Add support for distinct certificate chains per key type and per SSL

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index a81c80ddabd888b679c14815d6e0bb37d4142ec9..d96937915751c90ba8d8e5d5186646eff10eb1c7 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -335,7 +335,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 /* The DH ciphers */
 /* Cipher 0B */
        {
-       0,
+       1,
        SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
        SSL3_CK_DH_DSS_DES_40_CBC_SHA,
        SSL_kDHd,
@@ -351,7 +351,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0C */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
        SSL3_CK_DH_DSS_DES_64_CBC_SHA,
        SSL_kDHd,
@@ -367,7 +367,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0D */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
        SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
        SSL_kDHd,
@@ -383,7 +383,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0E */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
        SSL3_CK_DH_RSA_DES_40_CBC_SHA,
        SSL_kDHr,
@@ -399,7 +399,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0F */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
        SSL3_CK_DH_RSA_DES_64_CBC_SHA,
        SSL_kDHr,
@@ -415,7 +415,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 10 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
        SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
        SSL_kDHr,
@@ -902,7 +902,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 /* Cipher 30 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
        TLS1_CK_DH_DSS_WITH_AES_128_SHA,
        SSL_kDHd,
@@ -917,7 +917,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 /* Cipher 31 */
        {
-       0,
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
        TLS1_CK_DH_RSA_WITH_AES_128_SHA,
        SSL_kDHr,
@@ -993,7 +993,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 /* Cipher 36 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
        TLS1_CK_DH_DSS_WITH_AES_256_SHA,
        SSL_kDHd,
@@ -1009,7 +1009,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 37 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
        TLS1_CK_DH_RSA_WITH_AES_256_SHA,
        SSL_kDHr,
@@ -1122,7 +1122,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 3E */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
        SSL_kDHr,
@@ -1138,7 +1138,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 3F */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
        TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
        SSL_kDHr,
@@ -1189,7 +1189,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 42 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
        TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
        SSL_kDHd,
@@ -1205,7 +1205,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 43 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
        TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
        SSL_kDHr,
@@ -1404,7 +1404,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 68 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
        SSL_kDHr,
@@ -1420,7 +1420,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 69 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
        TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
        SSL_kDHr,
@@ -1577,7 +1577,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
        /* Cipher 85 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
        TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
        SSL_kDHd,
@@ -1593,7 +1593,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 86 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
        TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
        SSL_kDHr,
@@ -1743,7 +1743,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 97 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_SEED_SHA,
        TLS1_CK_DH_DSS_WITH_SEED_SHA,
        SSL_kDHd,
@@ -1759,7 +1759,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 98 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_SEED_SHA,
        TLS1_CK_DH_RSA_WITH_SEED_SHA,
        SSL_kDHr,
@@ -1891,7 +1891,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A0 */
        {
-       0,
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
        TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
        SSL_kDHr,
@@ -1907,7 +1907,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A1 */
        {
-       0,
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
        TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
        SSL_kDHr,
@@ -1955,7 +1955,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A4 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
        SSL_kDHr,
@@ -1971,7 +1971,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A5 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
        TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
        SSL_kDHr,
@@ -2904,6 +2904,9 @@ SSL3_ENC_METHOD SSLv3_enc_data={
        SSL3_MD_CLIENT_FINISHED_CONST,4,
        SSL3_MD_SERVER_FINISHED_CONST,4,
        ssl3_alert_code,
+       (int (*)(SSL *, unsigned char *, unsigned int, const char *,
+                unsigned int, const unsigned char *, unsigned int,
+                int use_context))ssl_undefined_function,
        };
 
 long ssl3_default_timeout(void)
@@ -3325,7 +3328,43 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                ret = 1;
                break;
 
+#ifndef OPENSSL_NO_HEARTBEATS
+       case SSL_CTRL_TLS_EXT_SEND_HEARTBEAT:
+               if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
+                       ret = dtls1_heartbeat(s);
+               else
+                       ret = tls1_heartbeat(s);
+               break;
+
+       case SSL_CTRL_GET_TLS_EXT_HEARTBEAT_PENDING:
+               ret = s->tlsext_hb_pending;
+               break;
+
+       case SSL_CTRL_SET_TLS_EXT_HEARTBEAT_NO_REQUESTS:
+               if (larg)
+                       s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_RECV_REQUESTS;
+               else
+                       s->tlsext_heartbeat &= ~SSL_TLSEXT_HB_DONT_RECV_REQUESTS;
+               ret = 1;
+               break;
+#endif
+
 #endif /* !OPENSSL_NO_TLSEXT */
+
+       case SSL_CTRL_CHAIN:
+               if (larg)
+                       return ssl_cert_set1_chain(s->cert,
+                                               (STACK_OF (X509) *)parg);
+               else
+                       return ssl_cert_set0_chain(s->cert,
+                                               (STACK_OF (X509) *)parg);
+
+       case SSL_CTRL_CHAIN_CERT:
+               if (larg)
+                       return ssl_cert_add1_chain_cert(s->cert, (X509 *)parg);
+               else
+                       return ssl_cert_add0_chain_cert(s->cert, (X509 *)parg);
+
        default:
                break;
                }
@@ -3606,6 +3645,32 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                sk_X509_push(ctx->extra_certs,(X509 *)parg);
                break;
 
+       case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
+               *(STACK_OF(X509) **)parg =  ctx->extra_certs;
+               break;
+
+       case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
+               if (ctx->extra_certs)
+                       {
+                       sk_X509_pop_free(ctx->extra_certs, X509_free);
+                       ctx->extra_certs = NULL;
+                       }
+               break;
+
+       case SSL_CTRL_CHAIN:
+               if (larg)
+                       return ssl_cert_set1_chain(ctx->cert,
+                                               (STACK_OF (X509) *)parg);
+               else
+                       return ssl_cert_set0_chain(ctx->cert,
+                                               (STACK_OF (X509) *)parg);
+
+       case SSL_CTRL_CHAIN_CERT:
+               if (larg)
+                       return ssl_cert_add1_chain_cert(ctx->cert, (X509 *)parg);
+               else
+                       return ssl_cert_add0_chain_cert(ctx->cert, (X509 *)parg);
+
        default:
                return(0);
                }
@@ -3676,10 +3741,6 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
                ctx->srp_ctx.srp_Mask|=SSL_kSRP;
                ctx->srp_ctx.SRP_give_srp_client_pwd_callback=(char *(*)(SSL *,void *))fp;
                break;
-       case SSL_CTRL_SET_TLS_EXT_SRP_MISSING_CLIENT_USERNAME_CB:
-               ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-               ctx->srp_ctx.SRP_TLS_ext_missing_srp_client_username_callback=(char *(*)(SSL *,void *))fp;
-               break;
 #endif
 #endif
        case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB: