Compare commits
No commits in common. "main" and "OpenSSL_1_0_1s" have entirely different histories.
main
...
OpenSSL_1_
10
CHANGES
10
CHANGES
@ -2,16 +2,6 @@
|
||||
OpenSSL CHANGES
|
||||
_______________
|
||||
|
||||
Changes between 1.0.1s and 1.0.1t [xx XXX xxxx]
|
||||
|
||||
*) Remove LOW from the DEFAULT cipher list. This removes singles DES from the
|
||||
default.
|
||||
[Kurt Roeckx]
|
||||
|
||||
*) Only remove the SSLv2 methods with the no-ssl2-method option. When the
|
||||
methods are enabled and ssl2 is disabled the methods return NULL.
|
||||
[Kurt Roeckx]
|
||||
|
||||
Changes between 1.0.1r and 1.0.1s [1 Mar 2016]
|
||||
|
||||
* Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
|
||||
|
||||
4
NEWS
4
NEWS
@ -5,10 +5,6 @@
|
||||
This file gives a brief overview of the major changes between each OpenSSL
|
||||
release. For more details please read the CHANGES file.
|
||||
|
||||
Major changes between OpenSSL 1.0.1s and OpenSSL 1.0.1t [under development]
|
||||
|
||||
o
|
||||
|
||||
Major changes between OpenSSL 1.0.1r and OpenSSL 1.0.1s [1 Mar 2016]
|
||||
|
||||
o Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
|
||||
|
||||
2
README
2
README
@ -1,5 +1,5 @@
|
||||
|
||||
OpenSSL 1.0.1t-dev
|
||||
OpenSSL 1.0.1s 1 Mar 2016
|
||||
|
||||
Copyright (c) 1998-2015 The OpenSSL Project
|
||||
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
|
||||
|
||||
12
apps/pkcs7.c
12
apps/pkcs7.c
@ -235,16 +235,12 @@ int MAIN(int argc, char **argv)
|
||||
i = OBJ_obj2nid(p7->type);
|
||||
switch (i) {
|
||||
case NID_pkcs7_signed:
|
||||
if (p7->d.sign != NULL) {
|
||||
certs = p7->d.sign->cert;
|
||||
crls = p7->d.sign->crl;
|
||||
}
|
||||
certs = p7->d.sign->cert;
|
||||
crls = p7->d.sign->crl;
|
||||
break;
|
||||
case NID_pkcs7_signedAndEnveloped:
|
||||
if (p7->d.signed_and_enveloped != NULL) {
|
||||
certs = p7->d.signed_and_enveloped->cert;
|
||||
crls = p7->d.signed_and_enveloped->crl;
|
||||
}
|
||||
certs = p7->d.signed_and_enveloped->cert;
|
||||
crls = p7->d.signed_and_enveloped->crl;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
|
||||
@ -200,13 +200,13 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, const unsigned char **pp,
|
||||
} else {
|
||||
if (len != 0) {
|
||||
if ((ret->length < len) || (ret->data == NULL)) {
|
||||
if (ret->data != NULL)
|
||||
OPENSSL_free(ret->data);
|
||||
s = (unsigned char *)OPENSSL_malloc((int)len + 1);
|
||||
if (s == NULL) {
|
||||
i = ERR_R_MALLOC_FAILURE;
|
||||
goto err;
|
||||
}
|
||||
if (ret->data != NULL)
|
||||
OPENSSL_free(ret->data);
|
||||
} else
|
||||
s = ret->data;
|
||||
memcpy(s, p, (int)len);
|
||||
|
||||
@ -141,7 +141,6 @@ void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
|
||||
#endif
|
||||
|
||||
#define HEADER_SIZE 8
|
||||
#define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
|
||||
static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
|
||||
{
|
||||
BUF_MEM *b;
|
||||
@ -218,44 +217,29 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
|
||||
/* suck in c.slen bytes of data */
|
||||
want = c.slen;
|
||||
if (want > (len - off)) {
|
||||
size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
|
||||
|
||||
want -= (len - off);
|
||||
if (want > INT_MAX /* BIO_read takes an int length */ ||
|
||||
len + want < len) {
|
||||
ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
|
||||
goto err;
|
||||
}
|
||||
if (!BUF_MEM_grow_clean(b, len + want)) {
|
||||
ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
while (want > 0) {
|
||||
/*
|
||||
* Read content in chunks of increasing size
|
||||
* so we can return an error for EOF without
|
||||
* having to allocate the entire content length
|
||||
* in one go.
|
||||
*/
|
||||
size_t chunk = want > chunk_max ? chunk_max : want;
|
||||
|
||||
if (!BUF_MEM_grow_clean(b, len + chunk)) {
|
||||
ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
|
||||
i = BIO_read(in, &(b->data[len]), want);
|
||||
if (i <= 0) {
|
||||
ASN1err(ASN1_F_ASN1_D2I_READ_BIO,
|
||||
ASN1_R_NOT_ENOUGH_DATA);
|
||||
goto err;
|
||||
}
|
||||
want -= chunk;
|
||||
while (chunk > 0) {
|
||||
i = BIO_read(in, &(b->data[len]), chunk);
|
||||
if (i <= 0) {
|
||||
ASN1err(ASN1_F_ASN1_D2I_READ_BIO,
|
||||
ASN1_R_NOT_ENOUGH_DATA);
|
||||
goto err;
|
||||
}
|
||||
/*
|
||||
* This can't overflow because |len+want| didn't
|
||||
* overflow.
