RT3548: Remove unsupported platforms
[openssl.git] / ssl / s3_lib.c
1 /* ssl/s3_lib.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  * 
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  * 
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  * 
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from 
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  * 
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  * 
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer. 
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113  *
114  * Portions of the attached software ("Contribution") are developed by 
115  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
116  *
117  * The Contribution is licensed pursuant to the OpenSSL open source
118  * license provided above.
119  *
120  * ECC cipher suite support in OpenSSL originally written by
121  * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
122  *
123  */
124 /* ====================================================================
125  * Copyright 2005 Nokia. All rights reserved.
126  *
127  * The portions of the attached software ("Contribution") is developed by
128  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
129  * license.
130  *
131  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
132  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
133  * support (see RFC 4279) to OpenSSL.
134  *
135  * No patent licenses or other rights except those expressly stated in
136  * the OpenSSL open source license shall be deemed granted or received
137  * expressly, by implication, estoppel, or otherwise.
138  *
139  * No assurances are provided by Nokia that the Contribution does not
140  * infringe the patent or other intellectual property rights of any third
141  * party or that the license provides you with all the necessary rights
142  * to make use of the Contribution.
143  *
144  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
145  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
146  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
147  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
148  * OTHERWISE.
149  */
150
151 #include <stdio.h>
152 #include <openssl/objects.h>
153 #include "ssl_locl.h"
154 #include "kssl_lcl.h"
155 #include <openssl/md5.h>
156 #ifndef OPENSSL_NO_DH
157 #include <openssl/dh.h>
158 #endif
159
160 const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
161
162 #define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
163
164 /* list of available SSLv3 ciphers (sorted by id) */
165 OPENSSL_GLOBAL const SSL_CIPHER ssl3_ciphers[]={
166
167 /* The RSA ciphers */
168 /* Cipher 01 */
169         {
170         1,
171         SSL3_TXT_RSA_NULL_MD5,
172         SSL3_CK_RSA_NULL_MD5,
173         SSL_kRSA,
174         SSL_aRSA,
175         SSL_eNULL,
176         SSL_MD5,
177         SSL_SSLV3,
178         SSL_NOT_EXP|SSL_STRONG_NONE,
179         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
180         0,
181         0,
182         },
183
184 /* Cipher 02 */
185         {
186         1,
187         SSL3_TXT_RSA_NULL_SHA,
188         SSL3_CK_RSA_NULL_SHA,
189         SSL_kRSA,
190         SSL_aRSA,
191         SSL_eNULL,
192         SSL_SHA1,
193         SSL_SSLV3,
194         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
195         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
196         0,
197         0,
198         },
199
200 /* Cipher 03 */
201         {
202         1,
203         SSL3_TXT_RSA_RC4_40_MD5,
204         SSL3_CK_RSA_RC4_40_MD5,
205         SSL_kRSA,
206         SSL_aRSA,
207         SSL_RC4,
208         SSL_MD5,
209         SSL_SSLV3,
210         SSL_EXPORT|SSL_EXP40,
211         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
212         40,
213         128,
214         },
215
216 /* Cipher 04 */
217         {
218         1,
219         SSL3_TXT_RSA_RC4_128_MD5,
220         SSL3_CK_RSA_RC4_128_MD5,
221         SSL_kRSA,
222         SSL_aRSA,
223         SSL_RC4,
224         SSL_MD5,
225         SSL_SSLV3,
226         SSL_NOT_EXP|SSL_MEDIUM,
227         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
228         128,
229         128,
230         },
231
232 /* Cipher 05 */
233         {
234         1,
235         SSL3_TXT_RSA_RC4_128_SHA,
236         SSL3_CK_RSA_RC4_128_SHA,
237         SSL_kRSA,
238         SSL_aRSA,
239         SSL_RC4,
240         SSL_SHA1,
241         SSL_SSLV3,
242         SSL_NOT_EXP|SSL_MEDIUM,
243         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
244         128,
245         128,
246         },
247
248 /* Cipher 06 */
249         {
250         1,
251         SSL3_TXT_RSA_RC2_40_MD5,
252         SSL3_CK_RSA_RC2_40_MD5,
253         SSL_kRSA,
254         SSL_aRSA,
255         SSL_RC2,
256         SSL_MD5,
257         SSL_SSLV3,
258         SSL_EXPORT|SSL_EXP40,
259         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
260         40,
261         128,
262         },
263
264 /* Cipher 07 */
265 #ifndef OPENSSL_NO_IDEA
266         {
267         1,
268         SSL3_TXT_RSA_IDEA_128_SHA,
269         SSL3_CK_RSA_IDEA_128_SHA,
270         SSL_kRSA,
271         SSL_aRSA,
272         SSL_IDEA,
273         SSL_SHA1,
274         SSL_SSLV3,
275         SSL_NOT_EXP|SSL_MEDIUM,
276         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
277         128,
278         128,
279         },
280 #endif
281
282 /* Cipher 08 */
283         {
284         1,
285         SSL3_TXT_RSA_DES_40_CBC_SHA,
286         SSL3_CK_RSA_DES_40_CBC_SHA,
287         SSL_kRSA,
288         SSL_aRSA,
289         SSL_DES,
290         SSL_SHA1,
291         SSL_SSLV3,
292         SSL_EXPORT|SSL_EXP40,
293         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
294         40,
295         56,
296         },
297
298 /* Cipher 09 */
299         {
300         1,
301         SSL3_TXT_RSA_DES_64_CBC_SHA,
302         SSL3_CK_RSA_DES_64_CBC_SHA,
303         SSL_kRSA,
304         SSL_aRSA,
305         SSL_DES,
306         SSL_SHA1,
307         SSL_SSLV3,
308         SSL_NOT_EXP|SSL_LOW,
309         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
310         56,
311         56,
312         },
313
314 /* Cipher 0A */
315         {
316         1,
317         SSL3_TXT_RSA_DES_192_CBC3_SHA,
318         SSL3_CK_RSA_DES_192_CBC3_SHA,
319         SSL_kRSA,
320         SSL_aRSA,
321         SSL_3DES,
322         SSL_SHA1,
323         SSL_SSLV3,
324         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
325         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
326         112,
327         168,
328         },
329
330 /* The DH ciphers */
331 /* Cipher 0B */
332         {
333         1,
334         SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
335         SSL3_CK_DH_DSS_DES_40_CBC_SHA,
336         SSL_kDHd,
337         SSL_aDH,
338         SSL_DES,
339         SSL_SHA1,
340         SSL_SSLV3,
341         SSL_EXPORT|SSL_EXP40,
342         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
343         40,
344         56,
345         },
346
347 /* Cipher 0C */
348         {
349         1,
350         SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
351         SSL3_CK_DH_DSS_DES_64_CBC_SHA,
352         SSL_kDHd,
353         SSL_aDH,
354         SSL_DES,
355         SSL_SHA1,
356         SSL_SSLV3,
357         SSL_NOT_EXP|SSL_LOW,
358         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
359         56,
360         56,
361         },
362
363 /* Cipher 0D */
364         {
365         1,
366         SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
367         SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
368         SSL_kDHd,
369         SSL_aDH,
370         SSL_3DES,
371         SSL_SHA1,
372         SSL_SSLV3,
373         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
374         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
375         112,
376         168,
377         },
378
379 /* Cipher 0E */
380         {
381         1,
382         SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
383         SSL3_CK_DH_RSA_DES_40_CBC_SHA,
384         SSL_kDHr,
385         SSL_aDH,
386         SSL_DES,
387         SSL_SHA1,
388         SSL_SSLV3,
389         SSL_EXPORT|SSL_EXP40,
390         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
391         40,
392         56,
393         },
394
395 /* Cipher 0F */
396         {
397         1,
398         SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
399         SSL3_CK_DH_RSA_DES_64_CBC_SHA,
400         SSL_kDHr,
401         SSL_aDH,
402         SSL_DES,
403         SSL_SHA1,
404         SSL_SSLV3,
405         SSL_NOT_EXP|SSL_LOW,
406         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
407         56,
408         56,
409         },
410
411 /* Cipher 10 */
412         {
413         1,
414         SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
415         SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
416         SSL_kDHr,
417         SSL_aDH,
418         SSL_3DES,
419         SSL_SHA1,
420         SSL_SSLV3,
421         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
422         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
423         112,
424         168,
425         },
426
427 /* The Ephemeral DH ciphers */
428 /* Cipher 11 */
429         {
430         1,
431         SSL3_TXT_DHE_DSS_DES_40_CBC_SHA,
432         SSL3_CK_DHE_DSS_DES_40_CBC_SHA,
433         SSL_kDHE,
434         SSL_aDSS,
435         SSL_DES,
436         SSL_SHA1,
437         SSL_SSLV3,
438         SSL_EXPORT|SSL_EXP40,
439         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
440         40,
441         56,
442         },
443
444 /* Cipher 12 */
445         {
446         1,
447         SSL3_TXT_DHE_DSS_DES_64_CBC_SHA,
448         SSL3_CK_DHE_DSS_DES_64_CBC_SHA,
449         SSL_kDHE,
450         SSL_aDSS,
451         SSL_DES,
452         SSL_SHA1,
453         SSL_SSLV3,
454         SSL_NOT_EXP|SSL_LOW,
455         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
456         56,
457         56,
458         },
459
460 /* Cipher 13 */
461         {
462         1,
463         SSL3_TXT_DHE_DSS_DES_192_CBC3_SHA,
464         SSL3_CK_DHE_DSS_DES_192_CBC3_SHA,
465         SSL_kDHE,
466         SSL_aDSS,
467         SSL_3DES,
468         SSL_SHA1,
469         SSL_SSLV3,
470         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
471         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
472         112,
473         168,
474         },
475
476 /* Cipher 14 */
477         {
478         1,
479         SSL3_TXT_DHE_RSA_DES_40_CBC_SHA,
480         SSL3_CK_DHE_RSA_DES_40_CBC_SHA,
481         SSL_kDHE,
482         SSL_aRSA,
483         SSL_DES,
484         SSL_SHA1,
485         SSL_SSLV3,
486         SSL_EXPORT|SSL_EXP40,
487         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
488         40,
489         56,
490         },
491
492 /* Cipher 15 */
493         {
494         1,
495         SSL3_TXT_DHE_RSA_DES_64_CBC_SHA,
496         SSL3_CK_DHE_RSA_DES_64_CBC_SHA,
497         SSL_kDHE,
498         SSL_aRSA,
499         SSL_DES,
500         SSL_SHA1,
501         SSL_SSLV3,
502         SSL_NOT_EXP|SSL_LOW,
503         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
504         56,
505         56,
506         },
507
508 /* Cipher 16 */
509         {
510         1,
511         SSL3_TXT_DHE_RSA_DES_192_CBC3_SHA,
512         SSL3_CK_DHE_RSA_DES_192_CBC3_SHA,
513         SSL_kDHE,
514         SSL_aRSA,
515         SSL_3DES,
516         SSL_SHA1,
517         SSL_SSLV3,
518         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
519         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
520         112,
521         168,
522         },
523
524 /* Cipher 17 */
525         {
526         1,
527         SSL3_TXT_ADH_RC4_40_MD5,
528         SSL3_CK_ADH_RC4_40_MD5,
529         SSL_kDHE,
530         SSL_aNULL,
531         SSL_RC4,
532         SSL_MD5,
533         SSL_SSLV3,
534         SSL_EXPORT|SSL_EXP40,
535         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
536         40,
537         128,
538         },
539
540 /* Cipher 18 */
541         {
542         1,
543         SSL3_TXT_ADH_RC4_128_MD5,
544         SSL3_CK_ADH_RC4_128_MD5,
545         SSL_kDHE,
546         SSL_aNULL,
547         SSL_RC4,
548         SSL_MD5,
549         SSL_SSLV3,
550         SSL_NOT_EXP|SSL_MEDIUM,
551         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
552         128,
553         128,
554         },
555
556 /* Cipher 19 */
557         {
558         1,
559         SSL3_TXT_ADH_DES_40_CBC_SHA,
560         SSL3_CK_ADH_DES_40_CBC_SHA,
561         SSL_kDHE,
562         SSL_aNULL,
563         SSL_DES,
564         SSL_SHA1,
565         SSL_SSLV3,
566         SSL_EXPORT|SSL_EXP40,
567         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
568         40,
569         128,
570         },
571
572 /* Cipher 1A */
573         {
574         1,
575         SSL3_TXT_ADH_DES_64_CBC_SHA,
576         SSL3_CK_ADH_DES_64_CBC_SHA,
577         SSL_kDHE,
578         SSL_aNULL,
579         SSL_DES,
580         SSL_SHA1,
581         SSL_SSLV3,
582         SSL_NOT_EXP|SSL_LOW,
583         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
584         56,
585         56,
586         },
587
588 /* Cipher 1B */
589         {
590         1,
591         SSL3_TXT_ADH_DES_192_CBC_SHA,
592         SSL3_CK_ADH_DES_192_CBC_SHA,
593         SSL_kDHE,
594         SSL_aNULL,
595         SSL_3DES,
596         SSL_SHA1,
597         SSL_SSLV3,
598         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
599         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
600         112,
601         168,
602         },
603
604 /* Fortezza ciphersuite from SSL 3.0 spec */
605 #if 0
606 /* Cipher 1C */
607         {
608         0,
609         SSL3_TXT_FZA_DMS_NULL_SHA,
610         SSL3_CK_FZA_DMS_NULL_SHA,
611         SSL_kFZA,
612         SSL_aFZA,
613         SSL_eNULL,
614         SSL_SHA1,
615         SSL_SSLV3,
616         SSL_NOT_EXP|SSL_STRONG_NONE,
617         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
618         0,
619         0,
620         },
621
622 /* Cipher 1D */
623         {
624         0,
625         SSL3_TXT_FZA_DMS_FZA_SHA,
626         SSL3_CK_FZA_DMS_FZA_SHA,
627         SSL_kFZA,
628         SSL_aFZA,
629         SSL_eFZA,
630         SSL_SHA1,
631         SSL_SSLV3,
632         SSL_NOT_EXP|SSL_STRONG_NONE,
633         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
634         0,
635         0,
636         },
637
638 /* Cipher 1E */
639         {
640         0,
641         SSL3_TXT_FZA_DMS_RC4_SHA,
642         SSL3_CK_FZA_DMS_RC4_SHA,
643         SSL_kFZA,
644         SSL_aFZA,
645         SSL_RC4,
646         SSL_SHA1,
647         SSL_SSLV3,
648         SSL_NOT_EXP|SSL_MEDIUM,
649         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
650         128,
651         128,
652         },
653 #endif
654
655 #ifndef OPENSSL_NO_KRB5
656 /* The Kerberos ciphers*/
657 /* Cipher 1E */
658         {
659         1,
660         SSL3_TXT_KRB5_DES_64_CBC_SHA,
661         SSL3_CK_KRB5_DES_64_CBC_SHA,
662         SSL_kKRB5,
663         SSL_aKRB5,
664         SSL_DES,
665         SSL_SHA1,
666         SSL_SSLV3,
667         SSL_NOT_EXP|SSL_LOW,
668         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
669         56,
670         56,
671         },
672
673 /* Cipher 1F */
674         {
675         1,
676         SSL3_TXT_KRB5_DES_192_CBC3_SHA,
677         SSL3_CK_KRB5_DES_192_CBC3_SHA,
678         SSL_kKRB5,
679         SSL_aKRB5,
680         SSL_3DES,
681         SSL_SHA1,
682         SSL_SSLV3,
683         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
684         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
685         112,
686         168,
687         },
688
689 /* Cipher 20 */
690         {
691         1,
692         SSL3_TXT_KRB5_RC4_128_SHA,
693         SSL3_CK_KRB5_RC4_128_SHA,
694         SSL_kKRB5,
695         SSL_aKRB5,
696         SSL_RC4,
697         SSL_SHA1,
698         SSL_SSLV3,
699         SSL_NOT_EXP|SSL_MEDIUM,
700         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
701         128,
702         128,
703         },
704
705 /* Cipher 21 */
706         {
707         1,
708         SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
709         SSL3_CK_KRB5_IDEA_128_CBC_SHA,
710         SSL_kKRB5,
711         SSL_aKRB5,
712         SSL_IDEA,
713         SSL_SHA1,
714         SSL_SSLV3,
715         SSL_NOT_EXP|SSL_MEDIUM,
716         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
717         128,
718         128,
719         },
720
721 /* Cipher 22 */
722         {
723         1,
724         SSL3_TXT_KRB5_DES_64_CBC_MD5,
725         SSL3_CK_KRB5_DES_64_CBC_MD5,
726         SSL_kKRB5,
727         SSL_aKRB5,
728         SSL_DES,
729         SSL_MD5,
730         SSL_SSLV3,
731         SSL_NOT_EXP|SSL_LOW,
732         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
733         56,
734         56,
735         },
736
737 /* Cipher 23 */
738         {
739         1,
740         SSL3_TXT_KRB5_DES_192_CBC3_MD5,
741         SSL3_CK_KRB5_DES_192_CBC3_MD5,
742         SSL_kKRB5,
743         SSL_aKRB5,
744         SSL_3DES,
