Added support for the DSS certificate SRP authenticated cipher suites (currently...

diff --git a/lib/gnutls.h.in.in b/lib/gnutls.h.in.in
index 97e7b5644f7b2c92eeb3bf75cb8e9c5352b57774..04efa1d67600d6892389321ebbd12d5034f66278 100644 (file)
--- a/lib/gnutls.h.in.in
+++ b/lib/gnutls.h.in.in
@@ -44,7 +44,7 @@ typedef enum gnutls_cipher_algorithm { GNUTLS_CIPHER_NULL=1,
 
 typedef enum gnutls_kx_algorithm { GNUTLS_KX_RSA=1, GNUTLS_KX_DHE_DSS, 
        GNUTLS_KX_DHE_RSA, GNUTLS_KX_ANON_DH, GNUTLS_KX_SRP,
-       GNUTLS_KX_RSA_EXPORT, GNUTLS_KX_SRP_RSA
+       GNUTLS_KX_RSA_EXPORT, GNUTLS_KX_SRP_RSA, GNUTLS_KX_SRP_DSS
 } gnutls_kx_algorithm;
 
 typedef enum gnutls_credentials_type { GNUTLS_CRD_CERTIFICATE=1, GNUTLS_CRD_ANON, GNUTLS_CRD_SRP } gnutls_credentials_type;
@@ -58,7 +58,7 @@ typedef enum gnutls_digest_algorithm { GNUTLS_DIG_NULL=1, GNUTLS_DIG_MD5, GNUTLS
 /* exported for other gnutls headers. This is the maximum number
  * of algorithms (ciphers, kx or macs). 
  */
-#define GNUTLS_MAX_ALGORITHM_NUM 8
+#define GNUTLS_MAX_ALGORITHM_NUM 10
 
 typedef enum gnutls_compression_method { GNUTLS_COMP_NULL=1, 
        GNUTLS_COMP_ZLIB, 

diff --git a/lib/gnutls_alert.c b/lib/gnutls_alert.c
index e40bda5d3145c21acae60379149f345705d17bd0..3a6207548b6769f6fe77b3bf2fd694e85e5abf78 100644 (file)
--- a/lib/gnutls_alert.c
+++ b/lib/gnutls_alert.c
@@ -166,6 +166,9 @@ int _level = -1;
                case GNUTLS_E_UNKNOWN_CIPHER_SUITE:
                case GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM:
                 case GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION:
+                case GNUTLS_E_INSUFICIENT_CREDENTIALS:
+               case GNUTLS_E_NO_CIPHER_SUITES:
+               case GNUTLS_E_NO_COMPRESSION_ALGORITHMS:
                         ret = GNUTLS_A_HANDSHAKE_FAILURE;
                        _level = GNUTLS_AL_FATAL;
                         break;

diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index f05a3cb4c290c73c4238a4b19bf2f61400a7f77c..873d35b91855ec1e82388b9404d303f7aab93d57 100644 (file)
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -41,6 +41,7 @@ static const gnutls_cred_map cred_mappings[] = {
        { GNUTLS_KX_DHE_RSA,    GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE },
        { GNUTLS_KX_SRP,        GNUTLS_CRD_SRP,         GNUTLS_CRD_SRP     },
        { GNUTLS_KX_SRP_RSA,    GNUTLS_CRD_SRP,         GNUTLS_CRD_CERTIFICATE     },
+       { GNUTLS_KX_SRP_DSS,    GNUTLS_CRD_SRP,         GNUTLS_CRD_CERTIFICATE     },
        { 0 }
 };
 
@@ -241,6 +242,7 @@ typedef struct {
 #define GNUTLS_SRP_SHA_RIJNDAEL_256_CBC_SHA { 0x00, 0x56 }
 
 #define GNUTLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA { 0x00, 0x51 }
+#define GNUTLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA { 0x00, 0x52 }
 
 /** RSA 
  **/
@@ -323,6 +325,10 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = {
                                  GNUTLS_CIPHER_RIJNDAEL_256_CBC, GNUTLS_KX_SRP,
                                  GNUTLS_MAC_SHA, GNUTLS_TLS1),
 
