OpenSSL CVS Repository
http://cvs.openssl.org/
____________________________________________________________
________________
Server: cvs.openssl.org Name: Dr.
Stephen Henson
Root: /v/openssl/cvs Email: steve openssl.org
Module: openssl Date:
15-Apr-2006 02:22:35
Branch: OpenSSL_0_9_8-stable Handle:
2006041501223301
Modified files: (Branch: OpenSSL_0_9_8-stable)
openssl CHANGES
openssl/crypto/asn1 t_pkey.c
openssl/ssl ssl_ciph.c
Log:
If cipher list contains a match for an explicit
ciphersuite only match that
one suite.
Summary:
Revision Changes Path
1.1238.2.31 +4 -0 openssl/CHANGES
1.33.2.6 +30 -30 openssl/crypto/asn1/t_pkey.c
1.49.2.6 +21 -4 openssl/ssl/ssl_ciph.c
____________________________________________________________
________________
patch -p0 <<' .'
Index: openssl/CHANGES
============================================================
================
$ cvs diff -u -r1.1238.2.30 -r1.1238.2.31 CHANGES
--- openssl/CHANGES 11 Mar 2006 22:10:46 -0000 1.1238.2.30
+++ openssl/CHANGES 15 Apr 2006 00:22:33 -0000 1.1238.2.31
-4,6 +4,10
Changes between 0.9.8a and 0.9.8b [XX xxx XXXX]
+ *) When applying a cipher rule check to see if string
match is an explicit
+ cipher suite and only match that one cipher suite if
it is.
+ [Steve Henson]
+
*) Link in manifests for VC++ if needed.
[Austin Ziegler <halostatuegmail.com>]
.
patch -p0 <<' .'
Index: openssl/crypto/asn1/t_pkey.c
============================================================
================
$ cvs diff -u -r1.33.2.5 -r1.33.2.6 t_pkey.c
--- openssl/crypto/asn1/t_pkey.c 8 Feb 2006 19:16:09
-0000 1.33.2.5
+++ openssl/crypto/asn1/t_pkey.c 15 Apr 2006 00:22:34
-0000 1.33.2.6
-158,21 +158,21
BIO_snprintf(str,sizeof str,"Modulus (%d
bit):", mod_len);
else
BUF_strlcpy(str,"modulus:",sizeof str);
- if (!print(bp,str,x->n,m,off)) goto err;
+ if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err;
s=(x->d ==
NULL)?"Exponent:":"publicExponent:";
- if ((x->e != NULL) &&
!print(bp,s,x->e,m,off))
+ if ((x->e != NULL) &&
!ASN1_bn_print(bp,s,x->e,m,off))
goto err;
- if ((x->d != NULL) &&
!print(bp,"privateExponent:",x->d,m,off))
+ if ((x->d != NULL) &&
!ASN1_bn_print(bp,"privateExponent:",x->d,m,o
ff))
goto err;
- if ((x->p != NULL) &&
!print(bp,"prime1:",x->p,m,off))
+ if ((x->p != NULL) &&
!ASN1_bn_print(bp,"prime1:",x->p,m,off))
goto err;
- if ((x->q != NULL) &&
!print(bp,"prime2:",x->q,m,off))
+ if ((x->q != NULL) &&
!ASN1_bn_print(bp,"prime2:",x->q,m,off))
goto err;
- if ((x->dmp1 != NULL) &&
!print(bp,"exponent1:",x->dmp1,m,off))
+ if ((x->dmp1 != NULL) &&
!ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off)
)
goto err;
- if ((x->dmq1 != NULL) &&
!print(bp,"exponent2:",x->dmq1,m,off))
+ if ((x->dmq1 != NULL) &&
!ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off)
)
goto err;
- if ((x->iqmp != NULL) &&
!print(bp,"coefficient:",x->iqmp,m,off))
+ if ((x->iqmp != NULL) &&
!ASN1_bn_print(bp,"coefficient:",x->iqmp,m,of
f))
goto err;
ret=1;
err:
-241,13 +241,13
<= 0) goto err;
}
- if ((x->priv_key != NULL) &&
!print(bp,"priv:",x->priv_key,m,off))
