/*

 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.

 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved

 * Copyright 2005 Nokia. All rights reserved.

 *

 * Licensed under the OpenSSL license (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

/* for secure_getenv */

#define _GNU_SOURCE

#include <stdio.h>

#include <ctype.h>

#include <openssl/objects.h>

#include <openssl/comp.h>

#include <openssl/engine.h>

#include <openssl/crypto.h>

#include <openssl/conf.h>

#include "internal/nelem.h"

#include "ssl_local.h"

#include "internal/thread_once.h"

#include "internal/cryptlib.h"

#define SSL_ENC_DES_IDX         0

#define SSL_ENC_3DES_IDX        1

#define SSL_ENC_RC4_IDX         2

#define SSL_ENC_RC2_IDX         3

#define SSL_ENC_IDEA_IDX        4

#define SSL_ENC_NULL_IDX        5

#define SSL_ENC_AES128_IDX      6

#define SSL_ENC_AES256_IDX      7

#define SSL_ENC_CAMELLIA128_IDX 8

#define SSL_ENC_CAMELLIA256_IDX 9

#define SSL_ENC_GOST89_IDX      10

#define SSL_ENC_SEED_IDX        11

#define SSL_ENC_AES128GCM_IDX   12

#define SSL_ENC_AES256GCM_IDX   13

#define SSL_ENC_AES128CCM_IDX   14

#define SSL_ENC_AES256CCM_IDX   15

#define SSL_ENC_AES128CCM8_IDX  16

#define SSL_ENC_AES256CCM8_IDX  17

#define SSL_ENC_GOST8912_IDX    18

#define SSL_ENC_CHACHA_IDX      19

#define SSL_ENC_ARIA128GCM_IDX  20

#define SSL_ENC_ARIA256GCM_IDX  21

#define SSL_ENC_NUM_IDX         22

/* NB: make sure indices in these tables match values above */

typedef struct {

    uint32_t mask;

    int nid;

} ssl_cipher_table;

/* Table of NIDs for each cipher */

static const ssl_cipher_table ssl_cipher_table_cipher[SSL_ENC_NUM_IDX] = {

    {SSL_DES, NID_des_cbc},     /* SSL_ENC_DES_IDX 0 */

    {SSL_3DES, NID_des_ede3_cbc}, /* SSL_ENC_3DES_IDX 1 */

    {SSL_RC4, NID_rc4},         /* SSL_ENC_RC4_IDX 2 */

    {SSL_RC2, NID_rc2_cbc},     /* SSL_ENC_RC2_IDX 3 */

    {SSL_IDEA, NID_idea_cbc},   /* SSL_ENC_IDEA_IDX 4 */

    {SSL_eNULL, NID_undef},     /* SSL_ENC_NULL_IDX 5 */

    {SSL_AES128, NID_aes_128_cbc}, /* SSL_ENC_AES128_IDX 6 */

    {SSL_AES256, NID_aes_256_cbc}, /* SSL_ENC_AES256_IDX 7 */

    {SSL_CAMELLIA128, NID_camellia_128_cbc}, /* SSL_ENC_CAMELLIA128_IDX 8 */

    {SSL_CAMELLIA256, NID_camellia_256_cbc}, /* SSL_ENC_CAMELLIA256_IDX 9 */

    {SSL_eGOST2814789CNT, NID_gost89_cnt}, /* SSL_ENC_GOST89_IDX 10 */

    {SSL_SEED, NID_seed_cbc},   /* SSL_ENC_SEED_IDX 11 */

    {SSL_AES128GCM, NID_aes_128_gcm}, /* SSL_ENC_AES128GCM_IDX 12 */

    {SSL_AES256GCM, NID_aes_256_gcm}, /* SSL_ENC_AES256GCM_IDX 13 */

    {SSL_AES128CCM, NID_aes_128_ccm}, /* SSL_ENC_AES128CCM_IDX 14 */

    {SSL_AES256CCM, NID_aes_256_ccm}, /* SSL_ENC_AES256CCM_IDX 15 */

    {SSL_AES128CCM8, NID_aes_128_ccm}, /* SSL_ENC_AES128CCM8_IDX 16 */

    {SSL_AES256CCM8, NID_aes_256_ccm}, /* SSL_ENC_AES256CCM8_IDX 17 */

    {SSL_eGOST2814789CNT12, NID_gost89_cnt_12}, /* SSL_ENC_GOST8912_IDX 18 */

    {SSL_CHACHA20POLY1305, NID_chacha20_poly1305}, /* SSL_ENC_CHACHA_IDX 19 */

    {SSL_ARIA128GCM, NID_aria_128_gcm}, /* SSL_ENC_ARIA128GCM_IDX 20 */

    {SSL_ARIA256GCM, NID_aria_256_gcm}, /* SSL_ENC_ARIA256GCM_IDX 21 */

};

static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX];

