/*

 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved

 * Copyright 2005 Nokia. All rights reserved.

 *

 * Licensed under the OpenSSL license (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#include <stdio.h>

#include <ctype.h>

#include <openssl/objects.h>

#include <openssl/comp.h>

#include <openssl/engine.h>

#include <openssl/crypto.h>

#include <openssl/conf.h>

#include "internal/nelem.h"

#include "ssl_local.h"

#include "internal/thread_once.h"

#include "internal/cryptlib.h"

#define SSL_ENC_DES_IDX         0

#define SSL_ENC_3DES_IDX        1

#define SSL_ENC_RC4_IDX         2

#define SSL_ENC_RC2_IDX         3

#define SSL_ENC_IDEA_IDX        4

#define SSL_ENC_NULL_IDX        5

#define SSL_ENC_AES128_IDX      6

#define SSL_ENC_AES256_IDX      7

#define SSL_ENC_CAMELLIA128_IDX 8

#define SSL_ENC_CAMELLIA256_IDX 9

#define SSL_ENC_GOST89_IDX      10

#define SSL_ENC_SEED_IDX        11

#define SSL_ENC_AES128GCM_IDX   12

#define SSL_ENC_AES256GCM_IDX   13

#define SSL_ENC_AES128CCM_IDX   14

#define SSL_ENC_AES256CCM_IDX   15

#define SSL_ENC_AES128CCM8_IDX  16

#define SSL_ENC_AES256CCM8_IDX  17

#define SSL_ENC_GOST8912_IDX    18

#define SSL_ENC_CHACHA_IDX      19

#define SSL_ENC_ARIA128GCM_IDX  20

#define SSL_ENC_ARIA256GCM_IDX  21

#define SSL_ENC_NUM_IDX         22

/* NB: make sure indices in these tables match values above */

typedef struct {

    uint32_t mask;

    int nid;

} ssl_cipher_table;

/* Table of NIDs for each cipher */

static const ssl_cipher_table ssl_cipher_table_cipher[SSL_ENC_NUM_IDX] = {

    {SSL_DES, NID_des_cbc},     /* SSL_ENC_DES_IDX 0 */

    {SSL_3DES, NID_des_ede3_cbc}, /* SSL_ENC_3DES_IDX 1 */

    {SSL_RC4, NID_rc4},         /* SSL_ENC_RC4_IDX 2 */

    {SSL_RC2, NID_rc2_cbc},     /* SSL_ENC_RC2_IDX 3 */

    {SSL_IDEA, NID_idea_cbc},   /* SSL_ENC_IDEA_IDX 4 */

    {SSL_eNULL, NID_undef},     /* SSL_ENC_NULL_IDX 5 */

    {SSL_AES128, NID_aes_128_cbc}, /* SSL_ENC_AES128_IDX 6 */

    {SSL_AES256, NID_aes_256_cbc}, /* SSL_ENC_AES256_IDX 7 */

    {SSL_CAMELLIA128, NID_camellia_128_cbc}, /* SSL_ENC_CAMELLIA128_IDX 8 */

    {SSL_CAMELLIA256, NID_camellia_256_cbc}, /* SSL_ENC_CAMELLIA256_IDX 9 */

    {SSL_eGOST2814789CNT, NID_gost89_cnt}, /* SSL_ENC_GOST89_IDX 10 */

    {SSL_SEED, NID_seed_cbc},   /* SSL_ENC_SEED_IDX 11 */

    {SSL_AES128GCM, NID_aes_128_gcm}, /* SSL_ENC_AES128GCM_IDX 12 */

    {SSL_AES256GCM, NID_aes_256_gcm}, /* SSL_ENC_AES256GCM_IDX 13 */

    {SSL_AES128CCM, NID_aes_128_ccm}, /* SSL_ENC_AES128CCM_IDX 14 */

    {SSL_AES256CCM, NID_aes_256_ccm}, /* SSL_ENC_AES256CCM_IDX 15 */

    {SSL_AES128CCM8, NID_aes_128_ccm}, /* SSL_ENC_AES128CCM8_IDX 16 */

    {SSL_AES256CCM8, NID_aes_256_ccm}, /* SSL_ENC_AES256CCM8_IDX 17 */

    {SSL_eGOST2814789CNT12, NID_gost89_cnt_12}, /* SSL_ENC_GOST8912_IDX 18 */

    {SSL_CHACHA20POLY1305, NID_chacha20_poly1305}, /* SSL_ENC_CHACHA_IDX 19 */

    {SSL_ARIA128GCM, NID_aria_128_gcm}, /* SSL_ENC_ARIA128GCM_IDX 20 */

    {SSL_ARIA256GCM, NID_aria_256_gcm}, /* SSL_ENC_ARIA256GCM_IDX 21 */

};

static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX];

#define SSL_COMP_NULL_IDX       0

#define SSL_COMP_ZLIB_IDX       1

#define SSL_COMP_NUM_IDX        2

static STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;

#ifndef OPENSSL_NO_COMP

static CRYPTO_ONCE ssl_load_builtin_comp_once = CRYPTO_ONCE_STATIC_INIT;

