xref: /openbsd-src/lib/libssl/ssl_ciph.c (revision 097a140d792de8b2bbe59ad827d39eabf9b4280a)
1 /* $OpenBSD: ssl_ciph.c,v 1.121 2021/03/24 18:44:00 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer.
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113  * ECC cipher suite support in OpenSSL originally developed by
114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
115  */
116 /* ====================================================================
117  * Copyright 2005 Nokia. All rights reserved.
118  *
119  * The portions of the attached software ("Contribution") is developed by
120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
121  * license.
122  *
123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
125  * support (see RFC 4279) to OpenSSL.
126  *
127  * No patent licenses or other rights except those expressly stated in
128  * the OpenSSL open source license shall be deemed granted or received
129  * expressly, by implication, estoppel, or otherwise.
130  *
131  * No assurances are provided by Nokia that the Contribution does not
132  * infringe the patent or other intellectual property rights of any third
133  * party or that the license provides you with all the necessary rights
134  * to make use of the Contribution.
135  *
136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
140  * OTHERWISE.
141  */
142 
143 #include <stdio.h>
144 
145 #include <openssl/objects.h>
146 
147 #ifndef OPENSSL_NO_ENGINE
148 #include <openssl/engine.h>
149 #endif
150 
151 #include "ssl_locl.h"
152 
153 #define CIPHER_ADD	1
154 #define CIPHER_KILL	2
155 #define CIPHER_DEL	3
156 #define CIPHER_ORD	4
157 #define CIPHER_SPECIAL	5
158 
159 typedef struct cipher_order_st {
160 	const SSL_CIPHER *cipher;
161 	int active;
162 	int dead;
163 	struct cipher_order_st *next, *prev;
164 } CIPHER_ORDER;
165 
166 static const SSL_CIPHER cipher_aliases[] = {
167 
168 	/* "ALL" doesn't include eNULL (must be specifically enabled) */
169 	{
170 		.name = SSL_TXT_ALL,
171 		.algorithm_enc = ~SSL_eNULL,
172 	},
173 
174 	/* "COMPLEMENTOFALL" */
175 	{
176 		.name = SSL_TXT_CMPALL,
177 		.algorithm_enc = SSL_eNULL,
178 	},
179 
180 	/*
181 	 * "COMPLEMENTOFDEFAULT"
182 	 * (does *not* include ciphersuites not found in ALL!)
183 	 */
184 	{
185 		.name = SSL_TXT_CMPDEF,
186 		.algorithm_mkey = SSL_kDHE|SSL_kECDHE,
187 		.algorithm_auth = SSL_aNULL,
188 		.algorithm_enc = ~SSL_eNULL,
189 	},
190 
191 	/*
192 	 * key exchange aliases
193 	 * (some of those using only a single bit here combine multiple key
194 	 * exchange algs according to the RFCs, e.g. kEDH combines DHE_DSS
195 	 * and DHE_RSA)
196 	 */
197 	{
198 		.name = SSL_TXT_kRSA,
199 		.algorithm_mkey = SSL_kRSA,
200 	},
201 	{
202 		.name = SSL_TXT_kEDH,
203 		.algorithm_mkey = SSL_kDHE,
204 	},
205 	{
206 		.name = SSL_TXT_DH,
207 		.algorithm_mkey = SSL_kDHE,
208 	},
209 	{
210 		.name = SSL_TXT_kEECDH,
211 		.algorithm_mkey = SSL_kECDHE,
212 	},
213 	{
214 		.name = SSL_TXT_ECDH,
215 		.algorithm_mkey = SSL_kECDHE,
216 	},
217 	{
218 		.name = SSL_TXT_kGOST,
219 		.algorithm_mkey = SSL_kGOST,
220 	},
221 
222 	/* server authentication aliases */
223 	{
224 		.name = SSL_TXT_aRSA,
225 		.algorithm_auth = SSL_aRSA,
226 	},
227 	{
228 		.name = SSL_TXT_aDSS,
229 		.algorithm_auth = SSL_aDSS,
230 	},
231 	{
232 		.name = SSL_TXT_DSS,
233 		.algorithm_auth = SSL_aDSS,
234 	},
235 	{
236 		.name = SSL_TXT_aNULL,
237 		.algorithm_auth = SSL_aNULL,
238 	},
239 	{
240 		.name = SSL_TXT_aECDSA,
241 		.algorithm_auth = SSL_aECDSA,
242 	},
243 	{
244 		.name = SSL_TXT_ECDSA,
245 		.algorithm_auth = SSL_aECDSA,
246 	},
247 	{
248 		.name = SSL_TXT_aGOST01,
249 		.algorithm_auth = SSL_aGOST01,
250 	},
251 	{
252 		.name = SSL_TXT_aGOST,
253 		.algorithm_auth = SSL_aGOST01,
254 	},
255 
256 	/* aliases combining key exchange and server authentication */
257 	{
258 		.name = SSL_TXT_DHE,
259 		.algorithm_mkey = SSL_kDHE,
260 		.algorithm_auth = ~SSL_aNULL,
261 	},
262 	{
263 		.name = SSL_TXT_EDH,
264 		.algorithm_mkey = SSL_kDHE,
265 		.algorithm_auth = ~SSL_aNULL,
266 	},
267 	{
268 		.name = SSL_TXT_ECDHE,
269 		.algorithm_mkey = SSL_kECDHE,
270 		.algorithm_auth = ~SSL_aNULL,
271 	},
272 	{
273 		.name = SSL_TXT_EECDH,
274 		.algorithm_mkey = SSL_kECDHE,
275 		.algorithm_auth = ~SSL_aNULL,
276 	},
277 	{
278 		.name = SSL_TXT_NULL,
279 		.algorithm_enc = SSL_eNULL,
280 	},
281 	{
282 		.name = SSL_TXT_RSA,
283 		.algorithm_mkey = SSL_kRSA,
284 		.algorithm_auth = SSL_aRSA,
285 	},
286 	{
287 		.name = SSL_TXT_ADH,
288 		.algorithm_mkey = SSL_kDHE,
289 		.algorithm_auth = SSL_aNULL,
290 	},
291 	{
292 		.name = SSL_TXT_AECDH,
293 		.algorithm_mkey = SSL_kECDHE,
294 		.algorithm_auth = SSL_aNULL,
295 	},