#define SSL_COMP_NULL_IDX       0

#define SSL_COMP_ZLIB_IDX       1

#define SSL_COMP_NUM_IDX        2

static STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;

#ifndef OPENSSL_NO_COMP

static CRYPTO_ONCE ssl_load_builtin_comp_once = CRYPTO_ONCE_STATIC_INIT;

#endif

/*

 * Constant SSL_MAX_DIGEST equal to size of digests array should be defined

 * in the ssl_local.h

 */

#define SSL_MD_NUM_IDX  SSL_MAX_DIGEST

/* NB: make sure indices in this table matches values above */

static const ssl_cipher_table ssl_cipher_table_mac[SSL_MD_NUM_IDX] = {

    {SSL_MD5, NID_md5},         /* SSL_MD_MD5_IDX 0 */

    {SSL_SHA1, NID_sha1},       /* SSL_MD_SHA1_IDX 1 */

    {SSL_GOST94, NID_id_GostR3411_94}, /* SSL_MD_GOST94_IDX 2 */

    {SSL_GOST89MAC, NID_id_Gost28147_89_MAC}, /* SSL_MD_GOST89MAC_IDX 3 */

    {SSL_SHA256, NID_sha256},   /* SSL_MD_SHA256_IDX 4 */

    {SSL_SHA384, NID_sha384},   /* SSL_MD_SHA384_IDX 5 */

    {SSL_GOST12_256, NID_id_GostR3411_2012_256}, /* SSL_MD_GOST12_256_IDX 6 */

    {SSL_GOST89MAC12, NID_gost_mac_12}, /* SSL_MD_GOST89MAC12_IDX 7 */

    {SSL_GOST12_512, NID_id_GostR3411_2012_512}, /* SSL_MD_GOST12_512_IDX 8 */

    {0, NID_md5_sha1},          /* SSL_MD_MD5_SHA1_IDX 9 */

    {0, NID_sha224},            /* SSL_MD_SHA224_IDX 10 */

    {0, NID_sha512}             /* SSL_MD_SHA512_IDX 11 */

};

static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = {

    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL

};

/* *INDENT-OFF* */

static const ssl_cipher_table ssl_cipher_table_kx[] = {

    {SSL_kRSA,      NID_kx_rsa},

    {SSL_kECDHE,    NID_kx_ecdhe},

    {SSL_kDHE,      NID_kx_dhe},

    {SSL_kECDHEPSK, NID_kx_ecdhe_psk},

    {SSL_kDHEPSK,   NID_kx_dhe_psk},

    {SSL_kRSAPSK,   NID_kx_rsa_psk},

    {SSL_kPSK,      NID_kx_psk},

    {SSL_kSRP,      NID_kx_srp},

    {SSL_kGOST,     NID_kx_gost},

    {SSL_kANY,      NID_kx_any}

};

static const ssl_cipher_table ssl_cipher_table_auth[] = {

    {SSL_aRSA,    NID_auth_rsa},

    {SSL_aECDSA,  NID_auth_ecdsa},

    {SSL_aPSK,    NID_auth_psk},

    {SSL_aDSS,    NID_auth_dss},

    {SSL_aGOST01, NID_auth_gost01},

    {SSL_aGOST12, NID_auth_gost12},

    {SSL_aSRP,    NID_auth_srp},

    {SSL_aNULL,   NID_auth_null},

    {SSL_aANY,    NID_auth_any}

};

/* *INDENT-ON* */

/* Utility function for table lookup */

static int ssl_cipher_info_find(const ssl_cipher_table * table,

                                size_t table_cnt, uint32_t mask)

{

    size_t i;

    for (i = 0; i < table_cnt; i++, table++) {

        if (table->mask == mask)

            return (int)i;

    }

    return -1;

}

#define ssl_cipher_info_lookup(table, x) \

    ssl_cipher_info_find(table, OSSL_NELEM(table), x)

/*

 * PKEY_TYPE for GOST89MAC is known in advance, but, because implementation

 * is engine-provided, we'll fill it only if corresponding EVP_PKEY_METHOD is

 * found

 */

static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {

    /* MD5, SHA, GOST94, MAC89 */

    EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,

    /* SHA256, SHA384, GOST2012_256, MAC89-12 */

    EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,

    /* GOST2012_512 */

    EVP_PKEY_HMAC,

    /* MD5/SHA1, SHA224, SHA512 */

    NID_undef, NID_undef, NID_undef

};

static size_t ssl_mac_secret_size[SSL_MD_NUM_IDX];

#define CIPHER_ADD      1

#define CIPHER_KILL     2

#define CIPHER_DEL      3

#define CIPHER_ORD      4

#define CIPHER_SPECIAL  5

/*

 * Bump the ciphers to the top of the list.

