crypto/libressl/ssl/s3_lib.c

   1 /* $OpenBSD: s3_lib.c,v 1.192 2020/04/18 14:07:56 jsing Exp $ */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  *
 114  * Portions of the attached software ("Contribution") are developed by
 115  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 116  *
 117  * The Contribution is licensed pursuant to the OpenSSL open source
 118  * license provided above.
 119  *
 120  * ECC cipher suite support in OpenSSL originally written by
 121  * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
 122  *
 123  */
 124 /* ====================================================================
 125  * Copyright 2005 Nokia. All rights reserved.
 126  *
 127  * The portions of the attached software ("Contribution") is developed by
 128  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 129  * license.
 130  *
 131  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 132  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 133  * support (see RFC 4279) to OpenSSL.
 134  *
 135  * No patent licenses or other rights except those expressly stated in
 136  * the OpenSSL open source license shall be deemed granted or received
 137  * expressly, by implication, estoppel, or otherwise.
 138  *
 139  * No assurances are provided by Nokia that the Contribution does not
 140  * infringe the patent or other intellectual property rights of any third
 141  * party or that the license provides you with all the necessary rights
 142  * to make use of the Contribution.
 143  *
 144  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 145  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 146  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 147  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 148  * OTHERWISE.
 149  */
 150
 151 #include <limits.h>
 152 #include <stdio.h>
 153
 154 #include <openssl/bn.h>
 155 #include <openssl/curve25519.h>
 156 #include <openssl/dh.h>
 157 #include <openssl/md5.h>
 158 #include <openssl/objects.h>
 159
 160 #include "ssl_locl.h"
 161 #include "bytestring.h"
 162
 163 #define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers) / sizeof(SSL_CIPHER))
 164
 165 /*
 166  * FIXED_NONCE_LEN is a macro that provides in the correct value to set the
 167  * fixed nonce length in algorithms2. It is the inverse of the
 168  * SSL_CIPHER_AEAD_FIXED_NONCE_LEN macro.
 169  */
 170 #define FIXED_NONCE_LEN(x) (((x / 2) & 0xf) << 24)
 171
 172 /* list of available SSLv3 ciphers (sorted by id) */
 173 SSL_CIPHER ssl3_ciphers[] = {
 174
 175         /* The RSA ciphers */
 176         /* Cipher 01 */
 177         {
 178                 .valid = 1,
 179                 .name = SSL3_TXT_RSA_NULL_MD5,
 180                 .id = SSL3_CK_RSA_NULL_MD5,
 181                 .algorithm_mkey = SSL_kRSA,
 182                 .algorithm_auth = SSL_aRSA,
 183                 .algorithm_enc = SSL_eNULL,
 184                 .algorithm_mac = SSL_MD5,
 185                 .algorithm_ssl = SSL_SSLV3,
 186                 .algo_strength = SSL_STRONG_NONE,
 187                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 188                 .strength_bits = 0,
 189                 .alg_bits = 0,
 190         },
 191
 192         /* Cipher 02 */
 193         {
 194                 .valid = 1,
 195                 .name = SSL3_TXT_RSA_NULL_SHA,
 196                 .id = SSL3_CK_RSA_NULL_SHA,
 197                 .algorithm_mkey = SSL_kRSA,
 198                 .algorithm_auth = SSL_aRSA,
 199                 .algorithm_enc = SSL_eNULL,
 200                 .algorithm_mac = SSL_SHA1,
 201                 .algorithm_ssl = SSL_SSLV3,
 202                 .algo_strength = SSL_STRONG_NONE,
 203                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 204                 .strength_bits = 0,
 205                 .alg_bits = 0,
 206         },
 207
 208         /* Cipher 04 */
 209         {
 210                 .valid = 1,
 211                 .name = SSL3_TXT_RSA_RC4_128_MD5,
 212                 .id = SSL3_CK_RSA_RC4_128_MD5,
 213                 .algorithm_mkey = SSL_kRSA,
 214                 .algorithm_auth = SSL_aRSA,
 215                 .algorithm_enc = SSL_RC4,
 216                 .algorithm_mac = SSL_MD5,
 217                 .algorithm_ssl = SSL_SSLV3,
 218                 .algo_strength = SSL_LOW,
 219                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 220                 .strength_bits = 128,
 221                 .alg_bits = 128,
 222         },
 223
 224         /* Cipher 05 */
 225         {
 226                 .valid = 1,
 227                 .name = SSL3_TXT_RSA_RC4_128_SHA,
 228                 .id = SSL3_CK_RSA_RC4_128_SHA,
 229                 .algorithm_mkey = SSL_kRSA,
 230                 .algorithm_auth = SSL_aRSA,
 231                 .algorithm_enc = SSL_RC4,
 232                 .algorithm_mac = SSL_SHA1,
 233                 .algorithm_ssl = SSL_SSLV3,
 234                 .algo_strength = SSL_LOW,
 235                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 236                 .strength_bits = 128,
 237                 .alg_bits = 128,
 238         },
 239
 240         /* Cipher 0A */
 241         {
 242                 .valid = 1,
 243                 .name = SSL3_TXT_RSA_DES_192_CBC3_SHA,
 244                 .id = SSL3_CK_RSA_DES_192_CBC3_SHA,
 245                 .algorithm_mkey = SSL_kRSA,
 246                 .algorithm_auth = SSL_aRSA,
 247                 .algorithm_enc = SSL_3DES,
 248                 .algorithm_mac = SSL_SHA1,
 249                 .algorithm_ssl = SSL_SSLV3,
 250                 .algo_strength = SSL_MEDIUM,
 251                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 252                 .strength_bits = 112,
 253                 .alg_bits = 168,
 254         },
 255
 256         /*
 257          * Ephemeral DH (DHE) ciphers.
 258          */
 259
 260         /* Cipher 16 */
 261         {
 262                 .valid = 1,
 263                 .name = SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
 264                 .id = SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
 265                 .algorithm_mkey = SSL_kDHE,
 266                 .algorithm_auth = SSL_aRSA,
 267                 .algorithm_enc = SSL_3DES,
 268                 .algorithm_mac = SSL_SHA1,
 269                 .algorithm_ssl = SSL_SSLV3,
 270                 .algo_strength = SSL_MEDIUM,
 271                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 272                 .strength_bits = 112,
 273                 .alg_bits = 168,
 274         },
 275
 276         /* Cipher 18 */
 277         {
 278                 .valid = 1,
 279                 .name = SSL3_TXT_ADH_RC4_128_MD5,
 280                 .id = SSL3_CK_ADH_RC4_128_MD5,
 281                 .algorithm_mkey = SSL_kDHE,
 282                 .algorithm_auth = SSL_aNULL,
 283                 .algorithm_enc = SSL_RC4,
 284                 .algorithm_mac = SSL_MD5,
 285                 .algorithm_ssl = SSL_SSLV3,
 286                 .algo_strength = SSL_LOW,
 287                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 288                 .strength_bits = 128,
 289                 .alg_bits = 128,
 290         },
 291
 292         /* Cipher 1B */
 293         {
 294                 .valid = 1,
 295                 .name = SSL3_TXT_ADH_DES_192_CBC_SHA,
 296                 .id = SSL3_CK_ADH_DES_192_CBC_SHA,
 297                 .algorithm_mkey = SSL_kDHE,
 298                 .algorithm_auth = SSL_aNULL,
 299                 .algorithm_enc = SSL_3DES,
 300                 .algorithm_mac = SSL_SHA1,
 301                 .algorithm_ssl = SSL_SSLV3,
 302                 .algo_strength = SSL_MEDIUM,
 303                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 304                 .strength_bits = 112,
 305                 .alg_bits = 168,
 306         },
 307
 308         /*
 309          * AES ciphersuites.
 310          */
 311
 312         /* Cipher 2F */
 313         {
 314                 .valid = 1,
 315                 .name = TLS1_TXT_RSA_WITH_AES_128_SHA,
 316                 .id = TLS1_CK_RSA_WITH_AES_128_SHA,
 317                 .algorithm_mkey = SSL_kRSA,
 318                 .algorithm_auth = SSL_aRSA,
 319                 .algorithm_enc = SSL_AES128,
 320                 .algorithm_mac = SSL_SHA1,
 321                 .algorithm_ssl = SSL_TLSV1,
 322                 .algo_strength = SSL_HIGH,
 323                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 324                 .strength_bits = 128,
 325                 .alg_bits = 128,
 326         },
 327
 328         /* Cipher 33 */
 329         {
 330                 .valid = 1,
 331                 .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
 332                 .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
 333                 .algorithm_mkey = SSL_kDHE,
 334                 .algorithm_auth = SSL_aRSA,
 335                 .algorithm_enc = SSL_AES128,
 336                 .algorithm_mac = SSL_SHA1,
 337                 .algorithm_ssl = SSL_TLSV1,
 338                 .algo_strength = SSL_HIGH,
 339                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 340                 .strength_bits = 128,
 341                 .alg_bits = 128,
 342         },
 343
 344         /* Cipher 34 */
 345         {
 346                 .valid = 1,
 347                 .name = TLS1_TXT_ADH_WITH_AES_128_SHA,
 348                 .id = TLS1_CK_ADH_WITH_AES_128_SHA,
 349                 .algorithm_mkey = SSL_kDHE,
 350                 .algorithm_auth = SSL_aNULL,
 351                 .algorithm_enc = SSL_AES128,
 352                 .algorithm_mac = SSL_SHA1,
 353                 .algorithm_ssl = SSL_TLSV1,
 354                 .algo_strength = SSL_HIGH,
 355                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 356                 .strength_bits = 128,
 357                 .alg_bits = 128,
 358         },
 359
 360         /* Cipher 35 */
 361         {
 362                 .valid = 1,
 363                 .name = TLS1_TXT_RSA_WITH_AES_256_SHA,
 364                 .id = TLS1_CK_RSA_WITH_AES_256_SHA,
 365                 .algorithm_mkey = SSL_kRSA,
 366                 .algorithm_auth = SSL_aRSA,
 367                 .algorithm_enc = SSL_AES256,
 368                 .algorithm_mac = SSL_SHA1,
 369                 .algorithm_ssl = SSL_TLSV1,
 370                 .algo_strength = SSL_HIGH,
 371                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 372                 .strength_bits = 256,
 373                 .alg_bits = 256,
 374         },
 375
 376         /* Cipher 39 */
 377         {
 378                 .valid = 1,
 379                 .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
 380                 .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
 381                 .algorithm_mkey = SSL_kDHE,
 382                 .algorithm_auth = SSL_aRSA,
 383                 .algorithm_enc = SSL_AES256,
 384                 .algorithm_mac = SSL_SHA1,
 385                 .algorithm_ssl = SSL_TLSV1,
 386                 .algo_strength = SSL_HIGH,
 387                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 388                 .strength_bits = 256,
 389                 .alg_bits = 256,
 390         },
 391
 392         /* Cipher 3A */
 393         {
 394                 .valid = 1,
