1*0Sstevel@tonic-gate /* ssl/s3_lib.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate /* ==================================================================== 59*0Sstevel@tonic-gate * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 60*0Sstevel@tonic-gate * 61*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 62*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 63*0Sstevel@tonic-gate * are met: 64*0Sstevel@tonic-gate * 65*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 66*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 67*0Sstevel@tonic-gate * 68*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 69*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 70*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 71*0Sstevel@tonic-gate * distribution. 72*0Sstevel@tonic-gate * 73*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 74*0Sstevel@tonic-gate * software must display the following acknowledgment: 75*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 76*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77*0Sstevel@tonic-gate * 78*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79*0Sstevel@tonic-gate * endorse or promote products derived from this software without 80*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 81*0Sstevel@tonic-gate * openssl-core@openssl.org. 82*0Sstevel@tonic-gate * 83*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 84*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 85*0Sstevel@tonic-gate * permission of the OpenSSL Project. 86*0Sstevel@tonic-gate * 87*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 88*0Sstevel@tonic-gate * acknowledgment: 89*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 90*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91*0Sstevel@tonic-gate * 92*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 104*0Sstevel@tonic-gate * ==================================================================== 105*0Sstevel@tonic-gate * 106*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 107*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 108*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 109*0Sstevel@tonic-gate * 110*0Sstevel@tonic-gate */ 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate #include <stdio.h> 113*0Sstevel@tonic-gate #include <openssl/objects.h> 114*0Sstevel@tonic-gate #include "ssl_locl.h" 115*0Sstevel@tonic-gate #include "kssl_lcl.h" 116*0Sstevel@tonic-gate #include <openssl/md5.h> 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT; 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate #define SSL3_NUM_CIPHERS (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER)) 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate static long ssl3_default_timeout(void ); 123*0Sstevel@tonic-gate 124*0Sstevel@tonic-gate OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={ 125*0Sstevel@tonic-gate /* The RSA ciphers */ 126*0Sstevel@tonic-gate /* Cipher 01 */ 127*0Sstevel@tonic-gate { 128*0Sstevel@tonic-gate 1, 129*0Sstevel@tonic-gate SSL3_TXT_RSA_NULL_MD5, 130*0Sstevel@tonic-gate SSL3_CK_RSA_NULL_MD5, 131*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3, 132*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_STRONG_NONE, 133*0Sstevel@tonic-gate 0, 134*0Sstevel@tonic-gate 0, 135*0Sstevel@tonic-gate 0, 136*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 137*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 138*0Sstevel@tonic-gate }, 139*0Sstevel@tonic-gate /* Cipher 02 */ 140*0Sstevel@tonic-gate { 141*0Sstevel@tonic-gate 1, 142*0Sstevel@tonic-gate SSL3_TXT_RSA_NULL_SHA, 143*0Sstevel@tonic-gate SSL3_CK_RSA_NULL_SHA, 144*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3, 145*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_STRONG_NONE, 146*0Sstevel@tonic-gate 0, 147*0Sstevel@tonic-gate 0, 148*0Sstevel@tonic-gate 0, 149*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 150*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 151*0Sstevel@tonic-gate }, 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate /* anon DH */ 154*0Sstevel@tonic-gate /* Cipher 17 */ 155*0Sstevel@tonic-gate { 156*0Sstevel@tonic-gate 1, 157*0Sstevel@tonic-gate SSL3_TXT_ADH_RC4_40_MD5, 158*0Sstevel@tonic-gate SSL3_CK_ADH_RC4_40_MD5, 159*0Sstevel@tonic-gate SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 160*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 161*0Sstevel@tonic-gate 0, 162*0Sstevel@tonic-gate 40, 163*0Sstevel@tonic-gate 128, 164*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 165*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 166*0Sstevel@tonic-gate }, 167*0Sstevel@tonic-gate /* Cipher 18 */ 168*0Sstevel@tonic-gate { 169*0Sstevel@tonic-gate 1, 170*0Sstevel@tonic-gate SSL3_TXT_ADH_RC4_128_MD5, 171*0Sstevel@tonic-gate SSL3_CK_ADH_RC4_128_MD5, 172*0Sstevel@tonic-gate SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 173*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 174*0Sstevel@tonic-gate 0, 175*0Sstevel@tonic-gate 128, 176*0Sstevel@tonic-gate 128, 177*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 178*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 179*0Sstevel@tonic-gate }, 180*0Sstevel@tonic-gate /* Cipher 19 */ 181*0Sstevel@tonic-gate { 182*0Sstevel@tonic-gate 1, 183*0Sstevel@tonic-gate SSL3_TXT_ADH_DES_40_CBC_SHA, 184*0Sstevel@tonic-gate SSL3_CK_ADH_DES_40_CBC_SHA, 185*0Sstevel@tonic-gate SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3, 186*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 187*0Sstevel@tonic-gate 0, 188*0Sstevel@tonic-gate 40, 189*0Sstevel@tonic-gate 128, 190*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 191*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 192*0Sstevel@tonic-gate }, 193*0Sstevel@tonic-gate /* Cipher 1A */ 194*0Sstevel@tonic-gate { 195*0Sstevel@tonic-gate 1, 196*0Sstevel@tonic-gate SSL3_TXT_ADH_DES_64_CBC_SHA, 197*0Sstevel@tonic-gate SSL3_CK_ADH_DES_64_CBC_SHA, 198*0Sstevel@tonic-gate SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3, 199*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 200*0Sstevel@tonic-gate 0, 201*0Sstevel@tonic-gate 56, 202*0Sstevel@tonic-gate 56, 203*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 204*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 205*0Sstevel@tonic-gate }, 206*0Sstevel@tonic-gate /* Cipher 1B */ 207*0Sstevel@tonic-gate { 208*0Sstevel@tonic-gate 1, 209*0Sstevel@tonic-gate SSL3_TXT_ADH_DES_192_CBC_SHA, 210*0Sstevel@tonic-gate SSL3_CK_ADH_DES_192_CBC_SHA, 211*0Sstevel@tonic-gate SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3, 212*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 213*0Sstevel@tonic-gate 0, 214*0Sstevel@tonic-gate 168, 215*0Sstevel@tonic-gate 168, 216*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 217*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 218*0Sstevel@tonic-gate }, 219*0Sstevel@tonic-gate 220*0Sstevel@tonic-gate /* RSA again */ 221*0Sstevel@tonic-gate /* Cipher 03 */ 222*0Sstevel@tonic-gate { 223*0Sstevel@tonic-gate 1, 224*0Sstevel@tonic-gate SSL3_TXT_RSA_RC4_40_MD5, 225*0Sstevel@tonic-gate SSL3_CK_RSA_RC4_40_MD5, 226*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_SSLV3, 227*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 228*0Sstevel@tonic-gate 0, 229*0Sstevel@tonic-gate 40, 230*0Sstevel@tonic-gate 128, 231*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 232*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 233*0Sstevel@tonic-gate }, 234*0Sstevel@tonic-gate /* Cipher 04 */ 235*0Sstevel@tonic-gate { 236*0Sstevel@tonic-gate 1, 237*0Sstevel@tonic-gate SSL3_TXT_RSA_RC4_128_MD5, 238*0Sstevel@tonic-gate SSL3_CK_RSA_RC4_128_MD5, 239*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_SSLV3, 240*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 241*0Sstevel@tonic-gate 0, 242*0Sstevel@tonic-gate 128, 243*0Sstevel@tonic-gate 128, 244*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 245*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 246*0Sstevel@tonic-gate }, 247*0Sstevel@tonic-gate /* Cipher 05 */ 248*0Sstevel@tonic-gate { 249*0Sstevel@tonic-gate 1, 250*0Sstevel@tonic-gate SSL3_TXT_RSA_RC4_128_SHA, 251*0Sstevel@tonic-gate SSL3_CK_RSA_RC4_128_SHA, 252*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_SSLV3, 253*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 254*0Sstevel@tonic-gate 0, 255*0Sstevel@tonic-gate 128, 256*0Sstevel@tonic-gate 128, 257*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 258*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 259*0Sstevel@tonic-gate }, 260*0Sstevel@tonic-gate /* Cipher 06 */ 261*0Sstevel@tonic-gate { 262*0Sstevel@tonic-gate 1, 263*0Sstevel@tonic-gate SSL3_TXT_RSA_RC2_40_MD5, 264*0Sstevel@tonic-gate SSL3_CK_RSA_RC2_40_MD5, 265*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_SSLV3, 266*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 267*0Sstevel@tonic-gate 0, 268*0Sstevel@tonic-gate 40, 269*0Sstevel@tonic-gate 128, 270*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 271*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 272*0Sstevel@tonic-gate }, 273*0Sstevel@tonic-gate /* Cipher 07 */ 274*0Sstevel@tonic-gate #ifndef OPENSSL_NO_IDEA 275*0Sstevel@tonic-gate { 276*0Sstevel@tonic-gate 1, 277*0Sstevel@tonic-gate SSL3_TXT_RSA_IDEA_128_SHA, 278*0Sstevel@tonic-gate SSL3_CK_RSA_IDEA_128_SHA, 279*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3, 280*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 281*0Sstevel@tonic-gate 