155714Skris/* ssl/s3_lib.c */ 255714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 355714Skris * All rights reserved. 455714Skris * 555714Skris * This package is an SSL implementation written 655714Skris * by Eric Young (eay@cryptsoft.com). 755714Skris * The implementation was written so as to conform with Netscapes SSL. 8280304Sjkim * 955714Skris * This library is free for commercial and non-commercial use as long as 1055714Skris * the following conditions are aheared to. The following conditions 1155714Skris * apply to all code found in this distribution, be it the RC4, RSA, 1255714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 1355714Skris * included with this distribution is covered by the same copyright terms 1455714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15280304Sjkim * 1655714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 1755714Skris * the code are not to be removed. 1855714Skris * If this package is used in a product, Eric Young should be given attribution 1955714Skris * as the author of the parts of the library used. 2055714Skris * This can be in the form of a textual message at program startup or 2155714Skris * in documentation (online or textual) provided with the package. 22280304Sjkim * 2355714Skris * Redistribution and use in source and binary forms, with or without 2455714Skris * modification, are permitted provided that the following conditions 2555714Skris * are met: 2655714Skris * 1. Redistributions of source code must retain the copyright 2755714Skris * notice, this list of conditions and the following disclaimer. 2855714Skris * 2. Redistributions in binary form must reproduce the above copyright 2955714Skris * notice, this list of conditions and the following disclaimer in the 3055714Skris * documentation and/or other materials provided with the distribution. 3155714Skris * 3. All advertising materials mentioning features or use of this software 3255714Skris * must display the following acknowledgement: 3355714Skris * "This product includes cryptographic software written by 3455714Skris * Eric Young (eay@cryptsoft.com)" 3555714Skris * The word 'cryptographic' can be left out if the rouines from the library 3655714Skris * being used are not cryptographic related :-). 37280304Sjkim * 4. If you include any Windows specific code (or a derivative thereof) from 3855714Skris * the apps directory (application code) you must include an acknowledgement: 3955714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40280304Sjkim * 4155714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 4255714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4355714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4455714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 4555714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4655714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4755714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4855714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4955714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 5055714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 5155714Skris * SUCH DAMAGE. 52280304Sjkim * 5355714Skris * The licence and distribution terms for any publically available version or 5455714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 5555714Skris * copied and put under another distribution licence 5655714Skris * [including the GNU Public Licence.] 5755714Skris */ 5872613Skris/* ==================================================================== 59238405Sjkim * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. 6072613Skris * 6172613Skris * Redistribution and use in source and binary forms, with or without 6272613Skris * modification, are permitted provided that the following conditions 6372613Skris * are met: 6472613Skris * 6572613Skris * 1. Redistributions of source code must retain the above copyright 66280304Sjkim * notice, this list of conditions and the following disclaimer. 6772613Skris * 6872613Skris * 2. Redistributions in binary form must reproduce the above copyright 6972613Skris * notice, this list of conditions and the following disclaimer in 7072613Skris * the documentation and/or other materials provided with the 7172613Skris * distribution. 7272613Skris * 7372613Skris * 3. All advertising materials mentioning features or use of this 7472613Skris * software must display the following acknowledgment: 7572613Skris * "This product includes software developed by the OpenSSL Project 7672613Skris * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 7772613Skris * 7872613Skris * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 7972613Skris * endorse or promote products derived from this software without 8072613Skris * prior written permission. For written permission, please contact 8172613Skris * openssl-core@openssl.org. 8272613Skris * 8372613Skris * 5. Products derived from this software may not be called "OpenSSL" 8472613Skris * nor may "OpenSSL" appear in their names without prior written 8572613Skris * permission of the OpenSSL Project. 8672613Skris * 8772613Skris * 6. Redistributions of any form whatsoever must retain the following 8872613Skris * acknowledgment: 8972613Skris * "This product includes software developed by the OpenSSL Project 9072613Skris * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 9172613Skris * 9272613Skris * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 9372613Skris * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 9472613Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 9572613Skris * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 9672613Skris * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 9772613Skris * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 9872613Skris * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 9972613Skris * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 10072613Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 10172613Skris * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 10272613Skris * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 10372613Skris * OF THE POSSIBILITY OF SUCH DAMAGE. 10472613Skris * ==================================================================== 10572613Skris * 10672613Skris * This product includes cryptographic software written by Eric Young 10772613Skris * (eay@cryptsoft.com). This product includes software written by Tim 10872613Skris * Hudson (tjh@cryptsoft.com). 10972613Skris * 11072613Skris */ 111160814Ssimon/* ==================================================================== 112160814Ssimon * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 113160814Ssimon * 114280304Sjkim * Portions of the attached software ("Contribution") are developed by 115160814Ssimon * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. 116160814Ssimon * 117160814Ssimon * The Contribution is licensed pursuant to the OpenSSL open source 118160814Ssimon * license provided above. 119160814Ssimon * 120160814Ssimon * ECC cipher suite support in OpenSSL originally written by 121160814Ssimon * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories. 122160814Ssimon * 123160814Ssimon */ 124238405Sjkim/* ==================================================================== 125238405Sjkim * Copyright 2005 Nokia. All rights reserved. 126238405Sjkim * 127238405Sjkim * The portions of the attached software ("Contribution") is developed by 128238405Sjkim * Nokia Corporation and is licensed pursuant to the OpenSSL open source 129238405Sjkim * license. 130238405Sjkim * 131238405Sjkim * The Contribution, originally written by Mika Kousa and Pasi Eronen of 132238405Sjkim * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites 133238405Sjkim * support (see RFC 4279) to OpenSSL. 134238405Sjkim * 135238405Sjkim * No patent licenses or other rights except those expressly stated in 136238405Sjkim * the OpenSSL open source license shall be deemed granted or received 137238405Sjkim * expressly, by implication, estoppel, or otherwise. 138238405Sjkim * 139238405Sjkim * No assurances are provided by Nokia that the Contribution does not 140238405Sjkim * infringe the patent or other intellectual property rights of any third 141238405Sjkim * party or that the license provides you with all the necessary rights 142238405Sjkim * to make use of the Contribution. 143238405Sjkim * 144238405Sjkim * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN 145238405Sjkim * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA 146238405Sjkim * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY 147238405Sjkim * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR 148238405Sjkim * OTHERWISE. 149238405Sjkim */ 15055714Skris 15155714Skris#include <stdio.h> 15255714Skris#include <openssl/objects.h> 15355714Skris#include "ssl_locl.h" 154109998Smarkm#include "kssl_lcl.h" 155238405Sjkim#ifndef OPENSSL_NO_TLSEXT 156280304Sjkim# ifndef OPENSSL_NO_EC 157280304Sjkim# include "../crypto/ec/ec_lcl.h" 158280304Sjkim# endif /* OPENSSL_NO_EC */ 159280304Sjkim#endif /* OPENSSL_NO_TLSEXT */ 160109998Smarkm#include <openssl/md5.h> 161160814Ssimon#ifndef OPENSSL_NO_DH 162280304Sjkim# include <openssl/dh.h> 163160814Ssimon#endif 16455714Skris 165280304Sjkimconst char ssl3_version_str[] = "SSLv3" OPENSSL_VERSION_PTEXT; 16655714Skris 167280304Sjkim#define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER)) 16855714Skris 169160814Ssimon/* list of available SSLv3 ciphers (sorted by id) */ 170280304SjkimOPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = { 171238405Sjkim 17255714Skris/* The RSA ciphers */ 17355714Skris/* Cipher 01 */ 174280304Sjkim { 175280304Sjkim 1, 176280304Sjkim SSL3_TXT_RSA_NULL_MD5, 177280304Sjkim SSL3_CK_RSA_NULL_MD5, 178280304Sjkim SSL_kRSA, 179280304Sjkim SSL_aRSA, 180280304Sjkim SSL_eNULL, 181280304Sjkim SSL_MD5, 182280304Sjkim SSL_SSLV3, 183280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE, 184280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 185280304Sjkim 0, 186280304Sjkim 0, 187280304Sjkim }, 188238405Sjkim 18955714Skris/* Cipher 02 */ 190280304Sjkim { 191280304Sjkim 1, 192280304Sjkim SSL3_TXT_RSA_NULL_SHA, 193280304Sjkim SSL3_CK_RSA_NULL_SHA, 194280304Sjkim SSL_kRSA, 195280304Sjkim SSL_aRSA, 196280304Sjkim SSL_eNULL, 197280304Sjkim SSL_SHA1, 198280304Sjkim SSL_SSLV3, 199280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 200280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 201280304Sjkim 0, 202280304Sjkim 0, 203280304Sjkim }, 204238405Sjkim 20555714Skris/* Cipher 03 */ 206296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 207280304Sjkim { 208280304Sjkim 1, 209280304Sjkim SSL3_TXT_RSA_RC4_40_MD5, 210280304Sjkim SSL3_CK_RSA_RC4_40_MD5, 211280304Sjkim SSL_kRSA, 212280304Sjkim SSL_aRSA, 213280304Sjkim SSL_RC4, 214280304Sjkim SSL_MD5, 215280304Sjkim SSL_SSLV3, 216298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 217280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 218280304Sjkim 40, 219280304Sjkim 128, 220280304Sjkim }, 221296317Sdelphij#endif 222238405Sjkim 22355714Skris/* Cipher 04 */ 224280304Sjkim { 225280304Sjkim 1, 226280304Sjkim SSL3_TXT_RSA_RC4_128_MD5, 227280304Sjkim SSL3_CK_RSA_RC4_128_MD5, 228280304Sjkim SSL_kRSA, 229280304Sjkim SSL_aRSA, 230280304Sjkim SSL_RC4, 231280304Sjkim SSL_MD5, 232280304Sjkim SSL_SSLV3, 233280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 234280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 235280304Sjkim 128, 236280304Sjkim 128, 237280304Sjkim }, 238238405Sjkim 23955714Skris/* Cipher 05 */ 240280304Sjkim { 241280304Sjkim 1, 242280304Sjkim SSL3_TXT_RSA_RC4_128_SHA, 243280304Sjkim SSL3_CK_RSA_RC4_128_SHA, 244280304Sjkim SSL_kRSA, 245280304Sjkim SSL_aRSA, 246280304Sjkim SSL_RC4, 247280304Sjkim SSL_SHA1, 248280304Sjkim SSL_SSLV3, 249280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 250280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 251280304Sjkim 128, 252280304Sjkim 128, 253280304Sjkim }, 254238405Sjkim 25555714Skris/* Cipher 06 */ 256296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 257280304Sjkim { 258280304Sjkim 1, 259280304Sjkim SSL3_TXT_RSA_RC2_40_MD5, 260280304Sjkim SSL3_CK_RSA_RC2_40_MD5, 261280304Sjkim SSL_kRSA, 262280304Sjkim SSL_aRSA, 263280304Sjkim SSL_RC2, 264280304Sjkim SSL_MD5, 265280304Sjkim SSL_SSLV3, 266298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 267280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 268280304Sjkim 40, 269280304Sjkim 128, 270280304Sjkim }, 271296317Sdelphij#endif 272238405Sjkim 27355714Skris/* Cipher 07 */ 274127128Snectar#ifndef OPENSSL_NO_IDEA 275280304Sjkim { 276280304Sjkim 1, 277280304Sjkim SSL3_TXT_RSA_IDEA_128_SHA, 278280304Sjkim SSL3_CK_RSA_IDEA_128_SHA, 279280304Sjkim SSL_kRSA, 280280304Sjkim SSL_aRSA, 281280304Sjkim SSL_IDEA, 282280304Sjkim SSL_SHA1, 283280304Sjkim SSL_SSLV3, 284280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 285280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 286280304Sjkim 128, 287280304Sjkim 128, 288280304Sjkim }, 289127128Snectar#endif 290238405Sjkim 29155714Skris/* Cipher 08 */ 292296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 293280304Sjkim { 294280304Sjkim 1, 295280304Sjkim SSL3_TXT_RSA_DES_40_CBC_SHA, 296280304Sjkim SSL3_CK_RSA_DES_40_CBC_SHA, 297280304Sjkim SSL_kRSA, 298280304Sjkim SSL_aRSA, 299280304Sjkim SSL_DES, 300280304Sjkim SSL_SHA1, 301280304Sjkim SSL_SSLV3, 302298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 303280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 304280304Sjkim 40, 305280304Sjkim 56, 306280304Sjkim }, 307296317Sdelphij#endif 308238405Sjkim 30955714Skris/* Cipher 09 */ 310296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 311280304Sjkim { 312280304Sjkim 1, 313280304Sjkim SSL3_TXT_RSA_DES_64_CBC_SHA, 314280304Sjkim SSL3_CK_RSA_DES_64_CBC_SHA, 315280304Sjkim SSL_kRSA, 316280304Sjkim SSL_aRSA, 317280304Sjkim SSL_DES, 318280304Sjkim SSL_SHA1, 319280304Sjkim SSL_SSLV3, 320298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 321280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 322280304Sjkim 56, 323280304Sjkim 56, 324280304Sjkim }, 325296317Sdelphij#endif 326238405Sjkim 32755714Skris/* Cipher 0A */ 328280304Sjkim { 329280304Sjkim 1, 330280304Sjkim SSL3_TXT_RSA_DES_192_CBC3_SHA, 331280304Sjkim SSL3_CK_RSA_DES_192_CBC3_SHA, 332280304Sjkim SSL_kRSA, 333280304Sjkim SSL_aRSA, 334280304Sjkim SSL_3DES, 335280304Sjkim SSL_SHA1, 336280304Sjkim SSL_SSLV3, 337306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 338280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 339280304Sjkim 112, 340280304Sjkim 168, 341280304Sjkim }, 342238405Sjkim 343160814Ssimon/* The DH ciphers */ 34455714Skris/* Cipher 0B */ 345296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 346280304Sjkim { 347280304Sjkim 0, 348280304Sjkim SSL3_TXT_DH_DSS_DES_40_CBC_SHA, 349280304Sjkim SSL3_CK_DH_DSS_DES_40_CBC_SHA, 350280304Sjkim SSL_kDHd, 351280304Sjkim SSL_aDH, 352280304Sjkim SSL_DES, 353280304Sjkim SSL_SHA1, 354280304Sjkim SSL_SSLV3, 355298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 356280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 357280304Sjkim 40, 358280304Sjkim 56, 359280304Sjkim }, 360296317Sdelphij#endif 361238405Sjkim 36255714Skris/* Cipher 0C */ 363296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 364280304Sjkim { 365280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 366280304Sjkim SSL3_TXT_DH_DSS_DES_64_CBC_SHA, 367280304Sjkim SSL3_CK_DH_DSS_DES_64_CBC_SHA, 368280304Sjkim SSL_kDHd, 369280304Sjkim SSL_aDH, 370280304Sjkim SSL_DES, 371280304Sjkim SSL_SHA1, 372280304Sjkim SSL_SSLV3, 373298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 374280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 375280304Sjkim 56, 376280304Sjkim 56, 377280304Sjkim }, 378296317Sdelphij#endif 379238405Sjkim 38055714Skris/* Cipher 0D */ 381280304Sjkim { 382280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 383280304Sjkim SSL3_TXT_DH_DSS_DES_192_CBC3_SHA, 384280304Sjkim SSL3_CK_DH_DSS_DES_192_CBC3_SHA, 385280304Sjkim SSL_kDHd, 386280304Sjkim SSL_aDH, 387280304Sjkim SSL_3DES, 388280304Sjkim SSL_SHA1, 389280304Sjkim SSL_SSLV3, 390306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 391280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 392280304Sjkim 112, 393280304Sjkim 168, 394280304Sjkim }, 395238405Sjkim 39655714Skris/* Cipher 0E */ 397296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 398280304Sjkim { 399280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 400280304Sjkim SSL3_TXT_DH_RSA_DES_40_CBC_SHA, 401280304Sjkim SSL3_CK_DH_RSA_DES_40_CBC_SHA, 402280304Sjkim SSL_kDHr, 403280304Sjkim SSL_aDH, 404280304Sjkim SSL_DES, 405280304Sjkim SSL_SHA1, 406280304Sjkim SSL_SSLV3, 407298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 408280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 409280304Sjkim 40, 410280304Sjkim 56, 411280304Sjkim }, 412296317Sdelphij#endif 413238405Sjkim 41455714Skris/* Cipher 0F */ 415296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 416280304Sjkim { 417280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 418280304Sjkim SSL3_TXT_DH_RSA_DES_64_CBC_SHA, 419280304Sjkim SSL3_CK_DH_RSA_DES_64_CBC_SHA, 420280304Sjkim SSL_kDHr, 421280304Sjkim SSL_aDH, 422280304Sjkim SSL_DES, 423280304Sjkim SSL_SHA1, 424280304Sjkim SSL_SSLV3, 425298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 426280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 427280304Sjkim 56, 428280304Sjkim 56, 429280304Sjkim }, 430296317Sdelphij#endif 431238405Sjkim 43255714Skris/* Cipher 10 */ 433280304Sjkim { 434280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 435280304Sjkim SSL3_TXT_DH_RSA_DES_192_CBC3_SHA, 436280304Sjkim SSL3_CK_DH_RSA_DES_192_CBC3_SHA, 437280304Sjkim SSL_kDHr, 438280304Sjkim SSL_aDH, 439280304Sjkim SSL_3DES, 440280304Sjkim SSL_SHA1, 441280304Sjkim SSL_SSLV3, 442306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 443280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 444280304Sjkim 112, 445280304Sjkim 168, 446280304Sjkim }, 44755714Skris 44855714Skris/* The Ephemeral DH ciphers */ 44955714Skris/* Cipher 11 */ 450296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 451280304Sjkim { 452280304Sjkim 1, 453280304Sjkim SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, 454280304Sjkim SSL3_CK_EDH_DSS_DES_40_CBC_SHA, 455280304Sjkim SSL_kEDH, 456280304Sjkim SSL_aDSS, 457280304Sjkim SSL_DES, 458280304Sjkim SSL_SHA1, 459280304Sjkim SSL_SSLV3, 460298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 461280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 462280304Sjkim 40, 463280304Sjkim 56, 464280304Sjkim }, 465296317Sdelphij#endif 466238405Sjkim 46755714Skris/* Cipher 12 */ 468296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 469280304Sjkim { 470280304Sjkim 1, 471280304Sjkim SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, 472280304Sjkim SSL3_CK_EDH_DSS_DES_64_CBC_SHA, 473280304Sjkim SSL_kEDH, 474280304Sjkim SSL_aDSS, 475280304Sjkim SSL_DES, 476280304Sjkim SSL_SHA1, 477280304Sjkim SSL_SSLV3, 478298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 479280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 480280304Sjkim 56, 481280304Sjkim 56, 482280304Sjkim }, 483296317Sdelphij#endif 484238405Sjkim 48555714Skris/* Cipher 13 */ 486280304Sjkim { 487280304Sjkim 1, 488280304Sjkim SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, 489280304Sjkim SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, 490280304Sjkim SSL_kEDH, 491280304Sjkim SSL_aDSS, 492280304Sjkim SSL_3DES, 493280304Sjkim SSL_SHA1, 494280304Sjkim SSL_SSLV3, 495306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 496280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 497280304Sjkim 112, 498280304Sjkim 168, 499280304Sjkim }, 500238405Sjkim 50155714Skris/* Cipher 14 */ 502296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 503280304Sjkim { 504280304Sjkim 1, 505280304Sjkim SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, 506280304Sjkim SSL3_CK_EDH_RSA_DES_40_CBC_SHA, 507280304Sjkim SSL_kEDH, 508280304Sjkim SSL_aRSA, 509280304Sjkim SSL_DES, 510280304Sjkim SSL_SHA1, 511280304Sjkim SSL_SSLV3, 512298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 513280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 514280304Sjkim 40, 515280304Sjkim 56, 516280304Sjkim }, 517296317Sdelphij#endif 518238405Sjkim 51955714Skris/* Cipher 15 */ 520296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 521280304Sjkim { 522280304Sjkim 1, 523280304Sjkim SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, 524280304Sjkim SSL3_CK_EDH_RSA_DES_64_CBC_SHA, 525280304Sjkim SSL_kEDH, 526280304Sjkim SSL_aRSA, 527280304Sjkim SSL_DES, 528280304Sjkim SSL_SHA1, 529280304Sjkim SSL_SSLV3, 530298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 531280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 532280304Sjkim 56, 533280304Sjkim 56, 534280304Sjkim }, 535296317Sdelphij#endif 536238405Sjkim 53755714Skris/* Cipher 16 */ 538280304Sjkim { 539280304Sjkim 1, 540280304Sjkim SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, 541280304Sjkim SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, 542280304Sjkim SSL_kEDH, 543280304Sjkim SSL_aRSA, 544280304Sjkim SSL_3DES, 545280304Sjkim SSL_SHA1, 546280304Sjkim SSL_SSLV3, 547306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 548280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 549280304Sjkim 112, 550280304Sjkim 168, 551280304Sjkim }, 552238405Sjkim 553160814Ssimon/* Cipher 17 */ 554296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 555280304Sjkim { 556280304Sjkim 1, 557280304Sjkim SSL3_TXT_ADH_RC4_40_MD5, 558280304Sjkim SSL3_CK_ADH_RC4_40_MD5, 559280304Sjkim SSL_kEDH, 560280304Sjkim SSL_aNULL, 561280304Sjkim SSL_RC4, 562280304Sjkim SSL_MD5, 563280304Sjkim SSL_SSLV3, 564298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 565280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 566280304Sjkim 40, 567280304Sjkim 128, 568280304Sjkim }, 569296317Sdelphij#endif 570238405Sjkim 571160814Ssimon/* Cipher 18 */ 572280304Sjkim { 573280304Sjkim 1, 574280304Sjkim SSL3_TXT_ADH_RC4_128_MD5, 575280304Sjkim SSL3_CK_ADH_RC4_128_MD5, 576280304Sjkim SSL_kEDH, 577280304Sjkim SSL_aNULL, 578280304Sjkim SSL_RC4, 579280304Sjkim SSL_MD5, 580280304Sjkim SSL_SSLV3, 581298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM, 582280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 583280304Sjkim 128, 584280304Sjkim 128, 585280304Sjkim }, 586238405Sjkim 587160814Ssimon/* Cipher 19 */ 588296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 589280304Sjkim { 590280304Sjkim 1, 591280304Sjkim SSL3_TXT_ADH_DES_40_CBC_SHA, 592280304Sjkim SSL3_CK_ADH_DES_40_CBC_SHA, 593280304Sjkim SSL_kEDH, 594280304Sjkim SSL_aNULL, 595280304Sjkim SSL_DES, 596280304Sjkim SSL_SHA1, 597280304Sjkim SSL_SSLV3, 598298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 599280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 600280304Sjkim 40, 601280304Sjkim 128, 602280304Sjkim }, 603296317Sdelphij#endif 604238405Sjkim 605160814Ssimon/* Cipher 1A */ 606296317Sdelphij#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 607280304Sjkim { 608280304Sjkim 1, 609280304Sjkim SSL3_TXT_ADH_DES_64_CBC_SHA, 610280304Sjkim SSL3_CK_ADH_DES_64_CBC_SHA, 611280304Sjkim SSL_kEDH, 612280304Sjkim SSL_aNULL, 613280304Sjkim SSL_DES, 614280304Sjkim SSL_SHA1, 615280304Sjkim SSL_SSLV3, 616298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 617280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 618280304Sjkim 56, 619280304Sjkim 56, 620280304Sjkim }, 621296317Sdelphij#endif 622238405Sjkim 623160814Ssimon/* Cipher 1B */ 624280304Sjkim { 625280304Sjkim 1, 626280304Sjkim SSL3_TXT_ADH_DES_192_CBC_SHA, 627280304Sjkim SSL3_CK_ADH_DES_192_CBC_SHA, 628280304Sjkim SSL_kEDH, 629280304Sjkim SSL_aNULL, 630280304Sjkim SSL_3DES, 631280304Sjkim SSL_SHA1, 632280304Sjkim SSL_SSLV3, 633306196Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 634280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 635280304Sjkim 112, 636280304Sjkim 168, 637280304Sjkim }, 63855714Skris 639238405Sjkim/* Fortezza ciphersuite from SSL 3.0 spec */ 640238405Sjkim#if 0 64155714Skris/* Cipher 1C */ 642280304Sjkim { 643280304Sjkim 0, 644280304Sjkim SSL3_TXT_FZA_DMS_NULL_SHA, 645280304Sjkim SSL3_CK_FZA_DMS_NULL_SHA, 646280304Sjkim SSL_kFZA, 647280304Sjkim SSL_aFZA, 648280304Sjkim SSL_eNULL, 649280304Sjkim SSL_SHA1, 650280304Sjkim SSL_SSLV3, 651280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE, 652280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 653280304Sjkim 0, 654280304Sjkim 0, 655280304Sjkim }, 65655714Skris 65755714Skris/* Cipher 1D */ 658280304Sjkim { 659280304Sjkim 0, 660280304Sjkim SSL3_TXT_FZA_DMS_FZA_SHA, 661280304Sjkim SSL3_CK_FZA_DMS_FZA_SHA, 662280304Sjkim SSL_kFZA, 663280304Sjkim SSL_aFZA, 664280304Sjkim SSL_eFZA, 665280304Sjkim SSL_SHA1, 666280304Sjkim SSL_SSLV3, 667280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE, 668280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 669280304Sjkim 0, 670280304Sjkim 0, 671280304Sjkim }, 67255714Skris 67355714Skris/* Cipher 1E */ 674280304Sjkim { 675280304Sjkim 0, 676280304Sjkim SSL3_TXT_FZA_DMS_RC4_SHA, 677280304Sjkim SSL3_CK_FZA_DMS_RC4_SHA, 678280304Sjkim SSL_kFZA, 679280304Sjkim SSL_aFZA, 680280304Sjkim SSL_RC4, 681280304Sjkim SSL_SHA1, 682280304Sjkim SSL_SSLV3, 683280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 684280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 685280304Sjkim 128, 686280304Sjkim 128, 687280304Sjkim }, 688109998Smarkm#endif 68955714Skris 690109998Smarkm#ifndef OPENSSL_NO_KRB5 691238405Sjkim/* The Kerberos ciphers*/ 692194206Ssimon/* Cipher 1E */ 693296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 694280304Sjkim { 695280304Sjkim 1, 696280304Sjkim SSL3_TXT_KRB5_DES_64_CBC_SHA, 697280304Sjkim SSL3_CK_KRB5_DES_64_CBC_SHA, 698280304Sjkim SSL_kKRB5, 699280304Sjkim SSL_aKRB5, 700280304Sjkim SSL_DES, 701280304Sjkim SSL_SHA1, 702280304Sjkim SSL_SSLV3, 703298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 704280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 705280304Sjkim 56, 706280304Sjkim 56, 707280304Sjkim }, 708296317Sdelphij# endif 709109998Smarkm 710194206Ssimon/* Cipher 1F */ 711280304Sjkim { 712280304Sjkim 1, 713280304Sjkim SSL3_TXT_KRB5_DES_192_CBC3_SHA, 714280304Sjkim SSL3_CK_KRB5_DES_192_CBC3_SHA, 715280304Sjkim SSL_kKRB5, 716280304Sjkim SSL_aKRB5, 717280304Sjkim SSL_3DES, 718280304Sjkim SSL_SHA1, 719280304Sjkim SSL_SSLV3, 720306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 721280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 722280304Sjkim 112, 723280304Sjkim 168, 724280304Sjkim }, 725109998Smarkm 726194206Ssimon/* Cipher 20 */ 727280304Sjkim { 728280304Sjkim 1, 729280304Sjkim SSL3_TXT_KRB5_RC4_128_SHA, 730280304Sjkim SSL3_CK_KRB5_RC4_128_SHA, 731280304Sjkim SSL_kKRB5, 732280304Sjkim SSL_aKRB5, 733280304Sjkim SSL_RC4, 734280304Sjkim SSL_SHA1, 735280304Sjkim SSL_SSLV3, 736280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 737280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 738280304Sjkim 128, 739280304Sjkim 128, 740280304Sjkim }, 741109998Smarkm 742194206Ssimon/* Cipher 21 */ 743280304Sjkim { 744280304Sjkim 1, 745280304Sjkim SSL3_TXT_KRB5_IDEA_128_CBC_SHA, 746280304Sjkim SSL3_CK_KRB5_IDEA_128_CBC_SHA, 747280304Sjkim SSL_kKRB5, 748280304Sjkim SSL_aKRB5, 749280304Sjkim SSL_IDEA, 750280304Sjkim SSL_SHA1, 751280304Sjkim SSL_SSLV3, 752280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 753280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 754280304Sjkim 128, 755280304Sjkim 128, 756280304Sjkim }, 757109998Smarkm 758194206Ssimon/* Cipher 22 */ 759296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 760280304Sjkim { 761280304Sjkim 1, 762280304Sjkim SSL3_TXT_KRB5_DES_64_CBC_MD5, 763280304Sjkim SSL3_CK_KRB5_DES_64_CBC_MD5, 764280304Sjkim SSL_kKRB5, 765280304Sjkim SSL_aKRB5, 766280304Sjkim SSL_DES, 767280304Sjkim SSL_MD5, 768280304Sjkim SSL_SSLV3, 769298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW, 770280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 771280304Sjkim 56, 772280304Sjkim 56, 773280304Sjkim }, 774296317Sdelphij# endif 775109998Smarkm 776194206Ssimon/* Cipher 23 */ 777280304Sjkim { 778280304Sjkim 1, 779280304Sjkim SSL3_TXT_KRB5_DES_192_CBC3_MD5, 780280304Sjkim SSL3_CK_KRB5_DES_192_CBC3_MD5, 781280304Sjkim SSL_kKRB5, 782280304Sjkim SSL_aKRB5, 783280304Sjkim SSL_3DES, 784280304Sjkim SSL_MD5, 785280304Sjkim SSL_SSLV3, 786306196Sjkim SSL_NOT_EXP | SSL_MEDIUM, 787280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 788280304Sjkim 112, 789280304Sjkim 168, 790280304Sjkim }, 791109998Smarkm 792194206Ssimon/* Cipher 24 */ 793280304Sjkim { 794280304Sjkim 1, 795280304Sjkim SSL3_TXT_KRB5_RC4_128_MD5, 796280304Sjkim SSL3_CK_KRB5_RC4_128_MD5, 797280304Sjkim SSL_kKRB5, 798280304Sjkim SSL_aKRB5, 799280304Sjkim SSL_RC4, 800280304Sjkim SSL_MD5, 801280304Sjkim SSL_SSLV3, 802280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 803280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 804280304Sjkim 128, 805280304Sjkim 128, 806280304Sjkim }, 807109998Smarkm 808194206Ssimon/* Cipher 25 */ 809280304Sjkim { 810280304Sjkim 1, 811280304Sjkim SSL3_TXT_KRB5_IDEA_128_CBC_MD5, 812280304Sjkim SSL3_CK_KRB5_IDEA_128_CBC_MD5, 813280304Sjkim SSL_kKRB5, 814280304Sjkim SSL_aKRB5, 815280304Sjkim SSL_IDEA, 816280304Sjkim SSL_MD5, 817280304Sjkim SSL_SSLV3, 818280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 819280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 820280304Sjkim 128, 821280304Sjkim 128, 822280304Sjkim }, 823109998Smarkm 824194206Ssimon/* Cipher 26 */ 825296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 826280304Sjkim { 827280304Sjkim 1, 828280304Sjkim SSL3_TXT_KRB5_DES_40_CBC_SHA, 829280304Sjkim SSL3_CK_KRB5_DES_40_CBC_SHA, 830280304Sjkim SSL_kKRB5, 831280304Sjkim SSL_aKRB5, 832280304Sjkim SSL_DES, 833280304Sjkim SSL_SHA1, 834280304Sjkim SSL_SSLV3, 835298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 836280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 837280304Sjkim 40, 838280304Sjkim 56, 839280304Sjkim }, 840296317Sdelphij# endif 841109998Smarkm 842194206Ssimon/* Cipher 27 */ 843296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 844280304Sjkim { 845280304Sjkim 1, 846280304Sjkim SSL3_TXT_KRB5_RC2_40_CBC_SHA, 847280304Sjkim SSL3_CK_KRB5_RC2_40_CBC_SHA, 848280304Sjkim SSL_kKRB5, 849280304Sjkim SSL_aKRB5, 850280304Sjkim SSL_RC2, 851280304Sjkim SSL_SHA1, 852280304Sjkim SSL_SSLV3, 853298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 854280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 855280304Sjkim 40, 856280304Sjkim 128, 857280304Sjkim }, 858296317Sdelphij# endif 859109998Smarkm 860194206Ssimon/* Cipher 28 */ 861296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 862280304Sjkim { 863280304Sjkim 1, 864280304Sjkim SSL3_TXT_KRB5_RC4_40_SHA, 865280304Sjkim SSL3_CK_KRB5_RC4_40_SHA, 866280304Sjkim SSL_kKRB5, 867280304Sjkim SSL_aKRB5, 868280304Sjkim SSL_RC4, 869280304Sjkim SSL_SHA1, 870280304Sjkim SSL_SSLV3, 871298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 872280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 873280304Sjkim 40, 874280304Sjkim 128, 875280304Sjkim }, 876296317Sdelphij# endif 877109998Smarkm 878194206Ssimon/* Cipher 29 */ 879296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 880280304Sjkim { 881280304Sjkim 1, 882280304Sjkim SSL3_TXT_KRB5_DES_40_CBC_MD5, 883280304Sjkim SSL3_CK_KRB5_DES_40_CBC_MD5, 884280304Sjkim SSL_kKRB5, 885280304Sjkim SSL_aKRB5, 886280304Sjkim SSL_DES, 887280304Sjkim SSL_MD5, 888280304Sjkim SSL_SSLV3, 889298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 890280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 891280304Sjkim 40, 892280304Sjkim 56, 893280304Sjkim }, 894296317Sdelphij# endif 895109998Smarkm 896194206Ssimon/* Cipher 2A */ 897296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 898280304Sjkim { 899280304Sjkim 1, 900280304Sjkim SSL3_TXT_KRB5_RC2_40_CBC_MD5, 901280304Sjkim SSL3_CK_KRB5_RC2_40_CBC_MD5, 902280304Sjkim SSL_kKRB5, 903280304Sjkim SSL_aKRB5, 904280304Sjkim SSL_RC2, 905280304Sjkim SSL_MD5, 906280304Sjkim SSL_SSLV3, 907298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 908280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 909280304Sjkim 40, 910280304Sjkim 128, 911280304Sjkim }, 912296317Sdelphij# endif 913109998Smarkm 914194206Ssimon/* Cipher 2B */ 915296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 916280304Sjkim { 917280304Sjkim 1, 918280304Sjkim SSL3_TXT_KRB5_RC4_40_MD5, 919280304Sjkim SSL3_CK_KRB5_RC4_40_MD5, 920280304Sjkim SSL_kKRB5, 921280304Sjkim SSL_aKRB5, 922280304Sjkim SSL_RC4, 923280304Sjkim SSL_MD5, 924280304Sjkim SSL_SSLV3, 925298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40, 926280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 927280304Sjkim 40, 928280304Sjkim 128, 929280304Sjkim }, 930296317Sdelphij# endif 931280304Sjkim#endif /* OPENSSL_NO_KRB5 */ 932194206Ssimon 933160814Ssimon/* New AES ciphersuites */ 934160814Ssimon/* Cipher 2F */ 935280304Sjkim { 936280304Sjkim 1, 937280304Sjkim TLS1_TXT_RSA_WITH_AES_128_SHA, 938280304Sjkim TLS1_CK_RSA_WITH_AES_128_SHA, 939280304Sjkim SSL_kRSA, 940280304Sjkim SSL_aRSA, 941280304Sjkim SSL_AES128, 942280304Sjkim SSL_SHA1, 943280304Sjkim SSL_TLSV1, 944280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 945280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 946280304Sjkim 128, 947280304Sjkim 128, 948280304Sjkim }, 949160814Ssimon/* Cipher 30 */ 950280304Sjkim { 951280304Sjkim 0, 952280304Sjkim TLS1_TXT_DH_DSS_WITH_AES_128_SHA, 953280304Sjkim TLS1_CK_DH_DSS_WITH_AES_128_SHA, 954280304Sjkim SSL_kDHd, 955280304Sjkim SSL_aDH, 956280304Sjkim SSL_AES128, 957280304Sjkim SSL_SHA1, 958280304Sjkim SSL_TLSV1, 959280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 960280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 961280304Sjkim 128, 962280304Sjkim 128, 963280304Sjkim }, 964160814Ssimon/* Cipher 31 */ 965280304Sjkim { 966280304Sjkim 0, 967280304Sjkim TLS1_TXT_DH_RSA_WITH_AES_128_SHA, 968280304Sjkim TLS1_CK_DH_RSA_WITH_AES_128_SHA, 969280304Sjkim SSL_kDHr, 970280304Sjkim SSL_aDH, 971280304Sjkim SSL_AES128, 972280304Sjkim SSL_SHA1, 973280304Sjkim SSL_TLSV1, 974280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 975280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 976280304Sjkim 128, 977280304Sjkim 128, 978280304Sjkim }, 979160814Ssimon/* Cipher 32 */ 980280304Sjkim { 981280304Sjkim 1, 982280304Sjkim TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, 983280304Sjkim TLS1_CK_DHE_DSS_WITH_AES_128_SHA, 984280304Sjkim SSL_kEDH, 985280304Sjkim SSL_aDSS, 986280304Sjkim SSL_AES128, 987280304Sjkim SSL_SHA1, 988280304Sjkim SSL_TLSV1, 989280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 990280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 991280304Sjkim 128, 992280304Sjkim 128, 993280304Sjkim }, 994160814Ssimon/* Cipher 33 */ 995280304Sjkim { 996280304Sjkim 1, 997280304Sjkim TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, 998280304Sjkim TLS1_CK_DHE_RSA_WITH_AES_128_SHA, 999280304Sjkim SSL_kEDH, 1000280304Sjkim SSL_aRSA, 1001280304Sjkim SSL_AES128, 1002280304Sjkim SSL_SHA1, 1003280304Sjkim SSL_TLSV1, 1004280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1005280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1006280304Sjkim 128, 1007280304Sjkim 128, 1008280304Sjkim }, 1009160814Ssimon/* Cipher 34 */ 1010280304Sjkim { 1011280304Sjkim 1, 1012280304Sjkim TLS1_TXT_ADH_WITH_AES_128_SHA, 1013280304Sjkim TLS1_CK_ADH_WITH_AES_128_SHA, 1014280304Sjkim SSL_kEDH, 1015280304Sjkim SSL_aNULL, 1016280304Sjkim SSL_AES128, 1017280304Sjkim SSL_SHA1, 1018280304Sjkim SSL_TLSV1, 1019298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1020280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1021280304Sjkim 128, 1022280304Sjkim 128, 1023280304Sjkim }, 1024109998Smarkm 1025160814Ssimon/* Cipher 35 */ 1026280304Sjkim { 1027280304Sjkim 1, 1028280304Sjkim TLS1_TXT_RSA_WITH_AES_256_SHA, 1029280304Sjkim TLS1_CK_RSA_WITH_AES_256_SHA, 1030280304Sjkim SSL_kRSA, 1031280304Sjkim SSL_aRSA, 1032280304Sjkim SSL_AES256, 1033280304Sjkim SSL_SHA1, 1034280304Sjkim SSL_TLSV1, 1035280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1036280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1037280304Sjkim 256, 1038280304Sjkim 256, 1039280304Sjkim }, 1040160814Ssimon/* Cipher 36 */ 1041280304Sjkim { 1042280304Sjkim 0, 1043280304Sjkim TLS1_TXT_DH_DSS_WITH_AES_256_SHA, 1044280304Sjkim TLS1_CK_DH_DSS_WITH_AES_256_SHA, 1045280304Sjkim SSL_kDHd, 1046280304Sjkim SSL_aDH, 1047280304Sjkim SSL_AES256, 1048280304Sjkim SSL_SHA1, 1049280304Sjkim SSL_TLSV1, 1050280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1051280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1052280304Sjkim 256, 1053280304Sjkim 256, 1054280304Sjkim }, 1055238405Sjkim 1056160814Ssimon/* Cipher 37 */ 1057280304Sjkim { 1058280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1059280304Sjkim TLS1_TXT_DH_RSA_WITH_AES_256_SHA, 1060280304Sjkim TLS1_CK_DH_RSA_WITH_AES_256_SHA, 1061280304Sjkim SSL_kDHr, 1062280304Sjkim SSL_aDH, 1063280304Sjkim SSL_AES256, 1064280304Sjkim SSL_SHA1, 1065280304Sjkim SSL_TLSV1, 1066280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1067280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1068280304Sjkim 256, 1069280304Sjkim 256, 1070280304Sjkim }, 1071238405Sjkim 1072160814Ssimon/* Cipher 38 */ 1073280304Sjkim { 1074280304Sjkim 1, 1075280304Sjkim TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, 1076280304Sjkim TLS1_CK_DHE_DSS_WITH_AES_256_SHA, 1077280304Sjkim SSL_kEDH, 1078280304Sjkim SSL_aDSS, 1079280304Sjkim SSL_AES256, 1080280304Sjkim SSL_SHA1, 1081280304Sjkim SSL_TLSV1, 1082280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1083280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1084280304Sjkim 256, 1085280304Sjkim 256, 1086280304Sjkim }, 1087238405Sjkim 1088160814Ssimon/* Cipher 39 */ 1089280304Sjkim { 1090280304Sjkim 1, 1091280304Sjkim TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, 1092280304Sjkim TLS1_CK_DHE_RSA_WITH_AES_256_SHA, 1093280304Sjkim SSL_kEDH, 1094280304Sjkim SSL_aRSA, 1095280304Sjkim SSL_AES256, 1096280304Sjkim SSL_SHA1, 1097280304Sjkim SSL_TLSV1, 1098280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1099280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1100280304Sjkim 256, 1101280304Sjkim 256, 1102280304Sjkim }, 1103238405Sjkim 1104280304Sjkim /* Cipher 3A */ 1105280304Sjkim { 1106280304Sjkim 1, 1107280304Sjkim TLS1_TXT_ADH_WITH_AES_256_SHA, 1108280304Sjkim TLS1_CK_ADH_WITH_AES_256_SHA, 1109280304Sjkim SSL_kEDH, 1110280304Sjkim SSL_aNULL, 1111280304Sjkim SSL_AES256, 1112280304Sjkim SSL_SHA1, 1113280304Sjkim SSL_TLSV1, 1114298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1115280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1116280304Sjkim 