xref: /openbsd-src/lib/libssl/ssl_ciph.c (revision c90a81c56dcebd6a1b73fe4aff9b03385b8e63b3)
1 /* $OpenBSD: ssl_ciph.c,v 1.106 2018/11/07 01:53:36 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer.
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113  * ECC cipher suite support in OpenSSL originally developed by
114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
115  */
116 /* ====================================================================
117  * Copyright 2005 Nokia. All rights reserved.
118  *
119  * The portions of the attached software ("Contribution") is developed by
120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
121  * license.
122  *
123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
125  * support (see RFC 4279) to OpenSSL.
126  *
127  * No patent licenses or other rights except those expressly stated in
128  * the OpenSSL open source license shall be deemed granted or received
129  * expressly, by implication, estoppel, or otherwise.
130  *
131  * No assurances are provided by Nokia that the Contribution does not
132  * infringe the patent or other intellectual property rights of any third
133  * party or that the license provides you with all the necessary rights
134  * to make use of the Contribution.
135  *
136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
140  * OTHERWISE.
141  */
142 
143 #include <stdio.h>
144 
145 #include <openssl/objects.h>
146 
147 #ifndef OPENSSL_NO_ENGINE
148 #include <openssl/engine.h>
149 #endif
150 
151 #include "ssl_locl.h"
152 
153 #define SSL_ENC_3DES_IDX	0
154 #define SSL_ENC_RC4_IDX		1
155 #define SSL_ENC_NULL_IDX	2
156 #define SSL_ENC_AES128_IDX	3
157 #define SSL_ENC_AES256_IDX	4
158 #define SSL_ENC_CAMELLIA128_IDX	5
159 #define SSL_ENC_CAMELLIA256_IDX	6
160 #define SSL_ENC_GOST89_IDX	7
161 #define SSL_ENC_NUM_IDX		8
162 
163 static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX] = {
164 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
165 };
166 
167 #define SSL_MD_MD5_IDX		0
168 #define SSL_MD_SHA1_IDX		1
169 #define SSL_MD_GOST94_IDX	2
170 #define SSL_MD_GOST89MAC_IDX	3
171 #define SSL_MD_SHA256_IDX	4
172 #define SSL_MD_SHA384_IDX	5
173 #define SSL_MD_STREEBOG256_IDX	6
174 #define SSL_MD_NUM_IDX		7
175 static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = {
176 	NULL, NULL, NULL, NULL, NULL, NULL, NULL,
177 };
178 
179 static int  ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {
180 	EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_GOSTIMIT,
181 	EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC,
182 };
183 
184 static int ssl_mac_secret_size[SSL_MD_NUM_IDX] = {
185 	0, 0, 0, 0, 0, 0, 0,
186 };
187 
188 #define CIPHER_ADD	1
189 #define CIPHER_KILL	2
190 #define CIPHER_DEL	3
191 #define CIPHER_ORD	4
192 #define CIPHER_SPECIAL	5
193 
194 typedef struct cipher_order_st {
195 	const SSL_CIPHER *cipher;
196 	int active;
197 	int dead;
198 	struct cipher_order_st *next, *prev;
199 } CIPHER_ORDER;
200 
201 static const SSL_CIPHER cipher_aliases[] = {
202 
203 	/* "ALL" doesn't include eNULL (must be specifically enabled) */
204 	{
205 		.name = SSL_TXT_ALL,
206 		.algorithm_enc = ~SSL_eNULL,
207 	},
208 
209 	/* "COMPLEMENTOFALL" */
210 	{
211 		.name = SSL_TXT_CMPALL,
212 		.algorithm_enc = SSL_eNULL,
213 	},
214 
215 	/*
216 	 * "COMPLEMENTOFDEFAULT"
217 	 * (does *not* include ciphersuites not found in ALL!)
218 	 */
219 	{
220 		.name = SSL_TXT_CMPDEF,
221 		.algorithm_mkey = SSL_kDHE|SSL_kECDHE,
222 		.algorithm_auth = SSL_aNULL,
223 		.algorithm_enc = ~SSL_eNULL,
224 	},
225 
226 	/*
227 	 * key exchange aliases
228 	 * (some of those using only a single bit here combine multiple key
229 	 * exchange algs according to the RFCs, e.g. kEDH combines DHE_DSS
230 	 * and DHE_RSA)
231 	 */
232 	{
233 		.name = SSL_TXT_kRSA,
234 		.algorithm_mkey = SSL_kRSA,
235 	},
236 	{
237 		.name = SSL_TXT_kEDH,
238 		.algorithm_mkey = SSL_kDHE,
239 	},
240 	{
241 		.name = SSL_TXT_DH,
242 		.algorithm_mkey = SSL_kDHE,
243 	},
244 	{
245 		.name = SSL_TXT_kEECDH,
246 		.algorithm_mkey = SSL_kECDHE,
247 	},
248 	{
249 		.name = SSL_TXT_ECDH,
250 		.algorithm_mkey = SSL_kECDHE,
251 	},
252 	{
253 		.name = SSL_TXT_kGOST,
254 		.algorithm_mkey = SSL_kGOST,
255 	},
256 
257 	/* server authentication aliases */
258 	{
259 		.name = SSL_TXT_aRSA,
260 		.algorithm_auth = SSL_aRSA,
261 	},
262 	{
263 		.name = SSL_TXT_aDSS,
264 		.algorithm_auth = SSL_aDSS,
265 	},
266 	{
267 		.name = SSL_TXT_DSS,
268 		.algorithm_auth = SSL_aDSS,
269 	},
270 	{
271 		.name = SSL_TXT_aNULL,
272 		.algorithm_auth = SSL_aNULL,
273 	},
274 	{
275 		.name = SSL_TXT_aECDSA,
276 		.algorithm_auth = SSL_aECDSA,
277 	},
278 	{
279 		.name = SSL_TXT_ECDSA,
280 		.algorithm_auth = SSL_aECDSA,
281 	},
282 	{
283 		.name = SSL_TXT_aGOST01,
284 		.algorithm_auth = SSL_aGOST01,
285 	},
286 	{
287 		.name = SSL_TXT_aGOST,
288 		.algorithm_auth = SSL_aGOST01,
289 	},
290 
291 	/* aliases combining key exchange and server authentication */
292 	{
293 		.name = SSL_TXT_DHE,
294 		.algorithm_mkey = SSL_kDHE,
295 		.algorithm_auth = ~SSL_aNULL,
296 	},
297 	{
298 		.name = SSL_TXT_EDH,
299 		.algorithm_mkey = SSL_kDHE,
300 		.algorithm_auth = ~SSL_aNULL,
301 	},
302 	{
303 		.name = SSL_TXT_ECDHE,
304 		.algorithm_mkey = SSL_kECDHE,
305 		.algorithm_auth = ~SSL_aNULL,
306 	},
307 	{
308 		.name = SSL_TXT_EECDH,
309 		.algorithm_mkey = SSL_kECDHE,
310 		.algorithm_auth = ~SSL_aNULL,
311 	},
312 	{
313 		.name = SSL_TXT_NULL,
314 		.algorithm_enc = SSL_eNULL,