0, 282*0Sstevel@tonic-gate 128, 283*0Sstevel@tonic-gate 128, 284*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 285*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 286*0Sstevel@tonic-gate }, 287*0Sstevel@tonic-gate #endif 288*0Sstevel@tonic-gate /* Cipher 08 */ 289*0Sstevel@tonic-gate { 290*0Sstevel@tonic-gate 1, 291*0Sstevel@tonic-gate SSL3_TXT_RSA_DES_40_CBC_SHA, 292*0Sstevel@tonic-gate SSL3_CK_RSA_DES_40_CBC_SHA, 293*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, 294*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 295*0Sstevel@tonic-gate 0, 296*0Sstevel@tonic-gate 40, 297*0Sstevel@tonic-gate 56, 298*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 299*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 300*0Sstevel@tonic-gate }, 301*0Sstevel@tonic-gate /* Cipher 09 */ 302*0Sstevel@tonic-gate { 303*0Sstevel@tonic-gate 1, 304*0Sstevel@tonic-gate SSL3_TXT_RSA_DES_64_CBC_SHA, 305*0Sstevel@tonic-gate SSL3_CK_RSA_DES_64_CBC_SHA, 306*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, 307*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 308*0Sstevel@tonic-gate 0, 309*0Sstevel@tonic-gate 56, 310*0Sstevel@tonic-gate 56, 311*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 312*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 313*0Sstevel@tonic-gate }, 314*0Sstevel@tonic-gate /* Cipher 0A */ 315*0Sstevel@tonic-gate { 316*0Sstevel@tonic-gate 1, 317*0Sstevel@tonic-gate SSL3_TXT_RSA_DES_192_CBC3_SHA, 318*0Sstevel@tonic-gate SSL3_CK_RSA_DES_192_CBC3_SHA, 319*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, 320*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 321*0Sstevel@tonic-gate 0, 322*0Sstevel@tonic-gate 168, 323*0Sstevel@tonic-gate 168, 324*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 325*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 326*0Sstevel@tonic-gate }, 327*0Sstevel@tonic-gate 328*0Sstevel@tonic-gate /* The DH ciphers */ 329*0Sstevel@tonic-gate /* Cipher 0B */ 330*0Sstevel@tonic-gate { 331*0Sstevel@tonic-gate 0, 332*0Sstevel@tonic-gate SSL3_TXT_DH_DSS_DES_40_CBC_SHA, 333*0Sstevel@tonic-gate SSL3_CK_DH_DSS_DES_40_CBC_SHA, 334*0Sstevel@tonic-gate SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, 335*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 336*0Sstevel@tonic-gate 0, 337*0Sstevel@tonic-gate 40, 338*0Sstevel@tonic-gate 56, 339*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 340*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 341*0Sstevel@tonic-gate }, 342*0Sstevel@tonic-gate /* Cipher 0C */ 343*0Sstevel@tonic-gate { 344*0Sstevel@tonic-gate 0, 345*0Sstevel@tonic-gate SSL3_TXT_DH_DSS_DES_64_CBC_SHA, 346*0Sstevel@tonic-gate SSL3_CK_DH_DSS_DES_64_CBC_SHA, 347*0Sstevel@tonic-gate SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, 348*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 349*0Sstevel@tonic-gate 0, 350*0Sstevel@tonic-gate 56, 351*0Sstevel@tonic-gate 56, 352*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 353*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 354*0Sstevel@tonic-gate }, 355*0Sstevel@tonic-gate /* Cipher 0D */ 356*0Sstevel@tonic-gate { 357*0Sstevel@tonic-gate 0, 358*0Sstevel@tonic-gate SSL3_TXT_DH_DSS_DES_192_CBC3_SHA, 359*0Sstevel@tonic-gate SSL3_CK_DH_DSS_DES_192_CBC3_SHA, 360*0Sstevel@tonic-gate SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, 361*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 362*0Sstevel@tonic-gate 0, 363*0Sstevel@tonic-gate 168, 364*0Sstevel@tonic-gate 168, 365*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 366*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 367*0Sstevel@tonic-gate }, 368*0Sstevel@tonic-gate /* Cipher 0E */ 369*0Sstevel@tonic-gate { 370*0Sstevel@tonic-gate 0, 371*0Sstevel@tonic-gate SSL3_TXT_DH_RSA_DES_40_CBC_SHA, 372*0Sstevel@tonic-gate SSL3_CK_DH_RSA_DES_40_CBC_SHA, 373*0Sstevel@tonic-gate SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3, 374*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 375*0Sstevel@tonic-gate 0, 376*0Sstevel@tonic-gate 40, 377*0Sstevel@tonic-gate 56, 378*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 379*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 380*0Sstevel@tonic-gate }, 381*0Sstevel@tonic-gate /* Cipher 0F */ 382*0Sstevel@tonic-gate { 383*0Sstevel@tonic-gate 0, 384*0Sstevel@tonic-gate SSL3_TXT_DH_RSA_DES_64_CBC_SHA, 385*0Sstevel@tonic-gate SSL3_CK_DH_RSA_DES_64_CBC_SHA, 386*0Sstevel@tonic-gate SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3, 387*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 388*0Sstevel@tonic-gate 0, 389*0Sstevel@tonic-gate 56, 390*0Sstevel@tonic-gate 56, 391*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 392*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 393*0Sstevel@tonic-gate }, 394*0Sstevel@tonic-gate /* Cipher 10 */ 395*0Sstevel@tonic-gate { 396*0Sstevel@tonic-gate 0, 397*0Sstevel@tonic-gate SSL3_TXT_DH_RSA_DES_192_CBC3_SHA, 398*0Sstevel@tonic-gate SSL3_CK_DH_RSA_DES_192_CBC3_SHA, 399*0Sstevel@tonic-gate SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3, 400*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 401*0Sstevel@tonic-gate 0, 402*0Sstevel@tonic-gate 168, 403*0Sstevel@tonic-gate 168, 404*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 405*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 406*0Sstevel@tonic-gate }, 407*0Sstevel@tonic-gate 408*0Sstevel@tonic-gate /* The Ephemeral DH ciphers */ 409*0Sstevel@tonic-gate /* Cipher 11 */ 410*0Sstevel@tonic-gate { 411*0Sstevel@tonic-gate 1, 412*0Sstevel@tonic-gate SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, 413*0Sstevel@tonic-gate SSL3_CK_EDH_DSS_DES_40_CBC_SHA, 414*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3, 415*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 416*0Sstevel@tonic-gate 0, 417*0Sstevel@tonic-gate 40, 418*0Sstevel@tonic-gate 56, 419*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 420*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 421*0Sstevel@tonic-gate }, 422*0Sstevel@tonic-gate /* Cipher 12 */ 423*0Sstevel@tonic-gate { 424*0Sstevel@tonic-gate 1, 425*0Sstevel@tonic-gate SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, 426*0Sstevel@tonic-gate SSL3_CK_EDH_DSS_DES_64_CBC_SHA, 427*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3, 428*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 429*0Sstevel@tonic-gate 0, 430*0Sstevel@tonic-gate 56, 431*0Sstevel@tonic-gate 56, 432*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 433*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 434*0Sstevel@tonic-gate }, 435*0Sstevel@tonic-gate /* Cipher 13 */ 436*0Sstevel@tonic-gate { 437*0Sstevel@tonic-gate 1, 438*0Sstevel@tonic-gate SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, 439*0Sstevel@tonic-gate SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, 440*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3, 441*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 442*0Sstevel@tonic-gate 0, 443*0Sstevel@tonic-gate 168, 444*0Sstevel@tonic-gate 168, 445*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 446*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 447*0Sstevel@tonic-gate }, 448*0Sstevel@tonic-gate /* Cipher 14 */ 449*0Sstevel@tonic-gate { 450*0Sstevel@tonic-gate 1, 451*0Sstevel@tonic-gate SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, 452*0Sstevel@tonic-gate SSL3_CK_EDH_RSA_DES_40_CBC_SHA, 453*0Sstevel@tonic-gate SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3, 454*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 455*0Sstevel@tonic-gate 0, 456*0Sstevel@tonic-gate 40, 457*0Sstevel@tonic-gate 56, 458*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 459*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 460*0Sstevel@tonic-gate }, 461*0Sstevel@tonic-gate /* Cipher 15 */ 462*0Sstevel@tonic-gate { 463*0Sstevel@tonic-gate 1, 464*0Sstevel@tonic-gate SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, 465*0Sstevel@tonic-gate SSL3_CK_EDH_RSA_DES_64_CBC_SHA, 466*0Sstevel@tonic-gate SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3, 467*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 468*0Sstevel@tonic-gate 0, 469*0Sstevel@tonic-gate 56, 470*0Sstevel@tonic-gate 56, 471*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 472*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 473*0Sstevel@tonic-gate }, 474*0Sstevel@tonic-gate /* Cipher 16 */ 475*0Sstevel@tonic-gate { 476*0Sstevel@tonic-gate 1, 477*0Sstevel@tonic-gate SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, 478*0Sstevel@tonic-gate SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, 479*0Sstevel@tonic-gate SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3, 480*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 481*0Sstevel@tonic-gate 0, 482*0Sstevel@tonic-gate 168, 483*0Sstevel@tonic-gate 168, 484*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 485*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 486*0Sstevel@tonic-gate }, 487*0Sstevel@tonic-gate 488*0Sstevel@tonic-gate /* Fortezza */ 489*0Sstevel@tonic-gate /* Cipher 1C */ 490*0Sstevel@tonic-gate { 491*0Sstevel@tonic-gate 0, 492*0Sstevel@tonic-gate SSL3_TXT_FZA_DMS_NULL_SHA, 493*0Sstevel@tonic-gate SSL3_CK_FZA_DMS_NULL_SHA, 494*0Sstevel@tonic-gate SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3, 495*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_STRONG_NONE, 496*0Sstevel@tonic-gate 0, 497*0Sstevel@tonic-gate 0, 498*0Sstevel@tonic-gate 0, 