?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
remove support for 'trademark files'
[unleashed/tickless.git] / lib / libssl / s3_lib.c
bloba05116cb8f209e18f46c22b0c8edcfbd3a3e71bf
1 /* $OpenBSD: s3_lib.c,v 1.161 2017/09/25 18:04:08 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58 /* ====================================================================
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
111 /* ====================================================================
112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113 *
114 * Portions of the attached software ("Contribution") are developed by
115 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
116 *
117 * The Contribution is licensed pursuant to the OpenSSL open source
118 * license provided above.
119 *
120 * ECC cipher suite support in OpenSSL originally written by
121 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
122 *
123 */
124 /* ====================================================================
125 * Copyright 2005 Nokia. All rights reserved.
126 *
127 * The portions of the attached software ("Contribution") is developed by
128 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
129 * license.
130 *
131 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
132 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
133 * support (see RFC 4279) to OpenSSL.
134 *
135 * No patent licenses or other rights except those expressly stated in
136 * the OpenSSL open source license shall be deemed granted or received
137 * expressly, by implication, estoppel, or otherwise.
138 *
139 * No assurances are provided by Nokia that the Contribution does not
140 * infringe the patent or other intellectual property rights of any third
141 * party or that the license provides you with all the necessary rights
142 * to make use of the Contribution.
143 *
144 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
145 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
146 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
147 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
148 * OTHERWISE.
149 */
150
151 #include <limits.h>
152 #include <stdio.h>
153
154 #include <openssl/bn.h>
155 #include <openssl/curve25519.h>
156 #include <openssl/dh.h>
157 #include <openssl/md5.h>
158 #include <openssl/objects.h>
159
160 #include "ssl_locl.h"
161 #include "bytestring.h"
162
163 #define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers) / sizeof(SSL_CIPHER))
164
165 /*
166 * FIXED_NONCE_LEN is a macro that provides in the correct value to set the
167 * fixed nonce length in algorithms2. It is the inverse of the
168 * SSL_CIPHER_AEAD_FIXED_NONCE_LEN macro.
169 */
170 #define FIXED_NONCE_LEN(x) (((x / 2) & 0xf) << 24)
171
172 /* list of available SSLv3 ciphers (sorted by id) */
173 SSL_CIPHER ssl3_ciphers[] = {
174
175 /* The RSA ciphers */
176 /* Cipher 01 */
177 {
178 .valid = 1,
179 .name = SSL3_TXT_RSA_NULL_MD5,
180 .id = SSL3_CK_RSA_NULL_MD5,
181 .algorithm_mkey = SSL_kRSA,
182 .algorithm_auth = SSL_aRSA,
183 .algorithm_enc = SSL_eNULL,
184 .algorithm_mac = SSL_MD5,
185 .algorithm_ssl = SSL_SSLV3,
186 .algo_strength = SSL_STRONG_NONE,
187 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
188 .strength_bits = 0,
189 .alg_bits = 0,
190 },
191
192 /* Cipher 02 */
193 {
194 .valid = 1,
195 .name = SSL3_TXT_RSA_NULL_SHA,
196 .id = SSL3_CK_RSA_NULL_SHA,
197 .algorithm_mkey = SSL_kRSA,
198 .algorithm_auth = SSL_aRSA,
199 .algorithm_enc = SSL_eNULL,
200 .algorithm_mac = SSL_SHA1,
201 .algorithm_ssl = SSL_SSLV3,
202 .algo_strength = SSL_STRONG_NONE,
203 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
204 .strength_bits = 0,
205 .alg_bits = 0,
206 },
207
208 /* Cipher 04 */
209 {
210 .valid = 1,
211 .name = SSL3_TXT_RSA_RC4_128_MD5,
212 .id = SSL3_CK_RSA_RC4_128_MD5,
213 .algorithm_mkey = SSL_kRSA,
214 .algorithm_auth = SSL_aRSA,
215 .algorithm_enc = SSL_RC4,
216 .algorithm_mac = SSL_MD5,
217 .algorithm_ssl = SSL_SSLV3,
218 .algo_strength = SSL_LOW,
219 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
220 .strength_bits = 128,
221 .alg_bits = 128,
222 },
223
224 /* Cipher 05 */
225 {
226 .valid = 1,
227 .name = SSL3_TXT_RSA_RC4_128_SHA,
228 .id = SSL3_CK_RSA_RC4_128_SHA,
229 .algorithm_mkey = SSL_kRSA,
230 .algorithm_auth = SSL_aRSA,
231 .algorithm_enc = SSL_RC4,
232 .algorithm_mac = SSL_SHA1,
233 .algorithm_ssl = SSL_SSLV3,
234 .algo_strength = SSL_LOW,
235 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
236 .strength_bits = 128,
237 .alg_bits = 128,
238 },
239
240 /* Cipher 09 */
241 {
242 .valid = 1,
243 .name = SSL3_TXT_RSA_DES_64_CBC_SHA,
244 .id = SSL3_CK_RSA_DES_64_CBC_SHA,
245 .algorithm_mkey = SSL_kRSA,
246 .algorithm_auth = SSL_aRSA,
247 .algorithm_enc = SSL_DES,
248 .algorithm_mac = SSL_SHA1,
249 .algorithm_ssl = SSL_SSLV3,
250 .algo_strength = SSL_LOW,
251 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
252 .strength_bits = 56,
253 .alg_bits = 56,
254 },
255
256 /* Cipher 0A */
257 {
258 .valid = 1,
259 .name = SSL3_TXT_RSA_DES_192_CBC3_SHA,
260 .id = SSL3_CK_RSA_DES_192_CBC3_SHA,
261 .algorithm_mkey = SSL_kRSA,
262 .algorithm_auth = SSL_aRSA,
263 .algorithm_enc = SSL_3DES,
264 .algorithm_mac = SSL_SHA1,
265 .algorithm_ssl = SSL_SSLV3,
266 .algo_strength = SSL_MEDIUM,
267 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
268 .strength_bits = 112,
269 .alg_bits = 168,
270 },
271
272 /*
273 * Ephemeral DH (DHE) ciphers.
274 */
275
276 /* Cipher 15 */
277 {
278 .valid = 1,
279 .name = SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
280 .id = SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
281 .algorithm_mkey = SSL_kDHE,
282 .algorithm_auth = SSL_aRSA,
283 .algorithm_enc = SSL_DES,
284 .algorithm_mac = SSL_SHA1,
285 .algorithm_ssl = SSL_SSLV3,
286 .algo_strength = SSL_LOW,
287 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
288 .strength_bits = 56,
289 .alg_bits = 56,
290 },
291
292 /* Cipher 16 */
293 {
294 .valid = 1,
295 .name = SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
296 .id = SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
297 .algorithm_mkey = SSL_kDHE,
298 .algorithm_auth = SSL_aRSA,
299 .algorithm_enc = SSL_3DES,
300 .algorithm_mac = SSL_SHA1,
301 .algorithm_ssl = SSL_SSLV3,
302 .algo_strength = SSL_MEDIUM,
303 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
304 .strength_bits = 112,
305 .alg_bits = 168,
306 },
307
308 /* Cipher 18 */
309 {
310 .valid = 1,
311 .name = SSL3_TXT_ADH_RC4_128_MD5,
312 .id = SSL3_CK_ADH_RC4_128_MD5,
313 .algorithm_mkey = SSL_kDHE,
314 .algorithm_auth = SSL_aNULL,
315 .algorithm_enc = SSL_RC4,
316 .algorithm_mac = SSL_MD5,
317 .algorithm_ssl = SSL_SSLV3,
318 .algo_strength = SSL_LOW,
319 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
320 .strength_bits = 128,
321 .alg_bits = 128,
322 },
323
324 /* Cipher 1A */
325 {
326 .valid = 1,
327 .name = SSL3_TXT_ADH_DES_64_CBC_SHA,
328 .id = SSL3_CK_ADH_DES_64_CBC_SHA,
329 .algorithm_mkey = SSL_kDHE,
330 .algorithm_auth = SSL_aNULL,
331 .algorithm_enc = SSL_DES,
332 .algorithm_mac = SSL_SHA1,
333 .algorithm_ssl = SSL_SSLV3,
334 .algo_strength = SSL_LOW,
335 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
336 .strength_bits = 56,
337 .alg_bits = 56,
338 },
339
340 /* Cipher 1B */
341 {
342 .valid = 1,
343 .name = SSL3_TXT_ADH_DES_192_CBC_SHA,
344 .id = SSL3_CK_ADH_DES_192_CBC_SHA,
345 .algorithm_mkey = SSL_kDHE,
346 .algorithm_auth = SSL_aNULL,
347 .algorithm_enc = SSL_3DES,
348 .algorithm_mac = SSL_SHA1,
349 .algorithm_ssl = SSL_SSLV3,
350 .algo_strength = SSL_MEDIUM,
351 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
352 .strength_bits = 112,
353 .alg_bits = 168,
354 },
355
356 /*
357 * AES ciphersuites.