315 	},
316 	{
317 		.name = SSL_TXT_RSA,
318 		.algorithm_mkey = SSL_kRSA,
319 		.algorithm_auth = SSL_aRSA,
320 	},
321 	{
322 		.name = SSL_TXT_ADH,
323 		.algorithm_mkey = SSL_kDHE,
324 		.algorithm_auth = SSL_aNULL,
325 	},
326 	{
327 		.name = SSL_TXT_AECDH,
328 		.algorithm_mkey = SSL_kECDHE,
329 		.algorithm_auth = SSL_aNULL,
330 	},
331 
332 	/* symmetric encryption aliases */
333 	{
334 		.name = SSL_TXT_3DES,
335 		.algorithm_enc = SSL_3DES,
336 	},
337 	{
338 		.name = SSL_TXT_RC4,
339 		.algorithm_enc = SSL_RC4,
340 	},
341 	{
342 		.name = SSL_TXT_eNULL,
343 		.algorithm_enc = SSL_eNULL,
344 	},
345 	{
346 		.name = SSL_TXT_AES128,
347 		.algorithm_enc = SSL_AES128|SSL_AES128GCM,
348 	},
349 	{
350 		.name = SSL_TXT_AES256,
351 		.algorithm_enc = SSL_AES256|SSL_AES256GCM,
352 	},
353 	{
354 		.name = SSL_TXT_AES,
355 		.algorithm_enc = SSL_AES,
356 	},
357 	{
358 		.name = SSL_TXT_AES_GCM,
359 		.algorithm_enc = SSL_AES128GCM|SSL_AES256GCM,
360 	},
361 	{
362 		.name = SSL_TXT_CAMELLIA128,
363 		.algorithm_enc = SSL_CAMELLIA128,
364 	},
365 	{
366 		.name = SSL_TXT_CAMELLIA256,
367 		.algorithm_enc = SSL_CAMELLIA256,
368 	},
369 	{
370 		.name = SSL_TXT_CAMELLIA,
371 		.algorithm_enc = SSL_CAMELLIA128|SSL_CAMELLIA256,
372 	},
373 	{
374 		.name = SSL_TXT_CHACHA20,
375 		.algorithm_enc = SSL_CHACHA20POLY1305,
376 	},
377 
378 	/* MAC aliases */
379 	{
380 		.name = SSL_TXT_AEAD,
381 		.algorithm_mac = SSL_AEAD,
382 	},
383 	{
384 		.name = SSL_TXT_MD5,
385 		.algorithm_mac = SSL_MD5,
386 	},
387 	{
388 		.name = SSL_TXT_SHA1,
389 		.algorithm_mac = SSL_SHA1,
390 	},
391 	{
392 		.name = SSL_TXT_SHA,
393 		.algorithm_mac = SSL_SHA1,
394 	},
395 	{
396 		.name = SSL_TXT_GOST94,
397 		.algorithm_mac = SSL_GOST94,
398 	},
399 	{
400 		.name = SSL_TXT_GOST89MAC,
401 		.algorithm_mac = SSL_GOST89MAC,
402 	},
403 	{
404 		.name = SSL_TXT_SHA256,
405 		.algorithm_mac = SSL_SHA256,
406 	},
407 	{
408 		.name = SSL_TXT_SHA384,
409 		.algorithm_mac = SSL_SHA384,
410 	},
411 	{
412 		.name = SSL_TXT_STREEBOG256,
413 		.algorithm_mac = SSL_STREEBOG256,
414 	},
415 
416 	/* protocol version aliases */
417 	{
418 		.name = SSL_TXT_SSLV3,
419 		.algorithm_ssl = SSL_SSLV3,
420 	},
421 	{
422 		.name = SSL_TXT_TLSV1,
423 		.algorithm_ssl = SSL_TLSV1,
424 	},
425 	{
426 		.name = SSL_TXT_TLSV1_2,
427 		.algorithm_ssl = SSL_TLSV1_2,
428 	},
429 	{
430 		.name = SSL_TXT_TLSV1_3,
431 		.algorithm_ssl = SSL_TLSV1_3,
432 	},
433 
434 	/* strength classes */
435 	{
436 		.name = SSL_TXT_LOW,
437 		.algo_strength = SSL_LOW,
438 	},
439 	{
440 		.name = SSL_TXT_MEDIUM,
441 		.algo_strength = SSL_MEDIUM,
442 	},
443 	{
444 		.name = SSL_TXT_HIGH,
445 		.algo_strength = SSL_HIGH,
446 	},
447 };
448 
449 void
450 ssl_load_ciphers(void)
451 {
452 	ssl_cipher_methods[SSL_ENC_3DES_IDX] =
453 	    EVP_get_cipherbyname(SN_des_ede3_cbc);
454 	ssl_cipher_methods[SSL_ENC_RC4_IDX] =
455 	    EVP_get_cipherbyname(SN_rc4);
456 	ssl_cipher_methods[SSL_ENC_AES128_IDX] =
457 	    EVP_get_cipherbyname(SN_aes_128_cbc);
458 	ssl_cipher_methods[SSL_ENC_AES256_IDX] =
459 	    EVP_get_cipherbyname(SN_aes_256_cbc);
460 	ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] =
461 	    EVP_get_cipherbyname(SN_camellia_128_cbc);
462 	ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] =
463 	    EVP_get_cipherbyname(SN_camellia_256_cbc);
464 	ssl_cipher_methods[SSL_ENC_GOST89_IDX] =
465 	    EVP_get_cipherbyname(SN_gost89_cnt);
466 
467 	ssl_digest_methods[SSL_MD_MD5_IDX] =
468 	    EVP_get_digestbyname(SN_md5);
469 	ssl_mac_secret_size[SSL_MD_MD5_IDX] =
470 	    EVP_MD_size(ssl_digest_methods[SSL_MD_MD5_IDX]);
471 	OPENSSL_assert(ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0);
472 	ssl_digest_methods[SSL_MD_SHA1_IDX] =
473 	    EVP_get_digestbyname(SN_sha1);
474 	ssl_mac_secret_size[SSL_MD_SHA1_IDX] =
475 	    EVP_MD_size(ssl_digest_methods[SSL_MD_SHA1_IDX]);
476 	OPENSSL_assert(ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0);
477 	ssl_digest_methods[SSL_MD_GOST94_IDX] =
478 	    EVP_get_digestbyname(SN_id_GostR3411_94);
479 	if (ssl_digest_methods[SSL_MD_GOST94_IDX]) {
480 		ssl_mac_secret_size[SSL_MD_GOST94_IDX] =
481 		    EVP_MD_size(ssl_digest_methods[SSL_MD_GOST94_IDX]);
482 		OPENSSL_assert(ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0);
483 	}
484 	ssl_digest_methods[SSL_MD_GOST89MAC_IDX] =
485 	    EVP_get_digestbyname(SN_id_Gost28147_89_MAC);
486 	if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) {
487 		ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32;
488 	}
489 
490 	ssl_digest_methods[SSL_MD_SHA256_IDX] =
491 	    EVP_get_digestbyname(SN_sha256);
492 	ssl_mac_secret_size[SSL_MD_SHA256_IDX] =
493 	    EVP_MD_size(ssl_digest_methods[SSL_MD_SHA256_IDX]);
494 	ssl_digest_methods[SSL_MD_SHA384_IDX] =
495 	    EVP_get_digestbyname(SN_sha384);
496 	ssl_mac_secret_size[SSL_MD_SHA384_IDX] =
497 	    EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]);
498 	ssl_digest_methods[SSL_MD_STREEBOG256_IDX] =
499 	    EVP_get_digestbyname(SN_id_tc26_gost3411_2012_256);
500 	ssl_mac_secret_size[SSL_MD_STREEBOG256_IDX] =
501 	    EVP_MD_size(ssl_digest_methods[SSL_MD_STREEBOG256_IDX]);
502 }
503 
504 int
505 ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
506     const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size)
507 {
508 	const SSL_CIPHER *c;
509 	int i;
510 
511 	c = s->cipher;
512 	if (c == NULL)
513 		return (0);
514 
515 	/*
516 	 * This function does not handle EVP_AEAD.