 395                 .name = TLS1_TXT_ADH_WITH_AES_256_SHA,
 396                 .id = TLS1_CK_ADH_WITH_AES_256_SHA,
 397                 .algorithm_mkey = SSL_kDHE,
 398                 .algorithm_auth = SSL_aNULL,
 399                 .algorithm_enc = SSL_AES256,
 400                 .algorithm_mac = SSL_SHA1,
 401                 .algorithm_ssl = SSL_TLSV1,
 402                 .algo_strength = SSL_HIGH,
 403                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 404                 .strength_bits = 256,
 405                 .alg_bits = 256,
 406         },
 407
 408         /* TLS v1.2 ciphersuites */
 409         /* Cipher 3B */
 410         {
 411                 .valid = 1,
 412                 .name = TLS1_TXT_RSA_WITH_NULL_SHA256,
 413                 .id = TLS1_CK_RSA_WITH_NULL_SHA256,
 414                 .algorithm_mkey = SSL_kRSA,
 415                 .algorithm_auth = SSL_aRSA,
 416                 .algorithm_enc = SSL_eNULL,
 417                 .algorithm_mac = SSL_SHA256,
 418                 .algorithm_ssl = SSL_TLSV1_2,
 419                 .algo_strength = SSL_STRONG_NONE,
 420                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 421                 .strength_bits = 0,
 422                 .alg_bits = 0,
 423         },
 424
 425         /* Cipher 3C */
 426         {
 427                 .valid = 1,
 428                 .name = TLS1_TXT_RSA_WITH_AES_128_SHA256,
 429                 .id = TLS1_CK_RSA_WITH_AES_128_SHA256,
 430                 .algorithm_mkey = SSL_kRSA,
 431                 .algorithm_auth = SSL_aRSA,
 432                 .algorithm_enc = SSL_AES128,
 433                 .algorithm_mac = SSL_SHA256,
 434                 .algorithm_ssl = SSL_TLSV1_2,
 435                 .algo_strength = SSL_HIGH,
 436                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 437                 .strength_bits = 128,
 438                 .alg_bits = 128,
 439         },
 440
 441         /* Cipher 3D */
 442         {
 443                 .valid = 1,
 444                 .name = TLS1_TXT_RSA_WITH_AES_256_SHA256,
 445                 .id = TLS1_CK_RSA_WITH_AES_256_SHA256,
 446                 .algorithm_mkey = SSL_kRSA,
 447                 .algorithm_auth = SSL_aRSA,
 448                 .algorithm_enc = SSL_AES256,
 449                 .algorithm_mac = SSL_SHA256,
 450                 .algorithm_ssl = SSL_TLSV1_2,
 451                 .algo_strength = SSL_HIGH,
 452                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 453                 .strength_bits = 256,
 454                 .alg_bits = 256,
 455         },
 456
 457 #ifndef OPENSSL_NO_CAMELLIA
 458         /* Camellia ciphersuites from RFC4132 (128-bit portion) */
 459
 460         /* Cipher 41 */
 461         {
 462                 .valid = 1,
 463                 .name = TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
 464                 .id = TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
 465                 .algorithm_mkey = SSL_kRSA,
 466                 .algorithm_auth = SSL_aRSA,
 467                 .algorithm_enc = SSL_CAMELLIA128,
 468                 .algorithm_mac = SSL_SHA1,
 469                 .algorithm_ssl = SSL_TLSV1,
 470                 .algo_strength = SSL_HIGH,
 471                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 472                 .strength_bits = 128,
 473                 .alg_bits = 128,
 474         },
 475
 476         /* Cipher 45 */
 477         {
 478                 .valid = 1,
 479                 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
 480                 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
 481                 .algorithm_mkey = SSL_kDHE,
 482                 .algorithm_auth = SSL_aRSA,
 483                 .algorithm_enc = SSL_CAMELLIA128,
 484                 .algorithm_mac = SSL_SHA1,
 485                 .algorithm_ssl = SSL_TLSV1,
 486                 .algo_strength = SSL_HIGH,
 487                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 488                 .strength_bits = 128,
 489                 .alg_bits = 128,
 490         },
 491
 492         /* Cipher 46 */
 493         {
 494                 .valid = 1,
 495                 .name = TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
 496                 .id = TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
 497                 .algorithm_mkey = SSL_kDHE,
 498                 .algorithm_auth = SSL_aNULL,
 499                 .algorithm_enc = SSL_CAMELLIA128,
 500                 .algorithm_mac = SSL_SHA1,
 501                 .algorithm_ssl = SSL_TLSV1,
 502                 .algo_strength = SSL_HIGH,
 503                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 504                 .strength_bits = 128,
 505                 .alg_bits = 128,
 506         },
 507 #endif /* OPENSSL_NO_CAMELLIA */
 508
 509         /* TLS v1.2 ciphersuites */
 510         /* Cipher 67 */
 511         {
 512                 .valid = 1,
 513                 .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
 514                 .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
 515                 .algorithm_mkey = SSL_kDHE,
 516                 .algorithm_auth = SSL_aRSA,
 517                 .algorithm_enc = SSL_AES128,
 518                 .algorithm_mac = SSL_SHA256,
 519                 .algorithm_ssl = SSL_TLSV1_2,
 520                 .algo_strength = SSL_HIGH,
 521                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 522                 .strength_bits = 128,
 523                 .alg_bits = 128,
 524         },
 525
 526         /* Cipher 6B */
 527         {
 528                 .valid = 1,
 529                 .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
 530                 .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
 531                 .algorithm_mkey = SSL_kDHE,
 532                 .algorithm_auth = SSL_aRSA,
 533                 .algorithm_enc = SSL_AES256,
 534                 .algorithm_mac = SSL_SHA256,
 535                 .algorithm_ssl = SSL_TLSV1_2,
 536                 .algo_strength = SSL_HIGH,
 537                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 538                 .strength_bits = 256,
 539                 .alg_bits = 256,
 540         },
 541
 542         /* Cipher 6C */
 543         {
 544                 .valid = 1,
 545                 .name = TLS1_TXT_ADH_WITH_AES_128_SHA256,
 546                 .id = TLS1_CK_ADH_WITH_AES_128_SHA256,
 547                 .algorithm_mkey = SSL_kDHE,
 548                 .algorithm_auth = SSL_aNULL,
 549                 .algorithm_enc = SSL_AES128,
 550                 .algorithm_mac = SSL_SHA256,
 551                 .algorithm_ssl = SSL_TLSV1_2,
 552                 .algo_strength = SSL_HIGH,
 553                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 554                 .strength_bits = 128,
 555                 .alg_bits = 128,
 556         },
 557
 558         /* Cipher 6D */
 559         {
 560                 .valid = 1,
 561                 .name = TLS1_TXT_ADH_WITH_AES_256_SHA256,
 562                 .id = TLS1_CK_ADH_WITH_AES_256_SHA256,
 563                 .algorithm_mkey = SSL_kDHE,
 564                 .algorithm_auth = SSL_aNULL,
 565                 .algorithm_enc = SSL_AES256,
 566                 .algorithm_mac = SSL_SHA256,
 567                 .algorithm_ssl = SSL_TLSV1_2,
 568                 .algo_strength = SSL_HIGH,
 569                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 570                 .strength_bits = 256,
 571                 .alg_bits = 256,
 572         },
 573
 574         /* GOST Ciphersuites */
 575
 576         /* Cipher 81 */
 577         {
 578                 .valid = 1,
 579                 .name = "GOST2001-GOST89-GOST89",
 580                 .id = 0x3000081,
 581                 .algorithm_mkey = SSL_kGOST,
 582                 .algorithm_auth = SSL_aGOST01,
 583                 .algorithm_enc = SSL_eGOST2814789CNT,
 584                 .algorithm_mac = SSL_GOST89MAC,
 585                 .algorithm_ssl = SSL_TLSV1,
 586                 .algo_strength = SSL_HIGH,
 587                 .algorithm2 = SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|
 588                     TLS1_STREAM_MAC,
 589                 .strength_bits = 256,
 590                 .alg_bits = 256
 591         },
 592
 593         /* Cipher 83 */
 594         {
 595                 .valid = 1,
 596                 .name = "GOST2001-NULL-GOST94",
 597                 .id = 0x3000083,
 598                 .algorithm_mkey = SSL_kGOST,
 599                 .algorithm_auth = SSL_aGOST01,
 600                 .algorithm_enc = SSL_eNULL,
 601                 .algorithm_mac = SSL_GOST94,
 602                 .algorithm_ssl = SSL_TLSV1,
 603                 .algo_strength = SSL_STRONG_NONE,
 604                 .algorithm2 = SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
 605                 .strength_bits = 0,
 606                 .alg_bits = 0
 607         },
 608
 609 #ifndef OPENSSL_NO_CAMELLIA
 610         /* Camellia ciphersuites from RFC4132 (256-bit portion) */
 611
 612         /* Cipher 84 */
 613         {
 614                 .valid = 1,
 615                 .name = TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
 616                 .id = TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
 617                 .algorithm_mkey = SSL_kRSA,
 618                 .algorithm_auth = SSL_aRSA,
 619                 .algorithm_enc = SSL_CAMELLIA256,
 620                 .algorithm_mac = SSL_SHA1,
 621                 .algorithm_ssl = SSL_TLSV1,
 622                 .algo_strength = SSL_HIGH,
 623                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 624                 .strength_bits = 256,
 625                 .alg_bits = 256,
 626         },
 627
 628         /* Cipher 88 */
 629         {
 630                 .valid = 1,
 631                 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
 632                 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
 633                 .algorithm_mkey = SSL_kDHE,
 634                 .algorithm_auth = SSL_aRSA,
 635                 .algorithm_enc = SSL_CAMELLIA256,
 636                 .algorithm_mac = SSL_SHA1,
 637                 .algorithm_ssl = SSL_TLSV1,
 638                 .algo_strength = SSL_HIGH,
 639                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 640                 .strength_bits = 256,
 641                 .alg_bits = 256,
 642         },
 643
 644         /* Cipher 89 */
 645         {
 646                 .valid = 1,
 647                 .name = TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
 648                 .id = TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
 649                 .algorithm_mkey = SSL_kDHE,
 650                 .algorithm_auth = SSL_aNULL,
 651                 .algorithm_enc = SSL_CAMELLIA256,
 652                 .algorithm_mac = SSL_SHA1,
 653                 .algorithm_ssl = SSL_TLSV1,
 654                 .algo_strength = SSL_HIGH,
 655                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 656                 .strength_bits = 256,
 657                 .alg_bits = 256,
 658         },
 659 #endif /* OPENSSL_NO_CAMELLIA */
 660
 661         /*
 662          * GCM ciphersuites from RFC5288.