358 */
359
360 /* Cipher 2F */
361 {
362 .valid = 1,
363 .name = TLS1_TXT_RSA_WITH_AES_128_SHA,
364 .id = TLS1_CK_RSA_WITH_AES_128_SHA,
365 .algorithm_mkey = SSL_kRSA,
366 .algorithm_auth = SSL_aRSA,
367 .algorithm_enc = SSL_AES128,
368 .algorithm_mac = SSL_SHA1,
369 .algorithm_ssl = SSL_TLSV1,
370 .algo_strength = SSL_HIGH,
371 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
372 .strength_bits = 128,
373 .alg_bits = 128,
374 },
375
376 /* Cipher 33 */
377 {
378 .valid = 1,
379 .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
380 .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
381 .algorithm_mkey = SSL_kDHE,
382 .algorithm_auth = SSL_aRSA,
383 .algorithm_enc = SSL_AES128,
384 .algorithm_mac = SSL_SHA1,
385 .algorithm_ssl = SSL_TLSV1,
386 .algo_strength = SSL_HIGH,
387 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
388 .strength_bits = 128,
389 .alg_bits = 128,
390 },
391
392 /* Cipher 34 */
393 {
394 .valid = 1,
395 .name = TLS1_TXT_ADH_WITH_AES_128_SHA,
396 .id = TLS1_CK_ADH_WITH_AES_128_SHA,
397 .algorithm_mkey = SSL_kDHE,
398 .algorithm_auth = SSL_aNULL,
399 .algorithm_enc = SSL_AES128,
400 .algorithm_mac = SSL_SHA1,
401 .algorithm_ssl = SSL_TLSV1,
402 .algo_strength = SSL_HIGH,
403 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
404 .strength_bits = 128,
405 .alg_bits = 128,
406 },
407
408 /* Cipher 35 */
409 {
410 .valid = 1,
411 .name = TLS1_TXT_RSA_WITH_AES_256_SHA,
412 .id = TLS1_CK_RSA_WITH_AES_256_SHA,
413 .algorithm_mkey = SSL_kRSA,
414 .algorithm_auth = SSL_aRSA,
415 .algorithm_enc = SSL_AES256,
416 .algorithm_mac = SSL_SHA1,
417 .algorithm_ssl = SSL_TLSV1,
418 .algo_strength = SSL_HIGH,
419 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
420 .strength_bits = 256,
421 .alg_bits = 256,
422 },
423
424 /* Cipher 39 */
425 {
426 .valid = 1,
427 .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
428 .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
429 .algorithm_mkey = SSL_kDHE,
430 .algorithm_auth = SSL_aRSA,
431 .algorithm_enc = SSL_AES256,
432 .algorithm_mac = SSL_SHA1,
433 .algorithm_ssl = SSL_TLSV1,
434 .algo_strength = SSL_HIGH,
435 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
436 .strength_bits = 256,
437 .alg_bits = 256,
438 },
439
440 /* Cipher 3A */
441 {
442 .valid = 1,
443 .name = TLS1_TXT_ADH_WITH_AES_256_SHA,
444 .id = TLS1_CK_ADH_WITH_AES_256_SHA,
445 .algorithm_mkey = SSL_kDHE,
446 .algorithm_auth = SSL_aNULL,
447 .algorithm_enc = SSL_AES256,
448 .algorithm_mac = SSL_SHA1,
449 .algorithm_ssl = SSL_TLSV1,
450 .algo_strength = SSL_HIGH,
451 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
452 .strength_bits = 256,
453 .alg_bits = 256,
454 },
455
456 /* TLS v1.2 ciphersuites */
457 /* Cipher 3B */
458 {
459 .valid = 1,
460 .name = TLS1_TXT_RSA_WITH_NULL_SHA256,
461 .id = TLS1_CK_RSA_WITH_NULL_SHA256,
462 .algorithm_mkey = SSL_kRSA,
463 .algorithm_auth = SSL_aRSA,
464 .algorithm_enc = SSL_eNULL,
465 .algorithm_mac = SSL_SHA256,
466 .algorithm_ssl = SSL_TLSV1_2,
467 .algo_strength = SSL_STRONG_NONE,
468 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
469 .strength_bits = 0,
470 .alg_bits = 0,
471 },
472
473 /* Cipher 3C */
474 {
475 .valid = 1,
476 .name = TLS1_TXT_RSA_WITH_AES_128_SHA256,
477 .id = TLS1_CK_RSA_WITH_AES_128_SHA256,
478 .algorithm_mkey = SSL_kRSA,
479 .algorithm_auth = SSL_aRSA,
480 .algorithm_enc = SSL_AES128,
481 .algorithm_mac = SSL_SHA256,
482 .algorithm_ssl = SSL_TLSV1_2,
483 .algo_strength = SSL_HIGH,
484 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
485 .strength_bits = 128,
486 .alg_bits = 128,
487 },
488
489 /* Cipher 3D */
490 {
491 .valid = 1,
492 .name = TLS1_TXT_RSA_WITH_AES_256_SHA256,
493 .id = TLS1_CK_RSA_WITH_AES_256_SHA256,
494 .algorithm_mkey = SSL_kRSA,
495 .algorithm_auth = SSL_aRSA,
496 .algorithm_enc = SSL_AES256,
497 .algorithm_mac = SSL_SHA256,
498 .algorithm_ssl = SSL_TLSV1_2,
499 .algo_strength = SSL_HIGH,
500 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
501 .strength_bits = 256,
502 .alg_bits = 256,
503 },
504
505 #ifndef OPENSSL_NO_CAMELLIA
506 /* Camellia ciphersuites from RFC4132 (128-bit portion) */
507
508 /* Cipher 41 */
509 {
510 .valid = 1,
511 .name = TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
512 .id = TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
513 .algorithm_mkey = SSL_kRSA,
514 .algorithm_auth = SSL_aRSA,
515 .algorithm_enc = SSL_CAMELLIA128,
516 .algorithm_mac = SSL_SHA1,
517 .algorithm_ssl = SSL_TLSV1,
518 .algo_strength = SSL_HIGH,
519 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
520 .strength_bits = 128,
521 .alg_bits = 128,
522 },
523
524 /* Cipher 45 */
525 {
526 .valid = 1,
527 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
528 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
529 .algorithm_mkey = SSL_kDHE,
530 .algorithm_auth = SSL_aRSA,
531 .algorithm_enc = SSL_CAMELLIA128,
532 .algorithm_mac = SSL_SHA1,
533 .algorithm_ssl = SSL_TLSV1,
534 .algo_strength = SSL_HIGH,
535 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
536 .strength_bits = 128,
537 .alg_bits = 128,
538 },
539
540 /* Cipher 46 */
541 {
542 .valid = 1,
543 .name = TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
544 .id = TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
545 .algorithm_mkey = SSL_kDHE,
546 .algorithm_auth = SSL_aNULL,
547 .algorithm_enc = SSL_CAMELLIA128,
548 .algorithm_mac = SSL_SHA1,
549 .algorithm_ssl = SSL_TLSV1,
550 .algo_strength = SSL_HIGH,
551 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
552 .strength_bits = 128,
553 .alg_bits = 128,
554 },
555 #endif /* OPENSSL_NO_CAMELLIA */
556
557 /* TLS v1.2 ciphersuites */
558 /* Cipher 67 */
559 {
560 .valid = 1,
561 .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
562 .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
563 .algorithm_mkey = SSL_kDHE,
564 .algorithm_auth = SSL_aRSA,
565 .algorithm_enc = SSL_AES128,
566 .algorithm_mac = SSL_SHA256,
567 .algorithm_ssl = SSL_TLSV1_2,
568 .algo_strength = SSL_HIGH,
569 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
570 .strength_bits = 128,
571 .alg_bits = 128,
572 },
573
574 /* Cipher 6B */
575 {
576 .valid = 1,
577 .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
578 .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
579 .algorithm_mkey = SSL_kDHE,
580 .algorithm_auth = SSL_aRSA,
581 .algorithm_enc = SSL_AES256,
582 .algorithm_mac = SSL_SHA256,
583 .algorithm_ssl = SSL_TLSV1_2,
584 .algo_strength = SSL_HIGH,
585 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
586 .strength_bits = 256,
587 .alg_bits = 256,
588 },
589
590 /* Cipher 6C */
591 {
592 .valid = 1,
593 .name = TLS1_TXT_ADH_WITH_AES_128_SHA256,
594 .id = TLS1_CK_ADH_WITH_AES_128_SHA256,
595 .algorithm_mkey = SSL_kDHE,
596 .algorithm_auth = SSL_aNULL,
597 .algorithm_enc = SSL_AES128,
598 .algorithm_mac = SSL_SHA256,
599 .algorithm_ssl = SSL_TLSV1_2,
600 .algo_strength = SSL_HIGH,
601 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
602 .strength_bits = 128,
603 .alg_bits = 128,
604 },
605
606 /* Cipher 6D */
607 {
608 .valid = 1,
609 .name = TLS1_TXT_ADH_WITH_AES_256_SHA256,
610 .id = TLS1_CK_ADH_WITH_AES_256_SHA256,
611 .algorithm_mkey = SSL_kDHE,
612 .algorithm_auth = SSL_aNULL,
613 .algorithm_enc = SSL_AES256,
614 .algorithm_mac = SSL_SHA256,
615 .algorithm_ssl = SSL_TLSV1_2,
616 .algo_strength = SSL_HIGH,
617 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
618 .strength_bits = 256,
619 .alg_bits = 256,
620 },
621
622 /* GOST Ciphersuites */
623
624 /* Cipher 81 */
625 {
626 .valid = 1,
627 .name = "GOST2001-GOST89-GOST89",
628 .id = 0x3000081,
629 .algorithm_mkey = SSL_kGOST,
630 .algorithm_auth = SSL_aGOST01,
631 .algorithm_enc = SSL_eGOST2814789CNT,
632 .algorithm_mac = SSL_GOST89MAC,
633 .algorithm_ssl = SSL_TLSV1,
634 .algo_strength = SSL_HIGH,
635 .algorithm2 = SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|
636 TLS1_STREAM_MAC,
637 .strength_bits = 256,
638 .alg_bits = 256
639 },
640
641 /* Cipher 83 */
642 {
643 .valid = 1,
644 .name = "GOST2001-NULL-GOST94",
645 .id = 0x3000083,
646 .algorithm_mkey = SSL_kGOST,
647 .algorithm_auth = SSL_aGOST01,
648 .algorithm_enc = SSL_eNULL,
649 .algorithm_mac = SSL_GOST94,
650 .algorithm_ssl = SSL_TLSV1,
651 .algo_strength = SSL_STRONG_NONE,
652 .algorithm2 = SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
653 .strength_bits = 0,
654 .alg_bits = 0
655 },
656
657 #ifndef OPENSSL_NO_CAMELLIA
658 /* Camellia ciphersuites from RFC4132 (256-bit portion) */
659
660 /* Cipher 84 */
661 {
662 .valid = 1,
663 .name = TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
664 .id = TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
665 .algorithm_mkey = SSL_kRSA,
666 .algorithm_auth = SSL_aRSA,
667 .algorithm_enc = SSL_CAMELLIA256,
668 .algorithm_mac = SSL_SHA1,
669 .algorithm_ssl = SSL_TLSV1,
670 .algo_strength = SSL_HIGH,
671 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
672 .strength_bits = 256,
673 .alg_bits = 256,
674 },
675
676 /* Cipher 88 */
677 {
678 .valid = 1,
679 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
680 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
681 .algorithm_mkey = SSL_kDHE,
682 .algorithm_auth = SSL_aRSA,
683 .algorithm_enc = SSL_CAMELLIA256,
684 .algorithm_mac = SSL_SHA1,
685 .algorithm_ssl = SSL_TLSV1,
686 .algo_strength = SSL_HIGH,
687 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
688 .strength_bits = 256,
689 .alg_bits = 256,
690 },
691
692 /* Cipher 89 */
693 {
694 .valid = 1,
695 .name = TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
696 .id = TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
697 .algorithm_mkey = SSL_kDHE,
698 .algorithm_auth = SSL_aNULL,
699 .algorithm_enc = SSL_CAMELLIA256,
700 .algorithm_mac = SSL_SHA1,
701 .algorithm_ssl = SSL_TLSV1,
702 .algo_strength = SSL_HIGH,
703 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
704 .strength_bits = 256,
705 .alg_bits = 256,
706 },
707 #endif /* OPENSSL_NO_CAMELLIA */
708
709 /*
710 * GCM ciphersuites from RFC5288.