 * This rule isn't currently supported by the public cipherstring API.

 */

#define CIPHER_BUMP     6

typedef struct cipher_order_st {

    const SSL_CIPHER *cipher;

    int active;

    int dead;

    struct cipher_order_st *next, *prev;

} CIPHER_ORDER;

static const SSL_CIPHER cipher_aliases[] = {

    /* "ALL" doesn't include eNULL (must be specifically enabled) */

    {0, SSL_TXT_ALL, NULL, 0, 0, 0, ~SSL_eNULL},

    /* "COMPLEMENTOFALL" */

    {0, SSL_TXT_CMPALL, NULL, 0, 0, 0, SSL_eNULL},

    /*

     * "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in

     * ALL!)

     */

    {0, SSL_TXT_CMPDEF, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_NOT_DEFAULT},

    /*

     * key exchange aliases (some of those using only a single bit here

     * combine multiple key exchange algs according to the RFCs, e.g. kDHE

     * combines DHE_DSS and DHE_RSA)

     */

    {0, SSL_TXT_kRSA, NULL, 0, SSL_kRSA},

    {0, SSL_TXT_kEDH, NULL, 0, SSL_kDHE},

    {0, SSL_TXT_kDHE, NULL, 0, SSL_kDHE},

    {0, SSL_TXT_DH, NULL, 0, SSL_kDHE},

    {0, SSL_TXT_kEECDH, NULL, 0, SSL_kECDHE},

    {0, SSL_TXT_kECDHE, NULL, 0, SSL_kECDHE},

    {0, SSL_TXT_ECDH, NULL, 0, SSL_kECDHE},

    {0, SSL_TXT_kPSK, NULL, 0, SSL_kPSK},

    {0, SSL_TXT_kRSAPSK, NULL, 0, SSL_kRSAPSK},

    {0, SSL_TXT_kECDHEPSK, NULL, 0, SSL_kECDHEPSK},

    {0, SSL_TXT_kDHEPSK, NULL, 0, SSL_kDHEPSK},

    {0, SSL_TXT_kSRP, NULL, 0, SSL_kSRP},

    {0, SSL_TXT_kGOST, NULL, 0, SSL_kGOST},

    /* server authentication aliases */

    {0, SSL_TXT_aRSA, NULL, 0, 0, SSL_aRSA},

    {0, SSL_TXT_aDSS, NULL, 0, 0, SSL_aDSS},

    {0, SSL_TXT_DSS, NULL, 0, 0, SSL_aDSS},

    {0, SSL_TXT_aNULL, NULL, 0, 0, SSL_aNULL},

    {0, SSL_TXT_aECDSA, NULL, 0, 0, SSL_aECDSA},

    {0, SSL_TXT_ECDSA, NULL, 0, 0, SSL_aECDSA},

    {0, SSL_TXT_aPSK, NULL, 0, 0, SSL_aPSK},

    {0, SSL_TXT_aGOST01, NULL, 0, 0, SSL_aGOST01},

    {0, SSL_TXT_aGOST12, NULL, 0, 0, SSL_aGOST12},

    {0, SSL_TXT_aGOST, NULL, 0, 0, SSL_aGOST01 | SSL_aGOST12},

    {0, SSL_TXT_aSRP, NULL, 0, 0, SSL_aSRP},

    /* aliases combining key exchange and server authentication */

    {0, SSL_TXT_EDH, NULL, 0, SSL_kDHE, ~SSL_aNULL},

    {0, SSL_TXT_DHE, NULL, 0, SSL_kDHE, ~SSL_aNULL},

    {0, SSL_TXT_EECDH, NULL, 0, SSL_kECDHE, ~SSL_aNULL},

    {0, SSL_TXT_ECDHE, NULL, 0, SSL_kECDHE, ~SSL_aNULL},

    {0, SSL_TXT_NULL, NULL, 0, 0, 0, SSL_eNULL},

    {0, SSL_TXT_RSA, NULL, 0, SSL_kRSA, SSL_aRSA},

    {0, SSL_TXT_ADH, NULL, 0, SSL_kDHE, SSL_aNULL},

    {0, SSL_TXT_AECDH, NULL, 0, SSL_kECDHE, SSL_aNULL},

    {0, SSL_TXT_PSK, NULL, 0, SSL_PSK},

    {0, SSL_TXT_SRP, NULL, 0, SSL_kSRP},

    /* symmetric encryption aliases */

    {0, SSL_TXT_3DES, NULL, 0, 0, 0, SSL_3DES},

    {0, SSL_TXT_RC4, NULL, 0, 0, 0, SSL_RC4},

