mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-04-12 20:30:52 +08:00
Code Issues Packages Projects Releases Wiki Activity
openssl/ssl/s3_lib.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

5206 lines
136 KiB
C
Raw Permalink Normal View History

Copyright consolidation 01/10 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-05-17 14:18:30 -04:00
/*
Copyright year updates Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2025-03-12 13:35:59 +00:00
* Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
Modify Sun copyright to follow OpenSSL style Approved by Oracle. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3585)
2017-06-15 10:16:46 -04:00
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
Merge Nokia copyright notice into standard This is done with the kind permission of Nokia. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3722)
2017-06-20 10:14:36 -04:00
* Copyright 2005 Nokia. All rights reserved.
First step towards SSL_peek fix.
2000-12-14 17:36:59 +00:00
*
Following the license change, modify the boilerplates in ssl/ Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7768)
2018-12-06 13:08:51 +01:00
* Licensed under the Apache License 2.0 (the "License"). You may not use
Copyright consolidation 01/10 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-05-17 14:18:30 -04:00
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
First step towards SSL_peek fix.
2000-12-14 17:36:59 +00:00
*/
Copyright consolidation 01/10 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-05-17 14:18:30 -04:00
ssl: rework "e_os.h" inclusions - Remove e_os.h include from "ssl_local.h" - Added e_os.h into the files that need it now. - Move e_os.h to be the very first include Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14344)
2021-02-21 00:04:07 +01:00
#include "internal/e_os.h"
Change #include filenames from <foo.h> to <openssl.h>. Submitted by: Reviewed by: PR:
1999-04-23 22:13:45 +00:00
#include <openssl/objects.h>
e_os.h removal from other headers and source files. Removed e_os.h from all bar three headers (apps/apps.h crypto/bio/bio_lcl.h and ssl/ssl_locl.h). Added e_os.h into the files that need it now. Directly reference internal/nelem.h when required. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
2017-08-18 13:52:46 +10:00
#include "internal/nelem.h"
Reorganize local header files Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-28 00:45:40 +02:00
#include "ssl_local.h"
Really add the EVP and all of the DES changes.
2001-07-30 23:57:25 +00:00
#include <openssl/md5.h>
Remove #error from include files. Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-18 14:30:20 -04:00
#include <openssl/dh.h>
Version negotiation rewrite cleanup Following the version negotiation rewrite all of the previous code that was dedicated to version negotiation can now be deleted - all six source files of it!! Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-31 13:57:46 +01:00
#include <openssl/rand.h>
Adapt CIPHER_DEBUG to the new generic trace API Co-authored-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8198)
2018-12-12 23:57:48 +01:00
#include <openssl/trace.h>
Explicitly cache X509v3 extensions in libssl Caching the X509v3 extensions requires an explicit libctx. We do that where required in libssl. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
2020-03-20 11:55:19 +00:00
#include <openssl/x509v3.h>
Deprecate EC_KEY + Update ec apps to use EVP_PKEY Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2020-10-15 13:41:59 +10:00
#include <openssl/core_names.h>
Add missing include of cryptlib.h Also use "" not <> for all include cryptlib Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4082)
2017-08-03 16:21:01 -04:00
#include "internal/cryptlib.h"
libssl: Move SSL object unwrapping macros to separate header Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23334)
2024-01-11 08:36:15 +00:00
#include "internal/ssl_unwrap.h"
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
#define TLS13_NUM_CIPHERS OSSL_NELEM(tls13_ciphers)
Add OSSL_NELEM macro. Add OSSL_NELEM macro to e_os.h to determine the number of elements in an array. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-02 18:30:00 +01:00
#define SSL3_NUM_CIPHERS OSSL_NELEM(ssl3_ciphers)
Add more first-class support for SCSVS Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain SSL_CIPHER objects for these non-valid ciphers. This will allow for unified handling of such indicators, especially as we are preparing to pass them around between functions. Since the 'valid' field is not set for the SCSVs, they should not be used for anything requiring a cryptographic cipher (as opposed to something being stuck in a cipher-shaped hole in the TLS wire protocol). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-03 17:17:21 -06:00
#define SSL3_NUM_SCSVS OSSL_NELEM(ssl3_scsvs)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Move the downgrade sentinel declarations to a header file Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-24 09:57:21 +00:00
/* TLSv1.3 downgrade protection sentinel values */
const unsigned char tls11downgrade[] = {
0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x00
};
const unsigned char tls12downgrade[] = {
0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x01
};
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
/* The list of available TLSv1.3 ciphers */
static SSL_CIPHER tls13_ciphers[] = {
{
1,
TLS1_3_RFC_AES_128_GCM_SHA256,
TLS1_3_RFC_AES_128_GCM_SHA256,
TLS1_3_CK_AES_128_GCM_SHA256,
Fix typo in the definition of tls13_ciphers SSL_kANY, and SSL_aANY were placed in the wrong fields. It makes no functional difference since these macros evaluate to 0 anyway, which is the correct value for these fields. Fixes #6048 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6095)
2018-04-26 14:20:59 +01:00
SSL_kANY,
SSL_aANY,
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
SSL_AES128GCM,
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
Fix typo in the definition of tls13_ciphers SSL_kANY, and SSL_aANY were placed in the wrong fields. It makes no functional difference since these macros evaluate to 0 anyway, which is the correct value for these fields. Fixes #6048 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6095)
2018-04-26 14:20:59 +01:00
0, 0,
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
SSL_HIGH,
Fix the SSL_CIPHER_find() function when used with a QCSO Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22011)
2023-09-07 17:45:49 +01:00
SSL_HANDSHAKE_MAC_SHA256 | SSL_QUIC,
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
128,
128,
}, {
1,
TLS1_3_RFC_AES_256_GCM_SHA384,
TLS1_3_RFC_AES_256_GCM_SHA384,
TLS1_3_CK_AES_256_GCM_SHA384,
SSL_kANY,
SSL_aANY,
SSL_AES256GCM,
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
SSL_HIGH,
Fix the SSL_CIPHER_find() function when used with a QCSO Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22011)
2023-09-07 17:45:49 +01:00
SSL_HANDSHAKE_MAC_SHA384 | SSL_QUIC,
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
256,
256,
},
{
1,
TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
TLS1_3_CK_CHACHA20_POLY1305_SHA256,
SSL_kANY,
SSL_aANY,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
SSL_HIGH,
Fix the SSL_CIPHER_find() function when used with a QCSO Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22011)
2023-09-07 17:45:49 +01:00
SSL_HANDSHAKE_MAC_SHA256 | SSL_QUIC,
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
256,
256,
},
{
1,
TLS1_3_RFC_AES_128_CCM_SHA256,
TLS1_3_RFC_AES_128_CCM_SHA256,
TLS1_3_CK_AES_128_CCM_SHA256,
SSL_kANY,
SSL_aANY,
SSL_AES128CCM,
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256,
128,
128,
}, {
1,
TLS1_3_RFC_AES_128_CCM_8_SHA256,
TLS1_3_RFC_AES_128_CCM_8_SHA256,
TLS1_3_CK_AES_128_CCM_8_SHA256,
SSL_kANY,
SSL_aANY,
SSL_AES128CCM8,
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
SSL_HANDSHAKE_MAC_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
128,
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
},
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
{
1,
TLS1_3_RFC_SHA256_SHA256,
TLS1_3_RFC_SHA256_SHA256,
TLS1_3_CK_SHA256_SHA256,
SSL_kANY,
SSL_aANY,
SSL_eNULL,
SSL_SHA256,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_STRONG_NONE,
SSL_HANDSHAKE_MAC_SHA256,
0,
256,
}, {
1,
TLS1_3_RFC_SHA384_SHA384,
TLS1_3_RFC_SHA384_SHA384,
TLS1_3_CK_SHA384_SHA384,
SSL_kANY,
SSL_aANY,
SSL_eNULL,
SSL_SHA384,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_STRONG_NONE,
SSL_HANDSHAKE_MAC_SHA384,
0,
384,
},
#endif
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
};
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
/*
Put DES into "not default" category. Add CVE to CHANGES Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-08-18 08:56:42 -04:00
* The list of available ciphers, mostly organized into the following
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
* groups:
* Always there
* EC
* PSK
* SRP (within that: RSA EC PSK)
fix spelling of Camellia in comment Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2337)
2017-02-02 09:56:47 +10:00
* Cipher families: Chacha/poly, Camellia, Gost, IDEA, SEED
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
* Weak ciphers
*/
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
static SSL_CIPHER ssl3_ciphers[] = {
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
1,
SSL3_TXT_RSA_NULL_MD5,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_RSA_NULL_MD5,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
SSL3_CK_RSA_NULL_MD5,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_kRSA,
SSL_aRSA,
SSL_eNULL,
SSL_MD5,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Apply Lutz Behnke's 56 bit cipher patch with a few minor changes. Docs haven't been added at this stage. They are probably best included in the 'ciphers' program docs.
2000-01-22 03:17:06 +00:00
0,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
0,
},
{
1,
SSL3_TXT_RSA_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_RSA_NULL_SHA,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
SSL3_CK_RSA_NULL_SHA,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_kRSA,
SSL_aRSA,
SSL_eNULL,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Apply Lutz Behnke's 56 bit cipher patch with a few minor changes. Docs haven't been added at this stage. They are probably best included in the 'ciphers' program docs.
2000-01-22 03:17:06 +00:00
0,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
1,
SSL3_TXT_RSA_DES_192_CBC3_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_RSA_DES_192_CBC3_SHA,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
SSL3_CK_RSA_DES_192_CBC3_SHA,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_kRSA,
SSL_aRSA,
SSL_3DES,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Update strength_bits for 3DES. Fix strength_bits to 112 for 3DES.
2014-06-09 08:55:37 +01:00
112,
Apply Lutz Behnke's 56 bit cipher patch with a few minor changes. Docs haven't been added at this stage. They are probably best included in the 'ciphers' program docs.
2000-01-22 03:17:06 +00:00
168,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
},
{
1,
Replace EDH-RSA-DES-CBC-SHA, etc. with DHE-RSA-DES-CBC-SHA Replace the full ciphersuites with "EDH-" in their labels with "DHE-" so that all DHE ciphersuites are referred to in the same way. Leave backward-compatible aliases for the ciphersuites in question so that configurations which specify these explicitly will continue working.
2013-12-20 02:28:10 -05:00
SSL3_TXT_DHE_DSS_DES_192_CBC3_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_DHE_DSS_DES_192_CBC3_SHA,
change SSL3_CK_EDH_* to SSL_CK_DHE_* (with backward-compatibility) This change normalizes the SSL_CK_DHE_ #defines to use the common term "DHE", while permitting older code that uses the more uncommon "EDH" constants to compile properly.
2013-12-20 01:42:03 -05:00
SSL3_CK_DHE_DSS_DES_192_CBC3_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aDSS,
SSL_3DES,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Update strength_bits for 3DES. Fix strength_bits to 112 for 3DES.
2014-06-09 08:55:37 +01:00
112,
Apply Lutz Behnke's 56 bit cipher patch with a few minor changes. Docs haven't been added at this stage. They are probably best included in the 'ciphers' program docs.
2000-01-22 03:17:06 +00:00
168,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
},
{
1,
Replace EDH-RSA-DES-CBC-SHA, etc. with DHE-RSA-DES-CBC-SHA Replace the full ciphersuites with "EDH-" in their labels with "DHE-" so that all DHE ciphersuites are referred to in the same way. Leave backward-compatible aliases for the ciphersuites in question so that configurations which specify these explicitly will continue working.
2013-12-20 02:28:10 -05:00
SSL3_TXT_DHE_RSA_DES_192_CBC3_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_DHE_RSA_DES_192_CBC3_SHA,
change SSL3_CK_EDH_* to SSL_CK_DHE_* (with backward-compatibility) This change normalizes the SSL_CK_DHE_ #defines to use the common term "DHE", while permitting older code that uses the more uncommon "EDH" constants to compile properly.
2013-12-20 01:42:03 -05:00
SSL3_CK_DHE_RSA_DES_192_CBC3_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
SSL_3DES,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Update strength_bits for 3DES. Fix strength_bits to 112 for 3DES.
2014-06-09 08:55:37 +01:00
112,
Apply Lutz Behnke's 56 bit cipher patch with a few minor changes. Docs haven't been added at this stage. They are probably best included in the 'ciphers' program docs.
2000-01-22 03:17:06 +00:00
168,
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
},
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
{
1,
SSL3_TXT_ADH_DES_192_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_ADH_DES_192_CBC_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
SSL3_CK_ADH_DES_192_CBC_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aNULL,
SSL_3DES,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Update strength_bits for 3DES. Fix strength_bits to 112 for 3DES.
2014-06-09 08:55:37 +01:00
112,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
168,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
#endif
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
{
1,
TLS1_TXT_RSA_WITH_AES_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_128_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_RSA_WITH_AES_128_SHA,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_kRSA,
SSL_aRSA,
SSL_AES128,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
128,
128,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_AES_128_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aDSS,
SSL_AES128,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
128,
128,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_128_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
SSL_AES128,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
128,
128,
},
{
1,
TLS1_TXT_ADH_WITH_AES_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_AES_128_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_ADH_WITH_AES_128_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aNULL,
SSL_AES128,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
128,
128,
},
{
1,
TLS1_TXT_RSA_WITH_AES_256_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_256_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_RSA_WITH_AES_256_SHA,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_kRSA,
SSL_aRSA,
SSL_AES256,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
256,
256,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_AES_256_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aDSS,
SSL_AES256,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
256,
256,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_256_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
SSL_AES256,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
256,
256,
},
{
1,
TLS1_TXT_ADH_WITH_AES_256_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_AES_256_SHA,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
TLS1_CK_ADH_WITH_AES_256_SHA,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aNULL,
SSL_AES256,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Keep cipher lists sorted in the source instead of sorting them at runtime, thus removing the need for a lock. Add a test to ssltest to verify that the cipher lists are sorted.
2005-08-25 07:29:54 +00:00
256,
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
{
1,
TLS1_TXT_RSA_WITH_NULL_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_NULL_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_RSA_WITH_NULL_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_eNULL,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
{
1,
TLS1_TXT_RSA_WITH_AES_128_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_128_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_RSA_WITH_AES_128_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_AES128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_RSA_WITH_AES_256_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_256_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_RSA_WITH_AES_256_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_AES256,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_AES_128_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_aDSS,
SSL_AES128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_128_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_aRSA,
SSL_AES128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_AES_256_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_aDSS,
SSL_AES256,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
},
{
1,
TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_256_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_aRSA,
SSL_AES256,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
},
{
1,
TLS1_TXT_ADH_WITH_AES_128_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_AES_128_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_ADH_WITH_AES_128_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_aNULL,
SSL_AES128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
128,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
},
{
1,
TLS1_TXT_ADH_WITH_AES_256_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_AES_256_SHA256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
TLS1_CK_ADH_WITH_AES_256_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_aNULL,
SSL_AES256,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
256,
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
},
1. Changes for s_client.c to make it return non-zero exit code in case of handshake failure 2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to make it recognize GOST certificates as EVP_PKT_SIGN|EVP_PKT_EXCH (required for s3_srvr to accept GOST client certificates). 3. Changes to EVP - adding of function EVP_PKEY_CTX_get0_peerkey - Make function EVP_PKEY_derive_set_peerkey work for context with ENCRYPT operation, because we use peerkey field in the context to pass non-ephemeral secret key to GOST encrypt operation. - added EVP_PKEY_CTRL_SET_IV control command. It is really GOST-specific, but it is used in SSL code, so it has to go in some header file, available during libssl compilation 4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data 5. Include des.h if KSSL_DEBUG is defined into some libssl files, to make debugging output which depends on constants defined there, work and other KSSL_DEBUG output fixes 6. Declaration of real GOST ciphersuites, two authentication methods SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST 7. Implementation of these methods. 8. Support for sending unsolicited serverhello extension if GOST ciphersuite is selected. It is require for interoperability with CryptoPro CSP 3.0 and 3.6 and controlled by SSL_OP_CRYPTOPRO_TLSEXT_BUG constant. This constant is added to SSL_OP_ALL, because it does nothing, if non-GOST ciphersuite is selected, and all implementation of GOST include compatibility with CryptoPro. 9. Support for CertificateVerify message without length field. It is another CryptoPro bug, but support is made unconditional, because it does no harm for draft-conforming implementation. 10. In tls1_mac extra copy of stream mac context is no more done. When I've written currently commited code I haven't read EVP_DigestSignFinal manual carefully enough and haven't noticed that it does an internal digest ctx copying. This implementation was tested against 1. CryptoPro CSP 3.6 client and server 2. Cryptopro CSP 3.0 server
2007-10-26 12:06:36 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
Camellia cipher, contributed by NTT Submitted by: Masashi Fujita Reviewed by: Bodo Moeller
2006-06-09 15:44:59 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_kRSA,
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Camellia cipher, contributed by NTT Submitted by: Masashi Fujita Reviewed by: Bodo Moeller
2006-06-09 15:44:59 +00:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aRSA,
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
Camellia cipher, contributed by NTT Submitted by: Masashi Fujita Reviewed by: Bodo Moeller
2006-06-09 15:44:59 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Camellia cipher, contributed by NTT Submitted by: Masashi Fujita Reviewed by: Bodo Moeller
2006-06-09 15:44:59 +00:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aDSS,
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
add initial support for RFC 4279 PSK SSL ciphersuites PR: 1191 Submitted by: Mika Kousa and Pasi Eronen of Nokia Corporation Reviewed by: Nils Larsch
2006-03-10 23:06:27 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
SSL_kDHE,
SSL_aDSS,
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
add initial support for RFC 4279 PSK SSL ciphersuites PR: 1191 Submitted by: Mika Kousa and Pasi Eronen of Nokia Corporation Reviewed by: Nils Larsch
2006-03-10 23:06:27 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
SSL_kDHE,
SSL_aNULL,
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
add initial support for RFC 4279 PSK SSL ciphersuites PR: 1191 Submitted by: Mika Kousa and Pasi Eronen of Nokia Corporation Reviewed by: Nils Larsch
2006-03-10 23:06:27 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
SSL_kDHE,
SSL_aNULL,
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
add initial support for RFC 4279 PSK SSL ciphersuites PR: 1191 Submitted by: Mika Kousa and Pasi Eronen of Nokia Corporation Reviewed by: Nils Larsch
2006-03-10 23:06:27 +00:00
256,
256,
},
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_AES_128_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_128_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_AES_128_CCM,
SSL_kRSA,
SSL_aRSA,
SSL_AES128CCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_AES_256_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_256_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_AES_256_CCM,
SSL_kRSA,
SSL_aRSA,
SSL_AES256CCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_AES_128_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_128_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_AES_128_CCM,
SSL_kDHE,
SSL_aRSA,
SSL_AES128CCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_AES_256_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_256_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_AES_256_CCM,
SSL_kDHE,
SSL_aRSA,
SSL_AES256CCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_AES_128_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_128_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_AES_128_CCM_8,
SSL_kRSA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES128CCM8,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_AES_256_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_AES_256_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_AES_256_CCM_8,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_kRSA,
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256CCM8,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_AES_128_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_128_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_AES_128_CCM_8,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES128CCM8,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_AES_256_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_AES_256_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_AES_256_CCM_8,
use SSL_kDHE throughout instead of SSL_kEDH DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
2013-12-19 15:11:15 -05:00
SSL_kDHE,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256CCM8,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_128_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_128_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_128_CCM,
SSL_kPSK,
SSL_aPSK,
SSL_AES128CCM,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_256_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_256_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_256_CCM,
SSL_kPSK,
SSL_aPSK,
SSL_AES256CCM,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_128_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_128_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_128_CCM,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES128CCM,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_256_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_256_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_256_CCM,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES256CCM,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
256,
256,
},
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_128_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_128_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_128_CCM_8,
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
SSL_kPSK,
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES128CCM8,
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_256_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_256_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_256_CCM_8,
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
SSL_kPSK,
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256CCM8,
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Add PSK GCM ciphersuites from RFC5487 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 14:47:53 +01:00
256,
},
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_128_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_128_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_128_CCM_8,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_kDHEPSK,
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES128CCM8,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_256_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_256_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_256_CCM_8,
SSL_kDHEPSK,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256CCM8,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES128CCM,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES256CCM,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM_8,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES128CCM8,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM_8,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM_8,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM_8,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES256CCM8,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
tls: reduce the strength of CCM_8 ciphers due to their short IV. Fixes #16154 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-22 10:31:22 +10:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits This is the length of the tag they use and should be considered an upper bound on their strength. This lowers their security strength to level 0. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16652)
2021-09-23 12:27:11 +10:00
64, /* CCM8 uses a short tag, so we have a low security strength */
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_NULL_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
SSL_kECDHE,
SSL_aECDSA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_eNULL,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
SSL_kECDHE,
SSL_aECDSA,
SSL_3DES,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
SSL_kECDHE,
SSL_aECDSA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_AES128,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
SSL_kECDHE,
SSL_aECDSA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_AES256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
256,
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_NULL_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
SSL_kECDHE,
SSL_aRSA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_eNULL,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
SSL_kECDHE,
SSL_aRSA,
SSL_3DES,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
SSL_kECDHE,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_aRSA,
SSL_AES128,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
SSL_kECDHE,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_aRSA,
SSL_AES256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
256,
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDH_anon_WITH_NULL_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDH_anon_WITH_NULL_SHA,
SSL_kECDHE,
SSL_aNULL,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_eNULL,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDH_anon_WITH_DES_192_CBC3_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
SSL_kECDHE,
SSL_aNULL,
SSL_3DES,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDH_anon_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
SSL_kECDHE,
SSL_aNULL,
SSL_AES128,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDH_anon_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
SSL_kECDHE,
SSL_aNULL,
SSL_AES256,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES128,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_AES_128_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
SSL_kECDHE,
SSL_aRSA,
SSL_AES128,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_AES_256_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
SSL_kECDHE,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES128GCM,
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
128,
},
{
1,
TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
SSL_kECDHE,
SSL_aECDSA,
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
SSL_kECDHE,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES128GCM,
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
128,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
SSL_kECDHE,
SSL_aRSA,
SSL_AES256GCM,
SSL_AEAD,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Add SHA256 Camellia ciphersuites from RFC5932 PR#2800
2014-06-27 18:22:51 +01:00
256,
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_NULL_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_NULL_SHA,
SSL_kPSK,
SSL_aPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_eNULL,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
0,
0,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_NULL_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_NULL_SHA,
SSL_kDHEPSK,
SSL_aPSK,
SSL_eNULL,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0,
0,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_NULL_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_NULL_SHA,
SSL_kRSAPSK,
SSL_aRSA,
SSL_eNULL,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_3DES_EDE_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
SSL_kPSK,
SSL_aPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_3DES,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Update strength_bits for 3DES. Fix strength_bits to 112 for 3DES.
