src/third_party/boringssl/src/ssl/s3_lib.c

   1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   2  * All rights reserved.
   3  *
   4  * This package is an SSL implementation written
   5  * by Eric Young (eay@cryptsoft.com).
   6  * The implementation was written so as to conform with Netscapes SSL.
   7  *
   8  * This library is free for commercial and non-commercial use as long as
   9  * the following conditions are aheared to.  The following conditions
  10  * apply to all code found in this distribution, be it the RC4, RSA,
  11  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  12  * included with this distribution is covered by the same copyright terms
  13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  14  *
  15  * Copyright remains Eric Young's, and as such any Copyright notices in
  16  * the code are not to be removed.
  17  * If this package is used in a product, Eric Young should be given attribution
  18  * as the author of the parts of the library used.
  19  * This can be in the form of a textual message at program startup or
  20  * in documentation (online or textual) provided with the package.
  21  *
  22  * Redistribution and use in source and binary forms, with or without
  23  * modification, are permitted provided that the following conditions
  24  * are met:
  25  * 1. Redistributions of source code must retain the copyright
  26  *    notice, this list of conditions and the following disclaimer.
  27  * 2. Redistributions in binary form must reproduce the above copyright
  28  *    notice, this list of conditions and the following disclaimer in the
  29  *    documentation and/or other materials provided with the distribution.
  30  * 3. All advertising materials mentioning features or use of this software
  31  *    must display the following acknowledgement:
  32  *    "This product includes cryptographic software written by
  33  *     Eric Young (eay@cryptsoft.com)"
  34  *    The word 'cryptographic' can be left out if the rouines from the library
  35  *    being used are not cryptographic related :-).
  36  * 4. If you include any Windows specific code (or a derivative thereof) from
  37  *    the apps directory (application code) you must include an acknowledgement:
  38  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  39  *
  40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  43  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  50  * SUCH DAMAGE.
  51  *
  52  * The licence and distribution terms for any publically available version or
  53  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  54  * copied and put under another distribution licence
  55  * [including the GNU Public Licence.]
  56  */
  57 /* ====================================================================
  58  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  59  *
  60  * Redistribution and use in source and binary forms, with or without
  61  * modification, are permitted provided that the following conditions
  62  * are met:
  63  *
  64  * 1. Redistributions of source code must retain the above copyright
  65  *    notice, this list of conditions and the following disclaimer.
  66  *
  67  * 2. Redistributions in binary form must reproduce the above copyright
  68  *    notice, this list of conditions and the following disclaimer in
  69  *    the documentation and/or other materials provided with the
  70  *    distribution.
  71  *
  72  * 3. All advertising materials mentioning features or use of this
  73  *    software must display the following acknowledgment:
  74  *    "This product includes software developed by the OpenSSL Project
  75  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  76  *
  77  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  78  *    endorse or promote products derived from this software without
  79  *    prior written permission. For written permission, please contact
  80  *    openssl-core@openssl.org.
  81  *
  82  * 5. Products derived from this software may not be called "OpenSSL"
  83  *    nor may "OpenSSL" appear in their names without prior written
  84  *    permission of the OpenSSL Project.
  85  *
  86  * 6. Redistributions of any form whatsoever must retain the following
  87  *    acknowledgment:
  88  *    "This product includes software developed by the OpenSSL Project
  89  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  90  *
  91  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  92  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  93  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  94  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  95  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  96  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  97  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  98  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  99  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 100  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 101  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 102  * OF THE POSSIBILITY OF SUCH DAMAGE.
 103  * ====================================================================
 104  *
 105  * This product includes cryptographic software written by Eric Young
 106  * (eay@cryptsoft.com).  This product includes software written by Tim
 107  * Hudson (tjh@cryptsoft.com).
 108  *
 109  */
 110 /* ====================================================================
 111  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 112  *
 113  * Portions of the attached software ("Contribution") are developed by
 114  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 115  *
 116  * The Contribution is licensed pursuant to the OpenSSL open source
 117  * license provided above.
 118  *
 119  * ECC cipher suite support in OpenSSL originally written by
 120  * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
 121  *
 122  */
 123 /* ====================================================================
 124  * Copyright 2005 Nokia. All rights reserved.
 125  *
 126  * The portions of the attached software ("Contribution") is developed by
 127  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 128  * license.
 129  *
 130  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 131  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 132  * support (see RFC 4279) to OpenSSL.
 133  *
 134  * No patent licenses or other rights except those expressly stated in
 135  * the OpenSSL open source license shall be deemed granted or received
 136  * expressly, by implication, estoppel, or otherwise.
 137  *
 138  * No assurances are provided by Nokia that the Contribution does not
 139  * infringe the patent or other intellectual property rights of any third
 140  * party or that the license provides you with all the necessary rights
 141  * to make use of the Contribution.
 142  *
 143  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 144  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 145  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 146  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 147  * OTHERWISE. */
 148
 149 #include <assert.h>
 150 #include <stdio.h>
 151
 152 #include <openssl/buf.h>
 153 #include <openssl/dh.h>
 154 #include <openssl/md5.h>
 155 #include <openssl/mem.h>
 156 #include <openssl/obj.h>
 157
 158 #include "ssl_locl.h"
 159
 160 #define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
 161
 162 /* FIXED_NONCE_LEN is a macro that results in the correct value to set the
 163  * fixed nonce length in SSL_CIPHER.algorithms2. It's the inverse of
 164  * SSL_CIPHER_AEAD_FIXED_NONCE_LEN. */
 165 #define FIXED_NONCE_LEN(x) ((x/2)<<24)
 166
 167 /* list of available SSLv3 ciphers (sorted by id) */
 168 SSL_CIPHER ssl3_ciphers[]={
 169
 170 /* The RSA ciphers */
 171 /* Cipher 01 */
 172         {
 173         1,
 174         SSL3_TXT_RSA_NULL_MD5,
 175         SSL3_CK_RSA_NULL_MD5,
 176         SSL_kRSA,
 177         SSL_aRSA,
 178         SSL_eNULL,
 179         SSL_MD5,
 180         SSL_SSLV3,
 181         SSL_NOT_EXP|SSL_STRONG_NONE,
 182         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 183         0,
 184         0,
 185         },
 186
 187 /* Cipher 02 */
 188         {
 189         1,
 190         SSL3_TXT_RSA_NULL_SHA,
 191         SSL3_CK_RSA_NULL_SHA,
 192         SSL_kRSA,
 193         SSL_aRSA,
 194         SSL_eNULL,
 195         SSL_SHA1,
 196         SSL_SSLV3,
 197         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
 198         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 199         0,
 200         0,
 201         },
 202
 203 /* Cipher 04 */
 204         {
 205         1,
 206         SSL3_TXT_RSA_RC4_128_MD5,
 207         SSL3_CK_RSA_RC4_128_MD5,
 208         SSL_kRSA,
 209         SSL_aRSA,
 210         SSL_RC4,
 211         SSL_MD5,
 212         SSL_SSLV3,
 213         SSL_NOT_EXP|SSL_MEDIUM,
 214         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|SSL_CIPHER_ALGORITHM2_STATEFUL_AEAD,
 215         128,
 216         128,
 217         },
 218
 219 /* Cipher 05 */
 220         {
 221         1,
 222         SSL3_TXT_RSA_RC4_128_SHA,
 223         SSL3_CK_RSA_RC4_128_SHA,
 224         SSL_kRSA,
 225         SSL_aRSA,
 226         SSL_RC4,
 227         SSL_SHA1,
 228         SSL_SSLV3,
 229         SSL_NOT_EXP|SSL_MEDIUM,
 230         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 231         128,
 232         128,
 233         },
 234
 235 /* Cipher 07 */
 236 #ifndef OPENSSL_NO_IDEA
 237         {
 238         1,
 239         SSL3_TXT_RSA_IDEA_128_SHA,
 240         SSL3_CK_RSA_IDEA_128_SHA,
 241         SSL_kRSA,
 242         SSL_aRSA,
 243         SSL_IDEA,
 244         SSL_SHA1,
 245         SSL_SSLV3,
 246         SSL_NOT_EXP|SSL_MEDIUM,
 247         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 248         128,
 249         128,
 250         },
 251 #endif
 252
 253 /* Cipher 09 */
 254         {
 255         1,
 256         SSL3_TXT_RSA_DES_64_CBC_SHA,
 257         SSL3_CK_RSA_DES_64_CBC_SHA,
 258         SSL_kRSA,
 259         SSL_aRSA,
 260         SSL_DES,
 261         SSL_SHA1,
 262         SSL_SSLV3,
 263         SSL_NOT_EXP|SSL_LOW,
 264         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 265         56,
 266         56,
 267         },
 268
 269 /* Cipher 0A */
 270         {
 271         1,
 272         SSL3_TXT_RSA_DES_192_CBC3_SHA,
 273         SSL3_CK_RSA_DES_192_CBC3_SHA,
 274         SSL_kRSA,
 275         SSL_aRSA,
 276         SSL_3DES,
 277         SSL_SHA1,
 278         SSL_SSLV3,
 279         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 280         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 281         112,
 282         168,
 283         },
 284
 285 /* The DH ciphers */
 286
 287 /* Cipher 0C */
 288         {
 289         1,
 290         SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
 291         SSL3_CK_DH_DSS_DES_64_CBC_SHA,
 292         SSL_kDHd,
 293         SSL_aDH,
 294         SSL_DES,
 295         SSL_SHA1,
 296         SSL_SSLV3,
 297         SSL_NOT_EXP|SSL_LOW,
 298         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 299         56,
 300         56,
 301         },
 302
 303 /* Cipher 0D */
 304         {
 305         1,
 306         SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
 307         SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
 308         SSL_kDHd,
 309         SSL_aDH,
 310         SSL_3DES,
 311         SSL_SHA1,
 312         SSL_SSLV3,
 313         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 314         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 315         112,
 316         168,
 317         },
 318
 319 /* Cipher 0F */
 320         {
 321         1,
 322         SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
 323         SSL3_CK_DH_RSA_DES_64_CBC_SHA,
 324         SSL_kDHr,
 325         SSL_aDH,
 326         SSL_DES,
 327         SSL_SHA1,
 328         SSL_SSLV3,
 329         SSL_NOT_EXP|SSL_LOW,
 330         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 331         56,
 332         56,
 333         },
 334
 335 /* Cipher 10 */
 336         {
 337         1,
 338         SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
 339         SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
 340         SSL_kDHr,
 341         SSL_aDH,
 342         SSL_3DES,
 343         SSL_SHA1,
 344         SSL_SSLV3,
 345         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 346         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 347         112,
 348         168,
 349         },
 350
 351 /* The Ephemeral DH ciphers */
 352
 353 /* Cipher 12 */
 354         {
 355         1,
 356         SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
 357         SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
 358         SSL_kEDH,
 359         SSL_aDSS,
 360         SSL_DES,
 361         SSL_SHA1,
 362         SSL_SSLV3,
 363         SSL_NOT_EXP|SSL_LOW,
 364         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 365         56,
 366         56,
 367         },
 368
 369 /* Cipher 13 */
 370         {
 371         1,
 372         SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
 373         SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
 374         SSL_kEDH,
 375         SSL_aDSS,
 376         SSL_3DES,
 377         SSL_SHA1,
 378         SSL_SSLV3,
 379         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 380         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 381         112,
 382         168,
 383         },
 384
 385 /* Cipher 15 */
 386         {
 387         1,
 388         SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
 389         SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
 390         SSL_kEDH,
 391         SSL_aRSA,
 392         SSL_DES,
 393         SSL_SHA1,
 394         SSL_SSLV3,
 395         SSL_NOT_EXP|SSL_LOW,
 396         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 397         56,
 398         56,
 399         },
 400
 401 /* Cipher 16 */
 402         {
 403         1,
 404         SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
 405         SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
 406         SSL_kEDH,
 407         SSL_aRSA,
 408         SSL_3DES,
 409         SSL_SHA1,
 410         SSL_SSLV3,
 411         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 412         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 413         112,
 414         168,
 415         },
 416
 417 /* Cipher 18 */
 418         {
 419         1,
 420         SSL3_TXT_ADH_RC4_128_MD5,
 421         SSL3_CK_ADH_RC4_128_MD5,
 422         SSL_kEDH,
 423         SSL_aNULL,
