1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57 /* ====================================================================
58 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com).
108 *
109 */
110 /* ====================================================================
111 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
112 * ECC cipher suite support in OpenSSL originally developed by
113 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
114 */
115 /* ====================================================================
116 * Copyright 2005 Nokia. All rights reserved.
117 *
118 * The portions of the attached software ("Contribution") is developed by
119 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
120 * license.
121 *
122 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
123 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
124 * support (see RFC 4279) to OpenSSL.
125 *
126 * No patent licenses or other rights except those expressly stated in
127 * the OpenSSL open source license shall be deemed granted or received
128 * expressly, by implication, estoppel, or otherwise.
129 *
130 * No assurances are provided by Nokia that the Contribution does not
131 * infringe the patent or other intellectual property rights of any third
132 * party or that the license provides you with all the necessary rights
133 * to make use of the Contribution.
134 *
135 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
136 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
137 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
138 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
139 * OTHERWISE. */
140
141 #include <openssl/ssl.h>
142
143 #include <assert.h>
144 #include <string.h>
145
146 #include <openssl/buf.h>
147 #include <openssl/err.h>
148 #include <openssl/md5.h>
149 #include <openssl/mem.h>
150 #include <openssl/sha.h>
151 #include <openssl/stack.h>
152
153 #include "internal.h"
154 #include "../crypto/internal.h"
155
156
157 /* kCiphers is an array of all supported ciphers, sorted by id. */
158 static const SSL_CIPHER kCiphers[] = {
159 /* The RSA ciphers */
160 /* Cipher 02 */
161 {
162 SSL3_TXT_RSA_NULL_SHA,
163 "TLS_RSA_WITH_NULL_SHA",
164 SSL3_CK_RSA_NULL_SHA,
165 SSL_kRSA,
166 SSL_aRSA,
167 SSL_eNULL,
168 SSL_SHA1,
169 SSL_HANDSHAKE_MAC_DEFAULT,
170 },
171
172 /* Cipher 0A */
173 {
174 SSL3_TXT_RSA_DES_192_CBC3_SHA,
175 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
176 SSL3_CK_RSA_DES_192_CBC3_SHA,
177 SSL_kRSA,
178 SSL_aRSA,
179 SSL_3DES,
180 SSL_SHA1,
181 SSL_HANDSHAKE_MAC_DEFAULT,
182 },
183
184
185 /* New AES ciphersuites */
186
187 /* Cipher 2F */
188 {
189 TLS1_TXT_RSA_WITH_AES_128_SHA,
190 "TLS_RSA_WITH_AES_128_CBC_SHA",
191 TLS1_CK_RSA_WITH_AES_128_SHA,
192 SSL_kRSA,
193 SSL_aRSA,
194 SSL_AES128,
195 SSL_SHA1,
196 SSL_HANDSHAKE_MAC_DEFAULT,
197 },
198
199 /* Cipher 35 */
200 {
201 TLS1_TXT_RSA_WITH_AES_256_SHA,
202 "TLS_RSA_WITH_AES_256_CBC_SHA",
203 TLS1_CK_RSA_WITH_AES_256_SHA,
204 SSL_kRSA,
205 SSL_aRSA,
206 SSL_AES256,
207 SSL_SHA1,
208 SSL_HANDSHAKE_MAC_DEFAULT,
209 },
210
211
212 /* TLS v1.2 ciphersuites */
213
214 /* Cipher 3C */
215 {
216 TLS1_TXT_RSA_WITH_AES_128_SHA256,
217 "TLS_RSA_WITH_AES_128_CBC_SHA256",
218 TLS1_CK_RSA_WITH_AES_128_SHA256,
219 SSL_kRSA,
220 SSL_aRSA,
221 SSL_AES128,
222 SSL_SHA256,
223 SSL_HANDSHAKE_MAC_SHA256,
224 },
225
226 /* Cipher 3D */
227 {
228 TLS1_TXT_RSA_WITH_AES_256_SHA256,
229 "TLS_RSA_WITH_AES_256_CBC_SHA256",
230 TLS1_CK_RSA_WITH_AES_256_SHA256,
231 SSL_kRSA,
232 SSL_aRSA,
233 SSL_AES256,
234 SSL_SHA256,
235 SSL_HANDSHAKE_MAC_SHA256,
236 },
237
238 /* PSK cipher suites. */
239
240 /* Cipher 8C */
241 {
242 TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
243 "TLS_PSK_WITH_AES_128_CBC_SHA",
244 TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
245 SSL_kPSK,
246 SSL_aPSK,
247 SSL_AES128,
248 SSL_SHA1,
249 SSL_HANDSHAKE_MAC_DEFAULT,
250 },
251
252 /* Cipher 8D */
253 {
254 TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
255 "TLS_PSK_WITH_AES_256_CBC_SHA",
256 TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
257 SSL_kPSK,
258 SSL_aPSK,
259 SSL_AES256,
260 SSL_SHA1,
261 SSL_HANDSHAKE_MAC_DEFAULT,
262 },
263
264 /* GCM ciphersuites from RFC5288 */
265
266 /* Cipher 9C */
267 {
268 TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
269 "TLS_RSA_WITH_AES_128_GCM_SHA256",
270 TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
271 SSL_kRSA,
272 SSL_aRSA,
273 SSL_AES128GCM,
274 SSL_AEAD,
275 SSL_HANDSHAKE_MAC_SHA256,
276 },
277
278 /* Cipher 9D */
279 {
280 TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
281 "TLS_RSA_WITH_AES_256_GCM_SHA384",
282 TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
283 SSL_kRSA,
284 SSL_aRSA,
285 SSL_AES256GCM,
286 SSL_AEAD,
287 SSL_HANDSHAKE_MAC_SHA384,
288 },
289
290 /* TLS 1.3 suites. */
291
292 /* Cipher 1301 */
293 {
294 TLS1_TXT_AES_128_GCM_SHA256,
295 "TLS_AES_128_GCM_SHA256",
296 TLS1_CK_AES_128_GCM_SHA256,
297 SSL_kGENERIC,
298 SSL_aGENERIC,
299 SSL_AES128GCM,
300 SSL_AEAD,
301 SSL_HANDSHAKE_MAC_SHA256,
302 },
303
304 /* Cipher 1302 */
305 {
306 TLS1_TXT_AES_256_GCM_SHA384,
307 "TLS_AES_256_GCM_SHA384",
308 TLS1_CK_AES_256_GCM_SHA384,
309 SSL_kGENERIC,
310 SSL_aGENERIC,
311 SSL_AES256GCM,
312 SSL_AEAD,
313 SSL_HANDSHAKE_MAC_SHA384,
314 },
315
316 /* Cipher 1303 */
317 {
318 TLS1_TXT_CHACHA20_POLY1305_SHA256,
319 "TLS_CHACHA20_POLY1305_SHA256",
320 TLS1_CK_CHACHA20_POLY1305_SHA256,
321 SSL_kGENERIC,
322 SSL_aGENERIC,
323 SSL_CHACHA20POLY1305,
324 SSL_AEAD,
325 SSL_HANDSHAKE_MAC_SHA256,
326 },
327
328 /* Cipher C009 */
329 {
330 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
331 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
332 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
333 SSL_kECDHE,
334 SSL_aECDSA,
335 SSL_AES128,
336 SSL_SHA1,
337 SSL_HANDSHAKE_MAC_DEFAULT,
338 },
339
340 /* Cipher C00A */
341 {
342 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
343 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
344 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
345 SSL_kECDHE,
346 SSL_aECDSA,
347 SSL_AES256,
348 SSL_SHA1,
349 SSL_HANDSHAKE_MAC_DEFAULT,
350 },
351
352 /* Cipher C013 */
353 {
354 TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
355 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
356 TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
357 SSL_kECDHE,
358 SSL_aRSA,
359 SSL_AES128,
360 SSL_SHA1,
361 SSL_HANDSHAKE_MAC_DEFAULT,
362 },
363
364 /* Cipher C014 */