2014-06-09 08:55:37 +01:00
112,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
168,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
SSL_kPSK,
SSL_aPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_AES128,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
SSL_kPSK,
SSL_aPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_AES256,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
256,
256,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
SSL_kDHEPSK,
SSL_aPSK,
SSL_3DES,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
112,
168,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
TLS1_TXT_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
SSL_kRSAPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
SSL_3DES,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Update strength_bits for 3DES. Fix strength_bits to 112 for 3DES.
2014-06-09 08:55:37 +01:00
112,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
168,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA,
SSL_kRSAPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
SSL_AES128,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA,
SSL_kRSAPSK,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
SSL_aRSA,
SSL_AES256,
SSL_SHA1,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Update ssl code to support digests other than MD5+SHA1 in handshake. Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
2007-08-31 12:42:53 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
256,
256,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_128_GCM_SHA256,
SSL_kPSK,
SSL_aPSK,
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_256_GCM_SHA384,
SSL_kPSK,
SSL_aPSK,
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_128_GCM_SHA256,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_256_GCM_SHA384,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
256,
256,
},
Add SRP support.
2011-03-12 17:01:19 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_AES_128_GCM_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_AES_128_GCM_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_AES_128_GCM_SHA256,
SSL_kRSAPSK,
Add SRP support.
2011-03-12 17:01:19 +00:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_AES128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
Add SRP support.
2011-03-12 17:01:19 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_AES_256_GCM_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_AES_256_GCM_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_AES_256_GCM_SHA384,
SSL_kRSAPSK,
SSL_aRSA,
SSL_AES256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
Add SRP support.
2011-03-12 17:01:19 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_128_CBC_SHA256,
SSL_kPSK,
SSL_aPSK,
Add SRP support.
2011-03-12 17:01:19 +00:00
SSL_AES128,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA256,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Add SRP support.
2011-03-12 17:01:19 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_AES_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_AES_256_CBC_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_AES_256_CBC_SHA384,
SSL_kPSK,
SSL_aPSK,
SSL_AES256,
SSL_SHA384,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
Add SRP support.
2011-03-12 17:01:19 +00:00
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Add SRP support.
2011-03-12 17:01:19 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_NULL_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_NULL_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_NULL_SHA256,
SSL_kPSK,
SSL_aPSK,
SSL_eNULL,
SSL_SHA256,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
Add SRP support.
2011-03-12 17:01:19 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0,
0,
Add SRP support.
2011-03-12 17:01:19 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_NULL_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_NULL_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_NULL_SHA384,
SSL_kPSK,
SSL_aPSK,
SSL_eNULL,
SSL_SHA384,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0,
0,
Add SRP support.
2011-03-12 17:01:19 +00:00
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
Add SRP support.
2011-03-12 17:01:19 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA256,
SSL_kDHEPSK,
SSL_aPSK,
SSL_AES128,
SSL_SHA256,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
Add SRP support.
2011-03-12 17:01:19 +00:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
128,
Add SRP support.
2011-03-12 17:01:19 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA384,
SSL_kDHEPSK,
SSL_aPSK,
Add SRP support.
2011-03-12 17:01:19 +00:00
SSL_AES256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_SHA384,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH | SSL_FIPS,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Add SRP support.
2011-03-12 17:01:19 +00:00
256,
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_NULL_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_NULL_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_NULL_SHA256,
SSL_kDHEPSK,
SSL_aPSK,
SSL_eNULL,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
SSL_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_NULL_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_NULL_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_NULL_SHA384,
SSL_kDHEPSK,
SSL_aPSK,
SSL_eNULL,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
SSL_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0,
0,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA256,
SSL_kRSAPSK,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
SSL_aRSA,
SSL_AES128,
SSL_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
128,
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
128,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA384,
SSL_kRSAPSK,
Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and prohibit use of these ciphersuites for TLS < 1.2
2011-07-25 20:41:32 +00:00
SSL_aRSA,
SSL_AES256,
SSL_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
256,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_NULL_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_NULL_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_NULL_SHA256,
SSL_kRSAPSK,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_eNULL,
SSL_SHA256,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_NULL_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_NULL_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_NULL_SHA384,
SSL_kRSAPSK,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_eNULL,
SSL_SHA384,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE | SSL_FIPS,
Expand range of ctrls for AES GCM to support retrieval and setting of invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-08-03 15:37:22 +00:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0,
0,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
TLS1_TXT_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_3DES,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
3DES ciphersuites are not allowed in FIPS anymore Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25028)
2024-07-29 19:49:51 +02:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_AES128,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_AES256,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_AES128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_AES256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Remove support for all 40 and 56 bit ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
2015-12-05 02:04:41 +01:00
SSL_HIGH | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
{
1,
TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_NULL_SHA,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_eNULL,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
{
1,
TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA256,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_NULL_SHA256,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_eNULL,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
0,
0,
},
{
1,
TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA384,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
TLS1_CK_ECDHE_PSK_WITH_NULL_SHA384,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_eNULL,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Don't mark the eNULL ciphers as non-default. They're not part of ALL, so they're not part of COMPLEMENTOFDEFAULT Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2202
2016-03-03 22:02:58 +01:00
SSL_STRONG_NONE | SSL_FIPS,
Add RFC4279, RFC5487 and RFC5489 ciphersuites. Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 17:05:47 +01:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
0,
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
#endif
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
SSL_kSRP,
SSL_aSRP,
SSL_3DES,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Put DES into "not default" category. Add CVE to CHANGES Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-08-18 08:56:42 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
},
{
1,
TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_kSRP,
SSL_aRSA,
SSL_3DES,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Put DES into "not default" category. Add CVE to CHANGES Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-08-18 08:56:42 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
},
{
1,
TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_kSRP,
SSL_aDSS,
SSL_3DES,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Move 3DES from HIGH to MEDIUM Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-05 17:08:41 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
112,
168,
},
To avoid SWEET32 attack, move 3DES to weak Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-07-30 12:21:32 -04:00
# endif
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
SSL_kSRP,
SSL_aSRP,
SSL_AES128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
SSL_kSRP,
SSL_aRSA,
SSL_AES128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
SSL_kSRP,
SSL_aDSS,
SSL_AES128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
SSL_kSRP,
SSL_aSRP,
SSL_AES256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
SSL_kSRP,
SSL_aRSA,
SSL_AES256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
SSL_kSRP,
SSL_aDSS,
SSL_AES256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_CHACHA20_POLY1305,
SSL_kDHE,
SSL_aRSA,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305,
SSL_kECDHE,
SSL_aRSA,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
SSL_kECDHE,
SSL_aECDSA,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_PSK_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_CHACHA20_POLY1305,
SSL_kPSK,
SSL_aPSK,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_DHE_PSK_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_CHACHA20_POLY1305,
SSL_kDHEPSK,
SSL_aPSK,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_RSA_PSK_WITH_CHACHA20_POLY1305,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_CHACHA20_POLY1305,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_CHACHA20_POLY1305,
SSL_kRSAPSK,
SSL_aRSA,
SSL_CHACHA20POLY1305,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_CAMELLIA128,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
[ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias `SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already marked as aliases of each other in the headers. This commit, for each pair, replaces the leftover uses of the latter synonym with the first one, which is considered more common. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17763)
2022-02-22 14:47:11 +02:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aDSS,
SSL_CAMELLIA128,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
[ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias `SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already marked as aliases of each other in the headers. This commit, for each pair, replaces the leftover uses of the latter synonym with the first one, which is considered more common. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17763)
2022-02-22 14:47:11 +02:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aRSA,
SSL_CAMELLIA128,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256,
[ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias `SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already marked as aliases of each other in the headers. This commit, for each pair, replaces the leftover uses of the latter synonym with the first one, which is considered more common. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17763)
2022-02-22 14:47:11 +02:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aNULL,
SSL_CAMELLIA128,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_CAMELLIA256,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
[ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias `SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already marked as aliases of each other in the headers. This commit, for each pair, replaces the leftover uses of the latter synonym with the first one, which is considered more common. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17763)
2022-02-22 14:47:11 +02:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aDSS,
SSL_CAMELLIA256,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
[ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias `SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already marked as aliases of each other in the headers. This commit, for each pair, replaces the leftover uses of the latter synonym with the first one, which is considered more common. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17763)
2022-02-22 14:47:11 +02:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aRSA,
SSL_CAMELLIA256,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256,
[ssl] Prefer SSL_k(EC)?DHE to the SSL_kE(EC)?DH alias `SSL_kECDHE` and `SSL_kEECDH`, and `SSL_kDHE` and `SSL_kEDH` are already marked as aliases of each other in the headers. This commit, for each pair, replaces the leftover uses of the latter synonym with the first one, which is considered more common. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17763)
2022-02-22 14:47:11 +02:00
SSL_kDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aNULL,
SSL_CAMELLIA256,
SSL_SHA256,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
256,
256,
},
{
1,
TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
SSL_kRSA,
SSL_aRSA,
SSL_CAMELLIA256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
SSL_kDHE,
SSL_aDSS,
SSL_CAMELLIA256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
SSL_kDHE,
SSL_aRSA,
SSL_CAMELLIA256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
SSL_kDHE,
SSL_aNULL,
SSL_CAMELLIA256,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
256,
256,
},
{
1,
TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
SSL_kRSA,
SSL_aRSA,
SSL_CAMELLIA128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
SSL_kDHE,
SSL_aDSS,
SSL_CAMELLIA128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
SSL_kDHE,
SSL_aRSA,
SSL_CAMELLIA128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
1,
TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
SSL_kDHE,
SSL_aNULL,
SSL_CAMELLIA128,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
},
{
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
1,
TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kECDHE,
SSL_aECDSA,
SSL_CAMELLIA128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
128,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
1,
TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
SSL_kECDHE,
SSL_aECDSA,
SSL_CAMELLIA256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
1,
TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kECDHE,
SSL_aRSA,
SSL_CAMELLIA128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
128,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
1,
TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
SSL_kECDHE,
SSL_aRSA,
SSL_CAMELLIA256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
Add support for Camellia HMAC-Based cipher suites from RFC6367 While RFC6367 focuses on Camellia-GCM cipher suites, it also adds a few cipher suites that use SHA-2 based HMAC that can be very easily added. Tested against gnutls 3.3.5 PR#3443 Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-23 15:03:59 +02:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
1,
TLS1_TXT_PSK_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_CAMELLIA_128_CBC_SHA256,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
TLS1_CK_PSK_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kPSK,
SSL_aPSK,
SSL_CAMELLIA128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
128,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
1,
TLS1_TXT_PSK_WITH_CAMELLIA_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_CAMELLIA_256_CBC_SHA384,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
TLS1_CK_PSK_WITH_CAMELLIA_256_CBC_SHA384,
SSL_kPSK,
SSL_aPSK,
SSL_CAMELLIA256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
1,
TLS1_TXT_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
TLS1_CK_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kDHEPSK,
SSL_aPSK,
SSL_CAMELLIA128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
128,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
1,
TLS1_TXT_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
TLS1_CK_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
SSL_kDHEPSK,
SSL_aPSK,
SSL_CAMELLIA256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
1,
TLS1_TXT_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
TLS1_CK_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kRSAPSK,
SSL_aRSA,
SSL_CAMELLIA128,
SSL_SHA256,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
128,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
1,
TLS1_TXT_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
TLS1_CK_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
SSL_kRSAPSK,
SSL_aRSA,
SSL_CAMELLIA256,
SSL_SHA384,
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
CAMELLIA PSK ciphersuites from RFC6367 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-30 19:14:58 +01:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
SSL_kECDHEPSK,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_CAMELLIA128,
SSL_SHA256,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
128,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
128,
},
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
SSL_kECDHEPSK,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_CAMELLIA256,
SSL_SHA384,
TLS1_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Rework the default cipherlist. - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-03 19:50:03 +01:00
SSL_NOT_DEFAULT | SSL_HIGH,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
RT4458: Fix #ifndef line for GOST Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-22 09:16:36 +10:00
#ifndef OPENSSL_NO_GOST
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
"GOST2001-GOST89-GOST89",
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
"TLS_GOSTR341001_WITH_28147_CNT_IMIT",
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0x3000081,
SSL_kGOST,
SSL_aGOST01,
SSL_eGOST2814789CNT,
SSL_GOST89MAC,
TLS1_VERSION, TLS1_2_VERSION,
Don't use GOST ciphersuites with DTLS. RT#4438 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-05-11 21:00:12 +01:00
0, 0,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH,
SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
# ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
"GOST2001-NULL-GOST94",
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
"TLS_GOSTR341001_WITH_NULL_GOSTR3411",
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0x3000083,
SSL_kGOST,
SSL_aGOST01,
SSL_eNULL,
SSL_GOST94,
TLS1_VERSION, TLS1_2_VERSION,
Don't use GOST ciphersuites with DTLS. RT#4438 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-05-11 21:00:12 +01:00
0, 0,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE,
SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94,
0,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
# endif
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
TLS Cipher Suite 0xC102 Support For GOST2012-GOST8912-GOST8912 was used 0xFF85 identifier, but new identifier 0xc102 was assigned. Because of old software we will support both numbers. https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 https://datatracker.ietf.org/doc/draft-smyshlyaev-tls12-gost-suites/ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11403)
2020-03-25 16:00:43 +03:00
"IANA-GOST2012-GOST8912-GOST8912",
NULL,
0x0300c102,
SSL_kGOST,
SSL_aGOST12 | SSL_aGOST01,
SSL_eGOST2814789CNT12,
SSL_GOST89MAC12,
TLS1_VERSION, TLS1_2_VERSION,
0, 0,
SSL_HIGH,
SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
256,
256,
},
{
1,
"LEGACY-GOST2012-GOST8912-GOST8912",
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
NULL,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0x0300ff85,
SSL_kGOST,
SSL_aGOST12 | SSL_aGOST01,
SSL_eGOST2814789CNT12,
SSL_GOST89MAC12,
TLS1_VERSION, TLS1_2_VERSION,
Don't use GOST ciphersuites with DTLS. RT#4438 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-05-11 21:00:12 +01:00
0, 0,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_HIGH,
SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
256,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
256,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
# ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
{
1,
"GOST2012-NULL-GOST12",
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
NULL,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0x0300ff87,
SSL_kGOST,
SSL_aGOST12 | SSL_aGOST01,
SSL_eNULL,
SSL_GOST12_256,
TLS1_VERSION, TLS1_2_VERSION,
Don't use GOST ciphersuites with DTLS. RT#4438 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-05-11 21:00:12 +01:00
0, 0,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_STRONG_NONE,
SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
0,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
0,
},
Add support for integrity-only cipher suites for TLS v1.3 - add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2023-12-01 12:47:07 +01:00
# endif
New Russian TLS 1.2 implementation Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11442)
2020-03-30 18:09:24 +03:00
{
1,
"GOST2012-KUZNYECHIK-KUZNYECHIKOMAC",
NULL,
0x0300C100,
SSL_kGOST18,
SSL_aGOST12,
SSL_KUZNYECHIK,
SSL_KUZNYECHIKOMAC,
TLS1_2_VERSION, TLS1_2_VERSION,
0, 0,
SSL_HIGH,
SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_TLSTREE,
256,
256,
},
{
1,
"GOST2012-MAGMA-MAGMAOMAC",
NULL,
0x0300C101,
SSL_kGOST18,
SSL_aGOST12,
SSL_MAGMA,
SSL_MAGMAOMAC,
TLS1_2_VERSION, TLS1_2_VERSION,
0, 0,
SSL_HIGH,
SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_TLSTREE,
256,
256,
},
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
#endif /* OPENSSL_NO_GOST */
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_TXT_RSA_IDEA_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_RSA_IDEA_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_CK_RSA_IDEA_128_SHA,
SSL_kRSA,
SSL_aRSA,
SSL_IDEA,
SSL_SHA1,
SSL3_VERSION, TLS1_1_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_WITH_SEED_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_WITH_SEED_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_WITH_SEED_SHA,
SSL_kRSA,
SSL_aRSA,
SSL_SEED,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_DSS_WITH_SEED_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_DSS_WITH_SEED_SHA,
SSL_kDHE,
SSL_aDSS,
SSL_SEED,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
128,
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_RSA_WITH_SEED_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_RSA_WITH_SEED_SHA,
SSL_kDHE,
SSL_aRSA,
SSL_SEED,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
128,
128,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ADH_WITH_SEED_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ADH_WITH_SEED_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ADH_WITH_SEED_SHA,
SSL_kDHE,
SSL_aNULL,
SSL_SEED,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
Fix cipher support for DTLS1_BAD_VER Commit 3eb2aff40 ("Add support for minimum and maximum protocol version supported by a cipher") disabled all ciphers for DTLS1_BAD_VER. That wasn't helpful. Give them back. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-08 20:59:50 +01:00
DTLS1_BAD_VER, DTLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
128,
128,
},
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
{
1,
SSL3_TXT_RSA_RC4_128_MD5,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_RSA_RC4_128_MD5,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_CK_RSA_RC4_128_MD5,
SSL_kRSA,
SSL_aRSA,
SSL_RC4,
SSL_MD5,
SSL3_VERSION, TLS1_2_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
},
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_TXT_RSA_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_RSA_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_CK_RSA_RC4_128_SHA,
SSL_kRSA,
SSL_aRSA,
SSL_RC4,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_TXT_ADH_RC4_128_MD5,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
SSL3_RFC_ADH_RC4_128_MD5,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL3_CK_ADH_RC4_128_MD5,
SSL_kDHE,
SSL_aNULL,
SSL_RC4,
SSL_MD5,
SSL3_VERSION, TLS1_2_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
128,
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_PSK_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_PSK_WITH_RC4_128_SHA,
SSL_kECDHEPSK,
SSL_aPSK,
SSL_RC4,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Add CCM ciphersuites from RFC6655 and RFC7251 Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-31 16:53:45 +01:00
},
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDH_anon_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
SSL_kECDHE,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_aNULL,
SSL_RC4,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_ECDSA_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
SSL_kECDHE,
SSL_aECDSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_RC4,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_ECDHE_RSA_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
SSL_kECDHE,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
SSL_aRSA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_RC4,
SSL_SHA1,
Remove ECDH(E) ciphers from SSLv3 SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
2017-04-11 09:02:05 -04:00
TLS1_VERSION, TLS1_2_VERSION,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_PSK_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_PSK_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_PSK_WITH_RC4_128_SHA,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
SSL_kPSK,
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_RC4,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_RSA_PSK_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_RSA_PSK_WITH_RC4_128_SHA,
SSL_kRSAPSK,
SSL_aRSA,
SSL_RC4,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
},
{
1,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_TXT_DHE_PSK_WITH_RC4_128_SHA,
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
TLS1_RFC_DHE_PSK_WITH_RC4_128_SHA,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
TLS1_CK_DHE_PSK_WITH_RC4_128_SHA,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
SSL_kDHEPSK,
SSL_aPSK,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
SSL_RC4,
SSL_SHA1,
SSL3_VERSION, TLS1_2_VERSION,
0, 0,
SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
Change TLS RC4 cipher strength check to be data driven. This is a same pattern as used in PR #16652 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16656)
2021-09-22 15:53:54 +10:00
80,
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
128,
Wire ChaCha20-Poly1305 to TLS. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-09 21:47:00 +01:00
},
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
#endif /* OPENSSL_NO_WEAK_SSL_CIPHERS */
Patch containing TLS implementation for GOST 2012 This patch contains the necessary changes to provide GOST 2012 ciphersuites in TLS. It requires the use of an external GOST 2012 engine. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-11-17 15:32:30 +00:00
Implement Aria GCM/CCM Modes and TLS cipher suites AEAD cipher mode implementation is based on that used for AES: https://tools.ietf.org/html/rfc5116 TLS GCM cipher suites as specified in: https://tools.ietf.org/html/rfc6209 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4287)
2017-08-22 09:56:13 +10:00
{
1,
TLS1_TXT_RSA_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_RSA_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_RSA_WITH_ARIA_128_GCM_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_RSA_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_RSA_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_RSA_WITH_ARIA_256_GCM_SHA384,
SSL_kRSA,
SSL_aRSA,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
SSL_kDHE,
SSL_aRSA,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
SSL_kDHE,
SSL_aRSA,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_DHE_DSS_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_DHE_DSS_WITH_ARIA_128_GCM_SHA256,
SSL_kDHE,
SSL_aDSS,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_DHE_DSS_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_DHE_DSS_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_DHE_DSS_WITH_ARIA_256_GCM_SHA384,
SSL_kDHE,
SSL_aDSS,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
SSL_kECDHE,
SSL_aECDSA,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
SSL_kECDHE,
SSL_aECDSA,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
SSL_kECDHE,
SSL_aRSA,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
SSL_kECDHE,
SSL_aRSA,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_PSK_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_PSK_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_PSK_WITH_ARIA_128_GCM_SHA256,
SSL_kPSK,
SSL_aPSK,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_PSK_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_PSK_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_PSK_WITH_ARIA_256_GCM_SHA384,
SSL_kPSK,
SSL_aPSK,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
SSL_kDHEPSK,
SSL_aPSK,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
SSL_kDHEPSK,
SSL_aPSK,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
{
1,
TLS1_TXT_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
TLS1_RFC_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
TLS1_CK_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
SSL_kRSAPSK,
SSL_aRSA,
SSL_ARIA128GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
{
1,
TLS1_TXT_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
TLS1_RFC_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
TLS1_CK_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
SSL_kRSAPSK,
SSL_aRSA,
SSL_ARIA256GCM,
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
SSL_NOT_DEFAULT | SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
256,
256,
},
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
};
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add more first-class support for SCSVS Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain SSL_CIPHER objects for these non-valid ciphers. This will allow for unified handling of such indicators, especially as we are preparing to pass them around between functions. Since the 'valid' field is not set for the SCSVs, they should not be used for anything requiring a cryptographic cipher (as opposed to something being stuck in a cipher-shaped hole in the TLS wire protocol). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-03 17:17:21 -06:00
/*
* The list of known Signalling Cipher-Suite Value "ciphers", non-valid
* values stuffed into the ciphers field of the wire protocol for signalling
* purposes.
