Commit bbb4ceb8 authored by Paul Yang's avatar Paul Yang Committed by Pauli
Browse files

Support converting cipher name to RFC name and vice versa 



Fixes: issue #3747

make SSL_CIPHER_standard_name globally available and introduce a new
function OPENSSL_cipher_name.

A new option '-convert' is also added to 'openssl ciphers' app.

Documentation and test cases are added.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/3859)
parent b8a437ff

apps/ciphers.c

+13 −10
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
typedef enum OPTION_choice {

    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,

    OPT_STDNAME,

    OPT_CONVERT,

    OPT_SSL3,

    OPT_TLS1,

    OPT_TLS1_1,
@@ -47,15 +48,14 @@ const OPTIONS ciphers_options[] = { 
#ifndef OPENSSL_NO_TLS1_3

    {"tls1_3", OPT_TLS1_3, '-', "TLS1.3 mode"},

#endif

#ifndef OPENSSL_NO_SSL_TRACE

    {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},

#endif

#ifndef OPENSSL_NO_PSK

    {"psk", OPT_PSK, '-', "include ciphersuites requiring PSK"},

#endif

#ifndef OPENSSL_NO_SRP

    {"srp", OPT_SRP, '-', "include ciphersuites requiring SRP"},

#endif

    {"convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name"},

    {NULL}

};
@@ -82,9 +82,7 @@ int ciphers_main(int argc, char **argv) 
    STACK_OF(SSL_CIPHER) *sk = NULL;

    const SSL_METHOD *meth = TLS_server_method();

    int ret = 1, i, verbose = 0, Verbose = 0, use_supported = 0;

#ifndef OPENSSL_NO_SSL_TRACE

    int stdname = 0;

#endif

#ifndef OPENSSL_NO_PSK

    int psk = 0;

#endif
@@ -92,7 +90,7 @@ int ciphers_main(int argc, char **argv) 
    int srp = 0;

#endif

    const char *p;

    char *ciphers = NULL, *prog;

    char *ciphers = NULL, *prog, *convert = NULL;

    char buf[512];

    OPTION_CHOICE o;

    int min_version = 0, max_version = 0;
@@ -119,9 +117,10 @@ int ciphers_main(int argc, char **argv) 
            use_supported = 1;

            break;

        case OPT_STDNAME:

#ifndef OPENSSL_NO_SSL_TRACE

            stdname = verbose = 1;

#endif

            break;

        case OPT_CONVERT:

            convert = opt_arg();

            break;

        case OPT_SSL3:

            min_version = SSL3_VERSION;
@@ -163,6 +162,12 @@ int ciphers_main(int argc, char **argv) 
    else if (argc != 0)

        goto opthelp;



    if (convert != NULL) {

        BIO_printf(bio_out, "OpenSSL cipher name: %s\n",

                   OPENSSL_cipher_name(convert));

        goto end;

    }



    ctx = SSL_CTX_new(meth);

    if (ctx == NULL)

        goto err;
@@ -225,14 +230,12 @@ int ciphers_main(int argc, char **argv) 
                else

                    BIO_printf(bio_out, "0x%02X,0x%02X,0x%02X,0x%02X - ", id0, id1, id2, id3); /* whatever */

            }

#ifndef OPENSSL_NO_SSL_TRACE

            if (stdname) {

                const char *nm = SSL_CIPHER_standard_name(c);

                if (nm == NULL)

                    nm = "UNKNOWN";

                BIO_printf(bio_out, "%s - ", nm);

            }

#endif

            BIO_puts(bio_out, SSL_CIPHER_description(c, buf, sizeof buf));

        }

    }
@@ -246,5 +249,5 @@ int ciphers_main(int argc, char **argv) 
        sk_SSL_CIPHER_free(sk);

    SSL_CTX_free(ctx);

    SSL_free(ssl);

    return (ret);

    return ret;

}

doc/man1/ciphers.pod

+11 −2
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ B<openssl> B<ciphers> 
[B<-psk>]

[B<-srp>]

[B<-stdname>]

[B<-convert name>]

[B<cipherlist>]



=head1 DESCRIPTION
@@ -97,8 +98,11 @@ TLSv1.1 were negotiated. 


=item B<-stdname>



Precede each cipher suite by its standard name: only available is OpenSSL

is built with tracing enabled (B<enable-ssl-trace> argument to Configure).

Precede each cipher suite by its standard name.



=item B<-convert name>



Convert a standard cipher B<name> to its OpenSSL name.



=item B<cipherlist>
@@ -752,6 +756,11 @@ L<s_client(1)>, L<s_server(1)>, L<ssl(7)> 


The B<-V> option for the B<ciphers> command was added in OpenSSL 1.0.0.



The B<-stdname> is only available if OpenSSL is built with tracing enabled

(B<enable-ssl-trace> argument to Configure) before OpenSSL 1.1.1.



The B<-convert> was added in OpenSSL 1.1.1.



