From: Nikos Mavrogiannopoulos Date: Sat, 24 Nov 2007 10:58:50 +0000 (+0200) Subject: new era of priority functions. X-Git-Tag: gnutls_2_1_7~37 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=00b764c86c20adfec59f2c8a60b021a4b57b59e9;p=thirdparty%2Fgnutls.git new era of priority functions. --- diff --git a/NEWS b/NEWS index b48a74bcaf..58cbb4b12b 100644 --- a/NEWS +++ b/NEWS @@ -6,8 +6,8 @@ See the end for copying conditions. * Version 2.1.7 (unreleased) ** Updated gnutls_set_default_priority2() now renamed to -gnutls_set_priority() which now accepts a string to indicate -preferences of ciphersuite parameters. +gnutls_priority_set() and gnutls_priority_set_direct() which +accept a string to indicate preferences of ciphersuite parameters. ** gnutls-cli and gnutls-serv now have a --priority option to set the priority string. @@ -18,9 +18,11 @@ the gnutls_set_priority(). ** Internal copy of OpenCDK upgraded to version 0.6.6. ** API and ABI modifications: -gnutls_check_priority: ADDED -gnutls_set_priority: ADDED -gnutls_set_default_priority2: RENAMED to gnutls_set_priority() +gnutls_priority_init: ADDED +gnutls_priority_deinit: ADDED +gnutls_priority_set: ADDED +gnutls_priority_set_direct: ADDED +gnutls_set_default_priority2: RENAMED to gnutls_priority_set_direct() gnutls_mac_convert_priority: REMOVED gnutls_compression_convert_priority: REMOVED gnutls_protocol_convert_priority: REMOVED diff --git a/doc/examples/ex-cert-select.c b/doc/examples/ex-cert-select.c index d7607db464..a220afa57c 100644 --- a/doc/examples/ex-cert-select.c +++ b/doc/examples/ex-cert-select.c @@ -126,6 +126,7 @@ main (void) { int ret, sd, ii; gnutls_session_t session; + gnutls_priority_t priorities_cache; char buffer[MAX_BUF + 1]; gnutls_certificate_credentials_t xcred; /* Allow connections to servers that have OpenPGP keys as well. @@ -138,6 +139,10 @@ main (void) /* X509 stuff */ gnutls_certificate_allocate_credentials (&xcred); + /* priorities */ + gnutls_priority_init( &priority_cache, "NORMAL", NULL, 0); + + /* sets the trusted cas file */ gnutls_certificate_set_x509_trust_file (xcred, CAFILE, GNUTLS_X509_FMT_PEM); @@ -149,7 +154,7 @@ main (void) gnutls_init (&session, GNUTLS_CLIENT); /* Use default priorities */ - gnutls_set_priority (session, "NORMAL", NULL, 0); + gnutls_set_priority (session, priority_cache); /* put the x509 credentials to the current session */ @@ -206,6 +211,7 @@ end: gnutls_deinit (session); gnutls_certificate_free_credentials (xcred); + gnutls_priority_deinit( priority_cache); gnutls_global_deinit (); diff --git a/doc/examples/ex-client-resume.c b/doc/examples/ex-client-resume.c index 39c025e3a1..7656691679 100644 --- a/doc/examples/ex-client-resume.c +++ b/doc/examples/ex-client-resume.c @@ -54,7 +54,7 @@ main (void) gnutls_init (&session, GNUTLS_CLIENT); - gnutls_set_priority (session, "PERFORMANCE", NULL, 0); + gnutls_priority_set_direct (session, "PERFORMANCE:!ARCFOUR-128", NULL, 0); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); diff --git a/doc/examples/ex-client-srp.c b/doc/examples/ex-client-srp.c index c3454f553c..c5f9105b23 100644 --- a/doc/examples/ex-client-srp.c +++ b/doc/examples/ex-client-srp.c @@ -65,7 +65,7 @@ main (void) /* Set the priorities. */ - gnutls_set_priority (session, "NORMAL:+SRP:+SRP-RSA:+SRP-DSS", NULL, 0); + gnutls_priority_set_direct (session, "NORMAL:+SRP:+SRP-RSA:+SRP-DSS", NULL, 0); /* put the SRP credentials to the current session */ diff --git a/doc/examples/ex-client-tlsia.c b/doc/examples/ex-client-tlsia.c index fb699e69d2..63e0f3ff2f 100644 --- a/doc/examples/ex-client-tlsia.c +++ b/doc/examples/ex-client-tlsia.c @@ -78,7 +78,7 @@ main (void) gnutls_init (&session, GNUTLS_CLIENT); /* Use default priorities */ - gnutls_set_priority (session, "NORMAL:+ANON-DH", NULL, 0); + gnutls_priority_set_direct (session, "NORMAL:+ANON-DH", NULL, 0); /* put the anonymous and TLS/IA credentials to the current session */ diff --git a/doc/examples/ex-client1.c b/doc/examples/ex-client1.c index c5e4f2dfa4..9709fb0265 100644 --- a/doc/examples/ex-client1.c +++ b/doc/examples/ex-client1.c @@ -46,7 +46,7 @@ main (void) gnutls_init (&session, GNUTLS_CLIENT); /* Use default priorities */ - gnutls_set_priority (session, "PERFORMANCE:+ANON-DH:!ARCFOUR-128", NULL, 0); + gnutls_priority_set_direct (session, "PERFORMANCE:+ANON-DH:!ARCFOUR-128", NULL, 0); /* put the anonymous credentials to the current session */ diff --git a/doc/examples/ex-client2.c b/doc/examples/ex-client2.c index 51c1608c68..3d7e594b06 100644 --- a/doc/examples/ex-client2.c +++ b/doc/examples/ex-client2.c @@ -51,7 +51,7 @@ main (void) gnutls_init (&session, GNUTLS_CLIENT); /* Use default priorities */ - ret = gnutls_set_priority (session, "PERFORMANCE", err, sizeof(err)); + ret = gnutls_priority_set_direct (session, "PERFORMANCE", err, sizeof(err)); if (ret < 0) { if (ret == GNUTLS_E_INVALID_REQUEST) { fprintf(stderr, "%s\n", err); diff --git a/doc/examples/ex-serv-anon.c b/doc/examples/ex-serv-anon.c index 46eb721fa6..18a888ea4e 100644 --- a/doc/examples/ex-serv-anon.c +++ b/doc/examples/ex-serv-anon.c @@ -40,10 +40,7 @@ initialize_tls_session (void) gnutls_init (&session, GNUTLS_SERVER); - /* avoid calling all the priority functions, since the defaults - * are adequate. - */ - gnutls_set_priority (session, "NORMAL:+ANON-DH", NULL, 0); + gnutls_priority_set_direct (session, "NORMAL:+ANON-DH", NULL, 0); gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred); diff --git a/doc/examples/ex-serv-export.c b/doc/examples/ex-serv-export.c index 39713bb1dd..24f0e083a4 100644 --- a/doc/examples/ex-serv-export.c +++ b/doc/examples/ex-serv-export.c @@ -56,7 +56,7 @@ initialize_tls_session (void) /* Use the default priorities, plus, export cipher suites. */ - gnutls_set_priority( session, "EXPORT", NULL, 0); + gnutls_priority_set_direct( session, "EXPORT", NULL, 0); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, cert_cred); diff --git a/doc/examples/ex-serv-pgp.c b/doc/examples/ex-serv-pgp.c index c9b8ebf81b..a08c2ee8cd 100644 --- a/doc/examples/ex-serv-pgp.c +++ b/doc/examples/ex-serv-pgp.c @@ -63,10 +63,7 @@ initialize_tls_session (void) gnutls_init (&session, GNUTLS_SERVER); - /* avoid calling all the priority functions, since the defaults - * are adequate. - */ - gnutls_set_priority(session, "NORMAL", NULL, 0); + gnutls_priority_set_direct(session, "NORMAL", NULL, 0); /* request client certificate if any. */ diff --git a/doc/examples/ex-serv-srp.c b/doc/examples/ex-serv-srp.c index 3c58c94889..b2957785db 100644 --- a/doc/examples/ex-serv-srp.c +++ b/doc/examples/ex-serv-srp.c @@ -47,7 +47,7 @@ initialize_tls_session (void) gnutls_init (&session, GNUTLS_SERVER); - gnutls_set_priority (session, "NORMAL:+SRP:+SRP-DSS:+SRP-RSA", NULL, 0); + gnutls_priority_set_direct (session, "NORMAL:+SRP:+SRP-DSS:+SRP-RSA", NULL, 0); gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred); /* for the certificate authenticated ciphersuites. diff --git a/doc/examples/ex-serv1.c b/doc/examples/ex-serv1.c index 50ca98b10e..4e2ab0f7eb 100644 --- a/doc/examples/ex-serv1.c +++ b/doc/examples/ex-serv1.c @@ -38,6 +38,7 @@ /* These are global */ gnutls_certificate_credentials_t x509_cred; +gnutls_priority_t