#endif

/*

 * Constant SSL_MAX_DIGEST equal to size of digests array should be defined

 * in the ssl_local.h

 */

#define SSL_MD_NUM_IDX  SSL_MAX_DIGEST

/* NB: make sure indices in this table matches values above */

static const ssl_cipher_table ssl_cipher_table_mac[SSL_MD_NUM_IDX] = {

    {SSL_MD5, NID_md5},         /* SSL_MD_MD5_IDX 0 */

    {SSL_SHA1, NID_sha1},       /* SSL_MD_SHA1_IDX 1 */

    {SSL_GOST94, NID_id_GostR3411_94}, /* SSL_MD_GOST94_IDX 2 */

    {SSL_GOST89MAC, NID_id_Gost28147_89_MAC}, /* SSL_MD_GOST89MAC_IDX 3 */

    {SSL_SHA256, NID_sha256},   /* SSL_MD_SHA256_IDX 4 */

    {SSL_SHA384, NID_sha384},   /* SSL_MD_SHA384_IDX 5 */

    {SSL_GOST12_256, NID_id_GostR3411_2012_256}, /* SSL_MD_GOST12_256_IDX 6 */

    {SSL_GOST89MAC12, NID_gost_mac_12}, /* SSL_MD_GOST89MAC12_IDX 7 */

    {SSL_GOST12_512, NID_id_GostR3411_2012_512}, /* SSL_MD_GOST12_512_IDX 8 */

    {0, NID_md5_sha1},          /* SSL_MD_MD5_SHA1_IDX 9 */

    {0, NID_sha224},            /* SSL_MD_SHA224_IDX 10 */

    {0, NID_sha512}             /* SSL_MD_SHA512_IDX 11 */

};

static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = {

    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL

};

/* *INDENT-OFF* */

static const ssl_cipher_table ssl_cipher_table_kx[] = {

    {SSL_kRSA,      NID_kx_rsa},

    {SSL_kECDHE,    NID_kx_ecdhe},

    {SSL_kDHE,      NID_kx_dhe},

    {SSL_kECDHEPSK, NID_kx_ecdhe_psk},

    {SSL_kDHEPSK,   NID_kx_dhe_psk},

    {SSL_kRSAPSK,   NID_kx_rsa_psk},

    {SSL_kPSK,      NID_kx_psk},

    {SSL_kSRP,      NID_kx_srp},

    {SSL_kGOST,     NID_kx_gost},

    {SSL_kANY,      NID_kx_any}

};

static const ssl_cipher_table ssl_cipher_table_auth[] = {

    {SSL_aRSA,    NID_auth_rsa},

    {SSL_aECDSA,  NID_auth_ecdsa},

    {SSL_aPSK,    NID_auth_psk},

    {SSL_aDSS,    NID_auth_dss},

    {SSL_aGOST01, NID_auth_gost01},

    {SSL_aGOST12, NID_auth_gost12},

    {SSL_aSRP,    NID_auth_srp},

    {SSL_aNULL,   NID_auth_null},

    {SSL_aANY,    NID_auth_any}

};

/* *INDENT-ON* */

/* Utility function for table lookup */

static int ssl_cipher_info_find(const ssl_cipher_table * table,

                                size_t table_cnt, uint32_t mask)

{

    size_t i;

    for (i = 0; i < table_cnt; i++, table++) {

        if (table->mask == mask)

            return (int)i;

    }

    return -1;

}

#define ssl_cipher_info_lookup(table, x) \

    ssl_cipher_info_find(table, OSSL_NELEM(table), x)

/*

 * PKEY_TYPE for GOST89MAC is known in advance, but, because implementation

 * is engine-provided, we'll fill it only if corresponding EVP_PKEY_METHOD is

 * found

 */

static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {

    /* MD5, SHA, GOST94, MAC89 */

    EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,

    /* SHA256, SHA384, GOST2012_256, MAC89-12 */

    EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,

    /* GOST2012_512 */

    EVP_PKEY_HMAC,

    /* MD5/SHA1, SHA224, SHA512 */

    NID_undef, NID_undef, NID_undef

};

static size_t ssl_mac_secret_size[SSL_MD_NUM_IDX];

#define CIPHER_ADD      1

#define CIPHER_KILL     2

#define CIPHER_DEL      3

#define CIPHER_ORD      4

#define CIPHER_SPECIAL  5

/*

 * Bump the ciphers to the top of the list.

 * This rule isn't currently supported by the public cipherstring API.

 */

#define CIPHER_BUMP     6

typedef struct cipher_order_st {

    const SSL_CIPHER *cipher;

    int active;

    int dead;

    struct cipher_order_st *next, *prev;

} CIPHER_ORDER;

static const SSL_CIPHER cipher_aliases[] = {

    /* "ALL" doesn't include eNULL (must be specifically enabled) */

    {0, SSL_TXT_ALL, NULL, 0, 0, 0, ~SSL_eNULL},

    /* "COMPLEMENTOFALL" */

    {0, SSL_TXT_CMPALL, NULL, 0, 0, 0, SSL_eNULL},

    /*

     * "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in

     * ALL!)