+       GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA,
+                                 GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP_DSS,
+                                 GNUTLS_MAC_SHA, GNUTLS_TLS1),
+
        GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA,
                                  GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP_RSA,
                                  GNUTLS_MAC_SHA, GNUTLS_TLS1),

diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index 2ddf17b937c0a27e7850eba57de4050edbae65c2..caa8acc11b87987e8a19380b4ba3c15da1683ba2 100644 (file)
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -59,6 +59,7 @@ static const gnutls_pk_map pk_mappings[] = {
        {GNUTLS_KX_DHE_RSA, GNUTLS_PK_RSA},
        {GNUTLS_KX_SRP_RSA, GNUTLS_PK_RSA},
        {GNUTLS_KX_DHE_DSS, GNUTLS_PK_DSA},
+       {GNUTLS_KX_SRP_DSS, GNUTLS_PK_DSA},
        {0}
 };
 

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 6771fcb8a74e96d797ececc9a7e6388d8beb1b87..00dfd2a5c2dc52d846f69070677a373d8a5abc44 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -553,7 +553,7 @@ int _gnutls_server_select_suite(gnutls_session session, opaque *data, int datale
        if (x<=0) {
                gnutls_assert();
                if (x<0) return x;
-               else return GNUTLS_E_INSUFICIENT_CREDENTIALS;
+               else return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
        }
 
 #ifdef HANDSHAKE_DEBUG
@@ -2389,6 +2389,7 @@ int _gnutls_remove_unwanted_ciphersuites(gnutls_session session,
                /* if it is defined but had no credentials 
                 */
                if (_gnutls_get_kx_cred(session, kx, NULL) == NULL) {
+fprintf(stderr, "HERE\n");
                        keep = 1;
                } else
                /* If there was no credentials to use with the specified
@@ -2396,14 +2397,16 @@ int _gnutls_remove_unwanted_ciphersuites(gnutls_session session,
                 */
                if (_gnutls_map_kx_get_cred(kx, server) == GNUTLS_CRD_CERTIFICATE) {
                        keep = 1;       /* do not keep */
+
+fprintf(stderr, "THERE %d\n", kx);
                        if (x509_cred != NULL) {
                                if (server) {
                                        /* here we check if the KX algorithm 
                                         * is compatible with the certificate.
                                         */
-fprintf(stderr, "KX: %d\n", kx);
                                        for (j = 0; j < alg_size; j++) {
-fprintf(stderr, "ALG: %d\n", alg[j]);
+fprintf(stderr, "ALG %d\n", alg[j]);
+
                                                if (alg[j] == kx) {
                                                        keep = 0;
                                                        break;

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 281ba655c859eb8e0ff0b031b4165c72412c6489..80426c1cb17e2a6b923a25de5a6627d707aac6ce 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -35,8 +35,10 @@
 #define X509_DEBUG
 #define RECORD_DEBUG
 #define COMPRESSION_DEBUG
-#define DEBUG
 */
+#define HANDSHAKE_DEBUG
+#define DEBUG
+
 
 /* It might be a good idea to replace int with void*
  * here.
@@ -145,7 +147,7 @@ typedef gnutls_datum gnutls_sdatum;
 /* This is the maximum number of algorithms (ciphers or macs etc).
  * keep it synced with GNUTLS_MAX_ALGORITHM_NUM in gnutls.h
  */
-#define MAX_ALGOS 8
+#define MAX_ALGOS 10
 
 #define MAX_CIPHERSUITES 256
 
@@ -159,7 +161,7 @@ typedef enum gnutls_cipher_algorithm { GNUTLS_CIPHER_NULL=1,
 
 typedef enum gnutls_kx_algorithm { GNUTLS_KX_RSA=1, GNUTLS_KX_DHE_DSS, 
        GNUTLS_KX_DHE_RSA, GNUTLS_KX_ANON_DH, GNUTLS_KX_SRP,
-       GNUTLS_KX_RSA_EXPORT, GNUTLS_KX_SRP_RSA
+       GNUTLS_KX_RSA_EXPORT, GNUTLS_KX_SRP_RSA, GNUTLS_KX_SRP_DSS
 } gnutls_kx_algorithm;
 
 typedef enum gnutls_mac_algorithm { GNUTLS_MAC_NULL=1, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA } gnutls_mac_algorithm;