|
||||
*/
|
||||
len += i;
|
||||
chunk -= i;
|
||||
}
|
||||
if (chunk_max < INT_MAX/2)
|
||||
chunk_max *= 2;
|
||||
len += i;
|
||||
want -= i;
|
||||
}
|
||||
}
|
||||
if (off + c.slen < off) {
|
||||
|
||||
@ -63,7 +63,7 @@
|
||||
#include <openssl/asn1_mac.h>
|
||||
|
||||
static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
|
||||
long max);
|
||||
int max);
|
||||
static void asn1_put_length(unsigned char **pp, int length);
|
||||
const char ASN1_version[] = "ASN.1" OPENSSL_VERSION_PTEXT;
|
||||
|
||||
@ -131,7 +131,7 @@ int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
|
||||
}
|
||||
*ptag = tag;
|
||||
*pclass = xclass;
|
||||
if (!asn1_get_length(&p, &inf, plength, max))
|
||||
if (!asn1_get_length(&p, &inf, plength, (int)max))
|
||||
goto err;
|
||||
|
||||
if (inf && !(ret & V_ASN1_CONSTRUCTED))
|
||||
@ -159,14 +159,14 @@ int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
|
||||
}
|
||||
|
||||
static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
|
||||
long max)
|
||||
int max)
|
||||
{
|
||||
const unsigned char *p = *pp;
|
||||
unsigned long ret = 0;
|
||||
unsigned long i;
|
||||
unsigned int i;
|
||||
|
||||
if (max-- < 1)
|
||||
return 0;
|
||||
return (0);
|
||||
if (*p == 0x80) {
|
||||
*inf = 1;
|
||||
ret = 0;
|
||||
@ -175,11 +175,15 @@ static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
|
||||
*inf = 0;
|
||||
i = *p & 0x7f;
|
||||
if (*(p++) & 0x80) {
|
||||
if (i > sizeof(ret) || max < (long)i)
|
||||
if (i > sizeof(long))
|
||||
return 0;
|
||||
if (max-- == 0)
|
||||
return (0);
|
||||
while (i-- > 0) {
|
||||
ret <<= 8L;
|
||||
ret |= *(p++);
|
||||
if (max-- == 0)
|
||||
return (0);
|
||||
}
|
||||
} else
|
||||
ret = i;
|
||||
@ -188,7 +192,7 @@ static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
|
||||
return 0;
|
||||
*pp = p;
|
||||
*rl = (long)ret;
|
||||
return 1;
|
||||
return (1);
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
@ -173,8 +173,6 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
|
||||
if (!asn1_print_info(bp, tag, xclass, j, (indent) ? depth : 0))
|
||||
goto end;
|
||||
if (j & V_ASN1_CONSTRUCTED) {
|
||||
const unsigned char *sp;
|
||||
|
||||
ep = p + len;
|
||||
if (BIO_write(bp, "\n", 1) <= 0)
|
||||
goto end;
|
||||
@ -184,7 +182,6 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
|
||||
goto end;
|
||||
}
|
||||
if ((j == 0x21) && (len == 0)) {
|
||||
sp = p;
|
||||
for (;;) {
|
||||
r = asn1_parse2(bp, &p, (long)(tot - p),
|
||||
offset + (p - *pp), depth + 1,
|
||||
@ -193,25 +190,19 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
if ((r == 2) || (p >= tot)) {
|
||||
len = p - sp;
|
||||
if ((r == 2) || (p >= tot))
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
long tmp = len;
|
||||
|
||||
} else
|
||||
while (p < ep) {
|
||||
sp = p;
|
||||
r = asn1_parse2(bp, &p, tmp, offset + (p - *pp), depth + 1,
|
||||
r = asn1_parse2(bp, &p, (long)len,
|
||||
offset + (p - *pp), depth + 1,
|
||||
indent, dump);
|
||||
if (r == 0) {
|
||||
ret = 0;
|
||||
goto end;
|
||||
}
|
||||
tmp -= p - sp;
|
||||
}
|
||||
}
|
||||
} else if (xclass != 0) {
|
||||
p += len;
|
||||
if (BIO_write(bp, "\n", 1) <= 0)
|
||||
|
||||
@ -140,8 +140,7 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
|
||||
goto err;
|
||||
|
||||
bs = X509_get_serialNumber(x);
|
||||
if (bs->length < (int)sizeof(long)
|
||||
|| (bs->length == sizeof(long) && (bs->data[0] & 0x80) == 0)) {
|
||||
if (bs->length <= (int)sizeof(long)) {
|
||||
l = ASN1_INTEGER_get(bs);
|
||||
if (bs->type == V_ASN1_NEG_INTEGER) {
|
||||
l = -l;
|
||||
|
||||
@ -66,13 +66,6 @@
|
||||
typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY;
|
||||
DECLARE_STACK_OF(STACK_OF_X509_NAME_ENTRY)
|
||||
|
||||
/*
|
||||
* Maximum length of X509_NAME: much larger than anything we should
|
||||
* ever see in practice.
|
||||
*/
|
||||
|
||||
#define X509_NAME_MAX (1024 * 1024)
|
||||
|
||||
static int x509_name_ex_d2i(ASN1_VALUE **val,
|
||||
const unsigned char **in, long len,
|
||||
const ASN1_ITEM *it,
|
||||
@ -199,10 +192,6 @@ static int x509_name_ex_d2i(ASN1_VALUE **val,
|
||||
int i, j, ret;
|
||||
STACK_OF(X509_NAME_ENTRY) *entries;
|
||||
X509_NAME_ENTRY *entry;
|
||||
if (len > X509_NAME_MAX) {
|
||||
ASN1err(ASN1_F_X509_NAME_EX_D2I, ASN1_R_TOO_LONG);
|
||||
return 0;
|
||||
}
|
||||
q = p;
|
||||
|
||||
/* Get internal representation of Name */
|
||||
|
||||
@ -201,19 +201,9 @@ X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, long length)
|
||||
|
||||
int i2d_X509_AUX(X509 *a, unsigned char **pp)
|
||||
{
|
||||
int length, tmplen;
|
||||
unsigned char *start = pp != NULL ? *pp : NULL;
|
||||
int length;
|
||||
length = i2d_X509(a, pp);
|
||||
if (length < 0 || a == NULL)
|
||||
return length;
|
||||
|
||||
tmplen = i2d_X509_CERT_AUX(a->aux, pp);
|
||||
if (tmplen < 0) {
|
||||
if (start != NULL)
|
||||
*pp = start;
|
||||
return tmplen;
|
||||
}
|
||||
length += tmplen;
|
||||
|
||||
if (a)
|
||||
length += i2d_X509_CERT_AUX(a->aux, pp);
|
||||
return length;
|
||||
}
|
||||
|
||||
@ -85,21 +85,6 @@ $frame=32; # size of above frame rounded up to 16n
|
||||
|
||||
&and ("esp",-64); # align to cache line
|
||||
|
||||
# Some OSes, *cough*-dows, insist on stack being "wired" to
|
||||
# physical memory in strictly sequential manner, i.e. if stack
|
||||
# allocation spans two pages, then reference to farmost one can
|
||||
# be punishable by SEGV. But page walking can do good even on
|
||||
# other OSes, because it guarantees that villain thread hits
|
||||
# the guard page before it can make damage to innocent one...
|
||||
&mov ("eax","ebp");
|
||||
&sub ("eax","esp");
|
||||
&and ("eax",-4096);
|
||||
&set_label("page_walk");
|
||||
&mov ("edx",&DWP(0,"esp","eax"));
|
||||
&sub ("eax",4096);
|
||||
&data_byte(0x2e);
|
||||
&jnc (&label("page_walk"));
|
||||
|
||||
################################# load argument block...
|
||||
&mov ("eax",&DWP(0*4,"esi"));# BN_ULONG *rp
|
||||
&mov ("ebx",&DWP(1*4,"esi"));# const BN_ULONG *ap
|
||||
|
||||
@ -91,20 +91,6 @@ bn_mul_mont:
|
||||
|
||||
mov %r11,8(%rsp,$num,8) # tp[num+1]=%rsp
|
||||
.Lmul_body:
