Skip to content

O
openssl

btwise / openssl

通知 1
Star 0
Fork 0
O
openssl

体验新版 GitCode，发现更多精彩内容 >>

提交 55a9a16f 编写于 作者: M Matt Caswell
浏览文件
操作

Remove Kerberos support from libssl 

Remove RFC2712 Kerberos support from libssl. This code and the associated
standard is no longer considered fit-for-purpose.
Reviewed-by: NRich Salz <rsalz@openssl.org>
上级 5561419a
展开全部 隐藏空白更改
内联 并排
Showing with 839 addition and 4406 deletion
apps/Makefile
浏览文件 @ 55a9a16f
此差异已折叠。
crypto/evp/e_des3.c
浏览文件 @ 55a9a16f
......@@ -146,17 +146,6 @@ static int des_ede_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
{
DES_EDE_KEY *dat = data(ctx);
# ifdef KSSL_DEBUG
{
int i;
fprintf(stderr, "des_ede_cbc_cipher(ctx=%p, buflen=%d)\n", ctx,
ctx->buf_len);
fprintf(stderr, "\t iv= ");
for (i = 0; i < 8; i++)
fprintf(stderr, "%02X", ctx->iv[i]);
fprintf(stderr, "\n");
}
# endif /* KSSL_DEBUG */
if (dat->stream.cbc) {
(*dat->stream.cbc) (in, out, inl, &dat->ks, ctx->iv);
return 1;
......@@ -298,23 +287,6 @@ static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
DES_cblock *deskey = (DES_cblock *)key;
DES_EDE_KEY *dat = data(ctx);
# ifdef KSSL_DEBUG
{
int i;
fprintf(stderr, "des_ede3_init_key(ctx=%p)\n", ctx);
fprintf(stderr, "\tKEY= ");
for (i = 0; i < 24; i++)
fprintf(stderr, "%02X", key[i]);
fprintf(stderr, "\n");
if (iv) {
fprintf(stderr, "\t IV= ");
for (i = 0; i < 8; i++)
fprintf(stderr, "%02X", iv[i]);
fprintf(stderr, "\n");
}
}
# endif /* KSSL_DEBUG */
dat->stream.cbc = NULL;
# if defined(SPARC_DES_CAPABLE)
if (SPARC_DES_CAPABLE) {
......
include/openssl/kssl.h 已删除 100644 → 0
浏览文件 @ 5561419a
/* ssl/kssl.h -*- mode: C; c-file-style: "eay" -*- */
/*
* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project
* 2000. project 2000.
*/
/* ====================================================================
* Copyright (c) 2000 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/*
** 19990701 VRS Started.
*/
#ifndef KSSL_H
# define KSSL_H
# include <openssl/opensslconf.h>
# ifndef OPENSSL_NO_KRB5
# include <stdio.h>
# include <ctype.h>
# include <krb5.h>
# ifdef OPENSSL_SYS_WIN32
/*
* These can sometimes get redefined indirectly by krb5 header files after
* they get undefed in ossl_typ.h
*/
# undef X509_NAME
# undef X509_EXTENSIONS
# undef OCSP_REQUEST
# undef OCSP_RESPONSE
# endif
#ifdef __cplusplus
extern "C" {
#endif
/*
* Depending on which KRB5 implementation used, some types from
* the other may be missing. Resolve that here and now
*/
# ifdef KRB5_HEIMDAL
typedef unsigned char krb5_octet;
# define FAR
# else
# ifndef FAR
# define FAR
# endif
# endif
/*-
* Uncomment this to debug kssl problems or
* to trace usage of the Kerberos session key
*
* #define KSSL_DEBUG
*/
# ifndef KRB5SVC
# define KRB5SVC "host"
# endif
# ifndef KRB5KEYTAB
# define KRB5KEYTAB "/etc/krb5.keytab"
# endif
# ifndef KRB5SENDAUTH
# define KRB5SENDAUTH 1
# endif
# ifndef KRB5CHECKAUTH
# define KRB5CHECKAUTH 1
# endif
# ifndef KSSL_CLOCKSKEW
# define KSSL_CLOCKSKEW 300;
# endif
# define KSSL_ERR_MAX 255
typedef struct kssl_err_st {