*/
static SSL_CIPHER ssl3_scsvs[] = {
{
0,
"TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
"TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
Add more first-class support for SCSVS Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain SSL_CIPHER objects for these non-valid ciphers. This will allow for unified handling of such indicators, especially as we are preparing to pass them around between functions. Since the 'valid' field is not set for the SCSVs, they should not be used for anything requiring a cryptographic cipher (as opposed to something being stuck in a cipher-shaped hole in the TLS wire protocol). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-03 17:17:21 -06:00
SSL3_CK_SCSV,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
},
{
0,
"TLS_FALLBACK_SCSV",
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
"TLS_FALLBACK_SCSV",
Add more first-class support for SCSVS Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain SSL_CIPHER objects for these non-valid ciphers. This will allow for unified handling of such indicators, especially as we are preparing to pass them around between functions. Since the 'valid' field is not set for the SCSVs, they should not be used for anything requiring a cryptographic cipher (as opposed to something being stuck in a cipher-shaped hole in the TLS wire protocol). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-03 17:17:21 -06:00
SSL3_CK_FALLBACK_SCSV,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
},
};
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
static int cipher_compare(const void *a, const void *b)
{
const SSL_CIPHER *ap = (const SSL_CIPHER *)a;
const SSL_CIPHER *bp = (const SSL_CIPHER *)b;
Fix cipher_compare Unsigned overflow. Found by Brian Carpenter Fixes #3889 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3890)
2017-07-08 22:13:24 +02:00
if (ap->id == bp->id)
return 0;
return ap->id < bp->id ? -1 : 1;
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
}
void ssl_sort_cipher_list(void)
{
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
qsort(tls13_ciphers, TLS13_NUM_CIPHERS, sizeof(tls13_ciphers[0]),
cipher_compare);
Consistent formatting for sizeof(foo) Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4872)
2017-12-07 13:39:34 -05:00
qsort(ssl3_ciphers, SSL3_NUM_CIPHERS, sizeof(ssl3_ciphers[0]),
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
cipher_compare);
Consistent formatting for sizeof(foo) Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4872)
2017-12-07 13:39:34 -05:00
qsort(ssl3_scsvs, SSL3_NUM_SCSVS, sizeof(ssl3_scsvs[0]), cipher_compare);
Sort cipher-list at runtime. Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-16 12:33:00 -04:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
static int sslcon_undefined_function_1(SSL_CONNECTION *sc, unsigned char *r,
size_t s, const char *t, size_t u,
const unsigned char *v, size_t w, int x)
Fix invalid function type casts. Rename bio_info_cb to BIO_info_cb. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4493)
2017-12-15 19:33:48 +01:00
{
(void)r;
(void)s;
(void)t;
(void)u;
(void)v;
(void)w;
(void)x;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc));
Fix invalid function type casts. Rename bio_info_cb to BIO_info_cb. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4493)
2017-12-15 19:33:48 +01:00
}
Constification - mostly originally from Chromium.
2014-06-29 21:05:23 +01:00
const SSL3_ENC_METHOD SSLv3_enc_data = {
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
ssl3_setup_key_block,
ssl3_generate_master_secret,
ssl3_change_cipher_state,
ssl3_final_finish_mac,
SSL3_MD_CLIENT_FINISHED_CONST, 4,
SSL3_MD_SERVER_FINISHED_CONST, 4,
ssl3_alert_code,
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sslcon_undefined_function_1,
DTLS revision. Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
2013-03-11 15:34:28 +00:00
0,
Rename ssl_set_handshake_header2() ssl_set_handshake_header2() was only ever a temporary name while we had to have ssl_set_handshake_header() for code that hadn't been converted to WPACKET yet. No code remains that needed that so we can rename it. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 22:40:15 +01:00
ssl3_set_handshake_header,
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
tls_close_construct_packet,
DTLS revision. Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
2013-03-11 15:34:28 +00:00
ssl3_handshake_write
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
};
ssl: modify libssl so that it uses OSSL_TIME This is instead of time_t and struct timeval. Some public APIs mandate a presence of these two types, but they are converted to OSSL_TIME internally. Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19082)
2022-08-29 14:17:25 +10:00
OSSL_TIME ssl3_default_timeout(void)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
/*
* 2 hours, the 24 hours mentioned in the SSLv3 spec is way too long for
* http, the cache would over fill
*/
ssl: modify libssl so that it uses OSSL_TIME This is instead of time_t and struct timeval. Some public APIs mandate a presence of these two types, but they are converted to OSSL_TIME internally. Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19082)
2022-08-29 14:17:25 +10:00
return ossl_seconds2time(60 * 60 * 2);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
int ssl3_num_ciphers(void)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return SSL3_NUM_CIPHERS;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Type-checked (and modern C compliant) OBJ_bsearch.
2008-10-12 14:32:47 +00:00
const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
if (u < SSL3_NUM_CIPHERS)
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return &(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
else
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl3_set_handshake_header(SSL_CONNECTION *s, WPACKET *pkt, int htype)
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
{
Harmonise setting the header and closing construction Ensure all message types work the same way including CCS so that the state machine doesn't need to know about special cases. Put all the special logic into ssl_set_handshake_header() and ssl_close_construct_packet(). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-30 10:38:32 +01:00
/* No header in the event of a CCS */
if (htype == SSL3_MT_CHANGE_CIPHER_SPEC)
return 1;
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
/* Set the content type and 3 bytes for the message len */
Convert WPACKET_put_bytes to use convenience macros All the other functions that take an argument for the number of bytes use convenience macros for this purpose. We should do the same with WPACKET_put_bytes(). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-20 14:47:44 +01:00
if (!WPACKET_put_bytes_u8(pkt, htype)
Address WPACKET review comments A few style tweaks here and there. The main change is that curr and packet_len are now offsets into the buffer to account for the fact that the pointers can change if the buffer grows. Also dropped support for the WPACKET_set_packet_len() function. I thought that was going to be needed but so far it hasn't been. It doesn't really work any more due to the offsets change. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-09 00:13:41 +01:00
|| !WPACKET_start_sub_packet_u24(pkt))
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
return 0;
return 1;
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl3_handshake_write(SSL_CONNECTION *s)
DTLS revision. Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
2013-03-11 15:34:28 +00:00
{
return ssl3_do_write(s, SSL3_RT_HANDSHAKE);
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
int ssl3_new(SSL *s)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Add SRP support.
2011-03-12 17:01:19 +00:00
#ifndef OPENSSL_NO_SRP
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
if (sc == NULL)
return 0;
if (!ssl_srp_ctx_init_intern(sc))
Fix no-srp Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8850)
2019-04-30 13:49:25 +01:00
return 0;
Add SRP support.
2011-03-12 17:01:19 +00:00
#endif
Convert existing usage of assert() to ossl_assert() in libssl Provides consistent output and approach. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22 12:33:42 +01:00
if (!s->method->ssl_clear(s))
return 0;
Fix some style issues in returns Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22 12:33:29 +01:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
void ssl3_free(SSL *s)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
size_t i;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc == NULL)
Accept NULL in *_free.
1999-01-07 19:15:59 +00:00
return;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ssl3_cleanup_key_block(sc);
Remove peer temp keys from SESS_CERT Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-06-21 16:26:08 +01:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
EVP_PKEY_free(sc->s3.peer_tmp);
sc->s3.peer_tmp = NULL;
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
for (i = 0; i < sc->s3.tmp.num_ks_pkey; i++)
if (sc->s3.tmp.ks_pkey[i] != NULL) {
if (sc->s3.tmp.pkey == sc->s3.tmp.ks_pkey[i])
sc->s3.tmp.pkey = NULL;
EVP_PKEY_free(sc->s3.tmp.ks_pkey[i]);
sc->s3.tmp.ks_pkey[i] = NULL;
}
sc->s3.tmp.num_ks_pkey = 0;
if (sc->s3.tmp.pkey != NULL) {
EVP_PKEY_free(sc->s3.tmp.pkey);
sc->s3.tmp.pkey = NULL;
}
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ssl_evp_cipher_free(sc->s3.tmp.new_sym_enc);
ssl_evp_md_free(sc->s3.tmp.new_hash);
Explicitly fetch ciphers and digests in libssl We modify libssl to use explicitly fetched ciphers, digests and other algorithms as required based on the configured library context and property query string for the SSL_CTX that is being used. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10854)
2020-01-16 12:14:27 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
OPENSSL_free(sc->s3.tmp.ctype);
sk_X509_NAME_pop_free(sc->s3.tmp.peer_ca_names, X509_NAME_free);
OPENSSL_free(sc->s3.tmp.ciphers_raw);
OPENSSL_clear_free(sc->s3.tmp.pms, sc->s3.tmp.pmslen);
OPENSSL_free(sc->s3.tmp.peer_sigalgs);
OPENSSL_free(sc->s3.tmp.peer_cert_sigalgs);
first cut at sigalg loading Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19312)
2022-09-26 17:32:05 +02:00
OPENSSL_free(sc->s3.tmp.valid_flags);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ssl3_free_digest_list(sc);
OPENSSL_free(sc->s3.alpn_selected);
OPENSSL_free(sc->s3.alpn_proposed);
Add an API for other QUIC stacks to use our TLS implementation We provide some callbacks for third party QUIC stacks to use in order to be able to reuse the OpenSSL TLS implementation in that stack. This is essentially a thin wrapper around the same API that OpenSSL's own QUIC stack uses in order to integrate TLS. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26683)
2024-08-20 15:09:17 +01:00
ossl_quic_tls_free(sc->qtls);
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 18:07:47 -04:00
Fix a possible memory leak of ssl->s3.tmp.psk Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22637)
2023-11-06 10:44:27 +01:00
#ifndef OPENSSL_NO_PSK
OPENSSL_free(sc->s3.tmp.psk);
#endif
Add SRP support.
2011-03-12 17:01:19 +00:00
#ifndef OPENSSL_NO_SRP
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ssl_srp_ctx_free_intern(sc);
Add SRP support.
2011-03-12 17:01:19 +00:00
#endif
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
memset(&sc->s3, 0, sizeof(sc->s3));
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Convert existing usage of assert() to ossl_assert() in libssl Provides consistent output and approach. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22 12:33:42 +01:00
int ssl3_clear(SSL *s)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
Don't forget we are doing QUIC if we clear the QUIC TLS data We should retain the TLS1_FLAGS_QUIC setting in in s3.flags even after a "clear" operation. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21686)
2023-08-08 11:23:39 +01:00
int flags;
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
size_t i;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc == NULL)
return 0;
ssl3_cleanup_key_block(sc);
OPENSSL_free(sc->s3.tmp.ctype);
sk_X509_NAME_pop_free(sc->s3.tmp.peer_ca_names, X509_NAME_free);
OPENSSL_free(sc->s3.tmp.ciphers_raw);
OPENSSL_clear_free(sc->s3.tmp.pms, sc->s3.tmp.pmslen);
OPENSSL_free(sc->s3.tmp.peer_sigalgs);
OPENSSL_free(sc->s3.tmp.peer_cert_sigalgs);
first cut at sigalg loading Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19312)
2022-09-26 17:32:05 +02:00
OPENSSL_free(sc->s3.tmp.valid_flags);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
EVP_PKEY_free(sc->s3.peer_tmp);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
for (i = 0; i < sc->s3.tmp.num_ks_pkey; i++)
if (sc->s3.tmp.ks_pkey[i] != NULL) {
if (sc->s3.tmp.pkey == sc->s3.tmp.ks_pkey[i])
sc->s3.tmp.pkey = NULL;
EVP_PKEY_free(sc->s3.tmp.ks_pkey[i]);
sc->s3.tmp.ks_pkey[i] = NULL;
}
sc->s3.tmp.num_ks_pkey = 0;
if (sc->s3.tmp.pkey != NULL) {
EVP_PKEY_free(sc->s3.tmp.pkey);
sc->s3.tmp.pkey = NULL;
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ssl3_free_digest_list(sc);
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
OPENSSL_free(sc->s3.alpn_selected);
OPENSSL_free(sc->s3.alpn_proposed);
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
Don't forget we are doing QUIC if we clear the QUIC TLS data We should retain the TLS1_FLAGS_QUIC setting in in s3.flags even after a "clear" operation. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21686)
2023-08-08 11:23:39 +01:00
/*
* NULL/zero-out everything in the s3 struct, but remember if we are doing
* QUIC.
*/
Fix the use of CCM ciphersuites with QUIC TLS API Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27091)
2025-03-18 14:36:28 +00:00
flags = sc->s3.flags & (TLS1_FLAGS_QUIC | TLS1_FLAGS_QUIC_INTERNAL);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
memset(&sc->s3, 0, sizeof(sc->s3));
Don't forget we are doing QUIC if we clear the QUIC TLS data We should retain the TLS1_FLAGS_QUIC setting in in s3.flags even after a "clear" operation. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21686)
2023-08-08 11:23:39 +01:00
sc->s3.flags |= flags;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!ssl_free_wbio_buffer(sc))
Convert existing usage of assert() to ossl_assert() in libssl Provides consistent output and approach. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22 12:33:42 +01:00
return 0;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->version = SSL3_VERSION;
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
#if !defined(OPENSSL_NO_NEXTPROTONEG)
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
OPENSSL_free(sc->ext.npn);
sc->ext.npn = NULL;
sc->ext.npn_len = 0;
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
#endif
Convert existing usage of assert() to ossl_assert() in libssl Provides consistent output and approach. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22 12:33:42 +01:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Add SRP support.
2011-03-12 17:01:19 +00:00
#ifndef OPENSSL_NO_SRP
RT3548: Remove unsupported platforms This last one for this ticket. Removes WIN16. So long, MS_CALLBACK and MS_FAR. We won't miss you. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-12 17:29:26 -05:00
static char *srp_password_from_info_cb(SSL *s, void *arg)
Add SRP support.
2011-03-12 17:01:19 +00:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
if (sc == NULL)
return NULL;
return OPENSSL_strdup(sc->srp_ctx.info);
Add SRP support.
2011-03-12 17:01:19 +00:00
}
#endif
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len);
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
New functions SSL[_CTX]_set_msg_callback(). New macros SSL[_CTX]_set_msg_callback_arg(). Message callback imlementation for SSL 3.0/TLS 1.0 (no SSL 2.0 yet). New '-msg' option for 'openssl s_client' and 'openssl s_server' that enable a message callback that displays all protocol messages. In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert if client_version is smaller than the protocol version in use. Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the client will at least see that alert. Fix SSL[_CTX]_ctrl prototype (void * instead of char * for generic pointer). Add/update some OpenSSL copyright notices.
2001-10-20 17:56:36 +00:00
long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
int ret = 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
if (sc == NULL)
return ret;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
switch (cmd) {
case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
break;
case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = sc->s3.num_renegotiations;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
break;
case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = sc->s3.num_renegotiations;
sc->s3.num_renegotiations = 0;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
break;
case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = sc->s3.total_renegotiations;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
break;
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 11:00:56 +00:00
case SSL_CTRL_GET_FLAGS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = (int)(sc->s3.flags);
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 11:00:56 +00:00
break;
Remove OPENSSL_NO_DH guards from libssl This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-13 12:39:40 +00:00
#if !defined(OPENSSL_NO_DEPRECATED_3_0)
Add a bunch of SSL_xxx() functions for configuring the temporary RSA and DH private keys and/or callback functions which directly correspond to their SSL_CTX_xxx() counterparts but work on a per-connection basis. This is needed for applications which have to configure certificates on a per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis (e.g. s_server). For the RSA certificate situation is makes no difference, but for the DSA certificate situation this fixes the "no shared cipher" problem where the OpenSSL cipher selection procedure failed because the temporary keys were not overtaken from the context and the API provided no way to reconfigure them. The new functions now let applications reconfigure the stuff and they are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh, SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback. Additionally a new non-public-API function ssl_cert_instantiate() is used as a helper function and also to reduce code redundancy inside ssl_rsa.c. Submitted by: Ralf S. Engelschall Reviewed by: Ben Laurie
1999-02-25 14:40:29 +00:00
case SSL_CTRL_SET_TMP_DH:
{
Server side EVP_PKEY DH support Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 00:05:26 +00:00
EVP_PKEY *pkdh = NULL;
Deprecate SSL_CTRL_SET_TMP_DH and other related ctrls These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-14 15:06:28 +01:00
if (parg == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
Add SSL_CTX_set_tmp_ecdh.pod Signed-off-by: Antoine Salon <asalon@vmware.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7522)
2018-10-16 16:40:01 -07:00
return 0;
Copy DH key (if available) in addition to the bare parameters in SSL_new. If SSL_OP_SINGLE_DH_USE is set, don't waste time in SSL_[CTX_]set_tmp_dh on computing a DH key that will be ignored anyway. ssltest -dhe1024dsa (w/ 160-bit sub-prime) had an unfair performance advantage over -dhe1024 (safe prime): SSL_OP_SINGLE_DH_USE was effectively always enabled because SSL_new ignored the DH key set in the SSL_CTX. Now -dhe1024 takes the server only about twice as long as -dhe1024dsa instead of three times as long (for 1024 bit RSA with 1024 bit DH).
2000-03-13 17:07:04 +00:00
}
Deprecate SSL_CTRL_SET_TMP_DH and other related ctrls These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-14 15:06:28 +01:00
pkdh = ssl_dh_to_pkey(parg);
Server side EVP_PKEY DH support Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 00:05:26 +00:00
if (pkdh == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
ERR_raise(ERR_LIB_SSL, ERR_R_DH_LIB);
Server side EVP_PKEY DH support Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 00:05:26 +00:00
return 0;
}
Don't free the EVP_PKEY on error in set0_tmp_dh_pkey() functions We should not be freeing the caller's key in the event of error. Fixes #17196 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17209)
2021-12-06 11:13:02 +00:00
if (!SSL_set0_tmp_dh_pkey(s, pkdh)) {
EVP_PKEY_free(pkdh);
return 0;
}
return 1;
Add a bunch of SSL_xxx() functions for configuring the temporary RSA and DH private keys and/or callback functions which directly correspond to their SSL_CTX_xxx() counterparts but work on a per-connection basis. This is needed for applications which have to configure certificates on a per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis (e.g. s_server). For the RSA certificate situation is makes no difference, but for the DSA certificate situation this fixes the "no shared cipher" problem where the OpenSSL cipher selection procedure failed because the temporary keys were not overtaken from the context and the API provided no way to reconfigure them. The new functions now let applications reconfigure the stuff and they are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh, SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback. Additionally a new non-public-API function ssl_cert_instantiate() is used as a helper function and also to reduce code redundancy inside ssl_rsa.c. Submitted by: Ralf S. Engelschall Reviewed by: Ben Laurie
1999-02-25 14:40:29 +00:00
}
break;
case SSL_CTRL_SET_TMP_DH_CB:
Compaq C 6.2 for VMS will complain when we want to convert non-function pointers to function pointers and vice versa. The current solution is to have unions that describe the conversion we want to do, and gives us the ability to extract the type of data we want. The current solution is a quick fix, and can probably be made in a more general or elegant way.
2000-01-18 09:30:51 +00:00
{
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return ret;
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
}
Deprecate EC_KEY + Update ec apps to use EVP_PKEY Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2020-10-15 13:41:59 +10:00
#endif
Auto DH support. Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
2014-01-22 16:22:48 +00:00
case SSL_CTRL_SET_DH_AUTO:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->cert->dh_tmp_auto = larg;
Auto DH support. Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
2014-01-22 16:22:48 +00:00
return 1;
Remove OPENSSL_NO_DH guards from libssl This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-13 12:39:40 +00:00
#if !defined(OPENSSL_NO_DEPRECATED_3_0)
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
case SSL_CTRL_SET_TMP_ECDH:
{
if (parg == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
Make SSL_{CTX}_set_tmp_ecdh() call SSL_{CTX_}set1_curves() SSL_{CTX}_set_tmp_ecdh() allows to set 1 EC curve and then tries to use it. On the other hand SSL_{CTX_}set1_curves() allows you to set a list of curves, but only when SSL_{CTX_}set_ecdh_auto() was called to turn it on. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2015-12-04 22:25:11 +01:00
return 0;
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_set_tmp_ecdh_groups(&sc->ext.supportedgroups,
&sc->ext.supportedgroups_len,
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
&sc->ext.keyshares,
&sc->ext.keyshares_len,
&sc->ext.tuples,
&sc->ext.tuples_len,
Avoid using OSSL_PKEY_PARAM_GROUP_NAME when the key might be legacy Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-20 14:01:01 +01:00
parg);
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
}
Remove OPENSSL_NO_EC guards from libssl Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:54:28 +00:00
#endif /* !OPENSSL_NO_DEPRECATED_3_0 */
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
case SSL_CTRL_SET_TLSEXT_HOSTNAME:
Add TODO comment for a nonsensical public API The API used to set what SNI value to send in the ClientHello can also be used on server SSL objects, with undocumented and un-useful behavior. Unfortunately, when generic SSL_METHODs are used, s->server is still set, prior to the start of the handshake, so we cannot prevent this nonsensical usage at the present time. Leave a note to revisit this when ABI-breaking changes are permitted. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6378)
2018-05-30 11:12:22 -05:00
/*
* This API is only used for a client to set what SNI it will request
* from the server, but we currently allow it to be used on servers
* as well, which is a programming error. Currently we just clear
* the field in SSL_do_handshake() for server SSLs, but when we can
* make ABI-breaking changes, we may want to make use of this API
* an error on server SSLs.