|
||||
# Some OSes, *cough*-dows, insist on stack being "wired" to
|
||||
# physical memory in strictly sequential manner, i.e. if stack
|
||||
# allocation spans two pages, then reference to farmost one can
|
||||
# be punishable by SEGV. But page walking can do good even on
|
||||
# other OSes, because it guarantees that villain thread hits
|
||||
# the guard page before it can make damage to innocent one...
|
||||
sub %rsp,%r11
|
||||
and \$-4096,%r11
|
||||
.Lmul_page_walk:
|
||||
mov (%rsp,%r11),%r10
|
||||
sub \$4096,%r11
|
||||
.byte 0x66,0x2e # predict non-taken
|
||||
jnc .Lmul_page_walk
|
||||
|
||||
mov $bp,%r12 # reassign $bp
|
||||
___
|
||||
$bp="%r12";
|
||||
@ -310,14 +296,6 @@ bn_mul4x_mont:
|
||||
|
||||
mov %r11,8(%rsp,$num,8) # tp[num+1]=%rsp
|
||||
.Lmul4x_body:
|
||||
sub %rsp,%r11
|
||||
and \$-4096,%r11
|
||||
.Lmul4x_page_walk:
|
||||
mov (%rsp,%r11),%r10
|
||||
sub \$4096,%r11
|
||||
.byte 0x2e # predict non-taken
|
||||
jnc .Lmul4x_page_walk
|
||||
|
||||
mov $rp,16(%rsp,$num,8) # tp[num+2]=$rp
|
||||
mov %rdx,%r12 # reassign $bp
|
||||
___
|
||||
@ -729,7 +707,6 @@ $code.=<<___;
|
||||
.align 16
|
||||
bn_sqr4x_mont:
|
||||
.Lsqr4x_enter:
|
||||
mov %rsp,%rax
|
||||
push %rbx
|
||||
push %rbp
|
||||
push %r12
|
||||
@ -738,23 +715,12 @@ bn_sqr4x_mont:
|
||||
push %r15
|
||||
|
||||
shl \$3,${num}d # convert $num to bytes
|
||||
xor %r10,%r10
|
||||
mov %rsp,%r11 # put aside %rsp
|
||||
neg $num # -$num
|
||||
sub $num,%r10 # -$num
|
||||
mov ($n0),$n0 # *n0
|
||||
lea -72(%rsp,$num,2),%rsp # alloca(frame+2*$num)
|
||||
lea -72(%rsp,%r10,2),%rsp # alloca(frame+2*$num)
|
||||
and \$-1024,%rsp # minimize TLB usage
|
||||
|
||||
sub %rsp,%r11
|
||||
and \$-4096,%r11
|
||||
.Lsqr4x_page_walk:
|
||||
mov (%rsp,%r11),%r10
|
||||
sub \$4096,%r11
|
||||
.byte 0x2e # predict non-taken
|
||||
jnc .Lsqr4x_page_walk
|
||||
|
||||
mov $num,%r10
|
||||
neg $num # restore $num
|
||||
lea -48(%rax),%r11 # restore saved %rsp
|
||||
##############################################################
|
||||
# Stack layout
|
||||
#
|
||||
|
||||
@ -84,20 +84,6 @@ bn_mul_mont_gather5:
|
||||
|
||||
mov %rax,8(%rsp,$num,8) # tp[num+1]=%rsp
|
||||
.Lmul_body:
|
||||
# Some OSes, *cough*-dows, insist on stack being "wired" to
|
||||
# physical memory in strictly sequential manner, i.e. if stack
|
||||
# allocation spans two pages, then reference to farmost one can
|
||||
# be punishable by SEGV. But page walking can do good even on
|
||||
# other OSes, because it guarantees that villain thread hits
|
||||
# the guard page before it can make damage to innocent one...
|
||||
sub %rsp,%rax
|
||||
and \$-4096,%rax
|
||||
.Lmul_page_walk:
|
||||
mov (%rsp,%rax),%r11
|
||||
sub \$4096,%rax
|
||||
.byte 0x2e # predict non-taken
|
||||
jnc .Lmul_page_walk
|
||||
|
||||
lea 128($bp),%r12 # reassign $bp (+size optimization)
|
||||
___
|
||||
$bp="%r12";
|
||||
@ -421,14 +407,6 @@ bn_mul4x_mont_gather5:
|
||||
|
||||
mov %rax,8(%rsp,$num,8) # tp[num+1]=%rsp
|
||||
.Lmul4x_body:
|
||||
sub %rsp,%rax
|
||||
and \$-4096,%rax
|
||||
.Lmul4x_page_walk:
|
||||
mov (%rsp,%rax),%r11
|
||||
sub \$4096,%rax
|
||||
.byte 0x2e # predict non-taken
|
||||
jnc .Lmul4x_page_walk
|
||||
|
||||
mov $rp,16(%rsp,$num,8) # tp[num+2]=$rp
|
||||
lea 128(%rdx),%r12 # reassign $bp (+size optimization)
|
||||
___
|
||||
|
||||
@ -4,10 +4,6 @@
|
||||
|
||||
# include <openssl/crypto.h>
|
||||
|
||||
# ifdef OPENSSL_NO_COMP
|
||||
# error COMP is disabled.
|
||||
# endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
@ -200,10 +200,8 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
|
||||
}
|
||||
#endif
|
||||
if (ctx->digest != type) {
|
||||
if (ctx->digest && ctx->digest->ctx_size) {
|
||||
if (ctx->digest && ctx->digest->ctx_size)
|
||||
OPENSSL_free(ctx->md_data);
|
||||
ctx->md_data = NULL;
|
||||
}
|
||||
ctx->digest = type;
|
||||
if (!(ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) && type->ctx_size) {
|
||||
ctx->update = type->update;
|
||||
|
||||
@ -57,7 +57,6 @@
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <limits.h>
|
||||
#include "cryptlib.h"
|
||||
#include <openssl/evp.h>
|
||||
|
||||
@ -152,13 +151,13 @@ void EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
|
||||
const unsigned char *in, int inl)
|
||||
{
|
||||
int i, j;
|
||||
size_t total = 0;
|
||||
unsigned int total = 0;
|
||||
|
||||
*outl = 0;
|
||||
if (inl <= 0)
|
||||
return;
|
||||
OPENSSL_assert(ctx->length <= (int)sizeof(ctx->enc_data));
|
||||
if (ctx->length - ctx->num > inl) {
|
||||
if ((ctx->num + inl) < ctx->length) {
|
||||
memcpy(&(ctx->enc_data[ctx->num]), in, inl);
|
||||
ctx->num += inl;
|
||||
return;
|
||||
@ -175,7 +174,7 @@ void EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
|
||||
*out = '\0';
|
||||
total = j + 1;
|
||||
}
|
||||
while (inl >= ctx->length && total <= INT_MAX) {
|
||||
while (inl >= ctx->length) {
|
||||
j = EVP_EncodeBlock(out, in, ctx->length);
|
||||
in += ctx->length;
|
||||
inl -= ctx->length;
|
||||
@ -184,11 +183,6 @@ void EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
|
||||
*out = '\0';
|
||||
total += j + 1;
|
||||
}
|
||||
if (total > INT_MAX) {
|
||||
/* Too much output data! */
|
||||
*outl = 0;
|
||||
return;
|
||||
}
|
||||
if (inl != 0)
|
||||
memcpy(&(ctx->enc_data[0]), in, inl);
|
||||
ctx->num = inl;
|
||||
|
||||
@ -334,7 +334,7 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
|
||||
bl = ctx->cipher->block_size;
|
||||
OPENSSL_assert(bl <= (int)sizeof(ctx->buf));
|
||||
if (i != 0) {
|
||||
if (bl - i > inl) {
|
||||
if (i + inl < bl) {
|
||||
memcpy(&(ctx->buf[i]), in, inl);
|
||||
ctx->buf_len += inl;
|
||||
*outl = 0;
|
||||
|
||||
@ -30,11 +30,11 @@ extern "C" {
|
||||
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
|
||||
* major minor fix final patch/beta)
|
||||
*/
|
||||
# define OPENSSL_VERSION_NUMBER 0x10001140L
|
||||
# define OPENSSL_VERSION_NUMBER 0x1000113fL
|
||||
# ifdef OPENSSL_FIPS
|
||||
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1t-fips-dev xx XXX xxxx"
|
||||
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1s-fips 1 Mar 2016"
|
||||
# else
|
||||
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1t-dev xx XXX xxxx"
|
||||
# define OPENSSL_VERSION_TEXT "OpenSSL 1.0.1s 1 Mar 2016"
|
||||
# endif
|
||||
# define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT
|
||||
|
||||
|
||||
@ -344,7 +344,7 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp,
|
||||
|
||||
if (enc != NULL) {
|
||||
objstr = OBJ_nid2sn(EVP_CIPHER_nid(enc));
|
||||
if (objstr == NULL || EVP_CIPHER_iv_length(enc) == 0) {
