generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

If cipher list contains a match for an explicit ciphersuite only match that

Browse Source 
one suite.
This commit is contained in:
Dr. Stephen Henson 2006-04-15 00:22:34 +00:00
parent f4bcd70f27
commit cbb0b734c7
3 changed files with 55 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@ -4,6 +4,10 @@
Changes between 0.9.8a and 0.9.8b [XX xxx XXXX] Changes between 0.9.8a and 0.9.8b [XX xxx XXXX]
*) When applying a cipher rule check to see if string match is an explicit
cipher suite and only match that one cipher suite if it is.
[Steve Henson]
*) Link in manifests for VC++ if needed. *) Link in manifests for VC++ if needed.
[Austin Ziegler <halostatue@gmail.com>] [Austin Ziegler <halostatue@gmail.com>]

60
crypto/asn1/t_pkey.c
View File

@ -158,21 +158,21 @@ int RSA_print(BIO *bp, const RSA *x, int off)
BIO_snprintf(str,sizeof str,"Modulus (%d bit):", mod_len); BIO_snprintf(str,sizeof str,"Modulus (%d bit):", mod_len);
else else
BUF_strlcpy(str,"modulus:",sizeof str); BUF_strlcpy(str,"modulus:",sizeof str);
if (!print(bp,str,x->n,m,off)) goto err; if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err;
s=(x->d == NULL)?"Exponent:":"publicExponent:"; s=(x->d == NULL)?"Exponent:":"publicExponent:";
if ((x->e != NULL) && !print(bp,s,x->e,m,off)) if ((x->e != NULL) && !ASN1_bn_print(bp,s,x->e,m,off))
goto err; goto err;
if ((x->d != NULL) && !print(bp,"privateExponent:",x->d,m,off)) if ((x->d != NULL) && !ASN1_bn_print(bp,"privateExponent:",x->d,m,off))
goto err; goto err;
if ((x->p != NULL) && !print(bp,"prime1:",x->p,m,off)) if ((x->p != NULL) && !ASN1_bn_print(bp,"prime1:",x->p,m,off))
goto err; goto err;
if ((x->q != NULL) && !print(bp,"prime2:",x->q,m,off)) if ((x->q != NULL) && !ASN1_bn_print(bp,"prime2:",x->q,m,off))
goto err; goto err;
if ((x->dmp1 != NULL) && !print(bp,"exponent1:",x->dmp1,m,off)) if ((x->dmp1 != NULL) && !ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off))
goto err; goto err;
if ((x->dmq1 != NULL) && !print(bp,"exponent2:",x->dmq1,m,off)) if ((x->dmq1 != NULL) && !ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off))
goto err; goto err;
if ((x->iqmp != NULL) && !print(bp,"coefficient:",x->iqmp,m,off)) if ((x->iqmp != NULL) && !ASN1_bn_print(bp,"coefficient:",x->iqmp,m,off))
goto err; goto err;
ret=1; ret=1;
err: err:
@ -241,13 +241,13 @@ int DSA_print(BIO *bp, const DSA *x, int off)
<= 0) goto err; <= 0) goto err;
} }
if ((x->priv_key != NULL) && !print(bp,"priv:",x->priv_key,m,off)) if ((x->priv_key != NULL) && !ASN1_bn_print(bp,"priv:",x->priv_key,m,off))
goto err; goto err;
if ((x->pub_key != NULL) && !print(bp,"pub: ",x->pub_key,m,off)) if ((x->pub_key != NULL) && !ASN1_bn_print(bp,"pub: ",x->pub_key,m,off))
goto err; goto err;
if ((x->p != NULL) && !print(bp,"P: ",x->p,m,off)) goto err; if ((x->p != NULL) && !ASN1_bn_print(bp,"P: ",x->p,m,off)) goto err;
if ((x->q != NULL) && !print(bp,"Q: ",x->q,m,off)) goto err; if ((x->q != NULL) && !ASN1_bn_print(bp,"Q: ",x->q,m,off)) goto err;
if ((x->g != NULL) && !print(bp,"G: ",x->g,m,off)) goto err; if ((x->g != NULL) && !ASN1_bn_print(bp,"G: ",x->g,m,off)) goto err;
ret=1; ret=1;
err: err:
if (m != NULL) OPENSSL_free(m); if (m != NULL) OPENSSL_free(m);
@ -430,40 +430,40 @@ int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off)
goto err; goto err;
/* print the polynomial */ /* print the polynomial */
if ((p != NULL) && !print(bp, "Polynomial:", p, buffer, if ((p != NULL) && !ASN1_bn_print(bp, "Polynomial:", p, buffer,
off)) off))
goto err; goto err;
} }
else else
{ {
if ((p != NULL) && !print(bp, "Prime:", p, buffer,off)) if ((p != NULL) && !ASN1_bn_print(bp, "Prime:", p, buffer,off))