=head1 COPYRIGHT



Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.

doc/man3/SSL_CIPHER_get_name.pod

+18 −0
Original line number Diff line number Diff line
@@ -3,6 +3,8 @@ 
=head1 NAME



SSL_CIPHER_get_name,

SSL_CIPHER_standard_name,

OPENSSL_cipher_name,

SSL_CIPHER_get_bits,

SSL_CIPHER_get_version,

SSL_CIPHER_description,
@@ -19,6 +21,8 @@ SSL_CIPHER_is_aead 
 #include <openssl/ssl.h>



 const char *SSL_CIPHER_get_name(const SSL_CIPHER *cipher);

 const char *SSL_CIPHER_standard_name(const SSL_CIPHER *cipher);

 const char *OPENSSL_cipher_name(const char *stdname);

 int SSL_CIPHER_get_bits(const SSL_CIPHER *cipher, int *alg_bits);

 char *SSL_CIPHER_get_version(const SSL_CIPHER *cipher);

 char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int size);
@@ -34,6 +38,14 @@ SSL_CIPHER_is_aead 
SSL_CIPHER_get_name() returns a pointer to the name of B<cipher>. If the

B<cipher> is NULL, it returns "(NONE)".



SSL_CIPHER_standard_name() returns a pointer to the standard RFC name of

B<cipher>. If the B<cipher> is NULL, it returns "(NONE)". If the B<cipher>

has no standard name, it returns B<NULL>.



OPENSSL_cipher_name() returns a pointer to the OpenSSL name of B<stdname>.

If the B<stdname> is NULL, or B<stdname> has no corresponding OpenSSL name,

it returns "(NONE)".



SSL_CIPHER_get_bits() returns the number of secret bits used for B<cipher>.

If B<cipher> is NULL, 0 is returned.
@@ -127,6 +139,12 @@ rather than a fixed string, in OpenSSL 1.1.0. 


SSL_CIPHER_get_handshake_digest() was added in OpenSSL 1.1.1.



SSL_CIPHER_standard_name() was globally available in OpenSSL 1.1.1. Before

OpenSSL 1.1.1, tracing (B<enable-ssl-trace> argument to Configure) was

required to enable this function.



OPENSSL_cipher_name() was added in OpenSSL 1.1.1.



=head1 SEE ALSO



L<ssl(7)>, L<SSL_get_current_cipher(3)>,

include/openssl/ssl.h

+2 −1
Original line number Diff line number Diff line
@@ -1434,6 +1434,8 @@ __owur const SSL_CIPHER *SSL_get_current_cipher(const SSL *s); 
__owur int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits);

__owur const char *SSL_CIPHER_get_version(const SSL_CIPHER *c);

__owur const char *SSL_CIPHER_get_name(const SSL_CIPHER *c);

__owur const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c);

__owur const char *OPENSSL_cipher_name(const char *rfc_name);

__owur uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);

__owur int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c);

__owur int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c);
@@ -2034,7 +2036,6 @@ int SSL_CTX_config(SSL_CTX *ctx, const char *name); 
# ifndef OPENSSL_NO_SSL_TRACE

void SSL_trace(int write_p, int version, int content_type,

               const void *buf, size_t len, SSL *ssl, void *arg);

__owur const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c);

# endif



# ifndef OPENSSL_NO_SOCK

include/openssl/ssl3.h

+13 −1
Original line number Diff line number Diff line 
/*

 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved

 *

 * Licensed under the OpenSSL license (the "License").  You may not use
@@ -69,6 +69,18 @@ extern "C" { 
# define SSL3_CK_ADH_DES_64_CBC_SHA              0x0300001A

# define SSL3_CK_ADH_DES_192_CBC_SHA             0x0300001B



/* a bundle of RFC standard cipher names, generated from ssl3_ciphers[] */

# define SSL3_RFC_RSA_NULL_MD5                   "SSL_RSA_WITH_NULL_MD5"

# define SSL3_RFC_RSA_NULL_SHA                   "SSL_RSA_WITH_NULL_SHA"

# define SSL3_RFC_RSA_DES_192_CBC3_SHA           "SSL_RSA_WITH_3DES_EDE_CBC_SHA"

# define SSL3_RFC_DHE_DSS_DES_192_CBC3_SHA       "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"

# define SSL3_RFC_DHE_RSA_DES_192_CBC3_SHA       "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"

# define SSL3_RFC_ADH_DES_192_CBC_SHA            "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA"

# define SSL3_RFC_RSA_IDEA_128_SHA               "SSL_RSA_WITH_IDEA_CBC_SHA"

# define SSL3_RFC_RSA_RC4_128_MD5                "SSL_RSA_WITH_RC4_128_MD5"

# define SSL3_RFC_RSA_RC4_128_SHA                "SSL_RSA_WITH_RC4_128_SHA"

# define SSL3_RFC_ADH_RC4_128_MD5                "SSL_DH_anon_WITH_RC4_128_MD5"



# define SSL3_TXT_RSA_NULL_MD5                   "NULL-MD5"

# define SSL3_TXT_RSA_NULL_SHA                   "NULL-SHA"

# define SSL3_TXT_RSA_RC4_40_MD5                 "EXP-RC4-MD5"