256, 1117280304Sjkim 256, 1118280304Sjkim }, 1119238405Sjkim 1120280304Sjkim /* TLS v1.2 ciphersuites */ 1121280304Sjkim /* Cipher 3B */ 1122280304Sjkim { 1123280304Sjkim 1, 1124280304Sjkim TLS1_TXT_RSA_WITH_NULL_SHA256, 1125280304Sjkim TLS1_CK_RSA_WITH_NULL_SHA256, 1126280304Sjkim SSL_kRSA, 1127280304Sjkim SSL_aRSA, 1128280304Sjkim SSL_eNULL, 1129280304Sjkim SSL_SHA256, 1130280304Sjkim SSL_TLSV1_2, 1131280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 1132280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1133280304Sjkim 0, 1134280304Sjkim 0, 1135280304Sjkim }, 1136238405Sjkim 1137280304Sjkim /* Cipher 3C */ 1138280304Sjkim { 1139280304Sjkim 1, 1140280304Sjkim TLS1_TXT_RSA_WITH_AES_128_SHA256, 1141280304Sjkim TLS1_CK_RSA_WITH_AES_128_SHA256, 1142280304Sjkim SSL_kRSA, 1143280304Sjkim SSL_aRSA, 1144280304Sjkim SSL_AES128, 1145280304Sjkim SSL_SHA256, 1146280304Sjkim SSL_TLSV1_2, 1147280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1148280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1149280304Sjkim 128, 1150280304Sjkim 128, 1151280304Sjkim }, 1152238405Sjkim 1153280304Sjkim /* Cipher 3D */ 1154280304Sjkim { 1155280304Sjkim 1, 1156280304Sjkim TLS1_TXT_RSA_WITH_AES_256_SHA256, 1157280304Sjkim TLS1_CK_RSA_WITH_AES_256_SHA256, 1158280304Sjkim SSL_kRSA, 1159280304Sjkim SSL_aRSA, 1160280304Sjkim SSL_AES256, 1161280304Sjkim SSL_SHA256, 1162280304Sjkim SSL_TLSV1_2, 1163280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1164280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1165280304Sjkim 256, 1166280304Sjkim 256, 1167280304Sjkim }, 1168160814Ssimon 1169280304Sjkim /* Cipher 3E */ 1170280304Sjkim { 1171280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1172280304Sjkim TLS1_TXT_DH_DSS_WITH_AES_128_SHA256, 1173280304Sjkim TLS1_CK_DH_DSS_WITH_AES_128_SHA256, 1174280304Sjkim SSL_kDHd, 1175280304Sjkim SSL_aDH, 1176280304Sjkim SSL_AES128, 1177280304Sjkim SSL_SHA256, 1178280304Sjkim SSL_TLSV1_2, 1179280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1180280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1181280304Sjkim 128, 1182280304Sjkim 128, 1183280304Sjkim }, 1184238405Sjkim 1185280304Sjkim /* Cipher 3F */ 1186280304Sjkim { 1187280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1188280304Sjkim TLS1_TXT_DH_RSA_WITH_AES_128_SHA256, 1189280304Sjkim TLS1_CK_DH_RSA_WITH_AES_128_SHA256, 1190280304Sjkim SSL_kDHr, 1191280304Sjkim SSL_aDH, 1192280304Sjkim SSL_AES128, 1193280304Sjkim SSL_SHA256, 1194280304Sjkim SSL_TLSV1_2, 1195280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1196280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1197280304Sjkim 128, 1198280304Sjkim 128, 1199280304Sjkim }, 1200238405Sjkim 1201280304Sjkim /* Cipher 40 */ 1202280304Sjkim { 1203280304Sjkim 1, 1204280304Sjkim TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256, 1205280304Sjkim TLS1_CK_DHE_DSS_WITH_AES_128_SHA256, 1206280304Sjkim SSL_kEDH, 1207280304Sjkim SSL_aDSS, 1208280304Sjkim SSL_AES128, 1209280304Sjkim SSL_SHA256, 1210280304Sjkim SSL_TLSV1_2, 1211280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1212280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1213280304Sjkim 128, 1214280304Sjkim 128, 1215280304Sjkim }, 1216238405Sjkim 1217162911Ssimon#ifndef OPENSSL_NO_CAMELLIA 1218280304Sjkim /* Camellia ciphersuites from RFC4132 (128-bit portion) */ 1219162911Ssimon 1220280304Sjkim /* Cipher 41 */ 1221280304Sjkim { 1222280304Sjkim 1, 1223280304Sjkim TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA, 1224280304Sjkim TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA, 1225280304Sjkim SSL_kRSA, 1226280304Sjkim SSL_aRSA, 1227280304Sjkim SSL_CAMELLIA128, 1228280304Sjkim SSL_SHA1, 1229280304Sjkim SSL_TLSV1, 1230280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1231280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1232280304Sjkim 128, 1233280304Sjkim 128, 1234280304Sjkim }, 1235238405Sjkim 1236280304Sjkim /* Cipher 42 */ 1237280304Sjkim { 1238280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1239280304Sjkim TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA, 1240280304Sjkim TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA, 1241280304Sjkim SSL_kDHd, 1242280304Sjkim SSL_aDH, 1243280304Sjkim SSL_CAMELLIA128, 1244280304Sjkim SSL_SHA1, 1245280304Sjkim SSL_TLSV1, 1246280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1247280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1248280304Sjkim 128, 1249280304Sjkim 128, 1250280304Sjkim }, 1251238405Sjkim 1252280304Sjkim /* Cipher 43 */ 1253280304Sjkim { 1254280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1255280304Sjkim TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA, 1256280304Sjkim TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA, 1257280304Sjkim SSL_kDHr, 1258280304Sjkim SSL_aDH, 1259280304Sjkim SSL_CAMELLIA128, 1260280304Sjkim SSL_SHA1, 1261280304Sjkim SSL_TLSV1, 1262280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1263280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1264280304Sjkim 128, 1265280304Sjkim 128, 1266280304Sjkim }, 1267238405Sjkim 1268280304Sjkim /* Cipher 44 */ 1269280304Sjkim { 1270280304Sjkim 1, 1271280304Sjkim TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, 1272280304Sjkim TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, 1273280304Sjkim SSL_kEDH, 1274280304Sjkim SSL_aDSS, 1275280304Sjkim SSL_CAMELLIA128, 1276280304Sjkim SSL_SHA1, 1277280304Sjkim SSL_TLSV1, 1278280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1279280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1280280304Sjkim 128, 1281280304Sjkim 128, 1282280304Sjkim }, 1283238405Sjkim 1284280304Sjkim /* Cipher 45 */ 1285280304Sjkim { 1286280304Sjkim 1, 1287280304Sjkim TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, 1288280304Sjkim TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, 1289280304Sjkim SSL_kEDH, 1290280304Sjkim SSL_aRSA, 1291280304Sjkim SSL_CAMELLIA128, 1292280304Sjkim SSL_SHA1, 1293280304Sjkim SSL_TLSV1, 1294280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1295280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1296280304Sjkim 128, 1297280304Sjkim 128, 1298280304Sjkim }, 1299238405Sjkim 1300280304Sjkim /* Cipher 46 */ 1301280304Sjkim { 1302280304Sjkim 1, 1303280304Sjkim TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA, 1304280304Sjkim TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA, 1305280304Sjkim SSL_kEDH, 1306280304Sjkim SSL_aNULL, 1307280304Sjkim SSL_CAMELLIA128, 1308280304Sjkim SSL_SHA1, 1309280304Sjkim SSL_TLSV1, 1310298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH, 1311280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1312280304Sjkim 128, 1313280304Sjkim 128, 1314280304Sjkim }, 1315280304Sjkim#endif /* OPENSSL_NO_CAMELLIA */ 1316162911Ssimon 131755714Skris#if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 1318280304Sjkim /* New TLS Export CipherSuites from expired ID */ 1319280304Sjkim# if 0 1320280304Sjkim /* Cipher 60 */ 1321280304Sjkim { 1322280304Sjkim 1, 1323280304Sjkim TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5, 1324280304Sjkim TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5, 1325280304Sjkim SSL_kRSA, 1326280304Sjkim SSL_aRSA, 1327280304Sjkim SSL_RC4, 1328280304Sjkim SSL_MD5, 1329280304Sjkim SSL_TLSV1, 1330298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56, 1331280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1332280304Sjkim 56, 1333280304Sjkim 128, 1334280304Sjkim }, 1335238405Sjkim 1336280304Sjkim /* Cipher 61 */ 1337280304Sjkim { 1338280304Sjkim 1, 1339280304Sjkim TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 1340280304Sjkim TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 1341280304Sjkim SSL_kRSA, 1342280304Sjkim SSL_aRSA, 1343280304Sjkim SSL_RC2, 1344280304Sjkim SSL_MD5, 1345280304Sjkim SSL_TLSV1, 1346298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56, 1347280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1348280304Sjkim 56, 1349280304Sjkim 128, 1350280304Sjkim }, 1351280304Sjkim# endif 1352238405Sjkim 1353280304Sjkim /* Cipher 62 */ 1354296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 1355280304Sjkim { 1356280304Sjkim 1, 1357280304Sjkim TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA, 1358280304Sjkim TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA, 1359280304Sjkim SSL_kRSA, 1360280304Sjkim SSL_aRSA, 1361280304Sjkim SSL_DES, 1362280304Sjkim SSL_SHA1, 1363280304Sjkim SSL_TLSV1, 1364298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56, 1365280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1366280304Sjkim 56, 1367280304Sjkim 56, 1368280304Sjkim }, 1369296317Sdelphij# endif 1370238405Sjkim 1371280304Sjkim /* Cipher 63 */ 1372296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 1373280304Sjkim { 1374280304Sjkim 1, 1375280304Sjkim TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 1376280304Sjkim TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 1377280304Sjkim SSL_kEDH, 1378280304Sjkim SSL_aDSS, 1379280304Sjkim SSL_DES, 1380280304Sjkim SSL_SHA1, 1381280304Sjkim SSL_TLSV1, 1382298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56, 1383280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1384280304Sjkim 56, 1385280304Sjkim 56, 1386280304Sjkim }, 1387296317Sdelphij# endif 1388238405Sjkim 1389280304Sjkim /* Cipher 64 */ 1390296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 1391280304Sjkim { 1392280304Sjkim 1, 1393280304Sjkim TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA, 1394280304Sjkim TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA, 1395280304Sjkim SSL_kRSA, 1396280304Sjkim SSL_aRSA, 1397280304Sjkim SSL_RC4, 1398280304Sjkim SSL_SHA1, 1399280304Sjkim SSL_TLSV1, 1400298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56, 1401280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1402280304Sjkim 56, 1403280304Sjkim 128, 1404280304Sjkim }, 1405296317Sdelphij# endif 1406238405Sjkim 1407280304Sjkim /* Cipher 65 */ 1408296317Sdelphij# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS 1409280304Sjkim { 1410280304Sjkim 1, 1411280304Sjkim TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 1412280304Sjkim TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 1413280304Sjkim SSL_kEDH, 1414280304Sjkim SSL_aDSS, 1415280304Sjkim SSL_RC4, 1416280304Sjkim SSL_SHA1, 1417280304Sjkim SSL_TLSV1, 1418298999Sjkim SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56, 1419280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1420280304Sjkim 56, 1421280304Sjkim 128, 1422280304Sjkim }, 1423296317Sdelphij# endif 1424238405Sjkim 1425280304Sjkim /* Cipher 66 */ 1426280304Sjkim { 1427280304Sjkim 1, 1428280304Sjkim TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA, 1429280304Sjkim TLS1_CK_DHE_DSS_WITH_RC4_128_SHA, 1430280304Sjkim SSL_kEDH, 1431280304Sjkim SSL_aDSS, 1432280304Sjkim SSL_RC4, 1433280304Sjkim SSL_SHA1, 1434280304Sjkim SSL_TLSV1, 1435280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1436280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1437280304Sjkim 128, 1438280304Sjkim 128, 1439280304Sjkim }, 144055714Skris#endif 1441162911Ssimon 1442280304Sjkim /* TLS v1.2 ciphersuites */ 1443280304Sjkim /* Cipher 67 */ 1444280304Sjkim { 1445280304Sjkim 1, 1446280304Sjkim TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256, 1447280304Sjkim TLS1_CK_DHE_RSA_WITH_AES_128_SHA256, 1448280304Sjkim SSL_kEDH, 1449280304Sjkim SSL_aRSA, 1450280304Sjkim SSL_AES128, 1451280304Sjkim SSL_SHA256, 1452280304Sjkim SSL_TLSV1_2, 1453280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1454280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1455280304Sjkim 128, 1456280304Sjkim 128, 1457280304Sjkim }, 1458238405Sjkim 1459280304Sjkim /* Cipher 68 */ 1460280304Sjkim { 1461280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1462280304Sjkim TLS1_TXT_DH_DSS_WITH_AES_256_SHA256, 1463280304Sjkim TLS1_CK_DH_DSS_WITH_AES_256_SHA256, 1464280304Sjkim SSL_kDHd, 1465280304Sjkim SSL_aDH, 1466280304Sjkim SSL_AES256, 1467280304Sjkim SSL_SHA256, 1468280304Sjkim SSL_TLSV1_2, 1469280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1470280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1471280304Sjkim 256, 1472280304Sjkim 256, 1473280304Sjkim }, 1474238405Sjkim 1475280304Sjkim /* Cipher 69 */ 1476280304Sjkim { 1477280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1478280304Sjkim TLS1_TXT_DH_RSA_WITH_AES_256_SHA256, 1479280304Sjkim TLS1_CK_DH_RSA_WITH_AES_256_SHA256, 1480280304Sjkim SSL_kDHr, 1481280304Sjkim SSL_aDH, 1482280304Sjkim SSL_AES256, 1483280304Sjkim SSL_SHA256, 1484280304Sjkim SSL_TLSV1_2, 1485280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1486280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1487280304Sjkim 256, 1488280304Sjkim 256, 1489280304Sjkim }, 1490238405Sjkim 1491280304Sjkim /* Cipher 6A */ 1492280304Sjkim { 1493280304Sjkim 1, 1494280304Sjkim TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256, 1495280304Sjkim TLS1_CK_DHE_DSS_WITH_AES_256_SHA256, 1496280304Sjkim SSL_kEDH, 1497280304Sjkim SSL_aDSS, 1498280304Sjkim SSL_AES256, 1499280304Sjkim SSL_SHA256, 1500280304Sjkim SSL_TLSV1_2, 1501280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1502280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1503280304Sjkim 256, 1504280304Sjkim 256, 1505280304Sjkim }, 1506238405Sjkim 1507280304Sjkim /* Cipher 6B */ 1508280304Sjkim { 1509280304Sjkim 1, 1510280304Sjkim TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256, 1511280304Sjkim TLS1_CK_DHE_RSA_WITH_AES_256_SHA256, 1512280304Sjkim SSL_kEDH, 1513280304Sjkim SSL_aRSA, 1514280304Sjkim SSL_AES256, 1515280304Sjkim SSL_SHA256, 1516280304Sjkim SSL_TLSV1_2, 1517280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1518280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1519280304Sjkim 256, 1520280304Sjkim 256, 1521280304Sjkim }, 1522238405Sjkim 1523280304Sjkim /* Cipher 6C */ 1524280304Sjkim { 1525280304Sjkim 1, 1526280304Sjkim TLS1_TXT_ADH_WITH_AES_128_SHA256, 1527280304Sjkim TLS1_CK_ADH_WITH_AES_128_SHA256, 1528280304Sjkim SSL_kEDH, 1529280304Sjkim SSL_aNULL, 1530280304Sjkim SSL_AES128, 1531280304Sjkim SSL_SHA256, 1532280304Sjkim SSL_TLSV1_2, 1533298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1534280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1535280304Sjkim 128, 1536280304Sjkim 128, 1537280304Sjkim }, 1538238405Sjkim 1539280304Sjkim /* Cipher 6D */ 1540280304Sjkim { 1541280304Sjkim 1, 1542280304Sjkim TLS1_TXT_ADH_WITH_AES_256_SHA256, 1543280304Sjkim TLS1_CK_ADH_WITH_AES_256_SHA256, 1544280304Sjkim SSL_kEDH, 1545280304Sjkim SSL_aNULL, 1546280304Sjkim SSL_AES256, 1547280304Sjkim SSL_SHA256, 1548280304Sjkim SSL_TLSV1_2, 1549298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1550280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1551280304Sjkim 256, 1552280304Sjkim 256, 1553280304Sjkim }, 1554238405Sjkim 1555280304Sjkim /* GOST Ciphersuites */ 1556238405Sjkim 1557280304Sjkim { 1558280304Sjkim 1, 1559280304Sjkim "GOST94-GOST89-GOST89", 1560280304Sjkim 0x3000080, 1561280304Sjkim SSL_kGOST, 1562280304Sjkim SSL_aGOST94, 1563280304Sjkim SSL_eGOST2814789CNT, 1564280304Sjkim SSL_GOST89MAC, 1565280304Sjkim SSL_TLSV1, 1566280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1567280304Sjkim SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC, 1568280304Sjkim 256, 1569280304Sjkim 256}, 1570280304Sjkim { 1571280304Sjkim 1, 1572280304Sjkim "GOST2001-GOST89-GOST89", 1573280304Sjkim 0x3000081, 1574280304Sjkim SSL_kGOST, 1575280304Sjkim SSL_aGOST01, 1576280304Sjkim SSL_eGOST2814789CNT, 1577280304Sjkim SSL_GOST89MAC, 1578280304Sjkim SSL_TLSV1, 1579280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1580280304Sjkim SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC, 1581280304Sjkim 256, 1582280304Sjkim 256}, 1583280304Sjkim { 1584280304Sjkim 1, 1585280304Sjkim "GOST94-NULL-GOST94", 1586280304Sjkim 0x3000082, 1587280304Sjkim SSL_kGOST, 1588280304Sjkim SSL_aGOST94, 1589280304Sjkim SSL_eNULL, 1590280304Sjkim SSL_GOST94, 1591280304Sjkim SSL_TLSV1, 1592280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE, 1593280304Sjkim SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94, 1594280304Sjkim 0, 1595280304Sjkim 0}, 1596280304Sjkim { 1597280304Sjkim 1, 1598280304Sjkim "GOST2001-NULL-GOST94", 1599280304Sjkim 0x3000083, 1600280304Sjkim SSL_kGOST, 1601280304Sjkim SSL_aGOST01, 1602280304Sjkim SSL_eNULL, 1603280304Sjkim SSL_GOST94, 1604280304Sjkim SSL_TLSV1, 1605280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE, 1606280304Sjkim SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94, 1607280304Sjkim 0, 1608280304Sjkim 0}, 1609238405Sjkim 1610162911Ssimon#ifndef OPENSSL_NO_CAMELLIA 1611280304Sjkim /* Camellia ciphersuites from RFC4132 (256-bit portion) */ 1612162911Ssimon 1613280304Sjkim /* Cipher 84 */ 1614280304Sjkim { 1615280304Sjkim 1, 1616280304Sjkim TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA, 1617280304Sjkim TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA, 1618280304Sjkim SSL_kRSA, 1619280304Sjkim SSL_aRSA, 1620280304Sjkim SSL_CAMELLIA256, 1621280304Sjkim SSL_SHA1, 1622280304Sjkim SSL_TLSV1, 1623280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1624280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1625280304Sjkim 256, 1626280304Sjkim 256, 1627280304Sjkim }, 1628280304Sjkim /* Cipher 85 */ 1629280304Sjkim { 1630280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1631280304Sjkim TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA, 1632280304Sjkim TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA, 1633280304Sjkim SSL_kDHd, 1634280304Sjkim SSL_aDH, 1635280304Sjkim SSL_CAMELLIA256, 1636280304Sjkim SSL_SHA1, 1637280304Sjkim SSL_TLSV1, 1638280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1639280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1640280304Sjkim 256, 1641280304Sjkim 256, 1642280304Sjkim }, 1643238405Sjkim 1644280304Sjkim /* Cipher 86 */ 1645280304Sjkim { 1646280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1647280304Sjkim TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA, 1648280304Sjkim TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA, 1649280304Sjkim SSL_kDHr, 1650280304Sjkim SSL_aDH, 1651280304Sjkim SSL_CAMELLIA256, 1652280304Sjkim SSL_SHA1, 1653280304Sjkim SSL_TLSV1, 1654280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1655280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1656280304Sjkim 256, 1657280304Sjkim 256, 1658280304Sjkim }, 1659238405Sjkim 1660280304Sjkim /* Cipher 87 */ 1661280304Sjkim { 1662280304Sjkim 1, 1663280304Sjkim TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, 1664280304Sjkim TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, 1665280304Sjkim SSL_kEDH, 1666280304Sjkim SSL_aDSS, 1667280304Sjkim SSL_CAMELLIA256, 1668280304Sjkim SSL_SHA1, 1669280304Sjkim SSL_TLSV1, 1670280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1671280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1672280304Sjkim 256, 1673280304Sjkim 256, 1674280304Sjkim }, 1675238405Sjkim 1676280304Sjkim /* Cipher 88 */ 1677280304Sjkim { 1678280304Sjkim 1, 1679280304Sjkim TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, 1680280304Sjkim TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, 1681280304Sjkim SSL_kEDH, 1682280304Sjkim SSL_aRSA, 1683280304Sjkim SSL_CAMELLIA256, 1684280304Sjkim SSL_SHA1, 