365 {
366 TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
367 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
368 TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
369 SSL_kECDHE,
370 SSL_aRSA,
371 SSL_AES256,
372 SSL_SHA1,
373 SSL_HANDSHAKE_MAC_DEFAULT,
374 },
375
376
377 /* HMAC based TLS v1.2 ciphersuites from RFC5289 */
378
379 /* Cipher C023 */
380 {
381 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
382 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
383 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
384 SSL_kECDHE,
385 SSL_aECDSA,
386 SSL_AES128,
387 SSL_SHA256,
388 SSL_HANDSHAKE_MAC_SHA256,
389 },
390
391 /* Cipher C024 */
392 {
393 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
394 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
395 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
396 SSL_kECDHE,
397 SSL_aECDSA,
398 SSL_AES256,
399 SSL_SHA384,
400 SSL_HANDSHAKE_MAC_SHA384,
401 },
402
403 /* Cipher C027 */
404 {
405 TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
406 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
407 TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
408 SSL_kECDHE,
409 SSL_aRSA,
410 SSL_AES128,
411 SSL_SHA256,
412 SSL_HANDSHAKE_MAC_SHA256,
413 },
414
415 /* Cipher C028 */
416 {
417 TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
418 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
419 TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
420 SSL_kECDHE,
421 SSL_aRSA,
422 SSL_AES256,
423 SSL_SHA384,
424 SSL_HANDSHAKE_MAC_SHA384,
425 },
426
427
428 /* GCM based TLS v1.2 ciphersuites from RFC5289 */
429
430 /* Cipher C02B */
431 {
432 TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
433 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
434 TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
435 SSL_kECDHE,
436 SSL_aECDSA,
437 SSL_AES128GCM,
438 SSL_AEAD,
439 SSL_HANDSHAKE_MAC_SHA256,
440 },
441
442 /* Cipher C02C */
443 {
444 TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
445 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
446 TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
447 SSL_kECDHE,
448 SSL_aECDSA,
449 SSL_AES256GCM,
450 SSL_AEAD,
451 SSL_HANDSHAKE_MAC_SHA384,
452 },
453
454 /* Cipher C02F */
455 {
456 TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
457 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
458 TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
459 SSL_kECDHE,
460 SSL_aRSA,
461 SSL_AES128GCM,
462 SSL_AEAD,
463 SSL_HANDSHAKE_MAC_SHA256,
464 },
465
466 /* Cipher C030 */
467 {
468 TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
469 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
470 TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
471 SSL_kECDHE,
472 SSL_aRSA,
473 SSL_AES256GCM,
474 SSL_AEAD,
475 SSL_HANDSHAKE_MAC_SHA384,
476 },
477
478 /* ECDHE-PSK cipher suites. */
479
480 /* Cipher C035 */
481 {
482 TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA,
483 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
484 TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA,
485 SSL_kECDHE,
486 SSL_aPSK,
487 SSL_AES128,
488 SSL_SHA1,
489 SSL_HANDSHAKE_MAC_DEFAULT,
490 },
491
492 /* Cipher C036 */
493 {
494 TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA,
495 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
496 TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA,
497 SSL_kECDHE,
498 SSL_aPSK,
499 SSL_AES256,
500 SSL_SHA1,
501 SSL_HANDSHAKE_MAC_DEFAULT,
502 },
503
504 /* ChaCha20-Poly1305 cipher suites. */
505
506 /* Cipher CCA8 */
507 {
508 TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
509 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
510 TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
511 SSL_kECDHE,
512 SSL_aRSA,
513 SSL_CHACHA20POLY1305,
514 SSL_AEAD,
515 SSL_HANDSHAKE_MAC_SHA256,
516 },
517
518 /* Cipher CCA9 */
519 {
520 TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
521 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
522 TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
523 SSL_kECDHE,
524 SSL_aECDSA,
525 SSL_CHACHA20POLY1305,
526 SSL_AEAD,
527 SSL_HANDSHAKE_MAC_SHA256,
528 },
529
530 /* Cipher CCAB */
531 {
532 TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
533 "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256",
534 TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
535 SSL_kECDHE,
536 SSL_aPSK,
537 SSL_CHACHA20POLY1305,
538 SSL_AEAD,
539 SSL_HANDSHAKE_MAC_SHA256,
540 },
541
542 };
543
544 static const size_t kCiphersLen = OPENSSL_ARRAY_SIZE(kCiphers);
545
546 #define CIPHER_ADD 1
547 #define CIPHER_KILL 2
548 #define CIPHER_DEL 3
549 #define CIPHER_ORD 4
550 #define CIPHER_SPECIAL 5
551
552 typedef struct cipher_order_st {
553 const SSL_CIPHER *cipher;
554 int active;
555 int in_group;
556 struct cipher_order_st *next, *prev;
557 } CIPHER_ORDER;
558
559 typedef struct cipher_alias_st {
560 /* name is the name of the cipher alias. */
561 const char *name;
562
563 /* The following fields are bitmasks for the corresponding fields on
564 * |SSL_CIPHER|. A cipher matches a cipher alias iff, for each bitmask, the
565 * bit corresponding to the cipher's value is set to 1. If any bitmask is
566 * all zeroes, the alias matches nothing. Use |~0u| for the default value. */
567 uint32_t algorithm_mkey;
568 uint32_t algorithm_auth;
569 uint32_t algorithm_enc;
570 uint32_t algorithm_mac;
571
572 /* min_version, if non-zero, matches all ciphers which were added in that
573 * particular protocol version. */
574 uint16_t min_version;
575 } CIPHER_ALIAS;
576
577 static const CIPHER_ALIAS kCipherAliases[] = {
578 /* "ALL" doesn't include eNULL. It must be explicitly enabled. */
579 {"ALL", ~0u, ~0u, ~SSL_eNULL, ~0u, 0},
580
581 /* The "COMPLEMENTOFDEFAULT" rule is omitted. It matches nothing. */
582
583 /* key exchange aliases
584 * (some of those using only a single bit here combine
585 * multiple key exchange algs according to the RFCs. */
586 {"kRSA", SSL_kRSA, ~0u, ~0u, ~0u, 0},
587
588 {"kECDHE", SSL_kECDHE, ~0u, ~0u, ~0u, 0},
589 {"kEECDH", SSL_kECDHE, ~0u, ~0u, ~0u, 0},
590 {"ECDH", SSL_kECDHE, ~0u, ~0u, ~0u, 0},
591
592 {"kPSK", SSL_kPSK, ~0u, ~0u, ~0u, 0},
593
594 /* server authentication aliases */
595 {"aRSA", ~0u, SSL_aRSA, ~SSL_eNULL, ~0u, 0},
596 {"aECDSA", ~0u, SSL_aECDSA, ~0u, ~0u, 0},
597 {"ECDSA", ~0u, SSL_aECDSA, ~0u, ~0u, 0},
598 {"aPSK", ~0u, SSL_aPSK, ~0u, ~0u, 0},
599
600 /* aliases combining key exchange and server authentication */