499*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 500*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 501*0Sstevel@tonic-gate }, 502*0Sstevel@tonic-gate 503*0Sstevel@tonic-gate /* Cipher 1D */ 504*0Sstevel@tonic-gate { 505*0Sstevel@tonic-gate 0, 506*0Sstevel@tonic-gate SSL3_TXT_FZA_DMS_FZA_SHA, 507*0Sstevel@tonic-gate SSL3_CK_FZA_DMS_FZA_SHA, 508*0Sstevel@tonic-gate SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3, 509*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_STRONG_NONE, 510*0Sstevel@tonic-gate 0, 511*0Sstevel@tonic-gate 0, 512*0Sstevel@tonic-gate 0, 513*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 514*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 515*0Sstevel@tonic-gate }, 516*0Sstevel@tonic-gate 517*0Sstevel@tonic-gate #if 0 518*0Sstevel@tonic-gate /* Cipher 1E */ 519*0Sstevel@tonic-gate { 520*0Sstevel@tonic-gate 0, 521*0Sstevel@tonic-gate SSL3_TXT_FZA_DMS_RC4_SHA, 522*0Sstevel@tonic-gate SSL3_CK_FZA_DMS_RC4_SHA, 523*0Sstevel@tonic-gate SSL_kFZA|SSL_aFZA |SSL_RC4 |SSL_SHA1|SSL_SSLV3, 524*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 525*0Sstevel@tonic-gate 0, 526*0Sstevel@tonic-gate 128, 527*0Sstevel@tonic-gate 128, 528*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 529*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 530*0Sstevel@tonic-gate }, 531*0Sstevel@tonic-gate #endif 532*0Sstevel@tonic-gate 533*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 534*0Sstevel@tonic-gate /* The Kerberos ciphers 535*0Sstevel@tonic-gate ** 20000107 VRS: And the first shall be last, 536*0Sstevel@tonic-gate ** in hopes of avoiding the lynx ssl renegotiation problem. 537*0Sstevel@tonic-gate */ 538*0Sstevel@tonic-gate /* Cipher 1E VRS */ 539*0Sstevel@tonic-gate { 540*0Sstevel@tonic-gate 1, 541*0Sstevel@tonic-gate SSL3_TXT_KRB5_DES_64_CBC_SHA, 542*0Sstevel@tonic-gate SSL3_CK_KRB5_DES_64_CBC_SHA, 543*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3, 544*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 545*0Sstevel@tonic-gate 0, 546*0Sstevel@tonic-gate 56, 547*0Sstevel@tonic-gate 56, 548*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 549*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 550*0Sstevel@tonic-gate }, 551*0Sstevel@tonic-gate 552*0Sstevel@tonic-gate /* Cipher 1F VRS */ 553*0Sstevel@tonic-gate { 554*0Sstevel@tonic-gate 1, 555*0Sstevel@tonic-gate SSL3_TXT_KRB5_DES_192_CBC3_SHA, 556*0Sstevel@tonic-gate SSL3_CK_KRB5_DES_192_CBC3_SHA, 557*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_SHA1 |SSL_SSLV3, 558*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 559*0Sstevel@tonic-gate 0, 560*0Sstevel@tonic-gate 112, 561*0Sstevel@tonic-gate 168, 562*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 563*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 564*0Sstevel@tonic-gate }, 565*0Sstevel@tonic-gate 566*0Sstevel@tonic-gate /* Cipher 20 VRS */ 567*0Sstevel@tonic-gate { 568*0Sstevel@tonic-gate 1, 569*0Sstevel@tonic-gate SSL3_TXT_KRB5_RC4_128_SHA, 570*0Sstevel@tonic-gate SSL3_CK_KRB5_RC4_128_SHA, 571*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3, 572*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 573*0Sstevel@tonic-gate 0, 574*0Sstevel@tonic-gate 128, 575*0Sstevel@tonic-gate 128, 576*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 577*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 578*0Sstevel@tonic-gate }, 579*0Sstevel@tonic-gate 580*0Sstevel@tonic-gate /* Cipher 21 VRS */ 581*0Sstevel@tonic-gate { 582*0Sstevel@tonic-gate 1, 583*0Sstevel@tonic-gate SSL3_TXT_KRB5_IDEA_128_CBC_SHA, 584*0Sstevel@tonic-gate SSL3_CK_KRB5_IDEA_128_CBC_SHA, 585*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_SHA1 |SSL_SSLV3, 586*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 587*0Sstevel@tonic-gate 0, 588*0Sstevel@tonic-gate 128, 589*0Sstevel@tonic-gate 128, 590*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 591*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 592*0Sstevel@tonic-gate }, 593*0Sstevel@tonic-gate 594*0Sstevel@tonic-gate /* Cipher 22 VRS */ 595*0Sstevel@tonic-gate { 596*0Sstevel@tonic-gate 1, 597*0Sstevel@tonic-gate SSL3_TXT_KRB5_DES_64_CBC_MD5, 598*0Sstevel@tonic-gate SSL3_CK_KRB5_DES_64_CBC_MD5, 599*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3, 600*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_LOW, 601*0Sstevel@tonic-gate 0, 602*0Sstevel@tonic-gate 56, 603*0Sstevel@tonic-gate 56, 604*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 605*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 606*0Sstevel@tonic-gate }, 607*0Sstevel@tonic-gate 608*0Sstevel@tonic-gate /* Cipher 23 VRS */ 609*0Sstevel@tonic-gate { 610*0Sstevel@tonic-gate 1, 611*0Sstevel@tonic-gate SSL3_TXT_KRB5_DES_192_CBC3_MD5, 612*0Sstevel@tonic-gate SSL3_CK_KRB5_DES_192_CBC3_MD5, 613*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_MD5 |SSL_SSLV3, 614*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 615*0Sstevel@tonic-gate 0, 616*0Sstevel@tonic-gate 112, 617*0Sstevel@tonic-gate 168, 618*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 619*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 620*0Sstevel@tonic-gate }, 621*0Sstevel@tonic-gate 622*0Sstevel@tonic-gate /* Cipher 24 VRS */ 623*0Sstevel@tonic-gate { 624*0Sstevel@tonic-gate 1, 625*0Sstevel@tonic-gate SSL3_TXT_KRB5_RC4_128_MD5, 626*0Sstevel@tonic-gate SSL3_CK_KRB5_RC4_128_MD5, 627*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3, 628*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 629*0Sstevel@tonic-gate 0, 630*0Sstevel@tonic-gate 128, 631*0Sstevel@tonic-gate 128, 632*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 633*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 634*0Sstevel@tonic-gate }, 635*0Sstevel@tonic-gate 636*0Sstevel@tonic-gate /* Cipher 25 VRS */ 637*0Sstevel@tonic-gate { 638*0Sstevel@tonic-gate 1, 639*0Sstevel@tonic-gate SSL3_TXT_KRB5_IDEA_128_CBC_MD5, 640*0Sstevel@tonic-gate SSL3_CK_KRB5_IDEA_128_CBC_MD5, 641*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_MD5 |SSL_SSLV3, 642*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 643*0Sstevel@tonic-gate 0, 644*0Sstevel@tonic-gate 128, 645*0Sstevel@tonic-gate 128, 646*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 647*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 648*0Sstevel@tonic-gate }, 649*0Sstevel@tonic-gate 650*0Sstevel@tonic-gate /* Cipher 26 VRS */ 651*0Sstevel@tonic-gate { 652*0Sstevel@tonic-gate 1, 653*0Sstevel@tonic-gate SSL3_TXT_KRB5_DES_40_CBC_SHA, 654*0Sstevel@tonic-gate SSL3_CK_KRB5_DES_40_CBC_SHA, 655*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3, 656*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 657*0Sstevel@tonic-gate 0, 658*0Sstevel@tonic-gate 40, 659*0Sstevel@tonic-gate 56, 660*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 661*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 662*0Sstevel@tonic-gate }, 663*0Sstevel@tonic-gate 664*0Sstevel@tonic-gate /* Cipher 27 VRS */ 665*0Sstevel@tonic-gate { 666*0Sstevel@tonic-gate 1, 667*0Sstevel@tonic-gate SSL3_TXT_KRB5_RC2_40_CBC_SHA, 668*0Sstevel@tonic-gate SSL3_CK_KRB5_RC2_40_CBC_SHA, 669*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_SHA1 |SSL_SSLV3, 670*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 671*0Sstevel@tonic-gate 0, 672*0Sstevel@tonic-gate 40, 673*0Sstevel@tonic-gate 128, 674*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 675*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 676*0Sstevel@tonic-gate }, 677*0Sstevel@tonic-gate 678*0Sstevel@tonic-gate /* Cipher 28 VRS */ 679*0Sstevel@tonic-gate { 680*0Sstevel@tonic-gate 1, 681*0Sstevel@tonic-gate SSL3_TXT_KRB5_RC4_40_SHA, 682*0Sstevel@tonic-gate SSL3_CK_KRB5_RC4_40_SHA, 683*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3, 684*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 685*0Sstevel@tonic-gate 0, 686*0Sstevel@tonic-gate 128, 687*0Sstevel@tonic-gate 128, 688*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 689*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 690*0Sstevel@tonic-gate }, 691*0Sstevel@tonic-gate 692*0Sstevel@tonic-gate /* Cipher 29 VRS */ 693*0Sstevel@tonic-gate { 694*0Sstevel@tonic-gate 1, 695*0Sstevel@tonic-gate SSL3_TXT_KRB5_DES_40_CBC_MD5, 696*0Sstevel@tonic-gate SSL3_CK_KRB5_DES_40_CBC_MD5, 697*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3, 698*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 699*0Sstevel@tonic-gate 0, 700*0Sstevel@tonic-gate 40, 701*0Sstevel@tonic-gate 56, 702*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 703*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 704*0Sstevel@tonic-gate }, 705*0Sstevel@tonic-gate 706*0Sstevel@tonic-gate /* Cipher 2A VRS */ 707*0Sstevel@tonic-gate { 708*0Sstevel@tonic-gate 1, 709*0Sstevel@tonic-gate SSL3_TXT_KRB5_RC2_40_CBC_MD5, 710*0Sstevel@tonic-gate SSL3_CK_KRB5_RC2_40_CBC_MD5, 711*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_MD5 |SSL_SSLV3, 712*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 713*0Sstevel@tonic-gate 0, 714*0Sstevel@tonic-gate 40, 715*0Sstevel@tonic-gate 128, 716*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 717*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 718*0Sstevel@tonic-gate }, 719*0Sstevel@tonic-gate 720*0Sstevel@tonic-gate /* Cipher 2B VRS */ 721*0Sstevel@tonic-gate { 722*0Sstevel@tonic-gate 1, 723*0Sstevel@tonic-gate SSL3_TXT_KRB5_RC4_40_MD5, 724*0Sstevel@tonic-gate SSL3_CK_KRB5_RC4_40_MD5, 725*0Sstevel@tonic-gate SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3, 