+ if ((x->priv_key != NULL) &&
!ASN1_bn_print(bp,"priv:",x->priv_key,m,off))
goto err;
- if ((x->pub_key != NULL) &&
!print(bp,"pub: ",x->pub_key,m,off))
+ if ((x->pub_key != NULL) &&
!ASN1_bn_print(bp,"pub: ",x->pub_key,m,off))
goto err;
- if ((x->p != NULL) && !print(bp,"P:
",x->p,m,off)) goto err;
- if ((x->q != NULL) && !print(bp,"Q:
",x->q,m,off)) goto err;
- if ((x->g != NULL) && !print(bp,"G:
",x->g,m,off)) goto err;
+ if ((x->p != NULL) &&
!ASN1_bn_print(bp,"P: ",x->p,m,off)) goto
err;
+ if ((x->q != NULL) &&
!ASN1_bn_print(bp,"Q: ",x->q,m,off)) goto
err;
+ if ((x->g != NULL) &&
!ASN1_bn_print(bp,"G: ",x->g,m,off)) goto
err;
ret=1;
err:
if (m != NULL) OPENSSL_free(m);
-430,40 +430,40
goto err;
/* print the polynomial */
- if ((p != NULL) && !print(bp,
"Polynomial:", p, buffer,
+ if ((p != NULL) && !ASN1_bn_print(bp,
"Polynomial:", p, buffer,
off))
goto err;
}
else
{
- if ((p != NULL) && !print(bp,
"Prime:", p, buffer,off))
+ if ((p != NULL) && !ASN1_bn_print(bp,
"Prime:", p, buffer,off))
goto err;
}
- if ((a != NULL) && !print(bp, "A:
", a, buffer, off))
+ if ((a != NULL) && !ASN1_bn_print(bp, "A:
", a, buffer, off))
goto err;
- if ((b != NULL) && !print(bp, "B:
", b, buffer, off))
+ if ((b != NULL) && !ASN1_bn_print(bp, "B:
", b, buffer, off))
goto err;
if (form == POINT_CONVERSION_COMPRESSED)
{
- if ((gen != NULL) && !print(bp,
gen_compressed, gen,
+ if ((gen != NULL) && !ASN1_bn_print(bp,
gen_compressed, gen,
buffer, off))
goto err;
}
else if (form == POINT_CONVERSION_UNCOMPRESSED)
{
- if ((gen != NULL) && !print(bp,
gen_uncompressed, gen,
+ if ((gen != NULL) && !ASN1_bn_print(bp,
gen_uncompressed, gen,
buffer, off))
goto err;
}
else /* form == POINT_CONVERSION_HYBRID */
{
- if ((gen != NULL) && !print(bp, gen_hybrid,
gen,
+ if ((gen != NULL) && !ASN1_bn_print(bp,
gen_hybrid, gen,
buffer, off))
goto err;
}
- if ((order != NULL) && !print(bp, "Order:
", order,
+ if ((order != NULL) && !ASN1_bn_print(bp,
"Order: ", order,
buffer, off)) goto err;
- if ((cofactor != NULL) && !print(bp,
"Cofactor: ", cofactor,
+ if ((cofactor != NULL) && !ASN1_bn_print(bp,
"Cofactor: ", cofactor,
buffer, off)) goto err;
if (seed && !print_bin(bp, "Seed:",
seed, seed_len, off))
goto err;
-543,10 +543,10
BN_num_bits(order)) <= 0) goto err;
}
- if ((priv_key != NULL) && !print(bp,
"priv:", priv_key,
+ if ((priv_key != NULL) && !ASN1_bn_print(bp,
"priv:", priv_key,
buffer, off))
goto err;
- if ((pub_key != NULL) && !print(bp, "pub:
", pub_key,
+ if ((pub_key != NULL) && !ASN1_bn_print(bp,
"pub: ", pub_key,
buffer, off))
goto err;
if (!ECPKParameters_print(bp, group, off))
-567,7 +567,7
}
#endif /* OPENSSL_NO_EC */
-static int print(BIO *bp, const char *number, const
BIGNUM *num, unsigned char *buf,
+static int BN_print_pkey(BIO *bp, const char *number,
const BIGNUM *num, unsigned char *buf,
int off)
{
int n,i;
-703,8 +703,8
if (BIO_printf(bp,"Diffie-Hellman-Parameters: (%d
bit)\n",
BN_num_bits(x->p)) <= 0)
goto err;
- if (!print(bp,"prime:",x->p,m,4)) goto
err;
- if (!print(bp,"generator:",x->g,m,4))