 424         SSL_RC4,
 425         SSL_MD5,
 426         SSL_SSLV3,
 427         SSL_NOT_EXP|SSL_MEDIUM,
 428         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 429         128,
 430         128,
 431         },
 432
 433 /* Cipher 1A */
 434         {
 435         1,
 436         SSL3_TXT_ADH_DES_64_CBC_SHA,
 437         SSL3_CK_ADH_DES_64_CBC_SHA,
 438         SSL_kEDH,
 439         SSL_aNULL,
 440         SSL_DES,
 441         SSL_SHA1,
 442         SSL_SSLV3,
 443         SSL_NOT_EXP|SSL_LOW,
 444         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 445         56,
 446         56,
 447         },
 448
 449 /* Cipher 1B */
 450         {
 451         1,
 452         SSL3_TXT_ADH_DES_192_CBC_SHA,
 453         SSL3_CK_ADH_DES_192_CBC_SHA,
 454         SSL_kEDH,
 455         SSL_aNULL,
 456         SSL_3DES,
 457         SSL_SHA1,
 458         SSL_SSLV3,
 459         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 460         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 461         112,
 462         168,
 463         },
 464
 465 /* Fortezza ciphersuite from SSL 3.0 spec */
 466 #if 0
 467 /* Cipher 1C */
 468         {
 469         0,
 470         SSL3_TXT_FZA_DMS_NULL_SHA,
 471         SSL3_CK_FZA_DMS_NULL_SHA,
 472         SSL_kFZA,
 473         SSL_aFZA,
 474         SSL_eNULL,
 475         SSL_SHA1,
 476         SSL_SSLV3,
 477         SSL_NOT_EXP|SSL_STRONG_NONE,
 478         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 479         0,
 480         0,
 481         },
 482
 483 /* Cipher 1D */
 484         {
 485         0,
 486         SSL3_TXT_FZA_DMS_FZA_SHA,
 487         SSL3_CK_FZA_DMS_FZA_SHA,
 488         SSL_kFZA,
 489         SSL_aFZA,
 490         SSL_eFZA,
 491         SSL_SHA1,
 492         SSL_SSLV3,
 493         SSL_NOT_EXP|SSL_STRONG_NONE,
 494         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 495         0,
 496         0,
 497         },
 498
 499 /* Cipher 1E */
 500         {
 501         0,
 502         SSL3_TXT_FZA_DMS_RC4_SHA,
 503         SSL3_CK_FZA_DMS_RC4_SHA,
 504         SSL_kFZA,
 505         SSL_aFZA,
 506         SSL_RC4,
 507         SSL_SHA1,
 508         SSL_SSLV3,
 509         SSL_NOT_EXP|SSL_MEDIUM,
 510         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 511         128,
 512         128,
 513         },
 514 #endif
 515
 516 /* New AES ciphersuites */
 517 /* Cipher 2F */
 518         {
 519         1,
 520         TLS1_TXT_RSA_WITH_AES_128_SHA,
 521         TLS1_CK_RSA_WITH_AES_128_SHA,
 522         SSL_kRSA,
 523         SSL_aRSA,
 524         SSL_AES128,
 525         SSL_SHA1,
 526         SSL_TLSV1,
 527         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 528         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 529         128,
 530         128,
 531         },
 532 /* Cipher 30 */
 533         {
 534         1,
 535         TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
 536         TLS1_CK_DH_DSS_WITH_AES_128_SHA,
 537         SSL_kDHd,
 538         SSL_aDH,
 539         SSL_AES128,
 540         SSL_SHA1,
 541         SSL_TLSV1,
 542         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 543         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 544         128,
 545         128,
 546         },
 547 /* Cipher 31 */
 548         {
 549         1,
 550         TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
 551         TLS1_CK_DH_RSA_WITH_AES_128_SHA,
 552         SSL_kDHr,
 553         SSL_aDH,
 554         SSL_AES128,
 555         SSL_SHA1,
 556         SSL_TLSV1,
 557         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 558         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 559         128,
 560         128,
 561         },
 562 /* Cipher 32 */
 563         {
 564         1,
 565         TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
 566         TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
 567         SSL_kEDH,
 568         SSL_aDSS,
 569         SSL_AES128,
 570         SSL_SHA1,
 571         SSL_TLSV1,
 572         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 573         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 574         128,
 575         128,
 576         },
 577 /* Cipher 33 */
 578         {
 579         1,
 580         TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
 581         TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
 582         SSL_kEDH,
 583         SSL_aRSA,
 584         SSL_AES128,
 585         SSL_SHA1,
 586         SSL_TLSV1,
 587         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 588         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 589         128,
 590         128,
 591         },
 592 /* Cipher 34 */
 593         {
 594         1,
 595         TLS1_TXT_ADH_WITH_AES_128_SHA,
 596         TLS1_CK_ADH_WITH_AES_128_SHA,
 597         SSL_kEDH,
 598         SSL_aNULL,
 599         SSL_AES128,
 600         SSL_SHA1,
 601         SSL_TLSV1,
 602         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 603         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 604         128,
 605         128,
 606         },
 607
 608 /* Cipher 35 */
 609         {
 610         1,
 611         TLS1_TXT_RSA_WITH_AES_256_SHA,
 612         TLS1_CK_RSA_WITH_AES_256_SHA,
 613         SSL_kRSA,
 614         SSL_aRSA,
 615         SSL_AES256,
 616         SSL_SHA1,
 617         SSL_TLSV1,
 618         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 619         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 620         256,
 621         256,
 622         },
 623 /* Cipher 36 */
 624         {
 625         1,
 626         TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
 627         TLS1_CK_DH_DSS_WITH_AES_256_SHA,
 628         SSL_kDHd,
 629         SSL_aDH,
 630         SSL_AES256,
 631         SSL_SHA1,
 632         SSL_TLSV1,
 633         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 634         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 635         256,
 636         256,
 637         },
 638
 639 /* Cipher 37 */
 640         {
 641         1,
 642         TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
 643         TLS1_CK_DH_RSA_WITH_AES_256_SHA,
 644         SSL_kDHr,
 645         SSL_aDH,
 646         SSL_AES256,
 647         SSL_SHA1,
 648         SSL_TLSV1,
 649         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 650         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 651         256,
 652         256,
 653         },
 654
 655 /* Cipher 38 */
 656         {
 657         1,
 658         TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
 659         TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
 660         SSL_kEDH,
 661         SSL_aDSS,
 662         SSL_AES256,
 663         SSL_SHA1,
 664         SSL_TLSV1,
 665         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 666         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 667         256,
 668         256,
 669         },
 670
 671 /* Cipher 39 */
 672         {
 673         1,
 674         TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
 675         TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
 676         SSL_kEDH,
 677         SSL_aRSA,
 678         SSL_AES256,
 679         SSL_SHA1,
 680         SSL_TLSV1,
 681         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 682         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 683         256,
 684         256,
 685         },
 686
 687         /* Cipher 3A */
 688         {
 689         1,
 690         TLS1_TXT_ADH_WITH_AES_256_SHA,
 691         TLS1_CK_ADH_WITH_AES_256_SHA,
 692         SSL_kEDH,
 693         SSL_aNULL,
 694         SSL_AES256,
 695         SSL_SHA1,
 696         SSL_TLSV1,
 697         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 698         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 699         256,
 700         256,
 701         },
 702
 703         /* TLS v1.2 ciphersuites */
 704         /* Cipher 3B */
 705         {
 706         1,
 707         TLS1_TXT_RSA_WITH_NULL_SHA256,
 708         TLS1_CK_RSA_WITH_NULL_SHA256,
 709         SSL_kRSA,
 710         SSL_aRSA,
 711         SSL_eNULL,
 712         SSL_SHA256,
 713         SSL_TLSV1_2,
 714         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
 715         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 716         0,
 717         0,
 718         },
 719
 720         /* Cipher 3C */
 721         {
 722         1,
 723         TLS1_TXT_RSA_WITH_AES_128_SHA256,
 724         TLS1_CK_RSA_WITH_AES_128_SHA256,
 725         SSL_kRSA,
 726         SSL_aRSA,
 727         SSL_AES128,
 728         SSL_SHA256,
 729         SSL_TLSV1_2,
 730         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 731         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 732         128,
 733         128,
 734         },
 735
 736         /* Cipher 3D */
 737         {
 738         1,
 739         TLS1_TXT_RSA_WITH_AES_256_SHA256,
 740         TLS1_CK_RSA_WITH_AES_256_SHA256,
 741         SSL_kRSA,
 742         SSL_aRSA,
 743         SSL_AES256,
 744         SSL_SHA256,
 745         SSL_TLSV1_2,
 746         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 747         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 748         256,
 749         256,
 750         },
 751
 752         /* Cipher 3E */
 753         {
 754         1,
 755         TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
 756         TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
 757         SSL_kDHd,
 758         SSL_aDH,
 759         SSL_AES128,
 760         SSL_SHA256,
 761         SSL_TLSV1_2,
 762         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 763         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 764         128,
 765         128,
 766         },
 767
 768         /* Cipher 3F */
 769         {
 770         1,
 771         TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
 772         TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
 773         SSL_kDHr,
 774         SSL_aDH,
 775         SSL_AES128,
 776         SSL_SHA256,
 777         SSL_TLSV1_2,
 778         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 779         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 780         128,
 781         128,
 782         },
 783
 784         /* Cipher 40 */
 785         {
 786         1,
 787         TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
 788         TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
 789         SSL_kEDH,
 790         SSL_aDSS,
 791         SSL_AES128,
 792         SSL_SHA256,
 793         SSL_TLSV1_2,
 794         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 795         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 796         128,
 797         128,
 798         },
 799
 800
 801 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
 802         /* Cipher 66 */
 803         {
 804         1,
 805         TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
 806         TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
 807         SSL_kEDH,
 808         SSL_aDSS,
 809         SSL_RC4,
 810         SSL_SHA1,
 811         SSL_TLSV1,
 812         SSL_NOT_EXP|SSL_MEDIUM,
 813         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 814         128,
 815         128,
 816         },
 817 #endif
 818
 819         /* TLS v1.2 ciphersuites */
 820         /* Cipher 67 */
 821         {
 822         1,
 823         TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
 824         TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
 825         SSL_kEDH,
 826         SSL_aRSA,
 827         SSL_AES128,
 828         SSL_SHA256,
 829         SSL_TLSV1_2,
 830         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 831         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 832         128,
 833         128,
 834         },
 835
 836         /* Cipher 68 */
 837         {
 838         1,
 839         TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
 840         TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
 841         SSL_kDHd,
 842         SSL_aDH,
 843         SSL_AES256,
 844         SSL_SHA256,
 845         SSL_TLSV1_2,
 846         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 847         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 848         256,
 849         256,
 850         },
 851
 852         /* Cipher 69 */
 853         {
 854         1,
 855         TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
 856         TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
 857         SSL_kDHr,
 858         SSL_aDH,
 859         SSL_AES256,
 860         SSL_SHA256,
 861         SSL_TLSV1_2,
 862         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 863         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 864         256,
 865         256,
 866         },
 867
 868         /* Cipher 6A */
 869         {
 870         1,
 871         TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
 872         TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
 873         SSL_kEDH,
 874         SSL_aDSS,
 875         SSL_AES256,
 876         SSL_SHA256,
 877         SSL_TLSV1_2,
 878         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 879         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 880         256,
 881         256,
 882         },
 883
 884         /* Cipher 6B */
 885         {
 886         1,
 887         TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
 888         TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
 889         SSL_kEDH,
 890         SSL_aRSA,
 891         SSL_AES256,
 892         SSL_SHA256,
 893         SSL_TLSV1_2,
 894         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 895         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 896         256,
 897         256,
 898         },
 899
 900         /* Cipher 6C */
 901         {
 902         1,
 903         TLS1_TXT_ADH_WITH_AES_128_SHA256,
 904         TLS1_CK_ADH_WITH_AES_128_SHA256,
 905         SSL_kEDH,
 906         SSL_aNULL,
 907         SSL_AES128,
 908         SSL_SHA256,
 909         SSL_TLSV1_2,
 910         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 911         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 912         128,
 913         128,
 914         },
 915
 916         /* Cipher 6D */
 917         {
 918         1,
 919         TLS1_TXT_ADH_WITH_AES_256_SHA256,
 920         TLS1_CK_ADH_WITH_AES_256_SHA256,
 921         SSL_kEDH,
 922         SSL_aNULL,
 923         SSL_AES256,
 924         SSL_SHA256,
 925         SSL_TLSV1_2,
