#define SSL_ENC_IDEA_IDX 4
#define SSL_ENC_eFZA_IDX 5
#define SSL_ENC_NULL_IDX 6
-#define SSL_ENC_NUM_IDX 7
+#define SSL_ENC_AES128_IDX 7
+#define SSL_ENC_AES256_IDX 8
+#define SSL_ENC_NUM_IDX 9
static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
NULL,NULL,NULL,NULL,NULL,NULL,
static const SSL_CIPHER cipher_aliases[]={
/* Don't include eNULL unless specifically enabled */
{0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+ {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0}, /* VRS Kerberos5 */
{0,SSL_TXT_kRSA,0,SSL_kRSA, 0,0,0,0,SSL_MKEY_MASK,0},
{0,SSL_TXT_kDHr,0,SSL_kDHr, 0,0,0,0,SSL_MKEY_MASK,0},
{0,SSL_TXT_kDHd,0,SSL_kDHd, 0,0,0,0,SSL_MKEY_MASK,0},
{0,SSL_TXT_DH, 0,SSL_DH, 0,0,0,0,SSL_MKEY_MASK,0},
{0,SSL_TXT_EDH, 0,SSL_EDH, 0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
+ {0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0}, /* VRS Kerberos5 */
{0,SSL_TXT_aRSA,0,SSL_aRSA, 0,0,0,0,SSL_AUTH_MASK,0},
{0,SSL_TXT_aDSS,0,SSL_aDSS, 0,0,0,0,SSL_AUTH_MASK,0},
{0,SSL_TXT_aFZA,0,SSL_aFZA, 0,0,0,0,SSL_AUTH_MASK,0},
{0,SSL_TXT_IDEA,0,SSL_IDEA, 0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_eFZA,0,SSL_eFZA, 0,0,0,0,SSL_ENC_MASK,0},
+ {0,SSL_TXT_AES, 0,SSL_AES, 0,0,0,0,SSL_ENC_MASK,0},
{0,SSL_TXT_MD5, 0,SSL_MD5, 0,0,0,0,SSL_MAC_MASK,0},
{0,SSL_TXT_SHA1,0,SSL_SHA1, 0,0,0,0,SSL_MAC_MASK,0},
{0,SSL_TXT_SHA, 0,SSL_SHA, 0,0,0,0,SSL_MAC_MASK,0},
{0,SSL_TXT_NULL,0,SSL_NULL, 0,0,0,0,SSL_ENC_MASK,0},
+ {0,SSL_TXT_KRB5,0,SSL_KRB5, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
{0,SSL_TXT_RSA, 0,SSL_RSA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
{0,SSL_TXT_ADH, 0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
{0,SSL_TXT_FZA, 0,SSL_FZA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0},
EVP_get_cipherbyname(SN_rc2_cbc);
ssl_cipher_methods[SSL_ENC_IDEA_IDX]=
EVP_get_cipherbyname(SN_idea_cbc);
+ ssl_cipher_methods[SSL_ENC_AES128_IDX]=
+ EVP_get_cipherbyname(SN_aes_128_cbc);
+ ssl_cipher_methods[SSL_ENC_AES256_IDX]=
+ EVP_get_cipherbyname(SN_aes_256_cbc);
ssl_digest_methods[SSL_MD_MD5_IDX]=
EVP_get_digestbyname(SN_md5);
case SSL_eNULL:
i=SSL_ENC_NULL_IDX;
break;
+ case SSL_AES:
+ switch(c->alg_bits)
+ {
+ case 128: i=SSL_ENC_AES128_IDX; break;
+ case 256: i=SSL_ENC_AES256_IDX; break;
+ default: i=-1; break;
+ }
+ break;
default:
i= -1;
break;
unsigned long mask;
mask = SSL_kFZA;
-#ifdef NO_RSA
+#ifdef OPENSSL_NO_RSA
mask |= SSL_aRSA|SSL_kRSA;
#endif
-#ifdef NO_DSA
+#ifdef OPENSSL_NO_DSA
mask |= SSL_aDSS;
#endif
-#ifdef NO_DH
+#ifdef OPENSSL_NO_DH
mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
#endif
+#ifdef OPENSSL_NO_KRB5
+ mask |= SSL_kKRB5|SSL_aKRB5;
+#endif
#ifdef SSL_FORBID_ENULL
mask |= SSL_eNULL;
mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0;
+ mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
int num_of_ciphers, unsigned long mask, CIPHER_ORDER *list,
CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
{
- unsigned int i, list_num;
+ int i, list_num;
SSL_CIPHER *c;
/*
list[list_num].prev = NULL;
list[list_num].active = 0;
list_num++;
+#ifdef KSSL_DEBUG
+ printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms);
+#endif /* KSSL_DEBUG */
/*
if (!sk_push(ca_list,(char *)c)) goto err;
*/
curr = curr->next;
}
- number_uses = Malloc((max_strength_bits + 1) * sizeof(int));
+ number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int));
if (!number_uses)
{
SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE);
ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
list, head_p, tail_p);
- Free(number_uses);
+ OPENSSL_free(number_uses);
return(1);
}
if (buflen == 0)
{
/*
- * We hit something, we cannot deal with,
- * it is no command or seperator nor
+ * We hit something we cannot deal with,
+ * it is no command or separator nor
* alphanumeric, so we call this an error.
