diff options
Diffstat (limited to 'src/lib/libssl/ssl_ciph.c')
-rw-r--r-- | src/lib/libssl/ssl_ciph.c | 79 |
1 files changed, 40 insertions, 39 deletions
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c index 532fb4e80d..2d6eab20c3 100644 --- a/src/lib/libssl/ssl_ciph.c +++ b/src/lib/libssl/ssl_ciph.c | |||
@@ -340,10 +340,10 @@ static unsigned long ssl_cipher_get_disabled(void) | |||
340 | } | 340 | } |
341 | 341 | ||
342 | static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, | 342 | static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, |
343 | int num_of_ciphers, unsigned long mask, CIPHER_ORDER *list, | 343 | int num_of_ciphers, unsigned long mask, CIPHER_ORDER *co_list, |
344 | CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) | 344 | CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) |
345 | { | 345 | { |
346 | int i, list_num; | 346 | int i, co_list_num; |
347 | SSL_CIPHER *c; | 347 | SSL_CIPHER *c; |
348 | 348 | ||
349 | /* | 349 | /* |
@@ -354,18 +354,18 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, | |||
354 | */ | 354 | */ |
355 | 355 | ||
356 | /* Get the initial list of ciphers */ | 356 | /* Get the initial list of ciphers */ |
357 | list_num = 0; /* actual count of ciphers */ | 357 | co_list_num = 0; /* actual count of ciphers */ |
358 | for (i = 0; i < num_of_ciphers; i++) | 358 | for (i = 0; i < num_of_ciphers; i++) |
359 | { | 359 | { |
360 | c = ssl_method->get_cipher(i); | 360 | c = ssl_method->get_cipher(i); |
361 | /* drop those that use any of that is not available */ | 361 | /* drop those that use any of that is not available */ |
362 | if ((c != NULL) && c->valid && !(c->algorithms & mask)) | 362 | if ((c != NULL) && c->valid && !(c->algorithms & mask)) |
363 | { | 363 | { |
364 | list[list_num].cipher = c; | 364 | co_list[co_list_num].cipher = c; |
365 | list[list_num].next = NULL; | 365 | co_list[co_list_num].next = NULL; |
366 | list[list_num].prev = NULL; | 366 | co_list[co_list_num].prev = NULL; |
367 | list[list_num].active = 0; | 367 | co_list[co_list_num].active = 0; |
368 | list_num++; | 368 | co_list_num++; |
369 | #ifdef KSSL_DEBUG | 369 | #ifdef KSSL_DEBUG |
370 | printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms); | 370 | printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms); |
371 | #endif /* KSSL_DEBUG */ | 371 | #endif /* KSSL_DEBUG */ |
@@ -378,18 +378,18 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, | |||
378 | /* | 378 | /* |
379 | * Prepare linked list from list entries | 379 | * Prepare linked list from list entries |
380 | */ | 380 | */ |
381 | for (i = 1; i < list_num - 1; i++) | 381 | for (i = 1; i < co_list_num - 1; i++) |
382 | { | 382 | { |
383 | list[i].prev = &(list[i-1]); | 383 | co_list[i].prev = &(co_list[i-1]); |
384 | list[i].next = &(list[i+1]); | 384 | co_list[i].next = &(co_list[i+1]); |
385 | } | 385 | } |
386 | if (list_num > 0) | 386 | if (co_list_num > 0) |
387 | { | 387 | { |
388 | (*head_p) = &(list[0]); | 388 | (*head_p) = &(co_list[0]); |
389 | (*head_p)->prev = NULL; | 389 | (*head_p)->prev = NULL; |
390 | (*head_p)->next = &(list[1]); | 390 | (*head_p)->next = &(co_list[1]); |
391 | (*tail_p) = &(list[list_num - 1]); | 391 | (*tail_p) = &(co_list[co_list_num - 1]); |
392 | (*tail_p)->prev = &(list[list_num - 2]); | 392 | (*tail_p)->prev = &(co_list[co_list_num - 2]); |
393 | (*tail_p)->next = NULL; | 393 | (*tail_p)->next = NULL; |
394 | } | 394 | } |
395 | } | 395 | } |
@@ -435,7 +435,7 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list, | |||
435 | 435 | ||
436 | static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, | 436 | static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, |
437 | unsigned long algo_strength, unsigned long mask_strength, | 437 | unsigned long algo_strength, unsigned long mask_strength, |
438 | int rule, int strength_bits, CIPHER_ORDER *list, | 438 | int rule, int strength_bits, CIPHER_ORDER *co_list, |
439 | CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) | 439 | CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) |
440 | { | 440 | { |
441 | CIPHER_ORDER *head, *tail, *curr, *curr2, *tail2; | 441 | CIPHER_ORDER *head, *tail, *curr, *curr2, *tail2; |
@@ -530,8 +530,9 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, | |||
530 | *tail_p = tail; | 530 | *tail_p = tail; |
531 | } | 531 | } |
532 | 532 | ||
533 | static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p, | 533 | static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list, |