 926         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 927         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 928         256,
 929         256,
 930         },
 931
 932
 933         /* Cipher 8A */
 934         {
 935         1,
 936         TLS1_TXT_PSK_WITH_RC4_128_SHA,
 937         TLS1_CK_PSK_WITH_RC4_128_SHA,
 938         SSL_kPSK,
 939         SSL_aPSK,
 940         SSL_RC4,
 941         SSL_SHA1,
 942         SSL_TLSV1,
 943         SSL_NOT_EXP|SSL_MEDIUM,
 944         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 945         128,
 946         128,
 947         },
 948
 949         /* Cipher 8B */
 950         {
 951         1,
 952         TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
 953         TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
 954         SSL_kPSK,
 955         SSL_aPSK,
 956         SSL_3DES,
 957         SSL_SHA1,
 958         SSL_TLSV1,
 959         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 960         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 961         112,
 962         168,
 963         },
 964
 965         /* Cipher 8C */
 966         {
 967         1,
 968         TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
 969         TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
 970         SSL_kPSK,
 971         SSL_aPSK,
 972         SSL_AES128,
 973         SSL_SHA1,
 974         SSL_TLSV1,
 975         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 976         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 977         128,
 978         128,
 979         },
 980
 981         /* Cipher 8D */
 982         {
 983         1,
 984         TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
 985         TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
 986         SSL_kPSK,
 987         SSL_aPSK,
 988         SSL_AES256,
 989         SSL_SHA1,
 990         SSL_TLSV1,
 991         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 992         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 993         256,
 994         256,
 995         },
 996
 997 #ifndef OPENSSL_NO_SEED
 998         /* SEED ciphersuites from RFC4162 */
 999
1000         /* Cipher 96 */
1001         {
1002         1,
1003         TLS1_TXT_RSA_WITH_SEED_SHA,
1004         TLS1_CK_RSA_WITH_SEED_SHA,
1005         SSL_kRSA,
1006         SSL_aRSA,
1007         SSL_SEED,
1008         SSL_SHA1,
1009         SSL_TLSV1,
1010         SSL_NOT_EXP|SSL_MEDIUM,
1011         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1012         128,
1013         128,
1014         },
1015
1016         /* Cipher 97 */
1017         {
1018         1,
1019         TLS1_TXT_DH_DSS_WITH_SEED_SHA,
1020         TLS1_CK_DH_DSS_WITH_SEED_SHA,
1021         SSL_kDHd,
1022         SSL_aDH,
1023         SSL_SEED,
1024         SSL_SHA1,
1025         SSL_TLSV1,
1026         SSL_NOT_EXP|SSL_MEDIUM,
1027         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1028         128,
1029         128,
1030         },
1031
1032         /* Cipher 98 */
1033         {
1034         1,
1035         TLS1_TXT_DH_RSA_WITH_SEED_SHA,
1036         TLS1_CK_DH_RSA_WITH_SEED_SHA,
1037         SSL_kDHr,
1038         SSL_aDH,
1039         SSL_SEED,
1040         SSL_SHA1,
1041         SSL_TLSV1,
1042         SSL_NOT_EXP|SSL_MEDIUM,
1043         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1044         128,
1045         128,
1046         },
1047
1048         /* Cipher 99 */
1049         {
1050         1,
1051         TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
1052         TLS1_CK_DHE_DSS_WITH_SEED_SHA,
1053         SSL_kEDH,
1054         SSL_aDSS,
1055         SSL_SEED,
1056         SSL_SHA1,
1057         SSL_TLSV1,
1058         SSL_NOT_EXP|SSL_MEDIUM,
1059         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1060         128,
1061         128,
1062         },
1063
1064         /* Cipher 9A */
1065         {
1066         1,
1067         TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
1068         TLS1_CK_DHE_RSA_WITH_SEED_SHA,
1069         SSL_kEDH,
1070         SSL_aRSA,
1071         SSL_SEED,
1072         SSL_SHA1,
1073         SSL_TLSV1,
1074         SSL_NOT_EXP|SSL_MEDIUM,
1075         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1076         128,
1077         128,
1078         },
1079
1080         /* Cipher 9B */
1081         {
1082         1,
1083         TLS1_TXT_ADH_WITH_SEED_SHA,
1084         TLS1_CK_ADH_WITH_SEED_SHA,
1085         SSL_kEDH,
1086         SSL_aNULL,
1087         SSL_SEED,
1088         SSL_SHA1,
1089         SSL_TLSV1,
1090         SSL_NOT_EXP|SSL_MEDIUM,
1091         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1092         128,
1093         128,
1094         },
1095
1096 #endif /* OPENSSL_NO_SEED */
1097
1098         /* GCM ciphersuites from RFC5288 */
1099
1100         /* Cipher 9C */
1101         {
1102         1,
1103         TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
1104         TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
1105         SSL_kRSA,
1106         SSL_aRSA,
1107         SSL_AES128GCM,
1108         SSL_AEAD,
1109         SSL_TLSV1_2,
1110         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1111         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1112         128,
1113         128,
1114         },
1115
1116         /* Cipher 9D */
1117         {
1118         1,
1119         TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
1120         TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
1121         SSL_kRSA,
1122         SSL_aRSA,
1123         SSL_AES256GCM,
1124         SSL_AEAD,
1125         SSL_TLSV1_2,
1126         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1127         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1128                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1129         256,
1130         256,
1131         },
1132
1133         /* Cipher 9E */
1134         {
1135         1,
1136         TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
1137         TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
1138         SSL_kEDH,
1139         SSL_aRSA,
1140         SSL_AES128GCM,
1141         SSL_AEAD,
1142         SSL_TLSV1_2,
1143         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1144         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1145         128,
1146         128,
1147         },
1148
1149         /* Cipher 9F */
1150         {
1151         1,
1152         TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
1153         TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
1154         SSL_kEDH,
1155         SSL_aRSA,
1156         SSL_AES256GCM,
1157         SSL_AEAD,
1158         SSL_TLSV1_2,
1159         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1160         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1161                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1162         256,
1163         256,
1164         },
1165
1166         /* Cipher A0 */
1167         {
1168         1,
1169         TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
1170         TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
1171         SSL_kDHr,
1172         SSL_aDH,
1173         SSL_AES128GCM,
1174         SSL_AEAD,
1175         SSL_TLSV1_2,
1176         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1177         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1178         128,
1179         128,
1180         },
1181
1182         /* Cipher A1 */
1183         {
1184         1,
1185         TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
1186         TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
1187         SSL_kDHr,
1188         SSL_aDH,
1189         SSL_AES256GCM,
1190         SSL_AEAD,
1191         SSL_TLSV1_2,
1192         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1193         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1194                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1195         256,
1196         256,
1197         },
1198
1199         /* Cipher A2 */
1200         {
1201         1,
1202         TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
1203         TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
1204         SSL_kEDH,
1205         SSL_aDSS,
1206         SSL_AES128GCM,
1207         SSL_AEAD,
1208         SSL_TLSV1_2,
1209         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1210         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1211         128,
1212         128,
1213         },
1214
1215         /* Cipher A3 */
1216         {
1217         1,
1218         TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
1219         TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
1220         SSL_kEDH,
1221         SSL_aDSS,
1222         SSL_AES256GCM,
1223         SSL_AEAD,
1224         SSL_TLSV1_2,
1225         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1226         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1227                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1228         256,
1229         256,
1230         },
1231
1232         /* Cipher A4 */
1233         {
1234         1,
1235         TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
1236         TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
1237         SSL_kDHd,
1238         SSL_aDH,
1239         SSL_AES128GCM,
1240         SSL_AEAD,
1241         SSL_TLSV1_2,
1242         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1243         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1244         128,
1245         128,
1246         },
1247
1248         /* Cipher A5 */
1249         {
1250         1,
1251         TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
1252         TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
1253         SSL_kDHd,
1254         SSL_aDH,
1255         SSL_AES256GCM,
1256         SSL_AEAD,
1257         SSL_TLSV1_2,
1258         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1259         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1260                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1261         256,
1262         256,
1263         },
1264
1265         /* Cipher A6 */
1266         {
1267         1,
1268         TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
1269         TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
1270         SSL_kEDH,
1271         SSL_aNULL,
1272         SSL_AES128GCM,
1273         SSL_AEAD,
1274         SSL_TLSV1_2,
1275         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1276         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1277         128,
1278         128,
1279         },
1280
1281         /* Cipher A7 */
1282         {
1283         1,
1284         TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
1285         TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
1286         SSL_kEDH,
1287         SSL_aNULL,
1288         SSL_AES256GCM,
1289         SSL_AEAD,
1290         SSL_TLSV1_2,
1291         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1292         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1293                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1294         256,
1295         256,
1296         },
1297 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
1298         {
1299         1,
1300         "SCSV",
1301         SSL3_CK_SCSV,
1302         0,
1303         0,
1304         0,
1305         0,
1306         0,
1307         0,
1308         0,
1309         0,
1310         0
1311         },
1312 #endif
1313
1314 #ifndef OPENSSL_NO_ECDH
1315         /* Cipher C001 */
1316         {
1317         1,
1318         TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
1319         TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
1320         SSL_kECDHe,
1321         SSL_aECDH,
1322         SSL_eNULL,
1323         SSL_SHA1,
1324         SSL_TLSV1,
1325         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
1326         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1327         0,
1328         0,
1329         },
1330
1331         /* Cipher C002 */
1332         {
1333         1,
1334         TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
1335         TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
1336         SSL_kECDHe,
1337         SSL_aECDH,
1338         SSL_RC4,
1339         SSL_SHA1,
1340         SSL_TLSV1,
1341         SSL_NOT_EXP|SSL_MEDIUM,
1342         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1343         128,
1344         128,
1345         },
1346
1347         /* Cipher C003 */
1348         {
1349         1,
1350         TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
1351         TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
1352         SSL_kECDHe,
1353         SSL_aECDH,
1354         SSL_3DES,
1355         SSL_SHA1,
1356         SSL_TLSV1,
1357         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1358         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1359         112,
1360         168,
1361         },
1362
1363         /* Cipher C004 */
1364         {
1365         1,
1366         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
1367         TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
1368         SSL_kECDHe,
1369         SSL_aECDH,
1370         SSL_AES128,
1371         SSL_SHA1,
1372         SSL_TLSV1,
1373         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1374         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1375         128,
1376         128,
1377         },
1378
1379         /* Cipher C005 */
1380         {
1381         1,
1382         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
1383         TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
1384         SSL_kECDHe,
1385         SSL_aECDH,
1386         SSL_AES256,
1387         SSL_SHA1,
1388         SSL_TLSV1,
1389         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1390         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1391         256,
1392         256,
1393         },
1394
1395         /* Cipher C006 */
1396         {
1397         1,
1398         TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
1399         TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
1400         SSL_kEECDH,
1401         SSL_aECDSA,
1402         SSL_eNULL,
1403         SSL_SHA1,
1404         SSL_TLSV1,
1405         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
1406         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1407         0,
1408         0,
1409         },
1410
1411         /* Cipher C007 */
1412         {
1413         1,