|
||||
if (objstr == NULL) {
|
||||
PEMerr(PEM_F_PEM_ASN1_WRITE_BIO, PEM_R_UNSUPPORTED_CIPHER);
|
||||
goto err;
|
||||
}
|
||||
|
||||
@ -131,10 +131,6 @@ static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r)
|
||||
# define MS_PVKMAGIC 0xb0b5f11eL
|
||||
/* Salt length for PVK files */
|
||||
# define PVK_SALTLEN 0x10
|
||||
/* Maximum length in PVK header */
|
||||
# define PVK_MAX_KEYLEN 102400
|
||||
/* Maximum salt length */
|
||||
# define PVK_MAX_SALTLEN 10240
|
||||
|
||||
static EVP_PKEY *b2i_rsa(const unsigned char **in, unsigned int length,
|
||||
unsigned int bitlen, int ispub);
|
||||
@ -648,9 +644,6 @@ static int do_PVK_header(const unsigned char **in, unsigned int length,
|
||||
*psaltlen = read_ledword(&p);
|
||||
*pkeylen = read_ledword(&p);
|
||||
|
||||
if (*pkeylen > PVK_MAX_KEYLEN || *psaltlen > PVK_MAX_SALTLEN)
|
||||
return 0;
|
||||
|
||||
if (is_encrypted && !*psaltlen) {
|
||||
PEMerr(PEM_F_DO_PVK_HEADER, PEM_R_INCONSISTENT_HEADER);
|
||||
return 0;
|
||||
|
||||
@ -1281,7 +1281,6 @@ void ERR_load_X509_strings(void);
|
||||
# define X509_R_LOADING_CERT_DIR 103
|
||||
# define X509_R_LOADING_DEFAULTS 104
|
||||
# define X509_R_METHOD_NOT_SUPPORTED 124
|
||||
# define X509_R_NAME_TOO_LONG 134
|
||||
# define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 105
|
||||
# define X509_R_PUBLIC_KEY_DECODE_ERROR 125
|
||||
# define X509_R_PUBLIC_KEY_ENCODE_ERROR 126
|
||||
|
||||
@ -145,7 +145,6 @@ static ERR_STRING_DATA X509_str_reasons[] = {
|
||||
{ERR_REASON(X509_R_LOADING_CERT_DIR), "loading cert dir"},
|
||||
{ERR_REASON(X509_R_LOADING_DEFAULTS), "loading defaults"},
|
||||
{ERR_REASON(X509_R_METHOD_NOT_SUPPORTED), "method not supported"},
|
||||
{ERR_REASON(X509_R_NAME_TOO_LONG), "name too long"},
|
||||
{ERR_REASON(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY),
|
||||
"no cert set for us to verify"},
|
||||
{ERR_REASON(X509_R_PUBLIC_KEY_DECODE_ERROR), "public key decode error"},
|
||||
|
||||
@ -63,13 +63,6 @@
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/buffer.h>
|
||||
|
||||
/*
|
||||
* Limit to ensure we don't overflow: much greater than
|
||||
* anything enountered in practice.
|
||||
*/
|
||||
|
||||
#define NAME_ONELINE_MAX (1024 * 1024)
|
||||
|
||||
char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
|
||||
{
|
||||
X509_NAME_ENTRY *ne;
|
||||
@ -93,8 +86,6 @@ char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
|
||||
goto err;
|
||||
b->data[0] = '\0';
|
||||
len = 200;
|
||||
} else if (len == 0) {
|
||||
return NULL;
|
||||
}
|
||||
if (a == NULL) {
|
||||
if (b) {
|
||||
@ -119,10 +110,6 @@ char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
|
||||
|
||||
type = ne->value->type;
|
||||
num = ne->value->length;
|
||||
if (num > NAME_ONELINE_MAX) {
|
||||
X509err(X509_F_X509_NAME_ONELINE, X509_R_NAME_TOO_LONG);
|
||||
goto end;
|
||||
}
|
||||
q = ne->value->data;
|
||||
#ifdef CHARSET_EBCDIC
|
||||
if (type == V_ASN1_GENERALSTRING ||
|
||||
@ -130,9 +117,8 @@ char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
|
||||
type == V_ASN1_PRINTABLESTRING ||
|
||||
type == V_ASN1_TELETEXSTRING ||
|
||||
type == V_ASN1_VISIBLESTRING || type == V_ASN1_IA5STRING) {
|
||||
if (num > (int)sizeof(ebcdic_buf))
|
||||
num = sizeof(ebcdic_buf);
|
||||
ascii2ebcdic(ebcdic_buf, q, num);
|
||||
ascii2ebcdic(ebcdic_buf, q, (num > sizeof ebcdic_buf)
|
||||
? sizeof ebcdic_buf : num);
|
||||
q = ebcdic_buf;
|
||||
}
|
||||
#endif
|
||||
@ -168,10 +154,6 @@ char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
|
||||
|
||||
lold = l;
|
||||
l += 1 + l1 + 1 + l2;
|
||||
if (l > NAME_ONELINE_MAX) {
|
||||
X509err(X509_F_X509_NAME_ONELINE, X509_R_NAME_TOO_LONG);
|
||||
goto end;
|
||||
}
|
||||
if (b != NULL) {
|
||||
if (!BUF_MEM_grow(b, l + 1))
|
||||
goto err;
|
||||
@ -224,7 +206,7 @@ char *X509_NAME_oneline(X509_NAME *a, char *buf, int len)
|
||||
return (p);
|
||||
err:
|
||||
X509err(X509_F_X509_NAME_ONELINE, ERR_R_MALLOC_FAILURE);
|
||||
end:
|
||||
BUF_MEM_free(b);
|
||||
if (b != NULL)
|
||||
BUF_MEM_free(b);
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
@ -107,7 +107,7 @@ The following is a list of all permitted cipher strings and their meanings.
|
||||
|
||||
The default cipher list.
|
||||
This is determined at compile time and is normally
|
||||
B<ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2>.
|
||||
B<ALL:!EXPORT:!aNULL:!eNULL:!SSLv2>.
|
||||
When used, this must be the first cipherstring specified.
|
||||
|
||||
=item B<COMPLEMENTOFDEFAULT>
|
||||
|
||||
@ -1,127 +0,0 @@
|
||||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
EVP_EncodeInit, EVP_EncodeUpdate, EVP_EncodeFinal, EVP_EncodeBlock,
|
||||
EVP_DecodeInit, EVP_DecodeUpdate, EVP_DecodeFinal, EVP_DecodeBlock - EVP base 64
|
||||
encode/decode routines
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/evp.h>
|
||||
|
||||
void EVP_EncodeInit(EVP_ENCODE_CTX *ctx);
|
||||
void EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
|
||||
const unsigned char *in, int inl);
|
||||
void EVP_EncodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl);
|
||||
int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int n);
|
||||
|
||||
void EVP_DecodeInit(EVP_ENCODE_CTX *ctx);
|
||||
int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
|
||||
const unsigned char *in, int inl);
|
||||
int EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned
|
||||
char *out, int *outl);
|
||||
int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
The EVP encode routines provide a high level interface to base 64 encoding and
|
||||
decoding. Base 64 encoding converts binary data into a printable form that uses
|
||||
the characters A-Z, a-z, 0-9, "+" and "/" to represent the data. For every 3
|
||||
bytes of binary data provided 4 bytes of base 64 encoded data will be produced
|
||||
plus some occasional newlines (see below). If the input data length is not a
|
||||
multiple of 3 then the output data will be padded at the end using the "="
|
||||
character.
|
||||
|
||||
Encoding of binary data is performed in blocks of 48 input bytes (or less for
|
||||
the final block). For each 48 byte input block encoded 64 bytes of base 64 data
|
||||
is output plus an additional newline character (i.e. 65 bytes in total). The
|
||||
final block (which may be less than 48 bytes) will output 4 bytes for every 3
|
||||
bytes of input. If the data length is not divisible by 3 then a full 4 bytes is
|
||||
still output for the final 1 or 2 bytes of input. Similarly a newline character
|
||||
will also be output.