711 */
712
713 /* Cipher 9C */
714 {
715 .valid = 1,
716 .name = TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
717 .id = TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
718 .algorithm_mkey = SSL_kRSA,
719 .algorithm_auth = SSL_aRSA,
720 .algorithm_enc = SSL_AES128GCM,
721 .algorithm_mac = SSL_AEAD,
722 .algorithm_ssl = SSL_TLSV1_2,
723 .algo_strength = SSL_HIGH,
724 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
725 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
726 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
727 .strength_bits = 128,
728 .alg_bits = 128,
729 },
730
731 /* Cipher 9D */
732 {
733 .valid = 1,
734 .name = TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
735 .id = TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
736 .algorithm_mkey = SSL_kRSA,
737 .algorithm_auth = SSL_aRSA,
738 .algorithm_enc = SSL_AES256GCM,
739 .algorithm_mac = SSL_AEAD,
740 .algorithm_ssl = SSL_TLSV1_2,
741 .algo_strength = SSL_HIGH,
742 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
743 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
744 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
745 .strength_bits = 256,
746 .alg_bits = 256,
747 },
748
749 /* Cipher 9E */
750 {
751 .valid = 1,
752 .name = TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
753 .id = TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
754 .algorithm_mkey = SSL_kDHE,
755 .algorithm_auth = SSL_aRSA,
756 .algorithm_enc = SSL_AES128GCM,
757 .algorithm_mac = SSL_AEAD,
758 .algorithm_ssl = SSL_TLSV1_2,
759 .algo_strength = SSL_HIGH,
760 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
761 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
762 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
763 .strength_bits = 128,
764 .alg_bits = 128,
765 },
766
767 /* Cipher 9F */
768 {
769 .valid = 1,
770 .name = TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
771 .id = TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
772 .algorithm_mkey = SSL_kDHE,
773 .algorithm_auth = SSL_aRSA,
774 .algorithm_enc = SSL_AES256GCM,
775 .algorithm_mac = SSL_AEAD,
776 .algorithm_ssl = SSL_TLSV1_2,
777 .algo_strength = SSL_HIGH,
778 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
779 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
780 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
781 .strength_bits = 256,
782 .alg_bits = 256,
783 },
784
785 /* Cipher A6 */
786 {
787 .valid = 1,
788 .name = TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
789 .id = TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
790 .algorithm_mkey = SSL_kDHE,
791 .algorithm_auth = SSL_aNULL,
792 .algorithm_enc = SSL_AES128GCM,
793 .algorithm_mac = SSL_AEAD,
794 .algorithm_ssl = SSL_TLSV1_2,
795 .algo_strength = SSL_HIGH,
796 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
797 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
798 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
799 .strength_bits = 128,
800 .alg_bits = 128,
801 },
802
803 /* Cipher A7 */
804 {
805 .valid = 1,
806 .name = TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
807 .id = TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
808 .algorithm_mkey = SSL_kDHE,
809 .algorithm_auth = SSL_aNULL,
810 .algorithm_enc = SSL_AES256GCM,
811 .algorithm_mac = SSL_AEAD,
812 .algorithm_ssl = SSL_TLSV1_2,
813 .algo_strength = SSL_HIGH,
814 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
815 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
816 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
817 .strength_bits = 256,
818 .alg_bits = 256,
819 },
820
821 #ifndef OPENSSL_NO_CAMELLIA
822 /* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
823
824 /* Cipher BA */
825 {
826 .valid = 1,
827 .name = TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256,
828 .id = TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256,
829 .algorithm_mkey = SSL_kRSA,
830 .algorithm_auth = SSL_aRSA,
831 .algorithm_enc = SSL_CAMELLIA128,
832 .algorithm_mac = SSL_SHA256,
833 .algorithm_ssl = SSL_TLSV1_2,
834 .algo_strength = SSL_HIGH,
835 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
836 .strength_bits = 128,
837 .alg_bits = 128,
838 },
839
840 /* Cipher BE */
841 {
842 .valid = 1,
843 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
844 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
845 .algorithm_mkey = SSL_kDHE,
846 .algorithm_auth = SSL_aRSA,
847 .algorithm_enc = SSL_CAMELLIA128,
848 .algorithm_mac = SSL_SHA256,
849 .algorithm_ssl = SSL_TLSV1_2,
850 .algo_strength = SSL_HIGH,
851 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
852 .strength_bits = 128,
853 .alg_bits = 128,
854 },
855
856 /* Cipher BF */
857 {
858 .valid = 1,
859 .name = TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256,
860 .id = TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256,
861 .algorithm_mkey = SSL_kDHE,
862 .algorithm_auth = SSL_aNULL,
863 .algorithm_enc = SSL_CAMELLIA128,
864 .algorithm_mac = SSL_SHA256,
865 .algorithm_ssl = SSL_TLSV1_2,
866 .algo_strength = SSL_HIGH,
867 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
868 .strength_bits = 128,
869 .alg_bits = 128,
870 },
871
872 /* Cipher C0 */
873 {
874 .valid = 1,
875 .name = TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256,
876 .id = TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256,
877 .algorithm_mkey = SSL_kRSA,
878 .algorithm_auth = SSL_aRSA,
879 .algorithm_enc = SSL_CAMELLIA256,
880 .algorithm_mac = SSL_SHA256,
881 .algorithm_ssl = SSL_TLSV1_2,
882 .algo_strength = SSL_HIGH,
883 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
884 .strength_bits = 256,
885 .alg_bits = 256,
886 },
887
888 /* Cipher C4 */
889 {
890 .valid = 1,
891 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
892 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
893 .algorithm_mkey = SSL_kDHE,
894 .algorithm_auth = SSL_aRSA,
895 .algorithm_enc = SSL_CAMELLIA256,
896 .algorithm_mac = SSL_SHA256,
897 .algorithm_ssl = SSL_TLSV1_2,
898 .algo_strength = SSL_HIGH,
899 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
900 .strength_bits = 256,
901 .alg_bits = 256,
902 },
903
904 /* Cipher C5 */
905 {
906 .valid = 1,
907 .name = TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256,
908 .id = TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256,
909 .algorithm_mkey = SSL_kDHE,
910 .algorithm_auth = SSL_aNULL,
911 .algorithm_enc = SSL_CAMELLIA256,
912 .algorithm_mac = SSL_SHA256,
913 .algorithm_ssl = SSL_TLSV1_2,
914 .algo_strength = SSL_HIGH,
915 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
916 .strength_bits = 256,
917 .alg_bits = 256,
918 },
919 #endif /* OPENSSL_NO_CAMELLIA */
920
921 /* Cipher C006 */
922 {
923 .valid = 1,
924 .name = TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
925 .id = TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
926 .algorithm_mkey = SSL_kECDHE,
927 .algorithm_auth = SSL_aECDSA,
928 .algorithm_enc = SSL_eNULL,
929 .algorithm_mac = SSL_SHA1,
930 .algorithm_ssl = SSL_TLSV1,
931 .algo_strength = SSL_STRONG_NONE,
932 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
933 .strength_bits = 0,
934 .alg_bits = 0,
935 },
936
937 /* Cipher C007 */
938 {
939 .valid = 1,
940 .name = TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
941 .id = TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
942 .algorithm_mkey = SSL_kECDHE,
943 .algorithm_auth = SSL_aECDSA,
944 .algorithm_enc = SSL_RC4,
945 .algorithm_mac = SSL_SHA1,
946 .algorithm_ssl = SSL_TLSV1,
947 .algo_strength = SSL_LOW,
948 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
949 .strength_bits = 128,
950 .alg_bits = 128,
951 },
952
953 /* Cipher C008 */
954 {
955 .valid = 1,
956 .name = TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
957 .id = TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
958 .algorithm_mkey = SSL_kECDHE,
959 .algorithm_auth = SSL_aECDSA,
960 .algorithm_enc = SSL_3DES,
961 .algorithm_mac = SSL_SHA1,
962 .algorithm_ssl = SSL_TLSV1,
963 .algo_strength = SSL_MEDIUM,
964 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
965 .strength_bits = 112,
966 .alg_bits = 168,
967 },
968
969 /* Cipher C009 */
970 {
971 .valid = 1,
972 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
973 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
974 .algorithm_mkey = SSL_kECDHE,
975 .algorithm_auth = SSL_aECDSA,
976 .algorithm_enc = SSL_AES128,
977 .algorithm_mac = SSL_SHA1,
978 .algorithm_ssl = SSL_TLSV1,
979 .algo_strength = SSL_HIGH,
980 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
981 .strength_bits = 128,
982 .alg_bits = 128,
983 },
984
985 /* Cipher C00A */
986 {
987 .valid = 1,
988 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
989 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
990 .algorithm_mkey = SSL_kECDHE,
991 .algorithm_auth = SSL_aECDSA,
992 .algorithm_enc = SSL_AES256,
993 .algorithm_mac = SSL_SHA1,
994 .algorithm_ssl = SSL_TLSV1,
995 .algo_strength = SSL_HIGH,
996 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
997 .strength_bits = 256,
998 .alg_bits = 256,
999 },
1000
1001 /* Cipher C010 */
1002 {
1003 .valid = 1,
1004 .name = TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
1005 .id = TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
1006 .algorithm_mkey = SSL_kECDHE,
1007 .algorithm_auth = SSL_aRSA,
1008 .algorithm_enc = SSL_eNULL,
1009 .algorithm_mac = SSL_SHA1,
1010 .algorithm_ssl = SSL_TLSV1,
1011 .algo_strength = SSL_STRONG_NONE,
1012 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1013 .strength_bits = 0,
1014 .alg_bits = 0,
1015 },
1016
1017 /* Cipher C011 */
1018 {
1019 .valid = 1,
1020 .name = TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
1021 .id = TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
1022 .algorithm_mkey = SSL_kECDHE,
1023 .algorithm_auth = SSL_aRSA,
1024 .algorithm_enc = SSL_RC4,
1025 .algorithm_mac = SSL_SHA1,
1026 .algorithm_ssl = SSL_TLSV1,
1027 .algo_strength = SSL_LOW,
1028 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1029 .strength_bits = 128,
1030 .alg_bits = 128,
1031 },
1032
1033 /* Cipher C012 */
1034 {
1035 .valid = 1,
1036 .name = TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1037 .id = TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1038 .algorithm_mkey = SSL_kECDHE,
1039 .algorithm_auth = SSL_aRSA,
1040 .algorithm_enc = SSL_3DES,
1041 .algorithm_mac = SSL_SHA1,
1042 .algorithm_ssl = SSL_TLSV1,
1043 .algo_strength = SSL_MEDIUM,
1044 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1045 .strength_bits = 112,
1046 .alg_bits = 168,
1047 },
1048
1049 /* Cipher C013 */
1050 {
1051 .valid = 1,
1052 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1053 .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1054 .algorithm_mkey = SSL_kECDHE,
1055 .algorithm_auth = SSL_aRSA,
1056 .algorithm_enc = SSL_AES128,
1057 .algorithm_mac = SSL_SHA1,
1058 .algorithm_ssl = SSL_TLSV1,
1059 .algo_strength = SSL_HIGH,
1060 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1061 .strength_bits = 128,
1062 .alg_bits = 128,
1063 },
1064
1065 /* Cipher C014 */
1066 {
1067 .valid = 1,
