*/
#include <stdio.h>
#include <openssl/objects.h>
+#ifndef OPENSSL_NO_COMP
#include <openssl/comp.h>
+#endif
+
#include "ssl_locl.h"
#define SSL_ENC_DES_IDX 0
#define SSL_ENC_NULL_IDX 6
#define SSL_ENC_AES128_IDX 7
#define SSL_ENC_AES256_IDX 8
-#define SSL_ENC_NUM_IDX 9
#define SSL_ENC_CAMELLIA128_IDX 9
#define SSL_ENC_CAMELLIA256_IDX 10
-#undef SSL_ENC_NUM_IDX
-#define SSL_ENC_NUM_IDX 11
+#define SSL_ENC_SEED_IDX 11
+#define SSL_ENC_NUM_IDX 12
static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
#ifndef OPENSSL_NO_IDEA
{0,SSL_TXT_IDEA,0,SSL_IDEA, 0,0,0,0,SSL_ENC_MASK,0},
#endif
+ {0,SSL_TXT_SEED,0,SSL_SEED, 0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_eFZA,0,SSL_eFZA, 0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_AES, 0,SSL_AES, 0,0,0,0,SSL_ENC_MASK,0},
- {0,SSL_TXT_CAMELLIA, 0,SSL_CAMELLIA, 0,0,0,0,SSL_ENC_MASK,0},
+ {0,SSL_TXT_CAMELLIA,0,SSL_CAMELLIA, 0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_MD5, 0,SSL_MD5, 0,0,0,0,SSL_MAC_MASK,0},
{0,SSL_TXT_SHA1,0,SSL_SHA1, 0,0,0,0,SSL_MAC_MASK,0},
{0,SSL_TXT_LOW, 0, 0, SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
{0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
{0,SSL_TXT_HIGH, 0, 0, SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
+ {0,SSL_TXT_FIPS, 0, 0, SSL_FIPS, 0,0,0,0,SSL_FIPS|SSL_STRONG_NONE},
};
void ssl_load_ciphers(void)
EVP_get_cipherbyname(SN_camellia_128_cbc);
ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]=
EVP_get_cipherbyname(SN_camellia_256_cbc);
+ ssl_cipher_methods[SSL_ENC_SEED_IDX]=
+ EVP_get_cipherbyname(SN_seed_cbc);
ssl_digest_methods[SSL_MD_MD5_IDX]=
EVP_get_digestbyname(SN_md5);
default: i=-1; break;
}
break;
+ case SSL_SEED:
+ i=SSL_ENC_SEED_IDX;
+ break;
default:
i= -1;
*tail=curr;
}
-static unsigned long ssl_cipher_get_disabled(void)
+struct disabled_masks { /* This is a kludge no longer needed with OpenSSL 0.9.9,
+ * where 128-bit and 256-bit algorithms simply will get
+ * separate bits. */
+ unsigned long mask; /* everything except m256 */
+ unsigned long m256; /* applies to 256-bit algorithms only */
+};
+
+static struct disabled_masks ssl_cipher_get_disabled(void)
{
unsigned long mask;
+ unsigned long m256;
+ struct disabled_masks ret;
mask = SSL_kFZA;
#ifdef OPENSSL_NO_RSA
mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0;
- mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
- mask |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA:0;
+ mask |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED:0;
mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
- return(mask);
+ /* finally consider algorithms where mask and m256 differ */
+ m256 = mask;
+ mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
+ mask |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA:0;
+ m256 |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES:0;
+ m256 |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA:0;
+
+ ret.mask = mask;
+ ret.m256 = m256;
+ return ret;
}
static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
- int num_of_ciphers, unsigned long mask, CIPHER_ORDER *co_list,
- CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+ int num_of_ciphers, unsigned long mask, unsigned long m256,
+ CIPHER_ORDER *co_list, CIPHER_ORDER **head_p,
+ CIPHER_ORDER **tail_p)
{
int i, co_list_num;
SSL_CIPHER *c;
for (i = 0; i < num_of_ciphers; i++)
{
c = ssl_method->get_cipher(i);
+#define IS_MASKED(c) ((c)->algorithms & (((c)->alg_bits == 256) ? m256 : mask))
/* drop those that use any of that is not available */
- if ((c != NULL) && c->valid && !(c->algorithms & mask))
+#ifdef OPENSSL_FIPS
+ if ((c != NULL) && c->valid && !IS_MASKED(c)
+ && (!FIPS_mode() || (c->algo_strength & SSL_FIPS)))
+#else
+ if ((c != NULL) && c->valid && !IS_MASKED(c))
+#endif
{
co_list[co_list_num].cipher = c;
co_list[co_list_num].next = NULL;
* rest of the command, if any left, until
* end or ':' is found.
*/
- while ((*l != '\0') && ITEM_SEP(*l))
+ while ((*l != '\0') && !ITEM_SEP(*l))
l++;
}
else if (found)
}
else
{
- while ((*l != '\0') && ITEM_SEP(*l))
+ while ((*l != '\0') && !ITEM_SEP(*l))
l++;
}
if (*l == '\0') break; /* done */
{
int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
unsigned long disabled_mask;
+ unsigned long disabled_m256;
STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
const char *rule_p;
CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
* To reduce the work to do we only want to process the compiled
* in algorithms, so we first get the mask of disabled ciphers.
*/
- disabled_mask = ssl_cipher_get_disabled();
+ {
+ struct disabled_masks d;
+ d = ssl_cipher_get_disabled();
+ disabled_mask = d.mask;
+ disabled_m256 = d.m256;
+ }
/*
* Now we have to collect the available ciphers from the compiled
}
ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,
- co_list, &head, &tail);
+ disabled_m256, co_list, &head, &tail);
/*
* We also need cipher aliases for selecting based on the rule_str.
SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
return(NULL); /* Failure */
}
- ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask,
- head);
+ ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
+ (disabled_mask & disabled_m256), head);
/*
* If the rule_string begins with DEFAULT, apply the default rule
*/
for (curr = head; curr != NULL; curr = curr->next)
{
+#ifdef OPENSSL_FIPS
+ if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
+#else
if (curr->active)
+#endif
{
sk_SSL_CIPHER_push(cipherstack, curr->cipher);
#ifdef CIPHER_DEBUG
if (*cipher_list_by_id != NULL)
sk_SSL_CIPHER_free(*cipher_list_by_id);
*cipher_list_by_id = tmp_cipher_list;
- sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
+ (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
+ sk_SSL_CIPHER_sort(*cipher_list_by_id);
return(cipherstack);
}
default: enc="Camellia(?""?""?)"; break;
}
break;
-
+ case SSL_SEED:
+ enc="SEED(128)";
+ break;
+
default:
enc="unknown";
break;
comp->method=cm;
load_builtin_compressions();
if (ssl_comp_methods
- && !sk_SSL_COMP_find(ssl_comp_methods,comp))
+ && sk_SSL_COMP_find(ssl_comp_methods,comp) >= 0)
{
OPENSSL_free(comp);
MemCheck_on();