priority_cache; gnutls_session_t initialize_tls_session (void) @@ -46,11 +47,7 @@ initialize_tls_session (void) gnutls_init (&session, GNUTLS_SERVER); - /* avoid calling all the priority functions, since the defaults - * are adequate. Depending on the needs it could also be - * "PERFORMANCE". - */ - gnutls_set_priority (session, "NORMAL", NULL, 0); + gnutls_set_priority (session, priority_cache); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred); @@ -118,6 +115,9 @@ main (void) generate_dh_params (); + gnutls_priority_init( &priority_cache, "NORMAL", NULL, 0); + + gnutls_certificate_set_dh_params (x509_cred, dh_params); /* Socket operations @@ -201,6 +201,7 @@ main (void) close (listen_sd); gnutls_certificate_free_credentials (x509_cred); + gnutls_priority_deinit(priority_cache); gnutls_global_deinit (); diff --git a/doc/gnutls.texi b/doc/gnutls.texi index e8f70be059..288d094616 100644 --- a/doc/gnutls.texi +++ b/doc/gnutls.texi @@ -834,29 +834,17 @@ has to set up the required parameters. Available functions to control the handshake protocol include: @table @asis -@item @ref{gnutls_cipher_set_priority}: -To set the priority of bulk cipher algorithms. +@item @ref{gnutls_priority_init}: +To initialize a priority set of ciphers. -@item @ref{gnutls_mac_set_priority}: -To set the priority of MAC algorithms. +@item @ref{gnutls_priority_deinit}: +To deinitialize a priority set of ciphers. -@item @ref{gnutls_kx_set_priority}: -To set the priority of key exchange algorithms. +@item @ref{gnutls_priority_set}: +To associate a priority set with a @acronym{TLS} session. -@item @ref{gnutls_compression_set_priority}: -To set the priority of compression methods. - -@item @ref{gnutls_certificate_type_set_priority}: -To set the priority of certificate types (e.g., @acronym{OpenPGP}, -@acronym{X.509}). - -@item @ref{gnutls_protocol_set_priority}: -To set the priority of protocol versions (e.g., @acronym{SSL} 3.0, -@acronym{TLS} 1.0). - -@item @ref{gnutls_set_priority}: -To set some defaults in the current session. That way you don't have -to call each priority function, independently. +@item @ref{gnutls_priority_set_direct}: +To directly associate a session with a given priority string. @item @ref{gnutls_credentials_set}: To set the appropriate credentials structures. diff --git a/includes/gnutls/compat.h b/includes/gnutls/compat.h index edde8c1081..cf1c089dfe 100644 --- a/includes/gnutls/compat.h +++ b/includes/gnutls/compat.h @@ -20,10 +20,10 @@ #endif #define gnutls_set_default_priority(x) \ - (gnutls_set_priority (x, "NORMAL", NULL, 0), \ + (gnutls_priority_set_direct (x, "NORMAL", NULL, 0), \ GNUTLS_E_SUCCESS) #define gnutls_set_default_export_priority(x) \ - (gnutls_set_priority( x, "EXPORT", NULL, 0), \ + (gnutls_priority_set_direct ( x, "EXPORT", NULL, 0), \ GNUTLS_E_SUCCESS) #define gnutls_cipher_algorithm gnutls_cipher_algorithm_t diff --git a/includes/gnutls/gnutls.h.in b/includes/gnutls/gnutls.h.in index 17d0c11524..1a6871192a 100644 --- a/includes/gnutls/gnutls.h.in +++ b/includes/gnutls/gnutls.h.in @@ -321,6 +321,9 @@ extern "C" struct gnutls_x509_privkey_int; /* XXX ugly. */ typedef struct gnutls_x509_privkey_int *gnutls_rsa_params_t; /* XXX ugly. */ + struct gnutls_priority_st; + typedef struct gnutls_priority_st *gnutls_priority_t; + typedef struct { unsigned char *data; @@ -507,17 +510,13 @@ extern "C" int gnutls_certificate_type_set_priority (gnutls_session_t session, const int *list); - int gnutls_mac_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep); - int gnutls_compression_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep); - int