Prohibit RC4 in DTLS.

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 622d2f7f735822341a7223e1df832c2aa7b5a295..d9486916f206ffd4d23208a1fec1c2708b657075 100644 (file)
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -167,3 +167,23 @@ void dtls1_clear(SSL *s)
        ssl3_clear(s);
        s->version=DTLS1_VERSION;
        }
+
+/*
+ * As it's impossible to use stream ciphers in "datagram" mode, this
+ * simple filter is designed to disengage them in DTLS. Unfortunately
+ * there is no universal way to identify stream SSL_CIPHER, so we have
+ * to explicitly list their SSL_* codes. Currently RC4 is the only one
+ * available, but if new ones emerge, they will have to be added...
+ */
+SSL_CIPHER *dtls1_get_cipher(unsigned int u)
+       {
+       SSL_CIPHER *ciph = ssl3_get_cipher(u);
+
+       if (ciph != NULL)
+               {
+               if (ciph->algorithm_enc == SSL_RC4)
+                       return NULL;
+               }
+
+       return ciph;
+       }

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index cb93ff2188feca8a92bcd9c77319561de0b0f202..a65071a47aa65ce38679a5883df1106f8668f8d6 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -746,7 +746,7 @@ const SSL_METHOD *func_name(void)  \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
-               ssl3_get_cipher, \
+               dtls1_get_cipher, \
                s_get_meth, \
                dtls1_default_timeout, \
                &DTLSv1_enc_data, \
@@ -915,6 +915,7 @@ void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
 void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
 void dtls1_reset_seq_numbers(SSL *s, int rw);
 long dtls1_default_timeout(void);
+SSL_CIPHER *dtls1_get_cipher(unsigned int u);
 
 
 /* some client-only functions */