SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_eNULL,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_MD5,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_MD5,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_3DES,
SSL_SHA1,
SSL_SSLV3,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_SHA1,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
56,
},
SSL_MD5,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_MD5,
SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
40,
128,
},
SSL_AES128,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_AES128,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_AES128,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_AES128,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_AES128,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_AES128,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_AES256,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_AES256,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_AES256,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_AES256,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_AES256,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_AES256,
SSL_SHA1,
SSL_TLSV1,
- SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_MD5,
SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
128,
},
SSL_MD5,
SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_SHA1,
SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
56,
},
SSL_SHA1,
SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
56,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
#endif
+ {
+ 1,
+ "GOST94-GOST89-GOST89",
+ 0x3000080,
+ SSL_kGOST,
+ SSL_aGOST94,
+ SSL_eGOST2814789CNT,
+ SSL_GOST89MAC,
+ SSL_TLSV1,
+ SSL_NOT_EXP|SSL_HIGH,
+ SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
+ 256,
+ 256
+ },
+ {
+ 1,
+ "GOST2001-GOST89-GOST89",
+ 0x3000081,
+ SSL_kGOST,
+ SSL_aGOST01,
+ SSL_eGOST2814789CNT,
+ SSL_GOST89MAC,
+ SSL_TLSV1,
+ SSL_NOT_EXP|SSL_HIGH,
+ SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
+ 256,
+ 256
+ },
+ {
+ 1,
+ "GOST94-NULL-GOST94",
+ 0x3000082,
+ SSL_kGOST,
+ SSL_aGOST94,
+ SSL_eNULL,
+ SSL_GOST94,
+ SSL_TLSV1,
+ SSL_NOT_EXP|SSL_STRONG_NONE,
+ SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
+ 0,
+ 0
+ },
+ {
+ 1,
+ "GOST2001-NULL-GOST94",
+ 0x3000083,
+ SSL_kGOST,
+ SSL_aGOST01,
+ SSL_eNULL,
+ SSL_GOST94,
+ SSL_TLSV1,
+ SSL_NOT_EXP|SSL_STRONG_NONE,
+ SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
+ 0,
+ 0
+ },
#ifndef OPENSSL_NO_CAMELLIA
/* Camellia ciphersuites from RFC4132 (256-bit portion) */
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_STRONG_NONE,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
0,
0,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
168,
168,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
128,
128,
},
SSL_SHA1,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_MD5,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256,
},
SSL_GOST94,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256
},
SSL_GOST89MAC,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- 0,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
256,
256
},
SSL_GOST89MAC,
SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
- TLS1_STREAM_MAC,
+ SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
256,
256
},
SSL3_ENC_METHOD SSLv3_enc_data={
ssl3_enc,
- ssl3_mac,
+ n_ssl3_mac,
ssl3_setup_key_block,
ssl3_generate_master_secret,
ssl3_change_cipher_state,
return(SSL3_NUM_CIPHERS);
}
-SSL_CIPHER *ssl3_get_cipher(unsigned int u)
+const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
{
if (u < SSL3_NUM_CIPHERS)
return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
memset(s3,0,sizeof *s3);
- EVP_MD_CTX_init(&s3->finish_dgst1);
- EVP_MD_CTX_init(&s3->finish_dgst2);
memset(s3->rrec.seq_num,0,sizeof(s3->rrec.seq_num));
memset(s3->wrec.seq_num,0,sizeof(s3->wrec.seq_num));
if(s == NULL)
return;
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ if (s->s3->client_opaque_prf_input != NULL)
+ OPENSSL_free(s->s3->client_opaque_prf_input);
+ if (s->s3->server_opaque_prf_input != NULL)
+ OPENSSL_free(s->s3->server_opaque_prf_input);
+#endif
+
ssl3_cleanup_key_block(s);
if (s->s3->rbuf.buf != NULL)