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 59f46a47eeb94acf76ddae9b5c1c7a52d43925f4..8d27ccb60c4e0d98411c593271a3136b68d33cb4 100644 (file)
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -2233,6 +2233,7 @@ int _gnutls_check_x509_key_usage( const gnutls_cert * cert,
                        }
                        return 0;
                case GNUTLS_KX_SRP_RSA:
+               case GNUTLS_KX_SRP_DSS:
                case GNUTLS_KX_DHE_RSA:
                case GNUTLS_KX_DHE_DSS:
                case GNUTLS_KX_RSA_EXPORT:

diff --git a/libextra/auth_srp_rsa.c b/libextra/auth_srp_rsa.c
index 466482a2ccf60577a26113650f98c512f03f08f8..ecf8d51c24b9ca59c1097efca37eddaf82d1bf8d 100644 (file)
--- a/libextra/auth_srp_rsa.c
+++ b/libextra/auth_srp_rsa.c
@@ -39,15 +39,15 @@
 #include <gnutls_x509.h>
 #include <gnutls_extra.h>
 
-static int gen_srp_rsa_server_kx2(gnutls_session, opaque **);
-static int proc_srp_rsa_server_kx2(gnutls_session, opaque *, size_t);
+static int gen_srp_cert_server_kx2(gnutls_session, opaque **);
+static int proc_srp_cert_server_kx2(gnutls_session, opaque *, size_t);
 
 const MOD_AUTH_STRUCT srp_rsa_auth_struct = {
        "SRP",
        _gnutls_gen_cert_server_certificate,
        NULL,
        NULL,
-       gen_srp_rsa_server_kx2,
+       gen_srp_cert_server_kx2,
        _gnutls_gen_srp_client_kx0,
        NULL,
        NULL,
@@ -56,15 +56,35 @@ const MOD_AUTH_STRUCT srp_rsa_auth_struct = {
        _gnutls_proc_cert_server_certificate,
        NULL, /* certificate */
        NULL,
-       proc_srp_rsa_server_kx2,
+       proc_srp_cert_server_kx2,
        _gnutls_proc_srp_client_kx0,
        NULL,
        NULL,
        NULL
 };
 
+const MOD_AUTH_STRUCT srp_dss_auth_struct = {
+       "SRP",
+       _gnutls_gen_cert_server_certificate,
+       NULL,
+       NULL,
+       gen_srp_cert_server_kx2,
+       _gnutls_gen_srp_client_kx0,
+       NULL,
+       NULL,
+       NULL,
+
+       _gnutls_proc_cert_server_certificate,
+       NULL, /* certificate */
+       NULL,
+       proc_srp_cert_server_kx2,
+       _gnutls_proc_srp_client_kx0,
+       NULL,
+       NULL,
+       NULL
+};
 
-static int gen_srp_rsa_server_kx2(gnutls_session session, opaque ** data)
+static int gen_srp_cert_server_kx2(gnutls_session session, opaque ** data)
 {
 ssize_t ret, data_size;
 gnutls_datum signature, ddata;
@@ -123,7 +143,7 @@ int apr_cert_list_length;
 
 extern OPENPGP_CERT2GNUTLS_CERT _E_gnutls_openpgp_cert2gnutls_cert;
 