    {0, SSL_TXT_RC2, NULL, 0, 0, 0, SSL_RC2},

    {0, SSL_TXT_IDEA, NULL, 0, 0, 0, SSL_IDEA},

    {0, SSL_TXT_SEED, NULL, 0, 0, 0, SSL_SEED},

    {0, SSL_TXT_eNULL, NULL, 0, 0, 0, SSL_eNULL},

    {0, SSL_TXT_GOST, NULL, 0, 0, 0, SSL_eGOST2814789CNT | SSL_eGOST2814789CNT12},

    {0, SSL_TXT_AES128, NULL, 0, 0, 0,

     SSL_AES128 | SSL_AES128GCM | SSL_AES128CCM | SSL_AES128CCM8},

    {0, SSL_TXT_AES256, NULL, 0, 0, 0,

     SSL_AES256 | SSL_AES256GCM | SSL_AES256CCM | SSL_AES256CCM8},

    {0, SSL_TXT_AES, NULL, 0, 0, 0, SSL_AES},

    {0, SSL_TXT_AES_GCM, NULL, 0, 0, 0, SSL_AES128GCM | SSL_AES256GCM},

    {0, SSL_TXT_AES_CCM, NULL, 0, 0, 0,

     SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8},

    {0, SSL_TXT_AES_CCM_8, NULL, 0, 0, 0, SSL_AES128CCM8 | SSL_AES256CCM8},

    {0, SSL_TXT_CAMELLIA128, NULL, 0, 0, 0, SSL_CAMELLIA128},

    {0, SSL_TXT_CAMELLIA256, NULL, 0, 0, 0, SSL_CAMELLIA256},

    {0, SSL_TXT_CAMELLIA, NULL, 0, 0, 0, SSL_CAMELLIA},

    {0, SSL_TXT_CHACHA20, NULL, 0, 0, 0, SSL_CHACHA20},

    {0, SSL_TXT_ARIA, NULL, 0, 0, 0, SSL_ARIA},

    {0, SSL_TXT_ARIA_GCM, NULL, 0, 0, 0, SSL_ARIA128GCM | SSL_ARIA256GCM},

    {0, SSL_TXT_ARIA128, NULL, 0, 0, 0, SSL_ARIA128GCM},

    {0, SSL_TXT_ARIA256, NULL, 0, 0, 0, SSL_ARIA256GCM},

    /* MAC aliases */

    {0, SSL_TXT_MD5, NULL, 0, 0, 0, 0, SSL_MD5},

    {0, SSL_TXT_SHA1, NULL, 0, 0, 0, 0, SSL_SHA1},

    {0, SSL_TXT_SHA, NULL, 0, 0, 0, 0, SSL_SHA1},

    {0, SSL_TXT_GOST94, NULL, 0, 0, 0, 0, SSL_GOST94},

    {0, SSL_TXT_GOST89MAC, NULL, 0, 0, 0, 0, SSL_GOST89MAC | SSL_GOST89MAC12},

    {0, SSL_TXT_SHA256, NULL, 0, 0, 0, 0, SSL_SHA256},

    {0, SSL_TXT_SHA384, NULL, 0, 0, 0, 0, SSL_SHA384},

    {0, SSL_TXT_GOST12, NULL, 0, 0, 0, 0, SSL_GOST12_256},

    /* protocol version aliases */

    {0, SSL_TXT_SSLV3, NULL, 0, 0, 0, 0, 0, SSL3_VERSION},

    {0, SSL_TXT_TLSV1, NULL, 0, 0, 0, 0, 0, TLS1_VERSION},

    {0, "TLSv1.0", NULL, 0, 0, 0, 0, 0, TLS1_VERSION},

    {0, SSL_TXT_TLSV1_2, NULL, 0, 0, 0, 0, 0, TLS1_2_VERSION},

    /* strength classes */

    {0, SSL_TXT_LOW, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_LOW},

    {0, SSL_TXT_MEDIUM, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_MEDIUM},

    {0, SSL_TXT_HIGH, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_HIGH},

    /* FIPS 140-2 approved ciphersuite */

    {0, SSL_TXT_FIPS, NULL, 0, 0, 0, ~SSL_eNULL, 0, 0, 0, 0, 0, SSL_FIPS},

    /* "EDH-" aliases to "DHE-" labels (for backward compatibility) */

    {0, SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, NULL, 0,

     SSL_kDHE, SSL_aDSS, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS},

    {0, SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, NULL, 0,

     SSL_kDHE, SSL_aRSA, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS},

};

