* Version 2.1.7 (unreleased)
+** Updated gnutls_set_default_priority2() now renamed to
+gnutls_set_priority() which now accepts a string to indicate
+preferences of ciphersuite parameters.
+
+** gnutls-cli and gnutls-serv now have a --priority option to set
+the priority string.
+
** Internal copy of OpenCDK upgraded to version 0.6.6.
** API and ABI modifications:
-No changes since last version.
+gnutls_set_default_priority2: RENAMED to gnutls_set_priority()
* Version 2.1.6 (released 2007-11-15)
# Interfaces changed/added/removed: CURRENT++ REVISION=0
# Interfaces added: AGE++
# Interfaces removed: AGE=0
-AC_SUBST(LT_CURRENT, 25)
-AC_SUBST(LT_REVISION, 2)
+AC_SUBST(LT_CURRENT, 26)
+AC_SUBST(LT_REVISION, 0)
AC_SUBST(LT_AGE, 0)
ac_full=1
gnutls_init (&session, GNUTLS_CLIENT);
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_PERFORMANCE);
+ gnutls_set_priority (session, "PERFORMANCE", NULL, 0);
gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
char buffer[MAX_BUF + 1];
gnutls_srp_client_credentials_t srp_cred;
gnutls_certificate_credentials_t cert_cred;
- int kx_priorities[MAX_PRIORITIES];
gnutls_global_init ();
*/
gnutls_global_init_extra ();
- gnutls_kx_convert_priority( kx_priorities, MAX_PRIORITIES,
- "SRP, SRP-RSA, SRP-DSS", ',');
-
gnutls_srp_allocate_client_credentials (&srp_cred);
gnutls_certificate_allocate_credentials (&cert_cred);
/* Set the priorities.
*/
gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_SECURITY_NORMAL);
- gnutls_kx_set_priority( session, kx_priorities);
+ gnutls_set_priority (session, "NORMAL:+SRP:+SRP-RSA:+SRP-DSS", NULL, 0);
/* put the SRP credentials to the current session
*/
gnutls_anon_client_credentials_t anoncred;
gnutls_ia_client_credentials_t iacred;
/* Need to enable anonymous KX specifically. */
- const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
gnutls_global_init ();
gnutls_init (&session, GNUTLS_CLIENT);
/* Use default priorities */
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_SECURITY_NORMAL);
- gnutls_kx_set_priority (session, kx_prio);
+ gnutls_set_priority (session, "NORMAL:+ANON-DH", NULL, 0);
/* put the anonymous and TLS/IA credentials to the current session
*/
char buffer[MAX_BUF + 1];
gnutls_anon_client_credentials_t anoncred;
/* Need to enable anonymous KX specifically. */
- const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
gnutls_global_init ();
gnutls_init (&session, GNUTLS_CLIENT);
/* Use default priorities */
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_PERFORMANCE);
- gnutls_kx_set_priority (session, kx_prio);
+ gnutls_set_priority (session, "PERFORMANCE:+ANON-DH:!ARCFOUR-128", NULL, 0);
/* put the anonymous credentials to the current session
*/
int ret, sd, ii;
gnutls_session_t session;
char buffer[MAX_BUF + 1];
+ char err[128];
gnutls_certificate_credentials_t xcred;
gnutls_global_init ();
gnutls_init (&session, GNUTLS_CLIENT);
/* Use default priorities */
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_PERFORMANCE);
+ ret = gnutls_set_priority (session, "PERFORMANCE", err, sizeof(err));
+ if (ret < 0) {
+ if (ret == GNUTLS_E_INVALID_REQUEST) {
+ fprintf(stderr, "%s\n", err);
+ }
+ exit(1);
+ }
/* put the x509 credentials to the current session
*/
initialize_tls_session (void)
{
gnutls_session_t session;
- const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
gnutls_init (&session, GNUTLS_SERVER);
/* avoid calling all the priority functions, since the defaults
* are adequate.
*/
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_SECURITY_NORMAL);
- gnutls_kx_set_priority (session, kx_prio);
+ gnutls_set_priority (session, "NORMAL:+ANON-DH", NULL, 0);
gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
/* Use the default priorities, plus, export cipher suites.
*/
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_EXPORT);
+ gnutls_set_priority( session, "EXPORT", NULL, 0);
gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, cert_cred);
/* avoid calling all the priority functions, since the defaults
* are adequate.
*/
- gnutls_set_default_priority (session);
-
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_SECURITY_NORMAL);
+ gnutls_set_priority(session, "NORMAL", NULL, 0);
/* request client certificate if any.
*/
initialize_tls_session (void)
{
gnutls_session_t session;
- const int kx_priority[] = { GNUTLS_KX_SRP, GNUTLS_KX_SRP_DSS,
- GNUTLS_KX_SRP_RSA, 0
- };
gnutls_init (&session, GNUTLS_SERVER);
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_SECURITY_NORMAL);
- gnutls_kx_set_priority (session, kx_priority);
+ gnutls_set_priority (session, "NORMAL:+SRP:+SRP-DSS:+SRP-RSA", NULL, 0);
gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred);
/* for the certificate authenticated ciphersuites.
/* avoid calling all the priority functions, since the defaults
* are adequate. Depending on the needs it could also be
- * GNUTLS_PRIORITIES_PERFORMANCE.
+ * "PERFORMANCE".
*/
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_SECURITY_NORMAL);
+ gnutls_set_priority (session, "NORMAL", NULL, 0);
gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
To set the priority of protocol versions (e.g., @acronym{SSL} 3.0,
@acronym{TLS} 1.0).
-@item @ref{gnutls_set_default_priority2}:
-To set some defaults in the current session. That way you don't have
-to call each priority function, independently, but you have to live
-with the defaults.
+@item @ref{gnutls_set_priority}:
+To set some defaults in the current session. That way you don't have
+to call each priority function, independently.
@item @ref{gnutls_credentials_set}:
To set the appropriate credentials structures.
#endif
#define gnutls_set_default_priority(x) \
- (gnutls_set_default_priority2 (x, GNUTLS_PRIORITIES_SECURITY_NORMAL), \
+ (gnutls_set_default_priority2 (x, "NORMAL", NULL, 0), \
GNUTLS_E_SUCCESS)
#define gnutls_set_default_export_priority(x) \
- (gnutls_set_default_priority2( x, GNUTLS_PRIORITIES_EXPORT), \
+ (gnutls_set_default_priority2( x, "EXPORT", NULL, 0), \
GNUTLS_E_SUCCESS)
#define gnutls_cipher_algorithm gnutls_cipher_algorithm_t
GNUTLS_CLIENT
} gnutls_connection_end_t;
- typedef enum
- {
- GNUTLS_PRIORITIES_EXPORT,
- GNUTLS_PRIORITIES_PERFORMANCE,
- GNUTLS_PRIORITIES_SECURITY_NORMAL,
- GNUTLS_PRIORITIES_SECURITY_HIGH
- } gnutls_priority_flag_t;
-
typedef enum
{
GNUTLS_AL_WARNING = 1,
/* if you just want some defaults, use the following.
*/
- void gnutls_set_default_priority2 (gnutls_session_t session,
- gnutls_priority_flag_t flag);
+ int gnutls_set_priority(gnutls_session_t session, const char *priority, char* syntax_error, size_t syntax_error_size);
/* Returns the name of a cipher suite */
const char *gnutls_cipher_suite_get_name (gnutls_kx_algorithm_t
gnutls_rsa_params_t params;
};
-typedef gnutls_priority_flag_t priority_flag;
-
class session
{
protected:
/* if you just want some defaults, use the following.