gnutls_protocol_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep); - int gnutls_kx_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep); - int gnutls_cipher_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep); - int gnutls_certificate_type_convert_priority (int* out_priority, int out_priority_len, const char *prio, char sep); - /* if you just want some defaults, use the following. */ - int gnutls_set_priority(gnutls_session_t session, const char *priority, char* syntax_error, size_t syntax_error_size); - int gnutls_check_priority(const char *priority, char *syntax_error, size_t syntax_error_size); + int gnutls_priority_init( gnutls_priority_t*, const char *priority, char* syntax_error, size_t syntax_error_size); + void gnutls_priority_deinit( gnutls_priority_t); + + int gnutls_priority_set(gnutls_session_t session, gnutls_priority_t); + int gnutls_priority_set_direct(gnutls_session_t session, const char *priority, char* syntax_error, size_t syntax_error_size); /* Returns the name of a cipher suite */ const char *gnutls_cipher_suite_get_name (gnutls_kx_algorithm_t diff --git a/includes/gnutls/gnutlsxx.h b/includes/gnutls/gnutlsxx.h index a6b49e3b6d..7b2188f8ae 100644 --- a/includes/gnutls/gnutlsxx.h +++ b/includes/gnutls/gnutlsxx.h @@ -124,6 +124,7 @@ class session /* if you just want some defaults, use the following. */ void set_priority (const char* prio, char* syntax_error, size_t syntax_error_size); + void set_priority (gnutls_priority_t p); gnutls_protocol_t get_protocol_version() const; diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index 47de0543c8..541a73192b 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -385,7 +385,7 @@ typedef struct } priority_st; /* For the external api */ -typedef struct gnutls_priority_st +struct gnutls_priority_st { priority_st cipher; priority_st mac; @@ -396,7 +396,7 @@ typedef struct gnutls_priority_st /* to disable record padding */ int no_padding; -} *gnutls_priority_t; +}; /* DH and RSA parameters types. diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c index 9de12feb20..ef44818063 100644 --- a/lib/gnutls_priority.c +++ b/lib/gnutls_priority.c @@ -69,6 +69,25 @@ gnutls_cipher_set_priority (gnutls_session_t session, const int *list) return 0; } +inline static int _set_priority( priority_st* st, const int *list) +{ + int num = 0, i; + + while (list[num] != 0) + num++; + if (num > MAX_ALGOS) + num = MAX_ALGOS; + st->algorithms = num; + + for (i = 0; i < num; i++) + { + st->priority[i] = list[i]; + } + + return 0; + +} + /** * gnutls_kx_set_priority - Sets the priority on the key exchange algorithms supported by gnutls. * @session: is a #gnutls_session_t structure. @@ -87,20 +106,7 @@ gnutls_cipher_set_priority (gnutls_session_t session, const int *list) int gnutls_kx_set_priority (gnutls_session_t session, const int *list) { - int num = 0, i; - - while (list[num] != 0) - num++; - if (num > MAX_ALGOS) - num = MAX_ALGOS; - session->internals.priorities.kx.algorithms = num; - - for (i = 0; i < num; i++) - { - session->internals.priorities.kx.priority[i] = list[i]; - } - - return 0; + return _set_priority( &session->internals.priorities.kx, list); } /** @@ -121,20 +127,7 @@ gnutls_kx_set_priority (gnutls_session_t session, const int *list) int gnutls_mac_set_priority (gnutls_session_t session, const int *list) { - int num = 0, i; - - while (list[num] != 0) - num++; - if (num > MAX_ALGOS) - num = MAX_ALGOS; - session->internals.priorities.mac.algorithms = num; - - for (i = 0; i < num; i++) - { - session->internals.priorities.mac.priority[i] = list[i]; - } - - return 