new ctrl to retrive value of received temporary key in server key exchange message...

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 3bc5ce952ad329454759bd207c08603b750c1f55..f1e703b873893d31b8ed43976769dd6580a23b9f 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3458,6 +3458,62 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
        case SSL_CTRL_SET_CHAIN_CERT_STORE:
                return ssl_cert_set_cert_store(s->cert, parg, 1, larg);
 
+       case SSL_CTRL_GET_PEER_SIGNATURE_NID:
+               if (TLS1_get_version(s) >= TLS1_2_VERSION)
+                       {
+                       if (s->session && s->session->sess_cert)
+                               {
+                               const EVP_MD *sig;
+                               sig = s->session->sess_cert->peer_key->digest;
+                               if (sig)
+                                       {
+                                       *(int *)parg = EVP_MD_type(sig);
+                                       return 1;
+                                       }
+                               }
+                       return 0;
+                       }
+               /* Might want to do something here for other versions */
+               else
+                       return 0;
+
+       case SSL_CTRL_GET_SERVER_TMP_KEY:
+               if (s->server || !s->session || !s->session->sess_cert)
+                       return 0;
+               else
+                       {
+                       SESS_CERT *sc;
+                       EVP_PKEY *ptmp;
+                       int rv = 0;
+                       sc = s->session->sess_cert;
+                       if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp
+                                                       && !sc->peer_ecdh_tmp)
+                               return 0;
+                       ptmp = EVP_PKEY_new();
+                       if (!ptmp)
+                               return 0;
+                       if (0);
+#ifndef OPENSSL_NO_RSA
+                       else if (sc->peer_rsa_tmp)
+                               rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
+#endif
+#ifndef OPENSSL_NO_DH
+                       else if (sc->peer_dh_tmp)
+                               rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
+#endif
+#ifndef OPENSSL_NO_ECDH
+                       else if (sc->peer_ecdh_tmp)
+                               rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
+#endif
+                       if (rv)
+                               {
+                               *(EVP_PKEY **)parg = ptmp;
+                               return 1;
+                               }
+                       EVP_PKEY_free(ptmp);
+                       return 0;
+                       }
+
        default:
                break;
                }
@@ -3966,7 +4022,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
            }
 #endif
 
-       if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
+       if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || tls1_suiteb(s))
                {
                prio = srvr;
                allow = clnt;
@@ -4040,7 +4096,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                /* if we are considering an ECC cipher suite that uses
                 * an ephemeral EC key check it */
                if (alg_k & SSL_kEECDH)
-                       ok = ok && tls1_check_ec_tmp_key(s);
+                       ok = ok && tls1_check_ec_tmp_key(s, c->id);
 #endif /* OPENSSL_NO_EC */
 #endif /* OPENSSL_NO_TLSEXT */
 
@@ -4059,7 +4115,7 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
        {
        int ret=0;
        const unsigned char *sig;
-       size_t siglen;
+       size_t i, siglen;
        int have_rsa_sign = 0, have_dsa_sign = 0, have_ecdsa_sign = 0;
        int nostrict = 1;
        unsigned long alg_k;
@@ -4070,48 +4126,27 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
                memcpy(p, s->cert->ctypes, s->cert->ctype_num);
                return (int)s->cert->ctype_num;
                }
-       /* Else see if we have any signature algorithms configured */
-       if (s->cert->client_sigalgs)
+       /* get configured sigalgs */
+       siglen = tls12_get_psigalgs(s, &sig);
+       if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
+               nostrict = 0;
+       for (i = 0; i < siglen; i+=2, sig+=2)
                {
-               sig = s->cert->client_sigalgs;
-               siglen = s->cert->client_sigalgslen;
-               }
-       else
-               {
-               sig = s->cert->conf_sigalgs;
-               siglen = s->cert->conf_sigalgslen;
-               }
-       /* If we have sigalgs work out if we can sign with RSA, DSA, ECDSA */
-       if (sig)
-               {
-               size_t i;
-               if (s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
-                       nostrict = 0;
-               for (i = 0; i < siglen; i+=2, sig+=2)
+               switch(sig[1])
                        {
-                       switch(sig[1])
-                               {
-                       case TLSEXT_signature_rsa:
-                               have_rsa_sign = 1;
-                               break;
+               case TLSEXT_signature_rsa:
+                       have_rsa_sign = 1;
+                       break;
 
-                       case TLSEXT_signature_dsa:
-                               have_dsa_sign = 1;
-                               break;
+               case TLSEXT_signature_dsa:
+                       have_dsa_sign = 1;
+                       break;
 
-                       case TLSEXT_signature_ecdsa:
-                               have_ecdsa_sign = 1;
-                               break;
-                               }
+               case TLSEXT_signature_ecdsa:
+                       have_ecdsa_sign = 1;
+                       break;
                        }
                }
-       /* Otherwise allow anything */
-       else
-               {
-               have_rsa_sign = 1;
-               have_dsa_sign = 1;
-               have_ecdsa_sign = 1;
-               }
 
        alg_k = s->s3->tmp.new_cipher->algorithm_mkey;