int reason;
char text[KSSL_ERR_MAX + 1];
} KSSL_ERR;
/*- Context for passing
* (1) Kerberos session key to SSL, and
* (2) Config data between application and SSL lib
*/
typedef struct kssl_ctx_st {
/* used by: disposition: */
char *service_name; /* C,S default ok (kssl) */
char *service_host; /* C input, REQUIRED */
char *client_princ; /* S output from krb5 ticket */
char *keytab_file; /* S NULL (/etc/krb5.keytab) */
char *cred_cache; /* C NULL (default) */
krb5_enctype enctype;
int length;
krb5_octet FAR *key;
} KSSL_CTX;
# define KSSL_CLIENT 1
# define KSSL_SERVER 2
# define KSSL_SERVICE 3
# define KSSL_KEYTAB 4
# define KSSL_CTX_OK 0
# define KSSL_CTX_ERR 1
# define KSSL_NOMEM 2
/* Public (for use by applications that use OpenSSL with Kerberos 5 support */
krb5_error_code kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text);
KSSL_CTX *kssl_ctx_new(void);
KSSL_CTX *kssl_ctx_free(KSSL_CTX *kssl_ctx);
void kssl_ctx_show(KSSL_CTX *kssl_ctx);
krb5_error_code kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
krb5_data *realm, krb5_data *entity,
int nentities);
krb5_error_code kssl_cget_tkt(KSSL_CTX *kssl_ctx, krb5_data **enc_tktp,
krb5_data *authenp, KSSL_ERR *kssl_err);
krb5_error_code kssl_sget_tkt(KSSL_CTX *kssl_ctx, krb5_data *indata,
krb5_ticket_times *ttimes, KSSL_ERR *kssl_err);
krb5_error_code kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session);
void kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text);
void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data);
krb5_error_code kssl_build_principal_2(krb5_context context,
krb5_principal *princ, int rlen,
const char *realm, int slen,
const char *svc, int hlen,
const char *host);
krb5_error_code kssl_validate_times(krb5_timestamp atime,
krb5_ticket_times *ttimes);
krb5_error_code kssl_check_authent(KSSL_CTX *kssl_ctx, krb5_data *authentp,
krb5_timestamp *atimep,
KSSL_ERR *kssl_err);
unsigned char *kssl_skip_confound(krb5_enctype enctype, unsigned char *authn);
void SSL_set0_kssl_ctx(SSL *s, KSSL_CTX *kctx);
KSSL_CTX *SSL_get0_kssl_ctx(SSL *s);
char *kssl_ctx_get0_client_princ(KSSL_CTX *kctx);
#ifdef __cplusplus
}
#endif
# endif /* OPENSSL_NO_KRB5 */
#endif /* KSSL_H */
include/openssl/ssl.h
浏览文件 @ 55a9a16f
......@@ -156,7 +156,6 @@
# include <openssl/pem.h>
# include <openssl/hmac.h>
# include <openssl/kssl.h>
# include <openssl/safestack.h>
# include <openssl/symhacks.h>
......@@ -171,35 +170,6 @@ extern "C" {
*/
# define SSL_SESSION_ASN1_VERSION 0x0001
/* text strings for the ciphers */
/*
* VRS Additional Kerberos5 entries
*/
