From: Dr. Stephen Henson Date: Sat, 15 Apr 2006 00:22:34 +0000 (+0000) Subject: If cipher list contains a match for an explicit ciphersuite only match that X-Git-Tag: OpenSSL_0_9_8b~8 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cbb0b734c7a116a483467aa1b741469269ff917e;p=openssl If cipher list contains a match for an explicit ciphersuite only match that one suite. --- diff --git a/CHANGES b/CHANGES index 6c2bb25578..bba071c20d 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,10 @@ Changes between 0.9.8a and 0.9.8b [XX xxx XXXX] + *) When applying a cipher rule check to see if string match is an explicit + cipher suite and only match that one cipher suite if it is. + [Steve Henson] + *) Link in manifests for VC++ if needed. [Austin Ziegler ] diff --git a/crypto/asn1/t_pkey.c b/crypto/asn1/t_pkey.c index afb95d6712..f9b1a11d6c 100644 --- a/crypto/asn1/t_pkey.c +++ b/crypto/asn1/t_pkey.c @@ -158,21 +158,21 @@ int RSA_print(BIO *bp, const RSA *x, int off) BIO_snprintf(str,sizeof str,"Modulus (%d bit):", mod_len); else BUF_strlcpy(str,"modulus:",sizeof str); - if (!print(bp,str,x->n,m,off)) goto err; + if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err; s=(x->d == NULL)?"Exponent:":"publicExponent:"; - if ((x->e != NULL) && !print(bp,s,x->e,m,off)) + if ((x->e != NULL) && !ASN1_bn_print(bp,s,x->e,m,off)) goto err; - if ((x->d != NULL) && !print(bp,"privateExponent:",x->d,m,off)) + if ((x->d != NULL) && !ASN1_bn_print(bp,"privateExponent:",x->d,m,off)) goto err; - if ((x->p != NULL) && !print(bp,"prime1:",x->p,m,off)) + if ((x->p != NULL) && !ASN1_bn_print(bp,"prime1:",x->p,m,off)) goto err; - if ((x->q != NULL) && !print(bp,"prime2:",x->q,m,off)) + if ((x->q != NULL) && !ASN1_bn_print(bp,"prime2:",x->q,m,off)) goto err; - if ((x->dmp1 != NULL) && !print(bp,"exponent1:",x->dmp1,m,off)) + if ((x->dmp1 != NULL) && !ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off)) goto err; - if ((x->dmq1 != NULL) && !print(bp,"exponent2:",x->dmq1,m,off)) + if ((x->dmq1 != NULL) && !ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off)) goto err; - if ((x->iqmp != NULL) && !print(bp,"coefficient:",x->iqmp,m,off)) + if ((x->iqmp != NULL) && !ASN1_bn_print(bp,"coefficient:",x->iqmp,m,off)) goto err; ret=1; err: @@ -241,13 +241,13 @@ int DSA_print(BIO *bp, const DSA *x, int off) <= 0) goto err; } - if ((x->priv_key != NULL) && !print(bp,"priv:",x->priv_key,m,off)) + if ((x->priv_key != NULL) && !ASN1_bn_print(bp,"priv:",x->priv_key,m,off)) goto err; - if ((x->pub_key != NULL) && !print(bp,"pub: ",x->pub_key,m,off)) + if ((x->pub_key != NULL) && !ASN1_bn_print(bp,"pub: ",x->pub_key,m,off)) goto err; - if ((x->p != NULL) && !print(bp,"P: ",x->p,m,off)) goto err; - if ((x->q != NULL) && !print(bp,"Q: ",x->q,m,off)) goto err; - if ((x->g != NULL) && !print(bp,"G: ",x->g,m,off)) goto err; + if ((x->p != NULL) && !ASN1_bn_print(bp,"P: ",x->p,m,off)) goto err; + if ((x->q != NULL) && !ASN1_bn_print(bp,"Q: ",x->q,m,off)) goto err; + if ((x->g != NULL) && !ASN1_bn_print(bp,"G: ",x->g,m,off)) goto err; ret=1; err: if (m != NULL) OPENSSL_free(m); @@ -430,40 +430,40 @@ int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off) goto err; /* print the polynomial */ - if ((p != NULL) && !print(bp, "Polynomial:", p, buffer, + if ((p != NULL) && !ASN1_bn_print(bp, "Polynomial:", p, buffer, off)) goto err; } else { - if ((p != NULL) && !print(bp, "Prime:", p, buffer,off)) + if ((p != NULL) && !ASN1_bn_print(bp, "Prime:", p, buffer,off)) goto err; } - if ((a != NULL) && !print(bp, "A: ", a, buffer, off)) + if ((a != NULL) && !ASN1_bn_print(bp, "A: ", a, buffer, off)) goto err; - if ((b != NULL) && !print(bp, "B: ", b, buffer, off)) + if ((b != NULL) && !ASN1_bn_print(bp, "B: ", b, buffer, off)) goto err; if (form == POINT_CONVERSION_COMPRESSED) { - if ((gen != NULL) && !print(bp, gen_compressed, gen, + if ((gen != NULL) && !ASN1_bn_print(bp, gen_compressed, gen, buffer, off)) goto err; } else if (form == POINT_CONVERSION_UNCOMPRESSED) { - if ((gen != NULL) && !print(bp, gen_uncompressed, gen, + if ((gen != NULL) && !ASN1_bn_print(bp, gen_uncompressed, gen, buffer, off)) goto err; } else /* form == POINT_CONVERSION_HYBRID */ { - if ((gen != NULL) && !print(bp, gen_hybrid, gen, + if ((gen != NULL) && !ASN1_bn_print(bp, gen_hybrid, gen, buffer, off)) goto err; } - if ((order != NULL) && !print(bp, "Order: ", order, + if ((order != NULL) && !ASN1_bn_print(bp, "Order: ", order, buffer, off)) goto err; - if ((cofactor != NULL) && !print(bp, "Cofactor: ", cofactor, + if ((cofactor != NULL) && !ASN1_bn_print(bp, "Cofactor: ", cofactor, buffer, off)) goto err; if (seed && !print_bin(bp, "Seed:", seed, seed_len, off)) goto err; @@ -543,10 +543,10 @@ int EC_KEY_print(BIO *bp, const EC_KEY *x, int off) BN_num_bits(order)) <= 0) goto err; } - if ((priv_key != NULL) && !print(bp, "priv:", priv_key, + if ((priv_key != NULL) && !ASN1_bn_print(bp, "priv:", priv_key, buffer, off)) goto err; - if ((pub_key != NULL) && !print(bp, "pub: ", pub_key, + if ((pub_key != NULL) && !ASN1_bn_print(bp, "pub: ", pub_key, buffer, off)) goto err; if (!ECPKParameters_print(bp, group, off)) @@ -567,7 +567,7 @@ err: } #endif /* OPENSSL_NO_EC */ -static int print(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf, +static int BN_print_pkey(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf, int off) { int n,i; @@ -703,8 +703,8 @@ int DHparams_print(BIO *bp, const DH *x) if (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d bit)\n", BN_num_bits(x->p)) <= 0) goto err; - if (!print(bp,"prime:",x->p,m,4)) goto err; - if (!print(bp,"generator:",x->g,m,4)) goto err; + if (!ASN1_bn_print(bp,"prime:",x->p,m,4)) goto err; + if (!ASN1_bn_print(bp,"generator:",x->g,m,4)) goto err; if (x->length != 0) { if (BIO_printf(bp," recommended-private-length: %d bits\n", @@ -769,9 +769,9 @@ int DSAparams_print(BIO *bp, const DSA *x) if (BIO_printf(bp,"DSA-Parameters: (%d bit)\n", BN_num_bits(x->p)) <= 0) goto err; - if (!print(bp,"p:",x->p,m,4)) goto err; - if ((x->q != NULL) && !print(bp,"q:",x->q,m,4)) goto err; - if ((x->g != NULL) && !print(bp,"g:",x->g,m,4)) goto err; + if (!ASN1_bn_print(bp,"p:",x->p,m,4)) goto err; + if ((x->q != NULL) && !ASN1_bn_print(bp,"q:",x->q,m,4)) goto err; + if ((x->g != NULL) && !ASN1_bn_print(bp,"g:",x->g,m,4)) goto err; ret=1; err: if (m != NULL) OPENSSL_free(m); diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index cdd7a9ae74..441507f494 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -482,7 +482,8 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list, *ca_curr = NULL; /* end of list */ } -static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, +static void ssl_cipher_apply_rule(unsigned long cipher_id, + unsigned long algorithms, unsigned long mask, unsigned long algo_strength, unsigned long mask_strength, int rule, int strength_bits, CIPHER_ORDER *co_list, CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) @@ -508,11 +509,19 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask, cp = curr->cipher; + /* If explicit cipher suite match that one only */ + + if (cipher_id) + { + if (cp->id != cipher_id) + continue; + } + /* * Selection criteria is either the number of strength_bits * or the algorithm used. */ - if (strength_bits == -1) + else if (strength_bits == -1) { ma = mask & cp->algorithms; ma_s = mask_strength & cp->algo_strength; @@ -625,7 +634,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list, */ for (i = max_strength_bits; i >= 0; i--) if (number_uses[i] > 0) - ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i, + ssl_cipher_apply_rule(0, 0, 0, 0, 0, CIPHER_ORD, i, co_list, head_p, tail_p); OPENSSL_free(number_uses); @@ -639,6 +648,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str, unsigned long algorithms, mask, algo_strength, mask_strength; const char *l, *start, *buf; int j, multi, found, rule, retval, ok, buflen; + unsigned long cipher_id; char ch; retval = 1; @@ -728,6 +738,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str, * use strcmp(), because buf is not '\0' terminated.) */ j = found = 0; + cipher_id = 0; while (ca_list[j]) { if (!strncmp(buf, ca_list[j]->name, buflen) && @@ -742,6 +753,12 @@ static int ssl_cipher_process_rulestr(const char *rule_str, if (!found) break; /* ignore this entry */ + if (ca_list[j]->valid) + { + cipher_id = ca_list[j]->id; + break; + } + /* New algorithms: * 1 - any old restrictions apply outside new mask * 2 - any new restrictions apply outside old mask @@ -785,7 +802,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str, } else if (found) { - ssl_cipher_apply_rule(algorithms, mask, + ssl_cipher_apply_rule(cipher_id, algorithms, mask, algo_strength, mask_strength, rule, -1, co_list, head_p, tail_p); }