/*

 * Search for public key algorithm with given name and return its pkey_id if

 * it is available. Otherwise return 0

 */

#ifdef OPENSSL_NO_ENGINE

static int get_optional_pkey_id(const char *pkey_name)

{

    const EVP_PKEY_ASN1_METHOD *ameth;

    int pkey_id = 0;

    ameth = EVP_PKEY_asn1_find_str(NULL, pkey_name, -1);

    if (ameth && EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL,

                                         ameth) > 0)

        return pkey_id;

    return 0;

}

#else

static int get_optional_pkey_id(const char *pkey_name)

{

    const EVP_PKEY_ASN1_METHOD *ameth;

    ENGINE *tmpeng = NULL;

    int pkey_id = 0;

    ameth = EVP_PKEY_asn1_find_str(&tmpeng, pkey_name, -1);

    if (ameth) {

        if (EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL,

                                    ameth) <= 0)

            pkey_id = 0;

    }

    ENGINE_finish(tmpeng);

    return pkey_id;

}

#endif

/* masks of disabled algorithms */

static uint32_t disabled_enc_mask;

static uint32_t disabled_mac_mask;

static uint32_t disabled_mkey_mask;

static uint32_t disabled_auth_mask;

int ssl_load_ciphers(void)

{

    size_t i;

    const ssl_cipher_table *t;

    disabled_enc_mask = 0;

    ssl_sort_cipher_list();

    for (i = 0, t = ssl_cipher_table_cipher; i < SSL_ENC_NUM_IDX; i++, t++) {

        if (t->nid == NID_undef) {

            ssl_cipher_methods[i] = NULL;

        } else {

            const EVP_CIPHER *cipher = EVP_get_cipherbynid(t->nid);

            ssl_cipher_methods[i] = cipher;

            if (cipher == NULL)

                disabled_enc_mask |= t->mask;

        }

    }

    disabled_mac_mask = 0;

    for (i = 0, t = ssl_cipher_table_mac; i < SSL_MD_NUM_IDX; i++, t++) {

        const EVP_MD *md = EVP_get_digestbynid(t->nid);

        ssl_digest_methods[i] = md;

        if (md == NULL) {

            disabled_mac_mask |= t->mask;

        } else {

            int tmpsize = EVP_MD_size(md);

            if (!ossl_assert(tmpsize >= 0))

                return 0;

            ssl_mac_secret_size[i] = tmpsize;

        }

    }

    /* Make sure we can access MD5 and SHA1 */

    if (!FIPS_mode() && !ossl_assert(ssl_digest_methods[SSL_MD_MD5_IDX] != NULL))

        return 0;

    if (!ossl_assert(ssl_digest_methods[SSL_MD_SHA1_IDX] != NULL))

        return 0;

    disabled_mkey_mask = 0;

    disabled_auth_mask = 0;

#ifdef OPENSSL_NO_RSA

    disabled_mkey_mask |= SSL_kRSA | SSL_kRSAPSK;

    disabled_auth_mask |= SSL_aRSA;

#endif

#ifdef OPENSSL_NO_DSA

    disabled_auth_mask |= SSL_aDSS;

#endif

#ifdef OPENSSL_NO_DH

    disabled_mkey_mask |= SSL_kDHE | SSL_kDHEPSK;

#endif

#ifdef OPENSSL_NO_EC

    disabled_mkey_mask |= SSL_kECDHE | SSL_kECDHEPSK;

    disabled_auth_mask |= SSL_aECDSA;

#endif

#ifdef OPENSSL_NO_PSK

    disabled_mkey_mask |= SSL_PSK;

    disabled_auth_mask |= SSL_aPSK;

#endif

#ifdef OPENSSL_NO_SRP

    disabled_mkey_mask |= SSL_kSRP;

#endif

    /*

     * Check for presence of GOST 34.10 algorithms, and if they are not

     * present, disable appropriate auth and key exchange

     */

    ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac");

    if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX])

        ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32;

    else

        disabled_mac_mask |= SSL_GOST89MAC;

    ssl_mac_pkey_id[SSL_MD_GOST89MAC12_IDX] =

        get_optional_pkey_id("gost-mac-12");

    if (ssl_mac_pkey_id[SSL_MD_GOST89MAC12_IDX])

        ssl_mac_secret_size[SSL_MD_GOST89MAC12_IDX] = 32;

    else

        disabled_mac_mask |= SSL_GOST89MAC12;

    if (!get_optional_pkey_id("gost2001"))

        disabled_auth_mask |= SSL_aGOST01 | SSL_aGOST12;

    if (!get_optional_pkey_id("gost2012_256"))

        disabled_auth_mask |= SSL_aGOST12;

    if (!get_optional_pkey_id("gost2012_512"))

        disabled_auth_mask |= SSL_aGOST12;

