS_MAC_RMD160, 20},
        {"NULL", GNUTLS_MAC_NULL, 0},
        {0, 0, 0}
 };
@@ -313,20 +314,35 @@ typedef struct {
 
 #define GNUTLS_DHE_DSS_3DES_EDE_CBC_SHA { 0x00, 0x13 }
 
+
 /* gnutls private extensions: 
  */
 #define GNUTLS_DHE_DSS_TWOFISH_128_CBC_SHA { 0xFF, 0x54 }
 
+
+/* draft-ietf-tls-openpgp-keys-04:
+ */
+#define GNUTLS_DHE_DSS_3DES_EDE_CBC_RMD { 0x00, 0x72 }
+#define GNUTLS_DHE_RSA_3DES_EDE_CBC_RMD { 0x00, 0x77 }
+#define GNUTLS_DHE_DSS_AES_256_CBC_RMD { 0x00, 0x73 }
+#define GNUTLS_DHE_DSS_AES_128_CBC_RMD { 0x00, 0x74 }
+#define GNUTLS_DHE_RSA_AES_128_CBC_RMD { 0x00, 0x78 }
+#define GNUTLS_DHE_RSA_AES_256_CBC_RMD { 0x00, 0x79 }
+#define GNUTLS_RSA_3DES_EDE_CBC_RMD { 0x00, 0x7C }
+#define GNUTLS_RSA_AES_128_CBC_RMD { 0x00, 0x7D }
+#define GNUTLS_RSA_AES_256_CBC_RMD { 0x00, 0x7E }
+
+
 /* draft-ietf-tls-56-bit-ciphersuites-01:
  */
 #define GNUTLS_DHE_DSS_ARCFOUR_SHA { 0x00, 0x66 }
 
+
 /* rfc3268: 
  */
 #define GNUTLS_DHE_DSS_AES_256_CBC_SHA { 0x00, 0x38 }
 #define GNUTLS_DHE_DSS_AES_128_CBC_SHA { 0x00, 0x32 }
 
-
 /** DHE RSA 
  **/
 #define GNUTLS_DHE_RSA_3DES_EDE_CBC_SHA { 0x00, 0x16 }
@@ -411,7 +427,15 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = {
        GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_AES_256_CBC_SHA,
                                  GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS,
                                  GNUTLS_MAC_SHA, GNUTLS_SSL3),
-
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_3DES_EDE_CBC_RMD,
+                                 GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_DSS,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_AES_128_CBC_RMD,
+                                 GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_DSS,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_AES_256_CBC_RMD,
+                                 GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
        /* DHE_RSA */
        GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_TWOFISH_128_CBC_SHA,
                                  GNUTLS_CIPHER_TWOFISH_128_CBC, GNUTLS_KX_DHE_RSA,
@@ -425,7 +449,15 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = {
        GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_AES_256_CBC_SHA,
                                  GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA,
                                  GNUTLS_MAC_SHA, GNUTLS_SSL3),
-
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_3DES_EDE_CBC_RMD,
+                                 GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_RSA,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_AES_128_CBC_RMD,
+                                 GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_RSA,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_AES_256_CBC_RMD,
+                                 GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
        /* RSA */
        GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_NULL_MD5,
                                  GNUTLS_CIPHER_NULL,
@@ -453,7 +485,15 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = {
        GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_TWOFISH_128_CBC_SHA,
                                  GNUTLS_CIPHER_TWOFISH_128_CBC, GNUTLS_KX_RSA,
                                  GNUTLS_MAC_SHA, GNUTLS_TLS1),
-
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_3DES_EDE_CBC_RMD,
+                                 GNUTLS_CIPHER_3DES_CBC,
+                                 GNUTLS_KX_RSA, GNUTLS_MAC_RMD160, GNUTLS_TLS1),
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_AES_128_CBC_RMD,
+                                 GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_RSA,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_AES_256_CBC_RMD,
+                                 GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_RSA,
+                                 GNUTLS_MAC_RMD160, GNUTLS_TLS1),
        {0, {{0,0}}, 0, 0, 0, 0}
 };
 

diff --git a/lib/gnutls_hash_int.c b/lib/gnutls_hash_int.c
index 4f836108fbe34d759787eccef224fb62a0df69d3..8f3abcaf65bcb05d101e24d29b680fe4ed95cb79 100644 (file)
--- a/lib/gnutls_hash_int.c
+++ b/lib/gnutls_hash_int.c
@@ -30,38 +30,38 @@
 
