From: Andy Polyakov <appro@openssl.org>
Date: Fri, 5 Oct 2007 21:05:27 +0000 (+0000)
Subject: Prohibit RC4 in DTLS [from HEAD].
X-Git-Tag: OpenSSL_0_9_8f~5
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=d5e858c55f4a4f9ec2b27896e839dffd2edc1578;p=oweals%2Fopenssl.git

Prohibit RC4 in DTLS [from HEAD].
---

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index d07a212fac..fc088b4148 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -188,3 +188,23 @@ void dtls1_clear(SSL *s)
 	ssl3_clear(s);
 	s->version=DTLS1_VERSION;
 	}
+
+/*
+ * As it's impossible to use stream ciphers in "datagram" mode, this
+ * simple filter is designed to disengage them in DTLS. Unfortunately
+ * there is no universal way to identify stream SSL_CIPHER, so we have
+ * to explicitly list their SSL_* codes. Currently RC4 is the only one
+ * available, but if new ones emerge, they will have to be added...
+ */
+SSL_CIPHER *dtls1_get_cipher(unsigned int u)
+	{
+	SSL_CIPHER *ciph = ssl3_get_cipher(u);
+
+	if (ciph != NULL)
+		{
+		if ((ciph->algorithms&SSL_ENC_MASK) == SSL_RC4)
+			return NULL;
+		}
+
+	return ciph;
+	}
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index fe064cc98a..e9fba49c53 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -695,7 +695,7 @@ SSL_METHOD *func_name(void)  \
 		ssl3_put_cipher_by_char, \
 		ssl3_pending, \
 		ssl3_num_ciphers, \
-		ssl3_get_cipher, \
+		dtls1_get_cipher, \
 		s_get_meth, \
 		dtls1_default_timeout, \
 		&DTLSv1_enc_data, \
@@ -861,6 +861,8 @@ void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
 void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
 void dtls1_reset_seq_numbers(SSL *s, int rw);
 long dtls1_default_timeout(void);
+SSL_CIPHER *dtls1_get_cipher(unsigned int u);
+
 
 
 /* some client-only functions */