1 /* 2 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved 4 * Copyright 2005 Nokia. All rights reserved. 5 * 6 * Licensed under the OpenSSL license (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include <stdio.h> 13 #include <ctype.h> 14 #include <openssl/objects.h> 15 #include <openssl/comp.h> 16 #include <openssl/engine.h> 17 #include <openssl/crypto.h> 18 #include <openssl/conf.h> 19 #include "internal/nelem.h" 20 #include "ssl_local.h" 21 #include "internal/thread_once.h" 22 #include "internal/cryptlib.h" 23 24 #define SSL_ENC_DES_IDX 0 25 #define SSL_ENC_3DES_IDX 1 26 #define SSL_ENC_RC4_IDX 2 27 #define SSL_ENC_RC2_IDX 3 28 #define SSL_ENC_IDEA_IDX 4 29 #define SSL_ENC_NULL_IDX 5 30 #define SSL_ENC_AES128_IDX 6 31 #define SSL_ENC_AES256_IDX 7 32 #define SSL_ENC_CAMELLIA128_IDX 8 33 #define SSL_ENC_CAMELLIA256_IDX 9 34 #define SSL_ENC_GOST89_IDX 10 35 #define SSL_ENC_SEED_IDX 11 36 #define SSL_ENC_AES128GCM_IDX 12 37 #define SSL_ENC_AES256GCM_IDX 13 38 #define SSL_ENC_AES128CCM_IDX 14 39 #define SSL_ENC_AES256CCM_IDX 15 40 #define SSL_ENC_AES128CCM8_IDX 16 41 #define SSL_ENC_AES256CCM8_IDX 17 42 #define SSL_ENC_GOST8912_IDX 18 43 #define SSL_ENC_CHACHA_IDX 19 44 #define SSL_ENC_ARIA128GCM_IDX 20 45 #define SSL_ENC_ARIA256GCM_IDX 21 46 #define SSL_ENC_NUM_IDX 22 47 48 /* NB: make sure indices in these tables match values above */ 49 50 typedef struct { 51 uint32_t mask; 52 int nid; 53 } ssl_cipher_table; 54 55 /* Table of NIDs for each cipher */ 56 static const ssl_cipher_table ssl_cipher_table_cipher[SSL_ENC_NUM_IDX] = { 57 {SSL_DES, NID_des_cbc}, /* SSL_ENC_DES_IDX 0 */ 58 {SSL_3DES, NID_des_ede3_cbc}, /* SSL_ENC_3DES_IDX 1 */ 59 {SSL_RC4, NID_rc4}, /* SSL_ENC_RC4_IDX 2 */ 60 {SSL_RC2, NID_rc2_cbc}, /* SSL_ENC_RC2_IDX 3 */ 61 {SSL_IDEA, NID_idea_cbc}, /* SSL_ENC_IDEA_IDX 4 */ 62 {SSL_eNULL, NID_undef}, /* SSL_ENC_NULL_IDX 5 */ 63 {SSL_AES128, NID_aes_128_cbc}, /* SSL_ENC_AES128_IDX 6 */ 64 {SSL_AES256, NID_aes_256_cbc}, /* SSL_ENC_AES256_IDX 7 */ 65 {SSL_CAMELLIA128, NID_camellia_128_cbc}, /* SSL_ENC_CAMELLIA128_IDX 8 */ 66 {SSL_CAMELLIA256, NID_camellia_256_cbc}, /* SSL_ENC_CAMELLIA256_IDX 9 */ 67 {SSL_eGOST2814789CNT, NID_gost89_cnt}, /* SSL_ENC_GOST89_IDX 10 */ 68 {SSL_SEED, NID_seed_cbc}, /* SSL_ENC_SEED_IDX 11 */ 69 {SSL_AES128GCM, NID_aes_128_gcm}, /* SSL_ENC_AES128GCM_IDX 12 */ 70 {SSL_AES256GCM, NID_aes_256_gcm}, /* SSL_ENC_AES256GCM_IDX 13 */ 71 {SSL_AES128CCM, NID_aes_128_ccm}, /* SSL_ENC_AES128CCM_IDX 14 */ 72 {SSL_AES256CCM, NID_aes_256_ccm}, /* SSL_ENC_AES256CCM_IDX 15 */ 73 {SSL_AES128CCM8, NID_aes_128_ccm}, /* SSL_ENC_AES128CCM8_IDX 16 */ 74 {SSL_AES256CCM8, NID_aes_256_ccm}, /* SSL_ENC_AES256CCM8_IDX 17 */ 75 {SSL_eGOST2814789CNT12, NID_gost89_cnt_12}, /* SSL_ENC_GOST8912_IDX 18 */ 76 {SSL_CHACHA20POLY1305, NID_chacha20_poly1305}, /* SSL_ENC_CHACHA_IDX 19 */ 77 {SSL_ARIA128GCM, NID_aria_128_gcm}, /* SSL_ENC_ARIA128GCM_IDX 20 */ 78 {SSL_ARIA256GCM, NID_aria_256_gcm}, /* SSL_ENC_ARIA256GCM_IDX 21 */ 79 }; 80 81 static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]; 82 83 #define SSL_COMP_NULL_IDX 0 84 #define SSL_COMP_ZLIB_IDX 1 85 #define SSL_COMP_NUM_IDX 2 86 87 static STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; 88 89 #ifndef OPENSSL_NO_COMP 90 static CRYPTO_ONCE ssl_load_builtin_comp_once = CRYPTO_ONCE_STATIC_INIT; 91 #endif 92 93 /* 94 * Constant SSL_MAX_DIGEST equal to size of digests array should be defined 95 * in the ssl_local.h 96 */ 97 98 #define SSL_MD_NUM_IDX SSL_MAX_DIGEST 99 100 /* NB: make sure indices in this table matches values above */ 101 static const ssl_cipher_table ssl_cipher_table_mac[SSL_MD_NUM_IDX] = { 102 {SSL_MD5, NID_md5}, /* SSL_MD_MD5_IDX 0 */ 103 {SSL_SHA1, NID_sha1}, /* SSL_MD_SHA1_IDX 1 */ 104 {SSL_GOST94, NID_id_GostR3411_94}, /* SSL_MD_GOST94_IDX 2 */ 105 {SSL_GOST89MAC, NID_id_Gost28147_89_MAC}, /* SSL_MD_GOST89MAC_IDX 3 */ 106 {SSL_SHA256, NID_sha256}, /* SSL_MD_SHA256_IDX 4 */ 107 {SSL_SHA384, NID_sha384}, /* SSL_MD_SHA384_IDX 5 */ 108 {SSL_GOST12_256, NID_id_GostR3411_2012_256}, /* SSL_MD_GOST12_256_IDX 6 */ 109 {SSL_GOST89MAC12, NID_gost_mac_12}, /* SSL_MD_GOST89MAC12_IDX 7 */ 110 {SSL_GOST12_512, NID_id_GostR3411_2012_512}, /* SSL_MD_GOST12_512_IDX 8 */ 111 {0, NID_md5_sha1}, /* SSL_MD_MD5_SHA1_IDX 9 */ 112 {0, NID_sha224}, /* SSL_MD_SHA224_IDX 10 */ 113 {0, NID_sha512} /* SSL_MD_SHA512_IDX 11 */ 114 }; 115 116 static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = { 117 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL 118 }; 119 120 /* *INDENT-OFF* */ 121 static const ssl_cipher_table ssl_cipher_table_kx[] = { 122 {SSL_kRSA, NID_kx_rsa}, 123 {SSL_kECDHE, NID_kx_ecdhe}, 124 {SSL_kDHE, NID_kx_dhe}, 125 {SSL_kECDHEPSK, NID_kx_ecdhe_psk}, 126 {SSL_kDHEPSK, NID_kx_dhe_psk}, 127 {SSL_kRSAPSK, NID_kx_rsa_psk}, 128 {SSL_kPSK, NID_kx_psk}, 129 {SSL_kSRP, NID_kx_srp}, 130 {SSL_kGOST, NID_kx_gost}, 131 {SSL_kANY, NID_kx_any} 132 }; 133 134 static const ssl_cipher_table ssl_cipher_table_auth[] = { 135 {SSL_aRSA, NID_auth_rsa}, 136 {SSL_aECDSA, NID_auth_ecdsa}, 137 {SSL_aPSK, NID_auth_psk}, 138 {SSL_aDSS, NID_auth_dss}, 139 {SSL_aGOST01, NID_auth_gost01}, 140 {SSL_aGOST12, NID_auth_gost12}, 141 {SSL_aSRP, NID_auth_srp}, 142 {SSL_aNULL, NID_auth_null}, 143 {SSL_aANY, NID_auth_any} 144 }; 145 /* *INDENT-ON* */ 146 147 /* Utility function for table lookup */ 148 static int ssl_cipher_info_find(const ssl_cipher_table * table, 149 size_t table_cnt, uint32_t mask) 150 { 151 size_t i; 152 for (i = 0; i < table_cnt; i++, table++) { 153 if (table->mask == mask) 154 return (int)i; 155 } 156 return -1; 157 } 158 159 #define ssl_cipher_info_lookup(table, x) \ 160 ssl_cipher_info_find(table, OSSL_NELEM(table), x) 161 162 /* 163 * PKEY_TYPE for GOST89MAC is known in advance, but, because implementation 164 * is engine-provided, we'll fill it only if corresponding EVP_PKEY_METHOD is 165 * found 166 */ 167 static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = { 168 /* MD5, SHA, GOST94, MAC89 */ 169 EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef, 170 /* SHA256, SHA384, GOST2012_256, MAC89-12 */ 171 EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef, 172 /* GOST2012_512 */ 173 EVP_PKEY_HMAC, 174 /* MD5/SHA1, SHA224, SHA512 */ 175 NID_undef, NID_undef, NID_undef 176 }; 177 178 static size_t ssl_mac_secret_size[SSL_MD_NUM_IDX]; 179 180 #define CIPHER_ADD 1 181 #define CIPHER_KILL 2 182 #define CIPHER_DEL 3 183 #define CIPHER_ORD 4 184 #define CIPHER_SPECIAL 5 185 /* 186 * Bump the ciphers to the top of the list. 187 * This rule isn't currently supported by the public cipherstring API. 188 */ 189 #define CIPHER_BUMP 6 190 191 typedef struct cipher_order_st { 192 const SSL_CIPHER *cipher; 193 int active; 194 int dead; 195 struct cipher_order_st *next, *prev; 196 } CIPHER_ORDER; 197 198 static const SSL_CIPHER cipher_aliases[] = { 199 /* "ALL" doesn't include eNULL (must be specifically enabled) */ 200 {0, SSL_TXT_ALL, NULL, 0, 0, 0, ~SSL_eNULL}, 201 /* "COMPLEMENTOFALL" */ 202 {0, SSL_TXT_CMPALL, NULL, 0, 0, 0, SSL_eNULL}, 203 204 /* 205 * "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in 206 * ALL!) 207 */ 208 {0, SSL_TXT_CMPDEF, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_NOT_DEFAULT}, 209 210 /* 211 * key exchange aliases (some of those using only a single bit here 212 * combine multiple key exchange algs according to the RFCs, e.g. kDHE 213 * combines DHE_DSS and DHE_RSA) 214 */ 215 {0, SSL_TXT_kRSA, NULL, 0, SSL_kRSA}, 216 217 {0, SSL_TXT_kEDH, NULL, 0, SSL_kDHE}, 218 {0, SSL_TXT_kDHE, NULL, 0, SSL_kDHE}, 219 {0, SSL_TXT_DH, NULL, 0, SSL_kDHE}, 220 221 {0, SSL_TXT_kEECDH, NULL, 0, SSL_kECDHE}, 222 {0, SSL_TXT_kECDHE, NULL, 0, SSL_kECDHE}, 223 {0, SSL_TXT_ECDH, NULL, 0, SSL_kECDHE}, 224 225 {0, SSL_TXT_kPSK, NULL, 0, SSL_kPSK}, 226 {0, SSL_TXT_kRSAPSK, NULL, 0, SSL_kRSAPSK}, 227 {0, SSL_TXT_kECDHEPSK, NULL, 0, SSL_kECDHEPSK}, 228 {0, SSL_TXT_kDHEPSK, NULL, 0, SSL_kDHEPSK}, 229 {0, SSL_TXT_kSRP, NULL, 0, SSL_kSRP}, 230 {0, SSL_TXT_kGOST, NULL, 0, SSL_kGOST}, 231 232 /* server authentication aliases */ 233 {0, SSL_TXT_aRSA, NULL, 0, 0, SSL_aRSA}, 234 {0, SSL_TXT_aDSS, NULL, 0, 0, SSL_aDSS}, 235 {0, SSL_TXT_DSS, NULL, 0, 0, SSL_aDSS}, 236 {0, SSL_TXT_aNULL, NULL, 0, 0, SSL_aNULL}, 237 {0, SSL_TXT_aECDSA, NULL, 0, 0, SSL_aECDSA}, 238 {0, SSL_TXT_ECDSA, NULL, 0, 0, SSL_aECDSA}, 239 {0, SSL_TXT_aPSK, NULL, 0, 0, SSL_aPSK}, 240 {0, SSL_TXT_aGOST01, NULL, 0, 0, SSL_aGOST01}, 241 {0, SSL_TXT_aGOST12, NULL, 0, 0, SSL_aGOST12}, 242 {0, SSL_TXT_aGOST, NULL, 0, 0, SSL_aGOST01 | SSL_aGOST12}, 243 {0, SSL_TXT_aSRP, NULL, 0, 0, SSL_aSRP}, 244 245 /* aliases combining key exchange and server authentication */ 246 {0, SSL_TXT_EDH, NULL, 0, SSL_kDHE, ~SSL_aNULL}, 247 {0, SSL_TXT_DHE, NULL, 0, SSL_kDHE, ~SSL_aNULL}, 248 {0, SSL_TXT_EECDH, NULL, 0, SSL_kECDHE, ~SSL_aNULL}, 249 {0, SSL_TXT_ECDHE, NULL, 0, SSL_kECDHE, ~SSL_aNULL}, 250 {0, SSL_TXT_NULL, NULL, 0, 0, 0, SSL_eNULL}, 251 {0, SSL_TXT_RSA, NULL, 0, SSL_kRSA, SSL_aRSA}, 252 {0, SSL_TXT_ADH, NULL, 0, SSL_kDHE, SSL_aNULL}, 253 {0, SSL_TXT_AECDH, NULL, 0, SSL_kECDHE, SSL_aNULL}, 254 {0, SSL_TXT_PSK, NULL, 0, SSL_PSK}, 255 {0, SSL_TXT_SRP, NULL, 0, SSL_kSRP}, 256 257 /* symmetric encryption aliases */ 258 {0, SSL_TXT_3DES, NULL, 0, 0, 0, SSL_3DES}, 259 {0, SSL_TXT_RC4, NULL, 0, 0, 0, SSL_RC4}, 260 {0, SSL_TXT_RC2, NULL, 0, 0, 0, SSL_RC2}, 261 {0, SSL_TXT_IDEA, NULL, 0, 0, 0, SSL_IDEA}, 262 {0, SSL_TXT_SEED, NULL, 0, 0, 0, SSL_SEED}, 263 {0, SSL_TXT_eNULL, NULL, 0, 0, 0, SSL_eNULL}, 264 {0, SSL_TXT_GOST, NULL, 0, 0, 0, SSL_eGOST2814789CNT | SSL_eGOST2814789CNT12}, 265 {0, SSL_TXT_AES128, NULL, 0, 0, 0, 266 SSL_AES128 | SSL_AES128GCM | SSL_AES128CCM | SSL_AES128CCM8}, 267 {0, SSL_TXT_AES256, NULL, 0, 0, 0, 268 SSL_AES256 | SSL_AES256GCM | SSL_AES256CCM | SSL_AES256CCM8}, 269 {0, SSL_TXT_AES, NULL, 0, 0, 0, SSL_AES}, 270 {0, SSL_TXT_AES_GCM, NULL, 0, 0, 0, SSL_AES128GCM | SSL_AES256GCM}, 271 {0, SSL_TXT_AES_CCM, NULL, 0, 0, 0, 272 SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8}, 273 {0, SSL_TXT_AES_CCM_8, NULL, 0, 0, 0, SSL_AES128CCM8 | SSL_AES256CCM8}, 274 {0, SSL_TXT_CAMELLIA128, NULL, 0, 0, 0, SSL_CAMELLIA128}, 275 {0, SSL_TXT_CAMELLIA256, NULL, 0, 0, 0, SSL_CAMELLIA256}, 276 {0, SSL_TXT_CAMELLIA, NULL, 0, 0, 0, SSL_CAMELLIA}, 277 {0, SSL_TXT_CHACHA20, NULL, 0, 0, 0, SSL_CHACHA20}, 278 279 {0, SSL_TXT_ARIA, NULL, 0, 0, 0, SSL_ARIA}, 280 {0, SSL_TXT_ARIA_GCM, NULL, 0, 0, 0, SSL_ARIA128GCM | SSL_ARIA256GCM}, 281 {0, SSL_TXT_ARIA128, NULL, 0, 0, 0, SSL_ARIA128GCM}, 282 {0, SSL_TXT_ARIA256, NULL, 0, 0, 0, SSL_ARIA256GCM}, 283 284 /* MAC aliases */ 285 {0, SSL_TXT_MD5, NULL, 0, 0, 0, 0, SSL_MD5}, 286 {0, SSL_TXT_SHA1, NULL, 0, 0, 0, 0, SSL_SHA1}, 287 {0, SSL_TXT_SHA, NULL, 0, 0, 0, 0, SSL_SHA1}, 288 {0, SSL_TXT_GOST94, NULL, 0, 0, 0, 0, SSL_GOST94}, 289 {0, SSL_TXT_GOST89MAC, NULL, 0, 0, 0, 0, SSL_GOST89MAC | SSL_GOST89MAC12}, 290 {0, SSL_TXT_SHA256, NULL, 0, 0, 0, 0, SSL_SHA256}, 291 {0, SSL_TXT_SHA384, NULL, 0, 0, 0, 0, SSL_SHA384}, 292 {0, SSL_TXT_GOST12, NULL, 0, 0, 0, 0, SSL_GOST12_256}, 293 294 /* protocol version aliases */ 295 {0, SSL_TXT_SSLV3, NULL, 0, 0, 0, 0, 0, SSL3_VERSION}, 296 {0, SSL_TXT_TLSV1, NULL, 0, 0, 0, 0, 0, TLS1_VERSION}, 297 {0, "TLSv1.0", NULL, 0, 0, 0, 0, 0, TLS1_VERSION}, 298 {0, SSL_TXT_TLSV1_2, NULL, 0, 0, 0, 0, 0, TLS1_2_VERSION}, 299 300 /* strength classes */ 301 {0, SSL_TXT_LOW, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_LOW}, 302 {0, SSL_TXT_MEDIUM, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_MEDIUM}, 303 {0, SSL_TXT_HIGH, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_HIGH}, 304 /* FIPS 140-2 approved ciphersuite */ 305 {0, SSL_TXT_FIPS, NULL, 0, 0, 0, ~SSL_eNULL, 0, 0, 0, 0, 0, SSL_FIPS}, 306 307 /* "EDH-" aliases to "DHE-" labels (for backward compatibility) */ 308 {0, SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, NULL, 0, 309 SSL_kDHE, SSL_aDSS, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS}, 310 {0, SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, NULL, 0, 311 SSL_kDHE, SSL_aRSA, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS}, 312 313 }; 314 315 /* 316 * Search for public key algorithm with given name and return its pkey_id if 317 * it is available. Otherwise return 0 318 */ 319 #ifdef OPENSSL_NO_ENGINE 320 321 static int get_optional_pkey_id(const char *pkey_name) 322 { 323 const EVP_PKEY_ASN1_METHOD *ameth; 324 int pkey_id = 0; 325 ameth = EVP_PKEY_asn1_find_str(NULL, pkey_name, -1); 326 if (ameth && EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, 327 ameth) > 0) 328 return pkey_id; 329 return 0; 330 } 331 332 #else 333 334 static int get_optional_pkey_id(const char *pkey_name) 335 { 336 const EVP_PKEY_ASN1_METHOD *ameth; 337 ENGINE *tmpeng = NULL; 338 int pkey_id = 0; 339 ameth = EVP_PKEY_asn1_find_str(&tmpeng, pkey_name, -1); 340 if (ameth) { 341 if (EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, 342 ameth) <= 0) 343 pkey_id = 0; 344 } 345 ENGINE_finish(tmpeng); 346 return pkey_id; 347 } 348 349 #endif 350 351 /* masks of disabled algorithms */ 352 static uint32_t disabled_enc_mask; 353 static uint32_t disabled_mac_mask; 354 static uint32_t disabled_mkey_mask; 355 static uint32_t disabled_auth_mask; 356 357 int ssl_load_ciphers(void) 358 { 359 size_t i; 360 const ssl_cipher_table *t; 361 362 disabled_enc_mask = 0; 363 ssl_sort_cipher_list(); 364 for (i = 0, t = ssl_cipher_table_cipher; i < SSL_ENC_NUM_IDX; i++, t++) { 365 if (t->nid == NID_undef) { 366 ssl_cipher_methods[i] = NULL; 367 } else { 368 const EVP_CIPHER *cipher = EVP_get_cipherbynid(t->nid); 369 ssl_cipher_methods[i] = cipher; 370 if (cipher == NULL) 371 disabled_enc_mask |= t->mask; 372 } 373 } 374 disabled_mac_mask = 0; 375 for (i = 0, t = ssl_cipher_table_mac; i < SSL_MD_NUM_IDX; i++, t++) { 376 const EVP_MD *md = EVP_get_digestbynid(t->nid); 377 ssl_digest_methods[i] = md; 378 if (md == NULL) { 379 disabled_mac_mask |= t->mask; 380 } else { 381 int tmpsize = EVP_MD_size(md); 382 if (!ossl_assert(tmpsize >= 0)) 383 return 0; 384 ssl_mac_secret_size[i] = tmpsize; 385 } 386 } 387 /* Make sure we can access MD5 and SHA1 */ 388 if (!ossl_assert(ssl_digest_methods[SSL_MD_MD5_IDX] != NULL)) 389 return 0; 390 if (!ossl_assert(ssl_digest_methods[SSL_MD_SHA1_IDX] != NULL)) 391 return 0; 392 393 disabled_mkey_mask = 0; 394 disabled_auth_mask = 0; 395 396 #ifdef OPENSSL_NO_RSA 397 disabled_mkey_mask |= SSL_kRSA | SSL_kRSAPSK; 398 disabled_auth_mask |= SSL_aRSA; 399 #endif 400 #ifdef OPENSSL_NO_DSA 401 disabled_auth_mask |= SSL_aDSS; 402 #endif 403 #ifdef OPENSSL_NO_DH 404 disabled_mkey_mask |= SSL_kDHE | SSL_kDHEPSK; 405 #endif 406 #ifdef OPENSSL_NO_EC 407 disabled_mkey_mask |= SSL_kECDHE | SSL_kECDHEPSK; 408 disabled_auth_mask |= SSL_aECDSA; 409 #endif 410 #ifdef OPENSSL_NO_PSK 411 disabled_mkey_mask |= SSL_PSK; 412 disabled_auth_mask |= SSL_aPSK; 413 #endif 414 #ifdef OPENSSL_NO_SRP 415 disabled_mkey_mask |= SSL_kSRP; 416 #endif 417 418 /* 419 * Check for presence of GOST 34.10 algorithms, and if they are not 420 * present, disable appropriate auth and key exchange 421 */ 422 ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac"); 423 if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) 424 ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32; 425 else 426 disabled_mac_mask |= SSL_GOST89MAC; 427 428 ssl_mac_pkey_id[SSL_MD_GOST89MAC12_IDX] = 429 get_optional_pkey_id("gost-mac-12"); 430 if (ssl_mac_pkey_id[SSL_MD_GOST89MAC12_IDX]) 431 ssl_mac_secret_size[SSL_MD_GOST89MAC12_IDX] = 32; 432 else 433 disabled_mac_mask |= SSL_GOST89MAC12; 434 435 if (!get_optional_pkey_id("gost2001")) 436 disabled_auth_mask |= SSL_aGOST01 | SSL_aGOST12; 437 if (!get_optional_pkey_id("gost2012_256")) 