726*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP40, 727*0Sstevel@tonic-gate 0, 728*0Sstevel@tonic-gate 128, 729*0Sstevel@tonic-gate 128, 730*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 731*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 732*0Sstevel@tonic-gate }, 733*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 734*0Sstevel@tonic-gate 735*0Sstevel@tonic-gate 736*0Sstevel@tonic-gate #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 737*0Sstevel@tonic-gate /* New TLS Export CipherSuites */ 738*0Sstevel@tonic-gate /* Cipher 60 */ 739*0Sstevel@tonic-gate { 740*0Sstevel@tonic-gate 1, 741*0Sstevel@tonic-gate TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5, 742*0Sstevel@tonic-gate TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5, 743*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1, 744*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP56, 745*0Sstevel@tonic-gate 0, 746*0Sstevel@tonic-gate 56, 747*0Sstevel@tonic-gate 128, 748*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 749*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 750*0Sstevel@tonic-gate }, 751*0Sstevel@tonic-gate /* Cipher 61 */ 752*0Sstevel@tonic-gate { 753*0Sstevel@tonic-gate 1, 754*0Sstevel@tonic-gate TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 755*0Sstevel@tonic-gate TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, 756*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1, 757*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP56, 758*0Sstevel@tonic-gate 0, 759*0Sstevel@tonic-gate 56, 760*0Sstevel@tonic-gate 128, 761*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 762*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 763*0Sstevel@tonic-gate }, 764*0Sstevel@tonic-gate /* Cipher 62 */ 765*0Sstevel@tonic-gate { 766*0Sstevel@tonic-gate 1, 767*0Sstevel@tonic-gate TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA, 768*0Sstevel@tonic-gate TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA, 769*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1, 770*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP56, 771*0Sstevel@tonic-gate 0, 772*0Sstevel@tonic-gate 56, 773*0Sstevel@tonic-gate 56, 774*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 775*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 776*0Sstevel@tonic-gate }, 777*0Sstevel@tonic-gate /* Cipher 63 */ 778*0Sstevel@tonic-gate { 779*0Sstevel@tonic-gate 1, 780*0Sstevel@tonic-gate TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 781*0Sstevel@tonic-gate TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, 782*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1, 783*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP56, 784*0Sstevel@tonic-gate 0, 785*0Sstevel@tonic-gate 56, 786*0Sstevel@tonic-gate 56, 787*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 788*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 789*0Sstevel@tonic-gate }, 790*0Sstevel@tonic-gate /* Cipher 64 */ 791*0Sstevel@tonic-gate { 792*0Sstevel@tonic-gate 1, 793*0Sstevel@tonic-gate TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA, 794*0Sstevel@tonic-gate TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA, 795*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1, 796*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP56, 797*0Sstevel@tonic-gate 0, 798*0Sstevel@tonic-gate 56, 799*0Sstevel@tonic-gate 128, 800*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 801*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 802*0Sstevel@tonic-gate }, 803*0Sstevel@tonic-gate /* Cipher 65 */ 804*0Sstevel@tonic-gate { 805*0Sstevel@tonic-gate 1, 806*0Sstevel@tonic-gate TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 807*0Sstevel@tonic-gate TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, 808*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, 809*0Sstevel@tonic-gate SSL_EXPORT|SSL_EXP56, 810*0Sstevel@tonic-gate 0, 811*0Sstevel@tonic-gate 56, 812*0Sstevel@tonic-gate 128, 813*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 814*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 815*0Sstevel@tonic-gate }, 816*0Sstevel@tonic-gate /* Cipher 66 */ 817*0Sstevel@tonic-gate { 818*0Sstevel@tonic-gate 1, 819*0Sstevel@tonic-gate TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA, 820*0Sstevel@tonic-gate TLS1_CK_DHE_DSS_WITH_RC4_128_SHA, 821*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1, 822*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 823*0Sstevel@tonic-gate 0, 824*0Sstevel@tonic-gate 128, 825*0Sstevel@tonic-gate 128, 826*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 827*0Sstevel@tonic-gate SSL_ALL_STRENGTHS 828*0Sstevel@tonic-gate }, 829*0Sstevel@tonic-gate #endif 830*0Sstevel@tonic-gate /* New AES ciphersuites */ 831*0Sstevel@tonic-gate 832*0Sstevel@tonic-gate /* Cipher 2F */ 833*0Sstevel@tonic-gate { 834*0Sstevel@tonic-gate 1, 835*0Sstevel@tonic-gate TLS1_TXT_RSA_WITH_AES_128_SHA, 836*0Sstevel@tonic-gate TLS1_CK_RSA_WITH_AES_128_SHA, 837*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1, 838*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 839*0Sstevel@tonic-gate 0, 840*0Sstevel@tonic-gate 128, 841*0Sstevel@tonic-gate 128, 842*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 843*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 844*0Sstevel@tonic-gate }, 845*0Sstevel@tonic-gate /* Cipher 30 */ 846*0Sstevel@tonic-gate { 847*0Sstevel@tonic-gate 0, 848*0Sstevel@tonic-gate TLS1_TXT_DH_DSS_WITH_AES_128_SHA, 849*0Sstevel@tonic-gate TLS1_CK_DH_DSS_WITH_AES_128_SHA, 850*0Sstevel@tonic-gate SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 851*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 852*0Sstevel@tonic-gate 0, 853*0Sstevel@tonic-gate 128, 854*0Sstevel@tonic-gate 128, 855*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 856*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 857*0Sstevel@tonic-gate }, 858*0Sstevel@tonic-gate /* Cipher 31 */ 859*0Sstevel@tonic-gate { 860*0Sstevel@tonic-gate 0, 861*0Sstevel@tonic-gate TLS1_TXT_DH_RSA_WITH_AES_128_SHA, 862*0Sstevel@tonic-gate TLS1_CK_DH_RSA_WITH_AES_128_SHA, 863*0Sstevel@tonic-gate SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 864*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 865*0Sstevel@tonic-gate 0, 866*0Sstevel@tonic-gate 128, 867*0Sstevel@tonic-gate 128, 868*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 869*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 870*0Sstevel@tonic-gate }, 871*0Sstevel@tonic-gate /* Cipher 32 */ 872*0Sstevel@tonic-gate { 873*0Sstevel@tonic-gate 1, 874*0Sstevel@tonic-gate TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, 875*0Sstevel@tonic-gate TLS1_CK_DHE_DSS_WITH_AES_128_SHA, 876*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1, 877*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 878*0Sstevel@tonic-gate 0, 879*0Sstevel@tonic-gate 128, 880*0Sstevel@tonic-gate 128, 881*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 882*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 883*0Sstevel@tonic-gate }, 884*0Sstevel@tonic-gate /* Cipher 33 */ 885*0Sstevel@tonic-gate { 886*0Sstevel@tonic-gate 1, 887*0Sstevel@tonic-gate TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, 888*0Sstevel@tonic-gate TLS1_CK_DHE_RSA_WITH_AES_128_SHA, 889*0Sstevel@tonic-gate SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 890*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 891*0Sstevel@tonic-gate 0, 892*0Sstevel@tonic-gate 128, 893*0Sstevel@tonic-gate 128, 894*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 895*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 896*0Sstevel@tonic-gate }, 897*0Sstevel@tonic-gate /* Cipher 34 */ 898*0Sstevel@tonic-gate { 899*0Sstevel@tonic-gate 1, 900*0Sstevel@tonic-gate TLS1_TXT_ADH_WITH_AES_128_SHA, 901*0Sstevel@tonic-gate TLS1_CK_ADH_WITH_AES_128_SHA, 902*0Sstevel@tonic-gate SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, 903*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_MEDIUM, 904*0Sstevel@tonic-gate 0, 905*0Sstevel@tonic-gate 128, 906*0Sstevel@tonic-gate 128, 907*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 908*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 909*0Sstevel@tonic-gate }, 910*0Sstevel@tonic-gate 911*0Sstevel@tonic-gate /* Cipher 35 */ 912*0Sstevel@tonic-gate { 913*0Sstevel@tonic-gate 1, 914*0Sstevel@tonic-gate TLS1_TXT_RSA_WITH_AES_256_SHA, 915*0Sstevel@tonic-gate TLS1_CK_RSA_WITH_AES_256_SHA, 916*0Sstevel@tonic-gate SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1, 917*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 918*0Sstevel@tonic-gate 0, 919*0Sstevel@tonic-gate 256, 920*0Sstevel@tonic-gate 256, 921*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 922*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 923*0Sstevel@tonic-gate }, 924*0Sstevel@tonic-gate /* Cipher 36 */ 925*0Sstevel@tonic-gate { 926*0Sstevel@tonic-gate 0, 927*0Sstevel@tonic-gate TLS1_TXT_DH_DSS_WITH_AES_256_SHA, 928*0Sstevel@tonic-gate TLS1_CK_DH_DSS_WITH_AES_256_SHA, 929*0Sstevel@tonic-gate SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 930*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 931*0Sstevel@tonic-gate 0, 932*0Sstevel@tonic-gate 256, 933*0Sstevel@tonic-gate 256, 934*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 935*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 936*0Sstevel@tonic-gate }, 937*0Sstevel@tonic-gate /* Cipher 37 */ 938*0Sstevel@tonic-gate { 