If cipher list contains a match for an explicit ciphersuite only match that

one suite.

diff --git a/CHANGES b/CHANGES
index 6c2bb25578c80b249d45f1b33aeb2afcbe814dcc..bba071c20df1e6eed049ff6918a9d93795ae768e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
 
  Changes between 0.9.8a and 0.9.8b  [XX xxx XXXX]
 
+  *) When applying a cipher rule check to see if string match is an explicit
+     cipher suite and only match that one cipher suite if it is.
+     [Steve Henson]
+
   *) Link in manifests for VC++ if needed.
      [Austin Ziegler <halostatue@gmail.com>]
 

diff --git a/crypto/asn1/t_pkey.c b/crypto/asn1/t_pkey.c
index afb95d67121a0995b2f7cd3ecf29df0d92f9d0e1..f9b1a11d6cfbfeb0cf71a59b1d39f76360450851 100644 (file)
--- a/crypto/asn1/t_pkey.c
+++ b/crypto/asn1/t_pkey.c
@@ -158,21 +158,21 @@ int RSA_print(BIO *bp, const RSA *x, int off)
                BIO_snprintf(str,sizeof str,"Modulus (%d bit):", mod_len);
        else
                BUF_strlcpy(str,"modulus:",sizeof str);
-       if (!print(bp,str,x->n,m,off)) goto err;
+       if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err;
        s=(x->d == NULL)?"Exponent:":"publicExponent:";
-       if ((x->e != NULL) && !print(bp,s,x->e,m,off))
+       if ((x->e != NULL) && !ASN1_bn_print(bp,s,x->e,m,off))
                goto err;
-       if ((x->d != NULL) && !print(bp,"privateExponent:",x->d,m,off))
+       if ((x->d != NULL) && !ASN1_bn_print(bp,"privateExponent:",x->d,m,off))
                goto err;
-       if ((x->p != NULL) && !print(bp,"prime1:",x->p,m,off))
+       if ((x->p != NULL) && !ASN1_bn_print(bp,"prime1:",x->p,m,off))
                goto err;
-       if ((x->q != NULL) && !print(bp,"prime2:",x->q,m,off))
+       if ((x->q != NULL) && !ASN1_bn_print(bp,"prime2:",x->q,m,off))
                goto err;
-       if ((x->dmp1 != NULL) && !print(bp,"exponent1:",x->dmp1,m,off))
+       if ((x->dmp1 != NULL) && !ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off))
                goto err;
-       if ((x->dmq1 != NULL) && !print(bp,"exponent2:",x->dmq1,m,off))
+       if ((x->dmq1 != NULL) && !ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off))
                goto err;
-       if ((x->iqmp != NULL) && !print(bp,"coefficient:",x->iqmp,m,off))
+       if ((x->iqmp != NULL) && !ASN1_bn_print(bp,"coefficient:",x->iqmp,m,off))
                goto err;
        ret=1;
 err:
@@ -241,13 +241,13 @@ int DSA_print(BIO *bp, const DSA *x, int off)
                        <= 0) goto err;
                }
 
-       if ((x->priv_key != NULL) && !print(bp,"priv:",x->priv_key,m,off))
+       if ((x->priv_key != NULL) && !ASN1_bn_print(bp,"priv:",x->priv_key,m,off))
                goto err;
-       if ((x->pub_key  != NULL) && !print(bp,"pub: ",x->pub_key,m,off))
+       if ((x->pub_key  != NULL) && !ASN1_bn_print(bp,"pub: ",x->pub_key,m,off))
                goto err;
-       if ((x->p != NULL) && !print(bp,"P:   ",x->p,m,off)) goto err;
-       if ((x->q != NULL) && !print(bp,"Q:   ",x->q,m,off)) goto err;
-       if ((x->g != NULL) && !print(bp,"G:   ",x->g,m,off)) goto err;
+       if ((x->p != NULL) && !ASN1_bn_print(bp,"P:   ",x->p,m,off)) goto err;
+       if ((x->q != NULL) && !ASN1_bn_print(bp,"Q:   ",x->q,m,off)) goto err;
+       if ((x->g != NULL) && !ASN1_bn_print(bp,"G:   ",x->g,m,off)) goto err;
        ret=1;
 err:
        if (m != NULL) OPENSSL_free(m);
@@ -430,40 +430,40 @@ int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off)
                                goto err;
 
