ssl_ciph.c 19.2 KB
Newer Older
1
/* ssl/ssl_ciph.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include "objects.h"
61
#include "comp.h"
62 63 64 65 66 67 68 69 70 71 72
#include "ssl_locl.h"

#define SSL_ENC_DES_IDX		0
#define SSL_ENC_3DES_IDX	1
#define SSL_ENC_RC4_IDX		2
#define SSL_ENC_RC2_IDX		3
#define SSL_ENC_IDEA_IDX	4
#define SSL_ENC_eFZA_IDX	5
#define SSL_ENC_NULL_IDX	6
#define SSL_ENC_NUM_IDX		7

B
Ben Laurie 已提交
73
static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
74 75 76
	NULL,NULL,NULL,NULL,NULL,NULL,
	};

B
Ben Laurie 已提交
77
static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
78

79
#define SSL_MD_MD5_IDX	0
80 81
#define SSL_MD_SHA1_IDX	1
#define SSL_MD_NUM_IDX	2
B
Ben Laurie 已提交
82
static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={
83
	NULL,NULL,
84 85 86 87 88 89 90 91 92 93 94
	};

typedef struct cipher_sort_st
	{
	SSL_CIPHER *cipher;
	int pref;
	} CIPHER_SORT;

#define CIPHER_ADD	1
#define CIPHER_KILL	2
#define CIPHER_DEL	3
95
#define CIPHER_ORD	4
96 97 98 99 100 101

typedef struct cipher_choice_st
	{
	int type;
	unsigned long algorithms;
	unsigned long mask;
102
	long top;
103 104
	} CIPHER_CHOICE;

105 106 107 108 109 110 111 112
typedef struct cipher_order_st
	{
	SSL_CIPHER *cipher;
	int active;
	int dead;
	struct cipher_order_st *next,*prev;
	} CIPHER_ORDER;

113
static SSL_CIPHER cipher_aliases[]={
114 115
	/* Don't include eNULL unless specifically enabled */
	{0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, 0,SSL_ALL}, /* must be first */
116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147
	{0,SSL_TXT_kRSA,0,SSL_kRSA,  0,SSL_MKEY_MASK},
	{0,SSL_TXT_kDHr,0,SSL_kDHr,  0,SSL_MKEY_MASK},
	{0,SSL_TXT_kDHd,0,SSL_kDHd,  0,SSL_MKEY_MASK},
	{0,SSL_TXT_kEDH,0,SSL_kEDH,  0,SSL_MKEY_MASK},
	{0,SSL_TXT_kFZA,0,SSL_kFZA,  0,SSL_MKEY_MASK},
	{0,SSL_TXT_DH,	0,SSL_DH,    0,SSL_MKEY_MASK},
	{0,SSL_TXT_EDH,	0,SSL_EDH,   0,SSL_MKEY_MASK|SSL_AUTH_MASK},

	{0,SSL_TXT_aRSA,0,SSL_aRSA,  0,SSL_AUTH_MASK},
	{0,SSL_TXT_aDSS,0,SSL_aDSS,  0,SSL_AUTH_MASK},
	{0,SSL_TXT_aFZA,0,SSL_aFZA,  0,SSL_AUTH_MASK},
	{0,SSL_TXT_aNULL,0,SSL_aNULL,0,SSL_AUTH_MASK},
	{0,SSL_TXT_aDH, 0,SSL_aDH,   0,SSL_AUTH_MASK},
	{0,SSL_TXT_DSS,	0,SSL_DSS,   0,SSL_AUTH_MASK},

	{0,SSL_TXT_DES,	0,SSL_DES,   0,SSL_ENC_MASK},
	{0,SSL_TXT_3DES,0,SSL_3DES,  0,SSL_ENC_MASK},
	{0,SSL_TXT_RC4,	0,SSL_RC4,   0,SSL_ENC_MASK},
	{0,SSL_TXT_RC2,	0,SSL_RC2,   0,SSL_ENC_MASK},
	{0,SSL_TXT_IDEA,0,SSL_IDEA,  0,SSL_ENC_MASK},
	{0,SSL_TXT_eNULL,0,SSL_eNULL,0,SSL_ENC_MASK},
	{0,SSL_TXT_eFZA,0,SSL_eFZA,  0,SSL_ENC_MASK},