296 
297 	/* symmetric encryption aliases */
298 	{
299 		.name = SSL_TXT_3DES,
300 		.algorithm_enc = SSL_3DES,
301 	},
302 	{
303 		.name = SSL_TXT_RC4,
304 		.algorithm_enc = SSL_RC4,
305 	},
306 	{
307 		.name = SSL_TXT_eNULL,
308 		.algorithm_enc = SSL_eNULL,
309 	},
310 	{
311 		.name = SSL_TXT_AES128,
312 		.algorithm_enc = SSL_AES128|SSL_AES128GCM,
313 	},
314 	{
315 		.name = SSL_TXT_AES256,
316 		.algorithm_enc = SSL_AES256|SSL_AES256GCM,
317 	},
318 	{
319 		.name = SSL_TXT_AES,
320 		.algorithm_enc = SSL_AES,
321 	},
322 	{
323 		.name = SSL_TXT_AES_GCM,
324 		.algorithm_enc = SSL_AES128GCM|SSL_AES256GCM,
325 	},
326 	{
327 		.name = SSL_TXT_CAMELLIA128,
328 		.algorithm_enc = SSL_CAMELLIA128,
329 	},
330 	{
331 		.name = SSL_TXT_CAMELLIA256,
332 		.algorithm_enc = SSL_CAMELLIA256,
333 	},
334 	{
335 		.name = SSL_TXT_CAMELLIA,
336 		.algorithm_enc = SSL_CAMELLIA128|SSL_CAMELLIA256,
337 	},
338 	{
339 		.name = SSL_TXT_CHACHA20,
340 		.algorithm_enc = SSL_CHACHA20POLY1305,
341 	},
342 
343 	/* MAC aliases */
344 	{
345 		.name = SSL_TXT_AEAD,
346 		.algorithm_mac = SSL_AEAD,
347 	},
348 	{
349 		.name = SSL_TXT_MD5,
350 		.algorithm_mac = SSL_MD5,
351 	},
352 	{
353 		.name = SSL_TXT_SHA1,
354 		.algorithm_mac = SSL_SHA1,
355 	},
356 	{
357 		.name = SSL_TXT_SHA,
358 		.algorithm_mac = SSL_SHA1,
359 	},
360 	{
361 		.name = SSL_TXT_GOST94,
362 		.algorithm_mac = SSL_GOST94,
363 	},
364 	{
365 		.name = SSL_TXT_GOST89MAC,
366 		.algorithm_mac = SSL_GOST89MAC,
367 	},
368 	{
369 		.name = SSL_TXT_SHA256,
370 		.algorithm_mac = SSL_SHA256,
371 	},
372 	{
373 		.name = SSL_TXT_SHA384,
374 		.algorithm_mac = SSL_SHA384,
375 	},
376 	{
377 		.name = SSL_TXT_STREEBOG256,
378 		.algorithm_mac = SSL_STREEBOG256,
379 	},
380 
381 	/* protocol version aliases */
382 	{
383 		.name = SSL_TXT_SSLV3,
384 		.algorithm_ssl = SSL_SSLV3,
385 	},
386 	{
387 		.name = SSL_TXT_TLSV1,
388 		.algorithm_ssl = SSL_TLSV1,
389 	},
390 	{
391 		.name = SSL_TXT_TLSV1_2,
392 		.algorithm_ssl = SSL_TLSV1_2,
393 	},
394 	{
395 		.name = SSL_TXT_TLSV1_3,
396 		.algorithm_ssl = SSL_TLSV1_3,
397 	},
398 
399 	/* cipher suite aliases */
400 #ifdef LIBRESSL_HAS_TLS1_3
401 	{
402 		.valid = 1,
403 		.name = "TLS_AES_128_GCM_SHA256",
404 		.id = TLS1_3_CK_AES_128_GCM_SHA256,
405 		.algorithm_ssl = SSL_TLSV1_3,
406 	},
407 	{
408 		.valid = 1,
409 		.name = "TLS_AES_256_GCM_SHA384",
410 		.id = TLS1_3_CK_AES_256_GCM_SHA384,
411 		.algorithm_ssl = SSL_TLSV1_3,
412 	},
413 	{
414 		.valid = 1,
415 		.name = "TLS_CHACHA20_POLY1305_SHA256",
416 		.id = TLS1_3_CK_CHACHA20_POLY1305_SHA256,
417 		.algorithm_ssl = SSL_TLSV1_3,
418 	},
419 #endif
420 
421 	/* strength classes */
422 	{
423 		.name = SSL_TXT_LOW,
424 		.algo_strength = SSL_LOW,
425 	},
426 	{
427 		.name = SSL_TXT_MEDIUM,
428 		.algo_strength = SSL_MEDIUM,
429 	},
430 	{
431 		.name = SSL_TXT_HIGH,
432 		.algo_strength = SSL_HIGH,
433 	},
434 };
435 
436 int
437 ssl_cipher_get_evp(const SSL_SESSION *ss, const EVP_CIPHER **enc,
438     const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size)
439 {
440 	*enc = NULL;
441 	*md = NULL;
442 	*mac_pkey_type = NID_undef;
443 	*mac_secret_size = 0;
444 
445 	if (ss->cipher == NULL)
446 		return 0;
447 
448 	/*
449 	 * This function does not handle EVP_AEAD.
450 	 * See ssl_cipher_get_aead_evp instead.
451 	 */
452 	if (ss->cipher->algorithm_mac & SSL_AEAD)
453 		return 0;
454 
455 	switch (ss->cipher->algorithm_enc) {
456 	case SSL_3DES:
457 		*enc = EVP_des_ede3_cbc();
458 		break;
459 	case SSL_RC4:
460 		*enc = EVP_rc4();
461 		break;
462 	case SSL_eNULL:
463 		*enc = EVP_enc_null();
464 		break;
465 	case SSL_AES128:
466 		*enc = EVP_aes_128_cbc();
467 		break;
468 	case SSL_AES256:
469 		*enc = EVP_aes_256_cbc();
470 		break;
471 	case SSL_CAMELLIA128:
472 		*enc = EVP_camellia_128_cbc();
473 		break;
474 	case SSL_CAMELLIA256:
475 		*enc = EVP_camellia_256_cbc();
476 		break;
477 	case SSL_eGOST2814789CNT:
478 		*enc = EVP_gost2814789_cnt();
479 		break;
480 	}
481 
482 	switch (ss->cipher->algorithm_mac) {
483 	case SSL_MD5:
484 		*md = EVP_md5();
485 		break;
486 	case SSL_SHA1:
487 		*md = EVP_sha1();
488 		break;
489 	case SSL_SHA256:
490 		*md = EVP_sha256();
491 		break;
492 	case SSL_SHA384:
493 		*md = EVP_sha384();
494 		break;
495 	case SSL_GOST89MAC:
496 		*md = EVP_gost2814789imit();
497 		break;
498 	case SSL_GOST94:
499 		*md = EVP_gostr341194();
500 		break;
501 	case SSL_STREEBOG256:
502 		*md = EVP_streebog256();
503 		break;
504 	}
505 
506 	if (*enc == NULL || *md == NULL)
507 		return 0;
508 
509 	/*
510 	 * EVP_CIPH_FLAG_AEAD_CIPHER and EVP_CIPH_GCM_MODE ciphers are not
511 	 * supported via EVP_CIPHER (they should be using EVP_AEAD instead).