 663          */
 664
 665         /* Cipher 9C */
 666         {
 667                 .valid = 1,
 668                 .name = TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
 669                 .id = TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
 670                 .algorithm_mkey = SSL_kRSA,
 671                 .algorithm_auth = SSL_aRSA,
 672                 .algorithm_enc = SSL_AES128GCM,
 673                 .algorithm_mac = SSL_AEAD,
 674                 .algorithm_ssl = SSL_TLSV1_2,
 675                 .algo_strength = SSL_HIGH,
 676                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
 677                     FIXED_NONCE_LEN(4)|
 678                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
 679                 .strength_bits = 128,
 680                 .alg_bits = 128,
 681         },
 682
 683         /* Cipher 9D */
 684         {
 685                 .valid = 1,
 686                 .name = TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
 687                 .id = TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
 688                 .algorithm_mkey = SSL_kRSA,
 689                 .algorithm_auth = SSL_aRSA,
 690                 .algorithm_enc = SSL_AES256GCM,
 691                 .algorithm_mac = SSL_AEAD,
 692                 .algorithm_ssl = SSL_TLSV1_2,
 693                 .algo_strength = SSL_HIGH,
 694                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
 695                     FIXED_NONCE_LEN(4)|
 696                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
 697                 .strength_bits = 256,
 698                 .alg_bits = 256,
 699         },
 700
 701         /* Cipher 9E */
 702         {
 703                 .valid = 1,
 704                 .name = TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
 705                 .id = TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
 706                 .algorithm_mkey = SSL_kDHE,
 707                 .algorithm_auth = SSL_aRSA,
 708                 .algorithm_enc = SSL_AES128GCM,
 709                 .algorithm_mac = SSL_AEAD,
 710                 .algorithm_ssl = SSL_TLSV1_2,
 711                 .algo_strength = SSL_HIGH,
 712                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
 713                     FIXED_NONCE_LEN(4)|
 714                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
 715                 .strength_bits = 128,
 716                 .alg_bits = 128,
 717         },
 718
 719         /* Cipher 9F */
 720         {
 721                 .valid = 1,
 722                 .name = TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
 723                 .id = TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
 724                 .algorithm_mkey = SSL_kDHE,
 725                 .algorithm_auth = SSL_aRSA,
 726                 .algorithm_enc = SSL_AES256GCM,
 727                 .algorithm_mac = SSL_AEAD,
 728                 .algorithm_ssl = SSL_TLSV1_2,
 729                 .algo_strength = SSL_HIGH,
 730                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
 731                     FIXED_NONCE_LEN(4)|
 732                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
 733                 .strength_bits = 256,
 734                 .alg_bits = 256,
 735         },
 736
 737         /* Cipher A6 */
 738         {
 739                 .valid = 1,
 740                 .name = TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
 741                 .id = TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
 742                 .algorithm_mkey = SSL_kDHE,
 743                 .algorithm_auth = SSL_aNULL,
 744                 .algorithm_enc = SSL_AES128GCM,
 745                 .algorithm_mac = SSL_AEAD,
 746                 .algorithm_ssl = SSL_TLSV1_2,
 747                 .algo_strength = SSL_HIGH,
 748                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
 749                     FIXED_NONCE_LEN(4)|
 750                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
 751                 .strength_bits = 128,
 752                 .alg_bits = 128,
 753         },
 754
 755         /* Cipher A7 */
 756         {
 757                 .valid = 1,
 758                 .name = TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
 759                 .id = TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
 760                 .algorithm_mkey = SSL_kDHE,
 761                 .algorithm_auth = SSL_aNULL,
 762                 .algorithm_enc = SSL_AES256GCM,
 763                 .algorithm_mac = SSL_AEAD,
 764                 .algorithm_ssl = SSL_TLSV1_2,
 765                 .algo_strength = SSL_HIGH,
 766                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
 767                     FIXED_NONCE_LEN(4)|
 768                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
 769                 .strength_bits = 256,
 770                 .alg_bits = 256,
 771         },
 772
 773 #ifndef OPENSSL_NO_CAMELLIA
 774         /* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
 775
 776         /* Cipher BA */
 777         {
 778                 .valid = 1,
 779                 .name = TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256,
 780                 .id = TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256,
 781                 .algorithm_mkey = SSL_kRSA,
 782                 .algorithm_auth = SSL_aRSA,
 783                 .algorithm_enc = SSL_CAMELLIA128,
 784                 .algorithm_mac = SSL_SHA256,
 785                 .algorithm_ssl = SSL_TLSV1_2,
 786                 .algo_strength = SSL_HIGH,
 787                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 788                 .strength_bits = 128,
 789                 .alg_bits = 128,
 790         },
 791
 792         /* Cipher BE */
 793         {
 794                 .valid = 1,
 795                 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
 796                 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
 797                 .algorithm_mkey = SSL_kDHE,
 798                 .algorithm_auth = SSL_aRSA,
 799                 .algorithm_enc = SSL_CAMELLIA128,
 800                 .algorithm_mac = SSL_SHA256,
 801                 .algorithm_ssl = SSL_TLSV1_2,
 802                 .algo_strength = SSL_HIGH,
 803                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 804                 .strength_bits = 128,
 805                 .alg_bits = 128,
 806         },
 807
 808         /* Cipher BF */
 809         {
 810                 .valid = 1,
 811                 .name = TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256,
 812                 .id = TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256,
 813                 .algorithm_mkey = SSL_kDHE,
 814                 .algorithm_auth = SSL_aNULL,
 815                 .algorithm_enc = SSL_CAMELLIA128,
 816                 .algorithm_mac = SSL_SHA256,
 817                 .algorithm_ssl = SSL_TLSV1_2,
 818                 .algo_strength = SSL_HIGH,
 819                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 820                 .strength_bits = 128,
 821                 .alg_bits = 128,
 822         },
 823
 824         /* Cipher C0 */
 825         {
 826                 .valid = 1,
 827                 .name = TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256,
 828                 .id = TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256,
 829                 .algorithm_mkey = SSL_kRSA,
 830                 .algorithm_auth = SSL_aRSA,
 831                 .algorithm_enc = SSL_CAMELLIA256,
 832                 .algorithm_mac = SSL_SHA256,
 833                 .algorithm_ssl = SSL_TLSV1_2,
 834                 .algo_strength = SSL_HIGH,
 835                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 836                 .strength_bits = 256,
 837                 .alg_bits = 256,
 838         },
 839
 840         /* Cipher C4 */
 841         {
 842                 .valid = 1,
 843                 .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
 844                 .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
 845                 .algorithm_mkey = SSL_kDHE,
 846                 .algorithm_auth = SSL_aRSA,
 847                 .algorithm_enc = SSL_CAMELLIA256,
 848                 .algorithm_mac = SSL_SHA256,
 849                 .algorithm_ssl = SSL_TLSV1_2,
 850                 .algo_strength = SSL_HIGH,
 851                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 852                 .strength_bits = 256,
 853                 .alg_bits = 256,
 854         },
 855
 856         /* Cipher C5 */
 857         {
 858                 .valid = 1,
 859                 .name = TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256,
 860                 .id = TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256,
 861                 .algorithm_mkey = SSL_kDHE,
 862                 .algorithm_auth = SSL_aNULL,
 863                 .algorithm_enc = SSL_CAMELLIA256,
 864                 .algorithm_mac = SSL_SHA256,
 865                 .algorithm_ssl = SSL_TLSV1_2,
 866                 .algo_strength = SSL_HIGH,
 867                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 868                 .strength_bits = 256,
 869                 .alg_bits = 256,
 870         },
 871 #endif /* OPENSSL_NO_CAMELLIA */
 872
 873         /*
 874          * TLSv1.3 cipher suites.
 875          */
 876
 877 #ifdef LIBRESSL_HAS_TLS1_3
 878         /* Cipher 1301 */
 879         {
 880                 .valid = 1,
 881                 .name = TLS1_3_TXT_AES_128_GCM_SHA256,
 882                 .id = TLS1_3_CK_AES_128_GCM_SHA256,
 883                 .algorithm_mkey = SSL_kTLS1_3,
 884                 .algorithm_auth = SSL_aTLS1_3,
 885                 .algorithm_enc = SSL_AES128GCM,
 886                 .algorithm_mac = SSL_AEAD,
 887                 .algorithm_ssl = SSL_TLSV1_3,
 888                 .algo_strength = SSL_HIGH,
 889                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256, /* XXX */
 890                 .strength_bits = 128,
 891                 .alg_bits = 128,
 892         },
 893
 894         /* Cipher 1302 */
 895         {
 896                 .valid = 1,
 897                 .name = TLS1_3_TXT_AES_256_GCM_SHA384,
 898                 .id = TLS1_3_CK_AES_256_GCM_SHA384,
 899                 .algorithm_mkey = SSL_kTLS1_3,
 900                 .algorithm_auth = SSL_aTLS1_3,
 901                 .algorithm_enc = SSL_AES256GCM,
 902                 .algorithm_mac = SSL_AEAD,
 903                 .algorithm_ssl = SSL_TLSV1_3,
 904                 .algo_strength = SSL_HIGH,
 905                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384, /* XXX */
 906                 .strength_bits = 256,
 907                 .alg_bits = 256,
 908         },
 909
 910         /* Cipher 1303 */
 911         {
 912                 .valid = 1,
 913                 .name = TLS1_3_TXT_CHACHA20_POLY1305_SHA256,
 914                 .id = TLS1_3_CK_CHACHA20_POLY1305_SHA256,
 915                 .algorithm_mkey = SSL_kTLS1_3,
 916                 .algorithm_auth = SSL_aTLS1_3,
 917                 .algorithm_enc = SSL_CHACHA20POLY1305,
 918                 .algorithm_mac = SSL_AEAD,
 919                 .algorithm_ssl = SSL_TLSV1_3,
 920                 .algo_strength = SSL_HIGH,
 921                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256, /* XXX */
 922                 .strength_bits = 256,
 923                 .alg_bits = 256,
 924         },
 925 #endif
 926
 927         /* Cipher C006 */
 928         {
 929                 .valid = 1,
 930                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
 931                 .id = TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
 932                 .algorithm_mkey = SSL_kECDHE,
 933                 .algorithm_auth = SSL_aECDSA,
 934                 .algorithm_enc = SSL_eNULL,
 935                 .algorithm_mac = SSL_SHA1,
 936                 .algorithm_ssl = SSL_TLSV1,
 937                 .algo_strength = SSL_STRONG_NONE,
 938                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 939                 .strength_bits = 0,
 940                 .alg_bits = 0,
 941         },
 942
 943         /* Cipher C007 */
 944         {
 945                 .valid = 1,
 946                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
 947                 .id = TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
 948                 .algorithm_mkey = SSL_kECDHE,
 949                 .algorithm_auth = SSL_aECDSA,
 950                 .algorithm_enc = SSL_RC4,
 951                 .algorithm_mac = SSL_SHA1,
 952                 .algorithm_ssl = SSL_TLSV1,
 953                 .algo_strength = SSL_LOW,
 954                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 955                 .strength_bits = 128,
 956                 .alg_bits = 128,
 957         },
 958
 959         /* Cipher C008 */
 960         {
 961                 .valid = 1,
 962                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
 963                 .id = TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
 964                 .algorithm_mkey = SSL_kECDHE,
 965                 .algorithm_auth = SSL_aECDSA,
 966                 .algorithm_enc = SSL_3DES,
 967                 .algorithm_mac = SSL_SHA1,
 968                 .algorithm_ssl = SSL_TLSV1,
 969                 .algo_strength = SSL_MEDIUM,
 970                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 971                 .strength_bits = 112,
 972                 .alg_bits = 168,
 973         },
 974
 975         /* Cipher C009 */
 976         {
 977                 .valid = 1,
 978                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
 979                 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
 980                 .algorithm_mkey = SSL_kECDHE,
 981                 .algorithm_auth = SSL_aECDSA,
 982                 .algorithm_enc = SSL_AES128,
 983                 .algorithm_mac = SSL_SHA1,
 984                 .algorithm_ssl = SSL_TLSV1,
 985                 .algo_strength = SSL_HIGH,
 986                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
 987                 .strength_bits = 128,
 988                 .alg_bits = 128,
 989         },
 990
 991         /* Cipher C00A */
 992         {
 993                 .valid = 1,
 994                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
 995                 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
 996                 .algorithm_mkey = SSL_kECDHE,
 997                 .algorithm_auth = SSL_aECDSA,
 998                 .algorithm_enc = SSL_AES256,
 999                 .algorithm_mac = SSL_SHA1,
1000                 .algorithm_ssl = SSL_TLSV1,
1001                 .algo_strength = SSL_HIGH,
1002                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1003                 .strength_bits = 256,
1004                 .alg_bits = 256,
1005         },
1006
1007         /* Cipher C010 */
1008         {
1009                 .valid = 1,
1010                 .name = TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
1011                 .id = TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
1012                 .algorithm_mkey = SSL_kECDHE,
1013                 .algorithm_auth = SSL_aRSA,
1014                 .algorithm_enc = SSL_eNULL,
1015                 .algorithm_mac = SSL_SHA1,
1016                 .algorithm_ssl = SSL_TLSV1,
1017                 .algo_strength = SSL_STRONG_NONE,
1018                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1019                 .strength_bits = 0,
1020                 .alg_bits = 0,
1021         },
1022
1023         /* Cipher C011 */
1024         {
1025                 .valid = 1,
1026                 .name = TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
1027                 .id = TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
1028                 .algorithm_mkey = SSL_kECDHE,
1029                 .algorithm_auth = SSL_aRSA,
1030                 .algorithm_enc = SSL_RC4,
1031                 .algorithm_mac = SSL_SHA1,
1032                 .algorithm_ssl = SSL_TLSV1,
1033                 .algo_strength = SSL_LOW,
1034                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1035                 .strength_bits = 128,
1036                 .alg_bits = 128,
1037         },
1038
1039         /* Cipher C012 */
1040         {
1041                 .valid = 1,