*/
SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
if (rule == CIPHER_SPECIAL)
{
+ found = 0; /* unused -- avoid compiler warning */
break; /* special treatment */
}
multi=0;
/*
- * Now search for the name in the ca_list. Be carefule
+ * Now search for the cipher alias in the ca_list. Be careful
* with the strncmp, because the "buflen" limitation
* will make the rule "ADH:SOME" and the cipher
* "ADH-MY-CIPHER" look like a match for buflen=3.
- * So additionally check, whether the cipher name found
- * has the correct length. We can save a strlen() call,
+ * So additionally check whether the cipher name found
+ * has the correct length. We can save a strlen() call:
* just checking for the '\0' at the right place is
* sufficient, we have to strncmp() anyway.
*/
if (!multi) break;
}
+ /*
+ * Ok, we have the rule, now apply it
+ */
+ if (rule == CIPHER_SPECIAL)
+ { /* special command */
+ ok = 0;
+ if ((buflen == 8) &&
+ !strncmp(buf, "STRENGTH", 8))
+ ok = ssl_cipher_strength_sort(list,
+ head_p, tail_p);
+ else
+ SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
+ SSL_R_INVALID_COMMAND);
+ if (ok == 0)
+ retval = 0;
/*
- * Ok, we have the rule, now apply it
+ * We do not support any "multi" options
+ * together with "@", so throw away the
+ * rest of the command, if any left, until
+ * end or ':' is found.
*/
- if (rule == CIPHER_SPECIAL)
- { /* special command */
- ok = 0;
- if ((buflen == 8) &&
- !strncmp(buf, "STRENGTH", 8))
- ok = ssl_cipher_strength_sort(list,
- head_p, tail_p);
- else
- SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
- SSL_R_INVALID_COMMAND);
- if (ok == 0)
- retval = 0;
- /*
- * We do not support any "multi" options
- * together with "@", so throw away the
- * rest of the command, if any left, until
- * end or ':' is found.
- */
- while ((*l != '\0') && ITEM_SEP(*l))
- l++;
- }
- else if (found)
- {
- ssl_cipher_apply_rule(algorithms, mask,
- algo_strength, mask_strength, rule, -1,
- list, head_p, tail_p);
- }
- else
- {
- while ((*l != '\0') && ITEM_SEP(*l))
- l++;
- }
- if (*l == '\0') break; /* done */
+ while ((*l != '\0') && ITEM_SEP(*l))
+ l++;
+ }
+ else if (found)
+ {
+ ssl_cipher_apply_rule(algorithms, mask,
+ algo_strength, mask_strength, rule, -1,
+ list, head_p, tail_p);
+ }
+ else
+ {
+ while ((*l != '\0') && ITEM_SEP(*l))
+ l++;
+ }
+ if (*l == '\0') break; /* done */
}
return(retval);
* it is used for allocation.
*/
num_of_ciphers = ssl_method->num_ciphers();
- list = (CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+#ifdef KSSL_DEBUG
+ printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
+#endif /* KSSL_DEBUG */
+ list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
if (list == NULL)
{
SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
* There might be two types of entries in the rule_str: 1) names
* of ciphers themselves 2) aliases for groups of ciphers.