 GNUTLS_HASH_HANDLE _gnutls_hash_init(gnutls_mac_algorithm algorithm)
 {
-       GNUTLS_MAC_HANDLE ret;
+       GNUTLS_MAC_HANDLE ret = NULL;
        gcry_error_t result;
 
+       ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT));
+       if (ret == NULL) {
+               gnutls_assert();
+               return GNUTLS_HASH_FAILED;
+       }
+
+       ret->algorithm = algorithm;
+
        switch (algorithm) {
        case GNUTLS_MAC_SHA:
-               ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT));
-               if (ret == NULL)
-                       return GNUTLS_HASH_FAILED;
                result = gcry_md_open( &ret->handle, GCRY_MD_SHA1, 0);
-               if (result) {
-                       gnutls_free(ret);
-                       ret = GNUTLS_HASH_FAILED;
-               }
                break;
-
        case GNUTLS_MAC_MD5:
-               ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT));
-               if (ret == NULL)
-                       return GNUTLS_HASH_FAILED;
                result = gcry_md_open( &ret->handle, GCRY_MD_MD5, 0);
-               if (result) {
-                       gnutls_free(ret);
-                       ret = GNUTLS_HASH_FAILED;
-               }
                break;
-
+       case GNUTLS_MAC_RMD160:
+               result = gcry_md_open( &ret->handle, GCRY_MD_RMD160, 0);
+               break;
        default:
+               gnutls_assert();
+               gnutls_free( ret);
                ret = GNUTLS_HASH_FAILED; break;
        }
 
-       if (ret != GNUTLS_HASH_FAILED)
-               ret->algorithm = algorithm;
+       if (result) {
+               gnutls_assert();
+               gnutls_free(ret);
+               ret = GNUTLS_HASH_FAILED;
+       }
 
        return ret;
 }
@@ -77,6 +77,9 @@ int _gnutls_hash_get_algo_len(gnutls_mac_algorithm algorithm)
        case GNUTLS_MAC_MD5:
                ret = gcry_md_get_algo_dlen(GCRY_MD_MD5);
                break;
+       case GNUTLS_MAC_RMD160:
+               ret = gcry_md_get_algo_dlen(GCRY_MD_MD5);
+               break;
        default:
                ret = 0; break;
        }
@@ -140,31 +143,28 @@ GNUTLS_MAC_HANDLE _gnutls_hmac_init(gnutls_mac_algorithm algorithm,
        GNUTLS_MAC_HANDLE ret;
        gcry_error_t result;
 
+       ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT));
+       if (ret == NULL)
+               return GNUTLS_MAC_FAILED;
+
        switch (algorithm) {
        case GNUTLS_MAC_SHA:
-               ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT));
-               if (ret == NULL)
-                       return GNUTLS_MAC_FAILED;
-
                result = gcry_md_open(&ret->handle, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC);
-
-               if (result)
-                       ret = GNUTLS_MAC_FAILED;
                break;
        case GNUTLS_MAC_MD5:
-               ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT));
-               if (ret == NULL)
-                       return GNUTLS_MAC_FAILED;
-
                result = gcry_md_open(&ret->handle, GCRY_MD_MD5, GCRY_MD_FLAG_HMAC);
-
-               if (result)
-                       ret = GNUTLS_MAC_FAILED;
+               break;
+       case GNUTLS_MAC_RMD160:
+               result = gcry_md_open(&ret->handle, GCRY_MD_RMD160, GCRY_MD_FLAG_HMAC);
                break;
        default:
+               gnutls_free(ret);
                ret = GNUTLS_MAC_FAILED;
        }
 