1042                 .name = TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1043                 .id = TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
1044                 .algorithm_mkey = SSL_kECDHE,
1045                 .algorithm_auth = SSL_aRSA,
1046                 .algorithm_enc = SSL_3DES,
1047                 .algorithm_mac = SSL_SHA1,
1048                 .algorithm_ssl = SSL_TLSV1,
1049                 .algo_strength = SSL_MEDIUM,
1050                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1051                 .strength_bits = 112,
1052                 .alg_bits = 168,
1053         },
1054
1055         /* Cipher C013 */
1056         {
1057                 .valid = 1,
1058                 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1059                 .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
1060                 .algorithm_mkey = SSL_kECDHE,
1061                 .algorithm_auth = SSL_aRSA,
1062                 .algorithm_enc = SSL_AES128,
1063                 .algorithm_mac = SSL_SHA1,
1064                 .algorithm_ssl = SSL_TLSV1,
1065                 .algo_strength = SSL_HIGH,
1066                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1067                 .strength_bits = 128,
1068                 .alg_bits = 128,
1069         },
1070
1071         /* Cipher C014 */
1072         {
1073                 .valid = 1,
1074                 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1075                 .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
1076                 .algorithm_mkey = SSL_kECDHE,
1077                 .algorithm_auth = SSL_aRSA,
1078                 .algorithm_enc = SSL_AES256,
1079                 .algorithm_mac = SSL_SHA1,
1080                 .algorithm_ssl = SSL_TLSV1,
1081                 .algo_strength = SSL_HIGH,
1082                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1083                 .strength_bits = 256,
1084                 .alg_bits = 256,
1085         },
1086
1087         /* Cipher C015 */
1088         {
1089                 .valid = 1,
1090                 .name = TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
1091                 .id = TLS1_CK_ECDH_anon_WITH_NULL_SHA,
1092                 .algorithm_mkey = SSL_kECDHE,
1093                 .algorithm_auth = SSL_aNULL,
1094                 .algorithm_enc = SSL_eNULL,
1095                 .algorithm_mac = SSL_SHA1,
1096                 .algorithm_ssl = SSL_TLSV1,
1097                 .algo_strength = SSL_STRONG_NONE,
1098                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1099                 .strength_bits = 0,
1100                 .alg_bits = 0,
1101         },
1102
1103         /* Cipher C016 */
1104         {
1105                 .valid = 1,
1106                 .name = TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
1107                 .id = TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
1108                 .algorithm_mkey = SSL_kECDHE,
1109                 .algorithm_auth = SSL_aNULL,
1110                 .algorithm_enc = SSL_RC4,
1111                 .algorithm_mac = SSL_SHA1,
1112                 .algorithm_ssl = SSL_TLSV1,
1113                 .algo_strength = SSL_LOW,
1114                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1115                 .strength_bits = 128,
1116                 .alg_bits = 128,
1117         },
1118
1119         /* Cipher C017 */
1120         {
1121                 .valid = 1,
1122                 .name = TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
1123                 .id = TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
1124                 .algorithm_mkey = SSL_kECDHE,
1125                 .algorithm_auth = SSL_aNULL,
1126                 .algorithm_enc = SSL_3DES,
1127                 .algorithm_mac = SSL_SHA1,
1128                 .algorithm_ssl = SSL_TLSV1,
1129                 .algo_strength = SSL_MEDIUM,
1130                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1131                 .strength_bits = 112,
1132                 .alg_bits = 168,
1133         },
1134
1135         /* Cipher C018 */
1136         {
1137                 .valid = 1,
1138                 .name = TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
1139                 .id = TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
1140                 .algorithm_mkey = SSL_kECDHE,
1141                 .algorithm_auth = SSL_aNULL,
1142                 .algorithm_enc = SSL_AES128,
1143                 .algorithm_mac = SSL_SHA1,
1144                 .algorithm_ssl = SSL_TLSV1,
1145                 .algo_strength = SSL_HIGH,
1146                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1147                 .strength_bits = 128,
1148                 .alg_bits = 128,
1149         },
1150
1151         /* Cipher C019 */
1152         {
1153                 .valid = 1,
1154                 .name = TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
1155                 .id = TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
1156                 .algorithm_mkey = SSL_kECDHE,
1157                 .algorithm_auth = SSL_aNULL,
1158                 .algorithm_enc = SSL_AES256,
1159                 .algorithm_mac = SSL_SHA1,
1160                 .algorithm_ssl = SSL_TLSV1,
1161                 .algo_strength = SSL_HIGH,
1162                 .algorithm2 = SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1163                 .strength_bits = 256,
1164                 .alg_bits = 256,
1165         },
1166
1167
1168         /* HMAC based TLS v1.2 ciphersuites from RFC5289 */
1169
1170         /* Cipher C023 */
1171         {
1172                 .valid = 1,
1173                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
1174                 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
1175                 .algorithm_mkey = SSL_kECDHE,
1176                 .algorithm_auth = SSL_aECDSA,
1177                 .algorithm_enc = SSL_AES128,
1178                 .algorithm_mac = SSL_SHA256,
1179                 .algorithm_ssl = SSL_TLSV1_2,
1180                 .algo_strength = SSL_HIGH,
1181                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1182                 .strength_bits = 128,
1183                 .alg_bits = 128,
1184         },
1185
1186         /* Cipher C024 */
1187         {
1188                 .valid = 1,
1189                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
1190                 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
1191                 .algorithm_mkey = SSL_kECDHE,
1192                 .algorithm_auth = SSL_aECDSA,
1193                 .algorithm_enc = SSL_AES256,
1194                 .algorithm_mac = SSL_SHA384,
1195                 .algorithm_ssl = SSL_TLSV1_2,
1196                 .algo_strength = SSL_HIGH,
1197                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1198                 .strength_bits = 256,
1199                 .alg_bits = 256,
1200         },
1201
1202         /* Cipher C027 */
1203         {
1204                 .valid = 1,
1205                 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
1206                 .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
1207                 .algorithm_mkey = SSL_kECDHE,
1208                 .algorithm_auth = SSL_aRSA,
1209                 .algorithm_enc = SSL_AES128,
1210                 .algorithm_mac = SSL_SHA256,
1211                 .algorithm_ssl = SSL_TLSV1_2,
1212                 .algo_strength = SSL_HIGH,
1213                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
1214                 .strength_bits = 128,
1215                 .alg_bits = 128,
1216         },
1217
1218         /* Cipher C028 */
1219         {
1220                 .valid = 1,
1221                 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
1222                 .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
1223                 .algorithm_mkey = SSL_kECDHE,
1224                 .algorithm_auth = SSL_aRSA,
1225                 .algorithm_enc = SSL_AES256,
1226                 .algorithm_mac = SSL_SHA384,
1227                 .algorithm_ssl = SSL_TLSV1_2,
1228                 .algo_strength = SSL_HIGH,
1229                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
1230                 .strength_bits = 256,
1231                 .alg_bits = 256,
1232         },
1233
1234         /* GCM based TLS v1.2 ciphersuites from RFC5289 */
1235
1236         /* Cipher C02B */
1237         {
1238                 .valid = 1,
1239                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1240                 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1241                 .algorithm_mkey = SSL_kECDHE,
1242                 .algorithm_auth = SSL_aECDSA,
1243                 .algorithm_enc = SSL_AES128GCM,
1244                 .algorithm_mac = SSL_AEAD,
1245                 .algorithm_ssl = SSL_TLSV1_2,
1246                 .algo_strength = SSL_HIGH,
1247                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1248                     FIXED_NONCE_LEN(4)|
1249                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1250                 .strength_bits = 128,
1251                 .alg_bits = 128,
1252         },
1253
1254         /* Cipher C02C */
1255         {
1256                 .valid = 1,
1257                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1258                 .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
1259                 .algorithm_mkey = SSL_kECDHE,
1260                 .algorithm_auth = SSL_aECDSA,
1261                 .algorithm_enc = SSL_AES256GCM,
1262                 .algorithm_mac = SSL_AEAD,
1263                 .algorithm_ssl = SSL_TLSV1_2,
1264                 .algo_strength = SSL_HIGH,
1265                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
1266                     FIXED_NONCE_LEN(4)|
1267                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1268                 .strength_bits = 256,
1269                 .alg_bits = 256,
1270         },
1271
1272         /* Cipher C02F */
1273         {
1274                 .valid = 1,
1275                 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1276                 .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1277                 .algorithm_mkey = SSL_kECDHE,
1278                 .algorithm_auth = SSL_aRSA,
1279                 .algorithm_enc = SSL_AES128GCM,
1280                 .algorithm_mac = SSL_AEAD,
1281                 .algorithm_ssl = SSL_TLSV1_2,
1282                 .algo_strength = SSL_HIGH,
1283                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1284                     FIXED_NONCE_LEN(4)|
1285                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1286                 .strength_bits = 128,
1287                 .alg_bits = 128,
1288         },
1289
1290         /* Cipher C030 */
1291         {
1292                 .valid = 1,
1293                 .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1294                 .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
1295                 .algorithm_mkey = SSL_kECDHE,
1296                 .algorithm_auth = SSL_aRSA,
1297                 .algorithm_enc = SSL_AES256GCM,
1298                 .algorithm_mac = SSL_AEAD,
1299                 .algorithm_ssl = SSL_TLSV1_2,
1300                 .algo_strength = SSL_HIGH,
1301                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384|
1302                     FIXED_NONCE_LEN(4)|
1303                     SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD,
1304                 .strength_bits = 256,
1305                 .alg_bits = 256,
1306         },
1307
1308         /* Cipher CCA8 */
1309         {
1310                 .valid = 1,
1311                 .name = TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
1312                 .id = TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305,
1313                 .algorithm_mkey = SSL_kECDHE,
1314                 .algorithm_auth = SSL_aRSA,
1315                 .algorithm_enc = SSL_CHACHA20POLY1305,
1316                 .algorithm_mac = SSL_AEAD,
1317                 .algorithm_ssl = SSL_TLSV1_2,
1318                 .algo_strength = SSL_HIGH,
1319                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1320                     FIXED_NONCE_LEN(12),
1321                 .strength_bits = 256,
1322                 .alg_bits = 256,
1323         },
1324
1325         /* Cipher CCA9 */
1326         {
1327                 .valid = 1,
1328                 .name = TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
1329                 .id = TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305,
1330                 .algorithm_mkey = SSL_kECDHE,
1331                 .algorithm_auth = SSL_aECDSA,
1332                 .algorithm_enc = SSL_CHACHA20POLY1305,
1333                 .algorithm_mac = SSL_AEAD,
1334                 .algorithm_ssl = SSL_TLSV1_2,
1335                 .algo_strength = SSL_HIGH,
1336                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1337                     FIXED_NONCE_LEN(12),
1338                 .strength_bits = 256,
1339                 .alg_bits = 256,
1340         },
1341
1342         /* Cipher CCAA */
1343         {
1344                 .valid = 1,
1345                 .name = TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
1346                 .id = TLS1_CK_DHE_RSA_CHACHA20_POLY1305,
1347                 .algorithm_mkey = SSL_kDHE,
1348                 .algorithm_auth = SSL_aRSA,
1349                 .algorithm_enc = SSL_CHACHA20POLY1305,
1350                 .algorithm_mac = SSL_AEAD,
1351                 .algorithm_ssl = SSL_TLSV1_2,
1352                 .algo_strength = SSL_HIGH,
1353                 .algorithm2 = SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|
1354                     FIXED_NONCE_LEN(12),
1355                 .strength_bits = 256,
1356                 .alg_bits = 256,
1357         },
1358
1359         /* Cipher FF85 FIXME IANA */
1360         {
1361                 .valid = 1,
1362                 .name = "GOST2012256-GOST89-GOST89",
1363                 .id = 0x300ff85, /* FIXME IANA */
1364                 .algorithm_mkey = SSL_kGOST,
1365                 .algorithm_auth = SSL_aGOST01,
1366                 .algorithm_enc = SSL_eGOST2814789CNT,
1367                 .algorithm_mac = SSL_GOST89MAC,
1368                 .algorithm_ssl = SSL_TLSV1,
1369                 .algo_strength = SSL_HIGH,
1370                 .algorithm2 = SSL_HANDSHAKE_MAC_STREEBOG256|TLS1_PRF_STREEBOG256|
1371                     TLS1_STREAM_MAC,
1372                 .strength_bits = 256,
1373                 .alg_bits = 256
1374         },
1375
1376         /* Cipher FF87 FIXME IANA */
1377         {
1378                 .valid = 1,
1379                 .name = "GOST2012256-NULL-STREEBOG256",
1380                 .id = 0x300ff87, /* FIXME IANA */
1381                 .algorithm_mkey = SSL_kGOST,
1382                 .algorithm_auth = SSL_aGOST01,
1383                 .algorithm_enc = SSL_eNULL,
1384                 .algorithm_mac = SSL_STREEBOG256,
1385                 .algorithm_ssl = SSL_TLSV1,
1386                 .algo_strength = SSL_STRONG_NONE,
1387                 .algorithm2 = SSL_HANDSHAKE_MAC_STREEBOG256|TLS1_PRF_STREEBOG256,
1388                 .strength_bits = 0,
1389                 .alg_bits = 0
1390         },
1391
1392
1393         /* end of list */
1394 };
1395
1396 int
1397 ssl3_num_ciphers(void)
1398 {
1399         return (SSL3_NUM_CIPHERS);
1400 }
1401
1402 const SSL_CIPHER *
1403 ssl3_get_cipher(unsigned int u)
1404 {
1405         if (u < SSL3_NUM_CIPHERS)
1406                 return (&(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]));
1407         else
1408                 return (NULL);
1409 }
1410
1411 const SSL_CIPHER *
1412 ssl3_get_cipher_by_id(unsigned int id)
1413 {
1414         const SSL_CIPHER *cp;
1415         SSL_CIPHER c;
1416
1417         c.id = id;
1418         cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
1419         if (cp != NULL && cp->valid == 1)
1420                 return (cp);
1421
1422         return (NULL);
1423 }
1424
1425 const SSL_CIPHER *
1426 ssl3_get_cipher_by_value(uint16_t value)
1427 {
1428         return ssl3_get_cipher_by_id(SSL3_CK_ID | value);
1429 }
1430
1431 uint16_t
1432 ssl3_cipher_get_value(const SSL_CIPHER *c)
1433 {
1434         return (c->id & SSL3_CK_VALUE_MASK);
1435 }
1436
1437 int
1438 ssl3_pending(const SSL *s)
1439 {
1440         if (s->internal->rstate == SSL_ST_READ_BODY)
1441                 return 0;
1442
1443         return (S3I(s)->rrec.type == SSL3_RT_APPLICATION_DATA) ?