                        /* print the polynomial */
-                       if ((p != NULL) && !print(bp, "Polynomial:", p, buffer,
+                       if ((p != NULL) && !ASN1_bn_print(bp, "Polynomial:", p, buffer,
                                off))
                                goto err;
                        }
                else
                        {
-                       if ((p != NULL) && !print(bp, "Prime:", p, buffer,off))
+                       if ((p != NULL) && !ASN1_bn_print(bp, "Prime:", p, buffer,off))
                                goto err;
                        }
-               if ((a != NULL) && !print(bp, "A:   ", a, buffer, off)) 
+               if ((a != NULL) && !ASN1_bn_print(bp, "A:   ", a, buffer, off)) 
                        goto err;
-               if ((b != NULL) && !print(bp, "B:   ", b, buffer, off))
+               if ((b != NULL) && !ASN1_bn_print(bp, "B:   ", b, buffer, off))
                        goto err;
                if (form == POINT_CONVERSION_COMPRESSED)
                        {
-                       if ((gen != NULL) && !print(bp, gen_compressed, gen,
+                       if ((gen != NULL) && !ASN1_bn_print(bp, gen_compressed, gen,
                                buffer, off))
                                goto err;
                        }
                else if (form == POINT_CONVERSION_UNCOMPRESSED)
                        {
-                       if ((gen != NULL) && !print(bp, gen_uncompressed, gen,
+                       if ((gen != NULL) && !ASN1_bn_print(bp, gen_uncompressed, gen,
                                buffer, off))
                                goto err;
                        }
                else /* form == POINT_CONVERSION_HYBRID */
                        {
-                       if ((gen != NULL) && !print(bp, gen_hybrid, gen,
+                       if ((gen != NULL) && !ASN1_bn_print(bp, gen_hybrid, gen,
                                buffer, off))
                                goto err;
                        }
-               if ((order != NULL) && !print(bp, "Order: ", order, 
+               if ((order != NULL) && !ASN1_bn_print(bp, "Order: ", order, 
                        buffer, off)) goto err;
-               if ((cofactor != NULL) && !print(bp, "Cofactor: ", cofactor, 
+               if ((cofactor != NULL) && !ASN1_bn_print(bp, "Cofactor: ", cofactor, 
                        buffer, off)) goto err;
                if (seed && !print_bin(bp, "Seed:", seed, seed_len, off))
                        goto err;
@@ -543,10 +543,10 @@ int EC_KEY_print(BIO *bp, const EC_KEY *x, int off)
                        BN_num_bits(order)) <= 0) goto err;
                }
   
-       if ((priv_key != NULL) && !print(bp, "priv:", priv_key, 
+       if ((priv_key != NULL) && !ASN1_bn_print(bp, "priv:", priv_key, 
                buffer, off))
                goto err;
-       if ((pub_key != NULL) && !print(bp, "pub: ", pub_key,
+       if ((pub_key != NULL) && !ASN1_bn_print(bp, "pub: ", pub_key,
                buffer, off))
                goto err;
        if (!ECPKParameters_print(bp, group, off))
@@ -567,7 +567,7 @@ err:
        }
 #endif /* OPENSSL_NO_EC */
 
