Skip to content

Commit b0d64b4

Browse files
SparkiDevSparkiDev
authored
Merge pull request #7084 from julek-wolfssl/set-cipher-ssl
Allow SetCipherList to operate on SSL without modifying on SSL_CTX
2 parents d043333 + 1288d71 commit b0d64b4

4 files changed

Lines changed: 83 additions & 54 deletions

File tree

‎src/internal.c‎

Lines changed: 54 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1254,7 +1254,7 @@ static int ExportOptions(WOLFSSL* ssl, byte* exp, word32 len, byte ver,
12541254
exp[idx++] = 0;
12551255
#endif
12561256
#ifdef HAVE_ANON
1257-
exp[idx++] = options->haveAnon;
1257+
exp[idx++] = options->useAnon;
12581258
#else
12591259
exp[idx++] = 0;
12601260
#endif
@@ -1459,7 +1459,7 @@ static int ImportOptions(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,
14591459
idx++;
14601460
#endif
14611461
#ifdef HAVE_ANON
1462-
options->haveAnon = exp[idx++]; /* User wants to allow Anon suites */
1462+
options->useAnon = exp[idx++]; /* User wants to allow Anon suites */
14631463
#else
14641464
idx++;
14651465
#endif
@@ -6409,7 +6409,7 @@ void InitSSL_CTX_Suites(WOLFSSL_CTX* ctx)
64096409
havePSK = ctx->havePSK;
64106410
#endif /* NO_PSK */
64116411
#ifdef HAVE_ANON
6412-
haveAnon = ctx->haveAnon;
6412+
haveAnon = ctx->useAnon;
64136413
#endif /* HAVE_ANON*/
64146414
#ifndef NO_CERTS
64156415
keySz = ctx->privateKeySz;
@@ -6442,7 +6442,7 @@ int InitSSL_Suites(WOLFSSL* ssl)
64426442
#endif /* NO_PSK */
64436443
#if !defined(NO_CERTS) && !defined(WOLFSSL_SESSION_EXPORT)
64446444
#ifdef HAVE_ANON
6445-
haveAnon = (byte)ssl->options.haveAnon;
6445+
haveAnon = (byte)ssl->options.useAnon;
64466446
#endif /* HAVE_ANON*/
64476447
#ifdef WOLFSSL_MULTICAST
64486448
haveMcast = (byte)ssl->options.haveMcast;
@@ -6472,7 +6472,7 @@ int InitSSL_Suites(WOLFSSL* ssl)
64726472
havePSK, ssl->options.haveDH, ssl->options.haveECDSAsig,
64736473
ssl->options.haveECC, ssl->options.haveStaticECC,
64746474
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
6475-
ssl->options.haveAnon, ssl->options.side);
6475+
ssl->options.useAnon, ssl->options.side);
64766476
}
64776477

64786478
#if !defined(NO_CERTS) && !defined(WOLFSSL_SESSION_EXPORT)
@@ -6692,7 +6692,7 @@ int SetSSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
66926692
#endif
66936693

66946694
#ifdef HAVE_ANON
6695-
ssl->options.haveAnon = ctx->haveAnon;
6695+
ssl->options.useAnon = ctx->useAnon;
66966696
#endif
66976697
#ifndef NO_DH
66986698
ssl->options.minDhKeySz = ctx->minDhKeySz;
@@ -26198,7 +26198,8 @@ ciphersuites introduced through the "bulk" ciphersuites.
2619826198

2619926199
@return true on success, else false.
2620026200
*/
26201-
int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
26201+
static int ParseCipherList(Suites* suites,
26202+
const char* list, ProtocolVersion version, int privateKeySz, byte side)
2620226203
{
2620326204
int ret = 0;
2620426205
int idx = 0;
@@ -26227,14 +26228,14 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2622726228
#ifndef NO_RSA
2622826229
haveRSA = 1;
2622926230
#endif
26230-
InitSuites(suites, ctx->method->version,
26231+
InitSuites(suites, version,
2623126232
#ifndef NO_CERTS
26232-
ctx->privateKeySz,
26233+
privateKeySz,
2623326234
#else
2623426235
0,
2623526236
#endif
2623626237
haveRSA, 1, 1, !haveRSA, 1, haveRSA, !haveRSA, 1, 1, 0, 0,
26237-
ctx->method->side);
26238+
side);
2623826239
return 1; /* wolfSSL default */
2623926240
}
2624026241

@@ -26311,9 +26312,6 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2631126312
haveSig |= SIG_ANON;
2631226313
else
2631326314
haveSig &= ~SIG_ANON;
26314-
#ifdef HAVE_ANON
26315-
ctx->haveAnon = (haveSig & SIG_ANON) == SIG_ANON;
26316-
#endif
2631726315
haveRSA = 1;
2631826316
haveDH = 1;
2631926317
haveECC = 1;
@@ -26336,9 +26334,6 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2633626334
if (XSTRCMP(name, "HIGH") == 0 && allowing) {
2633726335
/* Disable static, anonymous, and null ciphers */
2633826336
haveSig &= ~SIG_ANON;
26339-
#ifdef HAVE_ANON
26340-
ctx->haveAnon = 0;
26341-
#endif
2634226337
haveRSA = 1;
2634326338
haveDH = 1;
2634426339
haveECC = 1;
@@ -26358,9 +26353,6 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2635826353
haveSig |= SIG_ANON;
2635926354
else
2636026355
haveSig &= ~SIG_ANON;
26361-
#ifdef HAVE_ANON
26362-
ctx->haveAnon = allowing;
26363-
#endif
2636426356
if (allowing) {
2636526357
/* Allow RSA by default. */
2636626358
if (!haveECC)
@@ -26474,7 +26466,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2647426466