|
||||
|
||||
EVP_EncodeInit() initialises B<ctx> for the start of a new encoding operation.
|
||||
|
||||
EVP_EncodeUpdate() encode B<inl> bytes of data found in the buffer pointed to by
|
||||
B<in>. The output is stored in the buffer B<out> and the number of bytes output
|
||||
is stored in B<*outl>. It is the caller's responsibility to ensure that the
|
||||
buffer at B<out> is sufficiently large to accommodate the output data. Only full
|
||||
blocks of data (48 bytes) will be immediately processed and output by this
|
||||
function. Any remainder is held in the B<ctx> object and will be processed by a
|
||||
subsequent call to EVP_EncodeUpdate() or EVP_EncodeFinal(). To calculate the
|
||||
required size of the output buffer add together the value of B<inl> with the
|
||||
amount of unprocessed data held in B<ctx> and divide the result by 48 (ignore
|
||||
any remainder). This gives the number of blocks of data that will be processed.
|
||||
Ensure the output buffer contains 65 bytes of storage for each block, plus an
|
||||
additional byte for a NUL terminator. EVP_EncodeUpdate() may be called
|
||||
repeatedly to process large amounts of input data. In the event of an error
|
||||
EVP_EncodeUpdate() will set B<*outl> to 0.
|
||||
|
||||
EVP_EncodeFinal() must be called at the end of an encoding operation. It will
|
||||
process any partial block of data remaining in the B<ctx> object. The output
|
||||
data will be stored in B<out> and the length of the data written will be stored
|
||||
in B<*outl>. It is the caller's responsibility to ensure that B<out> is
|
||||
sufficiently large to accommodate the output data which will never be more than
|
||||
65 bytes plus an additional NUL terminator (i.e. 66 bytes in total).
|
||||
|
||||
EVP_EncodeBlock() encodes a full block of input data in B<f> and of length
|
||||
B<dlen> and stores it in B<t>. For every 3 bytes of input provided 4 bytes of
|
||||
output data will be produced. If B<dlen> is not divisible by 3 then the block is
|
||||
encoded as a final block of data and the output is padded such that it is always
|
||||
divisible by 4. Additionally a NUL terminator character will be added. For
|
||||
example if 16 bytes of input data is provided then 24 bytes of encoded data is
|
||||
created plus 1 byte for a NUL terminator (i.e. 25 bytes in total). The length of
|
||||
the data generated I<without> the NUL terminator is returned from the function.
|
||||
|
||||
EVP_DecodeInit() initialises B<ctx> for the start of a new decoding operation.
|
||||
|
||||
EVP_DecodeUpdate() decodes B<inl> characters of data found in the buffer pointed
|
||||
to by B<in>. The output is stored in the buffer B<out> and the number of bytes
|
||||
output is stored in B<*outl>. It is the caller's responsibility to ensure that
|
||||
the buffer at B<out> is sufficiently large to accommodate the output data. This
|
||||
function will attempt to decode as much data as possible in 4 byte chunks. Any
|
||||
whitespace, newline or carriage return characters are ignored. Any partial chunk
|
||||
of unprocessed data (1, 2 or 3 bytes) that remains at the end will be held in
|
||||
the B<ctx> object and processed by a subsequent call to EVP_DecodeUpdate(). If
|
||||
any illegal base 64 characters are encountered or if the base 64 padding
|
||||
character "=" is encountered in the middle of the data then the function returns
|
||||
-1 to indicate an error. A return value of 0 or 1 indicates successful
|
||||
processing of the data. A return value of 0 additionally indicates that the last
|
||||
input data characters processed included the base 64 padding character "=" and
|
||||
therefore no more non-padding character data is expected to be processed. For
|
||||
every 4 valid base 64 bytes processed (ignoring whitespace, carriage returns and
|
||||
line feeds), 3 bytes of binary output data will be produced (or less at the end
|
||||
of the data where the padding character "=" has been used).
|
||||
|
||||
EVP_DecodeFinal() must be called at the end of a decoding operation. If there
|
||||
is any unprocessed data still in B<ctx> then the input data must not have been
|
||||
a multiple of 4 and therefore an error has occurred. The function will return -1
|
||||
in this case. Otherwise the function returns 1 on success.
|
||||
|
||||
EVP_DecodeBlock() will decode the block of B<n> characters of base 64 data
|
||||
contained in B<f> and store the result in B<t>. Any leading whitespace will be
|
||||
trimmed as will any trailing whitespace, newlines, carriage returns or EOF
|
||||
characters. After such trimming the length of the data in B<f> must be divisbile
|
||||
by 4. For every 4 input bytes exactly 3 output bytes will be produced. The
|
||||
output will be padded with 0 bits if necessary to ensure that the output is
|
||||
always 3 bytes for every 4 input bytes. This function will return the length of
|
||||
the data decoded or -1 on error.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
EVP_EncodeBlock() returns the number of bytes encoded excluding the NUL
|
||||
terminator.
|
||||
|
||||
EVP_DecodeUpdate() returns -1 on error and 0 or 1 on success. If 0 is returned
|
||||
then no more non-padding base 64 characters are expected.
|
||||
|
||||
EVP_DecodeFinal() returns -1 on error or 1 on success.
|
||||
|
||||
EVP_DecodeBlock() returns the length of the data decoded or -1 on error.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<evp(3)>
|
||||
|
||||
=cut
|
||||
@ -25,10 +25,6 @@ functions. The B<EVP_Digest>I<...> functions provide message digests.
|
||||
The B<EVP_PKEY>I<...> functions provide a high level interface to
|
||||
asymmetric algorithms.
|
||||
|
||||
The L<B<EVP_Encode>I<...>|EVP_EncodeInit(3)> and
|
||||
L<B<EVP_Decode>I<...>|EVP_EncodeInit(3)> functions implement base 64 encoding
|
||||
and decoding.
|
||||
|
||||
Algorithms are loaded with OpenSSL_add_all_algorithms(3).