# define SSL_TXT_KRB5_DES_64_CBC_SHA SSL3_TXT_KRB5_DES_64_CBC_SHA
# define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA
# define SSL_TXT_KRB5_RC4_128_SHA SSL3_TXT_KRB5_RC4_128_SHA
# define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA
# define SSL_TXT_KRB5_DES_64_CBC_MD5 SSL3_TXT_KRB5_DES_64_CBC_MD5
# define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5
# define SSL_TXT_KRB5_RC4_128_MD5 SSL3_TXT_KRB5_RC4_128_MD5
# define SSL_TXT_KRB5_IDEA_128_CBC_MD5 SSL3_TXT_KRB5_IDEA_128_CBC_MD5
# define SSL_TXT_KRB5_DES_40_CBC_SHA SSL3_TXT_KRB5_DES_40_CBC_SHA
# define SSL_TXT_KRB5_RC2_40_CBC_SHA SSL3_TXT_KRB5_RC2_40_CBC_SHA
# define SSL_TXT_KRB5_RC4_40_SHA SSL3_TXT_KRB5_RC4_40_SHA
# define SSL_TXT_KRB5_DES_40_CBC_MD5 SSL3_TXT_KRB5_DES_40_CBC_MD5
# define SSL_TXT_KRB5_RC2_40_CBC_MD5 SSL3_TXT_KRB5_RC2_40_CBC_MD5
# define SSL_TXT_KRB5_RC4_40_MD5 SSL3_TXT_KRB5_RC4_40_MD5
# define SSL_TXT_KRB5_DES_40_CBC_SHA SSL3_TXT_KRB5_DES_40_CBC_SHA
# define SSL_TXT_KRB5_DES_40_CBC_MD5 SSL3_TXT_KRB5_DES_40_CBC_MD5
# define SSL_TXT_KRB5_DES_64_CBC_SHA SSL3_TXT_KRB5_DES_64_CBC_SHA
# define SSL_TXT_KRB5_DES_64_CBC_MD5 SSL3_TXT_KRB5_DES_64_CBC_MD5
# define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA
# define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5
# define SSL_MAX_KRB5_PRINCIPAL_LENGTH 256
# define SSL_MAX_SSL_SESSION_ID_LENGTH 32
# define SSL_MAX_SID_CTX_LENGTH 32
......@@ -207,6 +177,8 @@ extern "C" {
# define SSL_MAX_KEY_ARG_LENGTH 8
# define SSL_MAX_MASTER_KEY_LENGTH 48
/* text strings for the ciphers */
/* These are used to specify which ciphers to use and not to use */
# define SSL_TXT_EXP40 "EXPORT40"
......@@ -226,7 +198,6 @@ extern "C" {
# define SSL_TXT_kDH "kDH"
# define SSL_TXT_kEDH "kEDH"/* alias for kDHE */
# define SSL_TXT_kDHE "kDHE"
# define SSL_TXT_kKRB5 "kKRB5"
# define SSL_TXT_kECDHr "kECDHr"
# define SSL_TXT_kECDHe "kECDHe"
# define SSL_TXT_kECDH "kECDH"
......@@ -240,7 +211,6 @@ extern "C" {
# define SSL_TXT_aDSS "aDSS"
# define SSL_TXT_aDH "aDH"
# define SSL_TXT_aECDH "aECDH"
# define SSL_TXT_aKRB5 "aKRB5"
# define SSL_TXT_aECDSA "aECDSA"
# define SSL_TXT_aPSK "aPSK"
# define SSL_TXT_aGOST94 "aGOST94"
......@@ -259,7 +229,6 @@ extern "C" {
# define SSL_TXT_ECDHE "ECDHE"/* same as "kECDHE:-AECDH" */
# define SSL_TXT_AECDH "AECDH"
# define SSL_TXT_ECDSA "ECDSA"
# define SSL_TXT_KRB5 "KRB5"
# define SSL_TXT_PSK "PSK"
# define SSL_TXT_SRP "SRP"
......@@ -2238,17 +2207,6 @@ void ERR_load_SSL_strings(void);
# define SSL_R_INVALID_STATUS_RESPONSE 328
# define SSL_R_INVALID_TICKET_KEYS_LENGTH 325
# define SSL_R_INVALID_TRUST 279
# define SSL_R_KRB5 285
# define SSL_R_KRB5_C_CC_PRINC 286
# define SSL_R_KRB5_C_GET_CRED 287
# define SSL_R_KRB5_C_INIT 288
# define SSL_R_KRB5_C_MK_REQ 289
# define SSL_R_KRB5_S_BAD_TICKET 290
# define SSL_R_KRB5_S_INIT 291
# define SSL_R_KRB5_S_RD_REQ 292
# define SSL_R_KRB5_S_TKT_EXPIRED 293
# define SSL_R_KRB5_S_TKT_NYV 294
# define SSL_R_KRB5_S_TKT_SKEW 295
# define SSL_R_LENGTH_MISMATCH 159
# define SSL_R_LENGTH_TOO_SHORT 160
# define SSL_R_LIBRARY_BUG 274
......
