RFC 2712 redefines the codes for use of Kerberos 5 in SSL/TLS.

PR: 189

diff --git a/CHANGES b/CHANGES
index 4fbcc607cff6ce02b9e157f9089e273b17043396..d988a2996abb8c91b126183ee2b0b41e73b3f821 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,9 @@
 
  Changes between 0.9.6h and 0.9.7  [XX xxx 2002]
 
+  *) Change the SSL kerb5 codes to match RFC 2712.
+     [Richard Levitte]
+
   *) Make -nameopt work fully for req and add -reqopt switch.
      [Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]
 

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 0f006fad005fdb042290dba59e283f6fc90160dd..2b4b9a698511f027439abe56639edcb6685325e8 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -512,6 +512,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 
+#if 0
 /* Cipher 1E */
        {
        0,
@@ -525,55 +526,70 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
+#endif
 
 #ifndef OPENSSL_NO_KRB5
 /* The Kerberos ciphers
 ** 20000107 VRS: And the first shall be last,
 ** in hopes of avoiding the lynx ssl renegotiation problem.
 */
-/* Cipher 21 VRS */
+/* Cipher 1E VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_40_CBC_SHA,
-       SSL3_CK_KRB5_DES_40_CBC_SHA,
+       SSL3_TXT_KRB5_DES_64_CBC_SHA,
+       SSL3_CK_KRB5_DES_64_CBC_SHA,
        SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_NOT_EXP|SSL_LOW,
        0,
-       40,
+       56,
        56,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 22 VRS */
+/* Cipher 1F VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_40_CBC_MD5,
-       SSL3_CK_KRB5_DES_40_CBC_MD5,
-       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_MD5    |SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL3_TXT_KRB5_DES_192_CBC3_SHA,
+       SSL3_CK_KRB5_DES_192_CBC3_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_HIGH,
        0,
-       40,
-       56,
+       112,
+       168,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 23 VRS */
+/* Cipher 20 VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_64_CBC_SHA,
-       SSL3_CK_KRB5_DES_64_CBC_SHA,
-       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL3_TXT_KRB5_RC4_128_SHA,
+       SSL3_CK_KRB5_RC4_128_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_SHA1  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
        0,
-       56,
-       56,
+       128,
+       128,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 24 VRS */
+/* Cipher 21 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
+       SSL3_CK_KRB5_IDEA_128_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_IDEA|SSL_SHA1  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 22 VRS */
        {
        1,
        SSL3_TXT_KRB5_DES_64_CBC_MD5,
@@ -587,12 +603,12 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 
-/* Cipher 25 VRS */
+/* Cipher 23 VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_192_CBC3_SHA,
-       SSL3_CK_KRB5_DES_192_CBC3_SHA,
-       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
+       SSL3_TXT_KRB5_DES_192_CBC3_MD5,
+       SSL3_CK_KRB5_DES_192_CBC3_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
        0,
        112,
@@ -601,16 +617,114 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_ALL_STRENGTHS,
        },
 
+/* Cipher 24 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC4_128_MD5,
+       SSL3_CK_KRB5_RC4_128_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_MD5  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 25 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
+       SSL3_CK_KRB5_IDEA_128_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_IDEA|SSL_MD5  |SSL_SSLV3,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
 /* Cipher 26 VRS */
        {
        1,
-       SSL3_TXT_KRB5_DES_192_CBC3_MD5,
-       SSL3_CK_KRB5_DES_192_CBC3_MD5,
-       SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL3_TXT_KRB5_DES_40_CBC_SHA,
+       SSL3_CK_KRB5_DES_40_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
        0,
-       112,
-       168,
+       40,
+       56,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 27 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC2_40_CBC_SHA,
+       SSL3_CK_KRB5_RC2_40_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC2|SSL_SHA1   |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       40,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 28 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC4_40_CBC_SHA,
+       SSL3_CK_KRB5_RC4_40_CBC_SHA,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_SHA1   |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       128,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 29 VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_DES_40_CBC_MD5,
+       SSL3_CK_KRB5_DES_40_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_MD5    |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       40,
+       56,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 2A VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC2_40_CBC_MD5,
+       SSL3_CK_KRB5_RC2_40_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC2|SSL_MD5    |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       40,
+       128,
+       SSL_ALL_CIPHERS,
+       SSL_ALL_STRENGTHS,
+       },
+
+/* Cipher 2B VRS */
+       {
+       1,
+       SSL3_TXT_KRB5_RC4_40_CBC_MD5,
+       SSL3_CK_KRB5_RC4_40_CBC_MD5,
+       SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_MD5    |SSL_SSLV3,
+       SSL_EXPORT|SSL_EXP40,
+       0,
+       128,
+       128,
        SSL_ALL_CIPHERS,
        SSL_ALL_STRENGTHS,
        },