512 	 */
513 	if (EVP_CIPHER_flags(*enc) & EVP_CIPH_FLAG_AEAD_CIPHER)
514 		return 0;
515 	if (EVP_CIPHER_mode(*enc) == EVP_CIPH_GCM_MODE)
516 		return 0;
517 
518 	if (ss->cipher->algorithm_mac == SSL_GOST89MAC) {
519 		*mac_pkey_type = EVP_PKEY_GOSTIMIT;
520 		*mac_secret_size = 32; /* XXX */
521 	} else {
522 		*mac_pkey_type = EVP_PKEY_HMAC;
523 		*mac_secret_size = EVP_MD_size(*md);
524 	}
525 
526 	return 1;
527 }
528 
529 /*
530  * ssl_cipher_get_evp_aead sets aead to point to the correct EVP_AEAD object
531  * for s->cipher. It returns 1 on success and 0 on error.
532  */
533 int
534 ssl_cipher_get_evp_aead(const SSL_SESSION *ss, const EVP_AEAD **aead)
535 {
536 	*aead = NULL;
537 
538 	if (ss->cipher == NULL)
539 		return 0;
540 	if ((ss->cipher->algorithm_mac & SSL_AEAD) == 0)
541 		return 0;
542 
543 	switch (ss->cipher->algorithm_enc) {
544 	case SSL_AES128GCM:
545 		*aead = EVP_aead_aes_128_gcm();
546 		return 1;
547 	case SSL_AES256GCM:
548 		*aead = EVP_aead_aes_256_gcm();
549 		return 1;
550 	case SSL_CHACHA20POLY1305:
551 		*aead = EVP_aead_chacha20_poly1305();
552 		return 1;
553 	default:
554 		break;
555 	}
556 	return 0;
557 }
558 
559 int
560 ssl_get_handshake_evp_md(SSL *s, const EVP_MD **md)
561 {
562 	unsigned long handshake_mac;
563 
564 	*md = NULL;
565 
566 	if (S3I(s)->hs.cipher == NULL)
567 		return 0;
568 
569 	handshake_mac = S3I(s)->hs.cipher->algorithm2 &
570 	    SSL_HANDSHAKE_MAC_MASK;
571 
572 	/* For TLSv1.2 we upgrade the default MD5+SHA1 MAC to SHA256. */
573 	if (SSL_USE_SHA256_PRF(s) && handshake_mac == SSL_HANDSHAKE_MAC_DEFAULT)
574 		handshake_mac = SSL_HANDSHAKE_MAC_SHA256;
575 
576 	switch (handshake_mac) {
577 	case SSL_HANDSHAKE_MAC_DEFAULT:
578 		*md = EVP_md5_sha1();
579 		return 1;
580 	case SSL_HANDSHAKE_MAC_GOST94:
581 		*md = EVP_gostr341194();
582 		return 1;
583 	case SSL_HANDSHAKE_MAC_SHA256:
584 		*md = EVP_sha256();
585 		return 1;
586 	case SSL_HANDSHAKE_MAC_SHA384:
587 		*md = EVP_sha384();
588 		return 1;
589 	case SSL_HANDSHAKE_MAC_STREEBOG256:
590 		*md = EVP_streebog256();
591 		return 1;
592 	default:
593 		break;
594 	}
595 
596 	return 0;
597 }
598 
599 #define ITEM_SEP(a) \
600 	(((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))
601 
602 static void
603 ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
604     CIPHER_ORDER **tail)
605 {
606 	if (curr == *tail)
607 		return;
608 	if (curr == *head)
609 		*head = curr->next;
610 	if (curr->prev != NULL)
611 		curr->prev->next = curr->next;
612 	if (curr->next != NULL)
613 		curr->next->prev = curr->prev;
614 	(*tail)->next = curr;
615 	curr->prev= *tail;
616 	curr->next = NULL;
617 	*tail = curr;
618 }
619 
620 static void
621 ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,
622     CIPHER_ORDER **tail)
623 {
624 	if (curr == *head)
625 		return;
626 	if (curr == *tail)
627 		*tail = curr->prev;
628 	if (curr->next != NULL)
629 		curr->next->prev = curr->prev;
630 	if (curr->prev != NULL)
631 		curr->prev->next = curr->next;
632 	(*head)->prev = curr;
633 	curr->next= *head;
634 	curr->prev = NULL;
635 	*head = curr;
636 }
637 
638 static void
639 ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth,
640     unsigned long *enc, unsigned long *mac, unsigned long *ssl)
641 {
642 	*mkey = 0;
643 	*auth = 0;
644 	*enc = 0;
645 	*mac = 0;
646 	*ssl = 0;
647 
648 	/*
649 	 * Check for the availability of GOST 34.10 public/private key
650 	 * algorithms. If they are not available disable the associated
651 	 * authentication and key exchange algorithms.
652 	 */
653 	if (EVP_PKEY_meth_find(NID_id_GostR3410_2001) == NULL) {
654 		*auth |= SSL_aGOST01;
655 		*mkey |= SSL_kGOST;
656 	}
657 
658 #ifdef SSL_FORBID_ENULL
659 	*enc |= SSL_eNULL;
660 #endif
661 }
662 
663 static void
664 ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, int num_of_ciphers,
665     unsigned long disabled_mkey, unsigned long disabled_auth,
666     unsigned long disabled_enc, unsigned long disabled_mac,
667     unsigned long disabled_ssl, CIPHER_ORDER *co_list,
668     CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
669 {
670 	int i, co_list_num;
671 	const SSL_CIPHER *c;
672 
673 	/*
674 	 * We have num_of_ciphers descriptions compiled in, depending on the
675 	 * method selected (SSLv3, TLSv1, etc). These will later be sorted in
676 	 * a linked list with at most num entries.