include/openssl/ssl3.h
浏览文件 @ 55a9a16f
......@@ -177,25 +177,6 @@ extern "C" {
# define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A
# define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B
/*
* VRS Additional Kerberos5 entries
*/
# define SSL3_CK_KRB5_DES_64_CBC_SHA 0x0300001E
# define SSL3_CK_KRB5_DES_192_CBC3_SHA 0x0300001F
# define SSL3_CK_KRB5_RC4_128_SHA 0x03000020
# define SSL3_CK_KRB5_IDEA_128_CBC_SHA 0x03000021
# define SSL3_CK_KRB5_DES_64_CBC_MD5 0x03000022
# define SSL3_CK_KRB5_DES_192_CBC3_MD5 0x03000023
# define SSL3_CK_KRB5_RC4_128_MD5 0x03000024
# define SSL3_CK_KRB5_IDEA_128_CBC_MD5 0x03000025
# define SSL3_CK_KRB5_DES_40_CBC_SHA 0x03000026
# define SSL3_CK_KRB5_RC2_40_CBC_SHA 0x03000027
# define SSL3_CK_KRB5_RC4_40_SHA 0x03000028
# define SSL3_CK_KRB5_DES_40_CBC_MD5 0x03000029
# define SSL3_CK_KRB5_RC2_40_CBC_MD5 0x0300002A
# define SSL3_CK_KRB5_RC4_40_MD5 0x0300002B
# define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5"
# define SSL3_TXT_RSA_NULL_SHA "NULL-SHA"
# define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5"
......@@ -239,22 +220,6 @@ extern "C" {
# define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA"
# define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA"
# define SSL3_TXT_KRB5_DES_64_CBC_SHA "KRB5-DES-CBC-SHA"
# define SSL3_TXT_KRB5_DES_192_CBC3_SHA "KRB5-DES-CBC3-SHA"
# define SSL3_TXT_KRB5_RC4_128_SHA "KRB5-RC4-SHA"
# define SSL3_TXT_KRB5_IDEA_128_CBC_SHA "KRB5-IDEA-CBC-SHA"
# define SSL3_TXT_KRB5_DES_64_CBC_MD5 "KRB5-DES-CBC-MD5"
# define SSL3_TXT_KRB5_DES_192_CBC3_MD5 "KRB5-DES-CBC3-MD5"
# define SSL3_TXT_KRB5_RC4_128_MD5 "KRB5-RC4-MD5"
# define SSL3_TXT_KRB5_IDEA_128_CBC_MD5 "KRB5-IDEA-CBC-MD5"
# define SSL3_TXT_KRB5_DES_40_CBC_SHA "EXP-KRB5-DES-CBC-SHA"
# define SSL3_TXT_KRB5_RC2_40_CBC_SHA "EXP-KRB5-RC2-CBC-SHA"
# define SSL3_TXT_KRB5_RC4_40_SHA "EXP-KRB5-RC4-SHA"
# define SSL3_TXT_KRB5_DES_40_CBC_MD5 "EXP-KRB5-DES-CBC-MD5"
# define SSL3_TXT_KRB5_RC2_40_CBC_MD5 "EXP-KRB5-RC2-CBC-MD5"
# define SSL3_TXT_KRB5_RC4_40_MD5 "EXP-KRB5-RC4-MD5"
# define SSL3_SSL_SESSION_ID_LENGTH 32
# define SSL3_MAX_SSL_SESSION_ID_LENGTH 32
......
ssl/Makefile
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/d1_clnt.c
浏览文件 @ 55a9a16f
......@@ -115,9 +115,6 @@
#include <stdio.h>
#include "ssl_locl.h"
#ifndef OPENSSL_NO_KRB5
# include "kssl_lcl.h"
#endif
#include <openssl/buffer.h>
#include <openssl/rand.h>
#include <openssl/objects.h>
......
ssl/d1_srvr.c
浏览文件 @ 55a9a16f
......@@ -526,16 +526,12 @@ int dtls1_accept(SSL *s)
* RFC 2246):
*/
((s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
/*
* ... except when the application insists on
* verification (against the specs, but s3_clnt.c accepts
* this for SSL 3)
*/
!(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
/*
* never request cert in Kerberos ciphersuites
* ... except when the application insists on
* verification (against the specs, but s3_clnt.c accepts
* this for SSL 3)
*/
(s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5)
!(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
/*
* With normal PSK Certificates and Certificate Requests
* are omitted
......
ssl/install-ssl.com
浏览文件 @ 55a9a16f
......@@ -70,7 +70,7 @@ $ if f$parse("wrk_sslinclude:") .eqs. "" then -
$ if f$parse("wrk_sslxlib:") .eqs. "" then -
create /directory /log wrk_sslxlib:
$!