1414         TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
1415         TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
1416         SSL_kEECDH,
1417         SSL_aECDSA,
1418         SSL_RC4,
1419         SSL_SHA1,
1420         SSL_TLSV1,
1421         SSL_NOT_EXP|SSL_MEDIUM,
1422         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1423         128,
1424         128,
1425         },
1426
1427         /* Cipher C008 */
1428         {
1429         1,
1430         TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
1431         TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
1432         SSL_kEECDH,
1433         SSL_aECDSA,
1434         SSL_3DES,
1435         SSL_SHA1,
1436         SSL_TLSV1,
1437         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1438         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1439         112,
1440         168,
1441         },
1442
1443         /* Cipher C009 */
1444         {
1445         1,
1446         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
1447         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
1448         SSL_kEECDH,
1449         SSL_aECDSA,
1450         SSL_AES128,
1451         SSL_SHA1,
1452         SSL_TLSV1,
1453         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1454         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1455         128,
1456         128,
1457         },
1458
1459         /* Cipher C00A */
1460         {
1461         1,
1462         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
1463         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
1464         SSL_kEECDH,
1465         SSL_aECDSA,
1466         SSL_AES256,
1467         SSL_SHA1,
1468         SSL_TLSV1,
1469         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1470         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1471         256,
1472         256,
1473         },
1474
1475         /* Cipher C00B */
1476         {
1477         1,
1478         TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
1479         TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
1480         SSL_kECDHr,
1481         SSL_aECDH,
1482         SSL_eNULL,
1483         SSL_SHA1,
1484         SSL_TLSV1,
1485         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
1486         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1487         0,
1488         0,
1489         },
1490
1491         /* Cipher C00C */
1492         {
1493         1,
1494         TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
1495         TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
1496         SSL_kECDHr,
1497         SSL_aECDH,
1498         SSL_RC4,
1499         SSL_SHA1,
1500         SSL_TLSV1,
1501         SSL_NOT_EXP|SSL_MEDIUM,
1502         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1503         128,
1504         128,
1505         },
1506
1507         /* Cipher C00D */
1508         {
1509         1,
1510         TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
1511         TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
1512         SSL_kECDHr,
1513         SSL_aECDH,
1514         SSL_3DES,
1515         SSL_SHA1,
1516         SSL_TLSV1,
1517         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1518         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1519         112,
1520         168,
1521         },
1522
1523         /* Cipher C00E */
1524         {
1525         1,
1526         TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
1527         TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
1528         SSL_kECDHr,
1529         SSL_aECDH,
1530         SSL_AES128,
1531         SSL_SHA1,
1532         SSL_TLSV1,
1533         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1534         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1535         128,
1536         128,
1537         },
1538
1539         /* Cipher C00F */
1540         {
1541         1,
1542         TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
1543         TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
1544         SSL_kECDHr,
1545         SSL_aECDH,
1546         SSL_AES256,
1547         SSL_SHA1,
1548         SSL_TLSV1,
1549         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1550         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1551         256,
1552         256,
1553         },
1554
1555         /* Cipher C010 */
1556         {
1557         1,
1558         TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
1559         TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
1560         SSL_kEECDH,
1561         SSL_aRSA,
1562         SSL_eNULL,
1563         SSL_SHA1,
1564         SSL_TLSV1,
1565         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
1566         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1567         0,
1568         0,
1569         },
1570
1571         /* Cipher C011 */
1572         {
1573         1,
1574         TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
1575         TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
1576         SSL_kEECDH,
1577         SSL_aRSA,
1578         SSL_RC4,
1579         SSL_SHA1,
1580         SSL_TLSV1,
1581         SSL_NOT_EXP|SSL_MEDIUM,
1582         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1583         128,
1584         128,
1585         },
1586
1587         /* Cipher C012 */
1588         {
1589         1,
1590         TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1591         TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1592         SSL_kEECDH,
1593         SSL_aRSA,
1594         SSL_3DES,
1595         SSL_SHA1,
1596         SSL_TLSV1,
1597         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1598         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1599         112,
1600         168,
1601         },
1602
1603         /* Cipher C013 */
1604         {
1605         1,
1606         TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1607         TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1608         SSL_kEECDH,
1609         SSL_aRSA,
1610         SSL_AES128,
1611         SSL_SHA1,
1612         SSL_TLSV1,
1613         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1614         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1615         128,
1616         128,
1617         },
1618
1619         /* Cipher C014 */
1620         {
1621         1,
1622         TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1623         TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1624         SSL_kEECDH,
1625         SSL_aRSA,
1626         SSL_AES256,
1627         SSL_SHA1,
1628         SSL_TLSV1,
1629         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1630         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1631         256,
1632         256,
1633         },
1634
1635         /* Cipher C015 */
1636         {
1637         1,
1638         TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
1639         TLS1_CK_ECDH_anon_WITH_NULL_SHA,
1640         SSL_kEECDH,
1641         SSL_aNULL,
1642         SSL_eNULL,
1643         SSL_SHA1,
1644         SSL_TLSV1,
1645         SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
1646         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1647         0,
1648         0,
1649         },
1650
1651         /* Cipher C016 */
1652         {
1653         1,
1654         TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
1655         TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
1656         SSL_kEECDH,
1657         SSL_aNULL,
1658         SSL_RC4,
1659         SSL_SHA1,
1660         SSL_TLSV1,
1661         SSL_NOT_EXP|SSL_MEDIUM,
1662         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1663         128,
1664         128,
1665         },
1666
1667         /* Cipher C017 */
1668         {
1669         1,
1670         TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
1671         TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
1672         SSL_kEECDH,
1673         SSL_aNULL,
1674         SSL_3DES,
1675         SSL_SHA1,
1676         SSL_TLSV1,
1677         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1678         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1679         112,
1680         168,
1681         },
1682
1683         /* Cipher C018 */
1684         {
1685         1,
1686         TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
1687         TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
1688         SSL_kEECDH,
1689         SSL_aNULL,
1690         SSL_AES128,
1691         SSL_SHA1,
1692         SSL_TLSV1,
1693         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1694         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1695         128,
1696         128,
1697         },
1698
1699         /* Cipher C019 */
1700         {
1701         1,
1702         TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
1703         TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
1704         SSL_kEECDH,
1705         SSL_aNULL,
1706         SSL_AES256,
1707         SSL_SHA1,
1708         SSL_TLSV1,
1709         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1710         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1711         256,
1712         256,
1713         },
1714 #endif  /* OPENSSL_NO_ECDH */
1715
1716 #ifndef OPENSSL_NO_ECDH
1717
1718         /* HMAC based TLS v1.2 ciphersuites from RFC5289 */
1719
1720         /* Cipher C023 */
1721         {
1722         1,
1723         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
1724         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
1725         SSL_kEECDH,
1726         SSL_aECDSA,
1727         SSL_AES128,
1728         SSL_SHA256,
1729         SSL_TLSV1_2,
1730         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1731         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1732         128,
1733         128,
1734         },
1735
1736         /* Cipher C024 */
1737         {
1738         1,
1739         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
1740         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
1741         SSL_kEECDH,
1742         SSL_aECDSA,
1743         SSL_AES256,
1744         SSL_SHA384,
1745         SSL_TLSV1_2,
1746         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1747         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1748         256,
1749         256,
1750         },
1751
1752         /* Cipher C025 */
1753         {
1754         1,
1755         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256,
1756         TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256,
1757         SSL_kECDHe,
1758         SSL_aECDH,
1759         SSL_AES128,
1760         SSL_SHA256,
1761         SSL_TLSV1_2,
1762         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1763         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1764         128,
1765         128,
1766         },
1767
1768         /* Cipher C026 */
1769         {
1770         1,
1771         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384,
1772         TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384,
1773         SSL_kECDHe,
1774         SSL_aECDH,
1775         SSL_AES256,
1776         SSL_SHA384,
1777         SSL_TLSV1_2,
1778         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1779         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1780         256,
1781         256,
1782         },
1783
1784         /* Cipher C027 */
1785         {
1786         1,
1787         TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
1788         TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
1789         SSL_kEECDH,
1790         SSL_aRSA,
1791         SSL_AES128,
1792         SSL_SHA256,
1793         SSL_TLSV1_2,
1794         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1795         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1796         128,
1797         128,
1798         },
1799
1800         /* Cipher C028 */
1801         {
1802         1,
1803         TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
1804         TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
1805         SSL_kEECDH,
1806         SSL_aRSA,
1807         SSL_AES256,
1808         SSL_SHA384,
1809         SSL_TLSV1_2,
1810         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1811         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1812         256,
1813         256,
1814         },
1815
1816         /* Cipher C029 */
1817         {
1818         1,
1819         TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
1820         TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
1821         SSL_kECDHr,
1822         SSL_aECDH,
1823         SSL_AES128,
1824         SSL_SHA256,
1825         SSL_TLSV1_2,
1826         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1827         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1828         128,
1829         128,
1830         },
1831
1832         /* Cipher C02A */
1833         {
1834         1,
1835         TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
1836         TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
1837         SSL_kECDHr,
1838         SSL_aECDH,
1839         SSL_AES256,
1840         SSL_SHA384,
1841         SSL_TLSV1_2,
1842         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1843         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1844         256,
1845         256,
1846         },
1847
1848         /* GCM based TLS v1.2 ciphersuites from RFC5289 */
1849
1850         /* Cipher C02B */
1851         {
1852         1,
1853         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1854         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1855         SSL_kEECDH,
1856         SSL_aECDSA,
1857         SSL_AES128GCM,
1858         SSL_AEAD,
1859         SSL_TLSV1_2,
1860         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1861         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1862         128,
1863         128,
1864         },
1865
1866         /* Cipher C02C */
1867         {
1868         1,
1869         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1870         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1871         SSL_kEECDH,
1872         SSL_aECDSA,
1873         SSL_AES256GCM,
1874         SSL_AEAD,
1875         SSL_TLSV1_2,
1876         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1877         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1878                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1879         256,
1880         256,
1881         },
1882
1883         /* Cipher C02D */
1884         {