601 {"ECDHE", SSL_kECDHE, ~0u, ~0u, ~0u, 0},
602 {"EECDH", SSL_kECDHE, ~0u, ~0u, ~0u, 0},
603 {"RSA", SSL_kRSA, SSL_aRSA, ~SSL_eNULL, ~0u, 0},
604 {"PSK", SSL_kPSK, SSL_aPSK, ~0u, ~0u, 0},
605
606 /* symmetric encryption aliases */
607 {"3DES", ~0u, ~0u, SSL_3DES, ~0u, 0},
608 {"AES128", ~0u, ~0u, SSL_AES128 | SSL_AES128GCM, ~0u, 0},
609 {"AES256", ~0u, ~0u, SSL_AES256 | SSL_AES256GCM, ~0u, 0},
610 {"AES", ~0u, ~0u, SSL_AES, ~0u, 0},
611 {"AESGCM", ~0u, ~0u, SSL_AES128GCM | SSL_AES256GCM, ~0u, 0},
612 {"CHACHA20", ~0u, ~0u, SSL_CHACHA20POLY1305, ~0u, 0},
613
614 /* MAC aliases */
615 {"SHA1", ~0u, ~0u, ~SSL_eNULL, SSL_SHA1, 0},
616 {"SHA", ~0u, ~0u, ~SSL_eNULL, SSL_SHA1, 0},
617 {"SHA256", ~0u, ~0u, ~0u, SSL_SHA256, 0},
618 {"SHA384", ~0u, ~0u, ~0u, SSL_SHA384, 0},
619
620 /* Legacy protocol minimum version aliases. "TLSv1" is intentionally the
621 * same as "SSLv3". */
622 {"SSLv3", ~0u, ~0u, ~SSL_eNULL, ~0u, SSL3_VERSION},
623 {"TLSv1", ~0u, ~0u, ~SSL_eNULL, ~0u, SSL3_VERSION},
624 {"TLSv1.2", ~0u, ~0u, ~SSL_eNULL, ~0u, TLS1_2_VERSION},
625
626 /* Legacy strength classes. */
627 {"HIGH", ~0u, ~0u, ~SSL_eNULL, ~0u, 0},
628 {"FIPS", ~0u, ~0u, ~SSL_eNULL, ~0u, 0},
629 };
630
631 static const size_t kCipherAliasesLen = OPENSSL_ARRAY_SIZE(kCipherAliases);
632
ssl_cipher_id_cmp(const void * in_a,const void * in_b)633 static int ssl_cipher_id_cmp(const void *in_a, const void *in_b) {
634 const SSL_CIPHER *a = reinterpret_cast<const SSL_CIPHER *>(in_a);
635 const SSL_CIPHER *b = reinterpret_cast<const SSL_CIPHER *>(in_b);
636
637 if (a->id > b->id) {
638 return 1;
639 } else if (a->id < b->id) {
640 return -1;
641 } else {
642 return 0;
643 }
644 }
645
SSL_get_cipher_by_value(uint16_t value)646 const SSL_CIPHER *SSL_get_cipher_by_value(uint16_t value) {
647 SSL_CIPHER c;
648
649 c.id = 0x03000000L | value;
650 return reinterpret_cast<const SSL_CIPHER *>(bsearch(
651 &c, kCiphers, kCiphersLen, sizeof(SSL_CIPHER), ssl_cipher_id_cmp));
652 }
653
ssl_cipher_get_evp_aead(const EVP_AEAD ** out_aead,size_t * out_mac_secret_len,size_t * out_fixed_iv_len,const SSL_CIPHER * cipher,uint16_t version,int is_dtls)654 int ssl_cipher_get_evp_aead(const EVP_AEAD **out_aead,
655 size_t *out_mac_secret_len,
656 size_t *out_fixed_iv_len,
657 const SSL_CIPHER *cipher, uint16_t version, int is_dtls) {
658 *out_aead = NULL;
659 *out_mac_secret_len = 0;
660 *out_fixed_iv_len = 0;
661
662 const int is_tls12 = version == TLS1_2_VERSION && !is_dtls;
663
664 if (cipher->algorithm_mac == SSL_AEAD) {
665 if (cipher->algorithm_enc == SSL_AES128GCM) {
666 *out_aead =
667 is_tls12 ? EVP_aead_aes_128_gcm_tls12() : EVP_aead_aes_128_gcm();
668 *out_fixed_iv_len = 4;
669 } else if (cipher->algorithm_enc == SSL_AES256GCM) {
670 *out_aead =
671 is_tls12 ? EVP_aead_aes_256_gcm_tls12() : EVP_aead_aes_256_gcm();
672 *out_fixed_iv_len = 4;
673 } else if (cipher->algorithm_enc == SSL_CHACHA20POLY1305) {
674 *out_aead = EVP_aead_chacha20_poly1305();
675 *out_fixed_iv_len = 12;
676 } else {
677 return 0;
678 }
679
680 /* In TLS 1.3, the iv_len is equal to the AEAD nonce length whereas the code
681 * above computes the TLS 1.2 construction. */
682 if (version >= TLS1_3_VERSION) {
683 *out_fixed_iv_len = EVP_AEAD_nonce_length(*out_aead);
684 }
685 } else if (cipher->algorithm_mac == SSL_SHA1) {
686 if (cipher->algorithm_enc == SSL_eNULL) {
687 if (version == SSL3_VERSION) {
688 *out_aead = EVP_aead_null_sha1_ssl3();
689 } else {
690 *out_aead = EVP_aead_null_sha1_tls();
691 }
692 } else if (cipher->algorithm_enc == SSL_3DES) {
693 if (version == SSL3_VERSION) {
694 *out_aead = EVP_aead_des_ede3_cbc_sha1_ssl3();
695 *out_fixed_iv_len = 8;
696 } else if (version == TLS1_VERSION) {
697 *out_aead = EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv();
698 *out_fixed_iv_len = 8;
699 } else {
700 *out_aead = EVP_aead_des_ede3_cbc_sha1_tls();
701 }
702 } else if (cipher->algorithm_enc == SSL_AES128) {
703 if (version == SSL3_VERSION) {
704 *out_aead = EVP_aead_aes_128_cbc_sha1_ssl3();
705 *out_fixed_iv_len = 16;
706 } else if (version == TLS1_VERSION) {
707 *out_aead = EVP_aead_aes_128_cbc_sha1_tls_implicit_iv();
708 *out_fixed_iv_len = 16;
709 } else {
710 *out_aead = EVP_aead_aes_128_cbc_sha1_tls();
711 }
712 } else if (cipher->algorithm_enc == SSL_AES256) {
713 if (version == SSL3_VERSION) {
714 *out_aead = EVP_aead_aes_256_cbc_sha1_ssl3();
715 *out_fixed_iv_len = 16;
716 } else if (version == TLS1_VERSION) {
717 *out_aead = EVP_aead_aes_256_cbc_sha1_tls_implicit_iv();
718 *out_fixed_iv_len = 16;
719 } else {
720 *out_aead = EVP_aead_aes_256_cbc_sha1_tls();
721 }
722 } else {
723 return 0;
724 }
725
726 *out_mac_secret_len = SHA_DIGEST_LENGTH;
727 } else if (cipher->algorithm_mac == SSL_SHA256) {
728 if (cipher->algorithm_enc == SSL_AES128) {
729 *out_aead = EVP_aead_aes_128_cbc_sha256_tls();
730 } else if (cipher->algorithm_enc == SSL_AES256) {
731 *out_aead = EVP_aead_aes_256_cbc_sha256_tls();
732 } else {
733 return 0;
734 }
735
736 *out_mac_secret_len = SHA256_DIGEST_LENGTH;
737 } else if (cipher->algorithm_mac == SSL_SHA384) {
738 if (cipher->algorithm_enc != SSL_AES256) {
739 return 0;
740 }
741
742 *out_aead = EVP_aead_aes_256_cbc_sha384_tls();
743 *out_mac_secret_len = SHA384_DIGEST_LENGTH;
744 } else {
745 return 0;
746 }
747
748 return 1;
749 }
750
ssl_get_handshake_digest(uint32_t algorithm_prf,uint16_t version)751 const EVP_MD *ssl_get_handshake_digest(uint32_t algorithm_prf,
752 uint16_t version) {
753 switch (algorithm_prf) {
754 case SSL_HANDSHAKE_MAC_DEFAULT:
755 return version >= TLS1_2_VERSION ? EVP_sha256() : EVP_md5_sha1();
756 case SSL_HANDSHAKE_MAC_SHA256:
757 return EVP_sha256();
758 case SSL_HANDSHAKE_MAC_SHA384:
759 return EVP_sha384();
760 default:
761 return NULL;
762 }
763 }
764
765 #define ITEM_SEP(a) \
766 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))
767
768 /* rule_equals returns one iff the NUL-terminated string |rule| is equal to the
769 * |buf_len| bytes at |buf|. */
rule_equals(const char * rule,const char * buf,size_t buf_len)770 static int rule_equals(const char *rule, const char *buf, size_t buf_len) {
771 /* |strncmp| alone only checks that |buf| is a prefix of |rule|. */
772 return strncmp(rule, buf, buf_len) == 0 && rule[buf_len] == '\0';
773 }
774
ll_append_tail(CIPHER_ORDER ** head,CIPHER_ORDER * curr,CIPHER_ORDER ** tail)775 static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
776 CIPHER_ORDER **tail) {
777 if (curr == *tail) {
778 return;
779 }