|
||||
|
||||
All the symmetric algorithms (ciphers), digests and asymmetric algorithms
|
||||
@ -53,7 +49,6 @@ L<EVP_OpenInit(3)|EVP_OpenInit(3)>,
|
||||
L<EVP_SealInit(3)|EVP_SealInit(3)>,
|
||||
L<EVP_SignInit(3)|EVP_SignInit(3)>,
|
||||
L<EVP_VerifyInit(3)|EVP_VerifyInit(3)>,
|
||||
L<EVP_EncodeInit(3)>,
|
||||
L<OpenSSL_add_all_algorithms(3)|OpenSSL_add_all_algorithms(3)>,
|
||||
L<engine(3)|engine(3)>
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ Release: 1
|
||||
Summary: Secure Sockets Layer and cryptography libraries and tools
|
||||
Name: openssl
|
||||
#Version: %{libmaj}.%{libmin}.%{librel}
|
||||
Version: 1.0.1t
|
||||
Version: 1.0.1s
|
||||
Source0: ftp://ftp.openssl.org/source/%{name}-%{version}.tar.gz
|
||||
License: OpenSSL
|
||||
Group: System Environment/Libraries
|
||||
|
||||
@ -1579,8 +1579,6 @@ int dtls1_process_heartbeat(SSL *s)
|
||||
* plus 2 bytes payload length, plus payload, plus padding
|
||||
*/
|
||||
buffer = OPENSSL_malloc(write_length);
|
||||
if (buffer == NULL)
|
||||
return -1;
|
||||
bp = buffer;
|
||||
|
||||
/* Enter response type, length and copy payload */
|
||||
|
||||
16
ssl/s2_lib.c
16
ssl/s2_lib.c
@ -150,7 +150,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_NOT_EXP | SSL_MEDIUM,
|
||||
0,
|
||||
128,
|
||||
128,
|
||||
@ -167,7 +167,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL2_CF_5_BYTE_ENC,
|
||||
40,
|
||||
128,
|
||||
@ -184,7 +184,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_RC2,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_NOT_EXP | SSL_MEDIUM,
|
||||
0,
|
||||
128,
|
||||
128,
|
||||
@ -201,7 +201,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_RC2,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL2_CF_5_BYTE_ENC,
|
||||
40,
|
||||
128,
|
||||
@ -219,7 +219,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_IDEA,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_NOT_EXP | SSL_MEDIUM,
|
||||
0,
|
||||
128,
|
||||
128,
|
||||
@ -237,7 +237,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
0,
|
||||
56,
|
||||
56,
|
||||
@ -254,7 +254,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_3DES,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH,
|
||||
SSL_NOT_EXP | SSL_HIGH,
|
||||
0,
|
||||
112,
|
||||
168,
|
||||
@ -271,7 +271,7 @@ OPENSSL_GLOBAL const SSL_CIPHER ssl2_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL2_CF_8_BYTE_ENC,
|
||||
64,
|
||||
64,
|
||||
|
||||
@ -57,8 +57,7 @@
|
||||
*/
|
||||
|
||||
#include "ssl_locl.h"
|
||||
#ifndef OPENSSL_NO_SSL2_METHOD
|
||||
# ifndef OPENSSL_NO_SSL2
|
||||
#ifndef OPENSSL_NO_SSL2
|
||||
# include <stdio.h>
|
||||
# include <openssl/objects.h>
|
||||
|
||||
@ -73,16 +72,7 @@ static const SSL_METHOD *ssl2_get_method(int ver)
|
||||
|
||||
IMPLEMENT_ssl2_meth_func(SSLv2_method,
|
||||
ssl2_accept, ssl2_connect, ssl2_get_method)
|
||||
|
||||
# else /* !OPENSSL_NO_SSL2 */
|
||||
|
||||
const SSL_METHOD *SSLv2_method(void) { return NULL; }
|
||||
const SSL_METHOD *SSLv2_client_method(void) { return NULL; }
|
||||
const SSL_METHOD *SSLv2_server_method(void) { return NULL; }
|
||||
|
||||
# endif
|
||||
|
||||
#else /* !OPENSSL_NO_SSL2_METHOD */
|
||||
#else /* !OPENSSL_NO_SSL2 */
|
||||
|
||||
# if PEDANTIC
|
||||
static void *dummy = &dummy;
|
||||
|
||||
@ -2104,7 +2104,6 @@ int ssl3_get_certificate_request(SSL *s)
|
||||
SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
xn = NULL;
|
||||
|
||||
p += l;
|
||||
nc += l + 2;
|
||||
@ -2128,7 +2127,6 @@ int ssl3_get_certificate_request(SSL *s)
|
||||
err:
|
||||
s->state = SSL_ST_ERR;
|
||||
done:
|
||||
X509_NAME_free(xn);
|
||||
if (ca_sk != NULL)
|
||||
sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);
|
||||
return (ret);
|
||||
|
||||
88
ssl/s3_lib.c
88
ssl/s3_lib.c
@ -213,7 +213,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -263,7 +263,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC2,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -299,7 +299,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -317,7 +317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -352,7 +352,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -370,7 +370,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -404,7 +404,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -422,7 +422,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -457,7 +457,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -475,7 +475,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -509,7 +509,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -527,7 +527,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -561,7 +561,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -578,7 +578,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -595,7 +595,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -613,7 +613,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -630,7 +630,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_3DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
112,
|
||||
168,
|
||||
@ -700,7 +700,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -766,7 +766,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_NOT_EXP | SSL_LOW,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -832,7 +832,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -850,7 +850,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC2,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -868,7 +868,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_SHA1,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -886,7 +886,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
56,
|
||||
@ -904,7 +904,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC2,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -922,7 +922,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_SSLV3,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP40,
|
||||
SSL_EXPORT | SSL_EXP40,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
40,
|
||||
128,
|
||||
@ -1016,7 +1016,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES128,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -1111,7 +1111,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES256,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
256,
|
||||
256,
|
||||
@ -1307,7 +1307,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_CAMELLIA128,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH,
|
||||
SSL_NOT_EXP | SSL_HIGH,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -1327,7 +1327,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_MD5,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56,
|
||||
SSL_EXPORT | SSL_EXP56,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
128,
|
||||
@ -1343,7 +1343,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC2,
|
||||
SSL_MD5,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56,
|
||||
SSL_EXPORT | SSL_EXP56,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
128,
|
||||
@ -1361,7 +1361,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56,
|
||||
SSL_EXPORT | SSL_EXP56,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -1379,7 +1379,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_DES,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56,
|
||||
SSL_EXPORT | SSL_EXP56,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
56,
|
||||
@ -1397,7 +1397,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56,
|
||||
SSL_EXPORT | SSL_EXP56,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
128,
|
||||
@ -1415,7 +1415,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_EXPORT | SSL_EXP56,
|
||||
SSL_EXPORT | SSL_EXP56,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
56,
|
||||
128,
|
||||
@ -1530,7 +1530,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES128,
|
||||
SSL_SHA256,
|
||||
SSL_TLSV1_2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -1546,7 +1546,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES256,
|
||||
SSL_SHA256,
|
||||
SSL_TLSV1_2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
256,
|
||||
256,
|
||||
@ -1699,7 +1699,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_CAMELLIA256,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH,
|
||||
SSL_NOT_EXP | SSL_HIGH,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
256,
|
||||
256,
|
||||
@ -1865,7 +1865,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_SEED,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -2045,7 +2045,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES128GCM,
|
||||
SSL_AEAD,
|
||||
SSL_TLSV1_2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
|
||||
128,
|
||||
128,
|
||||
@ -2061,7 +2061,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES256GCM,
|
||||
SSL_AEAD,
|
||||
SSL_TLSV1_2,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
|
||||
256,
|
||||
256,
|
||||
@ -2414,7 +2414,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_RC4,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_NOT_EXP | SSL_MEDIUM,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -2430,7 +2430,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_3DES,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
112,
|
||||
168,
|
||||
@ -2446,7 +2446,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES128,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
128,
|
||||
128,
|
||||
@ -2462,7 +2462,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
|
||||
SSL_AES256,
|
||||
SSL_SHA1,
|
||||
SSL_TLSV1,
|
||||
SSL_NOT_DEFAULT | SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_NOT_EXP | SSL_HIGH | SSL_FIPS,
|
||||
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
|
||||
256,
|
||||
256,
|
||||
|
||||
@ -334,7 +334,7 @@ extern "C" {
|
||||
* The following cipher list is used by default. It also is substituted when
|
||||
* an application-defined cipher list string starts with 'DEFAULT'.