-static int proc_srp_rsa_server_kx2(gnutls_session session, opaque * data, size_t _data_size)
+static int proc_srp_cert_server_kx2(gnutls_session session, opaque * data, size_t _data_size)
 {
 ssize_t ret;
 int i, sigsize;

diff --git a/libextra/ext_srp.c b/libextra/ext_srp.c
index 957ec92529a79f007fac0ac7732490c18b3d3142..3cfa92167ba31f51918c564ff6e26e7a2dca2ff0 100644 (file)
--- a/libextra/ext_srp.c
+++ b/libextra/ext_srp.c
@@ -33,6 +33,7 @@ int _gnutls_srp_recv_params( gnutls_session state, const opaque* data, size_t _d
        ssize_t data_size = _data_size;
 
        if (_gnutls_kx_priority( state, GNUTLS_KX_SRP) < 0 && 
+               _gnutls_kx_priority( state, GNUTLS_KX_SRP_DSS) < 0 && 
                _gnutls_kx_priority( state, GNUTLS_KX_SRP_RSA) < 0) {
                /* algorithm was not allowed in this session
                 */
@@ -67,7 +68,10 @@ int _gnutls_srp_recv_params( gnutls_session state, const opaque* data, size_t _d
 inline static int is_srp( GNUTLS_CipherSuite suite) {
        int kx = _gnutls_cipher_suite_get_kx_algo( suite);
        
-       if (kx == GNUTLS_KX_SRP || (kx == GNUTLS_KX_SRP_RSA)) return 1;
+       if (kx == GNUTLS_KX_SRP || (kx == GNUTLS_KX_SRP_RSA) ||
+         kx == GNUTLS_KX_SRP_DSS) {
+               return 1;
+       }
        
        return 0;
 }
@@ -79,6 +83,7 @@ int _gnutls_srp_send_params( gnutls_session state, opaque* data, size_t data_siz
        uint len;
 
        if (_gnutls_kx_priority( state, GNUTLS_KX_SRP) < 0 && 
+               _gnutls_kx_priority( state, GNUTLS_KX_SRP_DSS) < 0 && 
                _gnutls_kx_priority( state, GNUTLS_KX_SRP_RSA) < 0) {
                /* algorithm was not allowed in this session
                 */

diff --git a/libextra/gnutls_extra.c b/libextra/gnutls_extra.c
index 608266ac32ec3a987c5731d08354f06322be1454..8f557b083c3dc61ac333c6a0e9d7a53fca237cad 100644 (file)
--- a/libextra/gnutls_extra.c
+++ b/libextra/gnutls_extra.c
@@ -58,6 +58,7 @@ extern const int _gnutls_kx_algorithms_size;
 extern gnutls_kx_algo_entry _gnutls_kx_algorithms[];
 extern MOD_AUTH_STRUCT srp_auth_struct;
 extern MOD_AUTH_STRUCT srp_rsa_auth_struct;
+extern MOD_AUTH_STRUCT srp_dss_auth_struct;
 
 static int _gnutls_add_srp_auth_struct(void) {
 int i;
@@ -71,9 +72,7 @@ int i;
                _gnutls_kx_algorithms[i].name = "SRP";
                _gnutls_kx_algorithms[i].algorithm = GNUTLS_KX_SRP;
                _gnutls_kx_algorithms[i].auth_struct = &srp_auth_struct;
-
                _gnutls_kx_algorithms[i+1].name = 0;
-       
        }
        i++;
 
@@ -81,6 +80,14 @@ int i;
                _gnutls_kx_algorithms[i].name = "SRP_RSA";
                _gnutls_kx_algorithms[i].algorithm = GNUTLS_KX_SRP_RSA;
                _gnutls_kx_algorithms[i].auth_struct = &srp_rsa_auth_struct;
+               _gnutls_kx_algorithms[i+1].name = 0;
+       }
+       i++;
+
+       if (_gnutls_kx_algorithms[i].name==NULL && (i < _gnutls_kx_algorithms_size-1)) {
+               _gnutls_kx_algorithms[i].name = "SRP_DSS";
+               _gnutls_kx_algorithms[i].algorithm = GNUTLS_KX_SRP_DSS;
+               _gnutls_kx_algorithms[i].auth_struct = &srp_dss_auth_struct;
 
                _gnutls_kx_algorithms[i+1].name = 0;
        

diff --git a/src/cli.c b/src/cli.c
index 027c47fd305dbf9f014621473708ce7cce15971c..ddf45b6defd53a192313688ddccbb27d49b7fa9f 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -456,85 +456,13 @@ void gaa_parser(int argc, char **argv)
    else
       hostname = info.rest_args;
 