     */

    {0, SSL_TXT_CMPDEF, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_NOT_DEFAULT},

    /*

     * key exchange aliases (some of those using only a single bit here

     * combine multiple key exchange algs according to the RFCs, e.g. kDHE

     * combines DHE_DSS and DHE_RSA)

     */

    {0, SSL_TXT_kRSA, NULL, 0, SSL_kRSA},

    {0, SSL_TXT_kEDH, NULL, 0, SSL_kDHE},

    {0, SSL_TXT_kDHE, NULL, 0, SSL_kDHE},

    {0, SSL_TXT_DH, NULL, 0, SSL_kDHE},

    {0, SSL_TXT_kEECDH, NULL, 0, SSL_kECDHE},

    {0, SSL_TXT_kECDHE, NULL, 0, SSL_kECDHE},

    {0, SSL_TXT_ECDH, NULL, 0, SSL_kECDHE},

    {0, SSL_TXT_kPSK, NULL, 0, SSL_kPSK},

    {0, SSL_TXT_kRSAPSK, NULL, 0, SSL_kRSAPSK},

    {0, SSL_TXT_kECDHEPSK, NULL, 0, SSL_kECDHEPSK},

    {0, SSL_TXT_kDHEPSK, NULL, 0, SSL_kDHEPSK},

    {0, SSL_TXT_kSRP, NULL, 0, SSL_kSRP},

    {0, SSL_TXT_kGOST, NULL, 0, SSL_kGOST},

    /* server authentication aliases */

    {0, SSL_TXT_aRSA, NULL, 0, 0, SSL_aRSA},

    {0, SSL_TXT_aDSS, NULL, 0, 0, SSL_aDSS},

    {0, SSL_TXT_DSS, NULL, 0, 0, SSL_aDSS},

    {0, SSL_TXT_aNULL, NULL, 0, 0, SSL_aNULL},

    {0, SSL_TXT_aECDSA, NULL, 0, 0, SSL_aECDSA},

    {0, SSL_TXT_ECDSA, NULL, 0, 0, SSL_aECDSA},

    {0, SSL_TXT_aPSK, NULL, 0, 0, SSL_aPSK},

    {0, SSL_TXT_aGOST01, NULL, 0, 0, SSL_aGOST01},

    {0, SSL_TXT_aGOST12, NULL, 0, 0, SSL_aGOST12},

    {0, SSL_TXT_aGOST, NULL, 0, 0, SSL_aGOST01 | SSL_aGOST12},

    {0, SSL_TXT_aSRP, NULL, 0, 0, SSL_aSRP},

    /* aliases combining key exchange and server authentication */

    {0, SSL_TXT_EDH, NULL, 0, SSL_kDHE, ~SSL_aNULL},

    {0, SSL_TXT_DHE, NULL, 0, SSL_kDHE, ~SSL_aNULL},

    {0, SSL_TXT_EECDH, NULL, 0, SSL_kECDHE, ~SSL_aNULL},

    {0, SSL_TXT_ECDHE, NULL, 0, SSL_kECDHE, ~SSL_aNULL},

    {0, SSL_TXT_NULL, NULL, 0, 0, 0, SSL_eNULL},

    {0, SSL_TXT_RSA, NULL, 0, SSL_kRSA, SSL_aRSA},

    {0, SSL_TXT_ADH, NULL, 0, SSL_kDHE, SSL_aNULL},

    {0, SSL_TXT_AECDH, NULL, 0, SSL_kECDHE, SSL_aNULL},

    {0, SSL_TXT_PSK, NULL, 0, SSL_PSK},

    {0, SSL_TXT_SRP, NULL, 0, SSL_kSRP},

    /* symmetric encryption aliases */

    {0, SSL_TXT_3DES, NULL, 0, 0, 0, SSL_3DES},

    {0, SSL_TXT_RC4, NULL, 0, 0, 0, SSL_RC4},

    {0, SSL_TXT_RC2, NULL, 0, 0, 0, SSL_RC2},

    {0, SSL_TXT_IDEA, NULL, 0, 0, 0, SSL_IDEA},

    {0, SSL_TXT_SEED, NULL, 0, 0, 0, SSL_SEED},

    {0, SSL_TXT_eNULL, NULL, 0, 0, 0, SSL_eNULL},

    {0, SSL_TXT_GOST, NULL, 0, 0, 0, SSL_eGOST2814789CNT | SSL_eGOST2814789CNT12},

    {0, SSL_TXT_AES128, NULL, 0, 0, 0,

     SSL_AES128 | SSL_AES128GCM | SSL_AES128CCM | SSL_AES128CCM8},

    {0, SSL_TXT_AES256, NULL, 0, 0, 0,

     SSL_AES256 | SSL_AES256GCM | SSL_AES256CCM | SSL_AES256CCM8},

    {0, SSL_TXT_AES, NULL, 0, 0, 0, SSL_AES},

    {0, SSL_TXT_AES_GCM, NULL, 0, 0, 0, SSL_AES128GCM | SSL_AES256GCM},

    {0, SSL_TXT_AES_CCM, NULL, 0, 0, 0,

     SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8},

    {0, SSL_TXT_AES_CCM_8, NULL, 0, 0, 0, SSL_AES128CCM8 | SSL_AES256CCM8},

    {0, SSL_TXT_CAMELLIA128, NULL, 0, 0, 0, SSL_CAMELLIA128},

    {0, SSL_TXT_CAMELLIA256, NULL, 0, 0, 0, SSL_CAMELLIA256},

    {0, SSL_TXT_CAMELLIA, NULL, 0, 0, 0, SSL_CAMELLIA},

    {0, SSL_TXT_CHACHA20, NULL, 0, 0, 0, SSL_CHACHA20},

    {0, SSL_TXT_ARIA, NULL, 0, 0, 0, SSL_ARIA},

    {0, SSL_TXT_ARIA_GCM, NULL, 0, 0, 0, SSL_ARIA128GCM | SSL_ARIA256GCM},

    {0, SSL_TXT_ARIA128, NULL, 0, 0, 0, SSL_ARIA128GCM},

    {0, SSL_TXT_ARIA256, NULL, 0, 0, 0, SSL_ARIA256GCM},

    /* MAC aliases */

    {0, SSL_TXT_MD5, NULL, 0, 0, 0, 0, SSL_MD5},