|
||||
*/
|
||||
# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2"
|
||||
# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!aNULL:!eNULL:!SSLv2"
|
||||
/*
|
||||
* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
|
||||
* starts with a reasonable order, and all we have to do for DEFAULT is
|
||||
@ -2017,7 +2017,7 @@ const char *SSL_get_version(const SSL *s);
|
||||
/* This sets the 'default' SSL version that SSL_new() will create */
|
||||
int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);
|
||||
|
||||
# ifndef OPENSSL_NO_SSL2_METHOD
|
||||
# ifndef OPENSSL_NO_SSL2
|
||||
const SSL_METHOD *SSLv2_method(void); /* SSLv2 */
|
||||
const SSL_METHOD *SSLv2_server_method(void); /* SSLv2 */
|
||||
const SSL_METHOD *SSLv2_client_method(void); /* SSLv2 */
|
||||
|
||||
@ -235,7 +235,8 @@ static const SSL_CIPHER cipher_aliases[] = {
|
||||
* "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in
|
||||
* ALL!)
|
||||
*/
|
||||
{0, SSL_TXT_CMPDEF, 0, 0, 0, 0, 0, 0, SSL_NOT_DEFAULT, 0, 0, 0},
|
||||
{0, SSL_TXT_CMPDEF, 0, 0, SSL_aNULL, ~SSL_eNULL, 0, ~SSL_SSLV2,
|
||||
SSL_EXP_MASK, 0, 0, 0},
|
||||
|
||||
/*
|
||||
* key exchange aliases (some of those using only a single bit here
|
||||
@ -999,6 +1000,10 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
|
||||
cp->algorithm_enc, cp->algorithm_mac, cp->algorithm_ssl,
|
||||
cp->algo_strength);
|
||||
#endif
|
||||
if (algo_strength == SSL_EXP_MASK && SSL_C_IS_EXPORT(cp))
|
||||
goto ok;
|
||||
if (alg_ssl == ~SSL_SSLV2 && cp->algorithm_ssl == SSL_SSLV2)
|
||||
goto ok;
|
||||
if (alg_mkey && !(alg_mkey & cp->algorithm_mkey))
|
||||
continue;
|
||||
if (alg_auth && !(alg_auth & cp->algorithm_auth))
|
||||
@ -1015,11 +1020,10 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
|
||||
if ((algo_strength & SSL_STRONG_MASK)
|
||||
&& !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))
|
||||
continue;
|
||||
if ((algo_strength & SSL_NOT_DEFAULT)
|
||||
&& !(cp->algo_strength & SSL_NOT_DEFAULT))
|
||||
continue;
|
||||
}
|
||||
|
||||
ok:
|
||||
|
||||
#ifdef CIPHER_DEBUG
|
||||
fprintf(stderr, "Action = %d\n", rule);
|
||||
#endif
|
||||
@ -1303,10 +1307,6 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
|
||||
ca_list[j]->algo_strength & SSL_STRONG_MASK;
|
||||
}
|
||||
|
||||
if (ca_list[j]->algo_strength & SSL_NOT_DEFAULT) {
|
||||
algo_strength |= SSL_NOT_DEFAULT;
|
||||
}
|
||||
|
||||
if (ca_list[j]->valid) {
|
||||
/*
|
||||
* explicit ciphersuite found; its protocol version does not
|
||||
|
||||
@ -435,9 +435,8 @@
|
||||
# define SSL_MEDIUM 0x00000040L
|
||||
# define SSL_HIGH 0x00000080L
|
||||
# define SSL_FIPS 0x00000100L
|
||||
# define SSL_NOT_DEFAULT 0x00000200L
|
||||
|
||||
/* we have used 000003ff - 22 bits left to go */
|
||||
/* we have used 000001ff - 23 bits left to go */
|
||||
|
||||
/*-
|
||||
* Macros to check the export status and cipher strength for export ciphers.
|
||||
|
||||
@ -2321,10 +2321,8 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
|
||||
p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
|
||||
eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
|
||||
sdec = OPENSSL_malloc(eticklen);
|
||||
if (sdec == NULL
|
||||
|| EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen) <= 0) {
|
||||
if (!sdec || EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen) <= 0) {
|
||||
EVP_CIPHER_CTX_cleanup(&ctx);
|
||||
OPENSSL_free(sdec);
|
||||
return -1;
|
||||
}
|
||||
if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0) {
|
||||
@ -2581,8 +2579,6 @@ int tls1_process_heartbeat(SSL *s)
|
||||
* plus 2 bytes payload length, plus payload, plus padding
|
||||
*/
|
||||
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
|
||||
if (buffer == NULL)
|
||||
return -1;
|
||||
bp = buffer;
|
||||
|
||||
/* Enter response type, length and copy payload */
|
||||
|
||||
@ -38,12 +38,8 @@ fi
|
||||
echo test ssl3 is forbidden in FIPS mode
|
||||
$ssltest -ssl3 $extra && exit 1
|
||||
|
||||
if ../util/shlib_wrap.sh ../apps/openssl ciphers SSLv2 >/dev/null 2>&1; then
|
||||
echo test ssl2 is forbidden in FIPS mode
|
||||
$ssltest -ssl2 $extra && exit 1
|
||||
else
|
||||
echo ssl2 disabled: skipping test
|
||||
fi
|
||||
echo test ssl2 is forbidden in FIPS mode
|
||||
$ssltest -ssl2 $extra && exit 1
|
||||
|
||||
echo test tls1
|
||||
$ssltest -tls1 $extra || exit 1
|
||||
|
||||
@ -1065,8 +1065,8 @@ d2i_ASN1_BMPSTRING 1092 EXIST::FUNCTION:
|
||||
i2d_ASN1_BMPSTRING 1093 EXIST::FUNCTION:
|
||||
BIO_f_ber 1094 NOEXIST::FUNCTION:
|
||||
BN_init 1095 EXIST::FUNCTION:
|
||||
COMP_CTX_new 1096 EXIST::FUNCTION:COMP
|
||||
COMP_CTX_free 1097 EXIST::FUNCTION:COMP
|
||||
COMP_CTX_new 1096 EXIST::FUNCTION:
|
||||
COMP_CTX_free 1097 EXIST::FUNCTION:
|
||||
COMP_CTX_compress_block 1098 NOEXIST::FUNCTION:
|
||||
COMP_CTX_expand_block 1099 NOEXIST::FUNCTION:
|
||||
X509_STORE_CTX_get_ex_new_index 1100 EXIST::FUNCTION:
|
||||
@ -1113,10 +1113,10 @@ PKCS7_digest_from_attributes 1140 EXIST::FUNCTION:
|
||||
PKCS7_get_attribute 1141 EXIST::FUNCTION:
|
||||
PKCS7_get_issuer_and_serial 1142 EXIST::FUNCTION:
|
||||
PKCS7_get_signed_attribute 1143 EXIST::FUNCTION:
|
||||
COMP_compress_block 1144 EXIST::FUNCTION:COMP
|
||||
COMP_expand_block 1145 EXIST::FUNCTION:COMP
|
||||
COMP_rle 1146 EXIST::FUNCTION:COMP
|
||||
COMP_zlib 1147 EXIST::FUNCTION:COMP