677 	 */
678 
679 	/* Get the initial list of ciphers */
680 	co_list_num = 0;	/* actual count of ciphers */
681 	for (i = 0; i < num_of_ciphers; i++) {
682 		c = ssl_method->get_cipher(i);
683 		/* drop those that use any of that is not available */
684 		if ((c != NULL) && c->valid &&
685 		    !(c->algorithm_mkey & disabled_mkey) &&
686 		    !(c->algorithm_auth & disabled_auth) &&
687 		    !(c->algorithm_enc & disabled_enc) &&
688 		    !(c->algorithm_mac & disabled_mac) &&
689 		    !(c->algorithm_ssl & disabled_ssl)) {
690 			co_list[co_list_num].cipher = c;
691 			co_list[co_list_num].next = NULL;
692 			co_list[co_list_num].prev = NULL;
693 			co_list[co_list_num].active = 0;
694 			co_list_num++;
695 			/*
696 			if (!sk_push(ca_list,(char *)c)) goto err;
697 			*/
698 		}
699 	}
700 
701 	/*
702 	 * Prepare linked list from list entries
703 	 */
704 	if (co_list_num > 0) {
705 		co_list[0].prev = NULL;
706 
707 		if (co_list_num > 1) {
708 			co_list[0].next = &co_list[1];
709 
710 			for (i = 1; i < co_list_num - 1; i++) {
711 				co_list[i].prev = &co_list[i - 1];
712 				co_list[i].next = &co_list[i + 1];
713 			}
714 
715 			co_list[co_list_num - 1].prev =
716 			    &co_list[co_list_num - 2];
717 		}
718 
719 		co_list[co_list_num - 1].next = NULL;
720 
721 		*head_p = &co_list[0];
722 		*tail_p = &co_list[co_list_num - 1];
723 	}
724 }
725 
726 static void
727 ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list, int num_of_group_aliases,
728     unsigned long disabled_mkey, unsigned long disabled_auth,
729     unsigned long disabled_enc, unsigned long disabled_mac,
730     unsigned long disabled_ssl, CIPHER_ORDER *head)
731 {
732 	CIPHER_ORDER *ciph_curr;
733 	const SSL_CIPHER **ca_curr;
734 	int i;
735 	unsigned long mask_mkey = ~disabled_mkey;
736 	unsigned long mask_auth = ~disabled_auth;
737 	unsigned long mask_enc = ~disabled_enc;
738 	unsigned long mask_mac = ~disabled_mac;
739 	unsigned long mask_ssl = ~disabled_ssl;
740 
741 	/*
742 	 * First, add the real ciphers as already collected
743 	 */
744 	ciph_curr = head;
745 	ca_curr = ca_list;
746 	while (ciph_curr != NULL) {
747 		*ca_curr = ciph_curr->cipher;
748 		ca_curr++;
749 		ciph_curr = ciph_curr->next;
750 	}
751 
752 	/*
753 	 * Now we add the available ones from the cipher_aliases[] table.
754 	 * They represent either one or more algorithms, some of which
755 	 * in any affected category must be supported (set in enabled_mask),
756 	 * or represent a cipher strength value (will be added in any case because algorithms=0).
757 	 */
758 	for (i = 0; i < num_of_group_aliases; i++) {
759 		unsigned long algorithm_mkey = cipher_aliases[i].algorithm_mkey;
760 		unsigned long algorithm_auth = cipher_aliases[i].algorithm_auth;
761 		unsigned long algorithm_enc = cipher_aliases[i].algorithm_enc;
762 		unsigned long algorithm_mac = cipher_aliases[i].algorithm_mac;
763 		unsigned long algorithm_ssl = cipher_aliases[i].algorithm_ssl;
764 
765 		if (algorithm_mkey)
766 			if ((algorithm_mkey & mask_mkey) == 0)
767 				continue;
768 
769 		if (algorithm_auth)
770 			if ((algorithm_auth & mask_auth) == 0)
771 				continue;
772 
773 		if (algorithm_enc)
774 			if ((algorithm_enc & mask_enc) == 0)
775 				continue;
776 
777 		if (algorithm_mac)
778 			if ((algorithm_mac & mask_mac) == 0)
779 				continue;
780 
781 		if (algorithm_ssl)
782 			if ((algorithm_ssl & mask_ssl) == 0)
783 				continue;
784 
785 		*ca_curr = (SSL_CIPHER *)(cipher_aliases + i);
786 		ca_curr++;
787 	}
788 
789 	*ca_curr = NULL;	/* end of list */
790 }
791 
792 static void
793 ssl_cipher_apply_rule(unsigned long cipher_id, unsigned long alg_mkey,
794     unsigned long alg_auth, unsigned long alg_enc, unsigned long alg_mac,
795     unsigned long alg_ssl, unsigned long algo_strength, int rule,
796     int strength_bits, CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
797 {
798 	CIPHER_ORDER *head, *tail, *curr, *next, *last;
799 	const SSL_CIPHER *cp;
800 	int reverse = 0;
801 
802 	if (rule == CIPHER_DEL)
803 		reverse = 1; /* needed to maintain sorting between currently deleted ciphers */
804 
805 	head = *head_p;
806 	tail = *tail_p;
807 
808 	if (reverse) {
809 		next = tail;
810 		last = head;
811 	} else {
812 		next = head;
813 		last = tail;
814 	}
815 
816 	curr = NULL;
817 	for (;;) {
818 		if (curr == last)
819 			break;
820 		curr = next;
821 		next = reverse ? curr->prev : curr->next;
822 
823 		cp = curr->cipher;
824 
825 		if (cipher_id && cp->id != cipher_id)
826 			continue;
827 
828 		/*
829 		 * Selection criteria is either the value of strength_bits
830 		 * or the algorithms used.
831 		 */
832 		if (strength_bits >= 0) {
833 			if (strength_bits != cp->strength_bits)
834 				continue;
835 		} else {
836 			if (alg_mkey && !(alg_mkey & cp->algorithm_mkey))
837 				continue;
838 			if (alg_auth && !(alg_auth & cp->algorithm_auth))
839 				continue;
840 			if (alg_enc && !(alg_enc & cp->algorithm_enc))
841 				continue;
842 			if (alg_mac && !(alg_mac & cp->algorithm_mac))
843 				continue;
844 			if (alg_ssl && !(alg_ssl & cp->algorithm_ssl))
845 				continue;
846 			if ((algo_strength & SSL_STRONG_MASK) && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))
847 				continue;
848 		}
849 
850 		/* add the cipher if it has not been added yet. */
851 		if (rule == CIPHER_ADD) {
852 			/* reverse == 0 */
853 			if (!curr->active) {
854 				ll_append_tail(&head, curr, &tail);
855 				curr->active = 1;
856 			}
857 		}
858 		/* Move the added cipher to this location */
859 		else if (rule == CIPHER_ORD) {
860 			/* reverse == 0 */
861 			if (curr->active) {
862 				ll_append_tail(&head, curr, &tail);
863 			}
864 		} else if (rule == CIPHER_DEL) {
865 			/* reverse == 1 */
866 			if (curr->active) {
867 				/* most recently deleted ciphersuites get best positions
868 				 * for any future CIPHER_ADD (note that the CIPHER_DEL loop
869 				 * works in reverse to maintain the order) */
870 				ll_append_head(&head, curr, &tail);
871 				curr->active = 0;
872 			}
873 		} else if (rule == CIPHER_KILL) {
874 			/* reverse == 0 */
875 			if (head == curr)
876 				head = curr->next;
877 			else
878 				curr->prev->next = curr->next;
879 			if (tail == curr)
880 				tail = curr->prev;
881 			curr->active = 0;
882 			if (curr->next != NULL)
883 				curr->next->prev = curr->prev;
884 			if (curr->prev != NULL)
885 				curr->prev->next = curr->next;
886 			curr->next = NULL;
887 			curr->prev = NULL;
888 		}
889 	}
890 
891 	*head_p = head;
892 	*tail_p = tail;
893 }
894 
895 static int
896 ssl_cipher_strength_sort(CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
897 {
898 	int max_strength_bits, i, *number_uses;
899 	CIPHER_ORDER *curr;
900 
901 	/*
902 	 * This routine sorts the ciphers with descending strength. The sorting
903 	 * must keep the pre-sorted sequence, so we apply the normal sorting
904 	 * routine as '+' movement to the end of the list.