1068 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1069 .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1070 .algorithm_mkey = SSL_kECDHE,
1071 .algorithm_auth = SSL_aRSA,
1072 .algorithm_enc = SSL_AES256,
1073 .algorithm_mac = SSL_SHA1,
1074 .algorithm_ssl = SSL_TLSV1,
1075 .algo_strength = SSL_HIGH,
1076 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1077 .strength_bits = 256,
1078 .alg_bits = 256,
1079 },
1080
1081 /* Cipher C015 */
1082 {
1083 .valid = 1,
1084 .name = TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
1085 .id = TLS1_CK_ECDH_anon_WITH_NULL_SHA,
1086 .algorithm_mkey = SSL_kECDHE,
1087 .algorithm_auth = SSL_aNULL,
1088 .algorithm_enc = SSL_eNULL,
1089 .algorithm_mac = SSL_SHA1,
1090 .algorithm_ssl = SSL_TLSV1,
1091 .algo_strength = SSL_STRONG_NONE,
1092 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1093 .strength_bits = 0,
1094 .alg_bits = 0,
1095 },
1096
1097 /* Cipher C016 */
1098 {
1099 .valid = 1,
1100 .name = TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
1101 .id = TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
1102 .algorithm_mkey = SSL_kECDHE,
1103 .algorithm_auth = SSL_aNULL,
1104 .algorithm_enc = SSL_RC4,
1105 .algorithm_mac = SSL_SHA1,
1106 .algorithm_ssl = SSL_TLSV1,
1107 .algo_strength = SSL_LOW,
1108 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1109 .strength_bits = 128,
1110 .alg_bits = 128,
1111 },
1112
1113 /* Cipher C017 */
1114 {
1115 .valid = 1,
1116 .name = TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
1117 .id = TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
1118 .algorithm_mkey = SSL_kECDHE,
1119 .algorithm_auth = SSL_aNULL,
1120 .algorithm_enc = SSL_3DES,
1121 .algorithm_mac = SSL_SHA1,
1122 .algorithm_ssl = SSL_TLSV1,
1123 .algo_strength = SSL_MEDIUM,
1124 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1125 .strength_bits = 112,
1126 .alg_bits = 168,
1127 },
1128
1129 /* Cipher C018 */
1130 {
1131 .valid = 1,
1132 .name = TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
1133 .id = TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
1134 .algorithm_mkey = SSL_kECDHE,
1135 .algorithm_auth = SSL_aNULL,
1136 .algorithm_enc = SSL_AES128,
1137 .algorithm_mac = SSL_SHA1,
1138 .algorithm_ssl = SSL_TLSV1,
1139 .algo_strength = SSL_HIGH,
1140 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1141 .strength_bits = 128,
1142 .alg_bits = 128,
1143 },
1144
1145 /* Cipher C019 */
1146 {
1147 .valid = 1,
1148 .name = TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
1149 .id = TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
1150 .algorithm_mkey = SSL_kECDHE,
1151 .algorithm_auth = SSL_aNULL,
1152 .algorithm_enc = SSL_AES256,
1153 .algorithm_mac = SSL_SHA1,
1154 .algorithm_ssl = SSL_TLSV1,
1155 .algo_strength = SSL_HIGH,
1156 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1157 .strength_bits = 256,
1158 .alg_bits = 256,
1159 },
1160
1161
1162 /* HMAC based TLS v1.2 ciphersuites from RFC5289 */
1163
1164 /* Cipher C023 */
1165 {
1166 .valid = 1,
1167 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
1168 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
1169 .algorithm_mkey = SSL_kECDHE,
1170 .algorithm_auth = SSL_aECDSA,
1171 .algorithm_enc = SSL_AES128,
1172 .algorithm_mac = SSL_SHA256,
1173 .algorithm_ssl = SSL_TLSV1_2,
1174 .algo_strength = SSL_HIGH,
1175 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1176 .strength_bits = 128,
1177 .alg_bits = 128,
1178 },
1179
1180 /* Cipher C024 */
1181 {
1182 .valid = 1,
1183 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
1184 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
1185 .algorithm_mkey = SSL_kECDHE,
1186 .algorithm_auth = SSL_aECDSA,
1187 .algorithm_enc = SSL_AES256,
1188 .algorithm_mac = SSL_SHA384,
1189 .algorithm_ssl = SSL_TLSV1_2,
1190 .algo_strength = SSL_HIGH,
1191 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1192 .strength_bits = 256,
1193 .alg_bits = 256,
1194 },
1195
1196 /* Cipher C027 */
1197 {
1198 .valid = 1,
1199 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
1200 .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
1201 .algorithm_mkey = SSL_kECDHE,
1202 .algorithm_auth = SSL_aRSA,
1203 .algorithm_enc = SSL_AES128,
1204 .algorithm_mac = SSL_SHA256,
1205 .algorithm_ssl = SSL_TLSV1_2,
1206 .algo_strength = SSL_HIGH,
1207 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1208 .strength_bits = 128,
1209 .alg_bits = 128,
1210 },
1211
1212 /* Cipher C028 */
1213 {
1214 .valid = 1,
1215 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
1216 .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
1217 .algorithm_mkey = SSL_kECDHE,
1218 .algorithm_auth = SSL_aRSA,
1219 .algorithm_enc = SSL_AES256,
1220 .algorithm_mac = SSL_SHA384,
1221 .algorithm_ssl = SSL_TLSV1_2,
1222 .algo_strength = SSL_HIGH,
1223 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1224 .strength_bits = 256,
1225 .alg_bits = 256,
1226 },
1227
1228 /* GCM based TLS v1.2 ciphersuites from RFC5289 */
1229
1230 /* Cipher C02B */
1231 {
1232 .valid = 1,
1233 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1234 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1235 .algorithm_mkey = SSL_kECDHE,
1236 .algorithm_auth = SSL_aECDSA,
1237 .algorithm_enc = SSL_AES128GCM,
1238 .algorithm_mac = SSL_AEAD,
1239 .algorithm_ssl = SSL_TLSV1_2,
1240 .algo_strength = SSL_HIGH,
1241 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1242 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1243 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1244 .strength_bits = 128,
1245 .alg_bits = 128,
1246 },
1247
1248 /* Cipher C02C */
1249 {
1250 .valid = 1,
1251 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1252 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1253 .algorithm_mkey = SSL_kECDHE,
1254 .algorithm_auth = SSL_aECDSA,
1255 .algorithm_enc = SSL_AES256GCM,
1256 .algorithm_mac = SSL_AEAD,
1257 .algorithm_ssl = SSL_TLSV1_2,
1258 .algo_strength = SSL_HIGH,
1259 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
1260 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1261 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1262 .strength_bits = 256,
1263 .alg_bits = 256,
1264 },
1265
1266 /* Cipher C02F */
1267 {
1268 .valid = 1,
1269 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1270 .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1271 .algorithm_mkey = SSL_kECDHE,
1272 .algorithm_auth = SSL_aRSA,
1273 .algorithm_enc = SSL_AES128GCM,
1274 .algorithm_mac = SSL_AEAD,
1275 .algorithm_ssl = SSL_TLSV1_2,
1276 .algo_strength = SSL_HIGH,
1277 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1278 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1279 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1280 .strength_bits = 128,
1281 .alg_bits = 128,
1282 },
1283
1284 /* Cipher C030 */
1285 {
1286 .valid = 1,
1287 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1288 .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1289 .algorithm_mkey = SSL_kECDHE,
1290 .algorithm_auth = SSL_aRSA,
1291 .algorithm_enc = SSL_AES256GCM,
1292 .algorithm_mac = SSL_AEAD,
1293 .algorithm_ssl = SSL_TLSV1_2,
1294 .algo_strength = SSL_HIGH,
1295 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
1296 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1297 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1298 .strength_bits = 256,
1299 .alg_bits = 256,
1300 },
1301
1302 /* Cipher CCA8 */
1303 {
1304 .valid = 1,
1305 .name = TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
1306 .id = TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305,
1307 .algorithm_mkey = SSL_kECDHE,
1308 .algorithm_auth = SSL_aRSA,
1309 .algorithm_enc = SSL_CHACHA20POLY1305,
1310 .algorithm_mac = SSL_AEAD,
1311 .algorithm_ssl = SSL_TLSV1_2,
1312 .algo_strength = SSL_HIGH,
1313 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1314 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(12),
1315 .strength_bits = 256,
1316 .alg_bits = 256,
1317 },
1318
1319 /* Cipher CCA9 */
1320 {
1321 .valid = 1,
1322 .name = TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
1323 .id = TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305,
1324 .algorithm_mkey = SSL_kECDHE,
1325 .algorithm_auth = SSL_aECDSA,
1326 .algorithm_enc = SSL_CHACHA20POLY1305,
1327 .algorithm_mac = SSL_AEAD,
1328 .algorithm_ssl = SSL_TLSV1_2,
1329 .algo_strength = SSL_HIGH,
1330 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1331 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(12),
1332 .strength_bits = 256,
1333 .alg_bits = 256,
1334 },
1335
1336 /* Cipher CCAA */
1337 {
1338 .valid = 1,
1339 .name = TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
1340 .id = TLS1_CK_DHE_RSA_CHACHA20_POLY1305,
1341 .algorithm_mkey = SSL_kDHE,
1342 .algorithm_auth = SSL_aRSA,
1343 .algorithm_enc = SSL_CHACHA20POLY1305,
1344 .algorithm_mac = SSL_AEAD,
1345 .algorithm_ssl = SSL_TLSV1_2,
1346 .algo_strength = SSL_HIGH,
1347 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1348 SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(12),
1349 .strength_bits = 256,
1350 .alg_bits = 256,
1351 },
1352
1353 /* Cipher FF85 FIXME IANA */
1354 {
1355 .valid = 1,
1356 .name = "GOST2012256-GOST89-GOST89",
1357 .id = 0x300ff85, /* FIXME IANA */
1358 .algorithm_mkey = SSL_kGOST,
1359 .algorithm_auth = SSL_aGOST01,
1360 .algorithm_enc = SSL_eGOST2814789CNT,
1361 .algorithm_mac = SSL_GOST89MAC,
1362 .algorithm_ssl = SSL_TLSV1,
1363 .algo_strength = SSL_HIGH,
1364 .algorithm2 = SSL_HANDSHAKE_MAC_STREEBOG256|TLS1_PRF_STREEBOG256|
1365 TLS1_STREAM_MAC,
1366 .strength_bits = 256,
1367 .alg_bits = 256
1368 },
1369
1370 /* Cipher FF87 FIXME IANA */
1371 {
1372 .valid = 1,
1373 .name = "GOST2012256-NULL-STREEBOG256",
1374 .id = 0x300ff87, /* FIXME IANA */
1375 .algorithm_mkey = SSL_kGOST,
1376 .algorithm_auth = SSL_aGOST01,
1377 .algorithm_enc = SSL_eNULL,
1378 .algorithm_mac = SSL_STREEBOG256,
1379 .algorithm_ssl = SSL_TLSV1,
1380 .algo_strength = SSL_STRONG_NONE,
1381 .algorithm2 = SSL_HANDSHAKE_MAC_STREEBOG256|TLS1_PRF_STREEBOG256,
1382 .strength_bits = 0,
1383 .alg_bits = 0
1384 },
1385
1386
1387 /* end of list */
1388 };
1389
1390 int
1391 ssl3_num_ciphers(void)
1392 {
1393 return (SSL3_NUM_CIPHERS);
1394 }
1395
1396 const SSL_CIPHER *
1397 ssl3_get_cipher(unsigned int u)
1398 {
1399 if (u < SSL3_NUM_CIPHERS)
1400 return (&(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]));
1401 else
1402 return (NULL);
1403 }
1404
1405 const SSL_CIPHER *
1406 ssl3_get_cipher_by_id(unsigned int id)
1407 {
1408 const SSL_CIPHER *cp;
1409 SSL_CIPHER c;
1410
1411 c.id = id;
1412 cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
1413 if (cp != NULL && cp->valid == 1)
1414 return (cp);
1415
1416 return (NULL);
1417 }
1418
1419 const SSL_CIPHER *
1420 ssl3_get_cipher_by_value(uint16_t value)
1421 {
1422 return ssl3_get_cipher_by_id(SSL3_CK_ID | value);
1423 }
1424
1425 uint16_t
1426 ssl3_cipher_get_value(const SSL_CIPHER *c)
1427 {
1428 return (c->id & SSL3_CK_VALUE_MASK);
1429 }
1430
1431 int
1432 ssl3_pending(const SSL *s)
1433 {
1434 if (s->internal->rstate == SSL_ST_READ_BODY)
1435 return 0;
1436
1437 return (S3I(s)->rrec.type == SSL3_RT_APPLICATION_DATA) ?