*/
- void set_default_priority (priority_flag flag);
+ void set_default_priority (const char* prio);
gnutls_protocol_t get_protocol_version() const;
int _gnutls_compression_priority (gnutls_session_t session,
gnutls_compression_method_t algorithm);
+gnutls_mac_algorithm_t gnutls_mac_get_id (const char* name);
+gnutls_cipher_algorithm_t gnutls_cipher_get_id (const char* name);
+gnutls_kx_algorithm_t gnutls_kx_get_id (const char* name);
+gnutls_protocol_t gnutls_protocol_get_id (const char* name);
+gnutls_certificate_type_t gnutls_certificate_type_get_id (const char* name);
+
#endif
#include "gnutls_errors.h"
#include <gnutls_num.h>
+static void
+break_comma_list (char *etag,
+ char **broken_etag, int *elements, int max_elements,
+ char sep);
+
/**
* gnutls_cipher_set_priority - Sets the priority on the ciphers supported by gnutls.
* @session: is a #gnutls_session_t structure.
}
static const int protocol_priority[] = {
- /* GNUTLS_TLS1_2, -- not finalized yet! */
- GNUTLS_TLS1_1,
- GNUTLS_TLS1_0,
- GNUTLS_SSL3,
- 0
+ /* GNUTLS_TLS1_2, -- not finalized yet! */
+ GNUTLS_TLS1_1,
+ GNUTLS_TLS1_0,
+ GNUTLS_SSL3,
+ 0
};
static const int kx_priority_performance[] = {
static const int cipher_priority_security_normal[] = {
GNUTLS_CIPHER_AES_128_CBC,
#ifdef ENABLE_CAMELLIA
- GNUTLS_CIPHER_CAMELLIA_128_CBC,
+ GNUTLS_CIPHER_CAMELLIA_128_CBC,
#endif
GNUTLS_CIPHER_3DES_CBC,
GNUTLS_CIPHER_ARCFOUR_128,
static const int cipher_priority_security_high[] = {
GNUTLS_CIPHER_AES_256_CBC,
#ifdef ENABLE_CAMELLIA
- GNUTLS_CIPHER_CAMELLIA_256_CBC,
+ GNUTLS_CIPHER_CAMELLIA_256_CBC,
#endif
GNUTLS_CIPHER_AES_128_CBC,
#ifdef ENABLE_CAMELLIA
- GNUTLS_CIPHER_CAMELLIA_128_CBC,
+ GNUTLS_CIPHER_CAMELLIA_128_CBC,
#endif
GNUTLS_CIPHER_3DES_CBC,
GNUTLS_CIPHER_ARCFOUR_128,
static int cert_type_priority[] = {
GNUTLS_CRT_X509,
- GNUTLS_CRT_OPENPGP,
0
};
+typedef void (rmadd_func)(priority_st* priority_list, int alg);
+
+static void
+prio_remove (priority_st* priority_list, int algo)
+{
+ int i = 0;
+ int pos = -1; /* the position of the cipher to remove */
+
+ while (priority_list->priority[i] != 0)
+ {
+ if (priority_list->priority[i] == algo)
+ pos = i;
+ i++;
+ }
+
+ if (pos >= 0)
+ {
+ priority_list->priority[pos] =
+ priority_list->priority[i - 1];
+ priority_list->priority[i - 1] = 0;
+ priority_list->algorithms--;
+ }
+
+ return;
+}
+
+static void
+prio_add (priority_st* priority_list, int algo)
+{
+ register int i = 0;
+ while (priority_list->priority[i] != 0) {
+ if (algo == priority_list->priority[i]) return; /* if it exists */
+ i++;
+ }
+
+ if (i < MAX_ALGOS) {
+ priority_list->priority[i] = algo;
+ priority_list->algorithms++;
+ }
+
+ return;
+}
+
+#define MAX_ELEMENTS 48
/**
- * gnutls_set_default_priority2 - Sets some default priority on the cipher suites supported by gnutls.
+ * gnutls_set_priority - Sets some default priority on the cipher suites supported by gnutls.
* @session: is a #gnutls_session_t structure.
+ * @priority: is a string describing priorities
+ * @syntax_error: In case of an error an error string will be copied there.
+ * @syntax_error_size: the length of the previous string.
*
* Sets some default priority on the ciphers, key exchange methods,
* macs and compression methods. This is to avoid using the
* override any of the following priorities by calling the
* appropriate functions.
*
- * The default order is:
- * Protocols: TLS 1.1, TLS 1.0, and SSL3.
+ * The #priority option allows you to specify a semi-colon separated
+ * list of the cipher priorities to enable.
+ *
+ * Unless the first keyword is "NONE" the defaults are:
+ * Protocols: TLS1.1, TLS1.0, and SSL3.0.
* Compression: NULL.
- * Certificate types: X.509, OpenPGP.
+ * Certificate types: X.509.
*
- * In GNUTLS_PRIORITIES_PERFORMANCE all the "secure" ciphersuites are enabled,
+ * You can also use predefined sets of ciphersuites:
+ * "PERFORMANCE" all the "secure" ciphersuites are enabled,
* limited to 128 bit ciphers and sorted by terms of speed performance.
- * The GNUTLS_PRIORITIES_SECURITY_NORMAL flag enables all "secure" ciphersuites
+ *
+ * "NORMAL" option enables all "secure" ciphersuites
* limited to 128 bit ciphers and sorted by security margin.
- * The GNUTLS_PRIORITIES_SECURITY_HIGH flag enables all "secure" ciphersuites
+ *
+ * "HIGH" flag enables all "secure" ciphersuites
* including 256 bit ciphers and sorted by security margin.
- * In GNUTLS_PRIORITIES_EXPORT all the ciphersuites are enabled, including
+ *
+ * "EXPORT" all the ciphersuites are enabled, including
* the low-security 40 bit ciphers.
*
- * For key exchange algorithms when in SECURITY_NORMAL or SECURITY_HIGH levels
+ * "NONE" nothing is enabled. This disables even protocols and compression
+ * methods.
+ *
+ * Special keywords:
+ * '!' or '-' appended with an algorithm will remove this algorithm.
+ * '+' appended with an algorithm will add this algorithm.
+ * '%COMPAT' will enable compatibility features for a server.
+ *
+ * To avoid collisions in order to specify a compression algorithm
+ * in this string you have to prefix it with "COMP-", protocol versions with
+ * "VERS-" and certificate types with "CTYPE-". All other algorithms don't need
+ * a prefix.
+ *
+ * For key exchange algorithms when in NORMAL or HIGH levels
* the perfect forward secrecy algorithms take precendence of the other protocols.
* In all cases all the supported key exchange algorithms are enabled (except for the
* RSA-EXPORT which is only enabled in EXPORT level).
* to actually increase security the public key algorithms have to use longer key
* sizes as well.
*
- * Returns 0 on success.
+ * Examples: "NORMAL:!AES-128-CBC", "EXPORT:!VERS-TLS1.0:+COMP-DEFLATE:+CTYPE-OPENPGP",
+ * "+AES-128-CBC:+RSA:+SHA1", "NORMAL".
+ *
+ * On syntax error GNUTLS_E_INVALID_REQUEST is returned and 0 on success.