    {0, SSL_TXT_SHA1, NULL, 0, 0, 0, 0, SSL_SHA1},

    {0, SSL_TXT_SHA, NULL, 0, 0, 0, 0, SSL_SHA1},

    {0, SSL_TXT_GOST94, NULL, 0, 0, 0, 0, SSL_GOST94},

    {0, SSL_TXT_GOST89MAC, NULL, 0, 0, 0, 0, SSL_GOST89MAC | SSL_GOST89MAC12},

    {0, SSL_TXT_SHA256, NULL, 0, 0, 0, 0, SSL_SHA256},

    {0, SSL_TXT_SHA384, NULL, 0, 0, 0, 0, SSL_SHA384},

    {0, SSL_TXT_GOST12, NULL, 0, 0, 0, 0, SSL_GOST12_256},

    /* protocol version aliases */

    {0, SSL_TXT_SSLV3, NULL, 0, 0, 0, 0, 0, SSL3_VERSION},

    {0, SSL_TXT_TLSV1, NULL, 0, 0, 0, 0, 0, TLS1_VERSION},

    {0, "TLSv1.0", NULL, 0, 0, 0, 0, 0, TLS1_VERSION},

    {0, SSL_TXT_TLSV1_2, NULL, 0, 0, 0, 0, 0, TLS1_2_VERSION},

    /* strength classes */

    {0, SSL_TXT_LOW, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_LOW},

    {0, SSL_TXT_MEDIUM, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_MEDIUM},

    {0, SSL_TXT_HIGH, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_HIGH},

    /* FIPS 140-2 approved ciphersuite */

    {0, SSL_TXT_FIPS, NULL, 0, 0, 0, ~SSL_eNULL, 0, 0, 0, 0, 0, SSL_FIPS},

    /* "EDH-" aliases to "DHE-" labels (for backward compatibility) */

    {0, SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, NULL, 0,

     SSL_kDHE, SSL_aDSS, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS},

    {0, SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, NULL, 0,

     SSL_kDHE, SSL_aRSA, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS},

};

/*

 * Search for public key algorithm with given name and return its pkey_id if

 * it is available. Otherwise return 0

 */

#ifdef OPENSSL_NO_ENGINE

static int get_optional_pkey_id(const char *pkey_name)

{

    const EVP_PKEY_ASN1_METHOD *ameth;

    int pkey_id = 0;

    ameth = EVP_PKEY_asn1_find_str(NULL, pkey_name, -1);

    if (ameth && EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL,

                                         ameth) > 0)

        return pkey_id;

    return 0;

}

#else

static int get_optional_pkey_id(const char *pkey_name)

{

    const EVP_PKEY_ASN1_METHOD *ameth;

    ENGINE *tmpeng = NULL;

    int pkey_id = 0;

    ameth = EVP_PKEY_asn1_find_str(&tmpeng, pkey_name, -1);

    if (ameth) {

        if (EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL,

                                    ameth) <= 0)

            pkey_id = 0;

    }

    ENGINE_finish(tmpeng);

    return pkey_id;

}

#endif

/* masks of disabled algorithms */

static uint32_t disabled_enc_mask;

static uint32_t disabled_mac_mask;

static uint32_t disabled_mkey_mask;

static uint32_t disabled_auth_mask;

int ssl_load_ciphers(void)

{

    size_t i;

    const ssl_cipher_table *t;

    disabled_enc_mask = 0;

    ssl_sort_cipher_list();

    for (i = 0, t = ssl_cipher_table_cipher; i < SSL_ENC_NUM_IDX; i++, t++) {

        if (t->nid == NID_undef) {

            ssl_cipher_methods[i] = NULL;

        } else {

            const EVP_CIPHER *cipher = EVP_get_cipherbynid(t->nid);

            ssl_cipher_methods[i] = cipher;

            if (cipher == NULL)

                disabled_enc_mask |= t->mask;

        }

    }

    disabled_mac_mask = 0;

    for (i = 0, t = ssl_cipher_table_mac; i < SSL_MD_NUM_IDX; i++, t++) {

        const EVP_MD *md = EVP_get_digestbynid(t->nid);

        ssl_digest_methods[i] = md;

        if (md == NULL) {

            disabled_mac_mask |= t->mask;

        } else {

            int tmpsize = EVP_MD_size(md);

            if (!ossl_assert(tmpsize >= 0))

                return 0;

            ssl_mac_secret_size[i] = tmpsize;