$ exheader := ssl.h, ssl2.h, ssl3.h, ssl23.h, tls1.h, dtls1.h, kssl.h, srtp.h
$ exheader := ssl.h, ssl2.h, ssl3.h, ssl23.h, tls1.h, dtls1.h, srtp.h
$ libs := ssl_libssl
$!
$ xexe_dir := [-.'archd'.exe.ssl]
......
ssl/kssl.c 已删除 100644 → 0
浏览文件 @ 5561419a
此差异已折叠。
ssl/kssl_lcl.h 已删除 100644 → 0
浏览文件 @ 5561419a
/* ssl/kssl.h -*- mode: C; c-file-style: "eay" -*- */
/*
* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project
* 2000. project 2000.
*/
/* ====================================================================
* Copyright (c) 2000 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
#ifndef KSSL_LCL_H
# define KSSL_LCL_H
# include <openssl/kssl.h>
# ifndef OPENSSL_NO_KRB5
#ifdef __cplusplus
extern "C" {
#endif
/* Private (internal to OpenSSL) */
void print_krb5_data(char *label, krb5_data *kdata);
void print_krb5_authdata(char *label, krb5_authdata **adata);
void print_krb5_keyblock(char *label, krb5_keyblock *keyblk);
char *kstring(char *string);
char *knumber(int len, krb5_octet *contents);
const EVP_CIPHER *kssl_map_enc(krb5_enctype enctype);
int kssl_keytab_is_available(KSSL_CTX *kssl_ctx);
int kssl_tgt_is_available(KSSL_CTX *kssl_ctx);
#ifdef __cplusplus
}
#endif
# endif /* OPENSSL_NO_KRB5 */
#endif /* KSSL_LCL_H */
ssl/record/ssl3_record.c
浏览文件 @ 55a9a16f
......@@ -644,10 +644,6 @@ int tls1_enc(SSL *s, int send)
enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
}
#ifdef KSSL_DEBUG
fprintf(stderr, "tls1_enc(%d)\n", send);
#endif /* KSSL_DEBUG */
if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
memmove(rec->data, rec->input, rec->length);
rec->input = rec->data;
......@@ -707,26 +703,6 @@ int tls1_enc(SSL *s, int send)
l += i;
rec->length += i;
}
#ifdef KSSL_DEBUG
{
unsigned long ui;
fprintf(stderr,
"EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
ds, rec->data, rec->input, l);
fprintf(stderr,
"\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%lu %lu], %d iv_len\n",
ds->buf_len, ds->cipher->key_len, DES_KEY_SZ,
DES_SCHEDULE_SZ, ds->cipher->iv_len);
fprintf(stderr, "\t\tIV: ");
for (i = 0; i < ds->cipher->iv_len; i++)
fprintf(stderr, "%02X", ds->iv[i]);
fprintf(stderr, "\n");
fprintf(stderr, "\trec->input=");
for (ui = 0; ui < l; ui++)
fprintf(stderr, " %02x", rec->input[ui]);
fprintf(stderr, "\n");
}
#endif /* KSSL_DEBUG */
if (!send) {
if (l == 0 || l % bs != 0)
......@@ -743,15 +719,6 @@ int tls1_enc(SSL *s, int send)
rec->input += EVP_GCM_TLS_EXPLICIT_IV_LEN;
rec->length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
}
#ifdef KSSL_DEBUG
{
unsigned long i;
fprintf(stderr, "\trec->data=");
for (i = 0; i < l; i++)
fprintf(stderr, " %02x", rec->data[i]);
fprintf(stderr, "\n");
}
#endif /* KSSL_DEBUG */
ret = 1;
if (!SSL_USE_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL)
......
