Documenting session caching, 2nd step.

[openssl.git] / ssl / ssl_ciph.c

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 7436a50ad14d16ed0c573e6ec91363fc094e7218..a196d5e574eb15a4d2c3f47835a2829890ad9796 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -100,6 +100,7 @@ typedef struct cipher_order_st
 static const SSL_CIPHER cipher_aliases[]={
        /* Don't include eNULL unless specifically enabled */
        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+        {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
        {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
        {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
        {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
@@ -108,6 +109,7 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_DH,  0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
        {0,SSL_TXT_EDH, 0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
 
+       {0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0},  /* VRS Kerberos5 */
        {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
        {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
        {0,SSL_TXT_aFZA,0,SSL_aFZA,  0,0,0,0,SSL_AUTH_MASK,0},
@@ -128,6 +130,7 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_SHA, 0,SSL_SHA,   0,0,0,0,SSL_MAC_MASK,0},
 
        {0,SSL_TXT_NULL,0,SSL_NULL,  0,0,0,0,SSL_ENC_MASK,0},
+       {0,SSL_TXT_KRB5,0,SSL_KRB5,  0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
        {0,SSL_TXT_RSA, 0,SSL_RSA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
        {0,SSL_TXT_ADH, 0,SSL_ADH,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0},
        {0,SSL_TXT_FZA, 0,SSL_FZA,   0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0},
@@ -291,6 +294,9 @@ static unsigned long ssl_cipher_get_disabled(void)
 #ifdef NO_DH
        mask |= SSL_kDHr|SSL_kDHd|SSL_kEDH|SSL_aDH;
 #endif
+#ifdef NO_KRB5
+       mask |= SSL_kKRB5|SSL_aKRB5;
+#endif
 
 #ifdef SSL_FORBID_ENULL
        mask |= SSL_eNULL;
@@ -336,6 +342,9 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
                        list[list_num].prev = NULL;
                        list[list_num].active = 0;
                        list_num++;
+#ifdef KSSL_DEBUG
+                       printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms);
+#endif /* KSSL_DEBUG */
                        /*
                        if (!sk_push(ca_list,(char *)c)) goto err;
                        */
@@ -518,7 +527,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p,
                curr = curr->next;
                }
 
-       number_uses = Malloc((max_strength_bits + 1) * sizeof(int));
+       number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int));
        if (!number_uses)
        {
                SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE);
@@ -545,7 +554,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p,
                        ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
                                        list, head_p, tail_p);
 
-       Free(number_uses);
+       OPENSSL_free(number_uses);
        return(1);
        }
 
@@ -738,7 +747,10 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         * it is used for allocation.
         */
        num_of_ciphers = ssl_method->num_ciphers();
-       list = (CIPHER_ORDER *)Malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+#ifdef KSSL_DEBUG
+       printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
+#endif    /* KSSL_DEBUG */
+       list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
        if (list == NULL)
                {
                SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
@@ -759,10 +771,10 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
        num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
        num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
        ca_list =
-               (SSL_CIPHER **)Malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
+               (SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
        if (ca_list == NULL)
                {
-               Free(list);
+               OPENSSL_free(list);
                SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
                return(NULL);   /* Failure */
                }
@@ -788,20 +800,20 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
                ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail,
                                                ca_list);
 
-       Free(ca_list);  /* Not needed anymore */
+       OPENSSL_free(ca_list);  /* Not needed anymore */
 
        if (!ok)
                {       /* Rule processing failure */
-               Free(list);
+               OPENSSL_free(list);
                return(NULL);
                }
        /*
         * Allocate new "cipherstack" for the result, return with error
         * if we cannot get one.
         */
-       if ((cipherstack = sk_SSL_CIPHER_new(NULL)) == NULL)
+       if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)
                {
-               Free(list);
+               OPENSSL_free(list);
                return(NULL);
                }
 
@@ -819,7 +831,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 #endif
                        }
                }
-       Free(list);     /* Not needed any longer */
+       OPENSSL_free(list);     /* Not needed any longer */
 
        /*
         * The following passage is a little bit odd. If pointer variables
@@ -872,8 +884,12 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        char *ver,*exp;
        char *kx,*au,*enc,*mac;
        unsigned long alg,alg2,alg_s;
+#ifdef KSSL_DEBUG
+       static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
+#else
        static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
-       
+#endif /* KSSL_DEBUG */
+
        alg=cipher->algorithms;
        alg_s=cipher->algo_strength;
        alg2=cipher->algorithm2;
@@ -901,6 +917,10 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        case SSL_kDHd:
                kx="DH/DSS";
                break;
+        case SSL_kKRB5:         /* VRS */
+        case SSL_KRB5:          /* VRS */
+            kx="KRB5";
+            break;
        case SSL_kFZA:
                kx="Fortezza";
                break;
@@ -922,6 +942,10 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
        case SSL_aDH:
                au="DH";
                break;
+        case SSL_aKRB5:         /* VRS */
+        case SSL_KRB5:          /* VRS */
+            au="KRB5";
+            break;
        case SSL_aFZA:
        case SSL_aNULL:
                au="None";
@@ -975,13 +999,18 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
 
        if (buf == NULL)
                {
-               buf=Malloc(128);
-               if (buf == NULL) return("Malloc Error");
+               len=128;
+               buf=OPENSSL_malloc(len);
+               if (buf == NULL) return("OPENSSL_malloc Error");
                }
        else if (len < 128)
                return("Buffer too small");
 
-       sprintf(buf,format,cipher->name,ver,kx,au,enc,mac,exp);
+#ifdef KSSL_DEBUG
+       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp,alg);
+#else
+       BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp);
+#endif /* KSSL_DEBUG */
        return(buf);
        }
 
@@ -1036,7 +1065,8 @@ SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
        return(NULL);
        }
 
-static int sk_comp_cmp(SSL_COMP **a,SSL_COMP **b)
+static int sk_comp_cmp(const SSL_COMP * const *a,
+                       const SSL_COMP * const *b)
        {
        return((*a)->id-(*b)->id);
        }
@@ -1051,7 +1081,11 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
        SSL_COMP *comp;
        STACK_OF(SSL_COMP) *sk;
 
-       comp=(SSL_COMP *)Malloc(sizeof(SSL_COMP));
+        if (cm == NULL || cm->type == NID_undef)
+                return 1;
+
+       MemCheck_off();
+       comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
        comp->id=id;
        comp->method=cm;
        if (ssl_comp_methods == NULL)
@@ -1060,10 +1094,13 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
                sk=ssl_comp_methods;
        if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
                {
+               MemCheck_on();
                SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
                return(0);
                }
        else
+               {
+               MemCheck_on();
                return(1);
+               }
        }
-