517 	 * See ssl_cipher_get_aead_evp instead.
518 	 */
519 	if (c->algorithm_mac & SSL_AEAD)
520 		return(0);
521 
522 	if ((enc == NULL) || (md == NULL))
523 		return (0);
524 
525 	switch (c->algorithm_enc) {
526 	case SSL_3DES:
527 		i = SSL_ENC_3DES_IDX;
528 		break;
529 	case SSL_RC4:
530 		i = SSL_ENC_RC4_IDX;
531 		break;
532 	case SSL_eNULL:
533 		i = SSL_ENC_NULL_IDX;
534 		break;
535 	case SSL_AES128:
536 		i = SSL_ENC_AES128_IDX;
537 		break;
538 	case SSL_AES256:
539 		i = SSL_ENC_AES256_IDX;
540 		break;
541 	case SSL_CAMELLIA128:
542 		i = SSL_ENC_CAMELLIA128_IDX;
543 		break;
544 	case SSL_CAMELLIA256:
545 		i = SSL_ENC_CAMELLIA256_IDX;
546 		break;
547 	case SSL_eGOST2814789CNT:
548 		i = SSL_ENC_GOST89_IDX;
549 		break;
550 	default:
551 		i = -1;
552 		break;
553 	}
554 
555 	if ((i < 0) || (i >= SSL_ENC_NUM_IDX))
556 		*enc = NULL;
557 	else {
558 		if (i == SSL_ENC_NULL_IDX)
559 			*enc = EVP_enc_null();
560 		else
561 			*enc = ssl_cipher_methods[i];
562 	}
563 
564 	switch (c->algorithm_mac) {
565 	case SSL_MD5:
566 		i = SSL_MD_MD5_IDX;
567 		break;
568 	case SSL_SHA1:
569 		i = SSL_MD_SHA1_IDX;
570 		break;
571 	case SSL_SHA256:
572 		i = SSL_MD_SHA256_IDX;
573 		break;
574 	case SSL_SHA384:
575 		i = SSL_MD_SHA384_IDX;
576 		break;
577 	case SSL_GOST94:
578 		i = SSL_MD_GOST94_IDX;
579 		break;
580 	case SSL_GOST89MAC:
581 		i = SSL_MD_GOST89MAC_IDX;
582 		break;
583 	case SSL_STREEBOG256:
584 		i = SSL_MD_STREEBOG256_IDX;
585 		break;
586 	default:
587 		i = -1;
588 		break;
589 	}
590 	if ((i < 0) || (i >= SSL_MD_NUM_IDX)) {
591 		*md = NULL;
592 
593 		if (mac_pkey_type != NULL)
594 			*mac_pkey_type = NID_undef;
595 		if (mac_secret_size != NULL)
596 			*mac_secret_size = 0;
597 	} else {
598 		*md = ssl_digest_methods[i];
599 		if (mac_pkey_type != NULL)
600 			*mac_pkey_type = ssl_mac_pkey_id[i];
601 		if (mac_secret_size != NULL)
602 			*mac_secret_size = ssl_mac_secret_size[i];
603 	}
604 
605 	if (*enc == NULL || *md == NULL ||
606 	    (mac_pkey_type != NULL && *mac_pkey_type == NID_undef))
607 		return 0;
608 
609 	/*
610 	 * EVP_CIPH_FLAG_AEAD_CIPHER and EVP_CIPH_GCM_MODE ciphers are not
611 	 * supported via EVP_CIPHER (they should be using EVP_AEAD instead).
612 	 */
613 	if (EVP_CIPHER_flags(*enc) & EVP_CIPH_FLAG_AEAD_CIPHER)
614 		return 0;
615 	if (EVP_CIPHER_mode(*enc) == EVP_CIPH_GCM_MODE)
616 		return 0;
617 
618 	return 1;
619 }
620 
621 /*
622  * ssl_cipher_get_evp_aead sets aead to point to the correct EVP_AEAD object
623  * for s->cipher. It returns 1 on success and 0 on error.
624  */
625 int
626 ssl_cipher_get_evp_aead(const SSL_SESSION *s, const EVP_AEAD **aead)
627 {
628 	const SSL_CIPHER *c = s->cipher;
629 
630 	*aead = NULL;
631 
632 	if (c == NULL)
633 		return 0;
634 	if ((c->algorithm_mac & SSL_AEAD) == 0)
635 		return 0;
636 
637 	switch (c->algorithm_enc) {
638 	case SSL_AES128GCM:
639 		*aead = EVP_aead_aes_128_gcm();
640 		return 1;
641 	case SSL_AES256GCM:
642 		*aead = EVP_aead_aes_256_gcm();
643 		return 1;
644 	case SSL_CHACHA20POLY1305:
645 		*aead = EVP_aead_chacha20_poly1305();
646 		return 1;
647 	default:
648 		break;
649 	}
650 	return 0;
651 }
652 
653 int
654 ssl_get_handshake_evp_md(SSL *s, const EVP_MD **md)
655 {
656 	*md = NULL;
657 
658 	switch (ssl_get_algorithm2(s) & SSL_HANDSHAKE_MAC_MASK) {
659 	case SSL_HANDSHAKE_MAC_DEFAULT:
660 		*md = EVP_md5_sha1();
661 		return 1;
662 	case SSL_HANDSHAKE_MAC_GOST94:
663 		*md = EVP_gostr341194();
664 		return 1;
665 	case SSL_HANDSHAKE_MAC_SHA256:
666 		*md = EVP_sha256();
667 		return 1;
668 	case SSL_HANDSHAKE_MAC_SHA384:
669 		*md = EVP_sha384();
670 		return 1;
671 	case SSL_HANDSHAKE_MAC_STREEBOG256:
672 		*md = EVP_streebog256();
673 		return 1;
674 	default:
675 		break;
676 	}
677 
678 	return 0;
679 }
680 
681 #define ITEM_SEP(a) \
682 	(((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))
683 
684 static void
685 ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
686     CIPHER_ORDER **tail)
687 {
688 	if (curr == *tail)
689 		return;
690 	if (curr == *head)
691 		*head = curr->next;
692 	if (curr->prev != NULL)
693 		curr->prev->next = curr->next;
694 	if (curr->next != NULL)
695 		curr->next->prev = curr->prev;
696 	(*tail)->next = curr;
697 	curr->prev= *tail;
698 	curr->next = NULL;
699 	*tail = curr;
700 }
701 
702 static void
703 ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,
704     CIPHER_ORDER **tail)
705 {
706 	if (curr == *head)
707 		return;
708 	if (curr == *tail)
709 		*tail = curr->prev;
710 	if (curr->next != NULL)
711 		curr->next->prev = curr->prev;
712 	if (curr->prev != NULL)
713 		curr->prev->next = curr->next;
714 	(*head)->prev = curr;
715 	curr->next= *head;
716 	curr->prev = NULL;
717 	*head = curr;
718 }
719 
720 static void
721 ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth,
722     unsigned long *enc, unsigned long *mac, unsigned long *ssl)
723 {
724 	*mkey = 0;
725 	*auth = 0;
726 	*enc = 0;
727 	*mac = 0;
728 	*ssl = 0;
729 
730 	/*
731 	 * Check for the availability of GOST 34.10 public/private key
732 	 * algorithms. If they are not available disable the associated
733 	 * authentication and key exchange algorithms.