745         SSL_MD5,
746         SSL_SSLV3,
747         SSL_NOT_EXP|SSL_HIGH,
748         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
749         112,
750         168,
751         },
752
753 /* Cipher 24 */
754         {
755         1,
756         SSL3_TXT_KRB5_RC4_128_MD5,
757         SSL3_CK_KRB5_RC4_128_MD5,
758         SSL_kKRB5,
759         SSL_aKRB5,
760         SSL_RC4,
761         SSL_MD5,
762         SSL_SSLV3,
763         SSL_NOT_EXP|SSL_MEDIUM,
764         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
765         128,
766         128,
767         },
768
769 /* Cipher 25 */
770         {
771         1,
772         SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
773         SSL3_CK_KRB5_IDEA_128_CBC_MD5,
774         SSL_kKRB5,
775         SSL_aKRB5,
776         SSL_IDEA,
777         SSL_MD5,
778         SSL_SSLV3,
779         SSL_NOT_EXP|SSL_MEDIUM,
780         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
781         128,
782         128,
783         },
784
785 /* Cipher 26 */
786         {
787         1,
788         SSL3_TXT_KRB5_DES_40_CBC_SHA,
789         SSL3_CK_KRB5_DES_40_CBC_SHA,
790         SSL_kKRB5,
791         SSL_aKRB5,
792         SSL_DES,
793         SSL_SHA1,
794         SSL_SSLV3,
795         SSL_EXPORT|SSL_EXP40,
796         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
797         40,
798         56,
799         },
800
801 /* Cipher 27 */
802         {
803         1,
804         SSL3_TXT_KRB5_RC2_40_CBC_SHA,
805         SSL3_CK_KRB5_RC2_40_CBC_SHA,
806         SSL_kKRB5,
807         SSL_aKRB5,
808         SSL_RC2,
809         SSL_SHA1,
810         SSL_SSLV3,
811         SSL_EXPORT|SSL_EXP40,
812         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
813         40,
814         128,
815         },
816
817 /* Cipher 28 */
818         {
819         1,
820         SSL3_TXT_KRB5_RC4_40_SHA,
821         SSL3_CK_KRB5_RC4_40_SHA,
822         SSL_kKRB5,
823         SSL_aKRB5,
824         SSL_RC4,
825         SSL_SHA1,
826         SSL_SSLV3,
827         SSL_EXPORT|SSL_EXP40,
828         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
829         40,
830         128,
831         },
832
833 /* Cipher 29 */
834         {
835         1,
836         SSL3_TXT_KRB5_DES_40_CBC_MD5,
837         SSL3_CK_KRB5_DES_40_CBC_MD5,
838         SSL_kKRB5,
839         SSL_aKRB5,
840         SSL_DES,
841         SSL_MD5,
842         SSL_SSLV3,
843         SSL_EXPORT|SSL_EXP40,
844         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
845         40,
846         56,
847         },
848
849 /* Cipher 2A */
850         {
851         1,
852         SSL3_TXT_KRB5_RC2_40_CBC_MD5,
853         SSL3_CK_KRB5_RC2_40_CBC_MD5,
854         SSL_kKRB5,
855         SSL_aKRB5,
856         SSL_RC2,
857         SSL_MD5,
858         SSL_SSLV3,
859         SSL_EXPORT|SSL_EXP40,
860         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
861         40,
862         128,
863         },
864
865 /* Cipher 2B */
866         {
867         1,
868         SSL3_TXT_KRB5_RC4_40_MD5,
869         SSL3_CK_KRB5_RC4_40_MD5,
870         SSL_kKRB5,
871         SSL_aKRB5,
872         SSL_RC4,
873         SSL_MD5,
874         SSL_SSLV3,
875         SSL_EXPORT|SSL_EXP40,
876         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
877         40,
878         128,
879         },
880 #endif  /* OPENSSL_NO_KRB5 */
881
882 /* New AES ciphersuites */
883 /* Cipher 2F */
884         {
885         1,
886         TLS1_TXT_RSA_WITH_AES_128_SHA,
887         TLS1_CK_RSA_WITH_AES_128_SHA,
888         SSL_kRSA,
889         SSL_aRSA,
890         SSL_AES128,
891         SSL_SHA1,
892         SSL_TLSV1,
893         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
894         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
895         128,
896         128,
897         },
898 /* Cipher 30 */
899         {
900         1,
901         TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
902         TLS1_CK_DH_DSS_WITH_AES_128_SHA,
903         SSL_kDHd,
904         SSL_aDH,
905         SSL_AES128,
906         SSL_SHA1,
907         SSL_TLSV1,
908         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
909         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
910         128,
911         128,
912         },
913 /* Cipher 31 */
914         {
915         1,
916         TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
917         TLS1_CK_DH_RSA_WITH_AES_128_SHA,
918         SSL_kDHr,
919         SSL_aDH,
920         SSL_AES128,
921         SSL_SHA1,
922         SSL_TLSV1,
923         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
924         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
925         128,
926         128,
927         },
928 /* Cipher 32 */
929         {
930         1,
931         TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
932         TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
933         SSL_kDHE,
934         SSL_aDSS,
935         SSL_AES128,
936         SSL_SHA1,
937         SSL_TLSV1,
938         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
939         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
940         128,
941         128,
942         },
943 /* Cipher 33 */
944         {
945         1,
946         TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
947         TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
948         SSL_kDHE,
949         SSL_aRSA,
950         SSL_AES128,
951         SSL_SHA1,
952         SSL_TLSV1,
953         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
954         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
955         128,
956         128,
957         },
958 /* Cipher 34 */
959         {
960         1,
961         TLS1_TXT_ADH_WITH_AES_128_SHA,
962         TLS1_CK_ADH_WITH_AES_128_SHA,
963         SSL_kDHE,
964         SSL_aNULL,
965         SSL_AES128,
966         SSL_SHA1,
967         SSL_TLSV1,
968         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
969         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
970         128,
971         128,
972         },
973
974 /* Cipher 35 */
975         {
976         1,
977         TLS1_TXT_RSA_WITH_AES_256_SHA,
978         TLS1_CK_RSA_WITH_AES_256_SHA,
979         SSL_kRSA,
980         SSL_aRSA,
981         SSL_AES256,
982         SSL_SHA1,
983         SSL_TLSV1,
984         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
985         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
986         256,
987         256,
988         },
989 /* Cipher 36 */
990         {
991         1,
992         TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
993         TLS1_CK_DH_DSS_WITH_AES_256_SHA,
994         SSL_kDHd,
995         SSL_aDH,
996         SSL_AES256,
997         SSL_SHA1,
998         SSL_TLSV1,
999         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1000         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1001         256,
1002         256,
1003         },
1004
1005 /* Cipher 37 */
1006         {
1007         1,
1008         TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
1009         TLS1_CK_DH_RSA_WITH_AES_256_SHA,
1010         SSL_kDHr,
1011         SSL_aDH,
1012         SSL_AES256,
1013         SSL_SHA1,
1014         SSL_TLSV1,
1015         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1016         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1017         256,
1018         256,
1019         },
1020
1021 /* Cipher 38 */
1022         {
1023         1,
1024         TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
1025         TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
1026         SSL_kDHE,
1027         SSL_aDSS,
1028         SSL_AES256,
1029         SSL_SHA1,
1030         SSL_TLSV1,
1031         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1032         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1033         256,
1034         256,
1035         },
1036
1037 /* Cipher 39 */
1038         {
1039         1,
1040         TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
1041         TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
1042         SSL_kDHE,
1043         SSL_aRSA,
1044         SSL_AES256,
1045         SSL_SHA1,
1046         SSL_TLSV1,
1047         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1048         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1049         256,
1050         256,
1051         },
1052
1053         /* Cipher 3A */
1054         {
1055         1,
1056         TLS1_TXT_ADH_WITH_AES_256_SHA,
1057         TLS1_CK_ADH_WITH_AES_256_SHA,
1058         SSL_kDHE,
1059         SSL_aNULL,
1060         SSL_AES256,
1061         SSL_SHA1,
1062         SSL_TLSV1,
1063         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1064         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1065         256,
1066         256,
1067         },
1068
1069         /* TLS v1.2 ciphersuites */
1070         /* Cipher 3B */
1071         {
1072         1,
1073         TLS1_TXT_RSA_WITH_NULL_SHA256,
1074         TLS1_CK_RSA_WITH_NULL_SHA256,
1075         SSL_kRSA,
1076         SSL_aRSA,
1077         SSL_eNULL,
1078         SSL_SHA256,
1079         SSL_TLSV1_2,
1080         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
1081         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1082         0,
1083         0,
1084         },
1085
1086         /* Cipher 3C */
1087         {
1088         1,
1089         TLS1_TXT_RSA_WITH_AES_128_SHA256,
1090         TLS1_CK_RSA_WITH_AES_128_SHA256,
1091         SSL_kRSA,
1092         SSL_aRSA,
1093         SSL_AES128,
1094         SSL_SHA256,
1095         SSL_TLSV1_2,
1096         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1097         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1098         128,
1099         128,
1100         },
1101
1102         /* Cipher 3D */
1103         {
1104         1,
1105         TLS1_TXT_RSA_WITH_AES_256_SHA256,
1106         TLS1_CK_RSA_WITH_AES_256_SHA256,
1107         SSL_kRSA,
1108         SSL_aRSA,
1109         SSL_AES256,
1110         SSL_SHA256,
1111         SSL_TLSV1_2,
1112         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1113         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1114         256,
1115         256,
1116         },
1117
1118         /* Cipher 3E */
1119         {
1120         1,
1121         TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
1122         TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
1123         SSL_kDHd,
1124         SSL_aDH,
1125         SSL_AES128,
1126         SSL_SHA256,
1127         SSL_TLSV1_2,
1128         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1129         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1130         128,
1131         128,
1132         },
1133
1134         /* Cipher 3F */
1135         {
1136         1,
1137         TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
1138         TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
1139         SSL_kDHr,
1140         SSL_aDH,
1141         SSL_AES128,
1142         SSL_SHA256,
1143         SSL_TLSV1_2,
1144         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1145         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1146         128,
1147         128,
1148         },
1149
1150         /* Cipher 40 */
1151         {
1152         1,
1153         TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
1154         TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
1155         SSL_kDHE,
1156         SSL_aDSS,
1157         SSL_AES128,
1158         SSL_SHA256,
1159         SSL_TLSV1_2,
1160         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1161         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1162         128,
1163         128,
1164         },
1165
1166 #ifndef OPENSSL_NO_CAMELLIA
1167         /* Camellia ciphersuites from RFC4132 (128-bit portion) */
1168
1169         /* Cipher 41 */
1170         {
1171         1,
1172         TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
1173         TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
1174         SSL_kRSA,
1175         SSL_aRSA,
1176         SSL_CAMELLIA128,
1177         SSL_SHA1,
1178         SSL_TLSV1,
1179         SSL_NOT_EXP|SSL_HIGH,
1180         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1181         128,
1182         128,
1183         },
1184
1185         /* Cipher 42 */
1186         {
1187         1,
1188         TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
1189         TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
1190         SSL_kDHd,
1191         SSL_aDH,
1192         SSL_CAMELLIA128,
1193         SSL_SHA1,
1194         SSL_TLSV1,
1195         SSL_NOT_EXP|SSL_HIGH,
1196         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1197         128,
1198         128,
1199         },
1200
1201         /* Cipher 43 */
1202         {
1203         1,
1204         TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
1205         TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
1206         SSL_kDHr,
1207         SSL_aDH,
1208         SSL_CAMELLIA128,
1209         SSL_SHA1,
1210         SSL_TLSV1,
1211         SSL_NOT_EXP|SSL_HIGH,
1212         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1213         128,
1214         128,
1215         },
1216
1217         /* Cipher 44 */
1218         {
1219         1,
1220         TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
1221         TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
1222         SSL_kDHE,
1223         SSL_aDSS,
1224         SSL_CAMELLIA128,
1225         SSL_SHA1,
1226         SSL_TLSV1,
1227         SSL_NOT_EXP|SSL_HIGH,
1228         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1229         128,
1230         128,
1231         },
1232
1233         /* Cipher 45 */
1234         {
1235         1,
1236         TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
1237         TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
1238         SSL_kDHE,
1239         SSL_aRSA,
1240         SSL_CAMELLIA128,
1241         SSL_SHA1,
1242         SSL_TLSV1,
1243         SSL_NOT_EXP|SSL_HIGH,
1244         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1245         128,
1246         128,
1247         },
1248
1249         /* Cipher 46 */
1250         {
1251         1,
1252         TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
1253         TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
1254         SSL_kDHE,
1255         SSL_aNULL,
1256         SSL_CAMELLIA128,
1257         SSL_SHA1,
1258         SSL_TLSV1,
1259         SSL_NOT_EXP|SSL_HIGH,
1260         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1261         128,
1262         128,
1263         },
1264 #endif /* OPENSSL_NO_CAMELLIA */
1265
1266 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
1267         /* New TLS Export CipherSuites from expired ID */
1268 #if 0
1269         /* Cipher 60 */
1270         {
1271         1,
1272         TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
1273         TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
1274         SSL_kRSA,
1275         SSL_aRSA,
1276         SSL_RC4,
1277         SSL_MD5,
1278         SSL_TLSV1,
1279         SSL_EXPORT|SSL_EXP56,
1280         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1281         56,
1282         128,
1283         },
1284
1285         /* Cipher 61 */
1286         {
1287         1,
1288         TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1289         TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1290         SSL_kRSA,
1291         SSL_aRSA,
1292         SSL_RC2,
1293         SSL_MD5,
1294         SSL_TLSV1,
1295         SSL_EXPORT|SSL_EXP56,
1296         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1297         56,
1298         128,
1299         },
1300 #endif
1301
1302         /* Cipher 62 */
1303         {
1304         1,
1305         TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1306         TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1307         SSL_kRSA,
1308         SSL_aRSA,
1309         SSL_DES,
1310         SSL_SHA1,
1311         SSL_TLSV1,
1312         SSL_EXPORT|SSL_EXP56,
1313         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1314         56,
1315         56,
1316         },
1317
1318         /* Cipher 63 */
1319         {
1320         1,
1321         TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1322         TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1323         SSL_kDHE,
1324         SSL_aDSS,
1325         SSL_DES,
1326         SSL_SHA1,
1327         SSL_TLSV1,
1328         SSL_EXPORT|SSL_EXP56,
1329         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1330         56,
1331         56,
1332         },
1333
1334         /* Cipher 64 */
1335         {
1336         1,
1337         TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
1338         TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
1339         SSL_kRSA,
1340         SSL_aRSA,
1341         SSL_RC4,
1342         SSL_SHA1,
1343         SSL_TLSV1,
1344         SSL_EXPORT|SSL_EXP56,
1345         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1346         56,