534 | CIPHER_ORDER **tail_p) | 534 | CIPHER_ORDER **head_p, |
535 | CIPHER_ORDER **tail_p) | ||
535 | { | 536 | { |
536 | int max_strength_bits, i, *number_uses; | 537 | int max_strength_bits, i, *number_uses; |
537 | CIPHER_ORDER *curr; | 538 | CIPHER_ORDER *curr; |
@@ -576,14 +577,14 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p, | |||
576 | for (i = max_strength_bits; i >= 0; i--) | 577 | for (i = max_strength_bits; i >= 0; i--) |
577 | if (number_uses[i] > 0) | 578 | if (number_uses[i] > 0) |
578 | ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i, | 579 | ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i, |
579 | list, head_p, tail_p); | 580 | co_list, head_p, tail_p); |
580 | 581 | ||
581 | OPENSSL_free(number_uses); | 582 | OPENSSL_free(number_uses); |
582 | return(1); | 583 | return(1); |
583 | } | 584 | } |
584 | 585 | ||
585 | static int ssl_cipher_process_rulestr(const char *rule_str, | 586 | static int ssl_cipher_process_rulestr(const char *rule_str, |
586 | CIPHER_ORDER *list, CIPHER_ORDER **head_p, | 587 | CIPHER_ORDER *co_list, CIPHER_ORDER **head_p, |
587 | CIPHER_ORDER **tail_p, SSL_CIPHER **ca_list) | 588 | CIPHER_ORDER **tail_p, SSL_CIPHER **ca_list) |
588 | { | 589 | { |
589 | unsigned long algorithms, mask, algo_strength, mask_strength; | 590 | unsigned long algorithms, mask, algo_strength, mask_strength; |
@@ -708,7 +709,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str, | |||
708 | ok = 0; | 709 | ok = 0; |
709 | if ((buflen == 8) && | 710 | if ((buflen == 8) && |
710 | !strncmp(buf, "STRENGTH", 8)) | 711 | !strncmp(buf, "STRENGTH", 8)) |
711 | ok = ssl_cipher_strength_sort(list, | 712 | ok = ssl_cipher_strength_sort(co_list, |
712 | head_p, tail_p); | 713 | head_p, tail_p); |
713 | else | 714 | else |
714 | SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, | 715 | SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, |
@@ -728,7 +729,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str, | |||
728 | { | 729 | { |
729 | ssl_cipher_apply_rule(algorithms, mask, | 730 | ssl_cipher_apply_rule(algorithms, mask, |
730 | algo_strength, mask_strength, rule, -1, | 731 | algo_strength, mask_strength, rule, -1, |
731 | list, head_p, tail_p); | 732 | co_list, head_p, tail_p); |
732 | } | 733 | } |
733 | else | 734 | else |
734 | { | 735 | { |
@@ -750,7 +751,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
750 | unsigned long disabled_mask; | 751 | unsigned long disabled_mask; |
751 | STACK_OF(SSL_CIPHER) *cipherstack; | 752 | STACK_OF(SSL_CIPHER) *cipherstack; |
752 | const char *rule_p; | 753 | const char *rule_p; |
753 | CIPHER_ORDER *list = NULL, *head = NULL, *tail = NULL, *curr; | 754 | CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr; |
754 | SSL_CIPHER **ca_list = NULL; | 755 | SSL_CIPHER **ca_list = NULL; |
755 | 756 | ||
756 | /* | 757 | /* |
@@ -780,15 +781,15 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
780 | #ifdef KSSL_DEBUG | 781 | #ifdef KSSL_DEBUG |
781 | printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers); | 782 | printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers); |
782 | #endif /* KSSL_DEBUG */ | 783 | #endif /* KSSL_DEBUG */ |
783 | list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers); | 784 | co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers); |
784 | if (list == NULL) | 785 | if (co_list == NULL) |
785 | { | 786 | { |
786 | SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); | 787 | SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); |
787 | return(NULL); /* Failure */ | 788 | return(NULL); /* Failure */ |
788 | } | 789 | } |
789 | 790 | ||
790 | ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask, | 791 | ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask, |
791 | list, &head, &tail); | 792 | co_list, &head, &tail); |
792 | 793 | ||
793 | /* | 794 | /* |
794 | * We also need cipher aliases for selecting based on the rule_str. | 795 | * We also need cipher aliases for selecting based on the rule_str. |
@@ -804,7 +805,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
804 | (SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max); | 805 | (SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max); |
805 | if (ca_list == NULL) | 806 | if (ca_list == NULL) |
806 | { | 807 | { |
807 | OPENSSL_free(list); | 808 | OPENSSL_free(co_list); |