-   if (info.proto != NULL && info.nproto > 0) {
-      for (j = i = 0; i < info.nproto; i++) {
-        if (strncasecmp(info.proto[i], "SSL", 3) == 0)
-           protocol_priority[j++] = GNUTLS_SSL3;
-        if (strncasecmp(info.proto[i], "TLS", 3) == 0)
-           protocol_priority[j++] = GNUTLS_TLS1;
-      }
-      protocol_priority[j] = 0;
-   }
-
-   if (info.ciphers != NULL && info.nciphers > 0) {
-      for (j = i = 0; i < info.nciphers; i++) {
-        if (strncasecmp(info.ciphers[i], "RIJ", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_RIJNDAEL_128_CBC;
-        if (strncasecmp(info.ciphers[i], "TWO", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_TWOFISH_128_CBC;
-        if (strncasecmp(info.ciphers[i], "3DE", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_3DES_CBC;
-        if (strcasecmp(info.ciphers[i], "ARCFOUR-40") == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_ARCFOUR_40;
-        if (strcasecmp(info.ciphers[i], "ARCFOUR") == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_ARCFOUR_128;
-        if (strncasecmp(info.ciphers[i], "NUL", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_NULL;
-      }
-      cipher_priority[j] = 0;
-   }
-
-   if (info.macs != NULL && info.nmacs > 0) {
-      for (j = i = 0; i < info.nmacs; i++) {
-        if (strncasecmp(info.macs[i], "MD5", 3) == 0)
-           mac_priority[j++] = GNUTLS_MAC_MD5;
-        if (strncasecmp(info.macs[i], "SHA", 3) == 0)
-           mac_priority[j++] = GNUTLS_MAC_SHA;
-      }
-      mac_priority[j] = 0;
-   }
+   parse_protocols( info.proto, info.nproto, protocol_priority);
+   parse_ciphers( info.ciphers, info.nciphers, cipher_priority);
+   parse_macs( info.macs, info.nmacs, mac_priority);
+   parse_ctypes( info.ctype, info.nctype, cert_type_priority);
+   parse_kx( info.kx, info.nkx, kx_priority);
+   parse_comp( info.comp, info.ncomp, comp_priority);
 
-   if (info.ctype != NULL && info.nctype > 0) {
-      for (j = i = 0; i < info.nctype; i++) {
-        if (strncasecmp(info.ctype[i], "OPE", 3) == 0)
-           cert_type_priority[j++] = GNUTLS_CRT_OPENPGP;
-        if (strncasecmp(info.ctype[i], "X", 1) == 0)
-           cert_type_priority[j++] = GNUTLS_CRT_X509;
-      }
-      cert_type_priority[j] = 0;
-   }
-
-   if (info.kx != NULL && info.nkx > 0) {
-      for (j = i = 0; i < info.nkx; i++) {
-        if (strcasecmp(info.kx[i], "SRP") == 0)
-           kx_priority[j++] = GNUTLS_KX_SRP;
-        if (strcasecmp(info.kx[i], "SRP-RSA") == 0)
-           kx_priority[j++] = GNUTLS_KX_SRP_RSA;
-        if (strcasecmp(info.kx[i], "RSA") == 0)
-           kx_priority[j++] = GNUTLS_KX_RSA;
-        if (strcasecmp(info.kx[i], "RSA-EXPORT") == 0)
-           kx_priority[j++] = GNUTLS_KX_RSA_EXPORT;
-        if (strncasecmp(info.kx[i], "DHE-RSA", 7) == 0)
-           kx_priority[j++] = GNUTLS_KX_DHE_RSA;
-        if (strncasecmp(info.kx[i], "DHE-DSS", 7) == 0)
-           kx_priority[j++] = GNUTLS_KX_DHE_DSS;
-        if (strncasecmp(info.kx[i], "ANON", 4) == 0)
-           kx_priority[j++] = GNUTLS_KX_ANON_DH;
-      }
-      kx_priority[j] = 0;
-   }
-
-   if (info.comp != NULL && info.ncomp > 0) {
-      for (j = i = 0; i < info.ncomp; i++) {
-        if (strncasecmp(info.comp[i], "NUL", 3) == 0)
-           comp_priority[j++] = GNUTLS_COMP_NULL;
-        if (strncasecmp(info.comp[i], "ZLI", 3) == 0)
-           comp_priority[j++] = GNUTLS_COMP_ZLIB;
-        if (strncasecmp(info.comp[i], "LZO", 3) == 0)
-           comp_priority[j++] = GNUTLS_COMP_LZO;
-      }
-      comp_priority[j] = 0;
-   }
 