1347         128,
1348         },
1349
1350         /* Cipher 65 */
1351         {
1352         1,
1353         TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1354         TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1355         SSL_kDHE,
1356         SSL_aDSS,
1357         SSL_RC4,
1358         SSL_SHA1,
1359         SSL_TLSV1,
1360         SSL_EXPORT|SSL_EXP56,
1361         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1362         56,
1363         128,
1364         },
1365
1366         /* Cipher 66 */
1367         {
1368         1,
1369         TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
1370         TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
1371         SSL_kDHE,
1372         SSL_aDSS,
1373         SSL_RC4,
1374         SSL_SHA1,
1375         SSL_TLSV1,
1376         SSL_NOT_EXP|SSL_MEDIUM,
1377         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1378         128,
1379         128,
1380         },
1381 #endif
1382
1383         /* TLS v1.2 ciphersuites */
1384         /* Cipher 67 */
1385         {
1386         1,
1387         TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
1388         TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
1389         SSL_kDHE,
1390         SSL_aRSA,
1391         SSL_AES128,
1392         SSL_SHA256,
1393         SSL_TLSV1_2,
1394         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1395         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1396         128,
1397         128,
1398         },
1399
1400         /* Cipher 68 */
1401         {
1402         1,
1403         TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
1404         TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
1405         SSL_kDHd,
1406         SSL_aDH,
1407         SSL_AES256,
1408         SSL_SHA256,
1409         SSL_TLSV1_2,
1410         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1411         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1412         256,
1413         256,
1414         },
1415
1416         /* Cipher 69 */
1417         {
1418         1,
1419         TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
1420         TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
1421         SSL_kDHr,
1422         SSL_aDH,
1423         SSL_AES256,
1424         SSL_SHA256,
1425         SSL_TLSV1_2,
1426         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1427         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1428         256,
1429         256,
1430         },
1431
1432         /* Cipher 6A */
1433         {
1434         1,
1435         TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
1436         TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
1437         SSL_kDHE,
1438         SSL_aDSS,
1439         SSL_AES256,
1440         SSL_SHA256,
1441         SSL_TLSV1_2,
1442         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1443         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1444         256,
1445         256,
1446         },
1447
1448         /* Cipher 6B */
1449         {
1450         1,
1451         TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
1452         TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
1453         SSL_kDHE,
1454         SSL_aRSA,
1455         SSL_AES256,
1456         SSL_SHA256,
1457         SSL_TLSV1_2,
1458         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1459         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1460         256,
1461         256,
1462         },
1463
1464         /* Cipher 6C */
1465         {
1466         1,
1467         TLS1_TXT_ADH_WITH_AES_128_SHA256,
1468         TLS1_CK_ADH_WITH_AES_128_SHA256,
1469         SSL_kDHE,
1470         SSL_aNULL,
1471         SSL_AES128,
1472         SSL_SHA256,
1473         SSL_TLSV1_2,
1474         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1475         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1476         128,
1477         128,
1478         },
1479
1480         /* Cipher 6D */
1481         {
1482         1,
1483         TLS1_TXT_ADH_WITH_AES_256_SHA256,
1484         TLS1_CK_ADH_WITH_AES_256_SHA256,
1485         SSL_kDHE,
1486         SSL_aNULL,
1487         SSL_AES256,
1488         SSL_SHA256,
1489         SSL_TLSV1_2,
1490         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1491         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1492         256,
1493         256,
1494         },
1495
1496         /* GOST Ciphersuites */
1497
1498         {
1499         1,
1500         "GOST94-GOST89-GOST89",
1501         0x3000080,
1502         SSL_kGOST,
1503         SSL_aGOST94,
1504         SSL_eGOST2814789CNT,
1505         SSL_GOST89MAC,
1506         SSL_TLSV1,
1507         SSL_NOT_EXP|SSL_HIGH,
1508         SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
1509         256,
1510         256
1511         },
1512         {
1513         1,
1514         "GOST2001-GOST89-GOST89",
1515         0x3000081,
1516         SSL_kGOST,
1517         SSL_aGOST01,
1518         SSL_eGOST2814789CNT,
1519         SSL_GOST89MAC,
1520         SSL_TLSV1,
1521         SSL_NOT_EXP|SSL_HIGH,
1522         SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
1523         256,
1524         256
1525         },
1526         {
1527         1,
1528         "GOST94-NULL-GOST94",
1529         0x3000082,
1530         SSL_kGOST,
1531         SSL_aGOST94,
1532         SSL_eNULL,
1533         SSL_GOST94,
1534         SSL_TLSV1,
1535         SSL_NOT_EXP|SSL_STRONG_NONE,
1536         SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
1537         0,
1538         0
1539         },
1540         {
1541         1,
1542         "GOST2001-NULL-GOST94",
1543         0x3000083,
1544         SSL_kGOST,
1545         SSL_aGOST01,
1546         SSL_eNULL,
1547         SSL_GOST94,
1548         SSL_TLSV1,
1549         SSL_NOT_EXP|SSL_STRONG_NONE,
1550         SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
1551         0,
1552         0
1553         },
1554
1555 #ifndef OPENSSL_NO_CAMELLIA
1556         /* Camellia ciphersuites from RFC4132 (256-bit portion) */
1557
1558         /* Cipher 84 */
1559         {
1560         1,
1561         TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
1562         TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
1563         SSL_kRSA,
1564         SSL_aRSA,
1565         SSL_CAMELLIA256,
1566         SSL_SHA1,
1567         SSL_TLSV1,
1568         SSL_NOT_EXP|SSL_HIGH,
1569         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1570         256,
1571         256,
1572         },
1573         /* Cipher 85 */
1574         {
1575         1,
1576         TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
1577         TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
1578         SSL_kDHd,
1579         SSL_aDH,
1580         SSL_CAMELLIA256,
1581         SSL_SHA1,
1582         SSL_TLSV1,
1583         SSL_NOT_EXP|SSL_HIGH,
1584         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1585         256,
1586         256,
1587         },
1588
1589         /* Cipher 86 */
1590         {
1591         1,
1592         TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
1593         TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
1594         SSL_kDHr,
1595         SSL_aDH,
1596         SSL_CAMELLIA256,
1597         SSL_SHA1,
1598         SSL_TLSV1,
1599         SSL_NOT_EXP|SSL_HIGH,
1600         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1601         256,
1602         256,
1603         },
1604
1605         /* Cipher 87 */
1606         {
1607         1,
1608         TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
1609         TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
1610         SSL_kDHE,
1611         SSL_aDSS,
1612         SSL_CAMELLIA256,
1613         SSL_SHA1,
1614         SSL_TLSV1,
1615         SSL_NOT_EXP|SSL_HIGH,
1616         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1617         256,
1618         256,
1619         },
1620
1621         /* Cipher 88 */
1622         {
1623         1,
1624         TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
1625         TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
1626         SSL_kDHE,
1627         SSL_aRSA,
1628         SSL_CAMELLIA256,
1629         SSL_SHA1,
1630         SSL_TLSV1,
1631         SSL_NOT_EXP|SSL_HIGH,
1632         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1633         256,
1634         256,
1635         },
1636
1637         /* Cipher 89 */
1638         {
1639         1,
1640         TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
1641         TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
1642         SSL_kDHE,
1643         SSL_aNULL,
1644         SSL_CAMELLIA256,
1645         SSL_SHA1,
1646         SSL_TLSV1,
1647         SSL_NOT_EXP|SSL_HIGH,
1648         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1649         256,
1650         256,
1651         },
1652 #endif /* OPENSSL_NO_CAMELLIA */
1653
1654 #ifndef OPENSSL_NO_PSK
1655         /* Cipher 8A */
1656         {
1657         1,
1658         TLS1_TXT_PSK_WITH_RC4_128_SHA,
1659         TLS1_CK_PSK_WITH_RC4_128_SHA,
1660         SSL_kPSK,
1661         SSL_aPSK,
1662         SSL_RC4,
1663         SSL_SHA1,
1664         SSL_TLSV1,
1665         SSL_NOT_EXP|SSL_MEDIUM,
1666         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1667         128,
1668         128,
1669         },
1670
1671         /* Cipher 8B */
1672         {
1673         1,
1674         TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
1675         TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
1676         SSL_kPSK,
1677         SSL_aPSK,
1678         SSL_3DES,
1679         SSL_SHA1,
1680         SSL_TLSV1,
1681         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1682         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1683         112,
1684         168,
1685         },
1686
1687         /* Cipher 8C */
1688         {
1689         1,
1690         TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
1691         TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
1692         SSL_kPSK,
1693         SSL_aPSK,
1694         SSL_AES128,
1695         SSL_SHA1,
1696         SSL_TLSV1,
1697         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1698         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1699         128,
1700         128,
1701         },
1702
1703         /* Cipher 8D */
1704         {
1705         1,
1706         TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
1707         TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
1708         SSL_kPSK,
1709         SSL_aPSK,
1710         SSL_AES256,
1711         SSL_SHA1,
1712         SSL_TLSV1,
1713         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1714         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1715         256,
1716         256,
1717         },
1718 #endif  /* OPENSSL_NO_PSK */
1719
1720 #ifndef OPENSSL_NO_SEED
1721         /* SEED ciphersuites from RFC4162 */
1722
1723         /* Cipher 96 */
1724         {
1725         1,
1726         TLS1_TXT_RSA_WITH_SEED_SHA,
1727         TLS1_CK_RSA_WITH_SEED_SHA,
1728         SSL_kRSA,
1729         SSL_aRSA,
1730         SSL_SEED,
1731         SSL_SHA1,
1732         SSL_TLSV1,
1733         SSL_NOT_EXP|SSL_MEDIUM,
1734         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1735         128,
1736         128,
1737         },
1738
1739         /* Cipher 97 */
1740         {
1741         1,
1742         TLS1_TXT_DH_DSS_WITH_SEED_SHA,
1743         TLS1_CK_DH_DSS_WITH_SEED_SHA,
1744         SSL_kDHd,
1745         SSL_aDH,
1746         SSL_SEED,
1747         SSL_SHA1,
1748         SSL_TLSV1,
1749         SSL_NOT_EXP|SSL_MEDIUM,
1750         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1751         128,
1752         128,
1753         },
1754
1755         /* Cipher 98 */
1756         {
1757         1,
1758         TLS1_TXT_DH_RSA_WITH_SEED_SHA,
1759         TLS1_CK_DH_RSA_WITH_SEED_SHA,
1760         SSL_kDHr,
1761         SSL_aDH,
1762         SSL_SEED,
1763         SSL_SHA1,
1764         SSL_TLSV1,
1765         SSL_NOT_EXP|SSL_MEDIUM,
1766         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1767         128,
1768         128,
1769         },
1770
1771         /* Cipher 99 */
1772         {
1773         1,
1774         TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
1775         TLS1_CK_DHE_DSS_WITH_SEED_SHA,
1776         SSL_kDHE,
1777         SSL_aDSS,
1778         SSL_SEED,
1779         SSL_SHA1,
1780         SSL_TLSV1,
1781         SSL_NOT_EXP|SSL_MEDIUM,
1782         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1783         128,
1784         128,
1785         },
1786
1787         /* Cipher 9A */
1788         {
1789         1,
1790         TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
1791         TLS1_CK_DHE_RSA_WITH_SEED_SHA,
1792         SSL_kDHE,
1793         SSL_aRSA,
1794         SSL_SEED,
1795         SSL_SHA1,
1796         SSL_TLSV1,
1797         SSL_NOT_EXP|SSL_MEDIUM,
1798         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1799         128,
1800         128,
1801         },
1802
1803         /* Cipher 9B */
1804         {
1805         1,
1806         TLS1_TXT_ADH_WITH_SEED_SHA,
1807         TLS1_CK_ADH_WITH_SEED_SHA,
1808         SSL_kDHE,
1809         SSL_aNULL,
1810         SSL_SEED,
1811         SSL_SHA1,
1812         SSL_TLSV1,
1813         SSL_NOT_EXP|SSL_MEDIUM,
1814         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1815         128,
1816         128,
1817         },
1818
1819 #endif /* OPENSSL_NO_SEED */
1820
1821         /* GCM ciphersuites from RFC5288 */
1822
1823         /* Cipher 9C */
1824         {
1825         1,
1826         TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
1827         TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
1828         SSL_kRSA,
1829         SSL_aRSA,
1830         SSL_AES128GCM,
1831         SSL_AEAD,
1832         SSL_TLSV1_2,
1833         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1834         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1835         128,
1836         128,
1837         },
1838
1839         /* Cipher 9D */
1840         {
1841         1,
1842         TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
1843         TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
1844         SSL_kRSA,
1845         SSL_aRSA,
1846         SSL_AES256GCM,
1847         SSL_AEAD,
1848         SSL_TLSV1_2,
1849         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1850         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1851         256,
1852         256,
1853         },
1854
1855         /* Cipher 9E */
1856         {
1857         1,
1858         TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
1859         TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
1860         SSL_kDHE,
1861         SSL_aRSA,
1862         SSL_AES128GCM,
1863         SSL_AEAD,
1864         SSL_TLSV1_2,
1865         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1866         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1867         128,
1868         128,
1869         },
1870
1871         /* Cipher 9F */
1872         {
1873         1,
1874         TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
1875         TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
1876         SSL_kDHE,
1877         SSL_aRSA,
1878         SSL_AES256GCM,
1879         SSL_AEAD,
1880         SSL_TLSV1_2,
1881         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1882         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1883         256,
1884         256,
1885         },
1886
1887         /* Cipher A0 */
1888         {
1889         1,
1890         TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
1891         TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
1892         SSL_kDHr,
1893         SSL_aDH,
1894         SSL_AES128GCM,
1895         SSL_AEAD,
1896         SSL_TLSV1_2,
1897         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1898         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1899         128,
1900         128,
1901         },
1902
1903         /* Cipher A1 */
1904         {
1905         1,
1906         TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
1907         TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
1908         SSL_kDHr,
1909         SSL_aDH,
1910         SSL_AES256GCM,
1911         SSL_AEAD,
1912         SSL_TLSV1_2,
1913         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1914         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1915         256,
1916         256,
1917         },
1918
1919         /* Cipher A2 */
1920         {
1921         1,
1922         TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
1923         TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
1924         SSL_kDHE,
1925         SSL_aDSS,
1926         SSL_AES128GCM,
1927         SSL_AEAD,
1928         SSL_TLSV1_2,
1929         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1930         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1931         128,