1885         1,
1886         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
1887         TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
1888         SSL_kECDHe,
1889         SSL_aECDH,
1890         SSL_AES128GCM,
1891         SSL_AEAD,
1892         SSL_TLSV1_2,
1893         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1894         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1895         128,
1896         128,
1897         },
1898
1899         /* Cipher C02E */
1900         {
1901         1,
1902         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
1903         TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
1904         SSL_kECDHe,
1905         SSL_aECDH,
1906         SSL_AES256GCM,
1907         SSL_AEAD,
1908         SSL_TLSV1_2,
1909         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1910         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1911                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1912         256,
1913         256,
1914         },
1915
1916         /* Cipher C02F */
1917         {
1918         1,
1919         TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1920         TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1921         SSL_kEECDH,
1922         SSL_aRSA,
1923         SSL_AES128GCM,
1924         SSL_AEAD,
1925         SSL_TLSV1_2,
1926         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1927         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1928         128,
1929         128,
1930         },
1931
1932         /* Cipher C030 */
1933         {
1934         1,
1935         TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1936         TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1937         SSL_kEECDH,
1938         SSL_aRSA,
1939         SSL_AES256GCM,
1940         SSL_AEAD,
1941         SSL_TLSV1_2,
1942         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1943         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1944                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1945         256,
1946         256,
1947         },
1948
1949         /* Cipher C031 */
1950         {
1951         1,
1952         TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
1953         TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
1954         SSL_kECDHr,
1955         SSL_aECDH,
1956         SSL_AES128GCM,
1957         SSL_AEAD,
1958         SSL_TLSV1_2,
1959         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1960         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1961         128,
1962         128,
1963         },
1964
1965         /* Cipher C032 */
1966         {
1967         1,
1968         TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
1969         TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
1970         SSL_kECDHr,
1971         SSL_aECDH,
1972         SSL_AES256GCM,
1973         SSL_AEAD,
1974         SSL_TLSV1_2,
1975         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
1976         SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1977                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1978         256,
1979         256,
1980         },
1981
1982     /* ECDH PSK ciphersuites */
1983         /* Cipher CAFE */
1984         {
1985         1,
1986         TLS1_TXT_ECDHE_PSK_WITH_AES_128_GCM_SHA256,
1987         TLS1_CK_ECDHE_PSK_WITH_AES_128_GCM_SHA256,
1988         SSL_kEECDH,
1989         SSL_aPSK,
1990         SSL_AES128GCM,
1991         SSL_AEAD,
1992         SSL_TLSV1_2,
1993         SSL_NOT_EXP|SSL_HIGH,
1994         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
1995                 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
1996         128,
1997         128,
1998         },
1999
2000 #endif /* OPENSSL_NO_ECDH */
2001
2002         {
2003         1,
2004         TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
2005         TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305,
2006         SSL_kEECDH,
2007         SSL_aRSA,
2008         SSL_CHACHA20POLY1305,
2009         SSL_AEAD,
2010         SSL_TLSV1_2,
2011         SSL_NOT_EXP|SSL_HIGH,
2012         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
2013         256,
2014         0,
2015         },
2016
2017         {
2018         1,
2019         TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
2020         TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305,
2021         SSL_kEECDH,
2022         SSL_aECDSA,
2023         SSL_CHACHA20POLY1305,
2024         SSL_AEAD,
2025         SSL_TLSV1_2,
2026         SSL_NOT_EXP|SSL_HIGH,
2027         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
2028         256,
2029         0,
2030         },
2031
2032         {
2033         1,
2034         TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
2035         TLS1_CK_DHE_RSA_CHACHA20_POLY1305,
2036         SSL_kEDH,
2037         SSL_aRSA,
2038         SSL_CHACHA20POLY1305,
2039         SSL_AEAD,
2040         SSL_TLSV1_2,
2041         SSL_NOT_EXP|SSL_HIGH,
2042         SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
2043         256,
2044         0,
2045         },
2046
2047 /* end of list */
2048         };
2049
2050 SSL3_ENC_METHOD SSLv3_enc_data={
2051         ssl3_enc,
2052         n_ssl3_mac,
2053         ssl3_setup_key_block,
2054         ssl3_generate_master_secret,
2055         ssl3_change_cipher_state,
2056         ssl3_final_finish_mac,
2057         MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
2058         ssl3_cert_verify_mac,
2059         SSL3_MD_CLIENT_FINISHED_CONST,4,
2060         SSL3_MD_SERVER_FINISHED_CONST,4,
2061         ssl3_alert_code,
2062         (int (*)(SSL *, unsigned char *, size_t, const char *,
2063                  size_t, const unsigned char *, size_t,
2064                  int use_context))ssl_undefined_function,
2065         0,
2066         SSL3_HM_HEADER_LENGTH,
2067         ssl3_set_handshake_header,
2068         ssl3_handshake_write
2069         };
2070
2071 long ssl3_default_timeout(void)
2072         {
2073         /* 2 hours, the 24 hours mentioned in the SSLv3 spec
2074          * is way too long for http, the cache would over fill */
2075         return(60*60*2);
2076         }
2077
2078 int ssl3_num_ciphers(void)
2079         {
2080         return(SSL3_NUM_CIPHERS);
2081         }
2082
2083 const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
2084         {
2085         if (u < SSL3_NUM_CIPHERS)
2086                 return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
2087         else
2088                 return(NULL);
2089         }
2090
2091 int ssl3_pending(const SSL *s)
2092         {
2093         if (s->rstate == SSL_ST_READ_BODY)
2094                 return 0;
2095
2096         return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0;
2097         }
2098
2099 void ssl3_set_handshake_header(SSL *s, int htype, unsigned long len)
2100         {
2101         unsigned char *p = (unsigned char *)s->init_buf->data;
2102         *(p++) = htype;
2103         l2n3(len, p);
2104         s->init_num = (int)len + SSL3_HM_HEADER_LENGTH;
2105         s->init_off = 0;
2106         }
2107
2108 int ssl3_handshake_write(SSL *s)
2109         {
2110         return ssl3_do_write(s, SSL3_RT_HANDSHAKE);
2111         }
2112
2113 int ssl3_new(SSL *s)
2114         {
2115         SSL3_STATE *s3;
2116
2117         if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
2118         memset(s3,0,sizeof *s3);
2119         memset(s3->rrec.seq_num,0,sizeof(s3->rrec.seq_num));
2120         memset(s3->wrec.seq_num,0,sizeof(s3->wrec.seq_num));
2121
2122         s->s3=s3;
2123
2124         s->tlsext_channel_id_enabled = s->ctx->tlsext_channel_id_enabled;
2125         if (s->ctx->tlsext_channel_id_private)
2126                 s->tlsext_channel_id_private = EVP_PKEY_dup(s->ctx->tlsext_channel_id_private);
2127         s->method->ssl_clear(s);
2128         return(1);
2129 err:
2130         return(0);
2131         }
2132
2133 void ssl3_free(SSL *s)
2134         {
2135         if(s == NULL)
2136             return;
2137
2138         ssl3_cleanup_key_block(s);
2139         if (s->s3->rbuf.buf != NULL)
2140                 ssl3_release_read_buffer(s);
2141         if (s->s3->wbuf.buf != NULL)
2142                 ssl3_release_write_buffer(s);
2143 #ifndef OPENSSL_NO_DH
2144         if (s->s3->tmp.dh != NULL)
2145                 DH_free(s->s3->tmp.dh);
2146 #endif
2147 #ifndef OPENSSL_NO_ECDH
2148         if (s->s3->tmp.ecdh != NULL)
2149                 EC_KEY_free(s->s3->tmp.ecdh);
2150 #endif
2151
2152         if (s->s3->tmp.ca_names != NULL)
2153                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
2154         if (s->s3->tmp.certificate_types != NULL)
2155                 OPENSSL_free(s->s3->tmp.certificate_types);
2156         if (s->s3->handshake_buffer) {
2157                 BIO_free(s->s3->handshake_buffer);
2158         }
2159         if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
2160         if (s->s3->alpn_selected)
2161                 OPENSSL_free(s->s3->alpn_selected);
2162
2163         OPENSSL_cleanse(s->s3,sizeof *s->s3);
2164         OPENSSL_free(s->s3);
2165         s->s3=NULL;
2166         }
2167
2168 void ssl3_clear(SSL *s)
2169         {
2170         unsigned char *rp,*wp;
2171         size_t rlen, wlen;
2172         int init_extra;
2173
2174         ssl3_cleanup_key_block(s);
2175         if (s->s3->tmp.ca_names != NULL)
2176                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
2177         if (s->s3->tmp.certificate_types != NULL)
2178                 OPENSSL_free(s->s3->tmp.certificate_types);
2179         s->s3->tmp.num_certificate_types = 0;
2180
2181 #ifndef OPENSSL_NO_DH
2182         if (s->s3->tmp.dh != NULL)
2183                 {
2184                 DH_free(s->s3->tmp.dh);
2185                 s->s3->tmp.dh = NULL;
2186                 }
2187 #endif
2188 #ifndef OPENSSL_NO_ECDH
2189         if (s->s3->tmp.ecdh != NULL)
2190                 {
2191                 EC_KEY_free(s->s3->tmp.ecdh);
2192                 s->s3->tmp.ecdh = NULL;
2193                 }
2194 #endif
2195         rp = s->s3->rbuf.buf;
2196         wp = s->s3->wbuf.buf;
2197         rlen = s->s3->rbuf.len;
2198         wlen = s->s3->wbuf.len;
2199         init_extra = s->s3->init_extra;
2200         if (s->s3->handshake_buffer) {
2201                 BIO_free(s->s3->handshake_buffer);
2202                 s->s3->handshake_buffer = NULL;
2203         }
2204         if (s->s3->handshake_dgst) {
2205                 ssl3_free_digest_list(s);
2206         }
2207
2208         if (s->s3->alpn_selected)
2209                 {
2210                 free(s->s3->alpn_selected);
2211                 s->s3->alpn_selected = NULL;
2212                 }
2213         memset(s->s3,0,sizeof *s->s3);
2214         s->s3->rbuf.buf = rp;
2215         s->s3->wbuf.buf = wp;
2216         s->s3->rbuf.len = rlen;
2217         s->s3->wbuf.len = wlen;
2218         s->s3->init_extra = init_extra;
2219
2220         ssl_free_wbio_buffer(s);
2221
2222         s->packet_length=0;
2223         s->s3->renegotiate=0;
2224         s->s3->total_renegotiations=0;
2225         s->s3->num_renegotiations=0;
2226         s->s3->in_read_app_data=0;
2227         s->version=SSL3_VERSION;
2228
2229 #if !defined(OPENSSL_NO_NEXTPROTONEG)
2230         if (s->next_proto_negotiated)
2231                 {
2232                 OPENSSL_free(s->next_proto_negotiated);
2233                 s->next_proto_negotiated = NULL;
2234                 s->next_proto_negotiated_len = 0;
2235                 }
2236 #endif
2237
2238         s->s3->tlsext_channel_id_valid = 0;
2239         }
2240
2241 static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len);
2242
2243 long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2244         {
2245         int ret=0;
2246
2247         if (
2248             cmd == SSL_CTRL_SET_TMP_RSA ||
2249             cmd == SSL_CTRL_SET_TMP_RSA_CB ||
2250 #ifndef OPENSSL_NO_DSA
2251             cmd == SSL_CTRL_SET_TMP_DH ||
2252             cmd == SSL_CTRL_SET_TMP_DH_CB ||
2253 #endif
2254                 0)
2255                 {
2256                 if (!ssl_cert_inst(&s->cert))
2257                         {
2258                         OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_MALLOC_FAILURE);
2259                         return(0);
2260                         }
2261                 }
2262
2263         switch (cmd)
2264                 {
2265         case SSL_CTRL_GET_SESSION_REUSED:
2266                 ret=s->hit;
2267                 break;
2268         case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
2269                 break;
2270         case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
2271                 ret=s->s3->num_renegotiations;
2272                 break;
2273         case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
2274                 ret=s->s3->num_renegotiations;
2275                 s->s3->num_renegotiations=0;
2276                 break;
2277         case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
2278                 ret=s->s3->total_renegotiations;
2279                 break;
2280         case SSL_CTRL_GET_FLAGS:
2281                 ret=(int)(s->s3->flags);
2282                 break;
2283         case SSL_CTRL_NEED_TMP_RSA:
2284                 /* Temporary RSA keys are never used. */
2285                 ret = 0;
2286                 break;
2287         case SSL_CTRL_SET_TMP_RSA:
2288                 /* Temporary RSA keys are never used. */
2289                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2290                 break;
2291         case SSL_CTRL_SET_TMP_RSA_CB:
2292                 {
2293                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2294                 return(ret);
2295                 }
2296                 break;
2297 #ifndef OPENSSL_NO_DH
2298         case SSL_CTRL_SET_TMP_DH:
2299                 {
2300                         DH *dh = (DH *)parg;
2301                         if (dh == NULL)
2302                                 {
2303                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_PASSED_NULL_PARAMETER);
2304                                 return(ret);
2305                                 }
2306                         if ((dh = DHparams_dup(dh)) == NULL)
2307                                 {
2308                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_DH_LIB);
2309                                 return(ret);
2310                                 }
2311                         if (!(s->options & SSL_OP_SINGLE_DH_USE))
2312                                 {
2313                                 if (!DH_generate_key(dh))