	{0,SSL_TXT_MD5,	0,SSL_MD5,   0,SSL_MAC_MASK},
	{0,SSL_TXT_SHA1,0,SSL_SHA1,  0,SSL_MAC_MASK},
	{0,SSL_TXT_SHA,	0,SSL_SHA,   0,SSL_MAC_MASK},

	{0,SSL_TXT_NULL,0,SSL_NULL,  0,SSL_ENC_MASK},
	{0,SSL_TXT_RSA,	0,SSL_RSA,   0,SSL_AUTH_MASK|SSL_MKEY_MASK},
	{0,SSL_TXT_ADH,	0,SSL_ADH,   0,SSL_AUTH_MASK|SSL_MKEY_MASK},
	{0,SSL_TXT_FZA,	0,SSL_FZA,   0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK},

B
Ben Laurie 已提交
148 149 150
	{0,SSL_TXT_EXP40, 0,SSL_EXP40, 0,SSL_EXP_MASK},
	{0,SSL_TXT_EXPORT,0,SSL_EXP40, 0,SSL_EXP_MASK},
	{0,SSL_TXT_EXP56, 0,SSL_EXP56, 0,SSL_EXP_MASK},
151 152 153 154
	{0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,SSL_SSL_MASK},
	{0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,SSL_SSL_MASK},
	{0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,SSL_SSL_MASK},
	{0,SSL_TXT_LOW,   0,SSL_LOW,   0,SSL_STRONG_MASK},
155
	{0,SSL_TXT_MEDIUM,0,SSL_MEDIUM,0,SSL_STRONG_MASK},
156
	{0,SSL_TXT_HIGH,  0,SSL_HIGH,  0,SSL_STRONG_MASK},
157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187
	};

static int init_ciphers=1;
static void load_ciphers();

static int cmp_by_name(a,b)
SSL_CIPHER **a,**b;
	{
	return(strcmp((*a)->name,(*b)->name));
	}

static void load_ciphers()
	{
	init_ciphers=0;
	ssl_cipher_methods[SSL_ENC_DES_IDX]= 
		EVP_get_cipherbyname(SN_des_cbc);
	ssl_cipher_methods[SSL_ENC_3DES_IDX]=
		EVP_get_cipherbyname(SN_des_ede3_cbc);
	ssl_cipher_methods[SSL_ENC_RC4_IDX]=
		EVP_get_cipherbyname(SN_rc4);
	ssl_cipher_methods[SSL_ENC_RC2_IDX]= 
		EVP_get_cipherbyname(SN_rc2_cbc);
	ssl_cipher_methods[SSL_ENC_IDEA_IDX]= 
		EVP_get_cipherbyname(SN_idea_cbc);

	ssl_digest_methods[SSL_MD_MD5_IDX]=
		EVP_get_digestbyname(SN_md5);
	ssl_digest_methods[SSL_MD_SHA1_IDX]=
		EVP_get_digestbyname(SN_sha1);
	}

188 189
int ssl_cipher_get_evp(s,enc,md,comp)
SSL_SESSION *s;
B
Ben Laurie 已提交
190 191
const EVP_CIPHER **enc;
const EVP_MD **md;
192
SSL_COMP **comp;
193 194
	{
	int i;
195
	SSL_CIPHER *c;
196