0; + return _set_priority( &session->internals.priorities.mac, list); } /** @@ -159,19 +152,7 @@ gnutls_mac_set_priority (gnutls_session_t session, const int *list) int gnutls_compression_set_priority (gnutls_session_t session, const int *list) { - int num = 0, i; - - while (list[num] != 0) - num++; - if (num > MAX_ALGOS) - num = MAX_ALGOS; - session->internals.priorities.compression.algorithms = num; - - for (i = 0; i < num; i++) - { - session->internals.priorities.compression.priority[i] = list[i]; - } - return 0; + return _set_priority( &session->internals.priorities.compression, list); } /** @@ -189,26 +170,17 @@ gnutls_compression_set_priority (gnutls_session_t session, const int *list) int gnutls_protocol_set_priority (gnutls_session_t session, const int *list) { - int num = 0, i; - - while (list[num] != 0) - num++; - if (num > MAX_ALGOS) - num = MAX_ALGOS; - session->internals.priorities.protocol.algorithms = num; +int ret; - for (i = 0; i < num; i++) - { - session->internals.priorities.protocol.priority[i] = list[i]; - } + ret = _set_priority( &session->internals.priorities.protocol, list); /* set the current version to the first in the chain. * This will be overridden later. */ - if (num > 0) + if (list) _gnutls_set_current_version (session, list[0]); - return 0; + return ret; } /** @@ -231,21 +203,7 @@ gnutls_certificate_type_set_priority (gnutls_session_t session, const int *list) { #ifdef ENABLE_OPENPGP - - int num = 0, i; - - while (list[num] != 0) - num++; - if (num > MAX_ALGOS) - num = MAX_ALGOS; - session->internals.priorities.cert_type.algorithms = num; - - for (i = 0; i < num; i++) - { - session->internals.priorities.cert_type.priority[i] = list[i]; - } - - return 0; + return _set_priority( &session->internals.priorities.cert_type, list); #else @@ -426,22 +384,40 @@ prio_add (priority_st* priority_list, int algo) return; } -#define MAX_ELEMENTS 48 /** - * gnutls_set_priority - Sets some default priority on the cipher suites supported by gnutls. + * gnutls_priority_set - Sets priorities for the cipher suites supported by gnutls. * @session: is a #gnutls_session_t structure. - * @priority: is a string describing priorities + * @priority: is a #gnutls_priority_t structure. + * + * Sets the priorities to use on the ciphers, key exchange methods, + * macs and compression methods. + * + * On success 0 is returned. + * + **/ +int +gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority) +{ + memcpy( &session->internals.priorities, priority, sizeof(struct gnutls_priority_st)); + return 0; +} + + +#define MAX_ELEMENTS 48 + +/** + * gnutls_priority_init - Sets priorities for the cipher suites supported by gnutls. + * @priority_cache: is a #gnutls_prioritity_t structure. + * @priorities: is a string describing priorities * @syntax_error: In case of an error an error string will be copied there. * @syntax_error_size: the length of the previous string. * - * Sets some default priority on the ciphers, key exchange methods, + * Sets priorities for the ciphers, key exchange methods, * macs and compression methods. This is to avoid using the - * gnutls_*_priority() functions, if these defaults are ok. You may - * override any of the following priorities by calling the - * appropriate functions. + * gnutls_*_priority() functions. * - * The #priority option allows you to specify a semi-colon separated + * The #priorities option allows you to specify a semi-colon separated * list of the cipher priorities to enable. * * Unless the first keyword is "NONE" the defaults are: @@ -491,7 +467,7 @@ prio_add (priority_st* priority_list, int algo) * **/ int -gnutls_set_priority(gnutls_session_t session, const char *priority, +gnutls_priority_init(gnutls_priority_t* priority_cache, const char *priorities, char *syntax_error, size_t syntax_error_size) { char *broken_list[MAX_ELEMENTS]; @@ -500,10 +476,17 @@ gnutls_set_priority(gnutls_session_t session, const char *priority, int ret, algo; rmadd_func* fn; - if (priority == NULL) - priority = "NORMAL"; + *priority_cache = gnutls_calloc( 1, sizeof(struct gnutls_priority_st)); + if (*priority_cache == NULL) + { + gnutls_assert(); + return GNUTLS_E_MEMORY_ERROR; + } + + if (priorities == NULL) + priorities = "NORMAL"; - darg = gnutls_strdup (priority); + darg = gnutls_strdup (priorities); if (darg == NULL) { gnutls_assert (); @@ -517,37 +500,37 @@ gnutls_set_priority(gnutls_session_t session, const char *priority, */ if (strcasecmp (broken_list[0], "NONE") != 0) { - gnutls_protocol_set_priority (session, protocol_priority); - gnutls_compression_set_priority (session, comp_priority); - gnutls_certificate_type_set_priority (session, cert_type_priority); + _set_priority (&(*priority_cache)->protocol, protocol_priority); + _set_priority (&(*priority_cache)->compression, comp_priority); + _set_priority (&(*priority_cache)->cert_type, cert_type_priority); } for (i = 0; i < broken_list_size; i++) { if (strcasecmp (broken_list[i], "PERFORMANCE") == 0) { - gnutls_cipher_set_priority (session, cipher_priority_performance); - gnutls_kx_set_priority (session, kx_priority_performance); - gnutls_mac_set_priority (session, mac_priority_performance); + _set_priority (&(*priority_cache)->cipher, cipher_priority_performance); + _set_priority (&(*priority_cache)->kx, kx_priority_performance); + _set_priority (&(*priority_cache)->mac, mac_priority_performance); } else if (strcasecmp (broken_list[i], "NORMAL") == 0) { - gnutls_cipher_set_priority (session, + _set_priority (&(*priority_cache)->cipher, cipher_priority_security_normal); - gnutls_kx_set_priority (session, kx_priority_security); - gnutls_mac_set_priority (session, mac_priority_security); + _set_priority (&(*priority_cache)->kx, kx_priority_security); + _set_priority (&(*priority_cache)->mac, mac_priority_security); } else if (strcasecmp (broken_list[i], "HIGH") == 0) { - gnutls_cipher_set_priority (session, cipher_priority_security_high); - gnutls_kx_set_priority (session, kx_priority_security); - gnutls_mac_set_priority (session, mac_priority_security); + _set_priority (&(*priority_cache)->cipher,cipher_priority_security_high); + _set_priority (&(*priority_cache)->kx, kx_priority_security); + _set_priority (&(*priority_cache)->mac, mac_priority_security); } else if (strcasecmp (broken_list[i], "EXPORT") == 0) { - gnutls_cipher_set_priority (session, cipher_priority_export); - gnutls_kx_set_priority (session, kx_priority_export); - gnutls_mac_set_priority (session, mac_priority_export); + _set_priority (&(*priority_cache)->cipher, cipher_priority_export); + _set_priority (&(*priority_cache)->kx, kx_priority_export); + _set_priority (&(*priority_cache)->mac, mac_priority_export); } /* now check if the element is something like -ALGO */ else if (broken_list[i][0] == '!' || broken_list[i][0] == '+' || broken_list[i][0] == '-') { @@ -556,33 +539,33 @@ gnutls_set_priority(gnutls_session_t session, const char *priority, if ((algo = gnutls_mac_get_id (&broken_list[i][1])) != GNUTLS_MAC_UNKNOWN) - fn(&session->internals.priorities.mac, algo); + fn(&(*priority_cache)->mac, algo); else if ((algo = gnutls_cipher_get_id (&broken_list[i][1])) != GNUTLS_CIPHER_UNKNOWN) - fn (&session->internals.priorities.cipher, algo); + fn (&(*priority_cache)->cipher, algo); else if ((algo = gnutls_kx_get_id (&broken_list[i][1])) != GNUTLS_KX_UNKNOWN) - fn(&session->internals.priorities.kx, algo); + fn(&(*priority_cache)->kx, algo); else if (strncasecmp (&broken_list[i][1], "VERS-", 5) == 0) { if ((algo = gnutls_protocol_get_id (&broken_list[i][6])) != GNUTLS_VERSION_UNKNOWN) - fn(&session->internals.priorities.protocol, algo); + fn(&(*priority_cache)->protocol, algo); } /* now check if the element is something like -ALGO */ else if (strncasecmp (&broken_list[i][1], "COMP-", 5) == 0) { if ((algo = gnutls_compression_get_id (&broken_list[i][6])) != GNUTLS_COMP_UNKNOWN) - fn(&session->internals.priorities.compression, algo); + fn(&(*priority_cache)->compression, algo); } /* now check if the element is something like -ALGO */ else if (strncasecmp (&broken_list[i][1], "CTYPE-", 6) == 0) { if ((algo = gnutls_certificate_type_get_id (&broken_list[i][7])) != GNUTLS_CRT_UNKNOWN) - fn(&session->internals.priorities.cert_type, algo); + fn(&(*priority_cache)->cert_type, algo); } /* now check if the element is something like -ALGO */ else goto error; @@ -590,7 +573,7 @@ gnutls_set_priority(gnutls_session_t session, const char *priority, else if (broken_list[i][0] == '%') { if (strcasecmp (&broken_list[i][1], "COMPAT") == 0) - gnutls_session_enable_compatibility_mode (session); + (*priority_cache)->no_padding = 1; else goto error; } @@ -611,33 +594,57 @@ error: } /** - * gnutls_check_priority - Checks for syntax errors the given priority string - * @priority: is a string describing priorities + * gnutls_priority_deinit - Deinitialize the priorities cache for the cipher suites supported by gnutls. + * @priority_cache: is a #gnutls_prioritity_t structure. + * + * Deinitializes the priority cache. + * + **/ +void +gnutls_priority_deinit(gnutls_priority_t priority_cache) +{ + gnutls_free( priority_cache); +} + + +/** + * gnutls_priority_set_direct - Sets priorities for the cipher suites supported by gnutls. + * @session: is a #gnutls_session_t structure. + * @priorities: is a string describing priorities * @syntax_error: In case of an error an error string will be copied there. * @syntax_error_size: the length of the previous string. * - * Checks for syntax errors the given priority string. The rules are - * described in gnutls_set_priority(). + * Sets the priorities to use on the ciphers, key exchange methods, + * macs and compression methods. This function avoids keeping a priority + * cache and is used to directly set string priorities to a TLS session. + * For documentation check the gnutls_priority_init(). * * On syntax error GNUTLS_E_INVALID_REQUEST is returned and 0 on success. * **/ int -gnutls_check_priority(const char *priority, char *syntax_error, size_t syntax_error_size) +gnutls_priority_set_direct(gnutls_session_t session, const char *priorities, + char *syntax_error, size_t syntax_error_size) { -gnutls_session t; +gnutls_priority_t prio; int ret; - gnutls_init(&t, GNUTLS_SERVER); - ret = gnutls_set_priority( t, priority, syntax_error, syntax_error_size); - gnutls_deinit(t); - - return ret; -} + ret = gnutls_priority_init( &prio, priorities, syntax_error, syntax_error_size); + if (ret < 0) { + gnutls_assert(); + return ret; + } + ret = gnutls_priority_set( session, prio); + if (ret < 0) { + gnutls_assert(); + return ret; + } -/* New priority API with strings - */ + gnutls_priority_deinit( prio); + + return 0; +} /* Breaks a list of "xxx", "yyy", to a character array, of * MAX_COMMA_SEP_ELEMENTS size; Note that the given string