905 	 */
906 	max_strength_bits = 0;
907 	curr = *head_p;
908 	while (curr != NULL) {
909 		if (curr->active &&
910 		    (curr->cipher->strength_bits > max_strength_bits))
911 			max_strength_bits = curr->cipher->strength_bits;
912 		curr = curr->next;
913 	}
914 
915 	number_uses = calloc((max_strength_bits + 1), sizeof(int));
916 	if (!number_uses) {
917 		SSLerrorx(ERR_R_MALLOC_FAILURE);
918 		return (0);
919 	}
920 
921 	/*
922 	 * Now find the strength_bits values actually used
923 	 */
924 	curr = *head_p;
925 	while (curr != NULL) {
926 		if (curr->active)
927 			number_uses[curr->cipher->strength_bits]++;
928 		curr = curr->next;
929 	}
930 	/*
931 	 * Go through the list of used strength_bits values in descending
932 	 * order.
933 	 */
934 	for (i = max_strength_bits; i >= 0; i--)
935 		if (number_uses[i] > 0)
936 			ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, tail_p);
937 
938 	free(number_uses);
939 	return (1);
940 }
941 
942 static int
943 ssl_cipher_process_rulestr(const char *rule_str, CIPHER_ORDER **head_p,
944     CIPHER_ORDER **tail_p, const SSL_CIPHER **ca_list, int *tls13_seen)
945 {
946 	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl;
947 	unsigned long algo_strength;
948 	int j, multi, found, rule, retval, ok, buflen;
949 	unsigned long cipher_id = 0;
950 	const char *l, *buf;
951 	char ch;
952 
953 	*tls13_seen = 0;
954 
955 	retval = 1;
956 	l = rule_str;
957 	for (;;) {
958 		ch = *l;
959 
960 		if (ch == '\0')
961 			break;
962 
963 		if (ch == '-') {
964 			rule = CIPHER_DEL;
965 			l++;
966 		} else if (ch == '+') {
967 			rule = CIPHER_ORD;
968 			l++;
969 		} else if (ch == '!') {
970 			rule = CIPHER_KILL;
971 			l++;
972 		} else if (ch == '@') {
973 			rule = CIPHER_SPECIAL;
974 			l++;
975 		} else {
976 			rule = CIPHER_ADD;
977 		}
978 
979 		if (ITEM_SEP(ch)) {
980 			l++;
981 			continue;
982 		}
983 
984 		alg_mkey = 0;
985 		alg_auth = 0;
986 		alg_enc = 0;
987 		alg_mac = 0;
988 		alg_ssl = 0;
989 		algo_strength = 0;
990 
991 		for (;;) {
992 			ch = *l;
993 			buf = l;
994 			buflen = 0;
995 			while (((ch >= 'A') && (ch <= 'Z')) ||
996 			    ((ch >= '0') && (ch <= '9')) ||
997 			    ((ch >= 'a') && (ch <= 'z')) ||
998 			    (ch == '-') || (ch == '.') ||
999 			    (ch == '_')) {
1000 				ch = *(++l);
1001 				buflen++;
1002 			}
1003 
1004 			if (buflen == 0) {
1005 				/*
1006 				 * We hit something we cannot deal with,
1007 				 * it is no command or separator nor
1008 				 * alphanumeric, so we call this an error.
1009 				 */
1010 				SSLerrorx(SSL_R_INVALID_COMMAND);
1011 				retval = found = 0;
1012 				l++;
1013 				break;
1014 			}
1015 
1016 			if (rule == CIPHER_SPECIAL) {
1017 				 /* unused -- avoid compiler warning */
1018 				found = 0;
1019 				/* special treatment */
1020 				break;
1021 			}
1022 
1023 			/* check for multi-part specification */
1024 			if (ch == '+') {
1025 				multi = 1;
1026 				l++;
1027 			} else
1028 				multi = 0;
1029 
1030 			/*
1031 			 * Now search for the cipher alias in the ca_list.
1032 			 * Be careful with the strncmp, because the "buflen"
1033 			 * limitation will make the rule "ADH:SOME" and the
1034 			 * cipher "ADH-MY-CIPHER" look like a match for
1035 			 * buflen=3. So additionally check whether the cipher
1036 			 * name found has the correct length. We can save a
1037 			 * strlen() call: just checking for the '\0' at the
1038 			 * right place is sufficient, we have to strncmp()
1039 			 * anyway (we cannot use strcmp(), because buf is not
1040 			 * '\0' terminated.)
1041 			 */
1042 			j = found = 0;
1043 			cipher_id = 0;
1044 			while (ca_list[j]) {
1045 				if (!strncmp(buf, ca_list[j]->name, buflen) &&
1046 				    (ca_list[j]->name[buflen] == '\0')) {
1047 					found = 1;
1048 					break;
1049 				} else
1050 					j++;
1051 			}
1052 
1053 			if (!found)
1054 				break;	/* ignore this entry */
1055 
1056 			if (ca_list[j]->algorithm_mkey) {
1057 				if (alg_mkey) {
1058 					alg_mkey &= ca_list[j]->algorithm_mkey;
1059 					if (!alg_mkey) {
1060 						found = 0;
1061 						break;
1062 					}
1063 				} else
1064 					alg_mkey = ca_list[j]->algorithm_mkey;
1065 			}
1066 
1067 			if (ca_list[j]->algorithm_auth) {
1068 				if (alg_auth) {
1069 					alg_auth &= ca_list[j]->algorithm_auth;
1070 					if (!alg_auth) {
1071 						found = 0;
1072 						break;
1073 					}
1074 				} else
1075 					alg_auth = ca_list[j]->algorithm_auth;
1076 			}
1077 
1078 			if (ca_list[j]->algorithm_enc) {
1079 				if (alg_enc) {
1080 					alg_enc &= ca_list[j]->algorithm_enc;
1081 					if (!alg_enc) {
1082 						found = 0;
1083 						break;
1084 					}
1085 				} else
1086 					alg_enc = ca_list[j]->algorithm_enc;
1087 			}
1088 
1089 			if (ca_list[j]->algorithm_mac) {
1090 				if (alg_mac) {
1091 					alg_mac &= ca_list[j]->algorithm_mac;
1092 					if (!alg_mac) {
1093 						found = 0;
1094 						break;
1095 					}
1096 				} else
1097 					alg_mac = ca_list[j]->algorithm_mac;
1098 			}
1099 
1100 			if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {
1101 				if (algo_strength & SSL_STRONG_MASK) {
1102 					algo_strength &=
1103 					    (ca_list[j]->algo_strength &
1104 					    SSL_STRONG_MASK) | ~SSL_STRONG_MASK;
1105 					if (!(algo_strength &
1106 					    SSL_STRONG_MASK)) {
1107 						found = 0;
1108 						break;
1109 					}
1110 				} else
1111 					algo_strength |=
1112 					    ca_list[j]->algo_strength &
1113 					    SSL_STRONG_MASK;
1114 			}
1115 
1116 			if (ca_list[j]->valid) {
1117 				/*
1118 				 * explicit ciphersuite found; its protocol
1119 				 * version does not become part of the search
1120 				 * pattern!