197
	c=s->cipher;
198
	if (c == NULL) return(0);
199 200 201 202 203 204 205 206 207 208 209 210 211 212 213
	if (comp != NULL)
		{
		SSL_COMP ctmp;

		if (s->compress_meth == 0)
			*comp=NULL;
		else if (ssl_comp_methods == NULL)
			{
			/* bad */
			*comp=NULL;
			}
		else
			{

			ctmp.id=s->compress_meth;
B
Ben Laurie 已提交
214
			i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
215
			if (i >= 0)
B
Ben Laurie 已提交
216
				*comp=sk_SSL_COMP_value(ssl_comp_methods,i);
217 218 219 220 221 222
			else
				*comp=NULL;
			}
		}

	if ((enc == NULL) || (md == NULL)) return(0);
223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281

	switch (c->algorithms & SSL_ENC_MASK)
		{
	case SSL_DES:
		i=SSL_ENC_DES_IDX;
		break;
	case SSL_3DES:
		i=SSL_ENC_3DES_IDX;
		break;
	case SSL_RC4:
		i=SSL_ENC_RC4_IDX;
		break;
	case SSL_RC2:
		i=SSL_ENC_RC2_IDX;
		break;
	case SSL_IDEA:
		i=SSL_ENC_IDEA_IDX;
		break;
	case SSL_eNULL:
		i=SSL_ENC_NULL_IDX;
		break;
	default:
		i= -1;
		break;
		}

	if ((i < 0) || (i > SSL_ENC_NUM_IDX))
		*enc=NULL;
	else
		{
		if (i == SSL_ENC_NULL_IDX)
			*enc=EVP_enc_null();
		else
			*enc=ssl_cipher_methods[i];
		}

	switch (c->algorithms & SSL_MAC_MASK)
		{
	case SSL_MD5:
		i=SSL_MD_MD5_IDX;
		break;
	case SSL_SHA1:
		i=SSL_MD_SHA1_IDX;
		break;
	default:
		i= -1;
		break;
		}
	if ((i < 0) || (i > SSL_MD_NUM_IDX))
		*md=NULL;
	else
		*md=ssl_digest_methods[i];

	if ((*enc != NULL) && (*md != NULL))
		return(1);
	else
		return(0);
	}

282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300
#define ITEM_SEP(a) \
	(((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))

static void ll_append_tail(head,curr,tail)
CIPHER_ORDER **head,*curr,**tail;
	{
	if (curr == *tail) return;
	if (curr == *head)
		*head=curr->next;
	if (curr->prev != NULL)
		curr->prev->next=curr->next;
	if (curr->next != NULL) /* should always be true */
		curr->next->prev=curr->prev;
	(*tail)->next=curr;
	curr->prev= *tail;
	curr->next=NULL;
	*tail=curr;
	}

B
Ben Laurie 已提交
301 302
STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(ssl_method,cipher_list,
					     cipher_list_by_id,str)
303
SSL_METHOD *ssl_method;
B
Ben Laurie 已提交
304
STACK_OF(SSL_CIPHER) **cipher_list,**cipher_list_by_id;
305 306 307 308
char *str;
	{
	SSL_CIPHER *c;
	char *l;
B
Ben Laurie 已提交
309
	STACK_OF(SSL_CIPHER) *ret=NULL,*ok=NULL;
310 311 312 313 314 315 316 317
#define CL_BUF	40
	char buf[CL_BUF];
	char *tmp_str=NULL;
	unsigned long mask,algorithms,ma;
	char *start;
	int i,j,k,num=0,ch,multi;
	unsigned long al;
	STACK *ca_list=NULL;
318
	int current_x,num_x;
319
	CIPHER_CHOICE *ops=NULL;
320 321 322
	CIPHER_ORDER *list=NULL,*head=NULL,*tail=NULL,*curr,*tail2,*curr2;
	int list_num;
	int type;
323 324 325 326 327 328 329 330 331 332 333 334 335
	SSL_CIPHER c_tmp,*cp;

	if (str == NULL) return(NULL);

	if (strncmp(str,"DEFAULT",7) == 0)
		{
		i=strlen(str)+2+strlen(SSL_DEFAULT_CIPHER_LIST);
		if ((tmp_str=Malloc(i)) == NULL)
			{
			SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
			goto err;
			}
		strcpy(tmp_str,SSL_DEFAULT_CIPHER_LIST);
336
		strcat(tmp_str,":");
337 338 339 340 341 342 343
		strcat(tmp_str,&(str[7]));
		str=tmp_str;
		}
	if (init_ciphers) load_ciphers();

	num=ssl_method->num_ciphers();