 }
 

diff --git a/src/common.c b/src/common.c
index 9038bcb811824cd69fd4d5af10430a2dcef020f7..c1e96c35c196bf8034738c4a3fdbf6157fc23b5f 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -374,6 +374,7 @@ void print_list(void)
        printf(", DHE-RSA");
        printf(", SRP");
        printf(", SRP-RSA");
+       printf(", SRP-DSS");
        printf(", ANON-DH\n");
 
        printf("Compression methods:");
@@ -399,3 +400,112 @@ void print_license(void)
                "along with this program; if not, write to the Free Software \n"
                "Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.\n\n");
 }
+
+void parse_protocols( char** protocols, int protocols_size, int* protocol_priority)
+{
+int i,j;
+
+   if (protocols != NULL && protocols_size > 0) {
+      for (j = i = 0; i < protocols_size; i++) {
+        if (strncasecmp(protocols[i], "SSL", 3) == 0)
+           protocol_priority[j++] = GNUTLS_SSL3;
+        if (strncasecmp(protocols[i], "TLS", 3) == 0)
+           protocol_priority[j++] = GNUTLS_TLS1;
+      }
+      protocol_priority[j] = 0;
+   }
+}
+
+void parse_ciphers( char** ciphers, int nciphers, int* cipher_priority)
+{   
+int j,i;
+
+   if (ciphers != NULL && nciphers > 0) {
+      for (j = i = 0; i < nciphers; i++) {
+        if (strncasecmp(ciphers[i], "RIJ", 3) == 0)
+           cipher_priority[j++] = GNUTLS_CIPHER_RIJNDAEL_128_CBC;
+        if (strncasecmp(ciphers[i], "TWO", 3) == 0)
+           cipher_priority[j++] = GNUTLS_CIPHER_TWOFISH_128_CBC;
+        if (strncasecmp(ciphers[i], "3DE", 3) == 0)
+           cipher_priority[j++] = GNUTLS_CIPHER_3DES_CBC;
+        if (strcasecmp(ciphers[i], "ARCFOUR-40") == 0)
+           cipher_priority[j++] = GNUTLS_CIPHER_ARCFOUR_40;
+        if (strcasecmp(ciphers[i], "ARCFOUR") == 0)
+           cipher_priority[j++] = GNUTLS_CIPHER_ARCFOUR_128;
+        if (strncasecmp(ciphers[i], "NUL", 3) == 0)
+           cipher_priority[j++] = GNUTLS_CIPHER_NULL;
+      }
+      cipher_priority[j] = 0;
+   }
+}
+
+void parse_macs( char** macs, int nmacs, int *mac_priority)
+{
+int i,j;
+   if (macs != NULL && nmacs > 0) {
+      for (j = i = 0; i < nmacs; i++) {