1438 S3I(s)->rrec.length : 0;
1439 }
1440
1441 int
1442 ssl3_handshake_msg_hdr_len(SSL *s)
1443 {
1444 return (SSL_IS_DTLS(s) ? DTLS1_HM_HEADER_LENGTH :
1445 SSL3_HM_HEADER_LENGTH);
1446 }
1447
1448 unsigned char *
1449 ssl3_handshake_msg_start(SSL *s, uint8_t msg_type)
1450 {
1451 unsigned char *d, *p;
1452
1453 d = p = (unsigned char *)s->internal->init_buf->data;
1454
1455 /* Handshake message type and length. */
1456 *(p++) = msg_type;
1457 l2n3(0, p);
1458
1459 return (d + ssl3_handshake_msg_hdr_len(s));
1460 }
1461
1462 void
1463 ssl3_handshake_msg_finish(SSL *s, unsigned int len)
1464 {
1465 unsigned char *p;
1466 uint8_t msg_type;
1467
1468 p = (unsigned char *)s->internal->init_buf->data;
1469
1470 /* Handshake message length. */
1471 msg_type = *(p++);
1472 l2n3(len, p);
1473
1474 s->internal->init_num = ssl3_handshake_msg_hdr_len(s) + (int)len;
1475 s->internal->init_off = 0;
1476
1477 if (SSL_IS_DTLS(s)) {
1478 dtls1_set_message_header(s, msg_type, len, 0, len);
1479 dtls1_buffer_message(s, 0);
1480 }
1481 }
1482
1483 int
1484 ssl3_handshake_msg_start_cbb(SSL *s, CBB *handshake, CBB *body,
1485 uint8_t msg_type)
1486 {
1487 int ret = 0;
1488
1489 if (!CBB_init(handshake, SSL3_RT_MAX_PLAIN_LENGTH))
1490 goto err;
1491 if (!CBB_add_u8(handshake, msg_type))
1492 goto err;
1493 if (SSL_IS_DTLS(s)) {
1494 unsigned char *data;
1495
1496 if (!CBB_add_space(handshake, &data, DTLS1_HM_HEADER_LENGTH -
1497 SSL3_HM_HEADER_LENGTH))
1498 goto err;
1499 }
1500 if (!CBB_add_u24_length_prefixed(handshake, body))
1501 goto err;
1502
1503 ret = 1;
1504
1505 err:
1506 return (ret);
1507 }
1508
1509 int
1510 ssl3_handshake_msg_finish_cbb(SSL *s, CBB *handshake)
1511 {
1512 unsigned char *data = NULL;
1513 size_t outlen;
1514 int ret = 0;
1515
1516 if (!CBB_finish(handshake, &data, &outlen))
1517 goto err;
1518
1519 if (outlen > INT_MAX)
1520 goto err;
1521
1522 if (!BUF_MEM_grow_clean(s->internal->init_buf, outlen))
1523 goto err;
1524
1525 memcpy(s->internal->init_buf->data, data, outlen);
1526
1527 s->internal->init_num = (int)outlen;
1528 s->internal->init_off = 0;
1529
1530 if (SSL_IS_DTLS(s)) {
1531 unsigned long len;
1532 uint8_t msg_type;
1533 CBS cbs;
1534
1535 CBS_init(&cbs, data, outlen);
1536 if (!CBS_get_u8(&cbs, &msg_type))
1537 goto err;
1538
1539 len = outlen - ssl3_handshake_msg_hdr_len(s);
1540
1541 dtls1_set_message_header(s, msg_type, len, 0, len);
1542 dtls1_buffer_message(s, 0);
1543 }
1544
1545 ret = 1;
1546
1547 err:
1548 free(data);
1549
1550 return (ret);
1551 }
1552
1553 int
1554 ssl3_handshake_write(SSL *s)
1555 {
1556 if (SSL_IS_DTLS(s))
1557 return dtls1_do_write(s, SSL3_RT_HANDSHAKE);
1558
1559 return ssl3_do_write(s, SSL3_RT_HANDSHAKE);
1560 }
1561
1562 int
1563 ssl3_new(SSL *s)
1564 {
1565 if ((s->s3 = calloc(1, sizeof(*s->s3))) == NULL)
1566 return (0);
1567 if ((S3I(s) = calloc(1, sizeof(*S3I(s)))) == NULL) {
1568 free(s->s3);
1569 return (0);
1570 }
1571
1572 s->method->internal->ssl_clear(s);
1573
1574 return (1);
1575 }
1576
1577 void
1578 ssl3_free(SSL *s)
1579 {
1580 if (s == NULL)
1581 return;
1582
1583 tls1_cleanup_key_block(s);
1584 ssl3_release_read_buffer(s);
1585 ssl3_release_write_buffer(s);
1586
1587 DH_free(S3I(s)->tmp.dh);
1588 EC_KEY_free(S3I(s)->tmp.ecdh);
1589
1590 freezero(S3I(s)->tmp.x25519, X25519_KEY_LENGTH);
1591
1592 sk_X509_NAME_pop_free(S3I(s)->tmp.ca_names, X509_NAME_free);
1593
1594 BIO_free(S3I(s)->handshake_buffer);
1595
1596 tls1_handshake_hash_free(s);
1597
1598 free(S3I(s)->alpn_selected);
1599
1600 freezero(S3I(s), sizeof(*S3I(s)));
1601 freezero(s->s3, sizeof(*s->s3));
1602
1603 s->s3 = NULL;
1604 }
1605
1606 void
1607 ssl3_clear(SSL *s)
1608 {
1609 struct ssl3_state_internal_st *internal;
1610 unsigned char *rp, *wp;
1611 size_t rlen, wlen;
1612
1613 tls1_cleanup_key_block(s);
1614 sk_X509_NAME_pop_free(S3I(s)->tmp.ca_names, X509_NAME_free);
1615
1616 DH_free(S3I(s)->tmp.dh);
1617 S3I(s)->tmp.dh = NULL;
1618 EC_KEY_free(S3I(s)->tmp.ecdh);
1619 S3I(s)->tmp.ecdh = NULL;
1620
1621 freezero(S3I(s)->tmp.x25519, X25519_KEY_LENGTH);
1622 S3I(s)->tmp.x25519 = NULL;
1623
1624 rp = s->s3->rbuf.buf;
1625 wp = s->s3->wbuf.buf;
1626 rlen = s->s3->rbuf.len;
1627 wlen = s->s3->wbuf.len;
1628
1629 BIO_free(S3I(s)->handshake_buffer);
1630 S3I(s)->handshake_buffer = NULL;
1631
1632 tls1_handshake_hash_free(s);
1633
1634 free(S3I(s)->alpn_selected);
1635 S3I(s)->alpn_selected = NULL;
1636
1637 memset(S3I(s), 0, sizeof(*S3I(s)));
1638 internal = S3I(s);
1639 memset(s->s3, 0, sizeof(*s->s3));
1640 S3I(s) = internal;
1641
1642 s->s3->rbuf.buf = rp;
1643 s->s3->wbuf.buf = wp;
1644 s->s3->rbuf.len = rlen;
1645 s->s3->wbuf.len = wlen;
1646
1647 ssl_free_wbio_buffer(s);
1648
1649 /* Not needed... */
1650 S3I(s)->renegotiate = 0;
1651 S3I(s)->total_renegotiations = 0;
1652 S3I(s)->num_renegotiations = 0;
1653 S3I(s)->in_read_app_data = 0;
1654
1655 s->internal->packet_length = 0;
1656 s->version = TLS1_VERSION;
1657 }
1658
1659 static long
1660 ssl_ctrl_get_server_tmp_key(SSL *s, EVP_PKEY **pkey_tmp)
1661 {
1662 EVP_PKEY *pkey = NULL;
1663 EC_GROUP *group = NULL;
1664 EC_POINT *point = NULL;
1665 EC_KEY *ec_key = NULL;
1666 BIGNUM *order = NULL;
1667 SESS_CERT *sc;
1668 int ret = 0;
1669
1670 *pkey_tmp = NULL;
1671
1672 if (s->server != 0)
1673 return 0;
1674 if (s->session == NULL || SSI(s)->sess_cert == NULL)
1675 return 0;
1676
1677 sc = SSI(s)->sess_cert;
1678
1679 if ((pkey = EVP_PKEY_new()) == NULL)
1680 return 0;
1681
1682 if (sc->peer_dh_tmp != NULL) {
1683 ret = EVP_PKEY_set1_DH(pkey, sc->peer_dh_tmp);
1684 } else if (sc->peer_ecdh_tmp) {
1685 ret = EVP_PKEY_set1_EC_KEY(pkey, sc->peer_ecdh_tmp);
1686 } else if (sc->peer_x25519_tmp != NULL) {
1687 /* Fudge up an EC_KEY that looks like X25519... */
1688 if ((group = EC_GROUP_new(EC_GFp_mont_method())) == NULL)
1689 goto err;
1690 if ((point = EC_POINT_new(group)) == NULL)
1691 goto err;
1692 if ((order = BN_new()) == NULL)
1693 goto err;
1694 if (!BN_set_bit(order, 252))
1695 goto err;
1696 if (!EC_GROUP_set_generator(group, point, order, NULL))
1697 goto err;
1698 EC_GROUP_set_curve_name(group, NID_X25519);
1699 if ((ec_key = EC_KEY_new()) == NULL)
1700 goto err;
1701 if (!EC_KEY_set_group(ec_key, group))
1702 goto err;
1703 ret = EVP_PKEY_set1_EC_KEY(pkey, ec_key);
1704 }
1705
1706 if (ret == 1) {
1707 *pkey_tmp = pkey;
1708 pkey = NULL;
1709 }
1710
1711 err:
1712 EVP_PKEY_free(pkey);
1713 EC_GROUP_free(group);
1714 EC_POINT_free(point);
1715 EC_KEY_free(ec_key);
1716 BN_free(order);
1717
1718 return (ret);
1719 }
1720
1721 static int
1722 _SSL_session_reused(SSL *s)
1723 {
1724 return s->internal->hit;
1725 }
1726
1727 static int
1728 _SSL_num_renegotiations(SSL *s)
