s3_lib.c revision 273415
1/* ssl/s3_lib.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111/* ==================================================================== 112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 113 * 114 * Portions of the attached software ("Contribution") are developed by 115 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. 116 * 117 * The Contribution is licensed pursuant to the OpenSSL open source 118 * license provided above. 119 * 120 * ECC cipher suite support in OpenSSL originally written by 121 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories. 122 * 123 */ 124 125#include <stdio.h> 126#include <openssl/objects.h> 127#include "ssl_locl.h" 128#include "kssl_lcl.h" 129#include <openssl/md5.h> 130#ifndef OPENSSL_NO_DH 131#include <openssl/dh.h> 132#endif 133#include <openssl/pq_compat.h> 134 135const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT; 136 137#define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER)) 138 139/* list of available SSLv3 ciphers (sorted by id) */ 140OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={ 141/* The RSA ciphers */ 142/* Cipher 01 */ 143 { 144 1, 145 SSL3_TXT_RSA_NULL_MD5, 146 SSL3_CK_RSA_NULL_MD5, 147 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3, 148 SSL_NOT_EXP|SSL_STRONG_NONE, 149 0, 150 0, 151 0, 152 SSL_ALL_CIPHERS, 153 SSL_ALL_STRENGTHS, 154 }, 155/* Cipher 02 */ 156 { 157 1, 158 SSL3_TXT_RSA_NULL_SHA, 159 SSL3_CK_RSA_NULL_SHA, 160 SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3, 161 SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS, 162 0, 163 0, 164 0, 165 SSL_ALL_CIPHERS, 166 SSL_ALL_STRENGTHS, 167 }, 168/* Cipher 03 */ 169 { 170 1, 171 SSL3_TXT_RSA_RC4_40_MD5, 172 SSL3_CK_RSA_RC4_40_MD5, 173 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 174 SSL_EXPORT|SSL_EXP40, 175 0, 176 40, 177 128, 178 SSL_ALL_CIPHERS, 179 SSL_ALL_STRENGTHS, 180 }, 181/* Cipher 04 */ 182 { 183 1, 184 SSL3_TXT_RSA_RC4_128_MD5, 185 SSL3_CK_RSA_RC4_128_MD5, 186 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_SSLV3, 187 SSL_NOT_EXP|SSL_MEDIUM, 188 0, 189 128, 190 128, 191 SSL_ALL_CIPHERS, 192 SSL_ALL_STRENGTHS, 193 }, 194/* Cipher 05 */ 195 { 196 1, 197 SSL3_TXT_RSA_RC4_128_SHA, 198 SSL3_CK_RSA_RC4_128_SHA, 199 SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_SSLV3, 200 SSL_NOT_EXP|SSL_MEDIUM, 201 0, 202 128, 203 128, 204 SSL_ALL_CIPHERS, 205 SSL_ALL_STRENGTHS, 206 }, 207/* Cipher 06 */ 208 { 209 1, 210 SSL3_TXT_RSA_RC2_40_MD5, 211 SSL3_CK_RSA_RC2_40_MD5, 212 SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_SSLV3, 213 SSL_EXPORT|SSL_EXP40, 214 0, 215 40, 216 128, 217 SSL_ALL_CIPHERS, 218 SSL_ALL_STRENGTHS, 219 }, 220/* Cipher 07 */ 221#ifndef OPENSSL_NO_IDEA 222 { 223 1, 224 SSL3_TXT_RSA_IDEA_128_SHA, 225 SSL3_CK_RSA_IDEA_128_SHA, 226 SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3, 227 SSL_NOT_EXP|SSL_MEDIUM, 228 0, 229 128, 230 128, 231 SSL_ALL_CIPHERS, 232 SSL_ALL_STRENGTHS, 233 }, 234#endif 235/* Cipher 08 */ 236 { 237 1, 238 SSL3_TXT_RSA_DES_40_CBC_SHA, 239 SSL3_CK_RSA_DES_40_CBC_SHA, 240 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, 241 SSL_EXPORT|SSL_EXP40, 242 0, 243 40, 244 56, 245 SSL_ALL_CIPHERS, 246 SSL_ALL_STRENGTHS, 247 }, 248/* Cipher 09 */ 249 { 250 1, 251 SSL3_TXT_RSA_DES_64_CBC_SHA, 252 SSL3_CK_RSA_DES_64_CBC_SHA, 253 SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, 254 SSL_NOT_EXP|SSL_LOW, 255 0, 256 56, 257 56, 258 SSL_ALL_CIPHERS, 259 SSL_ALL_STRENGTHS, 260 }, 261/* Cipher 0A */ 262 { 263 1, 264 SSL3_TXT_RSA_DES_192_CBC3_SHA, 265 SSL3_CK_RSA_DES_192_CBC3_SHA, 266 SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, 267 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 268 0, 269 168, 270 168, 271 SSL_ALL_CIPHERS, 272 SSL_ALL_STRENGTHS, 273 }, 274/* The DH ciphers */ 275/* Cipher 0B */ 276 { 277 0, 278 SSL3_TXT_DH_DSS_DES_40_CBC_SHA, 279 SSL3_CK_DH_DSS_DES_40_CBC_SHA, 280 SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, 281 SSL_EXPORT|SSL_EXP40, 282 0, 283 40, 284 56, 285 SSL_ALL_CIPHERS, 286 SSL_ALL_STRENGTHS, 287 }, 288/* Cipher 0C */ 289 { 290 0, 291 SSL3_TXT_DH_DSS_DES_64_CBC_SHA, 292 SSL3_CK_DH_DSS_DES_64_CBC_SHA, 293 SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, 294 SSL_NOT_EXP|SSL_LOW, 295 0, 296 56, 297 56, 298 SSL_ALL_CIPHERS, 299 SSL_ALL_STRENGTHS, 300 }, 301/* Cipher 0D */ 302 { 303 0, 304 SSL3_TXT_DH_DSS_DES_192_CBC3_SHA, 305 SSL3_CK_DH_DSS_DES_192_CBC3_SHA, 306 SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, 307 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 308 0, 309 168, 310 168, 311 SSL_ALL_CIPHERS, 312 SSL_ALL_STRENGTHS, 313 }, 314/* Cipher 0E */ 315 { 316 0, 317 SSL3_TXT_DH_RSA_DES_40_CBC_SHA, 318 SSL3_CK_DH_RSA_DES_40_CBC_SHA, 319 SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, 320 SSL_EXPORT|SSL_EXP40, 321 0, 322 40, 323 56, 324 SSL_ALL_CIPHERS, 325 SSL_ALL_STRENGTHS, 326 }, 327/* Cipher 0F */ 328 { 329 0, 330 SSL3_TXT_DH_RSA_DES_64_CBC_SHA, 331 SSL3_CK_DH_RSA_DES_64_CBC_SHA, 332 SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, 333 SSL_NOT_EXP|SSL_LOW, 334 0, 335 56, 336 56, 337 SSL_ALL_CIPHERS, 338 SSL_ALL_STRENGTHS, 339 }, 340/* Cipher 10 */ 341 { 342 0, 343 SSL3_TXT_DH_RSA_DES_192_CBC3_SHA, 344 SSL3_CK_DH_RSA_DES_192_CBC3_SHA, 345 SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, 346 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 347 0, 348 168, 349 168, 350 SSL_ALL_CIPHERS, 351 SSL_ALL_STRENGTHS, 352 }, 353 354/* The Ephemeral DH ciphers */ 355/* Cipher 11 */ 356 { 357 1, 358 SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, 359 SSL3_CK_EDH_DSS_DES_40_CBC_SHA, 360 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3, 361 SSL_EXPORT|SSL_EXP40, 362 0, 363 40, 364 56, 365 SSL_ALL_CIPHERS, 366 SSL_ALL_STRENGTHS, 367 }, 368/* Cipher 12 */ 369 { 370 1, 371 SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, 372 SSL3_CK_EDH_DSS_DES_64_CBC_SHA, 373 SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3, 374 SSL_NOT_EXP|SSL_LOW, 375 0, 376 56, 377 56, 378 SSL_ALL_CIPHERS, 379 SSL_ALL_STRENGTHS, 380 }, 381/* Cipher 13 */ 382 { 383 1, 384 SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, 385 SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, 386 SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3, 387 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 388 0, 389 168, 390 168, 391 SSL_ALL_CIPHERS, 392 SSL_ALL_STRENGTHS, 393 }, 394/* Cipher 14 */ 395 { 396 1, 397 SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, 398 SSL3_CK_EDH_RSA_DES_40_CBC_SHA, 399 SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, 400 SSL_EXPORT|SSL_EXP40, 401 0, 402 40, 403 56, 404 SSL_ALL_CIPHERS, 405 SSL_ALL_STRENGTHS, 406 }, 407/* Cipher 15 */ 408 { 409 1, 410 SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, 411 SSL3_CK_EDH_RSA_DES_64_CBC_SHA, 412 SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, 413 SSL_NOT_EXP|SSL_LOW, 414 0, 415 56, 416 56, 417 SSL_ALL_CIPHERS, 418 SSL_ALL_STRENGTHS, 419 }, 420/* Cipher 16 */ 421 { 422 1, 423 SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, 424 SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, 425 SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, 426 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 427 0, 428 168, 429 168, 430 SSL_ALL_CIPHERS, 431 SSL_ALL_STRENGTHS, 432 }, 433/* Cipher 17 */ 434 { 435 1, 436 SSL3_TXT_ADH_RC4_40_MD5, 437 SSL3_CK_ADH_RC4_40_MD5, 438 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 439 SSL_EXPORT|SSL_EXP40, 440 0, 441 40, 442 128, 443 SSL_ALL_CIPHERS, 444 SSL_ALL_STRENGTHS, 445 }, 