1444             S3I(s)->rrec.length : 0;
1445 }
1446
1447 int
1448 ssl3_handshake_msg_hdr_len(SSL *s)
1449 {
1450         return (SSL_IS_DTLS(s) ? DTLS1_HM_HEADER_LENGTH :
1451             SSL3_HM_HEADER_LENGTH);
1452 }
1453
1454 int
1455 ssl3_handshake_msg_start(SSL *s, CBB *handshake, CBB *body, uint8_t msg_type)
1456 {
1457         int ret = 0;
1458
1459         if (!CBB_init(handshake, SSL3_RT_MAX_PLAIN_LENGTH))
1460                 goto err;
1461         if (!CBB_add_u8(handshake, msg_type))
1462                 goto err;
1463         if (SSL_IS_DTLS(s)) {
1464                 unsigned char *data;
1465
1466                 if (!CBB_add_space(handshake, &data, DTLS1_HM_HEADER_LENGTH -
1467                     SSL3_HM_HEADER_LENGTH))
1468                         goto err;
1469         }
1470         if (!CBB_add_u24_length_prefixed(handshake, body))
1471                 goto err;
1472
1473         ret = 1;
1474
1475  err:
1476         return (ret);
1477 }
1478
1479 int
1480 ssl3_handshake_msg_finish(SSL *s, CBB *handshake)
1481 {
1482         unsigned char *data = NULL;
1483         size_t outlen;
1484         int ret = 0;
1485
1486         if (!CBB_finish(handshake, &data, &outlen))
1487                 goto err;
1488
1489         if (outlen > INT_MAX)
1490                 goto err;
1491
1492         if (!BUF_MEM_grow_clean(s->internal->init_buf, outlen))
1493                 goto err;
1494
1495         memcpy(s->internal->init_buf->data, data, outlen);
1496
1497         s->internal->init_num = (int)outlen;
1498         s->internal->init_off = 0;
1499
1500         if (SSL_IS_DTLS(s)) {
1501                 unsigned long len;
1502                 uint8_t msg_type;
1503                 CBS cbs;
1504
1505                 CBS_init(&cbs, data, outlen);
1506                 if (!CBS_get_u8(&cbs, &msg_type))
1507                         goto err;
1508
1509                 len = outlen - ssl3_handshake_msg_hdr_len(s);
1510
1511                 dtls1_set_message_header(s, msg_type, len, 0, len);
1512                 dtls1_buffer_message(s, 0);
1513         }
1514
1515         ret = 1;
1516
1517  err:
1518         free(data);
1519
1520         return (ret);
1521 }
1522
1523 int
1524 ssl3_handshake_write(SSL *s)
1525 {
1526         return ssl3_record_write(s, SSL3_RT_HANDSHAKE);
1527 }
1528
1529 int
1530 ssl3_record_write(SSL *s, int type)
1531 {
1532         if (SSL_IS_DTLS(s))
1533                 return dtls1_do_write(s, type);
1534
1535         return ssl3_do_write(s, type);
1536 }
1537
1538 int
1539 ssl3_new(SSL *s)
1540 {
1541         if ((s->s3 = calloc(1, sizeof(*s->s3))) == NULL)
1542                 return (0);
1543         if ((S3I(s) = calloc(1, sizeof(*S3I(s)))) == NULL) {
1544                 free(s->s3);
1545                 return (0);
1546         }
1547
1548         s->method->internal->ssl_clear(s);
1549
1550         return (1);
1551 }
1552
1553 void
1554 ssl3_free(SSL *s)
1555 {
1556         if (s == NULL)
1557                 return;
1558
1559         tls1_cleanup_key_block(s);
1560         ssl3_release_read_buffer(s);
1561         ssl3_release_write_buffer(s);
1562         freezero(S3I(s)->hs.sigalgs, S3I(s)->hs.sigalgs_len);
1563
1564         DH_free(S3I(s)->tmp.dh);
1565         EC_KEY_free(S3I(s)->tmp.ecdh);
1566         freezero(S3I(s)->tmp.x25519, X25519_KEY_LENGTH);
1567
1568         tls13_key_share_free(S3I(s)->hs_tls13.key_share);
1569         tls13_secrets_destroy(S3I(s)->hs_tls13.secrets);
1570         freezero(S3I(s)->hs_tls13.cookie, S3I(s)->hs_tls13.cookie_len);
1571
1572         sk_X509_NAME_pop_free(S3I(s)->tmp.ca_names, X509_NAME_free);
1573
1574         tls1_transcript_free(s);
1575         tls1_transcript_hash_free(s);
1576
1577         free(S3I(s)->alpn_selected);
1578
1579         freezero(S3I(s), sizeof(*S3I(s)));
1580         freezero(s->s3, sizeof(*s->s3));
1581
1582         s->s3 = NULL;
1583 }
1584
1585 void
1586 ssl3_clear(SSL *s)
1587 {
1588         struct ssl3_state_internal_st *internal;
1589         unsigned char   *rp, *wp;
1590         size_t           rlen, wlen;
1591
1592         tls1_cleanup_key_block(s);
1593         sk_X509_NAME_pop_free(S3I(s)->tmp.ca_names, X509_NAME_free);
1594
1595         DH_free(S3I(s)->tmp.dh);
1596         S3I(s)->tmp.dh = NULL;
1597         EC_KEY_free(S3I(s)->tmp.ecdh);
1598         S3I(s)->tmp.ecdh = NULL;
1599         S3I(s)->tmp.ecdh_nid = NID_undef;
1600         freezero(S3I(s)->tmp.x25519, X25519_KEY_LENGTH);
1601         S3I(s)->tmp.x25519 = NULL;
1602
1603         freezero(S3I(s)->hs.sigalgs, S3I(s)->hs.sigalgs_len);
1604         S3I(s)->hs.sigalgs = NULL;
1605         S3I(s)->hs.sigalgs_len = 0;
1606
1607         tls13_key_share_free(S3I(s)->hs_tls13.key_share);
1608         S3I(s)->hs_tls13.key_share = NULL;
1609
1610         tls13_secrets_destroy(S3I(s)->hs_tls13.secrets);
1611         S3I(s)->hs_tls13.secrets = NULL;
1612         freezero(S3I(s)->hs_tls13.cookie, S3I(s)->hs_tls13.cookie_len);
1613         S3I(s)->hs_tls13.cookie = NULL;
1614         S3I(s)->hs_tls13.cookie_len = 0;
1615
1616         S3I(s)->hs.extensions_seen = 0;
1617
1618         rp = S3I(s)->rbuf.buf;
1619         wp = S3I(s)->wbuf.buf;
1620         rlen = S3I(s)->rbuf.len;
1621         wlen = S3I(s)->wbuf.len;
1622
1623         tls1_transcript_free(s);
1624         tls1_transcript_hash_free(s);
1625
1626         free(S3I(s)->alpn_selected);
1627         S3I(s)->alpn_selected = NULL;
1628
1629         memset(S3I(s), 0, sizeof(*S3I(s)));
1630         internal = S3I(s);
1631         memset(s->s3, 0, sizeof(*s->s3));
1632         S3I(s) = internal;
1633
1634         S3I(s)->rbuf.buf = rp;
1635         S3I(s)->wbuf.buf = wp;
1636         S3I(s)->rbuf.len = rlen;
1637         S3I(s)->wbuf.len = wlen;
1638
1639         ssl_free_wbio_buffer(s);
1640
1641         /* Not needed... */
1642         S3I(s)->renegotiate = 0;
1643         S3I(s)->total_renegotiations = 0;
1644         S3I(s)->num_renegotiations = 0;
1645         S3I(s)->in_read_app_data = 0;
1646
1647         s->internal->packet_length = 0;
1648         s->version = TLS1_VERSION;
1649 }
1650
1651 static long
1652 ssl_ctrl_get_server_tmp_key(SSL *s, EVP_PKEY **pkey_tmp)
1653 {
1654         EVP_PKEY *pkey = NULL;
1655         SESS_CERT *sc;
1656         int ret = 0;
1657
1658         *pkey_tmp = NULL;
1659
1660         if (s->server != 0)
1661                 return 0;
1662         if (s->session == NULL || SSI(s)->sess_cert == NULL)
1663                 return 0;
1664
1665         sc = SSI(s)->sess_cert;
1666
1667         if ((pkey = EVP_PKEY_new()) == NULL)
1668                 return 0;
1669
1670         if (sc->peer_dh_tmp != NULL) {
1671                 if (!EVP_PKEY_set1_DH(pkey, sc->peer_dh_tmp))
1672                         goto err;
1673         } else if (sc->peer_ecdh_tmp) {
1674                 if (!EVP_PKEY_set1_EC_KEY(pkey, sc->peer_ecdh_tmp))
1675                         goto err;
1676         } else if (sc->peer_x25519_tmp != NULL) {
1677                 if (!ssl_kex_dummy_ecdhe_x25519(pkey))
1678                         goto err;
1679         } else if (S3I(s)->hs_tls13.key_share != NULL) {
1680                 if (!tls13_key_share_peer_pkey(S3I(s)->hs_tls13.key_share,
1681                     pkey))
1682                         goto err;
1683         } else {
1684                 goto err;
1685         }
1686
1687         *pkey_tmp = pkey;
1688         pkey = NULL;
1689
1690         ret = 1;
1691
1692  err:
1693         EVP_PKEY_free(pkey);
1694
1695         return (ret);
1696 }
1697
1698 static int
1699 _SSL_session_reused(SSL *s)
1700 {
1701         return s->internal->hit;
1702 }
1703
1704 static int
1705 _SSL_num_renegotiations(SSL *s)
1706 {
1707         return S3I(s)->num_renegotiations;
1708 }
1709
1710 static int
1711 _SSL_clear_num_renegotiations(SSL *s)
1712 {
1713         int renegs;
1714
1715         renegs = S3I(s)->num_renegotiations;
1716         S3I(s)->num_renegotiations = 0;
1717
1718         return renegs;
1719 }
1720
1721 static int
1722 _SSL_total_renegotiations(SSL *s)
1723 {
1724         return S3I(s)->total_renegotiations;
1725 }
1726
1727 static int
1728 _SSL_set_tmp_dh(SSL *s, DH *dh)
1729 {
1730         DH *dh_tmp;
1731
1732         if (dh == NULL) {
1733                 SSLerror(s, ERR_R_PASSED_NULL_PARAMETER);
1734                 return 0;
1735         }
1736
1737         if ((dh_tmp = DHparams_dup(dh)) == NULL) {
1738                 SSLerror(s, ERR_R_DH_LIB);
1739                 return 0;
1740         }
1741
1742         DH_free(s->cert->dh_tmp);
1743         s->cert->dh_tmp = dh_tmp;
1744
1745         return 1;
1746 }
1747
1748 static int
1749 _SSL_set_dh_auto(SSL *s, int state)