1729 {
1730 return S3I(s)->num_renegotiations;
1731 }
1732
1733 static int
1734 _SSL_clear_num_renegotiations(SSL *s)
1735 {
1736 int renegs;
1737
1738 renegs = S3I(s)->num_renegotiations;
1739 S3I(s)->num_renegotiations = 0;
1740
1741 return renegs;
1742 }
1743
1744 static int
1745 _SSL_total_renegotiations(SSL *s)
1746 {
1747 return S3I(s)->total_renegotiations;
1748 }
1749
1750 static int
1751 _SSL_set_tmp_dh(SSL *s, DH *dh)
1752 {
1753 DH *dh_tmp;
1754
1755 if (!ssl_cert_inst(&s->cert)) {
1756 SSLerror(s, ERR_R_MALLOC_FAILURE);
1757 return 0;
1758 }
1759
1760 if (dh == NULL) {
1761 SSLerror(s, ERR_R_PASSED_NULL_PARAMETER);
1762 return 0;
1763 }
1764
1765 if ((dh_tmp = DHparams_dup(dh)) == NULL) {
1766 SSLerror(s, ERR_R_DH_LIB);
1767 return 0;
1768 }
1769
1770 DH_free(s->cert->dh_tmp);
1771 s->cert->dh_tmp = dh_tmp;
1772
1773 return 1;
1774 }
1775
1776 static int
1777 _SSL_set_dh_auto(SSL *s, int state)
1778 {
1779 s->cert->dh_tmp_auto = state;
1780 return 1;
1781 }
1782
1783 static int
1784 _SSL_set_tmp_ecdh(SSL *s, EC_KEY *ecdh)
1785 {
1786 const EC_GROUP *group;
1787 int nid;
1788
1789 if (!ssl_cert_inst(&s->cert)) {
1790 SSLerror(s, ERR_R_MALLOC_FAILURE);
1791 return 0;
1792 }
1793
1794 if (ecdh == NULL)
1795 return 0;
1796 if ((group = EC_KEY_get0_group(ecdh)) == NULL)
1797 return 0;
1798
1799 nid = EC_GROUP_get_curve_name(group);
1800 return SSL_set1_groups(s, &nid, 1);
1801 }
1802
1803 static int
1804 _SSL_set_ecdh_auto(SSL *s, int state)
1805 {
1806 return 1;
1807 }
1808
1809 static int
1810 _SSL_set_tlsext_host_name(SSL *s, const char *name)
1811 {
1812 free(s->tlsext_hostname);
1813 s->tlsext_hostname = NULL;
1814
1815 if (name == NULL)
1816 return 1;
1817
1818 if (strlen(name) > TLSEXT_MAXLEN_host_name) {
1819 SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
1820 return 0;
1821 }
1822
1823 if ((s->tlsext_hostname = strdup(name)) == NULL) {
1824 SSLerror(s, ERR_R_INTERNAL_ERROR);
1825 return 0;
1826 }
1827
1828 return 1;
1829 }
1830
1831 static int
1832 _SSL_set_tlsext_debug_arg(SSL *s, void *arg)
1833 {
1834 s->internal->tlsext_debug_arg = arg;
1835 return 1;
1836 }
1837
1838 static int
1839 _SSL_set_tlsext_status_type(SSL *s, int type)
1840 {
1841 s->tlsext_status_type = type;
1842 return 1;
1843 }
1844
1845 static int
1846 _SSL_get_tlsext_status_exts(SSL *s, STACK_OF(X509_EXTENSION) **exts)
1847 {
1848 *exts = s->internal->tlsext_ocsp_exts;
1849 return 1;
1850 }
1851
1852 static int
1853 _SSL_set_tlsext_status_exts(SSL *s, STACK_OF(X509_EXTENSION) *exts)
1854 {
1855 /* XXX - leak... */
1856 s->internal->tlsext_ocsp_exts = exts;
1857 return 1;
1858 }
1859
1860 static int
1861 _SSL_get_tlsext_status_ids(SSL *s, STACK_OF(OCSP_RESPID) **ids)
1862 {
1863 *ids = s->internal->tlsext_ocsp_ids;
1864 return 1;
1865 }
1866
1867 static int
1868 _SSL_set_tlsext_status_ids(SSL *s, STACK_OF(OCSP_RESPID) *ids)
1869 {
1870 /* XXX - leak... */
1871 s->internal->tlsext_ocsp_ids = ids;
1872 return 1;
1873 }
1874
1875 static int
1876 _SSL_get_tlsext_status_ocsp_resp(SSL *s, unsigned char **resp)
1877 {
1878 *resp = s->internal->tlsext_ocsp_resp;
1879 return s->internal->tlsext_ocsp_resplen;
1880 }
1881
1882 static int
1883 _SSL_set_tlsext_status_ocsp_resp(SSL *s, unsigned char *resp, int resp_len)
1884 {
1885 free(s->internal->tlsext_ocsp_resp);
1886 s->internal->tlsext_ocsp_resp = resp;
1887 s->internal->tlsext_ocsp_resplen = resp_len;
1888 return 1;
1889 }
1890
1891 int
1892 SSL_set1_groups(SSL *s, const int *groups, size_t groups_len)
1893 {
1894 return tls1_set_groups(&s->internal->tlsext_supportedgroups,
1895 &s->internal->tlsext_supportedgroups_length, groups, groups_len);
1896 }
1897
1898 int
1899 SSL_set1_groups_list(SSL *s, const char *groups)
1900 {
1901 return tls1_set_groups_list(&s->internal->tlsext_supportedgroups,
1902 &s->internal->tlsext_supportedgroups_length, groups);
1903 }
1904
1905 long
1906 ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
1907 {
1908 switch (cmd) {
1909 case SSL_CTRL_GET_SESSION_REUSED:
1910 return _SSL_session_reused(s);
1911
1912 case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
1913 return _SSL_num_renegotiations(s);
1914
1915 case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
1916 return _SSL_clear_num_renegotiations(s);
1917
1918 case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
1919 return _SSL_total_renegotiations(s);
1920
1921 case SSL_CTRL_SET_TMP_DH:
1922 return _SSL_set_tmp_dh(s, parg);
1923
1924 case SSL_CTRL_SET_TMP_DH_CB:
1925 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1926 return 0;
1927
1928 case SSL_CTRL_SET_DH_AUTO:
1929 return _SSL_set_dh_auto(s, larg);
1930
1931 case SSL_CTRL_SET_TMP_ECDH:
1932 return _SSL_set_tmp_ecdh(s, parg);
1933
1934 case SSL_CTRL_SET_TMP_ECDH_CB:
1935 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1936 return 0;
1937
1938 case SSL_CTRL_SET_ECDH_AUTO:
1939 return _SSL_set_ecdh_auto(s, larg);
1940
1941 case SSL_CTRL_SET_TLSEXT_HOSTNAME:
1942 if (larg != TLSEXT_NAMETYPE_host_name) {
1943 SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
1944 return 0;
1945 }
1946 return _SSL_set_tlsext_host_name(s, parg);
1947
1948 case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
1949 return _SSL_set_tlsext_debug_arg(s, parg);
1950
1951 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
1952 return _SSL_set_tlsext_status_type(s, larg);
1953
1954 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
1955 return _SSL_get_tlsext_status_exts(s, parg);
1956
1957 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
1958 return _SSL_set_tlsext_status_exts(s, parg);
1959
1960 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
1961 return _SSL_get_tlsext_status_ids(s, parg);
1962
1963 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
1964 return _SSL_set_tlsext_status_ids(s, parg);
1965
1966 case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
1967 return _SSL_get_tlsext_status_ocsp_resp(s, parg);
1968
1969 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
1970 return _SSL_set_tlsext_status_ocsp_resp(s, parg, larg);
1971
1972 case SSL_CTRL_SET_GROUPS:
1973 return SSL_set1_groups(s, parg, larg);
1974
1975 case SSL_CTRL_SET_GROUPS_LIST:
1976 return SSL_set1_groups_list(s, parg);
1977
1978 case SSL_CTRL_GET_SERVER_TMP_KEY:
1979 return ssl_ctrl_get_server_tmp_key(s, parg);
1980
1981 case SSL_CTRL_SET_MIN_PROTO_VERSION:
1982 if (larg < 0 || larg > UINT16_MAX)
1983 return 0;
1984 return SSL_set_min_proto_version(s, larg);
1985
1986 case SSL_CTRL_SET_MAX_PROTO_VERSION:
1987 if (larg < 0 || larg > UINT16_MAX)
1988 return 0;
1989 return SSL_set_max_proto_version(s, larg);
1990
1991 /*
1992 * Legacy controls that should eventually be removed.