ssl/s3_clnt.c
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/s3_lib.c
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/s3_srvr.c
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/ssl-lib.com
浏览文件 @ 55a9a16f
......@@ -215,7 +215,7 @@ $ LIB_SSL = "s3_meth, s3_srvr, s3_clnt, s3_lib, s3_enc,s3_pkt,s3_both,s3_cbc,"+
"ssl_lib,ssl_err2,ssl_cert,ssl_sess,"+ -
"ssl_ciph,ssl_stat,ssl_rsa,"+ -
"ssl_asn1,ssl_txt,ssl_algs,ssl_conf,"+ -
"bio_ssl,ssl_err,kssl,t1_reneg,tls_srp,t1_trce,ssl_utst"
"bio_ssl,ssl_err,t1_reneg,tls_srp,t1_trce,ssl_utst"
$!
$! Tell The User That We Are Compiling The Library.
$!
......
ssl/ssl_asn1.c
浏览文件 @ 55a9a16f
......@@ -95,9 +95,6 @@ typedef struct {
ASN1_OCTET_STRING *comp_id;
ASN1_OCTET_STRING *master_key;
ASN1_OCTET_STRING *session_id;
#ifndef OPENSSL_NO_KRB5
ASN1_OCTET_STRING *krb5_princ;
#endif
ASN1_OCTET_STRING *key_arg;
long time;
long timeout;
......@@ -125,9 +122,6 @@ ASN1_SEQUENCE(SSL_SESSION_ASN1) = {
ASN1_SIMPLE(SSL_SESSION_ASN1, cipher, ASN1_OCTET_STRING),
ASN1_SIMPLE(SSL_SESSION_ASN1, session_id, ASN1_OCTET_STRING),
ASN1_SIMPLE(SSL_SESSION_ASN1, master_key, ASN1_OCTET_STRING),
#ifndef OPENSSL_NO_KRB5
ASN1_OPT(SSL_SESSION_ASN1, krb5_princ, ASN1_OCTET_STRING),
#endif
ASN1_IMP_OPT(SSL_SESSION_ASN1, key_arg, ASN1_OCTET_STRING, 0),
ASN1_EXP_OPT(SSL_SESSION_ASN1, time, ZLONG, 1),
ASN1_EXP_OPT(SSL_SESSION_ASN1, timeout, ZLONG, 2),
......@@ -195,10 +189,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
ASN1_OCTET_STRING tlsext_hostname, tlsext_tick;
#endif
#ifndef OPENSSL_NO_KRB5
ASN1_OCTET_STRING krb5_princ;
#endif
#ifndef OPENSSL_NO_SRP
ASN1_OCTET_STRING srp_username;
#endif
......@@ -241,12 +231,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
ssl_session_oinit(&as.session_id_context, &sid_ctx,
in->sid_ctx, in->sid_ctx_length);
#ifndef OPENSSL_NO_KRB5
if (in->krb5_client_princ_len) {
ssl_session_oinit(&as.krb5_princ, &krb5_princ,
in->krb5_client_princ, in->krb5_client_princ_len);
}
#endif /* OPENSSL_NO_KRB5 */
as.time = in->time;
as.timeout = in->timeout;
......@@ -368,12 +352,6 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
ret->master_key_length = tmpl;
#ifndef OPENSSL_NO_KRB5
if (!ssl_session_memcpy(ret->krb5_client_princ, &ret->krb5_client_princ_len,
as->krb5_princ, SSL_MAX_KRB5_PRINCIPAL_LENGTH))
goto err;
#endif /* OPENSSL_NO_KRB5 */
if (as->time != 0)
ret->time = as->time;
else
......