2314                                         {
2315                                         DH_free(dh);
2316                                         OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_DH_LIB);
2317                                         return(ret);
2318                                         }
2319                                 }
2320                         if (s->cert->dh_tmp != NULL)
2321                                 DH_free(s->cert->dh_tmp);
2322                         s->cert->dh_tmp = dh;
2323                         ret = 1;
2324                 }
2325                 break;
2326         case SSL_CTRL_SET_TMP_DH_CB:
2327                 {
2328                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2329                 return(ret);
2330                 }
2331                 break;
2332 #endif
2333 #ifndef OPENSSL_NO_ECDH
2334         case SSL_CTRL_SET_TMP_ECDH:
2335                 {
2336                 EC_KEY *ecdh = NULL;
2337
2338                 if (parg == NULL)
2339                         {
2340                         OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_PASSED_NULL_PARAMETER);
2341                         return(ret);
2342                         }
2343                 if (!EC_KEY_up_ref((EC_KEY *)parg))
2344                         {
2345                         OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_ECDH_LIB);
2346                         return(ret);
2347                         }
2348                 ecdh = (EC_KEY *)parg;
2349                 if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
2350                         {
2351                         if (!EC_KEY_generate_key(ecdh))
2352                                 {
2353                                 EC_KEY_free(ecdh);
2354                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_ECDH_LIB);
2355                                 return(ret);
2356                                 }
2357                         }
2358                 if (s->cert->ecdh_tmp != NULL)
2359                         EC_KEY_free(s->cert->ecdh_tmp);
2360                 s->cert->ecdh_tmp = ecdh;
2361                 ret = 1;
2362                 }
2363                 break;
2364         case SSL_CTRL_SET_TMP_ECDH_CB:
2365                 {
2366                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2367                 return(ret);
2368                 }
2369                 break;
2370 #endif /* !OPENSSL_NO_ECDH */
2371         case SSL_CTRL_SET_TLSEXT_HOSTNAME:
2372                 if (larg == TLSEXT_NAMETYPE_host_name)
2373                         {
2374                         if (s->tlsext_hostname != NULL)
2375                                 OPENSSL_free(s->tlsext_hostname);
2376                         s->tlsext_hostname = NULL;
2377
2378                         ret = 1;
2379                         if (parg == NULL)
2380                                 break;
2381                         if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
2382                                 {
2383                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
2384                                 return 0;
2385                                 }
2386                         if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
2387                                 {
2388                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, ERR_R_INTERNAL_ERROR);
2389                                 return 0;
2390                                 }
2391                         }
2392                 else
2393                         {
2394                         OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
2395                         return 0;
2396                         }
2397                 break;
2398         case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
2399                 s->tlsext_debug_arg=parg;
2400                 ret = 1;
2401                 break;
2402
2403         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
2404                 s->tlsext_status_type=larg;
2405                 ret = 1;
2406                 break;
2407
2408         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
2409                 *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts;
2410                 ret = 1;
2411                 break;
2412
2413         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
2414                 s->tlsext_ocsp_exts = parg;
2415                 ret = 1;
2416                 break;
2417
2418         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
2419                 *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids;
2420                 ret = 1;
2421                 break;
2422
2423         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
2424                 s->tlsext_ocsp_ids = parg;
2425                 ret = 1;
2426                 break;
2427
2428         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
2429                 *(unsigned char **)parg = s->tlsext_ocsp_resp;
2430                 return s->tlsext_ocsp_resplen;
2431
2432         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
2433                 if (s->tlsext_ocsp_resp)
2434                         OPENSSL_free(s->tlsext_ocsp_resp);
2435                 s->tlsext_ocsp_resp = parg;
2436                 s->tlsext_ocsp_resplen = larg;
2437                 ret = 1;
2438                 break;
2439
2440
2441         case SSL_CTRL_CHAIN:
2442                 if (larg)
2443                         return ssl_cert_set1_chain(s->cert,
2444                                                 (STACK_OF (X509) *)parg);
2445                 else
2446                         return ssl_cert_set0_chain(s->cert,
2447                                                 (STACK_OF (X509) *)parg);
2448
2449         case SSL_CTRL_CHAIN_CERT:
2450                 if (larg)
2451                         return ssl_cert_add1_chain_cert(s->cert, (X509 *)parg);
2452                 else
2453                         return ssl_cert_add0_chain_cert(s->cert, (X509 *)parg);
2454
2455         case SSL_CTRL_GET_CHAIN_CERTS:
2456                 *(STACK_OF(X509) **)parg = s->cert->key->chain;
2457                 break;
2458
2459         case SSL_CTRL_SELECT_CURRENT_CERT:
2460                 return ssl_cert_select_current(s->cert, (X509 *)parg);
2461
2462 #ifndef OPENSSL_NO_EC
2463         case SSL_CTRL_GET_CURVES:
2464                 {
2465                 const uint16_t *clist;
2466                 size_t clistlen;
2467                 if (!s->session)
2468                         return 0;
2469                 clist = s->session->tlsext_ellipticcurvelist;
2470                 clistlen = s->session->tlsext_ellipticcurvelist_length;
2471                 if (parg)
2472                         {
2473                         size_t i;
2474                         int *cptr = parg;
2475                         int nid;
2476                         for (i = 0; i < clistlen; i++)
2477                                 {
2478                                 nid = tls1_ec_curve_id2nid(clist[i]);
2479                                 if (nid != OBJ_undef)
2480                                         cptr[i] = nid;
2481                                 else
2482                                         cptr[i] = TLSEXT_nid_unknown | clist[i];
2483                                 }
2484                         }
2485                 return (int)clistlen;
2486                 }
2487
2488         case SSL_CTRL_SET_CURVES:
2489                 return tls1_set_curves(&s->tlsext_ellipticcurvelist,
2490                                         &s->tlsext_ellipticcurvelist_length,
2491                                                                 parg, larg);
2492
2493         case SSL_CTRL_SET_ECDH_AUTO:
2494                 s->cert->ecdh_tmp_auto = larg;
2495                 return 1;
2496 #endif
2497         case SSL_CTRL_SET_SIGALGS:
2498                 return tls1_set_sigalgs(s->cert, parg, larg, 0);
2499
2500         case SSL_CTRL_SET_CLIENT_SIGALGS:
2501                 return tls1_set_sigalgs(s->cert, parg, larg, 1);
2502
2503         case SSL_CTRL_GET_CLIENT_CERT_TYPES:
2504                 {
2505                 const unsigned char **pctype = parg;
2506                 if (s->server || !s->s3->tmp.cert_req)
2507                         return 0;
2508                 if (pctype)
2509                         *pctype = s->s3->tmp.certificate_types;
2510                 return (int)s->s3->tmp.num_certificate_types;
2511                 }
2512
2513         case SSL_CTRL_SET_CLIENT_CERT_TYPES:
2514                 if (!s->server)
2515                         return 0;
2516                 return ssl3_set_req_cert_type(s->cert, parg, larg);
2517
2518         case SSL_CTRL_BUILD_CERT_CHAIN:
2519                 return ssl_build_cert_chain(s->cert, s->ctx->cert_store, larg);
2520
2521         case SSL_CTRL_SET_VERIFY_CERT_STORE:
2522                 return ssl_cert_set_cert_store(s->cert, parg, 0, larg);
2523
2524         case SSL_CTRL_SET_CHAIN_CERT_STORE:
2525                 return ssl_cert_set_cert_store(s->cert, parg, 1, larg);
2526
2527         case SSL_CTRL_GET_PEER_SIGNATURE_NID:
2528                 if (SSL_USE_SIGALGS(s))
2529                         {
2530                         if (s->session && s->session->sess_cert)
2531                                 {
2532                                 const EVP_MD *sig;
2533                                 sig = s->session->sess_cert->peer_key->digest;
2534                                 if (sig)
2535                                         {
2536                                         *(int *)parg = EVP_MD_type(sig);
2537                                         return 1;
2538                                         }
2539                                 }
2540                         return 0;
2541                         }
2542                 /* Might want to do something here for other versions */
2543                 else
2544                         return 0;
2545
2546         case SSL_CTRL_GET_SERVER_TMP_KEY:
2547                 if (s->server || !s->session || !s->session->sess_cert)
2548                         return 0;
2549                 else
2550                         {
2551                         SESS_CERT *sc;
2552                         EVP_PKEY *ptmp;
2553                         int rv = 0;
2554                         sc = s->session->sess_cert;
2555 #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC)
2556                         if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp
2557                                                         && !sc->peer_ecdh_tmp)
2558                                 return 0;
2559 #endif
2560                         ptmp = EVP_PKEY_new();
2561                         if (!ptmp)
2562                                 return 0;
2563                         if (0);
2564                         else if (sc->peer_rsa_tmp)
2565                                 rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
2566 #ifndef OPENSSL_NO_DH
2567                         else if (sc->peer_dh_tmp)
2568                                 rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
2569 #endif
2570 #ifndef OPENSSL_NO_ECDH
2571                         else if (sc->peer_ecdh_tmp)
2572                                 rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
2573 #endif
2574                         if (rv)
2575                                 {
2576                                 *(EVP_PKEY **)parg = ptmp;
2577                                 return 1;
2578                                 }
2579                         EVP_PKEY_free(ptmp);
2580                         return 0;
2581                         }
2582 #ifndef OPENSSL_NO_EC
2583         case SSL_CTRL_GET_EC_POINT_FORMATS:
2584                 {
2585                 SSL_SESSION *sess = s->session;
2586                 const unsigned char **pformat = parg;
2587                 if (!sess || !sess->tlsext_ecpointformatlist)
2588                         return 0;
2589                 *pformat = sess->tlsext_ecpointformatlist;
2590                 return (int)sess->tlsext_ecpointformatlist_length;
2591                 }
2592 #endif
2593
2594         case SSL_CTRL_CHANNEL_ID:
2595                 s->tlsext_channel_id_enabled = 1;
2596                 ret = 1;
2597                 break;
2598
2599         case SSL_CTRL_SET_CHANNEL_ID:
2600                 if (s->server)
2601                         break;
2602                 s->tlsext_channel_id_enabled = 1;
2603                 if (EVP_PKEY_bits(parg) != 256)
2604                         {
2605                         OPENSSL_PUT_ERROR(SSL, ssl3_ctrl, SSL_R_CHANNEL_ID_NOT_P256);
2606                         break;
2607                         }
2608                 if (s->tlsext_channel_id_private)
2609                         EVP_PKEY_free(s->tlsext_channel_id_private);
2610                 s->tlsext_channel_id_private = EVP_PKEY_dup((EVP_PKEY*) parg);
2611                 ret = 1;
2612                 break;
2613
2614         case SSL_CTRL_GET_CHANNEL_ID:
2615                 if (!s->server)
2616                         break;
2617                 if (!s->s3->tlsext_channel_id_valid)
2618                         break;
2619                 memcpy(parg, s->s3->tlsext_channel_id, larg < 64 ? larg : 64);
2620                 return 64;
2621
2622         case SSL_CTRL_FALLBACK_SCSV:
2623                 if (s->server)
2624                         break;
2625                 s->fallback_scsv = 1;
2626                 ret = 1;
2627                 break;
2628
2629         default:
2630                 break;
2631                 }
2632         return(ret);
2633         }
2634
2635 long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
2636         {
2637         int ret=0;
2638
2639         if (
2640             cmd == SSL_CTRL_SET_TMP_RSA_CB ||
2641 #ifndef OPENSSL_NO_DSA
2642             cmd == SSL_CTRL_SET_TMP_DH_CB ||
2643 #endif
2644                 0)
2645                 {
2646                 if (!ssl_cert_inst(&s->cert))
2647                         {
2648                         OPENSSL_PUT_ERROR(SSL, ssl3_callback_ctrl, ERR_R_MALLOC_FAILURE);
2649                         return(0);
2650                         }
2651                 }
2652
2653         switch (cmd)
2654                 {
2655         case SSL_CTRL_SET_TMP_RSA_CB:
2656                 /* Ignore the callback; temporary RSA keys are never used. */
2657                 break;
2658 #ifndef OPENSSL_NO_DH
2659         case SSL_CTRL_SET_TMP_DH_CB:
2660                 {