438 disabled_auth_mask |= SSL_aGOST12; 439 if (!get_optional_pkey_id("gost2012_512")) 440 disabled_auth_mask |= SSL_aGOST12; 441 /* 442 * Disable GOST key exchange if no GOST signature algs are available * 443 */ 444 if ((disabled_auth_mask & (SSL_aGOST01 | SSL_aGOST12)) == 445 (SSL_aGOST01 | SSL_aGOST12)) 446 disabled_mkey_mask |= SSL_kGOST; 447 448 return 1; 449 } 450 451 #ifndef OPENSSL_NO_COMP 452 453 static int sk_comp_cmp(const SSL_COMP *const *a, const SSL_COMP *const *b) 454 { 455 return ((*a)->id - (*b)->id); 456 } 457 458 DEFINE_RUN_ONCE_STATIC(do_load_builtin_compressions) 459 { 460 SSL_COMP *comp = NULL; 461 COMP_METHOD *method = COMP_zlib(); 462 463 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE); 464 ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp); 465 466 if (COMP_get_type(method) != NID_undef && ssl_comp_methods != NULL) { 467 comp = OPENSSL_malloc(sizeof(*comp)); 468 if (comp != NULL) { 469 comp->method = method; 470 comp->id = SSL_COMP_ZLIB_IDX; 471 comp->name = COMP_get_name(method); 472 sk_SSL_COMP_push(ssl_comp_methods, comp); 473 sk_SSL_COMP_sort(ssl_comp_methods); 474 } 475 } 476 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE); 477 return 1; 478 } 479 480 static int load_builtin_compressions(void) 481 { 482 return RUN_ONCE(&ssl_load_builtin_comp_once, do_load_builtin_compressions); 483 } 484 #endif 485 486 int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, 487 const EVP_MD **md, int *mac_pkey_type, 488 size_t *mac_secret_size, SSL_COMP **comp, int use_etm) 489 { 490 int i; 491 const SSL_CIPHER *c; 492 493 c = s->cipher; 494 if (c == NULL) 495 return 0; 496 if (comp != NULL) { 497 SSL_COMP ctmp; 498 #ifndef OPENSSL_NO_COMP 499 if (!load_builtin_compressions()) { 500 /* 501 * Currently don't care, since a failure only means that 502 * ssl_comp_methods is NULL, which is perfectly OK 503 */ 504 } 505 #endif 506 *comp = NULL; 507 ctmp.id = s->compress_meth; 508 if (ssl_comp_methods != NULL) { 509 i = sk_SSL_COMP_find(ssl_comp_methods, &ctmp); 510 *comp = sk_SSL_COMP_value(ssl_comp_methods, i); 511 } 512 /* If were only interested in comp then return success */ 513 if ((enc == NULL) && (md == NULL)) 514 return 1; 515 } 516 517 if ((enc == NULL) || (md == NULL)) 518 return 0; 519 520 i = ssl_cipher_info_lookup(ssl_cipher_table_cipher, c->algorithm_enc); 521 522 if (i == -1) { 523 *enc = NULL; 524 } else { 525 if (i == SSL_ENC_NULL_IDX) 526 *enc = EVP_enc_null(); 527 else 528 *enc = ssl_cipher_methods[i]; 529 } 530 531 i = ssl_cipher_info_lookup(ssl_cipher_table_mac, c->algorithm_mac); 532 if (i == -1) { 533 *md = NULL; 534 if (mac_pkey_type != NULL) 535 *mac_pkey_type = NID_undef; 536 if (mac_secret_size != NULL) 537 *mac_secret_size = 0; 538 if (c->algorithm_mac == SSL_AEAD) 539 mac_pkey_type = NULL; 540 } else { 541 *md = ssl_digest_methods[i]; 542 if (mac_pkey_type != NULL) 543 *mac_pkey_type = ssl_mac_pkey_id[i]; 544 if (mac_secret_size != NULL) 545 *mac_secret_size = ssl_mac_secret_size[i]; 546 } 547 548 if ((*enc != NULL) && 549 (*md != NULL || (EVP_CIPHER_flags(*enc) & EVP_CIPH_FLAG_AEAD_CIPHER)) 550 && (!mac_pkey_type || *mac_pkey_type != NID_undef)) { 551 const EVP_CIPHER *evp; 552 553 if (use_etm) 554 return 1; 555 556 if (s->ssl_version >> 8 != TLS1_VERSION_MAJOR || 557 s->ssl_version < TLS1_VERSION) 558 return 1; 559 560 if (c->algorithm_enc == SSL_RC4 && 561 c->algorithm_mac == SSL_MD5 && 562 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5"))) 563 *enc = evp, *md = NULL; 564 else if (c->algorithm_enc == SSL_AES128 && 565 c->algorithm_mac == SSL_SHA1 && 566 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1"))) 567 *enc = evp, *md = NULL; 568 else if (c->algorithm_enc == SSL_AES256 && 569 c->algorithm_mac == SSL_SHA1 && 570 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1"))) 571 *enc = evp, *md = NULL; 572 else if (c->algorithm_enc == SSL_AES128 && 573 c->algorithm_mac == SSL_SHA256 && 574 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA256"))) 575 *enc = evp, *md = NULL; 576 else if (c->algorithm_enc == SSL_AES256 && 577 c->algorithm_mac == SSL_SHA256 && 578 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA256"))) 579 *enc = evp, *md = NULL; 580 return 1; 581 } else { 582 return 0; 583 } 584 } 585 586 const EVP_MD *ssl_md(int idx) 587 { 588 idx &= SSL_HANDSHAKE_MAC_MASK; 589 if (idx < 0 || idx >= SSL_MD_NUM_IDX) 590 return NULL; 591 return ssl_digest_methods[idx]; 592 } 593 594 const EVP_MD *ssl_handshake_md(SSL *s) 595 { 596 return ssl_md(ssl_get_algorithm2(s)); 597 } 598 599 const EVP_MD *ssl_prf_md(SSL *s) 600 { 601 return ssl_md(ssl_get_algorithm2(s) >> TLS1_PRF_DGST_SHIFT); 602 } 603 604 #define ITEM_SEP(a) \ 605 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ',')) 606 607 static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr, 608 CIPHER_ORDER **tail) 609 { 610 if (curr == *tail) 611 return; 612 if (curr == *head) 613 *head = curr->next; 614 if (curr->prev != NULL) 615 curr->prev->next = curr->next; 616 if (curr->next != NULL) 617 curr->next->prev = curr->prev; 618 (*tail)->next = curr; 619 curr->prev = *tail; 620 curr->next = NULL; 621 *tail = curr; 622 } 623 624 static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr, 625 CIPHER_ORDER **tail) 626 { 627 if (curr == *head) 628 return; 629 if (curr == *tail) 630 *tail = curr->prev; 631 if (curr->next != NULL) 632 curr->next->prev = curr->prev; 633 if (curr->prev != NULL) 634 curr->prev->next = curr->next; 635 (*head)->prev = curr; 636 curr->next = *head; 637 curr->prev = NULL; 638 *head = curr; 639 } 640 641 static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, 642 int num_of_ciphers, 643 uint32_t disabled_mkey, 644 uint32_t disabled_auth, 645 uint32_t disabled_enc, 646 uint32_t disabled_mac, 647 CIPHER_ORDER *co_list, 648 CIPHER_ORDER **head_p, 649 CIPHER_ORDER **tail_p) 650 { 651 int i, co_list_num; 652 const SSL_CIPHER *c; 653 654 /* 655 * We have num_of_ciphers descriptions compiled in, depending on the 656 * method selected (SSLv3, TLSv1 etc). 657 * These will later be sorted in a linked list with at most num 658 * entries. 659 */ 660 661 /* Get the initial list of ciphers */ 662 co_list_num = 0; /* actual count of ciphers */ 663 for (i = 0; i < num_of_ciphers; i++) { 664 c = ssl_method->get_cipher(i); 665 /* drop those that use any of that is not available */ 666 if (c == NULL || !c->valid) 667 continue; 668 if ((c->algorithm_mkey & disabled_mkey) || 669 (c->algorithm_auth & disabled_auth) || 670 (c->algorithm_enc & disabled_enc) || 671 (c->algorithm_mac & disabled_mac)) 672 continue; 673 if (((ssl_method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) == 0) && 674 c->min_tls == 0) 675 continue; 676 if (((ssl_method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) != 0) && 677 c->min_dtls == 0) 678 continue; 679 680 co_list[co_list_num].cipher = c; 681 co_list[co_list_num].next = NULL; 682 co_list[co_list_num].prev = NULL; 683 co_list[co_list_num].active = 0; 684 co_list_num++; 685 } 686 687 /* 688 * Prepare linked list from list entries 689 */ 690 if (co_list_num > 0) { 691 co_list[0].prev = NULL; 692 693 if (co_list_num > 1) { 694 co_list[0].next = &co_list[1]; 695 696 for (i = 1; i < co_list_num - 1; i++) { 697 co_list[i].prev = &co_list[i - 1]; 698 co_list[i].next = &co_list[i + 1]; 699 } 700 701 co_list[co_list_num - 1].prev = &co_list[co_list_num - 2]; 702 } 703 704 co_list[co_list_num - 1].next = NULL; 705 706 *head_p = &co_list[0]; 707 *tail_p = &co_list[co_list_num - 1]; 708 } 709 } 710 711 static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list, 712 int num_of_group_aliases, 713 uint32_t disabled_mkey, 714 uint32_t disabled_auth, 715 uint32_t disabled_enc, 716 uint32_t disabled_mac, 717 CIPHER_ORDER *head) 718 { 719 CIPHER_ORDER *ciph_curr; 720 const SSL_CIPHER **ca_curr; 721 int i; 722 uint32_t mask_mkey = ~disabled_mkey; 723 uint32_t mask_auth = ~disabled_auth; 724 uint32_t mask_enc = ~disabled_enc; 725 uint32_t mask_mac = ~disabled_mac; 726 727 /* 728 * First, add the real ciphers as already collected 729 */ 730 ciph_curr = head; 731 ca_curr = ca_list; 732 while (ciph_curr != NULL) { 733 *ca_curr = ciph_curr->cipher; 734 ca_curr++; 735 ciph_curr = ciph_curr->next; 736 } 737 738 /* 739 * Now we add the available ones from the cipher_aliases[] table. 