734 	 */
735 	if (EVP_PKEY_meth_find(NID_id_GostR3410_2001) == NULL) {
736 		*auth |= SSL_aGOST01;
737 		*mkey |= SSL_kGOST;
738 	}
739 
740 #ifdef SSL_FORBID_ENULL
741 	*enc |= SSL_eNULL;
742 #endif
743 
744 	*enc |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES : 0;
745 	*enc |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 : 0;
746 	*enc |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES128 : 0;
747 	*enc |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES256 : 0;
748 	*enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA128 : 0;
749 	*enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA256 : 0;
750 	*enc |= (ssl_cipher_methods[SSL_ENC_GOST89_IDX] == NULL) ? SSL_eGOST2814789CNT : 0;
751 
752 	*mac |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 : 0;
753 	*mac |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1 : 0;
754 	*mac |= (ssl_digest_methods[SSL_MD_SHA256_IDX] == NULL) ? SSL_SHA256 : 0;
755 	*mac |= (ssl_digest_methods[SSL_MD_SHA384_IDX] == NULL) ? SSL_SHA384 : 0;
756 	*mac |= (ssl_digest_methods[SSL_MD_GOST94_IDX] == NULL) ? SSL_GOST94 : 0;
757 	*mac |= (ssl_digest_methods[SSL_MD_GOST89MAC_IDX] == NULL) ? SSL_GOST89MAC : 0;
758 	*mac |= (ssl_digest_methods[SSL_MD_STREEBOG256_IDX] == NULL) ? SSL_STREEBOG256 : 0;
759 }
760 
761 static void
762 ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, int num_of_ciphers,
763     unsigned long disabled_mkey, unsigned long disabled_auth,
764     unsigned long disabled_enc, unsigned long disabled_mac,
765     unsigned long disabled_ssl, CIPHER_ORDER *co_list,
766     CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
767 {
768 	int i, co_list_num;
769 	const SSL_CIPHER *c;
770 
771 	/*
772 	 * We have num_of_ciphers descriptions compiled in, depending on the
773 	 * method selected (SSLv3, TLSv1, etc). These will later be sorted in
774 	 * a linked list with at most num entries.
775 	 */
776 
777 	/* Get the initial list of ciphers */
778 	co_list_num = 0;	/* actual count of ciphers */
779 	for (i = 0; i < num_of_ciphers; i++) {
780 		c = ssl_method->get_cipher(i);
781 		/* drop those that use any of that is not available */
782 		if ((c != NULL) && c->valid &&
783 		    !(c->algorithm_mkey & disabled_mkey) &&
784 		    !(c->algorithm_auth & disabled_auth) &&
785 		    !(c->algorithm_enc & disabled_enc) &&
786 		    !(c->algorithm_mac & disabled_mac) &&
787 		    !(c->algorithm_ssl & disabled_ssl)) {
788 			co_list[co_list_num].cipher = c;
789 			co_list[co_list_num].next = NULL;
790 			co_list[co_list_num].prev = NULL;
791 			co_list[co_list_num].active = 0;
792 			co_list_num++;
793 			/*
794 			if (!sk_push(ca_list,(char *)c)) goto err;
795 			*/
796 		}
797 	}
798 
799 	/*
800 	 * Prepare linked list from list entries
801 	 */
802 	if (co_list_num > 0) {
803 		co_list[0].prev = NULL;
804 
805 		if (co_list_num > 1) {
806 			co_list[0].next = &co_list[1];
807 
808 			for (i = 1; i < co_list_num - 1; i++) {
809 				co_list[i].prev = &co_list[i - 1];
810 				co_list[i].next = &co_list[i + 1];
811 			}
812 
813 			co_list[co_list_num - 1].prev =
814 			    &co_list[co_list_num - 2];
815 		}
816 
817 		co_list[co_list_num - 1].next = NULL;
818 
819 		*head_p = &co_list[0];
820 		*tail_p = &co_list[co_list_num - 1];
821 	}
822 }
823 
824 static void
825 ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list, int num_of_group_aliases,
826     unsigned long disabled_mkey, unsigned long disabled_auth,
827     unsigned long disabled_enc, unsigned long disabled_mac,
828     unsigned long disabled_ssl, CIPHER_ORDER *head)
829 {
830 	CIPHER_ORDER *ciph_curr;
831 	const SSL_CIPHER **ca_curr;
832 	int i;
833 	unsigned long mask_mkey = ~disabled_mkey;
834 	unsigned long mask_auth = ~disabled_auth;
835 	unsigned long mask_enc = ~disabled_enc;
836 	unsigned long mask_mac = ~disabled_mac;
837 	unsigned long mask_ssl = ~disabled_ssl;
838 
839 	/*
840 	 * First, add the real ciphers as already collected
841 	 */
842 	ciph_curr = head;
843 	ca_curr = ca_list;
844 	while (ciph_curr != NULL) {
845 		*ca_curr = ciph_curr->cipher;
846 		ca_curr++;
847 		ciph_curr = ciph_curr->next;
848 	}
849 
850 	/*
851 	 * Now we add the available ones from the cipher_aliases[] table.
852 	 * They represent either one or more algorithms, some of which
853 	 * in any affected category must be supported (set in enabled_mask),
854 	 * or represent a cipher strength value (will be added in any case because algorithms=0).
855 	 */
856 	for (i = 0; i < num_of_group_aliases; i++) {
857 		unsigned long algorithm_mkey = cipher_aliases[i].algorithm_mkey;
858 		unsigned long algorithm_auth = cipher_aliases[i].algorithm_auth;
859 		unsigned long algorithm_enc = cipher_aliases[i].algorithm_enc;
860 		unsigned long algorithm_mac = cipher_aliases[i].algorithm_mac;
861 		unsigned long algorithm_ssl = cipher_aliases[i].algorithm_ssl;
862 
863 		if (algorithm_mkey)
864 			if ((algorithm_mkey & mask_mkey) == 0)
865 				continue;
866 
867 		if (algorithm_auth)
868 			if ((algorithm_auth & mask_auth) == 0)
869 				continue;
870 
871 		if (algorithm_enc)
872 			if ((algorithm_enc & mask_enc) == 0)
873 				continue;
874 
875 		if (algorithm_mac)
876 			if ((algorithm_mac & mask_mac) == 0)
877 				continue;
878 
879 		if (algorithm_ssl)
880 			if ((algorithm_ssl & mask_ssl) == 0)
881 				continue;
882 
883 		*ca_curr = (SSL_CIPHER *)(cipher_aliases + i);
884 		ca_curr++;
885 	}
886 
887 	*ca_curr = NULL;	/* end of list */
888 }
889 
890 static void
891 ssl_cipher_apply_rule(unsigned long cipher_id, unsigned long alg_mkey,
892     unsigned long alg_auth, unsigned long alg_enc, unsigned long alg_mac,
893     unsigned long alg_ssl, unsigned long algo_strength,
894     int rule, int strength_bits, CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
895 {
896 	CIPHER_ORDER *head, *tail, *curr, *next, *last;
897 	const SSL_CIPHER *cp;
898 	int reverse = 0;
899 
900 
901 	if (rule == CIPHER_DEL)
902 		reverse = 1; /* needed to maintain sorting between currently deleted ciphers */
903 
904 	head = *head_p;
905 	tail = *tail_p;
906 
907 	if (reverse) {
908 		next = tail;
909 		last = head;
910 	} else {
911 		next = head;
912 		last = tail;
913 	}
914 
915 	curr = NULL;
916 	for (;;) {
917 		if (curr == last)
918 			break;
919 		curr = next;
920 		next = reverse ? curr->prev : curr->next;
921 
922 		cp = curr->cipher;
923 
924 		/*
925 		 * Selection criteria is either the value of strength_bits
926 		 * or the algorithms used.