1932         128,
1933         },
1934
1935         /* Cipher A3 */
1936         {
1937         1,
1938         TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
1939         TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
1940         SSL_kDHE,
1941         SSL_aDSS,
1942         SSL_AES256GCM,
1943         SSL_AEAD,
1944         SSL_TLSV1_2,
1945         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1946         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1947         256,
1948         256,
1949         },
1950
1951         /* Cipher A4 */
1952         {
1953         1,
1954         TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
1955         TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
1956         SSL_kDHd,
1957         SSL_aDH,
1958         SSL_AES128GCM,
1959         SSL_AEAD,
1960         SSL_TLSV1_2,
1961         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1962         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1963         128,
1964         128,
1965         },
1966
1967         /* Cipher A5 */
1968         {
1969         1,
1970         TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
1971         TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
1972         SSL_kDHd,
1973         SSL_aDH,
1974         SSL_AES256GCM,
1975         SSL_AEAD,
1976         SSL_TLSV1_2,
1977         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1978         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1979         256,
1980         256,
1981         },
1982
1983         /* Cipher A6 */
1984         {
1985         1,
1986         TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
1987         TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
1988         SSL_kDHE,
1989         SSL_aNULL,
1990         SSL_AES128GCM,
1991         SSL_AEAD,
1992         SSL_TLSV1_2,
1993         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1994         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1995         128,
1996         128,
1997         },
1998
1999         /* Cipher A7 */
2000         {
2001         1,
2002         TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
2003         TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
2004         SSL_kDHE,
2005         SSL_aNULL,
2006         SSL_AES256GCM,
2007         SSL_AEAD,
2008         SSL_TLSV1_2,
2009         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2010         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2011         256,
2012         256,
2013         },
2014 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
2015         {
2016         1,
2017         "SCSV",
2018         SSL3_CK_SCSV,
2019         0,
2020         0,
2021         0,
2022         0,
2023         0,
2024         0,
2025         0,
2026         0,
2027         0
2028         },
2029 #endif
2030
2031 #ifndef OPENSSL_NO_CAMELLIA
2032         /* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
2033
2034         /* Cipher BA */
2035         {
2036         1,
2037         TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2038         TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2039         SSL_kRSA,
2040         SSL_aRSA,
2041         SSL_CAMELLIA128,
2042         SSL_SHA256,
2043         SSL_TLSV1_2,
2044         SSL_NOT_EXP|SSL_HIGH,
2045         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2046         128,
2047         128,
2048         },
2049
2050         /* Cipher BB */
2051         {
2052         1,
2053         TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256,
2054         TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256,
2055         SSL_kDHd,
2056         SSL_aDH,
2057         SSL_CAMELLIA128,
2058         SSL_SHA256,
2059         SSL_TLSV1_2,
2060         SSL_NOT_EXP|SSL_HIGH,
2061         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2062         128,
2063         128,
2064         },
2065
2066         /* Cipher BC */
2067         {
2068         1,
2069         TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2070         TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2071         SSL_kDHr,
2072         SSL_aDH,
2073         SSL_CAMELLIA128,
2074         SSL_SHA256,
2075         SSL_TLSV1_2,
2076         SSL_NOT_EXP|SSL_HIGH,
2077         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2078         128,
2079         128,
2080         },
2081
2082         /* Cipher BD */
2083         {
2084         1,
2085         TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
2086         TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
2087         SSL_kEDH,
2088         SSL_aDSS,
2089         SSL_CAMELLIA128,
2090         SSL_SHA256,
2091         SSL_TLSV1_2,
2092         SSL_NOT_EXP|SSL_HIGH,
2093         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2094         128,
2095         128,
2096         },
2097
2098         /* Cipher BE */
2099         {
2100         1,
2101         TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2102         TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
2103         SSL_kEDH,
2104         SSL_aRSA,
2105         SSL_CAMELLIA128,
2106         SSL_SHA256,
2107         SSL_TLSV1_2,
2108         SSL_NOT_EXP|SSL_HIGH,
2109         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2110         128,
2111         128,
2112         },
2113
2114         /* Cipher BF */
2115         {
2116         1,
2117         TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256,
2118         TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256,
2119         SSL_kEDH,
2120         SSL_aNULL,
2121         SSL_CAMELLIA128,
2122         SSL_SHA256,
2123         SSL_TLSV1_2,
2124         SSL_NOT_EXP|SSL_HIGH,
2125         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2126         128,
2127         128,
2128         },
2129
2130         /* Cipher C0 */
2131         {
2132         1,
2133         TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2134         TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2135         SSL_kRSA,
2136         SSL_aRSA,
2137         SSL_CAMELLIA256,
2138         SSL_SHA256,
2139         SSL_TLSV1_2,
2140         SSL_NOT_EXP|SSL_HIGH,
2141         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2142         256,
2143         256,
2144         },
2145
2146         /* Cipher C1 */
2147         {
2148         1,
2149         TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256,
2150         TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256,
2151         SSL_kDHd,
2152         SSL_aDH,
2153         SSL_CAMELLIA256,
2154         SSL_SHA256,
2155         SSL_TLSV1_2,
2156         SSL_NOT_EXP|SSL_HIGH,
2157         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2158         256,
2159         256,
2160         },
2161
2162         /* Cipher C2 */
2163         {
2164         1,
2165         TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2166         TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2167         SSL_kDHr,
2168         SSL_aDH,
2169         SSL_CAMELLIA256,
2170         SSL_SHA256,
2171         SSL_TLSV1_2,
2172         SSL_NOT_EXP|SSL_HIGH,
2173         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2174         256,
2175         256,
2176         },
2177
2178         /* Cipher C3 */
2179         {
2180         1,
2181         TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
2182         TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
2183         SSL_kEDH,
2184         SSL_aDSS,
2185         SSL_CAMELLIA256,
2186         SSL_SHA256,
2187         SSL_TLSV1_2,
2188         SSL_NOT_EXP|SSL_HIGH,
2189         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2190         256,
2191         256,
2192         },
2193
2194         /* Cipher C4 */
2195         {
2196         1,
2197         TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2198         TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
2199         SSL_kEDH,
2200         SSL_aRSA,
2201         SSL_CAMELLIA256,
2202         SSL_SHA256,
2203         SSL_TLSV1_2,
2204         SSL_NOT_EXP|SSL_HIGH,
2205         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2206         256,
2207         256,
2208         },
2209
2210         /* Cipher C5 */
2211         {
2212         1,
2213         TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256,
2214         TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256,
2215         SSL_kEDH,
2216         SSL_aNULL,
2217         SSL_CAMELLIA256,
2218         SSL_SHA256,
2219         SSL_TLSV1_2,
2220         SSL_NOT_EXP|SSL_HIGH,
2221         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2222         256,
2223         256,
2224         },
2225 #endif
2226
2227 #ifndef OPENSSL_NO_ECDH
2228         /* Cipher C001 */
2229         {
2230         1,
2231         TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
2232         TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
2233         SSL_kECDHe,
2234         SSL_aECDH,
2235         SSL_eNULL,
2236         SSL_SHA1,
2237         SSL_TLSV1,
2238         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
2239         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2240         0,
2241         0,
2242         },
2243
2244         /* Cipher C002 */
2245         {
2246         1,
2247         TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
2248         TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
2249         SSL_kECDHe,
2250         SSL_aECDH,
2251         SSL_RC4,
2252         SSL_SHA1,
2253         SSL_TLSV1,
2254         SSL_NOT_EXP|SSL_MEDIUM,
2255         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2256         128,
2257         128,
2258         },
2259
2260         /* Cipher C003 */
2261         {
2262         1,
2263         TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
2264         TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
2265         SSL_kECDHe,
2266         SSL_aECDH,
2267         SSL_3DES,
2268         SSL_SHA1,
2269         SSL_TLSV1,
2270         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2271         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2272         112,
2273         168,
2274         },
2275
2276         /* Cipher C004 */
2277         {
2278         1,
2279         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
2280         TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
2281         SSL_kECDHe,
2282         SSL_aECDH,
2283         SSL_AES128,
2284         SSL_SHA1,
2285         SSL_TLSV1,
2286         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2287         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2288         128,
2289         128,
2290         },
2291
2292         /* Cipher C005 */
2293         {
2294         1,
2295         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
2296         TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
2297         SSL_kECDHe,
2298         SSL_aECDH,
2299         SSL_AES256,
2300         SSL_SHA1,
2301         SSL_TLSV1,
2302         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2303         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2304         256,
2305         256,
2306         },
2307
2308         /* Cipher C006 */
2309         {
2310         1,
2311         TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
2312         TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
2313         SSL_kECDHE,
2314         SSL_aECDSA,
2315         SSL_eNULL,
2316         SSL_SHA1,
2317         SSL_TLSV1,
2318         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
2319         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2320         0,
2321         0,
2322         },
2323
2324         /* Cipher C007 */
2325         {
2326         1,
2327         TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
2328         TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
2329         SSL_kECDHE,
2330         SSL_aECDSA,
2331         SSL_RC4,
2332         SSL_SHA1,
2333         SSL_TLSV1,
2334         SSL_NOT_EXP|SSL_MEDIUM,
2335         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2336         128,
2337         128,
2338         },
2339
2340         /* Cipher C008 */
2341         {
2342         1,
2343         TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
2344         TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
2345         SSL_kECDHE,
2346         SSL_aECDSA,
2347         SSL_3DES,
2348         SSL_SHA1,
2349         SSL_TLSV1,
2350         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2351         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2352         112,
2353         168,
2354         },
2355
2356         /* Cipher C009 */
2357         {
2358         1,
2359         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
2360         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
2361         SSL_kECDHE,
2362         SSL_aECDSA,
2363         SSL_AES128,
2364         SSL_SHA1,
2365         SSL_TLSV1,
2366         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2367         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2368         128,
2369         128,
2370         },
2371
2372         /* Cipher C00A */
2373         {
2374         1,
2375         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
2376         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
2377         SSL_kECDHE,
2378         SSL_aECDSA,
2379         SSL_AES256,
2380         SSL_SHA1,
2381         SSL_TLSV1,
2382         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2383         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2384         256,
2385         256,
2386         },
2387
2388         /* Cipher C00B */
2389         {
2390         1,
2391         TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
2392         TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
2393         SSL_kECDHr,
2394         SSL_aECDH,
2395         SSL_eNULL,
2396         SSL_SHA1,
2397         SSL_TLSV1,
2398         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
2399         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2400         0,
2401         0,
2402         },
2403
2404         /* Cipher C00C */
2405         {
2406         1,
2407         TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
2408         TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
2409         SSL_kECDHr,
2410         SSL_aECDH,
2411         SSL_RC4,
2412         SSL_SHA1,
2413         SSL_TLSV1,
2414         SSL_NOT_EXP|SSL_MEDIUM,
2415         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2416         128,
2417         128,
2418         },
2419
2420         /* Cipher C00D */
2421         {
2422         1,
2423         TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
2424         TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
2425         SSL_kECDHr,
2426         SSL_aECDH,
2427         SSL_3DES,
2428         SSL_SHA1,
2429         SSL_TLSV1,
2430         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2431         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2432         112,
2433         168,
2434         },
2435
2436         /* Cipher C00E */
2437         {
2438         1,
2439         TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
2440         TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
2441         SSL_kECDHr,
2442         SSL_aECDH,
2443         SSL_AES128,
2444         SSL_SHA1,
2445         SSL_TLSV1,
2446         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2447         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2448         128,
2449         128,
2450         },
2451
2452         /* Cipher C00F */
2453         {
2454         1,
2455         TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
2456         TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
2457         SSL_kECDHr,
2458         SSL_aECDH,
2459         SSL_AES256,
2460         SSL_SHA1,
2461         SSL_TLSV1,
2462         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2463         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2464         256,
2465         256,
2466         },
2467
2468         /* Cipher C010 */
2469         {
2470         1,
2471         TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
2472         TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
2473         SSL_kECDHE,
2474         SSL_aRSA,
2475         SSL_eNULL,
2476         SSL_SHA1,
2477         SSL_TLSV1,
2478         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
2479         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2480         0,
2481         0,
2482         },
2483
2484         /* Cipher C011 */
2485         {
2486         1,
2487         TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
2488         TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
2489         SSL_kECDHE,
2490         SSL_aRSA,
2491         SSL_RC4,
2492         SSL_SHA1,
2493         SSL_TLSV1,
2494         SSL_NOT_EXP|SSL_MEDIUM,
2495         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2496         128,
2497         128,