*
**/
-void
-gnutls_set_default_priority2 (gnutls_session_t session, gnutls_priority_flag_t flag)
+int
+gnutls_set_priority(gnutls_session_t session, const char *priority,
+ char *syntax_error, size_t syntax_error_size)
{
+ char *broken_list[MAX_ELEMENTS];
+ int broken_list_size, i, j;
+ char *darg;
+ int ret, algo;
+ rmadd_func* fn;
- if (flag == GNUTLS_PRIORITIES_PERFORMANCE) {
- gnutls_cipher_set_priority (session, cipher_priority_performance);
- gnutls_kx_set_priority (session, kx_priority_performance);
- gnutls_mac_set_priority (session, mac_priority_performance);
- } else if (flag == GNUTLS_PRIORITIES_SECURITY_NORMAL) {
- gnutls_cipher_set_priority (session, cipher_priority_security_normal);
- gnutls_kx_set_priority (session, kx_priority_security);
- gnutls_mac_set_priority (session, mac_priority_security);
- } else if (flag == GNUTLS_PRIORITIES_SECURITY_HIGH) {
- gnutls_cipher_set_priority (session, cipher_priority_security_high);
- gnutls_kx_set_priority (session, kx_priority_security);
- gnutls_mac_set_priority (session, mac_priority_security);
- } else if (flag == GNUTLS_PRIORITIES_EXPORT) {
- gnutls_cipher_set_priority (session, cipher_priority_export);
- gnutls_kx_set_priority (session, kx_priority_export);
- gnutls_mac_set_priority (session, mac_priority_export);
- }
+ if (priority == NULL)
+ priority = "NORMAL";
+
+ darg = gnutls_strdup (priority);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
+ return GNUTLS_E_MEMORY_ERROR;
+ }
- gnutls_protocol_set_priority (session, protocol_priority);
- gnutls_compression_set_priority (session, comp_priority);
- gnutls_certificate_type_set_priority (session, cert_type_priority);
+ break_comma_list (darg, broken_list, &broken_list_size, MAX_ELEMENTS, ':');
+
+ /* This is our default set of protocol version, certificate types and
+ * compression methods.
+ */
+ if (strcasecmp (broken_list[0], "NONE") != 0)
+ {
+ gnutls_protocol_set_priority (session, protocol_priority);
+ gnutls_compression_set_priority (session, comp_priority);
+ gnutls_certificate_type_set_priority (session, cert_type_priority);
+ }
+
+ for (i = 0; i < broken_list_size; i++)
+ {
+ if (strcasecmp (broken_list[i], "PERFORMANCE") == 0)
+ {
+ gnutls_cipher_set_priority (session, cipher_priority_performance);
+ gnutls_kx_set_priority (session, kx_priority_performance);
+ gnutls_mac_set_priority (session, mac_priority_performance);
+ }
+ else if (strcasecmp (broken_list[i], "NORMAL") == 0)
+ {
+ gnutls_cipher_set_priority (session,
+ cipher_priority_security_normal);
+ gnutls_kx_set_priority (session, kx_priority_security);
+ gnutls_mac_set_priority (session, mac_priority_security);
+ }
+ else if (strcasecmp (broken_list[i], "HIGH") == 0)
+ {
+ gnutls_cipher_set_priority (session, cipher_priority_security_high);
+ gnutls_kx_set_priority (session, kx_priority_security);
+ gnutls_mac_set_priority (session, mac_priority_security);
+ }
+ else if (strcasecmp (broken_list[i], "EXPORT") == 0)
+ {
+ gnutls_cipher_set_priority (session, cipher_priority_export);
+ gnutls_kx_set_priority (session, kx_priority_export);
+ gnutls_mac_set_priority (session, mac_priority_export);
+ } /* now check if the element is something like -ALGO */
+ else if (broken_list[i][0] == '!' || broken_list[i][0] == '+' || broken_list[i][0] == '-')
+ {
+ if (broken_list[i][0] == '+') fn = prio_add;
+ else fn = prio_remove;
+
+ if ((algo =
+ gnutls_mac_get_id (&broken_list[i][1])) != GNUTLS_MAC_UNKNOWN)
+ fn(&session->internals.mac_algorithm_priority, algo);
+ else if ((algo = gnutls_cipher_get_id (&broken_list[i][1])) !=
+ GNUTLS_CIPHER_UNKNOWN)
+ fn (&session->internals.cipher_algorithm_priority, algo);
+ else if ((algo = gnutls_kx_get_id (&broken_list[i][1])) !=
+ GNUTLS_KX_UNKNOWN)
+ fn(&session->internals.kx_algorithm_priority, algo);
+ else if (strncasecmp (&broken_list[i][1], "VERS-", 5) == 0)
+ {
+ if ((algo =
+ gnutls_protocol_get_id (&broken_list[i][6])) !=
+ GNUTLS_VERSION_UNKNOWN)
+ fn(&session->internals.protocol_priority, algo);
+ } /* now check if the element is something like -ALGO */
+ else if (strncasecmp (&broken_list[i][1], "COMP-", 5) == 0)
+ {
+ if ((algo =
+ gnutls_compression_get_id (&broken_list[i][6])) !=
+ GNUTLS_COMP_UNKNOWN)
+ fn(&session->internals.compression_method_priority, algo);
+ } /* now check if the element is something like -ALGO */
+ else if (strncasecmp (&broken_list[i][1], "CTYPE-", 6) == 0)
+ {
+ if ((algo =
+ gnutls_certificate_type_get_id (&broken_list[i][7])) !=
+ GNUTLS_CRT_UNKNOWN)
+ fn(&session->internals.cert_type_priority, algo);
+ } /* now check if the element is something like -ALGO */
+ else
+ goto error;
+ }
+ else if (broken_list[i][0] == '%')
+ {
+ if (strcasecmp (&broken_list[i][1], "COMPAT") == 0)
+ gnutls_session_enable_compatibility_mode (session);
+ else
+ goto error;
+ }
+ else
+ goto error;
+ }
+
+ gnutls_free (darg);
+ return 0;
+
+error:
+ gnutls_free (darg);
+ if (syntax_error != NULL)
+ snprintf (syntax_error, syntax_error_size, "Unknown element: %s",
+ broken_list[i]);
+ return GNUTLS_E_INVALID_REQUEST;
- return;
}
/* New priority API with strings
/* Breaks a list of "xxx", "yyy", to a character array, of
* MAX_COMMA_SEP_ELEMENTS size; Note that the given string is modified.
*/
-static void break_comma_list(char *etag,
- char **broken_etag, int* elements, int max_elements,
- char sep)
+static void
+break_comma_list (char *etag,
+ char **broken_etag, int *elements, int max_elements,
+ char sep)
{
- char *p = etag;
- if (sep == 0) sep = ',';
+ char *p = etag;
+ if (sep == 0)
+ sep = ',';
- *elements = 0;
+ *elements = 0;
- do {
- broken_etag[*elements] = p;
+ do
+ {
+ broken_etag[*elements] = p;
- (*elements)++;
+ (*elements)++;
- p = strchr(p, sep);
- if (p) {
- *p = 0;
- p++; /* move to next entry and skip white
+ p = strchr (p, sep);
+ if (p)
+ {
+ *p = 0;
+ p++; /* move to next entry and skip white
* space.