B
Ben Laurie 已提交
344
	if ((ret=sk_SSL_CIPHER_new(NULL)) == NULL) goto err;
345 346 347 348 349 350 351 352 353 354 355 356 357
	if ((ca_list=(STACK *)sk_new(cmp_by_name)) == NULL) goto err;

	mask =SSL_kFZA;
#ifdef NO_RSA
	mask|=SSL_aRSA|SSL_kRSA;
#endif
#ifdef NO_DSA
	mask|=SSL_aDSS;
#endif
#ifdef NO_DH
	mask|=SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
#endif

B
Ben Laurie 已提交
358
#ifdef SSL_FORBID_ENULL
359 360 361 362 363 364 365 366 367 368 369 370 371
	mask|=SSL_eNULL;
#endif

	mask|=(ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL)?SSL_DES :0;
	mask|=(ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL)?SSL_3DES:0;
	mask|=(ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL)?SSL_RC4 :0;
	mask|=(ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL)?SSL_RC2 :0;
	mask|=(ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL)?SSL_IDEA:0;
	mask|=(ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL)?SSL_eFZA:0;

	mask|=(ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL)?SSL_MD5 :0;
	mask|=(ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL)?SSL_SHA1:0;

372 373 374
	if ((list=(CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER)*num)) == NULL)
		goto err;

375
	/* Get the initial list of ciphers */
376
	list_num=0;
377 378 379 380 381 382
	for (i=0; i<num; i++)
		{
		c=ssl_method->get_cipher((unsigned int)i);
		/* drop those that use any of that is not available */
		if ((c != NULL) && c->valid && !(c->algorithms & mask))
			{
383 384 385 386 387
			list[list_num].cipher=c;
			list[list_num].next=NULL;
			list[list_num].prev=NULL;
			list[list_num].active=0;
			list_num++;
388 389 390
			if (!sk_push(ca_list,(char *)c)) goto err;
			}
		}
391 392 393 394 395 396 397 398 399 400 401 402 403 404 405
	
	for (i=1; i<list_num-1; i++)
		{
		list[i].prev= &(list[i-1]);
		list[i].next= &(list[i+1]);
		}
	if (list_num > 0)
		{
		head= &(list[0]);
		head->prev=NULL;
		head->next= &(list[1]);
		tail= &(list[list_num-1]);
		tail->prev= &(list[list_num-2]);
		tail->next=NULL;
		}
406 407

	/* special case */
408
	cipher_aliases[0].algorithms &= ~mask;
409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425

	/* get the aliases */
	k=sizeof(cipher_aliases)/sizeof(SSL_CIPHER);
	for (j=0; j<k; j++)
		{
		al=cipher_aliases[j].algorithms;
		/* Drop those that are not relevent */
		if ((al & mask) == al) continue;
		if (!sk_push(ca_list,(char *)&(cipher_aliases[j]))) goto err;
		}

	/* ca_list now holds a 'stack' of SSL_CIPHERS, some real, some
	 * 'aliases' */

	/* how many parameters are there? */
	num=1;
	for (l=str; *l; l++)
426 427
		if (ITEM_SEP(*l))
			num++;
428 429 430 431 432 433 434 435 436 437 438 439
	ops=(CIPHER_CHOICE *)Malloc(sizeof(CIPHER_CHOICE)*num);
	if (ops == NULL) goto err;
	memset(ops,0,sizeof(CIPHER_CHOICE)*num);

	/* we now parse the input string and create our operations */
	l=str;
	i=0;
	current_x=0;

	for (;;)
		{
		ch= *l;
440 441 442

		if (ch == '\0') break;

