Function tls1_check_ec_server_key is now redundant as we make

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 8ba557a919a27530769388b7508d64c44c520eec..7d109417671afe982d5393aa66186409838f7f39 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -1120,7 +1120,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
-       SSL_kDHr,
+       SSL_kDHd,
        SSL_aDH,
        SSL_AES128,
        SSL_SHA256,
@@ -1402,7 +1402,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
-       SSL_kDHr,
+       SSL_kDHd,
        SSL_aDH,
        SSL_AES256,
        SSL_SHA256,
@@ -1953,7 +1953,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
-       SSL_kDHr,
+       SSL_kDHd,
        SSL_aDH,
        SSL_AES128GCM,
        SSL_AEAD,
@@ -1969,7 +1969,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
        TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
-       SSL_kDHr,
+       SSL_kDHd,
        SSL_aDH,
        SSL_AES256GCM,
        SSL_AEAD,
@@ -2664,7 +2664,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
        TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
-       SSL_kECDHe,
+       SSL_kECDHr,
        SSL_aECDH,
        SSL_AES128,
        SSL_SHA256,
@@ -2680,7 +2680,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
        TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
-       SSL_kECDHe,
+       SSL_kECDHr,
        SSL_aECDH,
        SSL_AES256,
        SSL_SHA384,
@@ -2794,7 +2794,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
        TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-       SSL_kECDHe,
+       SSL_kECDHr,
        SSL_aECDH,
        SSL_AES128GCM,
        SSL_AEAD,
@@ -2810,7 +2810,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        1,
        TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
        TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-       SSL_kECDHe,
+       SSL_kECDHr,
        SSL_aECDH,
        SSL_AES256GCM,
        SSL_AEAD,
@@ -2988,6 +2988,10 @@ void ssl3_free(SSL *s)
        if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
 #ifndef OPENSSL_NO_SRP
        SSL_SRP_CTX_free(s);
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+       if (s->s3->tlsext_authz_client_types != NULL)
+               OPENSSL_free(s->s3->tlsext_authz_client_types);
 #endif
        OPENSSL_cleanse(s->s3,sizeof *s->s3);
        OPENSSL_free(s->s3);
@@ -3032,6 +3036,13 @@ void ssl3_clear(SSL *s)
                s->s3->tmp.ecdh = NULL;
                }
 #endif
+#ifndef OPENSSL_NO_TLSEXT
+       if (s->s3->tlsext_authz_client_types != NULL)
+               {
+               OPENSSL_free(s->s3->tlsext_authz_client_types);
+               s->s3->tlsext_authz_client_types = NULL;
+               }
+#endif
 
        rp = s->s3->rbuf.buf;
        wp = s->s3->wbuf.buf;
@@ -3403,6 +3414,12 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                s->cert->ecdh_tmp_auto = larg;
                break;
 
+       case SSL_CTRL_SET_SIGALGS:
+               return tls1_set_sigalgs(s->cert, parg, larg);
+
+       case SSL_CTRL_SET_SIGALGS_LIST:
+               return tls1_set_sigalgs_list(s->cert, parg);
+
        default:
                break;
                }
@@ -3684,6 +3701,17 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
        case SSL_CTRL_SET_ECDH_AUTO:
                ctx->cert->ecdh_tmp_auto = larg;
                break;
+
+       case SSL_CTRL_SET_SIGALGS:
+               return tls1_set_sigalgs(ctx->cert, parg, larg);
+
+       case SSL_CTRL_SET_SIGALGS_LIST:
+               return tls1_set_sigalgs_list(ctx->cert, parg);
+
+       case SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB_ARG:
+               ctx->tlsext_authz_server_audit_proof_cb_arg = parg;
+               break;
+
 #endif /* !OPENSSL_NO_TLSEXT */
 
        /* A Thawte special :-) */
@@ -3793,6 +3821,12 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
                ctx->srp_ctx.SRP_give_srp_client_pwd_callback=(char *(*)(SSL *,void *))fp;
                break;
 #endif
+
+       case SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB:
+               ctx->tlsext_authz_server_audit_proof_cb =
+                       (int (*)(SSL *, void *))fp;
+               break;
+
 #endif
        case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB:
                {
@@ -3887,6 +3921,8 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                allow = srvr;
                }
 
+       tls1_set_cert_validity(s);
+
        for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
                {
                c=sk_SSL_CIPHER_value(prio,i);
@@ -3945,10 +3981,6 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
-               /* if we are considering an ECC cipher suite that uses our
-                * certificate check it */
-               if (alg_a & (SSL_aECDSA|SSL_aECDH))
-                       ok = ok && tls1_check_ec_server_key(s);
                /* if we are considering an ECC cipher suite that uses
                 * an ephemeral EC key check it */
                if (alg_k & SSL_kEECDH)