780 if (curr == *head) {
781 *head = curr->next;
782 }
783 if (curr->prev != NULL) {
784 curr->prev->next = curr->next;
785 }
786 if (curr->next != NULL) {
787 curr->next->prev = curr->prev;
788 }
789 (*tail)->next = curr;
790 curr->prev = *tail;
791 curr->next = NULL;
792 *tail = curr;
793 }
794
ll_append_head(CIPHER_ORDER ** head,CIPHER_ORDER * curr,CIPHER_ORDER ** tail)795 static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,
796 CIPHER_ORDER **tail) {
797 if (curr == *head) {
798 return;
799 }
800 if (curr == *tail) {
801 *tail = curr->prev;
802 }
803 if (curr->next != NULL) {
804 curr->next->prev = curr->prev;
805 }
806 if (curr->prev != NULL) {
807 curr->prev->next = curr->next;
808 }
809 (*head)->prev = curr;
810 curr->next = *head;
811 curr->prev = NULL;
812 *head = curr;
813 }
814
ssl_cipher_collect_ciphers(const SSL_PROTOCOL_METHOD * ssl_method,CIPHER_ORDER * co_list,CIPHER_ORDER ** head_p,CIPHER_ORDER ** tail_p)815 static void ssl_cipher_collect_ciphers(const SSL_PROTOCOL_METHOD *ssl_method,
816 CIPHER_ORDER *co_list,
817 CIPHER_ORDER **head_p,
818 CIPHER_ORDER **tail_p) {
819 /* The set of ciphers is static, but some subset may be unsupported by
820 * |ssl_method|, so the list may be smaller. */
821 size_t co_list_num = 0;
822 for (size_t i = 0; i < kCiphersLen; i++) {
823 const SSL_CIPHER *cipher = &kCiphers[i];
824 if (ssl_method->supports_cipher(cipher) &&
825 /* TLS 1.3 ciphers do not participate in this mechanism. */
826 cipher->algorithm_mkey != SSL_kGENERIC) {
827 co_list[co_list_num].cipher = cipher;
828 co_list[co_list_num].next = NULL;
829 co_list[co_list_num].prev = NULL;
830 co_list[co_list_num].active = 0;
831 co_list[co_list_num].in_group = 0;
832 co_list_num++;
833 }
834 }
835
836 /* Prepare linked list from list entries. */
837 if (co_list_num > 0) {
838 co_list[0].prev = NULL;
839
840 if (co_list_num > 1) {
841 co_list[0].next = &co_list[1];
842
843 for (size_t i = 1; i < co_list_num - 1; i++) {
844 co_list[i].prev = &co_list[i - 1];
845 co_list[i].next = &co_list[i + 1];
846 }
847
848 co_list[co_list_num - 1].prev = &co_list[co_list_num - 2];
849 }
850
851 co_list[co_list_num - 1].next = NULL;
852
853 *head_p = &co_list[0];
854 *tail_p = &co_list[co_list_num - 1];
855 }
856 }
857
858 /* ssl_cipher_apply_rule applies the rule type |rule| to ciphers matching its
859 * parameters in the linked list from |*head_p| to |*tail_p|. It writes the new
860 * head and tail of the list to |*head_p| and |*tail_p|, respectively.
861 *
862 * - If |cipher_id| is non-zero, only that cipher is selected.
863 * - Otherwise, if |strength_bits| is non-negative, it selects ciphers
864 * of that strength.
865 * - Otherwise, it selects ciphers that match each bitmasks in |alg_*| and
866 * |min_version|. */
ssl_cipher_apply_rule(uint32_t cipher_id,uint32_t alg_mkey,uint32_t alg_auth,uint32_t alg_enc,uint32_t alg_mac,uint16_t min_version,int rule,int strength_bits,int in_group,CIPHER_ORDER ** head_p,CIPHER_ORDER ** tail_p)867 static void ssl_cipher_apply_rule(
868 uint32_t cipher_id, uint32_t alg_mkey, uint32_t alg_auth,
869 uint32_t alg_enc, uint32_t alg_mac, uint16_t min_version, int rule,
870 int strength_bits, int in_group, CIPHER_ORDER **head_p,
871 CIPHER_ORDER **tail_p) {
872 CIPHER_ORDER *head, *tail, *curr, *next, *last;
873 const SSL_CIPHER *cp;
874 int reverse = 0;
875
876 if (cipher_id == 0 && strength_bits == -1 && min_version == 0 &&
877 (alg_mkey == 0 || alg_auth == 0 || alg_enc == 0 || alg_mac == 0)) {
878 /* The rule matches nothing, so bail early. */
879 return;
880 }
881
882 if (rule == CIPHER_DEL) {
883 /* needed to maintain sorting between currently deleted ciphers */
884 reverse = 1;
885 }
886
887 head = *head_p;
888 tail = *tail_p;
889
890 if (reverse) {
891 next = tail;
892 last = head;
893 } else {
894 next = head;
895 last = tail;
896 }
897
898 curr = NULL;
899 for (;;) {
900 if (curr == last) {
901 break;
902 }
903
904 curr = next;
905 if (curr == NULL) {
906 break;
907 }
908
909 next = reverse ? curr->prev : curr->next;
910 cp = curr->cipher;
911
912 /* Selection criteria is either a specific cipher, the value of
913 * |strength_bits|, or the algorithms used. */
914 if (cipher_id != 0) {
915 if (cipher_id != cp->id) {
916 continue;
917 }
918 } else if (strength_bits >= 0) {
919 if (strength_bits != SSL_CIPHER_get_bits(cp, NULL)) {
920 continue;
921 }
922 } else {
923 if (!(alg_mkey & cp->algorithm_mkey) ||
924 !(alg_auth & cp->algorithm_auth) ||
925 !(alg_enc & cp->algorithm_enc) ||
926 !(alg_mac & cp->algorithm_mac) ||
927 (min_version != 0 && SSL_CIPHER_get_min_version(cp) != min_version)) {
928 continue;
929 }
930 }
931
932 /* add the cipher if it has not been added yet. */
933 if (rule == CIPHER_ADD) {
934 /* reverse == 0 */
935 if (!curr->active) {
936 ll_append_tail(&head, curr, &tail);
937 curr->active = 1;
938 curr->in_group = in_group;
939 }
940 }
941
942 /* Move the added cipher to this location */
943 else if (rule == CIPHER_ORD) {
944 /* reverse == 0 */
945 if (curr->active) {
946 ll_append_tail(&head, curr, &tail);
947 curr->in_group = 0;
948 }
949 } else if (rule == CIPHER_DEL) {
950 /* reverse == 1 */
951 if (curr->active) {
952 /* most recently deleted ciphersuites get best positions
953 * for any future CIPHER_ADD (note that the CIPHER_DEL loop
954 * works in reverse to maintain the order) */
955 ll_append_head(&head, curr, &tail);
956 curr->active = 0;
957 curr->in_group = 0;
958 }
959 } else if (rule == CIPHER_KILL) {
960 /* reverse == 0 */
961 if (head == curr) {
962 head = curr->next;
963 } else {
964 curr->prev->next = curr->next;
965 }
966
967 if (tail == curr) {
968 tail = curr->prev;
969 }
970 curr->active = 0;
971 if (curr->next != NULL) {
972 curr->next->prev = curr->prev;
973 }
974 if (curr->prev != NULL) {
975 curr->prev->next = curr->next;
976 }
977 curr->next = NULL;
978 curr->prev = NULL;
979 }
980 }
981
982 *head_p = head;
983 *tail_p = tail;
984 }
985
ssl_cipher_strength_sort(CIPHER_ORDER ** head_p,CIPHER_ORDER ** tail_p)986 static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
987 CIPHER_ORDER **tail_p) {
988 int max_strength_bits, i, *number_uses;
989 CIPHER_ORDER *curr;
990
991 /* This routine sorts the ciphers with descending strength. The sorting must
992 * keep the pre-sorted sequence, so we apply the normal sorting routine as
993 * '+' movement to the end of the list. */
994 max_strength_bits = 0;
995 curr = *head_p;
996 while (curr != NULL) {
997 if (curr->active &&
998 SSL_CIPHER_get_bits(curr->cipher, NULL) > max_strength_bits) {