* For 1) we need the available ciphers and for 2) the cipher
- * groups of cipher_aliases added togehter in one list (otherwise
+ * groups of cipher_aliases added together in one list (otherwise
* we would be happy with just the cipher_aliases table).
*/
num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
ca_list =
- (SSL_CIPHER **)Malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
+ (SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
if (ca_list == NULL)
{
- Free(list);
+ OPENSSL_free(list);
SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
return(NULL); /* Failure */
}
ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail,
ca_list);
- Free(ca_list); /* Not needed anymore */
+ OPENSSL_free(ca_list); /* Not needed anymore */
if (!ok)
{ /* Rule processing failure */
- Free(list);
+ OPENSSL_free(list);
return(NULL);
}
/*
* Allocate new "cipherstack" for the result, return with error
* if we cannot get one.
*/
- if ((cipherstack = sk_SSL_CIPHER_new(NULL)) == NULL)
+ if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)
{
- Free(list);
+ OPENSSL_free(list);
return(NULL);
}
#endif
}
}
- Free(list); /* Not needed any longer */
+ OPENSSL_free(list); /* Not needed any longer */
/*
* The following passage is a little bit odd. If pointer variables
/*
* Now it is getting really strange. If something failed during
- * the previous pointer assignement or if one of the pointers was
+ * the previous pointer assignment or if one of the pointers was
* not requested, the error condition is met. That might be
* discussable. The strange thing is however that in this case
* the memory "ret" pointed to is "free()ed" and hence the pointer
char *ver,*exp;
char *kx,*au,*enc,*mac;
unsigned long alg,alg2,alg_s;
+#ifdef KSSL_DEBUG
+ static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
+#else
static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
-
+#endif /* KSSL_DEBUG */
+
alg=cipher->algorithms;
alg_s=cipher->algo_strength;
alg2=cipher->algorithm2;
case SSL_kDHd:
kx="DH/DSS";
break;
+ case SSL_kKRB5: /* VRS */
+ case SSL_KRB5: /* VRS */
+ kx="KRB5";
+ break;
case SSL_kFZA:
kx="Fortezza";
break;
case SSL_aDH:
au="DH";
break;
+ case SSL_aKRB5: /* VRS */
+ case SSL_KRB5: /* VRS */
+ au="KRB5";
+ break;
case SSL_aFZA:
case SSL_aNULL:
au="None";
case SSL_eNULL:
enc="None";
break;
+ case SSL_AES:
+ switch(cipher->strength_bits)
+ {
+ case 128: enc="AES(128)"; break;
+ case 192: enc="AES(192)"; break;
+ case 256: enc="AES(256)"; break;
+ default: enc="AES(??\?)"; break;
+ }
+ break;
default:
enc="unknown";
break;
if (buf == NULL)
{
- buf=Malloc(128);
- if (buf == NULL) return("Malloc Error");
+ len=128;
+ buf=OPENSSL_malloc(len);
+ if (buf == NULL) return("OPENSSL_malloc Error");
}
else if (len < 128)
return("Buffer too small");
- sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp);
+#ifdef KSSL_DEBUG
+ BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp,alg);
+#else
+ BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp);
+#endif /* KSSL_DEBUG */
return(buf);
}
return("(NONE)");
}
-/* number of bits for symetric cipher */
+/* number of bits for symmetric cipher */
int SSL_CIPHER_get_bits(SSL_CIPHER *c, int *alg_bits)
{
int ret=0;
return(NULL);
}
-static int sk_comp_cmp(SSL_COMP **a,SSL_COMP **b)
+static int sk_comp_cmp(const SSL_COMP * const *a,
+ const SSL_COMP * const *b)
{
return((*a)->id-(*b)->id);
}
SSL_COMP *comp;
STACK_OF(SSL_COMP) *sk;
- comp=(SSL_COMP *)Malloc(sizeof(SSL_COMP));
+ if (cm == NULL || cm->type == NID_undef)
+ return 1;
+
+ MemCheck_off();
+ comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
comp->id=id;
comp->method=cm;
if (ssl_comp_methods == NULL)
sk=ssl_comp_methods;
if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
{
+ MemCheck_on();
SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
return(0);
}
else
+ {
+ MemCheck_on();
return(1);
+ }
}
-
projects / openssl.git / blobdiff