+       if (result)
+               ret = GNUTLS_MAC_FAILED;
+
        if (ret != GNUTLS_MAC_FAILED) {
                gcry_md_setkey(ret->handle, key, keylen);
 
@@ -173,8 +173,6 @@ GNUTLS_MAC_HANDLE _gnutls_hmac_init(gnutls_mac_algorithm algorithm,
                ret->keysize = keylen;
        }
 
-
-
        return ret;
 }
 
@@ -210,6 +208,18 @@ void _gnutls_hmac_deinit(GNUTLS_MAC_HANDLE handle, void *digest)
        gnutls_free(handle);
 }
 
+inline static int get_padsize( gnutls_mac_algorithm algorithm)
+{
+       switch (algorithm) {
+       case GNUTLS_MAC_MD5:
+               return 48;
+       case GNUTLS_MAC_SHA:
+               return 40;
+       default:
+               return 0;
+       }
+}
+
 GNUTLS_MAC_HANDLE _gnutls_mac_init_ssl3(gnutls_mac_algorithm algorithm, void *key,
                                        int keylen)
 {
@@ -217,19 +227,14 @@ GNUTLS_MAC_HANDLE _gnutls_mac_init_ssl3(gnutls_mac_algorithm algorithm, void *ke
        char ipad[48];
        int padsize;
 
-       switch (algorithm) {
-       case GNUTLS_MAC_MD5:
-               padsize = 48;
-               break;
-       case GNUTLS_MAC_SHA:
-               padsize = 40;
-               break;
-       default:
-               padsize = 0;
-       }
-       if (padsize > 0) {
-               memset(ipad, 0x36, padsize);
+       padsize = get_padsize( algorithm);
+       if (padsize == 0) {
+               gnutls_assert();
+               return GNUTLS_MAC_FAILED;
        }
+
+       memset(ipad, 0x36, padsize);
+
        ret = _gnutls_hash_init(algorithm);
        if (ret != GNUTLS_HASH_FAILED) {
                ret->key = key;
@@ -251,20 +256,14 @@ void _gnutls_mac_deinit_ssl3(GNUTLS_MAC_HANDLE handle, void *digest)
        int padsize;
        int block;
 
-       switch (handle->algorithm) {
-       case GNUTLS_MAC_MD5:
-               padsize = 48;
-               break;
-       case GNUTLS_MAC_SHA:
-               padsize = 40;
-               break;
-       default:
-               padsize = 0;
-       }
-       if (padsize > 0) {
-               memset(opad, 0x5C, padsize);
+       padsize = get_padsize( handle->algorithm);
+       if (padsize == 0) {
+               gnutls_assert();
+               return;
        }
 
+       memset(opad, 0x5C, padsize);
+
        td = _gnutls_hash_init(handle->algorithm);
        if (td != GNUTLS_MAC_FAILED) {
                if (handle->keysize > 0)
@@ -290,21 +289,15 @@ void _gnutls_mac_deinit_ssl3_handshake(GNUTLS_MAC_HANDLE handle,
        int padsize;
        int block;
 
-       switch (handle->algorithm) {
-       case GNUTLS_MAC_MD5:
-               padsize = 48;
-               break;
-       case GNUTLS_MAC_SHA:
-               padsize = 40;
-               break;
-       default:
-               padsize = 0;
-       }
-       if (padsize > 0) {
-               memset(opad, 0x5C, padsize);
-               memset(ipad, 0x36, padsize);
+       padsize = get_padsize( handle->algorithm);
+       if (padsize == 0) {
+               gnutls_assert();
+               return;
        }
 
+       memset(opad, 0x5C, padsize);
+       memset(ipad, 0x36, padsize);
+
        td = _gnutls_hash_init(handle->algorithm);
        if (td != GNUTLS_HASH_FAILED) {
                if (key_size > 0)