999 max_strength_bits = SSL_CIPHER_get_bits(curr->cipher, NULL);
1000 }
1001 curr = curr->next;
1002 }
1003
1004 number_uses = (int *)OPENSSL_malloc((max_strength_bits + 1) * sizeof(int));
1005 if (!number_uses) {
1006 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
1007 return 0;
1008 }
1009 OPENSSL_memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int));
1010
1011 /* Now find the strength_bits values actually used. */
1012 curr = *head_p;
1013 while (curr != NULL) {
1014 if (curr->active) {
1015 number_uses[SSL_CIPHER_get_bits(curr->cipher, NULL)]++;
1016 }
1017 curr = curr->next;
1018 }
1019
1020 /* Go through the list of used strength_bits values in descending order. */
1021 for (i = max_strength_bits; i >= 0; i--) {
1022 if (number_uses[i] > 0) {
1023 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, CIPHER_ORD, i, 0, head_p, tail_p);
1024 }
1025 }
1026
1027 OPENSSL_free(number_uses);
1028 return 1;
1029 }
1030
ssl_cipher_process_rulestr(const SSL_PROTOCOL_METHOD * ssl_method,const char * rule_str,CIPHER_ORDER ** head_p,CIPHER_ORDER ** tail_p,int strict)1031 static int ssl_cipher_process_rulestr(const SSL_PROTOCOL_METHOD *ssl_method,
1032 const char *rule_str,
1033 CIPHER_ORDER **head_p,
1034 CIPHER_ORDER **tail_p, int strict) {
1035 uint32_t alg_mkey, alg_auth, alg_enc, alg_mac;
1036 uint16_t min_version;
1037 const char *l, *buf;
1038 int multi, skip_rule, rule, in_group = 0, has_group = 0;
1039 size_t j, buf_len;
1040 uint32_t cipher_id;
1041 char ch;
1042
1043 l = rule_str;
1044 for (;;) {
1045 ch = *l;
1046
1047 if (ch == '\0') {
1048 break; /* done */
1049 }
1050
1051 if (in_group) {
1052 if (ch == ']') {
1053 if (*tail_p) {
1054 (*tail_p)->in_group = 0;
1055 }
1056 in_group = 0;
1057 l++;
1058 continue;
1059 }
1060
1061 if (ch == '|') {
1062 rule = CIPHER_ADD;
1063 l++;
1064 continue;
1065 } else if (!(ch >= 'a' && ch <= 'z') && !(ch >= 'A' && ch <= 'Z') &&
1066 !(ch >= '0' && ch <= '9')) {
1067 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_OPERATOR_IN_GROUP);
1068 return 0;
1069 } else {
1070 rule = CIPHER_ADD;
1071 }
1072 } else if (ch == '-') {
1073 rule = CIPHER_DEL;
1074 l++;
1075 } else if (ch == '+') {
1076 rule = CIPHER_ORD;
1077 l++;
1078 } else if (ch == '!') {
1079 rule = CIPHER_KILL;
1080 l++;
1081 } else if (ch == '@') {
1082 rule = CIPHER_SPECIAL;
1083 l++;
1084 } else if (ch == '[') {
1085 assert(!in_group);
1086 in_group = 1;
1087 has_group = 1;
1088 l++;
1089 continue;
1090 } else {
1091 rule = CIPHER_ADD;
1092 }
1093
1094 /* If preference groups are enabled, the only legal operator is +.
1095 * Otherwise the in_group bits will get mixed up. */
1096 if (has_group && rule != CIPHER_ADD) {
1097 OPENSSL_PUT_ERROR(SSL, SSL_R_MIXED_SPECIAL_OPERATOR_WITH_GROUPS);
1098 return 0;
1099 }
1100
1101 if (ITEM_SEP(ch)) {
1102 l++;
1103 continue;
1104 }
1105
1106 multi = 0;
1107 cipher_id = 0;
1108 alg_mkey = ~0u;
1109 alg_auth = ~0u;
1110 alg_enc = ~0u;
1111 alg_mac = ~0u;
1112 min_version = 0;
1113 skip_rule = 0;
1114
1115 for (;;) {
1116 ch = *l;
1117 buf = l;
1118 buf_len = 0;
1119 while ((ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') ||
1120 (ch >= 'a' && ch <= 'z') || ch == '-' || ch == '.' || ch == '_') {
1121 ch = *(++l);
1122 buf_len++;
1123 }
1124
1125 if (buf_len == 0) {
1126 /* We hit something we cannot deal with, it is no command or separator
1127 * nor alphanumeric, so we call this an error. */
1128 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND);
1129 return 0;
1130 }
1131
1132 if (rule == CIPHER_SPECIAL) {
1133 break;
1134 }
1135
1136 /* Look for a matching exact cipher. These aren't allowed in multipart
1137 * rules. */
1138 if (!multi && ch != '+') {
1139 for (j = 0; j < kCiphersLen; j++) {
1140 const SSL_CIPHER *cipher = &kCiphers[j];
1141 if (rule_equals(cipher->name, buf, buf_len) ||
1142 rule_equals(cipher->standard_name, buf, buf_len)) {
1143 cipher_id = cipher->id;
1144 break;
1145 }
1146 }
1147 }
1148 if (cipher_id == 0) {
1149 /* If not an exact cipher, look for a matching cipher alias. */
1150 for (j = 0; j < kCipherAliasesLen; j++) {
1151 if (rule_equals(kCipherAliases[j].name, buf, buf_len)) {
1152 alg_mkey &= kCipherAliases[j].algorithm_mkey;
1153 alg_auth &= kCipherAliases[j].algorithm_auth;
1154 alg_enc &= kCipherAliases[j].algorithm_enc;
1155 alg_mac &= kCipherAliases[j].algorithm_mac;
1156
1157 if (min_version != 0 &&
1158 min_version != kCipherAliases[j].min_version) {
1159 skip_rule = 1;
1160 } else {
1161 min_version = kCipherAliases[j].min_version;
1162 }
1163 break;
1164 }
1165 }
1166 if (j == kCipherAliasesLen) {
1167 skip_rule = 1;
1168 if (strict) {
1169 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND);
1170 return 0;
1171 }
1172 }
1173 }
1174
1175 /* Check for a multipart rule. */
1176 if (ch != '+') {
1177 break;
1178 }
1179 l++;
1180 multi = 1;
1181 }
1182
1183 /* Ok, we have the rule, now apply it. */
1184 if (rule == CIPHER_SPECIAL) {
1185 if (buf_len != 8 || strncmp(buf, "STRENGTH", 8) != 0) {
1186 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND);
1187 return 0;
1188 }
1189 if (!ssl_cipher_strength_sort(head_p, tail_p)) {
1190 return 0;
1191 }
1192
1193 /* We do not support any "multi" options together with "@", so throw away
1194 * the rest of the command, if any left, until end or ':' is found. */
1195 while (*l != '\0' && !ITEM_SEP(*l)) {
1196 l++;
1197 }
1198 } else if (!skip_rule) {
1199 ssl_cipher_apply_rule(cipher_id, alg_mkey, alg_auth, alg_enc, alg_mac,
1200 min_version, rule, -1, in_group, head_p, tail_p);
1201 }
1202 }
1203
1204 if (in_group) {
1205 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND);
1206 return 0;
1207 }
1208
1209 return 1;
1210 }
1211
ssl_create_cipher_list(const SSL_PROTOCOL_METHOD * ssl_method,struct ssl_cipher_preference_list_st ** out_cipher_list,const char * rule_str,int strict)1212 int ssl_create_cipher_list(
1213 const SSL_PROTOCOL_METHOD *ssl_method,
1214 struct ssl_cipher_preference_list_st **out_cipher_list,
1215 const char *rule_str, int strict) {
1216 STACK_OF(SSL_CIPHER) *cipherstack = NULL;
1217 CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
1218 uint8_t *in_group_flags = NULL;
1219 unsigned int num_in_group_flags = 0;
1220 struct ssl_cipher_preference_list_st *pref_list = NULL;
1221
1222 /* Return with error if nothing to do. */
1223 if (rule_str == NULL || out_cipher_list == NULL) {
1224 return 0;
1225 }
1226
1227 /* Now we have to collect the available ciphers from the compiled in ciphers.