1993 */
1994 case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
1995 return 0;
1996
1997 case SSL_CTRL_GET_FLAGS:
1998 return (int)(s->s3->flags);
1999
2000 case SSL_CTRL_NEED_TMP_RSA:
2001 return 0;
2002
2003 case SSL_CTRL_SET_TMP_RSA:
2004 case SSL_CTRL_SET_TMP_RSA_CB:
2005 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2006 return 0;
2007 }
2008
2009 return 0;
2010 }
2011
2012 long
2013 ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
2014 {
2015 if (cmd == SSL_CTRL_SET_TMP_DH_CB || cmd == SSL_CTRL_SET_TMP_ECDH_CB) {
2016 if (!ssl_cert_inst(&s->cert)) {
2017 SSLerror(s, ERR_R_MALLOC_FAILURE);
2018 return 0;
2019 }
2020 }
2021
2022 switch (cmd) {
2023 case SSL_CTRL_SET_TMP_RSA_CB:
2024 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2025 return 0;
2026
2027 case SSL_CTRL_SET_TMP_DH_CB:
2028 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
2029 return 1;
2030
2031 case SSL_CTRL_SET_TMP_ECDH_CB:
2032 return 1;
2033
2034 case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
2035 s->internal->tlsext_debug_cb = (void (*)(SSL *, int , int,
2036 unsigned char *, int, void *))fp;
2037 return 1;
2038 }
2039
2040 return 0;
2041 }
2042
2043 static int
2044 _SSL_CTX_set_tmp_dh(SSL_CTX *ctx, DH *dh)
2045 {
2046 DH *dh_tmp;
2047
2048 if ((dh_tmp = DHparams_dup(dh)) == NULL) {
2049 SSLerrorx(ERR_R_DH_LIB);
2050 return 0;
2051 }
2052
2053 DH_free(ctx->internal->cert->dh_tmp);
2054 ctx->internal->cert->dh_tmp = dh_tmp;
2055
2056 return 1;
2057 }
2058
2059 static int
2060 _SSL_CTX_set_dh_auto(SSL_CTX *ctx, int state)
2061 {
2062 ctx->internal->cert->dh_tmp_auto = state;
2063 return 1;
2064 }
2065
2066 static int
2067 _SSL_CTX_set_tmp_ecdh(SSL_CTX *ctx, EC_KEY *ecdh)
2068 {
2069 const EC_GROUP *group;
2070 int nid;
2071
2072 if (ecdh == NULL)
2073 return 0;
2074 if ((group = EC_KEY_get0_group(ecdh)) == NULL)
2075 return 0;
2076
2077 nid = EC_GROUP_get_curve_name(group);
2078 return SSL_CTX_set1_groups(ctx, &nid, 1);
2079 }
2080
2081 static int
2082 _SSL_CTX_set_ecdh_auto(SSL_CTX *ctx, int state)
2083 {
2084 return 1;
2085 }
2086
2087 static int
2088 _SSL_CTX_set_tlsext_servername_arg(SSL_CTX *ctx, void *arg)
2089 {
2090 ctx->internal->tlsext_servername_arg = arg;
2091 return 1;
2092 }
2093
2094 static int
2095 _SSL_CTX_get_tlsext_ticket_keys(SSL_CTX *ctx, unsigned char *keys, int keys_len)
2096 {
2097 if (keys == NULL)
2098 return 48;
2099
2100 if (keys_len != 48) {
2101 SSLerrorx(SSL_R_INVALID_TICKET_KEYS_LENGTH);
2102 return 0;
2103 }
2104
2105 memcpy(keys, ctx->internal->tlsext_tick_key_name, 16);
2106 memcpy(keys + 16, ctx->internal->tlsext_tick_hmac_key, 16);
2107 memcpy(keys + 32, ctx->internal->tlsext_tick_aes_key, 16);
2108
2109 return 1;
2110 }
2111
2112 static int
2113 _SSL_CTX_set_tlsext_ticket_keys(SSL_CTX *ctx, unsigned char *keys, int keys_len)
2114 {
2115 if (keys == NULL)
2116 return 48;
2117
2118 if (keys_len != 48) {
2119 SSLerrorx(SSL_R_INVALID_TICKET_KEYS_LENGTH);
2120 return 0;
2121 }
2122
2123 memcpy(ctx->internal->tlsext_tick_key_name, keys, 16);
2124 memcpy(ctx->internal->tlsext_tick_hmac_key, keys + 16, 16);
2125 memcpy(ctx->internal->tlsext_tick_aes_key, keys + 32, 16);
2126
2127 return 1;
2128 }
2129
2130 static int
2131 _SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg)
2132 {
2133 ctx->internal->tlsext_status_arg = arg;
2134 return 1;
2135 }
2136
2137 static int
2138 _SSL_CTX_add_extra_chain_cert(SSL_CTX *ctx, X509 *cert)
2139 {
2140 if (ctx->extra_certs == NULL) {
2141 if ((ctx->extra_certs = sk_X509_new_null()) == NULL)
2142 return 0;
2143 }
2144 if (sk_X509_push(ctx->extra_certs, cert) == 0)
2145 return 0;
2146
2147 return 1;
2148 }
2149
2150 int
2151 _SSL_CTX_get_extra_chain_certs(SSL_CTX *ctx, STACK_OF(X509) **certs)
2152 {
2153 *certs = ctx->extra_certs;
2154 return 1;
2155 }
2156
2157 int
2158 _SSL_CTX_clear_extra_chain_certs(SSL_CTX *ctx)
2159 {
2160 sk_X509_pop_free(ctx->extra_certs, X509_free);
2161 ctx->extra_certs = NULL;
2162 return 1;
2163 }
2164
2165 int
2166 SSL_CTX_set1_groups(SSL_CTX *ctx, const int *groups, size_t groups_len)
2167 {
2168 return tls1_set_groups(&ctx->internal->tlsext_supportedgroups,
2169 &ctx->internal->tlsext_supportedgroups_length, groups, groups_len);
2170 }
2171
2172 int
2173 SSL_CTX_set1_groups_list(SSL_CTX *ctx, const char *groups)
2174 {
2175 return tls1_set_groups_list(&ctx->internal->tlsext_supportedgroups,
2176 &ctx->internal->tlsext_supportedgroups_length, groups);
2177 }
2178
2179 long
2180 ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2181 {
2182 switch (cmd) {
2183 case SSL_CTRL_SET_TMP_DH:
2184 return _SSL_CTX_set_tmp_dh(ctx, parg);
2185
2186 case SSL_CTRL_SET_TMP_DH_CB:
2187 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2188 return 0;
2189
2190 case SSL_CTRL_SET_DH_AUTO:
2191 return _SSL_CTX_set_dh_auto(ctx, larg);
2192
2193 case SSL_CTRL_SET_TMP_ECDH:
2194 return _SSL_CTX_set_tmp_ecdh(ctx, parg);
2195
2196 case SSL_CTRL_SET_TMP_ECDH_CB:
2197 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2198 return 0;
2199
2200 case SSL_CTRL_SET_ECDH_AUTO:
2201 return _SSL_CTX_set_ecdh_auto(ctx, larg);
2202
2203 case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
2204 return _SSL_CTX_set_tlsext_servername_arg(ctx, parg);
2205
2206 case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
2207 return _SSL_CTX_get_tlsext_ticket_keys(ctx, parg, larg);
2208
2209 case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
2210 return _SSL_CTX_set_tlsext_ticket_keys(ctx, parg, larg);
2211
2212 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
2213 return _SSL_CTX_set_tlsext_status_arg(ctx, parg);
2214
2215 case SSL_CTRL_EXTRA_CHAIN_CERT:
2216 return _SSL_CTX_add_extra_chain_cert(ctx, parg);
2217
2218 case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
2219 return _SSL_CTX_get_extra_chain_certs(ctx, parg);
2220
2221 case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
2222 return _SSL_CTX_clear_extra_chain_certs(ctx);
2223
2224 case SSL_CTRL_SET_GROUPS:
2225 return SSL_CTX_set1_groups(ctx, parg, larg);
2226
2227 case SSL_CTRL_SET_GROUPS_LIST:
2228 return SSL_CTX_set1_groups_list(ctx, parg);
2229
2230 case SSL_CTRL_SET_MIN_PROTO_VERSION:
2231 if (larg < 0 || larg > UINT16_MAX)
2232 return 0;
2233 return SSL_CTX_set_min_proto_version(ctx, larg);
2234
2235 case SSL_CTRL_SET_MAX_PROTO_VERSION:
2236 if (larg < 0 || larg > UINT16_MAX)
2237 return 0;
2238 return SSL_CTX_set_max_proto_version(ctx, larg);
2239
2240 /*
2241 * Legacy controls that should eventually be removed.
2242 */
2243 case SSL_CTRL_NEED_TMP_RSA:
2244 return 0;
2245
2246 case SSL_CTRL_SET_TMP_RSA:
2247 case SSL_CTRL_SET_TMP_RSA_CB:
2248 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2249 return 0;
2250 }
2251
2252 return 0;
2253 }
2254
2255 long
2256 ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
2257 {
2258 switch (cmd) {
2259 case SSL_CTRL_SET_TMP_RSA_CB:
2260 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2261 return 0;
2262
2263 case SSL_CTRL_SET_TMP_DH_CB:
2264 ctx->internal->cert->dh_tmp_cb =
2265 (DH *(*)(SSL *, int, int))fp;
2266 return 1;
2267
2268 case SSL_CTRL_SET_TMP_ECDH_CB:
2269 return 1;
2270
2271 case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
2272 ctx->internal->tlsext_servername_callback =
2273 (int (*)(SSL *, int *, void *))fp;
2274 return 1;
2275
2276 case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
2277 ctx->internal->tlsext_status_cb = (int (*)(SSL *, void *))fp;
2278 return 1;
2279
2280 case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
2281 ctx->internal->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char *,
2282 unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int))fp;
2283 return 1;
2284 }
2285
2286 return 0;
2287 }
2288
2289 /*
2290 * This function needs to check if the ciphers required are actually available.