2498         },
2499
2500         /* Cipher C012 */
2501         {
2502         1,
2503         TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
2504         TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
2505         SSL_kECDHE,
2506         SSL_aRSA,
2507         SSL_3DES,
2508         SSL_SHA1,
2509         SSL_TLSV1,
2510         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2511         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2512         112,
2513         168,
2514         },
2515
2516         /* Cipher C013 */
2517         {
2518         1,
2519         TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
2520         TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
2521         SSL_kECDHE,
2522         SSL_aRSA,
2523         SSL_AES128,
2524         SSL_SHA1,
2525         SSL_TLSV1,
2526         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2527         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2528         128,
2529         128,
2530         },
2531
2532         /* Cipher C014 */
2533         {
2534         1,
2535         TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
2536         TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
2537         SSL_kECDHE,
2538         SSL_aRSA,
2539         SSL_AES256,
2540         SSL_SHA1,
2541         SSL_TLSV1,
2542         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2543         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2544         256,
2545         256,
2546         },
2547
2548         /* Cipher C015 */
2549         {
2550         1,
2551         TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
2552         TLS1_CK_ECDH_anon_WITH_NULL_SHA,
2553         SSL_kECDHE,
2554         SSL_aNULL,
2555         SSL_eNULL,
2556         SSL_SHA1,
2557         SSL_TLSV1,
2558         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
2559         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2560         0,
2561         0,
2562         },
2563
2564         /* Cipher C016 */
2565         {
2566         1,
2567         TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
2568         TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
2569         SSL_kECDHE,
2570         SSL_aNULL,
2571         SSL_RC4,
2572         SSL_SHA1,
2573         SSL_TLSV1,
2574         SSL_NOT_EXP|SSL_MEDIUM,
2575         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2576         128,
2577         128,
2578         },
2579
2580         /* Cipher C017 */
2581         {
2582         1,
2583         TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
2584         TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
2585         SSL_kECDHE,
2586         SSL_aNULL,
2587         SSL_3DES,
2588         SSL_SHA1,
2589         SSL_TLSV1,
2590         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2591         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2592         112,
2593         168,
2594         },
2595
2596         /* Cipher C018 */
2597         {
2598         1,
2599         TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
2600         TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
2601         SSL_kECDHE,
2602         SSL_aNULL,
2603         SSL_AES128,
2604         SSL_SHA1,
2605         SSL_TLSV1,
2606         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2607         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2608         128,
2609         128,
2610         },
2611
2612         /* Cipher C019 */
2613         {
2614         1,
2615         TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
2616         TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
2617         SSL_kECDHE,
2618         SSL_aNULL,
2619         SSL_AES256,
2620         SSL_SHA1,
2621         SSL_TLSV1,
2622         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2623         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2624         256,
2625         256,
2626         },
2627 #endif  /* OPENSSL_NO_ECDH */
2628
2629 #ifndef OPENSSL_NO_SRP
2630         /* Cipher C01A */
2631         {
2632         1,
2633         TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
2634         TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
2635         SSL_kSRP,
2636         SSL_aSRP,
2637         SSL_3DES,
2638         SSL_SHA1,
2639         SSL_TLSV1,
2640         SSL_NOT_EXP|SSL_HIGH,
2641         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2642         112,
2643         168,
2644         },
2645
2646         /* Cipher C01B */
2647         {
2648         1,
2649         TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
2650         TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
2651         SSL_kSRP,
2652         SSL_aRSA,
2653         SSL_3DES,
2654         SSL_SHA1,
2655         SSL_TLSV1,
2656         SSL_NOT_EXP|SSL_HIGH,
2657         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2658         112,
2659         168,
2660         },
2661
2662         /* Cipher C01C */
2663         {
2664         1,
2665         TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
2666         TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
2667         SSL_kSRP,
2668         SSL_aDSS,
2669         SSL_3DES,
2670         SSL_SHA1,
2671         SSL_TLSV1,
2672         SSL_NOT_EXP|SSL_HIGH,
2673         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2674         112,
2675         168,
2676         },
2677
2678         /* Cipher C01D */
2679         {
2680         1,
2681         TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
2682         TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
2683         SSL_kSRP,
2684         SSL_aSRP,
2685         SSL_AES128,
2686         SSL_SHA1,
2687         SSL_TLSV1,
2688         SSL_NOT_EXP|SSL_HIGH,
2689         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2690         128,
2691         128,
2692         },
2693
2694         /* Cipher C01E */
2695         {
2696         1,
2697         TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
2698         TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
2699         SSL_kSRP,
2700         SSL_aRSA,
2701         SSL_AES128,
2702         SSL_SHA1,
2703         SSL_TLSV1,
2704         SSL_NOT_EXP|SSL_HIGH,
2705         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2706         128,
2707         128,
2708         },
2709
2710         /* Cipher C01F */
2711         {
2712         1,
2713         TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
2714         TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
2715         SSL_kSRP,
2716         SSL_aDSS,
2717         SSL_AES128,
2718         SSL_SHA1,
2719         SSL_TLSV1,
2720         SSL_NOT_EXP|SSL_HIGH,
2721         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2722         128,
2723         128,
2724         },
2725
2726         /* Cipher C020 */
2727         {
2728         1,
2729         TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
2730         TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
2731         SSL_kSRP,
2732         SSL_aSRP,
2733         SSL_AES256,
2734         SSL_SHA1,
2735         SSL_TLSV1,
2736         SSL_NOT_EXP|SSL_HIGH,
2737         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2738         256,
2739         256,
2740         },
2741
2742         /* Cipher C021 */
2743         {
2744         1,
2745         TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
2746         TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
2747         SSL_kSRP,
2748         SSL_aRSA,
2749         SSL_AES256,
2750         SSL_SHA1,
2751         SSL_TLSV1,
2752         SSL_NOT_EXP|SSL_HIGH,
2753         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2754         256,
2755         256,
2756         },
2757
2758         /* Cipher C022 */
2759         {
2760         1,
2761         TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
2762         TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
2763         SSL_kSRP,
2764         SSL_aDSS,
2765         SSL_AES256,
2766         SSL_SHA1,
2767         SSL_TLSV1,
2768         SSL_NOT_EXP|SSL_HIGH,
2769         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
2770         256,
2771         256,
2772         },
2773 #endif  /* OPENSSL_NO_SRP */
2774 #ifndef OPENSSL_NO_ECDH
2775
2776         /* HMAC based TLS v1.2 ciphersuites from RFC5289 */
2777
2778         /* Cipher C023 */
2779         {
2780         1,
2781         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
2782         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
2783         SSL_kECDHE,
2784         SSL_aECDSA,
2785         SSL_AES128,
2786         SSL_SHA256,
2787         SSL_TLSV1_2,
2788         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2789         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2790         128,
2791         128,
2792         },
2793
2794         /* Cipher C024 */
2795         {
2796         1,
2797         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
2798         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
2799         SSL_kECDHE,
2800         SSL_aECDSA,
2801         SSL_AES256,
2802         SSL_SHA384,
2803         SSL_TLSV1_2,
2804         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2805         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2806         256,
2807         256,
2808         },
2809
2810         /* Cipher C025 */
2811         {
2812         1,
2813         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256,
2814         TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256,
2815         SSL_kECDHe,
2816         SSL_aECDH,
2817         SSL_AES128,
2818         SSL_SHA256,
2819         SSL_TLSV1_2,
2820         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2821         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2822         128,
2823         128,
2824         },
2825
2826         /* Cipher C026 */
2827         {
2828         1,
2829         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384,
2830         TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384,
2831         SSL_kECDHe,
2832         SSL_aECDH,
2833         SSL_AES256,
2834         SSL_SHA384,
2835         SSL_TLSV1_2,
2836         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2837         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2838         256,
2839         256,
2840         },
2841
2842         /* Cipher C027 */
2843         {
2844         1,
2845         TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
2846         TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
2847         SSL_kECDHE,
2848         SSL_aRSA,
2849         SSL_AES128,
2850         SSL_SHA256,
2851         SSL_TLSV1_2,
2852         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2853         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2854         128,
2855         128,
2856         },
2857
2858         /* Cipher C028 */
2859         {
2860         1,
2861         TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
2862         TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
2863         SSL_kECDHE,
2864         SSL_aRSA,
2865         SSL_AES256,
2866         SSL_SHA384,
2867         SSL_TLSV1_2,
2868         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2869         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2870         256,
2871         256,
2872         },
2873
2874         /* Cipher C029 */
2875         {
2876         1,
2877         TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
2878         TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
2879         SSL_kECDHr,
2880         SSL_aECDH,
2881         SSL_AES128,
2882         SSL_SHA256,
2883         SSL_TLSV1_2,
2884         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2885         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2886         128,
2887         128,
2888         },
2889
2890         /* Cipher C02A */
2891         {
2892         1,
2893         TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
2894         TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
2895         SSL_kECDHr,
2896         SSL_aECDH,
2897         SSL_AES256,
2898         SSL_SHA384,
2899         SSL_TLSV1_2,
2900         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2901         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2902         256,
2903         256,
2904         },
2905
2906         /* GCM based TLS v1.2 ciphersuites from RFC5289 */
2907
2908         /* Cipher C02B */
2909         {
2910         1,
2911         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
2912         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
2913         SSL_kECDHE,
2914         SSL_aECDSA,
2915         SSL_AES128GCM,
2916         SSL_AEAD,
2917         SSL_TLSV1_2,
2918         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2919         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2920         128,
2921         128,
2922         },
2923
2924         /* Cipher C02C */
2925         {
2926         1,
2927         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
2928         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
2929         SSL_kECDHE,
2930         SSL_aECDSA,
2931         SSL_AES256GCM,
2932         SSL_AEAD,
2933         SSL_TLSV1_2,
2934         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2935         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2936         256,
2937         256,
2938         },
2939
2940         /* Cipher C02D */
2941         {
2942         1,
2943         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
2944         TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
2945         SSL_kECDHe,
2946         SSL_aECDH,
2947         SSL_AES128GCM,
2948         SSL_AEAD,
2949         SSL_TLSV1_2,
2950         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2951         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2952         128,
2953         128,
2954         },
2955
2956         /* Cipher C02E */
2957         {
2958         1,
2959         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
2960         TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
2961         SSL_kECDHe,
2962         SSL_aECDH,
2963         SSL_AES256GCM,
2964         SSL_AEAD,
2965         SSL_TLSV1_2,
2966         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2967         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
2968         256,
2969         256,
2970         },
2971
2972         /* Cipher C02F */
2973         {
2974         1,
2975         TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
2976         TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
2977         SSL_kECDHE,
2978         SSL_aRSA,
2979         SSL_AES128GCM,
2980         SSL_AEAD,
2981         SSL_TLSV1_2,
2982         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2983         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
2984         128,
2985         128,
2986         },
2987
2988         /* Cipher C030 */
2989         {
2990         1,
2991         TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
2992         TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
2993         SSL_kECDHE,
2994         SSL_aRSA,
2995         SSL_AES256GCM,
2996         SSL_AEAD,
2997         SSL_TLSV1_2,
2998         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
2999         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
3000         256,
3001         256,
3002         },
3003
3004         /* Cipher C031 */
3005         {
3006         1,
3007         TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
3008         TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
3009         SSL_kECDHr,
3010         SSL_aECDH,
3011         SSL_AES128GCM,
3012         SSL_AEAD,
3013         SSL_TLSV1_2,
3014         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
3015         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
3016         128,
3017         128,
3018         },
3019
3020         /* Cipher C032 */
3021         {
3022         1,
3023         TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
3024         TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
3025         SSL_kECDHr,
3026         SSL_aECDH,
3027         SSL_AES256GCM,
3028         SSL_AEAD,
3029         SSL_TLSV1_2,
3030         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
3031         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
3032         256,
3033         256,
3034         },
3035
3036 #ifndef OPENSSL_NO_CAMELLIA
3037         { /* Cipher C072 */
3038         1,
3039         TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
3040         TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
3041         SSL_kECDHE,
3042         SSL_aECDSA,
3043         SSL_CAMELLIA128,
3044         SSL_SHA256,
3045         SSL_TLSV1_2,
3046         SSL_NOT_EXP|SSL_HIGH,
3047         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
3048         128,
3049         128
3050         },
3051
3052         { /* Cipher C073 */
3053         1,