+        if (strncasecmp(macs[i], "MD5", 3) == 0)
+           mac_priority[j++] = GNUTLS_MAC_MD5;
+        if (strncasecmp(macs[i], "SHA", 3) == 0)
+           mac_priority[j++] = GNUTLS_MAC_SHA;
+      }
+      mac_priority[j] = 0;
+   }
+}
+
+void parse_ctypes( char** ctype, int nctype, int * cert_type_priority)
+{
+int i,j;
+   if (ctype != NULL && nctype > 0) {
+      for (j = i = 0; i < nctype; i++) {
+        if (strncasecmp(ctype[i], "OPE", 3) == 0)
+           cert_type_priority[j++] = GNUTLS_CRT_OPENPGP;
+        if (strncasecmp(ctype[i], "X", 1) == 0)
+           cert_type_priority[j++] = GNUTLS_CRT_X509;
+      }
+      cert_type_priority[j] = 0;
+   }
+}
+
+void parse_kx( char** kx, int nkx, int* kx_priority)
+{
+int i,j;
+   if (kx != NULL && nkx > 0) {
+      for (j = i = 0; i < nkx; i++) {
+        if (strcasecmp(kx[i], "SRP") == 0)
+           kx_priority[j++] = GNUTLS_KX_SRP;
+        if (strcasecmp(kx[i], "SRP-RSA") == 0)
+           kx_priority[j++] = GNUTLS_KX_SRP_RSA;
+        if (strcasecmp(kx[i], "SRP-DSS") == 0)
+           kx_priority[j++] = GNUTLS_KX_SRP_DSS;
+        if (strcasecmp(kx[i], "RSA") == 0)
+           kx_priority[j++] = GNUTLS_KX_RSA;
+        if (strcasecmp(kx[i], "RSA-EXPORT") == 0)
+           kx_priority[j++] = GNUTLS_KX_RSA_EXPORT;
+        if (strncasecmp(kx[i], "DHE-RSA", 7) == 0)
+           kx_priority[j++] = GNUTLS_KX_DHE_RSA;
+        if (strncasecmp(kx[i], "DHE-DSS", 7) == 0)
+           kx_priority[j++] = GNUTLS_KX_DHE_DSS;
+        if (strncasecmp(kx[i], "ANON", 4) == 0)
+           kx_priority[j++] = GNUTLS_KX_ANON_DH;
+      }
+      kx_priority[j] = 0;
+   }
+}
+
+void parse_comp( char** comp, int ncomp, int* comp_priority)
+{
+int i,j;
+   if (comp != NULL && ncomp > 0) {
+      for (j = i = 0; i < ncomp; i++) {
+        if (strncasecmp(comp[i], "NUL", 3) == 0)
+           comp_priority[j++] = GNUTLS_COMP_NULL;
+        if (strncasecmp(comp[i], "ZLI", 3) == 0)
+           comp_priority[j++] = GNUTLS_COMP_ZLIB;
+        if (strncasecmp(comp[i], "LZO", 3) == 0)
+           comp_priority[j++] = GNUTLS_COMP_LZO;
+      }
+      comp_priority[j] = 0;
+   }
+
+}

