New ctrl to set current certificate.

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 25b652c20a0a3f3b65302fa9590c41debb7ca83a..bb1d50810d541c1b36131e29c879ff040526c34d 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -161,11 +161,6 @@ const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
 
 #define SSL3_NUM_CIPHERS       (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
 
-/* FIXED_NONCE_LEN is a macro that results in the correct value to set the
- * fixed nonce length in SSL_CIPHER.algorithms2. It's the inverse of
- * SSL_CIPHER_AEAD_FIXED_NONCE_LEN. */
-#define FIXED_NONCE_LEN(x) ((x/2)<<24)
-
 /* list of available SSLv3 ciphers (sorted by id) */
 OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
@@ -1683,7 +1678,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_3DES,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
@@ -1699,7 +1694,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AES128,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
@@ -1715,7 +1710,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AES256,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
@@ -1836,9 +1831,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -1854,9 +1847,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -1872,9 +1863,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -1890,9 +1879,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -1908,9 +1895,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -1926,9 +1911,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -1944,9 +1927,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -1962,9 +1943,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -1980,9 +1959,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -1998,9 +1975,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -2016,9 +1991,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -2034,9 +2007,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -2749,9 +2720,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -2767,9 +2736,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -2785,9 +2752,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -2803,9 +2768,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -2821,9 +2784,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -2839,9 +2800,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -2857,9 +2816,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
        128,
        128,
        },
@@ -2875,9 +2832,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AEAD,
        SSL_TLSV1_2,
        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|
-               FIXED_NONCE_LEN(4)|
-               SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
+       SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
        256,
        256,
        },
@@ -2945,53 +2900,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 #endif
 
-#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
-       {
-       1,
-       TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-       TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305,
-       SSL_kEECDH,
-       SSL_aRSA,
-       SSL_CHACHA20POLY1305,
-       SSL_AEAD,
-       SSL_TLSV1_2,
-       SSL_NOT_EXP|SSL_HIGH,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
-       256,
-       0,
-       },
-
-       {
-       1,
-       TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-       TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305,
-       SSL_kEECDH,
-       SSL_aECDSA,
-       SSL_CHACHA20POLY1305,
-       SSL_AEAD,
-       SSL_TLSV1_2,
-       SSL_NOT_EXP|SSL_HIGH,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
-       256,
-       0,
-       },
-
-       {
-       1,
-       TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
-       TLS1_CK_DHE_RSA_CHACHA20_POLY1305,
-       SSL_kEDH,
-       SSL_aRSA,
-       SSL_CHACHA20POLY1305,
-       SSL_AEAD,
-       SSL_TLSV1_2,
-       SSL_NOT_EXP|SSL_HIGH,
-       SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
-       256,
-       0,
-       },
-#endif
-
 /* end of list */
        };
 
@@ -3523,6 +3431,16 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                else
                        return ssl_cert_add0_chain_cert(s->cert, (X509 *)parg);
 
+       case SSL_CTRL_GET_CHAIN_CERTS:
+               *(STACK_OF(X509) **)parg = s->cert->key->chain;
+               break;
+
+       case SSL_CTRL_SELECT_CURRENT_CERT:
+               return ssl_cert_select_current(s->cert, (X509 *)parg);
+
+       case SSL_CTRL_SET_CURRENT_CERT:
+               return ssl_cert_set_current(s->cert, larg);
+
 #ifndef OPENSSL_NO_EC
        case SSL_CTRL_GET_CURVES:
                {
@@ -4021,6 +3939,16 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                else
                        return ssl_cert_add0_chain_cert(ctx->cert, (X509 *)parg);
 
+       case SSL_CTRL_GET_CHAIN_CERTS:
+               *(STACK_OF(X509) **)parg = ctx->cert->key->chain;
+               break;
+
+       case SSL_CTRL_SELECT_CURRENT_CERT:
+               return ssl_cert_select_current(ctx->cert, (X509 *)parg);
+
+       case SSL_CTRL_SET_CURRENT_CERT:
+               return ssl_cert_set_current(ctx->cert, larg);
+
        default:
                return(0);
                }