*/
- while (*p == ' ')
- p++;
+ while (*p == ' ')
+ p++;
}
- } while (p != NULL && *elements < max_elements);
+ }
+ while (p != NULL && *elements < max_elements);
}
#if defined(__STDC_VERSION__) && __STD_VERSION__ > 199901L
*
**/
int
-gnutls_mac_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep)
+gnutls_mac_convert_priority (int *out_priority, int out_priority_len,
+ const char *prio, char sep)
{
- char *broken_list[_GNUTLS_MAX_PRIO];
- int broken_list_size, i, j;
- char* darg;
- int ret;
-
- _GNUTLS_MAX_PRIO_CHECK(out_priority_len);
-
- darg = gnutls_strdup( prio);
- if (darg == NULL) {
- gnutls_assert();
+ char *broken_list[_GNUTLS_MAX_PRIO];
+ int broken_list_size, i, j;
+ char *darg;
+ int ret;
+
+ _GNUTLS_MAX_PRIO_CHECK (out_priority_len);
+
+ darg = gnutls_strdup (prio);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
return GNUTLS_E_MEMORY_ERROR;
}
- break_comma_list(darg, broken_list, &broken_list_size, out_priority_len-1, sep);
+ break_comma_list (darg, broken_list, &broken_list_size,
+ out_priority_len - 1, sep);
- j = 0;
- for (i=0;i<broken_list_size;i++) {
- ret = gnutls_mac_get_id( broken_list[i]);
- if (ret != GNUTLS_MAC_UNKNOWN) {
- out_priority[j++] = ret;
- continue;
- }
-
- _gnutls_debug_log( "MAC algorithm %s is not known\n", broken_list[i]);
+ j = 0;
+ for (i = 0; i < broken_list_size; i++)
+ {
+ ret = gnutls_mac_get_id (broken_list[i]);
+ if (ret != GNUTLS_MAC_UNKNOWN)
+ {
+ out_priority[j++] = ret;
+ continue;
+ }
- gnutls_free(darg);
- return GNUTLS_E_UNKNOWN_ALGORITHM;
+ _gnutls_debug_log ("MAC algorithm %s is not known\n", broken_list[i]);
+
+ gnutls_free (darg);
+ return GNUTLS_E_UNKNOWN_ALGORITHM;
}
- out_priority[j] = 0;
+ out_priority[j] = 0;
- gnutls_free(darg);
- return 0;
+ gnutls_free (darg);
+ return 0;
}
/**
*
**/
int
-gnutls_certificate_type_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep)
+gnutls_certificate_type_convert_priority (int *out_priority,
+ int out_priority_len,
+ const char *prio, char sep)
{
- char *broken_list[_GNUTLS_MAX_PRIO];
- int broken_list_size, i, j, ret;
- char* darg;
-
- _GNUTLS_MAX_PRIO_CHECK(out_priority_len);
-
- darg = gnutls_strdup( prio);
- if (darg == NULL) {
- gnutls_assert();
+ char *broken_list[_GNUTLS_MAX_PRIO];
+ int broken_list_size, i, j, ret;
+ char *darg;
+
+ _GNUTLS_MAX_PRIO_CHECK (out_priority_len);
+
+ darg = gnutls_strdup (prio);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
return GNUTLS_E_MEMORY_ERROR;
}
- break_comma_list(darg, broken_list, &broken_list_size, out_priority_len-1, sep);
-
- j = 0;
- for (i=0;i<broken_list_size;i++) {
- ret = gnutls_certificate_type_get_id( broken_list[i]);
- if (ret != GNUTLS_CRT_UNKNOWN) {
- out_priority[j++] = ret;
- continue;
- }
-
- _gnutls_debug_log("Certificate type %s is not known\n", broken_list[i]);
- gnutls_free(darg);
- return GNUTLS_E_UNKNOWN_ALGORITHM;
+ break_comma_list (darg, broken_list, &broken_list_size,
+ out_priority_len - 1, sep);
+
+ j = 0;
+ for (i = 0; i < broken_list_size; i++)
+ {
+ ret = gnutls_certificate_type_get_id (broken_list[i]);
+ if (ret != GNUTLS_CRT_UNKNOWN)
+ {
+ out_priority[j++] = ret;
+ continue;
+ }
+
+ _gnutls_debug_log ("Certificate type %s is not known\n",
+ broken_list[i]);
+ gnutls_free (darg);
+ return GNUTLS_E_UNKNOWN_ALGORITHM;
}
- out_priority[j] = 0;
+ out_priority[j] = 0;
- gnutls_free(darg);
- return 0;
+ gnutls_free (darg);
+ return 0;
}
/**
*
**/
int
-gnutls_compression_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep)
+gnutls_compression_convert_priority (int *out_priority, int out_priority_len,
+ const char *prio, char sep)
{
- char *broken_list[_GNUTLS_MAX_PRIO];
- int broken_list_size, i, j;
- char* darg;
- int ret;
-
- _GNUTLS_MAX_PRIO_CHECK(out_priority_len);
-
- darg = gnutls_strdup( prio);
- if (darg == NULL) {
- gnutls_assert();
+ char *broken_list[_GNUTLS_MAX_PRIO];
+ int broken_list_size, i, j;
+ char *darg;
+ int ret;
+
+ _GNUTLS_MAX_PRIO_CHECK (out_priority_len);
+
+ darg = gnutls_strdup (prio);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
return GNUTLS_E_MEMORY_ERROR;
}
- break_comma_list(darg, broken_list, &broken_list_size, out_priority_len-1, sep);
+ break_comma_list (darg, broken_list, &broken_list_size,
+ out_priority_len - 1, sep);
- j = 0;
- for (i=0;i<broken_list_size;i++) {
- ret = gnutls_compression_get_id( broken_list[i]);
- if (ret != GNUTLS_COMP_UNKNOWN) {
- out_priority[j++] = ret;
- continue;
- }
+ j = 0;
+ for (i = 0; i < broken_list_size; i++)
+ {
+ ret = gnutls_compression_get_id (broken_list[i]);
+ if (ret != GNUTLS_COMP_UNKNOWN)
+ {
+ out_priority[j++] = ret;
+ continue;
+ }
- _gnutls_debug_log( "Compression algorithm %s is not known\n", broken_list[i]);
- gnutls_free(darg);
- return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+ _gnutls_debug_log ("Compression algorithm %s is not known\n",
+ broken_list[i]);
+ gnutls_free (darg);
+ return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