1750 {
1751         s->cert->dh_tmp_auto = state;
1752         return 1;
1753 }
1754
1755 static int
1756 _SSL_set_tmp_ecdh(SSL *s, EC_KEY *ecdh)
1757 {
1758         const EC_GROUP *group;
1759         int nid;
1760
1761         if (ecdh == NULL)
1762                 return 0;
1763         if ((group = EC_KEY_get0_group(ecdh)) == NULL)
1764                 return 0;
1765
1766         nid = EC_GROUP_get_curve_name(group);
1767         return SSL_set1_groups(s, &nid, 1);
1768 }
1769
1770 static int
1771 _SSL_set_ecdh_auto(SSL *s, int state)
1772 {
1773         return 1;
1774 }
1775
1776 static int
1777 _SSL_set_tlsext_host_name(SSL *s, const char *name)
1778 {
1779         free(s->tlsext_hostname);
1780         s->tlsext_hostname = NULL;
1781
1782         if (name == NULL)
1783                 return 1;
1784
1785         if (strlen(name) > TLSEXT_MAXLEN_host_name) {
1786                 SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
1787                 return 0;
1788         }
1789
1790         if ((s->tlsext_hostname = strdup(name)) == NULL) {
1791                 SSLerror(s, ERR_R_INTERNAL_ERROR);
1792                 return 0;
1793         }
1794
1795         return 1;
1796 }
1797
1798 static int
1799 _SSL_set_tlsext_debug_arg(SSL *s, void *arg)
1800 {
1801         s->internal->tlsext_debug_arg = arg;
1802         return 1;
1803 }
1804
1805 static int
1806 _SSL_set_tlsext_status_type(SSL *s, int type)
1807 {
1808         s->tlsext_status_type = type;
1809         return 1;
1810 }
1811
1812 static int
1813 _SSL_get_tlsext_status_exts(SSL *s, STACK_OF(X509_EXTENSION) **exts)
1814 {
1815         *exts = s->internal->tlsext_ocsp_exts;
1816         return 1;
1817 }
1818
1819 static int
1820 _SSL_set_tlsext_status_exts(SSL *s, STACK_OF(X509_EXTENSION) *exts)
1821 {
1822         /* XXX - leak... */
1823         s->internal->tlsext_ocsp_exts = exts;
1824         return 1;
1825 }
1826
1827 static int
1828 _SSL_get_tlsext_status_ids(SSL *s, STACK_OF(OCSP_RESPID) **ids)
1829 {
1830         *ids = s->internal->tlsext_ocsp_ids;
1831         return 1;
1832 }
1833
1834 static int
1835 _SSL_set_tlsext_status_ids(SSL *s, STACK_OF(OCSP_RESPID) *ids)
1836 {
1837         /* XXX - leak... */
1838         s->internal->tlsext_ocsp_ids = ids;
1839         return 1;
1840 }
1841
1842 static int
1843 _SSL_get_tlsext_status_ocsp_resp(SSL *s, unsigned char **resp)
1844 {
1845         *resp = s->internal->tlsext_ocsp_resp;
1846         return s->internal->tlsext_ocsp_resplen;
1847 }
1848
1849 static int
1850 _SSL_set_tlsext_status_ocsp_resp(SSL *s, unsigned char *resp, int resp_len)
1851 {
1852         free(s->internal->tlsext_ocsp_resp);
1853         s->internal->tlsext_ocsp_resp = resp;
1854         s->internal->tlsext_ocsp_resplen = resp_len;
1855         return 1;
1856 }
1857
1858 int
1859 SSL_set0_chain(SSL *ssl, STACK_OF(X509) *chain)
1860 {
1861         return ssl_cert_set0_chain(ssl->cert, chain);
1862 }
1863
1864 int
1865 SSL_set1_chain(SSL *ssl, STACK_OF(X509) *chain)
1866 {
1867         return ssl_cert_set1_chain(ssl->cert, chain);
1868 }
1869
1870 int
1871 SSL_add0_chain_cert(SSL *ssl, X509 *x509)
1872 {
1873         return ssl_cert_add0_chain_cert(ssl->cert, x509);
1874 }
1875
1876 int
1877 SSL_add1_chain_cert(SSL *ssl, X509 *x509)
1878 {
1879         return ssl_cert_add1_chain_cert(ssl->cert, x509);
1880 }
1881
1882 int
1883 SSL_get0_chain_certs(const SSL *ssl, STACK_OF(X509) **out_chain)
1884 {
1885         *out_chain = NULL;
1886
1887         if (ssl->cert->key != NULL)
1888                 *out_chain = ssl->cert->key->chain;
1889
1890         return 1;
1891 }
1892
1893 int
1894 SSL_clear_chain_certs(SSL *ssl)
1895 {
1896         return ssl_cert_set0_chain(ssl->cert, NULL);
1897 }
1898
1899 int
1900 SSL_set1_groups(SSL *s, const int *groups, size_t groups_len)
1901 {
1902         return tls1_set_groups(&s->internal->tlsext_supportedgroups,
1903             &s->internal->tlsext_supportedgroups_length, groups, groups_len);
1904 }
1905
1906 int
1907 SSL_set1_groups_list(SSL *s, const char *groups)
1908 {
1909         return tls1_set_group_list(&s->internal->tlsext_supportedgroups,
1910             &s->internal->tlsext_supportedgroups_length, groups);
1911 }
1912
1913 long
1914 ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
1915 {
1916         switch (cmd) {
1917         case SSL_CTRL_GET_SESSION_REUSED:
1918                 return _SSL_session_reused(s);
1919
1920         case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
1921                 return _SSL_num_renegotiations(s);
1922
1923         case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
1924                 return _SSL_clear_num_renegotiations(s);
1925
1926         case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
1927                 return _SSL_total_renegotiations(s);
1928
1929         case SSL_CTRL_SET_TMP_DH:
1930                 return _SSL_set_tmp_dh(s, parg);
1931
1932         case SSL_CTRL_SET_TMP_DH_CB:
1933                 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1934                 return 0;
1935
1936         case SSL_CTRL_SET_DH_AUTO:
1937                 return _SSL_set_dh_auto(s, larg);
1938
1939         case SSL_CTRL_SET_TMP_ECDH:
1940                 return _SSL_set_tmp_ecdh(s, parg);
1941
1942         case SSL_CTRL_SET_TMP_ECDH_CB:
1943                 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1944                 return 0;
1945
1946         case SSL_CTRL_SET_ECDH_AUTO:
1947                 return _SSL_set_ecdh_auto(s, larg);
1948
1949         case SSL_CTRL_SET_TLSEXT_HOSTNAME:
1950                 if (larg != TLSEXT_NAMETYPE_host_name) {
1951                         SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
1952                         return 0;
1953                 }
1954                 return _SSL_set_tlsext_host_name(s, parg);
1955
1956         case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
1957                 return _SSL_set_tlsext_debug_arg(s, parg);
1958
1959         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
1960                 return _SSL_set_tlsext_status_type(s, larg);
1961
1962         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
1963                 return _SSL_get_tlsext_status_exts(s, parg);
1964
1965         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
1966                 return _SSL_set_tlsext_status_exts(s, parg);
1967
1968         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
1969                 return _SSL_get_tlsext_status_ids(s, parg);
1970
1971         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
1972                 return _SSL_set_tlsext_status_ids(s, parg);
1973
1974         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
1975                 return _SSL_get_tlsext_status_ocsp_resp(s, parg);
1976
1977         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
1978                 return _SSL_set_tlsext_status_ocsp_resp(s, parg, larg);
1979
1980         case SSL_CTRL_CHAIN:
1981                 if (larg == 0)
1982                         return SSL_set0_chain(s, (STACK_OF(X509) *)parg);
1983                 else
1984                         return SSL_set1_chain(s, (STACK_OF(X509) *)parg);
1985
1986         case SSL_CTRL_CHAIN_CERT:
1987                 if (larg == 0)
1988                         return SSL_add0_chain_cert(s, (X509 *)parg);
1989                 else
1990                         return SSL_add1_chain_cert(s, (X509 *)parg);
1991
1992         case SSL_CTRL_GET_CHAIN_CERTS:
1993                 return SSL_get0_chain_certs(s, (STACK_OF(X509) **)parg);
1994
1995         case SSL_CTRL_SET_GROUPS:
1996                 return SSL_set1_groups(s, parg, larg);
1997
1998         case SSL_CTRL_SET_GROUPS_LIST:
1999                 return SSL_set1_groups_list(s, parg);
2000
2001         case SSL_CTRL_GET_SERVER_TMP_KEY:
2002                 return ssl_ctrl_get_server_tmp_key(s, parg);
2003
2004         case SSL_CTRL_GET_MIN_PROTO_VERSION:
2005                 return SSL_get_min_proto_version(s);
2006
2007         case SSL_CTRL_GET_MAX_PROTO_VERSION:
2008                 return SSL_get_max_proto_version(s);
2009
2010         case SSL_CTRL_SET_MIN_PROTO_VERSION:
2011                 if (larg < 0 || larg > UINT16_MAX)
2012                         return 0;
2013                 return SSL_set_min_proto_version(s, larg);
2014
2015         case SSL_CTRL_SET_MAX_PROTO_VERSION:
2016                 if (larg < 0 || larg > UINT16_MAX)
2017                         return 0;
2018                 return SSL_set_max_proto_version(s, larg);
2019
2020         /*
2021          * Legacy controls that should eventually be removed.
