Make it substantially easier to identify protocol version requirements

by adding an enc_flags field to the ssl3_enc_method, specifying four flags
that are used with this field and providing macros for evaluating these
conditions. Currently the version requirements are identified by
continually checking the version number and other criteria.

This change also adds separate SSL3_ENC_METHOD data for TLS v1.1 and v1.2,
since they have different enc_flags from TLS v1.

Based on changes in OpenSSL head.

No objection from miod@

1 files changed, 38 insertions, 0 deletions

diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 205c2558fb..1424eab6e6 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -140,6 +140,44 @@ SSL3_ENC_METHOD TLSv1_enc_data = {
         .server_finished_label_len = TLS_MD_SERVER_FINISH_CONST_SIZE,
         .alert_value = tls1_alert_code,
         .export_keying_material = tls1_export_keying_material,
+        .enc_flags = 0,
+};
+
+SSL3_ENC_METHOD TLSv1_1_enc_data = {
+        .enc = tls1_enc,
+        .mac = tls1_mac,
+        .setup_key_block = tls1_setup_key_block,
+        .generate_master_secret = tls1_generate_master_secret,
+        .change_cipher_state = tls1_change_cipher_state,
+        .final_finish_mac = tls1_final_finish_mac,
+        .finish_mac_length = TLS1_FINISH_MAC_LENGTH,
+        .cert_verify_mac = tls1_cert_verify_mac,
+        .client_finished_label = TLS_MD_CLIENT_FINISH_CONST,
+        .client_finished_label_len = TLS_MD_CLIENT_FINISH_CONST_SIZE,
+        .server_finished_label = TLS_MD_SERVER_FINISH_CONST,
+        .server_finished_label_len = TLS_MD_SERVER_FINISH_CONST_SIZE,
+        .alert_value = tls1_alert_code,
+        .export_keying_material = tls1_export_keying_material,
+        .enc_flags = SSL_ENC_FLAG_EXPLICIT_IV,
+};
+
+SSL3_ENC_METHOD TLSv1_2_enc_data = {
+        .enc = tls1_enc,
+        .mac = tls1_mac,
+        .setup_key_block = tls1_setup_key_block,
+        .generate_master_secret = tls1_generate_master_secret,
+        .change_cipher_state = tls1_change_cipher_state,
+        .final_finish_mac = tls1_final_finish_mac,
+        .finish_mac_length = TLS1_FINISH_MAC_LENGTH,
+        .cert_verify_mac = tls1_cert_verify_mac,
+        .client_finished_label = TLS_MD_CLIENT_FINISH_CONST,
+        .client_finished_label_len = TLS_MD_CLIENT_FINISH_CONST_SIZE,
+        .server_finished_label = TLS_MD_SERVER_FINISH_CONST,
+        .server_finished_label_len = TLS_MD_SERVER_FINISH_CONST_SIZE,
+        .alert_value = tls1_alert_code,
+        .export_keying_material = tls1_export_keying_material,
+        .enc_flags = SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|
+            SSL_ENC_FLAG_SHA256_PRF|SSL_ENC_FLAG_TLS1_2_CIPHERS,
 };
 
 long