generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Put ECCdraft ciphersuites back into default build (but disabled

Browse Source 
unless specifically requested)
This commit is contained in:
Bodo Möller
2006-06-22 12:35:54 +00:00
parent 35908bd040
commit aa17ab7e57
3 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
CHANGES
View File

@@ -4,9 +4,13 @@
Changes between 0.9.8b and 0.9.8c [xx XXX xxxx] Changes between 0.9.8b and 0.9.8c [xx XXX xxxx]
*) Disable "ECCdraft" ciphersuites (which were not part of the "ALL" *) Disable "ECCdraft" ciphersuites more thoroughly. Now special
alias). These are now excluded from compilation by default, since treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
OpenSSL 0.9.9[-dev] should be used for TLS with elliptic curves. cannot be implicitly activated as part of, e.g., the "AES" alias.
However, please upgrade to OpenSSL 0.9.9[-dev] for
non-experimental use of the ECC ciphersuites to get TLS extension
support, which is required for curve and point format negotiation
to avoid potential handshake problems.
[Bodo Moeller] [Bodo Moeller]
*) Disable rogue ciphersuites: *) Disable rogue ciphersuites:

2
ssl/s3_lib.c
View File

@@ -1165,7 +1165,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
}, },
#endif /* OPENSSL_NO_CAMELLIA */ #endif /* OPENSSL_NO_CAMELLIA */
#if 0 /* please use OpenSSL 0.9.9 branch for ECC ciphersuites */
#ifndef OPENSSL_NO_ECDH #ifndef OPENSSL_NO_ECDH
/* Cipher C001 */ /* Cipher C001 */
{ {
@@ -1517,7 +1516,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
SSL_ALL_STRENGTHS, SSL_ALL_STRENGTHS,
}, },
#endif /* OPENSSL_NO_ECDH */ #endif /* OPENSSL_NO_ECDH */
#endif
/* end of list */ /* end of list */

18
ssl/ssl_ciph.c
View File

@@ -635,8 +635,22 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
{ {
if (!curr->active) if (!curr->active)
{ {
ll_append_tail(&head, curr, &tail); int add_this_cipher = 1;
curr->active = 1;
if (((cp->algorithms & (SSL_kECDHE|SSL_kECDH|SSL_aECDSA)) != 0))
{
/* Make sure "ECCdraft" ciphersuites are activated only if
* *explicitly* requested, but not implicitly (such as
* as part of the "AES" alias). */
add_this_cipher = (mask & (SSL_kECDHE|SSL_kECDH|SSL_aECDSA)) != 0;
}
if (add_this_cipher)
{
ll_append_tail(&head, curr, &tail);
curr->active = 1;
}
} }
} }
/* Move the added cipher to this location */ /* Move the added cipher to this location */