*/
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
if (larg == TLSEXT_NAMETYPE_host_name) {
Empty SNI names are not valid While empty inputs to SSL_set1_host() clear the reference identifier list. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-16 12:57:24 -05:00
size_t len;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
OPENSSL_free(sc->ext.hostname);
sc->ext.hostname = NULL;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
ret = 1;
if (parg == NULL)
break;
Empty SNI names are not valid While empty inputs to SSL_set1_host() clear the reference identifier list. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-16 12:57:24 -05:00
len = strlen((char *)parg);
if (len == 0 || len > TLSEXT_MAXLEN_host_name) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
return 0;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if ((sc->ext.hostname = OPENSSL_strdup((char *)parg)) == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
return 0;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
} else {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
return 0;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
break;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->ext.debug_arg = parg;
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add SSL_get_tlsext_status_type() method The tlsext_status_type field in SSL is used by e.g. OpenResty to determine if the client requested the certificate status, but SSL is now opaque. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-11 00:48:49 +01:00
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = sc->ext.status_type;
Add SSL_get_tlsext_status_type() method The tlsext_status_type field in SSL is used by e.g. OpenResty to determine if the client requested the certificate status, but SSL is now opaque. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-11 00:48:49 +01:00
break;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->ext.status_type = larg;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(STACK_OF(X509_EXTENSION) **)parg = sc->ext.ocsp.exts;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->ext.ocsp.exts = parg;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(STACK_OF(OCSP_RESPID) **)parg = sc->ext.ocsp.ids;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->ext.ocsp.ids = parg;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(unsigned char **)parg = sc->ext.ocsp.resp;
if (sc->ext.ocsp.resp_len == 0
|| sc->ext.ocsp.resp_len > LONG_MAX)
Fix some missed size_t updates Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-06 19:17:54 +01:00
return -1;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return (long)sc->ext.ocsp.resp_len;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
OPENSSL_free(sc->ext.ocsp.resp);
sc->ext.ocsp.resp = parg;
sc->ext.ocsp.resp_len = larg;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
ret = 1;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
case SSL_CTRL_CHAIN:
if (larg)
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_set1_chain(sc, NULL, (STACK_OF(X509) *)parg);
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
else
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_set0_chain(sc, NULL, (STACK_OF(X509) *)parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
case SSL_CTRL_CHAIN_CERT:
if (larg)
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_add1_chain_cert(sc, NULL, (X509 *)parg);
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
else
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_add0_chain_cert(sc, NULL, (X509 *)parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Additional "chain_cert" functions. PR#3169 This patch, which currently applies successfully against master and 1_0_2, adds the following functions: SSL_[CTX_]select_current_cert() - set the current certificate without disturbing the existing structure. SSL_[CTX_]get0_chain_certs() - get the current certificate's chain. SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain. The patch also adds these functions to, and fixes some existing errors in, SSL_CTX_add1_chain_cert.pod.
2013-11-11 18:04:24 +01:00
case SSL_CTRL_GET_CHAIN_CERTS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(STACK_OF(X509) **)parg = sc->cert->key->chain;
Fix the return value for SSL_get0_chain_certs() This function was always returning 0. It should return 1 on success. Fixes #9374 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/9395)
2019-07-16 15:32:35 +01:00
ret = 1;
Additional "chain_cert" functions. PR#3169 This patch, which currently applies successfully against master and 1_0_2, adds the following functions: SSL_[CTX_]select_current_cert() - set the current certificate without disturbing the existing structure. SSL_[CTX_]get0_chain_certs() - get the current certificate's chain. SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain. The patch also adds these functions to, and fixes some existing errors in, SSL_CTX_add1_chain_cert.pod.
2013-11-11 18:04:24 +01:00
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Additional "chain_cert" functions. PR#3169 This patch, which currently applies successfully against master and 1_0_2, adds the following functions: SSL_[CTX_]select_current_cert() - set the current certificate without disturbing the existing structure. SSL_[CTX_]get0_chain_certs() - get the current certificate's chain. SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain. The patch also adds these functions to, and fixes some existing errors in, SSL_CTX_add1_chain_cert.pod.
2013-11-11 18:04:24 +01:00
case SSL_CTRL_SELECT_CURRENT_CERT:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_select_current(sc->cert, (X509 *)parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
New ctrl to set current certificate. New ctrl sets current certificate based on certain criteria. Currently two options: set the first valid certificate as current and set the next valid certificate as current. Using these an application can iterate over all certificates in an SSL_CTX or SSL structure.
2014-02-02 02:51:30 +00:00
case SSL_CTRL_SET_CURRENT_CERT:
Option to set current cert to server certificate.
2014-02-21 19:42:03 +00:00
if (larg == SSL_CERT_SET_SERVER) {
const SSL_CIPHER *cipher;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!sc->server)
Option to set current cert to server certificate.
2014-02-21 19:42:03 +00:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
cipher = sc->s3.tmp.new_cipher;
Use cert_index and sigalg Now the certificate and signature algorithm is set in one place we can use it directly insetad of recalculating it. The old functions ssl_get_server_send_pkey() and ssl_get_server_cert_index() are no longer required. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2623)
2017-02-13 16:32:06 +00:00
if (cipher == NULL)
Option to set current cert to server certificate.
2014-02-21 19:42:03 +00:00
return 0;
Fix SRP authentication ciphersuites. The addition of SRP authentication needs to be checked in various places to work properly. Specifically: A certificate is not sent. A certificate request must not be sent. Server key exchange message must not contain a signature. If appropriate SRP authentication ciphersuites should be chosen. Reviewed-by: Matt Caswell <matt@openssl.org>
2014-08-08 11:24:25 +01:00
/*
* No certificate for unauthenticated ciphersuites or using SRP
* authentication
*/
if (cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
Option to set current cert to server certificate.
2014-02-21 19:42:03 +00:00
return 2;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->s3.tmp.cert == NULL)
Option to set current cert to server certificate.
2014-02-21 19:42:03 +00:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->cert->key = sc->s3.tmp.cert;
Option to set current cert to server certificate.
2014-02-21 19:42:03 +00:00
return 1;
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_set_current(sc->cert, larg);
New ctrl to set current certificate. New ctrl sets current certificate based on certain criteria. Currently two options: set the first valid certificate as current and set the next valid certificate as current. Using these an application can iterate over all certificates in an SSL_CTX or SSL structure.
2014-02-02 02:51:30 +00:00
Rename the Elliptic Curves extension to supported_groups This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:51:06 +00:00
case SSL_CTRL_GET_GROUPS:
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
{
Store groups as uint16_t Instead of storing supported groups in on-the-wire format store them as parsed uint16_t values. This simplifies handling of groups as the values can be directly used instead of being converted. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4406)
2017-09-22 16:06:52 +01:00
uint16_t *clist;
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
size_t clistlen;
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!sc->session)
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
clist = sc->ext.peer_supportedgroups;
clistlen = sc->ext.peer_supportedgroups_len;
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
if (parg) {
size_t i;
int *cptr = parg;
Replace tls1_ec_curve_id2nid. Replace tls1_ec_curve_id2nid() with tls_group_id_lookup() which returns the TLS_GROUP_INFO for the group. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 00:15:34 +01:00
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
for (i = 0; i < clistlen; i++) {
Modify libssl to discover supported groups based on available providers Now that we have added the TLS-GROUP capability to the default provider we can use that to discover the supported group list based on the loaded providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
2020-05-18 23:37:18 +01:00
const TLS_GROUP_INFO *cinf
Partial revert and reimplement "Enable brainpool curves for TLS1.3" This partially reverts commit 0a10825a0 in order to reimplement it in a simpler way in the next commit. The reverted aspects are all related to the TLSv1.3 brainpool curves in the supported_groups extension. Rather than special casing the handling of these curves we simply add new entries to the groups table to represent them. They can then be handled without any additional special casing. This makes the code simpler to maintain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19315)
2022-09-30 10:50:53 +01:00
= tls1_group_id_lookup(s->ctx, clist[i]);
Modify libssl to discover supported groups based on available providers Now that we have added the TLS-GROUP capability to the default provider we can use that to discover the supported group list based on the loaded providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
2020-05-18 23:37:18 +01:00
Update the various SSL group getting and setting functions A number of these functions returned a NID or an array of NIDs for the groups. Now that groups can come from the providers we do not necessarily know the NID. Therefore we need to handle this in a clean way. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
2020-05-21 16:36:32 +01:00
if (cinf != NULL)
cptr[i] = tls1_group_id2nid(cinf->group_id, 1);
else
Store groups as uint16_t Instead of storing supported groups in on-the-wire format store them as parsed uint16_t values. This simplifies handling of groups as the values can be directly used instead of being converted. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4406)
2017-09-22 16:06:52 +01:00
cptr[i] = TLSEXT_nid_unknown | clist[i];
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
}
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
}
return (int)clistlen;
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Rename the Elliptic Curves extension to supported_groups This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:51:06 +00:00
case SSL_CTRL_SET_GROUPS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return tls1_set_groups(&sc->ext.supportedgroups,
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
&sc->ext.supportedgroups_len,
&sc->ext.keyshares,
&sc->ext.keyshares_len,
&sc->ext.tuples,
&sc->ext.tuples_len,
parg, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Rename the Elliptic Curves extension to supported_groups This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:51:06 +00:00
case SSL_CTRL_SET_GROUPS_LIST:
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
return tls1_set_groups_list(s->ctx,
&sc->ext.supportedgroups,
&sc->ext.supportedgroups_len,
&sc->ext.keyshares,
&sc->ext.keyshares_len,
&sc->ext.tuples,
&sc->ext.tuples_len,
parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Rename the Elliptic Curves extension to supported_groups This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:51:06 +00:00
case SSL_CTRL_GET_SHARED_GROUP:
Replace tls1_ec_curve_id2nid. Replace tls1_ec_curve_id2nid() with tls_group_id_lookup() which returns the TLS_GROUP_INFO for the group. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 00:15:34 +01:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
uint16_t id = tls1_shared_group(sc, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
API to get negotiated key exchange algorithm in TLS1.3 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9323)
2019-07-08 14:50:59 +05:30
if (larg != -1)
Update the various SSL group getting and setting functions A number of these functions returned a NID or an array of NIDs for the groups. Now that groups can come from the providers we do not necessarily know the NID. Therefore we need to handle this in a clean way. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
2020-05-21 16:36:32 +01:00
return tls1_group_id2nid(id, 1);
Replace tls1_ec_curve_id2nid. Replace tls1_ec_curve_id2nid() with tls_group_id_lookup() which returns the TLS_GROUP_INFO for the group. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 00:15:34 +01:00
return id;
}
API to get negotiated key exchange algorithm in TLS1.3 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9323)
2019-07-08 14:50:59 +05:30
case SSL_CTRL_GET_NEGOTIATED_GROUP:
Promote SSL_get_negotiated_group() for non-TLSv1.3 It can be useful to know what group was used for the handshake's key exchange process even on non-TLS 1.3 connections. Allow this API, new in OpenSSL 3.0.0, to be used on other TLS versions as well. Since pre-TLS-1.3 key exchange occurs only on full handshakes, this necessitates adding a field to the SSL_SESSION object to carry the group information across resumptions. The key exchange group in the SSL_SESSION can also be relevant in TLS 1.3 when the resumption handshake uses the "psk_ke" key-exchange mode, so also track whether a fresh key exchange was done for TLS 1.3. Since the new field is optional in the ASN.1 sense, there is no need to increment SSL_SESSION_ASN1_VERSION (which incurs strong incompatibility churn). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-03-16 07:47:09 -07:00
{
unsigned int id;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (SSL_CONNECTION_IS_TLS13(sc) && sc->s3.did_kex)
id = sc->s3.group_id;
Promote SSL_get_negotiated_group() for non-TLSv1.3 It can be useful to know what group was used for the handshake's key exchange process even on non-TLS 1.3 connections. Allow this API, new in OpenSSL 3.0.0, to be used on other TLS versions as well. Since pre-TLS-1.3 key exchange occurs only on full handshakes, this necessitates adding a field to the SSL_SESSION object to carry the group information across resumptions. The key exchange group in the SSL_SESSION can also be relevant in TLS 1.3 when the resumption handshake uses the "psk_ke" key-exchange mode, so also track whether a fresh key exchange was done for TLS 1.3. Since the new field is optional in the ASN.1 sense, there is no need to increment SSL_SESSION_ASN1_VERSION (which incurs strong incompatibility churn). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-03-16 07:47:09 -07:00
else
When we try to get a group, we need session to be valid Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26722)
2025-02-12 14:40:08 +01:00
id = (sc->session != NULL) ? sc->session->kex_group : NID_undef;
Promote SSL_get_negotiated_group() for non-TLSv1.3 It can be useful to know what group was used for the handshake's key exchange process even on non-TLS 1.3 connections. Allow this API, new in OpenSSL 3.0.0, to be used on other TLS versions as well. Since pre-TLS-1.3 key exchange occurs only on full handshakes, this necessitates adding a field to the SSL_SESSION object to carry the group information across resumptions. The key exchange group in the SSL_SESSION can also be relevant in TLS 1.3 when the resumption handshake uses the "psk_ke" key-exchange mode, so also track whether a fresh key exchange was done for TLS 1.3. Since the new field is optional in the ASN.1 sense, there is no need to increment SSL_SESSION_ASN1_VERSION (which incurs strong incompatibility churn). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-03-16 07:47:09 -07:00
ret = tls1_group_id2nid(id, 1);
break;
}
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
case SSL_CTRL_SET_SIGALGS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return tls1_set_sigalgs(sc->cert, parg, larg, 0);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
case SSL_CTRL_SET_SIGALGS_LIST:
Allow provider sigalgs in SignatureAlgorithms conf Though support for provider-based signature algorithms was added in ee58915 this functionality did not work with the SignatureAlgorithms configuration command. If SignatureAlgorithms is set then the provider sigalgs are not used and instead it used the default value. This PR adds a check against the provider-base sigalg list when parsing the SignatureAlgorithms value. Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com> Fixes #22761 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22779)
2023-11-20 15:20:31 -06:00
return tls1_set_sigalgs_list(s->ctx, sc->cert, parg, 0);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
case SSL_CTRL_SET_CLIENT_SIGALGS:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return tls1_set_sigalgs(sc->cert, parg, larg, 1);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
Allow provider sigalgs in SignatureAlgorithms conf Though support for provider-based signature algorithms was added in ee58915 this functionality did not work with the SignatureAlgorithms configuration command. If SignatureAlgorithms is set then the provider sigalgs are not used and instead it used the default value. This PR adds a check against the provider-base sigalg list when parsing the SignatureAlgorithms value. Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com> Fixes #22761 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22779)
2023-11-20 15:20:31 -06:00
return tls1_set_sigalgs_list(s->ctx, sc->cert, parg, 1);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
case SSL_CTRL_GET_CLIENT_CERT_TYPES:
{
const unsigned char **pctype = parg;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->server || !sc->s3.tmp.cert_req)
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
return 0;
if (pctype)
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*pctype = sc->s3.tmp.ctype;
return sc->s3.tmp.ctype_len;
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
case SSL_CTRL_SET_CLIENT_CERT_TYPES:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!sc->server)
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl3_set_req_cert_type(sc->cert, parg, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
2012-07-23 23:34:28 +00:00
case SSL_CTRL_BUILD_CERT_CHAIN:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_build_cert_chain(sc, NULL, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
2012-07-23 23:34:28 +00:00
case SSL_CTRL_SET_VERIFY_CERT_STORE:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_set_cert_store(sc->cert, parg, 0, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
2012-07-23 23:34:28 +00:00
case SSL_CTRL_SET_CHAIN_CERT_STORE:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_set_cert_store(sc->cert, parg, 1, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add SSL_(CTX_)?get0_(verify|chain)_cert_store functions Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18038)
2022-04-04 14:36:20 +01:00
case SSL_CTRL_GET_VERIFY_CERT_STORE:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_get_cert_store(sc->cert, parg, 0);
Add SSL_(CTX_)?get0_(verify|chain)_cert_store functions Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18038)
2022-04-04 14:36:20 +01:00
case SSL_CTRL_GET_CHAIN_CERT_STORE:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return ssl_cert_get_cert_store(sc->cert, parg, 1);
Add SSL_(CTX_)?get0_(verify|chain)_cert_store functions Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18038)
2022-04-04 14:36:20 +01:00
Accessors for the IANA signature scheme name This is the official name of the signature algorithm(s) used by the peer and/or local end of the connection, and should be available, e.g. for logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26738)
2025-02-14 02:07:14 +11:00
case SSL_CTRL_GET_PEER_SIGNATURE_NAME:
ssl3_ctrl(): Fix condition in SSL_CTRL_GET_PEER_SIGNATURE_NAME Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26819)
2025-02-19 01:44:17 +11:00
if (parg == NULL || sc->s3.tmp.peer_sigalg == NULL)
Accessors for the IANA signature scheme name This is the official name of the signature algorithm(s) used by the peer and/or local end of the connection, and should be available, e.g. for logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26738)
2025-02-14 02:07:14 +11:00
return 0;
*(const char **)parg = sc->s3.tmp.peer_sigalg->name;
return 1;
store and print out message digest peer signed with in TLS 1.2
2012-09-07 12:53:42 +00:00
case SSL_CTRL_GET_PEER_SIGNATURE_NID:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->s3.tmp.peer_sigalg == NULL)
store and print out message digest peer signed with in TLS 1.2
2012-09-07 12:53:42 +00:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(int *)parg = sc->s3.tmp.peer_sigalg->hash;
Store table entry to peer signature algorithm. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2324)
2017-01-30 13:48:39 +00:00
return 1;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Accessors for the IANA signature scheme name This is the official name of the signature algorithm(s) used by the peer and/or local end of the connection, and should be available, e.g. for logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26738)
2025-02-14 02:07:14 +11:00
case SSL_CTRL_GET_SIGNATURE_NAME:
if (parg == NULL || sc->s3.tmp.sigalg == NULL)
return 0;
*(const char **)parg = sc->s3.tmp.sigalg->name;
return 1;
Added missing signature algorithm reflection functions SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10 01:53:56 -05:00
case SSL_CTRL_GET_SIGNATURE_NID:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->s3.tmp.sigalg == NULL)
Added missing signature algorithm reflection functions SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10 01:53:56 -05:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(int *)parg = sc->s3.tmp.sigalg->hash;
Added missing signature algorithm reflection functions SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10 01:53:56 -05:00
return 1;
case SSL_CTRL_GET_PEER_TMP_KEY:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->session == NULL || sc->s3.peer_tmp == NULL) {
new ctrl to retrive value of received temporary key in server key exchange message, print out details in s_client
2012-09-08 13:59:51 +00:00
return 0;
EVP_PKEY DH client support. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 01:07:46 +00:00
} else {
Adds missing checks of return from XXX_up_ref(). Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26294)
2024-12-28 10:13:48 +01:00
if (!EVP_PKEY_up_ref(sc->s3.peer_tmp))
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(EVP_PKEY **)parg = sc->s3.peer_tmp;
EVP_PKEY DH client support. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 01:07:46 +00:00
return 1;
new ctrl to retrive value of received temporary key in server key exchange message, print out details in s_client
2012-09-08 13:59:51 +00:00
}
Added missing signature algorithm reflection functions SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10 01:53:56 -05:00
case SSL_CTRL_GET_TMP_KEY:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->session == NULL || sc->s3.tmp.pkey == NULL) {
Added missing signature algorithm reflection functions SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10 01:53:56 -05:00
return 0;
} else {
Adds missing checks of return from XXX_up_ref(). Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26294)
2024-12-28 10:13:48 +01:00
if (!EVP_PKEY_up_ref(sc->s3.tmp.pkey))
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(EVP_PKEY **)parg = sc->s3.tmp.pkey;
Added missing signature algorithm reflection functions SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10 01:53:56 -05:00
return 1;
}
Add support for printing out and retrieving EC point formats extension.
2012-11-22 15:20:53 +00:00
case SSL_CTRL_GET_EC_POINT_FORMATS:
Print out point format list for clients too.
2012-11-26 18:39:38 +00:00
{
const unsigned char **pformat = parg;
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->ext.peer_ecpointformats == NULL)
Add support for printing out and retrieving EC point formats extension.
2012-11-22 15:20:53 +00:00
return 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*pformat = sc->ext.peer_ecpointformats;
return (int)sc->ext.peer_ecpointformats_len;
Print out point format list for clients too.
2012-11-26 18:39:38 +00:00
}
Support TLS_FALLBACK_SCSV. Reviewed-by: Stephen Henson <steve@openssl.org>
2014-10-15 04:03:28 +02:00
add SSL_get0_iana_groups() & SSL_client_hello_get_extension_order() The function/macro allow user get groups/extensions without memory allcations. So we could calculate the ssl fignerprint(ja3) in low cost. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16910)
2021-10-25 18:47:00 +08:00
case SSL_CTRL_GET_IANA_GROUPS:
{
if (parg != NULL) {
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
*(uint16_t **)parg = (uint16_t *)sc->ext.peer_supportedgroups;
add SSL_get0_iana_groups() & SSL_client_hello_get_extension_order() The function/macro allow user get groups/extensions without memory allcations. So we could calculate the ssl fignerprint(ja3) in low cost. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16910)
2021-10-25 18:47:00 +08:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
return (int)sc->ext.peer_supportedgroups_len;
add SSL_get0_iana_groups() & SSL_client_hello_get_extension_order() The function/macro allow user get groups/extensions without memory allcations. So we could calculate the ssl fignerprint(ja3) in low cost. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16910)
2021-10-25 18:47:00 +08:00
}
Add initial QUIC support for the msg_callback At this stage we just support msg_callback on receipt of a datagram. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20914)
2023-05-01 15:40:28 +01:00
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
sc->msg_callback_arg = parg;
return 1;
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
default:
break;
}
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return ret;
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Give everything prototypes (well, everything that's actually used).