1685280304Sjkim SSL_TLSV1, 1686280304Sjkim SSL_NOT_EXP | SSL_HIGH, 1687280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1688280304Sjkim 256, 1689280304Sjkim 256, 1690280304Sjkim }, 1691238405Sjkim 1692280304Sjkim /* Cipher 89 */ 1693280304Sjkim { 1694280304Sjkim 1, 1695280304Sjkim TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA, 1696280304Sjkim TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA, 1697280304Sjkim SSL_kEDH, 1698280304Sjkim SSL_aNULL, 1699280304Sjkim SSL_CAMELLIA256, 1700280304Sjkim SSL_SHA1, 1701280304Sjkim SSL_TLSV1, 1702298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH, 1703280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1704280304Sjkim 256, 1705280304Sjkim 256, 1706280304Sjkim }, 1707280304Sjkim#endif /* OPENSSL_NO_CAMELLIA */ 1708162911Ssimon 1709238405Sjkim#ifndef OPENSSL_NO_PSK 1710280304Sjkim /* Cipher 8A */ 1711280304Sjkim { 1712280304Sjkim 1, 1713280304Sjkim TLS1_TXT_PSK_WITH_RC4_128_SHA, 1714280304Sjkim TLS1_CK_PSK_WITH_RC4_128_SHA, 1715280304Sjkim SSL_kPSK, 1716280304Sjkim SSL_aPSK, 1717280304Sjkim SSL_RC4, 1718280304Sjkim SSL_SHA1, 1719280304Sjkim SSL_TLSV1, 1720280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1721280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1722280304Sjkim 128, 1723280304Sjkim 128, 1724280304Sjkim }, 1725238405Sjkim 1726280304Sjkim /* Cipher 8B */ 1727280304Sjkim { 1728280304Sjkim 1, 1729280304Sjkim TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA, 1730280304Sjkim TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA, 1731280304Sjkim SSL_kPSK, 1732280304Sjkim SSL_aPSK, 1733280304Sjkim SSL_3DES, 1734280304Sjkim SSL_SHA1, 1735280304Sjkim SSL_TLSV1, 1736306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 1737280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1738280304Sjkim 112, 1739280304Sjkim 168, 1740280304Sjkim }, 1741238405Sjkim 1742280304Sjkim /* Cipher 8C */ 1743280304Sjkim { 1744280304Sjkim 1, 1745280304Sjkim TLS1_TXT_PSK_WITH_AES_128_CBC_SHA, 1746280304Sjkim TLS1_CK_PSK_WITH_AES_128_CBC_SHA, 1747280304Sjkim SSL_kPSK, 1748280304Sjkim SSL_aPSK, 1749280304Sjkim SSL_AES128, 1750280304Sjkim SSL_SHA1, 1751280304Sjkim SSL_TLSV1, 1752280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1753280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1754280304Sjkim 128, 1755280304Sjkim 128, 1756280304Sjkim }, 1757238405Sjkim 1758280304Sjkim /* Cipher 8D */ 1759280304Sjkim { 1760280304Sjkim 1, 1761280304Sjkim TLS1_TXT_PSK_WITH_AES_256_CBC_SHA, 1762280304Sjkim TLS1_CK_PSK_WITH_AES_256_CBC_SHA, 1763280304Sjkim SSL_kPSK, 1764280304Sjkim SSL_aPSK, 1765280304Sjkim SSL_AES256, 1766280304Sjkim SSL_SHA1, 1767280304Sjkim SSL_TLSV1, 1768280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1769280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1770280304Sjkim 256, 1771280304Sjkim 256, 1772280304Sjkim }, 1773280304Sjkim#endif /* OPENSSL_NO_PSK */ 1774238405Sjkim 1775194206Ssimon#ifndef OPENSSL_NO_SEED 1776280304Sjkim /* SEED ciphersuites from RFC4162 */ 1777194206Ssimon 1778280304Sjkim /* Cipher 96 */ 1779280304Sjkim { 1780280304Sjkim 1, 1781280304Sjkim TLS1_TXT_RSA_WITH_SEED_SHA, 1782280304Sjkim TLS1_CK_RSA_WITH_SEED_SHA, 1783280304Sjkim SSL_kRSA, 1784280304Sjkim SSL_aRSA, 1785280304Sjkim SSL_SEED, 1786280304Sjkim SSL_SHA1, 1787280304Sjkim SSL_TLSV1, 1788280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1789280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1790280304Sjkim 128, 1791280304Sjkim 128, 1792280304Sjkim }, 1793194206Ssimon 1794280304Sjkim /* Cipher 97 */ 1795280304Sjkim { 1796280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1797280304Sjkim TLS1_TXT_DH_DSS_WITH_SEED_SHA, 1798280304Sjkim TLS1_CK_DH_DSS_WITH_SEED_SHA, 1799280304Sjkim SSL_kDHd, 1800280304Sjkim SSL_aDH, 1801280304Sjkim SSL_SEED, 1802280304Sjkim SSL_SHA1, 1803280304Sjkim SSL_TLSV1, 1804280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1805280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1806280304Sjkim 128, 1807280304Sjkim 128, 1808280304Sjkim }, 1809194206Ssimon 1810280304Sjkim /* Cipher 98 */ 1811280304Sjkim { 1812280304Sjkim 0, /* not implemented (non-ephemeral DH) */ 1813280304Sjkim TLS1_TXT_DH_RSA_WITH_SEED_SHA, 1814280304Sjkim TLS1_CK_DH_RSA_WITH_SEED_SHA, 1815280304Sjkim SSL_kDHr, 1816280304Sjkim SSL_aDH, 1817280304Sjkim SSL_SEED, 1818280304Sjkim SSL_SHA1, 1819280304Sjkim SSL_TLSV1, 1820280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1821280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1822280304Sjkim 128, 1823280304Sjkim 128, 1824280304Sjkim }, 1825194206Ssimon 1826280304Sjkim /* Cipher 99 */ 1827280304Sjkim { 1828280304Sjkim 1, 1829280304Sjkim TLS1_TXT_DHE_DSS_WITH_SEED_SHA, 1830280304Sjkim TLS1_CK_DHE_DSS_WITH_SEED_SHA, 1831280304Sjkim SSL_kEDH, 1832280304Sjkim SSL_aDSS, 1833280304Sjkim SSL_SEED, 1834280304Sjkim SSL_SHA1, 1835280304Sjkim SSL_TLSV1, 1836280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1837280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1838280304Sjkim 128, 1839280304Sjkim 128, 1840280304Sjkim }, 1841194206Ssimon 1842280304Sjkim /* Cipher 9A */ 1843280304Sjkim { 1844280304Sjkim 1, 1845280304Sjkim TLS1_TXT_DHE_RSA_WITH_SEED_SHA, 1846280304Sjkim TLS1_CK_DHE_RSA_WITH_SEED_SHA, 1847280304Sjkim SSL_kEDH, 1848280304Sjkim SSL_aRSA, 1849280304Sjkim SSL_SEED, 1850280304Sjkim SSL_SHA1, 1851280304Sjkim SSL_TLSV1, 1852280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 1853280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1854280304Sjkim 128, 1855280304Sjkim 128, 1856280304Sjkim }, 1857194206Ssimon 1858280304Sjkim /* Cipher 9B */ 1859280304Sjkim { 1860280304Sjkim 1, 1861280304Sjkim TLS1_TXT_ADH_WITH_SEED_SHA, 1862280304Sjkim TLS1_CK_ADH_WITH_SEED_SHA, 1863280304Sjkim SSL_kEDH, 1864280304Sjkim SSL_aNULL, 1865280304Sjkim SSL_SEED, 1866280304Sjkim SSL_SHA1, 1867280304Sjkim SSL_TLSV1, 1868298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM, 1869280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 1870280304Sjkim 128, 1871280304Sjkim 128, 1872280304Sjkim }, 1873194206Ssimon 1874280304Sjkim#endif /* OPENSSL_NO_SEED */ 1875194206Ssimon 1876280304Sjkim /* GCM ciphersuites from RFC5288 */ 1877238405Sjkim 1878280304Sjkim /* Cipher 9C */ 1879280304Sjkim { 1880280304Sjkim 1, 1881280304Sjkim TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256, 1882280304Sjkim TLS1_CK_RSA_WITH_AES_128_GCM_SHA256, 1883280304Sjkim SSL_kRSA, 1884280304Sjkim SSL_aRSA, 1885280304Sjkim SSL_AES128GCM, 1886280304Sjkim SSL_AEAD, 1887280304Sjkim SSL_TLSV1_2, 1888280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1889280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 1890280304Sjkim 128, 1891280304Sjkim 128, 1892280304Sjkim }, 1893238405Sjkim 1894280304Sjkim /* Cipher 9D */ 1895280304Sjkim { 1896280304Sjkim 1, 1897280304Sjkim TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384, 1898280304Sjkim TLS1_CK_RSA_WITH_AES_256_GCM_SHA384, 1899280304Sjkim SSL_kRSA, 1900280304Sjkim SSL_aRSA, 1901280304Sjkim SSL_AES256GCM, 1902280304Sjkim SSL_AEAD, 1903280304Sjkim SSL_TLSV1_2, 1904280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1905280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 1906280304Sjkim 256, 1907280304Sjkim 256, 1908280304Sjkim }, 1909238405Sjkim 1910280304Sjkim /* Cipher 9E */ 1911280304Sjkim { 1912280304Sjkim 1, 1913280304Sjkim TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256, 1914280304Sjkim TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256, 1915280304Sjkim SSL_kEDH, 1916280304Sjkim SSL_aRSA, 1917280304Sjkim SSL_AES128GCM, 1918280304Sjkim SSL_AEAD, 1919280304Sjkim SSL_TLSV1_2, 1920280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1921280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 1922280304Sjkim 128, 1923280304Sjkim 128, 1924280304Sjkim }, 1925238405Sjkim 1926280304Sjkim /* Cipher 9F */ 1927280304Sjkim { 1928280304Sjkim 1, 1929280304Sjkim TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384, 1930280304Sjkim TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384, 1931280304Sjkim SSL_kEDH, 1932280304Sjkim SSL_aRSA, 1933280304Sjkim SSL_AES256GCM, 1934280304Sjkim SSL_AEAD, 1935280304Sjkim SSL_TLSV1_2, 1936280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1937280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 1938280304Sjkim 256, 1939280304Sjkim 256, 1940280304Sjkim }, 1941238405Sjkim 1942280304Sjkim /* Cipher A0 */ 1943280304Sjkim { 1944280304Sjkim 0, 1945280304Sjkim TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256, 1946280304Sjkim TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256, 1947280304Sjkim SSL_kDHr, 1948280304Sjkim SSL_aDH, 1949280304Sjkim SSL_AES128GCM, 1950280304Sjkim SSL_AEAD, 1951280304Sjkim SSL_TLSV1_2, 1952280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1953280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 1954280304Sjkim 128, 1955280304Sjkim 128, 1956280304Sjkim }, 1957238405Sjkim 1958280304Sjkim /* Cipher A1 */ 1959280304Sjkim { 1960280304Sjkim 0, 1961280304Sjkim TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384, 1962280304Sjkim TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384, 1963280304Sjkim SSL_kDHr, 1964280304Sjkim SSL_aDH, 1965280304Sjkim SSL_AES256GCM, 1966280304Sjkim SSL_AEAD, 1967280304Sjkim SSL_TLSV1_2, 1968280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1969280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 1970280304Sjkim 256, 1971280304Sjkim 256, 1972280304Sjkim }, 1973238405Sjkim 1974280304Sjkim /* Cipher A2 */ 1975280304Sjkim { 1976280304Sjkim 1, 1977280304Sjkim TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256, 1978280304Sjkim TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256, 1979280304Sjkim SSL_kEDH, 1980280304Sjkim SSL_aDSS, 1981280304Sjkim SSL_AES128GCM, 1982280304Sjkim SSL_AEAD, 1983280304Sjkim SSL_TLSV1_2, 1984280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 1985280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 1986280304Sjkim 128, 1987280304Sjkim 128, 1988280304Sjkim }, 1989238405Sjkim 1990280304Sjkim /* Cipher A3 */ 1991280304Sjkim { 1992280304Sjkim 1, 1993280304Sjkim TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384, 1994280304Sjkim TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384, 1995280304Sjkim SSL_kEDH, 1996280304Sjkim SSL_aDSS, 1997280304Sjkim SSL_AES256GCM, 1998280304Sjkim SSL_AEAD, 1999280304Sjkim SSL_TLSV1_2, 2000280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2001280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2002280304Sjkim 256, 2003280304Sjkim 256, 2004280304Sjkim }, 2005238405Sjkim 2006280304Sjkim /* Cipher A4 */ 2007280304Sjkim { 2008280304Sjkim 0, 2009280304Sjkim TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256, 2010280304Sjkim TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256, 2011280304Sjkim SSL_kDHd, 2012280304Sjkim SSL_aDH, 2013280304Sjkim SSL_AES128GCM, 2014280304Sjkim SSL_AEAD, 2015280304Sjkim SSL_TLSV1_2, 2016280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2017280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2018280304Sjkim 128, 2019280304Sjkim 128, 2020280304Sjkim }, 2021238405Sjkim 2022280304Sjkim /* Cipher A5 */ 2023280304Sjkim { 2024280304Sjkim 0, 2025280304Sjkim TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384, 2026280304Sjkim TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384, 2027280304Sjkim SSL_kDHd, 2028280304Sjkim SSL_aDH, 2029280304Sjkim SSL_AES256GCM, 2030280304Sjkim SSL_AEAD, 2031280304Sjkim SSL_TLSV1_2, 2032280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2033280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2034280304Sjkim 256, 2035280304Sjkim 256, 2036280304Sjkim }, 2037238405Sjkim 2038280304Sjkim /* Cipher A6 */ 2039280304Sjkim { 2040280304Sjkim 1, 2041280304Sjkim TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256, 2042280304Sjkim TLS1_CK_ADH_WITH_AES_128_GCM_SHA256, 2043280304Sjkim SSL_kEDH, 2044280304Sjkim SSL_aNULL, 2045280304Sjkim SSL_AES128GCM, 2046280304Sjkim SSL_AEAD, 2047280304Sjkim SSL_TLSV1_2, 2048298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2049280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2050280304Sjkim 128, 2051280304Sjkim 128, 2052280304Sjkim }, 2053238405Sjkim 2054280304Sjkim /* Cipher A7 */ 2055280304Sjkim { 2056280304Sjkim 1, 2057280304Sjkim TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384, 2058280304Sjkim TLS1_CK_ADH_WITH_AES_256_GCM_SHA384, 2059280304Sjkim SSL_kEDH, 2060280304Sjkim SSL_aNULL, 2061280304Sjkim SSL_AES256GCM, 2062280304Sjkim SSL_AEAD, 2063280304Sjkim SSL_TLSV1_2, 2064298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2065280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2066280304Sjkim 256, 2067280304Sjkim 256, 2068280304Sjkim }, 2069238405Sjkim 2070160814Ssimon#ifndef OPENSSL_NO_ECDH 2071280304Sjkim /* Cipher C001 */ 2072280304Sjkim { 2073280304Sjkim 1, 2074280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA, 2075280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA, 2076280304Sjkim SSL_kECDHe, 2077280304Sjkim SSL_aECDH, 2078280304Sjkim SSL_eNULL, 2079280304Sjkim SSL_SHA1, 2080280304Sjkim SSL_TLSV1, 2081280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 2082280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2083280304Sjkim 0, 2084280304Sjkim 0, 2085280304Sjkim }, 208655714Skris 2087280304Sjkim /* Cipher C002 */ 2088280304Sjkim { 2089280304Sjkim 1, 2090280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA, 2091280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA, 2092280304Sjkim SSL_kECDHe, 2093280304Sjkim SSL_aECDH, 2094280304Sjkim SSL_RC4, 2095280304Sjkim SSL_SHA1, 2096280304Sjkim SSL_TLSV1, 2097280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2098280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2099280304Sjkim 128, 2100280304Sjkim 128, 2101280304Sjkim }, 2102160814Ssimon 2103280304Sjkim /* Cipher C003 */ 2104280304Sjkim { 2105280304Sjkim 1, 2106280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA, 2107280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA, 2108280304Sjkim SSL_kECDHe, 2109280304Sjkim SSL_aECDH, 2110280304Sjkim SSL_3DES, 2111280304Sjkim SSL_SHA1, 2112280304Sjkim SSL_TLSV1, 2113306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 2114280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2115280304Sjkim 112, 2116280304Sjkim 168, 2117280304Sjkim }, 2118160814Ssimon 2119280304Sjkim /* Cipher C004 */ 2120280304Sjkim { 2121280304Sjkim 1, 2122280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 2123280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 2124280304Sjkim SSL_kECDHe, 2125280304Sjkim SSL_aECDH, 2126280304Sjkim SSL_AES128, 2127280304Sjkim SSL_SHA1, 2128280304Sjkim SSL_TLSV1, 2129280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2130280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2131280304Sjkim 128, 2132280304Sjkim 128, 2133280304Sjkim }, 2134160814Ssimon 2135280304Sjkim /* Cipher C005 */ 2136280304Sjkim { 2137280304Sjkim 1, 2138280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 2139280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 2140280304Sjkim SSL_kECDHe, 2141280304Sjkim SSL_aECDH, 2142280304Sjkim SSL_AES256, 2143280304Sjkim SSL_SHA1, 2144280304Sjkim SSL_TLSV1, 2145280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2146280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2147280304Sjkim 256, 2148280304Sjkim 256, 2149280304Sjkim }, 2150160814Ssimon 2151280304Sjkim /* Cipher C006 */ 2152280304Sjkim { 2153280304Sjkim 1, 2154280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA, 2155280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA, 2156280304Sjkim SSL_kEECDH, 2157280304Sjkim SSL_aECDSA, 2158280304Sjkim SSL_eNULL, 2159280304Sjkim SSL_SHA1, 2160280304Sjkim SSL_TLSV1, 2161280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 2162280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2163280304Sjkim 0, 2164280304Sjkim 0, 2165280304Sjkim }, 2166160814Ssimon 2167280304Sjkim /* Cipher C007 */ 2168280304Sjkim { 2169280304Sjkim 1, 2170280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA, 2171280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA, 2172280304Sjkim SSL_kEECDH, 2173280304Sjkim SSL_aECDSA, 2174280304Sjkim SSL_RC4, 2175280304Sjkim SSL_SHA1, 2176280304Sjkim SSL_TLSV1, 2177280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2178280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2179280304Sjkim 128, 2180280304Sjkim 128, 2181280304Sjkim }, 2182109998Smarkm 2183280304Sjkim /* Cipher C008 */ 2184280304Sjkim { 2185280304Sjkim 1, 2186280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, 2187280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, 2188280304Sjkim SSL_kEECDH, 2189280304Sjkim SSL_aECDSA, 2190280304Sjkim SSL_3DES, 2191280304Sjkim SSL_SHA1, 2192280304Sjkim SSL_TLSV1, 2193306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 2194280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2195280304Sjkim 112, 2196280304Sjkim 168, 2197280304Sjkim }, 2198160814Ssimon 2199280304Sjkim /* Cipher C009 */ 2200280304Sjkim { 2201280304Sjkim 1, 2202280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 2203280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 2204280304Sjkim SSL_kEECDH, 2205280304Sjkim SSL_aECDSA, 2206280304Sjkim SSL_AES128, 2207280304Sjkim SSL_SHA1, 2208280304Sjkim SSL_TLSV1, 2209280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2210280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2211280304Sjkim 128, 2212280304Sjkim 128, 2213280304Sjkim }, 2214160814Ssimon 2215280304Sjkim /* Cipher C00A */ 2216280304Sjkim { 2217280304Sjkim 1, 2218280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 2219280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 2220280304Sjkim SSL_kEECDH, 2221280304Sjkim SSL_aECDSA, 2222280304Sjkim SSL_AES256, 2223280304Sjkim SSL_SHA1, 2224280304Sjkim SSL_TLSV1, 2225280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2226280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2227280304Sjkim 256, 2228280304Sjkim 256, 2229280304Sjkim }, 2230160814Ssimon 2231280304Sjkim /* Cipher C00B */ 2232280304Sjkim { 2233280304Sjkim 1, 2234280304Sjkim TLS1_TXT_ECDH_RSA_WITH_NULL_SHA, 2235280304Sjkim TLS1_CK_ECDH_RSA_WITH_NULL_SHA, 2236280304Sjkim SSL_kECDHr, 2237280304Sjkim SSL_aECDH, 2238280304Sjkim SSL_eNULL, 2239280304Sjkim SSL_SHA1, 2240280304Sjkim SSL_TLSV1, 2241280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 2242280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2243280304Sjkim 0, 2244280304Sjkim 0, 2245280304Sjkim }, 2246160814Ssimon 2247280304Sjkim /* Cipher C00C */ 2248280304Sjkim { 2249280304Sjkim 1, 2250280304Sjkim TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA, 2251280304Sjkim TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA, 2252280304Sjkim SSL_kECDHr, 2253280304Sjkim SSL_aECDH, 2254280304Sjkim SSL_RC4, 2255280304Sjkim SSL_SHA1, 2256280304Sjkim SSL_TLSV1, 2257280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2258280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2259280304Sjkim 128, 2260280304Sjkim 128, 2261280304Sjkim }, 2262160814Ssimon 2263280304Sjkim /* Cipher C00D */ 2264280304Sjkim { 2265280304Sjkim 1, 2266280304Sjkim TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA, 2267280304Sjkim TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA, 2268280304Sjkim SSL_kECDHr, 2269280304Sjkim SSL_aECDH, 2270280304Sjkim SSL_3DES, 2271280304Sjkim SSL_SHA1, 