1121 				 */
1122 				cipher_id = ca_list[j]->id;
1123 				if (ca_list[j]->algorithm_ssl == SSL_TLSV1_3)
1124 					*tls13_seen = 1;
1125 			} else {
1126 				/*
1127 				 * not an explicit ciphersuite; only in this
1128 				 * case, the protocol version is considered
1129 				 * part of the search pattern
1130 				 */
1131 				if (ca_list[j]->algorithm_ssl) {
1132 					if (alg_ssl) {
1133 						alg_ssl &=
1134 						    ca_list[j]->algorithm_ssl;
1135 						if (!alg_ssl) {
1136 							found = 0;
1137 							break;
1138 						}
1139 					} else
1140 						alg_ssl =
1141 						    ca_list[j]->algorithm_ssl;
1142 				}
1143 			}
1144 
1145 			if (!multi)
1146 				break;
1147 		}
1148 
1149 		/*
1150 		 * Ok, we have the rule, now apply it
1151 		 */
1152 		if (rule == CIPHER_SPECIAL) {
1153 			/* special command */
1154 			ok = 0;
1155 			if ((buflen == 8) && !strncmp(buf, "STRENGTH", 8))
1156 				ok = ssl_cipher_strength_sort(head_p, tail_p);
1157 			else
1158 				SSLerrorx(SSL_R_INVALID_COMMAND);
1159 			if (ok == 0)
1160 				retval = 0;
1161 			/*
1162 			 * We do not support any "multi" options
1163 			 * together with "@", so throw away the
1164 			 * rest of the command, if any left, until
1165 			 * end or ':' is found.
1166 			 */
1167 			while ((*l != '\0') && !ITEM_SEP(*l))
1168 				l++;
1169 		} else if (found) {
1170 			if (alg_ssl == SSL_TLSV1_3)
1171 				*tls13_seen = 1;
1172 			ssl_cipher_apply_rule(cipher_id, alg_mkey, alg_auth,
1173 			    alg_enc, alg_mac, alg_ssl, algo_strength, rule,
1174 			    -1, head_p, tail_p);
1175 		} else {
1176 			while ((*l != '\0') && !ITEM_SEP(*l))
1177 				l++;
1178 		}
1179 		if (*l == '\0')
1180 			break; /* done */
1181 	}
1182 
1183 	return (retval);
1184 }
1185 
1186 static inline int
1187 ssl_aes_is_accelerated(void)
1188 {
1189 #if defined(__i386__) || defined(__x86_64__)
1190 	return ((OPENSSL_cpu_caps() & (1ULL << 57)) != 0);
1191 #else
1192 	return (0);
1193 #endif
1194 }
1195 
1196 STACK_OF(SSL_CIPHER) *
1197 ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1198     STACK_OF(SSL_CIPHER) **cipher_list,
1199     STACK_OF(SSL_CIPHER) *cipher_list_tls13,
1200     const char *rule_str)
1201 {
1202 	int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
1203 	unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;
1204 	STACK_OF(SSL_CIPHER) *cipherstack;
1205 	const char *rule_p;
1206 	CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
1207 	const SSL_CIPHER **ca_list = NULL;
1208 	const SSL_CIPHER *cipher;
1209 	int tls13_seen = 0;
1210 	int any_active;
1211 	int i;
1212 
1213 	/*
1214 	 * Return with error if nothing to do.
1215 	 */
1216 	if (rule_str == NULL || cipher_list == NULL)
1217 		return NULL;
1218 
1219 	/*
1220 	 * To reduce the work to do we only want to process the compiled
1221 	 * in algorithms, so we first get the mask of disabled ciphers.
1222 	 */
1223 	ssl_cipher_get_disabled(&disabled_mkey, &disabled_auth, &disabled_enc, &disabled_mac, &disabled_ssl);
1224 
1225 	/*
1226 	 * Now we have to collect the available ciphers from the compiled
1227 	 * in ciphers. We cannot get more than the number compiled in, so
1228 	 * it is used for allocation.
1229 	 */
1230 	num_of_ciphers = ssl_method->num_ciphers();
1231 	co_list = reallocarray(NULL, num_of_ciphers, sizeof(CIPHER_ORDER));
1232 	if (co_list == NULL) {
1233 		SSLerrorx(ERR_R_MALLOC_FAILURE);
1234 		return(NULL);	/* Failure */
1235 	}
1236 
1237 	ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
1238 	    disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,
1239 	    co_list, &head, &tail);
1240 
1241 
1242 	/* Now arrange all ciphers by preference: */
1243 
1244 	/* Everything else being equal, prefer ephemeral ECDH over other key exchange mechanisms */
1245 	ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1246 	ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
1247 
1248 	if (ssl_aes_is_accelerated()) {
1249 		/*
1250 		 * We have hardware assisted AES - prefer AES as a symmetric
1251 		 * cipher, with CHACHA20 second.
1252 		 */
1253 		ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0,
1254 		    CIPHER_ADD, -1, &head, &tail);
1255 		ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305,
1256 		    0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1257 	} else {
1258 		/*
1259 		 * CHACHA20 is fast and safe on all hardware and is thus our
1260 		 * preferred symmetric cipher, with AES second.
1261 		 */
1262 		ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305,
1263 		    0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1264 		ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0,
1265 		    CIPHER_ADD, -1, &head, &tail);
1266 	}
1267 
1268 	/* Temporarily enable everything else for sorting */
1269 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1270 
1271 	/* Low priority for MD5 */
1272 	ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head, &tail);
1273 
1274 	/* Move anonymous ciphers to the end.  Usually, these will remain disabled.
1275 	 * (For applications that allow them, they aren't too bad, but we prefer
1276 	 * authenticated ciphers.) */
1277 	ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1278 
1279 	/* Move ciphers without forward secrecy to the end */
1280 	ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1281 
1282 	/* RC4 is sort of broken - move it to the end */
1283 	ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1284 
1285 	/* Now sort by symmetric encryption strength.  The above ordering remains
1286 	 * in force within each class */
1287 	if (!ssl_cipher_strength_sort(&head, &tail)) {
1288 		free(co_list);
1289 		return NULL;
1290 	}
1291 
1292 	/* Now disable everything (maintaining the ordering!) */
1293 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
1294 
1295 	/* TLSv1.3 first. */
1296 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, SSL_TLSV1_3, 0, CIPHER_ADD, -1, &head, &tail);
1297 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, SSL_TLSV1_3, 0, CIPHER_DEL, -1, &head, &tail);
1298 
1299 	/*
1300 	 * We also need cipher aliases for selecting based on the rule_str.