740 * They represent either one or more algorithms, some of which 741 * in any affected category must be supported (set in enabled_mask), 742 * or represent a cipher strength value (will be added in any case because algorithms=0). 743 */ 744 for (i = 0; i < num_of_group_aliases; i++) { 745 uint32_t algorithm_mkey = cipher_aliases[i].algorithm_mkey; 746 uint32_t algorithm_auth = cipher_aliases[i].algorithm_auth; 747 uint32_t algorithm_enc = cipher_aliases[i].algorithm_enc; 748 uint32_t algorithm_mac = cipher_aliases[i].algorithm_mac; 749 750 if (algorithm_mkey) 751 if ((algorithm_mkey & mask_mkey) == 0) 752 continue; 753 754 if (algorithm_auth) 755 if ((algorithm_auth & mask_auth) == 0) 756 continue; 757 758 if (algorithm_enc) 759 if ((algorithm_enc & mask_enc) == 0) 760 continue; 761 762 if (algorithm_mac) 763 if ((algorithm_mac & mask_mac) == 0) 764 continue; 765 766 *ca_curr = (SSL_CIPHER *)(cipher_aliases + i); 767 ca_curr++; 768 } 769 770 *ca_curr = NULL; /* end of list */ 771 } 772 773 static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey, 774 uint32_t alg_auth, uint32_t alg_enc, 775 uint32_t alg_mac, int min_tls, 776 uint32_t algo_strength, int rule, 777 int32_t strength_bits, CIPHER_ORDER **head_p, 778 CIPHER_ORDER **tail_p) 779 { 780 CIPHER_ORDER *head, *tail, *curr, *next, *last; 781 const SSL_CIPHER *cp; 782 int reverse = 0; 783 784 #ifdef CIPHER_DEBUG 785 fprintf(stderr, 786 "Applying rule %d with %08x/%08x/%08x/%08x/%08x %08x (%d)\n", 787 rule, alg_mkey, alg_auth, alg_enc, alg_mac, min_tls, 788 algo_strength, strength_bits); 789 #endif 790 791 if (rule == CIPHER_DEL || rule == CIPHER_BUMP) 792 reverse = 1; /* needed to maintain sorting between currently 793 * deleted ciphers */ 794 795 head = *head_p; 796 tail = *tail_p; 797 798 if (reverse) { 799 next = tail; 800 last = head; 801 } else { 802 next = head; 803 last = tail; 804 } 805 806 curr = NULL; 807 for (;;) { 808 if (curr == last) 809 break; 810 811 curr = next; 812 813 if (curr == NULL) 814 break; 815 816 next = reverse ? curr->prev : curr->next; 817 818 cp = curr->cipher; 819 820 /* 821 * Selection criteria is either the value of strength_bits 822 * or the algorithms used. 823 */ 824 if (strength_bits >= 0) { 825 if (strength_bits != cp->strength_bits) 826 continue; 827 } else { 828 #ifdef CIPHER_DEBUG 829 fprintf(stderr, 830 "\nName: %s:\nAlgo = %08x/%08x/%08x/%08x/%08x Algo_strength = %08x\n", 831 cp->name, cp->algorithm_mkey, cp->algorithm_auth, 832 cp->algorithm_enc, cp->algorithm_mac, cp->min_tls, 833 cp->algo_strength); 834 #endif 835 if (cipher_id != 0 && (cipher_id != cp->id)) 836 continue; 837 if (alg_mkey && !(alg_mkey & cp->algorithm_mkey)) 838 continue; 839 if (alg_auth && !(alg_auth & cp->algorithm_auth)) 840 continue; 841 if (alg_enc && !(alg_enc & cp->algorithm_enc)) 842 continue; 843 if (alg_mac && !(alg_mac & cp->algorithm_mac)) 844 continue; 845 if (min_tls && (min_tls != cp->min_tls)) 846 continue; 847 if ((algo_strength & SSL_STRONG_MASK) 848 && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength)) 849 continue; 850 if ((algo_strength & SSL_DEFAULT_MASK) 851 && !(algo_strength & SSL_DEFAULT_MASK & cp->algo_strength)) 852 continue; 853 } 854 855 #ifdef CIPHER_DEBUG 856 fprintf(stderr, "Action = %d\n", rule); 857 #endif 858 859 /* add the cipher if it has not been added yet. */ 860 if (rule == CIPHER_ADD) { 861 /* reverse == 0 */ 862 if (!curr->active) { 863 ll_append_tail(&head, curr, &tail); 864 curr->active = 1; 865 } 866 } 867 /* Move the added cipher to this location */ 868 else if (rule == CIPHER_ORD) { 869 /* reverse == 0 */ 870 if (curr->active) { 871 ll_append_tail(&head, curr, &tail); 872 } 873 } else if (rule == CIPHER_DEL) { 874 /* reverse == 1 */ 875 if (curr->active) { 876 /* 877 * most recently deleted ciphersuites get best positions for 878 * any future CIPHER_ADD (note that the CIPHER_DEL loop works 879 * in reverse to maintain the order) 880 */ 881 ll_append_head(&head, curr, &tail); 882 curr->active = 0; 883 } 884 } else if (rule == CIPHER_BUMP) { 885 if (curr->active) 886 ll_append_head(&head, curr, &tail); 887 } else if (rule == CIPHER_KILL) { 888 /* reverse == 0 */ 889 if (head == curr) 890 head = curr->next; 891 else 892 curr->prev->next = curr->next; 893 if (tail == curr) 894 tail = curr->prev; 895 curr->active = 0; 896 if (curr->next != NULL) 897 curr->next->prev = curr->prev; 898 if (curr->prev != NULL) 899 curr->prev->next = curr->next; 900 curr->next = NULL; 901 curr->prev = NULL; 902 } 903 } 904 905 *head_p = head; 906 *tail_p = tail; 907 } 908 909 static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p, 910 CIPHER_ORDER **tail_p) 911 { 912 int32_t max_strength_bits; 913 int i, *number_uses; 914 CIPHER_ORDER *curr; 915 916 /* 917 * This routine sorts the ciphers with descending strength. The sorting 918 * must keep the pre-sorted sequence, so we apply the normal sorting 919 * routine as '+' movement to the end of the list. 920 */ 921 max_strength_bits = 0; 922 curr = *head_p; 923 while (curr != NULL) { 924 if (curr->active && (curr->cipher->strength_bits > max_strength_bits)) 925 max_strength_bits = curr->cipher->strength_bits; 926 curr = curr->next; 927 } 928 929 number_uses = OPENSSL_zalloc(sizeof(int) * (max_strength_bits + 1)); 930 if (number_uses == NULL) { 931 SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT, ERR_R_MALLOC_FAILURE); 932 return 0; 933 } 934 935 /* 936 * Now find the strength_bits values actually used 937 */ 938 curr = *head_p; 939 while (curr != NULL) { 940 if (curr->active) 941 number_uses[curr->cipher->strength_bits]++; 942 curr = curr->next; 943 } 944 /* 945 * Go through the list of used strength_bits values in descending 946 * order. 947 */ 948 for (i = max_strength_bits; i >= 0; i--) 949 if (number_uses[i] > 0) 950 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, 951 tail_p); 952 953 OPENSSL_free(number_uses); 954 return 1; 955 } 956 957 static int ssl_cipher_process_rulestr(const char *rule_str, 958 CIPHER_ORDER **head_p, 959 CIPHER_ORDER **tail_p, 960 const SSL_CIPHER **ca_list, CERT *c) 961 { 962 uint32_t alg_mkey, alg_auth, alg_enc, alg_mac, algo_strength; 963 int min_tls; 964 const char *l, *buf; 965 int j, multi, found, rule, retval, ok, buflen; 966 uint32_t cipher_id = 0; 967 char ch; 968 969 retval = 1; 970 l = rule_str; 971 for ( ; ; ) { 972 ch = *l; 973 974 if (ch == '\0') 975 break; /* done */ 976 if (ch == '-') { 977 rule = CIPHER_DEL; 978 l++; 979 } else if (ch == '+') { 980 rule = CIPHER_ORD; 981 l++; 982 } else if (ch == '!') { 983 rule = CIPHER_KILL; 984 l++; 985 } else if (ch == '@') { 986 rule = CIPHER_SPECIAL; 987 l++; 988 } else { 989 rule = CIPHER_ADD; 990 } 991 992 if (ITEM_SEP(ch)) { 993 l++; 994 continue; 995 } 996 997 alg_mkey = 0; 998 alg_auth = 0; 999 alg_enc = 0; 1000 alg_mac = 0; 1001 min_tls = 0; 1002 algo_strength = 0; 1003 1004 for (;;) { 1005 ch = *l; 1006 buf = l; 1007 buflen = 0; 1008 #ifndef CHARSET_EBCDIC 1009 while (((ch >= 'A') && (ch <= 'Z')) || 1010 ((ch >= '0') && (ch <= '9')) || 1011 ((ch >= 'a') && (ch <= 'z')) || 1012 (ch == '-') || (ch == '.') || (ch == '=')) 1013 #else 1014 while (isalnum((unsigned char)ch) || (ch == '-') || (ch == '.') 1015 || (ch == '=')) 1016 #endif 1017 { 1018 ch = *(++l); 1019 buflen++; 1020 } 1021 1022 if (buflen == 0) { 1023 /* 1024 * We hit something we cannot deal with, 1025 * it is no command or separator nor 1026 * alphanumeric, so we call this an error. 