SSL export fixes (from Adam Langley) [original from 1.0.1]

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 3e4a95df547a534c1acf84c6d5a7bcf7bc5dc0c6..db79a99ccd69cfaa66f5fa0f974a76650b688480 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -335,7 +335,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 /* The DH ciphers */
 /* Cipher 0B */
        {
-       0,
+       1,
        SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
        SSL3_CK_DH_DSS_DES_40_CBC_SHA,
        SSL_kDHd,
@@ -351,7 +351,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0C */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
        SSL3_CK_DH_DSS_DES_64_CBC_SHA,
        SSL_kDHd,
@@ -367,7 +367,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0D */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
        SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
        SSL_kDHd,
@@ -383,7 +383,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0E */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
        SSL3_CK_DH_RSA_DES_40_CBC_SHA,
        SSL_kDHr,
@@ -399,7 +399,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 0F */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
        SSL3_CK_DH_RSA_DES_64_CBC_SHA,
        SSL_kDHr,
@@ -415,7 +415,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 10 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
        SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
        SSL_kDHr,
@@ -902,7 +902,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 /* Cipher 30 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
        TLS1_CK_DH_DSS_WITH_AES_128_SHA,
        SSL_kDHd,
@@ -917,7 +917,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 /* Cipher 31 */
        {
-       0,
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
        TLS1_CK_DH_RSA_WITH_AES_128_SHA,
        SSL_kDHr,
@@ -993,7 +993,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
 /* Cipher 36 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
        TLS1_CK_DH_DSS_WITH_AES_256_SHA,
        SSL_kDHd,
@@ -1009,7 +1009,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* Cipher 37 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
        TLS1_CK_DH_RSA_WITH_AES_256_SHA,
        SSL_kDHr,
@@ -1122,7 +1122,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 3E */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
        SSL_kDHr,
@@ -1138,7 +1138,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 3F */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
        TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
        SSL_kDHr,
@@ -1189,7 +1189,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 42 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
        TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
        SSL_kDHd,
@@ -1205,7 +1205,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 43 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
        TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
        SSL_kDHr,
@@ -1404,7 +1404,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 68 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
        SSL_kDHr,
@@ -1420,7 +1420,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 69 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
        TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
        SSL_kDHr,
@@ -1577,7 +1577,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        },
        /* Cipher 85 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
        TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
        SSL_kDHd,
@@ -1593,7 +1593,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 86 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
        TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
        SSL_kDHr,
@@ -1743,7 +1743,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 97 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_DSS_WITH_SEED_SHA,
        TLS1_CK_DH_DSS_WITH_SEED_SHA,
        SSL_kDHd,
@@ -1759,7 +1759,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher 98 */
        {
-       0, /* not implemented (non-ephemeral DH) */
+       1,
        TLS1_TXT_DH_RSA_WITH_SEED_SHA,
        TLS1_CK_DH_RSA_WITH_SEED_SHA,
        SSL_kDHr,
@@ -1891,7 +1891,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A0 */
        {
-       0,
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
        TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
        SSL_kDHr,
@@ -1907,7 +1907,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A1 */
        {
-       0,
+       1,
        TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
        TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
        SSL_kDHr,
@@ -1955,7 +1955,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A4 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
        TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
        SSL_kDHr,
@@ -1971,7 +1971,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
        /* Cipher A5 */
        {
-       0,
+       1,
        TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
        TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
        SSL_kDHr,
@@ -2904,8 +2904,8 @@ SSL3_ENC_METHOD SSLv3_enc_data={
        SSL3_MD_CLIENT_FINISHED_CONST,4,
        SSL3_MD_SERVER_FINISHED_CONST,4,
        ssl3_alert_code,
-       (int (*)(SSL *, unsigned char *, unsigned int, const char *,
-                unsigned int, const unsigned char *, unsigned int,
+       (int (*)(SSL *, unsigned char *, size_t, const char *,
+                size_t, const unsigned char *, size_t,
                 int use_context))ssl_undefined_function,
        };
 
@@ -3350,6 +3350,21 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 #endif
 
 #endif /* !OPENSSL_NO_TLSEXT */
+
+       case SSL_CTRL_CHAIN:
+               if (larg)
+                       return ssl_cert_set1_chain(s->cert,
+                                               (STACK_OF (X509) *)parg);
+               else
+                       return ssl_cert_set0_chain(s->cert,
+                                               (STACK_OF (X509) *)parg);
+
+       case SSL_CTRL_CHAIN_CERT:
+               if (larg)
+                       return ssl_cert_add1_chain_cert(s->cert, (X509 *)parg);
+               else
+                       return ssl_cert_add0_chain_cert(s->cert, (X509 *)parg);
+
        default:
                break;
                }
@@ -3594,7 +3609,7 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                ctx->srp_ctx.login = NULL;
                if (parg == NULL)
                        break;
-               if (strlen((char *)parg) > 254)
+               if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1)
                        {
                        SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);
                        return 0;
@@ -3642,6 +3657,20 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                        }
                break;
 
+       case SSL_CTRL_CHAIN:
+               if (larg)
+                       return ssl_cert_set1_chain(ctx->cert,
+                                               (STACK_OF (X509) *)parg);
+               else
+                       return ssl_cert_set0_chain(ctx->cert,
+                                               (STACK_OF (X509) *)parg);
+
+       case SSL_CTRL_CHAIN_CERT:
+               if (larg)
+                       return ssl_cert_add1_chain_cert(ctx->cert, (X509 *)parg);
+               else
+                       return ssl_cert_add0_chain_cert(ctx->cert, (X509 *)parg);
+
        default:
                return(0);
                }