        }

    }

    /* Make sure we can access MD5 and SHA1 */

    if (!ossl_assert(ssl_digest_methods[SSL_MD_MD5_IDX] != NULL))

        return 0;

    if (!ossl_assert(ssl_digest_methods[SSL_MD_SHA1_IDX] != NULL))

        return 0;

    disabled_mkey_mask = 0;

    disabled_auth_mask = 0;

#ifdef OPENSSL_NO_RSA

    disabled_mkey_mask |= SSL_kRSA | SSL_kRSAPSK;

    disabled_auth_mask |= SSL_aRSA;

#endif

#ifdef OPENSSL_NO_DSA

    disabled_auth_mask |= SSL_aDSS;

#endif

#ifdef OPENSSL_NO_DH

    disabled_mkey_mask |= SSL_kDHE | SSL_kDHEPSK;

#endif

#ifdef OPENSSL_NO_EC

    disabled_mkey_mask |= SSL_kECDHE | SSL_kECDHEPSK;

    disabled_auth_mask |= SSL_aECDSA;

#endif

#ifdef OPENSSL_NO_PSK

    disabled_mkey_mask |= SSL_PSK;

    disabled_auth_mask |= SSL_aPSK;

#endif

#ifdef OPENSSL_NO_SRP

    disabled_mkey_mask |= SSL_kSRP;

#endif

    /*

     * Check for presence of GOST 34.10 algorithms, and if they are not

     * present, disable appropriate auth and key exchange

     */

    ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac");

    if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX])

        ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32;

    else

        disabled_mac_mask |= SSL_GOST89MAC;

    ssl_mac_pkey_id[SSL_MD_GOST89MAC12_IDX] =

        get_optional_pkey_id("gost-mac-12");

    if (ssl_mac_pkey_id[SSL_MD_GOST89MAC12_IDX])

        ssl_mac_secret_size[SSL_MD_GOST89MAC12_IDX] = 32;

    else

        disabled_mac_mask |= SSL_GOST89MAC12;

    if (!get_optional_pkey_id("gost2001"))

        disabled_auth_mask |= SSL_aGOST01 | SSL_aGOST12;

    if (!get_optional_pkey_id("gost2012_256"))

        disabled_auth_mask |= SSL_aGOST12;

    if (!get_optional_pkey_id("gost2012_512"))

        disabled_auth_mask |= SSL_aGOST12;

    /*

     * Disable GOST key exchange if no GOST signature algs are available *

     */

    if ((disabled_auth_mask & (SSL_aGOST01 | SSL_aGOST12)) ==

        (SSL_aGOST01 | SSL_aGOST12))

        disabled_mkey_mask |= SSL_kGOST;

    return 1;

}

#ifndef OPENSSL_NO_COMP

static int sk_comp_cmp(const SSL_COMP *const *a, const SSL_COMP *const *b)

{

    return ((*a)->id - (*b)->id);

}

DEFINE_RUN_ONCE_STATIC(do_load_builtin_compressions)

{

    SSL_COMP *comp = NULL;

    COMP_METHOD *method = COMP_zlib();

    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE);

    ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);

    if (COMP_get_type(method) != NID_undef && ssl_comp_methods != NULL) {

        comp = OPENSSL_malloc(sizeof(*comp));

        if (comp != NULL) {

            comp->method = method;

            comp->id = SSL_COMP_ZLIB_IDX;

            comp->name = COMP_get_name(method);

            sk_SSL_COMP_push(ssl_comp_methods, comp);

            sk_SSL_COMP_sort(ssl_comp_methods);

        }

    }

    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE);

    return 1;

}

static int load_builtin_compressions(void)

{

    return RUN_ONCE(&ssl_load_builtin_comp_once, do_load_builtin_compressions);

}

#endif

int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,

                       const EVP_MD **md, int *mac_pkey_type,

                       size_t *mac_secret_size, SSL_COMP **comp, int use_etm)

{

    int i;

    const SSL_CIPHER *c;

    c = s->cipher;

    if (c == NULL)

        return 0;

    if (comp != NULL) {

        SSL_COMP ctmp;

#ifndef OPENSSL_NO_COMP

        if (!load_builtin_compressions()) {

            /*

             * Currently don't care, since a failure only means that

             * ssl_comp_methods is NULL, which is perfectly OK

             */

        }

#endif

        *comp = NULL;

        ctmp.id = s->compress_meth;

        if (ssl_comp_methods != NULL) {

            i = sk_SSL_COMP_find(ssl_comp_methods, &ctmp);

            *comp = sk_SSL_COMP_value(ssl_comp_methods, i);

        }

        /* If were only interested in comp then return success */

        if ((enc == NULL) && (md == NULL))

            return 1;

    }

    if ((enc == NULL) || (md == NULL))

        return 0;

    i = ssl_cipher_info_lookup(ssl_cipher_table_cipher, c->algorithm_enc);

    if (i == -1) {

        *enc = NULL;

    } else {

        if (i == SSL_ENC_NULL_IDX)

            *enc = EVP_enc_null();

        else

            *enc = ssl_cipher_methods[i];

    }

    i = ssl_cipher_info_lookup(ssl_cipher_table_mac, c->algorithm_mac);

    if (i == -1) {

        *md = NULL;

        if (mac_pkey_type != NULL)