3054         TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
3055         TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
3056         SSL_kECDHE,
3057         SSL_aECDSA,
3058         SSL_CAMELLIA256,
3059         SSL_SHA384,
3060         SSL_TLSV1_2,
3061         SSL_NOT_EXP|SSL_HIGH,
3062         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
3063         256,
3064         256
3065         },
3066
3067         { /* Cipher C074 */
3068         1,
3069         TLS1_TXT_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
3070         TLS1_CK_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
3071         SSL_kECDHe,
3072         SSL_aECDH,
3073         SSL_CAMELLIA128,
3074         SSL_SHA256,
3075         SSL_TLSV1_2,
3076         SSL_NOT_EXP|SSL_HIGH,
3077         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
3078         128,
3079         128
3080         },
3081
3082         { /* Cipher C075 */
3083         1,
3084         TLS1_TXT_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
3085         TLS1_CK_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
3086         SSL_kECDHe,
3087         SSL_aECDH,
3088         SSL_CAMELLIA256,
3089         SSL_SHA384,
3090         SSL_TLSV1_2,
3091         SSL_NOT_EXP|SSL_HIGH,
3092         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
3093         256,
3094         256
3095         },
3096
3097         { /* Cipher C076 */
3098         1,
3099         TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
3100         TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
3101         SSL_kECDHE,
3102         SSL_aRSA,
3103         SSL_CAMELLIA128,
3104         SSL_SHA256,
3105         SSL_TLSV1_2,
3106         SSL_NOT_EXP|SSL_HIGH,
3107         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
3108         128,
3109         128
3110         },
3111
3112         { /* Cipher C077 */
3113         1,
3114         TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
3115         TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
3116         SSL_kECDHE,
3117         SSL_aRSA,
3118         SSL_CAMELLIA256,
3119         SSL_SHA384,
3120         SSL_TLSV1_2,
3121         SSL_NOT_EXP|SSL_HIGH,
3122         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
3123         256,
3124         256
3125         },
3126
3127         { /* Cipher C078 */
3128         1,
3129         TLS1_TXT_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256,
3130         TLS1_CK_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256,
3131         SSL_kECDHr,
3132         SSL_aECDH,
3133         SSL_CAMELLIA128,
3134         SSL_SHA256,
3135         SSL_TLSV1_2,
3136         SSL_NOT_EXP|SSL_HIGH,
3137         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
3138         128,
3139         128
3140         },
3141
3142         { /* Cipher C079 */
3143         1,
3144         TLS1_TXT_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384,
3145         TLS1_CK_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384,
3146         SSL_kECDHr,
3147         SSL_aECDH,
3148         SSL_CAMELLIA256,
3149         SSL_SHA384,
3150         SSL_TLSV1_2,
3151         SSL_NOT_EXP|SSL_HIGH,
3152         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
3153         256,
3154         256
3155         },
3156 #endif  /* OPENSSL_NO_CAMELLIA */
3157 #endif /* OPENSSL_NO_ECDH */
3158
3159
3160 #ifdef TEMP_GOST_TLS
3161 /* Cipher FF00 */
3162         {
3163         1,
3164         "GOST-MD5",
3165         0x0300ff00,
3166         SSL_kRSA,
3167         SSL_aRSA,
3168         SSL_eGOST2814789CNT,
3169         SSL_MD5,
3170         SSL_TLSV1,
3171         SSL_NOT_EXP|SSL_HIGH,
3172         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
3173         256,
3174         256,
3175         },
3176         {
3177         1,
3178         "GOST-GOST94",
3179         0x0300ff01,
3180         SSL_kRSA,
3181         SSL_aRSA,
3182         SSL_eGOST2814789CNT,
3183         SSL_GOST94,
3184         SSL_TLSV1,
3185         SSL_NOT_EXP|SSL_HIGH,
3186         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
3187         256,
3188         256
3189         },
3190         {
3191         1,
3192         "GOST-GOST89MAC",
3193         0x0300ff02,
3194         SSL_kRSA,
3195         SSL_aRSA,
3196         SSL_eGOST2814789CNT,
3197         SSL_GOST89MAC,
3198         SSL_TLSV1,
3199         SSL_NOT_EXP|SSL_HIGH,
3200         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
3201         256,
3202         256
3203         },
3204         {
3205         1,
3206         "GOST-GOST89STREAM",
3207         0x0300ff03,
3208         SSL_kRSA,
3209         SSL_aRSA,
3210         SSL_eGOST2814789CNT,
3211         SSL_GOST89MAC,
3212         SSL_TLSV1,
3213         SSL_NOT_EXP|SSL_HIGH,
3214         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
3215         256,
3216         256
3217         },
3218 #endif
3219
3220 /* end of list */
3221         };
3222
3223 const SSL3_ENC_METHOD SSLv3_enc_data={
3224         ssl3_enc,
3225         n_ssl3_mac,
3226         ssl3_setup_key_block,
3227         ssl3_generate_master_secret,
3228         ssl3_change_cipher_state,
3229         ssl3_final_finish_mac,
3230         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
3231         ssl3_cert_verify_mac,
3232         SSL3_MD_CLIENT_FINISHED_CONST,4,
3233         SSL3_MD_SERVER_FINISHED_CONST,4,
3234         ssl3_alert_code,
3235         (int (*)(SSL *, unsigned char *, size_t, const char *,
3236                  size_t, const unsigned char *, size_t,
3237                  int use_context))ssl_undefined_function,
3238         0,
3239         SSL3_HM_HEADER_LENGTH,
3240         ssl3_set_handshake_header,
3241         ssl3_handshake_write
3242         };
3243
3244 long ssl3_default_timeout(void)
3245         {
3246         /* 2 hours, the 24 hours mentioned in the SSLv3 spec
3247          * is way too long for http, the cache would over fill */
3248         return(60*60*2);
3249         }
3250
3251 int ssl3_num_ciphers(void)
3252         {
3253         return(SSL3_NUM_CIPHERS);
3254         }
3255
3256 const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
3257         {
3258         if (u < SSL3_NUM_CIPHERS)
3259                 return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
3260         else
3261                 return(NULL);
3262         }
3263
3264 int ssl3_pending(const SSL *s)
3265         {
3266         if (s->rstate == SSL_ST_READ_BODY)
3267                 return 0;
3268         
3269         return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0;
3270         }
3271
3272 void ssl3_set_handshake_header(SSL *s, int htype, unsigned long len)
3273         {
3274         unsigned char *p = (unsigned char *)s->init_buf->data;
3275         *(p++) = htype;
3276         l2n3(len, p);
3277         s->init_num = (int)len + SSL3_HM_HEADER_LENGTH;
3278         s->init_off = 0;
3279         }
3280
3281 int ssl3_handshake_write(SSL *s)
3282         {
3283         return ssl3_do_write(s, SSL3_RT_HANDSHAKE);
3284         }
3285
3286 int ssl3_new(SSL *s)
3287         {
3288         SSL3_STATE *s3;
3289
3290         if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
3291         memset(s3,0,sizeof *s3);
3292         memset(s3->rrec.seq_num,0,sizeof(s3->rrec.seq_num));
3293         memset(s3->wrec.seq_num,0,sizeof(s3->wrec.seq_num));
3294
3295         s->s3=s3;
3296
3297 #ifndef OPENSSL_NO_SRP
3298         SSL_SRP_CTX_init(s);
3299 #endif
3300         s->method->ssl_clear(s);
3301         return(1);
3302 err:
3303         return(0);
3304         }
3305
3306 void ssl3_free(SSL *s)
3307         {
3308         if(s == NULL)
3309             return;
3310
3311 #ifdef TLSEXT_TYPE_opaque_prf_input
3312         if (s->s3->client_opaque_prf_input != NULL)
3313                 OPENSSL_free(s->s3->client_opaque_prf_input);
3314         if (s->s3->server_opaque_prf_input != NULL)
3315                 OPENSSL_free(s->s3->server_opaque_prf_input);
3316 #endif
3317
3318         ssl3_cleanup_key_block(s);
3319         if (s->s3->rbuf.buf != NULL)
3320                 ssl3_release_read_buffer(s);
3321         if (s->s3->wbuf.buf != NULL)
3322                 ssl3_release_write_buffer(s);
3323         if (s->s3->rrec.comp != NULL)
3324                 OPENSSL_free(s->s3->rrec.comp);
3325 #ifndef OPENSSL_NO_DH
3326         if (s->s3->tmp.dh != NULL)
3327                 DH_free(s->s3->tmp.dh);
3328 #endif
3329 #ifndef OPENSSL_NO_ECDH
3330         if (s->s3->tmp.ecdh != NULL)
3331                 EC_KEY_free(s->s3->tmp.ecdh);
3332 #endif
3333
3334         if (s->s3->tmp.ca_names != NULL)
3335                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
3336         if (s->s3->handshake_buffer) {
3337                 BIO_free(s->s3->handshake_buffer);
3338         }
3339         if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
3340 #ifndef OPENSSL_NO_TLSEXT
3341         if (s->s3->alpn_selected)
3342                 OPENSSL_free(s->s3->alpn_selected);
3343 #endif
3344
3345 #ifndef OPENSSL_NO_SRP
3346         SSL_SRP_CTX_free(s);
3347 #endif
3348         OPENSSL_cleanse(s->s3,sizeof *s->s3);
3349         OPENSSL_free(s->s3);
3350         s->s3=NULL;
3351         }
3352
3353 void ssl3_clear(SSL *s)
3354         {
3355         unsigned char *rp,*wp;
3356         size_t rlen, wlen;
3357         int init_extra;
3358
3359 #ifdef TLSEXT_TYPE_opaque_prf_input
3360         if (s->s3->client_opaque_prf_input != NULL)
3361                 OPENSSL_free(s->s3->client_opaque_prf_input);
3362         s->s3->client_opaque_prf_input = NULL;
3363         if (s->s3->server_opaque_prf_input != NULL)
3364                 OPENSSL_free(s->s3->server_opaque_prf_input);
3365         s->s3->server_opaque_prf_input = NULL;
3366 #endif
3367
3368         ssl3_cleanup_key_block(s);
3369         if (s->s3->tmp.ca_names != NULL)
3370                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
3371
3372         if (s->s3->rrec.comp != NULL)
3373                 {
3374                 OPENSSL_free(s->s3->rrec.comp);
3375                 s->s3->rrec.comp=NULL;
3376                 }
3377 #ifndef OPENSSL_NO_DH
3378         if (s->s3->tmp.dh != NULL)
3379                 {
3380                 DH_free(s->s3->tmp.dh);
3381                 s->s3->tmp.dh = NULL;
3382                 }
3383 #endif
3384 #ifndef OPENSSL_NO_ECDH
3385         if (s->s3->tmp.ecdh != NULL)
3386                 {
3387                 EC_KEY_free(s->s3->tmp.ecdh);
3388                 s->s3->tmp.ecdh = NULL;
3389                 }
3390 #endif
3391 #ifndef OPENSSL_NO_TLSEXT
3392 #ifndef OPENSSL_NO_EC
3393         s->s3->is_probably_safari = 0;
3394 #endif /* !OPENSSL_NO_EC */
3395 #endif /* !OPENSSL_NO_TLSEXT */
3396
3397         rp = s->s3->rbuf.buf;
3398         wp = s->s3->wbuf.buf;
3399         rlen = s->s3->rbuf.len;
3400         wlen = s->s3->wbuf.len;
3401         init_extra = s->s3->init_extra;
3402         if (s->s3->handshake_buffer) {
3403                 BIO_free(s->s3->handshake_buffer);
3404                 s->s3->handshake_buffer = NULL;
3405         }
3406         if (s->s3->handshake_dgst) {
3407                 ssl3_free_digest_list(s);
3408         }       
3409
3410 #if !defined(OPENSSL_NO_TLSEXT)
3411         if (s->s3->alpn_selected)
3412                 {
3413                 free(s->s3->alpn_selected);
3414                 s->s3->alpn_selected = NULL;
3415                 }
3416 #endif
3417         memset(s->s3,0,sizeof *s->s3);
3418         s->s3->rbuf.buf = rp;
3419         s->s3->wbuf.buf = wp;
3420         s->s3->rbuf.len = rlen;
3421         s->s3->wbuf.len = wlen;
3422         s->s3->init_extra = init_extra;
3423
3424         ssl_free_wbio_buffer(s);
3425
3426         s->packet_length=0;
3427         s->s3->renegotiate=0;
3428         s->s3->total_renegotiations=0;
3429         s->s3->num_renegotiations=0;
3430         s->s3->in_read_app_data=0;
3431         s->version=SSL3_VERSION;
3432
3433 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
3434         if (s->next_proto_negotiated)
3435                 {
3436                 OPENSSL_free(s->next_proto_negotiated);
3437                 s->next_proto_negotiated = NULL;
3438                 s->next_proto_negotiated_len = 0;
3439                 }
3440 #endif
3441         }
3442
3443 #ifndef OPENSSL_NO_SRP
3444 static char * srp_password_from_info_cb(SSL *s, void *arg)
3445         {
3446         return BUF_strdup(s->srp_ctx.info) ;
3447         }
3448 #endif
3449
3450 static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len);
3451
3452 long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
3453         {
3454         int ret=0;
3455
3456 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
3457         if (
3458 #ifndef OPENSSL_NO_RSA
3459             cmd == SSL_CTRL_SET_TMP_RSA ||
3460             cmd == SSL_CTRL_SET_TMP_RSA_CB ||
3461 #endif
3462 #ifndef OPENSSL_NO_DSA
3463             cmd == SSL_CTRL_SET_TMP_DH ||
3464             cmd == SSL_CTRL_SET_TMP_DH_CB ||
3465 #endif
3466                 0)
3467                 {
3468                 if (!ssl_cert_inst(&s->cert))
3469                         {
3470                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
3471                         return(0);
3472                         }
3473                 }
3474 #endif
3475
3476         switch (cmd)
3477                 {
3478         case SSL_CTRL_GET_SESSION_REUSED:
3479                 ret=s->hit;
3480                 break;
3481         case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
3482                 break;
3483         case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
3484                 ret=s->s3->num_renegotiations;
3485                 break;
3486         case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
3487                 ret=s->s3->num_renegotiations;
3488                 s->s3->num_renegotiations=0;
3489                 break;
3490         case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
3491                 ret=s->s3->total_renegotiations;
3492                 break;
3493         case SSL_CTRL_GET_FLAGS:
3494                 ret=(int)(s->s3->flags);
3495                 break;
3496 #ifndef OPENSSL_NO_RSA
3497         case SSL_CTRL_NEED_TMP_RSA:
3498                 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) &&
3499                     ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
3500                      (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))))
3501                         ret = 1;
3502                 break;
3503         case SSL_CTRL_SET_TMP_RSA:
3504                 {
3505                         RSA *rsa = (RSA *)parg;
3506                         if (rsa == NULL)
3507                                 {
3508                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
3509                                 return(ret);
3510                                 }
3511                         if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
3512                                 {
3513                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB);
3514                                 return(ret);
3515                                 }
3516                         if (s->cert->rsa_tmp != NULL)
3517                                 RSA_free(s->cert->rsa_tmp);
3518                         s->cert->rsa_tmp = rsa;
3519                         ret = 1;
3520                 }
3521                 break;
3522         case SSL_CTRL_SET_TMP_RSA_CB:
3523                 {
3524                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3525                 return(ret);
3526                 }
3527                 break;
3528 #endif
3529 #ifndef OPENSSL_NO_DH
3530         case SSL_CTRL_SET_TMP_DH:
3531                 {
3532                         DH *dh = (DH *)parg;
3533                         if (dh == NULL)
3534                                 {
3535                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
3536                                 return(ret);
3537                                 }
3538                         if (!ssl_security(s, SSL_SECOP_TMP_DH,
3539                                                 DH_security_bits(dh), 0, dh))
3540                                 {
3541                                 SSLerr(SSL_F_SSL3_CTRL, SSL_R_DH_KEY_TOO_SMALL);
3542                                 return(ret);
3543                                 }
3544                         if ((dh = DHparams_dup(dh)) == NULL)
3545                                 {
3546                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
3547                                 return(ret);
3548                                 }
3549                         if (!(s->options & SSL_OP_SINGLE_DH_USE))
3550                                 {
3551                                 if (!DH_generate_key(dh))
3552                                         {
3553                                         DH_free(dh);
3554                                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
3555                                         return(ret);
3556                                         }