is modified. diff --git a/lib/gnutlsxx.cpp b/lib/gnutlsxx.cpp index 47a1f4d78b..b5e8c99da9 100644 --- a/lib/gnutlsxx.cpp +++ b/lib/gnutlsxx.cpp @@ -189,7 +189,12 @@ void session::set_certificate_type_priority (const int *list) */ void session::set_priority(const char* prio, char* syntax_error, size_t syntax_error_size) { - RETWRAP(gnutls_set_priority( this->s, prio, syntax_error, syntax_error_size)); + RETWRAP(gnutls_priority_set_direct( this->s, prio, syntax_error, syntax_error_size)); +} + +void session::set_priority(gnutls_priority_t p) +{ + RETWRAP(gnutls_priority_set( this->s, p)); } gnutls_protocol_t session::get_protocol_version() const diff --git a/src/cli.c b/src/cli.c index ef11fd62e5..83e8ef36b6 100644 --- a/src/cli.c +++ b/src/cli.c @@ -380,7 +380,7 @@ char err[128]; gnutls_init (&session, GNUTLS_CLIENT); - if (gnutls_set_priority (session, info.priorities, err, sizeof(err)-1) < 0) + if (gnutls_priority_set_direct (session, info.priorities, err, sizeof(err)-1) < 0) { fprintf(stderr, "%s\n", err); exit(1); diff --git a/src/common.c b/src/common.c index ab1a907687..1c781979b5 100644 --- a/src/common.c +++ b/src/common.c @@ -670,7 +670,7 @@ print_list (int verbose) void print_license (void) { - fputs ("\nCopyright (C) 2004 Free Software Foundation\n" + fputs ("\nCopyright (C) 2004,2005,2006,2007 Free Software Foundation\n" "This program is free software; you can redistribute it and/or modify \n" "it under the terms of the GNU General Public License as published by \n" "the Free Software Foundation; either version 2 of the License, or \n" @@ -685,13 +685,21 @@ print_license (void) stdout); } +static int depr_printed = 0; +#define DEPRECATED if (depr_printed==0) { \ + fprintf(stderr, "This method of specifying algorithms is deprecated. Please use the --priority option.\n"); \ + depr_printed = 1; \ + } + void parse_protocols (char **protocols, int protocols_size, int *protocol_priority) { int i, j; - + if (protocols != NULL && protocols_size > 0) { + DEPRECATED; + for (j = i = 0; i < protocols_size; i++) { if (strncasecmp (protocols[i], "SSL", 3) == 0) @@ -714,8 +722,10 @@ parse_ciphers (char **ciphers, int nciphers, int *cipher_priority) { int j, i; + if (ciphers != NULL && nciphers > 0) { + DEPRECATED; for (j = i = 0; i < nciphers; i++) { if (strncasecmp (ciphers[i], "AES-2", 5) == 0) @@ -747,8 +757,11 @@ void parse_macs (char **macs, int nmacs, int *mac_priority) { int i, j; + + if (macs != NULL && nmacs > 0) { + DEPRECATED; for (j = i = 0; i < nmacs; i++) { if (strncasecmp (macs[i], "MD5", 3) == 0) @@ -774,8 +787,10 @@ void parse_ctypes (char **ctype, int nctype, int *cert_type_priority) { int i, j; + if (ctype != NULL && nctype > 0) { + DEPRECATED; for (j = i = 0; i < nctype; i++) { if (strncasecmp (ctype[i], "OPE", 3) == 0) @@ -793,8 +808,11 @@ void parse_kx (char **kx, int nkx, int *kx_priority) { int i, j; + + if (kx != NULL && nkx > 0) { + DEPRECATED; for (j = i = 0; i < nkx; i++) { if (strcasecmp (kx[i], "SRP") == 0) @@ -828,8 +846,10 @@ void parse_comp (char **comp, int ncomp, int *comp_priority) { int i, j; + if (comp != NULL && ncomp > 0) { + DEPRECATED; for (j = i = 0; i < ncomp; i++) { if (strncasecmp (comp[i], "NUL", 3) == 0) diff --git a/src/serv.c b/src/serv.c index 24c06f7189..0e788f8110 100644 --- a/src/serv.c +++ b/src/serv.c @@ -381,7 +381,7 @@ initialize_session (void) gnutls_db_set_ptr (session, NULL); } - if (gnutls_set_priority (session, info.priorities, err, sizeof(err)-1) < 0) + if (gnutls_priority_set_direct (session, info.priorities, err, sizeof(err)-1) < 0) { fprintf(stderr, "%s\n", err); exit(1);