446/* Cipher 18 */ 447 { 448 1, 449 SSL3_TXT_ADH_RC4_128_MD5, 450 SSL3_CK_ADH_RC4_128_MD5, 451 SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 452 SSL_NOT_EXP|SSL_MEDIUM, 453 0, 454 128, 455 128, 456 SSL_ALL_CIPHERS, 457 SSL_ALL_STRENGTHS, 458 }, 459/* Cipher 19 */ 460 { 461 1, 462 SSL3_TXT_ADH_DES_40_CBC_SHA, 463 SSL3_CK_ADH_DES_40_CBC_SHA, 464 SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3, 465 SSL_EXPORT|SSL_EXP40, 466 0, 467 40, 468 128, 469 SSL_ALL_CIPHERS, 470 SSL_ALL_STRENGTHS, 471 }, 472/* Cipher 1A */ 473 { 474 1, 475 SSL3_TXT_ADH_DES_64_CBC_SHA, 476 SSL3_CK_ADH_DES_64_CBC_SHA, 477 SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3, 478 SSL_NOT_EXP|SSL_LOW, 479 0, 480 56, 481 56, 482 SSL_ALL_CIPHERS, 483 SSL_ALL_STRENGTHS, 484 }, 485/* Cipher 1B */ 486 { 487 1, 488 SSL3_TXT_ADH_DES_192_CBC_SHA, 489 SSL3_CK_ADH_DES_192_CBC_SHA, 490 SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3, 491 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 492 0, 493 168, 494 168, 495 SSL_ALL_CIPHERS, 496 SSL_ALL_STRENGTHS, 497 }, 498 499/* Fortezza */ 500/* Cipher 1C */ 501 { 502 0, 503 SSL3_TXT_FZA_DMS_NULL_SHA, 504 SSL3_CK_FZA_DMS_NULL_SHA, 505 SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3, 506 SSL_NOT_EXP|SSL_STRONG_NONE, 507 0, 508 0, 509 0, 510 SSL_ALL_CIPHERS, 511 SSL_ALL_STRENGTHS, 512 }, 513 514/* Cipher 1D */ 515 { 516 0, 517 SSL3_TXT_FZA_DMS_FZA_SHA, 518 SSL3_CK_FZA_DMS_FZA_SHA, 519 SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3, 520 SSL_NOT_EXP|SSL_STRONG_NONE, 521 0, 522 0, 523 0, 524 SSL_ALL_CIPHERS, 525 SSL_ALL_STRENGTHS, 526 }, 527 528#if 0 529/* Cipher 1E */ 530 { 531 0, 532 SSL3_TXT_FZA_DMS_RC4_SHA, 533 SSL3_CK_FZA_DMS_RC4_SHA, 534 SSL_kFZA|SSL_aFZA |SSL_RC4 |SSL_SHA1|SSL_SSLV3, 535 SSL_NOT_EXP|SSL_MEDIUM, 536 0, 537 128, 538 128, 539 SSL_ALL_CIPHERS, 540 SSL_ALL_STRENGTHS, 541 }, 542#endif 543 544#ifndef OPENSSL_NO_KRB5 545/* The Kerberos ciphers */ 546/* Cipher 1E */ 547 { 548 1, 549 SSL3_TXT_KRB5_DES_64_CBC_SHA, 550 SSL3_CK_KRB5_DES_64_CBC_SHA, 551 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3, 552 SSL_NOT_EXP|SSL_LOW, 553 0, 554 56, 555 56, 556 SSL_ALL_CIPHERS, 557 SSL_ALL_STRENGTHS, 558 }, 559 560/* Cipher 1F */ 561 { 562 1, 563 SSL3_TXT_KRB5_DES_192_CBC3_SHA, 564 SSL3_CK_KRB5_DES_192_CBC3_SHA, 565 SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_SHA1 |SSL_SSLV3, 566 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 567 0, 568 168, 569 168, 570 SSL_ALL_CIPHERS, 571 SSL_ALL_STRENGTHS, 572 }, 573 574/* Cipher 20 */ 575 { 576 1, 577 SSL3_TXT_KRB5_RC4_128_SHA, 578 SSL3_CK_KRB5_RC4_128_SHA, 579 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3, 580 SSL_NOT_EXP|SSL_MEDIUM, 581 0, 582 128, 583 128, 584 SSL_ALL_CIPHERS, 585 SSL_ALL_STRENGTHS, 586 }, 587 588/* Cipher 21 */ 589 { 590 1, 591 SSL3_TXT_KRB5_IDEA_128_CBC_SHA, 592 SSL3_CK_KRB5_IDEA_128_CBC_SHA, 593 SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_SHA1 |SSL_SSLV3, 594 SSL_NOT_EXP|SSL_MEDIUM, 595 0, 596 128, 597 128, 598 SSL_ALL_CIPHERS, 599 SSL_ALL_STRENGTHS, 600 }, 601 602/* Cipher 22 */ 603 { 604 1, 605 SSL3_TXT_KRB5_DES_64_CBC_MD5, 606 SSL3_CK_KRB5_DES_64_CBC_MD5, 607 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3, 608 SSL_NOT_EXP|SSL_LOW, 609 0, 610 56, 611 56, 612 SSL_ALL_CIPHERS, 613 SSL_ALL_STRENGTHS, 614 }, 615 616/* Cipher 23 */ 617 { 618 1, 619 SSL3_TXT_KRB5_DES_192_CBC3_MD5, 620 SSL3_CK_KRB5_DES_192_CBC3_MD5, 621 SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_MD5 |SSL_SSLV3, 622 SSL_NOT_EXP|SSL_HIGH, 623 0, 624 168, 625 168, 626 SSL_ALL_CIPHERS, 627 SSL_ALL_STRENGTHS, 628 }, 629 630/* Cipher 24 */ 631 { 632 1, 633 SSL3_TXT_KRB5_RC4_128_MD5, 634 SSL3_CK_KRB5_RC4_128_MD5, 635 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3, 636 SSL_NOT_EXP|SSL_MEDIUM, 637 0, 638 128, 639 128, 640 SSL_ALL_CIPHERS, 641 SSL_ALL_STRENGTHS, 642 }, 643 644/* Cipher 25 */ 645 { 646 1, 647 SSL3_TXT_KRB5_IDEA_128_CBC_MD5, 648 SSL3_CK_KRB5_IDEA_128_CBC_MD5, 649 SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_MD5 |SSL_SSLV3, 650 SSL_NOT_EXP|SSL_MEDIUM, 651 0, 652 128, 653 128, 654 SSL_ALL_CIPHERS, 655 SSL_ALL_STRENGTHS, 656 }, 657 658/* Cipher 26 */ 659 { 660 1, 661 SSL3_TXT_KRB5_DES_40_CBC_SHA, 662 SSL3_CK_KRB5_DES_40_CBC_SHA, 663 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3, 664 SSL_EXPORT|SSL_EXP40, 665 0, 666 40, 667 56, 668 SSL_ALL_CIPHERS, 669 SSL_ALL_STRENGTHS, 670 }, 671 672/* Cipher 27 */ 673 { 674 1, 675 SSL3_TXT_KRB5_RC2_40_CBC_SHA, 676 SSL3_CK_KRB5_RC2_40_CBC_SHA, 677 SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_SHA1 |SSL_SSLV3, 678 SSL_EXPORT|SSL_EXP40, 679 0, 680 40, 681 128, 682 SSL_ALL_CIPHERS, 683 SSL_ALL_STRENGTHS, 684 }, 685 686/* Cipher 28 */ 687 { 688 1, 689 SSL3_TXT_KRB5_RC4_40_SHA, 690 SSL3_CK_KRB5_RC4_40_SHA, 691 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3, 692 SSL_EXPORT|SSL_EXP40, 693 0, 694 40, 695 128, 696 SSL_ALL_CIPHERS, 697 SSL_ALL_STRENGTHS, 698 }, 699 700/* Cipher 29 */ 701 { 702 1, 703 SSL3_TXT_KRB5_DES_40_CBC_MD5, 704 SSL3_CK_KRB5_DES_40_CBC_MD5, 705 SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3, 706 SSL_EXPORT|SSL_EXP40, 707 0, 708 40, 709 56, 710 SSL_ALL_CIPHERS, 711 SSL_ALL_STRENGTHS, 712 }, 713 714/* Cipher 2A */ 715 { 716 1, 717 SSL3_TXT_KRB5_RC2_40_CBC_MD5, 718 SSL3_CK_KRB5_RC2_40_CBC_MD5, 719 SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_MD5 |SSL_SSLV3, 720 SSL_EXPORT|SSL_EXP40, 721 0, 722 40, 723 128, 724 SSL_ALL_CIPHERS, 725 SSL_ALL_STRENGTHS, 726 }, 727 728/* Cipher 2B */ 729 { 730 1, 731 SSL3_TXT_KRB5_RC4_40_MD5, 732 SSL3_CK_KRB5_RC4_40_MD5, 733 SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3, 734 SSL_EXPORT|SSL_EXP40, 735 0, 736 40, 737 128, 738 SSL_ALL_CIPHERS, 739 SSL_ALL_STRENGTHS, 740 }, 741#endif /* OPENSSL_NO_KRB5 */ 742 743/* New AES ciphersuites */ 744/* Cipher 2F */ 745 { 746 1, 747 TLS1_TXT_RSA_WITH_AES_128_SHA, 748 TLS1_CK_RSA_WITH_AES_128_SHA, 749 SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1, 750 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 751 0, 752 128, 753 128, 754 SSL_ALL_CIPHERS, 755 SSL_ALL_STRENGTHS, 756 }, 757/* Cipher 30 */ 758 { 759 0, 760 TLS1_TXT_DH_DSS_WITH_AES_128_SHA, 761 TLS1_CK_DH_DSS_WITH_AES_128_SHA, 762 SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 763 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 764 0, 765 128, 766 128, 767 SSL_ALL_CIPHERS, 768 SSL_ALL_STRENGTHS, 769 }, 770/* Cipher 31 */ 771 { 772 0, 773 TLS1_TXT_DH_RSA_WITH_AES_128_SHA, 774 TLS1_CK_DH_RSA_WITH_AES_128_SHA, 775 SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 776 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 777 0, 778 128, 779 128, 780 SSL_ALL_CIPHERS, 781 SSL_ALL_STRENGTHS, 782 }, 783/* Cipher 32 */ 784 { 785 1, 786 TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, 787 TLS1_CK_DHE_DSS_WITH_AES_128_SHA, 788 SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1, 789 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 790 0, 791 128, 792 128, 793 SSL_ALL_CIPHERS, 794 SSL_ALL_STRENGTHS, 795 }, 796/* Cipher 33 */ 797 { 798 1, 799 TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, 800 TLS1_CK_DHE_RSA_WITH_AES_128_SHA, 801 SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 802 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 803 0, 804 128, 805 128, 806 SSL_ALL_CIPHERS, 807 SSL_ALL_STRENGTHS, 808 }, 809/* Cipher 34 */ 810 { 811 1, 812 TLS1_TXT_ADH_WITH_AES_128_SHA, 813 TLS1_CK_ADH_WITH_AES_128_SHA, 814 SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, 815 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 816 0, 817 128, 818 128, 