1 files changed, 23 insertions, 11 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index b73b5ac87f..c4ef2738d7 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1125,7 +1125,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0, /* not implemented (non-ephemeral DH) */
         TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES128,
         SSL_SHA256,
@@ -1407,7 +1407,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0, /* not implemented (non-ephemeral DH) */
         TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES256,
         SSL_SHA256,
@@ -1683,7 +1683,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_3DES,
         SSL_SHA1,
         SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
+        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
         168,
         168,
@@ -1699,7 +1699,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_AES128,
         SSL_SHA1,
         SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
+        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
         128,
         128,
@@ -1715,7 +1715,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_AES256,
         SSL_SHA1,
         SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
+        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
         256,
         256,
@@ -1958,7 +1958,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES128GCM,
         SSL_AEAD,
@@ -1974,7 +1974,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
         TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES256GCM,
         SSL_AEAD,
@@ -2669,7 +2669,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
         TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES128,
         SSL_SHA256,
@@ -2685,7 +2685,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
         TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES256,
         SSL_SHA384,
@@ -2799,7 +2799,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES128GCM,
         SSL_AEAD,
@@ -2815,7 +2815,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES256GCM,
         SSL_AEAD,
@@ -3037,6 +3037,11 @@ void ssl3_clear(SSL *s)
                 s->s3->tmp.ecdh = NULL;
                 }
 #endif
+#ifndef OPENSSL_NO_TLSEXT
+#ifndef OPENSSL_NO_EC
+        s->s3->is_probably_safari = 0;
+#endif /* !OPENSSL_NO_EC */
+#endif /* !OPENSSL_NO_TLSEXT */
 
         rp = s->s3->rbuf.buf;
         wp = s->s3->wbuf.buf;
@@ -4016,6 +4021,13 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                 ii=sk_SSL_CIPHER_find(allow,c);
                 if (ii >= 0)
                         {
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT)
+                        if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari)
+                                {
+                                if (!ret) ret=sk_SSL_CIPHER_value(allow,ii);
+                                continue;
+                                }
+#endif
                         ret=sk_SSL_CIPHER_value(allow,ii);
                         break;
                         }