}
- out_priority[j] = 0;
+ out_priority[j] = 0;
- gnutls_free(darg);
- return 0;
+ gnutls_free (darg);
+ return 0;
}
/**
*
**/
int
-gnutls_protocol_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep)
+gnutls_protocol_convert_priority (int *out_priority, int out_priority_len,
+ const char *prio, char sep)
{
- char *broken_list[_GNUTLS_MAX_PRIO];
- int broken_list_size, i, j;
- char* darg;
- int ret;
-
- _GNUTLS_MAX_PRIO_CHECK(out_priority_len);
-
- darg = gnutls_strdup( prio);
- if (darg == NULL) {
- gnutls_assert();
+ char *broken_list[_GNUTLS_MAX_PRIO];
+ int broken_list_size, i, j;
+ char *darg;
+ int ret;
+
+ _GNUTLS_MAX_PRIO_CHECK (out_priority_len);
+
+ darg = gnutls_strdup (prio);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
return GNUTLS_E_MEMORY_ERROR;
}
- break_comma_list(darg, broken_list, &broken_list_size, out_priority_len-1, sep);
-
- j = 0;
- for (i=0;i<broken_list_size;i++) {
- ret = gnutls_compression_get_id( broken_list[i]);
- if (ret != GNUTLS_VERSION_UNKNOWN) {
- out_priority[j++] = ret;
- continue;
- }
-
- _gnutls_debug_log( "Protocol %s is not known\n", broken_list[i]);
- gnutls_free(darg);
- return GNUTLS_E_UNKNOWN_ALGORITHM;
+ break_comma_list (darg, broken_list, &broken_list_size,
+ out_priority_len - 1, sep);
+
+ j = 0;
+ for (i = 0; i < broken_list_size; i++)
+ {
+ ret = gnutls_compression_get_id (broken_list[i]);
+ if (ret != GNUTLS_VERSION_UNKNOWN)
+ {
+ out_priority[j++] = ret;
+ continue;
+ }
+
+ _gnutls_debug_log ("Protocol %s is not known\n", broken_list[i]);
+ gnutls_free (darg);
+ return GNUTLS_E_UNKNOWN_ALGORITHM;
}
- out_priority[j] = 0;
+ out_priority[j] = 0;
- gnutls_free(darg);
- return 0;
+ gnutls_free (darg);
+ return 0;
}
/**
*
**/
int
-gnutls_kx_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep)
+gnutls_kx_convert_priority (int *out_priority, int out_priority_len,
+ const char *prio, char sep)
{
- char *broken_list[_GNUTLS_MAX_PRIO];
- int broken_list_size, i, j;
- char* darg;
- int ret;
-
- _GNUTLS_MAX_PRIO_CHECK(out_priority_len);
-
- darg = gnutls_strdup( prio);
- if (darg == NULL) {
- gnutls_assert();
+ char *broken_list[_GNUTLS_MAX_PRIO];
+ int broken_list_size, i, j;
+ char *darg;
+ int ret;
+
+ _GNUTLS_MAX_PRIO_CHECK (out_priority_len);
+
+ darg = gnutls_strdup (prio);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
return GNUTLS_E_MEMORY_ERROR;
}
- break_comma_list(darg, broken_list, &broken_list_size, out_priority_len-1, sep);
+ break_comma_list (darg, broken_list, &broken_list_size,
+ out_priority_len - 1, sep);
- j = 0;
- for (i=0;i<broken_list_size;i++) {
- ret = gnutls_kx_get_id( broken_list[i]);
- if (ret != GNUTLS_KX_UNKNOWN) {
- out_priority[j++] = ret;
- continue;
- }
+ j = 0;
+ for (i = 0; i < broken_list_size; i++)
+ {
+ ret = gnutls_kx_get_id (broken_list[i]);
+ if (ret != GNUTLS_KX_UNKNOWN)
+ {
+ out_priority[j++] = ret;
+ continue;
+ }
- _gnutls_debug_log( "Key exchange algorithm %s is not known\n", broken_list[i]);
- gnutls_free(darg);
- return GNUTLS_E_UNKNOWN_ALGORITHM;
+ _gnutls_debug_log ("Key exchange algorithm %s is not known\n",
+ broken_list[i]);
+ gnutls_free (darg);
+ return GNUTLS_E_UNKNOWN_ALGORITHM;
}
- out_priority[j] = 0;
+ out_priority[j] = 0;
- gnutls_free(darg);
- return 0;
+ gnutls_free (darg);
+ return 0;
}
/**
*
**/
int
-gnutls_cipher_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep)
+gnutls_cipher_convert_priority (int *out_priority, int out_priority_len,
+ const char *prio, char sep)
{
- char *broken_list[_GNUTLS_MAX_PRIO];
- int broken_list_size, i, j;
- char* darg;
- int ret;
-
- _GNUTLS_MAX_PRIO_CHECK(out_priority_len);
-
- darg = gnutls_strdup( prio);
- if (darg == NULL) {
- gnutls_assert();
+ char *broken_list[_GNUTLS_MAX_PRIO];
+ int broken_list_size, i, j;
+ char *darg;
+ int ret;
+
+ _GNUTLS_MAX_PRIO_CHECK (out_priority_len);
+
+ darg = gnutls_strdup (prio);
+ if (darg == NULL)
+ {
+ gnutls_assert ();
return GNUTLS_E_MEMORY_ERROR;
}
- break_comma_list(darg, broken_list, &broken_list_size, out_priority_len-1, sep);
+ break_comma_list (darg, broken_list, &broken_list_size,
+ out_priority_len - 1, sep);
- j = 0;
- for (i=0;i<broken_list_size;i++) {
- ret = gnutls_cipher_get_id( broken_list[i]);
- if (ret != GNUTLS_CIPHER_UNKNOWN) {
- out_priority[j++] = ret;
- continue;
- }
+ j = 0;
+ for (i = 0; i < broken_list_size; i++)
+ {
+ ret = gnutls_cipher_get_id (broken_list[i]);
+ if (ret != GNUTLS_CIPHER_UNKNOWN)
+ {
+ out_priority[j++] = ret;
+ continue;
+ }
- _gnutls_debug_log( "Cipher %s is not known\n", broken_list[i]);
- gnutls_free(darg);
- return GNUTLS_E_UNKNOWN_ALGORITHM;
+ _gnutls_debug_log ("Cipher %s is not known\n", broken_list[i]);
+ gnutls_free (darg);
+ return GNUTLS_E_UNKNOWN_ALGORITHM;
}
- out_priority[j] = 0;
+ out_priority[j] = 0;
- gnutls_free(darg);
- return 0;
+ gnutls_free (darg);
+ return 0;
}
/* if you just want some defaults, use the following.
