If cipher list contains a match for an explicit ciphersuite only match that (cbb0b734) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+4 −0

Original line number	Diff line number	Diff line
		@@ -4,6 +4,10 @@

		Changes between 0.9.8a and 0.9.8b [XX xxx XXXX]

		*) When applying a cipher rule check to see if string match is an explicit
		cipher suite and only match that one cipher suite if it is.
		[Steve Henson]

		*) Link in manifests for VC++ if needed.
		[Austin Ziegler <halostatue@gmail.com>]

crypto/asn1/t_pkey.c

+30 −30

Original line number	Diff line number	Diff line
		@@ -158,21 +158,21 @@ int RSA_print(BIO bp, const RSA x, int off)
		BIO_snprintf(str,sizeof str,"Modulus (%d bit):", mod_len);
		else
		BUF_strlcpy(str,"modulus:",sizeof str);
		if (!print(bp,str,x->n,m,off)) goto err;
		if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err;
		s=(x->d == NULL)?"Exponent:":"publicExponent:";
		if ((x->e != NULL) && !print(bp,s,x->e,m,off))
		if ((x->e != NULL) && !ASN1_bn_print(bp,s,x->e,m,off))
		goto err;
		if ((x->d != NULL) && !print(bp,"privateExponent:",x->d,m,off))
		if ((x->d != NULL) && !ASN1_bn_print(bp,"privateExponent:",x->d,m,off))
		goto err;
		if ((x->p != NULL) && !print(bp,"prime1:",x->p,m,off))
		if ((x->p != NULL) && !ASN1_bn_print(bp,"prime1:",x->p,m,off))
		goto err;
		if ((x->q != NULL) && !print(bp,"prime2:",x->q,m,off))
		if ((x->q != NULL) && !ASN1_bn_print(bp,"prime2:",x->q,m,off))
		goto err;
		if ((x->dmp1 != NULL) && !print(bp,"exponent1:",x->dmp1,m,off))
		if ((x->dmp1 != NULL) && !ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off))
		goto err;
		if ((x->dmq1 != NULL) && !print(bp,"exponent2:",x->dmq1,m,off))
		if ((x->dmq1 != NULL) && !ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off))
		goto err;
		if ((x->iqmp != NULL) && !print(bp,"coefficient:",x->iqmp,m,off))
		if ((x->iqmp != NULL) && !ASN1_bn_print(bp,"coefficient:",x->iqmp,m,off))
		goto err;
		ret=1;
		err:
		@@ -241,13 +241,13 @@ int DSA_print(BIO bp, const DSA x, int off)
		<= 0) goto err;
		}

		if ((x->priv_key != NULL) && !print(bp,"priv:",x->priv_key,m,off))
		if ((x->priv_key != NULL) && !ASN1_bn_print(bp,"priv:",x->priv_key,m,off))
		goto err;
		if ((x->pub_key != NULL) && !print(bp,"pub: ",x->pub_key,m,off))
		if ((x->pub_key != NULL) && !ASN1_bn_print(bp,"pub: ",x->pub_key,m,off))
		goto err;
		if ((x->p != NULL) && !print(bp,"P: ",x->p,m,off)) goto err;
		if ((x->q != NULL) && !print(bp,"Q: ",x->q,m,off)) goto err;
		if ((x->g != NULL) && !print(bp,"G: ",x->g,m,off)) goto err;
		if ((x->p != NULL) && !ASN1_bn_print(bp,"P: ",x->p,m,off)) goto err;
		if ((x->q != NULL) && !ASN1_bn_print(bp,"Q: ",x->q,m,off)) goto err;
		if ((x->g != NULL) && !ASN1_bn_print(bp,"G: ",x->g,m,off)) goto err;
		ret=1;
		err:
		if (m != NULL) OPENSSL_free(m);
		@@ -430,40 +430,40 @@ int ECPKParameters_print(BIO bp, const EC_GROUP x, int off)
		goto err;

		/* print the polynomial */
		if ((p != NULL) && !print(bp, "Polynomial:", p, buffer,
		if ((p != NULL) && !ASN1_bn_print(bp, "Polynomial:", p, buffer,
		off))
		goto err;
		}
		else
		{
		if ((p != NULL) && !print(bp, "Prime:", p, buffer,off))
		if ((p != NULL) && !ASN1_bn_print(bp, "Prime:", p, buffer,off))
		goto err;
		}
		if ((a != NULL) && !print(bp, "A: ", a, buffer, off))
		if ((a != NULL) && !ASN1_bn_print(bp, "A: ", a, buffer, off))
		goto err;
		if ((b != NULL) && !print(bp, "B: ", b, buffer, off))
		if ((b != NULL) && !ASN1_bn_print(bp, "B: ", b, buffer, off))
		goto err;
		if (form == POINT_CONVERSION_COMPRESSED)
		{
		if ((gen != NULL) && !print(bp, gen_compressed, gen,
		if ((gen != NULL) && !ASN1_bn_print(bp, gen_compressed, gen,
		buffer, off))
		goto err;
		}
		else if (form == POINT_CONVERSION_UNCOMPRESSED)
		{
		if ((gen != NULL) && !print(bp, gen_uncompressed, gen,
		if ((gen != NULL) && !ASN1_bn_print(bp, gen_uncompressed, gen,
		buffer, off))
		goto err;
		}
		else /* form == POINT_CONVERSION_HYBRID */
		{
		if ((gen != NULL) && !print(bp, gen_hybrid, gen,
		if ((gen != NULL) && !ASN1_bn_print(bp, gen_hybrid, gen,
		buffer, off))
		goto err;
		}
		if ((order != NULL) && !print(bp, "Order: ", order,
		if ((order != NULL) && !ASN1_bn_print(bp, "Order: ", order,
		buffer, off)) goto err;
		if ((cofactor != NULL) && !print(bp, "Cofactor: ", cofactor,
		if ((cofactor != NULL) && !ASN1_bn_print(bp, "Cofactor: ", cofactor,
		buffer, off)) goto err;
		if (seed && !print_bin(bp, "Seed:", seed, seed_len, off))
		goto err;
		@@ -543,10 +543,10 @@ int EC_KEY_print(BIO bp, const EC_KEY x, int off)
		BN_num_bits(order)) <= 0) goto err;
		}