2291 */
2292 const SSL_CIPHER *
2293 ssl3_get_cipher_by_char(const unsigned char *p)
2294 {
2295 CBS cipher;
2296 uint16_t cipher_value;
2297
2298 /* We have to assume it is at least 2 bytes due to existing API. */
2299 CBS_init(&cipher, p, 2);
2300 if (!CBS_get_u16(&cipher, &cipher_value))
2301 return NULL;
2302
2303 return ssl3_get_cipher_by_value(cipher_value);
2304 }
2305
2306 int
2307 ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
2308 {
2309 if (p != NULL) {
2310 if ((c->id & ~SSL3_CK_VALUE_MASK) != SSL3_CK_ID)
2311 return (0);
2312 s2n(ssl3_cipher_get_value(c), p);
2313 }
2314 return (2);
2315 }
2316
2317 SSL_CIPHER *
2318 ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
2319 STACK_OF(SSL_CIPHER) *srvr)
2320 {
2321 unsigned long alg_k, alg_a, mask_k, mask_a;
2322 STACK_OF(SSL_CIPHER) *prio, *allow;
2323 SSL_CIPHER *c, *ret = NULL;
2324 int i, ii, ok;
2325 CERT *cert;
2326
2327 /* Let's see which ciphers we can support */
2328 cert = s->cert;
2329
2330 /*
2331 * Do not set the compare functions, because this may lead to a
2332 * reordering by "id". We want to keep the original ordering.
2333 * We may pay a price in performance during sk_SSL_CIPHER_find(),
2334 * but would have to pay with the price of sk_SSL_CIPHER_dup().
2335 */
2336
2337 if (s->internal->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
2338 prio = srvr;
2339 allow = clnt;
2340 } else {
2341 prio = clnt;
2342 allow = srvr;
2343 }
2344
2345 for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
2346 c = sk_SSL_CIPHER_value(prio, i);
2347
2348 /* Skip TLS v1.2 only ciphersuites if not supported. */
2349 if ((c->algorithm_ssl & SSL_TLSV1_2) &&
2350 !SSL_USE_TLS1_2_CIPHERS(s))
2351 continue;
2352
2353 ssl_set_cert_masks(cert, c);
2354 mask_k = cert->mask_k;
2355 mask_a = cert->mask_a;
2356
2357 alg_k = c->algorithm_mkey;
2358 alg_a = c->algorithm_auth;
2359
2360
2361 ok = (alg_k & mask_k) && (alg_a & mask_a);
2362
2363 /*
2364 * If we are considering an ECC cipher suite that uses our
2365 * certificate check it.
2366 */
2367 if (alg_a & SSL_aECDSA)
2368 ok = ok && tls1_check_ec_server_key(s);
2369 /*
2370 * If we are considering an ECC cipher suite that uses
2371 * an ephemeral EC key check it.
2372 */
2373 if (alg_k & SSL_kECDHE)
2374 ok = ok && tls1_check_ec_tmp_key(s);
2375
2376 if (!ok)
2377 continue;
2378 ii = sk_SSL_CIPHER_find(allow, c);
2379 if (ii >= 0) {
2380 ret = sk_SSL_CIPHER_value(allow, ii);
2381 break;
2382 }
2383 }
2384 return (ret);
2385 }
2386
2387 int
2388 ssl3_get_req_cert_types(SSL *s, CBB *cbb)
2389 {
2390 unsigned long alg_k;
2391
2392 alg_k = S3I(s)->hs.new_cipher->algorithm_mkey;
2393
2394 #ifndef OPENSSL_NO_GOST
2395 if ((alg_k & SSL_kGOST) != 0) {
2396 if (!CBB_add_u8(cbb, TLS_CT_GOST94_SIGN))
2397 return 0;
2398 if (!CBB_add_u8(cbb, TLS_CT_GOST01_SIGN))
2399 return 0;
2400 if (!CBB_add_u8(cbb, TLS_CT_GOST12_256_SIGN))
2401 return 0;
2402 if (!CBB_add_u8(cbb, TLS_CT_GOST12_512_SIGN))
2403 return 0;
2404 }
2405 #endif
2406
2407 if ((alg_k & SSL_kDHE) != 0) {
2408 if (!CBB_add_u8(cbb, SSL3_CT_RSA_FIXED_DH))
2409 return 0;
2410 }
2411
2412 if (!CBB_add_u8(cbb, SSL3_CT_RSA_SIGN))
2413 return 0;
2414
2415 /*
2416 * ECDSA certs can be used with RSA cipher suites as well
2417 * so we don't need to check for SSL_kECDH or SSL_kECDHE.
2418 */
2419 if (!CBB_add_u8(cbb, TLS_CT_ECDSA_SIGN))
2420 return 0;
2421
2422 return 1;
2423 }
2424
2425 int
2426 ssl3_shutdown(SSL *s)
2427 {
2428 int ret;
2429
2430 /*
2431 * Don't do anything much if we have not done the handshake or
2432 * we don't want to send messages :-)
2433 */
2434 if ((s->internal->quiet_shutdown) || (S3I(s)->hs.state == SSL_ST_BEFORE)) {
2435 s->internal->shutdown = (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
2436 return (1);
2437 }
2438
2439 if (!(s->internal->shutdown & SSL_SENT_SHUTDOWN)) {
2440 s->internal->shutdown|=SSL_SENT_SHUTDOWN;
2441 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
2442 /*
2443 * Our shutdown alert has been sent now, and if it still needs
2444 * to be written, s->s3->alert_dispatch will be true
2445 */
2446 if (s->s3->alert_dispatch)
2447 return(-1); /* return WANT_WRITE */
2448 } else if (s->s3->alert_dispatch) {
2449 /* resend it if not sent */
2450 ret = s->method->ssl_dispatch_alert(s);
2451 if (ret == -1) {
2452 /*
2453 * We only get to return -1 here the 2nd/Nth
2454 * invocation, we must have already signalled
2455 * return 0 upon a previous invoation,
2456 * return WANT_WRITE
2457 */
2458 return (ret);
2459 }
2460 } else if (!(s->internal->shutdown & SSL_RECEIVED_SHUTDOWN)) {
2461 /* If we are waiting for a close from our peer, we are closed */
2462 s->method->internal->ssl_read_bytes(s, 0, NULL, 0, 0);
2463 if (!(s->internal->shutdown & SSL_RECEIVED_SHUTDOWN)) {
2464 return(-1); /* return WANT_READ */
2465 }
2466 }
2467
2468 if ((s->internal->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
2469 !s->s3->alert_dispatch)
2470 return (1);
2471 else
2472 return (0);
2473 }
2474
2475 int
2476 ssl3_write(SSL *s, const void *buf, int len)
2477 {
2478 int ret, n;
2479
2480 #if 0
2481 if (s->internal->shutdown & SSL_SEND_SHUTDOWN) {
2482 s->internal->rwstate = SSL_NOTHING;
2483 return (0);
2484 }
2485 #endif
2486 errno = 0;
2487 if (S3I(s)->renegotiate)
2488 ssl3_renegotiate_check(s);
2489
2490 /*
2491 * This is an experimental flag that sends the
2492 * last handshake message in the same packet as the first
2493 * use data - used to see if it helps the TCP protocol during
2494 * session-id reuse
2495 */
2496 /* The second test is because the buffer may have been removed */
2497 if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) {
2498 /* First time through, we write into the buffer */
2499 if (S3I(s)->delay_buf_pop_ret == 0) {
2500 ret = ssl3_write_bytes(s, SSL3_RT_APPLICATION_DATA,
2501 buf, len);
2502 if (ret <= 0)
2503 return (ret);
2504
2505 S3I(s)->delay_buf_pop_ret = ret;
2506 }
2507
2508 s->internal->rwstate = SSL_WRITING;
2509 n = BIO_flush(s->wbio);
2510 if (n <= 0)
2511 return (n);
2512 s->internal->rwstate = SSL_NOTHING;
2513
2514 /* We have flushed the buffer, so remove it */
2515 ssl_free_wbio_buffer(s);
2516 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
2517
2518 ret = S3I(s)->delay_buf_pop_ret;
2519 S3I(s)->delay_buf_pop_ret = 0;
2520 } else {
2521 ret = s->method->internal->ssl_write_bytes(s,
2522 SSL3_RT_APPLICATION_DATA, buf, len);
2523 if (ret <= 0)
2524 return (ret);
2525 }
2526
2527 return (ret);
2528 }
2529
2530 static int
2531 ssl3_read_internal(SSL *s, void *buf, int len, int peek)
2532 {
2533 int ret;
2534
2535 errno = 0;
2536 if (S3I(s)->renegotiate)
2537 ssl3_renegotiate_check(s);
2538 S3I(s)->in_read_app_data = 1;
2539 ret = s->method->internal->ssl_read_bytes(s,
2540 SSL3_RT_APPLICATION_DATA, buf, len, peek);
2541 if ((ret == -1) && (S3I(s)->in_read_app_data == 2)) {
2542 /*
2543 * ssl3_read_bytes decided to call s->internal->handshake_func, which
2544 * called ssl3_read_bytes to read handshake data.
2545 * However, ssl3_read_bytes actually found application data
2546 * and thinks that application data makes sense here; so disable
2547 * handshake processing and try to read application data again.
2548 */
2549 s->internal->in_handshake++;
2550 ret = s->method->internal->ssl_read_bytes(s,
2551 SSL3_RT_APPLICATION_DATA, buf, len, peek);
2552 s->internal->in_handshake--;
2553 } else
2554 S3I(s)->in_read_app_data = 0;
2555
2556 return (ret);
2557 }
2558
2559 int
2560 ssl3_read(SSL *s, void *buf, int len)
2561 {
2562 return ssl3_read_internal(s, buf, len, 0);
2563 }
2564
2565 int
2566 ssl3_peek(SSL *s, void *buf, int len)
2567 {
2568 return ssl3_read_internal(s, buf, len, 1);
2569 }
2570
2571 int
2572 ssl3_renegotiate(SSL *s)
2573 {
2574 if (s->internal->handshake_func == NULL)
2575 return (1);
2576
2577 if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
2578 return (0);
2579
2580 S3I(s)->renegotiate = 1;
2581 return (1);
2582 }
2583
2584 int
2585 ssl3_renegotiate_check(SSL *s)
2586 {
2587 int ret = 0;
2588
2589 if (S3I(s)->renegotiate) {
2590 if ((s->s3->rbuf.left == 0) && (s->s3->wbuf.left == 0) &&
2591 !SSL_in_init(s)) {
2592 /*
2593 * If we are the server, and we have sent
2594 * a 'RENEGOTIATE' message, we need to go
2595 * to SSL_ST_ACCEPT.
2596 */
2597 /* SSL_ST_ACCEPT */
2598 S3I(s)->hs.state = SSL_ST_RENEGOTIATE;
2599 S3I(s)->renegotiate = 0;
2600 S3I(s)->num_renegotiations++;
2601 S3I(s)->total_renegotiations++;
2602 ret = 1;
2603 }
2604 }
2605 return (ret);
2606 }
2607 /*
2608 * If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF
2609 * and handshake macs if required.
2610 */
2611 long
2612 ssl_get_algorithm2(SSL *s)
2613 {
2614 long alg2 = S3I(s)->hs.new_cipher->algorithm2;
2615
2616 if (s->method->internal->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF &&
2617 alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
2618 return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
2619 return alg2;
2620 }
unleashed repo fork