            *mac_pkey_type = NID_undef;

        if (mac_secret_size != NULL)

            *mac_secret_size = 0;

        if (c->algorithm_mac == SSL_AEAD)

            mac_pkey_type = NULL;

    } else {

        *md = ssl_digest_methods[i];

        if (mac_pkey_type != NULL)

            *mac_pkey_type = ssl_mac_pkey_id[i];

        if (mac_secret_size != NULL)

            *mac_secret_size = ssl_mac_secret_size[i];

    }

    if ((*enc != NULL) &&

        (*md != NULL || (EVP_CIPHER_flags(*enc) & EVP_CIPH_FLAG_AEAD_CIPHER))

        && (!mac_pkey_type || *mac_pkey_type != NID_undef)) {

        const EVP_CIPHER *evp;

        if (use_etm)

            return 1;

        if (s->ssl_version >> 8 != TLS1_VERSION_MAJOR ||

            s->ssl_version < TLS1_VERSION)

            return 1;

        if (c->algorithm_enc == SSL_RC4 &&

            c->algorithm_mac == SSL_MD5 &&

            (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES128 &&

                 c->algorithm_mac == SSL_SHA1 &&

                 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES256 &&

                 c->algorithm_mac == SSL_SHA1 &&

                 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES128 &&

                 c->algorithm_mac == SSL_SHA256 &&

                 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA256")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES256 &&

                 c->algorithm_mac == SSL_SHA256 &&

                 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA256")))

            *enc = evp, *md = NULL;

        return 1;

    } else {

        return 0;

    }

}

const EVP_MD *ssl_md(int idx)

{

    idx &= SSL_HANDSHAKE_MAC_MASK;

    if (idx < 0 || idx >= SSL_MD_NUM_IDX)

        return NULL;

    return ssl_digest_methods[idx];

}

const EVP_MD *ssl_handshake_md(SSL *s)

{

    return ssl_md(ssl_get_algorithm2(s));

}

const EVP_MD *ssl_prf_md(SSL *s)

{

    return ssl_md(ssl_get_algorithm2(s) >> TLS1_PRF_DGST_SHIFT);

}

#define ITEM_SEP(a) \

        (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))

static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,

                           CIPHER_ORDER **tail)

{

    if (curr == *tail)

        return;

    if (curr == *head)

        *head = curr->next;

    if (curr->prev != NULL)

        curr->prev->next = curr->next;

    if (curr->next != NULL)

        curr->next->prev = curr->prev;

    (*tail)->next = curr;

    curr->prev = *tail;

    curr->next = NULL;

    *tail = curr;

}

static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,

                           CIPHER_ORDER **tail)

{

    if (curr == *head)

        return;

    if (curr == *tail)

        *tail = curr->prev;

    if (curr->next != NULL)

        curr->next->prev = curr->prev;

    if (curr->prev != NULL)

        curr->prev->next = curr->next;

    (*head)->prev = curr;

    curr->next = *head;

    curr->prev = NULL;

    *head = curr;

}

static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,

                                       int num_of_ciphers,

                                       uint32_t disabled_mkey,

                                       uint32_t disabled_auth,

                                       uint32_t disabled_enc,

                                       uint32_t disabled_mac,

                                       CIPHER_ORDER *co_list,

                                       CIPHER_ORDER **head_p,

                                       CIPHER_ORDER **tail_p)

{

    int i, co_list_num;

    const SSL_CIPHER *c;

    /*

     * We have num_of_ciphers descriptions compiled in, depending on the

     * method selected (SSLv3, TLSv1 etc).

     * These will later be sorted in a linked list with at most num

     * entries.

     */

    /* Get the initial list of ciphers */

    co_list_num = 0;            /* actual count of ciphers */

    for (i = 0; i < num_of_ciphers; i++) {

        c = ssl_method->get_cipher(i);

        /* drop those that use any of that is not available */

        if (c == NULL || !c->valid)

            continue;

        if ((c->algorithm_mkey & disabled_mkey) ||

            (c->algorithm_auth & disabled_auth) ||

            (c->algorithm_enc & disabled_enc) ||

            (c->algorithm_mac & disabled_mac))

            continue;

        if (((ssl_method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) == 0) &&

            c->min_tls == 0)

            continue;

        if (((ssl_method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) != 0) &&

            c->min_dtls == 0)

            continue;

        co_list[co_list_num].cipher = c;

        co_list[co_list_num].next = NULL;

        co_list[co_list_num].prev = NULL;

        co_list[co_list_num].active = 0;

        co_list_num++;

    }

    /*

     * Prepare linked list from list entries

     */

    if (co_list_num > 0) {

        co_list[0].prev = NULL;

        if (co_list_num > 1) {

            co_list[0].next = &co_list[1];

            for (i = 1; i < co_list_num - 1; i++) {

                co_list[i].prev = &co_list[i - 1];

                co_list[i].next = &co_list[i + 1];

            }

            co_list[co_list_num - 1].prev = &co_list[co_list_num - 2];

        }

        co_list[co_list_num - 1].next = NULL;

        *head_p = &co_list[0];

        *tail_p = &co_list[co_list_num - 1];