diff --git a/src/common.h b/src/common.h
index f24f14649bef31db7dfb1f67806391d9d3164ee5..6ffe52508f92a56b2fd6ec2c4de348ecf06779cb 100644 (file)
--- a/src/common.h
+++ b/src/common.h
@@ -6,3 +6,10 @@
 int print_info( gnutls_session state);
 void print_cert_info( gnutls_session state);
 int print_list(void);
+
+void parse_comp( char** comp, int ncomp, int* comp_priority);
+void parse_kx( char** kx, int nkx, int* kx_priority);
+void parse_ctypes( char** ctype, int nctype, int * cert_type_priority);
+void parse_macs( char** macs, int nmacs, int *mac_priority);
+void parse_ciphers( char** ciphers, int nciphers, int* cipher_priority);
+void parse_protocols( char** protocols, int protocols_size, int* protocol_priority);

diff --git a/src/serv.c b/src/serv.c
index f0a508f68bb634e222847bc9ba73404500e7b1bc..05907772398546eeaf9f750f834c59972295fdcc 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -938,83 +938,12 @@ void gaa_parser(int argc, char **argv)
    pgp_keyring = info.pgp_keyring;
    pgp_trustdb = info.pgp_trustdb;
 
-   if (info.proto != NULL && info.nproto > 0) {
-      for (j = i = 0; i < info.nproto; i++) {
-        if (strncasecmp(info.proto[i], "SSL", 3) == 0)
-           protocol_priority[j++] = GNUTLS_SSL3;
-        if (strncasecmp(info.proto[i], "TLS", 3) == 0)
-           protocol_priority[j++] = GNUTLS_TLS1;
-      }
-      protocol_priority[j] = 0;
-   }
-
-   if (info.ciphers != NULL && info.nciphers > 0) {
-      for (j = i = 0; i < info.nciphers; i++) {
-        if (strncasecmp(info.ciphers[i], "RIJ", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_RIJNDAEL_128_CBC;
-        if (strncasecmp(info.ciphers[i], "TWO", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_TWOFISH_128_CBC;
-        if (strncasecmp(info.ciphers[i], "3DE", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_3DES_CBC;
-        if (strncasecmp(info.ciphers[i], "ARC", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_ARCFOUR_128;
-        if (strncasecmp(info.ciphers[i], "NUL", 3) == 0)
-           cipher_priority[j++] = GNUTLS_CIPHER_NULL;
-      }
-      cipher_priority[j] = 0;
-   }
-
-   if (info.macs != NULL && info.nmacs > 0) {
-      for (j = i = 0; i < info.nmacs; i++) {
-        if (strncasecmp(info.macs[i], "MD5", 3) == 0)
-           mac_priority[j++] = GNUTLS_MAC_MD5;
-        if (strncasecmp(info.macs[i], "SHA", 3) == 0)
-           mac_priority[j++] = GNUTLS_MAC_SHA;
-      }
-      mac_priority[j] = 0;
-   }
-
-   if (info.ctype != NULL && info.nctype > 0) {
-      for (j = i = 0; i < info.nctype; i++) {
-        if (strncasecmp(info.ctype[i], "OPE", 3) == 0)
-           cert_type_priority[j++] = GNUTLS_CRT_OPENPGP;
-        if (strncasecmp(info.ctype[i], "X", 1) == 0)
-           cert_type_priority[j++] = GNUTLS_CRT_X509;
-      }
-      cert_type_priority[j] = 0;
-   }
-
-   if (info.kx != NULL && info.nkx > 0) {
-      for (j = i = 0; i < info.nkx; i++) {
-        if (strcasecmp(info.kx[i], "SRP") == 0)
-           kx_priority[j++] = GNUTLS_KX_SRP;
-        if (strcasecmp(info.kx[i], "SRP-RSA") == 0)
-           kx_priority[j++] = GNUTLS_KX_SRP_RSA;
-        if (strcasecmp(info.kx[i], "RSA") == 0)
-           kx_priority[j++] = GNUTLS_KX_RSA;
-        if (strcasecmp(info.kx[i], "RSA-EXPORT") == 0)
-           kx_priority[j++] = GNUTLS_KX_RSA_EXPORT;
-        if (strncasecmp(info.kx[i], "DHE-RSA", 7) == 0)
-           kx_priority[j++] = GNUTLS_KX_DHE_RSA;
-        if (strncasecmp(info.kx[i], "DHE-DSS", 7) == 0)
-           kx_priority[j++] = GNUTLS_KX_DHE_DSS;
-        if (strncasecmp(info.kx[i], "ANON", 4) == 0)
-           kx_priority[j++] = GNUTLS_KX_ANON_DH;
-      }
-      kx_priority[j] = 0;
-   }
-
-   if (info.comp != NULL && info.ncomp > 0) {
-      for (j = i = 0; i < info.ncomp; i++) {
-        if (strncasecmp(info.comp[i], "NUL", 3) == 0)
-           comp_priority[j++] = GNUTLS_COMP_NULL;
-        if (strncasecmp(info.comp[i], "ZLI", 3) == 0)
-           comp_priority[j++] = GNUTLS_COMP_ZLIB;
-        if (strncasecmp(info.comp[i], "LZO", 3) == 0)
-           comp_priority[j++] = GNUTLS_COMP_LZO;
-      }
-      comp_priority[j] = 0;
-   }
+   parse_protocols( info.proto, info.nproto, protocol_priority);
+   parse_ciphers( info.ciphers, info.nciphers, cipher_priority);
+   parse_macs( info.macs, info.nmacs, mac_priority);
+   parse_ctypes( info.ctype, info.nctype, cert_type_priority);
+   parse_kx( info.kx, info.nkx, kx_priority);
+   parse_comp( info.comp, info.ncomp, comp_priority);
 }
 
 void serv_version(void) {