443 444 445
		if (ch == '-')
			{ j=CIPHER_DEL; l++; }
		else if (ch == '+')
446
			{ j=CIPHER_ORD; l++; }
447 448 449 450 451
		else if (ch == '!')
			{ j=CIPHER_KILL; l++; }
		else	
			{ j=CIPHER_ADD; }

452
		if (ITEM_SEP(ch))
453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478
			{
			l++;
			continue;
			}
		ops[current_x].type=j;
		ops[current_x].algorithms=0;
		ops[current_x].mask=0;

		start=l;
		for (;;)
			{
			ch= *l;
			i=0;
			while (	((ch >= 'A') && (ch <= 'Z')) ||
				((ch >= '0') && (ch <= '9')) ||
				((ch >= 'a') && (ch <= 'z')) ||
				 (ch == '-'))
				 {
				 buf[i]=ch;
				 ch= *(++l);
				 i++;
				 if (i >= (CL_BUF-2)) break;
				 }
			buf[i]='\0';

			/* check for multi-part specification */
479 480 481 482 483 484 485
			if (ch == '+')
				{
				multi=1;
				l++;
				}
			else
				multi=0;
486 487 488 489

			c_tmp.name=buf;
			j=sk_find(ca_list,(char *)&c_tmp);
			if (j < 0)
490
				goto end_loop;
491 492 493 494 495 496 497 498 499 500

			cp=(SSL_CIPHER *)sk_value(ca_list,j);
			ops[current_x].algorithms|=cp->algorithms;
			/* We add the SSL_SSL_MASK so we can match the
			 * SSLv2 and SSLv3 versions of RC4-MD5 */
			ops[current_x].mask|=cp->mask;
			if (!multi) break;
			}
		current_x++;
		if (ch == '\0') break;
501 502 503 504
end_loop:
		/* Make sure we scan until the next valid start point */
		while ((*l != '\0') && ITEM_SEP(*l))
			l++;
505 506 507 508 509
		}

	num_x=current_x;
	current_x=0;

510 511 512
	/* We will now process the list of ciphers, once for each category, to
	 * decide what we should do with it. */
	for (j=0; j<num_x; j++)
513
		{
514 515 516 517 518 519 520 521
		algorithms=ops[j].algorithms;
		type=ops[j].type;
		mask=ops[j].mask;

		curr=head;
		curr2=head;
		tail2=tail;
		for (;;)
522
			{
523 524 525 526 527 528
			if ((curr == NULL) || (curr == tail2)) break;
			curr=curr2;
			curr2=curr->next;

			cp=curr->cipher;
			ma=mask & cp->algorithms;
529 530
			if ((ma == 0) || ((ma & algorithms) != ma))
				{
531
				/* does not apply */
532 533 534 535
				continue;
				}

			/* add the cipher if it has not been added yet. */
536
			if (type == CIPHER_ADD)
537
				{
538
				if (!curr->active)
539
					{
540 541
					ll_append_tail(&head,curr,&tail);
					curr->active=1;
542 543 544
					}
				}
			/* Move the added cipher to this location */
545
			else if (type == CIPHER_ORD)
546
				{
547
				if (curr->active)
548
					{
549
					ll_append_tail(&head,curr,&tail);
550 551
					}
				}
552 553 554
			else if	(type == CIPHER_DEL)
				curr->active=0;
			if (type == CIPHER_KILL)
555
				{
556 557 558 559 560 561 562 563 564 565 566 567 568
				if (head == curr)
					head=curr->next;
				else
					curr->prev->next=curr->next;
				if (tail == curr)
					tail=curr->prev;
				curr->active=0;
				if (curr->next != NULL)
					curr->next->prev=curr->prev;
				if (curr->prev != NULL)
					curr->prev->next=curr->next;
				curr->next=NULL;
				curr->prev=NULL;
569 570 571 572
				}
			}
		}