    /*

     * Disable GOST key exchange if no GOST signature algs are available *

     */

    if ((disabled_auth_mask & (SSL_aGOST01 | SSL_aGOST12)) ==

        (SSL_aGOST01 | SSL_aGOST12))

        disabled_mkey_mask |= SSL_kGOST;

    return 1;

}

#ifndef OPENSSL_NO_COMP

static int sk_comp_cmp(const SSL_COMP *const *a, const SSL_COMP *const *b)

{

    return ((*a)->id - (*b)->id);

}

DEFINE_RUN_ONCE_STATIC(do_load_builtin_compressions)

{

    SSL_COMP *comp = NULL;

    COMP_METHOD *method = COMP_zlib();

    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE);

    ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);

    if (COMP_get_type(method) != NID_undef && ssl_comp_methods != NULL) {

        comp = OPENSSL_malloc(sizeof(*comp));

        if (comp != NULL) {

            comp->method = method;

            comp->id = SSL_COMP_ZLIB_IDX;

            comp->name = COMP_get_name(method);

            sk_SSL_COMP_push(ssl_comp_methods, comp);

            sk_SSL_COMP_sort(ssl_comp_methods);

        }

    }

    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE);

    return 1;

}

static int load_builtin_compressions(void)

{

    return RUN_ONCE(&ssl_load_builtin_comp_once, do_load_builtin_compressions);

}

#endif

int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,

                       const EVP_MD **md, int *mac_pkey_type,

                       size_t *mac_secret_size, SSL_COMP **comp, int use_etm)

{

    int i;

    const SSL_CIPHER *c;

    c = s->cipher;

    if (c == NULL)

        return 0;

    if (comp != NULL) {

        SSL_COMP ctmp;

#ifndef OPENSSL_NO_COMP

        if (!load_builtin_compressions()) {

            /*

             * Currently don't care, since a failure only means that

             * ssl_comp_methods is NULL, which is perfectly OK

             */

        }

#endif

        *comp = NULL;

        ctmp.id = s->compress_meth;

        if (ssl_comp_methods != NULL) {

            i = sk_SSL_COMP_find(ssl_comp_methods, &ctmp);

            *comp = sk_SSL_COMP_value(ssl_comp_methods, i);

        }

        /* If were only interested in comp then return success */

        if ((enc == NULL) && (md == NULL))

            return 1;

    }

    if ((enc == NULL) || (md == NULL))

        return 0;

    i = ssl_cipher_info_lookup(ssl_cipher_table_cipher, c->algorithm_enc);

    if (i == -1) {

        *enc = NULL;

    } else {

        if (i == SSL_ENC_NULL_IDX)

            *enc = EVP_enc_null();

        else

            *enc = ssl_cipher_methods[i];

    }

    i = ssl_cipher_info_lookup(ssl_cipher_table_mac, c->algorithm_mac);

    if (i == -1) {

        *md = NULL;

        if (mac_pkey_type != NULL)

            *mac_pkey_type = NID_undef;

        if (mac_secret_size != NULL)

            *mac_secret_size = 0;

        if (c->algorithm_mac == SSL_AEAD)

            mac_pkey_type = NULL;

    } else {

        *md = ssl_digest_methods[i];

        if (mac_pkey_type != NULL)

            *mac_pkey_type = ssl_mac_pkey_id[i];

        if (mac_secret_size != NULL)

            *mac_secret_size = ssl_mac_secret_size[i];

    }

    if ((*enc != NULL) &&

        (*md != NULL || (EVP_CIPHER_flags(*enc) & EVP_CIPH_FLAG_AEAD_CIPHER))

        && (!mac_pkey_type || *mac_pkey_type != NID_undef)) {

        const EVP_CIPHER *evp;

        if (use_etm)

            return 1;

        if (s->ssl_version >> 8 != TLS1_VERSION_MAJOR ||

            s->ssl_version < TLS1_VERSION)

            return 1;

        if (FIPS_mode())

            return 1;

        if (c->algorithm_enc == SSL_RC4 &&

            c->algorithm_mac == SSL_MD5 &&

            (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES128 &&

                 c->algorithm_mac == SSL_SHA1 &&

                 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES256 &&

                 c->algorithm_mac == SSL_SHA1 &&

                 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES128 &&

                 c->algorithm_mac == SSL_SHA256 &&

                 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA256")))