927 		 */
928 		if (strength_bits >= 0) {
929 			if (strength_bits != cp->strength_bits)
930 				continue;
931 		} else {
932 
933 			if (alg_mkey && !(alg_mkey & cp->algorithm_mkey))
934 				continue;
935 			if (alg_auth && !(alg_auth & cp->algorithm_auth))
936 				continue;
937 			if (alg_enc && !(alg_enc & cp->algorithm_enc))
938 				continue;
939 			if (alg_mac && !(alg_mac & cp->algorithm_mac))
940 				continue;
941 			if (alg_ssl && !(alg_ssl & cp->algorithm_ssl))
942 				continue;
943 			if ((algo_strength & SSL_STRONG_MASK) && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))
944 				continue;
945 		}
946 
947 
948 		/* add the cipher if it has not been added yet. */
949 		if (rule == CIPHER_ADD) {
950 			/* reverse == 0 */
951 			if (!curr->active) {
952 				ll_append_tail(&head, curr, &tail);
953 				curr->active = 1;
954 			}
955 		}
956 		/* Move the added cipher to this location */
957 		else if (rule == CIPHER_ORD) {
958 			/* reverse == 0 */
959 			if (curr->active) {
960 				ll_append_tail(&head, curr, &tail);
961 			}
962 		} else if (rule == CIPHER_DEL) {
963 			/* reverse == 1 */
964 			if (curr->active) {
965 				/* most recently deleted ciphersuites get best positions
966 				 * for any future CIPHER_ADD (note that the CIPHER_DEL loop
967 				 * works in reverse to maintain the order) */
968 				ll_append_head(&head, curr, &tail);
969 				curr->active = 0;
970 			}
971 		} else if (rule == CIPHER_KILL) {
972 			/* reverse == 0 */
973 			if (head == curr)
974 				head = curr->next;
975 			else
976 				curr->prev->next = curr->next;
977 			if (tail == curr)
978 				tail = curr->prev;
979 			curr->active = 0;
980 			if (curr->next != NULL)
981 				curr->next->prev = curr->prev;
982 			if (curr->prev != NULL)
983 				curr->prev->next = curr->next;
984 			curr->next = NULL;
985 			curr->prev = NULL;
986 		}
987 	}
988 
989 	*head_p = head;
990 	*tail_p = tail;
991 }
992 
993 static int
994 ssl_cipher_strength_sort(CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
995 {
996 	int max_strength_bits, i, *number_uses;
997 	CIPHER_ORDER *curr;
998 
999 	/*
1000 	 * This routine sorts the ciphers with descending strength. The sorting
1001 	 * must keep the pre-sorted sequence, so we apply the normal sorting
1002 	 * routine as '+' movement to the end of the list.
1003 	 */
1004 	max_strength_bits = 0;
1005 	curr = *head_p;
1006 	while (curr != NULL) {
1007 		if (curr->active &&
1008 		    (curr->cipher->strength_bits > max_strength_bits))
1009 			max_strength_bits = curr->cipher->strength_bits;
1010 		curr = curr->next;
1011 	}
1012 
1013 	number_uses = calloc((max_strength_bits + 1), sizeof(int));
1014 	if (!number_uses) {
1015 		SSLerrorx(ERR_R_MALLOC_FAILURE);
1016 		return (0);
1017 	}
1018 
1019 	/*
1020 	 * Now find the strength_bits values actually used
1021 	 */
1022 	curr = *head_p;
1023 	while (curr != NULL) {
1024 		if (curr->active)
1025 			number_uses[curr->cipher->strength_bits]++;
1026 		curr = curr->next;
1027 	}
1028 	/*
1029 	 * Go through the list of used strength_bits values in descending
1030 	 * order.
1031 	 */
1032 	for (i = max_strength_bits; i >= 0; i--)
1033 		if (number_uses[i] > 0)
1034 			ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, tail_p);
1035 
1036 	free(number_uses);
1037 	return (1);
1038 }
1039 
1040 static int
1041 ssl_cipher_process_rulestr(const char *rule_str, CIPHER_ORDER **head_p,
1042     CIPHER_ORDER **tail_p, const SSL_CIPHER **ca_list)
1043 {
1044 	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl;
1045 	unsigned long algo_strength;
1046 	int j, multi, found, rule, retval, ok, buflen;
1047 	unsigned long cipher_id = 0;
1048 	const char *l, *buf;
1049 	char ch;
1050 
1051 	retval = 1;
1052 	l = rule_str;
1053 	for (;;) {
1054 		ch = *l;
1055 
1056 		if (ch == '\0')
1057 			break;
1058 
1059 		if (ch == '-') {
1060 			rule = CIPHER_DEL;
1061 			l++;
1062 		} else if (ch == '+') {
1063 			rule = CIPHER_ORD;
1064 			l++;
1065 		} else if (ch == '!') {
1066 			rule = CIPHER_KILL;
1067 			l++;
1068 		} else if (ch == '@') {
1069 			rule = CIPHER_SPECIAL;
1070 			l++;
1071 		} else {
1072 			rule = CIPHER_ADD;
1073 		}
1074 
1075 		if (ITEM_SEP(ch)) {
1076 			l++;
1077 			continue;
1078 		}
1079 
1080 		alg_mkey = 0;
1081 		alg_auth = 0;
1082 		alg_enc = 0;
1083 		alg_mac = 0;
1084 		alg_ssl = 0;
1085 		algo_strength = 0;
1086 
1087 		for (;;) {
1088 			ch = *l;
1089 			buf = l;
1090 			buflen = 0;
1091 			while (((ch >= 'A') && (ch <= 'Z')) ||
1092 			    ((ch >= '0') && (ch <= '9')) ||
1093 			    ((ch >= 'a') && (ch <= 'z')) ||
1094 			    (ch == '-') || (ch == '.')) {
1095 				ch = *(++l);
1096 				buflen++;
1097 			}
1098 
1099 			if (buflen == 0) {
1100 				/*
1101 				 * We hit something we cannot deal with,
1102 				 * it is no command or separator nor
1103 				 * alphanumeric, so we call this an error.
1104 				 */
1105 				SSLerrorx(SSL_R_INVALID_COMMAND);
1106 				retval = found = 0;
1107 				l++;
1108 				break;
1109 			}
1110 
1111 			if (rule == CIPHER_SPECIAL) {
1112 				 /* unused -- avoid compiler warning */
1113 				found = 0;
1114 				/* special treatment */
1115 				break;
1116 			}
1117 
1118 			/* check for multi-part specification */
1119 			if (ch == '+') {
1120 				multi = 1;
1121 				l++;
1122 			} else
1123 				multi = 0;
1124 
1125 			/*
1126 			 * Now search for the cipher alias in the ca_list.