1301 	 * There might be two types of entries in the rule_str: 1) names
1302 	 * of ciphers themselves 2) aliases for groups of ciphers.
1303 	 * For 1) we need the available ciphers and for 2) the cipher
1304 	 * groups of cipher_aliases added together in one list (otherwise
1305 	 * we would be happy with just the cipher_aliases table).
1306 	 */
1307 	num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
1308 	num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
1309 	ca_list = reallocarray(NULL, num_of_alias_max, sizeof(SSL_CIPHER *));
1310 	if (ca_list == NULL) {
1311 		free(co_list);
1312 		SSLerrorx(ERR_R_MALLOC_FAILURE);
1313 		return(NULL);	/* Failure */
1314 	}
1315 	ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mkey,
1316 	    disabled_auth, disabled_enc, disabled_mac, disabled_ssl, head);
1317 
1318 	/*
1319 	 * If the rule_string begins with DEFAULT, apply the default rule
1320 	 * before using the (possibly available) additional rules.
1321 	 */
1322 	ok = 1;
1323 	rule_p = rule_str;
1324 	if (strncmp(rule_str, "DEFAULT", 7) == 0) {
1325 		ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
1326 		    &head, &tail, ca_list, &tls13_seen);
1327 		rule_p += 7;
1328 		if (*rule_p == ':')
1329 			rule_p++;
1330 	}
1331 
1332 	if (ok && (strlen(rule_p) > 0))
1333 		ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list,
1334 		    &tls13_seen);
1335 
1336 	free((void *)ca_list);	/* Not needed anymore */
1337 
1338 	if (!ok) {
1339 		/* Rule processing failure */
1340 		free(co_list);
1341 		return (NULL);
1342 	}
1343 
1344 	/*
1345 	 * Allocate new "cipherstack" for the result, return with error
1346 	 * if we cannot get one.
1347 	 */
1348 	if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
1349 		free(co_list);
1350 		return (NULL);
1351 	}
1352 
1353 	/* Prefer TLSv1.3 cipher suites. */
1354 	if (cipher_list_tls13 != NULL) {
1355 		for (i = 0; i < sk_SSL_CIPHER_num(cipher_list_tls13); i++) {
1356 			cipher = sk_SSL_CIPHER_value(cipher_list_tls13, i);
1357 			sk_SSL_CIPHER_push(cipherstack, cipher);
1358 		}
1359 		tls13_seen = 1;
1360 	}
1361 
1362 	/*
1363 	 * The cipher selection for the list is done. The ciphers are added
1364 	 * to the resulting precedence to the STACK_OF(SSL_CIPHER).
1365 	 *
1366 	 * If the rule string did not contain any references to TLSv1.3 and
1367 	 * TLSv1.3 cipher suites have not been configured separately,
1368 	 * include inactive TLSv1.3 cipher suites. This avoids attempts to
1369 	 * use TLSv1.3 with an older rule string that does not include
1370 	 * TLSv1.3 cipher suites. If the rule string resulted in no active
1371 	 * cipher suites then we return an empty stack.
1372 	 */
1373 	any_active = 0;
1374 	for (curr = head; curr != NULL; curr = curr->next) {
1375 		if (curr->active ||
1376 		    (!tls13_seen && curr->cipher->algorithm_ssl == SSL_TLSV1_3))
1377 			sk_SSL_CIPHER_push(cipherstack, curr->cipher);
1378 		any_active |= curr->active;
1379 	}
1380 	if (!any_active)
1381 		sk_SSL_CIPHER_zero(cipherstack);
1382 
1383 	free(co_list);	/* Not needed any longer */
1384 
1385 	sk_SSL_CIPHER_free(*cipher_list);
1386 	*cipher_list = cipherstack;
1387 
1388 	return (cipherstack);
1389 }
1390 
1391 const SSL_CIPHER *
1392 SSL_CIPHER_get_by_id(unsigned int id)
1393 {
1394 	return ssl3_get_cipher_by_id(id);
1395 }
1396 
1397 const SSL_CIPHER *
1398 SSL_CIPHER_get_by_value(uint16_t value)
1399 {
1400 	return ssl3_get_cipher_by_value(value);
1401 }
1402 
1403 char *
1404 SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1405 {
1406 	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, alg2;
1407 	const char *ver, *kx, *au, *enc, *mac;
1408 	char *ret;
1409 	int l;
1410 
1411 	alg_mkey = cipher->algorithm_mkey;
1412 	alg_auth = cipher->algorithm_auth;
1413 	alg_enc = cipher->algorithm_enc;
1414 	alg_mac = cipher->algorithm_mac;
1415 	alg_ssl = cipher->algorithm_ssl;
1416 
1417 	alg2 = cipher->algorithm2;
1418 
1419 	if (alg_ssl & SSL_SSLV3)
1420 		ver = "SSLv3";
1421 	else if (alg_ssl & SSL_TLSV1_2)
1422 		ver = "TLSv1.2";
1423 	else if (alg_ssl & SSL_TLSV1_3)
1424 		ver = "TLSv1.3";
1425 	else
1426 		ver = "unknown";
1427 
1428 	switch (alg_mkey) {
1429 	case SSL_kRSA:
1430 		kx = "RSA";
1431 		break;
1432 	case SSL_kDHE:
1433 		kx = "DH";
1434 		break;
1435 	case SSL_kECDHE:
1436 		kx = "ECDH";
1437 		break;
1438 	case SSL_kGOST:
1439 		kx = "GOST";
1440 		break;
1441 	case SSL_kTLS1_3:
1442 		kx = "TLSv1.3";
1443 		break;
1444 	default:
1445 		kx = "unknown";
1446 	}
1447 
1448 	switch (alg_auth) {
1449 	case SSL_aRSA:
1450 		au = "RSA";
1451 		break;
1452 	case SSL_aDSS:
1453 		au = "DSS";
1454 		break;
1455 	case SSL_aNULL:
1456 		au = "None";
1457 		break;
1458 	case SSL_aECDSA:
1459 		au = "ECDSA";
1460 		break;
1461 	case SSL_aGOST01:
1462 		au = "GOST01";
1463 		break;
1464 	case SSL_aTLS1_3:
1465 		au = "TLSv1.3";
1466 		break;
1467 	default:
1468 		au = "unknown";
1469 		break;
1470 	}
1471 
1472 	switch (alg_enc) {
1473 	case SSL_3DES:
1474 		enc = "3DES(168)";
1475 		break;
1476 	case SSL_RC4:
1477 		enc = alg2 & SSL2_CF_8_BYTE_ENC ? "RC4(64)" : "RC4(128)";
1478 		break;
1479 	case SSL_eNULL:
1480 		enc = "None";