3557                                 }
3558                         if (s->cert->dh_tmp != NULL)
3559                                 DH_free(s->cert->dh_tmp);
3560                         s->cert->dh_tmp = dh;
3561                         ret = 1;
3562                 }
3563                 break;
3564         case SSL_CTRL_SET_TMP_DH_CB:
3565                 {
3566                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3567                 return(ret);
3568                 }
3569                 break;
3570         case SSL_CTRL_SET_DH_AUTO:
3571                 s->cert->dh_tmp_auto = larg;
3572                 return 1;
3573 #endif
3574 #ifndef OPENSSL_NO_ECDH
3575         case SSL_CTRL_SET_TMP_ECDH:
3576                 {
3577                 EC_KEY *ecdh = NULL;
3578                         
3579                 if (parg == NULL)
3580                         {
3581                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
3582                         return(ret);
3583                         }
3584                 if (!EC_KEY_up_ref((EC_KEY *)parg))
3585                         {
3586                         SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
3587                         return(ret);
3588                         }
3589                 ecdh = (EC_KEY *)parg;
3590                 if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
3591                         {
3592                         if (!EC_KEY_generate_key(ecdh))
3593                                 {
3594                                 EC_KEY_free(ecdh);
3595                                 SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
3596                                 return(ret);
3597                                 }
3598                         }
3599                 if (s->cert->ecdh_tmp != NULL)
3600                         EC_KEY_free(s->cert->ecdh_tmp);
3601                 s->cert->ecdh_tmp = ecdh;
3602                 ret = 1;
3603                 }
3604                 break;
3605         case SSL_CTRL_SET_TMP_ECDH_CB:
3606                 {
3607                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3608                 return(ret);
3609                 }
3610                 break;
3611 #endif /* !OPENSSL_NO_ECDH */
3612 #ifndef OPENSSL_NO_TLSEXT
3613         case SSL_CTRL_SET_TLSEXT_HOSTNAME:
3614                 if (larg == TLSEXT_NAMETYPE_host_name)
3615                         {
3616                         if (s->tlsext_hostname != NULL) 
3617                                 OPENSSL_free(s->tlsext_hostname);
3618                         s->tlsext_hostname = NULL;
3619
3620                         ret = 1;
3621                         if (parg == NULL) 
3622                                 break;
3623                         if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
3624                                 {
3625                                 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
3626                                 return 0;
3627                                 }
3628                         if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
3629                                 {
3630                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
3631                                 return 0;
3632                                 }
3633                         }
3634                 else
3635                         {
3636                         SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
3637                         return 0;
3638                         }
3639                 break;
3640         case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
3641                 s->tlsext_debug_arg=parg;
3642                 ret = 1;
3643                 break;
3644
3645 #ifdef TLSEXT_TYPE_opaque_prf_input
3646         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT:
3647                 if (larg > 12288) /* actual internal limit is 2^16 for the complete hello message
3648                                    * (including the cert chain and everything) */
3649                         {
3650                         SSLerr(SSL_F_SSL3_CTRL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG);
3651                         break;
3652                         }
3653                 if (s->tlsext_opaque_prf_input != NULL)
3654                         OPENSSL_free(s->tlsext_opaque_prf_input);
3655                 if ((size_t)larg == 0)
3656                         s->tlsext_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
3657                 else
3658                         s->tlsext_opaque_prf_input = BUF_memdup(parg, (size_t)larg);
3659                 if (s->tlsext_opaque_prf_input != NULL)
3660                         {
3661                         s->tlsext_opaque_prf_input_len = (size_t)larg;
3662                         ret = 1;
3663                         }
3664                 else
3665                         s->tlsext_opaque_prf_input_len = 0;
3666                 break;
3667 #endif
3668
3669         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
3670                 s->tlsext_status_type=larg;
3671                 ret = 1;
3672                 break;
3673
3674         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
3675                 *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts;
3676                 ret = 1;
3677                 break;
3678
3679         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
3680                 s->tlsext_ocsp_exts = parg;
3681                 ret = 1;
3682                 break;
3683
3684         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
3685                 *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids;
3686                 ret = 1;
3687                 break;
3688
3689         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
3690                 s->tlsext_ocsp_ids = parg;
3691                 ret = 1;
3692                 break;
3693
3694         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
3695                 *(unsigned char **)parg = s->tlsext_ocsp_resp;
3696                 return s->tlsext_ocsp_resplen;
3697                 
3698         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
3699                 if (s->tlsext_ocsp_resp)
3700                         OPENSSL_free(s->tlsext_ocsp_resp);
3701                 s->tlsext_ocsp_resp = parg;
3702                 s->tlsext_ocsp_resplen = larg;
3703                 ret = 1;
3704                 break;
3705
3706 #ifndef OPENSSL_NO_HEARTBEATS
3707         case SSL_CTRL_TLS_EXT_SEND_HEARTBEAT:
3708                 if (SSL_IS_DTLS(s))
3709                         ret = dtls1_heartbeat(s);
3710                 else
3711                         ret = tls1_heartbeat(s);
3712                 break;
3713
3714         case SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING:
3715                 ret = s->tlsext_hb_pending;
3716                 break;
3717
3718         case SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS:
3719                 if (larg)
3720                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_RECV_REQUESTS;
3721                 else
3722                         s->tlsext_heartbeat &= ~SSL_TLSEXT_HB_DONT_RECV_REQUESTS;
3723                 ret = 1;
3724                 break;
3725 #endif
3726
3727 #endif /* !OPENSSL_NO_TLSEXT */
3728
3729         case SSL_CTRL_CHAIN:
3730                 if (larg)
3731                         return ssl_cert_set1_chain(s, NULL,
3732                                                 (STACK_OF (X509) *)parg);
3733                 else
3734                         return ssl_cert_set0_chain(s, NULL,
3735                                                 (STACK_OF (X509) *)parg);
3736
3737         case SSL_CTRL_CHAIN_CERT:
3738                 if (larg)
3739                         return ssl_cert_add1_chain_cert(s, NULL, (X509 *)parg);
3740                 else
3741                         return ssl_cert_add0_chain_cert(s, NULL, (X509 *)parg);
3742
3743         case SSL_CTRL_GET_CHAIN_CERTS:
3744                 *(STACK_OF(X509) **)parg = s->cert->key->chain;
3745                 break;
3746
3747         case SSL_CTRL_SELECT_CURRENT_CERT:
3748                 return ssl_cert_select_current(s->cert, (X509 *)parg);
3749
3750         case SSL_CTRL_SET_CURRENT_CERT:
3751                 if (larg == SSL_CERT_SET_SERVER)
3752                         {
3753                         CERT_PKEY *cpk;
3754                         const SSL_CIPHER *cipher;
3755                         if (!s->server)
3756                                 return 0;
3757                         cipher = s->s3->tmp.new_cipher;
3758                         if (!cipher)
3759                                 return 0;
3760                         /* No certificate for unauthenticated ciphersuites
3761                          * or using SRP authentication
3762                          */
3763                         if (cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP))
3764                                 return 2;
3765                         cpk = ssl_get_server_send_pkey(s);
3766                         if (!cpk)
3767                                 return 0;
3768                         s->cert->key = cpk;
3769                         return 1;
3770                         }
3771                 return ssl_cert_set_current(s->cert, larg);
3772
3773 #ifndef OPENSSL_NO_EC
3774         case SSL_CTRL_GET_CURVES:
3775                 {
3776                 unsigned char *clist;
3777                 size_t clistlen;
3778                 if (!s->session)
3779                         return 0;
3780                 clist = s->session->tlsext_ellipticcurvelist;
3781                 clistlen = s->session->tlsext_ellipticcurvelist_length / 2;
3782                 if (parg)
3783                         {
3784                         size_t i;
3785                         int *cptr = parg;
3786                         unsigned int cid, nid;
3787                         for (i = 0; i < clistlen; i++)
3788                                 {
3789                                 n2s(clist, cid);
3790                                 nid = tls1_ec_curve_id2nid(cid);
3791                                 if (nid != 0)
3792                                         cptr[i] = nid;
3793                                 else
3794                                         cptr[i] = TLSEXT_nid_unknown | cid;
3795                                 }
3796                         }
3797                 return (int)clistlen;
3798                 }
3799
3800         case SSL_CTRL_SET_CURVES:
3801                 return tls1_set_curves(&s->tlsext_ellipticcurvelist,
3802                                         &s->tlsext_ellipticcurvelist_length,
3803                                                                 parg, larg);
3804
3805         case SSL_CTRL_SET_CURVES_LIST:
3806                 return tls1_set_curves_list(&s->tlsext_ellipticcurvelist,
3807                                         &s->tlsext_ellipticcurvelist_length,
3808                                                                 parg);
3809
3810         case SSL_CTRL_GET_SHARED_CURVE:
3811                 return tls1_shared_curve(s, larg);
3812
3813 #ifndef OPENSSL_NO_ECDH
3814         case SSL_CTRL_SET_ECDH_AUTO:
3815                 s->cert->ecdh_tmp_auto = larg;
3816                 return 1;
3817 #endif
3818 #endif
3819         case SSL_CTRL_SET_SIGALGS:
3820                 return tls1_set_sigalgs(s->cert, parg, larg, 0);
3821
3822         case SSL_CTRL_SET_SIGALGS_LIST:
3823                 return tls1_set_sigalgs_list(s->cert, parg, 0);
3824
3825         case SSL_CTRL_SET_CLIENT_SIGALGS:
3826                 return tls1_set_sigalgs(s->cert, parg, larg, 1);
3827
3828         case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
3829                 return tls1_set_sigalgs_list(s->cert, parg, 1);
3830
3831         case SSL_CTRL_GET_CLIENT_CERT_TYPES:
3832                 {
3833                 const unsigned char **pctype = parg;
3834                 if (s->server || !s->s3->tmp.cert_req)
3835                         return 0;
3836                 if (s->cert->ctypes)
3837                         {
3838                         if (pctype)
3839                                 *pctype = s->cert->ctypes;
3840                         return (int)s->cert->ctype_num;
3841                         }
3842                 if (pctype)
3843                         *pctype = (unsigned char *)s->s3->tmp.ctype;
3844                 return s->s3->tmp.ctype_num;
3845                 }
3846
3847         case SSL_CTRL_SET_CLIENT_CERT_TYPES:
3848                 if (!s->server)
3849                         return 0;
3850                 return ssl3_set_req_cert_type(s->cert, parg, larg);
3851
3852         case SSL_CTRL_BUILD_CERT_CHAIN:
3853                 return ssl_build_cert_chain(s, NULL, larg);
3854
3855         case SSL_CTRL_SET_VERIFY_CERT_STORE:
3856                 return ssl_cert_set_cert_store(s->cert, parg, 0, larg);
3857
3858         case SSL_CTRL_SET_CHAIN_CERT_STORE:
3859                 return ssl_cert_set_cert_store(s->cert, parg, 1, larg);
3860
3861         case SSL_CTRL_GET_PEER_SIGNATURE_NID:
3862                 if (SSL_USE_SIGALGS(s))
3863                         {
3864                         if (s->session && s->session->sess_cert)
3865                                 {
3866                                 const EVP_MD *sig;
3867                                 sig = s->session->sess_cert->peer_key->digest;
3868                                 if (sig)
3869                                         {
3870                                         *(int *)parg = EVP_MD_type(sig);
3871                                         return 1;
3872                                         }
3873                                 }
3874                         return 0;
3875                         }
3876                 /* Might want to do something here for other versions */
3877                 else
3878                         return 0;
3879
3880         case SSL_CTRL_GET_SERVER_TMP_KEY:
3881                 if (s->server || !s->session || !s->session->sess_cert)
3882                         return 0;
3883                 else
3884                         {
3885                         SESS_CERT *sc;
3886                         EVP_PKEY *ptmp;
3887                         int rv = 0;
3888                         sc = s->session->sess_cert;
3889 #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_ECDH)
3890                         if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp
3891                                                         && !sc->peer_ecdh_tmp)
3892                                 return 0;
3893 #endif
3894                         ptmp = EVP_PKEY_new();
3895                         if (!ptmp)
3896                                 return 0;
3897                         if (0);
3898 #ifndef OPENSSL_NO_RSA
3899                         else if (sc->peer_rsa_tmp)
3900                                 rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
3901 #endif
3902 #ifndef OPENSSL_NO_DH
3903                         else if (sc->peer_dh_tmp)
3904                                 rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
3905 #endif
3906 #ifndef OPENSSL_NO_ECDH
3907                         else if (sc->peer_ecdh_tmp)
3908                                 rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
3909 #endif
3910                         if (rv)
3911                                 {
3912                                 *(EVP_PKEY **)parg = ptmp;
3913                                 return 1;
3914                                 }
3915                         EVP_PKEY_free(ptmp);
3916                         return 0;
3917                         }
3918 #ifndef OPENSSL_NO_EC
3919         case SSL_CTRL_GET_EC_POINT_FORMATS:
3920                 {
3921                 SSL_SESSION *sess = s->session;
3922                 const unsigned char **pformat = parg;
3923                 if (!sess || !sess->tlsext_ecpointformatlist)
3924                         return 0;
3925                 *pformat = sess->tlsext_ecpointformatlist;
3926                 return (int)sess->tlsext_ecpointformatlist_length;
3927                 }
3928 #endif
3929
3930         case SSL_CTRL_CHECK_PROTO_VERSION:
3931                 /* For library-internal use; checks that the current protocol
3932                  * is the highest enabled version (according to s->ctx->method,
3933                  * as version negotiation may have changed s->method). */
3934                 if (s->version == s->ctx->method->version)
3935                         return 1;
3936                 /* Apparently we're using a version-flexible SSL_METHOD
3937                  * (not at its highest protocol version). */
3938                 if (s->ctx->method->version == SSLv23_method()->version)
3939                         {
3940 #if TLS_MAX_VERSION != TLS1_2_VERSION
3941 #  error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION.
