replace macros with functions

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 091195f79040b9f1698f6badb04fdfbb6f8f5d51..1cc3ac9cb6c4e7d17381c31d943cfb23c4c53572 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -1272,7 +1272,7 @@ char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
                c=sk_SSL_CIPHER_value(sk,i);
                for (cp=c->name; *cp; )
                        {
-                       if (len-- == 0)
+                       if (len-- <= 0)
                                {
                                *p='\0';
                                return(buf);
@@ -1707,8 +1707,8 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
        emask=0;
 
 #ifdef CIPHER_DEBUG
-       printf("rt=%d rte=%d dht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
-               rsa_tmp,rsa_tmp_export,dh_tmp,
+       printf("rt=%d rte=%d dht=%d ecdht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
+               rsa_tmp,rsa_tmp_export,dh_tmp,ecdh_tmp,
                rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa);
 #endif
 
@@ -1780,19 +1780,25 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
 #ifndef OPENSSL_NO_ECDH
                if (ecdh_ok)
                        {
-                       if ((signature_nid == NID_md5WithRSAEncryption) ||
-                           (signature_nid == NID_md4WithRSAEncryption) ||
-                           (signature_nid == NID_md2WithRSAEncryption))
+                       const char *sig = OBJ_nid2ln(signature_nid);
+                       if (sig == NULL)
                                {
-                               mask|=SSL_kECDH|SSL_aRSA;
+                               ERR_clear_error();
+                               sig = "unknown";
+                               }
+                               
+                       if (strstr(sig, "WithRSA"))
+                               {
+                               mask|=SSL_kECDHr|SSL_aECDH;
                                if (ecc_pkey_size <= 163)
-                                       emask|=SSL_kECDH|SSL_aRSA;
+                                       emask|=SSL_kECDHr|SSL_aECDH;
                                }
+
                        if (signature_nid == NID_ecdsa_with_SHA1)
                                {
-                               mask|=SSL_kECDH|SSL_aECDSA;
+                               mask|=SSL_kECDHe|SSL_aECDH;
                                if (ecc_pkey_size <= 163)
-                                       emask|=SSL_kECDH|SSL_aECDSA;
+                                       emask|=SSL_kECDHe|SSL_aECDH;
                                }
                        }
 #endif
@@ -1808,8 +1814,8 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
 #ifndef OPENSSL_NO_ECDH
        if (have_ecdh_tmp)
                {
-               mask|=SSL_kECDHE;
-               emask|=SSL_kECDHE;
+               mask|=SSL_kEECDH;
+               emask|=SSL_kEECDH;
                }
 #endif
 
@@ -1827,7 +1833,7 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
 #define ku_reject(x, usage) \
        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
 
-int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
+int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
        {
        unsigned long alg = cs->algorithms;
        EVP_PKEY *pkey = NULL;
@@ -1848,37 +1854,46 @@ int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
        X509_check_purpose(x, -1, 0);
        if ((x->sig_alg) && (x->sig_alg->algorithm))
                signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
-       if (alg & SSL_kECDH) 
+       if (alg & SSL_kECDHe || alg & SSL_kECDHr) 
                {
                /* key usage, if present, must allow key agreement */
                if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))
                        {
+                       SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT);
                        return 0;
                        }
-               if (alg & SSL_aECDSA) 
+               if (alg & SSL_kECDHe)
                        {
                        /* signature alg must be ECDSA */
                        if (signature_nid != NID_ecdsa_with_SHA1)
                                {
+                               SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
                                return 0;
                                }
                        }
-               if (alg & SSL_aRSA)
+               if (alg & SSL_kECDHr)
                        {
                        /* signature alg must be RSA */
-                       if ((signature_nid != NID_md5WithRSAEncryption) &&
-                           (signature_nid != NID_md4WithRSAEncryption) &&
-                           (signature_nid != NID_md2WithRSAEncryption))
+
+                       const char *sig = OBJ_nid2ln(signature_nid);
+                       if (sig == NULL)
                                {
+                               ERR_clear_error();
+                               sig = "unknown";
+                               }
+                       if (strstr(sig, "WithRSA") == NULL)
+                               {
+                               SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
                                return 0;
                                }
                        }
                } 
-       else if (alg & SSL_aECDSA)
+       if (alg & SSL_aECDSA)
                {
                /* key usage, if present, must allow signing */
                if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))
                        {
+                       SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
                        return 0;
                        }
                }
@@ -1902,13 +1917,13 @@ X509 *ssl_get_server_send_cert(SSL *s)
 
        if (kalg & SSL_kECDH)
                {
-               /* we don't need to look at SSL_kECDHE 
+               /* we don't need to look at SSL_kEECDH
                 * since no certificate is needed for
                 * anon ECDH and for authenticated
-                * ECDHE, the check for the auth 
+                * EECDH, the check for the auth
                 * algorithm will set i correctly
                 * NOTE: For ECDH-RSA, we need an ECC
-                * not an RSA cert but for ECDHE-RSA
+                * not an RSA cert but for EECDH-RSA
                 * we need an RSA cert. Placing the
                 * checks for SSL_kECDH before RSA
                 * checks ensures the correct cert is chosen.
@@ -2535,14 +2550,14 @@ int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
 #endif
 
 void SSL_set_info_callback(SSL *ssl,
-                          void (*cb)(const SSL *ssl,int type,int val))
+       void (*cb)(const SSL *ssl,int type,int val))
        {
        ssl->info_callback=cb;
        }
 
 /* One compiler (Diab DCC) doesn't like argument names in returned
    function pointer.  */
-void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/)
+void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/) 
        {
        return ssl->info_callback;
        }
@@ -2749,6 +2764,36 @@ const char *SSL_get_psk_identity(const SSL *s)
                return NULL;
        return(s->session->psk_identity);
        }
+
+void SSL_set_psk_client_callback(SSL *s, 
+       unsigned int (*cb)(SSL *ssl, const char *hint,
+                char *identity, unsigned int max_identity_len, unsigned char *psk,
+                unsigned int max_psk_len))
+       {
+       s->psk_client_callback = cb;    
+       }
+
+void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx,
+       unsigned int (*cb)(SSL *ssl, const char *hint,
+                char *identity, unsigned int max_identity_len, unsigned char *psk,
+                unsigned int max_psk_len))
+       {
+       ctx->psk_client_callback = cb;  
+       }
+
+void SSL_set_psk_server_callback(SSL *s, 
+       unsigned int (*cb)(SSL *ssl, const char *identity,
+                unsigned char *psk, unsigned int max_psk_len))
+       {
+       s->psk_server_callback = cb;    
+       }
+
+void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx,
+       unsigned int (*cb)(SSL *ssl, const char *identity,
+                unsigned char *psk, unsigned int max_psk_len))
+       {
+       ctx->psk_server_callback = cb;  
+       }
 #endif
 
 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))