1228 * We cannot get more than the number compiled in, so it is used for
1229 * allocation. */
1230 co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * kCiphersLen);
1231 if (co_list == NULL) {
1232 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
1233 return 0;
1234 }
1235
1236 ssl_cipher_collect_ciphers(ssl_method, co_list, &head, &tail);
1237
1238 /* Now arrange all ciphers by preference:
1239 * TODO(davidben): Compute this order once and copy it. */
1240
1241 /* Everything else being equal, prefer ECDHE_ECDSA and ECDHE_RSA over other
1242 * key exchange mechanisms */
1243 ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, ~0u, ~0u, 0, CIPHER_ADD, -1,
1244 0, &head, &tail);
1245 ssl_cipher_apply_rule(0, SSL_kECDHE, ~0u, ~0u, ~0u, 0, CIPHER_ADD, -1, 0,
1246 &head, &tail);
1247 ssl_cipher_apply_rule(0, ~0u, ~0u, ~0u, ~0u, 0, CIPHER_DEL, -1, 0, &head,
1248 &tail);
1249
1250 /* Order the bulk ciphers. First the preferred AEAD ciphers. We prefer
1251 * CHACHA20 unless there is hardware support for fast and constant-time
1252 * AES_GCM. Of the two CHACHA20 variants, the new one is preferred over the
1253 * old one. */
1254 if (EVP_has_aes_hardware()) {
1255 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_AES128GCM, ~0u, 0, CIPHER_ADD, -1, 0,
1256 &head, &tail);
1257 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_AES256GCM, ~0u, 0, CIPHER_ADD, -1, 0,
1258 &head, &tail);
1259 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_CHACHA20POLY1305, ~0u, 0, CIPHER_ADD,
1260 -1, 0, &head, &tail);
1261 } else {
1262 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_CHACHA20POLY1305, ~0u, 0, CIPHER_ADD,
1263 -1, 0, &head, &tail);
1264 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_AES128GCM, ~0u, 0, CIPHER_ADD, -1, 0,
1265 &head, &tail);
1266 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_AES256GCM, ~0u, 0, CIPHER_ADD, -1, 0,
1267 &head, &tail);
1268 }
1269
1270 /* Then the legacy non-AEAD ciphers: AES_128_CBC, AES_256_CBC,
1271 * 3DES_EDE_CBC_SHA. */
1272 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_AES128, ~0u, 0, CIPHER_ADD, -1, 0,
1273 &head, &tail);
1274 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_AES256, ~0u, 0, CIPHER_ADD, -1, 0,
1275 &head, &tail);
1276 ssl_cipher_apply_rule(0, ~0u, ~0u, SSL_3DES, ~0u, 0, CIPHER_ADD, -1, 0, &head,
1277 &tail);
1278
1279 /* Temporarily enable everything else for sorting */
1280 ssl_cipher_apply_rule(0, ~0u, ~0u, ~0u, ~0u, 0, CIPHER_ADD, -1, 0, &head,
1281 &tail);
1282
1283 /* Move ciphers without forward secrecy to the end. */
1284 ssl_cipher_apply_rule(0, (SSL_kRSA | SSL_kPSK), ~0u, ~0u, ~0u, 0,
1285 CIPHER_ORD, -1, 0, &head, &tail);
1286
1287 /* Now disable everything (maintaining the ordering!) */
1288 ssl_cipher_apply_rule(0, ~0u, ~0u, ~0u, ~0u, 0, CIPHER_DEL, -1, 0, &head,
1289 &tail);
1290
1291 /* If the rule_string begins with DEFAULT, apply the default rule before
1292 * using the (possibly available) additional rules. */
1293 const char *rule_p = rule_str;
1294 if (strncmp(rule_str, "DEFAULT", 7) == 0) {
1295 if (!ssl_cipher_process_rulestr(ssl_method, SSL_DEFAULT_CIPHER_LIST, &head,
1296 &tail, strict)) {
1297 goto err;
1298 }
1299 rule_p += 7;
1300 if (*rule_p == ':') {
1301 rule_p++;
1302 }
1303 }
1304
1305 if (*rule_p != '\0' &&
1306 !ssl_cipher_process_rulestr(ssl_method, rule_p, &head, &tail, strict)) {
1307 goto err;
1308 }
1309
1310 /* Allocate new "cipherstack" for the result, return with error
1311 * if we cannot get one. */
1312 cipherstack = sk_SSL_CIPHER_new_null();
1313 if (cipherstack == NULL) {
1314 goto err;
1315 }
1316
1317 in_group_flags = (uint8_t *)OPENSSL_malloc(kCiphersLen);
1318 if (!in_group_flags) {
1319 goto err;
1320 }
1321
1322 /* The cipher selection for the list is done. The ciphers are added
1323 * to the resulting precedence to the STACK_OF(SSL_CIPHER). */
1324 for (curr = head; curr != NULL; curr = curr->next) {
1325 if (curr->active) {
1326 if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {
1327 goto err;
1328 }
1329 in_group_flags[num_in_group_flags++] = curr->in_group;
1330 }
1331 }
1332 OPENSSL_free(co_list); /* Not needed any longer */
1333 co_list = NULL;
1334
1335 pref_list = (ssl_cipher_preference_list_st *)OPENSSL_malloc(
1336 sizeof(struct ssl_cipher_preference_list_st));
1337 if (!pref_list) {
1338 goto err;
1339 }
1340 pref_list->ciphers = cipherstack;
1341 pref_list->in_group_flags = (uint8_t *)OPENSSL_malloc(num_in_group_flags);
1342 if (!pref_list->in_group_flags) {
1343 goto err;
1344 }
1345 OPENSSL_memcpy(pref_list->in_group_flags, in_group_flags, num_in_group_flags);
1346 OPENSSL_free(in_group_flags);
1347 in_group_flags = NULL;
1348 if (*out_cipher_list != NULL) {
1349 ssl_cipher_preference_list_free(*out_cipher_list);
1350 }
1351 *out_cipher_list = pref_list;
1352 pref_list = NULL;
1353
1354 /* Configuring an empty cipher list is an error but still updates the
1355 * output. */
1356 if (sk_SSL_CIPHER_num((*out_cipher_list)->ciphers) == 0) {
1357 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CIPHER_MATCH);
1358 return 0;
1359 }
1360
1361 return 1;
1362
1363 err:
1364 OPENSSL_free(co_list);
1365 OPENSSL_free(in_group_flags);
1366 sk_SSL_CIPHER_free(cipherstack);
1367 if (pref_list) {
1368 OPENSSL_free(pref_list->in_group_flags);
1369 }
1370 OPENSSL_free(pref_list);
1371 return 0;
1372 }
1373
SSL_CIPHER_get_id(const SSL_CIPHER * cipher)1374 uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *cipher) { return cipher->id; }
1375
ssl_cipher_get_value(const SSL_CIPHER * cipher)1376 uint16_t ssl_cipher_get_value(const SSL_CIPHER *cipher) {
1377 uint32_t id = cipher->id;
1378 /* All ciphers are SSLv3. */
1379 assert((id & 0xff000000) == 0x03000000);
1380 return id & 0xffff;
1381 }
1382
SSL_CIPHER_is_AES(const SSL_CIPHER * cipher)1383 int SSL_CIPHER_is_AES(const SSL_CIPHER *cipher) {
1384 return (cipher->algorithm_enc & SSL_AES) != 0;
1385 }
1386
SSL_CIPHER_has_SHA1_HMAC(const SSL_CIPHER * cipher)1387 int SSL_CIPHER_has_SHA1_HMAC(const SSL_CIPHER *cipher) {
1388 return (cipher->algorithm_mac & SSL_SHA1) != 0;
1389 }
1390
SSL_CIPHER_has_SHA256_HMAC(const SSL_CIPHER * cipher)1391 int SSL_CIPHER_has_SHA256_HMAC(const SSL_CIPHER *cipher) {
1392 return (cipher->algorithm_mac & SSL_SHA256) != 0;
1393 }
1394
SSL_CIPHER_has_SHA384_HMAC(const SSL_CIPHER * cipher)1395 int SSL_CIPHER_has_SHA384_HMAC(const SSL_CIPHER *cipher) {
1396 return (cipher->algorithm_mac & SSL_SHA384) != 0;
1397 }
1398
SSL_CIPHER_is_AEAD(const SSL_CIPHER * cipher)1399 int SSL_CIPHER_is_AEAD(const SSL_CIPHER *cipher) {
1400 return (cipher->algorithm_mac & SSL_AEAD) != 0;
1401 }
1402
SSL_CIPHER_is_AESGCM(const SSL_CIPHER * cipher)1403 int SSL_CIPHER_is_AESGCM(const SSL_CIPHER *cipher) {
1404 return (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) != 0;
1405 }
1406
SSL_CIPHER_is_AES128GCM(const SSL_CIPHER * cipher)1407 int SSL_CIPHER_is_AES128GCM(const SSL_CIPHER *cipher) {
1408 return (cipher->algorithm_enc & SSL_AES128GCM) != 0;
1409 }
1410
SSL_CIPHER_is_AES128CBC(const SSL_CIPHER * cipher)1411 int SSL_CIPHER_is_AES128CBC(const SSL_CIPHER *cipher) {
1412 return (cipher->algorithm_enc & SSL_AES128) != 0;
1413 }
1414
SSL_CIPHER_is_AES256CBC(const SSL_CIPHER * cipher)1415 int SSL_CIPHER_is_AES256CBC(const SSL_CIPHER *cipher) {
1416 return (cipher->algorithm_enc & SSL_AES256) != 0;
1417 }
1418
SSL_CIPHER_is_CHACHA20POLY1305(const SSL_CIPHER * cipher)1419 int SSL_CIPHER_is_CHACHA20POLY1305(const SSL_CIPHER *cipher) {
1420 return (cipher->algorithm_enc & SSL_CHACHA20POLY1305) != 0;
1421 }
1422
SSL_CIPHER_is_NULL(const SSL_CIPHER * cipher)1423 int SSL_CIPHER_is_NULL(const SSL_CIPHER *cipher) {
1424 return (cipher->algorithm_enc & SSL_eNULL) != 0;
1425 }
1426
SSL_CIPHER_is_block_cipher(const SSL_CIPHER * cipher)1427 int SSL_CIPHER_is_block_cipher(const SSL_CIPHER *cipher) {
1428 return (cipher->algorithm_enc & SSL_eNULL) == 0 &&
1429 cipher->algorithm_mac != SSL_AEAD;
1430 }
1431
SSL_CIPHER_is_ECDSA(const SSL_CIPHER * cipher)1432 int SSL_CIPHER_is_ECDSA(const SSL_CIPHER *cipher) {
1433 return (cipher->algorithm_auth & SSL_aECDSA) != 0;
1434 }
1435
SSL_CIPHER_is_ECDHE(const SSL_CIPHER * cipher)1436 int SSL_CIPHER_is_ECDHE(const SSL_CIPHER *cipher) {
1437 return (cipher->algorithm_mkey & SSL_kECDHE) != 0;
1438 }
1439
SSL_CIPHER_is_static_RSA(const SSL_CIPHER * cipher)1440 int SSL_CIPHER_is_static_RSA(const SSL_CIPHER *cipher) {
1441 return (cipher->algorithm_mkey & SSL_kRSA) != 0;
1442 }
1443
SSL_CIPHER_get_min_version(const SSL_CIPHER * cipher)1444 uint16_t SSL_CIPHER_get_min_version(const SSL_CIPHER *cipher) {
1445 if (cipher->algorithm_mkey == SSL_kGENERIC ||
1446 cipher->algorithm_auth == SSL_aGENERIC) {
1447 return TLS1_3_VERSION;
1448 }
1449
1450 if (cipher->algorithm_prf != SSL_HANDSHAKE_MAC_DEFAULT) {
1451 /* Cipher suites before TLS 1.2 use the default PRF, while all those added
1452 * afterwards specify a particular hash. */
1453 return TLS1_2_VERSION;
1454 }
1455 return SSL3_VERSION;
1456 }
1457
SSL_CIPHER_get_max_version(const SSL_CIPHER * cipher)1458 uint16_t SSL_CIPHER_get_max_version(const SSL_CIPHER *cipher) {
1459 if (cipher->algorithm_mkey == SSL_kGENERIC ||
1460 cipher->algorithm_auth == SSL_aGENERIC) {
1461 return TLS1_3_VERSION;
1462 }
1463 return TLS1_2_VERSION;
1464 }
1465
1466 /* return the actual cipher being used */
SSL_CIPHER_get_name(const SSL_CIPHER * cipher)1467 const char *SSL_CIPHER_get_name(const SSL_CIPHER *cipher) {
1468 if (cipher != NULL) {
1469 return cipher->name;
1470 }
1471
1472 return "(NONE)";
1473 }
1474
SSL_CIPHER_standard_name(const SSL_CIPHER * cipher)1475 const char *SSL_CIPHER_standard_name(const SSL_CIPHER *cipher) {
1476 return cipher->standard_name;
1477 }
1478
SSL_CIPHER_get_kx_name(const SSL_CIPHER * cipher)1479 const char *SSL_CIPHER_get_kx_name(const SSL_CIPHER *cipher) {
1480 if (cipher == NULL) {
1481 return "";
1482 }
1483
1484 switch (cipher->algorithm_mkey) {
1485 case SSL_kRSA:
1486 return "RSA";
1487
1488 case SSL_kECDHE:
1489 switch (cipher->algorithm_auth) {
1490 case SSL_aECDSA:
1491 return "ECDHE_ECDSA";
1492 case SSL_aRSA:
1493 return "ECDHE_RSA";
1494 case SSL_aPSK:
1495 return "ECDHE_PSK";
1496 default:
1497 assert(0);
1498 return "UNKNOWN";
1499 }
1500
1501 case SSL_kPSK:
1502 assert(cipher->algorithm_auth == SSL_aPSK);
1503 return "PSK";
1504
1505 case SSL_kGENERIC:
1506 assert(cipher->algorithm_auth == SSL_aGENERIC);
1507 return "GENERIC";
1508
1509 default:
1510 assert(0);
1511 return "UNKNOWN";
1512 }
1513 }
1514
SSL_CIPHER_get_rfc_name(const SSL_CIPHER * cipher)1515 char *SSL_CIPHER_get_rfc_name(const SSL_CIPHER *cipher) {
1516 if (cipher == NULL) {
1517 return NULL;
1518 }
1519