|
||||
COMP_compress_block 1144 EXIST::FUNCTION:
|
||||
COMP_expand_block 1145 EXIST::FUNCTION:
|
||||
COMP_rle 1146 EXIST::FUNCTION:
|
||||
COMP_zlib 1147 EXIST::FUNCTION:
|
||||
ms_time_diff 1148 NOEXIST::FUNCTION:
|
||||
ms_time_new 1149 NOEXIST::FUNCTION:
|
||||
ms_time_free 1150 NOEXIST::FUNCTION:
|
||||
@ -1945,7 +1945,7 @@ ENGINE_get_ctrl_function 2521 EXIST::FUNCTION:ENGINE
|
||||
ENGINE_set_ctrl_function 2522 EXIST::FUNCTION:ENGINE
|
||||
BN_pseudo_rand_range 2523 EXIST::FUNCTION:
|
||||
X509_STORE_CTX_set_verify_cb 2524 EXIST::FUNCTION:
|
||||
ERR_load_COMP_strings 2525 EXIST::FUNCTION:COMP
|
||||
ERR_load_COMP_strings 2525 EXIST::FUNCTION:
|
||||
PKCS12_item_decrypt_d2i 2526 EXIST::FUNCTION:
|
||||
ASN1_UTF8STRING_it 2527 EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
|
||||
ASN1_UTF8STRING_it 2527 EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
|
||||
@ -3545,8 +3545,8 @@ X509at_get0_data_by_OBJ 3931 EXIST::FUNCTION:
|
||||
ASN1_TYPE_set1 3932 EXIST::FUNCTION:
|
||||
ASN1_STRING_set0 3933 EXIST::FUNCTION:
|
||||
i2d_X509_ALGORS 3934 EXIST::FUNCTION:
|
||||
BIO_f_zlib 3935 EXIST:ZLIB:FUNCTION:COMP
|
||||
COMP_zlib_cleanup 3936 EXIST::FUNCTION:COMP
|
||||
BIO_f_zlib 3935 EXIST:ZLIB:FUNCTION:
|
||||
COMP_zlib_cleanup 3936 EXIST::FUNCTION:
|
||||
d2i_X509_ALGORS 3937 EXIST::FUNCTION:
|
||||
CMS_ReceiptRequest_free 3938 EXIST::FUNCTION:CMS
|
||||
PEM_write_CMS 3939 EXIST:!WIN16:FUNCTION:CMS
|
||||
|
||||
@ -282,9 +282,8 @@ $cflags.=" -DOPENSSL_FIPS" if $fips;
|
||||
$cflags.=" -DOPENSSL_NO_JPAKE" if $no_jpake;
|
||||
$cflags.=" -DOPENSSL_NO_EC2M" if $no_ec2m;
|
||||
$cflags.=" -DOPENSSL_NO_WEAK_SSL_CIPHERS" if $no_weak_ssl;
|
||||
$cflags.=" -DZLIB" if $zlib_opt;
|
||||
$cflags.=" -DZLIB_SHARED" if $zlib_opt == 2;
|
||||
$cflags.=" -DOPENSSL_NO_COMP" if $no_comp;
|
||||
$cflags.= " -DZLIB" if $zlib_opt;
|
||||
$cflags.= " -DZLIB_SHARED" if $zlib_opt == 2;
|
||||
|
||||
if ($no_static_engine)
|
||||
{
|
||||
@ -781,7 +780,6 @@ sub var_add
|
||||
return("") if $no_gost && $dir =~ /\/ccgost/;
|
||||
return("") if $no_cms && $dir =~ /\/cms/;
|
||||
return("") if $no_jpake && $dir =~ /\/jpake/;
|
||||
return("") if $no_comp && $dir =~ /\/comp/;
|
||||
if ($no_des && $dir =~ /\/des/)
|
||||
{
|
||||
if ($val =~ /read_pwd/)
|
||||
@ -1117,7 +1115,6 @@ sub read_options
|
||||
"nw-mwasm" => \$nw_mwasm,
|
||||
"gaswin" => \$gaswin,
|
||||
"no-ssl2" => \$no_ssl2,
|
||||
"no-ssl2-method" => 0,
|
||||
"no-ssl3" => \$no_ssl3,
|
||||
"no-ssl3-method" => 0,
|
||||
"no-tlsext" => \$no_tlsext,
|
||||
@ -1159,7 +1156,6 @@ sub read_options
|
||||
"no-unit-test" => 0,
|
||||
"no-zlib" => 0,
|
||||
"no-zlib-dynamic" => 0,
|
||||
"no-comp" => \$no_comp,
|
||||
"fips" => \$fips
|
||||
);
|
||||
|
||||
@ -1177,6 +1173,7 @@ sub read_options
|
||||
}
|
||||
}
|
||||
}
|
||||
elsif (/^no-comp$/) { $xcflags = "-DOPENSSL_NO_COMP $xcflags"; }
|
||||
elsif (/^enable-zlib$/) { $zlib_opt = 1 if $zlib_opt == 0 }
|
||||
elsif (/^enable-zlib-dynamic$/)
|
||||
{
|
||||
|
||||
@ -107,8 +107,6 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
|
||||
"CAPIENG",
|
||||
# SSL v2
|
||||
"SSL2",
|
||||
# SSL v2 method
|
||||
"SSL2_METHOD",
|
||||
# SSL v3 method
|
||||
"SSL3_METHOD",
|
||||
# JPAKE
|
||||
@ -145,7 +143,7 @@ my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated;
|
||||
my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng;
|
||||
my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc;
|
||||
my $no_nextprotoneg; my $no_sctp; my $no_srtp;
|
||||
my $no_unit_test; my $no_ssl3_method; my $no_ssl2_method;
|
||||
my $no_unit_test; my $no_ssl3_method;
|
||||
|
||||
my $fips;
|
||||
|
||||
@ -240,7 +238,6 @@ foreach (@ARGV, split(/ /, $options))
|
||||
elsif (/^no-ec_nistp_64_gcc_128$/) { $no_nistp_gcc=1; }
|
||||
elsif (/^no-nextprotoneg$/) { $no_nextprotoneg=1; }
|
||||
elsif (/^no-ssl2$/) { $no_ssl2=1; }
|
||||
elsif (/^no-ssl2-method$/) { $no_ssl2_method=1; }
|
||||
elsif (/^no-ssl3-method$/) { $no_ssl3_method=1; }
|
||||
elsif (/^no-capieng$/) { $no_capieng=1; }
|
||||
elsif (/^no-jpake$/) { $no_jpake=1; }
|
||||
@ -1214,7 +1211,6 @@ sub is_valid
|
||||
if ($keyword eq "EC_NISTP_64_GCC_128" && $no_nistp_gcc)
|
||||
{ return 0; }
|
||||
if ($keyword eq "SSL2" && $no_ssl2) { return 0; }
|
||||
if ($keyword eq "SSL2_METHOD" && $no_ssl2_method) { return 0; }
|
||||
if ($keyword eq "SSL3_METHOD" && $no_ssl3_method) { return 0; }
|
||||
if ($keyword eq "CAPIENG" && $no_capieng) { return 0; }
|
||||
if ($keyword eq "JPAKE" && $no_jpake) { return 0; }
|
||||
|
||||
@ -98,9 +98,9 @@ SSLeay_add_ssl_algorithms 109 NOEXIST::FUNCTION:
|
||||
SSLv23_client_method 110 EXIST::FUNCTION:RSA
|
||||
SSLv23_method 111 EXIST::FUNCTION:RSA
|
||||
SSLv23_server_method 112 EXIST::FUNCTION:RSA
|
||||
SSLv2_client_method 113 EXIST::FUNCTION:RSA,SSL2_METHOD
|
||||
SSLv2_method 114 EXIST::FUNCTION:RSA,SSL2_METHOD
|
||||
SSLv2_server_method 115 EXIST::FUNCTION:RSA,SSL2_METHOD
|
||||
SSLv2_client_method 113 EXIST::FUNCTION:RSA,SSL2
|
||||
SSLv2_method 114 EXIST::FUNCTION:RSA,SSL2
|
||||
SSLv2_server_method 115 EXIST::FUNCTION:RSA,SSL2
|
||||
SSLv3_client_method 116 EXIST::FUNCTION:SSL3_METHOD
|
||||
SSLv3_method 117 EXIST::FUNCTION:SSL3_METHOD
|
||||
SSLv3_server_method 118 EXIST::FUNCTION:SSL3_METHOD
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user