diff --git a/ssl/ssl.h b/ssl/ssl.h
index e9d1e896d79b6494222a0f20c33681e0bebeedd0..f8536496a2aeb5880276e90510434686b84c6b2c 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -204,6 +204,22 @@ extern "C" {
 
 /*    VRS Additional Kerberos5 entries
  */
+#define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA
+#define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA
+#define SSL_TXT_KRB5_RC4_128_SHA      SSL3_TXT_KRB5_RC4_128_SHA
+#define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA
+#define SSL_TXT_KRB5_DES_64_CBC_MD5   SSL3_TXT_KRB5_DES_64_CBC_MD5       
+#define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA       
+#define SSL_TXT_KRB5_RC4_128_MD5      SSL3_TXT_KRB5_RC4_128_MD5
+#define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA 
+
+#define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA 
+#define SSL_TXT_KRB5_RC2_40_CBC_SHA   SSL3_TXT_KRB5_RC2_40_CBC_SHA 
+#define SSL_TXT_KRB5_RC4_40_SHA              SSL3_TXT_KRB5_RC4_40_SHA
+#define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5 
+#define SSL_TXT_KRB5_RC2_40_CBC_MD5   SSL3_TXT_KRB5_RC2_40_CBC_MD5 
+#define SSL_TXT_KRB5_RC4_40_MD5              SSL3_TXT_KRB5_RC4_40_MD5
+
 #define SSL_TXT_KRB5_DES_40_CBC_SHA   SSL3_TXT_KRB5_DES_40_CBC_SHA
 #define SSL_TXT_KRB5_DES_40_CBC_MD5   SSL3_TXT_KRB5_DES_40_CBC_MD5
 #define SSL_TXT_KRB5_DES_64_CBC_SHA   SSL3_TXT_KRB5_DES_64_CBC_SHA

diff --git a/ssl/ssl3.h b/ssl/ssl3.h
index 8fd6951d7776708c28635a5175fc0c612d11536b..4bf14d5aa3ff97b9ea097b498ca96c1f3445ff04 100644 (file)
--- a/ssl/ssl3.h
+++ b/ssl/ssl3.h
@@ -156,23 +156,29 @@ extern "C" {
 
 #define SSL3_CK_FZA_DMS_NULL_SHA               0x0300001C
 #define SSL3_CK_FZA_DMS_FZA_SHA                        0x0300001D
+#if 0 /* Because it clashes with KRB5, is never used any more, and is safe
+        to remove according to David Hopwood <david.hopwood@zetnet.co.uk>
+        of the ietf-tls list */
 #define SSL3_CK_FZA_DMS_RC4_SHA                        0x0300001E
+#endif
 
