From 5d58f1bbfe23fe990293ecd209d1a8336c423a62 Mon Sep 17 00:00:00 2001
From: Andy Polyakov <appro@openssl.org>
Date: Fri, 5 Oct 2007 21:04:56 +0000
Subject: [PATCH] Prohibit RC4 in DTLS.
---
ssl/d1_lib.c | 20 ++++++++++++++++++++
ssl/ssl_locl.h | 3 ++-
2 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 622d2f7f73..d9486916f2 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -167,3 +167,23 @@ void dtls1_clear(SSL *s)
ssl3_clear(s);
s->version=DTLS1_VERSION;
}
+
+/*
+ * As it's impossible to use stream ciphers in "datagram" mode, this
+ * simple filter is designed to disengage them in DTLS. Unfortunately
+ * there is no universal way to identify stream SSL_CIPHER, so we have
+ * to explicitly list their SSL_* codes. Currently RC4 is the only one
+ * available, but if new ones emerge, they will have to be added...
+ */
+SSL_CIPHER *dtls1_get_cipher(unsigned int u)
+ {
+ SSL_CIPHER *ciph = ssl3_get_cipher(u);
+
+ if (ciph != NULL)
+ {
+ if (ciph->algorithm_enc == SSL_RC4)
+ return NULL;
+ }
+
+ return ciph;
+ }
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index cb93ff2188..a65071a47a 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -746,7 +746,7 @@ const SSL_METHOD *func_name(void) \
ssl3_put_cipher_by_char, \
ssl3_pending, \
ssl3_num_ciphers, \
- ssl3_get_cipher, \
+ dtls1_get_cipher, \
s_get_meth, \
dtls1_default_timeout, \
&DTLSv1_enc_data, \
@@ -915,6 +915,7 @@ void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
void dtls1_reset_seq_numbers(SSL *s, int rw);
long dtls1_default_timeout(void);
+SSL_CIPHER *dtls1_get_cipher(unsigned int u);
/* some client-only functions */
--
2.25.1