ssl/ssl_ciph.c
浏览文件 @ 55a9a16f
......@@ -305,8 +305,6 @@ static const SSL_CIPHER cipher_aliases[] = {
{0, SSL_TXT_DH, 0, SSL_kDHr | SSL_kDHd | SSL_kDHE, 0, 0, 0, 0, 0, 0, 0,
0},
{0, SSL_TXT_kKRB5, 0, SSL_kKRB5, 0, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_kECDHr, 0, SSL_kECDHr, 0, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_kECDHe, 0, SSL_kECDHe, 0, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_kECDH, 0, SSL_kECDHr | SSL_kECDHe, 0, 0, 0, 0, 0, 0, 0, 0},
......@@ -323,7 +321,6 @@ static const SSL_CIPHER cipher_aliases[] = {
{0, SSL_TXT_aRSA, 0, 0, SSL_aRSA, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_aDSS, 0, 0, SSL_aDSS, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_DSS, 0, 0, SSL_aDSS, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_aKRB5, 0, 0, SSL_aKRB5, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_aNULL, 0, 0, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
/* no such ciphersuites supported! */
{0, SSL_TXT_aDH, 0, 0, SSL_aDH, 0, 0, 0, 0, 0, 0, 0},
......@@ -342,7 +339,6 @@ static const SSL_CIPHER cipher_aliases[] = {
{0, SSL_TXT_EECDH, 0, SSL_kECDHE, ~SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_ECDHE, 0, SSL_kECDHE, ~SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_NULL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_KRB5, 0, SSL_kKRB5, SSL_aKRB5, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_RSA, 0, SSL_kRSA, SSL_aRSA, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_ADH, 0, SSL_kDHE, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
{0, SSL_TXT_AECDH, 0, SSL_kECDHE, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
......@@ -693,10 +689,6 @@ static void ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth,
*mkey |= SSL_kDHr | SSL_kDHd | SSL_kDHE;
*auth |= SSL_aDH;
#endif
#ifdef OPENSSL_NO_KRB5
*mkey |= SSL_kKRB5;
*auth |= SSL_aKRB5;
#endif
#ifdef OPENSSL_NO_EC
*mkey |= SSL_kECDHe | SSL_kECDHr;
*auth |= SSL_aECDSA | SSL_aECDH;
......@@ -801,10 +793,6 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
co_list[co_list_num].prev = NULL;
co_list[co_list_num].active = 0;
co_list_num++;
#ifdef KSSL_DEBUG
fprintf(stderr, "\t%d: %s %lx %lx %lx\n", i, c->name, c->id,
c->algorithm_mkey, c->algorithm_auth);
#endif /* KSSL_DEBUG */
/*
* if (!sk_push(ca_list,(char *)c)) goto err;
*/
......@@ -1446,10 +1434,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK
* it is used for allocation.
*/
num_of_ciphers = ssl_method->num_ciphers();
#ifdef KSSL_DEBUG
fprintf(stderr, "ssl_create_cipher_list() for %d ciphers\n",
num_of_ciphers);
#endif /* KSSL_DEBUG */
co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);
if (co_list == NULL) {
SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
......@@ -1502,8 +1487,6 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK
&tail);
ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
&tail);
ssl_cipher_apply_rule(0, SSL_kKRB5, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
&tail);
/* RC4 is sort-of broken -- move the the end */
ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head,
......@@ -1616,13 +1599,8 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
const char *ver, *exp_str;
const char *kx, *au, *enc, *mac;
unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl;
#ifdef KSSL_DEBUG
static const char *format =
"%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx/%lx/%lx/%lx/%lx\n";
#else
static const char *format =
"%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
#endif /* KSSL_DEBUG */
alg_mkey = cipher->algorithm_mkey;
alg_auth = cipher->algorithm_auth;
......@@ -1652,9 +1630,6 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
case SSL_kDHd:
kx = "DH/DSS";
break;
case SSL_kKRB5:
kx = "KRB5";
break;
case SSL_kDHE:
kx = is_export ? (pkl == 512 ? "DH(512)" : "DH(1024)") : "DH";
break;
......@@ -1690,9 +1665,6 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
case SSL_aDH:
au = "DH";
break;
case SSL_aKRB5:
au = "KRB5";
break;
case SSL_aECDH:
au = "ECDH";
break;
......@@ -1802,13 +1774,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
} else if (len < 128)
return ("Buffer too small");
#ifdef KSSL_DEBUG
BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac,
exp_str, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl);
#else
BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac,
exp_str);
#endif /* KSSL_DEBUG */
return (buf);
}
......@@ -2000,9 +1968,6 @@ int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
return SSL_PKEY_DSA_SIGN;
else if (alg_a & SSL_aRSA)
return SSL_PKEY_RSA_ENC;
else if (alg_a & SSL_aKRB5)
/* VRS something else here? */
return -1;
else if (alg_a & SSL_aGOST94)
return SSL_PKEY_GOST94;
else if (alg_a & SSL_aGOST01)
......
