Reorganize the data used for SSL ciphersuite pattern matching.

[openssl.git] / ssl / d1_srvr.c

diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c
index 67baf80dc2159f9fd488b29e45c2b713663af029..450524a5e91ee95ee8b9b961e3bdb7529b4aa841 100644 (file)
--- a/ssl/d1_srvr.c
+++ b/ssl/d1_srvr.c
@@ -4,7 +4,7 @@
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
  */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -148,6 +148,7 @@ int dtls1_accept(SSL *s)
        unsigned long l,Time=(unsigned long)time(NULL);
        void (*cb)(const SSL *ssl,int type,int val)=NULL;
        long num1;
+       unsigned long alg_k;
        int ret= -1;
        int new_state,state,skip=0;
 
@@ -237,11 +238,11 @@ int dtls1_accept(SSL *s)
                                s->state=SSL3_ST_SW_HELLO_REQ_A;
                                }
 
-            if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE))
-                s->d1->send_cookie = 1;
-            else
-                s->d1->send_cookie = 0;
-
+                       if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE))
+                               s->d1->send_cookie = 1;
+                       else
+                               s->d1->send_cookie = 0;
+                       
                        break;
 
                case SSL3_ST_SW_HELLO_REQ_A:
@@ -270,7 +271,7 @@ int dtls1_accept(SSL *s)
                        if (ret <= 0) goto end;
                        s->new_session = 2;
 
-                       if ( s->d1->send_cookie)
+                       if (s->d1->send_cookie)
                                s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A;
                        else
                                s->state = SSL3_ST_SW_SRVR_HELLO_A;
@@ -303,7 +304,7 @@ int dtls1_accept(SSL *s)
                case SSL3_ST_SW_CERT_A:
                case SSL3_ST_SW_CERT_B:
                        /* Check if it is anon DH */
-                       if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                       if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL))
                                {
                                ret=dtls1_send_server_certificate(s);
                                if (ret <= 0) goto end;
@@ -316,13 +317,13 @@ int dtls1_accept(SSL *s)
 
                case SSL3_ST_SW_KEY_EXCH_A:
                case SSL3_ST_SW_KEY_EXCH_B:
-                       l=s->s3->tmp.new_cipher->algorithms;
+                       alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 
                        /* clear this, it may get reset by
                         * send_server_key_exchange */
                        if ((s->options & SSL_OP_EPHEMERAL_RSA)
 #ifndef OPENSSL_NO_KRB5
-                               && !(l & SSL_KRB5)
+                               && !(alg_k & SSL_kKRB5)
 #endif /* OPENSSL_NO_KRB5 */
                                )
                                /* option SSL_OP_EPHEMERAL_RSA sends temporary RSA key
@@ -336,8 +337,8 @@ int dtls1_accept(SSL *s)
                        /* only send if a DH key exchange or
                         * RSA but we have a sign only certificate */
                        if (s->s3->tmp.use_rsa_tmp
-                           || (l & SSL_DH)
-                           || ((l & SSL_kRSA)
+                           || (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
+                           || ((alg_k & SSL_kRSA)
                                && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
                                    || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
                                        && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
@@ -367,12 +368,12 @@ int dtls1_accept(SSL *s)
                                /* never request cert in anonymous ciphersuites
                                 * (see section "Certificate request" in SSL 3 drafts
                                 * and in RFC 2246): */
-                               ((s->s3->tmp.new_cipher->algorithms & SSL_aNULL) &&
+                               ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
                                 /* ... except when the application insists on verification
                                  * (against the specs, but s3_clnt.c accepts this for SSL 3) */
                                 !(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
-                                 /* never request cert in Kerberos ciphersuites */
-                                (s->s3->tmp.new_cipher->algorithms & SSL_aKRB5))
+                                /* never request cert in Kerberos ciphersuites */
+                               (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
                                {
                                /* no cert request */
                                skip=1;
@@ -625,15 +626,15 @@ int dtls1_send_hello_verify_request(SSL *s)
                *(p++) = s->version & 0xFF;
 
                *(p++) = (unsigned char) s->d1->cookie_len;
-        if ( s->ctx->app_gen_cookie_cb != NULL &&
-            s->ctx->app_gen_cookie_cb(s, s->d1->cookie, 
-                &(s->d1->cookie_len)) == 0)
-            {
-                       SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST,ERR_R_INTERNAL_ERROR);
-            return 0;
-            }
-        /* else the cookie is assumed to have 
-         * been initialized by the application */
+       if (s->ctx->app_gen_cookie_cb != NULL &&
+           s->ctx->app_gen_cookie_cb(s, s->d1->cookie, 
+               &(s->d1->cookie_len)) == 0)
+               {
+               SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST,ERR_R_INTERNAL_ERROR);
+               return 0;
+               }
+       /* else the cookie is assumed to have 
+        * been initialized by the application */
 
                memcpy(p, s->d1->cookie, s->d1->cookie_len);
                p += s->d1->cookie_len;
@@ -784,7 +785,7 @@ int dtls1_send_server_key_exchange(SSL *s)
        EVP_MD_CTX_init(&md_ctx);
        if (s->state == SSL3_ST_SW_KEY_EXCH_A)
                {
-               type=s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK;
+               type=s->s3->tmp.new_cipher->algorithm_mkey;
                cert=s->cert;
 
                buf=s->init_buf;
@@ -889,7 +890,7 @@ int dtls1_send_server_key_exchange(SSL *s)
                        n+=2+nr[i];
                        }
 
-               if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+               if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL))
                        {
                        if ((pkey=ssl_get_sign_pkey(s,s->s3->tmp.new_cipher))
                                == NULL)
@@ -1107,14 +1108,15 @@ int dtls1_send_server_certificate(SSL *s)
        if (s->state == SSL3_ST_SW_CERT_A)
                {
                x=ssl_get_server_send_cert(s);
-               if (x == NULL &&
-                        /* VRS: allow null cert if auth == KRB5 */
-                        (s->s3->tmp.new_cipher->algorithms
-                                & (SSL_MKEY_MASK|SSL_AUTH_MASK))
-                        != (SSL_aKRB5|SSL_kKRB5))
+               if (x == NULL)
                        {
-                       SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE,ERR_R_INTERNAL_ERROR);
-                       return(0);
+                       /* VRS: allow null cert if auth == KRB5 */
+                       if ((s->s3->tmp.new_cipher->algorithm_mkey != SSL_kKRB5) ||
+                           (s->s3->tmp.new_cipher->algorithm_auth != SSL_aKRB5))
+                               {
+                               SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE,ERR_R_INTERNAL_ERROR);
+                               return(0);
+                               }
                        }
 
                l=dtls1_output_cert_chain(s,x);