-static int print(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf,
+static int BN_print_pkey(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf,
             int off)
        {
        int n,i;
@@ -703,8 +703,8 @@ int DHparams_print(BIO *bp, const DH *x)
        if (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d bit)\n",
                BN_num_bits(x->p)) <= 0)
                goto err;
-       if (!print(bp,"prime:",x->p,m,4)) goto err;
-       if (!print(bp,"generator:",x->g,m,4)) goto err;
+       if (!ASN1_bn_print(bp,"prime:",x->p,m,4)) goto err;
+       if (!ASN1_bn_print(bp,"generator:",x->g,m,4)) goto err;
        if (x->length != 0)
                {
                if (BIO_printf(bp,"    recommended-private-length: %d bits\n",
@@ -769,9 +769,9 @@ int DSAparams_print(BIO *bp, const DSA *x)
        if (BIO_printf(bp,"DSA-Parameters: (%d bit)\n",
                BN_num_bits(x->p)) <= 0)
                goto err;
-       if (!print(bp,"p:",x->p,m,4)) goto err;
-       if ((x->q != NULL) && !print(bp,"q:",x->q,m,4)) goto err;
-       if ((x->g != NULL) && !print(bp,"g:",x->g,m,4)) goto err;
+       if (!ASN1_bn_print(bp,"p:",x->p,m,4)) goto err;
+       if ((x->q != NULL) && !ASN1_bn_print(bp,"q:",x->q,m,4)) goto err;
+       if ((x->g != NULL) && !ASN1_bn_print(bp,"g:",x->g,m,4)) goto err;
        ret=1;
 err:
        if (m != NULL) OPENSSL_free(m);

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index cdd7a9ae74d682e2d4eb6651a17a46eb482d06ce..441507f4946bf3764fc3cbb2eb2cadbfdebdf42e 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -482,7 +482,8 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
        *ca_curr = NULL;        /* end of list */
        }
 
-static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
+static void ssl_cipher_apply_rule(unsigned long cipher_id,
+               unsigned long algorithms, unsigned long mask,
                unsigned long algo_strength, unsigned long mask_strength,
                int rule, int strength_bits, CIPHER_ORDER *co_list,
                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
@@ -508,11 +509,19 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
 
                cp = curr->cipher;
 
+               /* If explicit cipher suite match that one only */
+
+               if (cipher_id)
+                       {
+                       if (cp->id != cipher_id)
+                               continue;
+                       }
+
                /*
                 * Selection criteria is either the number of strength_bits
                 * or the algorithm used.
                 */
-               if (strength_bits == -1)
+               else if (strength_bits == -1)
                        {
                        ma = mask & cp->algorithms;
                        ma_s = mask_strength & cp->algo_strength;
@@ -625,7 +634,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list,
         */
        for (i = max_strength_bits; i >= 0; i--)
                if (number_uses[i] > 0)
-                       ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
+                       ssl_cipher_apply_rule(0, 0, 0, 0, 0, CIPHER_ORD, i,
                                        co_list, head_p, tail_p);
 
        OPENSSL_free(number_uses);
@@ -639,6 +648,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
        unsigned long algorithms, mask, algo_strength, mask_strength;
        const char *l, *start, *buf;
        int j, multi, found, rule, retval, ok, buflen;
+       unsigned long cipher_id;
        char ch;
 
        retval = 1;
@@ -728,6 +738,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                         * use strcmp(), because buf is not '\0' terminated.)
                         */
                         j = found = 0;
+                        cipher_id = 0;
                         while (ca_list[j])
                                {
                                if (!strncmp(buf, ca_list[j]->name, buflen) &&
@@ -742,6 +753,12 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                        if (!found)
                                break;  /* ignore this entry */
 
+                       if (ca_list[j]->valid)
+                               {
+                               cipher_id = ca_list[j]->id;
+                               break;
+                               }
+
                        /* New algorithms:
                         *  1 - any old restrictions apply outside new mask
                         *  2 - any new restrictions apply outside old mask
@@ -785,7 +802,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                        }
                else if (found)
                        {
-                       ssl_cipher_apply_rule(algorithms, mask,
+                       ssl_cipher_apply_rule(cipher_id, algorithms, mask,
                                algo_strength, mask_strength, rule, -1,
                                co_list, head_p, tail_p);
                        }