goto err; goto err;
} }
if ((a != NULL) && !print(bp, "A: ", a, buffer, off)) if ((a != NULL) && !ASN1_bn_print(bp, "A: ", a, buffer, off))
goto err; goto err;
if ((b != NULL) && !print(bp, "B: ", b, buffer, off)) if ((b != NULL) && !ASN1_bn_print(bp, "B: ", b, buffer, off))
goto err; goto err;
if (form == POINT_CONVERSION_COMPRESSED) if (form == POINT_CONVERSION_COMPRESSED)
{ {
if ((gen != NULL) && !print(bp, gen_compressed, gen, if ((gen != NULL) && !ASN1_bn_print(bp, gen_compressed, gen,
buffer, off)) buffer, off))
goto err; goto err;
} }
else if (form == POINT_CONVERSION_UNCOMPRESSED) else if (form == POINT_CONVERSION_UNCOMPRESSED)
{ {
if ((gen != NULL) && !print(bp, gen_uncompressed, gen, if ((gen != NULL) && !ASN1_bn_print(bp, gen_uncompressed, gen,
buffer, off)) buffer, off))
goto err; goto err;
} }
else /* form == POINT_CONVERSION_HYBRID */ else /* form == POINT_CONVERSION_HYBRID */
{ {
if ((gen != NULL) && !print(bp, gen_hybrid, gen, if ((gen != NULL) && !ASN1_bn_print(bp, gen_hybrid, gen,
buffer, off)) buffer, off))
goto err; goto err;
} }
if ((order != NULL) && !print(bp, "Order: ", order, if ((order != NULL) && !ASN1_bn_print(bp, "Order: ", order,
buffer, off)) goto err; buffer, off)) goto err;
if ((cofactor != NULL) && !print(bp, "Cofactor: ", cofactor, if ((cofactor != NULL) && !ASN1_bn_print(bp, "Cofactor: ", cofactor,
buffer, off)) goto err; buffer, off)) goto err;
if (seed && !print_bin(bp, "Seed:", seed, seed_len, off)) if (seed && !print_bin(bp, "Seed:", seed, seed_len, off))
goto err; goto err;
@ -543,10 +543,10 @@ int EC_KEY_print(BIO *bp, const EC_KEY *x, int off)
BN_num_bits(order)) <= 0) goto err; BN_num_bits(order)) <= 0) goto err;
} }
if ((priv_key != NULL) && !print(bp, "priv:", priv_key, if ((priv_key != NULL) && !ASN1_bn_print(bp, "priv:", priv_key,
buffer, off)) buffer, off))
goto err; goto err;
if ((pub_key != NULL) && !print(bp, "pub: ", pub_key, if ((pub_key != NULL) && !ASN1_bn_print(bp, "pub: ", pub_key,
buffer, off)) buffer, off))
goto err; goto err;
if (!ECPKParameters_print(bp, group, off)) if (!ECPKParameters_print(bp, group, off))
@ -567,7 +567,7 @@ err:
} }
#endif /* OPENSSL_NO_EC */ #endif /* OPENSSL_NO_EC */
static int print(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf, static int BN_print_pkey(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf,
int off) int off)
{ {
int n,i; int n,i;
@ -703,8 +703,8 @@ int DHparams_print(BIO *bp, const DH *x)
if (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d bit)\n", if (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d bit)\n",
BN_num_bits(x->p)) <= 0) BN_num_bits(x->p)) <= 0)
goto err; goto err;
if (!print(bp,"prime:",x->p,m,4)) goto err; if (!ASN1_bn_print(bp,"prime:",x->p,m,4)) goto err;
if (!print(bp,"generator:",x->g,m,4)) goto err; if (!ASN1_bn_print(bp,"generator:",x->g,m,4)) goto err;
if (x->length != 0) if (x->length != 0)
{ {
if (BIO_printf(bp," recommended-private-length: %d bits\n", if (BIO_printf(bp," recommended-private-length: %d bits\n",
@ -769,9 +769,9 @@ int DSAparams_print(BIO *bp, const DSA *x)
if (BIO_printf(bp,"DSA-Parameters: (%d bit)\n", if (BIO_printf(bp,"DSA-Parameters: (%d bit)\n",
BN_num_bits(x->p)) <= 0) BN_num_bits(x->p)) <= 0)
goto err; goto err;
if (!print(bp,"p:",x->p,m,4)) goto err; if (!ASN1_bn_print(bp,"p:",x->p,m,4)) goto err;
if ((x->q != NULL) && !print(bp,"q:",x->q,m,4)) goto err; if ((x->q != NULL) && !ASN1_bn_print(bp,"q:",x->q,m,4)) goto err;
if ((x->g != NULL) && !print(bp,"g:",x->g,m,4)) goto err; if ((x->g != NULL) && !ASN1_bn_print(bp,"g:",x->g,m,4)) goto err;
ret=1; ret=1;
err: err:
if (m != NULL) OPENSSL_free(m); if (m != NULL) OPENSSL_free(m);