2661                 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
2662                 }
2663                 break;
2664 #endif
2665 #ifndef OPENSSL_NO_ECDH
2666         case SSL_CTRL_SET_TMP_ECDH_CB:
2667                 {
2668                 s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
2669                 }
2670                 break;
2671 #endif
2672         case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
2673                 s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
2674                                         unsigned char *, int, void *))fp;
2675                 break;
2676         default:
2677                 break;
2678                 }
2679         return(ret);
2680         }
2681
2682 long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2683         {
2684         CERT *cert;
2685
2686         cert=ctx->cert;
2687
2688         switch (cmd)
2689                 {
2690         case SSL_CTRL_NEED_TMP_RSA:
2691                 /* Temporary RSA keys are never used. */
2692                 return 0;
2693         case SSL_CTRL_SET_TMP_RSA:
2694                 OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2695                 return 0;
2696         case SSL_CTRL_SET_TMP_RSA_CB:
2697                 {
2698                 OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2699                 return(0);
2700                 }
2701                 break;
2702 #ifndef OPENSSL_NO_DH
2703         case SSL_CTRL_SET_TMP_DH:
2704                 {
2705                 DH *new=NULL,*dh;
2706
2707                 dh=(DH *)parg;
2708                 if ((new=DHparams_dup(dh)) == NULL)
2709                         {
2710                         OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_DH_LIB);
2711                         return 0;
2712                         }
2713                 if (!(ctx->options & SSL_OP_SINGLE_DH_USE))
2714                         {
2715                         if (!DH_generate_key(new))
2716                                 {
2717                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_DH_LIB);
2718                                 DH_free(new);
2719                                 return 0;
2720                                 }
2721                         }
2722                 if (cert->dh_tmp != NULL)
2723                         DH_free(cert->dh_tmp);
2724                 cert->dh_tmp=new;
2725                 return 1;
2726                 }
2727                 /*break; */
2728         case SSL_CTRL_SET_TMP_DH_CB:
2729                 {
2730                 OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2731                 return(0);
2732                 }
2733                 break;
2734 #endif
2735 #ifndef OPENSSL_NO_ECDH
2736         case SSL_CTRL_SET_TMP_ECDH:
2737                 {
2738                 EC_KEY *ecdh = NULL;
2739
2740                 if (parg == NULL)
2741                         {
2742                         OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_ECDH_LIB);
2743                         return 0;
2744                         }
2745                 ecdh = EC_KEY_dup((EC_KEY *)parg);
2746                 if (ecdh == NULL)
2747                         {
2748                         OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_EC_LIB);
2749                         return 0;
2750                         }
2751                 if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
2752                         {
2753                         if (!EC_KEY_generate_key(ecdh))
2754                                 {
2755                                 EC_KEY_free(ecdh);
2756                                 OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_ECDH_LIB);
2757                                 return 0;
2758                                 }
2759                         }
2760
2761                 if (cert->ecdh_tmp != NULL)
2762                         {
2763                         EC_KEY_free(cert->ecdh_tmp);
2764                         }
2765                 cert->ecdh_tmp = ecdh;
2766                 return 1;
2767                 }
2768                 /* break; */
2769         case SSL_CTRL_SET_TMP_ECDH_CB:
2770                 {
2771                 OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2772                 return(0);
2773                 }
2774                 break;
2775 #endif /* !OPENSSL_NO_ECDH */
2776         case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
2777                 ctx->tlsext_servername_arg=parg;
2778                 break;
2779         case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
2780         case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
2781                 {
2782                 unsigned char *keys = parg;
2783                 if (!keys)
2784                         return 48;
2785                 if (larg != 48)
2786                         {
2787                         OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, SSL_R_INVALID_TICKET_KEYS_LENGTH);
2788                         return 0;
2789                         }
2790                 if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
2791                         {
2792                         memcpy(ctx->tlsext_tick_key_name, keys, 16);
2793                         memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
2794                         memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
2795                         }
2796                 else
2797                         {
2798                         memcpy(keys, ctx->tlsext_tick_key_name, 16);
2799                         memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
2800                         memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
2801                         }
2802                 return 1;
2803                 }
2804
2805         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
2806                 ctx->tlsext_status_arg=parg;
2807                 return 1;
2808                 break;
2809
2810 #ifndef OPENSSL_NO_EC
2811         case SSL_CTRL_SET_CURVES:
2812                 return tls1_set_curves(&ctx->tlsext_ellipticcurvelist,
2813                                         &ctx->tlsext_ellipticcurvelist_length,
2814                                                                 parg, larg);
2815
2816         case SSL_CTRL_SET_ECDH_AUTO:
2817                 ctx->cert->ecdh_tmp_auto = larg;
2818                 return 1;
2819 #endif
2820         case SSL_CTRL_SET_SIGALGS:
2821                 return tls1_set_sigalgs(ctx->cert, parg, larg, 0);
2822
2823         case SSL_CTRL_SET_CLIENT_SIGALGS:
2824                 return tls1_set_sigalgs(ctx->cert, parg, larg, 1);
2825
2826         case SSL_CTRL_SET_CLIENT_CERT_TYPES:
2827                 return ssl3_set_req_cert_type(ctx->cert, parg, larg);
2828
2829         case SSL_CTRL_BUILD_CERT_CHAIN:
2830                 return ssl_build_cert_chain(ctx->cert, ctx->cert_store, larg);
2831
2832         case SSL_CTRL_SET_VERIFY_CERT_STORE:
2833                 return ssl_cert_set_cert_store(ctx->cert, parg, 0, larg);
2834
2835         case SSL_CTRL_SET_CHAIN_CERT_STORE:
2836                 return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg);
2837
2838
2839         /* A Thawte special :-) */
2840         case SSL_CTRL_EXTRA_CHAIN_CERT:
2841                 if (ctx->extra_certs == NULL)
2842                         {
2843                         if ((ctx->extra_certs=sk_X509_new_null()) == NULL)
2844                                 return(0);
2845                         }
2846                 sk_X509_push(ctx->extra_certs,(X509 *)parg);
2847                 break;
2848
2849         case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
2850                 if (ctx->extra_certs == NULL && larg == 0)
2851                         *(STACK_OF(X509) **)parg =  ctx->cert->key->chain;
2852                 else
2853                         *(STACK_OF(X509) **)parg =  ctx->extra_certs;
2854                 break;
2855
2856         case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
2857                 if (ctx->extra_certs)
2858                         {
2859                         sk_X509_pop_free(ctx->extra_certs, X509_free);
2860                         ctx->extra_certs = NULL;
2861                         }
2862                 break;
2863
2864         case SSL_CTRL_CHAIN:
2865                 if (larg)
2866                         return ssl_cert_set1_chain(ctx->cert,
2867                                                 (STACK_OF (X509) *)parg);
2868                 else
2869                         return ssl_cert_set0_chain(ctx->cert,
2870                                                 (STACK_OF (X509) *)parg);
2871
2872         case SSL_CTRL_CHAIN_CERT:
2873                 if (larg)
2874                         return ssl_cert_add1_chain_cert(ctx->cert, (X509 *)parg);
2875                 else
2876                         return ssl_cert_add0_chain_cert(ctx->cert, (X509 *)parg);
2877
2878         case SSL_CTRL_GET_CHAIN_CERTS:
2879                 *(STACK_OF(X509) **)parg = ctx->cert->key->chain;
2880                 break;
2881
2882         case SSL_CTRL_SELECT_CURRENT_CERT:
2883                 return ssl_cert_select_current(ctx->cert, (X509 *)parg);
2884
2885         case SSL_CTRL_CHANNEL_ID:
2886                 /* must be called on a server */
2887                 if (ctx->method->ssl_accept == ssl_undefined_function)
2888                         return 0;
2889                 ctx->tlsext_channel_id_enabled=1;
2890                 return 1;
2891
2892         case SSL_CTRL_SET_CHANNEL_ID:
2893                 ctx->tlsext_channel_id_enabled = 1;
2894                 if (EVP_PKEY_bits(parg) != 256)
2895                         {
2896                         OPENSSL_PUT_ERROR(SSL, ssl3_ctx_ctrl, SSL_R_CHANNEL_ID_NOT_P256);
2897                         break;
2898                         }
2899                 if (ctx->tlsext_channel_id_private)
2900                         EVP_PKEY_free(ctx->tlsext_channel_id_private);
2901                 ctx->tlsext_channel_id_private = EVP_PKEY_dup((EVP_PKEY*) parg);
2902                 break;
2903
2904         default:
2905                 return(0);
2906                 }
2907         return(1);
2908         }
2909
2910 long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
2911         {
2912         CERT *cert;
2913
2914         cert=ctx->cert;
2915
2916         switch (cmd)
2917                 {
2918         case SSL_CTRL_SET_TMP_RSA_CB:
2919                 /* Ignore the callback; temporary RSA keys are never used. */
2920                 break;
2921 #ifndef OPENSSL_NO_DH
2922         case SSL_CTRL_SET_TMP_DH_CB:
2923                 {
2924                 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
2925                 }
2926                 break;
2927 #endif
2928 #ifndef OPENSSL_NO_ECDH
2929         case SSL_CTRL_SET_TMP_ECDH_CB:
2930                 {
2931                 cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
2932                 }
2933                 break;
2934 #endif
2935         case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
2936                 ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
2937                 break;
2938
2939         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
2940                 ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
2941                 break;
2942
2943         case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
2944                 ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char  *,
2945                                                 unsigned char *,
2946                                                 EVP_CIPHER_CTX *,
2947                                                 HMAC_CTX *, int))fp;
2948                 break;
2949
2950         default:
2951                 return(0);
2952                 }
2953         return(1);
2954         }
2955
2956 /* ssl3_get_cipher_by_value returns the SSL_CIPHER with value |value| or NULL if
2957  * none exists.
2958  *
2959  * This function needs to check if the ciphers required are actually
2960  * available. */
2961 const SSL_CIPHER *ssl3_get_cipher_by_value(uint16_t value)
2962         {
2963         SSL_CIPHER c;
2964
2965         c.id = 0x03000000L|value;
2966         return bsearch(&c, ssl3_ciphers, SSL3_NUM_CIPHERS, sizeof(SSL_CIPHER), ssl_cipher_id_cmp);
2967         }
2968
2969 /* ssl3_get_cipher_by_value returns the cipher value of |c|. */
2970 uint16_t ssl3_get_cipher_value(const SSL_CIPHER *c)
2971         {
2972         unsigned long id = c->id;
2973         /* All ciphers are SSLv3 now. */
2974         assert((id & 0xff000000) == 0x03000000);
2975         return id & 0xffff;
2976         }
2977
2978 struct ssl_cipher_preference_list_st* ssl_get_cipher_preferences(SSL *s)
2979         {
2980         if (s->cipher_list != NULL)
2981                 return(s->cipher_list);
2982
2983         if (s->version >= TLS1_1_VERSION)
2984                 {
2985                 if (s->ctx != NULL && s->ctx->cipher_list_tls11 != NULL)
2986                         return s->ctx->cipher_list_tls11;
2987                 }
2988
2989         if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL))
2990                 return(s->ctx->cipher_list);
2991
2992         return NULL;
2993         }
2994
2995 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
2996              struct ssl_cipher_preference_list_st *server_pref)
2997         {
2998         SSL_CIPHER *c,*ret=NULL;
2999         STACK_OF(SSL_CIPHER) *srvr = server_pref->ciphers, *prio, *allow;
3000         int i,ok;
3001         size_t cipher_index;
3002         CERT *cert;
3003         unsigned long alg_k,alg_a,mask_k,mask_a;
3004         /* in_group_flags will either be NULL, or will point to an array of
3005          * bytes which indicate equal-preference groups in the |prio| stack.
3006          * See the comment about |in_group_flags| in the
3007          * |ssl_cipher_preference_list_st| struct. */
3008         const unsigned char *in_group_flags;
3009         /* group_min contains the minimal index so far found in a group, or -1
3010          * if no such value exists yet. */
3011         int group_min = -1;
3012
3013         /* Let's see which ciphers we can support */
3014         cert=s->cert;
3015
3016 #if 0
3017         /* Do not set the compare functions, because this may lead to a
3018          * reordering by "id". We want to keep the original ordering.
3019          * We may pay a price in performance during sk_SSL_CIPHER_find(),
3020          * but would have to pay with the price of sk_SSL_CIPHER_dup().