ssl/ssl_err.c
浏览文件 @ 55a9a16f
......@@ -462,17 +462,6 @@ static ERR_STRING_DATA SSL_str_reasons[] = {
{ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH),
"invalid ticket keys length"},
{ERR_REASON(SSL_R_INVALID_TRUST), "invalid trust"},
{ERR_REASON(SSL_R_KRB5), "krb5"},
{ERR_REASON(SSL_R_KRB5_C_CC_PRINC), "krb5 client cc principal (no tkt?)"},
{ERR_REASON(SSL_R_KRB5_C_GET_CRED), "krb5 client get cred"},
{ERR_REASON(SSL_R_KRB5_C_INIT), "krb5 client init"},
{ERR_REASON(SSL_R_KRB5_C_MK_REQ), "krb5 client mk_req (expired tkt?)"},
{ERR_REASON(SSL_R_KRB5_S_BAD_TICKET), "krb5 server bad ticket"},
{ERR_REASON(SSL_R_KRB5_S_INIT), "krb5 server init"},
{ERR_REASON(SSL_R_KRB5_S_RD_REQ), "krb5 server rd_req (keytab perms?)"},
{ERR_REASON(SSL_R_KRB5_S_TKT_EXPIRED), "krb5 server tkt expired"},
{ERR_REASON(SSL_R_KRB5_S_TKT_NYV), "krb5 server tkt not yet valid"},
{ERR_REASON(SSL_R_KRB5_S_TKT_SKEW), "krb5 server tkt skew"},
{ERR_REASON(SSL_R_LENGTH_MISMATCH), "length mismatch"},
{ERR_REASON(SSL_R_LENGTH_TOO_SHORT), "length too short"},
{ERR_REASON(SSL_R_LIBRARY_BUG), "library bug"},
......
ssl/ssl_lib.c
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/ssl_locl.h
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/ssl_sess.c
浏览文件 @ 55a9a16f
......@@ -772,20 +772,6 @@ int SSL_set_session(SSL *s, SSL_SESSION *session)
if (!SSL_set_ssl_method(s, meth))
return (0);
}
#ifndef OPENSSL_NO_KRB5
if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
session->krb5_client_princ_len > 0) {
s->kssl_ctx->client_princ =
OPENSSL_malloc(session->krb5_client_princ_len + 1);
if (s->kssl_ctx->client_princ == NULL) {
SSLerr(SSL_F_SSL_SET_SESSION, ERR_R_MALLOC_FAILURE);
return (0);
}
memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
session->krb5_client_princ_len);
s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
}
#endif /* OPENSSL_NO_KRB5 */
/* CRYPTO_w_lock(CRYPTO_LOCK_SSL); */
CRYPTO_add(&session->references, 1, CRYPTO_LOCK_SSL_SESSION);
......
ssl/ssl_txt.c
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/t1_enc.c
浏览文件 @ 55a9a16f
此差异已折叠。
ssl/t1_lib.c
浏览文件 @ 55a9a16f
......@@ -1068,12 +1068,6 @@ void ssl_set_client_disabled(SSL *s)
c->mask_k |= SSL_kDHd;
if (c->mask_a & SSL_aECDSA)
c->mask_k |= SSL_kECDHe;
# ifndef OPENSSL_NO_KRB5
if (!kssl_tgt_is_available(s->kssl_ctx)) {
c->mask_a |= SSL_aKRB5;
c->mask_k |= SSL_kKRB5;
}
# endif
# ifndef OPENSSL_NO_PSK
/* with PSK there must be client callback set */
if (!s->psk_client_callback) {
......
ssl/t1_trce.c
浏览文件 @ 55a9a16f
此差异已折叠。
test/Makefile
浏览文件 @ 55a9a16f
此差异已折叠。
test/ssltest.c
浏览文件 @ 55a9a16f
此差异已折叠。
util/indent.pro
浏览文件 @ 55a9a16f
此差异已折叠。
util/mkdef.pl
浏览文件 @ 55a9a16f
此差异已折叠。
util/ssleay.num
浏览文件 @ 55a9a16f
此差异已折叠。
Markdown is supported
0% 或 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑！
想要评论请 注册 或