2272280304Sjkim SSL_TLSV1, 2273306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 2274280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2275280304Sjkim 112, 2276280304Sjkim 168, 2277280304Sjkim }, 2278160814Ssimon 2279280304Sjkim /* Cipher C00E */ 2280280304Sjkim { 2281280304Sjkim 1, 2282280304Sjkim TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA, 2283280304Sjkim TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA, 2284280304Sjkim SSL_kECDHr, 2285280304Sjkim SSL_aECDH, 2286280304Sjkim SSL_AES128, 2287280304Sjkim SSL_SHA1, 2288280304Sjkim SSL_TLSV1, 2289280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2290280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2291280304Sjkim 128, 2292280304Sjkim 128, 2293280304Sjkim }, 2294160814Ssimon 2295280304Sjkim /* Cipher C00F */ 2296280304Sjkim { 2297280304Sjkim 1, 2298280304Sjkim TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA, 2299280304Sjkim TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA, 2300280304Sjkim SSL_kECDHr, 2301280304Sjkim SSL_aECDH, 2302280304Sjkim SSL_AES256, 2303280304Sjkim SSL_SHA1, 2304280304Sjkim SSL_TLSV1, 2305280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2306280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2307280304Sjkim 256, 2308280304Sjkim 256, 2309280304Sjkim }, 2310160814Ssimon 2311280304Sjkim /* Cipher C010 */ 2312280304Sjkim { 2313280304Sjkim 1, 2314280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA, 2315280304Sjkim TLS1_CK_ECDHE_RSA_WITH_NULL_SHA, 2316280304Sjkim SSL_kEECDH, 2317280304Sjkim SSL_aRSA, 2318280304Sjkim SSL_eNULL, 2319280304Sjkim SSL_SHA1, 2320280304Sjkim SSL_TLSV1, 2321280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 2322280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2323280304Sjkim 0, 2324280304Sjkim 0, 2325280304Sjkim }, 2326160814Ssimon 2327280304Sjkim /* Cipher C011 */ 2328280304Sjkim { 2329280304Sjkim 1, 2330280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA, 2331280304Sjkim TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA, 2332280304Sjkim SSL_kEECDH, 2333280304Sjkim SSL_aRSA, 2334280304Sjkim SSL_RC4, 2335280304Sjkim SSL_SHA1, 2336280304Sjkim SSL_TLSV1, 2337280304Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2338280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2339280304Sjkim 128, 2340280304Sjkim 128, 2341280304Sjkim }, 2342160814Ssimon 2343280304Sjkim /* Cipher C012 */ 2344280304Sjkim { 2345280304Sjkim 1, 2346280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA, 2347280304Sjkim TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA, 2348280304Sjkim SSL_kEECDH, 2349280304Sjkim SSL_aRSA, 2350280304Sjkim SSL_3DES, 2351280304Sjkim SSL_SHA1, 2352280304Sjkim SSL_TLSV1, 2353306196Sjkim SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 2354280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2355280304Sjkim 112, 2356280304Sjkim 168, 2357280304Sjkim }, 2358160814Ssimon 2359280304Sjkim /* Cipher C013 */ 2360280304Sjkim { 2361280304Sjkim 1, 2362280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA, 2363280304Sjkim TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA, 2364280304Sjkim SSL_kEECDH, 2365280304Sjkim SSL_aRSA, 2366280304Sjkim SSL_AES128, 2367280304Sjkim SSL_SHA1, 2368280304Sjkim SSL_TLSV1, 2369280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2370280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2371280304Sjkim 128, 2372280304Sjkim 128, 2373280304Sjkim }, 2374160814Ssimon 2375280304Sjkim /* Cipher C014 */ 2376280304Sjkim { 2377280304Sjkim 1, 2378280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA, 2379280304Sjkim TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA, 2380280304Sjkim SSL_kEECDH, 2381280304Sjkim SSL_aRSA, 2382280304Sjkim SSL_AES256, 2383280304Sjkim SSL_SHA1, 2384280304Sjkim SSL_TLSV1, 2385280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2386280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2387280304Sjkim 256, 2388280304Sjkim 256, 2389280304Sjkim }, 2390160814Ssimon 2391280304Sjkim /* Cipher C015 */ 2392280304Sjkim { 2393280304Sjkim 1, 2394280304Sjkim TLS1_TXT_ECDH_anon_WITH_NULL_SHA, 2395280304Sjkim TLS1_CK_ECDH_anon_WITH_NULL_SHA, 2396280304Sjkim SSL_kEECDH, 2397280304Sjkim SSL_aNULL, 2398280304Sjkim SSL_eNULL, 2399280304Sjkim SSL_SHA1, 2400280304Sjkim SSL_TLSV1, 2401280304Sjkim SSL_NOT_EXP | SSL_STRONG_NONE | SSL_FIPS, 2402280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2403280304Sjkim 0, 2404280304Sjkim 0, 2405280304Sjkim }, 2406109998Smarkm 2407280304Sjkim /* Cipher C016 */ 2408280304Sjkim { 2409280304Sjkim 1, 2410280304Sjkim TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA, 2411280304Sjkim TLS1_CK_ECDH_anon_WITH_RC4_128_SHA, 2412280304Sjkim SSL_kEECDH, 2413280304Sjkim SSL_aNULL, 2414280304Sjkim SSL_RC4, 2415280304Sjkim SSL_SHA1, 2416280304Sjkim SSL_TLSV1, 2417298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM, 2418280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2419280304Sjkim 128, 2420280304Sjkim 128, 2421280304Sjkim }, 2422160814Ssimon 2423280304Sjkim /* Cipher C017 */ 2424280304Sjkim { 2425280304Sjkim 1, 2426280304Sjkim TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA, 2427280304Sjkim TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA, 2428280304Sjkim SSL_kEECDH, 2429280304Sjkim SSL_aNULL, 2430280304Sjkim SSL_3DES, 2431280304Sjkim SSL_SHA1, 2432280304Sjkim SSL_TLSV1, 2433306196Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM | SSL_FIPS, 2434280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2435280304Sjkim 112, 2436280304Sjkim 168, 2437280304Sjkim }, 2438160814Ssimon 2439280304Sjkim /* Cipher C018 */ 2440280304Sjkim { 2441280304Sjkim 1, 2442280304Sjkim TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA, 2443280304Sjkim TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA, 2444280304Sjkim SSL_kEECDH, 2445280304Sjkim SSL_aNULL, 2446280304Sjkim SSL_AES128, 2447280304Sjkim SSL_SHA1, 2448280304Sjkim SSL_TLSV1, 2449298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2450280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2451280304Sjkim 128, 2452280304Sjkim 128, 2453280304Sjkim }, 2454160814Ssimon 2455280304Sjkim /* Cipher C019 */ 2456280304Sjkim { 2457280304Sjkim 1, 2458280304Sjkim TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA, 2459280304Sjkim TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA, 2460280304Sjkim SSL_kEECDH, 2461280304Sjkim SSL_aNULL, 2462280304Sjkim SSL_AES256, 2463280304Sjkim SSL_SHA1, 2464280304Sjkim SSL_TLSV1, 2465298999Sjkim SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2466280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2467280304Sjkim 256, 2468280304Sjkim 256, 2469280304Sjkim }, 2470280304Sjkim#endif /* OPENSSL_NO_ECDH */ 2471160814Ssimon 2472238405Sjkim#ifndef OPENSSL_NO_SRP 2473280304Sjkim /* Cipher C01A */ 2474280304Sjkim { 2475280304Sjkim 1, 2476280304Sjkim TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA, 2477280304Sjkim TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA, 2478280304Sjkim SSL_kSRP, 2479280304Sjkim SSL_aSRP, 2480280304Sjkim SSL_3DES, 2481280304Sjkim SSL_SHA1, 2482280304Sjkim SSL_TLSV1, 2483306196Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2484280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2485280304Sjkim 112, 2486280304Sjkim 168, 2487280304Sjkim }, 2488162911Ssimon 2489280304Sjkim /* Cipher C01B */ 2490280304Sjkim { 2491280304Sjkim 1, 2492280304Sjkim TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA, 2493280304Sjkim TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA, 2494280304Sjkim SSL_kSRP, 2495280304Sjkim SSL_aRSA, 2496280304Sjkim SSL_3DES, 2497280304Sjkim SSL_SHA1, 2498280304Sjkim SSL_TLSV1, 2499306196Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2500280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2501280304Sjkim 112, 2502280304Sjkim 168, 2503280304Sjkim }, 2504238405Sjkim 2505280304Sjkim /* Cipher C01C */ 2506280304Sjkim { 2507280304Sjkim 1, 2508280304Sjkim TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA, 2509280304Sjkim TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA, 2510280304Sjkim SSL_kSRP, 2511280304Sjkim SSL_aDSS, 2512280304Sjkim SSL_3DES, 2513280304Sjkim SSL_SHA1, 2514280304Sjkim SSL_TLSV1, 2515306196Sjkim SSL_NOT_EXP | SSL_MEDIUM, 2516280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2517280304Sjkim 112, 2518280304Sjkim 168, 2519280304Sjkim }, 2520238405Sjkim 2521280304Sjkim /* Cipher C01D */ 2522280304Sjkim { 2523280304Sjkim 1, 2524280304Sjkim TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA, 2525280304Sjkim TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA, 2526280304Sjkim SSL_kSRP, 2527280304Sjkim SSL_aSRP, 2528280304Sjkim SSL_AES128, 2529280304Sjkim SSL_SHA1, 2530280304Sjkim SSL_TLSV1, 2531280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2532280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2533280304Sjkim 128, 2534280304Sjkim 128, 2535280304Sjkim }, 2536238405Sjkim 2537280304Sjkim /* Cipher C01E */ 2538280304Sjkim { 2539280304Sjkim 1, 2540280304Sjkim TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA, 2541280304Sjkim TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA, 2542280304Sjkim SSL_kSRP, 2543280304Sjkim SSL_aRSA, 2544280304Sjkim SSL_AES128, 2545280304Sjkim SSL_SHA1, 2546280304Sjkim SSL_TLSV1, 2547280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2548280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2549280304Sjkim 128, 2550280304Sjkim 128, 2551280304Sjkim }, 2552238405Sjkim 2553280304Sjkim /* Cipher C01F */ 2554280304Sjkim { 2555280304Sjkim 1, 2556280304Sjkim TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA, 2557280304Sjkim TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA, 2558280304Sjkim SSL_kSRP, 2559280304Sjkim SSL_aDSS, 2560280304Sjkim SSL_AES128, 2561280304Sjkim SSL_SHA1, 2562280304Sjkim SSL_TLSV1, 2563280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2564280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2565280304Sjkim 128, 2566280304Sjkim 128, 2567280304Sjkim }, 2568238405Sjkim 2569280304Sjkim /* Cipher C020 */ 2570280304Sjkim { 2571280304Sjkim 1, 2572280304Sjkim TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA, 2573280304Sjkim TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA, 2574280304Sjkim SSL_kSRP, 2575280304Sjkim SSL_aSRP, 2576280304Sjkim SSL_AES256, 2577280304Sjkim SSL_SHA1, 2578280304Sjkim SSL_TLSV1, 2579280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2580280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2581280304Sjkim 256, 2582280304Sjkim 256, 2583280304Sjkim }, 2584238405Sjkim 2585280304Sjkim /* Cipher C021 */ 2586280304Sjkim { 2587280304Sjkim 1, 2588280304Sjkim TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA, 2589280304Sjkim TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA, 2590280304Sjkim SSL_kSRP, 2591280304Sjkim SSL_aRSA, 2592280304Sjkim SSL_AES256, 2593280304Sjkim SSL_SHA1, 2594280304Sjkim SSL_TLSV1, 2595280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2596280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2597280304Sjkim 256, 2598280304Sjkim 256, 2599280304Sjkim }, 2600238405Sjkim 2601280304Sjkim /* Cipher C022 */ 2602280304Sjkim { 2603280304Sjkim 1, 2604280304Sjkim TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA, 2605280304Sjkim TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA, 2606280304Sjkim SSL_kSRP, 2607280304Sjkim SSL_aDSS, 2608280304Sjkim SSL_AES256, 2609280304Sjkim SSL_SHA1, 2610280304Sjkim SSL_TLSV1, 2611280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2612280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2613280304Sjkim 256, 2614280304Sjkim 256, 2615280304Sjkim }, 2616280304Sjkim#endif /* OPENSSL_NO_SRP */ 2617238405Sjkim#ifndef OPENSSL_NO_ECDH 2618238405Sjkim 2619280304Sjkim /* HMAC based TLS v1.2 ciphersuites from RFC5289 */ 2620238405Sjkim 2621280304Sjkim /* Cipher C023 */ 2622280304Sjkim { 2623280304Sjkim 1, 2624280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256, 2625280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256, 2626280304Sjkim SSL_kEECDH, 2627280304Sjkim SSL_aECDSA, 2628280304Sjkim SSL_AES128, 2629280304Sjkim SSL_SHA256, 2630280304Sjkim SSL_TLSV1_2, 2631280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2632280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2633280304Sjkim 128, 2634280304Sjkim 128, 2635280304Sjkim }, 2636238405Sjkim 2637280304Sjkim /* Cipher C024 */ 2638280304Sjkim { 2639280304Sjkim 1, 2640280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384, 2641280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384, 2642280304Sjkim SSL_kEECDH, 2643280304Sjkim SSL_aECDSA, 2644280304Sjkim SSL_AES256, 2645280304Sjkim SSL_SHA384, 2646280304Sjkim SSL_TLSV1_2, 2647280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2648280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2649280304Sjkim 256, 2650280304Sjkim 256, 2651280304Sjkim }, 2652238405Sjkim 2653280304Sjkim /* Cipher C025 */ 2654280304Sjkim { 2655280304Sjkim 1, 2656280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256, 2657280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256, 2658280304Sjkim SSL_kECDHe, 2659280304Sjkim SSL_aECDH, 2660280304Sjkim SSL_AES128, 2661280304Sjkim SSL_SHA256, 2662280304Sjkim SSL_TLSV1_2, 2663280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2664280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2665280304Sjkim 128, 2666280304Sjkim 128, 2667280304Sjkim }, 2668238405Sjkim 2669280304Sjkim /* Cipher C026 */ 2670280304Sjkim { 2671280304Sjkim 1, 2672280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384, 2673280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384, 2674280304Sjkim SSL_kECDHe, 2675280304Sjkim SSL_aECDH, 2676280304Sjkim SSL_AES256, 2677280304Sjkim SSL_SHA384, 2678280304Sjkim SSL_TLSV1_2, 2679280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2680280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2681280304Sjkim 256, 2682280304Sjkim 256, 2683280304Sjkim }, 2684238405Sjkim 2685280304Sjkim /* Cipher C027 */ 2686280304Sjkim { 2687280304Sjkim 1, 2688280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256, 2689280304Sjkim TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256, 2690280304Sjkim SSL_kEECDH, 2691280304Sjkim SSL_aRSA, 2692280304Sjkim SSL_AES128, 2693280304Sjkim SSL_SHA256, 2694280304Sjkim SSL_TLSV1_2, 2695280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2696280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2697280304Sjkim 128, 2698280304Sjkim 128, 2699280304Sjkim }, 2700238405Sjkim 2701280304Sjkim /* Cipher C028 */ 2702280304Sjkim { 2703280304Sjkim 1, 2704280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384, 2705280304Sjkim TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384, 2706280304Sjkim SSL_kEECDH, 2707280304Sjkim SSL_aRSA, 2708280304Sjkim SSL_AES256, 2709280304Sjkim SSL_SHA384, 2710280304Sjkim SSL_TLSV1_2, 2711280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2712280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2713280304Sjkim 256, 2714280304Sjkim 256, 2715280304Sjkim }, 2716238405Sjkim 2717280304Sjkim /* Cipher C029 */ 2718280304Sjkim { 2719280304Sjkim 1, 2720280304Sjkim TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256, 2721280304Sjkim TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256, 2722280304Sjkim SSL_kECDHr, 2723280304Sjkim SSL_aECDH, 2724280304Sjkim SSL_AES128, 2725280304Sjkim SSL_SHA256, 2726280304Sjkim SSL_TLSV1_2, 2727280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2728280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2729280304Sjkim 128, 2730280304Sjkim 128, 2731280304Sjkim }, 2732238405Sjkim 2733280304Sjkim /* Cipher C02A */ 2734280304Sjkim { 2735280304Sjkim 1, 2736280304Sjkim TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384, 2737280304Sjkim TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384, 2738280304Sjkim SSL_kECDHr, 2739280304Sjkim SSL_aECDH, 2740280304Sjkim SSL_AES256, 2741280304Sjkim SSL_SHA384, 2742280304Sjkim SSL_TLSV1_2, 2743280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2744280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2745280304Sjkim 256, 2746280304Sjkim 256, 2747280304Sjkim }, 2748238405Sjkim 2749280304Sjkim /* GCM based TLS v1.2 ciphersuites from RFC5289 */ 2750238405Sjkim 2751280304Sjkim /* Cipher C02B */ 2752280304Sjkim { 2753280304Sjkim 1, 2754280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 2755280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 2756280304Sjkim SSL_kEECDH, 2757280304Sjkim SSL_aECDSA, 2758280304Sjkim SSL_AES128GCM, 2759280304Sjkim SSL_AEAD, 2760280304Sjkim SSL_TLSV1_2, 2761280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2762280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2763280304Sjkim 128, 2764280304Sjkim 128, 2765280304Sjkim }, 2766238405Sjkim 2767280304Sjkim /* Cipher C02C */ 2768280304Sjkim { 2769280304Sjkim 1, 2770280304Sjkim TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 2771280304Sjkim TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 2772280304Sjkim SSL_kEECDH, 2773280304Sjkim SSL_aECDSA, 2774280304Sjkim SSL_AES256GCM, 2775280304Sjkim SSL_AEAD, 2776280304Sjkim SSL_TLSV1_2, 2777280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2778280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2779280304Sjkim 256, 2780280304Sjkim 256, 2781280304Sjkim }, 2782238405Sjkim 2783280304Sjkim /* Cipher C02D */ 2784280304Sjkim { 2785280304Sjkim 1, 2786280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, 2787280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, 2788280304Sjkim SSL_kECDHe, 2789280304Sjkim SSL_aECDH, 2790280304Sjkim SSL_AES128GCM, 2791280304Sjkim SSL_AEAD, 2792280304Sjkim SSL_TLSV1_2, 2793280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2794280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2795280304Sjkim 128, 2796280304Sjkim 128, 2797280304Sjkim }, 2798238405Sjkim 2799280304Sjkim /* Cipher C02E */ 2800280304Sjkim { 2801280304Sjkim 1, 2802280304Sjkim TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, 2803280304Sjkim TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, 2804280304Sjkim SSL_kECDHe, 2805280304Sjkim SSL_aECDH, 2806280304Sjkim SSL_AES256GCM, 2807280304Sjkim SSL_AEAD, 2808280304Sjkim SSL_TLSV1_2, 2809280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2810280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2811280304Sjkim 256, 2812280304Sjkim 256, 2813280304Sjkim }, 2814238405Sjkim 2815280304Sjkim /* Cipher C02F */ 2816280304Sjkim { 2817280304Sjkim 1, 2818280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 2819280304Sjkim TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 2820280304Sjkim SSL_kEECDH, 2821280304Sjkim SSL_aRSA, 2822280304Sjkim SSL_AES128GCM, 2823280304Sjkim SSL_AEAD, 2824280304Sjkim SSL_TLSV1_2, 2825280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2826280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2827280304Sjkim 128, 2828280304Sjkim 128, 2829280304Sjkim }, 2830238405Sjkim 2831280304Sjkim /* Cipher C030 */ 2832280304Sjkim { 2833280304Sjkim 1, 2834280304Sjkim TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 2835280304Sjkim TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 2836280304Sjkim SSL_kEECDH, 2837280304Sjkim SSL_aRSA, 2838280304Sjkim SSL_AES256GCM, 2839280304Sjkim SSL_AEAD, 2840280304Sjkim SSL_TLSV1_2, 