1 files changed, 44 insertions, 30 deletions

diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 46732791fd..497515f9ec 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1306,36 +1306,33 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 /* works well for SSLv2, not so good for SSLv3 */
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
         {
-        char *p;
+        char *end;
         STACK_OF(SSL_CIPHER) *sk;
         SSL_CIPHER *c;
+        size_t curlen = 0;
         int i;
 
         if ((s->session == NULL) || (s->session->ciphers == NULL) ||
                 (len < 2))
                 return(NULL);
 
-        p=buf;
         sk=s->session->ciphers;
+        buf[0] = '\0';
         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
                 {
-                int n;
-
                 c=sk_SSL_CIPHER_value(sk,i);
-                n=strlen(c->name);
-                if (n+1 > len)
+                end = buf + curlen;
+                if (strlcat(buf, c->name, len) >= len ||
+                    (curlen = strlcat(buf, ":", len)) >= len)
                         {
-                        if (p != buf)
-                                --p;
-                        *p='\0';
-                        return buf;
+                        /* remove truncated cipher from list */
+                        *end = '\0';
+                        break;
                         }
-                strcpy(p,c->name);
-                p+=n;
-                *(p++)=':';
-                len-=n+1;
                 }
-        p[-1]='\0';
+        /* remove trailing colon */
+        if ((end = strrchr(buf, ':')) != NULL)
+                *end = '\0';
         return(buf);
         }
 
@@ -1833,7 +1830,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
 #endif
         X509 *x = NULL;
         EVP_PKEY *ecc_pkey = NULL;
-        int signature_nid = 0, pk_nid = 0, md_nid = 0;
+        int signature_nid = 0;
 
         if (c == NULL) return;
 
@@ -1963,15 +1960,18 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
                     EVP_PKEY_bits(ecc_pkey) : 0;
                 EVP_PKEY_free(ecc_pkey);
                 if ((x->sig_alg) && (x->sig_alg->algorithm))
-                        {
                         signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
-                        OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
-                        }
 #ifndef OPENSSL_NO_ECDH
                 if (ecdh_ok)
                         {
-
-                        if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa)
+                        const char *sig = OBJ_nid2ln(signature_nid);
+                        if (sig == NULL)
+                                {
+                                ERR_clear_error();
+                                sig = "unknown";
+                                }
+                                
+                        if (strstr(sig, "WithRSA"))
                                 {
                                 mask_k|=SSL_kECDHr;
                                 mask_a|=SSL_aECDH;
@@ -1982,7 +1982,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
                                         }
                                 }
 
-                        if (pk_nid == NID_X9_62_id_ecPublicKey)
+                        if (signature_nid == NID_ecdsa_with_SHA1)
                                 {
                                 mask_k|=SSL_kECDHe;
                                 mask_a|=SSL_aECDH;
@@ -2036,7 +2036,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
         unsigned long alg_k, alg_a;
         EVP_PKEY *pkey = NULL;
         int keysize = 0;
-        int signature_nid = 0, md_nid = 0, pk_nid = 0;
+        int signature_nid = 0;
 
         alg_k = cs->algorithm_mkey;
         alg_a = cs->algorithm_auth;
@@ -2054,10 +2054,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
         /* This call populates the ex_flags field correctly */
         X509_check_purpose(x, -1, 0);
         if ((x->sig_alg) && (x->sig_alg->algorithm))
-                {
                 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
-                OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
-                }
         if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr)
                 {
                 /* key usage, if present, must allow key agreement */
@@ -2069,7 +2066,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
                 if (alg_k & SSL_kECDHe)
                         {
                         /* signature alg must be ECDSA */
-                        if (pk_nid != NID_X9_62_id_ecPublicKey)
+                        if (signature_nid != NID_ecdsa_with_SHA1)
                                 {
                                 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
                                 return 0;
@@ -2079,7 +2076,13 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
                         {
                         /* signature alg must be RSA */
 
-                        if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa)
+                        const char *sig = OBJ_nid2ln(signature_nid);
+                        if (sig == NULL)
+                                {
+                                ERR_clear_error();
+                                sig = "unknown";
+                                }
+                        if (strstr(sig, "WithRSA") == NULL)
                                 {
                                 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
                                 return 0;
@@ -2104,12 +2107,23 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, const SSL_CIPHER *cs)
 /* THIS NEEDS CLEANING UP */
 X509 *ssl_get_server_send_cert(SSL *s)
         {
-        unsigned long alg_k,alg_a;
+        unsigned long alg_k,alg_a,mask_k,mask_a;
         CERT *c;
-        int i;
+        int i,is_export;
 
         c=s->cert;
         ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
+        is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
+        if (is_export)
+                {
+                mask_k = c->export_mask_k;
+                mask_a = c->export_mask_a;
+                }
+        else
+                {
+                mask_k = c->mask_k;
+                mask_a = c->mask_a;
+                }
         
         alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
         alg_a = s->s3->tmp.new_cipher->algorithm_auth;