            *enc = evp, *md = NULL;

        else if (c->algorithm_enc == SSL_AES256 &&

                 c->algorithm_mac == SSL_SHA256 &&

                 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA256")))

            *enc = evp, *md = NULL;

        return 1;

    } else {

        return 0;

    }

}

const EVP_MD *ssl_md(int idx)

{

    idx &= SSL_HANDSHAKE_MAC_MASK;

    if (idx < 0 || idx >= SSL_MD_NUM_IDX)

        return NULL;

    return ssl_digest_methods[idx];

}

const EVP_MD *ssl_handshake_md(SSL *s)

{

    return ssl_md(ssl_get_algorithm2(s));

}

const EVP_MD *ssl_prf_md(SSL *s)

{

    return ssl_md(ssl_get_algorithm2(s) >> TLS1_PRF_DGST_SHIFT);

}

#define ITEM_SEP(a) \

        (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))

static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,

                           CIPHER_ORDER **tail)

{

    if (curr == *tail)

        return;

    if (curr == *head)

        *head = curr->next;

    if (curr->prev != NULL)

        curr->prev->next = curr->next;

    if (curr->next != NULL)

        curr->next->prev = curr->prev;

    (*tail)->next = curr;

    curr->prev = *tail;

    curr->next = NULL;

    *tail = curr;

}

static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,

                           CIPHER_ORDER **tail)

{

    if (curr == *head)

        return;

    if (curr == *tail)

        *tail = curr->prev;

    if (curr->next != NULL)

        curr->next->prev = curr->prev;

    if (curr->prev != NULL)

        curr->prev->next = curr->next;

    (*head)->prev = curr;

    curr->next = *head;

    curr->prev = NULL;

    *head = curr;

}

static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,

                                       int num_of_ciphers,

                                       uint32_t disabled_mkey,

                                       uint32_t disabled_auth,

                                       uint32_t disabled_enc,

                                       uint32_t disabled_mac,

                                       CIPHER_ORDER *co_list,

                                       CIPHER_ORDER **head_p,

                                       CIPHER_ORDER **tail_p)

{

    int i, co_list_num;

    const SSL_CIPHER *c;

    /*

     * We have num_of_ciphers descriptions compiled in, depending on the

     * method selected (SSLv3, TLSv1 etc).

     * These will later be sorted in a linked list with at most num

     * entries.

     */

    /* Get the initial list of ciphers */

    co_list_num = 0;            /* actual count of ciphers */

    for (i = 0; i < num_of_ciphers; i++) {

        c = ssl_method->get_cipher(i);

        /* drop those that use any of that is not available */

        if (c == NULL || !c->valid)

            continue;

        if (FIPS_mode() && !(c->algo_strength & SSL_FIPS))

            continue;

        if ((c->algorithm_mkey & disabled_mkey) ||

            (c->algorithm_auth & disabled_auth) ||

            (c->algorithm_enc & disabled_enc) ||

            (c->algorithm_mac & disabled_mac))

            continue;

        if (((ssl_method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) == 0) &&

            c->min_tls == 0)

            continue;

        if (((ssl_method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS) != 0) &&

            c->min_dtls == 0)

            continue;

        co_list[co_list_num].cipher = c;

        co_list[co_list_num].next = NULL;

        co_list[co_list_num].prev = NULL;

        co_list[co_list_num].active = 0;

        co_list_num++;

    }

    /*

     * Prepare linked list from list entries

     */

    if (co_list_num > 0) {

        co_list[0].prev = NULL;

        if (co_list_num > 1) {

            co_list[0].next = &co_list[1];

            for (i = 1; i < co_list_num - 1; i++) {

                co_list[i].prev = &co_list[i - 1];

                co_list[i].next = &co_list[i + 1];

            }

            co_list[co_list_num - 1].prev = &co_list[co_list_num - 2];

        }

        co_list[co_list_num - 1].next = NULL;

        *head_p = &co_list[0];

        *tail_p = &co_list[co_list_num - 1];

    }

}

static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,

                                       int num_of_group_aliases,

                                       uint32_t disabled_mkey,

                                       uint32_t disabled_auth,

                                       uint32_t disabled_enc,

                                       uint32_t disabled_mac,

                                       CIPHER_ORDER *head)

{

    CIPHER_ORDER *ciph_curr;

    const SSL_CIPHER **ca_curr;

    int i;

    uint32_t mask_mkey = ~disabled_mkey;

    uint32_t mask_auth = ~disabled_auth;

    uint32_t mask_enc = ~disabled_enc;

    uint32_t mask_mac = ~disabled_mac;

    /*

     * First, add the real ciphers as already collected

     */

    ciph_curr = head;

    ca_curr = ca_list;

    while (ciph_curr != NULL) {

        *ca_curr = ciph_curr->cipher;

        ca_curr++;

        ciph_curr = ciph_curr->next;

    }

    /*

     * Now we add the available ones from the cipher_aliases[] table.