939*0Sstevel@tonic-gate 0, 940*0Sstevel@tonic-gate TLS1_TXT_DH_RSA_WITH_AES_256_SHA, 941*0Sstevel@tonic-gate TLS1_CK_DH_RSA_WITH_AES_256_SHA, 942*0Sstevel@tonic-gate SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, 943*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 944*0Sstevel@tonic-gate 0, 945*0Sstevel@tonic-gate 256, 946*0Sstevel@tonic-gate 256, 947*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 948*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 949*0Sstevel@tonic-gate }, 950*0Sstevel@tonic-gate /* Cipher 38 */ 951*0Sstevel@tonic-gate { 952*0Sstevel@tonic-gate 1, 953*0Sstevel@tonic-gate TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, 954*0Sstevel@tonic-gate TLS1_CK_DHE_DSS_WITH_AES_256_SHA, 955*0Sstevel@tonic-gate SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1, 956*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 957*0Sstevel@tonic-gate 0, 958*0Sstevel@tonic-gate 256, 959*0Sstevel@tonic-gate 256, 960*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 961*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 962*0Sstevel@tonic-gate }, 963*0Sstevel@tonic-gate /* Cipher 39 */ 964*0Sstevel@tonic-gate { 965*0Sstevel@tonic-gate 1, 966*0Sstevel@tonic-gate TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, 967*0Sstevel@tonic-gate TLS1_CK_DHE_RSA_WITH_AES_256_SHA, 968*0Sstevel@tonic-gate SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, 969*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 970*0Sstevel@tonic-gate 0, 971*0Sstevel@tonic-gate 256, 972*0Sstevel@tonic-gate 256, 973*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 974*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 975*0Sstevel@tonic-gate }, 976*0Sstevel@tonic-gate /* Cipher 3A */ 977*0Sstevel@tonic-gate { 978*0Sstevel@tonic-gate 1, 979*0Sstevel@tonic-gate TLS1_TXT_ADH_WITH_AES_256_SHA, 980*0Sstevel@tonic-gate TLS1_CK_ADH_WITH_AES_256_SHA, 981*0Sstevel@tonic-gate SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, 982*0Sstevel@tonic-gate SSL_NOT_EXP|SSL_HIGH, 983*0Sstevel@tonic-gate 0, 984*0Sstevel@tonic-gate 256, 985*0Sstevel@tonic-gate 256, 986*0Sstevel@tonic-gate SSL_ALL_CIPHERS, 987*0Sstevel@tonic-gate SSL_ALL_STRENGTHS, 988*0Sstevel@tonic-gate }, 989*0Sstevel@tonic-gate 990*0Sstevel@tonic-gate /* end of list */ 991*0Sstevel@tonic-gate }; 992*0Sstevel@tonic-gate 993*0Sstevel@tonic-gate static SSL3_ENC_METHOD SSLv3_enc_data={ 994*0Sstevel@tonic-gate ssl3_enc, 995*0Sstevel@tonic-gate ssl3_mac, 996*0Sstevel@tonic-gate ssl3_setup_key_block, 997*0Sstevel@tonic-gate ssl3_generate_master_secret, 998*0Sstevel@tonic-gate ssl3_change_cipher_state, 999*0Sstevel@tonic-gate ssl3_final_finish_mac, 1000*0Sstevel@tonic-gate MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, 1001*0Sstevel@tonic-gate ssl3_cert_verify_mac, 1002*0Sstevel@tonic-gate SSL3_MD_CLIENT_FINISHED_CONST,4, 1003*0Sstevel@tonic-gate SSL3_MD_SERVER_FINISHED_CONST,4, 1004*0Sstevel@tonic-gate ssl3_alert_code, 1005*0Sstevel@tonic-gate }; 1006*0Sstevel@tonic-gate 1007*0Sstevel@tonic-gate static SSL_METHOD SSLv3_data= { 1008*0Sstevel@tonic-gate SSL3_VERSION, 1009*0Sstevel@tonic-gate ssl3_new, 1010*0Sstevel@tonic-gate ssl3_clear, 1011*0Sstevel@tonic-gate ssl3_free, 1012*0Sstevel@tonic-gate ssl_undefined_function, 1013*0Sstevel@tonic-gate ssl_undefined_function, 1014*0Sstevel@tonic-gate ssl3_read, 1015*0Sstevel@tonic-gate ssl3_peek, 1016*0Sstevel@tonic-gate ssl3_write, 1017*0Sstevel@tonic-gate ssl3_shutdown, 1018*0Sstevel@tonic-gate ssl3_renegotiate, 1019*0Sstevel@tonic-gate ssl3_renegotiate_check, 1020*0Sstevel@tonic-gate ssl3_ctrl, 1021*0Sstevel@tonic-gate ssl3_ctx_ctrl, 1022*0Sstevel@tonic-gate ssl3_get_cipher_by_char, 1023*0Sstevel@tonic-gate ssl3_put_cipher_by_char, 1024*0Sstevel@tonic-gate ssl3_pending, 1025*0Sstevel@tonic-gate ssl3_num_ciphers, 1026*0Sstevel@tonic-gate ssl3_get_cipher, 1027*0Sstevel@tonic-gate ssl_bad_method, 1028*0Sstevel@tonic-gate ssl3_default_timeout, 1029*0Sstevel@tonic-gate &SSLv3_enc_data, 1030*0Sstevel@tonic-gate ssl_undefined_function, 1031*0Sstevel@tonic-gate ssl3_callback_ctrl, 1032*0Sstevel@tonic-gate ssl3_ctx_callback_ctrl, 1033*0Sstevel@tonic-gate }; 1034*0Sstevel@tonic-gate 1035*0Sstevel@tonic-gate static long ssl3_default_timeout(void) 1036*0Sstevel@tonic-gate { 1037*0Sstevel@tonic-gate /* 2 hours, the 24 hours mentioned in the SSLv3 spec 1038*0Sstevel@tonic-gate * is way too long for http, the cache would over fill */ 1039*0Sstevel@tonic-gate return(60*60*2); 1040*0Sstevel@tonic-gate } 1041*0Sstevel@tonic-gate 1042*0Sstevel@tonic-gate SSL_METHOD *sslv3_base_method(void) 1043*0Sstevel@tonic-gate { 1044*0Sstevel@tonic-gate return(&SSLv3_data); 1045*0Sstevel@tonic-gate } 1046*0Sstevel@tonic-gate 1047*0Sstevel@tonic-gate int ssl3_num_ciphers(void) 1048*0Sstevel@tonic-gate { 1049*0Sstevel@tonic-gate return(SSL3_NUM_CIPHERS); 1050*0Sstevel@tonic-gate } 1051*0Sstevel@tonic-gate 1052*0Sstevel@tonic-gate SSL_CIPHER *ssl3_get_cipher(unsigned int u) 1053*0Sstevel@tonic-gate { 1054*0Sstevel@tonic-gate if (u < SSL3_NUM_CIPHERS) 1055*0Sstevel@tonic-gate return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u])); 1056*0Sstevel@tonic-gate else 1057*0Sstevel@tonic-gate return(NULL); 1058*0Sstevel@tonic-gate } 1059*0Sstevel@tonic-gate 1060*0Sstevel@tonic-gate int ssl3_pending(SSL *s) 1061*0Sstevel@tonic-gate { 1062*0Sstevel@tonic-gate if (s->rstate == SSL_ST_READ_BODY) 1063*0Sstevel@tonic-gate return 0; 1064*0Sstevel@tonic-gate 1065*0Sstevel@tonic-gate return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0; 1066*0Sstevel@tonic-gate } 1067*0Sstevel@tonic-gate 1068*0Sstevel@tonic-gate int ssl3_new(SSL *s) 1069*0Sstevel@tonic-gate { 1070*0Sstevel@tonic-gate SSL3_STATE *s3; 1071*0Sstevel@tonic-gate 1072*0Sstevel@tonic-gate if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err; 1073*0Sstevel@tonic-gate memset(s3,0,sizeof *s3); 1074*0Sstevel@tonic-gate EVP_MD_CTX_init(&s3->finish_dgst1); 1075*0Sstevel@tonic-gate EVP_MD_CTX_init(&s3->finish_dgst2); 1076*0Sstevel@tonic-gate 1077*0Sstevel@tonic-gate s->s3=s3; 1078*0Sstevel@tonic-gate 1079*0Sstevel@tonic-gate s->method->ssl_clear(s); 1080*0Sstevel@tonic-gate return(1); 1081*0Sstevel@tonic-gate err: 1082*0Sstevel@tonic-gate return(0); 1083*0Sstevel@tonic-gate } 1084*0Sstevel@tonic-gate 1085*0Sstevel@tonic-gate void ssl3_free(SSL *s) 1086*0Sstevel@tonic-gate { 1087*0Sstevel@tonic-gate if(s == NULL) 1088*0Sstevel@tonic-gate return; 1089*0Sstevel@tonic-gate 1090*0Sstevel@tonic-gate ssl3_cleanup_key_block(s); 1091*0Sstevel@tonic-gate if (s->s3->rbuf.buf != NULL) 1092*0Sstevel@tonic-gate OPENSSL_free(s->s3->rbuf.buf); 1093*0Sstevel@tonic-gate if (s->s3->wbuf.buf != NULL) 1094*0Sstevel@tonic-gate OPENSSL_free(s->s3->wbuf.buf); 1095*0Sstevel@tonic-gate if (s->s3->rrec.comp != NULL) 1096*0Sstevel@tonic-gate OPENSSL_free(s->s3->rrec.comp); 1097*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1098*0Sstevel@tonic-gate if (s->s3->tmp.dh != NULL) 1099*0Sstevel@tonic-gate DH_free(s->s3->tmp.dh); 1100*0Sstevel@tonic-gate #endif 1101*0Sstevel@tonic-gate if (s->s3->tmp.ca_names != NULL) 1102*0Sstevel@tonic-gate sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 1103*0Sstevel@tonic-gate EVP_MD_CTX_cleanup(&s->s3->finish_dgst1); 1104*0Sstevel@tonic-gate EVP_MD_CTX_cleanup(&s->s3->finish_dgst2); 1105*0Sstevel@tonic-gate OPENSSL_cleanse(s->s3,sizeof *s->s3); 1106*0Sstevel@tonic-gate OPENSSL_free(s->s3); 1107*0Sstevel@tonic-gate s->s3=NULL; 1108*0Sstevel@tonic-gate } 1109*0Sstevel@tonic-gate 1110*0Sstevel@tonic-gate void ssl3_clear(SSL *s) 1111*0Sstevel@tonic-gate { 1112*0Sstevel@tonic-gate unsigned char *rp,*wp; 1113*0Sstevel@tonic-gate size_t rlen, wlen; 1114*0Sstevel@tonic-gate 1115*0Sstevel@tonic-gate ssl3_cleanup_key_block(s); 1116*0Sstevel@tonic-gate if (s->s3->tmp.ca_names != NULL) 1117*0Sstevel@tonic-gate sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free); 1118*0Sstevel@tonic-gate 1119*0Sstevel@tonic-gate if (s->s3->rrec.comp != NULL) 1120*0Sstevel@tonic-gate { 1121*0Sstevel@tonic-gate OPENSSL_free(s->s3->rrec.comp); 1122*0Sstevel@tonic-gate s->s3->rrec.comp=NULL; 1123*0Sstevel@tonic-gate } 1124*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1125*0Sstevel@tonic-gate if (s->s3->tmp.dh != NULL) 1126*0Sstevel@tonic-gate DH_free(s->s3->tmp.dh); 1127*0Sstevel@tonic-gate #endif 1128*0Sstevel@tonic-gate 1129*0Sstevel@tonic-gate rp = s->s3->rbuf.buf; 1130*0Sstevel@tonic-gate wp = s->s3->wbuf.buf; 1131*0Sstevel@tonic-gate rlen = s->s3->rbuf.len; 1132*0Sstevel@tonic-gate wlen = s->s3->wbuf.len; 1133*0Sstevel@tonic-gate 1134*0Sstevel@tonic-gate EVP_MD_CTX_cleanup(&s->s3->finish_dgst1); 1135*0Sstevel@tonic-gate EVP_MD_CTX_cleanup(&s->s3->finish_dgst2); 1136*0Sstevel@tonic-gate 1137*0Sstevel@tonic-gate memset(s->s3,0,sizeof *s->s3); 1138*0Sstevel@tonic-gate s->s3->rbuf.buf = rp; 1139*0Sstevel@tonic-gate s->s3->wbuf.buf = wp; 1140*0Sstevel@tonic-gate s->s3->rbuf.len = rlen; 1141*0Sstevel@tonic-gate s->s3->wbuf.len = wlen; 1142*0Sstevel@tonic-gate 1143*0Sstevel@tonic-gate ssl_free_wbio_buffer(s); 1144*0Sstevel@tonic-gate 1145*0Sstevel@tonic-gate s->packet_length=0; 1146*0Sstevel@tonic-gate s->s3->renegotiate=0; 1147*0Sstevel@tonic-gate s->s3->total_renegotiations=0; 1148*0Sstevel@tonic-gate s->s3->num_renegotiations=0; 1149*0Sstevel@tonic-gate s->s3->in_read_app_data=0; 1150*0Sstevel@tonic-gate s->version=SSL3_VERSION; 1151*0Sstevel@tonic-gate } 1152*0Sstevel@tonic-gate 1153*0Sstevel@tonic-gate long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) 