25
ssl/ssl_ciph.c
View File

@ -482,7 +482,8 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
*ca_curr = NULL; /* end of list */ *ca_curr = NULL; /* end of list */
} }
static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, static void ssl_cipher_apply_rule(unsigned long cipher_id,
unsigned long algorithms, unsigned long mask,
unsigned long algo_strength, unsigned long mask_strength, unsigned long algo_strength, unsigned long mask_strength,
int rule, int strength_bits, CIPHER_ORDER *co_list, int rule, int strength_bits, CIPHER_ORDER *co_list,
CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
@ -508,11 +509,19 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
cp = curr->cipher; cp = curr->cipher;
/* If explicit cipher suite match that one only */
if (cipher_id)
{
if (cp->id != cipher_id)
continue;
}
/* /*
* Selection criteria is either the number of strength_bits * Selection criteria is either the number of strength_bits
* or the algorithm used. * or the algorithm used.
*/ */
if (strength_bits == -1) else if (strength_bits == -1)
{ {
ma = mask & cp->algorithms; ma = mask & cp->algorithms;
ma_s = mask_strength & cp->algo_strength; ma_s = mask_strength & cp->algo_strength;
@ -625,7 +634,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list,
*/ */
for (i = max_strength_bits; i >= 0; i--) for (i = max_strength_bits; i >= 0; i--)
if (number_uses[i] > 0) if (number_uses[i] > 0)
ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i, ssl_cipher_apply_rule(0, 0, 0, 0, 0, CIPHER_ORD, i,
co_list, head_p, tail_p); co_list, head_p, tail_p);
OPENSSL_free(number_uses); OPENSSL_free(number_uses);
@ -639,6 +648,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
unsigned long algorithms, mask, algo_strength, mask_strength; unsigned long algorithms, mask, algo_strength, mask_strength;
const char *l, *start, *buf; const char *l, *start, *buf;
int j, multi, found, rule, retval, ok, buflen; int j, multi, found, rule, retval, ok, buflen;
unsigned long cipher_id;
char ch; char ch;
retval = 1; retval = 1;
@ -728,6 +738,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
* use strcmp(), because buf is not '\0' terminated.) * use strcmp(), because buf is not '\0' terminated.)
*/ */
j = found = 0; j = found = 0;
cipher_id = 0;
while (ca_list[j]) while (ca_list[j])
{ {
if (!strncmp(buf, ca_list[j]->name, buflen) && if (!strncmp(buf, ca_list[j]->name, buflen) &&
@ -742,6 +753,12 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
if (!found) if (!found)
break; /* ignore this entry */ break; /* ignore this entry */
if (ca_list[j]->valid)
{
cipher_id = ca_list[j]->id;
break;
}
/* New algorithms: /* New algorithms:
* 1 - any old restrictions apply outside new mask * 1 - any old restrictions apply outside new mask
* 2 - any new restrictions apply outside old mask * 2 - any new restrictions apply outside old mask
@ -785,7 +802,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
} }
else if (found) else if (found)
{ {
ssl_cipher_apply_rule(algorithms, mask, ssl_cipher_apply_rule(cipher_id, algorithms, mask,
algo_strength, mask_strength, rule, -1, algo_strength, mask_strength, rule, -1,
co_list, head_p, tail_p); co_list, head_p, tail_p);
} }