From 4fbee6b90386fa14be274db8ba947f951bc6de4c Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Mon, 22 Jul 2024 14:47:15 +0000
Subject: Use cipher suite values instead of IDs.

OpenSSL has had the concept of cipher IDs, which were a way of working
around overlapping cipher suite values between SSLv2 and SSLv3. Given
that we no longer have to deal with this issue, replace the use of IDs
with cipher suite values. In particular, this means that we can stop
mapping back and forth between the two, simplifying things considerably.

While here, remove the 'valid' member of the SSL_CIPHER. The ssl3_ciphers[]
table is no longer mutable, meaning that ciphers cannot be disabled at
runtime (and we have `#if 0' if we want to do it at compile time).

Clean up the comments and add/update RFC references for cipher suites.

ok tb@
---
 src/lib/libssl/ssl_asn1.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

(limited to 'src/lib/libssl/ssl_asn1.c')

diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index ef34cbdb04..fcf4631a59 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_asn1.c,v 1.68 2024/07/20 04:04:23 jsing Exp $ */
+/* $OpenBSD: ssl_asn1.c,v 1.69 2024/07/22 14:47:15 jsing Exp $ */
 /*
  * Copyright (c) 2016 Joel Sing <jsing@openbsd.org>
  *
@@ -51,7 +51,6 @@ SSL_SESSION_encode(SSL_SESSION *s, unsigned char **out, size_t *out_len,
 	CBB peer_cert, sidctx, verify_result, hostname, lifetime, ticket, value;
 	unsigned char *peer_cert_bytes = NULL;
 	int len, rv = 0;
-	uint16_t cid;
 
 	if (!CBB_init(&cbb, 0))
 		goto err;
@@ -69,11 +68,10 @@ SSL_SESSION_encode(SSL_SESSION *s, unsigned char **out, size_t *out_len,
 	if (!CBB_add_asn1_uint64(&session, s->ssl_version))
 		goto err;
 
-	/* Cipher suite ID. */
-	cid = (uint16_t)(s->cipher_id & SSL3_CK_VALUE_MASK);
+	/* Cipher suite value. */
 	if (!CBB_add_asn1(&session, &cipher_suite, CBS_ASN1_OCTETSTRING))
 		goto err;
-	if (!CBB_add_u16(&cipher_suite, cid))
+	if (!CBB_add_u16(&cipher_suite, s->cipher_value))
 		goto err;
 
 	/* Session ID - zero length for a ticket. */
@@ -193,7 +191,7 @@ SSL_SESSION_ticket(SSL_SESSION *ss, unsigned char **out, size_t *out_len)
 	if (ss == NULL)
 		return 0;
 
-	if (ss->cipher_id == 0)
+	if (ss->cipher_value == 0)
 		return 0;
 
 	return SSL_SESSION_encode(ss, out, out_len, 1);
@@ -209,7 +207,7 @@ i2d_SSL_SESSION(SSL_SESSION *ss, unsigned char **pp)
 	if (ss == NULL)
 		return 0;
 
-	if (ss->cipher_id == 0)
+	if (ss->cipher_value == 0)
 		return 0;
 
 	if (!SSL_SESSION_encode(ss, &data, &data_len, 0))
@@ -244,7 +242,6 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
 	CBS hostname, ticket;
 	uint64_t version, tls_version, stime, timeout, verify_result, lifetime;
 	const unsigned char *peer_cert_bytes;
-	uint16_t cipher_value;
 	SSL_SESSION *s = NULL;
 	size_t data_len;
 	int present;
@@ -277,14 +274,13 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
 		goto err;
 	s->ssl_version = (int)tls_version;
 
-	/* Cipher suite. */
+	/* Cipher suite value. */
 	if (!CBS_get_asn1(&session, &cipher_suite, CBS_ASN1_OCTETSTRING))
 		goto err;
-	if (!CBS_get_u16(&cipher_suite, &cipher_value))
+	if (!CBS_get_u16(&cipher_suite, &s->cipher_value))
 		goto err;
 	if (CBS_len(&cipher_suite) != 0)
 		goto err;
-	s->cipher_id = SSL3_CK_ID | cipher_value;
 
 	/* Session ID. */
 	if (!CBS_get_asn1(&session, &session_id, CBS_ASN1_OCTETSTRING))
-- 
cgit v1.2.3-55-g6feb