    }

}

static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,

                                       int num_of_group_aliases,

                                       uint32_t disabled_mkey,

                                       uint32_t disabled_auth,

                                       uint32_t disabled_enc,

                                       uint32_t disabled_mac,

                                       CIPHER_ORDER *head)

{

    CIPHER_ORDER *ciph_curr;

    const SSL_CIPHER **ca_curr;

    int i;

    uint32_t mask_mkey = ~disabled_mkey;

    uint32_t mask_auth = ~disabled_auth;

    uint32_t mask_enc = ~disabled_enc;

    uint32_t mask_mac = ~disabled_mac;

    /*

     * First, add the real ciphers as already collected

     */

    ciph_curr = head;

    ca_curr = ca_list;

    while (ciph_curr != NULL) {

        *ca_curr = ciph_curr->cipher;

        ca_curr++;

        ciph_curr = ciph_curr->next;

    }

    /*

     * Now we add the available ones from the cipher_aliases[] table.

     * They represent either one or more algorithms, some of which

     * in any affected category must be supported (set in enabled_mask),

     * or represent a cipher strength value (will be added in any case because algorithms=0).

     */

    for (i = 0; i < num_of_group_aliases; i++) {

        uint32_t algorithm_mkey = cipher_aliases[i].algorithm_mkey;

        uint32_t algorithm_auth = cipher_aliases[i].algorithm_auth;

        uint32_t algorithm_enc = cipher_aliases[i].algorithm_enc;

        uint32_t algorithm_mac = cipher_aliases[i].algorithm_mac;

        if (algorithm_mkey)

            if ((algorithm_mkey & mask_mkey) == 0)

                continue;

        if (algorithm_auth)

            if ((algorithm_auth & mask_auth) == 0)

                continue;

        if (algorithm_enc)

            if ((algorithm_enc & mask_enc) == 0)

                continue;

        if (algorithm_mac)

            if ((algorithm_mac & mask_mac) == 0)

                continue;

        *ca_curr = (SSL_CIPHER *)(cipher_aliases + i);

        ca_curr++;

    }

    *ca_curr = NULL;            /* end of list */

}

static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,

                                  uint32_t alg_auth, uint32_t alg_enc,

                                  uint32_t alg_mac, int min_tls,

                                  uint32_t algo_strength, int rule,

                                  int32_t strength_bits, CIPHER_ORDER **head_p,

                                  CIPHER_ORDER **tail_p)

{

    CIPHER_ORDER *head, *tail, *curr, *next, *last;

    const SSL_CIPHER *cp;

    int reverse = 0;

#ifdef CIPHER_DEBUG

    fprintf(stderr,

            "Applying rule %d with %08x/%08x/%08x/%08x/%08x %08x (%d)\n",

            rule, alg_mkey, alg_auth, alg_enc, alg_mac, min_tls,

            algo_strength, strength_bits);

#endif

    if (rule == CIPHER_DEL || rule == CIPHER_BUMP)

        reverse = 1;            /* needed to maintain sorting between currently

                                 * deleted ciphers */

    head = *head_p;

    tail = *tail_p;

    if (reverse) {

        next = tail;

        last = head;

    } else {

        next = head;

        last = tail;

    }

    curr = NULL;

    for (;;) {

        if (curr == last)

            break;

        curr = next;

        if (curr == NULL)

            break;

        next = reverse ? curr->prev : curr->next;

        cp = curr->cipher;

        /*

         * Selection criteria is either the value of strength_bits

         * or the algorithms used.

         */

        if (strength_bits >= 0) {

            if (strength_bits != cp->strength_bits)

                continue;

        } else {

#ifdef CIPHER_DEBUG

            fprintf(stderr,

                    "\nName: %s:\nAlgo = %08x/%08x/%08x/%08x/%08x Algo_strength = %08x\n",

                    cp->name, cp->algorithm_mkey, cp->algorithm_auth,

                    cp->algorithm_enc, cp->algorithm_mac, cp->min_tls,

                    cp->algo_strength);

#endif

            if (cipher_id != 0 && (cipher_id != cp->id))

                continue;

            if (alg_mkey && !(alg_mkey & cp->algorithm_mkey))

                continue;

            if (alg_auth && !(alg_auth & cp->algorithm_auth))

                continue;

            if (alg_enc && !(alg_enc & cp->algorithm_enc))

                continue;

            if (alg_mac && !(alg_mac & cp->algorithm_mac))

                continue;

            if (min_tls && (min_tls != cp->min_tls))

                continue;

            if ((algo_strength & SSL_STRONG_MASK)

                && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))

                continue;

            if ((algo_strength & SSL_DEFAULT_MASK)

                && !(algo_strength & SSL_DEFAULT_MASK & cp->algo_strength))

                continue;

        }

#ifdef CIPHER_DEBUG

        fprintf(stderr, "Action = %d\n", rule);

#endif

        /* add the cipher if it has not been added yet. */

        if (rule == CIPHER_ADD) {

            /* reverse == 0 */

            if (!curr->active) {

                ll_append_tail(&head, curr, &tail);

                curr->active = 1;

            }

        }

        /* Move the added cipher to this location */

        else if (rule == CIPHER_ORD) {

            /* reverse == 0 */

            if (curr->active) {

                ll_append_tail(&head, curr, &tail);

