mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Prohibit RC4 in DTLS.

Browse Source
This commit is contained in:
Andy Polyakov 2007-10-05 21:04:56 +00:00
parent fcd1cb666c
commit 5d58f1bbfe
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
ssl/d1_lib.c
View File

@ -167,3 +167,23 @@ void dtls1_clear(SSL *s)
ssl3_clear(s);
s->version=DTLS1_VERSION;
}
/*
* As it's impossible to use stream ciphers in "datagram" mode, this
* simple filter is designed to disengage them in DTLS. Unfortunately
* there is no universal way to identify stream SSL_CIPHER, so we have
* to explicitly list their SSL_* codes. Currently RC4 is the only one
* available, but if new ones emerge, they will have to be added...
*/
SSL_CIPHER *dtls1_get_cipher(unsigned int u)
{
SSL_CIPHER *ciph = ssl3_get_cipher(u);
if (ciph != NULL)
{
if (ciph->algorithm_enc == SSL_RC4)
return NULL;
}
return ciph;
}

3
ssl/ssl_locl.h
View File

@ -746,7 +746,7 @@ const SSL_METHOD *func_name(void) \
ssl3_put_cipher_by_char, \
ssl3_pending, \
ssl3_num_ciphers, \
ssl3_get_cipher, \
dtls1_get_cipher, \
s_get_meth, \
dtls1_default_timeout, \
&DTLSv1_enc_data, \
@ -915,6 +915,7 @@ void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
void dtls1_reset_seq_numbers(SSL *s, int rw);
long dtls1_default_timeout(void);
SSL_CIPHER *dtls1_get_cipher(unsigned int u);
/* some client-only functions */