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 729e09ac758cca07d4875ab428858f63026577f2..58b86444020db389a9432ed4650af70c719ed117 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -175,7 +175,9 @@ typedef enum gnutls_kx_algorithm { GNUTLS_KX_RSA=1, GNUTLS_KX_DHE_DSS,
        GNUTLS_KX_RSA_EXPORT, GNUTLS_KX_SRP_RSA, GNUTLS_KX_SRP_DSS
 } gnutls_kx_algorithm;
 
-typedef enum gnutls_mac_algorithm { GNUTLS_MAC_UNKNOWN=0, GNUTLS_MAC_NULL=1, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA } gnutls_mac_algorithm;
+typedef enum gnutls_mac_algorithm { GNUTLS_MAC_UNKNOWN=0, GNUTLS_MAC_NULL=1, 
+GNUTLS_MAC_MD5, GNUTLS_MAC_SHA, GNUTLS_MAC_RMD160
+} gnutls_mac_algorithm;
 typedef gnutls_mac_algorithm gnutls_digest_algorithm;
 
 typedef enum gnutls_compression_method { GNUTLS_COMP_NULL=1, GNUTLS_COMP_ZLIB,

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index c5f8fd39866f1ffb0cd7198c8bb9d28844149a21..ad898bc53dc16a50cebda0cedb720a7feb979010 100644 (file)
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -222,13 +222,10 @@ int gnutls_certificate_type_set_priority(gnutls_session session,
   * the appropriate functions.
   *
   * The order is TLS1, SSL3 for protocols.
-  * GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA for key exchange 
-  * algorithms.
-  * GNUTLS_MAC_SHA, GNUTLS_MAC_MD5 for MAC algorithms.
-  * GNUTLS_CIPHER_AES_256_CBC, 
-  * GNUTLS_CIPHER_AES_128_CBC, 
-  * and GNUTLS_CIPHER_3DES_CBC, 
-  * GNUTLS_CIPHER_ARCFOUR_128 for ciphers.
+  * RSA, DHE_DSS, DHE_RSA for key exchange 
+  * algorithms. SHA, MD5 and RIPEMD160 for MAC algorithms.
+  * AES_256_CBC, AES_128_CBC, 3DES_CBC, 
+  * and ARCFOUR_128 for ciphers.
   *
   **/
 int gnutls_set_default_priority(gnutls_session session)
@@ -243,7 +240,7 @@ int gnutls_set_default_priority(gnutls_session session)
        };
        static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 };
        static const int mac_priority[] =
-           { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
+           { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 };
 
        gnutls_cipher_set_priority(session, cipher_priority);
        gnutls_compression_set_priority(session, comp_priority);
@@ -261,12 +258,11 @@ int gnutls_set_default_priority(gnutls_session session)
   * Sets some default priority on the ciphers, key exchange methods, macs
   * and compression methods. This is to avoid using the gnutls_*_priority() functions, if
   * these defaults are ok. This function also includes weak algorithms.
-  * The order is TLS1, SSL3 for protocols,  GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, 
-  * GNUTLS_KX_DHE_RSA, GNUTLS_KX_RSA_EXPORT for key exchange algorithms.
-  * GNUTLS_MAC_SHA, GNUTLS_MAC_MD5 for MAC algorithms,
-  * GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC, 
-  * and GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128, 
-  * GNUTLS_CIPHER_ARCFOUR_40 for ciphers.
+  * The order is TLS1, SSL3 for protocols,  RSA, DHE_DSS, 
+  * DHE_RSA, RSA_EXPORT for key exchange algorithms.
+  * SHA, MD5, RIPEMD160 for MAC algorithms,
+  * AES_256_CBC, AES_128_CBC, 
+  * and 3DES_CBC, ARCFOUR_128, ARCFOUR_40 for ciphers.
   *
   **/
 int gnutls_set_default_export_priority(gnutls_session session)
@@ -285,7 +281,7 @@ int gnutls_set_default_export_priority(gnutls_session session)
        };
        static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 };
        static const int mac_priority[] =
-           { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
+           { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 };
 