2841280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2842280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2843280304Sjkim 256, 2844280304Sjkim 256, 2845280304Sjkim }, 2846238405Sjkim 2847280304Sjkim /* Cipher C031 */ 2848280304Sjkim { 2849280304Sjkim 1, 2850280304Sjkim TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256, 2851280304Sjkim TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256, 2852280304Sjkim SSL_kECDHr, 2853280304Sjkim SSL_aECDH, 2854280304Sjkim SSL_AES128GCM, 2855280304Sjkim SSL_AEAD, 2856280304Sjkim SSL_TLSV1_2, 2857280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2858280304Sjkim SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 2859280304Sjkim 128, 2860280304Sjkim 128, 2861280304Sjkim }, 2862238405Sjkim 2863280304Sjkim /* Cipher C032 */ 2864280304Sjkim { 2865280304Sjkim 1, 2866280304Sjkim TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384, 2867280304Sjkim TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384, 2868280304Sjkim SSL_kECDHr, 2869280304Sjkim SSL_aECDH, 2870280304Sjkim SSL_AES256GCM, 2871280304Sjkim SSL_AEAD, 2872280304Sjkim SSL_TLSV1_2, 2873280304Sjkim SSL_NOT_EXP | SSL_HIGH | SSL_FIPS, 2874280304Sjkim SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 2875280304Sjkim 256, 2876280304Sjkim 256, 2877280304Sjkim }, 2878238405Sjkim 2879280304Sjkim#endif /* OPENSSL_NO_ECDH */ 2880238405Sjkim 2881238405Sjkim#ifdef TEMP_GOST_TLS 2882238405Sjkim/* Cipher FF00 */ 2883280304Sjkim { 2884280304Sjkim 1, 2885280304Sjkim "GOST-MD5", 2886280304Sjkim 0x0300ff00, 2887280304Sjkim SSL_kRSA, 2888280304Sjkim SSL_aRSA, 2889280304Sjkim SSL_eGOST2814789CNT, 2890280304Sjkim SSL_MD5, 2891280304Sjkim SSL_TLSV1, 2892280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2893280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2894280304Sjkim 256, 2895280304Sjkim 256, 2896280304Sjkim }, 2897280304Sjkim { 2898280304Sjkim 1, 2899280304Sjkim "GOST-GOST94", 2900280304Sjkim 0x0300ff01, 2901280304Sjkim SSL_kRSA, 2902280304Sjkim SSL_aRSA, 2903280304Sjkim SSL_eGOST2814789CNT, 2904280304Sjkim SSL_GOST94, 2905280304Sjkim SSL_TLSV1, 2906280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2907280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2908280304Sjkim 256, 2909280304Sjkim 256}, 2910280304Sjkim { 2911280304Sjkim 1, 2912280304Sjkim "GOST-GOST89MAC", 2913280304Sjkim 0x0300ff02, 2914280304Sjkim SSL_kRSA, 2915280304Sjkim SSL_aRSA, 2916280304Sjkim SSL_eGOST2814789CNT, 2917280304Sjkim SSL_GOST89MAC, 2918280304Sjkim SSL_TLSV1, 2919280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2920280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 2921280304Sjkim 256, 2922280304Sjkim 256}, 2923280304Sjkim { 2924280304Sjkim 1, 2925280304Sjkim "GOST-GOST89STREAM", 2926280304Sjkim 0x0300ff03, 2927280304Sjkim SSL_kRSA, 2928280304Sjkim SSL_aRSA, 2929280304Sjkim SSL_eGOST2814789CNT, 2930280304Sjkim SSL_GOST89MAC, 2931280304Sjkim SSL_TLSV1, 2932280304Sjkim SSL_NOT_EXP | SSL_HIGH, 2933280304Sjkim SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF | TLS1_STREAM_MAC, 2934280304Sjkim 256, 2935280304Sjkim 256}, 2936238405Sjkim#endif 2937238405Sjkim 293855714Skris/* end of list */ 2939280304Sjkim}; 294055714Skris 2941280304SjkimSSL3_ENC_METHOD SSLv3_enc_data = { 2942280304Sjkim ssl3_enc, 2943280304Sjkim n_ssl3_mac, 2944280304Sjkim ssl3_setup_key_block, 2945280304Sjkim ssl3_generate_master_secret, 2946280304Sjkim ssl3_change_cipher_state, 2947280304Sjkim ssl3_final_finish_mac, 2948280304Sjkim MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, 2949280304Sjkim ssl3_cert_verify_mac, 2950280304Sjkim SSL3_MD_CLIENT_FINISHED_CONST, 4, 2951280304Sjkim SSL3_MD_SERVER_FINISHED_CONST, 4, 2952280304Sjkim ssl3_alert_code, 2953280304Sjkim (int (*)(SSL *, unsigned char *, size_t, const char *, 2954280304Sjkim size_t, const unsigned char *, size_t, 2955280304Sjkim int use_context))ssl_undefined_function, 2956280304Sjkim}; 295755714Skris 2958160814Ssimonlong ssl3_default_timeout(void) 2959280304Sjkim{ 2960280304Sjkim /* 2961280304Sjkim * 2 hours, the 24 hours mentioned in the SSLv3 spec is way too long for 2962280304Sjkim * http, the cache would over fill 2963280304Sjkim */ 2964280304Sjkim return (60 * 60 * 2); 2965280304Sjkim} 296655714Skris 296755714Skrisint ssl3_num_ciphers(void) 2968280304Sjkim{ 2969280304Sjkim return (SSL3_NUM_CIPHERS); 2970280304Sjkim} 297155714Skris 2972238405Sjkimconst SSL_CIPHER *ssl3_get_cipher(unsigned int u) 2973280304Sjkim{ 2974280304Sjkim if (u < SSL3_NUM_CIPHERS) 2975280304Sjkim return (&(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u])); 2976280304Sjkim else 2977280304Sjkim return (NULL); 2978280304Sjkim} 297955714Skris 2980160814Ssimonint ssl3_pending(const SSL *s) 2981280304Sjkim{ 2982280304Sjkim if (s->rstate == SSL_ST_READ_BODY) 2983280304Sjkim return 0; 298455714Skris 2985280304Sjkim return (s->s3->rrec.type == 2986280304Sjkim SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0; 2987280304Sjkim} 2988280304Sjkim 298955714Skrisint ssl3_new(SSL *s) 2990280304Sjkim{ 2991280304Sjkim SSL3_STATE *s3; 299255714Skris 2993280304Sjkim if ((s3 = OPENSSL_malloc(sizeof *s3)) == NULL) 2994280304Sjkim goto err; 2995280304Sjkim memset(s3, 0, sizeof *s3); 2996280304Sjkim memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num)); 2997280304Sjkim memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num)); 299855714Skris 2999280304Sjkim s->s3 = s3; 300055714Skris 3001238405Sjkim#ifndef OPENSSL_NO_SRP 3002280304Sjkim SSL_SRP_CTX_init(s); 3003238405Sjkim#endif 3004280304Sjkim s->method->ssl_clear(s); 3005280304Sjkim return (1); 3006280304Sjkim err: 3007280304Sjkim return (0); 3008280304Sjkim} 300955714Skris 301055714Skrisvoid ssl3_free(SSL *s) 3011280304Sjkim{ 3012291721Sjkim if (s == NULL || s->s3 == NULL) 3013280304Sjkim return; 301455714Skris 3015238405Sjkim#ifdef TLSEXT_TYPE_opaque_prf_input 3016280304Sjkim if (s->s3->client_opaque_prf_input != NULL) 3017280304Sjkim OPENSSL_free(s->s3->client_opaque_prf_input); 3018280304Sjkim if (s->s3->server_opaque_prf_input != NULL) 3019280304Sjkim OPENSSL_free(s->s3->server_opaque_prf_input); 3020238405Sjkim#endif 3021238405Sjkim 3022280304Sjkim ssl3_cleanup_key_block(s); 3023280304Sjkim if (s->s3->rbuf.buf != NULL) 3024280304Sjkim ssl3_release_read_buffer(s); 3025280304Sjkim if (s->s3->wbuf.buf != NULL) 3026280304Sjkim ssl3_release_write_buffer(s); 3027280304Sjkim if (s->s3->rrec.comp != NULL) 3028280304Sjkim OPENSSL_free(s->s3->rrec.comp); 3029109998Smarkm#ifndef OPENSSL_NO_DH 3030280304Sjkim if (s->s3->tmp.dh != NULL) 3031280304Sjkim DH_free(s->s3->tmp.dh); 303255714Skris#endif 3033160814Ssimon#ifndef OPENSSL_NO_ECDH 3034280304Sjkim if (s->s3->tmp.ecdh != NULL) 3035280304Sjkim EC_KEY_free(s->s3->tmp.ecdh); 3036160814Ssimon#endif 3037160814Ssimon 3038280304Sjkim if (s->s3->tmp.ca_names != NULL) 3039280304Sjkim sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free); 3040280304Sjkim if (s->s3->handshake_buffer) { 3041280304Sjkim BIO_free(s->s3->handshake_buffer); 3042280304Sjkim } 3043280304Sjkim if (s->s3->handshake_dgst) 3044280304Sjkim ssl3_free_digest_list(s); 3045238405Sjkim#ifndef OPENSSL_NO_SRP 3046280304Sjkim SSL_SRP_CTX_free(s); 3047238405Sjkim#endif 3048280304Sjkim OPENSSL_cleanse(s->s3, sizeof *s->s3); 3049280304Sjkim OPENSSL_free(s->s3); 3050280304Sjkim s->s3 = NULL; 3051280304Sjkim} 305255714Skris 305355714Skrisvoid ssl3_clear(SSL *s) 3054280304Sjkim{ 3055280304Sjkim unsigned char *rp, *wp; 3056280304Sjkim size_t rlen, wlen; 3057280304Sjkim int init_extra; 305855714Skris 3059238405Sjkim#ifdef TLSEXT_TYPE_opaque_prf_input 3060280304Sjkim if (s->s3->client_opaque_prf_input != NULL) 3061280304Sjkim OPENSSL_free(s->s3->client_opaque_prf_input); 3062280304Sjkim s->s3->client_opaque_prf_input = NULL; 3063280304Sjkim if (s->s3->server_opaque_prf_input != NULL) 3064280304Sjkim OPENSSL_free(s->s3->server_opaque_prf_input); 3065280304Sjkim s->s3->server_opaque_prf_input = NULL; 3066238405Sjkim#endif 3067238405Sjkim 3068280304Sjkim ssl3_cleanup_key_block(s); 3069280304Sjkim if (s->s3->tmp.ca_names != NULL) 3070280304Sjkim sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free); 307155714Skris 3072280304Sjkim if (s->s3->rrec.comp != NULL) { 3073280304Sjkim OPENSSL_free(s->s3->rrec.comp); 3074280304Sjkim s->s3->rrec.comp = NULL; 3075280304Sjkim } 3076109998Smarkm#ifndef OPENSSL_NO_DH 3077280304Sjkim if (s->s3->tmp.dh != NULL) { 3078280304Sjkim DH_free(s->s3->tmp.dh); 3079280304Sjkim s->s3->tmp.dh = NULL; 3080280304Sjkim } 308159191Skris#endif 3082160814Ssimon#ifndef OPENSSL_NO_ECDH 3083280304Sjkim if (s->s3->tmp.ecdh != NULL) { 3084280304Sjkim EC_KEY_free(s->s3->tmp.ecdh); 3085280304Sjkim s->s3->tmp.ecdh = NULL; 3086280304Sjkim } 3087160814Ssimon#endif 3088264331Sjkim#ifndef OPENSSL_NO_TLSEXT 3089280304Sjkim# ifndef OPENSSL_NO_EC 3090280304Sjkim s->s3->is_probably_safari = 0; 3091280304Sjkim# endif /* !OPENSSL_NO_EC */ 3092280304Sjkim#endif /* !OPENSSL_NO_TLSEXT */ 309355714Skris 3094280304Sjkim rp = s->s3->rbuf.buf; 3095280304Sjkim wp = s->s3->wbuf.buf; 3096280304Sjkim rlen = s->s3->rbuf.len; 3097280304Sjkim wlen = s->s3->wbuf.len; 3098280304Sjkim init_extra = s->s3->init_extra; 3099280304Sjkim if (s->s3->handshake_buffer) { 3100280304Sjkim BIO_free(s->s3->handshake_buffer); 3101280304Sjkim s->s3->handshake_buffer = NULL; 3102280304Sjkim } 3103280304Sjkim if (s->s3->handshake_dgst) { 3104280304Sjkim ssl3_free_digest_list(s); 3105280304Sjkim } 3106280304Sjkim memset(s->s3, 0, sizeof *s->s3); 3107280304Sjkim s->s3->rbuf.buf = rp; 3108280304Sjkim s->s3->wbuf.buf = wp; 3109280304Sjkim s->s3->rbuf.len = rlen; 3110280304Sjkim s->s3->wbuf.len = wlen; 3111280304Sjkim s->s3->init_extra = init_extra; 311255714Skris 3113280304Sjkim ssl_free_wbio_buffer(s); 311455714Skris 3115280304Sjkim s->packet_length = 0; 3116280304Sjkim s->s3->renegotiate = 0; 3117280304Sjkim s->s3->total_renegotiations = 0; 3118280304Sjkim s->s3->num_renegotiations = 0; 3119280304Sjkim s->s3->in_read_app_data = 0; 3120280304Sjkim s->version = SSL3_VERSION; 3121238405Sjkim 3122238405Sjkim#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG) 3123280304Sjkim if (s->next_proto_negotiated) { 3124280304Sjkim OPENSSL_free(s->next_proto_negotiated); 3125280304Sjkim s->next_proto_negotiated = NULL; 3126280304Sjkim s->next_proto_negotiated_len = 0; 3127280304Sjkim } 3128238405Sjkim#endif 3129280304Sjkim} 313055714Skris 3131238405Sjkim#ifndef OPENSSL_NO_SRP 3132280304Sjkimstatic char *MS_CALLBACK srp_password_from_info_cb(SSL *s, void *arg) 3133280304Sjkim{ 3134280304Sjkim return BUF_strdup(s->srp_ctx.info); 3135280304Sjkim} 3136238405Sjkim#endif 3137238405Sjkim 3138109998Smarkmlong ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) 3139280304Sjkim{ 3140280304Sjkim int ret = 0; 314155714Skris 3142109998Smarkm#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA) 3143280304Sjkim if ( 3144280304Sjkim# ifndef OPENSSL_NO_RSA 3145280304Sjkim cmd == SSL_CTRL_SET_TMP_RSA || cmd == SSL_CTRL_SET_TMP_RSA_CB || 3146280304Sjkim# endif 3147280304Sjkim# ifndef OPENSSL_NO_DSA 3148280304Sjkim cmd == SSL_CTRL_SET_TMP_DH || cmd == SSL_CTRL_SET_TMP_DH_CB || 3149280304Sjkim# endif 3150280304Sjkim 0) { 3151280304Sjkim if (!ssl_cert_inst(&s->cert)) { 3152280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE); 3153280304Sjkim return (0); 3154280304Sjkim } 3155280304Sjkim } 315655714Skris#endif 315755714Skris 3158280304Sjkim switch (cmd) { 3159280304Sjkim case SSL_CTRL_GET_SESSION_REUSED: 3160280304Sjkim ret = s->hit; 3161280304Sjkim break; 3162280304Sjkim case SSL_CTRL_GET_CLIENT_CERT_REQUEST: 3163280304Sjkim break; 3164280304Sjkim case SSL_CTRL_GET_NUM_RENEGOTIATIONS: 3165280304Sjkim ret = s->s3->num_renegotiations; 3166280304Sjkim break; 3167280304Sjkim case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS: 3168280304Sjkim ret = s->s3->num_renegotiations; 3169280304Sjkim s->s3->num_renegotiations = 0; 3170280304Sjkim break; 3171280304Sjkim case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS: 3172280304Sjkim ret = s->s3->total_renegotiations; 3173280304Sjkim break; 3174280304Sjkim case SSL_CTRL_GET_FLAGS: 3175280304Sjkim ret = (int)(s->s3->flags); 3176280304Sjkim break; 3177109998Smarkm#ifndef OPENSSL_NO_RSA 3178280304Sjkim case SSL_CTRL_NEED_TMP_RSA: 3179280304Sjkim if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) && 3180280304Sjkim ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 3181280304Sjkim (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > 3182280304Sjkim (512 / 8)))) 3183280304Sjkim ret = 1; 3184280304Sjkim break; 3185280304Sjkim case SSL_CTRL_SET_TMP_RSA: 3186280304Sjkim { 3187280304Sjkim RSA *rsa = (RSA *)parg; 3188280304Sjkim if (rsa == NULL) { 3189280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 3190280304Sjkim return (ret); 3191280304Sjkim } 3192280304Sjkim if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) { 3193280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB); 3194280304Sjkim return (ret); 3195280304Sjkim } 3196280304Sjkim if (s->cert->rsa_tmp != NULL) 3197280304Sjkim RSA_free(s->cert->rsa_tmp); 3198280304Sjkim s->cert->rsa_tmp = rsa; 3199280304Sjkim ret = 1; 3200280304Sjkim } 3201280304Sjkim break; 3202280304Sjkim case SSL_CTRL_SET_TMP_RSA_CB: 3203280304Sjkim { 3204280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3205280304Sjkim return (ret); 3206280304Sjkim } 3207280304Sjkim break; 320855714Skris#endif 3209109998Smarkm#ifndef OPENSSL_NO_DH 3210280304Sjkim case SSL_CTRL_SET_TMP_DH: 3211280304Sjkim { 3212280304Sjkim DH *dh = (DH *)parg; 3213280304Sjkim if (dh == NULL) { 3214280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 3215280304Sjkim return (ret); 3216280304Sjkim } 3217280304Sjkim if ((dh = DHparams_dup(dh)) == NULL) { 3218280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 3219280304Sjkim return (ret); 3220280304Sjkim } 3221280304Sjkim if (s->cert->dh_tmp != NULL) 3222280304Sjkim DH_free(s->cert->dh_tmp); 3223280304Sjkim s->cert->dh_tmp = dh; 3224280304Sjkim ret = 1; 3225280304Sjkim } 3226280304Sjkim break; 3227280304Sjkim case SSL_CTRL_SET_TMP_DH_CB: 3228280304Sjkim { 3229280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3230280304Sjkim return (ret); 3231280304Sjkim } 3232280304Sjkim break; 323355714Skris#endif 3234160814Ssimon#ifndef OPENSSL_NO_ECDH 3235280304Sjkim case SSL_CTRL_SET_TMP_ECDH: 3236280304Sjkim { 3237280304Sjkim EC_KEY *ecdh = NULL; 3238280304Sjkim 3239280304Sjkim if (parg == NULL) { 3240280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 3241280304Sjkim return (ret); 3242280304Sjkim } 3243280304Sjkim if (!EC_KEY_up_ref((EC_KEY *)parg)) { 3244280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_ECDH_LIB); 3245280304Sjkim return (ret); 3246280304Sjkim } 3247280304Sjkim ecdh = (EC_KEY *)parg; 3248280304Sjkim if (!(s->options & SSL_OP_SINGLE_ECDH_USE)) { 3249280304Sjkim if (!EC_KEY_generate_key(ecdh)) { 3250280304Sjkim EC_KEY_free(ecdh); 3251280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_ECDH_LIB); 3252280304Sjkim return (ret); 3253280304Sjkim } 3254280304Sjkim } 3255280304Sjkim if (s->cert->ecdh_tmp != NULL) 3256280304Sjkim EC_KEY_free(s->cert->ecdh_tmp); 3257280304Sjkim s->cert->ecdh_tmp = ecdh; 3258280304Sjkim ret = 1; 3259280304Sjkim } 3260280304Sjkim break; 3261280304Sjkim case SSL_CTRL_SET_TMP_ECDH_CB: 3262280304Sjkim { 3263280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3264280304Sjkim return (ret); 3265280304Sjkim } 3266280304Sjkim break; 3267280304Sjkim#endif /* !OPENSSL_NO_ECDH */ 3268194206Ssimon#ifndef OPENSSL_NO_TLSEXT 3269280304Sjkim case SSL_CTRL_SET_TLSEXT_HOSTNAME: 3270280304Sjkim if (larg == TLSEXT_NAMETYPE_host_name) { 3271295016Sjkim size_t len; 3272295016Sjkim 3273280304Sjkim if (s->tlsext_hostname != NULL) 3274280304Sjkim OPENSSL_free(s->tlsext_hostname); 3275280304Sjkim s->tlsext_hostname = NULL; 3276194206Ssimon 3277280304Sjkim ret = 1; 3278280304Sjkim if (parg == NULL) 3279280304Sjkim break; 3280295016Sjkim len = strlen((char *)parg); 3281295016Sjkim if (len == 0 || len > TLSEXT_MAXLEN_host_name) { 3282280304Sjkim SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME); 3283280304Sjkim return 0; 3284280304Sjkim } 3285280304Sjkim if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL) { 3286280304Sjkim SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR); 3287280304Sjkim return 0; 3288280304Sjkim } 3289280304Sjkim } else { 3290280304Sjkim SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE); 3291280304Sjkim return 0; 3292280304Sjkim } 3293280304Sjkim break; 3294280304Sjkim case SSL_CTRL_SET_TLSEXT_DEBUG_ARG: 3295280304Sjkim s->tlsext_debug_arg = parg; 3296280304Sjkim ret = 1; 3297280304Sjkim break; 3298238405Sjkim 3299280304Sjkim# ifdef TLSEXT_TYPE_opaque_prf_input 3300280304Sjkim case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT: 3301280304Sjkim if (larg > 12288) { /* actual internal limit is 2^16 for the 3302280304Sjkim * complete hello message * (including the 3303280304Sjkim * cert chain and everything) */ 3304280304Sjkim SSLerr(SSL_F_SSL3_CTRL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG); 3305280304Sjkim break; 3306280304Sjkim } 3307280304Sjkim if (s->tlsext_opaque_prf_input != NULL) 3308280304Sjkim OPENSSL_free(s->tlsext_opaque_prf_input); 3309280304Sjkim if ((size_t)larg == 0) 3310280304Sjkim s->tlsext_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte 3311280304Sjkim * just to get 3312280304Sjkim * non-NULL */ 3313280304Sjkim else 3314280304Sjkim s->tlsext_opaque_prf_input = BUF_memdup(parg, (size_t)larg); 3315280304Sjkim if (s->tlsext_opaque_prf_input != NULL) { 3316280304Sjkim s->tlsext_opaque_prf_input_len = (size_t)larg; 3317280304Sjkim ret = 1; 3318280304Sjkim } else 3319280304Sjkim s->tlsext_opaque_prf_input_len = 0; 3320280304Sjkim break; 3321280304Sjkim# endif 3322238405Sjkim 3323280304Sjkim case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE: 3324280304Sjkim s->tlsext_status_type = larg; 3325280304Sjkim ret = 1; 3326280304Sjkim break; 3327194206Ssimon 3328280304Sjkim case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS: 3329280304Sjkim *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts; 3330280304Sjkim ret = 1; 3331280304Sjkim break; 3332194206Ssimon 3333280304Sjkim case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS: 3334280304Sjkim s->tlsext_ocsp_exts = parg; 3335280304Sjkim ret = 1; 3336280304Sjkim break; 3337194206Ssimon 3338280304Sjkim case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS: 3339280304Sjkim *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids; 3340280304Sjkim ret = 1; 3341280304Sjkim break; 3342194206Ssimon 3343280304Sjkim case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS: 3344280304Sjkim s->tlsext_ocsp_ids = parg; 3345280304Sjkim ret = 1; 3346280304Sjkim break; 3347194206Ssimon 3348280304Sjkim case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP: 3349280304Sjkim *(unsigned char **)parg = s->tlsext_ocsp_resp; 3350280304Sjkim return s->tlsext_ocsp_resplen; 3351194206Ssimon 3352280304Sjkim case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP: 3353280304Sjkim if (s->tlsext_ocsp_resp) 3354280304Sjkim OPENSSL_free(s->tlsext_ocsp_resp); 3355280304Sjkim s->tlsext_ocsp_resp = parg; 3356280304Sjkim s->tlsext_ocsp_resplen = larg; 3357280304Sjkim ret = 1; 3358280304Sjkim break; 3359238405Sjkim 3360280304Sjkim# ifndef OPENSSL_NO_HEARTBEATS 3361280304Sjkim case SSL_CTRL_TLS_EXT_SEND_HEARTBEAT: 3362280304Sjkim if (SSL_version(s) == DTLS1_VERSION 3363280304Sjkim || SSL_version(s) == DTLS1_BAD_VER) 3364280304Sjkim ret = dtls1_heartbeat(s); 3365280304Sjkim else 3366280304Sjkim ret = tls1_heartbeat(s); 3367280304Sjkim break; 3368238405Sjkim 3369280304Sjkim case SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING: 3370280304Sjkim ret = s->tlsext_hb_pending; 3371280304Sjkim break; 3372238405Sjkim 3373280304Sjkim case SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS: 3374280304Sjkim if (larg) 3375280304Sjkim s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_RECV_REQUESTS; 3376280304Sjkim else 3377280304Sjkim s->tlsext_heartbeat &= ~SSL_TLSEXT_HB_DONT_RECV_REQUESTS; 3378280304Sjkim ret = 1; 3379280304Sjkim break; 3380280304Sjkim# endif 3381273149Sjkim 3382280304Sjkim#endif /* !OPENSSL_NO_TLSEXT */ 3383280304Sjkim 3384280304Sjkim case SSL_CTRL_CHECK_PROTO_VERSION: 3385280304Sjkim /* 3386280304Sjkim * For library-internal use; checks that the current protocol is the 3387280304Sjkim * highest enabled version (according to s->ctx->method, as version 3388280304Sjkim * negotiation may have changed s->method). 