This commit was manufactured by cvs2svn to create branch

[oweals/openssl.git] / ssl / ssl_ciph.c

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 8fc0d3e1b885cb43ef4d8b659005d0cab1b7519c..b68ed81e5227626bffe6297c30bb51903571512e 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/comp.h>
+#include <openssl/fips.h>
 #include "ssl_locl.h"
 
 #define SSL_ENC_DES_IDX                0
@@ -125,7 +126,9 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_3DES,0,SSL_3DES,  0,0,0,0,SSL_ENC_MASK,0},
        {0,SSL_TXT_RC4, 0,SSL_RC4,   0,0,0,0,SSL_ENC_MASK,0},
        {0,SSL_TXT_RC2, 0,SSL_RC2,   0,0,0,0,SSL_ENC_MASK,0},
+#ifndef OPENSSL_NO_IDEA
        {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,0,0,0,SSL_ENC_MASK,0},
+#endif
        {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
        {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,0,0,0,SSL_ENC_MASK,0},
        {0,SSL_TXT_AES, 0,SSL_AES,   0,0,0,0,SSL_ENC_MASK,0},
@@ -151,13 +154,13 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_LOW,   0, 0,   SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
        {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
        {0,SSL_TXT_HIGH,  0, 0,  SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
+       {0,SSL_TXT_FIPS,  0, 0,  SSL_FIPS, 0,0,0,0,SSL_FIPS|SSL_STRONG_NONE},
        };
 
 static int init_ciphers=1;
 
 static void load_ciphers(void)
        {
-       init_ciphers=0;
        ssl_cipher_methods[SSL_ENC_DES_IDX]= 
                EVP_get_cipherbyname(SN_des_cbc);
        ssl_cipher_methods[SSL_ENC_3DES_IDX]=
@@ -166,8 +169,12 @@ static void load_ciphers(void)
                EVP_get_cipherbyname(SN_rc4);
        ssl_cipher_methods[SSL_ENC_RC2_IDX]= 
                EVP_get_cipherbyname(SN_rc2_cbc);
+#ifndef OPENSSL_NO_IDEA
        ssl_cipher_methods[SSL_ENC_IDEA_IDX]= 
                EVP_get_cipherbyname(SN_idea_cbc);
+#else
+       ssl_cipher_methods[SSL_ENC_IDEA_IDX]= NULL;
+#endif
        ssl_cipher_methods[SSL_ENC_AES128_IDX]=
          EVP_get_cipherbyname(SN_aes_128_cbc);
        ssl_cipher_methods[SSL_ENC_AES256_IDX]=
@@ -177,9 +184,10 @@ static void load_ciphers(void)
                EVP_get_digestbyname(SN_md5);
        ssl_digest_methods[SSL_MD_SHA1_IDX]=
                EVP_get_digestbyname(SN_sha1);
+       init_ciphers=0;
        }
 
-int ssl_cipher_get_evp(SSL_SESSION *s, const EVP_CIPHER **enc,
+int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
             const EVP_MD **md, SSL_COMP **comp)
        {
        int i;
@@ -353,7 +361,12 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
                {
                c = ssl_method->get_cipher(i);
                /* drop those that use any of that is not available */
+#ifdef OPENSSL_FIPS
+               if ((c != NULL) && c->valid && !(c->algorithms & mask)
+                       && (!FIPS_mode() || (c->algo_strength & SSL_FIPS)))
+#else
                if ((c != NULL) && c->valid && !(c->algorithms & mask))
+#endif
                        {
                        co_list[co_list_num].cipher = c;
                        co_list[co_list_num].next = NULL;
@@ -848,7 +861,11 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         */
        for (curr = head; curr != NULL; curr = curr->next)
                {
+#ifdef OPENSSL_FIPS
+               if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
+#else
                if (curr->active)
+#endif
                        {
                        sk_SSL_CIPHER_push(cipherstack, curr->cipher);
 #ifdef CIPHER_DEBUG
@@ -906,7 +923,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        {
        int is_export,pkl,kl;
-       char *ver,*exp;
+       char *ver,*exp_str;
        char *kx,*au,*enc,*mac;
        unsigned long alg,alg2,alg_s;
 #ifdef KSSL_DEBUG
@@ -922,7 +939,7 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        is_export=SSL_C_IS_EXPORT(cipher);
        pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
        kl=SSL_C_EXPORT_KEYLENGTH(cipher);
-       exp=is_export?" export":"";
+       exp_str=is_export?" export":"";
 
        if (alg & SSL_SSLV2)
                ver="SSLv2";
@@ -1041,14 +1058,14 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
                return("Buffer too small");
 
 #ifdef KSSL_DEBUG
-       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp,alg);
+       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str,alg);
 #else
-       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp);
+       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str);
 #endif /* KSSL_DEBUG */
        return(buf);
        }
 
-char *SSL_CIPHER_get_version(SSL_CIPHER *c)
+char *SSL_CIPHER_get_version(const SSL_CIPHER *c)
        {
        int i;
 
@@ -1063,7 +1080,7 @@ char *SSL_CIPHER_get_version(SSL_CIPHER *c)
        }
 
 /* return the actual cipher being used */
-const char *SSL_CIPHER_get_name(SSL_CIPHER *c)
+const char *SSL_CIPHER_get_name(const SSL_CIPHER *c)
        {
        if (c != NULL)
                return(c->name);
@@ -1071,7 +1088,7 @@ const char *SSL_CIPHER_get_name(SSL_CIPHER *c)
        }
 
 /* number of bits for symmetric cipher */
-int SSL_CIPHER_get_bits(SSL_CIPHER *c, int *alg_bits)
+int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits)
        {
        int ret=0;