goto err;
+ if (!ASN1_bn_print(bp,"prime:",x->p,m,4))
goto err;
+ if
(!ASN1_bn_print(bp,"generator:",x->g,m,4))
goto err;
if (x->length != 0)
{
if (BIO_printf(bp,"
recommended-private-length: %d bits\n",
-769,9 +769,9
if (BIO_printf(bp,"DSA-Parameters: (%d
bit)\n",
BN_num_bits(x->p)) <= 0)
goto err;
- if (!print(bp,"p:",x->p,m,4)) goto err;
- if ((x->q != NULL) &&
!print(bp,"q:",x->q,m,4)) goto err;
- if ((x->g != NULL) &&
!print(bp,"g:",x->g,m,4)) goto err;
+ if (!ASN1_bn_print(bp,"p:",x->p,m,4))
goto err;
+ if ((x->q != NULL) &&
!ASN1_bn_print(bp,"q:",x->q,m,4)) goto err;
+ if ((x->g != NULL) &&
!ASN1_bn_print(bp,"g:",x->g,m,4)) goto err;
ret=1;
err:
if (m != NULL) OPENSSL_free(m);
.
patch -p0 <<' .'
Index: openssl/ssl/ssl_ciph.c
============================================================
================
$ cvs diff -u -r1.49.2.5 -r1.49.2.6 ssl_ciph.c
--- openssl/ssl/ssl_ciph.c 30 Sep 2005 23:38:20
-0000 1.49.2.5
+++ openssl/ssl/ssl_ciph.c 15 Apr 2006 00:22:34
-0000 1.49.2.6
-482,7 +482,8
*ca_curr = NULL; /* end of list */
}
-static void ssl_cipher_apply_rule(unsigned long
algorithms, unsigned long mask,
+static void ssl_cipher_apply_rule(unsigned long
cipher_id,
+ unsigned long algorithms, unsigned long mask,
unsigned long algo_strength, unsigned long
mask_strength,
int rule, int strength_bits, CIPHER_ORDER *co_list,
CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
-508,11 +509,19
cp = curr->cipher;
+ /* If explicit cipher suite match that one only */
+
+ if (cipher_id)
+ {
+ if (cp->id != cipher_id)
+ continue;
+ }
+
/*
* Selection criteria is either the number of
strength_bits
* or the algorithm used.
*/
- if (strength_bits == -1)
+ else if (strength_bits == -1)
{
ma = mask & cp->algorithms;
ma_s = mask_strength & cp->algo_strength;
-625,7 +634,7
*/
for (i = max_strength_bits; i >= 0; i--)
if (number_uses[i] > 0)
- ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
+ ssl_cipher_apply_rule(0, 0, 0, 0, 0, CIPHER_ORD, i,
co_list, head_p, tail_p);
OPENSSL_free(number_uses);
-639,6 +648,7
unsigned long algorithms, mask, algo_strength,
mask_strength;
const char *l, *start, *buf;
int j, multi, found, rule, retval, ok, buflen;
+ unsigned long cipher_id;
char ch;
retval = 1;
-728,6 +738,7
* use strcmp(), because buf is not '\0'
terminated.)
*/
j = found = 0;
+ cipher_id = 0;
while (ca_list[j])
{
if (!strncmp(buf, ca_list[j]->name, buflen)
&&
-742,6 +753,12
if (!found)
break; /* ignore this entry */
+ if (ca_list[j]->valid)
+ {
+ cipher_id = ca_list[j]->id;
+ break;
+ }
+
/* New algorithms:
* 1 - any old restrictions apply outside new mask
* 2 - any new restrictions apply outside old mask
-785,7 +802,7
}
else if (found)
{
- ssl_cipher_apply_rule(algorithms, mask,
+ ssl_cipher_apply_rule(cipher_id, algorithms, mask,
algo_strength, mask_strength, rule, -1,
co_list, head_p, tail_p);
}
.
____________________________________________________________
__________
OpenSSL Project http://www.openssl.org
CVS Repository Commit List
openssl-cvsopenssl.org
Automated List Manager
majordomoopenssl.org
|