 /*    VRS Additional Kerberos5 entries
  */
-#define SSL3_CK_KRB5_DES_40_CBC_SHA            0x03000021
-#define SSL3_CK_KRB5_DES_40_CBC_MD5            0x03000022
-#define SSL3_CK_KRB5_DES_64_CBC_SHA            0x03000023
-#define SSL3_CK_KRB5_DES_64_CBC_MD5            0x03000024
-#define SSL3_CK_KRB5_DES_192_CBC3_SHA          0x03000025
-#define SSL3_CK_KRB5_DES_192_CBC3_MD5          0x03000026
-
-#define SSL3_TXT_KRB5_DES_40_CBC_SHA           "EXP-KRB5-DES-CBC-SHA"
-#define SSL3_TXT_KRB5_DES_40_CBC_MD5           "EXP-KRB5-DES-CBC-MD5"
-#define SSL3_TXT_KRB5_DES_64_CBC_SHA           "KRB5-DES-CBC-SHA"
-#define SSL3_TXT_KRB5_DES_64_CBC_MD5           "KRB5-DES-CBC-MD5"
-#define SSL3_TXT_KRB5_DES_192_CBC3_SHA         "KRB5-DES-CBC3-SHA"
-#define SSL3_TXT_KRB5_DES_192_CBC3_MD5         "KRB5-DES-CBC3-MD5"
+#define SSL3_CK_KRB5_DES_64_CBC_SHA            0x0300001E
+#define SSL3_CK_KRB5_DES_192_CBC3_SHA          0x0300001F
+#define SSL3_CK_KRB5_RC4_128_SHA               0x03000020
+#define SSL3_CK_KRB5_IDEA_128_CBC_SHA          0x03000021
+#define SSL3_CK_KRB5_DES_64_CBC_MD5            0x03000022
+#define SSL3_CK_KRB5_DES_192_CBC3_SHA          0x03000023
+#define SSL3_CK_KRB5_RC4_128_MD5               0x03000024
+#define SSL3_CK_KRB5_IDEA_128_CBC_SHA          0x03000025
+
+#define SSL3_CK_KRB5_DES_40_CBC_SHA            0x03000026
+#define SSL3_CK_KRB5_RC2_40_CBC_SHA            0x03000027
+#define SSL3_CK_KRB5_RC4_40_SHA                        0x03000028
+#define SSL3_CK_KRB5_DES_40_CBC_MD5            0x03000029
+#define SSL3_CK_KRB5_RC2_40_CBC_MD5            0x0300002A
+#define SSL3_CK_KRB5_RC4_40_MD5                        0x0300002B
 
 #define SSL3_TXT_RSA_NULL_MD5                  "NULL-MD5"
 #define SSL3_TXT_RSA_NULL_SHA                  "NULL-SHA"
@@ -209,6 +215,22 @@ extern "C" {
 #define SSL3_TXT_FZA_DMS_FZA_SHA               "FZA-FZA-CBC-SHA"
 #define SSL3_TXT_FZA_DMS_RC4_SHA               "FZA-RC4-SHA"
 
+#define SSL3_TXT_KRB5_DES_64_CBC_SHA           "KRB5-DES-CBC-SHA"
+#define SSL3_TXT_KRB5_DES_192_CBC3_SHA         "KRB5-DES-CBC3-SHA"
+#define SSL3_TXT_KRB5_RC4_128_SHA              "KRB5-RC4-SHA"
+#define SSL3_TXT_KRB5_IDEA_128_CBC_SHA         "KRB5-IDEA-CBC-SHA"
+#define SSL3_TXT_KRB5_DES_64_CBC_MD5           "KRB5-DES-CBC-MD5"
+#define SSL3_TXT_KRB5_DES_192_CBC3_SHA         "KRB5-DES-CBC3-SHA"
+#define SSL3_TXT_KRB5_RC4_128_MD5              "KRB5-RC4-MD5"
+#define SSL3_TXT_KRB5_IDEA_128_CBC_SHA                 "KRB5-IDEA-CBC-SHA"
+
+#define SSL3_TXT_KRB5_DES_40_CBC_SHA           "EXP-KRB5-DES-CBC-SHA"
+#define SSL3_TXT_KRB5_RC2_40_CBC_SHA           "EXP-KRB5-RC2-CBC-SHA"
+#define SSL3_TXT_KRB5_RC4_40_SHA               "EXP-KRB5-RC4-SHA"
+#define SSL3_TXT_KRB5_DES_40_CBC_MD5           "EXP-KRB5-DES-CBC-MD5"
+#define SSL3_TXT_KRB5_DES_40_CBC_MD5           "EXP-KRB5-DES-CBC-MD5"
+#define SSL3_TXT_KRB5_RC4_40_MD5               "EXP-KRB5-RC4-MD5"
+
 #define SSL3_SSL_SESSION_ID_LENGTH             32
 #define SSL3_MAX_SSL_SESSION_ID_LENGTH         32