1027 */ 1028 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND); 1029 retval = found = 0; 1030 l++; 1031 break; 1032 } 1033 1034 if (rule == CIPHER_SPECIAL) { 1035 found = 0; /* unused -- avoid compiler warning */ 1036 break; /* special treatment */ 1037 } 1038 1039 /* check for multi-part specification */ 1040 if (ch == '+') { 1041 multi = 1; 1042 l++; 1043 } else { 1044 multi = 0; 1045 } 1046 1047 /* 1048 * Now search for the cipher alias in the ca_list. Be careful 1049 * with the strncmp, because the "buflen" limitation 1050 * will make the rule "ADH:SOME" and the cipher 1051 * "ADH-MY-CIPHER" look like a match for buflen=3. 1052 * So additionally check whether the cipher name found 1053 * has the correct length. We can save a strlen() call: 1054 * just checking for the '\0' at the right place is 1055 * sufficient, we have to strncmp() anyway. (We cannot 1056 * use strcmp(), because buf is not '\0' terminated.) 1057 */ 1058 j = found = 0; 1059 cipher_id = 0; 1060 while (ca_list[j]) { 1061 if (strncmp(buf, ca_list[j]->name, buflen) == 0 1062 && (ca_list[j]->name[buflen] == '\0')) { 1063 found = 1; 1064 break; 1065 } else 1066 j++; 1067 } 1068 1069 if (!found) 1070 break; /* ignore this entry */ 1071 1072 if (ca_list[j]->algorithm_mkey) { 1073 if (alg_mkey) { 1074 alg_mkey &= ca_list[j]->algorithm_mkey; 1075 if (!alg_mkey) { 1076 found = 0; 1077 break; 1078 } 1079 } else { 1080 alg_mkey = ca_list[j]->algorithm_mkey; 1081 } 1082 } 1083 1084 if (ca_list[j]->algorithm_auth) { 1085 if (alg_auth) { 1086 alg_auth &= ca_list[j]->algorithm_auth; 1087 if (!alg_auth) { 1088 found = 0; 1089 break; 1090 } 1091 } else { 1092 alg_auth = ca_list[j]->algorithm_auth; 1093 } 1094 } 1095 1096 if (ca_list[j]->algorithm_enc) { 1097 if (alg_enc) { 1098 alg_enc &= ca_list[j]->algorithm_enc; 1099 if (!alg_enc) { 1100 found = 0; 1101 break; 1102 } 1103 } else { 1104 alg_enc = ca_list[j]->algorithm_enc; 1105 } 1106 } 1107 1108 if (ca_list[j]->algorithm_mac) { 1109 if (alg_mac) { 1110 alg_mac &= ca_list[j]->algorithm_mac; 1111 if (!alg_mac) { 1112 found = 0; 1113 break; 1114 } 1115 } else { 1116 alg_mac = ca_list[j]->algorithm_mac; 1117 } 1118 } 1119 1120 if (ca_list[j]->algo_strength & SSL_STRONG_MASK) { 1121 if (algo_strength & SSL_STRONG_MASK) { 1122 algo_strength &= 1123 (ca_list[j]->algo_strength & SSL_STRONG_MASK) | 1124 ~SSL_STRONG_MASK; 1125 if (!(algo_strength & SSL_STRONG_MASK)) { 1126 found = 0; 1127 break; 1128 } 1129 } else { 1130 algo_strength = ca_list[j]->algo_strength & SSL_STRONG_MASK; 1131 } 1132 } 1133 1134 if (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) { 1135 if (algo_strength & SSL_DEFAULT_MASK) { 1136 algo_strength &= 1137 (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) | 1138 ~SSL_DEFAULT_MASK; 1139 if (!(algo_strength & SSL_DEFAULT_MASK)) { 1140 found = 0; 1141 break; 1142 } 1143 } else { 1144 algo_strength |= 1145 ca_list[j]->algo_strength & SSL_DEFAULT_MASK; 1146 } 1147 } 1148 1149 if (ca_list[j]->valid) { 1150 /* 1151 * explicit ciphersuite found; its protocol version does not 1152 * become part of the search pattern! 1153 */ 1154 1155 cipher_id = ca_list[j]->id; 1156 } else { 1157 /* 1158 * not an explicit ciphersuite; only in this case, the 1159 * protocol version is considered part of the search pattern 1160 */ 1161 1162 if (ca_list[j]->min_tls) { 1163 if (min_tls != 0 && min_tls != ca_list[j]->min_tls) { 1164 found = 0; 1165 break; 1166 } else { 1167 min_tls = ca_list[j]->min_tls; 1168 } 1169 } 1170 } 1171 1172 if (!multi) 1173 break; 1174 } 1175 1176 /* 1177 * Ok, we have the rule, now apply it 1178 */ 1179 if (rule == CIPHER_SPECIAL) { /* special command */ 1180 ok = 0; 1181 if ((buflen == 8) && strncmp(buf, "STRENGTH", 8) == 0) { 1182 ok = ssl_cipher_strength_sort(head_p, tail_p); 1183 } else if (buflen == 10 && strncmp(buf, "SECLEVEL=", 9) == 0) { 1184 int level = buf[9] - '0'; 1185 if (level < 0 || level > 5) { 1186 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1187 SSL_R_INVALID_COMMAND); 1188 } else { 1189 c->sec_level = level; 1190 ok = 1; 1191 } 1192 } else { 1193 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND); 1194 } 1195 if (ok == 0) 1196 retval = 0; 1197 /* 1198 * We do not support any "multi" options 1199 * together with "@", so throw away the 1200 * rest of the command, if any left, until 1201 * end or ':' is found. 1202 */ 1203 while ((*l != '\0') && !ITEM_SEP(*l)) 1204 l++; 1205 } else if (found) { 1206 ssl_cipher_apply_rule(cipher_id, 1207 alg_mkey, alg_auth, alg_enc, alg_mac, 1208 min_tls, algo_strength, rule, -1, head_p, 1209 tail_p); 1210 } else { 1211 while ((*l != '\0') && !ITEM_SEP(*l)) 1212 l++; 1213 } 1214 if (*l == '\0') 1215 break; /* done */ 1216 } 1217 1218 return retval; 1219 } 1220 1221 #ifndef OPENSSL_NO_EC 1222 static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c, 1223 const char **prule_str) 1224 { 1225 unsigned int suiteb_flags = 0, suiteb_comb2 = 0; 1226 if (strncmp(*prule_str, "SUITEB128ONLY", 13) == 0) { 1227 suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY; 1228 } else if (strncmp(*prule_str, "SUITEB128C2", 11) == 0) { 1229 suiteb_comb2 = 1; 1230 suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS; 1231 } else if (strncmp(*prule_str, "SUITEB128", 9) == 0) { 1232 suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS; 1233 } else if (strncmp(*prule_str, "SUITEB192", 9) == 0) { 1234 suiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS; 1235 } 1236 1237 if (suiteb_flags) { 1238 c->cert_flags &= ~SSL_CERT_FLAG_SUITEB_128_LOS; 1239 c->cert_flags |= suiteb_flags; 1240 } else { 1241 suiteb_flags = c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS; 1242 } 1243 1244 if (!suiteb_flags) 1245 return 1; 1246 /* Check version: if TLS 1.2 ciphers allowed we can use Suite B */ 1247 1248 if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)) { 1249 SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, 1250 SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE); 1251 return 0; 1252 } 1253 # ifndef OPENSSL_NO_EC 1254 switch (suiteb_flags) { 1255 case SSL_CERT_FLAG_SUITEB_128_LOS: 1256 if (suiteb_comb2) 1257 *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384"; 1258 else 1259 *prule_str = 1260 "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384"; 1261 break; 1262 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY: 1263 *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256"; 1264 break; 1265 case SSL_CERT_FLAG_SUITEB_192_LOS: 1266 *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384"; 1267 break; 1268 } 1269 return 1; 1270 # else 1271 SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE); 1272 return 0; 1273 # endif 1274 } 1275 #endif 1276 1277 static int ciphersuite_cb(const char *elem, int len, void *arg) 1278 { 1279 STACK_OF(SSL_CIPHER) *ciphersuites = (STACK_OF(SSL_CIPHER) *)arg; 1280 const SSL_CIPHER *cipher; 1281 /* Arbitrary sized temp buffer for the cipher name. Should be big enough */ 1282 char name[80]; 1283 1284 if (len > (int)(sizeof(name) - 1)) { 1285 SSLerr(SSL_F_CIPHERSUITE_CB, SSL_R_NO_CIPHER_MATCH); 1286 return 0; 1287 } 1288 1289 memcpy(name, elem, len); 1290 name[len] = '\0'; 1291 1292 cipher = ssl3_get_cipher_by_std_name(name); 1293 if (cipher == NULL) { 1294 SSLerr(SSL_F_CIPHERSUITE_CB, SSL_R_NO_CIPHER_MATCH); 1295 return 0; 1296 } 1297 1298 if (!sk_SSL_CIPHER_push(ciphersuites, cipher)) { 1299 SSLerr(SSL_F_CIPHERSUITE_CB, ERR_R_INTERNAL_ERROR); 1300 return 0; 1301 } 1302 1303 return 1; 1304 } 1305 1306 static __owur int set_ciphersuites(STACK_OF(SSL_CIPHER) **currciphers, const char *str) 1307 { 1308 STACK_OF(SSL_CIPHER) *newciphers = sk_SSL_CIPHER_new_null(); 1309 1310 if (newciphers == NULL) 1311 return 0; 1312 1313 /* Parse the list. We explicitly allow an empty list */ 1314 if (*str != '\0' 1315 && !CONF_parse_list(str, ':', 1, ciphersuite_cb, newciphers)) { 1316 sk_SSL_CIPHER_free(newciphers); 1317 return 0; 1318 } 1319 sk_SSL_CIPHER_free(*currciphers); 1320 *currciphers = newciphers; 1321 1322 return 1; 1323 } 1324 1325 static int update_cipher_list_by_id(STACK_OF(SSL_CIPHER) **cipher_list_by_id, 1326 STACK_OF(SSL_CIPHER) *cipherstack) 1327 { 1328 STACK_OF(SSL_CIPHER) *tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack); 1329 1330 if (tmp_cipher_list == NULL) { 1331 return 0; 1332 } 1333 1334 sk_SSL_CIPHER_free(*cipher_list_by_id); 1335 *cipher_list_by_id = tmp_cipher_list; 1336 1337 (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp); 1338 sk_SSL_CIPHER_sort(*cipher_list_by_id); 1339 1340 return 1; 1341 } 1342 1343 static int update_cipher_list(STACK_OF(SSL_CIPHER) **cipher_list, 1344 STACK_OF(SSL_CIPHER) **cipher_list_by_id, 1345 STACK_OF(SSL_CIPHER) *tls13_ciphersuites) 1346 { 1347 int i; 1348 STACK_OF(SSL_CIPHER) *tmp_cipher_list = sk_SSL_CIPHER_dup(*cipher_list); 1349 1350 if (tmp_cipher_list == NULL) 1351 return 0; 1352 1353 /* 1354 * Delete any existing TLSv1.3 ciphersuites. These are always first in the 1355 * list. 1356 */ 1357 while (sk_SSL_CIPHER_num(tmp_cipher_list) > 0 1358 && sk_SSL_CIPHER_value(tmp_cipher_list, 0)->min_tls 1359 == TLS1_3_VERSION) 1360 sk_SSL_CIPHER_delete(tmp_cipher_list, 0); 1361 1362 /* Insert the new TLSv1.3 ciphersuites */ 1363 for (i = 0; i < sk_SSL_CIPHER_num(tls13_ciphersuites); i++) 1364 sk_SSL_CIPHER_insert(tmp_cipher_list, 1365 sk_SSL_CIPHER_value(tls13_ciphersuites, i), i); 1366 1367 if (!update_cipher_list_by_id(cipher_list_by_id, tmp_cipher_list)) 1368 return 0; 1369 1370 sk_SSL_CIPHER_free(*cipher_list); 1371 *cipher_list = tmp_cipher_list; 1372 1373 return 1; 1374 } 1375 1376 int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str) 1377 { 1378 int ret = set_ciphersuites(&(ctx->tls13_ciphersuites), str); 1379 1380 if (ret && ctx->cipher_list != NULL) 1381 return update_cipher_list(&ctx->cipher_list, &ctx->cipher_list_by_id, 1382 ctx->tls13_ciphersuites); 1383 1384 return ret; 1385 } 1386 1387 int SSL_set_ciphersuites(SSL *s, const char *str) 1388 { 1389 STACK_OF(SSL_CIPHER) *cipher_list; 1390 int ret = set_ciphersuites(&(s->tls13_ciphersuites), str); 1391 1392 if (s->cipher_list == NULL) { 1393 if ((cipher_list = SSL_get_ciphers(s)) != NULL) 1394 s->cipher_list = sk_SSL_CIPHER_dup(cipher_list); 1395 } 1396 if (ret && s->cipher_list != NULL) 1397 return update_cipher_list(&s->cipher_list, &s->cipher_list_by_id, 1398 s->tls13_ciphersuites); 1399 1400 return ret; 1401 } 1402 1403 STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, 1404 STACK_OF(SSL_CIPHER) *tls13_ciphersuites, 1405 STACK_OF(SSL_CIPHER) **cipher_list, 1406 STACK_OF(SSL_CIPHER) **cipher_list_by_id, 1407 const char *rule_str, 1408 CERT *c) 1409 { 1410 int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases, i; 1411 uint32_t disabled_mkey, disabled_auth, disabled_enc, disabled_mac; 1412 STACK_OF(SSL_CIPHER) *cipherstack; 1413 const char *rule_p; 1414 CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr; 1415 const SSL_CIPHER **ca_list = NULL; 1416 1417 /* 1418 * Return with error if nothing to do. 1419 */ 1420 if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL) 1421 return NULL; 1422 #ifndef OPENSSL_NO_EC 1423 if (!check_suiteb_cipher_list(ssl_method, c, &rule_str)) 1424 return NULL; 1425 #endif 1426 1427 /* 1428 * To reduce the work to do we only want to process the compiled 1429 * in algorithms, so we first get the mask of disabled ciphers. 1430 */ 1431 1432 disabled_mkey = disabled_mkey_mask; 1433 disabled_auth = disabled_auth_mask; 1434 disabled_enc = disabled_enc_mask; 1435 disabled_mac = disabled_mac_mask; 1436 1437 /* 1438 * Now we have to collect the available ciphers from the compiled 1439 * in ciphers. We cannot get more than the number compiled in, so 1440 * it is used for allocation. 1441 */ 1442 num_of_ciphers = ssl_method->num_ciphers(); 1443 1444 co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers); 1445 if (co_list == NULL) { 1446 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 1447 return NULL; /* Failure */ 1448 } 1449 1450 ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, 1451 disabled_mkey, disabled_auth, disabled_enc, 1452 disabled_mac, co_list, &head, &tail); 1453 1454 /* Now arrange all ciphers by preference. */ 1455 1456 /* 1457 * Everything else being equal, prefer ephemeral ECDH over other key 1458 * exchange mechanisms. 1459 * For consistency, prefer ECDSA over RSA (though this only matters if the 1460 * server has both certificates, and is using the DEFAULT, or a client 1461 * preference). 1462 */ 1463 ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD, 1464 -1, &head, &tail); 1465 ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, 1466 &tail); 1467 ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, 1468 &tail); 1469 1470 /* Within each strength group, we prefer GCM over CHACHA... */ 1471 ssl_cipher_apply_rule(0, 0, 0, SSL_AESGCM, 0, 0, 0, CIPHER_ADD, -1, 1472 &head, &tail); 1473 ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20, 0, 0, 0, CIPHER_ADD, -1, 1474 &head, &tail); 1475 1476 /* 1477 * ...and generally, our preferred cipher is AES. 1478 * Note that AEADs will be bumped to take preference after sorting by 1479 * strength. 1480 */ 1481 ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD, 1482 -1, &head, &tail); 1483 1484 /* Temporarily enable everything else for sorting */ 1485 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); 1486 1487 /* Low priority for MD5 */ 1488 ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head, 1489 &tail); 1490 1491 /* 1492 * Move anonymous ciphers to the end. Usually, these will remain 1493 * disabled. (For applications that allow them, they aren't too bad, but 1494 * we prefer authenticated ciphers.) 1495 */ 1496 ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head, 1497 &tail); 1498 1499 ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, 1500 &tail); 1501 ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, 1502 &tail); 1503 1504 /* RC4 is sort-of broken -- move to the end */ 1505 ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, 1506 &tail); 1507 1508 /* 1509 * Now sort by symmetric encryption strength. The above ordering remains 1510 * in force within each class 1511 */ 1512 if (!ssl_cipher_strength_sort(&head, &tail)) { 1513 OPENSSL_free(co_list); 1514 return NULL; 1515 } 1516 1517 /* 1518 * Partially overrule strength sort to prefer TLS 1.2 ciphers/PRFs. 1519 * TODO(openssl-team): is there an easier way to accomplish all this? 1520 */ 1521 ssl_cipher_apply_rule(0, 0, 0, 0, 0, TLS1_2_VERSION, 0, CIPHER_BUMP, -1, 1522 &head, &tail); 1523 1524 /* 1525 * Irrespective of strength, enforce the following order: 1526 * (EC)DHE + AEAD > (EC)DHE > rest of AEAD > rest. 1527 * Within each group, ciphers remain sorted by strength and previous 1528 * preference, i.e., 1529 * 1) ECDHE > DHE 1530 * 2) GCM > CHACHA 1531 * 3) AES > rest 1532 * 4) TLS 1.2 > legacy 1533 * 1534 * Because we now bump ciphers to the top of the list, we proceed in 1535 * reverse order of preference. 1536 */ 1537 ssl_cipher_apply_rule(0, 0, 0, 0, SSL_AEAD, 0, 0, CIPHER_BUMP, -1, 1538 &head, &tail); 1539 ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, 0, 0, 0, 1540 CIPHER_BUMP, -1, &head, &tail); 1541 ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, SSL_AEAD, 0, 0, 1542 CIPHER_BUMP, -1, &head, &tail); 1543 1544 /* Now disable everything (maintaining the ordering!) */ 1545 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); 1546 1547 /* 1548 * We also need cipher aliases for selecting based on the rule_str. 1549 * There might be two types of entries in the rule_str: 1) names 1550 * of ciphers themselves 2) aliases for groups of ciphers. 