            }

        } else if (rule == CIPHER_DEL) {

            /* reverse == 1 */

            if (curr->active) {

                /*

                 * most recently deleted ciphersuites get best positions for

                 * any future CIPHER_ADD (note that the CIPHER_DEL loop works

                 * in reverse to maintain the order)

                 */

                ll_append_head(&head, curr, &tail);

                curr->active = 0;

            }

        } else if (rule == CIPHER_BUMP) {

            if (curr->active)

                ll_append_head(&head, curr, &tail);

        } else if (rule == CIPHER_KILL) {

            /* reverse == 0 */

            if (head == curr)

                head = curr->next;

            else

                curr->prev->next = curr->next;

            if (tail == curr)

                tail = curr->prev;

            curr->active = 0;

            if (curr->next != NULL)

                curr->next->prev = curr->prev;

            if (curr->prev != NULL)

                curr->prev->next = curr->next;

            curr->next = NULL;

            curr->prev = NULL;

        }

    }

    *head_p = head;

    *tail_p = tail;

}

static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,

                                    CIPHER_ORDER **tail_p)

{

    int32_t max_strength_bits;

    int i, *number_uses;

    CIPHER_ORDER *curr;

    /*

     * This routine sorts the ciphers with descending strength. The sorting

     * must keep the pre-sorted sequence, so we apply the normal sorting

     * routine as '+' movement to the end of the list.

     */

    max_strength_bits = 0;

    curr = *head_p;

    while (curr != NULL) {

        if (curr->active && (curr->cipher->strength_bits > max_strength_bits))

            max_strength_bits = curr->cipher->strength_bits;

        curr = curr->next;

    }

    number_uses = OPENSSL_zalloc(sizeof(int) * (max_strength_bits + 1));

    if (number_uses == NULL) {

        SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT, ERR_R_MALLOC_FAILURE);

        return 0;

    }

    /*

     * Now find the strength_bits values actually used

     */

    curr = *head_p;

    while (curr != NULL) {

        if (curr->active)

            number_uses[curr->cipher->strength_bits]++;

        curr = curr->next;

    }

    /*

     * Go through the list of used strength_bits values in descending

     * order.

     */

    for (i = max_strength_bits; i >= 0; i--)

        if (number_uses[i] > 0)

            ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p,

                                  tail_p);

    OPENSSL_free(number_uses);

    return 1;

}

static int ssl_cipher_process_rulestr(const char *rule_str,

                                      CIPHER_ORDER **head_p,

                                      CIPHER_ORDER **tail_p,

                                      const SSL_CIPHER **ca_list, CERT *c)

{

    uint32_t alg_mkey, alg_auth, alg_enc, alg_mac, algo_strength;

    int min_tls;

    const char *l, *buf;

    int j, multi, found, rule, retval, ok, buflen;

    uint32_t cipher_id = 0;

    char ch;

    retval = 1;

    l = rule_str;

    for ( ; ; ) {

        ch = *l;

        if (ch == '\0')

            break;              /* done */

        if (ch == '-') {

            rule = CIPHER_DEL;

            l++;

        } else if (ch == '+') {

            rule = CIPHER_ORD;

            l++;

        } else if (ch == '!') {

            rule = CIPHER_KILL;

            l++;

        } else if (ch == '@') {

            rule = CIPHER_SPECIAL;

            l++;

        } else {

            rule = CIPHER_ADD;

        }

        if (ITEM_SEP(ch)) {

            l++;

            continue;

        }

        alg_mkey = 0;

        alg_auth = 0;

        alg_enc = 0;

        alg_mac = 0;

        min_tls = 0;

        algo_strength = 0;

        for (;;) {

            ch = *l;

            buf = l;

            buflen = 0;

#ifndef CHARSET_EBCDIC

            while (((ch >= 'A') && (ch <= 'Z')) ||

                   ((ch >= '0') && (ch <= '9')) ||

                   ((ch >= 'a') && (ch <= 'z')) ||

                   (ch == '-') || (ch == '.') || (ch == '='))

#else

            while (isalnum((unsigned char)ch) || (ch == '-') || (ch == '.')

                   || (ch == '='))

#endif

            {

                ch = *(++l);

                buflen++;

            }

            if (buflen == 0) {

                /*

                 * We hit something we cannot deal with,

                 * it is no command or separator nor

                 * alphanumeric, so we call this an error.

                 */

                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND);

                return 0;

            }

            if (rule == CIPHER_SPECIAL) {

                found = 0;      /* unused -- avoid compiler warning */

                break;          /* special treatment */

            }

            /* check for multi-part specification */

            if (ch == '+') {

                multi = 1;

                l++;

            } else {

                multi = 0;

            }

            /*

             * Now search for the cipher alias in the ca_list. Be careful

             * with the strncmp, because the "buflen" limitation

             * will make the rule "ADH:SOME" and the cipher

             * "ADH-MY-CIPHER" look like a match for buflen=3.

             * So additionally check whether the cipher name found

             * has the correct length. We can save a strlen() call:

             * just checking for the '\0' at the right place is

             * sufficient, we have to strncmp() anyway. (We cannot

             * use strcmp(), because buf is not '\0' terminated.)

             */

            j = found = 0;