*/
-void session::set_default_priority(priority_flag flag)
+void session::set_default_priority(const char* prio)
{
- gnutls_set_default_priority2( this->s, flag);
+ gnutls_set_default_priority2( this->s, prio, NULL, 0);
}
gnutls_protocol_t session::get_protocol_version() const
__gaa_helpsingle(0, "macs", "mac1 mac2... ", "MACs to enable.");
__gaa_helpsingle(0, "kx", "kx1 kx2... ", "Key exchange methods to enable.");
__gaa_helpsingle(0, "ctypes", "certType1 certType2... ", "Certificate types to enable.");
+ __gaa_helpsingle(0, "priority", "PRIORITY STRING ", "Priorities string.");
__gaa_helpsingle(0, "x509cafile", "FILE ", "Certificate file to use.");
__gaa_helpsingle(0, "x509crlfile", "FILE ", "CRL file to use.");
__gaa_helpsingle(0, "pgpkeyfile", "FILE ", "PGP Key file to use.");
struct _gaainfo
{
-#line 116 "cli.gaa"
+#line 119 "cli.gaa"
char *rest_args;
-#line 107 "cli.gaa"
+#line 110 "cli.gaa"
int insecure;
-#line 104 "cli.gaa"
+#line 107 "cli.gaa"
char *port;
-#line 101 "cli.gaa"
+#line 104 "cli.gaa"
char *opaque_prf_input;
-#line 98 "cli.gaa"
+#line 101 "cli.gaa"
char *psk_key;
-#line 95 "cli.gaa"
+#line 98 "cli.gaa"
char *psk_username;
-#line 92 "cli.gaa"
+#line 95 "cli.gaa"
char *srp_passwd;
-#line 89 "cli.gaa"
+#line 92 "cli.gaa"
char *srp_username;
-#line 86 "cli.gaa"
+#line 89 "cli.gaa"
char *x509_certfile;
-#line 83 "cli.gaa"
+#line 86 "cli.gaa"
char *x509_keyfile;
-#line 80 "cli.gaa"
+#line 83 "cli.gaa"
char *pgp_certfile;
-#line 77 "cli.gaa"
+#line 80 "cli.gaa"
char *pgp_keyring;
-#line 74 "cli.gaa"
+#line 77 "cli.gaa"
char *pgp_keyfile;
-#line 71 "cli.gaa"
+#line 74 "cli.gaa"
char *x509_crlfile;
-#line 68 "cli.gaa"
+#line 71 "cli.gaa"
char *x509_cafile;
+#line 68 "cli.gaa"
+ char *priorities;
#line 65 "cli.gaa"
char **ctype;
#line 64 "cli.gaa"
#define GAA_MULTIPLE_OPTION 3
#define GAA_REST 0
-#define GAA_NB_OPTION 34
+#define GAA_NB_OPTION 35
#define GAAOPTID_copyright 1
#define GAAOPTID_version 2
#define GAAOPTID_help 3
#define GAAOPTID_pgpkeyfile 16
#define GAAOPTID_x509crlfile 17
#define GAAOPTID_x509cafile 18
-#define GAAOPTID_ctypes 19
-#define GAAOPTID_kx 20
-#define GAAOPTID_macs 21
-#define GAAOPTID_comp 22
-#define GAAOPTID_protocols 23
-#define GAAOPTID_ciphers 24
-#define GAAOPTID_verbose 25
-#define GAAOPTID_recordsize 26
-#define GAAOPTID_print_cert 27
-#define GAAOPTID_disable_extensions 28
-#define GAAOPTID_fingerprint 29
-#define GAAOPTID_x509fmtder 30
-#define GAAOPTID_crlf 31
-#define GAAOPTID_starttls 32
-#define GAAOPTID_resume 33
-#define GAAOPTID_debug 34
+#define GAAOPTID_priority 19
+#define GAAOPTID_ctypes 20
+#define GAAOPTID_kx 21
+#define GAAOPTID_macs 22
+#define GAAOPTID_comp 23
+#define GAAOPTID_protocols 24
+#define GAAOPTID_ciphers 25
+#define GAAOPTID_verbose 26
+#define GAAOPTID_recordsize 27
+#define GAAOPTID_print_cert 28
+#define GAAOPTID_disable_extensions 29
+#define GAAOPTID_fingerprint 30
+#define GAAOPTID_x509fmtder 31
+#define GAAOPTID_crlf 32
+#define GAAOPTID_starttls 33
+#define GAAOPTID_resume 34
+#define GAAOPTID_debug 35
#line 168 "gaa.skel"
int size1;
};
+struct GAAOPTION_priority
+{
+ char* arg1;
+ int size1;
+};
+
struct GAAOPTION_ctypes
{
char** arg1;
GAA_CHECK1STR("", GAAOPTID_pgpkeyfile);
GAA_CHECK1STR("", GAAOPTID_x509crlfile);
GAA_CHECK1STR("", GAAOPTID_x509cafile);
+ GAA_CHECK1STR("", GAAOPTID_priority);
GAA_CHECK1STR("", GAAOPTID_ctypes);
GAA_CHECK1STR("", GAAOPTID_kx);
GAA_CHECK1STR("", GAAOPTID_macs);
GAA_CHECKSTR("pgpkeyfile", GAAOPTID_pgpkeyfile);
GAA_CHECKSTR("x509crlfile", GAAOPTID_x509crlfile);
GAA_CHECKSTR("x509cafile", GAAOPTID_x509cafile);
+ GAA_CHECKSTR("priority", GAAOPTID_priority);
GAA_CHECKSTR("ctypes", GAAOPTID_ctypes);
GAA_CHECKSTR("kx", GAAOPTID_kx);
GAA_CHECKSTR("macs", GAAOPTID_macs);
struct GAAOPTION_pgpkeyfile GAATMP_pgpkeyfile;
struct GAAOPTION_x509crlfile GAATMP_x509crlfile;
struct GAAOPTION_x509cafile GAATMP_x509cafile;
+ struct GAAOPTION_priority GAATMP_priority;
struct GAAOPTION_ctypes GAATMP_ctypes;
struct GAAOPTION_kx GAATMP_kx;
struct GAAOPTION_macs GAATMP_macs;
{
case GAAOPTID_copyright:
OK = 0;
-#line 114 "cli.gaa"
+#line 117 "cli.gaa"
{ print_license(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_version:
OK = 0;
-#line 113 "cli.gaa"
+#line 116 "cli.gaa"
{ cli_version(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_help:
OK = 0;
-#line 111 "cli.gaa"
+#line 114 "cli.gaa"
{ gaa_help(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_list:
OK = 0;
-#line 110 "cli.gaa"
+#line 113 "cli.gaa"
{ print_list(gaaval->verbose); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_insecure:
OK = 0;
-#line 108 "cli.gaa"
+#line 111 "cli.gaa"
{ gaaval->insecure = 1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_port.arg1, gaa_getstr, GAATMP_port.size1);
gaa_index++;
-#line 105 "cli.gaa"
+#line 108 "cli.gaa"
{ gaaval->port = GAATMP_port.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_opaque_prf_input.arg1, gaa_getstr, GAATMP_opaque_prf_input.size1);
gaa_index++;
-#line 102 "cli.gaa"
+#line 105 "cli.gaa"
{ gaaval->opaque_prf_input = GAATMP_opaque_prf_input.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_pskkey.arg1, gaa_getstr, GAATMP_pskkey.size1);
gaa_index++;
-#line 99 "cli.gaa"
+#line 102 "cli.gaa"