3389280304Sjkim */ 3390280304Sjkim if (s->version == s->ctx->method->version) 3391280304Sjkim return 1; 3392280304Sjkim /* 3393280304Sjkim * Apparently we're using a version-flexible SSL_METHOD (not at its 3394280304Sjkim * highest protocol version). 3395280304Sjkim */ 3396280304Sjkim if (s->ctx->method->version == SSLv23_method()->version) { 3397273149Sjkim#if TLS_MAX_VERSION != TLS1_2_VERSION 3398280304Sjkim# error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION. 3399273149Sjkim#endif 3400280304Sjkim if (!(s->options & SSL_OP_NO_TLSv1_2)) 3401280304Sjkim return s->version == TLS1_2_VERSION; 3402280304Sjkim if (!(s->options & SSL_OP_NO_TLSv1_1)) 3403280304Sjkim return s->version == TLS1_1_VERSION; 3404280304Sjkim if (!(s->options & SSL_OP_NO_TLSv1)) 3405280304Sjkim return s->version == TLS1_VERSION; 3406280304Sjkim if (!(s->options & SSL_OP_NO_SSLv3)) 3407280304Sjkim return s->version == SSL3_VERSION; 3408280304Sjkim if (!(s->options & SSL_OP_NO_SSLv2)) 3409280304Sjkim return s->version == SSL2_VERSION; 3410280304Sjkim } 3411280304Sjkim return 0; /* Unexpected state; fail closed. */ 3412273149Sjkim 3413280304Sjkim default: 3414280304Sjkim break; 3415280304Sjkim } 3416280304Sjkim return (ret); 3417280304Sjkim} 341855714Skris 3419280304Sjkimlong ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void)) 3420280304Sjkim{ 3421280304Sjkim int ret = 0; 342259191Skris 3423109998Smarkm#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA) 3424280304Sjkim if ( 3425280304Sjkim# ifndef OPENSSL_NO_RSA 3426280304Sjkim cmd == SSL_CTRL_SET_TMP_RSA_CB || 3427280304Sjkim# endif 3428280304Sjkim# ifndef OPENSSL_NO_DSA 3429280304Sjkim cmd == SSL_CTRL_SET_TMP_DH_CB || 3430280304Sjkim# endif 3431280304Sjkim 0) { 3432280304Sjkim if (!ssl_cert_inst(&s->cert)) { 3433280304Sjkim SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE); 3434280304Sjkim return (0); 3435280304Sjkim } 3436280304Sjkim } 343759191Skris#endif 343859191Skris 3439280304Sjkim switch (cmd) { 3440109998Smarkm#ifndef OPENSSL_NO_RSA 3441280304Sjkim case SSL_CTRL_SET_TMP_RSA_CB: 3442280304Sjkim { 3443280304Sjkim s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 3444280304Sjkim } 3445280304Sjkim break; 344659191Skris#endif 3447109998Smarkm#ifndef OPENSSL_NO_DH 3448280304Sjkim case SSL_CTRL_SET_TMP_DH_CB: 3449280304Sjkim { 3450280304Sjkim s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 3451280304Sjkim } 3452280304Sjkim break; 345359191Skris#endif 3454160814Ssimon#ifndef OPENSSL_NO_ECDH 3455280304Sjkim case SSL_CTRL_SET_TMP_ECDH_CB: 3456280304Sjkim { 3457280304Sjkim s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp; 3458280304Sjkim } 3459280304Sjkim break; 3460160814Ssimon#endif 3461194206Ssimon#ifndef OPENSSL_NO_TLSEXT 3462280304Sjkim case SSL_CTRL_SET_TLSEXT_DEBUG_CB: 3463280304Sjkim s->tlsext_debug_cb = (void (*)(SSL *, int, int, 3464280304Sjkim unsigned char *, int, void *))fp; 3465280304Sjkim break; 3466194206Ssimon#endif 3467280304Sjkim default: 3468280304Sjkim break; 3469280304Sjkim } 3470280304Sjkim return (ret); 3471280304Sjkim} 347259191Skris 3473109998Smarkmlong ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) 3474280304Sjkim{ 3475280304Sjkim CERT *cert; 347655714Skris 3477280304Sjkim cert = ctx->cert; 347855714Skris 3479280304Sjkim switch (cmd) { 3480109998Smarkm#ifndef OPENSSL_NO_RSA 3481280304Sjkim case SSL_CTRL_NEED_TMP_RSA: 3482280304Sjkim if ((cert->rsa_tmp == NULL) && 3483280304Sjkim ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 3484280304Sjkim (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > 3485280304Sjkim (512 / 8))) 3486280304Sjkim ) 3487280304Sjkim return (1); 3488280304Sjkim else 3489280304Sjkim return (0); 3490280304Sjkim /* break; */ 3491280304Sjkim case SSL_CTRL_SET_TMP_RSA: 3492280304Sjkim { 3493280304Sjkim RSA *rsa; 3494280304Sjkim int i; 349555714Skris 3496280304Sjkim rsa = (RSA *)parg; 3497280304Sjkim i = 1; 3498280304Sjkim if (rsa == NULL) 3499280304Sjkim i = 0; 3500280304Sjkim else { 3501280304Sjkim if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) 3502280304Sjkim i = 0; 3503280304Sjkim } 3504280304Sjkim if (!i) { 3505280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_RSA_LIB); 3506280304Sjkim return (0); 3507280304Sjkim } else { 3508280304Sjkim if (cert->rsa_tmp != NULL) 3509280304Sjkim RSA_free(cert->rsa_tmp); 3510280304Sjkim cert->rsa_tmp = rsa; 3511280304Sjkim return (1); 3512280304Sjkim } 3513280304Sjkim } 3514280304Sjkim /* break; */ 3515280304Sjkim case SSL_CTRL_SET_TMP_RSA_CB: 3516280304Sjkim { 3517280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3518280304Sjkim return (0); 3519280304Sjkim } 3520280304Sjkim break; 352155714Skris#endif 3522109998Smarkm#ifndef OPENSSL_NO_DH 3523280304Sjkim case SSL_CTRL_SET_TMP_DH: 3524280304Sjkim { 3525280304Sjkim DH *new = NULL, *dh; 352655714Skris 3527280304Sjkim dh = (DH *)parg; 3528280304Sjkim if ((new = DHparams_dup(dh)) == NULL) { 3529280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB); 3530280304Sjkim return 0; 3531280304Sjkim } 3532280304Sjkim if (cert->dh_tmp != NULL) 3533280304Sjkim DH_free(cert->dh_tmp); 3534280304Sjkim cert->dh_tmp = new; 3535280304Sjkim return 1; 3536280304Sjkim } 3537280304Sjkim /* 3538280304Sjkim * break; 3539280304Sjkim */ 3540280304Sjkim case SSL_CTRL_SET_TMP_DH_CB: 3541280304Sjkim { 3542280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3543280304Sjkim return (0); 3544280304Sjkim } 3545280304Sjkim break; 354655714Skris#endif 3547160814Ssimon#ifndef OPENSSL_NO_ECDH 3548280304Sjkim case SSL_CTRL_SET_TMP_ECDH: 3549280304Sjkim { 3550280304Sjkim EC_KEY *ecdh = NULL; 3551160814Ssimon 3552280304Sjkim if (parg == NULL) { 3553280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_ECDH_LIB); 3554280304Sjkim return 0; 3555280304Sjkim } 3556280304Sjkim ecdh = EC_KEY_dup((EC_KEY *)parg); 3557280304Sjkim if (ecdh == NULL) { 3558280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_EC_LIB); 3559280304Sjkim return 0; 3560280304Sjkim } 3561280304Sjkim if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE)) { 3562280304Sjkim if (!EC_KEY_generate_key(ecdh)) { 3563280304Sjkim EC_KEY_free(ecdh); 3564280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_ECDH_LIB); 3565280304Sjkim return 0; 3566280304Sjkim } 3567280304Sjkim } 3568280304Sjkim 3569280304Sjkim if (cert->ecdh_tmp != NULL) { 3570280304Sjkim EC_KEY_free(cert->ecdh_tmp); 3571280304Sjkim } 3572280304Sjkim cert->ecdh_tmp = ecdh; 3573280304Sjkim return 1; 3574280304Sjkim } 3575280304Sjkim /* break; */ 3576280304Sjkim case SSL_CTRL_SET_TMP_ECDH_CB: 3577280304Sjkim { 3578280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3579280304Sjkim return (0); 3580280304Sjkim } 3581280304Sjkim break; 3582280304Sjkim#endif /* !OPENSSL_NO_ECDH */ 3583194206Ssimon#ifndef OPENSSL_NO_TLSEXT 3584280304Sjkim case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG: 3585280304Sjkim ctx->tlsext_servername_arg = parg; 3586280304Sjkim break; 3587280304Sjkim case SSL_CTRL_SET_TLSEXT_TICKET_KEYS: 3588280304Sjkim case SSL_CTRL_GET_TLSEXT_TICKET_KEYS: 3589280304Sjkim { 3590280304Sjkim unsigned char *keys = parg; 3591280304Sjkim if (!keys) 3592280304Sjkim return 48; 3593280304Sjkim if (larg != 48) { 3594280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH); 3595280304Sjkim return 0; 3596280304Sjkim } 3597280304Sjkim if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) { 3598280304Sjkim memcpy(ctx->tlsext_tick_key_name, keys, 16); 3599280304Sjkim memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16); 3600280304Sjkim memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16); 3601280304Sjkim } else { 3602280304Sjkim memcpy(keys, ctx->tlsext_tick_key_name, 16); 3603280304Sjkim memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16); 3604280304Sjkim memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16); 3605280304Sjkim } 3606280304Sjkim return 1; 3607280304Sjkim } 3608238405Sjkim 3609280304Sjkim# ifdef TLSEXT_TYPE_opaque_prf_input 3610280304Sjkim case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG: 3611280304Sjkim ctx->tlsext_opaque_prf_input_callback_arg = parg; 3612280304Sjkim return 1; 3613280304Sjkim# endif 3614238405Sjkim 3615280304Sjkim case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG: 3616280304Sjkim ctx->tlsext_status_arg = parg; 3617280304Sjkim return 1; 3618280304Sjkim break; 3619194206Ssimon 3620280304Sjkim# ifndef OPENSSL_NO_SRP 3621280304Sjkim case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME: 3622280304Sjkim ctx->srp_ctx.srp_Mask |= SSL_kSRP; 3623280304Sjkim if (ctx->srp_ctx.login != NULL) 3624280304Sjkim OPENSSL_free(ctx->srp_ctx.login); 3625280304Sjkim ctx->srp_ctx.login = NULL; 3626280304Sjkim if (parg == NULL) 3627280304Sjkim break; 3628280304Sjkim if (strlen((const char *)parg) > 255 3629280304Sjkim || strlen((const char *)parg) < 1) { 3630280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME); 3631280304Sjkim return 0; 3632280304Sjkim } 3633280304Sjkim if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL) { 3634280304Sjkim SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR); 3635280304Sjkim return 0; 3636280304Sjkim } 3637280304Sjkim break; 3638280304Sjkim case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD: 3639280304Sjkim ctx->srp_ctx.SRP_give_srp_client_pwd_callback = 3640280304Sjkim srp_password_from_info_cb; 3641280304Sjkim ctx->srp_ctx.info = parg; 3642280304Sjkim break; 3643280304Sjkim case SSL_CTRL_SET_SRP_ARG: 3644280304Sjkim ctx->srp_ctx.srp_Mask |= SSL_kSRP; 3645280304Sjkim ctx->srp_ctx.SRP_cb_arg = parg; 3646280304Sjkim break; 3647238405Sjkim 3648280304Sjkim case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH: 3649280304Sjkim ctx->srp_ctx.strength = larg; 3650280304Sjkim break; 3651280304Sjkim# endif 3652280304Sjkim#endif /* !OPENSSL_NO_TLSEXT */ 3653238405Sjkim 3654280304Sjkim /* A Thawte special :-) */ 3655280304Sjkim case SSL_CTRL_EXTRA_CHAIN_CERT: 3656280304Sjkim if (ctx->extra_certs == NULL) { 3657280304Sjkim if ((ctx->extra_certs = sk_X509_new_null()) == NULL) 3658280304Sjkim return (0); 3659280304Sjkim } 3660280304Sjkim sk_X509_push(ctx->extra_certs, (X509 *)parg); 3661280304Sjkim break; 366255714Skris 3663280304Sjkim case SSL_CTRL_GET_EXTRA_CHAIN_CERTS: 3664280304Sjkim *(STACK_OF(X509) **)parg = ctx->extra_certs; 3665280304Sjkim break; 3666238405Sjkim 3667280304Sjkim case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS: 3668280304Sjkim if (ctx->extra_certs) { 3669280304Sjkim sk_X509_pop_free(ctx->extra_certs, X509_free); 3670280304Sjkim ctx->extra_certs = NULL; 3671280304Sjkim } 3672280304Sjkim break; 3673238405Sjkim 3674280304Sjkim default: 3675280304Sjkim return (0); 3676280304Sjkim } 3677280304Sjkim return (1); 3678280304Sjkim} 367955714Skris 3680280304Sjkimlong ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void)) 3681280304Sjkim{ 3682280304Sjkim CERT *cert; 368359191Skris 3684280304Sjkim cert = ctx->cert; 368559191Skris 3686280304Sjkim switch (cmd) { 3687109998Smarkm#ifndef OPENSSL_NO_RSA 3688280304Sjkim case SSL_CTRL_SET_TMP_RSA_CB: 3689280304Sjkim { 3690280304Sjkim cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 3691280304Sjkim } 3692280304Sjkim break; 369359191Skris#endif 3694109998Smarkm#ifndef OPENSSL_NO_DH 3695280304Sjkim case SSL_CTRL_SET_TMP_DH_CB: 3696280304Sjkim { 3697280304Sjkim cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 3698280304Sjkim } 3699280304Sjkim break; 370059191Skris#endif 3701160814Ssimon#ifndef OPENSSL_NO_ECDH 3702280304Sjkim case SSL_CTRL_SET_TMP_ECDH_CB: 3703280304Sjkim { 3704280304Sjkim cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp; 3705280304Sjkim } 3706280304Sjkim break; 3707160814Ssimon#endif 3708194206Ssimon#ifndef OPENSSL_NO_TLSEXT 3709280304Sjkim case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB: 3710280304Sjkim ctx->tlsext_servername_callback = (int (*)(SSL *, int *, void *))fp; 3711280304Sjkim break; 3712238405Sjkim 3713280304Sjkim# ifdef TLSEXT_TYPE_opaque_prf_input 3714280304Sjkim case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB: 3715280304Sjkim ctx->tlsext_opaque_prf_input_callback = 3716280304Sjkim (int (*)(SSL *, void *, size_t, void *))fp; 3717280304Sjkim break; 3718280304Sjkim# endif 3719238405Sjkim 3720280304Sjkim case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB: 3721280304Sjkim ctx->tlsext_status_cb = (int (*)(SSL *, void *))fp; 3722280304Sjkim break; 3723194206Ssimon 3724280304Sjkim case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB: 3725280304Sjkim ctx->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char *, 3726280304Sjkim unsigned char *, 3727280304Sjkim EVP_CIPHER_CTX *, 3728280304Sjkim HMAC_CTX *, int))fp; 3729280304Sjkim break; 3730194206Ssimon 3731280304Sjkim# ifndef OPENSSL_NO_SRP 3732280304Sjkim case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB: 3733280304Sjkim ctx->srp_ctx.srp_Mask |= SSL_kSRP; 3734280304Sjkim ctx->srp_ctx.SRP_verify_param_callback = (int (*)(SSL *, void *))fp; 3735280304Sjkim break; 3736280304Sjkim case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB: 3737280304Sjkim ctx->srp_ctx.srp_Mask |= SSL_kSRP; 3738280304Sjkim ctx->srp_ctx.TLS_ext_srp_username_callback = 3739280304Sjkim (int (*)(SSL *, int *, void *))fp; 3740280304Sjkim break; 3741280304Sjkim case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB: 3742280304Sjkim ctx->srp_ctx.srp_Mask |= SSL_kSRP; 3743280304Sjkim ctx->srp_ctx.SRP_give_srp_client_pwd_callback = 3744280304Sjkim (char *(*)(SSL *, void *))fp; 3745280304Sjkim break; 3746280304Sjkim# endif 3747194206Ssimon#endif 3748273149Sjkim 3749280304Sjkim default: 3750280304Sjkim return (0); 3751280304Sjkim } 3752280304Sjkim return (1); 3753280304Sjkim} 375459191Skris 3755280304Sjkim/* 3756280304Sjkim * This function needs to check if the ciphers required are actually 3757280304Sjkim * available 3758280304Sjkim */ 3759238405Sjkimconst SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p) 3760280304Sjkim{ 3761280304Sjkim SSL_CIPHER c; 3762280304Sjkim const SSL_CIPHER *cp; 3763280304Sjkim unsigned long id; 376455714Skris 3765280304Sjkim id = 0x03000000L | ((unsigned long)p[0] << 8L) | (unsigned long)p[1]; 3766280304Sjkim c.id = id; 3767280304Sjkim cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS); 3768238405Sjkim#ifdef DEBUG_PRINT_UNKNOWN_CIPHERSUITES 3769280304Sjkim if (cp == NULL) 3770280304Sjkim fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]); 3771238405Sjkim#endif 3772280304Sjkim if (cp == NULL || cp->valid == 0) 3773280304Sjkim return NULL; 3774280304Sjkim else 3775280304Sjkim return cp; 3776280304Sjkim} 377755714Skris 377855714Skrisint ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p) 3779280304Sjkim{ 3780280304Sjkim long l; 378155714Skris 3782280304Sjkim if (p != NULL) { 3783280304Sjkim l = c->id; 3784280304Sjkim if ((l & 0xff000000) != 0x03000000) 3785280304Sjkim return (0); 3786280304Sjkim p[0] = ((unsigned char)(l >> 8L)) & 0xFF; 3787280304Sjkim p[1] = ((unsigned char)(l)) & 0xFF; 3788280304Sjkim } 3789280304Sjkim return (2); 3790280304Sjkim} 379155714Skris 3792109998SmarkmSSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, 3793280304Sjkim STACK_OF(SSL_CIPHER) *srvr) 3794280304Sjkim{ 3795280304Sjkim SSL_CIPHER *c, *ret = NULL; 3796280304Sjkim STACK_OF(SSL_CIPHER) *prio, *allow; 3797280304Sjkim int i, ii, ok; 3798238405Sjkim#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_EC) 3799280304Sjkim unsigned int j; 3800280304Sjkim int ec_ok, ec_nid; 3801280304Sjkim unsigned char ec_search1 = 0, ec_search2 = 0; 3802238405Sjkim#endif 3803280304Sjkim CERT *cert; 3804280304Sjkim unsigned long alg_k, alg_a, mask_k, mask_a, emask_k, emask_a; 380555714Skris 3806280304Sjkim /* Let's see which ciphers we can support */ 3807280304Sjkim cert = s->cert; 380855714Skris 3809109998Smarkm#if 0 3810280304Sjkim /* 3811280304Sjkim * Do not set the compare functions, because this may lead to a 3812280304Sjkim * reordering by "id". We want to keep the original ordering. We may pay 3813280304Sjkim * a price in performance during sk_SSL_CIPHER_find(), but would have to 3814280304Sjkim * pay with the price of sk_SSL_CIPHER_dup(). 