3021          */
3022         sk_SSL_CIPHER_set_cmp_func(srvr, ssl_cipher_ptr_id_cmp);
3023         sk_SSL_CIPHER_set_cmp_func(clnt, ssl_cipher_ptr_id_cmp);
3024 #endif
3025
3026 #ifdef CIPHER_DEBUG
3027         printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), (void *)srvr);
3028         for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
3029                 {
3030                 c=sk_SSL_CIPHER_value(srvr,i);
3031                 printf("%p:%s\n",(void *)c,c->name);
3032                 }
3033         printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), (void *)clnt);
3034         for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
3035             {
3036             c=sk_SSL_CIPHER_value(clnt,i);
3037             printf("%p:%s\n",(void *)c,c->name);
3038             }
3039 #endif
3040
3041         if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || tls1_suiteb(s))
3042                 {
3043                 prio = srvr;
3044                 in_group_flags = server_pref->in_group_flags;
3045                 allow = clnt;
3046                 }
3047         else
3048                 {
3049                 prio = clnt;
3050                 in_group_flags = NULL;
3051                 allow = srvr;
3052                 }
3053
3054         tls1_set_cert_validity(s);
3055
3056         for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
3057                 {
3058                 c=sk_SSL_CIPHER_value(prio,i);
3059
3060                 ok = 1;
3061
3062                 /* Skip TLS v1.2 only ciphersuites if not supported */
3063                 if ((c->algorithm_ssl & SSL_TLSV1_2) &&
3064                         !SSL_USE_TLS1_2_CIPHERS(s))
3065                         ok = 0;
3066
3067                 ssl_set_cert_masks(cert,c);
3068                 mask_k = cert->mask_k;
3069                 mask_a = cert->mask_a;
3070
3071 #ifdef KSSL_DEBUG
3072 /*              printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/
3073 #endif    /* KSSL_DEBUG */
3074
3075                 alg_k=c->algorithm_mkey;
3076                 alg_a=c->algorithm_auth;
3077
3078                 /* with PSK there must be server callback set */
3079                 if ((alg_a & SSL_aPSK) && s->psk_server_callback == NULL)
3080                         ok = 0;
3081
3082                 ok = ok && (alg_k & mask_k) && (alg_a & mask_a);
3083 #ifdef CIPHER_DEBUG
3084                 printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",ok,alg_k,alg_a,mask_k,mask_a,(void *)c,
3085                        c->name);
3086 #endif
3087
3088 #ifndef OPENSSL_NO_EC
3089                 /* if we are considering an ECC cipher suite that uses
3090                  * an ephemeral EC key check it */
3091                 if (alg_k & SSL_kEECDH)
3092                         ok = ok && tls1_check_ec_tmp_key(s, c->id);
3093 #endif /* OPENSSL_NO_EC */
3094
3095                 if (ok && sk_SSL_CIPHER_find(allow, &cipher_index, c))
3096                         {
3097                         if (in_group_flags != NULL && in_group_flags[i] == 1)
3098                                 {
3099                                 /* This element of |prio| is in a group. Update
3100                                  * the minimum index found so far and continue
3101                                  * looking. */
3102                                 if (group_min == -1 || group_min > cipher_index)
3103                                         group_min = cipher_index;
3104                                 }
3105                         else
3106                                 {
3107                                 if (group_min != -1 && group_min < cipher_index)
3108                                         cipher_index = group_min;
3109                                 ret=sk_SSL_CIPHER_value(allow,cipher_index);
3110                                 break;
3111                                 }
3112                         }
3113
3114                 if (in_group_flags != NULL &&
3115                     in_group_flags[i] == 0 &&
3116                     group_min != -1)
3117                         {
3118                         /* We are about to leave a group, but we found a match
3119                          * in it, so that's our answer. */
3120                         ret=sk_SSL_CIPHER_value(allow,group_min);
3121                         break;
3122                         }
3123                 }
3124         return(ret);
3125         }
3126
3127 int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
3128         {
3129         int ret=0;
3130         const unsigned char *sig;
3131         size_t i, siglen;
3132         int have_rsa_sign = 0, have_dsa_sign = 0;
3133 #ifndef OPENSSL_NO_ECDSA
3134         int have_ecdsa_sign = 0;
3135 #endif
3136         int nostrict = 1;
3137         unsigned long alg_k;
3138
3139         /* If we have custom certificate types set, use them */
3140         if (s->cert->client_certificate_types)
3141                 {
3142                 memcpy(p, s->cert->client_certificate_types,
3143                         s->cert->num_client_certificate_types);
3144                 return (int)s->cert->num_client_certificate_types;
3145                 }
3146         /* get configured sigalgs */
3147         siglen = tls12_get_psigalgs(s, &sig);
3148         if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
3149                 nostrict = 0;
3150         for (i = 0; i < siglen; i+=2, sig+=2)
3151                 {
3152                 switch(sig[1])
3153                         {
3154                 case TLSEXT_signature_rsa:
3155                         have_rsa_sign = 1;
3156                         break;
3157
3158                 case TLSEXT_signature_dsa:
3159                         have_dsa_sign = 1;
3160                         break;
3161 #ifndef OPENSSL_NO_ECDSA
3162                 case TLSEXT_signature_ecdsa:
3163                         have_ecdsa_sign = 1;
3164                         break;
3165 #endif
3166                         }
3167                 }
3168
3169         alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3170
3171 #ifndef OPENSSL_NO_DH
3172         if (alg_k & (SSL_kDHr|SSL_kEDH))
3173                 {
3174                 /* Since this refers to a certificate signed with an RSA
3175                  * algorithm, only check for rsa signing in strict mode.
3176                  */
3177                 if (nostrict || have_rsa_sign)
3178                         p[ret++]=SSL3_CT_RSA_FIXED_DH;
3179 #  ifndef OPENSSL_NO_DSA
3180                 if (nostrict || have_dsa_sign)
3181                         p[ret++]=SSL3_CT_DSS_FIXED_DH;
3182 #  endif
3183                 }
3184         if ((s->version == SSL3_VERSION) &&
3185                 (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr)))
3186                 {
3187                 p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
3188 #  ifndef OPENSSL_NO_DSA
3189                 p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
3190 #  endif
3191                 }
3192 #endif /* !OPENSSL_NO_DH */
3193         if (have_rsa_sign)
3194                 p[ret++]=SSL3_CT_RSA_SIGN;
3195 #ifndef OPENSSL_NO_DSA
3196         if (have_dsa_sign)
3197                 p[ret++]=SSL3_CT_DSS_SIGN;
3198 #endif
3199 #ifndef OPENSSL_NO_ECDH
3200         if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION))
3201                 {
3202                 if (nostrict || have_rsa_sign)
3203                         p[ret++]=TLS_CT_RSA_FIXED_ECDH;
3204                 if (nostrict || have_ecdsa_sign)
3205                         p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
3206                 }
3207 #endif
3208
3209 #ifndef OPENSSL_NO_ECDSA
3210         /* ECDSA certs can be used with RSA cipher suites as well
3211          * so we don't need to check for SSL_kECDH or SSL_kEECDH
3212          */
3213         if (s->version >= TLS1_VERSION)
3214                 {
3215                 if (have_ecdsa_sign)
3216                         p[ret++]=TLS_CT_ECDSA_SIGN;
3217                 }
3218 #endif
3219         return(ret);
3220         }
3221
3222 static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len)
3223         {
3224         if (c->client_certificate_types)
3225                 {
3226                 OPENSSL_free(c->client_certificate_types);
3227                 c->client_certificate_types = NULL;
3228                 }
3229         c->num_client_certificate_types = 0;
3230         if (!p || !len)
3231                 return 1;
3232         if (len > 0xff)
3233                 return 0;
3234         c->client_certificate_types = BUF_memdup(p, len);
3235         if (!c->client_certificate_types)
3236                 return 0;
3237         c->num_client_certificate_types = len;
3238         return 1;
3239         }
3240
3241 int ssl3_shutdown(SSL *s)
3242         {
3243         int ret;
3244
3245         /* Don't do anything much if we have not done the handshake or
3246          * we don't want to send messages :-) */
3247         if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE))
3248                 {
3249                 s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
3250                 return(1);
3251                 }
3252
3253         if (!(s->shutdown & SSL_SENT_SHUTDOWN))
3254                 {
3255                 s->shutdown|=SSL_SENT_SHUTDOWN;
3256 #if 1
3257                 ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY);
3258 #endif
3259                 /* our shutdown alert has been sent now, and if it still needs
3260                  * to be written, s->s3->alert_dispatch will be true */
3261                 if (s->s3->alert_dispatch)
3262                         return(-1);     /* return WANT_WRITE */
3263                 }
3264         else if (s->s3->alert_dispatch)
3265                 {
3266                 /* resend it if not sent */
3267 #if 1
3268                 ret=s->method->ssl_dispatch_alert(s);
3269                 if(ret == -1)
3270                         {
3271                         /* we only get to return -1 here the 2nd/Nth
3272                          * invocation, we must  have already signalled
3273                          * return 0 upon a previous invoation,
3274                          * return WANT_WRITE */
3275                         return(ret);
3276                         }
3277 #endif
3278                 }
3279         else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
3280                 {
3281                 /* If we are waiting for a close from our peer, we are closed */
3282                 s->method->ssl_read_bytes(s,0,NULL,0,0);
3283                 if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
3284                         {
3285                         return(-1);     /* return WANT_READ */
3286                         }
3287                 }
3288
3289         if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
3290                 !s->s3->alert_dispatch)
3291                 return(1);
3292         else
3293                 return(0);
3294         }
3295
3296 int ssl3_write(SSL *s, const void *buf, int len)
3297         {
3298         int ret,n;
3299
3300 #if 0
3301         if (s->shutdown & SSL_SEND_SHUTDOWN)
3302                 {
3303                 s->rwstate=SSL_NOTHING;
3304                 return(0);
3305                 }
3306 #endif
3307         ERR_clear_system_error();
3308         if (s->s3->renegotiate) ssl3_renegotiate_check(s);
3309
3310         /* This is an experimental flag that sends the
3311          * last handshake message in the same packet as the first
3312          * use data - used to see if it helps the TCP protocol during
3313          * session-id reuse */
3314         /* The second test is because the buffer may have been removed */
3315         if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio))
3316                 {
3317                 /* First time through, we write into the buffer */
3318                 if (s->s3->delay_buf_pop_ret == 0)
3319                         {
3320                         ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
3321                                              buf,len);
3322                         if (ret <= 0) return(ret);
3323
3324                         s->s3->delay_buf_pop_ret=ret;
3325                         }
3326
3327                 s->rwstate=SSL_WRITING;
3328                 n=BIO_flush(s->wbio);
3329                 if (n <= 0) return(n);
3330                 s->rwstate=SSL_NOTHING;
3331
3332                 /* We have flushed the buffer, so remove it */
3333                 ssl_free_wbio_buffer(s);
3334                 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
3335
3336                 ret=s->s3->delay_buf_pop_ret;
3337                 s->s3->delay_buf_pop_ret=0;
3338                 }
3339         else
3340                 {
3341                 ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA,
3342                         buf,len);
3343                 if (ret <= 0) return(ret);
3344                 }
3345
3346         return(ret);
3347         }
3348
3349 static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
3350         {
3351         int n,ret;
3352
3353         ERR_clear_system_error();
3354         if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio))
3355                 {
3356                 /* Deal with an application that calls SSL_read() when handshake data
3357                  * is yet to be written.
3358                  */
3359                 if (BIO_wpending(s->wbio) > 0)
3360                         {
3361                         s->rwstate=SSL_WRITING;
3362                         n=BIO_flush(s->wbio);
3363                         if (n <= 0) return(n);
3364                         s->rwstate=SSL_NOTHING;
3365                         }
3366                 }
3367         if (s->s3->renegotiate) ssl3_renegotiate_check(s);
3368         s->s3->in_read_app_data=1;
3369         ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
3370         if ((ret == -1) && (s->s3->in_read_app_data == 2))
3371                 {
3372                 /* ssl3_read_bytes decided to call s->handshake_func, which
3373                  * called ssl3_read_bytes to read handshake data.
3374                  * However, ssl3_read_bytes actually found application data
3375                  * and thinks that application data makes sense here; so disable
3376                  * handshake processing and try to read application data again. */
3377                 s->in_handshake++;
3378                 ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
3379                 s->in_handshake--;
3380                 }
3381         else
3382                 s->s3->in_read_app_data=0;
3383
3384         return(ret);
3385         }
3386
3387 int ssl3_read(SSL *s, void *buf, int len)
3388         {
3389         return ssl3_read_internal(s, buf, len, 0);
3390         }
3391
3392 int ssl3_peek(SSL *s, void *buf, int len)
3393         {
3394         return ssl3_read_internal(s, buf, len, 1);
3395         }
3396
3397 int ssl3_renegotiate(SSL *s)
3398         {
3399         if (s->handshake_func == NULL)
3400                 return(1);
3401
3402         if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
3403                 return(0);
3404
3405         s->s3->renegotiate=1;
3406         return(1);
3407         }
3408
3409 int ssl3_renegotiate_check(SSL *s)
3410         {
3411         int ret=0;
3412
3413         if (s->s3->renegotiate)
3414                 {
3415                 if (    (s->s3->rbuf.left == 0) &&
3416                         (s->s3->wbuf.left == 0) &&
3417                         !SSL_in_init(s))
3418                         {
3419 /*
3420 if we are the server, and we have sent a 'RENEGOTIATE' message, we
3421 need to go to SSL_ST_ACCEPT.
3422 */
3423                         /* SSL_ST_ACCEPT */
3424                         s->state=SSL_ST_RENEGOTIATE;
3425                         s->s3->renegotiate=0;
3426                         s->s3->num_renegotiations++;
3427                         s->s3->total_renegotiations++;
3428                         ret=1;
3429                         }
3430                 }
3431         return(ret);
3432         }
3433 /* If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF
3434  * and handshake macs if required.
3435  */
3436 long ssl_get_algorithm2(SSL *s)
3437         {
3438         static const unsigned long kMask = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF;
3439         long alg2 = s->s3->tmp.new_cipher->algorithm2;
3440         if (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF
3441             && (alg2 & kMask) == kMask)
3442                 return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
3443         return alg2;
3444         }
3445