573
	for (curr=head; curr != NULL; curr=curr->next)
574
		{
575
		if (curr->active)
576
			{
B
Ben Laurie 已提交
577
			sk_SSL_CIPHER_push(ret,curr->cipher);
578
#ifdef CIPHER_DEBUG
579
			printf("<%s>\n",curr->cipher->name);
580 581 582 583 584 585 586
#endif
			}
		}

	if (cipher_list != NULL)
		{
		if (*cipher_list != NULL)
B
Ben Laurie 已提交
587
			sk_SSL_CIPHER_free(*cipher_list);
588 589 590 591 592 593
		*cipher_list=ret;
		}

	if (cipher_list_by_id != NULL)
		{
		if (*cipher_list_by_id != NULL)
B
Ben Laurie 已提交
594 595
			sk_SSL_CIPHER_free(*cipher_list_by_id);
		*cipher_list_by_id=sk_SSL_CIPHER_dup(ret);
596 597 598 599 600 601 602
		}

	if (	(cipher_list_by_id == NULL) ||
		(*cipher_list_by_id == NULL) ||
		(cipher_list == NULL) ||
		(*cipher_list == NULL))
		goto err;
B
Ben Laurie 已提交
603
	sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
604 605 606 607 608

	ok=ret;
	ret=NULL;
err:
	if (tmp_str) Free(tmp_str);
609
	if (ops != NULL) Free(ops);
B
Ben Laurie 已提交
610
	if (ret != NULL) sk_SSL_CIPHER_free(ret);
611
	if (ca_list != NULL) sk_free(ca_list);
612
	if (list != NULL) Free(list);
613 614 615 616 617 618 619 620
	return(ok);
	}

char *SSL_CIPHER_description(cipher,buf,len)
SSL_CIPHER *cipher;
char *buf;
int len;
	{
621
        int is_export,pkl,kl;
622 623 624 625 626 627 628 629
	char *ver,*exp;
	char *kx,*au,*enc,*mac;
	unsigned long alg,alg2;
	static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
	
	alg=cipher->algorithms;
	alg2=cipher->algorithm2;

630
        is_export=SSL_IS_EXPORT(alg);
631 632
	pkl=SSL_EXPORT_PKEYLENGTH(alg);
	kl=SSL_EXPORT_KEYLENGTH(alg);
633
        exp=is_export?" export":"";
634 635 636 637 638 639 640 641 642 643 644

	if (alg & SSL_SSLV2)
		ver="SSLv2";
	else if (alg & SSL_SSLV3)
		ver="SSLv3";
	else
		ver="unknown";

	switch (alg&SSL_MKEY_MASK)
		{
	case SSL_kRSA:
645
                kx=is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA";
646 647 648 649 650 651 652 653 654 655 656
		break;
	case SSL_kDHr:
		kx="DH/RSA";
		break;
	case SSL_kDHd:
		kx="DH/DSS";
		break;
	case SSL_kFZA:
		kx="Fortezza";
		break;
	case SSL_kEDH:
657
                kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH";
658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685
		break;
	default:
		kx="unknown";
		}

	switch (alg&SSL_AUTH_MASK)
		{
	case SSL_aRSA:
		au="RSA";
		break;
	case SSL_aDSS:
		au="DSS";
		break;
	case SSL_aDH:
		au="DH";
		break;
	case SSL_aFZA:
	case SSL_aNULL:
		au="None";
		break;
	default:
		au="unknown";
		break;
		}

	switch (alg&SSL_ENC_MASK)
		{
	case SSL_DES:
686
                enc=(is_export && kl == 5)?"DES(40)":"DES(56)";
687 688 689 690 691
		break;
	case SSL_3DES:
		enc="3DES(168)";
		break;
	case SSL_RC4:
692
                enc=is_export?(kl == 5 ? "RC4(40)" : "RC4(56)")
693
		  :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)");
694 695
		break;
	case SSL_RC2:
696
                enc=is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)";
697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741
		break;
	case SSL_IDEA:
		enc="IDEA(128)";
		break;
	case SSL_eFZA:
		enc="Fortezza";
		break;
	case SSL_eNULL:
		enc="None";
		break;
	default:
		enc="unknown";
		break;
		}

	switch (alg&SSL_MAC_MASK)
		{
	case SSL_MD5:
		mac="MD5";
		break;
	case SSL_SHA1:
		mac="SHA1";
		break;
	default:
		mac="unknown";
		break;
		}

	if (buf == NULL)
		{
		buf=Malloc(128);
		if (buf == NULL) return("Malloc Error");
		}
	else if (len < 128)
		return("Buffer too small");

	sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp);
	return(buf);
	}

char *SSL_CIPHER_get_version(c)
SSL_CIPHER *c;
	{
	int i;