808 | SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); | 809 | SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); |
809 | return(NULL); /* Failure */ | 810 | return(NULL); /* Failure */ |
810 | } | 811 | } |
@@ -820,21 +821,21 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
820 | if (strncmp(rule_str,"DEFAULT",7) == 0) | 821 | if (strncmp(rule_str,"DEFAULT",7) == 0) |
821 | { | 822 | { |
822 | ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, | 823 | ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, |
823 | list, &head, &tail, ca_list); | 824 | co_list, &head, &tail, ca_list); |
824 | rule_p += 7; | 825 | rule_p += 7; |
825 | if (*rule_p == ':') | 826 | if (*rule_p == ':') |
826 | rule_p++; | 827 | rule_p++; |
827 | } | 828 | } |
828 | 829 | ||
829 | if (ok && (strlen(rule_p) > 0)) | 830 | if (ok && (strlen(rule_p) > 0)) |
830 | ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail, | 831 | ok = ssl_cipher_process_rulestr(rule_p, co_list, &head, &tail, |
831 | ca_list); | 832 | ca_list); |
832 | 833 | ||
833 | OPENSSL_free(ca_list); /* Not needed anymore */ | 834 | OPENSSL_free(ca_list); /* Not needed anymore */ |
834 | 835 | ||
835 | if (!ok) | 836 | if (!ok) |
836 | { /* Rule processing failure */ | 837 | { /* Rule processing failure */ |
837 | OPENSSL_free(list); | 838 | OPENSSL_free(co_list); |
838 | return(NULL); | 839 | return(NULL); |
839 | } | 840 | } |
840 | /* | 841 | /* |
@@ -843,7 +844,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
843 | */ | 844 | */ |
844 | if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) | 845 | if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) |
845 | { | 846 | { |
846 | OPENSSL_free(list); | 847 | OPENSSL_free(co_list); |
847 | return(NULL); | 848 | return(NULL); |
848 | } | 849 | } |
849 | 850 | ||
@@ -861,7 +862,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
861 | #endif | 862 | #endif |
862 | } | 863 | } |
863 | } | 864 | } |
864 | OPENSSL_free(list); /* Not needed any longer */ | 865 | OPENSSL_free(co_list); /* Not needed any longer */ |
865 | 866 | ||
866 | /* | 867 | /* |
867 | * The following passage is a little bit odd. If pointer variables | 868 | * The following passage is a little bit odd. If pointer variables |
@@ -911,7 +912,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, | |||
911 | char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len) | 912 | char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len) |
912 | { | 913 | { |
913 | int is_export,pkl,kl; | 914 | int is_export,pkl,kl; |
914 | char *ver,*exp; | 915 | char *ver,*exp_str; |
915 | char *kx,*au,*enc,*mac; | 916 | char *kx,*au,*enc,*mac; |
916 | unsigned long alg,alg2,alg_s; | 917 | unsigned long alg,alg2,alg_s; |
917 | #ifdef KSSL_DEBUG | 918 | #ifdef KSSL_DEBUG |
@@ -927,7 +928,7 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len) | |||
927 | is_export=SSL_C_IS_EXPORT(cipher); | 928 | is_export=SSL_C_IS_EXPORT(cipher); |
928 | pkl=SSL_C_EXPORT_PKEYLENGTH(cipher); | 929 | pkl=SSL_C_EXPORT_PKEYLENGTH(cipher); |
929 | kl=SSL_C_EXPORT_KEYLENGTH(cipher); | 930 | kl=SSL_C_EXPORT_KEYLENGTH(cipher); |
930 | exp=is_export?" export":""; | 931 | exp_str=is_export?" export":""; |
931 | 932 | ||
932 | if (alg & SSL_SSLV2) | 933 | if (alg & SSL_SSLV2) |
933 | ver="SSLv2"; | 934 | ver="SSLv2"; |
@@ -1046,9 +1047,9 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len) | |||
1046 | return("Buffer too small"); | 1047 | return("Buffer too small"); |
1047 | 1048 | ||
1048 | #ifdef KSSL_DEBUG | 1049 | #ifdef KSSL_DEBUG |
1049 | BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp,alg); | 1050 | BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str,alg); |
1050 | #else | 1051 | #else |
1051 | BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp); | 1052 | BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str); |
1052 | #endif /* KSSL_DEBUG */ | 1053 | #endif /* KSSL_DEBUG */ |
1053 | return(buf); | 1054 | return(buf); |
1054 | } | 1055 | } |
@@ -1135,11 +1136,11 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) | |||
1135 | { | 1136 | { |
1136 | MemCheck_on(); | 1137 | MemCheck_on(); |
1137 | SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE); | 1138 | SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE); |
1138 | return(0); | 1139 | return(1); |
1139 | } | 1140 | } |
1140 | else | 1141 | else |
1141 | { | 1142 | { |
1142 | MemCheck_on(); | 1143 | MemCheck_on(); |
1143 | return(1); | 1144 | return(0); |
1144 | } | 1145 | } |
1145 | } | 1146 | } |