819 SSL_ALL_CIPHERS, 820 SSL_ALL_STRENGTHS, 821 }, 822 823/* Cipher 35 */ 824 { 825 1, 826 TLS1_TXT_RSA_WITH_AES_256_SHA, 827 TLS1_CK_RSA_WITH_AES_256_SHA, 828 SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1, 829 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 830 0, 831 256, 832 256, 833 SSL_ALL_CIPHERS, 834 SSL_ALL_STRENGTHS, 835 }, 836/* Cipher 36 */ 837 { 838 0, 839 TLS1_TXT_DH_DSS_WITH_AES_256_SHA, 840 TLS1_CK_DH_DSS_WITH_AES_256_SHA, 841 SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 842 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 843 0, 844 256, 845 256, 846 SSL_ALL_CIPHERS, 847 SSL_ALL_STRENGTHS, 848 }, 849/* Cipher 37 */ 850 { 851 0, 852 TLS1_TXT_DH_RSA_WITH_AES_256_SHA, 853 TLS1_CK_DH_RSA_WITH_AES_256_SHA, 854 SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 855 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 856 0, 857 256, 858 256, 859 SSL_ALL_CIPHERS, 860 SSL_ALL_STRENGTHS, 861 }, 862/* Cipher 38 */ 863 { 864 1, 865 TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, 866 TLS1_CK_DHE_DSS_WITH_AES_256_SHA, 867 SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1, 868 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 869 0, 870 256, 871 256, 872 SSL_ALL_CIPHERS, 873 SSL_ALL_STRENGTHS, 874 }, 875/* Cipher 39 */ 876 { 877 1, 878 TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, 879 TLS1_CK_DHE_RSA_WITH_AES_256_SHA, 880 SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 881 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 882 0, 883 256, 884 256, 885 SSL_ALL_CIPHERS, 886 SSL_ALL_STRENGTHS, 887 }, 888 /* Cipher 3A */ 889 { 890 1, 891 TLS1_TXT_ADH_WITH_AES_256_SHA, 892 TLS1_CK_ADH_WITH_AES_256_SHA, 893 SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, 894 SSL_NOT_EXP|SSL_HIGH|SSL_FIPS, 895 0, 896 256, 897 256, 898 SSL_ALL_CIPHERS, 899 SSL_ALL_STRENGTHS, 900 }, 901 902#ifndef OPENSSL_NO_CAMELLIA 903 /* Camellia ciphersuites from RFC4132 (128-bit portion) */ 904 905 /* Cipher 41 */ 906 { 907 1, 908 TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA, 909 TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA, 910 SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 911 SSL_NOT_EXP|SSL_HIGH, 912 0, 913 128, 914 128, 915 SSL_ALL_CIPHERS, 916 SSL_ALL_STRENGTHS 917 }, 918 /* Cipher 42 */ 919 { 920 0, /* not implemented (non-ephemeral DH) */ 921 TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA, 922 TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA, 923 SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 924 SSL_NOT_EXP|SSL_HIGH, 925 0, 926 128, 927 128, 928 SSL_ALL_CIPHERS, 929 SSL_ALL_STRENGTHS 930 }, 931 /* Cipher 43 */ 932 { 933 0, /* not implemented (non-ephemeral DH) */ 934 TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA, 935 TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA, 936 SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 937 SSL_NOT_EXP|SSL_HIGH, 938 0, 939 128, 940 128, 941 SSL_ALL_CIPHERS, 942 SSL_ALL_STRENGTHS 943 }, 944 /* Cipher 44 */ 945 { 946 1, 947 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, 948 TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, 949 SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 950 SSL_NOT_EXP|SSL_HIGH, 951 0, 952 128, 953 128, 954 SSL_ALL_CIPHERS, 955 SSL_ALL_STRENGTHS 956 }, 957 /* Cipher 45 */ 958 { 959 1, 960 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, 961 TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, 962 SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 963 SSL_NOT_EXP|SSL_HIGH, 964 0, 965 128, 966 128, 967 SSL_ALL_CIPHERS, 968 SSL_ALL_STRENGTHS 969 }, 970 /* Cipher 46 */ 971 { 972 1, 973 TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA, 974 TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA, 975 SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 976 SSL_NOT_EXP|SSL_HIGH, 977 0, 978 128, 979 128, 980 SSL_ALL_CIPHERS, 981 SSL_ALL_STRENGTHS 982 }, 983#endif /* OPENSSL_NO_CAMELLIA */ 984 985#if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 986 /* New TLS Export CipherSuites from expired ID */ 987#if 0 988 /* Cipher 60 */ 989 { 990 1, 991 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5, 992 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5, 993 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1, 994 SSL_EXPORT|SSL_EXP56, 995 0, 996 56, 997 128, 998 SSL_ALL_CIPHERS, 999 SSL_ALL_STRENGTHS, 1000 }, 1001 /* Cipher 61 */ 1002 { 1003 1, 1004 TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 1005 TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 1006 SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1, 1007 SSL_EXPORT|SSL_EXP56, 1008 0, 1009 56, 1010 128, 1011 SSL_ALL_CIPHERS, 1012 SSL_ALL_STRENGTHS, 1013 }, 1014#endif 1015 /* Cipher 62 */ 1016 { 1017 1, 1018 TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA, 1019 TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA, 1020 SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1, 1021 SSL_EXPORT|SSL_EXP56, 1022 0, 1023 56, 1024 56, 1025 SSL_ALL_CIPHERS, 1026 SSL_ALL_STRENGTHS, 1027 }, 1028 /* Cipher 63 */ 1029 { 1030 1, 1031 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 1032 TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 1033 SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1, 1034 SSL_EXPORT|SSL_EXP56, 1035 0, 1036 56, 1037 56, 1038 SSL_ALL_CIPHERS, 1039 SSL_ALL_STRENGTHS, 1040 }, 1041 /* Cipher 64 */ 1042 { 1043 1, 1044 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA, 1045 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA, 1046 SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 1047 SSL_EXPORT|SSL_EXP56, 1048 0, 1049 56, 1050 128, 1051 SSL_ALL_CIPHERS, 1052 SSL_ALL_STRENGTHS, 1053 }, 1054 /* Cipher 65 */ 1055 { 1056 1, 1057 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 1058 TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 1059 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, 1060 SSL_EXPORT|SSL_EXP56, 1061 0, 1062 56, 1063 128, 1064 SSL_ALL_CIPHERS, 1065 SSL_ALL_STRENGTHS, 1066 }, 1067 /* Cipher 66 */ 1068 { 1069 1, 1070 TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA, 1071 TLS1_CK_DHE_DSS_WITH_RC4_128_SHA, 1072 SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, 1073 SSL_NOT_EXP|SSL_MEDIUM, 1074 0, 1075 128, 1076 128, 1077 SSL_ALL_CIPHERS, 1078 SSL_ALL_STRENGTHS 1079 }, 1080#endif 1081 1082#ifndef OPENSSL_NO_CAMELLIA 1083 /* Camellia ciphersuites from RFC4132 (256-bit portion) */ 1084 1085 /* Cipher 84 */ 1086 { 1087 1, 1088 TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA, 1089 TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA, 1090 SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 1091 SSL_NOT_EXP|SSL_HIGH, 1092 0, 1093 256, 1094 256, 1095 SSL_ALL_CIPHERS, 1096 SSL_ALL_STRENGTHS 1097 }, 1098 /* Cipher 85 */ 1099 { 1100 0, /* not implemented (non-ephemeral DH) */ 1101 TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA, 1102 TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA, 1103 SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 1104 SSL_NOT_EXP|SSL_HIGH, 1105 0, 1106 256, 1107 256, 1108 SSL_ALL_CIPHERS, 1109 SSL_ALL_STRENGTHS 1110 }, 1111 /* Cipher 86 */ 1112 { 1113 0, /* not implemented (non-ephemeral DH) */ 1114 TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA, 1115 TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA, 1116 SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 1117 SSL_NOT_EXP|SSL_HIGH, 1118 0, 1119 256, 1120 256, 1121 SSL_ALL_CIPHERS, 1122 SSL_ALL_STRENGTHS 1123 }, 1124 /* Cipher 87 */ 1125 { 1126 1, 1127 TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, 1128 TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, 1129 SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 1130 SSL_NOT_EXP|SSL_HIGH, 1131 0, 1132 256, 1133 256, 1134 SSL_ALL_CIPHERS, 1135 SSL_ALL_STRENGTHS 1136 }, 1137 /* Cipher 88 */ 1138 { 1139 1, 1140 TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, 1141 TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, 1142 SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 1143 SSL_NOT_EXP|SSL_HIGH, 1144 0, 1145 256, 1146 256, 1147 SSL_ALL_CIPHERS, 1148 SSL_ALL_STRENGTHS 1149 }, 1150 /* Cipher 89 */ 1151 { 1152 1, 1153 TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA, 1154 TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA, 1155 SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1, 1156 SSL_NOT_EXP|SSL_HIGH, 1157 0, 1158 256, 1159 256, 1160 SSL_ALL_CIPHERS, 1161 SSL_ALL_STRENGTHS 1162 }, 1163#endif /* OPENSSL_NO_CAMELLIA */ 1164 1165#ifndef OPENSSL_NO_SEED 1166 /* SEED ciphersuites from RFC4162 */ 1167 1168 /* Cipher 96 */ 1169 { 1170 1, 1171 TLS1_TXT_RSA_WITH_SEED_SHA, 1172 TLS1_CK_RSA_WITH_SEED_SHA, 1173 SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1, 1174 SSL_NOT_EXP|SSL_MEDIUM, 1175 0, 1176 128, 1177 128, 1178 SSL_ALL_CIPHERS, 1179 SSL_ALL_STRENGTHS, 1180 }, 1181 1182 /* Cipher 97 */ 1183 { 1184 0, /* not implemented (non-ephemeral DH) */ 1185 TLS1_TXT_DH_DSS_WITH_SEED_SHA, 1186 TLS1_CK_DH_DSS_WITH_SEED_SHA, 1187 SSL_kDHd|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1, 1188 SSL_NOT_EXP|SSL_MEDIUM, 1189 0, 1190 128, 1191 128, 1192 SSL_ALL_CIPHERS, 1193 SSL_ALL_STRENGTHS, 1194 }, 1195 1196 /* Cipher 98 */ 1197 { 1198 0, /* not implemented (non-ephemeral DH) */ 1199 TLS1_TXT_DH_RSA_WITH_SEED_SHA, 1200 TLS1_CK_DH_RSA_WITH_SEED_SHA, 1201 SSL_kDHr|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1, 1202 SSL_NOT_EXP|SSL_MEDIUM, 1203 0, 1204 128, 1205 128, 1206 SSL_ALL_CIPHERS, 1207 SSL_ALL_STRENGTHS, 1208 }, 1209 1210 /* Cipher 99 */ 1211 { 1212 1, 1213 TLS1_TXT_DHE_DSS_WITH_SEED_SHA, 1214 TLS1_CK_DHE_DSS_WITH_SEED_SHA, 1215 SSL_kEDH|SSL_aDSS|SSL_SEED|SSL_SHA1|SSL_TLSV1, 1216 SSL_NOT_EXP|SSL_MEDIUM, 1217 0, 1218 128, 1219 128, 1220 SSL_ALL_CIPHERS, 1221 SSL_ALL_STRENGTHS, 1222 }, 1223 1224 /* Cipher 9A */ 1225 { 1226 1, 1227 TLS1_TXT_DHE_RSA_WITH_SEED_SHA, 1228 TLS1_CK_DHE_RSA_WITH_SEED_SHA, 1229 SSL_kEDH|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1, 1230 SSL_NOT_EXP|SSL_MEDIUM, 1231 0, 1232 128, 1233 128, 1234 SSL_ALL_CIPHERS, 1235 SSL_ALL_STRENGTHS, 1236 }, 1237 1238 /* Cipher 9B */ 1239 { 1240 1, 1241 TLS1_TXT_ADH_WITH_SEED_SHA, 1242 TLS1_CK_ADH_WITH_SEED_SHA, 1243 SSL_kEDH|SSL_aNULL|SSL_SEED|SSL_SHA1|SSL_TLSV1, 1244 SSL_NOT_EXP|SSL_MEDIUM, 1245 0, 1246 128, 1247 128, 1248 SSL_ALL_CIPHERS, 1249 SSL_ALL_STRENGTHS, 1250 }, 1251 1252#endif /* OPENSSL_NO_SEED */ 1253 1254#ifndef OPENSSL_NO_ECDH 1255 /* Cipher C001 */ 1256 { 1257 1, 1258 TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA, 1259 TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA, 1260 SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1, 1261 SSL_NOT_EXP, 1262 0, 1263 0, 1264 0, 1265 SSL_ALL_CIPHERS, 1266 SSL_ALL_STRENGTHS, 1267 }, 1268 1269 /* Cipher C002 */ 1270 { 1271 1, 1272 TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA, 1273 TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA, 1274 SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 1275 SSL_NOT_EXP, 1276 0, 1277 128, 1278 128, 1279 SSL_ALL_CIPHERS, 1280 SSL_ALL_STRENGTHS, 1281 }, 1282 1283 /* Cipher C003 */ 1284 { 1285 1, 1286 TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA, 1287 TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA, 1288 SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1, 1289 SSL_NOT_EXP|SSL_HIGH, 1290 0, 1291 168, 1292 168, 1293 SSL_ALL_CIPHERS, 1294 SSL_ALL_STRENGTHS, 1295 }, 1296 1297 /* Cipher C004 */ 1298 { 1299 1, 1300 TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 1301 TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 1302 SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1303 SSL_NOT_EXP|SSL_HIGH, 1304 0, 1305 128, 1306 128, 1307 SSL_ALL_CIPHERS, 1308 SSL_ALL_STRENGTHS, 1309 }, 1310 1311 /* Cipher C005 */ 1312 { 1313 1, 1314 TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 1315 TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 1316 SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1317 SSL_NOT_EXP|SSL_HIGH, 1318 0, 1319 256, 1320 256, 1321 SSL_ALL_CIPHERS, 1322 SSL_ALL_STRENGTHS, 1323 }, 1324 1325 /* Cipher C006 */ 1326 { 1327 1, 1328 TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA, 1329 TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA, 1330 SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1, 1331 SSL_NOT_EXP, 1332 0, 1333 0, 1334 0, 1335 SSL_ALL_CIPHERS, 1336 SSL_ALL_STRENGTHS, 1337 }, 1338 1339 /* Cipher C007 */ 1340 { 1341 1, 1342 TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA, 1343 TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA, 1344 SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 1345 SSL_NOT_EXP, 1346 0, 1347 128, 1348 128, 1349 SSL_ALL_CIPHERS, 1350 SSL_ALL_STRENGTHS, 1351 }, 1352 1353 /* Cipher C008 */ 1354 { 1355 1, 1356 TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, 1357 TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, 1358 SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1, 1359 SSL_NOT_EXP|SSL_HIGH, 1360 0, 1361 168, 1362 168, 1363 SSL_ALL_CIPHERS, 1364 SSL_ALL_STRENGTHS, 1365 }, 1366 1367 /* Cipher C009 */ 1368 { 1369 1, 1370 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 1371 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 1372 SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1373 SSL_NOT_EXP|SSL_HIGH, 1374 0, 1375 128, 1376 128, 1377 SSL_ALL_CIPHERS, 1378 SSL_ALL_STRENGTHS, 1379 }, 1380 1381 /* Cipher C00A */ 1382 { 1383 1, 1384 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 1385 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 1386 SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1387 SSL_NOT_EXP|SSL_HIGH, 1388 0, 1389 256, 1390 256, 1391 SSL_ALL_CIPHERS, 1392 SSL_ALL_STRENGTHS, 1393 }, 1394 1395 /* Cipher C00B */ 1396 { 1397 1, 1398 TLS1_TXT_ECDH_RSA_WITH_NULL_SHA, 1399 TLS1_CK_ECDH_RSA_WITH_NULL_SHA, 1400 SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1, 1401 SSL_NOT_EXP, 1402 0, 1403 0, 1404 0, 1405 SSL_ALL_CIPHERS, 1406 SSL_ALL_STRENGTHS, 1407 }, 1408 1409 /* Cipher C00C */ 1410 { 1411 1, 1412 TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA, 1413 TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA, 1414 SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 1415 SSL_NOT_EXP, 1416 0, 1417 128, 1418 128, 1419 SSL_ALL_CIPHERS, 1420 SSL_ALL_STRENGTHS, 1421 }, 1422 1423 /* Cipher C00D */ 1424 { 1425 1, 1426 TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA, 1427 TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA, 1428 SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1, 1429 SSL_NOT_EXP|SSL_HIGH, 1430 0, 1431 168, 1432 168, 1433 SSL_ALL_CIPHERS, 1434 SSL_ALL_STRENGTHS, 1435 }, 1436 1437 /* Cipher C00E */ 1438 { 1439 1, 1440 TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA, 1441 TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA, 1442 SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1443 SSL_NOT_EXP|SSL_HIGH, 1444 0, 1445 128, 1446 128, 1447 SSL_ALL_CIPHERS, 1448 SSL_ALL_STRENGTHS, 1449 }, 1450 1451 /* Cipher C00F */ 1452 { 1453 1, 1454 TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA, 1455 TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA, 1456 SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1457 SSL_NOT_EXP|SSL_HIGH, 1458 0, 1459 256, 1460 256, 1461 SSL_ALL_CIPHERS, 1462 SSL_ALL_STRENGTHS, 1463 }, 1464 1465 /* Cipher C010 */ 1466 { 1467 1, 1468 TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA, 1469 TLS1_CK_ECDHE_RSA_WITH_NULL_SHA, 1470 SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1, 1471 SSL_NOT_EXP, 1472 0, 1473 0, 1474 0, 1475 SSL_ALL_CIPHERS, 1476 SSL_ALL_STRENGTHS, 1477 }, 1478 1479 /* Cipher C011 */ 1480 { 1481 1, 1482 TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA, 1483 TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA, 1484 SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 1485 SSL_NOT_EXP, 1486 0, 1487 128, 1488 128, 1489 SSL_ALL_CIPHERS, 1490 SSL_ALL_STRENGTHS, 1491 }, 1492 1493 /* Cipher C012 */ 1494 { 1495 1, 1496 TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA, 1497 TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA, 1498 SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1, 1499 SSL_NOT_EXP|SSL_HIGH, 1500 0, 1501 168, 1502 168, 1503 SSL_ALL_CIPHERS, 1504 SSL_ALL_STRENGTHS, 1505 }, 1506 1507 /* Cipher C013 */ 1508 { 1509 1, 1510 TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA, 1511 TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA, 1512 SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1513 SSL_NOT_EXP|SSL_HIGH, 1514 0, 1515 128, 1516 128, 1517 SSL_ALL_CIPHERS, 1518 SSL_ALL_STRENGTHS, 1519 }, 1520 1521 /* Cipher C014 */ 1522 { 1523 1, 1524 TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA, 1525 TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA, 1526 SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 1527 SSL_NOT_EXP|SSL_HIGH, 1528 0, 1529 256, 1530 256, 1531 SSL_ALL_CIPHERS, 1532 SSL_ALL_STRENGTHS, 1533 }, 1534 1535 /* Cipher C015 */ 1536 { 1537 1, 1538 TLS1_TXT_ECDH_anon_WITH_NULL_SHA, 1539 TLS1_CK_ECDH_anon_WITH_NULL_SHA, 1540 SSL_kECDHE|SSL_aNULL|SSL_eNULL|SSL_SHA|SSL_TLSV1, 1541 SSL_NOT_EXP, 1542 0, 1543 0, 1544 0, 1545 SSL_ALL_CIPHERS, 1546 SSL_ALL_STRENGTHS, 1547 }, 1548 1549 /* Cipher C016 */ 1550 { 1551 1, 1552 TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA, 1553 TLS1_CK_ECDH_anon_WITH_RC4_128_SHA, 1554 SSL_kECDHE|SSL_aNULL|SSL_RC4|SSL_SHA|SSL_TLSV1, 1555 SSL_NOT_EXP, 1556 0, 1557 128, 1558 128, 1559 SSL_ALL_CIPHERS, 1560 SSL_ALL_STRENGTHS, 1561 }, 1562 1563 /* Cipher C017 */ 1564 { 1565 1, 1566 TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA, 1567 TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA, 1568 SSL_kECDHE|SSL_aNULL|SSL_3DES|SSL_SHA|SSL_TLSV1, 1569 SSL_NOT_EXP|SSL_HIGH, 1570 0, 1571 168, 1572 168, 1573 SSL_ALL_CIPHERS, 1574 SSL_ALL_STRENGTHS, 1575 }, 1576 1577 /* Cipher C018 */ 1578 { 1579 1, 1580 TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA, 1581 TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA, 1582 SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, 1583 SSL_NOT_EXP|SSL_HIGH, 1584 0, 1585 128, 1586 128, 1587 SSL_ALL_CIPHERS, 1588 SSL_ALL_STRENGTHS, 1589 }, 1590 1591 /* Cipher C019 */ 1592 { 1593 1, 1594 TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA, 1595 TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA, 1596 SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, 1597 SSL_NOT_EXP|SSL_HIGH, 1598 0, 1599 256, 1600 256, 1601 SSL_ALL_CIPHERS, 1602 SSL_ALL_STRENGTHS, 1603 }, 1604#endif /* OPENSSL_NO_ECDH */ 1605 1606 1607/* end of list */ 1608 }; 1609 1610SSL3_ENC_METHOD SSLv3_enc_data={ 1611 ssl3_enc, 1612 ssl3_mac, 1613 ssl3_setup_key_block, 1614 ssl3_generate_master_secret, 1615 ssl3_change_cipher_state, 1616 ssl3_final_finish_mac, 1617 MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, 1618 ssl3_cert_verify_mac, 1619 SSL3_MD_CLIENT_FINISHED_CONST,4, 1620 SSL3_MD_SERVER_FINISHED_CONST,4, 1621 ssl3_alert_code, 1622 }; 1623 1624long ssl3_default_timeout(void) 1625 { 1626 /* 2 hours, the 24 hours mentioned in the SSLv3 spec 1627 * is way too long for http, the cache would over fill */ 1628 return(60*60*2); 1629 } 1630 1631IMPLEMENT_ssl3_meth_func(sslv3_base_method, 1632 ssl_undefined_function, 1633 ssl_undefined_function, 1634 ssl_bad_method) 1635 1636int ssl3_num_ciphers(void) 1637 { 1638 return(SSL3_NUM_CIPHERS); 1639 } 1640 1641SSL_CIPHER *ssl3_get_cipher(unsigned int u) 1642 { 1643 if (u < SSL3_NUM_CIPHERS) 1644 return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u])); 1645 else 1646 return(NULL); 1647 } 1648 1649int ssl3_pending(const SSL *s) 1650 { 1651 if (s->rstate == SSL_ST_READ_BODY) 1652 return 0; 1653 1654 return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0; 1655 } 1656 1657int ssl3_new(SSL *s) 1658 { 1659 SSL3_STATE *s3; 1660 1661 if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err; 1662 memset(s3,0,sizeof *s3); 1663 EVP_MD_CTX_init(&s3->finish_dgst1); 1664 EVP_MD_CTX_init(&s3->finish_dgst2); 1665 pq_64bit_init(&(s3->rrec.seq_num)); 1666 pq_64bit_init(&(s3->wrec.seq_num)); 1667 1668 s->s3=s3; 1669 1670 s->method->ssl_clear(s); 1671 return(1); 1672err: 1673 return(0); 1674 } 1675 1676void ssl3_free(SSL *s) 1677 { 1678 if(s == NULL) 1679 return; 1680 1681 ssl3_cleanup_key_block(s); 1682 if (s->s3->rbuf.buf != NULL) 1683 OPENSSL_free(s->s3->rbuf.buf); 1684 if (s->s3->wbuf.buf != NULL) 1685 OPENSSL_free(s->s3->wbuf.buf); 1686 if (s->s3->rrec.comp != NULL) 1687 OPENSSL_free(s->s3->rrec.comp); 1688#ifndef OPENSSL_NO_DH 1689 if (s->s3->tmp.dh != NULL) 1690 DH_free(s->s3->tmp.dh); 1691#endif 1692#ifndef OPENSSL_NO_ECDH 1693 if (s->s3->tmp.ecdh != NULL) 1694 EC_KEY_free(s->s3->tmp.ecdh); 1695#endif 1696 1697 if (s->s3->tmp.ca_names != NULL) 1698 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 1699 EVP_MD_CTX_cleanup(&s->s3->finish_dgst1); 1700 EVP_MD_CTX_cleanup(&s->s3->finish_dgst2); 1701 pq_64bit_free(&(s->s3->rrec.seq_num)); 1702 pq_64bit_free(&(s->s3->wrec.seq_num)); 1703 1704 OPENSSL_cleanse(s->s3,sizeof *s->s3); 1705 OPENSSL_free(s->s3); 1706 s->s3=NULL; 1707 } 1708 1709void ssl3_clear(SSL *s) 1710 { 1711 unsigned char *rp,*wp; 1712 size_t rlen, wlen; 1713 1714 ssl3_cleanup_key_block(s); 1715 if (s->s3->tmp.ca_names != NULL) 1716 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 1717 1718 if (s->s3->rrec.comp != NULL) 1719 { 1720 OPENSSL_free(s->s3->rrec.comp); 1721 s->s3->rrec.comp=NULL; 1722 } 1723#ifndef OPENSSL_NO_DH 1724 if (s->s3->tmp.dh != NULL) 1725 { 1726 DH_free(s->s3->tmp.dh); 1727 s->s3->tmp.dh = NULL; 1728 } 1729#endif 1730#ifndef OPENSSL_NO_ECDH 1731 if (s->s3->tmp.ecdh != NULL) 1732 { 1733 EC_KEY_free(s->s3->tmp.ecdh); 1734 s->s3->tmp.ecdh = NULL; 1735 } 1736#endif 1737#ifndef OPENSSL_NO_TLSEXT 1738#ifndef OPENSSL_NO_EC 1739 s->s3->is_probably_safari = 0; 1740#endif /* !OPENSSL_NO_EC */ 1741#endif /* !OPENSSL_NO_TLSEXT */ 1742 1743 rp = s->s3->rbuf.buf; 1744 wp = s->s3->wbuf.buf; 1745 rlen = s->s3->rbuf.len; 1746 wlen = s->s3->wbuf.len; 1747 1748 EVP_MD_CTX_cleanup(&s->s3->finish_dgst1); 1749 EVP_MD_CTX_cleanup(&s->s3->finish_dgst2); 1750 1751 memset(s->s3,0,sizeof *s->s3); 1752 s->s3->rbuf.buf = rp; 1753 s->s3->wbuf.buf = wp; 1754 s->s3->rbuf.len = rlen; 1755 s->s3->wbuf.len = wlen; 1756 1757 ssl_free_wbio_buffer(s); 1758 1759 s->packet_length=0; 1760 s->s3->renegotiate=0; 1761 s->s3->total_renegotiations=0; 1762 s->s3->num_renegotiations=0; 1763 s->s3->in_read_app_data=0; 1764 s->version=SSL3_VERSION; 1765 } 1766 1767long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) 1768 { 1769 int ret=0; 1770 1771#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA) 1772 if ( 1773#ifndef OPENSSL_NO_RSA 1774 cmd == SSL_CTRL_SET_TMP_RSA || 1775 cmd == SSL_CTRL_SET_TMP_RSA_CB || 1776#endif 1777#ifndef OPENSSL_NO_DSA 1778 cmd == SSL_CTRL_SET_TMP_DH || 1779 cmd == SSL_CTRL_SET_TMP_DH_CB || 1780#endif 1781 0) 1782 { 1783 if (!ssl_cert_inst(&s->cert)) 1784 { 1785 SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE); 1786 return(0); 1787 } 1788 } 1789#endif 1790 1791 switch (cmd) 1792 { 1793 case SSL_CTRL_GET_SESSION_REUSED: 1794 ret=s->hit; 1795 break; 1796 case SSL_CTRL_GET_CLIENT_CERT_REQUEST: 1797 break; 1798 case SSL_CTRL_GET_NUM_RENEGOTIATIONS: 1799 ret=s->s3->num_renegotiations; 1800 break; 1801 case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS: 1802 ret=s->s3->num_renegotiations; 1803 s->s3->num_renegotiations=0; 1804 break; 1805 case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS: 1806 ret=s->s3->total_renegotiations; 1807 break; 1808 case SSL_CTRL_GET_FLAGS: 1809 ret=(int)(s->s3->flags); 1810 break; 1811#ifndef OPENSSL_NO_RSA 1812 case SSL_CTRL_NEED_TMP_RSA: 1813 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) && 1814 ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 1815 (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))) 1816 ret = 1; 1817 break; 1818 case SSL_CTRL_SET_TMP_RSA: 1819 { 1820 RSA *rsa = (RSA *)parg; 1821 if (rsa == NULL) 1822 { 1823 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 1824 return(ret); 1825 } 1826 if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) 1827 { 1828 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB); 1829 return(ret); 1830 } 1831 if (s->cert->rsa_tmp != NULL) 1832 RSA_free(s->cert->rsa_tmp); 1833 s->cert->rsa_tmp = rsa; 1834 ret = 1; 1835 } 1836 break; 1837 case SSL_CTRL_SET_TMP_RSA_CB: 1838 { 1839 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1840 return(ret); 1841 } 1842 break; 1843#endif 1844#ifndef OPENSSL_NO_DH 1845 case SSL_CTRL_SET_TMP_DH: 1846 { 1847 DH *dh = (DH *)parg; 1848 if (dh == NULL) 1849 { 1850 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 1851 return(ret); 1852 } 1853 if ((dh = DHparams_dup(dh)) == NULL) 1854 { 1855 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 1856 return(ret); 1857 } 1858 if (!(s->options & SSL_OP_SINGLE_DH_USE)) 1859 { 1860 if (!DH_generate_key(dh)) 1861 { 1862 DH_free(dh); 1863 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 1864 return(ret); 1865 } 1866 } 1867 if (s->cert->dh_tmp != NULL) 1868 DH_free(s->cert->dh_tmp); 1869 s->cert->dh_tmp = dh; 1870 ret = 1; 1871 } 1872 break; 1873 case SSL_CTRL_SET_TMP_DH_CB: 1874 { 1875 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1876 return(ret); 1877 } 1878 break; 1879#endif 1880#ifndef OPENSSL_NO_ECDH 1881 case SSL_CTRL_SET_TMP_ECDH: 1882 { 1883 EC_KEY *ecdh = NULL; 1884 1885 if (parg == NULL) 1886 { 1887 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 1888 return(ret); 1889 } 1890 if (!EC_KEY_up_ref((EC_KEY *)parg)) 1891 { 1892 SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB); 1893 return(ret); 1894 } 1895 ecdh = (EC_KEY *)parg; 1896 if (!(s->options & SSL_OP_SINGLE_ECDH_USE)) 1897 { 1898 if (!EC_KEY_generate_key(ecdh)) 1899 { 1900 EC_KEY_free(ecdh); 1901 SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB); 1902 return(ret); 1903 } 1904 } 1905 if (s->cert->ecdh_tmp != NULL) 1906 EC_KEY_free(s->cert->ecdh_tmp); 1907 s->cert->ecdh_tmp = ecdh; 1908 ret = 1; 1909 } 1910 break; 1911 case SSL_CTRL_SET_TMP_ECDH_CB: 1912 { 1913 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1914 return(ret); 1915 } 1916 break; 1917#endif /* !OPENSSL_NO_ECDH */ 1918#ifndef OPENSSL_NO_TLSEXT 1919 case SSL_CTRL_SET_TLSEXT_HOSTNAME: 1920 if (larg == TLSEXT_NAMETYPE_host_name) 1921 { 1922 if (s->tlsext_hostname != NULL) 1923 OPENSSL_free(s->tlsext_hostname); 1924 s->tlsext_hostname = NULL; 1925 1926 ret = 1; 1927 if (parg == NULL) 1928 break; 1929 if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name) 1930 { 1931 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME); 1932 return 0; 1933 } 1934 if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL) 1935 { 1936 SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR); 1937 return 0; 1938 } 1939 } 1940 else 1941 { 1942 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE); 1943 return 0; 1944 } 1945 break; 1946 case SSL_CTRL_SET_TLSEXT_DEBUG_ARG: 1947 s->tlsext_debug_arg=parg; 1948 ret = 1; 1949 break; 1950 1951 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE: 1952 s->tlsext_status_type=larg; 1953 ret = 1; 1954 break; 1955 1956 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS: 1957 *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts; 1958 ret = 1; 1959 break; 1960 1961 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS: 1962 s->tlsext_ocsp_exts = parg; 1963 ret = 1; 1964 break; 1965 1966 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS: 1967 *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids; 1968 ret = 1; 1969 break; 1970 1971 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS: 1972 s->tlsext_ocsp_ids = parg; 1973 ret = 1; 1974 break; 1975 1976 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP: 1977 *(unsigned char **)parg = s->tlsext_ocsp_resp; 1978 return s->tlsext_ocsp_resplen; 1979 1980 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP: 1981 if (s->tlsext_ocsp_resp) 1982 OPENSSL_free(s->tlsext_ocsp_resp); 1983 s->tlsext_ocsp_resp = parg; 1984 s->tlsext_ocsp_resplen = larg; 1985 ret = 1; 1986 break; 1987 1988#endif /* !OPENSSL_NO_TLSEXT */ 1989 1990 case SSL_CTRL_CHECK_PROTO_VERSION: 1991 /* For library-internal use; checks that the current protocol 1992 * is the highest enabled version (according to s->ctx->method, 1993 * as version negotiation may have changed s->method). */ 1994 if (s->version == s->ctx->method->version) 1995 return 1; 1996 /* Apparently we're using a version-flexible SSL_METHOD 1997 * (not at its highest protocol version). */ 1998 if (s->ctx->method->version == SSLv23_method()->version) 1999 { 2000#if TLS_MAX_VERSION != TLS1_VERSION 2001# error Code needs update for SSLv23_method() support beyond TLS1_VERSION. 2002#endif 2003 if (!(s->options & SSL_OP_NO_TLSv1)) 2004 return s->version == TLS1_VERSION; 2005 if (!(s->options & SSL_OP_NO_SSLv3)) 2006 return s->version == SSL3_VERSION; 2007 if (!(s->options & SSL_OP_NO_SSLv2)) 2008 return s->version == SSL2_VERSION; 2009 } 2010 return 0; /* Unexpected state; fail closed. */ 2011 2012 default: 2013 break; 2014 } 2015 return(ret); 2016 } 2017 2018long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) 2019 { 2020 int ret=0; 2021 2022#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA) 2023 if ( 2024#ifndef OPENSSL_NO_RSA 2025 cmd == SSL_CTRL_SET_TMP_RSA_CB || 2026#endif 2027#ifndef OPENSSL_NO_DSA 2028 cmd == SSL_CTRL_SET_TMP_DH_CB || 2029#endif 2030 0) 2031 { 2032 if (!ssl_cert_inst(&s->cert)) 2033 { 2034 SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE); 2035 return(0); 2036 } 2037 } 2038#endif 2039 2040 switch (cmd) 2041 { 2042#ifndef OPENSSL_NO_RSA 2043 case SSL_CTRL_SET_TMP_RSA_CB: 2044 { 2045 s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 2046 } 2047 break; 2048#endif 2049#ifndef OPENSSL_NO_DH 2050 case SSL_CTRL_SET_TMP_DH_CB: 2051 { 2052 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 2053 } 2054 break; 2055#endif 2056#ifndef OPENSSL_NO_ECDH 2057 case SSL_CTRL_SET_TMP_ECDH_CB: 2058 { 2059 s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp; 2060 } 2061 break; 2062#endif 2063#ifndef OPENSSL_NO_TLSEXT 2064 case SSL_CTRL_SET_TLSEXT_DEBUG_CB: 2065 s->tlsext_debug_cb=(void (*)(SSL *,int ,int, 2066 unsigned char *, int, void *))fp; 2067 break; 2068#endif 2069 