2022          */
2023         case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
2024                 return 0;
2025
2026         case SSL_CTRL_GET_FLAGS:
2027                 return (int)(s->s3->flags);
2028
2029         case SSL_CTRL_NEED_TMP_RSA:
2030                 return 0;
2031
2032         case SSL_CTRL_SET_TMP_RSA:
2033         case SSL_CTRL_SET_TMP_RSA_CB:
2034                 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2035                 return 0;
2036         }
2037
2038         return 0;
2039 }
2040
2041 long
2042 ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
2043 {
2044         switch (cmd) {
2045         case SSL_CTRL_SET_TMP_RSA_CB:
2046                 SSLerror(s, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2047                 return 0;
2048
2049         case SSL_CTRL_SET_TMP_DH_CB:
2050                 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
2051                 return 1;
2052
2053         case SSL_CTRL_SET_TMP_ECDH_CB:
2054                 return 1;
2055
2056         case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
2057                 s->internal->tlsext_debug_cb = (void (*)(SSL *, int , int,
2058                     unsigned char *, int, void *))fp;
2059                 return 1;
2060         }
2061
2062         return 0;
2063 }
2064
2065 static int
2066 _SSL_CTX_set_tmp_dh(SSL_CTX *ctx, DH *dh)
2067 {
2068         DH *dh_tmp;
2069
2070         if ((dh_tmp = DHparams_dup(dh)) == NULL) {
2071                 SSLerrorx(ERR_R_DH_LIB);
2072                 return 0;
2073         }
2074
2075         DH_free(ctx->internal->cert->dh_tmp);
2076         ctx->internal->cert->dh_tmp = dh_tmp;
2077
2078         return 1;
2079 }
2080
2081 static int
2082 _SSL_CTX_set_dh_auto(SSL_CTX *ctx, int state)
2083 {
2084         ctx->internal->cert->dh_tmp_auto = state;
2085         return 1;
2086 }
2087
2088 static int
2089 _SSL_CTX_set_tmp_ecdh(SSL_CTX *ctx, EC_KEY *ecdh)
2090 {
2091         const EC_GROUP *group;
2092         int nid;
2093
2094         if (ecdh == NULL)
2095                 return 0;
2096         if ((group = EC_KEY_get0_group(ecdh)) == NULL)
2097                 return 0;
2098
2099         nid = EC_GROUP_get_curve_name(group);
2100         return SSL_CTX_set1_groups(ctx, &nid, 1);
2101 }
2102
2103 static int
2104 _SSL_CTX_set_ecdh_auto(SSL_CTX *ctx, int state)
2105 {
2106         return 1;
2107 }
2108
2109 static int
2110 _SSL_CTX_set_tlsext_servername_arg(SSL_CTX *ctx, void *arg)
2111 {
2112         ctx->internal->tlsext_servername_arg = arg;
2113         return 1;
2114 }
2115
2116 static int
2117 _SSL_CTX_get_tlsext_ticket_keys(SSL_CTX *ctx, unsigned char *keys, int keys_len)
2118 {
2119         if (keys == NULL)
2120                 return 48;
2121
2122         if (keys_len != 48) {
2123                 SSLerrorx(SSL_R_INVALID_TICKET_KEYS_LENGTH);
2124                 return 0;
2125         }
2126
2127         memcpy(keys, ctx->internal->tlsext_tick_key_name, 16);
2128         memcpy(keys + 16, ctx->internal->tlsext_tick_hmac_key, 16);
2129         memcpy(keys + 32, ctx->internal->tlsext_tick_aes_key, 16);
2130
2131         return 1;
2132 }
2133
2134 static int
2135 _SSL_CTX_set_tlsext_ticket_keys(SSL_CTX *ctx, unsigned char *keys, int keys_len)
2136 {
2137         if (keys == NULL)
2138                 return 48;
2139
2140         if (keys_len != 48) {
2141                 SSLerrorx(SSL_R_INVALID_TICKET_KEYS_LENGTH);
2142                 return 0;
2143         }
2144
2145         memcpy(ctx->internal->tlsext_tick_key_name, keys, 16);
2146         memcpy(ctx->internal->tlsext_tick_hmac_key, keys + 16, 16);
2147         memcpy(ctx->internal->tlsext_tick_aes_key, keys + 32, 16);
2148
2149         return 1;
2150 }
2151
2152 static int
2153 _SSL_CTX_get_tlsext_status_arg(SSL_CTX *ctx, void **arg)
2154 {
2155         *arg = ctx->internal->tlsext_status_arg;
2156         return 1;
2157 }
2158
2159 static int
2160 _SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg)
2161 {
2162         ctx->internal->tlsext_status_arg = arg;
2163         return 1;
2164 }
2165
2166 int
2167 SSL_CTX_set0_chain(SSL_CTX *ctx, STACK_OF(X509) *chain)
2168 {
2169         return ssl_cert_set0_chain(ctx->internal->cert, chain);
2170 }
2171
2172 int
2173 SSL_CTX_set1_chain(SSL_CTX *ctx, STACK_OF(X509) *chain)
2174 {
2175         return ssl_cert_set1_chain(ctx->internal->cert, chain);
2176 }
2177
2178 int
2179 SSL_CTX_add0_chain_cert(SSL_CTX *ctx, X509 *x509)
2180 {
2181         return ssl_cert_add0_chain_cert(ctx->internal->cert, x509);
2182 }
2183
2184 int
2185 SSL_CTX_add1_chain_cert(SSL_CTX *ctx, X509 *x509)
2186 {
2187         return ssl_cert_add1_chain_cert(ctx->internal->cert, x509);
2188 }
2189
2190 int
2191 SSL_CTX_get0_chain_certs(const SSL_CTX *ctx, STACK_OF(X509) **out_chain)
2192 {
2193         *out_chain = NULL;
2194
2195         if (ctx->internal->cert->key != NULL)
2196                 *out_chain = ctx->internal->cert->key->chain;
2197
2198         return 1;
2199 }
2200
2201 int
2202 SSL_CTX_clear_chain_certs(SSL_CTX *ctx)
2203 {
2204         return ssl_cert_set0_chain(ctx->internal->cert, NULL);
2205 }
2206
2207 static int
2208 _SSL_CTX_add_extra_chain_cert(SSL_CTX *ctx, X509 *cert)
2209 {
2210         if (ctx->extra_certs == NULL) {
2211                 if ((ctx->extra_certs = sk_X509_new_null()) == NULL)
2212                         return 0;
2213         }
2214         if (sk_X509_push(ctx->extra_certs, cert) == 0)
2215                 return 0;
2216
2217         return 1;
2218 }
2219
2220 static int
2221 _SSL_CTX_get_extra_chain_certs(SSL_CTX *ctx, STACK_OF(X509) **certs)
2222 {
2223         *certs = ctx->extra_certs;
2224         if (*certs == NULL)
2225                 *certs = ctx->internal->cert->key->chain;
2226
2227         return 1;
2228 }
2229
2230 static int
2231 _SSL_CTX_get_extra_chain_certs_only(SSL_CTX *ctx, STACK_OF(X509) **certs)
2232 {
2233         *certs = ctx->extra_certs;
2234         return 1;
2235 }
2236
2237 static int
2238 _SSL_CTX_clear_extra_chain_certs(SSL_CTX *ctx)
2239 {
2240         sk_X509_pop_free(ctx->extra_certs, X509_free);
2241         ctx->extra_certs = NULL;
2242         return 1;
2243 }
2244
2245 int
2246 SSL_CTX_set1_groups(SSL_CTX *ctx, const int *groups, size_t groups_len)
2247 {
2248         return tls1_set_groups(&ctx->internal->tlsext_supportedgroups,
2249             &ctx->internal->tlsext_supportedgroups_length, groups, groups_len);
2250 }
2251
2252 int
2253 SSL_CTX_set1_groups_list(SSL_CTX *ctx, const char *groups)
2254 {
2255         return tls1_set_group_list(&ctx->internal->tlsext_supportedgroups,
2256             &ctx->internal->tlsext_supportedgroups_length, groups);
2257 }
2258
2259 long
2260 ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2261 {
2262         switch (cmd) {
2263         case SSL_CTRL_SET_TMP_DH:
2264                 return _SSL_CTX_set_tmp_dh(ctx, parg);
2265
2266         case SSL_CTRL_SET_TMP_DH_CB:
2267                 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2268                 return 0;
2269
2270         case SSL_CTRL_SET_DH_AUTO:
2271                 return _SSL_CTX_set_dh_auto(ctx, larg);
2272
2273         case SSL_CTRL_SET_TMP_ECDH:
2274                 return _SSL_CTX_set_tmp_ecdh(ctx, parg);
2275
2276         case SSL_CTRL_SET_TMP_ECDH_CB:
2277                 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2278                 return 0;
2279
2280         case SSL_CTRL_SET_ECDH_AUTO:
2281                 return _SSL_CTX_set_ecdh_auto(ctx, larg);
2282
2283         case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
2284                 return _SSL_CTX_set_tlsext_servername_arg(ctx, parg);
2285
2286         case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
2287                 return _SSL_CTX_get_tlsext_ticket_keys(ctx, parg, larg);
2288
2289         case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
2290                 return _SSL_CTX_set_tlsext_ticket_keys(ctx, parg, larg);
2291
2292         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG:
2293                 return _SSL_CTX_get_tlsext_status_arg(ctx, parg);
2294
2295         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
2296                 return _SSL_CTX_set_tlsext_status_arg(ctx, parg);
2297
2298         case SSL_CTRL_CHAIN:
2299                 if (larg == 0)
2300                         return SSL_CTX_set0_chain(ctx, (STACK_OF(X509) *)parg);
2301                 else
2302                         return SSL_CTX_set1_chain(ctx, (STACK_OF(X509) *)parg);
2303
2304         case SSL_CTRL_CHAIN_CERT:
2305                 if (larg == 0)
2306                         return SSL_CTX_add0_chain_cert(ctx, (X509 *)parg);
2307                 else
2308                         return SSL_CTX_add1_chain_cert(ctx, (X509 *)parg);
2309
2310         case SSL_CTRL_GET_CHAIN_CERTS:
2311                 return SSL_CTX_get0_chain_certs(ctx, (STACK_OF(X509) **)parg);
2312
2313         case SSL_CTRL_EXTRA_CHAIN_CERT:
2314                 return _SSL_CTX_add_extra_chain_cert(ctx, parg);
2315
2316         case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
2317                 if (larg == 0)
2318                         return _SSL_CTX_get_extra_chain_certs(ctx, parg);
2319                 else
2320                         return _SSL_CTX_get_extra_chain_certs_only(ctx, parg);
2321
2322         case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
2323                 return _SSL_CTX_clear_extra_chain_certs(ctx);
2324
2325         case SSL_CTRL_SET_GROUPS:
2326                 return SSL_CTX_set1_groups(ctx, parg, larg);
2327
2328         case SSL_CTRL_SET_GROUPS_LIST:
2329                 return SSL_CTX_set1_groups_list(ctx, parg);
2330
2331         case SSL_CTRL_GET_MIN_PROTO_VERSION:
2332                 return SSL_CTX_get_min_proto_version(ctx);
2333
2334         case SSL_CTRL_GET_MAX_PROTO_VERSION:
2335                 return SSL_CTX_get_max_proto_version(ctx);
2336
2337         case SSL_CTRL_SET_MIN_PROTO_VERSION:
2338                 if (larg < 0 || larg > UINT16_MAX)
2339                         return 0;
2340                 return SSL_CTX_set_min_proto_version(ctx, larg);
2341
2342         case SSL_CTRL_SET_MAX_PROTO_VERSION:
2343                 if (larg < 0 || larg > UINT16_MAX)
2344                         return 0;
2345                 return SSL_CTX_set_max_proto_version(ctx, larg);
2346
2347         /*
2348          * Legacy controls that should eventually be removed.
2349          */
2350         case SSL_CTRL_NEED_TMP_RSA:
2351                 return 0;
2352
2353         case SSL_CTRL_SET_TMP_RSA:
2354         case SSL_CTRL_SET_TMP_RSA_CB:
2355                 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2356                 return 0;
2357         }
2358
2359         return 0;
2360 }
2361
2362 long
2363 ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
2364 {
2365         switch (cmd) {
2366         case SSL_CTRL_SET_TMP_RSA_CB:
2367                 SSLerrorx(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2368                 return 0;
2369
2370         case SSL_CTRL_SET_TMP_DH_CB:
2371                 ctx->internal->cert->dh_tmp_cb =
2372                     (DH *(*)(SSL *, int, int))fp;
2373                 return 1;
2374
2375         case SSL_CTRL_SET_TMP_ECDH_CB:
2376                 return 1;
2377
2378         case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
2379                 ctx->internal->tlsext_servername_callback =
2380                     (int (*)(SSL *, int *, void *))fp;
2381                 return 1;
2382
2383         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB:
2384                 *(int (**)(SSL *, void *))fp = ctx->internal->tlsext_status_cb;
2385                 return 1;
2386
2387         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
2388                 ctx->internal->tlsext_status_cb = (int (*)(SSL *, void *))fp;
2389                 return 1;
2390
2391         case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
2392                 ctx->internal->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char  *,
2393                     unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int))fp;
2394                 return 1;
2395         }
2396
2397         return 0;
2398 }
2399
2400 /*
2401  * This function needs to check if the ciphers required are actually available.