3942 #endif
3943                         if (!(s->options & SSL_OP_NO_TLSv1_2))
3944                                 return s->version == TLS1_2_VERSION;
3945                         if (!(s->options & SSL_OP_NO_TLSv1_1))
3946                                 return s->version == TLS1_1_VERSION;
3947                         if (!(s->options & SSL_OP_NO_TLSv1))
3948                                 return s->version == TLS1_VERSION;
3949                         if (!(s->options & SSL_OP_NO_SSLv3))
3950                                 return s->version == SSL3_VERSION;
3951                         }
3952                 return 0; /* Unexpected state; fail closed. */
3953
3954         default:
3955                 break;
3956                 }
3957         return(ret);
3958         }
3959
3960 long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
3961         {
3962         int ret=0;
3963
3964 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
3965         if (
3966 #ifndef OPENSSL_NO_RSA
3967             cmd == SSL_CTRL_SET_TMP_RSA_CB ||
3968 #endif
3969 #ifndef OPENSSL_NO_DSA
3970             cmd == SSL_CTRL_SET_TMP_DH_CB ||
3971 #endif
3972                 0)
3973                 {
3974                 if (!ssl_cert_inst(&s->cert))
3975                         {
3976                         SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE);
3977                         return(0);
3978                         }
3979                 }
3980 #endif
3981
3982         switch (cmd)
3983                 {
3984 #ifndef OPENSSL_NO_RSA
3985         case SSL_CTRL_SET_TMP_RSA_CB:
3986                 {
3987                 s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
3988                 }
3989                 break;
3990 #endif
3991 #ifndef OPENSSL_NO_DH
3992         case SSL_CTRL_SET_TMP_DH_CB:
3993                 {
3994                 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
3995                 }
3996                 break;
3997 #endif
3998 #ifndef OPENSSL_NO_ECDH
3999         case SSL_CTRL_SET_TMP_ECDH_CB:
4000                 {
4001                 s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
4002                 }
4003                 break;
4004 #endif
4005 #ifndef OPENSSL_NO_TLSEXT
4006         case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
4007                 s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
4008                                         unsigned char *, int, void *))fp;
4009                 break;
4010 #endif
4011         case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
4012                 {
4013                 s->not_resumable_session_cb = (int (*)(SSL *, int))fp;
4014                 }
4015                 break;
4016         default:
4017                 break;
4018                 }
4019         return(ret);
4020         }
4021
4022 long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
4023         {
4024         CERT *cert;
4025
4026         cert=ctx->cert;
4027
4028         switch (cmd)
4029                 {
4030 #ifndef OPENSSL_NO_RSA
4031         case SSL_CTRL_NEED_TMP_RSA:
4032                 if (    (cert->rsa_tmp == NULL) &&
4033                         ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
4034                          (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))
4035                         )
4036                         return(1);
4037                 else
4038                         return(0);
4039                 /* break; */
4040         case SSL_CTRL_SET_TMP_RSA:
4041                 {
4042                 RSA *rsa;
4043                 int i;
4044
4045                 rsa=(RSA *)parg;
4046                 i=1;
4047                 if (rsa == NULL)
4048                         i=0;
4049                 else
4050                         {
4051                         if ((rsa=RSAPrivateKey_dup(rsa)) == NULL)
4052                                 i=0;
4053                         }
4054                 if (!i)
4055                         {
4056                         SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB);
4057                         return(0);
4058                         }
4059                 else
4060                         {
4061                         if (cert->rsa_tmp != NULL)
4062                                 RSA_free(cert->rsa_tmp);
4063                         cert->rsa_tmp=rsa;
4064                         return(1);
4065                         }
4066                 }
4067                 /* break; */
4068         case SSL_CTRL_SET_TMP_RSA_CB:
4069                 {
4070                 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
4071                 return(0);
4072                 }
4073                 break;
4074 #endif
4075 #ifndef OPENSSL_NO_DH
4076         case SSL_CTRL_SET_TMP_DH:
4077                 {
4078                 DH *new=NULL,*dh;
4079
4080                 dh=(DH *)parg;
4081                 if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH,
4082                                                 DH_security_bits(dh), 0, dh))
4083                         {
4084                         SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_DH_KEY_TOO_SMALL);
4085                         return 0;
4086                         }
4087                 if ((new=DHparams_dup(dh)) == NULL)
4088                         {
4089                         SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
4090                         return 0;
4091                         }
4092                 if (!(ctx->options & SSL_OP_SINGLE_DH_USE))
4093                         {
4094                         if (!DH_generate_key(new))
4095                                 {
4096                                 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
4097                                 DH_free(new);
4098                                 return 0;
4099                                 }
4100                         }
4101                 if (cert->dh_tmp != NULL)
4102                         DH_free(cert->dh_tmp);
4103                 cert->dh_tmp=new;
4104                 return 1;
4105                 }
4106                 /*break; */
4107         case SSL_CTRL_SET_TMP_DH_CB:
4108                 {
4109                 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
4110                 return(0);
4111                 }
4112                 break;
4113         case SSL_CTRL_SET_DH_AUTO:
4114                 ctx->cert->dh_tmp_auto = larg;
4115                 return 1;
4116 #endif
4117 #ifndef OPENSSL_NO_ECDH
4118         case SSL_CTRL_SET_TMP_ECDH:
4119                 {
4120                 EC_KEY *ecdh = NULL;
4121                         
4122                 if (parg == NULL)
4123                         {
4124                         SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
4125                         return 0;
4126                         }
4127                 ecdh = EC_KEY_dup((EC_KEY *)parg);
4128                 if (ecdh == NULL)
4129                         {
4130                         SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB);
4131                         return 0;
4132                         }
4133                 if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
4134                         {
4135                         if (!EC_KEY_generate_key(ecdh))
4136                                 {
4137                                 EC_KEY_free(ecdh);
4138                                 SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
4139                                 return 0;
4140                                 }
4141                         }
4142
4143                 if (cert->ecdh_tmp != NULL)
4144                         {
4145                         EC_KEY_free(cert->ecdh_tmp);
4146                         }
4147                 cert->ecdh_tmp = ecdh;
4148                 return 1;
4149                 }
4150                 /* break; */
4151         case SSL_CTRL_SET_TMP_ECDH_CB:
4152                 {
4153                 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
4154                 return(0);
4155                 }
4156                 break;
4157 #endif /* !OPENSSL_NO_ECDH */
4158 #ifndef OPENSSL_NO_TLSEXT
4159         case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
4160                 ctx->tlsext_servername_arg=parg;
4161                 break;
4162         case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
4163         case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
4164                 {
4165                 unsigned char *keys = parg;
4166                 if (!keys)
4167                         return 48;
4168                 if (larg != 48)
4169                         {
4170                         SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
4171                         return 0;
4172                         }
4173                 if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
4174                         {
4175                         memcpy(ctx->tlsext_tick_key_name, keys, 16);
4176                         memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
4177                         memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
4178                         }
4179                 else
4180                         {
4181                         memcpy(keys, ctx->tlsext_tick_key_name, 16);
4182                         memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
4183                         memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
4184                         }
4185                 return 1;
4186                 }
4187
4188 #ifdef TLSEXT_TYPE_opaque_prf_input
4189         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG:
4190                 ctx->tlsext_opaque_prf_input_callback_arg = parg;
4191                 return 1;
4192 #endif
4193
4194         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
4195                 ctx->tlsext_status_arg=parg;
4196                 return 1;
4197                 break;
4198
4199 #ifndef OPENSSL_NO_SRP
4200         case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME:
4201                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
4202                 if (ctx->srp_ctx.login != NULL)
4203                         OPENSSL_free(ctx->srp_ctx.login);
4204                 ctx->srp_ctx.login = NULL;
4205                 if (parg == NULL)
4206                         break;
4207                 if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1)
4208                         {
4209                         SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);
4210                         return 0;
4211                         } 
4212                 if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL)
4213                         {
4214                         SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);
4215                         return 0;
4216                         }
4217                 break;
4218         case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:
4219                 ctx->srp_ctx.SRP_give_srp_client_pwd_callback=srp_password_from_info_cb;
4220                 ctx->srp_ctx.info=parg;
4221                 break;
4222         case SSL_CTRL_SET_SRP_ARG:
4223                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
4224                 ctx->srp_ctx.SRP_cb_arg=parg;
4225                 break;
4226
4227         case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:
4228                 ctx->srp_ctx.strength=larg;
4229                 break;
4230 #endif
4231
4232 #ifndef OPENSSL_NO_EC
4233         case SSL_CTRL_SET_CURVES:
4234                 return tls1_set_curves(&ctx->tlsext_ellipticcurvelist,
4235                                         &ctx->tlsext_ellipticcurvelist_length,
4236                                                                 parg, larg);
4237
4238         case SSL_CTRL_SET_CURVES_LIST:
4239                 return tls1_set_curves_list(&ctx->tlsext_ellipticcurvelist,
4240                                         &ctx->tlsext_ellipticcurvelist_length,
4241                                                                 parg);
4242 #ifndef OPENSSL_NO_ECDH
4243         case SSL_CTRL_SET_ECDH_AUTO:
4244                 ctx->cert->ecdh_tmp_auto = larg;
4245                 return 1;
4246 #endif
4247 #endif
4248         case SSL_CTRL_SET_SIGALGS:
4249                 return tls1_set_sigalgs(ctx->cert, parg, larg, 0);
4250
4251         case SSL_CTRL_SET_SIGALGS_LIST:
4252                 return tls1_set_sigalgs_list(ctx->cert, parg, 0);
4253
4254         case SSL_CTRL_SET_CLIENT_SIGALGS:
4255                 return tls1_set_sigalgs(ctx->cert, parg, larg, 1);
4256
4257         case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
4258                 return tls1_set_sigalgs_list(ctx->cert, parg, 1);
4259
4260         case SSL_CTRL_SET_CLIENT_CERT_TYPES:
4261                 return ssl3_set_req_cert_type(ctx->cert, parg, larg);
4262
4263         case SSL_CTRL_BUILD_CERT_CHAIN:
4264                 return ssl_build_cert_chain(NULL, ctx, larg);
4265
4266         case SSL_CTRL_SET_VERIFY_CERT_STORE:
4267                 return ssl_cert_set_cert_store(ctx->cert, parg, 0, larg);
4268
4269         case SSL_CTRL_SET_CHAIN_CERT_STORE:
4270                 return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg);
4271
4272 #endif /* !OPENSSL_NO_TLSEXT */
4273
4274         /* A Thawte special :-) */
4275         case SSL_CTRL_EXTRA_CHAIN_CERT:
4276                 if (ctx->extra_certs == NULL)
4277                         {
4278                         if ((ctx->extra_certs=sk_X509_new_null()) == NULL)
4279                                 return(0);
4280                         }
4281                 sk_X509_push(ctx->extra_certs,(X509 *)parg);
4282                 break;
4283
4284         case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
4285                 if (ctx->extra_certs == NULL && larg == 0)
4286                         *(STACK_OF(X509) **)parg =  ctx->cert->key->chain;
4287                 else
4288                         *(STACK_OF(X509) **)parg =  ctx->extra_certs;
4289                 break;
4290
4291         case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
4292                 if (ctx->extra_certs)
4293                         {
4294                         sk_X509_pop_free(ctx->extra_certs, X509_free);
4295                         ctx->extra_certs = NULL;
4296                         }
4297                 break;
4298
4299         case SSL_CTRL_CHAIN:
4300                 if (larg)
4301                         return ssl_cert_set1_chain(NULL, ctx,
4302                                                 (STACK_OF (X509) *)parg);
4303                 else
4304                         return ssl_cert_set0_chain(NULL, ctx,
4305                                                 (STACK_OF (X509) *)parg);
4306
4307         case SSL_CTRL_CHAIN_CERT:
4308                 if (larg)
4309                         return ssl_cert_add1_chain_cert(NULL, ctx, (X509 *)parg);
4310                 else
4311                         return ssl_cert_add0_chain_cert(NULL, ctx, (X509 *)parg);
4312
4313         case SSL_CTRL_GET_CHAIN_CERTS:
4314                 *(STACK_OF(X509) **)parg = ctx->cert->key->chain;
4315                 break;
4316
4317         case SSL_CTRL_SELECT_CURRENT_CERT:
4318                 return ssl_cert_select_current(ctx->cert, (X509 *)parg);
4319
4320         case SSL_CTRL_SET_CURRENT_CERT:
4321                 return ssl_cert_set_current(ctx->cert, larg);
4322
4323         default:
4324                 return(0);
4325                 }
4326         return(1);
4327         }
4328
4329 long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
4330         {
4331         CERT *cert;
4332
4333         cert=ctx->cert;
4334
4335         switch (cmd)
4336                 {
4337 #ifndef OPENSSL_NO_RSA
4338         case SSL_CTRL_SET_TMP_RSA_CB:
4339                 {
4340                 cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
4341                 }
4342                 break;
4343 #endif
4344 #ifndef OPENSSL_NO_DH
4345         case SSL_CTRL_SET_TMP_DH_CB:
4346                 {
4347                 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
4348                 }
4349                 break;
4350 #endif
4351 #ifndef OPENSSL_NO_ECDH
4352         case SSL_CTRL_SET_TMP_ECDH_CB:
4353                 {
4354                 cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
4355                 }
4356                 break;
4357 #endif
4358 #ifndef OPENSSL_NO_TLSEXT
4359         case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
4360                 ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
4361                 break;
4362
4363 #ifdef TLSEXT_TYPE_opaque_prf_input
4364         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB:
4365                 ctx->tlsext_opaque_prf_input_callback = (int (*)(SSL *,void *, size_t, void *))fp;
4366                 break;
4367 #endif
4368
4369         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
4370                 ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
4371                 break;
4372
4373         case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
4374                 ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char  *,
4375                                                 unsigned char *,
4376                                                 EVP_CIPHER_CTX *,
4377                                                 HMAC_CTX *, int))fp;
4378                 break;
4379
4380 #ifndef OPENSSL_NO_SRP
4381         case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB:
4382                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
4383                 ctx->srp_ctx.SRP_verify_param_callback=(int (*)(SSL *,void *))fp;
4384                 break;
4385         case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB:
4386                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
4387                 ctx->srp_ctx.TLS_ext_srp_username_callback=(int (*)(SSL *,int *,void *))fp;
4388                 break;
4389         case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB:
4390                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
4391                 ctx->srp_ctx.SRP_give_srp_client_pwd_callback=(char *(*)(SSL *,void *))fp;
4392                 break;
4393 #endif
4394 #endif
4395         case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
4396                 {
4397                 ctx->not_resumable_session_cb = (int (*)(SSL *, int))fp;
4398                 }
4399                 break;
4400         default:
4401                 return(0);
4402                 }
4403         return(1);
4404         }
4405
4406 /* This function needs to check if the ciphers required are actually
4407  * available */
4408 const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
4409         {
4410         SSL_CIPHER c;
4411         const SSL_CIPHER *cp;
4412         unsigned long id;
4413
4414         id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
4415         c.id=id;
4416         cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
4417 #ifdef DEBUG_PRINT_UNKNOWN_CIPHERSUITES
4418 if (cp == NULL) fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]);
4419 #endif
4420         return cp;
4421         }
4422
4423 int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
4424         {
4425         long l;
4426
4427         if (p != NULL)
4428                 {
4429                 l=c->id;
4430                 if ((l & 0xff000000) != 0x03000000) return(0);
4431                 p[0]=((unsigned char)(l>> 8L))&0xFF;
4432                 p[1]=((unsigned char)(l     ))&0xFF;
4433                 }
4434         return(2);
4435         }
4436
4437 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
4438              STACK_OF(SSL_CIPHER) *srvr)
4439         {
4440         SSL_CIPHER *c,*ret=NULL;
4441         STACK_OF(SSL_CIPHER) *prio, *allow;
4442         int i,ii,ok;
4443         CERT *cert;
4444         unsigned long alg_k,alg_a,mask_k,mask_a,emask_k,emask_a;
4445
4446         /* Let's see which ciphers we can support */
4447         cert=s->cert;
4448
4449 #if 0
4450         /* Do not set the compare functions, because this may lead to a
4451          * reordering by "id". We want to keep the original ordering.
4452          * We may pay a price in performance during sk_SSL_CIPHER_find(),
4453          * but would have to pay with the price of sk_SSL_CIPHER_dup().
4454          */
4455         sk_SSL_CIPHER_set_cmp_func(srvr, ssl_cipher_ptr_id_cmp);
4456         sk_SSL_CIPHER_set_cmp_func(clnt, ssl_cipher_ptr_id_cmp);
4457 #endif
4458
4459 #ifdef CIPHER_DEBUG
4460         fprintf(stderr, "Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), (void *)srvr);
4461         for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
4462                 {
4463                 c=sk_SSL_CIPHER_value(srvr,i);
4464                 fprintf(stderr, "%p:%s\n",(void *)c,c->name);
4465                 }
4466         fprintf(stderr, "Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), (void *)clnt);
4467         for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
4468             {
4469             c=sk_SSL_CIPHER_value(clnt,i);
4470             fprintf(stderr, "%p:%s\n",(void *)c,c->name);
4471             }
4472 #endif
4473
4474         if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || tls1_suiteb(s))
4475                 {
4476                 prio = srvr;
4477                 allow = clnt;
4478                 }
4479         else
4480                 {
4481                 prio = clnt;
4482                 allow = srvr;
4483                 }
4484
4485         tls1_set_cert_validity(s);
4486
4487         for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
4488                 {
4489                 c=sk_SSL_CIPHER_value(prio,i);
4490
4491                 /* Skip TLS v1.2 only ciphersuites if not supported */
4492                 if ((c->algorithm_ssl & SSL_TLSV1_2) && 
4493                         !SSL_USE_TLS1_2_CIPHERS(s))
4494                         continue;
4495
4496                 ssl_set_cert_masks(cert,c);
4497                 mask_k = cert->mask_k;
4498                 mask_a = cert->mask_a;
4499                 emask_k = cert->export_mask_k;
4500                 emask_a = cert->export_mask_a;
4501 #ifndef OPENSSL_NO_SRP
4502                 if (s->srp_ctx.srp_Mask & SSL_kSRP)
4503                         {
4504                         mask_k |= SSL_kSRP;
4505                         emask_k |= SSL_kSRP;
4506                         mask_a |= SSL_aSRP;
4507                         emask_a |= SSL_aSRP;
4508                         }
4509 #endif
4510                         
4511 #ifdef KSSL_DEBUG
4512 /*              fprintf(stderr,"ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/
4513 #endif    /* KSSL_DEBUG */
4514
4515                 alg_k=c->algorithm_mkey;
4516                 alg_a=c->algorithm_auth;