default: 2070 break; 2071 } 2072 return(ret); 2073 } 2074 2075long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) 2076 { 2077 CERT *cert; 2078 2079 cert=ctx->cert; 2080 2081 switch (cmd) 2082 { 2083#ifndef OPENSSL_NO_RSA 2084 case SSL_CTRL_NEED_TMP_RSA: 2085 if ( (cert->rsa_tmp == NULL) && 2086 ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 2087 (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))) 2088 ) 2089 return(1); 2090 else 2091 return(0); 2092 /* break; */ 2093 case SSL_CTRL_SET_TMP_RSA: 2094 { 2095 RSA *rsa; 2096 int i; 2097 2098 rsa=(RSA *)parg; 2099 i=1; 2100 if (rsa == NULL) 2101 i=0; 2102 else 2103 { 2104 if ((rsa=RSAPrivateKey_dup(rsa)) == NULL) 2105 i=0; 2106 } 2107 if (!i) 2108 { 2109 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB); 2110 return(0); 2111 } 2112 else 2113 { 2114 if (cert->rsa_tmp != NULL) 2115 RSA_free(cert->rsa_tmp); 2116 cert->rsa_tmp=rsa; 2117 return(1); 2118 } 2119 } 2120 /* break; */ 2121 case SSL_CTRL_SET_TMP_RSA_CB: 2122 { 2123 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2124 return(0); 2125 } 2126 break; 2127#endif 2128#ifndef OPENSSL_NO_DH 2129 case SSL_CTRL_SET_TMP_DH: 2130 { 2131 DH *new=NULL,*dh; 2132 2133 dh=(DH *)parg; 2134 if ((new=DHparams_dup(dh)) == NULL) 2135 { 2136 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); 2137 return 0; 2138 } 2139 if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) 2140 { 2141 if (!DH_generate_key(new)) 2142 { 2143 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); 2144 DH_free(new); 2145 return 0; 2146 } 2147 } 2148 if (cert->dh_tmp != NULL) 2149 DH_free(cert->dh_tmp); 2150 cert->dh_tmp=new; 2151 return 1; 2152 } 2153 /*break; */ 2154 case SSL_CTRL_SET_TMP_DH_CB: 2155 { 2156 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2157 return(0); 2158 } 2159 break; 2160#endif 2161#ifndef OPENSSL_NO_ECDH 2162 case SSL_CTRL_SET_TMP_ECDH: 2163 { 2164 EC_KEY *ecdh = NULL; 2165 2166 if (parg == NULL) 2167 { 2168 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB); 2169 return 0; 2170 } 2171 ecdh = EC_KEY_dup((EC_KEY *)parg); 2172 if (ecdh == NULL) 2173 { 2174 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB); 2175 return 0; 2176 } 2177 if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE)) 2178 { 2179 if (!EC_KEY_generate_key(ecdh)) 2180 { 2181 EC_KEY_free(ecdh); 2182 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB); 2183 return 0; 2184 } 2185 } 2186 2187 if (cert->ecdh_tmp != NULL) 2188 { 2189 EC_KEY_free(cert->ecdh_tmp); 2190 } 2191 cert->ecdh_tmp = ecdh; 2192 return 1; 2193 } 2194 /* break; */ 2195 case SSL_CTRL_SET_TMP_ECDH_CB: 2196 { 2197 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2198 return(0); 2199 } 2200 break; 2201#endif /* !OPENSSL_NO_ECDH */ 2202#ifndef OPENSSL_NO_TLSEXT 2203 case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG: 2204 ctx->tlsext_servername_arg=parg; 2205 break; 2206 case SSL_CTRL_SET_TLSEXT_TICKET_KEYS: 2207 case SSL_CTRL_GET_TLSEXT_TICKET_KEYS: 2208 { 2209 unsigned char *keys = parg; 2210 if (!keys) 2211 return 48; 2212 if (larg != 48) 2213 { 2214 SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH); 2215 return 0; 2216 } 2217 if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) 2218 { 2219 memcpy(ctx->tlsext_tick_key_name, keys, 16); 2220 memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16); 2221 memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16); 2222 } 2223 else 2224 { 2225 memcpy(keys, ctx->tlsext_tick_key_name, 16); 2226 memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16); 2227 memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16); 2228 } 2229 return 1; 2230 } 2231 2232 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG: 2233 ctx->tlsext_status_arg=parg; 2234 return 1; 2235 break; 2236 2237#endif /* !OPENSSL_NO_TLSEXT */ 2238 /* A Thawte special :-) */ 2239 case SSL_CTRL_EXTRA_CHAIN_CERT: 2240 if (ctx->extra_certs == NULL) 2241 { 2242 if ((ctx->extra_certs=sk_X509_new_null()) == NULL) 2243 return(0); 2244 } 2245 sk_X509_push(ctx->extra_certs,(X509 *)parg); 2246 break; 2247 2248 default: 2249 return(0); 2250 } 2251 return(1); 2252 } 2253 2254long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) 2255 { 2256 CERT *cert; 2257 2258 cert=ctx->cert; 2259 2260 switch (cmd) 2261 { 2262#ifndef OPENSSL_NO_RSA 2263 case SSL_CTRL_SET_TMP_RSA_CB: 2264 { 2265 cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 2266 } 2267 break; 2268#endif 2269#ifndef OPENSSL_NO_DH 2270 case SSL_CTRL_SET_TMP_DH_CB: 2271 { 2272 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 2273 } 2274 break; 2275#endif 2276#ifndef OPENSSL_NO_ECDH 2277 case SSL_CTRL_SET_TMP_ECDH_CB: 2278 { 2279 cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp; 2280 } 2281 break; 2282#endif 2283#ifndef OPENSSL_NO_TLSEXT 2284 case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB: 2285 ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp; 2286 break; 2287 2288 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB: 2289 ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp; 2290 break; 2291 2292 case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB: 2293 ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char *, 2294 unsigned char *, 2295 EVP_CIPHER_CTX *, 2296 HMAC_CTX *, int))fp; 2297 break; 2298 2299#endif 2300 2301 default: 2302 return(0); 2303 } 2304 return(1); 2305 } 2306 2307/* This function needs to check if the ciphers required are actually 2308 * available */ 2309SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p) 2310 { 2311 SSL_CIPHER c,*cp; 2312 unsigned long id; 2313 2314 id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1]; 2315 c.id=id; 2316 cp = (SSL_CIPHER *)OBJ_bsearch((char *)&c, 2317 (char *)ssl3_ciphers, 2318 SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER), 2319 FP_ICC ssl_cipher_id_cmp); 2320 if (cp == NULL || cp->valid == 0) 2321 return NULL; 2322 else 2323 return cp; 2324 } 2325 2326int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p) 2327 { 2328 long l; 2329 2330 if (p != NULL) 2331 { 2332 l=c->id; 2333 if ((l & 0xff000000) != 0x03000000) return(0); 2334 p[0]=((unsigned char)(l>> 8L))&0xFF; 2335 p[1]=((unsigned char)(l ))&0xFF; 2336 } 2337 return(2); 2338 } 2339 2340SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, 2341 STACK_OF(SSL_CIPHER) *srvr) 2342 { 2343 SSL_CIPHER *c,*ret=NULL; 2344 STACK_OF(SSL_CIPHER) *prio, *allow; 2345 int i,j,ok; 2346 2347 CERT *cert; 2348 unsigned long alg,mask,emask; 2349 2350 /* Let's see which ciphers we can support */ 2351 cert=s->cert; 2352 2353#if 0 2354 /* Do not set the compare functions, because this may lead to a 2355 * reordering by "id". We want to keep the original ordering. 2356 * We may pay a price in performance during sk_SSL_CIPHER_find(), 2357 * but would have to pay with the price of sk_SSL_CIPHER_dup(). 