        gnutls_cipher_set_priority(session, cipher_priority);
        gnutls_compression_set_priority(session, comp_priority);

diff --git a/lib/x509/common.c b/lib/x509/common.c
index ec76e18463d76bba3939f0d4f09b3091c845c075..557ab03c1e3b9e5fb4127f5593a9de76cad50c9d 100644 (file)
--- a/lib/x509/common.c
+++ b/lib/x509/common.c
@@ -602,7 +602,6 @@ int _gnutls_x509_export_int( ASN1_TYPE asn1_data,
                        *output_data_size = len;
                        if (result == ASN1_MEM_ERROR) {
                                gnutls_assert();
-                               _gnutls_debug_log("Length required for der coding: %d\n", len);
                                return GNUTLS_E_SHORT_MEMORY_BUFFER;
                        }
                        gnutls_assert();
@@ -626,7 +625,6 @@ int _gnutls_x509_export_int( ASN1_TYPE asn1_data,
                if ((result=asn1_der_coding( asn1_data, "", tmp, &len, NULL)) != ASN1_SUCCESS) {
                        gnutls_assert();
                        if (result == ASN1_MEM_ERROR) {
-                               _gnutls_debug_log("Length required for der coding: %d\n", len);
                                *output_data_size = B64FSIZE(strlen(pem_header),len) + 1;
                        }
                        gnutls_afree(tmp);

diff --git a/src/cli.c b/src/cli.c
index 7bbb141c7dfaf56a931bacad8d23d7ef9937000b..6a52c2c1fdb45c34c2c49b42def6e20a2a76d019 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -81,11 +81,12 @@ int kx_priority[PRI_MAX] =
 };
 int cipher_priority[PRI_MAX] =
     { GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_AES_128_CBC,
-       GNUTLS_CIPHER_3DES_CBC,
+       GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_AES_256_CBC,
        GNUTLS_CIPHER_ARCFOUR_40, 0
 };
 int comp_priority[PRI_MAX] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 };
-int mac_priority[PRI_MAX] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
+int mac_priority[PRI_MAX] = 
+       { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 };
 int cert_type_priority[PRI_MAX] = { GNUTLS_CRT_X509, GNUTLS_CRT_OPENPGP, 0 };
 
 /* end of global stuff */

diff --git a/src/common.c b/src/common.c
index 9bf983d79507db67c33660de7a2c078011c07ccf..2dc8e502a7f19e74729881d03783a3ccb38d7884 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -486,6 +486,7 @@ void print_list(void)
 
        printf("MACs:");
        printf(" MD5");
+       printf(", RMD160");
        printf(", SHA-1\n");
 
        printf("Key exchange algorithms:");
@@ -571,6 +572,8 @@ void parse_macs(char **macs, int nmacs, int *mac_priority)
                for (j = i = 0; i < nmacs; i++) {
                        if (strncasecmp(macs[i], "MD5", 3) == 0)
                                mac_priority[j++] = GNUTLS_MAC_MD5;
+                       if (strncasecmp(macs[i], "RMD", 3) == 0)
+                               mac_priority[j++] = GNUTLS_MAC_RMD160;
                        if (strncasecmp(macs[i], "SHA", 3) == 0)
                                mac_priority[j++] = GNUTLS_MAC_SHA;
                }

diff --git a/src/serv.c b/src/serv.c
index ec879e8e645b92420936257ba33e982906d27d44..6b9c0c57f0e9393832fd08553ae28e5205905aca 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -259,7 +259,8 @@ int cipher_priority[PRI_MAX] =
 
 int comp_priority[PRI_MAX] =
     { GNUTLS_COMP_ZLIB, GNUTLS_COMP_LZO, GNUTLS_COMP_NULL, 0 };
-int mac_priority[PRI_MAX] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
+int mac_priority[PRI_MAX] = 
+       { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 };
 int cert_type_priority[PRI_MAX] = { GNUTLS_CRT_X509, GNUTLS_CRT_OPENPGP, 0 };
 
 LIST_DECLARE_INIT(listener_list, listener_item, listener_free);