1127 			 * Be careful with the strncmp, because the "buflen"
1128 			 * limitation will make the rule "ADH:SOME" and the
1129 			 * cipher "ADH-MY-CIPHER" look like a match for
1130 			 * buflen=3. So additionally check whether the cipher
1131 			 * name found has the correct length. We can save a
1132 			 * strlen() call: just checking for the '\0' at the
1133 			 * right place is sufficient, we have to strncmp()
1134 			 * anyway (we cannot use strcmp(), because buf is not
1135 			 * '\0' terminated.)
1136 			 */
1137 			j = found = 0;
1138 			cipher_id = 0;
1139 			while (ca_list[j]) {
1140 				if (!strncmp(buf, ca_list[j]->name, buflen) &&
1141 				    (ca_list[j]->name[buflen] == '\0')) {
1142 					found = 1;
1143 					break;
1144 				} else
1145 					j++;
1146 			}
1147 
1148 			if (!found)
1149 				break;	/* ignore this entry */
1150 
1151 			if (ca_list[j]->algorithm_mkey) {
1152 				if (alg_mkey) {
1153 					alg_mkey &= ca_list[j]->algorithm_mkey;
1154 					if (!alg_mkey) {
1155 						found = 0;
1156 						break;
1157 					}
1158 				} else
1159 					alg_mkey = ca_list[j]->algorithm_mkey;
1160 			}
1161 
1162 			if (ca_list[j]->algorithm_auth) {
1163 				if (alg_auth) {
1164 					alg_auth &= ca_list[j]->algorithm_auth;
1165 					if (!alg_auth) {
1166 						found = 0;
1167 						break;
1168 					}
1169 				} else
1170 					alg_auth = ca_list[j]->algorithm_auth;
1171 			}
1172 
1173 			if (ca_list[j]->algorithm_enc) {
1174 				if (alg_enc) {
1175 					alg_enc &= ca_list[j]->algorithm_enc;
1176 					if (!alg_enc) {
1177 						found = 0;
1178 						break;
1179 					}
1180 				} else
1181 					alg_enc = ca_list[j]->algorithm_enc;
1182 			}
1183 
1184 			if (ca_list[j]->algorithm_mac) {
1185 				if (alg_mac) {
1186 					alg_mac &= ca_list[j]->algorithm_mac;
1187 					if (!alg_mac) {
1188 						found = 0;
1189 						break;
1190 					}
1191 				} else
1192 					alg_mac = ca_list[j]->algorithm_mac;
1193 			}
1194 
1195 			if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {
1196 				if (algo_strength & SSL_STRONG_MASK) {
1197 					algo_strength &=
1198 					    (ca_list[j]->algo_strength &
1199 					    SSL_STRONG_MASK) | ~SSL_STRONG_MASK;
1200 					if (!(algo_strength &
1201 					    SSL_STRONG_MASK)) {
1202 						found = 0;
1203 						break;
1204 					}
1205 				} else
1206 					algo_strength |=
1207 					    ca_list[j]->algo_strength &
1208 					    SSL_STRONG_MASK;
1209 			}
1210 
1211 			if (ca_list[j]->valid) {
1212 				/*
1213 				 * explicit ciphersuite found; its protocol
1214 				 * version does not become part of the search
1215 				 * pattern!
1216 				 */
1217 				cipher_id = ca_list[j]->id;
1218 			} else {
1219 				/*
1220 				 * not an explicit ciphersuite; only in this
1221 				 * case, the protocol version is considered
1222 				 * part of the search pattern
1223 				 */
1224 				if (ca_list[j]->algorithm_ssl) {
1225 					if (alg_ssl) {
1226 						alg_ssl &=
1227 						    ca_list[j]->algorithm_ssl;
1228 						if (!alg_ssl) {
1229 							found = 0;
1230 							break;
1231 						}
1232 					} else
1233 						alg_ssl =
1234 						    ca_list[j]->algorithm_ssl;
1235 				}
1236 			}
1237 
1238 			if (!multi)
1239 				break;
1240 		}
1241 
1242 		/*
1243 		 * Ok, we have the rule, now apply it
1244 		 */
1245 		if (rule == CIPHER_SPECIAL) {
1246 			/* special command */
1247 			ok = 0;
1248 			if ((buflen == 8) && !strncmp(buf, "STRENGTH", 8))
1249 				ok = ssl_cipher_strength_sort(head_p, tail_p);
1250 			else
1251 				SSLerrorx(SSL_R_INVALID_COMMAND);
1252 			if (ok == 0)
1253 				retval = 0;
1254 			/*
1255 			 * We do not support any "multi" options
1256 			 * together with "@", so throw away the
1257 			 * rest of the command, if any left, until
1258 			 * end or ':' is found.
1259 			 */
1260 			while ((*l != '\0') && !ITEM_SEP(*l))
1261 				l++;
1262 		} else if (found) {
1263 			ssl_cipher_apply_rule(cipher_id, alg_mkey, alg_auth,
1264 			    alg_enc, alg_mac, alg_ssl, algo_strength, rule,
1265 			    -1, head_p, tail_p);
1266 		} else {
1267 			while ((*l != '\0') && !ITEM_SEP(*l))
1268 				l++;
1269 		}
1270 		if (*l == '\0')
1271 			break; /* done */
1272 	}
1273 
1274 	return (retval);
1275 }
1276 
1277 static inline int
1278 ssl_aes_is_accelerated(void)
1279 {
1280 #if defined(__i386__) || defined(__x86_64__)
1281 	return ((OPENSSL_cpu_caps() & (1ULL << 57)) != 0);
1282 #else
1283 	return (0);
1284 #endif
1285 }
1286 
1287 STACK_OF(SSL_CIPHER) *
1288 ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1289     STACK_OF(SSL_CIPHER) **cipher_list,
1290     STACK_OF(SSL_CIPHER) **cipher_list_by_id,
1291     const char *rule_str)
1292 {
1293 	int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
1294 	unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;
1295 	STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
1296 	const char *rule_p;
1297 	CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
1298 	const SSL_CIPHER **ca_list = NULL;
1299 
1300 	/*
1301 	 * Return with error if nothing to do.
1302 	 */
1303 	if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
1304 		return NULL;
1305 
1306 	/*
1307 	 * To reduce the work to do we only want to process the compiled
1308 	 * in algorithms, so we first get the mask of disabled ciphers.
1309 	 */
1310 	ssl_cipher_get_disabled(&disabled_mkey, &disabled_auth, &disabled_enc, &disabled_mac, &disabled_ssl);
1311 
1312 	/*
1313 	 * Now we have to collect the available ciphers from the compiled
1314 	 * in ciphers. We cannot get more than the number compiled in, so
1315 	 * it is used for allocation.
1316 	 */
1317 	num_of_ciphers = ssl_method->num_ciphers();
1318 	co_list = reallocarray(NULL, num_of_ciphers, sizeof(CIPHER_ORDER));
1319 	if (co_list == NULL) {
1320 		SSLerrorx(ERR_R_MALLOC_FAILURE);
1321 		return(NULL);	/* Failure */
1322 	}
1323 
1324 	ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
1325 	    disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,
1326 	    co_list, &head, &tail);
1327 
1328 
1329 	/* Now arrange all ciphers by preference: */
1330 
1331 	/* Everything else being equal, prefer ephemeral ECDH over other key exchange mechanisms */
1332 	ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1333 	ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
1334 
1335 	if (ssl_aes_is_accelerated() == 1) {
1336 		/*
1337 		 * We have hardware assisted AES - prefer AES as a symmetric
1338 		 * cipher, with CHACHA20 second.