2358 */ 2359 sk_SSL_CIPHER_set_cmp_func(srvr, ssl_cipher_ptr_id_cmp); 2360 sk_SSL_CIPHER_set_cmp_func(clnt, ssl_cipher_ptr_id_cmp); 2361#endif 2362 2363#ifdef CIPHER_DEBUG 2364 printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), srvr); 2365 for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i) 2366 { 2367 c=sk_SSL_CIPHER_value(srvr,i); 2368 printf("%p:%s\n",c,c->name); 2369 } 2370 printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), clnt); 2371 for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i) 2372 { 2373 c=sk_SSL_CIPHER_value(clnt,i); 2374 printf("%p:%s\n",c,c->name); 2375 } 2376#endif 2377 2378 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) 2379 { 2380 prio = srvr; 2381 allow = clnt; 2382 } 2383 else 2384 { 2385 prio = clnt; 2386 allow = srvr; 2387 } 2388 2389 for (i=0; i<sk_SSL_CIPHER_num(prio); i++) 2390 { 2391 c=sk_SSL_CIPHER_value(prio,i); 2392 2393 ssl_set_cert_masks(cert,c); 2394 mask=cert->mask; 2395 emask=cert->export_mask; 2396 2397#ifdef KSSL_DEBUG 2398 printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms); 2399#endif /* KSSL_DEBUG */ 2400 2401 alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK); 2402#ifndef OPENSSL_NO_KRB5 2403 if (alg & SSL_KRB5) 2404 { 2405 if ( !kssl_keytab_is_available(s->kssl_ctx) ) 2406 continue; 2407 } 2408#endif /* OPENSSL_NO_KRB5 */ 2409 if (SSL_C_IS_EXPORT(c)) 2410 { 2411 ok=((alg & emask) == alg)?1:0; 2412#ifdef CIPHER_DEBUG 2413 printf("%d:[%08lX:%08lX]%p:%s (export)\n",ok,alg,emask, 2414 c,c->name); 2415#endif 2416 } 2417 else 2418 { 2419 ok=((alg & mask) == alg)?1:0; 2420#ifdef CIPHER_DEBUG 2421 printf("%d:[%08lX:%08lX]%p:%s\n",ok,alg,mask,c, 2422 c->name); 2423#endif 2424 } 2425 2426 if (!ok) continue; 2427 j=sk_SSL_CIPHER_find(allow,c); 2428 if (j >= 0) 2429 { 2430#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT) 2431 if ((alg & SSL_kECDHE) && (alg & SSL_aECDSA) && s->s3->is_probably_safari) 2432 { 2433 if (!ret) ret=sk_SSL_CIPHER_value(allow,j); 2434 continue; 2435 } 2436#endif 2437 ret=sk_SSL_CIPHER_value(allow,j); 2438 break; 2439 } 2440 } 2441 return(ret); 2442 } 2443 2444int ssl3_get_req_cert_type(SSL *s, unsigned char *p) 2445 { 2446 int ret=0; 2447 unsigned long alg; 2448 2449 alg=s->s3->tmp.new_cipher->algorithms; 2450 2451#ifndef OPENSSL_NO_DH 2452 if (alg & (SSL_kDHr|SSL_kEDH)) 2453 { 2454# ifndef OPENSSL_NO_RSA 2455 p[ret++]=SSL3_CT_RSA_FIXED_DH; 2456# endif 2457# ifndef OPENSSL_NO_DSA 2458 p[ret++]=SSL3_CT_DSS_FIXED_DH; 2459# endif 2460 } 2461 if ((s->version == SSL3_VERSION) && 2462 (alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) 2463 { 2464# ifndef OPENSSL_NO_RSA 2465 p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH; 2466# endif 2467# ifndef OPENSSL_NO_DSA 2468 p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH; 2469# endif 2470 } 2471#endif /* !OPENSSL_NO_DH */ 2472#ifndef OPENSSL_NO_RSA 2473 p[ret++]=SSL3_CT_RSA_SIGN; 2474#endif 2475#ifndef OPENSSL_NO_DSA 2476 p[ret++]=SSL3_CT_DSS_SIGN; 2477#endif 2478#ifndef OPENSSL_NO_ECDH 2479 /* We should ask for fixed ECDH certificates only 2480 * for SSL_kECDH (and not SSL_kECDHE) 2481 */ 2482 if ((alg & SSL_kECDH) && (s->version >= TLS1_VERSION)) 2483 { 2484 p[ret++]=TLS_CT_RSA_FIXED_ECDH; 2485 p[ret++]=TLS_CT_ECDSA_FIXED_ECDH; 2486 } 2487#endif 2488 2489#ifndef OPENSSL_NO_ECDSA 2490 /* ECDSA certs can be used with RSA cipher suites as well 2491 * so we don't need to check for SSL_kECDH or SSL_kECDHE 2492 */ 2493 if (s->version >= TLS1_VERSION) 2494 { 2495 p[ret++]=TLS_CT_ECDSA_SIGN; 2496 } 2497#endif 2498 return(ret); 2499 } 2500 2501int ssl3_shutdown(SSL *s) 2502 { 2503 int ret; 2504 2505 /* Don't do anything much if we have not done the handshake or 2506 * we don't want to send messages :-) */ 2507 if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) 2508 { 2509 s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); 2510 return(1); 2511 } 2512 2513 if (!(s->shutdown & SSL_SENT_SHUTDOWN)) 2514 { 2515 s->shutdown|=SSL_SENT_SHUTDOWN; 2516#if 1 2517 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY); 2518#endif 2519 /* our shutdown alert has been sent now, and if it still needs 2520 * to be written, s->s3->alert_dispatch will be true */ 2521 if (s->s3->alert_dispatch) 2522 return(-1); /* return WANT_WRITE */ 2523 } 2524 else if (s->s3->alert_dispatch) 2525 { 2526 /* resend it if not sent */ 2527#if 1 2528 ret=s->method->ssl_dispatch_alert(s); 2529 if(ret == -1) 2530 { 2531 /* we only get to return -1 here the 2nd/Nth 2532 * invocation, we must have already signalled 2533 * return 0 upon a previous invoation, 2534 * return WANT_WRITE */ 2535 return(ret); 2536 } 2537#endif 2538 } 2539 else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) 2540 { 2541 /* If we are waiting for a close from our peer, we are closed */ 2542 s->method->ssl_read_bytes(s,0,NULL,0,0); 2543 if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) 2544 { 2545 return(-1); /* return WANT_READ */ 2546 } 2547 } 2548 2549 if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) && 2550 !s->s3->alert_dispatch) 2551 return(1); 2552 else 2553 return(0); 2554 } 2555 2556int ssl3_write(SSL *s, const void *buf, int len) 2557 { 2558 int ret,n; 2559 2560#if 0 2561 if (s->shutdown & SSL_SEND_SHUTDOWN) 2562 { 2563 s->rwstate=SSL_NOTHING; 2564 return(0); 2565 } 2566#endif 2567 clear_sys_error(); 2568 if (s->s3->renegotiate) ssl3_renegotiate_check(s); 2569 2570 /* This is an experimental flag that sends the 2571 * last handshake message in the same packet as the first 2572 * use data - used to see if it helps the TCP protocol during 2573 * session-id reuse */ 2574 /* The second test is because the buffer may have been removed */ 2575 if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) 2576 { 2577 /* First time through, we write into the buffer */ 2578 if (s->s3->delay_buf_pop_ret == 0) 2579 { 2580 ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, 2581 buf,len); 2582 if (ret <= 0) return(ret); 2583 2584 s->s3->delay_buf_pop_ret=ret; 2585 } 2586 2587 s->rwstate=SSL_WRITING; 2588 n=BIO_flush(s->wbio); 2589 if (n <= 0) return(n); 2590 s->rwstate=SSL_NOTHING; 2591 2592 /* We have flushed the buffer, so remove it */ 2593 ssl_free_wbio_buffer(s); 2594 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; 2595 2596 ret=s->s3->delay_buf_pop_ret; 2597 s->s3->delay_buf_pop_ret=0; 2598 } 2599 else 2600 { 2601 ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA, 2602 buf,len); 2603 if (ret <= 0) return(ret); 2604 } 2605 2606 return(ret); 2607 } 2608 2609static int ssl3_read_internal(SSL *s, void *buf, int len, int peek) 2610 { 2611 int ret; 2612 2613 clear_sys_error(); 2614 if (s->s3->renegotiate) ssl3_renegotiate_check(s); 2615 s->s3->in_read_app_data=1; 2616 ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek); 2617 if ((ret == -1) && (s->s3->in_read_app_data == 2)) 2618 { 2619 /* ssl3_read_bytes decided to call s->handshake_func, which 2620 * called ssl3_read_bytes to read handshake data. 2621 * However, ssl3_read_bytes actually found application data 2622 * and thinks that application data makes sense here; so disable 2623 * handshake processing and try to read application data again. */ 2624 s->in_handshake++; 2625 ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek); 2626 s->in_handshake--; 2627 } 2628 else 2629 s->s3->in_read_app_data=0; 2630 2631 return(ret); 2632 } 2633 2634int ssl3_read(SSL *s, void *buf, int len) 2635 { 2636 return ssl3_read_internal(s, buf, len, 0); 2637 } 2638 2639int ssl3_peek(SSL *s, void *buf, int len) 2640 { 2641 return ssl3_read_internal(s, buf, len, 1); 2642 } 2643 2644int ssl3_renegotiate(SSL *s) 2645 { 2646 if (s->handshake_func == NULL) 2647 return(1); 2648 2649 if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) 2650 return(0); 2651 2652 s->s3->renegotiate=1; 2653 return(1); 2654 } 2655 2656int ssl3_renegotiate_check(SSL *s) 2657 { 2658 int ret=0; 2659 2660 if (s->s3->renegotiate) 2661 { 2662 if ( (s->s3->rbuf.left == 0) && 2663 (s->s3->wbuf.left == 0) && 2664 !SSL_in_init(s)) 2665 { 2666/* 2667if we are the server, and we have sent a 'RENEGOTIATE' message, we 2668need to go to SSL_ST_ACCEPT. 2669*/ 2670 /* SSL_ST_ACCEPT */ 2671 s->state=SSL_ST_RENEGOTIATE; 2672 s->s3->renegotiate=0; 2673 s->s3->num_renegotiations++; 2674 s->s3->total_renegotiations++; 2675 ret=1; 2676 } 2677 } 2678 return(ret); 2679 } 2680