3815280304Sjkim */ 3816280304Sjkim sk_SSL_CIPHER_set_cmp_func(srvr, ssl_cipher_ptr_id_cmp); 3817280304Sjkim sk_SSL_CIPHER_set_cmp_func(clnt, ssl_cipher_ptr_id_cmp); 3818109998Smarkm#endif 381955714Skris 382055714Skris#ifdef CIPHER_DEBUG 3821280304Sjkim fprintf(stderr, "Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), 3822280304Sjkim (void *)srvr); 3823280304Sjkim for (i = 0; i < sk_SSL_CIPHER_num(srvr); ++i) { 3824280304Sjkim c = sk_SSL_CIPHER_value(srvr, i); 3825280304Sjkim fprintf(stderr, "%p:%s\n", (void *)c, c->name); 3826280304Sjkim } 3827280304Sjkim fprintf(stderr, "Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), 3828280304Sjkim (void *)clnt); 3829280304Sjkim for (i = 0; i < sk_SSL_CIPHER_num(clnt); ++i) { 3830280304Sjkim c = sk_SSL_CIPHER_value(clnt, i); 3831280304Sjkim fprintf(stderr, "%p:%s\n", (void *)c, c->name); 3832280304Sjkim } 383355714Skris#endif 383455714Skris 3835280304Sjkim if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) { 3836280304Sjkim prio = srvr; 3837280304Sjkim allow = clnt; 3838280304Sjkim } else { 3839280304Sjkim prio = clnt; 3840280304Sjkim allow = srvr; 3841280304Sjkim } 3842109998Smarkm 3843280304Sjkim for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) { 3844280304Sjkim c = sk_SSL_CIPHER_value(prio, i); 384555714Skris 3846280304Sjkim /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */ 3847280304Sjkim if ((c->algorithm_ssl & SSL_TLSV1_2) && 3848280304Sjkim (TLS1_get_version(s) < TLS1_2_VERSION)) 3849280304Sjkim continue; 3850238405Sjkim 3851280304Sjkim ssl_set_cert_masks(cert, c); 3852280304Sjkim mask_k = cert->mask_k; 3853280304Sjkim mask_a = cert->mask_a; 3854280304Sjkim emask_k = cert->export_mask_k; 3855280304Sjkim emask_a = cert->export_mask_a; 3856238405Sjkim#ifndef OPENSSL_NO_SRP 3857280304Sjkim if (s->srp_ctx.srp_Mask & SSL_kSRP) { 3858280304Sjkim mask_k |= SSL_kSRP; 3859280304Sjkim emask_k |= SSL_kSRP; 3860280304Sjkim mask_a |= SSL_aSRP; 3861280304Sjkim emask_a |= SSL_aSRP; 3862280304Sjkim } 3863238405Sjkim#endif 3864273149Sjkim 3865109998Smarkm#ifdef KSSL_DEBUG 3866280304Sjkim /* 3867280304Sjkim * fprintf(stderr,"ssl3_choose_cipher %d alg= %lx\n", 3868280304Sjkim * i,c->algorithms); 3869280304Sjkim */ 3870280304Sjkim#endif /* KSSL_DEBUG */ 3871109998Smarkm 3872280304Sjkim alg_k = c->algorithm_mkey; 3873280304Sjkim alg_a = c->algorithm_auth; 3874238405Sjkim 3875109998Smarkm#ifndef OPENSSL_NO_KRB5 3876280304Sjkim if (alg_k & SSL_kKRB5) { 3877280304Sjkim if (!kssl_keytab_is_available(s->kssl_ctx)) 3878280304Sjkim continue; 3879280304Sjkim } 3880280304Sjkim#endif /* OPENSSL_NO_KRB5 */ 3881238405Sjkim#ifndef OPENSSL_NO_PSK 3882280304Sjkim /* with PSK there must be server callback set */ 3883280304Sjkim if ((alg_k & SSL_kPSK) && s->psk_server_callback == NULL) 3884280304Sjkim continue; 3885280304Sjkim#endif /* OPENSSL_NO_PSK */ 3886238405Sjkim 3887280304Sjkim if (SSL_C_IS_EXPORT(c)) { 3888280304Sjkim ok = (alg_k & emask_k) && (alg_a & emask_a); 388955714Skris#ifdef CIPHER_DEBUG 3890280304Sjkim fprintf(stderr, "%d:[%08lX:%08lX:%08lX:%08lX]%p:%s (export)\n", 3891280304Sjkim ok, alg_k, alg_a, emask_k, emask_a, (void *)c, c->name); 389255714Skris#endif 3893280304Sjkim } else { 3894280304Sjkim ok = (alg_k & mask_k) && (alg_a & mask_a); 389555714Skris#ifdef CIPHER_DEBUG 3896280304Sjkim fprintf(stderr, "%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n", ok, alg_k, 3897280304Sjkim alg_a, mask_k, mask_a, (void *)c, c->name); 389855714Skris#endif 3899280304Sjkim } 390055714Skris 3901238405Sjkim#ifndef OPENSSL_NO_TLSEXT 3902280304Sjkim# ifndef OPENSSL_NO_EC 3903280304Sjkim if ( 3904280304Sjkim /* 3905280304Sjkim * if we are considering an ECC cipher suite that uses our 3906280304Sjkim * certificate 3907280304Sjkim */ 3908280304Sjkim (alg_a & SSL_aECDSA || alg_a & SSL_aECDH) 3909280304Sjkim /* and we have an ECC certificate */ 3910280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL) 3911280304Sjkim /* 3912280304Sjkim * and the client specified a Supported Point Formats 3913280304Sjkim * extension 3914280304Sjkim */ 3915280304Sjkim && ((s->session->tlsext_ecpointformatlist_length > 0) 3916280304Sjkim && (s->session->tlsext_ecpointformatlist != NULL)) 3917280304Sjkim /* and our certificate's point is compressed */ 3918280304Sjkim && ((s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info != NULL) 3919280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key != 3920280304Sjkim NULL) 3921280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info-> 3922280304Sjkim key->public_key != NULL) 3923280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info-> 3924280304Sjkim key->public_key->data != NULL) 3925280304Sjkim && 3926280304Sjkim ((* 3927280304Sjkim (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info-> 3928280304Sjkim key->public_key->data) == POINT_CONVERSION_COMPRESSED) 3929280304Sjkim || 3930280304Sjkim (* 3931280304Sjkim (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info-> 3932280304Sjkim key->public_key->data) == 3933280304Sjkim POINT_CONVERSION_COMPRESSED + 1) 3934280304Sjkim ) 3935280304Sjkim ) 3936280304Sjkim ) { 3937280304Sjkim ec_ok = 0; 3938280304Sjkim /* 3939280304Sjkim * if our certificate's curve is over a field type that the 3940280304Sjkim * client does not support then do not allow this cipher suite to 3941280304Sjkim * be negotiated 3942280304Sjkim */ 3943280304Sjkim if ((s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL) 3944280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != 3945280304Sjkim NULL) 3946280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec-> 3947280304Sjkim group->meth != NULL) 3948280304Sjkim && 3949280304Sjkim (EC_METHOD_get_field_type 3950280304Sjkim (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec-> 3951280304Sjkim group->meth) == NID_X9_62_prime_field) 3952280304Sjkim ) { 3953280304Sjkim for (j = 0; j < s->session->tlsext_ecpointformatlist_length; 3954280304Sjkim j++) { 3955280304Sjkim if (s->session->tlsext_ecpointformatlist[j] == 3956280304Sjkim TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime) { 3957280304Sjkim ec_ok = 1; 3958280304Sjkim break; 3959280304Sjkim } 3960280304Sjkim } 3961280304Sjkim } else 3962280304Sjkim if (EC_METHOD_get_field_type 3963280304Sjkim (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec-> 3964280304Sjkim group->meth) == NID_X9_62_characteristic_two_field) { 3965280304Sjkim for (j = 0; j < s->session->tlsext_ecpointformatlist_length; 3966280304Sjkim j++) { 3967280304Sjkim if (s->session->tlsext_ecpointformatlist[j] == 3968280304Sjkim TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2) { 3969280304Sjkim ec_ok = 1; 3970280304Sjkim break; 3971280304Sjkim } 3972280304Sjkim } 3973280304Sjkim } 3974280304Sjkim ok = ok && ec_ok; 3975280304Sjkim } 3976280304Sjkim if ( 3977280304Sjkim /* 3978280304Sjkim * if we are considering an ECC cipher suite that uses our 3979280304Sjkim * certificate 3980280304Sjkim */ 3981280304Sjkim (alg_a & SSL_aECDSA || alg_a & SSL_aECDH) 3982280304Sjkim /* and we have an ECC certificate */ 3983280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL) 3984280304Sjkim /* 3985280304Sjkim * and the client specified an EllipticCurves extension 3986280304Sjkim */ 3987280304Sjkim && ((s->session->tlsext_ellipticcurvelist_length > 0) 3988280304Sjkim && (s->session->tlsext_ellipticcurvelist != NULL)) 3989280304Sjkim ) { 3990280304Sjkim ec_ok = 0; 3991280304Sjkim if ((s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL) 3992280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != 3993280304Sjkim NULL) 3994280304Sjkim ) { 3995280304Sjkim ec_nid = 3996280304Sjkim EC_GROUP_get_curve_name(s->cert-> 3997280304Sjkim pkeys[SSL_PKEY_ECC].privatekey-> 3998280304Sjkim pkey.ec->group); 3999280304Sjkim if ((ec_nid == 0) 4000280304Sjkim && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey. 4001280304Sjkim ec->group->meth != NULL) 4002280304Sjkim ) { 4003280304Sjkim if (EC_METHOD_get_field_type 4004280304Sjkim (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey. 4005280304Sjkim ec->group->meth) == NID_X9_62_prime_field) { 4006280304Sjkim ec_search1 = 0xFF; 4007280304Sjkim ec_search2 = 0x01; 4008280304Sjkim } else 4009280304Sjkim if (EC_METHOD_get_field_type 4010280304Sjkim (s->cert->pkeys[SSL_PKEY_ECC].privatekey-> 4011280304Sjkim pkey.ec->group->meth) == 4012280304Sjkim NID_X9_62_characteristic_two_field) { 4013280304Sjkim ec_search1 = 0xFF; 4014280304Sjkim ec_search2 = 0x02; 4015280304Sjkim } 4016280304Sjkim } else { 4017280304Sjkim ec_search1 = 0x00; 4018280304Sjkim ec_search2 = tls1_ec_nid2curve_id(ec_nid); 4019280304Sjkim } 4020280304Sjkim if ((ec_search1 != 0) || (ec_search2 != 0)) { 4021280304Sjkim for (j = 0; 4022280304Sjkim j < s->session->tlsext_ellipticcurvelist_length / 2; 4023280304Sjkim j++) { 4024280304Sjkim if ((s->session->tlsext_ellipticcurvelist[2 * j] == 4025280304Sjkim ec_search1) 4026280304Sjkim && (s->session->tlsext_ellipticcurvelist[2 * j + 4027280304Sjkim 1] == 4028280304Sjkim ec_search2)) { 4029280304Sjkim ec_ok = 1; 4030280304Sjkim break; 4031280304Sjkim } 4032280304Sjkim } 4033280304Sjkim } 4034280304Sjkim } 4035280304Sjkim ok = ok && ec_ok; 4036280304Sjkim } 4037280304Sjkim# ifndef OPENSSL_NO_ECDH 4038280304Sjkim if ( 4039280304Sjkim /* 4040280304Sjkim * if we are considering an ECC cipher suite that uses an 4041280304Sjkim * ephemeral EC key 4042280304Sjkim */ 4043280304Sjkim (alg_k & SSL_kEECDH) 4044280304Sjkim /* and we have an ephemeral EC key */ 4045280304Sjkim && (s->cert->ecdh_tmp != NULL) 4046280304Sjkim /* 4047280304Sjkim * and the client specified an EllipticCurves extension 4048280304Sjkim */ 4049280304Sjkim && ((s->session->tlsext_ellipticcurvelist_length > 0) 4050280304Sjkim && (s->session->tlsext_ellipticcurvelist != NULL)) 4051280304Sjkim ) { 4052280304Sjkim ec_ok = 0; 4053280304Sjkim if (s->cert->ecdh_tmp->group != NULL) { 4054280304Sjkim ec_nid = EC_GROUP_get_curve_name(s->cert->ecdh_tmp->group); 4055280304Sjkim if ((ec_nid == 0) 4056280304Sjkim && (s->cert->ecdh_tmp->group->meth != NULL) 4057280304Sjkim ) { 4058280304Sjkim if (EC_METHOD_get_field_type 4059280304Sjkim (s->cert->ecdh_tmp->group->meth) == 4060280304Sjkim NID_X9_62_prime_field) { 4061280304Sjkim ec_search1 = 0xFF; 4062280304Sjkim ec_search2 = 0x01; 4063280304Sjkim } else 4064280304Sjkim if (EC_METHOD_get_field_type 4065280304Sjkim (s->cert->ecdh_tmp->group->meth) == 4066280304Sjkim NID_X9_62_characteristic_two_field) { 4067280304Sjkim ec_search1 = 0xFF; 4068280304Sjkim ec_search2 = 0x02; 4069280304Sjkim } 4070280304Sjkim } else { 4071280304Sjkim ec_search1 = 0x00; 4072280304Sjkim ec_search2 = tls1_ec_nid2curve_id(ec_nid); 4073280304Sjkim } 4074280304Sjkim if ((ec_search1 != 0) || (ec_search2 != 0)) { 4075280304Sjkim for (j = 0; 4076280304Sjkim j < s->session->tlsext_ellipticcurvelist_length / 2; 4077280304Sjkim j++) { 4078280304Sjkim if ((s->session->tlsext_ellipticcurvelist[2 * j] == 4079280304Sjkim ec_search1) 4080280304Sjkim && (s->session->tlsext_ellipticcurvelist[2 * j + 4081280304Sjkim 1] == 4082280304Sjkim ec_search2)) { 4083280304Sjkim ec_ok = 1; 4084280304Sjkim break; 4085280304Sjkim } 4086280304Sjkim } 4087280304Sjkim } 4088280304Sjkim } 4089280304Sjkim ok = ok && ec_ok; 4090280304Sjkim } 4091280304Sjkim# endif /* OPENSSL_NO_ECDH */ 4092280304Sjkim# endif /* OPENSSL_NO_EC */ 4093280304Sjkim#endif /* OPENSSL_NO_TLSEXT */ 4094238405Sjkim 4095280304Sjkim if (!ok) 4096280304Sjkim continue; 4097280304Sjkim ii = sk_SSL_CIPHER_find(allow, c); 4098280304Sjkim if (ii >= 0) { 4099264331Sjkim#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT) 4100280304Sjkim if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) 4101280304Sjkim && s->s3->is_probably_safari) { 4102280304Sjkim if (!ret) 4103280304Sjkim ret = sk_SSL_CIPHER_value(allow, ii); 4104280304Sjkim continue; 4105280304Sjkim } 4106264331Sjkim#endif 4107280304Sjkim ret = sk_SSL_CIPHER_value(allow, ii); 4108280304Sjkim break; 4109280304Sjkim } 4110280304Sjkim } 4111280304Sjkim return (ret); 4112280304Sjkim} 411355714Skris 411455714Skrisint ssl3_get_req_cert_type(SSL *s, unsigned char *p) 4115280304Sjkim{ 4116280304Sjkim int ret = 0; 4117280304Sjkim unsigned long alg_k; 411855714Skris 4119280304Sjkim alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 412055714Skris 4121238405Sjkim#ifndef OPENSSL_NO_GOST 4122280304Sjkim if (s->version >= TLS1_VERSION) { 4123280304Sjkim if (alg_k & SSL_kGOST) { 4124280304Sjkim p[ret++] = TLS_CT_GOST94_SIGN; 4125280304Sjkim p[ret++] = TLS_CT_GOST01_SIGN; 4126280304Sjkim return (ret); 4127280304Sjkim } 4128280304Sjkim } 4129238405Sjkim#endif 4130238405Sjkim 4131109998Smarkm#ifndef OPENSSL_NO_DH 4132280304Sjkim if (alg_k & (SSL_kDHr | SSL_kEDH)) { 4133280304Sjkim# ifndef OPENSSL_NO_RSA 4134280304Sjkim p[ret++] = SSL3_CT_RSA_FIXED_DH; 4135280304Sjkim# endif 4136280304Sjkim# ifndef OPENSSL_NO_DSA 4137280304Sjkim p[ret++] = SSL3_CT_DSS_FIXED_DH; 4138280304Sjkim# endif 4139280304Sjkim } 4140280304Sjkim if ((s->version == SSL3_VERSION) && 4141280304Sjkim (alg_k & (SSL_kEDH | SSL_kDHd | SSL_kDHr))) { 4142280304Sjkim# ifndef OPENSSL_NO_RSA 4143280304Sjkim p[ret++] = SSL3_CT_RSA_EPHEMERAL_DH; 4144280304Sjkim# endif 4145280304Sjkim# ifndef OPENSSL_NO_DSA 4146280304Sjkim p[ret++] = SSL3_CT_DSS_EPHEMERAL_DH; 4147280304Sjkim# endif 4148280304Sjkim } 4149280304Sjkim#endif /* !OPENSSL_NO_DH */ 4150109998Smarkm#ifndef OPENSSL_NO_RSA 4151280304Sjkim p[ret++] = SSL3_CT_RSA_SIGN; 415255714Skris#endif 4153109998Smarkm#ifndef OPENSSL_NO_DSA 4154280304Sjkim p[ret++] = SSL3_CT_DSS_SIGN; 415555714Skris#endif 4156160814Ssimon#ifndef OPENSSL_NO_ECDH 4157280304Sjkim if ((alg_k & (SSL_kECDHr | SSL_kECDHe)) && (s->version >= TLS1_VERSION)) { 4158280304Sjkim p[ret++] = TLS_CT_RSA_FIXED_ECDH; 4159280304Sjkim p[ret++] = TLS_CT_ECDSA_FIXED_ECDH; 4160280304Sjkim } 4161160814Ssimon#endif 4162160814Ssimon 4163160814Ssimon#ifndef OPENSSL_NO_ECDSA 4164280304Sjkim /* 4165280304Sjkim * ECDSA certs can be used with RSA cipher suites as well so we don't 4166280304Sjkim * need to check for SSL_kECDH or SSL_kEECDH 4167280304Sjkim */ 4168280304Sjkim if (s->version >= TLS1_VERSION) { 4169280304Sjkim p[ret++] = TLS_CT_ECDSA_SIGN; 4170280304Sjkim } 4171280304Sjkim#endif 4172280304Sjkim return (ret); 4173280304Sjkim} 417455714Skris 417555714Skrisint ssl3_shutdown(SSL *s) 4176280304Sjkim{ 4177280304Sjkim int ret; 417855714Skris 4179280304Sjkim /* 4180280304Sjkim * Don't do anything much if we have not done the handshake or we don't 4181280304Sjkim * want to send messages :-) 4182280304Sjkim */ 4183280304Sjkim if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) { 4184280304Sjkim s->shutdown = (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN); 4185280304Sjkim return (1); 4186280304Sjkim } 418755714Skris 4188280304Sjkim if (!(s->shutdown & SSL_SENT_SHUTDOWN)) { 4189280304Sjkim s->shutdown |= SSL_SENT_SHUTDOWN; 419055714Skris#if 1 4191280304Sjkim ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY); 419255714Skris#endif 4193280304Sjkim /* 4194280304Sjkim * our shutdown alert has been sent now, and if it still needs to be 4195280304Sjkim * written, s->s3->alert_dispatch will be true 4196280304Sjkim */ 4197280304Sjkim if (s->s3->alert_dispatch) 4198280304Sjkim return (-1); /* return WANT_WRITE */ 4199280304Sjkim } else if (s->s3->alert_dispatch) { 4200280304Sjkim /* resend it if not sent */ 420155714Skris#if 1 4202280304Sjkim ret = s->method->ssl_dispatch_alert(s); 4203280304Sjkim if (ret == -1) { 4204280304Sjkim /* 4205280304Sjkim * we only get to return -1 here the 2nd/Nth invocation, we must 4206280304Sjkim * have already signalled return 0 upon a previous invoation, 4207280304Sjkim * return WANT_WRITE 4208280304Sjkim */ 4209280304Sjkim return (ret); 4210280304Sjkim } 421155714Skris#endif 4212280304Sjkim } else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) { 4213280304Sjkim /* 4214280304Sjkim * If we are waiting for a close from our peer, we are closed 4215280304Sjkim */ 4216280304Sjkim s->method->ssl_read_bytes(s, 0, NULL, 0, 0); 4217280304Sjkim if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) { 4218280304Sjkim return (-1); /* return WANT_READ */ 4219280304Sjkim } 4220280304Sjkim } 422155714Skris 4222280304Sjkim if ((s->shutdown == (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN)) && 4223280304Sjkim !s->s3->alert_dispatch) 4224280304Sjkim return (1); 4225280304Sjkim else 4226280304Sjkim return (0); 4227280304Sjkim} 422855714Skris 422955714Skrisint ssl3_write(SSL *s, const void *buf, int len) 4230280304Sjkim{ 4231280304Sjkim int ret, n; 423255714Skris 423355714Skris#if 0 4234280304Sjkim if (s->shutdown & SSL_SEND_SHUTDOWN) { 4235280304Sjkim s->rwstate = SSL_NOTHING; 4236280304Sjkim return (0); 4237280304Sjkim } 423855714Skris#endif 4239280304Sjkim clear_sys_error(); 4240280304Sjkim if (s->s3->renegotiate) 4241280304Sjkim ssl3_renegotiate_check(s); 424255714Skris 4243280304Sjkim /* 4244280304Sjkim * This is an experimental flag that sends the last handshake message in 4245280304Sjkim * the same packet as the first use data - used to see if it helps the 4246280304Sjkim * TCP protocol during session-id reuse 4247280304Sjkim */ 4248280304Sjkim /* The second test is because the buffer may have been removed */ 4249280304Sjkim if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) { 4250280304Sjkim /* First time through, we write into the buffer */ 4251280304Sjkim if (s->s3->delay_buf_pop_ret == 0) { 4252280304Sjkim ret = ssl3_write_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len); 4253280304Sjkim if (ret <= 0) 4254280304Sjkim return (ret); 425555714Skris 4256280304Sjkim s->s3->delay_buf_pop_ret = ret; 4257280304Sjkim } 425855714Skris 4259280304Sjkim s->rwstate = SSL_WRITING; 4260280304Sjkim n = BIO_flush(s->wbio); 4261280304Sjkim if (n <= 0) 4262280304Sjkim return (n); 4263280304Sjkim s->rwstate = SSL_NOTHING; 426455714Skris 4265280304Sjkim /* We have flushed the buffer, so remove it */ 4266280304Sjkim ssl_free_wbio_buffer(s); 4267280304Sjkim s->s3->flags &= ~SSL3_FLAGS_POP_BUFFER; 426855714Skris 4269280304Sjkim ret = s->s3->delay_buf_pop_ret; 4270280304Sjkim s->s3->delay_buf_pop_ret = 0; 4271280304Sjkim } else { 4272280304Sjkim ret = s->method->ssl_write_bytes(s, SSL3_RT_APPLICATION_DATA, 4273280304Sjkim buf, len); 4274280304Sjkim if (ret <= 0) 4275280304Sjkim return (ret); 4276280304Sjkim } 427755714Skris 4278280304Sjkim return (ret); 4279280304Sjkim} 428055714Skris 428172613Skrisstatic int ssl3_read_internal(SSL *s, void *buf, int len, int peek) 4282280304Sjkim{ 4283280304Sjkim int ret; 428455714Skris 4285280304Sjkim clear_sys_error(); 4286280304Sjkim if (s->s3->renegotiate) 4287280304Sjkim ssl3_renegotiate_check(s); 4288280304Sjkim s->s3->in_read_app_data = 1; 4289280304Sjkim ret = 4290280304Sjkim s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, 4291280304Sjkim peek); 4292280304Sjkim if ((ret == -1) && (s->s3->in_read_app_data == 2)) { 4293280304Sjkim /* 4294280304Sjkim * ssl3_read_bytes decided to call s->handshake_func, which called 4295280304Sjkim * ssl3_read_bytes to read handshake data. However, ssl3_read_bytes 4296280304Sjkim * actually found application data and thinks that application data 4297280304Sjkim * makes sense here; so disable handshake processing and try to read 4298280304Sjkim * application data again. 4299280304Sjkim */ 4300280304Sjkim s->in_handshake++; 4301280304Sjkim ret = 4302280304Sjkim s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, 4303280304Sjkim peek); 4304280304Sjkim s->in_handshake--; 4305280304Sjkim } else 4306280304Sjkim s->s3->in_read_app_data = 0; 430755714Skris 4308280304Sjkim return (ret); 4309280304Sjkim} 4310280304Sjkim 431172613Skrisint ssl3_read(SSL *s, void *buf, int len) 4312280304Sjkim{ 4313280304Sjkim return ssl3_read_internal(s, buf, len, 0); 4314280304Sjkim} 431572613Skris 431676866Skrisint ssl3_peek(SSL *s, void *buf, int len) 4317280304Sjkim{ 4318280304Sjkim return ssl3_read_internal(s, buf, len, 1); 4319280304Sjkim} 432055714Skris 432155714Skrisint ssl3_renegotiate(SSL *s) 4322280304Sjkim{ 4323280304Sjkim if (s->handshake_func == NULL) 4324280304Sjkim return (1); 432555714Skris 4326280304Sjkim if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) 4327280304Sjkim return (0); 432855714Skris 4329280304Sjkim s->s3->renegotiate = 1; 4330280304Sjkim return (1); 4331280304Sjkim} 433255714Skris 433355714Skrisint ssl3_renegotiate_check(SSL *s) 4334280304Sjkim{ 4335280304Sjkim int ret = 0; 433655714Skris 4337280304Sjkim if (s->s3->renegotiate) { 4338280304Sjkim if ((s->s3->rbuf.left == 0) && 4339280304Sjkim (s->s3->wbuf.left == 0) && !SSL_in_init(s)) { 4340280304Sjkim /* 4341280304Sjkim * if we are the server, and we have sent a 'RENEGOTIATE' 4342280304Sjkim * message, we need to go to SSL_ST_ACCEPT. 4343280304Sjkim */ 4344280304Sjkim /* SSL_ST_ACCEPT */ 4345280304Sjkim s->state = SSL_ST_RENEGOTIATE; 4346280304Sjkim s->s3->renegotiate = 0; 4347280304Sjkim s->s3->num_renegotiations++; 4348280304Sjkim s->s3->total_renegotiations++; 4349280304Sjkim ret = 1; 4350280304Sjkim } 4351280304Sjkim } 4352280304Sjkim return (ret); 4353280304Sjkim} 4354280304Sjkim 435555714Skris/* 4356280304Sjkim * If we are using TLS v1.2 or later and default SHA1+MD5 algorithms switch 4357238405Sjkim * to new SHA256 PRF and handshake macs 4358238405Sjkim */ 4359238405Sjkimlong ssl_get_algorithm2(SSL *s) 4360280304Sjkim{ 4361280304Sjkim long alg2 = s->s3->tmp.new_cipher->algorithm2; 4362280304Sjkim if (s->method->version == TLS1_2_VERSION && 4363280304Sjkim alg2 == (SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF)) 4364280304Sjkim return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; 4365280304Sjkim return alg2; 4366280304Sjkim} 4367