{ gaaval->psk_key = GAATMP_pskkey.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_pskusername.arg1, gaa_getstr, GAATMP_pskusername.size1);
gaa_index++;
-#line 96 "cli.gaa"
+#line 99 "cli.gaa"
{ gaaval->psk_username = GAATMP_pskusername.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_srppasswd.arg1, gaa_getstr, GAATMP_srppasswd.size1);
gaa_index++;
-#line 93 "cli.gaa"
+#line 96 "cli.gaa"
{ gaaval->srp_passwd = GAATMP_srppasswd.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_srpusername.arg1, gaa_getstr, GAATMP_srpusername.size1);
gaa_index++;
-#line 90 "cli.gaa"
+#line 93 "cli.gaa"
{ gaaval->srp_username = GAATMP_srpusername.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_x509certfile.arg1, gaa_getstr, GAATMP_x509certfile.size1);
gaa_index++;
-#line 87 "cli.gaa"
+#line 90 "cli.gaa"
{ gaaval->x509_certfile = GAATMP_x509certfile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_x509keyfile.arg1, gaa_getstr, GAATMP_x509keyfile.size1);
gaa_index++;
-#line 84 "cli.gaa"
+#line 87 "cli.gaa"
{ gaaval->x509_keyfile = GAATMP_x509keyfile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_pgpcertfile.arg1, gaa_getstr, GAATMP_pgpcertfile.size1);
gaa_index++;
-#line 81 "cli.gaa"
+#line 84 "cli.gaa"
{ gaaval->pgp_certfile = GAATMP_pgpcertfile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_pgpkeyring.arg1, gaa_getstr, GAATMP_pgpkeyring.size1);
gaa_index++;
-#line 78 "cli.gaa"
+#line 81 "cli.gaa"
{ gaaval->pgp_keyring = GAATMP_pgpkeyring.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_pgpkeyfile.arg1, gaa_getstr, GAATMP_pgpkeyfile.size1);
gaa_index++;
-#line 75 "cli.gaa"
+#line 78 "cli.gaa"
{ gaaval->pgp_keyfile = GAATMP_pgpkeyfile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_x509crlfile.arg1, gaa_getstr, GAATMP_x509crlfile.size1);
gaa_index++;
-#line 72 "cli.gaa"
+#line 75 "cli.gaa"
{ gaaval->x509_crlfile = GAATMP_x509crlfile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_x509cafile.arg1, gaa_getstr, GAATMP_x509cafile.size1);
gaa_index++;
-#line 69 "cli.gaa"
+#line 72 "cli.gaa"
{ gaaval->x509_cafile = GAATMP_x509cafile.arg1 ;};
+ return GAA_OK;
+ break;
+ case GAAOPTID_priority:
+ OK = 0;
+ GAA_TESTMOREARGS;
+ GAA_FILL(GAATMP_priority.arg1, gaa_getstr, GAATMP_priority.size1);
+ gaa_index++;
+#line 69 "cli.gaa"
+{ gaaval->priorities = GAATMP_priority.arg1 ;};
+
return GAA_OK;
break;
case GAAOPTID_ctypes:
GAA_TESTMOREARGS;
GAA_FILL(GAAREST_tmp.arg1, gaa_getstr, GAAREST_tmp.size1);
gaa_index++;
-#line 117 "cli.gaa"
+#line 120 "cli.gaa"
{ gaaval->rest_args = GAAREST_tmp.arg1; ;};
return GAA_OK;
if(inited == 0)
{
-#line 119 "cli.gaa"
+#line 122 "cli.gaa"
{ gaaval->resume=0; gaaval->port="443"; gaaval->rest_args=NULL; gaaval->ciphers=NULL;
gaaval->kx=NULL; gaaval->comp=NULL; gaaval->macs=NULL; gaaval->ctype=NULL; gaaval->nciphers=0;
gaaval->nkx=0; gaaval->ncomp=0; gaaval->nmacs=0; gaaval->nctype = 0; gaaval->record_size=0;
gaaval->x509_keyfile=NULL; gaaval->x509_certfile=NULL; gaaval->crlf = 0;
gaaval->srp_username=NULL; gaaval->srp_passwd=NULL; gaaval->fmtder = 0; gaaval->starttls =0;
gaaval->debug = 0; gaaval->print_cert = 0; gaaval->verbose = 0; gaaval->psk_key = NULL;
- gaaval->psk_username = NULL;
+ gaaval->psk_username = NULL; gaaval->priorities = NULL;
gaaval->opaque_prf_input = NULL; ;};
}
len++;
a = fgetc( file);
- if(a==EOF) return 0; /* a = ' '; */
+ if(a==EOF) return 0; //a = ' ';
}
len += 1;
struct _gaainfo
{
-#line 116 "cli.gaa"
+#line 119 "cli.gaa"
char *rest_args;
-#line 107 "cli.gaa"
+#line 110 "cli.gaa"
int insecure;
-#line 104 "cli.gaa"
+#line 107 "cli.gaa"
char *port;
-#line 101 "cli.gaa"
+#line 104 "cli.gaa"
char *opaque_prf_input;
-#line 98 "cli.gaa"
+#line 101 "cli.gaa"
char *psk_key;
-#line 95 "cli.gaa"
+#line 98 "cli.gaa"
char *psk_username;
-#line 92 "cli.gaa"
+#line 95 "cli.gaa"
char *srp_passwd;
-#line 89 "cli.gaa"
+#line 92 "cli.gaa"
char *srp_username;
-#line 86 "cli.gaa"
+#line 89 "cli.gaa"
char *x509_certfile;
-#line 83 "cli.gaa"
+#line 86 "cli.gaa"
char *x509_keyfile;
-#line 80 "cli.gaa"
+#line 83 "cli.gaa"
char *pgp_certfile;
-#line 77 "cli.gaa"
+#line 80 "cli.gaa"
char *pgp_keyring;
-#line 74 "cli.gaa"
+#line 77 "cli.gaa"
char *pgp_keyfile;
-#line 71 "cli.gaa"
+#line 74 "cli.gaa"
char *x509_crlfile;
-#line 68 "cli.gaa"
+#line 71 "cli.gaa"
char *x509_cafile;
+#line 68 "cli.gaa"
+ char *priorities;
#line 65 "cli.gaa"
char **ctype;
#line 64 "cli.gaa"
static gnutls_session_t
init_tls_session (const char *hostname)
{
+char err[128];
+
gnutls_session_t session;
gnutls_init (&session, GNUTLS_CLIENT);
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_PERFORMANCE);
+ if (gnutls_set_priority (session, info.priorities, err, sizeof(err)-1) < 0)
+ {
+ fprintf(stderr, "%s\n", err);
+ exit(1);
+ }
/* allow the use of private ciphersuites.
*/
if ((ret = gnutls_global_init_extra ()) < 0)
{
fprintf (stderr, "global_init_extra: %s\n", gnutls_strerror (ret));
- exit (1);
+// exit (1);
}
gaa_parser (argc, argv);
#char **ctype;
option (ctypes) *STR "certType1 certType2..." { $ctype = $1; $nctype = @1 } "Certificate types to enable."
+#char *priorities;
+option (priority) STR "PRIORITY STRING" { $priorities = $1 } "Priorities string."
+
#char *x509_cafile;
option (x509cafile) STR "FILE" { $x509_cafile = $1 } "Certificate file to use."