1154*0Sstevel@tonic-gate { 1155*0Sstevel@tonic-gate int ret=0; 1156*0Sstevel@tonic-gate 1157*0Sstevel@tonic-gate #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA) 1158*0Sstevel@tonic-gate if ( 1159*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1160*0Sstevel@tonic-gate cmd == SSL_CTRL_SET_TMP_RSA || 1161*0Sstevel@tonic-gate cmd == SSL_CTRL_SET_TMP_RSA_CB || 1162*0Sstevel@tonic-gate #endif 1163*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 1164*0Sstevel@tonic-gate cmd == SSL_CTRL_SET_TMP_DH || 1165*0Sstevel@tonic-gate cmd == SSL_CTRL_SET_TMP_DH_CB || 1166*0Sstevel@tonic-gate #endif 1167*0Sstevel@tonic-gate 0) 1168*0Sstevel@tonic-gate { 1169*0Sstevel@tonic-gate if (!ssl_cert_inst(&s->cert)) 1170*0Sstevel@tonic-gate { 1171*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE); 1172*0Sstevel@tonic-gate return(0); 1173*0Sstevel@tonic-gate } 1174*0Sstevel@tonic-gate } 1175*0Sstevel@tonic-gate #endif 1176*0Sstevel@tonic-gate 1177*0Sstevel@tonic-gate switch (cmd) 1178*0Sstevel@tonic-gate { 1179*0Sstevel@tonic-gate case SSL_CTRL_GET_SESSION_REUSED: 1180*0Sstevel@tonic-gate ret=s->hit; 1181*0Sstevel@tonic-gate break; 1182*0Sstevel@tonic-gate case SSL_CTRL_GET_CLIENT_CERT_REQUEST: 1183*0Sstevel@tonic-gate break; 1184*0Sstevel@tonic-gate case SSL_CTRL_GET_NUM_RENEGOTIATIONS: 1185*0Sstevel@tonic-gate ret=s->s3->num_renegotiations; 1186*0Sstevel@tonic-gate break; 1187*0Sstevel@tonic-gate case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS: 1188*0Sstevel@tonic-gate ret=s->s3->num_renegotiations; 1189*0Sstevel@tonic-gate s->s3->num_renegotiations=0; 1190*0Sstevel@tonic-gate break; 1191*0Sstevel@tonic-gate case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS: 1192*0Sstevel@tonic-gate ret=s->s3->total_renegotiations; 1193*0Sstevel@tonic-gate break; 1194*0Sstevel@tonic-gate case SSL_CTRL_GET_FLAGS: 1195*0Sstevel@tonic-gate ret=(int)(s->s3->flags); 1196*0Sstevel@tonic-gate break; 1197*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1198*0Sstevel@tonic-gate case SSL_CTRL_NEED_TMP_RSA: 1199*0Sstevel@tonic-gate if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) && 1200*0Sstevel@tonic-gate ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 1201*0Sstevel@tonic-gate (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))) 1202*0Sstevel@tonic-gate ret = 1; 1203*0Sstevel@tonic-gate break; 1204*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_RSA: 1205*0Sstevel@tonic-gate { 1206*0Sstevel@tonic-gate RSA *rsa = (RSA *)parg; 1207*0Sstevel@tonic-gate if (rsa == NULL) 1208*0Sstevel@tonic-gate { 1209*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 1210*0Sstevel@tonic-gate return(ret); 1211*0Sstevel@tonic-gate } 1212*0Sstevel@tonic-gate if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) 1213*0Sstevel@tonic-gate { 1214*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB); 1215*0Sstevel@tonic-gate return(ret); 1216*0Sstevel@tonic-gate } 1217*0Sstevel@tonic-gate if (s->cert->rsa_tmp != NULL) 1218*0Sstevel@tonic-gate RSA_free(s->cert->rsa_tmp); 1219*0Sstevel@tonic-gate s->cert->rsa_tmp = rsa; 1220*0Sstevel@tonic-gate ret = 1; 1221*0Sstevel@tonic-gate } 1222*0Sstevel@tonic-gate break; 1223*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_RSA_CB: 1224*0Sstevel@tonic-gate { 1225*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1226*0Sstevel@tonic-gate return(ret); 1227*0Sstevel@tonic-gate } 1228*0Sstevel@tonic-gate break; 1229*0Sstevel@tonic-gate #endif 1230*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1231*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_DH: 1232*0Sstevel@tonic-gate { 1233*0Sstevel@tonic-gate DH *dh = (DH *)parg; 1234*0Sstevel@tonic-gate if (dh == NULL) 1235*0Sstevel@tonic-gate { 1236*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); 1237*0Sstevel@tonic-gate return(ret); 1238*0Sstevel@tonic-gate } 1239*0Sstevel@tonic-gate if ((dh = DHparams_dup(dh)) == NULL) 1240*0Sstevel@tonic-gate { 1241*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 1242*0Sstevel@tonic-gate return(ret); 1243*0Sstevel@tonic-gate } 1244*0Sstevel@tonic-gate if (!(s->options & SSL_OP_SINGLE_DH_USE)) 1245*0Sstevel@tonic-gate { 1246*0Sstevel@tonic-gate if (!DH_generate_key(dh)) 1247*0Sstevel@tonic-gate { 1248*0Sstevel@tonic-gate DH_free(dh); 1249*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB); 1250*0Sstevel@tonic-gate return(ret); 1251*0Sstevel@tonic-gate } 1252*0Sstevel@tonic-gate } 1253*0Sstevel@tonic-gate if (s->cert->dh_tmp != NULL) 1254*0Sstevel@tonic-gate DH_free(s->cert->dh_tmp); 1255*0Sstevel@tonic-gate s->cert->dh_tmp = dh; 1256*0Sstevel@tonic-gate ret = 1; 1257*0Sstevel@tonic-gate } 1258*0Sstevel@tonic-gate break; 1259*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_DH_CB: 1260*0Sstevel@tonic-gate { 1261*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1262*0Sstevel@tonic-gate return(ret); 1263*0Sstevel@tonic-gate } 1264*0Sstevel@tonic-gate break; 1265*0Sstevel@tonic-gate #endif 1266*0Sstevel@tonic-gate default: 1267*0Sstevel@tonic-gate break; 1268*0Sstevel@tonic-gate } 1269*0Sstevel@tonic-gate return(ret); 1270*0Sstevel@tonic-gate } 1271*0Sstevel@tonic-gate 1272*0Sstevel@tonic-gate long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)()) 1273*0Sstevel@tonic-gate { 1274*0Sstevel@tonic-gate int ret=0; 1275*0Sstevel@tonic-gate 1276*0Sstevel@tonic-gate #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA) 1277*0Sstevel@tonic-gate if ( 1278*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1279*0Sstevel@tonic-gate cmd == SSL_CTRL_SET_TMP_RSA_CB || 1280*0Sstevel@tonic-gate #endif 1281*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 1282*0Sstevel@tonic-gate cmd == SSL_CTRL_SET_TMP_DH_CB || 1283*0Sstevel@tonic-gate #endif 1284*0Sstevel@tonic-gate 0) 1285*0Sstevel@tonic-gate { 1286*0Sstevel@tonic-gate if (!ssl_cert_inst(&s->cert)) 1287*0Sstevel@tonic-gate { 1288*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE); 1289*0Sstevel@tonic-gate return(0); 1290*0Sstevel@tonic-gate } 1291*0Sstevel@tonic-gate } 1292*0Sstevel@tonic-gate #endif 1293*0Sstevel@tonic-gate 1294*0Sstevel@tonic-gate switch (cmd) 1295*0Sstevel@tonic-gate { 1296*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1297*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_RSA_CB: 1298*0Sstevel@tonic-gate { 1299*0Sstevel@tonic-gate s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 1300*0Sstevel@tonic-gate } 1301*0Sstevel@tonic-gate break; 1302*0Sstevel@tonic-gate #endif 1303*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1304*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_DH_CB: 1305*0Sstevel@tonic-gate { 1306*0Sstevel@tonic-gate s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 1307*0Sstevel@tonic-gate } 1308*0Sstevel@tonic-gate break; 1309*0Sstevel@tonic-gate #endif 1310*0Sstevel@tonic-gate default: 1311*0Sstevel@tonic-gate break; 1312*0Sstevel@tonic-gate } 1313*0Sstevel@tonic-gate return(ret); 1314*0Sstevel@tonic-gate } 1315*0Sstevel@tonic-gate 1316*0Sstevel@tonic-gate long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) 1317*0Sstevel@tonic-gate { 1318*0Sstevel@tonic-gate CERT *cert; 1319*0Sstevel@tonic-gate 1320*0Sstevel@tonic-gate cert=ctx->cert; 1321*0Sstevel@tonic-gate 1322*0Sstevel@tonic-gate switch (cmd) 1323*0Sstevel@tonic-gate { 1324*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1325*0Sstevel@tonic-gate case SSL_CTRL_NEED_TMP_RSA: 1326*0Sstevel@tonic-gate if ( (cert->rsa_tmp == NULL) && 1327*0Sstevel@tonic-gate ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) || 1328*0Sstevel@tonic-gate (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))) 1329*0Sstevel@tonic-gate ) 1330*0Sstevel@tonic-gate return(1); 1331*0Sstevel@tonic-gate else 1332*0Sstevel@tonic-gate return(0); 1333*0Sstevel@tonic-gate /* break; */ 1334*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_RSA: 1335*0Sstevel@tonic-gate { 1336*0Sstevel@tonic-gate RSA *rsa; 1337*0Sstevel@tonic-gate int i; 1338*0Sstevel@tonic-gate 1339*0Sstevel@tonic-gate rsa=(RSA *)parg; 1340*0Sstevel@tonic-gate i=1; 1341*0Sstevel@tonic-gate if (rsa == NULL) 1342*0Sstevel@tonic-gate i=0; 1343*0Sstevel@tonic-gate else 1344*0Sstevel@tonic-gate { 1345*0Sstevel@tonic-gate if ((rsa=RSAPrivateKey_dup(rsa)) == NULL) 1346*0Sstevel@tonic-gate i=0; 1347*0Sstevel@tonic-gate } 1348*0Sstevel@tonic-gate if (!i) 1349*0Sstevel@tonic-gate { 1350*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB); 1351*0Sstevel@tonic-gate return(0); 1352*0Sstevel@tonic-gate } 1353*0Sstevel@tonic-gate else 1354*0Sstevel@tonic-gate { 1355*0Sstevel@tonic-gate if (cert->rsa_tmp != NULL) 1356*0Sstevel@tonic-gate RSA_free(cert->rsa_tmp); 1357*0Sstevel@tonic-gate cert->rsa_tmp=rsa; 1358*0Sstevel@tonic-gate return(1); 1359*0Sstevel@tonic-gate } 1360*0Sstevel@tonic-gate } 1361*0Sstevel@tonic-gate /* break; */ 1362*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_RSA_CB: 1363*0Sstevel@tonic-gate { 1364*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1365*0Sstevel@tonic-gate return(0); 1366*0Sstevel@tonic-gate } 1367*0Sstevel@tonic-gate break; 1368*0Sstevel@tonic-gate #endif 1369*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1370*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_DH: 1371*0Sstevel@tonic-gate { 1372*0Sstevel@tonic-gate DH *new=NULL,*dh; 1373*0Sstevel@tonic-gate 1374*0Sstevel@tonic-gate dh=(DH *)parg; 1375*0Sstevel@tonic-gate if ((new=DHparams_dup(dh)) == NULL) 1376*0Sstevel@tonic-gate { 1377*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); 1378*0Sstevel@tonic-gate