1551 * For 1) we need the available ciphers and for 2) the cipher 1552 * groups of cipher_aliases added together in one list (otherwise 1553 * we would be happy with just the cipher_aliases table). 1554 */ 1555 num_of_group_aliases = OSSL_NELEM(cipher_aliases); 1556 num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1; 1557 ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max); 1558 if (ca_list == NULL) { 1559 OPENSSL_free(co_list); 1560 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 1561 return NULL; /* Failure */ 1562 } 1563 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, 1564 disabled_mkey, disabled_auth, disabled_enc, 1565 disabled_mac, head); 1566 1567 /* 1568 * If the rule_string begins with DEFAULT, apply the default rule 1569 * before using the (possibly available) additional rules. 1570 */ 1571 ok = 1; 1572 rule_p = rule_str; 1573 if (strncmp(rule_str, "DEFAULT", 7) == 0) { 1574 ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, 1575 &head, &tail, ca_list, c); 1576 rule_p += 7; 1577 if (*rule_p == ':') 1578 rule_p++; 1579 } 1580 1581 if (ok && (strlen(rule_p) > 0)) 1582 ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c); 1583 1584 OPENSSL_free(ca_list); /* Not needed anymore */ 1585 1586 if (!ok) { /* Rule processing failure */ 1587 OPENSSL_free(co_list); 1588 return NULL; 1589 } 1590 1591 /* 1592 * Allocate new "cipherstack" for the result, return with error 1593 * if we cannot get one. 1594 */ 1595 if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) { 1596 OPENSSL_free(co_list); 1597 return NULL; 1598 } 1599 1600 /* Add TLSv1.3 ciphers first - we always prefer those if possible */ 1601 for (i = 0; i < sk_SSL_CIPHER_num(tls13_ciphersuites); i++) { 1602 if (!sk_SSL_CIPHER_push(cipherstack, 1603 sk_SSL_CIPHER_value(tls13_ciphersuites, i))) { 1604 sk_SSL_CIPHER_free(cipherstack); 1605 return NULL; 1606 } 1607 } 1608 1609 /* 1610 * The cipher selection for the list is done. The ciphers are added 1611 * to the resulting precedence to the STACK_OF(SSL_CIPHER). 1612 */ 1613 for (curr = head; curr != NULL; curr = curr->next) { 1614 if (curr->active) { 1615 if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) { 1616 OPENSSL_free(co_list); 1617 sk_SSL_CIPHER_free(cipherstack); 1618 return NULL; 1619 } 1620 #ifdef CIPHER_DEBUG 1621 fprintf(stderr, "<%s>\n", curr->cipher->name); 1622 #endif 1623 } 1624 } 1625 OPENSSL_free(co_list); /* Not needed any longer */ 1626 1627 if (!update_cipher_list_by_id(cipher_list_by_id, cipherstack)) { 1628 sk_SSL_CIPHER_free(cipherstack); 1629 return NULL; 1630 } 1631 sk_SSL_CIPHER_free(*cipher_list); 1632 *cipher_list = cipherstack; 1633 1634 return cipherstack; 1635 } 1636 1637 char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) 1638 { 1639 const char *ver; 1640 const char *kx, *au, *enc, *mac; 1641 uint32_t alg_mkey, alg_auth, alg_enc, alg_mac; 1642 static const char *format = "%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s\n"; 1643 1644 if (buf == NULL) { 1645 len = 128; 1646 if ((buf = OPENSSL_malloc(len)) == NULL) { 1647 SSLerr(SSL_F_SSL_CIPHER_DESCRIPTION, ERR_R_MALLOC_FAILURE); 1648 return NULL; 1649 } 1650 } else if (len < 128) { 1651 return NULL; 1652 } 1653 1654 alg_mkey = cipher->algorithm_mkey; 1655 alg_auth = cipher->algorithm_auth; 1656 alg_enc = cipher->algorithm_enc; 1657 alg_mac = cipher->algorithm_mac; 1658 1659 ver = ssl_protocol_to_string(cipher->min_tls); 1660 1661 switch (alg_mkey) { 1662 case SSL_kRSA: 1663 kx = "RSA"; 1664 break; 1665 case SSL_kDHE: 1666 kx = "DH"; 1667 break; 1668 case SSL_kECDHE: 1669 kx = "ECDH"; 1670 break; 1671 case SSL_kPSK: 1672 kx = "PSK"; 1673 break; 1674 case SSL_kRSAPSK: 1675 kx = "RSAPSK"; 1676 break; 1677 case SSL_kECDHEPSK: 1678 kx = "ECDHEPSK"; 1679 break; 1680 case SSL_kDHEPSK: 1681 kx = "DHEPSK"; 1682 break; 1683 case SSL_kSRP: 1684 kx = "SRP"; 1685 break; 1686 case SSL_kGOST: 1687 kx = "GOST"; 1688 break; 1689 case SSL_kANY: 1690 kx = "any"; 1691 break; 1692 default: 1693 kx = "unknown"; 1694 } 1695 1696 switch (alg_auth) { 1697 case SSL_aRSA: 1698 au = "RSA"; 1699 break; 1700 case SSL_aDSS: 1701 au = "DSS"; 1702 break; 1703 case SSL_aNULL: 1704 au = "None"; 1705 break; 1706 case SSL_aECDSA: 1707 au = "ECDSA"; 1708 break; 1709 case SSL_aPSK: 1710 au = "PSK"; 1711 break; 1712 case SSL_aSRP: 1713 au = "SRP"; 1714 break; 1715 case SSL_aGOST01: 1716 au = "GOST01"; 1717 break; 1718 /* New GOST ciphersuites have both SSL_aGOST12 and SSL_aGOST01 bits */ 1719 case (SSL_aGOST12 | SSL_aGOST01): 1720 au = "GOST12"; 1721 break; 1722 case SSL_aANY: 1723 au = "any"; 1724 break; 1725 default: 1726 au = "unknown"; 1727 break; 1728 } 1729 1730 switch (alg_enc) { 1731 case SSL_DES: 1732 enc = "DES(56)"; 1733 break; 1734 case SSL_3DES: 1735 enc = "3DES(168)"; 1736 break; 1737 case SSL_RC4: 1738 enc = "RC4(128)"; 1739 break; 1740 case SSL_RC2: 1741 enc = "RC2(128)"; 1742 break; 1743 case SSL_IDEA: 1744 enc = "IDEA(128)"; 1745 break; 1746 case SSL_eNULL: 1747 enc = "None"; 1748 break; 1749 case SSL_AES128: 1750 enc = "AES(128)"; 1751 break; 1752 case SSL_AES256: 1753 enc = "AES(256)"; 1754 break; 1755 case SSL_AES128GCM: 1756 enc = "AESGCM(128)"; 1757 break; 1758 case SSL_AES256GCM: 1759 enc = "AESGCM(256)"; 1760 break; 1761 case SSL_AES128CCM: 1762 enc = "AESCCM(128)"; 1763 break; 1764 case SSL_AES256CCM: 1765 enc = "AESCCM(256)"; 1766 break; 1767 case SSL_AES128CCM8: 1768 enc = "AESCCM8(128)"; 1769 break; 1770 case SSL_AES256CCM8: 1771 enc = "AESCCM8(256)"; 1772 break; 1773 case SSL_CAMELLIA128: 1774 enc = "Camellia(128)"; 1775 break; 1776 case SSL_CAMELLIA256: 1777 enc = "Camellia(256)"; 1778 break; 1779 case SSL_ARIA128GCM: 1780 enc = "ARIAGCM(128)"; 1781 break; 1782 case SSL_ARIA256GCM: 1783 enc = "ARIAGCM(256)"; 1784 break; 1785 case SSL_SEED: 1786 enc = "SEED(128)"; 1787 break; 1788 case SSL_eGOST2814789CNT: 1789 case SSL_eGOST2814789CNT12: 1790 enc = "GOST89(256)"; 1791 break; 1792 case SSL_CHACHA20POLY1305: 1793 enc = "CHACHA20/POLY1305(256)"; 1794 break; 1795 default: 1796 enc = "unknown"; 1797 break; 1798 } 1799 1800 switch (alg_mac) { 1801 case SSL_MD5: 1802 mac = "MD5"; 1803 break; 1804 case SSL_SHA1: 1805 mac = "SHA1"; 1806 break; 1807 case SSL_SHA256: 1808 mac = "SHA256"; 1809 break; 1810 case SSL_SHA384: 1811 mac = "SHA384"; 1812 break; 1813 case SSL_AEAD: 1814 mac = "AEAD"; 1815 break; 1816 case SSL_GOST89MAC: 1817 case SSL_GOST89MAC12: 1818 mac = "GOST89"; 1819 break; 1820 case SSL_GOST94: 1821 mac = "GOST94"; 1822 break; 1823 case SSL_GOST12_256: 1824 case SSL_GOST12_512: 1825 mac = "GOST2012"; 1826 break; 1827 default: 1828 mac = "unknown"; 1829 break; 1830 } 1831 1832 BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac); 1833 1834 return buf; 1835 } 1836 1837 const char *SSL_CIPHER_get_version(const SSL_CIPHER *c) 1838 { 1839 if (c == NULL) 1840 return "(NONE)"; 1841 1842 /* 1843 * Backwards-compatibility crutch. In almost all contexts we report TLS 1844 * 1.0 as "TLSv1", but for ciphers we report "TLSv1.0". 