1339 		 */
1340 		ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0,
1341 		    CIPHER_ADD, -1, &head, &tail);
1342 		ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305,
1343 		    0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1344 	} else {
1345 		/*
1346 		 * CHACHA20 is fast and safe on all hardware and is thus our
1347 		 * preferred symmetric cipher, with AES second.
1348 		 */
1349 		ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305,
1350 		    0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1351 		ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0,
1352 		    CIPHER_ADD, -1, &head, &tail);
1353 	}
1354 
1355 	/* Temporarily enable everything else for sorting */
1356 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
1357 
1358 	/* Low priority for MD5 */
1359 	ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head, &tail);
1360 
1361 	/* Move anonymous ciphers to the end.  Usually, these will remain disabled.
1362 	 * (For applications that allow them, they aren't too bad, but we prefer
1363 	 * authenticated ciphers.) */
1364 	ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1365 
1366 	/* Move ciphers without forward secrecy to the end */
1367 	ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1368 
1369 	/* RC4 is sort of broken - move it to the end */
1370 	ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1371 
1372 	/* Now sort by symmetric encryption strength.  The above ordering remains
1373 	 * in force within each class */
1374 	if (!ssl_cipher_strength_sort(&head, &tail)) {
1375 		free(co_list);
1376 		return NULL;
1377 	}
1378 
1379 	/* Now disable everything (maintaining the ordering!) */
1380 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
1381 
1382 	/* TLSv1.3 first. */
1383 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, SSL_TLSV1_3, 0, CIPHER_ADD, -1, &head, &tail);
1384 	ssl_cipher_apply_rule(0, 0, 0, 0, 0, SSL_TLSV1_3, 0, CIPHER_DEL, -1, &head, &tail);
1385 
1386 	/*
1387 	 * We also need cipher aliases for selecting based on the rule_str.
1388 	 * There might be two types of entries in the rule_str: 1) names
1389 	 * of ciphers themselves 2) aliases for groups of ciphers.
1390 	 * For 1) we need the available ciphers and for 2) the cipher
1391 	 * groups of cipher_aliases added together in one list (otherwise
1392 	 * we would be happy with just the cipher_aliases table).
1393 	 */
1394 	num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
1395 	num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
1396 	ca_list = reallocarray(NULL, num_of_alias_max, sizeof(SSL_CIPHER *));
1397 	if (ca_list == NULL) {
1398 		free(co_list);
1399 		SSLerrorx(ERR_R_MALLOC_FAILURE);
1400 		return(NULL);	/* Failure */
1401 	}
1402 	ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
1403 	disabled_mkey, disabled_auth, disabled_enc,
1404 	disabled_mac, disabled_ssl, head);
1405 
1406 	/*
1407 	 * If the rule_string begins with DEFAULT, apply the default rule
1408 	 * before using the (possibly available) additional rules.
1409 	 */
1410 	ok = 1;
1411 	rule_p = rule_str;
1412 	if (strncmp(rule_str, "DEFAULT", 7) == 0) {
1413 		ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
1414 		&head, &tail, ca_list);
1415 		rule_p += 7;
1416 		if (*rule_p == ':')
1417 			rule_p++;
1418 	}
1419 
1420 	if (ok && (strlen(rule_p) > 0))
1421 		ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list);
1422 
1423 	free((void *)ca_list);	/* Not needed anymore */
1424 
1425 	if (!ok) {
1426 		/* Rule processing failure */
1427 		free(co_list);
1428 		return (NULL);
1429 	}
1430 
1431 	/*
1432 	 * Allocate new "cipherstack" for the result, return with error
1433 	 * if we cannot get one.
1434 	 */
1435 	if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
1436 		free(co_list);
1437 		return (NULL);
1438 	}
1439 
1440 	/*
1441 	 * The cipher selection for the list is done. The ciphers are added
1442 	 * to the resulting precedence to the STACK_OF(SSL_CIPHER).
1443 	 */
1444 	for (curr = head; curr != NULL; curr = curr->next) {
1445 		if (curr->active) {
1446 			sk_SSL_CIPHER_push(cipherstack, curr->cipher);
1447 		}
1448 	}
1449 	free(co_list);	/* Not needed any longer */
1450 
1451 	tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
1452 	if (tmp_cipher_list == NULL) {
1453 		sk_SSL_CIPHER_free(cipherstack);
1454 		return NULL;
1455 	}
1456 	sk_SSL_CIPHER_free(*cipher_list);
1457 	*cipher_list = cipherstack;
1458 	sk_SSL_CIPHER_free(*cipher_list_by_id);
1459 	*cipher_list_by_id = tmp_cipher_list;
1460 	(void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,
1461 	    ssl_cipher_ptr_id_cmp);
1462 
1463 	sk_SSL_CIPHER_sort(*cipher_list_by_id);
1464 	return (cipherstack);
1465 }
1466 
1467 const SSL_CIPHER *
1468 SSL_CIPHER_get_by_id(unsigned int id)
1469 {
1470 	return ssl3_get_cipher_by_id(id);
1471 }
1472 
1473 const SSL_CIPHER *
1474 SSL_CIPHER_get_by_value(uint16_t value)
1475 {
1476 	return ssl3_get_cipher_by_value(value);
1477 }
1478 
1479 char *
1480 SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1481 {
1482 	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, alg2;
1483 	const char *ver, *kx, *au, *enc, *mac;
1484 	char *ret;
1485 	int l;
1486 
1487 	alg_mkey = cipher->algorithm_mkey;
1488 	alg_auth = cipher->algorithm_auth;
1489 	alg_enc = cipher->algorithm_enc;
1490 	alg_mac = cipher->algorithm_mac;
1491 	alg_ssl = cipher->algorithm_ssl;
1492 
1493 	alg2 = cipher->algorithm2;
1494 
1495 	if (alg_ssl & SSL_SSLV3)
1496 		ver = "SSLv3";
1497 	else if (alg_ssl & SSL_TLSV1_2)
1498 		ver = "TLSv1.2";
1499 	else if (alg_ssl & SSL_TLSV1_3)
1500 		ver = "TLSv1.3";
1501 	else
1502 		ver = "unknown";
1503 
1504 	switch (alg_mkey) {
1505 	case SSL_kRSA:
1506 		kx = "RSA";
1507 		break;
1508 	case SSL_kDHE:
1509 		kx = "DH";
1510 		break;
1511 	case SSL_kECDHE:
1512 		kx = "ECDH";
1513 		break;