return 0; 1379*0Sstevel@tonic-gate } 1380*0Sstevel@tonic-gate if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) 1381*0Sstevel@tonic-gate { 1382*0Sstevel@tonic-gate if (!DH_generate_key(new)) 1383*0Sstevel@tonic-gate { 1384*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB); 1385*0Sstevel@tonic-gate DH_free(new); 1386*0Sstevel@tonic-gate return 0; 1387*0Sstevel@tonic-gate } 1388*0Sstevel@tonic-gate } 1389*0Sstevel@tonic-gate if (cert->dh_tmp != NULL) 1390*0Sstevel@tonic-gate DH_free(cert->dh_tmp); 1391*0Sstevel@tonic-gate cert->dh_tmp=new; 1392*0Sstevel@tonic-gate return 1; 1393*0Sstevel@tonic-gate } 1394*0Sstevel@tonic-gate /*break; */ 1395*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_DH_CB: 1396*0Sstevel@tonic-gate { 1397*0Sstevel@tonic-gate SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1398*0Sstevel@tonic-gate return(0); 1399*0Sstevel@tonic-gate } 1400*0Sstevel@tonic-gate break; 1401*0Sstevel@tonic-gate #endif 1402*0Sstevel@tonic-gate /* A Thawte special :-) */ 1403*0Sstevel@tonic-gate case SSL_CTRL_EXTRA_CHAIN_CERT: 1404*0Sstevel@tonic-gate if (ctx->extra_certs == NULL) 1405*0Sstevel@tonic-gate { 1406*0Sstevel@tonic-gate if ((ctx->extra_certs=sk_X509_new_null()) == NULL) 1407*0Sstevel@tonic-gate return(0); 1408*0Sstevel@tonic-gate } 1409*0Sstevel@tonic-gate sk_X509_push(ctx->extra_certs,(X509 *)parg); 1410*0Sstevel@tonic-gate break; 1411*0Sstevel@tonic-gate 1412*0Sstevel@tonic-gate default: 1413*0Sstevel@tonic-gate return(0); 1414*0Sstevel@tonic-gate } 1415*0Sstevel@tonic-gate return(1); 1416*0Sstevel@tonic-gate } 1417*0Sstevel@tonic-gate 1418*0Sstevel@tonic-gate long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)()) 1419*0Sstevel@tonic-gate { 1420*0Sstevel@tonic-gate CERT *cert; 1421*0Sstevel@tonic-gate 1422*0Sstevel@tonic-gate cert=ctx->cert; 1423*0Sstevel@tonic-gate 1424*0Sstevel@tonic-gate switch (cmd) 1425*0Sstevel@tonic-gate { 1426*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1427*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_RSA_CB: 1428*0Sstevel@tonic-gate { 1429*0Sstevel@tonic-gate cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp; 1430*0Sstevel@tonic-gate } 1431*0Sstevel@tonic-gate break; 1432*0Sstevel@tonic-gate #endif 1433*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1434*0Sstevel@tonic-gate case SSL_CTRL_SET_TMP_DH_CB: 1435*0Sstevel@tonic-gate { 1436*0Sstevel@tonic-gate cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 1437*0Sstevel@tonic-gate } 1438*0Sstevel@tonic-gate break; 1439*0Sstevel@tonic-gate #endif 1440*0Sstevel@tonic-gate default: 1441*0Sstevel@tonic-gate return(0); 1442*0Sstevel@tonic-gate } 1443*0Sstevel@tonic-gate return(1); 1444*0Sstevel@tonic-gate } 1445*0Sstevel@tonic-gate 1446*0Sstevel@tonic-gate /* This function needs to check if the ciphers required are actually 1447*0Sstevel@tonic-gate * available */ 1448*0Sstevel@tonic-gate SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p) 1449*0Sstevel@tonic-gate { 1450*0Sstevel@tonic-gate static int init=1; 1451*0Sstevel@tonic-gate static SSL_CIPHER *sorted[SSL3_NUM_CIPHERS]; 1452*0Sstevel@tonic-gate SSL_CIPHER c,*cp= &c,**cpp; 1453*0Sstevel@tonic-gate unsigned long id; 1454*0Sstevel@tonic-gate int i; 1455*0Sstevel@tonic-gate 1456*0Sstevel@tonic-gate if (init) 1457*0Sstevel@tonic-gate { 1458*0Sstevel@tonic-gate CRYPTO_w_lock(CRYPTO_LOCK_SSL); 1459*0Sstevel@tonic-gate 1460*0Sstevel@tonic-gate if (init) 1461*0Sstevel@tonic-gate { 1462*0Sstevel@tonic-gate for (i=0; i<SSL3_NUM_CIPHERS; i++) 1463*0Sstevel@tonic-gate sorted[i]= &(ssl3_ciphers[i]); 1464*0Sstevel@tonic-gate 1465*0Sstevel@tonic-gate qsort(sorted, 1466*0Sstevel@tonic-gate SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *), 1467*0Sstevel@tonic-gate FP_ICC ssl_cipher_ptr_id_cmp); 1468*0Sstevel@tonic-gate 1469*0Sstevel@tonic-gate init=0; 1470*0Sstevel@tonic-gate } 1471*0Sstevel@tonic-gate 1472*0Sstevel@tonic-gate CRYPTO_w_unlock(CRYPTO_LOCK_SSL); 1473*0Sstevel@tonic-gate } 1474*0Sstevel@tonic-gate 1475*0Sstevel@tonic-gate id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1]; 1476*0Sstevel@tonic-gate c.id=id; 1477*0Sstevel@tonic-gate cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp, 1478*0Sstevel@tonic-gate (char *)sorted, 1479*0Sstevel@tonic-gate SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *), 1480*0Sstevel@tonic-gate FP_ICC ssl_cipher_ptr_id_cmp); 1481*0Sstevel@tonic-gate if ((cpp == NULL) || !(*cpp)->valid) 1482*0Sstevel@tonic-gate return(NULL); 1483*0Sstevel@tonic-gate else 1484*0Sstevel@tonic-gate return(*cpp); 1485*0Sstevel@tonic-gate } 1486*0Sstevel@tonic-gate 1487*0Sstevel@tonic-gate int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p) 1488*0Sstevel@tonic-gate { 1489*0Sstevel@tonic-gate long l; 1490*0Sstevel@tonic-gate 1491*0Sstevel@tonic-gate if (p != NULL) 1492*0Sstevel@tonic-gate { 1493*0Sstevel@tonic-gate l=c->id; 1494*0Sstevel@tonic-gate if ((l & 0xff000000) != 0x03000000) return(0); 1495*0Sstevel@tonic-gate p[0]=((unsigned char)(l>> 8L))&0xFF; 1496*0Sstevel@tonic-gate p[1]=((unsigned char)(l ))&0xFF; 1497*0Sstevel@tonic-gate } 1498*0Sstevel@tonic-gate return(2); 1499*0Sstevel@tonic-gate } 1500*0Sstevel@tonic-gate 1501*0Sstevel@tonic-gate SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, 1502*0Sstevel@tonic-gate STACK_OF(SSL_CIPHER) *srvr) 1503*0Sstevel@tonic-gate { 1504*0Sstevel@tonic-gate SSL_CIPHER *c,*ret=NULL; 1505*0Sstevel@tonic-gate STACK_OF(SSL_CIPHER) *prio, *allow; 1506*0Sstevel@tonic-gate int i,j,ok; 1507*0Sstevel@tonic-gate CERT *cert; 1508*0Sstevel@tonic-gate unsigned long alg,mask,emask; 1509*0Sstevel@tonic-gate 1510*0Sstevel@tonic-gate /* Let's see which ciphers we can support */ 1511*0Sstevel@tonic-gate cert=s->cert; 1512*0Sstevel@tonic-gate 1513*0Sstevel@tonic-gate #if 0 1514*0Sstevel@tonic-gate /* Do not set the compare functions, because this may lead to a 1515*0Sstevel@tonic-gate * reordering by "id". We want to keep the original ordering. 1516*0Sstevel@tonic-gate * We may pay a price in performance during sk_SSL_CIPHER_find(), 1517*0Sstevel@tonic-gate * but would have to pay with the price of sk_SSL_CIPHER_dup(). 1518*0Sstevel@tonic-gate */ 1519*0Sstevel@tonic-gate sk_SSL_CIPHER_set_cmp_func(srvr, ssl_cipher_ptr_id_cmp); 1520*0Sstevel@tonic-gate sk_SSL_CIPHER_set_cmp_func(clnt, ssl_cipher_ptr_id_cmp); 1521*0Sstevel@tonic-gate #endif 1522*0Sstevel@tonic-gate 1523*0Sstevel@tonic-gate #ifdef CIPHER_DEBUG 1524*0Sstevel@tonic-gate printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), srvr); 1525*0Sstevel@tonic-gate for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i) 1526*0Sstevel@tonic-gate { 1527*0Sstevel@tonic-gate c=sk_SSL_CIPHER_value(srvr,i); 1528*0Sstevel@tonic-gate printf("%p:%s\n",c,c->name); 1529*0Sstevel@tonic-gate } 1530*0Sstevel@tonic-gate printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), clnt); 1531*0Sstevel@tonic-gate for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i) 1532*0Sstevel@tonic-gate { 1533*0Sstevel@tonic-gate c=sk_SSL_CIPHER_value(clnt,i); 1534*0Sstevel@tonic-gate printf("%p:%s\n",c,c->name); 1535*0Sstevel@tonic-gate } 1536*0Sstevel@tonic-gate #endif 1537*0Sstevel@tonic-gate 1538*0Sstevel@tonic-gate if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) 1539*0Sstevel@tonic-gate { 1540*0Sstevel@tonic-gate prio = srvr; 1541*0Sstevel@tonic-gate allow = clnt; 1542*0Sstevel@tonic-gate } 1543*0Sstevel@tonic-gate else 1544*0Sstevel@tonic-gate { 1545*0Sstevel@tonic-gate prio = clnt; 1546*0Sstevel@tonic-gate allow = srvr; 1547*0Sstevel@tonic-gate } 1548*0Sstevel@tonic-gate 1549*0Sstevel@tonic-gate for (i=0; i<sk_SSL_CIPHER_num(prio); i++) 1550*0Sstevel@tonic-gate { 1551*0Sstevel@tonic-gate c=sk_SSL_CIPHER_value(prio,i); 1552*0Sstevel@tonic-gate 1553*0Sstevel@tonic-gate ssl_set_cert_masks(cert,c); 1554*0Sstevel@tonic-gate mask=cert->mask; 1555*0Sstevel@tonic-gate emask=cert->export_mask; 1556*0Sstevel@tonic-gate 1557*0Sstevel@tonic-gate #ifdef KSSL_DEBUG 1558*0Sstevel@tonic-gate printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms); 1559*0Sstevel@tonic-gate #endif /* KSSL_DEBUG */ 1560*0Sstevel@tonic-gate 1561*0Sstevel@tonic-gate alg=c->algorithms&(SSL_MKEY_MASK|SSL_AUTH_MASK); 1562*0Sstevel@tonic-gate #ifndef OPENSSL_NO_KRB5 1563*0Sstevel@tonic-gate if (alg & SSL_KRB5) 1564*0Sstevel@tonic-gate { 1565*0Sstevel@tonic-gate if ( !kssl_keytab_is_available(s->kssl_ctx) ) 1566*0Sstevel@tonic-gate continue; 1567*0Sstevel@tonic-gate } 1568*0Sstevel@tonic-gate #endif /* OPENSSL_NO_KRB5 */ 1569*0Sstevel@tonic-gate if (SSL_C_IS_EXPORT(c)) 1570*0Sstevel@tonic-gate { 1571*0Sstevel@tonic-gate ok=((alg & emask) == alg)?1:0; 1572*0Sstevel@tonic-gate #ifdef CIPHER_DEBUG 1573*0Sstevel@tonic-gate printf("%d:[%08lX:%08lX]%p:%s (export)\n",ok,alg,emask, 1574*0Sstevel@tonic-gate c,c->name); 1575*0Sstevel@tonic-gate #endif 1576*0Sstevel@tonic-gate } 1577*0Sstevel@tonic-gate else 1578*0Sstevel@tonic-gate { 1579*0Sstevel@tonic-gate ok=((alg & mask) == alg)?1:0; 1580*0Sstevel@tonic-gate #ifdef CIPHER_DEBUG 1581*0Sstevel@tonic-gate printf("%d:[%08lX:%08lX]%p:%s\n",ok,alg,mask,c, 1582*0Sstevel@tonic-gate c->name); 1583*0Sstevel@tonic-gate #endif 1584*0Sstevel@tonic-gate } 1585*0Sstevel@tonic-gate 1586*0Sstevel@tonic-gate if (!ok) continue; 1587*0Sstevel@tonic-gate 1588*0Sstevel@tonic-gate j=sk_SSL_CIPHER_find(allow,c); 1589*0Sstevel@tonic-gate if (j >= 0) 1590*0Sstevel@tonic-gate { 1591*0Sstevel@tonic-gate ret=sk_SSL_CIPHER_value(allow,j); 1592*0Sstevel@tonic-gate break; 1593*0Sstevel@tonic-gate } 