$x509_keyfile=NULL; $x509_certfile=NULL; $crlf = 0;
$srp_username=NULL; $srp_passwd=NULL; $fmtder = 0; $starttls =0;
$debug = 0; $print_cert = 0; $verbose = 0; $psk_key = NULL;
- $psk_username = NULL;
+ $psk_username = NULL; $priorities = NULL;
$opaque_prf_input = NULL; }
__gaa_helpsingle(0, "macs", "mac1 mac2... ", "MACs to enable.");
__gaa_helpsingle(0, "kx", "kx1 kx2... ", "Key exchange methods to enable.");
__gaa_helpsingle(0, "ctypes", "certType1 certType2... ", "Certificate types to enable.");
+ __gaa_helpsingle(0, "priority", "PRIORITY STRING ", "Priorities string.");
__gaa_helpsingle('l', "list", "", "Print a list of the supported algorithms and modes.");
__gaa_helpsingle('h', "help", "", "prints this help");
__gaa_helpsingle('v', "version", "", "prints the program's version number");
struct _gaainfo
{
+#line 106 "serv.gaa"
+ char *priorities;
#line 103 "serv.gaa"
char **ctype;
#line 102 "serv.gaa"
#define GAA_MULTIPLE_OPTION 3
#define GAA_REST 0
-#define GAA_NB_OPTION 34
+#define GAA_NB_OPTION 35
#define GAAOPTID_copyright 1
#define GAAOPTID_version 2
#define GAAOPTID_help 3
#define GAAOPTID_list 4
-#define GAAOPTID_ctypes 5
-#define GAAOPTID_kx 6
-#define GAAOPTID_macs 7
-#define GAAOPTID_comp 8
-#define GAAOPTID_protocols 9
-#define GAAOPTID_ciphers 10
-#define GAAOPTID_opaque_prf_input 11
-#define GAAOPTID_srppasswdconf 12
-#define GAAOPTID_srppasswd 13
-#define GAAOPTID_pskpasswd 14
-#define GAAOPTID_disable_client_cert 15
-#define GAAOPTID_require_cert 16
-#define GAAOPTID_x509dsacertfile 17
-#define GAAOPTID_x509dsakeyfile 18
-#define GAAOPTID_x509certfile 19
-#define GAAOPTID_x509keyfile 20
-#define GAAOPTID_pgpcertfile 21
-#define GAAOPTID_pgpkeyfile 22
-#define GAAOPTID_pgpkeyring 23
-#define GAAOPTID_x509crlfile 24
-#define GAAOPTID_x509cafile 25
-#define GAAOPTID_x509fmtder 26
-#define GAAOPTID_dhparams 27
-#define GAAOPTID_echo 28
-#define GAAOPTID_http 29
-#define GAAOPTID_nodb 30
-#define GAAOPTID_quiet 31
-#define GAAOPTID_port 32
-#define GAAOPTID_generate 33
-#define GAAOPTID_debug 34
+#define GAAOPTID_priority 5
+#define GAAOPTID_ctypes 6
+#define GAAOPTID_kx 7
+#define GAAOPTID_macs 8
+#define GAAOPTID_comp 9
+#define GAAOPTID_protocols 10
+#define GAAOPTID_ciphers 11
+#define GAAOPTID_opaque_prf_input 12
+#define GAAOPTID_srppasswdconf 13
+#define GAAOPTID_srppasswd 14
+#define GAAOPTID_pskpasswd 15
+#define GAAOPTID_disable_client_cert 16
+#define GAAOPTID_require_cert 17
+#define GAAOPTID_x509dsacertfile 18
+#define GAAOPTID_x509dsakeyfile 19
+#define GAAOPTID_x509certfile 20
+#define GAAOPTID_x509keyfile 21
+#define GAAOPTID_pgpcertfile 22
+#define GAAOPTID_pgpkeyfile 23
+#define GAAOPTID_pgpkeyring 24
+#define GAAOPTID_x509crlfile 25
+#define GAAOPTID_x509cafile 26
+#define GAAOPTID_x509fmtder 27
+#define GAAOPTID_dhparams 28
+#define GAAOPTID_echo 29
+#define GAAOPTID_http 30
+#define GAAOPTID_nodb 31
+#define GAAOPTID_quiet 32
+#define GAAOPTID_port 33
+#define GAAOPTID_generate 34
+#define GAAOPTID_debug 35
#line 168 "gaa.skel"
}
/* option structures */
+struct GAAOPTION_priority
+{
+ char* arg1;
+ int size1;
+};
+
struct GAAOPTION_ctypes
{
char** arg1;
switch(status)
{
case GAA_LETTER_OPTION:
+ GAA_CHECK1STR("", GAAOPTID_priority);
GAA_CHECK1STR("", GAAOPTID_ctypes);
GAA_CHECK1STR("", GAAOPTID_kx);
GAA_CHECK1STR("", GAAOPTID_macs);
GAA_CHECKSTR("version", GAAOPTID_version);
GAA_CHECKSTR("help", GAAOPTID_help);
GAA_CHECKSTR("list", GAAOPTID_list);
+ GAA_CHECKSTR("priority", GAAOPTID_priority);
GAA_CHECKSTR("ctypes", GAAOPTID_ctypes);
GAA_CHECKSTR("kx", GAAOPTID_kx);
GAA_CHECKSTR("macs", GAAOPTID_macs);
{
int OK = 0;
int gaa_last_non_option;
+ struct GAAOPTION_priority GAATMP_priority;
struct GAAOPTION_ctypes GAATMP_ctypes;
struct GAAOPTION_kx GAATMP_kx;
struct GAAOPTION_macs GAATMP_macs;
{
case GAAOPTID_copyright:
OK = 0;
-#line 110 "serv.gaa"
+#line 113 "serv.gaa"
{ print_serv_license(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_version:
OK = 0;
-#line 109 "serv.gaa"
+#line 112 "serv.gaa"
{ serv_version(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_help:
OK = 0;
-#line 107 "serv.gaa"
+#line 110 "serv.gaa"
{ gaa_help(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_list:
OK = 0;
-#line 106 "serv.gaa"
+#line 109 "serv.gaa"
{ print_list(0); exit(0); ;};
+ return GAA_OK;
+ break;
+ case GAAOPTID_priority:
+ OK = 0;
+ GAA_TESTMOREARGS;
+ GAA_FILL(GAATMP_priority.arg1, gaa_getstr, GAATMP_priority.size1);
+ gaa_index++;
+#line 107 "serv.gaa"
+{ gaaval->priorities = GAATMP_priority.arg1 ;};
+
return GAA_OK;
break;
case GAAOPTID_ctypes:
if(inited == 0)
{
-#line 114 "serv.gaa"
+#line 117 "serv.gaa"
{ gaaval->generate=0; gaaval->port=5556; gaaval->http=0; gaaval->ciphers=NULL;
gaaval->kx=NULL; gaaval->comp=NULL; gaaval->macs=NULL; gaaval->ctype=NULL; gaaval->nciphers=0;
gaaval->nkx=0; gaaval->ncomp=0; gaaval->nmacs=0; gaaval->nctype = 0; gaaval->nodb = 0;
gaaval->x509_dsakeyfile=NULL; gaaval->x509_dsacertfile=NULL;
gaaval->srp_passwd=NULL; gaaval->srp_passwd_conf=NULL; gaaval->quiet = 0;
gaaval->pgp_keyring=NULL; gaaval->fmtder = 0;
- gaaval->disable_client_cert = 0;
+ gaaval->disable_client_cert = 0; gaaval->priorities = NULL;
gaaval->dh_params_file=NULL; gaaval->debug=0; gaaval->require_cert = 0; gaaval->psk_passwd = 0;
gaaval->opaque_prf_input=NULL; ;};
len++;
a = fgetc( file);
- if(a==EOF) return 0; /* a = ' '; */
+ if(a==EOF) return 0; //a = ' ';
}
len += 1;
struct _gaainfo
{
+#line 106 "serv.gaa"
+ char *priorities;
#line 103 "serv.gaa"
char **ctype;
#line 102 "serv.gaa"
initialize_session (void)
{
gnutls_session_t session;
+ char err[128];
gnutls_init (&session, GNUTLS_SERVER);
gnutls_db_set_ptr (session, NULL);
}
- gnutls_set_default_priority2 (session, GNUTLS_PRIORITIES_PERFORMANCE);
+ if (gnutls_set_priority (session, info.priorities, err, sizeof(err)-1) < 0)
+ {
+ fprintf(stderr, "%s\n", err);
+ exit(1);
+ }
if (cipher_priority[0])
gnutls_cipher_set_priority (session, cipher_priority);
#char **ctype;
option (ctypes) *STR "certType1 certType2..." { $ctype = $1; $nctype = @1 } "Certificate types to enable."
+#char *priorities;
+option (priority) STR "PRIORITY STRING" { $priorities = $1 } "Priorities string."
+
option (l, list) { print_list(0); exit(0); } "Print a list of the supported algorithms and modes."
option (h, help) { gaa_help(); exit(0); } "prints this help"
$x509_dsakeyfile=NULL; $x509_dsacertfile=NULL;
$srp_passwd=NULL; $srp_passwd_conf=NULL; $quiet = 0;
$pgp_keyring=NULL; $fmtder = 0;
- $disable_client_cert = 0;
+ $disable_client_cert = 0; $priorities = NULL;
$dh_params_file=NULL; $debug=0; $require_cert = 0; $psk_passwd = 0;
$opaque_prf_input=NULL; }
projects / thirdparty / gnutls.git / commitdiff