1481 		break;
1482 	case SSL_AES128:
1483 		enc = "AES(128)";
1484 		break;
1485 	case SSL_AES256:
1486 		enc = "AES(256)";
1487 		break;
1488 	case SSL_AES128GCM:
1489 		enc = "AESGCM(128)";
1490 		break;
1491 	case SSL_AES256GCM:
1492 		enc = "AESGCM(256)";
1493 		break;
1494 	case SSL_CAMELLIA128:
1495 		enc = "Camellia(128)";
1496 		break;
1497 	case SSL_CAMELLIA256:
1498 		enc = "Camellia(256)";
1499 		break;
1500 	case SSL_CHACHA20POLY1305:
1501 		enc = "ChaCha20-Poly1305";
1502 		break;
1503 	case SSL_eGOST2814789CNT:
1504 		enc = "GOST-28178-89-CNT";
1505 		break;
1506 	default:
1507 		enc = "unknown";
1508 		break;
1509 	}
1510 
1511 	switch (alg_mac) {
1512 	case SSL_MD5:
1513 		mac = "MD5";
1514 		break;
1515 	case SSL_SHA1:
1516 		mac = "SHA1";
1517 		break;
1518 	case SSL_SHA256:
1519 		mac = "SHA256";
1520 		break;
1521 	case SSL_SHA384:
1522 		mac = "SHA384";
1523 		break;
1524 	case SSL_AEAD:
1525 		mac = "AEAD";
1526 		break;
1527 	case SSL_GOST94:
1528 		mac = "GOST94";
1529 		break;
1530 	case SSL_GOST89MAC:
1531 		mac = "GOST89IMIT";
1532 		break;
1533 	case SSL_STREEBOG256:
1534 		mac = "STREEBOG256";
1535 		break;
1536 	default:
1537 		mac = "unknown";
1538 		break;
1539 	}
1540 
1541 	if (asprintf(&ret, "%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s\n",
1542 	    cipher->name, ver, kx, au, enc, mac) == -1)
1543 		return "OPENSSL_malloc Error";
1544 
1545 	if (buf != NULL) {
1546 		l = strlcpy(buf, ret, len);
1547 		free(ret);
1548 		ret = buf;
1549 		if (l >= len)
1550 			ret = "Buffer too small";
1551 	}
1552 
1553 	return (ret);
1554 }
1555 
1556 const char *
1557 SSL_CIPHER_get_version(const SSL_CIPHER *c)
1558 {
1559 	if (c == NULL)
1560 		return("(NONE)");
1561 	if ((c->id >> 24) == 3)
1562 		return("TLSv1/SSLv3");
1563 	else
1564 		return("unknown");
1565 }
1566 
1567 /* return the actual cipher being used */
1568 const char *
1569 SSL_CIPHER_get_name(const SSL_CIPHER *c)
1570 {
1571 	if (c != NULL)
1572 		return (c->name);
1573 	return("(NONE)");
1574 }
1575 
1576 /* number of bits for symmetric cipher */
1577 int
1578 SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits)
1579 {
1580 	int ret = 0;
1581 
1582 	if (c != NULL) {
1583 		if (alg_bits != NULL)
1584 			*alg_bits = c->alg_bits;
1585 		ret = c->strength_bits;
1586 	}
1587 	return (ret);
1588 }
1589 
1590 unsigned long
1591 SSL_CIPHER_get_id(const SSL_CIPHER *c)
1592 {
1593 	return c->id;
1594 }
1595 
1596 uint16_t
1597 SSL_CIPHER_get_value(const SSL_CIPHER *c)
1598 {
1599 	return ssl3_cipher_get_value(c);
1600 }
1601 
1602 int
1603 SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c)
1604 {
1605 	switch (c->algorithm_enc) {
1606 	case SSL_eNULL:
1607 		return NID_undef;
1608 	case SSL_3DES:
1609 		return NID_des_ede3_cbc;
1610 	case SSL_AES128:
1611 		return NID_aes_128_cbc;
1612 	case SSL_AES128GCM:
1613 		return NID_aes_128_gcm;
1614 	case SSL_AES256:
1615 		return NID_aes_256_cbc;
1616 	case SSL_AES256GCM:
1617 		return NID_aes_256_gcm;
1618 	case SSL_CAMELLIA128:
1619 		return NID_camellia_128_cbc;
1620 	case SSL_CAMELLIA256:
1621 		return NID_camellia_256_cbc;
1622 	case SSL_CHACHA20POLY1305:
1623 		return NID_chacha20_poly1305;
1624 	case SSL_DES:
1625 		return NID_des_cbc;
1626 	case SSL_RC4:
1627 		return NID_rc4;
1628 	case SSL_eGOST2814789CNT:
1629 		return NID_gost89_cnt;
1630 	default:
1631 		return NID_undef;
1632 	}
1633 }
1634 
1635 int
1636 SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c)
1637 {
1638 	switch (c->algorithm_mac) {
1639 	case SSL_AEAD:
1640 		return NID_undef;
1641 	case SSL_GOST89MAC:
1642 		return NID_id_Gost28147_89_MAC;
1643 	case SSL_GOST94:
1644 		return NID_id_GostR3411_94;
1645 	case SSL_MD5:
1646 		return NID_md5;
1647 	case SSL_SHA1:
1648 		return NID_sha1;
1649 	case SSL_SHA256:
1650 		return NID_sha256;
1651 	case SSL_SHA384:
1652 		return NID_sha384;
1653 	case SSL_STREEBOG256:
1654 		return NID_id_tc26_gost3411_2012_256;
1655 	default:
1656 		return NID_undef;
1657 	}
1658 }
1659 
1660 int
1661 SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c)
1662 {
1663 	switch (c->algorithm_mkey) {
1664 	case SSL_kDHE:
1665 		return NID_kx_dhe;
1666 	case SSL_kECDHE:
1667 		return NID_kx_ecdhe;
1668 	case SSL_kGOST:
1669 		return NID_kx_gost;
1670 	case SSL_kRSA:
1671 		return NID_kx_rsa;
1672 	default:
1673 		return NID_undef;
1674 	}
1675 }
1676 
1677 int
1678 SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c)
1679 {
1680 	switch (c->algorithm_auth) {
1681 	case SSL_aNULL:
1682 		return NID_auth_null;
1683 	case SSL_aECDSA:
1684 		return NID_auth_ecdsa;
1685 	case SSL_aGOST01:
1686 		return NID_auth_gost01;
1687 	case SSL_aRSA:
1688 		return NID_auth_rsa;
1689 	default:
1690 		return NID_undef;
1691 	}
1692 }
1693 
1694 int
1695 SSL_CIPHER_is_aead(const SSL_CIPHER *c)
1696 {
1697 	return (c->algorithm_mac & SSL_AEAD) == SSL_AEAD;
1698 }
1699 
1700 void *
1701 SSL_COMP_get_compression_methods(void)
1702 {
1703 	return NULL;
1704 }
1705 
1706 int
1707 SSL_COMP_add_compression_method(int id, void *cm)
1708 {
1709 	return 1;
1710 }
1711 
1712 const char *
1713 SSL_COMP_get_name(const void *comp)
1714 {
1715 	return NULL;
1716 }
1717