2005-03-31 09:26:39 +00:00
long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
{
int ret = 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
if (sc == NULL)
return ret;
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
switch (cmd) {
Remove OPENSSL_NO_DH guards from libssl This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-13 12:39:40 +00:00
#if !defined(OPENSSL_NO_DEPRECATED_3_0)
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
case SSL_CTRL_SET_TMP_DH_CB:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
Return sensible values for some SSL ctrls Some ctrls were always returning 0 even if they were successful. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-21 15:06:28 +01:00
ret = 1;
Add a bunch of SSL_xxx() functions for configuring the temporary RSA and DH private keys and/or callback functions which directly correspond to their SSL_CTX_xxx() counterparts but work on a per-connection basis. This is needed for applications which have to configure certificates on a per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis (e.g. s_server). For the RSA certificate situation is makes no difference, but for the DSA certificate situation this fixes the "no shared cipher" problem where the OpenSSL cipher selection procedure failed because the temporary keys were not overtaken from the context and the API provided no way to reconfigure them. The new functions now let applications reconfigure the stuff and they are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh, SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback. Additionally a new non-public-API function ssl_cert_instantiate() is used as a helper function and also to reduce code redundancy inside ssl_rsa.c. Submitted by: Ralf S. Engelschall Reviewed by: Ben Laurie
1999-02-25 14:40:29 +00:00
break;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
#endif
case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->ext.debug_cb = (void (*)(SSL *, int, int,
const unsigned char *, int, void *))fp;
Return sensible values for some SSL ctrls Some ctrls were always returning 0 even if they were successful. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-21 15:06:28 +01:00
ret = 1;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
break;
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
Patch from PR #1833 was broken: there's no s->s3->new_session (only s->new_session).
2010-08-26 14:54:16 +00:00
case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->not_resumable_session_cb = (int (*)(SSL *, int))fp;
Return sensible values for some SSL ctrls Some ctrls were always returning 0 even if they were successful. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-21 15:06:28 +01:00
ret = 1;
Patch from PR #1833 was broken: there's no s->s3->new_session (only s->new_session).
2010-08-26 14:54:16 +00:00
break;
Add initial QUIC support for the msg_callback At this stage we just support msg_callback on receipt of a datagram. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20914)
2023-05-01 15:40:28 +01:00
case SSL_CTRL_SET_MSG_CALLBACK:
sc->msg_callback = (ossl_msg_cb)fp;
return 1;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
default:
break;
}
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return ret;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
New functions SSL[_CTX]_set_msg_callback(). New macros SSL[_CTX]_set_msg_callback_arg(). Message callback imlementation for SSL 3.0/TLS 1.0 (no SSL 2.0 yet). New '-msg' option for 'openssl s_client' and 'openssl s_server' that enable a message callback that displays all protocol messages. In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert if client_version is smaller than the protocol version in use. Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the client will at least see that alert. Fix SSL[_CTX]_ctrl prototype (void * instead of char * for generic pointer). Add/update some OpenSSL copyright notices.
2001-10-20 17:56:36 +00:00
long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
switch (cmd) {
Remove OPENSSL_NO_DH guards from libssl This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-13 12:39:40 +00:00
#if !defined(OPENSSL_NO_DEPRECATED_3_0)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
case SSL_CTRL_SET_TMP_DH:
{
Server side EVP_PKEY DH support Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 00:05:26 +00:00
EVP_PKEY *pkdh = NULL;
Deprecate SSL_CTRL_SET_TMP_DH and other related ctrls These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-14 15:06:28 +01:00
if (parg == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return 0;
}
Deprecate SSL_CTRL_SET_TMP_DH and other related ctrls These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-14 15:06:28 +01:00
pkdh = ssl_dh_to_pkey(parg);
Server side EVP_PKEY DH support Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-17 00:05:26 +00:00
if (pkdh == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
ERR_raise(ERR_LIB_SSL, ERR_R_DH_LIB);
Copy DH key (if available) in addition to the bare parameters in SSL_new. If SSL_OP_SINGLE_DH_USE is set, don't waste time in SSL_[CTX_]set_tmp_dh on computing a DH key that will be ignored anyway. ssltest -dhe1024dsa (w/ 160-bit sub-prime) had an unfair performance advantage over -dhe1024 (safe prime): SSL_OP_SINGLE_DH_USE was effectively always enabled because SSL_new ignored the DH key set in the SSL_CTX. Now -dhe1024 takes the server only about twice as long as -dhe1024dsa instead of three times as long (for 1024 bit RSA with 1024 bit DH).
2000-03-13 17:07:04 +00:00
return 0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Don't free the EVP_PKEY on error in set0_tmp_dh_pkey() functions We should not be freeing the caller's key in the event of error. Fixes #17196 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17209)
2021-12-06 11:13:02 +00:00
if (!SSL_CTX_set0_tmp_dh_pkey(ctx, pkdh)) {
EVP_PKEY_free(pkdh);
return 0;
}
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
case SSL_CTRL_SET_TMP_DH_CB:
Compaq C 6.2 for VMS will complain when we want to convert non-function pointers to function pointers and vice versa. The current solution is to have unions that describe the conversion we want to do, and gives us the ability to extract the type of data we want. The current solution is a quick fix, and can probably be made in a more general or elegant way.
2000-01-18 09:30:51 +00:00
{
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return 0;
Compaq C 6.2 for VMS will complain when we want to convert non-function pointers to function pointers and vice versa. The current solution is to have unions that describe the conversion we want to do, and gives us the ability to extract the type of data we want. The current solution is a quick fix, and can probably be made in a more general or elegant way.
2000-01-18 09:30:51 +00:00
}
Deprecate SSL_CTRL_SET_TMP_DH and other related ctrls These ctrls pass around a DH object which is now deprecated, so we deprecate the ctrls themselves. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-10-14 15:06:28 +01:00
#endif
Auto DH support. Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
2014-01-22 16:22:48 +00:00
case SSL_CTRL_SET_DH_AUTO:
ctx->cert->dh_tmp_auto = larg;
return 1;
Remove OPENSSL_NO_DH guards from libssl This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-13 12:39:40 +00:00
#if !defined(OPENSSL_NO_DEPRECATED_3_0)
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
case SSL_CTRL_SET_TMP_ECDH:
{
if (parg == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
return 0;
}
Deprecate EC_KEY + Update ec apps to use EVP_PKEY Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2020-10-15 13:41:59 +10:00
return ssl_set_tmp_ecdh_groups(&ctx->ext.supportedgroups,
&ctx->ext.supportedgroups_len,
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
&ctx->ext.keyshares,
&ctx->ext.keyshares_len,
&ctx->ext.tuples,
&ctx->ext.tuples_len,
Avoid using OSSL_PKEY_PARAM_GROUP_NAME when the key might be legacy Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-20 14:01:01 +01:00
parg);
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
}
Remove OPENSSL_NO_EC guards from libssl Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:54:28 +00:00
#endif /* !OPENSSL_NO_DEPRECATED_3_0 */
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
ctx->ext.servername_arg = parg;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
break;
Add ctrls to set and get RFC4507bis keys to enable several contexts to reuse the same tickets.
2007-08-28 01:08:45 +00:00
case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
{
unsigned char *keys = parg;
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
long tick_keylen = (sizeof(ctx->ext.tick_key_name) +
Place ticket keys into secure memory Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19 10:50:51 -04:00
sizeof(ctx->ext.secure->tick_hmac_key) +
sizeof(ctx->ext.secure->tick_aes_key));
session tickets: use more sizeof Reviewed-by: Matt Caswell <matt@openssl.org> MR: #2153
2016-03-02 14:39:14 +01:00
if (keys == NULL)
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
return tick_keylen;
if (larg != tick_keylen) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
Add ctrls to set and get RFC4507bis keys to enable several contexts to reuse the same tickets.
2007-08-28 01:08:45 +00:00
return 0;
}
if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) {
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
memcpy(ctx->ext.tick_key_name, keys,
sizeof(ctx->ext.tick_key_name));
Place ticket keys into secure memory Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19 10:50:51 -04:00
memcpy(ctx->ext.secure->tick_hmac_key,
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
keys + sizeof(ctx->ext.tick_key_name),
Place ticket keys into secure memory Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19 10:50:51 -04:00
sizeof(ctx->ext.secure->tick_hmac_key));
memcpy(ctx->ext.secure->tick_aes_key,
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
keys + sizeof(ctx->ext.tick_key_name) +
Place ticket keys into secure memory Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19 10:50:51 -04:00
sizeof(ctx->ext.secure->tick_hmac_key),
sizeof(ctx->ext.secure->tick_aes_key));
Add ctrls to set and get RFC4507bis keys to enable several contexts to reuse the same tickets.
2007-08-28 01:08:45 +00:00
} else {
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
memcpy(keys, ctx->ext.tick_key_name,
sizeof(ctx->ext.tick_key_name));
memcpy(keys + sizeof(ctx->ext.tick_key_name),
Place ticket keys into secure memory Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19 10:50:51 -04:00
ctx->ext.secure->tick_hmac_key,
sizeof(ctx->ext.secure->tick_hmac_key));
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
memcpy(keys + sizeof(ctx->ext.tick_key_name) +
Place ticket keys into secure memory Place the session ticket AES and HMAC keys into secure memory. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2351)
2018-03-19 10:50:51 -04:00
sizeof(ctx->ext.secure->tick_hmac_key),
ctx->ext.secure->tick_aes_key,
sizeof(ctx->ext.secure->tick_aes_key));
Add ctrls to set and get RFC4507bis keys to enable several contexts to reuse the same tickets.
2007-08-28 01:08:45 +00:00
}
return 1;
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add SSL_CTX_get_tlsext_status_type() Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-07 15:14:14 +01:00
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
return ctx->ext.status_type;
Add SSL_CTX_get_tlsext_status_type() Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-07 15:14:14 +01:00
Propagate tlsext_status_type from SSL_CTX to SSL To allow OCSP stapling to work with libcurl. Github PR #200 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-02 15:44:49 -05:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
ctx->ext.status_type = larg;
Propagate tlsext_status_type from SSL_CTX to SSL To allow OCSP stapling to work with libcurl. Github PR #200 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-02 15:44:49 -05:00
break;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
ctx->ext.status_arg = parg;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
return 1;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add missing session id and tlsext_status accessors * SSL_SESSION_set1_id() * SSL_SESSION_get0_id_context() * SSL_CTX_get_tlsext_status_cb() * SSL_CTX_get_tlsext_status_arg() Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-06 12:54:29 +02:00
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
*(void**)parg = ctx->ext.status_arg;
Add missing session id and tlsext_status accessors * SSL_SESSION_set1_id() * SSL_SESSION_get0_id_context() * SSL_CTX_get_tlsext_status_cb() * SSL_CTX_get_tlsext_status_arg() Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-06 12:54:29 +02:00
break;
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
*(int (**)(SSL*, void*))parg = ctx->ext.status_cb;
Add missing session id and tlsext_status accessors * SSL_SESSION_set1_id() * SSL_SESSION_get0_id_context() * SSL_CTX_get_tlsext_status_cb() * SSL_CTX_get_tlsext_status_arg() Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-06 12:54:29 +02:00
break;
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
#ifndef OPENSSL_NO_SRP
Add SRP support.
2011-03-12 17:01:19 +00:00
case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME:
ctx->srp_ctx.srp_Mask |= SSL_kSRP;
free null cleanup finale Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-01 10:02:07 -04:00
OPENSSL_free(ctx->srp_ctx.login);
Add SRP support.
2011-03-12 17:01:19 +00:00
ctx->srp_ctx.login = NULL;
if (parg == NULL)
break;
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SRP_USERNAME);
Add SRP support.
2011-03-12 17:01:19 +00:00
return 0;
}
Rename some BUF_xxx to OPENSSL_xxx Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} Add #define's for the old names. Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-12-16 16:12:24 -05:00
if ((ctx->srp_ctx.login = OPENSSL_strdup((char *)parg)) == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
Add SRP support.
2011-03-12 17:01:19 +00:00
return 0;
}
break;
case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:
ctx->srp_ctx.SRP_give_srp_client_pwd_callback =
srp_password_from_info_cb;
Make SRP_CTX.info ownership and lifetime be the same as SRP_CTX.login. Ownership and lifetime rules of SRP_CTX.info are confusing and different from those of SRP_CTX.login, making it difficult to use correctly. This makes the ownership and lifetime be the same as those of SRP_CTX.login, thet is a copy is made when setting it and is freed when SRP_CTX is freed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3467)
2017-05-15 10:35:45 +02:00
if (ctx->srp_ctx.info != NULL)
OPENSSL_free(ctx->srp_ctx.info);
Replace BUF_ string function calls with OPENSSL_ ones Deprecate the BUF_ string macros Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10207)
2019-10-17 15:45:34 -04:00
if ((ctx->srp_ctx.info = OPENSSL_strdup((char *)parg)) == NULL) {
Convert all {NAME}err() in ssl/ to their corresponding ERR_raise() call This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 12:18:33 +01:00
ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
Make SRP_CTX.info ownership and lifetime be the same as SRP_CTX.login. Ownership and lifetime rules of SRP_CTX.info are confusing and different from those of SRP_CTX.login, making it difficult to use correctly. This makes the ownership and lifetime be the same as those of SRP_CTX.login, thet is a copy is made when setting it and is freed when SRP_CTX is freed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3467)
2017-05-15 10:35:45 +02:00
return 0;
}
Add SRP support.
2011-03-12 17:01:19 +00:00
break;
case SSL_CTRL_SET_SRP_ARG:
ctx->srp_ctx.srp_Mask |= SSL_kSRP;
ctx->srp_ctx.SRP_cb_arg = parg;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add SRP support.
2011-03-12 17:01:19 +00:00
case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:
ctx->srp_ctx.strength = larg;
break;
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
#endif
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Rename the Elliptic Curves extension to supported_groups This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:51:06 +00:00
case SSL_CTRL_SET_GROUPS:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
return tls1_set_groups(&ctx->ext.supportedgroups,
&ctx->ext.supportedgroups_len,
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
&ctx->ext.keyshares,
&ctx->ext.keyshares_len,
&ctx->ext.tuples,
&ctx->ext.tuples_len,
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
parg, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Rename the Elliptic Curves extension to supported_groups This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:51:06 +00:00
case SSL_CTRL_SET_GROUPS_LIST:
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
return tls1_set_groups_list(ctx,
&ctx->ext.supportedgroups,
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
&ctx->ext.supportedgroups_len,
Add support for multiple key shares This PR is the implementation of concluded discussion that occurred in a draft PR #25605. This changes were mainly authored by @martinschmatz with some contribution from myself. It addresses issue #21633 This extends the group list definition to support a more complex definition while still retaining backward compatibility with the simple form of colon separated groups. Details of the agreed format and expected behaviour can be found in #25605 and in the documentation changes. Signed-off-by: Dave Kelsey <d_kelsey@uk.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26445)
2025-01-16 15:10:41 +00:00
&ctx->ext.keyshares,
&ctx->ext.keyshares_len,
&ctx->ext.tuples,
&ctx->ext.tuples_len,
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
parg);
Allow TLSv1.3 in a no-ec build Now that we have TLSv1.3 FFDHE support there is no reason why we should not allow TLSv1.3 to be used in a no-ec build. This commit enables that to happen. It also fixes no-ec which was previously broken. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9156)
2019-06-13 11:06:12 +01:00
ML-KEM hybrids for TLS - When used as KEMs in TLS the ECDHE algorithms are NOT subjected to HPKE Extract/Expand key derivation. Instead the TLS HKDF is used as usual. - Consequently these KEMs are just the usual ECDHE key exchange operations, be it with the encap ECDH private key unavoidably ephemeral. - A new "MLX" KEM provider is added that supports four hybrids of EC/ECX DH with ML-KEM: * ML-KEM-768 + X25519 * ML-KEM-1024 + X448 * P-256 + ML-KEM-768 * P-384 + ML-KEM-1024 - Support listing of implemented TLS groups. The SSL_CTX_get0_implemented_groups() function and new `openssl list -tls-groups` and `openssl list -all-tls-groups` commands make it possible to determine which groups are implemented by the SSL library for a particular TLS version or range of versions matching an SSL_CTX. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26220)
2024-12-20 20:26:50 +11:00
case SSL_CTRL_GET0_IMPLEMENTED_GROUPS:
return tls1_get0_implemented_groups(ctx->min_proto_version,
ctx->max_proto_version,
ctx->group_list,
ctx->group_list_len, larg, parg);
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
case SSL_CTRL_SET_SIGALGS:
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
return tls1_set_sigalgs(ctx->cert, parg, larg, 0);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
case SSL_CTRL_SET_SIGALGS_LIST:
Allow provider sigalgs in SignatureAlgorithms conf Though support for provider-based signature algorithms was added in ee58915 this functionality did not work with the SignatureAlgorithms configuration command. If SignatureAlgorithms is set then the provider sigalgs are not used and instead it used the default value. This PR adds a check against the provider-base sigalg list when parsing the SignatureAlgorithms value. Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com> Fixes #22761 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22779)
2023-11-20 15:20:31 -06:00
return tls1_set_sigalgs_list(ctx, ctx->cert, parg, 0);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
case SSL_CTRL_SET_CLIENT_SIGALGS:
return tls1_set_sigalgs(ctx->cert, parg, larg, 1);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
Allow provider sigalgs in SignatureAlgorithms conf Though support for provider-based signature algorithms was added in ee58915 this functionality did not work with the SignatureAlgorithms configuration command. If SignatureAlgorithms is set then the provider sigalgs are not used and instead it used the default value. This PR adds a check against the provider-base sigalg list when parsing the SignatureAlgorithms value. Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com> Fixes #22761 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22779)
2023-11-20 15:20:31 -06:00
return tls1_set_sigalgs_list(ctx, ctx->cert, parg, 1);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
case SSL_CTRL_SET_CLIENT_CERT_TYPES:
return ssl3_set_req_cert_type(ctx->cert, parg, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
2012-07-23 23:34:28 +00:00
case SSL_CTRL_BUILD_CERT_CHAIN:
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return ssl_build_cert_chain(NULL, ctx, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
2012-07-23 23:34:28 +00:00
case SSL_CTRL_SET_VERIFY_CERT_STORE:
return ssl_cert_set_cert_store(ctx->cert, parg, 0, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
2012-07-23 23:34:28 +00:00
case SSL_CTRL_SET_CHAIN_CERT_STORE:
return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add SSL_(CTX_)?get0_(verify|chain)_cert_store functions Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18038)
2022-04-04 14:36:20 +01:00
case SSL_CTRL_GET_VERIFY_CERT_STORE:
return ssl_cert_get_cert_store(ctx->cert, parg, 0);
case SSL_CTRL_GET_CHAIN_CERT_STORE:
return ssl_cert_get_cert_store(ctx->cert, parg, 1);
Various cleanups and fixed by Marc and Ralf to start the OpenTLS project
1998-12-22 15:04:48 +00:00
/* A Thawte special :-) */
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 11:00:56 +00:00
case SSL_CTRL_EXTRA_CHAIN_CERT:
if (ctx->extra_certs == NULL) {
Add checks on sk_TYPE_push() returned result Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-04 00:15:19 +02:00
if ((ctx->extra_certs = sk_X509_new_null()) == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
Add checks on sk_TYPE_push() returned result Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-04 00:15:19 +02:00
return 0;
}
}
if (!sk_X509_push(ctx->extra_certs, (X509 *)parg)) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
Add checks on sk_TYPE_push() returned result Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-04 00:15:19 +02:00
return 0;
Import of old SSLeay release: SSLeay 0.9.1b (unreleased)
1998-12-21 11:00:56 +00:00
}
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
New ctrl values to clear or retrieve extra chain certs from an SSL_CTX. New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.
2011-12-22 15:14:32 +00:00
case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
Oops, get selection logic right.
2014-02-05 18:55:37 +00:00
if (ctx->extra_certs == NULL && larg == 0)
Return per-certificate chain if extra chain is NULL. If an application calls the macro SSL_CTX_get_extra_chain_certs return either the old "shared" extra certificates or those associated with the current certificate. This means applications which call SSL_CTX_use_certificate_chain_file and retrieve the additional chain using SSL_CTX_get_extra_chain_certs will still work. An application which only wants to check the shared extra certificates can call the new macro SSL_CTX_get_extra_chain_certs_only
2014-02-05 16:56:58 +00:00
*(STACK_OF(X509) **)parg = ctx->cert->key->chain;
Oops, get selection logic right.
2014-02-05 18:55:37 +00:00
else
*(STACK_OF(X509) **)parg = ctx->extra_certs;
New ctrl values to clear or retrieve extra chain certs from an SSL_CTX. New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.
2011-12-22 15:14:32 +00:00
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
New ctrl values to clear or retrieve extra chain certs from an SSL_CTX. New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.
2011-12-22 15:14:32 +00:00
case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
add OSSL_STACK_OF_X509_free() for commonly used pattern Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17307)
2021-12-18 16:15:49 +01:00
OSSL_STACK_OF_X509_free(ctx->extra_certs);
free NULL cleanup 5a Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30 17:33:59 -04:00
ctx->extra_certs = NULL;
New ctrl values to clear or retrieve extra chain certs from an SSL_CTX. New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.
2011-12-22 15:14:32 +00:00
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
case SSL_CTRL_CHAIN:
if (larg)
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return ssl_cert_set1_chain(NULL, ctx, (STACK_OF(X509) *)parg);
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
else
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return ssl_cert_set0_chain(NULL, ctx, (STACK_OF(X509) *)parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
case SSL_CTRL_CHAIN_CERT:
if (larg)
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return ssl_cert_add1_chain_cert(NULL, ctx, (X509 *)parg);
Add support for distinct certificate chains per key type and per SSL structure. Before this the only way to add a custom chain was in the parent SSL_CTX (which is shared by all key types and SSL structures) or rely on auto chain building (which is performed on each handshake) from the trust store.
2012-01-31 14:00:10 +00:00
else
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return ssl_cert_add0_chain_cert(NULL, ctx, (X509 *)parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Additional "chain_cert" functions. PR#3169 This patch, which currently applies successfully against master and 1_0_2, adds the following functions: SSL_[CTX_]select_current_cert() - set the current certificate without disturbing the existing structure. SSL_[CTX_]get0_chain_certs() - get the current certificate's chain. SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain. The patch also adds these functions to, and fixes some existing errors in, SSL_CTX_add1_chain_cert.pod.
2013-11-11 18:04:24 +01:00
case SSL_CTRL_GET_CHAIN_CERTS:
*(STACK_OF(X509) **)parg = ctx->cert->key->chain;
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Additional "chain_cert" functions. PR#3169 This patch, which currently applies successfully against master and 1_0_2, adds the following functions: SSL_[CTX_]select_current_cert() - set the current certificate without disturbing the existing structure. SSL_[CTX_]get0_chain_certs() - get the current certificate's chain. SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain. The patch also adds these functions to, and fixes some existing errors in, SSL_CTX_add1_chain_cert.pod.