2402  */
2403 const SSL_CIPHER *
2404 ssl3_get_cipher_by_char(const unsigned char *p)
2405 {
2406         uint16_t cipher_value;
2407         CBS cbs;
2408
2409         /* We have to assume it is at least 2 bytes due to existing API. */
2410         CBS_init(&cbs, p, 2);
2411         if (!CBS_get_u16(&cbs, &cipher_value))
2412                 return NULL;
2413
2414         return ssl3_get_cipher_by_value(cipher_value);
2415 }
2416
2417 int
2418 ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
2419 {
2420         CBB cbb;
2421
2422         if (p == NULL)
2423                 return (2);
2424
2425         if ((c->id & ~SSL3_CK_VALUE_MASK) != SSL3_CK_ID)
2426                 return (0);
2427
2428         memset(&cbb, 0, sizeof(cbb));
2429
2430         /* We have to assume it is at least 2 bytes due to existing API. */
2431         if (!CBB_init_fixed(&cbb, p, 2))
2432                 goto err;
2433         if (!CBB_add_u16(&cbb, ssl3_cipher_get_value(c)))
2434                 goto err;
2435         if (!CBB_finish(&cbb, NULL, NULL))
2436                 goto err;
2437
2438         return (2);
2439
2440  err:
2441         CBB_cleanup(&cbb);
2442         return (0);
2443 }
2444
2445 SSL_CIPHER *
2446 ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
2447     STACK_OF(SSL_CIPHER) *srvr)
2448 {
2449         unsigned long alg_k, alg_a, mask_k, mask_a;
2450         STACK_OF(SSL_CIPHER) *prio, *allow;
2451         SSL_CIPHER *c, *ret = NULL;
2452         int can_use_ecc;
2453         int i, ii, ok;
2454         CERT *cert;
2455
2456         /* Let's see which ciphers we can support */
2457         cert = s->cert;
2458
2459         can_use_ecc = (tls1_get_shared_curve(s) != NID_undef);
2460
2461         /*
2462          * Do not set the compare functions, because this may lead to a
2463          * reordering by "id". We want to keep the original ordering.
2464          * We may pay a price in performance during sk_SSL_CIPHER_find(),
2465          * but would have to pay with the price of sk_SSL_CIPHER_dup().
2466          */
2467
2468         if (s->internal->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
2469                 prio = srvr;
2470                 allow = clnt;
2471         } else {
2472                 prio = clnt;
2473                 allow = srvr;
2474         }
2475
2476         for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
2477                 c = sk_SSL_CIPHER_value(prio, i);
2478
2479                 /* Skip TLS v1.2 only ciphersuites if not supported. */
2480                 if ((c->algorithm_ssl & SSL_TLSV1_2) &&
2481                     !SSL_USE_TLS1_2_CIPHERS(s))
2482                         continue;
2483
2484                 /* Skip TLS v1.3 only ciphersuites if not supported. */
2485                 if ((c->algorithm_ssl & SSL_TLSV1_3) &&
2486                     !SSL_USE_TLS1_3_CIPHERS(s))
2487                         continue;
2488
2489                 /* If TLS v1.3, only allow TLS v1.3 ciphersuites. */
2490                 if (SSL_USE_TLS1_3_CIPHERS(s) &&
2491                     !(c->algorithm_ssl & SSL_TLSV1_3))
2492                         continue;
2493
2494                 ssl_set_cert_masks(cert, c);
2495                 mask_k = cert->mask_k;
2496                 mask_a = cert->mask_a;
2497
2498                 alg_k = c->algorithm_mkey;
2499                 alg_a = c->algorithm_auth;
2500
2501                 ok = (alg_k & mask_k) && (alg_a & mask_a);
2502
2503                 /*
2504                  * If we are considering an ECC cipher suite that uses our
2505                  * certificate check it.
2506                  */
2507                 if (alg_a & SSL_aECDSA)
2508                         ok = ok && tls1_check_ec_server_key(s);
2509                 /*
2510                  * If we are considering an ECC cipher suite that uses
2511                  * an ephemeral EC key check it.
2512                  */
2513                 if (alg_k & SSL_kECDHE)
2514                         ok = ok && can_use_ecc;
2515
2516                 if (!ok)
2517                         continue;
2518                 ii = sk_SSL_CIPHER_find(allow, c);
2519                 if (ii >= 0) {
2520                         ret = sk_SSL_CIPHER_value(allow, ii);
2521                         break;
2522                 }
2523         }
2524         return (ret);
2525 }
2526
2527 int
2528 ssl3_get_req_cert_types(SSL *s, CBB *cbb)
2529 {
2530         unsigned long alg_k;
2531
2532         alg_k = S3I(s)->hs.new_cipher->algorithm_mkey;
2533
2534 #ifndef OPENSSL_NO_GOST
2535         if ((alg_k & SSL_kGOST) != 0) {
2536                 if (!CBB_add_u8(cbb, TLS_CT_GOST94_SIGN))
2537                         return 0;
2538                 if (!CBB_add_u8(cbb, TLS_CT_GOST01_SIGN))
2539                         return 0;
2540                 if (!CBB_add_u8(cbb, TLS_CT_GOST12_256_SIGN))
2541                         return 0;
2542                 if (!CBB_add_u8(cbb, TLS_CT_GOST12_512_SIGN))
2543                         return 0;
2544         }
2545 #endif
2546
2547         if ((alg_k & SSL_kDHE) != 0) {
2548                 if (!CBB_add_u8(cbb, SSL3_CT_RSA_FIXED_DH))
2549                         return 0;
2550         }
2551
2552         if (!CBB_add_u8(cbb, SSL3_CT_RSA_SIGN))
2553                 return 0;
2554
2555         /*
2556          * ECDSA certs can be used with RSA cipher suites as well
2557          * so we don't need to check for SSL_kECDH or SSL_kECDHE.
2558          */
2559         if (!CBB_add_u8(cbb, TLS_CT_ECDSA_SIGN))
2560                 return 0;
2561
2562         return 1;
2563 }
2564
2565 int
2566 ssl3_shutdown(SSL *s)
2567 {
2568         int     ret;
2569
2570         /*
2571          * Don't do anything much if we have not done the handshake or
2572          * we don't want to send messages :-)
2573          */
2574         if ((s->internal->quiet_shutdown) || (S3I(s)->hs.state == SSL_ST_BEFORE)) {
2575                 s->internal->shutdown = (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
2576                 return (1);
2577         }
2578
2579         if (!(s->internal->shutdown & SSL_SENT_SHUTDOWN)) {
2580                 s->internal->shutdown|=SSL_SENT_SHUTDOWN;
2581                 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
2582                 /*
2583                  * Our shutdown alert has been sent now, and if it still needs
2584                  * to be written, S3I(s)->alert_dispatch will be true
2585                  */
2586                 if (S3I(s)->alert_dispatch)
2587                         return(-1);     /* return WANT_WRITE */
2588         } else if (S3I(s)->alert_dispatch) {
2589                 /* resend it if not sent */
2590                 ret = s->method->ssl_dispatch_alert(s);
2591                 if (ret == -1) {
2592                         /*
2593                          * We only get to return -1 here the 2nd/Nth
2594                          * invocation, we must  have already signalled
2595                          * return 0 upon a previous invoation,
2596                          * return WANT_WRITE
2597                          */
2598                         return (ret);
2599                 }
2600         } else if (!(s->internal->shutdown & SSL_RECEIVED_SHUTDOWN)) {
2601                 /* If we are waiting for a close from our peer, we are closed */
2602                 s->method->internal->ssl_read_bytes(s, 0, NULL, 0, 0);
2603                 if (!(s->internal->shutdown & SSL_RECEIVED_SHUTDOWN)) {
2604                         return(-1);     /* return WANT_READ */
2605                 }
2606         }
2607
2608         if ((s->internal->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
2609             !S3I(s)->alert_dispatch)
2610                 return (1);
2611         else
2612                 return (0);
2613 }
2614
2615 int
2616 ssl3_write(SSL *s, const void *buf, int len)
2617 {
2618         errno = 0;
2619
2620         if (S3I(s)->renegotiate)
2621                 ssl3_renegotiate_check(s);
2622
2623         return s->method->internal->ssl_write_bytes(s,
2624             SSL3_RT_APPLICATION_DATA, buf, len);
2625 }
2626
2627 static int
2628 ssl3_read_internal(SSL *s, void *buf, int len, int peek)
2629 {
2630         int     ret;
2631
2632         errno = 0;
2633         if (S3I(s)->renegotiate)
2634                 ssl3_renegotiate_check(s);
2635         S3I(s)->in_read_app_data = 1;
2636         ret = s->method->internal->ssl_read_bytes(s,
2637             SSL3_RT_APPLICATION_DATA, buf, len, peek);
2638         if ((ret == -1) && (S3I(s)->in_read_app_data == 2)) {
2639                 /*
2640                  * ssl3_read_bytes decided to call s->internal->handshake_func, which
2641                  * called ssl3_read_bytes to read handshake data.
2642                  * However, ssl3_read_bytes actually found application data
2643                  * and thinks that application data makes sense here; so disable
2644                  * handshake processing and try to read application data again.
2645                  */
2646                 s->internal->in_handshake++;
2647                 ret = s->method->internal->ssl_read_bytes(s,
2648                     SSL3_RT_APPLICATION_DATA, buf, len, peek);
2649                 s->internal->in_handshake--;
2650         } else
2651                 S3I(s)->in_read_app_data = 0;
2652
2653         return (ret);
2654 }
2655
2656 int
2657 ssl3_read(SSL *s, void *buf, int len)
2658 {
2659         return ssl3_read_internal(s, buf, len, 0);
2660 }
2661
2662 int
2663 ssl3_peek(SSL *s, void *buf, int len)
2664 {
2665         return ssl3_read_internal(s, buf, len, 1);
2666 }
2667
2668 int
2669 ssl3_renegotiate(SSL *s)
2670 {
2671         if (s->internal->handshake_func == NULL)
2672                 return (1);
2673
2674         if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
2675                 return (0);
2676
2677         S3I(s)->renegotiate = 1;
2678         return (1);
2679 }
2680
2681 int
2682 ssl3_renegotiate_check(SSL *s)
2683 {
2684         int     ret = 0;
2685
2686         if (S3I(s)->renegotiate) {
2687                 if ((S3I(s)->rbuf.left == 0) && (S3I(s)->wbuf.left == 0) &&
2688                     !SSL_in_init(s)) {
2689                         /*
2690                          * If we are the server, and we have sent
2691                          * a 'RENEGOTIATE' message, we need to go
2692                          * to SSL_ST_ACCEPT.
2693                          */
2694                         /* SSL_ST_ACCEPT */
2695                         S3I(s)->hs.state = SSL_ST_RENEGOTIATE;
2696                         S3I(s)->renegotiate = 0;
2697                         S3I(s)->num_renegotiations++;
2698                         S3I(s)->total_renegotiations++;
2699                         ret = 1;
2700                 }
2701         }
2702         return (ret);
2703 }
2704 /*
2705  * If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF
2706  * and handshake macs if required.
2707  */
2708 long
2709 ssl_get_algorithm2(SSL *s)
2710 {
2711         long    alg2 = S3I(s)->hs.new_cipher->algorithm2;
2712
2713         if (s->method->internal->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF &&
2714             alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
2715                 return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
2716         return alg2;
2717 }