1514 	case SSL_kGOST:
1515 		kx = "GOST";
1516 		break;
1517 	default:
1518 		kx = "unknown";
1519 	}
1520 
1521 	switch (alg_auth) {
1522 	case SSL_aRSA:
1523 		au = "RSA";
1524 		break;
1525 	case SSL_aDSS:
1526 		au = "DSS";
1527 		break;
1528 	case SSL_aNULL:
1529 		au = "None";
1530 		break;
1531 	case SSL_aECDSA:
1532 		au = "ECDSA";
1533 		break;
1534 	case SSL_aGOST01:
1535 		au = "GOST01";
1536 		break;
1537 	default:
1538 		au = "unknown";
1539 		break;
1540 	}
1541 
1542 	switch (alg_enc) {
1543 	case SSL_3DES:
1544 		enc = "3DES(168)";
1545 		break;
1546 	case SSL_RC4:
1547 		enc = alg2 & SSL2_CF_8_BYTE_ENC ? "RC4(64)" : "RC4(128)";
1548 		break;
1549 	case SSL_eNULL:
1550 		enc = "None";
1551 		break;
1552 	case SSL_AES128:
1553 		enc = "AES(128)";
1554 		break;
1555 	case SSL_AES256:
1556 		enc = "AES(256)";
1557 		break;
1558 	case SSL_AES128GCM:
1559 		enc = "AESGCM(128)";
1560 		break;
1561 	case SSL_AES256GCM:
1562 		enc = "AESGCM(256)";
1563 		break;
1564 	case SSL_CAMELLIA128:
1565 		enc = "Camellia(128)";
1566 		break;
1567 	case SSL_CAMELLIA256:
1568 		enc = "Camellia(256)";
1569 		break;
1570 	case SSL_CHACHA20POLY1305:
1571 		enc = "ChaCha20-Poly1305";
1572 		break;
1573 	case SSL_eGOST2814789CNT:
1574 		enc = "GOST-28178-89-CNT";
1575 		break;
1576 	default:
1577 		enc = "unknown";
1578 		break;
1579 	}
1580 
1581 	switch (alg_mac) {
1582 	case SSL_MD5:
1583 		mac = "MD5";
1584 		break;
1585 	case SSL_SHA1:
1586 		mac = "SHA1";
1587 		break;
1588 	case SSL_SHA256:
1589 		mac = "SHA256";
1590 		break;
1591 	case SSL_SHA384:
1592 		mac = "SHA384";
1593 		break;
1594 	case SSL_AEAD:
1595 		mac = "AEAD";
1596 		break;
1597 	case SSL_GOST94:
1598 		mac = "GOST94";
1599 		break;
1600 	case SSL_GOST89MAC:
1601 		mac = "GOST89IMIT";
1602 		break;
1603 	case SSL_STREEBOG256:
1604 		mac = "STREEBOG256";
1605 		break;
1606 	default:
1607 		mac = "unknown";
1608 		break;
1609 	}
1610 
1611 	if (asprintf(&ret, "%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s\n",
1612 	    cipher->name, ver, kx, au, enc, mac) == -1)
1613 		return "OPENSSL_malloc Error";
1614 
1615 	if (buf != NULL) {
1616 		l = strlcpy(buf, ret, len);
1617 		free(ret);
1618 		ret = buf;
1619 		if (l >= len)
1620 			ret = "Buffer too small";
1621 	}
1622 
1623 	return (ret);
1624 }
1625 
1626 const char *
1627 SSL_CIPHER_get_version(const SSL_CIPHER *c)
1628 {
1629 	if (c == NULL)
1630 		return("(NONE)");
1631 	if ((c->id >> 24) == 3)
1632 		return("TLSv1/SSLv3");
1633 	else
1634 		return("unknown");
1635 }
1636 
1637 /* return the actual cipher being used */
1638 const char *
1639 SSL_CIPHER_get_name(const SSL_CIPHER *c)
1640 {
1641 	if (c != NULL)
1642 		return (c->name);
1643 	return("(NONE)");
1644 }
1645 
1646 /* number of bits for symmetric cipher */
1647 int
1648 SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits)
1649 {
1650 	int ret = 0;
1651 
1652 	if (c != NULL) {
1653 		if (alg_bits != NULL)
1654 			*alg_bits = c->alg_bits;
1655 		ret = c->strength_bits;
1656 	}
1657 	return (ret);
1658 }
1659 
1660 unsigned long
1661 SSL_CIPHER_get_id(const SSL_CIPHER *c)
1662 {
1663 	return c->id;
1664 }
1665 
1666 uint16_t
1667 SSL_CIPHER_get_value(const SSL_CIPHER *c)
1668 {
1669 	return ssl3_cipher_get_value(c);
1670 }
1671 
1672 int
1673 SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c)
1674 {
1675 	switch (c->algorithm_enc) {
1676 	case SSL_eNULL:
1677 		return NID_undef;
1678 	case SSL_3DES:
1679 		return NID_des_ede3_cbc;
1680 	case SSL_AES128:
1681 		return NID_aes_128_cbc;
1682 	case SSL_AES128GCM:
1683 		return NID_aes_128_gcm;
1684 	case SSL_AES256:
1685 		return NID_aes_256_cbc;
1686 	case SSL_AES256GCM:
1687 		return NID_aes_256_gcm;
1688 	case SSL_CAMELLIA128:
1689 		return NID_camellia_128_cbc;
1690 	case SSL_CAMELLIA256:
1691 		return NID_camellia_256_cbc;
1692 	case SSL_CHACHA20POLY1305:
1693 		return NID_chacha20_poly1305;
1694 	case SSL_DES:
1695 		return NID_des_cbc;
1696 	case SSL_RC4:
1697 		return NID_rc4;
1698 	case SSL_eGOST2814789CNT:
1699 		return NID_gost89_cnt;
1700 	default:
1701 		return NID_undef;
1702 	}
1703 }
1704 
1705 int
1706 SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c)
1707 {
1708 	switch (c->algorithm_mac) {
1709 	case SSL_AEAD:
1710 		return NID_undef;
1711 	case SSL_GOST89MAC:
1712 		return NID_id_Gost28147_89_MAC;
1713 	case SSL_GOST94:
1714 		return NID_id_GostR3411_94;
1715 	case SSL_MD5:
1716 		return NID_md5;
1717 	case SSL_SHA1:
1718 		return NID_sha1;
1719 	case SSL_SHA256:
1720 		return NID_sha256;
1721 	case SSL_SHA384:
1722 		return NID_sha384;
1723 	case SSL_STREEBOG256:
1724 		return NID_id_tc26_gost3411_2012_256;
1725 	default:
1726 		return NID_undef;
1727 	}
1728 }
1729 
1730 int
1731 SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c)
1732 {
1733 	switch (c->algorithm_mkey) {
1734 	case SSL_kDHE:
1735 		return NID_kx_dhe;
1736 	case SSL_kECDHE:
1737 		return NID_kx_ecdhe;
1738 	case SSL_kGOST:
1739 		return NID_kx_gost;
1740 	case SSL_kRSA:
1741 		return NID_kx_rsa;
1742 	default:
1743 		return NID_undef;
1744 	}
1745 }
1746 
1747 int
1748 SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c)
1749 {
1750 	switch (c->algorithm_auth) {
1751 	case SSL_aNULL:
1752 		return NID_auth_null;
1753 	case SSL_aECDSA:
1754 		return NID_auth_ecdsa;
1755 	case SSL_aGOST01:
1756 		return NID_auth_gost01;
1757 	case SSL_aRSA:
1758 		return NID_auth_rsa;
1759 	default:
1760 		return NID_undef;
1761 	}
1762 }
1763 
1764 int
1765 SSL_CIPHER_is_aead(const SSL_CIPHER *c)
1766 {
1767 	return (c->algorithm_mac & SSL_AEAD) == SSL_AEAD;
1768 }
1769 
1770 void *
1771 SSL_COMP_get_compression_methods(void)
1772 {
1773 	return NULL;
1774 }
1775 
1776 int
1777 SSL_COMP_add_compression_method(int id, void *cm)
1778 {
1779 	return 1;
1780 }
1781 
1782 const char *
1783 SSL_COMP_get_name(const void *comp)
1784 {
1785 	return NULL;
1786 }
1787