1594*0Sstevel@tonic-gate } 1595*0Sstevel@tonic-gate return(ret); 1596*0Sstevel@tonic-gate } 1597*0Sstevel@tonic-gate 1598*0Sstevel@tonic-gate int ssl3_get_req_cert_type(SSL *s, unsigned char *p) 1599*0Sstevel@tonic-gate { 1600*0Sstevel@tonic-gate int ret=0; 1601*0Sstevel@tonic-gate unsigned long alg; 1602*0Sstevel@tonic-gate 1603*0Sstevel@tonic-gate alg=s->s3->tmp.new_cipher->algorithms; 1604*0Sstevel@tonic-gate 1605*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DH 1606*0Sstevel@tonic-gate if (alg & (SSL_kDHr|SSL_kEDH)) 1607*0Sstevel@tonic-gate { 1608*0Sstevel@tonic-gate # ifndef OPENSSL_NO_RSA 1609*0Sstevel@tonic-gate p[ret++]=SSL3_CT_RSA_FIXED_DH; 1610*0Sstevel@tonic-gate # endif 1611*0Sstevel@tonic-gate # ifndef OPENSSL_NO_DSA 1612*0Sstevel@tonic-gate p[ret++]=SSL3_CT_DSS_FIXED_DH; 1613*0Sstevel@tonic-gate # endif 1614*0Sstevel@tonic-gate } 1615*0Sstevel@tonic-gate if ((s->version == SSL3_VERSION) && 1616*0Sstevel@tonic-gate (alg & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) 1617*0Sstevel@tonic-gate { 1618*0Sstevel@tonic-gate # ifndef OPENSSL_NO_RSA 1619*0Sstevel@tonic-gate p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH; 1620*0Sstevel@tonic-gate # endif 1621*0Sstevel@tonic-gate # ifndef OPENSSL_NO_DSA 1622*0Sstevel@tonic-gate p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH; 1623*0Sstevel@tonic-gate # endif 1624*0Sstevel@tonic-gate } 1625*0Sstevel@tonic-gate #endif /* !OPENSSL_NO_DH */ 1626*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 1627*0Sstevel@tonic-gate p[ret++]=SSL3_CT_RSA_SIGN; 1628*0Sstevel@tonic-gate #endif 1629*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 1630*0Sstevel@tonic-gate p[ret++]=SSL3_CT_DSS_SIGN; 1631*0Sstevel@tonic-gate #endif 1632*0Sstevel@tonic-gate return(ret); 1633*0Sstevel@tonic-gate } 1634*0Sstevel@tonic-gate 1635*0Sstevel@tonic-gate int ssl3_shutdown(SSL *s) 1636*0Sstevel@tonic-gate { 1637*0Sstevel@tonic-gate 1638*0Sstevel@tonic-gate /* Don't do anything much if we have not done the handshake or 1639*0Sstevel@tonic-gate * we don't want to send messages :-) */ 1640*0Sstevel@tonic-gate if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) 1641*0Sstevel@tonic-gate { 1642*0Sstevel@tonic-gate s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); 1643*0Sstevel@tonic-gate return(1); 1644*0Sstevel@tonic-gate } 1645*0Sstevel@tonic-gate 1646*0Sstevel@tonic-gate if (!(s->shutdown & SSL_SENT_SHUTDOWN)) 1647*0Sstevel@tonic-gate { 1648*0Sstevel@tonic-gate s->shutdown|=SSL_SENT_SHUTDOWN; 1649*0Sstevel@tonic-gate #if 1 1650*0Sstevel@tonic-gate ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY); 1651*0Sstevel@tonic-gate #endif 1652*0Sstevel@tonic-gate /* our shutdown alert has been sent now, and if it still needs 1653*0Sstevel@tonic-gate * to be written, s->s3->alert_dispatch will be true */ 1654*0Sstevel@tonic-gate } 1655*0Sstevel@tonic-gate else if (s->s3->alert_dispatch) 1656*0Sstevel@tonic-gate { 1657*0Sstevel@tonic-gate /* resend it if not sent */ 1658*0Sstevel@tonic-gate #if 1 1659*0Sstevel@tonic-gate ssl3_dispatch_alert(s); 1660*0Sstevel@tonic-gate #endif 1661*0Sstevel@tonic-gate } 1662*0Sstevel@tonic-gate else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) 1663*0Sstevel@tonic-gate { 1664*0Sstevel@tonic-gate /* If we are waiting for a close from our peer, we are closed */ 1665*0Sstevel@tonic-gate ssl3_read_bytes(s,0,NULL,0,0); 1666*0Sstevel@tonic-gate } 1667*0Sstevel@tonic-gate 1668*0Sstevel@tonic-gate if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) && 1669*0Sstevel@tonic-gate !s->s3->alert_dispatch) 1670*0Sstevel@tonic-gate return(1); 1671*0Sstevel@tonic-gate else 1672*0Sstevel@tonic-gate return(0); 1673*0Sstevel@tonic-gate } 1674*0Sstevel@tonic-gate 1675*0Sstevel@tonic-gate int ssl3_write(SSL *s, const void *buf, int len) 1676*0Sstevel@tonic-gate { 1677*0Sstevel@tonic-gate int ret,n; 1678*0Sstevel@tonic-gate 1679*0Sstevel@tonic-gate #if 0 1680*0Sstevel@tonic-gate if (s->shutdown & SSL_SEND_SHUTDOWN) 1681*0Sstevel@tonic-gate { 1682*0Sstevel@tonic-gate s->rwstate=SSL_NOTHING; 1683*0Sstevel@tonic-gate return(0); 1684*0Sstevel@tonic-gate } 1685*0Sstevel@tonic-gate #endif 1686*0Sstevel@tonic-gate clear_sys_error(); 1687*0Sstevel@tonic-gate if (s->s3->renegotiate) ssl3_renegotiate_check(s); 1688*0Sstevel@tonic-gate 1689*0Sstevel@tonic-gate /* This is an experimental flag that sends the 1690*0Sstevel@tonic-gate * last handshake message in the same packet as the first 1691*0Sstevel@tonic-gate * use data - used to see if it helps the TCP protocol during 1692*0Sstevel@tonic-gate * session-id reuse */ 1693*0Sstevel@tonic-gate /* The second test is because the buffer may have been removed */ 1694*0Sstevel@tonic-gate if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) 1695*0Sstevel@tonic-gate { 1696*0Sstevel@tonic-gate /* First time through, we write into the buffer */ 1697*0Sstevel@tonic-gate if (s->s3->delay_buf_pop_ret == 0) 1698*0Sstevel@tonic-gate { 1699*0Sstevel@tonic-gate ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, 1700*0Sstevel@tonic-gate buf,len); 1701*0Sstevel@tonic-gate if (ret <= 0) return(ret); 1702*0Sstevel@tonic-gate 1703*0Sstevel@tonic-gate s->s3->delay_buf_pop_ret=ret; 1704*0Sstevel@tonic-gate } 1705*0Sstevel@tonic-gate 1706*0Sstevel@tonic-gate s->rwstate=SSL_WRITING; 1707*0Sstevel@tonic-gate n=BIO_flush(s->wbio); 1708*0Sstevel@tonic-gate if (n <= 0) return(n); 1709*0Sstevel@tonic-gate s->rwstate=SSL_NOTHING; 1710*0Sstevel@tonic-gate 1711*0Sstevel@tonic-gate /* We have flushed the buffer, so remove it */ 1712*0Sstevel@tonic-gate ssl_free_wbio_buffer(s); 1713*0Sstevel@tonic-gate s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER; 1714*0Sstevel@tonic-gate 1715*0Sstevel@tonic-gate ret=s->s3->delay_buf_pop_ret; 1716*0Sstevel@tonic-gate s->s3->delay_buf_pop_ret=0; 1717*0Sstevel@tonic-gate } 1718*0Sstevel@tonic-gate else 1719*0Sstevel@tonic-gate { 1720*0Sstevel@tonic-gate ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA, 1721*0Sstevel@tonic-gate buf,len); 1722*0Sstevel@tonic-gate if (ret <= 0) return(ret); 1723*0Sstevel@tonic-gate } 1724*0Sstevel@tonic-gate 1725*0Sstevel@tonic-gate return(ret); 1726*0Sstevel@tonic-gate } 1727*0Sstevel@tonic-gate 1728*0Sstevel@tonic-gate static int ssl3_read_internal(SSL *s, void *buf, int len, int peek) 1729*0Sstevel@tonic-gate { 1730*0Sstevel@tonic-gate int ret; 1731*0Sstevel@tonic-gate 1732*0Sstevel@tonic-gate clear_sys_error(); 1733*0Sstevel@tonic-gate if (s->s3->renegotiate) ssl3_renegotiate_check(s); 1734*0Sstevel@tonic-gate s->s3->in_read_app_data=1; 1735*0Sstevel@tonic-gate ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek); 1736*0Sstevel@tonic-gate if ((ret == -1) && (s->s3->in_read_app_data == 2)) 1737*0Sstevel@tonic-gate { 1738*0Sstevel@tonic-gate /* ssl3_read_bytes decided to call s->handshake_func, which 1739*0Sstevel@tonic-gate * called ssl3_read_bytes to read handshake data. 1740*0Sstevel@tonic-gate * However, ssl3_read_bytes actually found application data 1741*0Sstevel@tonic-gate * and thinks that application data makes sense here; so disable 1742*0Sstevel@tonic-gate * handshake processing and try to read application data again. */ 1743*0Sstevel@tonic-gate s->in_handshake++; 1744*0Sstevel@tonic-gate ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek); 1745*0Sstevel@tonic-gate s->in_handshake--; 1746*0Sstevel@tonic-gate } 1747*0Sstevel@tonic-gate else 1748*0Sstevel@tonic-gate s->s3->in_read_app_data=0; 1749*0Sstevel@tonic-gate 1750*0Sstevel@tonic-gate return(ret); 1751*0Sstevel@tonic-gate } 1752*0Sstevel@tonic-gate 1753*0Sstevel@tonic-gate int ssl3_read(SSL *s, void *buf, int len) 1754*0Sstevel@tonic-gate { 1755*0Sstevel@tonic-gate return ssl3_read_internal(s, buf, len, 0); 1756*0Sstevel@tonic-gate } 1757*0Sstevel@tonic-gate 1758*0Sstevel@tonic-gate int ssl3_peek(SSL *s, void *buf, int len) 1759*0Sstevel@tonic-gate { 1760*0Sstevel@tonic-gate return ssl3_read_internal(s, buf, len, 1); 1761*0Sstevel@tonic-gate } 1762*0Sstevel@tonic-gate 1763*0Sstevel@tonic-gate int ssl3_renegotiate(SSL *s) 1764*0Sstevel@tonic-gate { 1765*0Sstevel@tonic-gate if (s->handshake_func == NULL) 1766*0Sstevel@tonic-gate return(1); 1767*0Sstevel@tonic-gate 1768*0Sstevel@tonic-gate if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) 1769*0Sstevel@tonic-gate return(0); 1770*0Sstevel@tonic-gate 1771*0Sstevel@tonic-gate s->s3->renegotiate=1; 1772*0Sstevel@tonic-gate return(1); 1773*0Sstevel@tonic-gate } 1774*0Sstevel@tonic-gate 1775*0Sstevel@tonic-gate int ssl3_renegotiate_check(SSL *s) 1776*0Sstevel@tonic-gate { 1777*0Sstevel@tonic-gate int ret=0; 1778*0Sstevel@tonic-gate 1779*0Sstevel@tonic-gate if (s->s3->renegotiate) 1780*0Sstevel@tonic-gate { 1781*0Sstevel@tonic-gate if ( (s->s3->rbuf.left == 0) && 1782*0Sstevel@tonic-gate (s->s3->wbuf.left == 0) && 1783*0Sstevel@tonic-gate !SSL_in_init(s)) 1784*0Sstevel@tonic-gate { 1785*0Sstevel@tonic-gate /* 1786*0Sstevel@tonic-gate if we are the server, and we have sent a 'RENEGOTIATE' message, we 1787*0Sstevel@tonic-gate need to go to SSL_ST_ACCEPT. 1788*0Sstevel@tonic-gate */ 1789*0Sstevel@tonic-gate /* SSL_ST_ACCEPT */ 1790*0Sstevel@tonic-gate s->state=SSL_ST_RENEGOTIATE; 1791*0Sstevel@tonic-gate s->s3->renegotiate=0; 1792*0Sstevel@tonic-gate s->s3->num_renegotiations++; 1793*0Sstevel@tonic-gate s->s3->total_renegotiations++; 1794*0Sstevel@tonic-gate ret=1; 1795*0Sstevel@tonic-gate } 1796*0Sstevel@tonic-gate } 1797*0Sstevel@tonic-gate return(ret); 1798*0Sstevel@tonic-gate } 1799*0Sstevel@tonic-gate 1800