     * They represent either one or more algorithms, some of which

     * in any affected category must be supported (set in enabled_mask),

     * or represent a cipher strength value (will be added in any case because algorithms=0).

     */

    for (i = 0; i < num_of_group_aliases; i++) {

        uint32_t algorithm_mkey = cipher_aliases[i].algorithm_mkey;

        uint32_t algorithm_auth = cipher_aliases[i].algorithm_auth;

        uint32_t algorithm_enc = cipher_aliases[i].algorithm_enc;

        uint32_t algorithm_mac = cipher_aliases[i].algorithm_mac;

        if (algorithm_mkey)

            if ((algorithm_mkey & mask_mkey) == 0)

                continue;

        if (algorithm_auth)

            if ((algorithm_auth & mask_auth) == 0)

                continue;

        if (algorithm_enc)

            if ((algorithm_enc & mask_enc) == 0)

                continue;

        if (algorithm_mac)

            if ((algorithm_mac & mask_mac) == 0)

                continue;

        *ca_curr = (SSL_CIPHER *)(cipher_aliases + i);

        ca_curr++;

    }

    *ca_curr = NULL;            /* end of list */

}

static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,

                                  uint32_t alg_auth, uint32_t alg_enc,

                                  uint32_t alg_mac, int min_tls,

                                  uint32_t algo_strength, int rule,

                                  int32_t strength_bits, CIPHER_ORDER **head_p,

                                  CIPHER_ORDER **tail_p)

{

    CIPHER_ORDER *head, *tail, *curr, *next, *last;

    const SSL_CIPHER *cp;

    int reverse = 0;

#ifdef CIPHER_DEBUG

    fprintf(stderr,

            "Applying rule %d with %08x/%08x/%08x/%08x/%08x %08x (%d)\n",

            rule, alg_mkey, alg_auth, alg_enc, alg_mac, min_tls,

            algo_strength, strength_bits);

#endif

    if (rule == CIPHER_DEL || rule == CIPHER_BUMP)

        reverse = 1;            /* needed to maintain sorting between currently

                                 * deleted ciphers */

    head = *head_p;

    tail = *tail_p;

    if (reverse) {

        next = tail;

        last = head;

    } else {

        next = head;

        last = tail;

    }

    curr = NULL;

    for (;;) {

        if (curr == last)

            break;

        curr = next;

        if (curr == NULL)

            break;

        next = reverse ? curr->prev : curr->next;

        cp = curr->cipher;

        /*

         * Selection criteria is either the value of strength_bits

         * or the algorithms used.

         */

        if (strength_bits >= 0) {

            if (strength_bits != cp->strength_bits)

                continue;

        } else {

#ifdef CIPHER_DEBUG

            fprintf(stderr,

                    "\nName: %s:\nAlgo = %08x/%08x/%08x/%08x/%08x Algo_strength = %08x\n",

                    cp->name, cp->algorithm_mkey, cp->algorithm_auth,

                    cp->algorithm_enc, cp->algorithm_mac, cp->min_tls,

                    cp->algo_strength);

#endif

            if (cipher_id != 0 && (cipher_id != cp->id))

                continue;

            if (alg_mkey && !(alg_mkey & cp->algorithm_mkey))

                continue;

            if (alg_auth && !(alg_auth & cp->algorithm_auth))

                continue;

            if (alg_enc && !(alg_enc & cp->algorithm_enc))

                continue;

            if (alg_mac && !(alg_mac & cp->algorithm_mac))

                continue;

            if (min_tls && (min_tls != cp->min_tls))

                continue;

            if ((algo_strength & SSL_STRONG_MASK)

                && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))

                continue;

            if ((algo_strength & SSL_DEFAULT_MASK)

                && !(algo_strength & SSL_DEFAULT_MASK & cp->algo_strength))

                continue;

        }

#ifdef CIPHER_DEBUG

        fprintf(stderr, "Action = %d\n", rule);

#endif

        /* add the cipher if it has not been added yet. */

        if (rule == CIPHER_ADD) {

            /* reverse == 0 */

            if (!curr->active) {

                ll_append_tail(&head, curr, &tail);

                curr->active = 1;

            }

        }

        /* Move the added cipher to this location */

        else if (rule == CIPHER_ORD) {

            /* reverse == 0 */

            if (curr->active) {

                ll_append_tail(&head, curr, &tail);

            }

        } else if (rule == CIPHER_DEL) {