1520 return OPENSSL_strdup(SSL_CIPHER_standard_name(cipher));
1521 }
1522
SSL_CIPHER_get_bits(const SSL_CIPHER * cipher,int * out_alg_bits)1523 int SSL_CIPHER_get_bits(const SSL_CIPHER *cipher, int *out_alg_bits) {
1524 if (cipher == NULL) {
1525 return 0;
1526 }
1527
1528 int alg_bits, strength_bits;
1529 switch (cipher->algorithm_enc) {
1530 case SSL_AES128:
1531 case SSL_AES128GCM:
1532 alg_bits = 128;
1533 strength_bits = 128;
1534 break;
1535
1536 case SSL_AES256:
1537 case SSL_AES256GCM:
1538 case SSL_CHACHA20POLY1305:
1539 alg_bits = 256;
1540 strength_bits = 256;
1541 break;
1542
1543 case SSL_3DES:
1544 alg_bits = 168;
1545 strength_bits = 112;
1546 break;
1547
1548 case SSL_eNULL:
1549 alg_bits = 0;
1550 strength_bits = 0;
1551 break;
1552
1553 default:
1554 assert(0);
1555 alg_bits = 0;
1556 strength_bits = 0;
1557 }
1558
1559 if (out_alg_bits != NULL) {
1560 *out_alg_bits = alg_bits;
1561 }
1562 return strength_bits;
1563 }
1564
SSL_CIPHER_description(const SSL_CIPHER * cipher,char * buf,int len)1565 const char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf,
1566 int len) {
1567 const char *kx, *au, *enc, *mac;
1568 uint32_t alg_mkey, alg_auth, alg_enc, alg_mac;
1569
1570 alg_mkey = cipher->algorithm_mkey;
1571 alg_auth = cipher->algorithm_auth;
1572 alg_enc = cipher->algorithm_enc;
1573 alg_mac = cipher->algorithm_mac;
1574
1575 switch (alg_mkey) {
1576 case SSL_kRSA:
1577 kx = "RSA";
1578 break;
1579
1580 case SSL_kECDHE:
1581 kx = "ECDH";
1582 break;
1583
1584 case SSL_kPSK:
1585 kx = "PSK";
1586 break;
1587
1588 case SSL_kGENERIC:
1589 kx = "GENERIC";
1590 break;
1591
1592 default:
1593 kx = "unknown";
1594 }
1595
1596 switch (alg_auth) {
1597 case SSL_aRSA:
1598 au = "RSA";
1599 break;
1600
1601 case SSL_aECDSA:
1602 au = "ECDSA";
1603 break;
1604
1605 case SSL_aPSK:
1606 au = "PSK";
1607 break;
1608
1609 case SSL_aGENERIC:
1610 au = "GENERIC";
1611 break;
1612
1613 default:
1614 au = "unknown";
1615 break;
1616 }
1617
1618 switch (alg_enc) {
1619 case SSL_3DES:
1620 enc = "3DES(168)";
1621 break;
1622
1623 case SSL_AES128:
1624 enc = "AES(128)";
1625 break;
1626
1627 case SSL_AES256:
1628 enc = "AES(256)";
1629 break;
1630
1631 case SSL_AES128GCM:
1632 enc = "AESGCM(128)";
1633 break;
1634
1635 case SSL_AES256GCM:
1636 enc = "AESGCM(256)";
1637 break;
1638
1639 case SSL_CHACHA20POLY1305:
1640 enc = "ChaCha20-Poly1305";
1641 break;
1642
1643 case SSL_eNULL:
1644 enc="None";
1645 break;
1646
1647 default:
1648 enc = "unknown";
1649 break;
1650 }
1651
1652 switch (alg_mac) {
1653 case SSL_SHA1:
1654 mac = "SHA1";
1655 break;
1656
1657 case SSL_SHA256:
1658 mac = "SHA256";
1659 break;
1660
1661 case SSL_SHA384:
1662 mac = "SHA384";
1663 break;
1664
1665 case SSL_AEAD:
1666 mac = "AEAD";
1667 break;
1668
1669 default:
1670 mac = "unknown";
1671 break;
1672 }
1673
1674 if (buf == NULL) {
1675 len = 128;
1676 buf = (char *)OPENSSL_malloc(len);
1677 if (buf == NULL) {
1678 return NULL;
1679 }
1680 } else if (len < 128) {
1681 return "Buffer too small";
1682 }
1683
1684 BIO_snprintf(buf, len, "%-23s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s\n",
1685 cipher->name, kx, au, enc, mac);
1686 return buf;
1687 }
1688
SSL_CIPHER_get_version(const SSL_CIPHER * cipher)1689 const char *SSL_CIPHER_get_version(const SSL_CIPHER *cipher) {
1690 return "TLSv1/SSLv3";
1691 }
1692
STACK_OF(SSL_COMP)1693 STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) { return NULL; }
1694
SSL_COMP_add_compression_method(int id,COMP_METHOD * cm)1695 int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) { return 1; }
1696
SSL_COMP_get_name(const COMP_METHOD * comp)1697 const char *SSL_COMP_get_name(const COMP_METHOD *comp) { return NULL; }
1698
SSL_COMP_free_compression_methods(void)1699 void SSL_COMP_free_compression_methods(void) {}
1700
ssl_cipher_auth_mask_for_key(const EVP_PKEY * key)1701 uint32_t ssl_cipher_auth_mask_for_key(const EVP_PKEY *key) {
1702 switch (EVP_PKEY_id(key)) {
1703 case EVP_PKEY_RSA:
1704 return SSL_aRSA;
1705 case EVP_PKEY_EC:
1706 case EVP_PKEY_ED25519:
1707 /* Ed25519 keys in TLS 1.2 repurpose the ECDSA ciphers. */
1708 return SSL_aECDSA;
1709 default:
1710 return 0;
1711 }
1712 }
1713
ssl_cipher_uses_certificate_auth(const SSL_CIPHER * cipher)1714 int ssl_cipher_uses_certificate_auth(const SSL_CIPHER *cipher) {
1715 return (cipher->algorithm_auth & SSL_aCERT) != 0;
1716 }
1717
ssl_cipher_requires_server_key_exchange(const SSL_CIPHER * cipher)1718 int ssl_cipher_requires_server_key_exchange(const SSL_CIPHER *cipher) {
1719 /* Ephemeral Diffie-Hellman key exchanges require a ServerKeyExchange. */
1720 if (cipher->algorithm_mkey & SSL_kECDHE) {
1721 return 1;
1722 }
1723
1724 /* It is optional in all others. */
1725 return 0;
1726 }
1727
ssl_cipher_get_record_split_len(const SSL_CIPHER * cipher)1728 size_t ssl_cipher_get_record_split_len(const SSL_CIPHER *cipher) {
1729 size_t block_size;
1730 switch (cipher->algorithm_enc) {
1731 case SSL_3DES:
1732 block_size = 8;
1733 break;
1734 case SSL_AES128:
1735 case SSL_AES256:
1736 block_size = 16;
1737 break;
1738 default:
1739 return 0;
1740 }
1741
1742 /* All supported TLS 1.0 ciphers use SHA-1. */
1743 assert(cipher->algorithm_mac == SSL_SHA1);
1744 size_t ret = 1 + SHA_DIGEST_LENGTH;
1745 ret += block_size - (ret % block_size);
1746 return ret;
1747 }
1748