		if ((priv_key != NULL) && !print(bp, "priv:", priv_key,
		if ((priv_key != NULL) && !ASN1_bn_print(bp, "priv:", priv_key,
		buffer, off))
		goto err;
		if ((pub_key != NULL) && !print(bp, "pub: ", pub_key,
		if ((pub_key != NULL) && !ASN1_bn_print(bp, "pub: ", pub_key,
		buffer, off))
		goto err;
		if (!ECPKParameters_print(bp, group, off))
		@@ -567,7 +567,7 @@ err:
		}
		#endif /* OPENSSL_NO_EC */

		static int print(BIO bp, const char number, const BIGNUM num, unsigned char buf,
		static int BN_print_pkey(BIO bp, const char number, const BIGNUM num, unsigned char buf,
		int off)
		{
		int n,i;
		@@ -703,8 +703,8 @@ int DHparams_print(BIO bp, const DH x)
		if (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d bit)\n",
		BN_num_bits(x->p)) <= 0)
		goto err;
		if (!print(bp,"prime:",x->p,m,4)) goto err;
		if (!print(bp,"generator:",x->g,m,4)) goto err;
		if (!ASN1_bn_print(bp,"prime:",x->p,m,4)) goto err;
		if (!ASN1_bn_print(bp,"generator:",x->g,m,4)) goto err;
		if (x->length != 0)
		{
		if (BIO_printf(bp," recommended-private-length: %d bits\n",
		@@ -769,9 +769,9 @@ int DSAparams_print(BIO bp, const DSA x)
		if (BIO_printf(bp,"DSA-Parameters: (%d bit)\n",
		BN_num_bits(x->p)) <= 0)
		goto err;
		if (!print(bp,"p:",x->p,m,4)) goto err;
		if ((x->q != NULL) && !print(bp,"q:",x->q,m,4)) goto err;
		if ((x->g != NULL) && !print(bp,"g:",x->g,m,4)) goto err;
		if (!ASN1_bn_print(bp,"p:",x->p,m,4)) goto err;
		if ((x->q != NULL) && !ASN1_bn_print(bp,"q:",x->q,m,4)) goto err;
		if ((x->g != NULL) && !ASN1_bn_print(bp,"g:",x->g,m,4)) goto err;
		ret=1;
		err:
		if (m != NULL) OPENSSL_free(m);

ssl/ssl_ciph.c

+21 −4

Original line number	Diff line number	Diff line
		@@ -482,7 +482,8 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
		ca_curr = NULL; / end of list */
		}

		static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
		static void ssl_cipher_apply_rule(unsigned long cipher_id,
		unsigned long algorithms, unsigned long mask,
		unsigned long algo_strength, unsigned long mask_strength,
		int rule, int strength_bits, CIPHER_ORDER *co_list,
		CIPHER_ORDER head_p, CIPHER_ORDER tail_p)
		@@ -508,11 +509,19 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,

		cp = curr->cipher;

		/* If explicit cipher suite match that one only */

		if (cipher_id)
		{
		if (cp->id != cipher_id)
		continue;
		}

		/*
		* Selection criteria is either the number of strength_bits
		* or the algorithm used.
		*/
		if (strength_bits == -1)
		else if (strength_bits == -1)
		{
		ma = mask & cp->algorithms;
		ma_s = mask_strength & cp->algo_strength;
		@@ -625,7 +634,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list,
		*/
		for (i = max_strength_bits; i >= 0; i--)
		if (number_uses[i] > 0)
		ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
		ssl_cipher_apply_rule(0, 0, 0, 0, 0, CIPHER_ORD, i,
		co_list, head_p, tail_p);

		OPENSSL_free(number_uses);
		@@ -639,6 +648,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
		unsigned long algorithms, mask, algo_strength, mask_strength;
		const char l, start, *buf;
		int j, multi, found, rule, retval, ok, buflen;
		unsigned long cipher_id;
		char ch;

		retval = 1;
		@@ -728,6 +738,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
		* use strcmp(), because buf is not '\0' terminated.)
		*/
		j = found = 0;
		cipher_id = 0;
		while (ca_list[j])
		{
		if (!strncmp(buf, ca_list[j]->name, buflen) &&
		@@ -742,6 +753,12 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
		if (!found)
		break; /* ignore this entry */

		if (ca_list[j]->valid)
		{
		cipher_id = ca_list[j]->id;
		break;
		}

		/* New algorithms:
		* 1 - any old restrictions apply outside new mask
		* 2 - any new restrictions apply outside old mask
		@@ -785,7 +802,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
		}
		else if (found)
		{
		ssl_cipher_apply_rule(algorithms, mask,
		ssl_cipher_apply_rule(cipher_id, algorithms, mask,
		algo_strength, mask_strength, rule, -1,
		co_list, head_p, tail_p);
		}