742
	if (c == NULL) return("(NONE)");
743 744
	i=(int)(c->id>>24L);
	if (i == 3)
745
		return("TLSv1/SSLv3");
746 747 748 749 750 751 752
	else if (i == 2)
		return("SSLv2");
	else
		return("unknown");
	}

/* return the actual cipher being used */
B
Ben Laurie 已提交
753
const char *SSL_CIPHER_get_name(c)
754 755 756 757 758 759 760 761 762 763 764 765 766
SSL_CIPHER *c;
	{
	if (c != NULL)
		return(c->name);
	return("(NONE)");
	}

/* number of bits for symetric cipher */
int SSL_CIPHER_get_bits(c,alg_bits)
SSL_CIPHER *c;
int *alg_bits;
	{
	int ret=0,a=0;
B
Ben Laurie 已提交
767 768
	const EVP_CIPHER *enc;
	const EVP_MD *md;
769
	SSL_SESSION ss;
770 771 772

	if (c != NULL)
		{
773 774
		ss.cipher=c;
		if (!ssl_cipher_get_evp(&ss,&enc,&md,NULL))
775 776 777 778
			return(0);

		a=EVP_CIPHER_key_length(enc)*8;

779
		if (SSL_C_IS_EXPORT(c))
780
			{
781
			ret=SSL_C_EXPORT_KEYLENGTH(c)*8;
782 783 784 785 786 787 788 789 790 791 792 793 794 795 796
			}
		else
			{
			if (c->algorithm2 & SSL2_CF_8_BYTE_ENC)
				ret=64;
			else
				ret=a;
			}
		}

	if (alg_bits != NULL) *alg_bits=a;
	
	return(ret);
	}

797
SSL_COMP *ssl3_comp_find(sk,n)
B
Ben Laurie 已提交
798
STACK_OF(SSL_COMP) *sk;
799 800 801 802 803 804
int n;
	{
	SSL_COMP *ctmp;
	int i,nn;

	if ((n == 0) || (sk == NULL)) return(NULL);
B
Ben Laurie 已提交
805
	nn=sk_SSL_COMP_num(sk);
806 807
	for (i=0; i<nn; i++)
		{
B
Ben Laurie 已提交
808
		ctmp=sk_SSL_COMP_value(sk,i);
809 810 811 812 813 814
		if (ctmp->id == n)
			return(ctmp);
		}
	return(NULL);
	}

815
static int sk_comp_cmp(SSL_COMP **a,SSL_COMP **b)
816 817 818 819
	{
	return((*a)->id-(*b)->id);
	}

B
Ben Laurie 已提交
820
STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods()
821 822 823 824 825 826 827 828 829
	{
	return(ssl_comp_methods);
	}

int SSL_COMP_add_compression_method(id,cm)
int id;
COMP_METHOD *cm;
	{
	SSL_COMP *comp;
B
Ben Laurie 已提交
830
	STACK_OF(SSL_COMP) *sk;
831 832 833 834 835

	comp=(SSL_COMP *)Malloc(sizeof(SSL_COMP));
	comp->id=id;
	comp->method=cm;
	if (ssl_comp_methods == NULL)
B
Ben Laurie 已提交
836
		sk=ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
837 838
	else
		sk=ssl_comp_methods;
B
Ben Laurie 已提交
839
	if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
840 841 842 843 844 845 846 847
		{
		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
		return(0);
		}
	else
		return(1);
	}