Check for deselection of KRB5. In fact, skip it completely on VMS for now...

[openssl.git] / ssl / ssl_ciph.c

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index f63163f26c38cfd1964194803e67b0c51c4a04ee..a196d5e574eb15a4d2c3f47835a2829890ad9796 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -100,6 +100,7 @@ typedef struct cipher_order_st
 static const SSL_CIPHER cipher_aliases[]={
        /* Don't include eNULL unless specifically enabled */
        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+        {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
        {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
        {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
        {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
@@ -108,6 +109,7 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_DH,  0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
        {0,SSL_TXT_EDH, 0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
 
+       {0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0},  /* VRS Kerberos5 */
        {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
        {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
        {0,SSL_TXT_aFZA,0,SSL_aFZA,  0,0,0,0,SSL_AUTH_MASK,0},
@@ -128,6 +130,7 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_SHA, 0,SSL_SHA,   0,0,0,0,SSL_MAC_MASK,0},
 
        {0,SSL_TXT_NULL,0,SSL_NULL,  0,0,0,0,SSL_ENC_MASK,0},
+       {0,SSL_TXT_KRB5,0,SSL_KRB5,  0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
        {0,SSL_TXT_RSA, 0,SSL_RSA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
        {0,SSL_TXT_ADH, 0,SSL_ADH,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
        {0,SSL_TXT_FZA, 0,SSL_FZA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0},
@@ -291,6 +294,9 @@ static unsigned long ssl_cipher_get_disabled(void)
 #ifdef NO_DH
        mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
 #endif
+#ifdef NO_KRB5
+       mask |= SSL_kKRB5|SSL_aKRB5;
+#endif
 
 #ifdef SSL_FORBID_ENULL
        mask |= SSL_eNULL;
@@ -336,6 +342,9 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
                        list[list_num].prev = NULL;
                        list[list_num].active = 0;
                        list_num++;
+#ifdef KSSL_DEBUG
+                       printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms);
+#endif /* KSSL_DEBUG */
                        /*
                        if (!sk_push(ca_list,(char *)c)) goto err;
                        */
@@ -738,6 +747,9 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         * it is used for allocation.
         */
        num_of_ciphers = ssl_method->num_ciphers();
+#ifdef KSSL_DEBUG
+       printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
+#endif    /* KSSL_DEBUG */
        list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
        if (list == NULL)
                {
@@ -872,8 +884,12 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        char *ver,*exp;
        char *kx,*au,*enc,*mac;
        unsigned long alg,alg2,alg_s;
+#ifdef KSSL_DEBUG
+       static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
+#else
        static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
-       
+#endif /* KSSL_DEBUG */
+
        alg=cipher->algorithms;
        alg_s=cipher->algo_strength;
        alg2=cipher->algorithm2;
@@ -901,6 +917,10 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        case SSL_kDHd:
                kx="DH/DSS";
                break;
+        case SSL_kKRB5:         /* VRS */
+        case SSL_KRB5:          /* VRS */
+            kx="KRB5";
+            break;
        case SSL_kFZA:
                kx="Fortezza";
                break;
@@ -922,6 +942,10 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        case SSL_aDH:
                au="DH";
                break;
+        case SSL_aKRB5:         /* VRS */
+        case SSL_KRB5:          /* VRS */
+            au="KRB5";
+            break;
        case SSL_aFZA:
        case SSL_aNULL:
                au="None";
@@ -982,7 +1006,11 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        else if (len < 128)
                return("Buffer too small");
 
+#ifdef KSSL_DEBUG
+       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp,alg);
+#else
        BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp);
+#endif /* KSSL_DEBUG */
        return(buf);
        }
 
@@ -1053,6 +1081,10 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
        SSL_COMP *comp;
        STACK_OF(SSL_COMP) *sk;
 
+        if (cm == NULL || cm->type == NID_undef)
+                return 1;
+
+       MemCheck_off();
        comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
        comp->id=id;
        comp->method=cm;
@@ -1062,10 +1094,13 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
                sk=ssl_comp_methods;
        if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
                {
+               MemCheck_on();
                SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
                return(0);
                }
        else
+               {
+               MemCheck_on();
                return(1);
+               }
        }
-