2013-11-11 18:04:24 +01:00
case SSL_CTRL_SELECT_CURRENT_CERT:
return ssl_cert_select_current(ctx->cert, (X509 *)parg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
New ctrl to set current certificate. New ctrl sets current certificate based on certain criteria. Currently two options: set the first valid certificate as current and set the next valid certificate as current. Using these an application can iterate over all certificates in an SSL_CTX or SSL structure.
2014-02-02 02:51:30 +00:00
case SSL_CTRL_SET_CURRENT_CERT:
return ssl_cert_set_current(ctx->cert, larg);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
default:
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return 0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Since return is inconsistent, I removed unnecessary parentheses and unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-10-09 20:05:58 +09:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Give everything prototypes (well, everything that's actually used).
2005-03-31 09:26:39 +00:00
long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
{
switch (cmd) {
Remove OPENSSL_NO_DH guards from libssl This removes man unnecessary OPENSSL_NO_DH guards from libssl. Now that libssl is entirely using the EVP APIs and implementations can be plugged in via providers it is no longer needed to disable DH at compile time in libssl. Instead it should detect at runtime whether DH is available from the loaded providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-13 12:39:40 +00:00
#if !defined(OPENSSL_NO_DEPRECATED_3_0)
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
case SSL_CTRL_SET_TMP_DH_CB:
{
Fix compile failure Fix compile failure introduced by commit 94d61512360c due to a typo. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-11 22:18:00 +00:00
ctx->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
}
break;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
#endif
case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
ctx->ext.servername_cb = (int (*)(SSL *, int *, void *))fp;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
break;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
ctx->ext.status_cb = (int (*)(SSL *, void *))fp;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
break;
TLS: use EVP for HMAC throughout libssl. Backwards compatibility with the old ticket key call back is maintained. This will be removed when the low level HMAC APIs are finally removed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
2020-01-24 10:41:38 +10:00
# ifndef OPENSSL_NO_DEPRECATED_3_0
Update from stable branch.
2008-04-30 16:14:02 +00:00
case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
Move extension data into sub-structs Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2052)
2016-12-08 14:18:40 -05:00
ctx->ext.ticket_key_cb = (int (*)(SSL *, unsigned char *,
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
unsigned char *,
EVP_CIPHER_CTX *,
HMAC_CTX *, int))fp;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
break;
TLS: use EVP for HMAC throughout libssl. Backwards compatibility with the old ticket key call back is maintained. This will be removed when the low level HMAC APIs are finally removed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
2020-01-24 10:41:38 +10:00
#endif
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Remove support for OPENSSL_NO_TLSEXT Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-15 10:49:56 +01:00
#ifndef OPENSSL_NO_SRP
Add SRP support.
2011-03-12 17:01:19 +00:00
case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB:
ctx->srp_ctx.srp_Mask |= SSL_kSRP;
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
ctx->srp_ctx.SRP_verify_param_callback = (int (*)(SSL *, void *))fp;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
break;
Add SRP support.
2011-03-12 17:01:19 +00:00
case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB:
ctx->srp_ctx.srp_Mask |= SSL_kSRP;
ctx->srp_ctx.TLS_ext_srp_username_callback =
(int (*)(SSL *, int *, void *))fp;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
break;
Add SRP support.
2011-03-12 17:01:19 +00:00
case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB:
ctx->srp_ctx.srp_Mask |= SSL_kSRP;
ctx->srp_ctx.SRP_give_srp_client_pwd_callback =
(char *(*)(SSL *, void *))fp;
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
break;
#endif
Patch from PR #1833 was broken: there's no s->s3->new_session (only s->new_session).
2010-08-26 14:54:16 +00:00
case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
{
Patch from PR #1833 was broken: there's no s->s3->new_session (only s->new_session).
2010-08-26 14:54:16 +00:00
ctx->not_resumable_session_cb = (int (*)(SSL *, int))fp;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
}
break;
default:
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return 0;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
}
Since return is inconsistent, I removed unnecessary parentheses and unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-10-09 20:05:58 +09:00
return 1;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
TLS: use EVP for HMAC throughout libssl. Backwards compatibility with the old ticket key call back is maintained. This will be removed when the low level HMAC APIs are finally removed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
2020-01-24 10:41:38 +10:00
int SSL_CTX_set_tlsext_ticket_key_evp_cb
(SSL_CTX *ctx, int (*fp)(SSL *, unsigned char *, unsigned char *,
EVP_CIPHER_CTX *, EVP_MAC_CTX *, int))
{
ctx->ext.ticket_key_evp_cb = fp;
return 1;
}
Construct the client side psk extension for TLSv1.3 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-13 17:00:49 +00:00
const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id)
{
SSL_CIPHER c;
Add more first-class support for SCSVS Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain SSL_CIPHER objects for these non-valid ciphers. This will allow for unified handling of such indicators, especially as we are preparing to pass them around between functions. Since the 'valid' field is not set for the SCSVs, they should not be used for anything requiring a cryptographic cipher (as opposed to something being stuck in a cipher-shaped hole in the TLS wire protocol). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-03 17:17:21 -06:00
const SSL_CIPHER *cp;
Construct the client side psk extension for TLSv1.3 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-13 17:00:49 +00:00
c.id = id;
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
cp = OBJ_bsearch_ssl_cipher_id(&c, tls13_ciphers, TLS13_NUM_CIPHERS);
if (cp != NULL)
return cp;
Add more first-class support for SCSVS Just as we have a table of ssl3_ciphers, add a table of ssl3_scsvs, to contain SSL_CIPHER objects for these non-valid ciphers. This will allow for unified handling of such indicators, especially as we are preparing to pass them around between functions. Since the 'valid' field is not set for the SCSVs, they should not be used for anything requiring a cryptographic cipher (as opposed to something being stuck in a cipher-shaped hole in the TLS wire protocol). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-03 17:17:21 -06:00
cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
if (cp != NULL)
return cp;
return OBJ_bsearch_ssl_cipher_id(&c, ssl3_scsvs, SSL3_NUM_SCSVS);
Construct the client side psk extension for TLSv1.3 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-13 17:00:49 +00:00
}
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
const SSL_CIPHER *ssl3_get_cipher_by_std_name(const char *stdname)
{
Unify ssl3_get_cipher_by_std_name() implementation The handling for the SCSVs was the same as for regular ciphers; just merge them into the same table-driven handler. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13010)
2020-09-27 15:01:12 -07:00
SSL_CIPHER *tbl;
SSL_CIPHER *alltabs[] = {tls13_ciphers, ssl3_ciphers, ssl3_scsvs};
size_t i, j, tblsize[] = {TLS13_NUM_CIPHERS, SSL3_NUM_CIPHERS,
SSL3_NUM_SCSVS};
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
Fix typos in files in ssl directory Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4052)
2017-07-30 18:43:19 -04:00
/* this is not efficient, necessary to optimize this? */
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
for (j = 0; j < OSSL_NELEM(alltabs); j++) {
for (i = 0, tbl = alltabs[j]; i < tblsize[j]; i++, tbl++) {
if (tbl->stdname == NULL)
continue;
if (strcmp(stdname, tbl->stdname) == 0) {
optimise ssl3_get_cipher_by_std_name() Return immediately on matched cipher. Without this patch the code only breaks out of the inner for loop, meaning for a matched TLS13 cipher the code will still loop through 160ish SSL3 ciphers. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13000)
2020-09-26 10:54:13 +01:00
return tbl;
Split configuration of TLSv1.3 ciphers from older ciphers With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-02-16 11:26:02 +00:00
}
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
}
}
Unify ssl3_get_cipher_by_std_name() implementation The handling for the SCSVs was the same as for regular ciphers; just merge them into the same table-driven handler. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13010)
2020-09-27 15:01:12 -07:00
return NULL;
Support converting cipher name to RFC name and vice versa Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-06-30 03:06:19 +08:00
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
/*
Add SRP support.
2011-03-12 17:01:19 +00:00
* This function needs to check if the ciphers required are actually
Patch from PR #1833 was broken: there's no s->s3->new_session (only s->new_session).
2010-08-26 14:54:16 +00:00
* available
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
*/
Type-checked (and modern C compliant) OBJ_bsearch.
2008-10-12 14:32:47 +00:00
const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Miscellaneous style tweaks based on feedback received Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-20 16:02:07 +00:00
return ssl3_get_cipher_by_id(SSL3_CK_CIPHERSUITE_FLAG
Construct the client side psk extension for TLSv1.3 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-13 17:00:49 +00:00
| ((uint32_t)p[0] << 8L)
| (uint32_t)p[1]);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Rename PACKETW to WPACKET To avoid confusion with the read PACKET structure. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-05 17:34:04 +01:00
int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
{
Move the SSL3_CK_CIPHERSUITE_FLAG out of public header The newly added SSL3_CK_CIPHERSUITE_FLAG shouldn't be in a public header file Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-27 11:58:04 +00:00
if ((c->id & 0xff000000) != SSL3_CK_CIPHERSUITE_FLAG) {
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
*len = 0;
return 1;
}
Convert WPACKET_put_bytes to use convenience macros All the other functions that take an argument for the number of bytes use convenience macros for this purpose. We should do the same with WPACKET_put_bytes(). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-20 14:47:44 +01:00
if (!WPACKET_put_bytes_u16(pkt, c->id & 0xffff))
Convert tls_construct_client_hello() to use PACKETW Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-03 20:57:52 +01:00
return 0;
*len = 2;
return 1;
}
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
/*
* ssl3_choose_cipher - choose a cipher from those offered by the client
* @s: SSL connection
* @clnt: ciphers offered by the client
* @srvr: ciphers enabled on the server?
*
* Returns the selected cipher or NULL when no common ciphers.
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
const SSL_CIPHER *ssl3_choose_cipher(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *clnt,
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
STACK_OF(SSL_CIPHER) *srvr)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Fix declarations and constification for inline stack. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-23 00:47:28 +00:00
const SSL_CIPHER *c, *ret = NULL;
New Option SSL_OP_CIPHER_SERVER_PREFERENCE allows TLS/SSLv3 server to override the clients choice; in SSLv2 the client uses the server's preferences.
2001-02-09 19:56:31 +00:00
STACK_OF(SSL_CIPHER) *prio, *allow;
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
int i, ii, ok, prefer_sha256 = 0;
Move ciphersuite selection before session resumption in TLSv1.3 This does things as per the recommendation in the TLSv1.3 spec. It also means that the server will always choose its preferred ciphersuite. Previously the server would only select ciphersuites compatible with the session. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
2017-06-06 17:19:32 +01:00
unsigned long alg_k = 0, alg_a = 0, mask_k = 0, mask_a = 0;
Use ChaCha only if prioritized by clnt IFF the client has ChaCha first, and server cipher priority is used, and the new SSL_OP_PRIORITIZE_CHACHA_FOR_MOBILE option is used, then reprioritize ChaCha above everything else. This way, A matching ChaCha cipher will be selected if there is a match. If no ChaCha ciphers match, then the other ciphers are used. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2015-12-21 15:19:29 -05:00
STACK_OF(SSL_CIPHER) *prio_chacha = NULL;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Create a duplicate of the SSL_CTX's CERT in SSL_new instead of copying pointers. The cert_st handling is changed by this in various ways. Submitted by: Reviewed by: PR:
1999-05-09 20:12:44 +00:00
/* Let's see which ciphers we can support */
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
New Option SSL_OP_CIPHER_SERVER_PREFERENCE allows TLS/SSLv3 server to override the clients choice; in SSLv2 the client uses the server's preferences.
2001-02-09 19:56:31 +00:00
/*
* Do not set the compare functions, because this may lead to a
* reordering by "id". We want to keep the original ordering. We may pay
* a price in performance during sk_SSL_CIPHER_find(), but would have to
* pay with the price of sk_SSL_CIPHER_dup().
*/
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Adapt CIPHER_DEBUG to the new generic trace API Co-authored-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8198)
2018-12-12 23:57:48 +01:00
OSSL_TRACE_BEGIN(TLS_CIPHER) {
BIO_printf(trc_out, "Server has %d from %p:\n",
sk_SSL_CIPHER_num(srvr), (void *)srvr);
for (i = 0; i < sk_SSL_CIPHER_num(srvr); ++i) {
c = sk_SSL_CIPHER_value(srvr, i);
BIO_printf(trc_out, "%p:%s\n", (void *)c, c->name);
}
BIO_printf(trc_out, "Client sent %d from %p:\n",
sk_SSL_CIPHER_num(clnt), (void *)clnt);
for (i = 0; i < sk_SSL_CIPHER_num(clnt); ++i) {
c = sk_SSL_CIPHER_value(clnt, i);
BIO_printf(trc_out, "%p:%s\n", (void *)c, c->name);
}
} OSSL_TRACE_END(TLS_CIPHER);
Fix export ciphersuites, again.
1999-03-06 14:09:36 +00:00
Use ChaCha only if prioritized by clnt IFF the client has ChaCha first, and server cipher priority is used, and the new SSL_OP_PRIORITIZE_CHACHA_FOR_MOBILE option is used, then reprioritize ChaCha above everything else. This way, A matching ChaCha cipher will be selected if there is a match. If no ChaCha ciphers match, then the other ciphers are used. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2015-12-21 15:19:29 -05:00
/* SUITE-B takes precedence over server preference and ChaCha priortiy */
if (tls1_suiteb(s)) {
prio = srvr;
allow = clnt;
} else if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
fix warnings for CIPHER_DEBUG builds
2007-02-19 16:59:13 +00:00
prio = srvr;
allow = clnt;
Remove all OPENSSL_NO_XXX from libssl where XXX is a crypto alg We should no longer be relying on compile time checks in libssl for the availability of crypto algorithms. The availability of crypto algorithms should be determined at runtime based on what providers have been loaded. Fixes #13616 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-20 15:29:59 +00:00
Use ChaCha only if prioritized by clnt IFF the client has ChaCha first, and server cipher priority is used, and the new SSL_OP_PRIORITIZE_CHACHA_FOR_MOBILE option is used, then reprioritize ChaCha above everything else. This way, A matching ChaCha cipher will be selected if there is a match. If no ChaCha ciphers match, then the other ciphers are used. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2015-12-21 15:19:29 -05:00
/* If ChaCha20 is at the top of the client preference list,
and there are ChaCha20 ciphers in the server list, then
temporarily prioritize all ChaCha20 ciphers in the servers list. */
if (s->options & SSL_OP_PRIORITIZE_CHACHA && sk_SSL_CIPHER_num(clnt) > 0) {
c = sk_SSL_CIPHER_value(clnt, 0);
if (c->algorithm_enc == SSL_CHACHA20POLY1305) {
/* ChaCha20 is client preferred, check server... */
int num = sk_SSL_CIPHER_num(srvr);
int found = 0;
for (i = 0; i < num; i++) {
c = sk_SSL_CIPHER_value(srvr, i);
if (c->algorithm_enc == SSL_CHACHA20POLY1305) {
found = 1;
break;
}
}
if (found) {
Add sk_new_reserve support This is a specific 1.1.1 change; do not squash if the chacha prioritization code is to be backported Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2017-10-04 09:15:19 -04:00
prio_chacha = sk_SSL_CIPHER_new_reserve(NULL, num);
Use ChaCha only if prioritized by clnt IFF the client has ChaCha first, and server cipher priority is used, and the new SSL_OP_PRIORITIZE_CHACHA_FOR_MOBILE option is used, then reprioritize ChaCha above everything else. This way, A matching ChaCha cipher will be selected if there is a match. If no ChaCha ciphers match, then the other ciphers are used. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2015-12-21 15:19:29 -05:00
/* if reserve fails, then there's likely a memory issue */
if (prio_chacha != NULL) {
/* Put all ChaCha20 at the top, starting with the one we just found */
sk_SSL_CIPHER_push(prio_chacha, c);
for (i++; i < num; i++) {
c = sk_SSL_CIPHER_value(srvr, i);
if (c->algorithm_enc == SSL_CHACHA20POLY1305)
sk_SSL_CIPHER_push(prio_chacha, c);
}
/* Pull in the rest */
for (i = 0; i < num; i++) {
c = sk_SSL_CIPHER_value(srvr, i);
if (c->algorithm_enc != SSL_CHACHA20POLY1305)
sk_SSL_CIPHER_push(prio_chacha, c);
}
prio = prio_chacha;
}
}
}
}
New Option SSL_OP_CIPHER_SERVER_PREFERENCE allows TLS/SSLv3 server to override the clients choice; in SSLv2 the client uses the server's preferences.
2001-02-09 19:56:31 +00:00
} else {
fix warnings for CIPHER_DEBUG builds
2007-02-19 16:59:13 +00:00
prio = clnt;
allow = srvr;
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (SSL_CONNECTION_IS_TLS13(s)) {
Fix no-psk Fixes #6239 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6253)
2018-05-14 14:28:06 +01:00
#ifndef OPENSSL_NO_PSK
first cut at sigalg loading Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19312)
2022-09-26 17:32:05 +02:00
size_t j;
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
/*
* If we allow "old" style PSK callbacks, and we have no certificate (so
* we're not going to succeed without a PSK anyway), and we're in
* TLSv1.3 then the default hash for a PSK is SHA-256 (as per the
* TLSv1.3 spec). Therefore we should prioritise ciphersuites using
* that.
*/
if (s->psk_server_callback != NULL) {
first cut at sigalg loading Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19312)
2022-09-26 17:32:05 +02:00
for (j = 0; j < s->ssl_pkey_num && !ssl_has_cert(s, j); j++);
if (j == s->ssl_pkey_num) {
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
/* There are no certificates */
prefer_sha256 = 1;
}
}
Fix no-psk Fixes #6239 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6253)
2018-05-14 14:28:06 +01:00
#endif
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
} else {
Move ciphersuite selection before session resumption in TLSv1.3 This does things as per the recommendation in the TLSv1.3 spec. It also means that the server will always choose its preferred ciphersuite. Previously the server would only select ciphersuites compatible with the session. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
2017-06-06 17:19:32 +01:00
tls1_set_cert_validity(s);
ssl_set_masks(s);
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
New Option SSL_OP_CIPHER_SERVER_PREFERENCE allows TLS/SSLv3 server to override the clients choice; in SSLv2 the client uses the server's preferences.
2001-02-09 19:56:31 +00:00
for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
Simplify ssl protocol version comparisons. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23163)
2023-12-28 21:23:18 +01:00
int minversion, maxversion;
New Option SSL_OP_CIPHER_SERVER_PREFERENCE allows TLS/SSLv3 server to override the clients choice; in SSLv2 the client uses the server's preferences.
2001-02-09 19:56:31 +00:00
c = sk_SSL_CIPHER_value(prio, i);
Simplify ssl protocol version comparisons. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23163)
2023-12-28 21:23:18 +01:00
minversion = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls;
maxversion = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add support for minimum and maximum protocol version supported by a cipher Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-02-07 20:17:07 +01:00
/* Skip ciphers not supported by the protocol version */
Simplify ssl protocol version comparisons. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23163)
2023-12-28 21:23:18 +01:00
if (ssl_version_cmp(s, s->version, minversion) < 0
|| ssl_version_cmp(s, s->version, maxversion) > 0)
Don't alow TLS v1.0 ciphersuites for SSLv3 This disables some ciphersuites which aren't supported in SSL v3: specifically PSK ciphersuites which use SHA256 or SHA384 for the MAC. Thanks to the Open Crypto Audit Project for identifying this issue. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-11-13 14:37:24 +00:00
continue;
Allow the server to change the ciphersuite on resume Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
2017-05-26 17:59:34 +01:00
Move ciphersuite selection before session resumption in TLSv1.3 This does things as per the recommendation in the TLSv1.3 spec. It also means that the server will always choose its preferred ciphersuite. Previously the server would only select ciphersuites compatible with the session. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3623)
2017-06-06 17:19:32 +01:00
/*
* Since TLS 1.3 ciphersuites can be used with any auth or
* key exchange scheme skip tests.
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!SSL_CONNECTION_IS_TLS13(s)) {
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
mask_k = s->s3.tmp.mask_k;
mask_a = s->s3.tmp.mask_a;
Add SRP support.
2011-03-12 17:01:19 +00:00
#ifndef OPENSSL_NO_SRP
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2339)
2017-01-31 18:59:31 +00:00
if (s->srp_ctx.srp_Mask & SSL_kSRP) {
mask_k |= SSL_kSRP;
mask_a |= SSL_aSRP;
}
Add SRP support.
2011-03-12 17:01:19 +00:00
#endif
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2339)
2017-01-31 18:59:31 +00:00
alg_k = c->algorithm_mkey;
alg_a = c->algorithm_auth;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
add initial support for RFC 4279 PSK SSL ciphersuites PR: 1191 Submitted by: Mika Kousa and Pasi Eronen of Nokia Corporation Reviewed by: Nils Larsch
2006-03-10 23:06:27 +00:00
#ifndef OPENSSL_NO_PSK
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2339)
2017-01-31 18:59:31 +00:00
/* with PSK there must be server callback set */
if ((alg_k & SSL_PSK) && s->psk_server_callback == NULL)
continue;
add initial support for RFC 4279 PSK SSL ciphersuites PR: 1191 Submitted by: Mika Kousa and Pasi Eronen of Nokia Corporation Reviewed by: Nils Larsch
2006-03-10 23:06:27 +00:00
#endif /* OPENSSL_NO_PSK */
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2339)
2017-01-31 18:59:31 +00:00
ok = (alg_k & mask_k) && (alg_a & mask_a);
Adapt CIPHER_DEBUG to the new generic trace API Co-authored-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8198)
2018-12-12 23:57:48 +01:00
OSSL_TRACE7(TLS_CIPHER,
"%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",
ok, alg_k, alg_a, mask_k, mask_a, (void *)c, c->name);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2339)
2017-01-31 18:59:31 +00:00
/*
* if we are considering an ECC cipher suite that uses an ephemeral
* EC key check it
*/
if (alg_k & SSL_kECDHE)
ok = ok && tls1_check_ec_tmp_key(s, c->id);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Don't filter TLS 1.3 ciphersuites by signing or key exchange algorithm Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2339)
2017-01-31 18:59:31 +00:00
if (!ok)
continue;
}
Use a new signed int ii instead of j (which is unsigned) to handle the return value from sk_SSL_CIPHER_find().
2006-05-28 19:44:27 +00:00
ii = sk_SSL_CIPHER_find(allow, c);
if (ii >= 0) {
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
/* Check security callback permits this cipher */
if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED,
Fix declarations and constification for inline stack. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-23 00:47:28 +00:00
c->strength_bits, 0, (void *)c))
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
continue;
Remove OPENSSL_NO_EC guards from libssl Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:54:28 +00:00
use SSL_kECDHE throughout instead of SSL_kEECDH ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
2013-12-19 13:57:49 -05:00
if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA)
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
&& s->s3.is_probably_safari) {
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 13:09:03 +01:00
if (!ret)
ret = sk_SSL_CIPHER_value(allow, ii);
Fix compilation with no-ec and/or no-tlsext.
2013-09-10 12:20:29 +01:00
continue;
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 13:09:03 +01:00
}
Remove OPENSSL_NO_EC guards from libssl Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:54:28 +00:00
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
if (prefer_sha256) {
const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, ii);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
const EVP_MD *md = ssl_md(SSL_CONNECTION_GET_CTX(s),
tmp->algorithm2);
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
Check for EVP_MD being NULL inside ssl. Fix multiple places that could potentially segfault if memory allocations fail. e.g. ssl_load_ciphers() could fail while calling ssl_evp_md_fetch(). Found by #18355 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18784)
2022-07-12 14:28:37 +10:00
if (md != NULL
&& EVP_MD_is_a(md, OSSL_DIGEST_NAME_SHA2_256)) {
Prefer SHA-256 ciphersuites if using old style PSKs If we have no certificate and we are using "old style" PSKs then we will always default to using SHA-256 for that PSK. However we may have selected a ciphersuite that is not based on SHA-256. Therefore if we see that there are no certificates and we have been configured for "old style" PSKs then we should prefer SHA-256 based ciphersuites during the selection process. Fixes #6197 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6215)
2018-05-10 11:51:45 +01:00
ret = tmp;
break;
}
if (ret == NULL)
ret = tmp;
continue;
}
Fix compilation with no-ec and/or no-tlsext.
2013-09-10 12:20:29 +01:00
ret = sk_SSL_CIPHER_value(allow, ii);
break;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
}
Remove all OPENSSL_NO_XXX from libssl where XXX is a crypto alg We should no longer be relying on compile time checks in libssl for the availability of crypto algorithms. The availability of crypto algorithms should be determined at runtime based on what providers have been loaded. Fixes #13616 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-20 15:29:59 +00:00
Use ChaCha only if prioritized by clnt IFF the client has ChaCha first, and server cipher priority is used, and the new SSL_OP_PRIORITIZE_CHACHA_FOR_MOBILE option is used, then reprioritize ChaCha above everything else. This way, A matching ChaCha cipher will be selected if there is a match. If no ChaCha ciphers match, then the other ciphers are used. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2015-12-21 15:19:29 -05:00
sk_SSL_CIPHER_free(prio_chacha);
Remove all OPENSSL_NO_XXX from libssl where XXX is a crypto alg We should no longer be relying on compile time checks in libssl for the availability of crypto algorithms. The availability of crypto algorithms should be determined at runtime based on what providers have been loaded. Fixes #13616 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-20 15:29:59 +00:00
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return ret;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl3_get_req_cert_type(SSL_CONNECTION *s, WPACKET *pkt)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Use uint32_t and int32_t for SSL_CIPHER structure. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-11-05 16:14:17 +00:00
uint32_t alg_k, alg_a = 0;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
/* If we have custom certificate types set, use them */
Tidy up certificate type handling. The certificate types used to be held in a fixed length array or (if it was too long) a malloced buffer. This was done to retain binary compatibility. The code can be simplified now SSL is opaque by always using a malloced buffer. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2733)
2017-02-23 22:12:28 +00:00
if (s->cert->ctype)
return WPACKET_memcpy(pkt, s->cert->ctype, s->cert->ctype_len);
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
/* Get mask of algorithms disabled by signature list */
ssl_set_sig_mask(&alg_a, s, SSL_SECOP_SIGALG_MASK);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Update from 1.0.0-stable.
2009-05-28 18:11:29 +00:00
#ifndef OPENSSL_NO_GOST
Convert CertificateRequest construction to WPACKET Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 14:25:52 +01:00
if (s->version >= TLS1_VERSION && (alg_k & SSL_kGOST))
New Russian TLS 1.2 implementation Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11442)
2020-03-30 18:09:24 +03:00
if (!WPACKET_put_bytes_u8(pkt, TLS_CT_GOST01_SIGN)
|| !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_SIGN)
|| !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_512_SIGN)
|| !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_LEGACY_SIGN)
|| !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_LEGACY_512_SIGN))
return 0;
if (s->version >= TLS1_2_VERSION && (alg_k & SSL_kGOST18))
if (!WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_SIGN)
|| !WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_IANA_512_SIGN))
return 0;
Update from 1.0.0-stable.
2009-05-28 18:11:29 +00:00
#endif
Remove fixed DH ciphersuites. Remove all fixed DH ciphersuites and associated logic. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-15 23:57:18 +00:00
if ((s->version == SSL3_VERSION) && (alg_k & SSL_kDHE)) {
Convert CertificateRequest construction to WPACKET Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 14:25:52 +01:00
if (!WPACKET_put_bytes_u8(pkt, SSL3_CT_RSA_EPHEMERAL_DH))
return 0;
Remove compile time guard checking from ssl3_get_req_cert_type With 3.0 we need to know whether algs are available at run time not at compile time. Actually the code as written is sufficient to do this, so we can simply remove the guards. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:10:52 +00:00
if (!(alg_a & SSL_aDSS)
&& !WPACKET_put_bytes_u8(pkt, SSL3_CT_DSS_EPHEMERAL_DH))
Convert CertificateRequest construction to WPACKET Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 14:25:52 +01:00
return 0;
Fix no-dh. Reviewed-by: Stephen Henson <steve@openssl.org>
2016-01-01 15:39:31 +00:00
}
Convert CertificateRequest construction to WPACKET Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 14:25:52 +01:00
if (!(alg_a & SSL_aRSA) && !WPACKET_put_bytes_u8(pkt, SSL3_CT_RSA_SIGN))
return 0;
if (!(alg_a & SSL_aDSS) && !WPACKET_put_bytes_u8(pkt, SSL3_CT_DSS_SIGN))
return 0;
Remove compile time guard checking from ssl3_get_req_cert_type With 3.0 we need to know whether algs are available at run time not at compile time. Actually the code as written is sufficient to do this, so we can simply remove the guards. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:10:52 +00:00
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
/*
Remove ECDH client auth code. Remove incomplete non-functional ECDH client authentication code. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-12 17:41:18 +00:00
* ECDSA certs can be used with RSA cipher suites too so we don't
use SSL_kECDHE throughout instead of SSL_kEECDH ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
2013-12-19 13:57:49 -05:00
* need to check for SSL_kECDH or SSL_kECDHE
ECC ciphersuite support Submitted by: Douglas Stebila <douglas.stebila@sun.com> (Authors: Vipul Gupta and Sumit Gupta, Sun Microsystems Laboratories)
2002-08-09 08:56:08 +00:00
*/
Convert CertificateRequest construction to WPACKET Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 14:25:52 +01:00
if (s->version >= TLS1_VERSION
&& !(alg_a & SSL_aECDSA)
&& !WPACKET_put_bytes_u8(pkt, TLS_CT_ECDSA_SIGN))
return 0;
Remove compile time guard checking from ssl3_get_req_cert_type With 3.0 we need to know whether algs are available at run time not at compile time. Actually the code as written is sufficient to do this, so we can simply remove the guards. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-01-15 16:10:52 +00:00
Convert CertificateRequest construction to WPACKET Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-29 14:25:52 +01:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len)
{
Tidy up certificate type handling. The certificate types used to be held in a fixed length array or (if it was too long) a malloced buffer. This was done to retain binary compatibility. The code can be simplified now SSL is opaque by always using a malloced buffer. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2733)
2017-02-23 22:12:28 +00:00
OPENSSL_free(c->ctype);
c->ctype = NULL;
c->ctype_len = 0;
if (p == NULL || len == 0)
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
return 1;
if (len > 0xff)
return 0;
Tidy up certificate type handling. The certificate types used to be held in a fixed length array or (if it was too long) a malloced buffer. This was done to retain binary compatibility. The code can be simplified now SSL is opaque by always using a malloced buffer. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2733)
2017-02-23 22:12:28 +00:00
c->ctype = OPENSSL_memdup(p, len);
if (c->ctype == NULL)
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
return 0;
Tidy up certificate type handling. The certificate types used to be held in a fixed length array or (if it was too long) a malloced buffer. This was done to retain binary compatibility. The code can be simplified now SSL is opaque by always using a malloced buffer. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2733)
2017-02-23 22:12:28 +00:00
c->ctype_len = len;
Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
2012-07-08 14:22:45 +00:00
return 1;
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
int ssl3_shutdown(SSL *s)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Changes from 1.0.0-stable.
2009-04-07 16:33:26 +00:00
int ret;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
if (sc == NULL)
return 0;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
/*
* Don't do anything much if we have not done the handshake or we don't
* want to send messages :-)
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->quiet_shutdown || SSL_in_before(s)) {
sc->shutdown = (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
Since return is inconsistent, I removed unnecessary parentheses and unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-10-09 20:05:58 +09:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!(sc->shutdown & SSL_SENT_SHUTDOWN)) {
sc->shutdown |= SSL_SENT_SHUTDOWN;
ssl3_send_alert(sc, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
/*
* our shutdown alert has been sent now, and if it still needs to be
Resolve a TODO in ssl3_dispatch_alert Properly handle the case where there is pending write data and we want to send an alert. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19550)
2022-10-27 15:38:32 +01:00
* written, s->s3.alert_dispatch will be > 0
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
*/
Resolve a TODO in ssl3_dispatch_alert Properly handle the case where there is pending write data and we want to send an alert. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19550)
2022-10-27 15:38:32 +01:00
if (sc->s3.alert_dispatch > 0)
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return -1; /* return WANT_WRITE */
Resolve a TODO in ssl3_dispatch_alert Properly handle the case where there is pending write data and we want to send an alert. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19550)
2022-10-27 15:38:32 +01:00
} else if (sc->s3.alert_dispatch > 0) {
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
/* resend it if not sent */
Changes from 1.0.0-stable.
2009-04-07 16:33:26 +00:00
ret = s->method->ssl_dispatch_alert(s);
if (ret == -1) {
/*
* we only get to return -1 here the 2nd/Nth invocation, we must
various spelling fixes Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/952)
2016-03-10 21:34:48 +01:00
* have already signalled return 0 upon a previous invocation,
Changes from 1.0.0-stable.
2009-04-07 16:33:26 +00:00
* return WANT_WRITE
*/
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return ret;
Changes from 1.0.0-stable.
2009-04-07 16:33:26 +00:00
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
} else if (!(sc->shutdown & SSL_RECEIVED_SHUTDOWN)) {
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
size_t readbytes;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
/*
* If we are waiting for a close from our peer, we are closed
*/
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
s->method->ssl_read_bytes(s, 0, NULL, NULL, 0, 0, &readbytes);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!(sc->shutdown & SSL_RECEIVED_SHUTDOWN)) {
Further libssl size_t-ify of reading Writing still to be done Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-06 12:05:25 +01:00
return -1; /* return WANT_READ */
Changes from 1.0.0-stable.
2009-04-07 16:33:26 +00:00
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Resolve a TODO in ssl3_dispatch_alert Properly handle the case where there is pending write data and we want to send an alert. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19550)
2022-10-27 15:38:32 +01:00
if ((sc->shutdown == (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN))
&& sc->s3.alert_dispatch == SSL_ALERT_DISPATCH_NONE)
Since return is inconsistent, I removed unnecessary parentheses and unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-10-09 20:05:58 +09:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
else
Remove parentheses of return. Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-17 23:04:09 +09:00
return 0;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Convert libssl writing for size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-07 11:34:39 +01:00
int ssl3_write(SSL *s, const void *buf, size_t len, size_t *written)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
if (sc == NULL)
return 0;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
clear_sys_error();
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->s3.renegotiate)
Move state machine knowledge out of the record layer The record layer was making decisions that should really be left to the state machine around unexpected handshake messages that are received after the initial handshake (i.e. renegotiation related messages). This commit removes that code from the record layer and updates the state machine accordingly. This simplifies the state machine and paves the way for handling other messages post-handshake such as the NewSessionTicket in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-10 23:02:28 +00:00
ssl3_renegotiate_check(s, 0);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Convert libssl writing for size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-07 11:34:39 +01:00
return s->method->ssl_write_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len,
written);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Further libssl size_t-ify of reading Writing still to be done Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-06 12:05:25 +01:00
static int ssl3_read_internal(SSL *s, void *buf, size_t len, int peek,
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
size_t *readbytes)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
int ret;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
if (sc == NULL)
return 0;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
clear_sys_error();
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc->s3.renegotiate)
Move state machine knowledge out of the record layer The record layer was making decisions that should really be left to the state machine around unexpected handshake messages that are received after the initial handshake (i.e. renegotiation related messages). This commit removes that code from the record layer and updates the state machine accordingly. This simplifies the state machine and paves the way for handling other messages post-handshake such as the NewSessionTicket in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-10 23:02:28 +00:00
ssl3_renegotiate_check(s, 0);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->s3.in_read_app_data = 1;
Add DTLS support.
2005-04-26 16:02:40 +00:00
ret =
Move TLS CCS processing into the state machine The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-11 09:35:41 +01:00
s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, NULL, buf, len,
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
peek, readbytes);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if ((ret == -1) && (sc->s3.in_read_app_data == 2)) {
Tolerate fragmentation and interleaving in the SSL 3/TLS record layer.
2000-02-20 23:04:06 +00:00
/*
* ssl3_read_bytes decided to call s->handshake_func, which called
* ssl3_read_bytes to read handshake data. However, ssl3_read_bytes
Implement known-IV countermeasure. Fix length checks in ssl3_get_client_hello(). Use s->s3->in_read_app_data differently to fix ssl3_read_internal().
2002-04-13 22:47:20 +00:00
* actually found application data and thinks that application data
Tolerate fragmentation and interleaving in the SSL 3/TLS record layer.
2000-02-20 23:04:06 +00:00
* makes sense here; so disable handshake processing and try to read
* application data again.
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ossl_statem_set_in_handshake(sc, 1);
Add DTLS support.
2005-04-26 16:02:40 +00:00
ret =
Move TLS CCS processing into the state machine The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-11 09:35:41 +01:00
s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, NULL, buf,
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
len, peek, readbytes);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ossl_statem_set_in_handshake(sc, 0);
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
} else
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->s3.in_read_app_data = 0;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
Further libssl size_t-ify of reading Writing still to be done Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-06 12:05:25 +01:00
return ret;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
int ssl3_read(SSL *s, void *buf, size_t len, size_t *readbytes)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
return ssl3_read_internal(s, buf, len, 0, readbytes);
First step towards SSL_peek fix.
2000-12-14 17:36:59 +00:00
}
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
int ssl3_peek(SSL *s, void *buf, size_t len, size_t *readbytes)
First step towards SSL_peek fix.
2000-12-14 17:36:59 +00:00
{
Rename all "read" variables with "readbytes" Travis is reporting one file at a time shadowed variable warnings where "read" has been used. This attempts to go through all of libssl and replace "read" with "readbytes" to fix all the problems in one go. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-26 10:43:34 +01:00
return ssl3_read_internal(s, buf, len, 1, readbytes);
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
int ssl3_renegotiate(SSL *s)
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
if (sc == NULL)
return 0;
if (sc->handshake_func == NULL)
Since return is inconsistent, I removed unnecessary parentheses and unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-10-09 20:05:58 +09:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
sc->s3.renegotiate = 1;
Since return is inconsistent, I removed unnecessary parentheses and unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-10-09 20:05:58 +09:00
return 1;
Import of old SSLeay release: SSLeay 0.8.1b
1998-12-21 10:52:47 +00:00
}
Move state machine knowledge out of the record layer The record layer was making decisions that should really be left to the state machine around unexpected handshake messages that are received after the initial handshake (i.e. renegotiation related messages). This commit removes that code from the record layer and updates the state machine accordingly. This simplifies the state machine and paves the way for handling other messages post-handshake such as the NewSessionTicket in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-10 23:02:28 +00:00
/*
* Check if we are waiting to do a renegotiation and if so whether now is a
* good time to do it. If |initok| is true then we are being called from inside
* the state machine so ignore the result of SSL_in_init(s). Otherwise we
* should not do a renegotiation if SSL_in_init(s) is true. Returns 1 if we
* should do a renegotiation now and sets up the state machine for it. Otherwise
* returns 0.
*/
int ssl3_renegotiate_check(SSL *s, int initok)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
{
int ret = 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (sc == NULL)
return 0;
if (sc->s3.renegotiate) {
if (!RECORD_LAYER_read_pending(&sc->rlayer)
&& !RECORD_LAYER_write_pending(&sc->rlayer)
Move state machine knowledge out of the record layer The record layer was making decisions that should really be left to the state machine around unexpected handshake messages that are received after the initial handshake (i.e. renegotiation related messages). This commit removes that code from the record layer and updates the state machine accordingly. This simplifies the state machine and paves the way for handling other messages post-handshake such as the NewSessionTicket in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-10 23:02:28 +00:00
&& (initok || !SSL_in_init(s))) {
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
/*
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
* if we are the server, and we have sent a 'RENEGOTIATE'
Remove redundant code Clean up and remove lots of code that is now no longer needed due to the move to the new state machine. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-08 09:13:50 +01:00
* message, we need to set the state machine into the renegotiate
* state.
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ossl_statem_set_renegotiate(sc);
sc->s3.renegotiate = 0;
sc->s3.num_renegotiations++;
sc->s3.total_renegotiations++;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
ret = 1;
}
}
Move state machine knowledge out of the record layer The record layer was making decisions that should really be left to the state machine around unexpected handshake messages that are received after the initial handshake (i.e. renegotiation related messages). This commit removes that code from the record layer and updates the state machine accordingly. This simplifies the state machine and paves the way for handling other messages post-handshake such as the NewSessionTicket in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-10 23:02:28 +00:00
return ret;
Run util/openssl-format-source -v -c . Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 03:40:55 +00:00
}
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
/*
Use enc_flags when deciding protocol variations. Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement.
2013-03-13 15:33:24 +00:00
* If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF and
* handshake macs if required.
PSK PRF correction. For SHA384 PRF PSK ciphersuites we have to switch to default PRF for TLS < 1.2 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 23:18:59 +01:00
*
* If PSK and using SHA384 for TLS < 1.2 switch to default.
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
long ssl_get_algorithm2(SSL_CONNECTION *s)
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
{
Sanity check in ssl_get_algorithm2(). RT#4600 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-19 16:03:10 +01:00
long alg2;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL *ssl = SSL_CONNECTION_GET_SSL(s);
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
if (s->s3.tmp.new_cipher == NULL)
Sanity check in ssl_get_algorithm2(). RT#4600 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-19 16:03:10 +01:00
return -1;
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
alg2 = s->s3.tmp.new_cipher->algorithm2;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (ssl->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF) {
PSK PRF correction. For SHA384 PRF PSK ciphersuites we have to switch to default PRF for TLS < 1.2 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 23:18:59 +01:00
if (alg2 == (SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF))
return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
} else if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK) {
PSK PRF correction. For SHA384 PRF PSK ciphersuites we have to switch to default PRF for TLS < 1.2 Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 23:18:59 +01:00
if (alg2 == (SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384))
return SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF;
}
Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29 22:56:51 +00:00
return alg2;
}
Version negotiation rewrite cleanup Following the version negotiation rewrite all of the previous code that was dedicated to version negotiation can now be deleted - all six source files of it!! Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-31 13:57:46 +01:00
/*
* Fill a ClientRandom or ServerRandom field of length len. Returns <= 0 on
* failure, 1 on success.