- OPENSSL_free(s->s3->rbuf.buf);
+ ssl3_release_read_buffer(s);
if (s->s3->wbuf.buf != NULL)
- OPENSSL_free(s->s3->wbuf.buf);
+ ssl3_release_write_buffer(s);
if (s->s3->rrec.comp != NULL)
OPENSSL_free(s->s3->rrec.comp);
#ifndef OPENSSL_NO_DH
if (s->s3->tmp.ca_names != NULL)
sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
- EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
- EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
-
+ if (s->s3->handshake_buffer) {
+ BIO_free(s->s3->handshake_buffer);
+ }
+ if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
OPENSSL_cleanse(s->s3,sizeof *s->s3);
OPENSSL_free(s->s3);
s->s3=NULL;
unsigned char *rp,*wp;
size_t rlen, wlen;
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ if (s->s3->client_opaque_prf_input != NULL)
+ OPENSSL_free(s->s3->client_opaque_prf_input);
+ s->s3->client_opaque_prf_input = NULL;
+ if (s->s3->server_opaque_prf_input != NULL)
+ OPENSSL_free(s->s3->server_opaque_prf_input);
+ s->s3->server_opaque_prf_input = NULL;
+#endif
+
ssl3_cleanup_key_block(s);
if (s->s3->tmp.ca_names != NULL)
sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
wp = s->s3->wbuf.buf;
rlen = s->s3->rbuf.len;
wlen = s->s3->wbuf.len;
-
- EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
- EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
-
+ if (s->s3->handshake_buffer) {
+ BIO_free(s->s3->handshake_buffer);
+ s->s3->handshake_buffer = NULL;
+ }
+ if (s->s3->handshake_dgst) {
+ ssl3_free_digest_list(s);
+ }
memset(s->s3,0,sizeof *s->s3);
s->s3->rbuf.buf = rp;
s->s3->wbuf.buf = wp;
s->s3->num_renegotiations=0;
s->s3->in_read_app_data=0;
s->version=SSL3_VERSION;
+
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+ if (s->next_proto_negotiated)
+ {
+ OPENSSL_free(s->next_proto_negotiated);
+ s->next_proto_negotiated = NULL;
+ s->next_proto_negotiated_len = 0;
+ }
+#endif
}
long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
return 0;
}
- s->options |= SSL_OP_NO_SSLv2; /* can't use extension w/ SSL 2.0 format */
break;
case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
s->tlsext_debug_arg=parg;
+ ret = 1;
+ break;
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT:
+ if (larg > 12288) /* actual internal limit is 2^16 for the complete hello message
+ * (including the cert chain and everything) */
+ {
+ SSLerr(SSL_F_SSL3_CTRL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG);
+ break;
+ }
+ if (s->tlsext_opaque_prf_input != NULL)
+ OPENSSL_free(s->tlsext_opaque_prf_input);
+ if ((size_t)larg == 0)
+ s->tlsext_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
+ else
+ s->tlsext_opaque_prf_input = BUF_memdup(parg, (size_t)larg);
+ if (s->tlsext_opaque_prf_input != NULL)
+ {
+ s->tlsext_opaque_prf_input_len = (size_t)larg;
+ ret = 1;
+ }
+ else
+ s->tlsext_opaque_prf_input_len = 0;
+ break;
+#endif
+
+ case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
+ s->tlsext_status_type=larg;
+ ret = 1;
+ break;
+
+ case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
+ *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts;
+ ret = 1;
break;
+
+ case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
+ s->tlsext_ocsp_exts = parg;
+ ret = 1;
+ break;
+
+ case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
+ *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids;
+ ret = 1;
+ break;
+
+ case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
+ s->tlsext_ocsp_ids = parg;
+ ret = 1;
+ break;
+
+ case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
+ *(unsigned char **)parg = s->tlsext_ocsp_resp;
+ return s->tlsext_ocsp_resplen;
+
+ case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
+ if (s->tlsext_ocsp_resp)
+ OPENSSL_free(s->tlsext_ocsp_resp);
+ s->tlsext_ocsp_resp = parg;
+ s->tlsext_ocsp_resplen = larg;
+ ret = 1;
+ break;
+
#endif /* !OPENSSL_NO_TLSEXT */
default:
break;
unsigned char *, int, void *))fp;
break;
#endif
+ case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
+ {
+ s->not_resumable_session_cb = (int (*)(SSL *, int))fp;
+ }
+ break;
default:
break;
}
case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
ctx->tlsext_servername_arg=parg;
break;
+ case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
+ case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
