set auto ecdh parameter selction for Suite B

[openssl.git] / ssl / ssl_ciph.c

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index bac2515789ba965648a9aa6770c134452c44a32d..e4bc18440e472dcde3efe4f45bf9fa089ebe2c5e 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -1351,11 +1351,16 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
 static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
                                        const char **prule_str)
        {
-       unsigned int suiteb_flags = 0;
+       unsigned int suiteb_flags = 0, suiteb_comb2 = 0;
        if (!strcmp(*prule_str, "SUITEB128"))
                suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;
        else if (!strcmp(*prule_str, "SUITEB128ONLY"))
                suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY;
+       else if (!strcmp(*prule_str, "SUITEB128C2"))
+               {
+               suiteb_comb2 = 1;
+               suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;
+               }
        else if (!strcmp(*prule_str, "SUITEB192"))
                suiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS;
 
@@ -1374,7 +1379,10 @@ static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
        switch(suiteb_flags)
                {
        case SSL_CERT_FLAG_SUITEB_128_LOS:
-               *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384";
+               if (suiteb_comb2)
+                       *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";
+               else
+                       *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384";
                break;
        case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
                *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256";
@@ -1383,6 +1391,8 @@ static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
                *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";
                break;
                }
+       /* Set auto ECDH parameter determination */
+       c->ecdh_tmp_auto = 1;
        return 1;
        }
 
@@ -1934,3 +1944,16 @@ int ssl_cipher_get_cert_index(const SSL_CIPHER *c)
        return -1;
        }
 
+const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr)
+       {
+       const SSL_CIPHER *c;
+       c = ssl->method->get_cipher_by_char(ptr);
+       if (c == NULL || c->valid == 0)
+               return NULL;
+       return c;
+       }
+
+const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr)
+       {
+       return ssl->method->get_cipher_by_char(ptr);
+       }