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl_fill_hello_random(SSL_CONNECTION *s, int server,
unsigned char *result, size_t len,
Add server side support for TLSv1.3 downgrade mechanism Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-22 08:52:54 +00:00
DOWNGRADE dgrd)
Version negotiation rewrite cleanup Following the version negotiation rewrite all of the previous code that was dedicated to version negotiation can now be deleted - all six source files of it!! Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-31 13:57:46 +01:00
{
Add server side support for TLSv1.3 downgrade mechanism Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-22 08:52:54 +00:00
int send_time = 0, ret;
Version negotiation rewrite cleanup Following the version negotiation rewrite all of the previous code that was dedicated to version negotiation can now be deleted - all six source files of it!! Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-31 13:57:46 +01:00
if (len < 4)
return 0;
if (server)
send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;
else
send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;
if (send_time) {
unsigned long Time = (unsigned long)time(NULL);
unsigned char *p = result;
Add a DRBG to each SSL object Give each SSL object it's own DRBG, chained to the parent global DRBG which is used only as a source of randomness into the per-SSL DRBG. This is used for all session, ticket, and pre-master secret keys. It is NOT used for ECDH key generation which use only the global DRBG. (Doing that without changing the API is tricky, if not impossible.) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4050)
2017-08-03 10:24:03 -04:00
Version negotiation rewrite cleanup Following the version negotiation rewrite all of the previous code that was dedicated to version negotiation can now be deleted - all six source files of it!! Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-31 13:57:46 +01:00
l2n(Time, p);
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = RAND_bytes_ex(SSL_CONNECTION_GET_CTX(s)->libctx, p, len - 4, 0);
Add server side support for TLSv1.3 downgrade mechanism Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-22 08:52:54 +00:00
} else {
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
ret = RAND_bytes_ex(SSL_CONNECTION_GET_CTX(s)->libctx, result, len, 0);
Add server side support for TLSv1.3 downgrade mechanism Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-22 08:52:54 +00:00
}
Turn on TLSv1.3 downgrade protection by default Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6741)
2018-07-18 16:13:14 +01:00
Don't use a ssl specific DRBG anymore Since the public and private DRBG are per thread we don't need one per ssl object anymore. It could also try to get entropy from a DRBG that's really from an other thread because the SSL object moved to an other thread. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5547)
2018-03-08 22:30:28 +01:00
if (ret > 0) {
Convert existing usage of assert() to ossl_assert() in libssl Provides consistent output and approach. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-05-22 12:33:42 +01:00
if (!ossl_assert(sizeof(tls11downgrade) < len)
|| !ossl_assert(sizeof(tls12downgrade) < len))
return 0;
Add server side support for TLSv1.3 downgrade mechanism Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-22 08:52:54 +00:00
if (dgrd == DOWNGRADE_TO_1_2)
memcpy(result + len - sizeof(tls12downgrade), tls12downgrade,
sizeof(tls12downgrade));
else if (dgrd == DOWNGRADE_TO_1_1)
memcpy(result + len - sizeof(tls11downgrade), tls11downgrade,
sizeof(tls11downgrade));
}
Turn on TLSv1.3 downgrade protection by default Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6741)
2018-07-18 16:13:14 +01:00
Add server side support for TLSv1.3 downgrade mechanism Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3022)
2017-03-22 08:52:54 +00:00
return ret;
Version negotiation rewrite cleanup Following the version negotiation rewrite all of the previous code that was dedicated to version negotiation can now be deleted - all six source files of it!! Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-31 13:57:46 +01:00
}
Use single master secret generation function. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 04:10:04 +01:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl_generate_master_secret(SSL_CONNECTION *s, unsigned char *pms,
size_t pmslen, int free_pms)
Use single master secret generation function. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 04:10:04 +01:00
{
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
unsigned long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
int ret = 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL *ssl = SSL_CONNECTION_GET_SSL(s);
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
if (alg_k & SSL_PSK) {
Split out PSK preamble and RSA from process CKE code The tls_process_client_key_exchange() function is far too long. This splits out the PSK preamble processing, and the RSA processing into separate functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-06 09:55:31 +01:00
#ifndef OPENSSL_NO_PSK
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
unsigned char *pskpms, *t;
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
size_t psklen = s->s3.tmp.psklen;
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
size_t pskpmslen;
/* create PSK premaster_secret */
/* For plain PSK "other_secret" is psklen zeroes */
if (alg_k & SSL_kPSK)
pmslen = psklen;
pskpmslen = 4 + pmslen + psklen;
pskpms = OPENSSL_malloc(pskpmslen);
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
if (pskpms == NULL)
Free and cleanse pms on error Reviewed-by: Matt Caswell <matt@openssl.org>
2015-07-28 16:04:53 +01:00
goto err;
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
t = pskpms;
s2n(pmslen, t);
if (alg_k & SSL_kPSK)
memset(t, 0, pmslen);
else
memcpy(t, pms, pmslen);
t += pmslen;
s2n(psklen, t);
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
memcpy(t, s->s3.tmp.psk, psklen);
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
OPENSSL_clear_free(s->s3.tmp.psk, psklen);
s->s3.tmp.psk = NULL;
Ensure buffer/length pairs are always in sync Following on from CVE-2021-3449 which was caused by a non-zero length associated with a NULL buffer, other buffer/length pairs are updated to ensure that they too are always in sync. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2021-03-18 16:52:10 +00:00
s->s3.tmp.psklen = 0;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!ssl->method->ssl3_enc->generate_master_secret(s,
Fix whitespace nit in ssl_generate_master_secret() Use a space after a comma. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10943)
2020-01-24 13:25:02 -08:00
s->session->master_key, pskpms, pskpmslen,
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
&s->session->master_key_length)) {
Fix a mem leak on error in the PSK code Thanks to @fangang190 for reporting this issue. Fixes #7060 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7065)
2018-08-27 14:52:09 +01:00
OPENSSL_clear_free(pskpms, pskpmslen);
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
/* SSLfatal() already called */
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
OPENSSL_clear_free(pskpms, pskpmslen);
Split out PSK preamble and RSA from process CKE code The tls_process_client_key_exchange() function is far too long. This splits out the PSK preamble processing, and the RSA processing into separate functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-06 09:55:31 +01:00
#else
/* Should never happen */
goto err;
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
#endif
Split out PSK preamble and RSA from process CKE code The tls_process_client_key_exchange() function is far too long. This splits out the PSK preamble processing, and the RSA processing into separate functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-06 09:55:31 +01:00
} else {
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (!ssl->method->ssl3_enc->generate_master_secret(s,
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
s->session->master_key, pms, pmslen,
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
&s->session->master_key_length)) {
/* SSLfatal() already called */
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Split out PSK preamble and RSA from process CKE code The tls_process_client_key_exchange() function is far too long. This splits out the PSK preamble processing, and the RSA processing into separate functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-06 09:55:31 +01:00
}
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
ret = 1;
Split out PSK preamble and RSA from process CKE code The tls_process_client_key_exchange() function is far too long. This splits out the PSK preamble processing, and the RSA processing into separate functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-06 09:55:31 +01:00
err:
PSK premaster secret derivation. Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-28 16:58:00 +01:00
if (pms) {
if (free_pms)
OPENSSL_clear_free(pms, pmslen);
else
OPENSSL_cleanse(pms, pmslen);
}
Ensure buffer/length pairs are always in sync Following on from CVE-2021-3449 which was caused by a non-zero length associated with a NULL buffer, other buffer/length pairs are updated to ensure that they too are always in sync. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2021-03-18 16:52:10 +00:00
if (s->server == 0) {
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
s->s3.tmp.pms = NULL;
Ensure buffer/length pairs are always in sync Following on from CVE-2021-3449 which was caused by a non-zero length associated with a NULL buffer, other buffer/length pairs are updated to ensure that they too are always in sync. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2021-03-18 16:52:10 +00:00
s->s3.tmp.pmslen = 0;
}
Convert master_secret_size code to size_t Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-03 23:22:07 +01:00
return ret;
Use single master secret generation function. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-17 04:10:04 +01:00
}
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
Fix no-ec Fix no-ec builds by having separate functions to create keys based on an existing EVP_PKEY and a curve id. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15 14:07:33 +01:00
/* Generate a private key from parameters */
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
EVP_PKEY *ssl_generate_pkey(SSL_CONNECTION *s, EVP_PKEY *pm)
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
{
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY *pkey = NULL;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
Fix no-ec Fix no-ec builds by having separate functions to create keys based on an existing EVP_PKEY and a curve id. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15 14:07:33 +01:00
if (pm == NULL)
return NULL;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, pm, sctx->propq);
Fix no-ec Fix no-ec builds by having separate functions to create keys based on an existing EVP_PKEY and a curve id. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15 14:07:33 +01:00
if (pctx == NULL)
goto err;
if (EVP_PKEY_keygen_init(pctx) <= 0)
goto err;
if (EVP_PKEY_keygen(pctx, &pkey) <= 0) {
EVP_PKEY_free(pkey);
pkey = NULL;
}
err:
EVP_PKEY_CTX_free(pctx);
return pkey;
}
TLS1.3 FFDHE Support Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8178)
2019-01-25 21:04:49 +05:30
Replace tls1_ec_curve_id2nid. Replace tls1_ec_curve_id2nid() with tls_group_id_lookup() which returns the TLS_GROUP_INFO for the group. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 00:15:34 +01:00
/* Generate a private key from a group ID */
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
EVP_PKEY *ssl_generate_pkey_group(SSL_CONNECTION *s, uint16_t id)
Fix no-ec Fix no-ec builds by having separate functions to create keys based on an existing EVP_PKEY and a curve id. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15 14:07:33 +01:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(sctx, id);
Fix no-ec Fix no-ec builds by having separate functions to create keys based on an existing EVP_PKEY and a curve id. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15 14:07:33 +01:00
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY *pkey = NULL;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
if (ginf == NULL) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
Fix no-ec Fix no-ec builds by having separate functions to create keys based on an existing EVP_PKEY and a curve id. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15 14:07:33 +01:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Make sure we use the libctx when creating an EVP_PKEY_CTX in libssl We should use EVP_PKEY_CTX_new_from_pkey() to ensure we use the correct libctx. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11401)
2020-03-12 14:49:19 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, ginf->algorithm,
sctx->propq);
Use the libctx for all EVP_PKEY_CTX operations There were a few places where we were not passing through the libctx when constructing and EVP_PKEY_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11508)
2020-04-10 16:32:16 +01:00
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
if (pctx == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
if (EVP_PKEY_keygen_init(pctx) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Fix the erroneous checks of EVP_PKEY_CTX_set_group_name Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18399)
2022-05-24 23:27:49 +08:00
if (EVP_PKEY_CTX_set_group_name(pctx, ginf->realname) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
Modify libssl to discover supported groups based on available providers Now that we have added the TLS-GROUP capability to the default provider we can use that to discover the supported group list based on the loaded providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
2020-05-18 23:37:18 +01:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
if (EVP_PKEY_keygen(pctx, &pkey) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
EVP_PKEY_free(pkey);
pkey = NULL;
}
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
err:
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
EVP_PKEY_CTX_free(pctx);
return pkey;
}
New function ssl_generate_param_group Setup EVP_PKEY structure from a group ID in ssl_generate_param_group, replace duplicate code with this function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 02:40:30 +01:00
/*
* Generate parameters from a group ID
*/
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
EVP_PKEY *ssl_generate_param_group(SSL_CONNECTION *s, uint16_t id)
New function ssl_generate_param_group Setup EVP_PKEY structure from a group ID in ssl_generate_param_group, replace duplicate code with this function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 02:40:30 +01:00
{
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
New function ssl_generate_param_group Setup EVP_PKEY structure from a group ID in ssl_generate_param_group, replace duplicate code with this function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 02:40:30 +01:00
EVP_PKEY_CTX *pctx = NULL;
EVP_PKEY *pkey = NULL;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(sctx, id);
New function ssl_generate_param_group Setup EVP_PKEY structure from a group ID in ssl_generate_param_group, replace duplicate code with this function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 02:40:30 +01:00
if (ginf == NULL)
goto err;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, ginf->algorithm,
sctx->propq);
Make sure we use the libctx when creating an EVP_PKEY_CTX in libssl We should use EVP_PKEY_CTX_new_from_pkey() to ensure we use the correct libctx. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11401)
2020-03-12 14:49:19 +00:00
New function ssl_generate_param_group Setup EVP_PKEY structure from a group ID in ssl_generate_param_group, replace duplicate code with this function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 02:40:30 +01:00
if (pctx == NULL)
goto err;
if (EVP_PKEY_paramgen_init(pctx) <= 0)
goto err;
Fix the erroneous checks of EVP_PKEY_CTX_set_group_name Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18399)
2022-05-24 23:27:49 +08:00
if (EVP_PKEY_CTX_set_group_name(pctx, ginf->realname) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
Modify libssl to discover supported groups based on available providers Now that we have added the TLS-GROUP capability to the default provider we can use that to discover the supported group list based on the loaded providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
2020-05-18 23:37:18 +01:00
goto err;
TLS1.3 FFDHE Support Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8178)
2019-01-25 21:04:49 +05:30
}
New function ssl_generate_param_group Setup EVP_PKEY structure from a group ID in ssl_generate_param_group, replace duplicate code with this function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/=4412)
2017-09-23 02:40:30 +01:00
if (EVP_PKEY_paramgen(pctx, &pkey) <= 0) {
EVP_PKEY_free(pkey);
pkey = NULL;
}
err:
EVP_PKEY_CTX_free(pctx);
return pkey;
}
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
/* Generate secrets from pms */
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl_gensecret(SSL_CONNECTION *s, unsigned char *pms, size_t pmslen)
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
{
int rv = 0;
/* SSLfatal() called as appropriate in the below functions */
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (SSL_CONNECTION_IS_TLS13(s)) {
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
/*
* If we are resuming then we already generated the early secret
* when we created the ClientHello, so don't recreate it.
*/
if (!s->hit)
rv = tls13_generate_secret(s, ssl_handshake_md(s), NULL, NULL,
0,
(unsigned char *)&s->early_secret);
else
rv = 1;
rv = rv && tls13_generate_handshake_secret(s, pms, pmslen);
} else {
rv = ssl_generate_master_secret(s, pms, pmslen, 0);
}
return rv;
}
Update state machine to be closer to TLS1.3 This is a major overhaul of the TLSv1.3 state machine. Currently it still looks like TLSv1.2. This commit changes things around so that it starts to look a bit less like TLSv1.2 and bit more like TLSv1.3. After this commit we have: ClientHello + key_share ----> ServerHello +key_share {CertificateRequest*} {Certificate*} {CertificateStatus*} <---- {Finished} {Certificate*} {CertificateVerify*} {Finished} ----> [ApplicationData] <---> [Application Data] Key differences between this intermediate position and the final TLSv1.3 position are: - No EncryptedExtensions message yet - No server side CertificateVerify message yet - CertificateStatus still exists as a separate message - A number of the messages are still in the TLSv1.2 format - Still running on the TLSv1.2 record layer Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:06:12 +00:00
/* Derive secrets for ECDH/DH */
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl_derive(SSL_CONNECTION *s, EVP_PKEY *privkey, EVP_PKEY *pubkey, int gensecret)
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
{
int rv = 0;
unsigned char *pms = NULL;
size_t pmslen = 0;
EVP_PKEY_CTX *pctx;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
if (privkey == NULL || pubkey == NULL) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
return 0;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, privkey, sctx->propq);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
if (EVP_PKEY_derive_init(pctx) <= 0
|| EVP_PKEY_derive_set_peer(pctx, pubkey) <= 0
|| EVP_PKEY_derive(pctx, NULL, &pmslen) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
goto err;
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
if (SSL_CONNECTION_IS_TLS13(s) && EVP_PKEY_is_a(privkey, "DH"))
TLS1.3 FFDHE Support Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8178)
2019-01-25 21:04:49 +05:30
EVP_PKEY_CTX_set_dh_pad(pctx, 1);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
pms = OPENSSL_malloc(pmslen);
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
if (pms == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
if (EVP_PKEY_derive(pctx, pms, &pmslen) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
goto err;
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
}
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
Update state machine to be closer to TLS1.3 This is a major overhaul of the TLSv1.3 state machine. Currently it still looks like TLSv1.2. This commit changes things around so that it starts to look a bit less like TLSv1.2 and bit more like TLSv1.3. After this commit we have: ClientHello + key_share ----> ServerHello +key_share {CertificateRequest*} {Certificate*} {CertificateStatus*} <---- {Finished} {Certificate*} {CertificateVerify*} {Finished} ----> [ApplicationData] <---> [Application Data] Key differences between this intermediate position and the final TLSv1.3 position are: - No EncryptedExtensions message yet - No server side CertificateVerify message yet - CertificateStatus still exists as a separate message - A number of the messages are still in the TLSv1.2 format - Still running on the TLSv1.2 record layer Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09 14:06:12 +00:00
if (gensecret) {
Convert the state machine code to use SSLfatal() Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
2017-11-21 17:18:43 +00:00
/* SSLfatal() called as appropriate in the below functions */
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
rv = ssl_gensecret(s, pms, pmslen);
} else {
/* Save premaster secret */
s->s3.tmp.pms = pms;
s->s3.tmp.pmslen = pmslen;
pms = NULL;
rv = 1;
}
err:
OPENSSL_clear_free(pms, pmslen);
EVP_PKEY_CTX_free(pctx);
return rv;
}
/* Decapsulate secrets for KEM */
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl_decapsulate(SSL_CONNECTION *s, EVP_PKEY *privkey,
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
const unsigned char *ct, size_t ctlen,
int gensecret)
{
int rv = 0;
unsigned char *pms = NULL;
size_t pmslen = 0;
EVP_PKEY_CTX *pctx;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
if (privkey == NULL) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
return 0;
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, privkey, sctx->propq);
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
ssl: support params arguments to init functions Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-02 22:41:10 +10:00
if (EVP_PKEY_decapsulate_init(pctx, NULL) <= 0
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
|| EVP_PKEY_decapsulate(pctx, NULL, &pmslen, ct, ctlen) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
goto err;
}
pms = OPENSSL_malloc(pmslen);
if (pms == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
goto err;
}
if (EVP_PKEY_decapsulate(pctx, pms, &pmslen, ct, ctlen) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
[ssl] Support ssl_decapsulate on client side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 03:45:30 +03:00
goto err;
}
if (gensecret) {
/* SSLfatal() called as appropriate in the below functions */
rv = ssl_gensecret(s, pms, pmslen);
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
} else {
Start using the key_share data to derive the PMS The previous commits put in place the logic to exchange key_share data. We now need to do something with that information. In <= TLSv1.2 the equivalent of the key_share extension is the ServerKeyExchange and ClientKeyExchange messages. With key_share those two messages are no longer necessary. The commit removes the SKE and CKE messages from the TLSv1.3 state machine. TLSv1.3 is completely different to TLSv1.2 in the messages that it sends and the transitions that are allowed. Therefore, rather than extend the existing <=TLS1.2 state transition functions, we create a whole new set for TLSv1.3. Intially these are still based on the TLSv1.2 ones, but over time they will be amended. The new TLSv1.3 transitions remove SKE and CKE completely. There's also some cleanup for some stuff which is not relevant to TLSv1.3 and is easy to remove, e.g. the DTLS support (we're not doing DTLSv1.3 yet) and NPN. I also disable EXTMS for TLSv1.3. Using it was causing some added complexity, so rather than fix it I removed it, since eventually it will not be needed anyway. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02 15:03:56 +00:00
/* Save premaster secret */
Collapse ssl3_state_st (s3) into ssl_st With the removal of SSLv2, the s3 structure is always allocated, so there is little point in having it be an allocated pointer. Collapse the ssl3_state_st structure into ssl_st and fixup any references. This should be faster than going through an indirection and due to fewer allocations, but I'm not seeing any significant performance improvement; it seems to be within the margin of error in timing. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7888)
2018-12-12 13:09:50 -05:00
s->s3.tmp.pms = pms;
s->s3.tmp.pmslen = pmslen;
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
pms = NULL;
rv = 1;
}
Indent ssl/ Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-05 19:03:17 +02:00
err:
Add ECDH/DH utility functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-15 18:15:16 +00:00
OPENSSL_clear_free(pms, pmslen);
EVP_PKEY_CTX_free(pctx);
return rv;
}
utility function Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-18 15:58:28 +00:00
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
int ssl_encapsulate(SSL_CONNECTION *s, EVP_PKEY *pubkey,
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
unsigned char **ctp, size_t *ctlenp,
int gensecret)
{
int rv = 0;
unsigned char *pms = NULL, *ct = NULL;
size_t pmslen = 0, ctlen = 0;
EVP_PKEY_CTX *pctx;
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
if (pubkey == NULL) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
return 0;
}
SSL object refactoring using SSL_CONNECTION object Make the SSL object polymorphic based on whether this is a traditional SSL connection, QUIC connection, or later to be implemented a QUIC stream. It requires adding if after every SSL_CONNECTION_FROM_SSL() call which itself has to be added to almost every public SSL_ API call. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18612)
2022-06-20 17:11:28 +02:00
pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, pubkey, sctx->propq);
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
ssl: support params arguments to init functions Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-02 22:41:10 +10:00
if (EVP_PKEY_encapsulate_init(pctx, NULL) <= 0
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
|| EVP_PKEY_encapsulate(pctx, NULL, &ctlen, NULL, &pmslen) <= 0
|| pmslen == 0 || ctlen == 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
goto err;
}
pms = OPENSSL_malloc(pmslen);
ct = OPENSSL_malloc(ctlen);
if (pms == NULL || ct == NULL) {
Stop raising ERR_R_MALLOC_FAILURE in most places Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
2022-09-29 13:57:34 +02:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
goto err;
}
if (EVP_PKEY_encapsulate(pctx, ct, &ctlen, pms, &pmslen) <= 0) {
SSL: refactor all SSLfatal() calls Since SSLfatal() doesn't take a function code any more, we drop that argument everywhere. Also, we convert all combinations of SSLfatal() and ERR_add_data() to an SSLfatal_data() call. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13316)
2020-11-04 14:39:57 +01:00
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
[ssl] Support ssl_encapsulate on server side Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13018)
2020-09-28 04:32:03 +03:00
goto err;
}
if (gensecret) {
/* SSLfatal() called as appropriate in the below functions */
rv = ssl_gensecret(s, pms, pmslen);
} else {
/* Save premaster secret */
s->s3.tmp.pms = pms;
s->s3.tmp.pmslen = pmslen;
pms = NULL;
rv = 1;
}
if (rv > 0) {
/* Pass ownership of ct to caller */
*ctp = ct;
*ctlenp = ctlen;
ct = NULL;
}
err:
OPENSSL_clear_free(pms, pmslen);
OPENSSL_free(ct);
EVP_PKEY_CTX_free(pctx);
return rv;
}
Adding TLS group name retrieval Function SSL_group_to_name() added, together with documentation and tests. This now permits displaying names of internal and external provider-implemented groups. Partial fix of #13767 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13785)
2021-01-07 09:09:32 +01:00
Add SSL_get0_group_name() to get name of the group used for KEX Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20866)
2023-05-19 14:08:41 -05:00
const char *SSL_get0_group_name(SSL *s)
{
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
unsigned int id;
if (sc == NULL)
return NULL;
if (SSL_CONNECTION_IS_TLS13(sc) && sc->s3.did_kex)
id = sc->s3.group_id;
else
id = sc->session->kex_group;
return tls1_group_id2name(s->ctx, id);
}
Adding TLS group name retrieval Function SSL_group_to_name() added, together with documentation and tests. This now permits displaying names of internal and external provider-implemented groups. Partial fix of #13767 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13785)
2021-01-07 09:09:32 +01:00
const char *SSL_group_to_name(SSL *s, int nid) {
int group_id = 0;
const TLS_GROUP_INFO *cinf = NULL;
/* first convert to real group id for internal and external IDs */
if (nid & TLSEXT_nid_unknown)
group_id = nid & 0xFFFF;
else
group_id = tls1_nid2group_id(nid);
/* then look up */
cinf = tls1_group_id_lookup(s->ctx, group_id);
if (cinf != NULL)
return cinf->tlsname;
return NULL;
}
Reference in New Issue Copy Permalink