+ {
+ unsigned char *keys = parg;
+ if (!keys)
+ return 48;
+ if (larg != 48)
+ {
+ SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
+ return 0;
+ }
+ if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
+ {
+ memcpy(ctx->tlsext_tick_key_name, keys, 16);
+ memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+ memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+ }
+ else
+ {
+ memcpy(keys, ctx->tlsext_tick_key_name, 16);
+ memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+ memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
+ }
+ return 1;
+ }
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG:
+ ctx->tlsext_opaque_prf_input_callback_arg = parg;
+ return 1;
+#endif
+
+ case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
+ ctx->tlsext_status_arg=parg;
+ return 1;
+ break;
+
#endif /* !OPENSSL_NO_TLSEXT */
+
/* A Thawte special :-) */
case SSL_CTRL_EXTRA_CHAIN_CERT:
if (ctx->extra_certs == NULL)
case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
break;
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB:
+ ctx->tlsext_opaque_prf_input_callback = (int (*)(SSL *,void *, size_t, void *))fp;
+ break;
#endif
+
+ case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
+ ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
+ break;
+
+ case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
+ ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char *,
+ unsigned char *,
+ EVP_CIPHER_CTX *,
+ HMAC_CTX *, int))fp;
+ break;
+
+#endif
+ case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
+ {
+ ctx->not_resumable_session_cb = (int (*)(SSL *, int))fp;
+ }
+ break;
default:
return(0);
}
/* This function needs to check if the ciphers required are actually
* available */
-SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
+const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
{
- SSL_CIPHER c,*cp;
+ SSL_CIPHER c;
+ const SSL_CIPHER *cp;
unsigned long id;
id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
c.id=id;
- cp = (SSL_CIPHER *)OBJ_bsearch((char *)&c,
- (char *)ssl3_ciphers,
- SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER),
- FP_ICC ssl_cipher_id_cmp);
+ cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
if (cp == NULL || cp->valid == 0)
return NULL;
else
SSL_CIPHER *c,*ret=NULL;
STACK_OF(SSL_CIPHER) *prio, *allow;
int i,ii,ok;
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_EC)
unsigned int j;
-#ifndef OPENSSL_NO_TLSEXT
-#ifndef OPENSSL_NO_EC
int ec_ok, ec_nid;
unsigned char ec_search1 = 0, ec_search2 = 0;
-#endif /* OPENSSL_NO_EC */
-#endif /* OPENSSL_NO_TLSEXT */
+#endif
CERT *cert;
unsigned long alg_k,alg_a,mask_k,mask_a,emask_k,emask_a;
emask_a = cert->export_mask_a;
#ifdef KSSL_DEBUG
- printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);
+/* printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/
#endif /* KSSL_DEBUG */
alg_k=c->algorithm_mkey;
alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
+#ifndef OPENSSL_NO_GOST
+ if (s->version >= TLS1_VERSION)
+ {
+ if (alg_k & SSL_kGOST)
+ {
+ p[ret++]=TLS_CT_GOST94_SIGN;
+ p[ret++]=TLS_CT_GOST01_SIGN;
+ return(ret);
+ }
+ }
+#endif
+
#ifndef OPENSSL_NO_DH
if (alg_k & (SSL_kDHr|SSL_kEDH))
{
int ssl3_shutdown(SSL *s)
{
+ int ret;
/* Don't do anything much if we have not done the handshake or
* we don't want to send messages :-) */
#endif
/* our shutdown alert has been sent now, and if it still needs
* to be written, s->s3->alert_dispatch will be true */
+ if (s->s3->alert_dispatch)
+ return(-1); /* return WANT_WRITE */
}
else if (s->s3->alert_dispatch)
{
/* resend it if not sent */
#if 1
- s->method->ssl_dispatch_alert(s);
+ ret=s->method->ssl_dispatch_alert(s);
+ if(ret == -1)
+ {
+ /* we only get to return -1 here the 2nd/Nth
+ * invocation, we must have already signalled
+ * return 0 upon a previous invoation,
+ * return WANT_WRITE */
+ return(ret);
+ }
#endif
}
else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
{
/* If we are waiting for a close from our peer, we are closed */
s->method->ssl_read_bytes(s,0,NULL,0,0);
+ if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
+ {
+ return(-1); /* return WANT_READ */
+ }
}
if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
}
return(ret);
}
-