1845 */ 1846 if (c->min_tls == TLS1_VERSION) 1847 return "TLSv1.0"; 1848 return ssl_protocol_to_string(c->min_tls); 1849 } 1850 1851 /* return the actual cipher being used */ 1852 const char *SSL_CIPHER_get_name(const SSL_CIPHER *c) 1853 { 1854 if (c != NULL) 1855 return c->name; 1856 return "(NONE)"; 1857 } 1858 1859 /* return the actual cipher being used in RFC standard name */ 1860 const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c) 1861 { 1862 if (c != NULL) 1863 return c->stdname; 1864 return "(NONE)"; 1865 } 1866 1867 /* return the OpenSSL name based on given RFC standard name */ 1868 const char *OPENSSL_cipher_name(const char *stdname) 1869 { 1870 const SSL_CIPHER *c; 1871 1872 if (stdname == NULL) 1873 return "(NONE)"; 1874 c = ssl3_get_cipher_by_std_name(stdname); 1875 return SSL_CIPHER_get_name(c); 1876 } 1877 1878 /* number of bits for symmetric cipher */ 1879 int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits) 1880 { 1881 int ret = 0; 1882 1883 if (c != NULL) { 1884 if (alg_bits != NULL) 1885 *alg_bits = (int)c->alg_bits; 1886 ret = (int)c->strength_bits; 1887 } 1888 return ret; 1889 } 1890 1891 uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c) 1892 { 1893 return c->id; 1894 } 1895 1896 uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c) 1897 { 1898 return c->id & 0xFFFF; 1899 } 1900 1901 SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n) 1902 { 1903 SSL_COMP *ctmp; 1904 int i, nn; 1905 1906 if ((n == 0) || (sk == NULL)) 1907 return NULL; 1908 nn = sk_SSL_COMP_num(sk); 1909 for (i = 0; i < nn; i++) { 1910 ctmp = sk_SSL_COMP_value(sk, i); 1911 if (ctmp->id == n) 1912 return ctmp; 1913 } 1914 return NULL; 1915 } 1916 1917 #ifdef OPENSSL_NO_COMP 1918 STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) 1919 { 1920 return NULL; 1921 } 1922 1923 STACK_OF(SSL_COMP) *SSL_COMP_set0_compression_methods(STACK_OF(SSL_COMP) 1924 *meths) 1925 { 1926 return meths; 1927 } 1928 1929 int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) 1930 { 1931 return 1; 1932 } 1933 1934 #else 1935 STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) 1936 { 1937 load_builtin_compressions(); 1938 return ssl_comp_methods; 1939 } 1940 1941 STACK_OF(SSL_COMP) *SSL_COMP_set0_compression_methods(STACK_OF(SSL_COMP) 1942 *meths) 1943 { 1944 STACK_OF(SSL_COMP) *old_meths = ssl_comp_methods; 1945 ssl_comp_methods = meths; 1946 return old_meths; 1947 } 1948 1949 static void cmeth_free(SSL_COMP *cm) 1950 { 1951 OPENSSL_free(cm); 1952 } 1953 1954 void ssl_comp_free_compression_methods_int(void) 1955 { 1956 STACK_OF(SSL_COMP) *old_meths = ssl_comp_methods; 1957 ssl_comp_methods = NULL; 1958 sk_SSL_COMP_pop_free(old_meths, cmeth_free); 1959 } 1960 1961 int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) 1962 { 1963 SSL_COMP *comp; 1964 1965 if (cm == NULL || COMP_get_type(cm) == NID_undef) 1966 return 1; 1967 1968 /*- 1969 * According to draft-ietf-tls-compression-04.txt, the 1970 * compression number ranges should be the following: 1971 * 1972 * 0 to 63: methods defined by the IETF 1973 * 64 to 192: external party methods assigned by IANA 1974 * 193 to 255: reserved for private use 1975 */ 1976 if (id < 193 || id > 255) { 1977 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, 1978 SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE); 1979 return 1; 1980 } 1981 1982 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE); 1983 comp = OPENSSL_malloc(sizeof(*comp)); 1984 if (comp == NULL) { 1985 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE); 1986 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, ERR_R_MALLOC_FAILURE); 1987 return 1; 1988 } 1989 1990 comp->id = id; 1991 comp->method = cm; 1992 load_builtin_compressions(); 1993 if (ssl_comp_methods && sk_SSL_COMP_find(ssl_comp_methods, comp) >= 0) { 1994 OPENSSL_free(comp); 1995 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE); 1996 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, 1997 SSL_R_DUPLICATE_COMPRESSION_ID); 1998 return 1; 1999 } 2000 if (ssl_comp_methods == NULL || !sk_SSL_COMP_push(ssl_comp_methods, comp)) { 2001 OPENSSL_free(comp); 2002 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE); 2003 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, ERR_R_MALLOC_FAILURE); 2004 return 1; 2005 } 2006 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE); 2007 return 0; 2008 } 2009 #endif 2010 2011 const char *SSL_COMP_get_name(const COMP_METHOD *comp) 2012 { 2013 #ifndef OPENSSL_NO_COMP 2014 return comp ? COMP_get_name(comp) : NULL; 2015 #else 2016 return NULL; 2017 #endif 2018 } 2019 2020 const char *SSL_COMP_get0_name(const SSL_COMP *comp) 2021 { 2022 #ifndef OPENSSL_NO_COMP 2023 return comp->name; 2024 #else 2025 return NULL; 2026 #endif 2027 } 2028 2029 int SSL_COMP_get_id(const SSL_COMP *comp) 2030 { 2031 #ifndef OPENSSL_NO_COMP 2032 return comp->id; 2033 #else 2034 return -1; 2035 #endif 2036 } 2037 2038 const SSL_CIPHER *ssl_get_cipher_by_char(SSL *ssl, const unsigned char *ptr, 2039 int all) 2040 { 2041 const SSL_CIPHER *c = ssl->method->get_cipher_by_char(ptr); 2042 2043 if (c == NULL || (!all && c->valid == 0)) 2044 return NULL; 2045 return c; 2046 } 2047 2048 const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr) 2049 { 2050 return ssl->method->get_cipher_by_char(ptr); 2051 } 2052 2053 int SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c) 2054 { 2055 int i; 2056 if (c == NULL) 2057 return NID_undef; 2058 i = ssl_cipher_info_lookup(ssl_cipher_table_cipher, c->algorithm_enc); 2059 if (i == -1) 2060 return NID_undef; 2061 return ssl_cipher_table_cipher[i].nid; 2062 } 2063 2064 int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c) 2065 { 2066 int i = ssl_cipher_info_lookup(ssl_cipher_table_mac, c->algorithm_mac); 2067 2068 if (i == -1) 2069 return NID_undef; 2070 return ssl_cipher_table_mac[i].nid; 2071 } 2072 2073 int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c) 2074 { 2075 int i = ssl_cipher_info_lookup(ssl_cipher_table_kx, c->algorithm_mkey); 2076 2077 if (i == -1) 2078 return NID_undef; 2079 return ssl_cipher_table_kx[i].nid; 2080 } 2081 2082 int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c) 2083 { 2084 int i = ssl_cipher_info_lookup(ssl_cipher_table_auth, c->algorithm_auth); 2085 2086 if (i == -1) 2087 return NID_undef; 2088 return ssl_cipher_table_auth[i].nid; 2089 } 2090 2091 const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c) 2092 { 2093 int idx = c->algorithm2 & SSL_HANDSHAKE_MAC_MASK; 2094 2095 if (idx < 0 || idx >= SSL_MD_NUM_IDX) 2096 return NULL; 2097 return ssl_digest_methods[idx]; 2098 } 2099 2100 int SSL_CIPHER_is_aead(const SSL_CIPHER *c) 2101 { 2102 return (c->algorithm_mac & SSL_AEAD) ? 1 : 0; 2103 } 2104 2105 int ssl_cipher_get_overhead(const SSL_CIPHER *c, size_t *mac_overhead, 2106 size_t *int_overhead, size_t *blocksize, 2107 size_t *ext_overhead) 2108 { 2109 size_t mac = 0, in = 0, blk = 0, out = 0; 2110 2111 /* Some hard-coded numbers for the CCM/Poly1305 MAC overhead 2112 * because there are no handy #defines for those. */ 2113 if (c->algorithm_enc & (SSL_AESGCM | SSL_ARIAGCM)) { 2114 out = EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN; 2115 } else if (c->algorithm_enc & (SSL_AES128CCM | SSL_AES256CCM)) { 2116 out = EVP_CCM_TLS_EXPLICIT_IV_LEN + 16; 2117 } else if (c->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) { 2118 out = EVP_CCM_TLS_EXPLICIT_IV_LEN + 8; 2119 } else if (c->algorithm_enc & SSL_CHACHA20POLY1305) { 2120 out = 16; 2121 } else if (c->algorithm_mac & SSL_AEAD) { 2122 /* We're supposed to have handled all the AEAD modes above */ 2123 return 0; 2124 } else { 2125 /* Non-AEAD modes. Calculate MAC/cipher overhead separately */ 2126 int digest_nid = SSL_CIPHER_get_digest_nid(c); 2127 const EVP_MD *e_md = EVP_get_digestbynid(digest_nid); 2128 2129 if (e_md == NULL) 2130 return 0; 2131 2132 mac = EVP_MD_size(e_md); 2133 if (c->algorithm_enc != SSL_eNULL) { 2134 int cipher_nid = SSL_CIPHER_get_cipher_nid(c); 2135 const EVP_CIPHER *e_ciph = EVP_get_cipherbynid(cipher_nid); 2136 2137 /* If it wasn't AEAD or SSL_eNULL, we expect it to be a 2138 known CBC cipher. */ 2139 if (e_ciph == NULL || 2140 EVP_CIPHER_mode(e_ciph) != EVP_CIPH_CBC_MODE) 2141 return 0; 2142 2143 in = 1; /* padding length byte */ 2144 out = EVP_CIPHER_iv_length(e_ciph); 2145 blk = EVP_CIPHER_block_size(e_ciph); 2146 } 2147 } 2148 2149 *mac_overhead = mac; 2150 *int_overhead = in; 2151 *blocksize = blk; 2152 *ext_overhead = out; 2153 2154 return 1; 2155 } 2156 2157 int ssl_cert_is_disabled(size_t idx) 2158 { 2159 const SSL_CERT_LOOKUP *cl = ssl_cert_lookup_by_idx(idx); 2160 2161 if (cl == NULL || (cl->amask & disabled_auth_mask) != 0) 2162 return 1; 2163 return 0; 2164 } 2165