2647526467
#ifdef WOLFSSL_DTLS
2647626468
/* don't allow stream ciphers with DTLS */
26477-
if (ctx->method->version.major == DTLS_MAJOR) {
26469+
if (version.major == DTLS_MAJOR) {
2647826470
if (XSTRSTR(name, "RC4"))
2647926471
{
2648026472
WOLFSSL_MSG("Stream ciphers not supported with DTLS");
@@ -26591,22 +26583,22 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2659126583
if (ret) {
2659226584
int keySz = 0;
2659326585
#ifndef NO_CERTS
26594-
keySz = ctx->privateKeySz;
26586+
keySz = privateKeySz;
2659526587
#endif
2659626588
#ifdef OPENSSL_EXTRA
2659726589
if (callInitSuites) {
2659826590
suites->setSuites = 0; /* Force InitSuites */
2659926591
suites->hashSigAlgoSz = 0; /* Force InitSuitesHashSigAlgo call
2660026592
* inside InitSuites */
26601-
InitSuites(suites, ctx->method->version, keySz, (word16)haveRSA,
26593+
InitSuites(suites, version, keySz, (word16)haveRSA,
2660226594
(word16)havePSK, (word16)haveDH,
2660326595
(word16)((haveSig & SIG_ECDSA) != 0),
2660426596
(word16)haveECC, (word16)haveStaticRSA,
2660526597
(word16)haveStaticECC,
2660626598
(word16)((haveSig & SIG_FALCON) != 0),
2660726599
(word16)((haveSig & SIG_DILITHIUM) != 0),
2660826600
(word16)((haveSig & SIG_ANON) != 0),
26609-
(word16)haveNull, ctx->method->side);
26601+
(word16)haveNull, side);
2661026602
/* Restore user ciphers ahead of defaults */
2661126603
XMEMMOVE(suites->suites + idx, suites->suites,
2661226604
min(suites->suiteSz, WOLFSSL_MAX_SUITE_SZ-idx));
@@ -26621,7 +26613,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2662126613
}
2662226614

2662326615
#ifdef HAVE_RENEGOTIATION_INDICATION
26624-
if (ctx->method->side == WOLFSSL_CLIENT_END) {
26616+
if (side == WOLFSSL_CLIENT_END) {
2662526617
if (suites->suiteSz > WOLFSSL_MAX_SUITE_SZ - 2) {
2662626618
WOLFSSL_MSG("Too many ciphersuites");
2662726619
return 0;
@@ -26635,11 +26627,44 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2663526627
suites->setSuites = 1;
2663626628
}
2663726629

26638-
(void)ctx;
26639-
2664026630
return ret;
2664126631
}
2664226632

26633+
int SetCipherList_ex(const WOLFSSL_CTX* ctx, const WOLFSSL* ssl,
26634+
Suites* suites, const char* list)
26635+
{
26636+
ProtocolVersion version;
26637+
int privateKeySz = 0;
26638+
byte side;
26639+
26640+
if (ctx != NULL) {
26641+
version = ctx->method->version;
26642+
#ifndef NO_CERTS
26643+
privateKeySz = ctx->privateKeySz;
26644+
#endif
26645+
side = ctx->method->side;
26646+
}
26647+
else if (ssl != NULL) {
26648+
version = ssl->version;
26649+
#ifndef NO_CERTS
26650+
privateKeySz = ssl->buffers.keySz;
26651+
#endif
26652+
side = (byte)ssl->options.side;
26653+
}
26654+
else {
26655+
WOLFSSL_MSG("SetCipherList_ex parameter error");
26656+
return 0;
26657+
}
26658+
26659+
return ParseCipherList(suites, list, version, privateKeySz, side);
26660+
}
26661+
26662+
int SetCipherList(const WOLFSSL_CTX* ctx, Suites* suites,
26663+
const char* list)
26664+
{
26665+
return SetCipherList_ex(ctx, NULL, suites, list);
26666+
}
26667+
2664326668
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_SET_CIPHER_BYTES)
2664426669
int SetCipherListFromBytes(WOLFSSL_CTX* ctx, Suites* suites, const byte* list,
2664526670
const int listSz)
@@ -35323,7 +35348,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
3532335348
ssl->options.haveDH, ssl->options.haveECDSAsig,
3532435349
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
3532535350
ssl->options.haveFalconSig,
35326-
ssl->options.haveDilithiumSig, ssl->options.haveAnon,
35351+
ssl->options.haveDilithiumSig, ssl->options.useAnon,
3532735352
TRUE, ssl->options.side);
3532835353
}
3532935354

@@ -35714,7 +35739,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
3571435739
ssl->options.haveDH, ssl->options.haveECDSAsig,
3571535740
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
3571635741
ssl->options.haveFalconSig,
35717-
ssl->options.haveDilithiumSig, ssl->options.haveAnon,
35742+
ssl->options.haveDilithiumSig, ssl->options.useAnon,
3571835743
TRUE, ssl->options.side);
3571935744
}
3572035745

@@ -35792,7 +35817,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
3579235817
ssl->options.haveDH, ssl->options.haveECDSAsig,
3579335818
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
3579435819
ssl->options.haveFalconSig,
35795-
ssl->options.haveDilithiumSig, ssl->options.haveAnon,
35820+
ssl->options.haveDilithiumSig, ssl->options.useAnon,
3579635821
TRUE, ssl->options.side);
3579735822
}
3579835823
}

‎src/ssl.c‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1478,11 +1478,12 @@ WOLFSSL* wolfSSL_new(WOLFSSL_CTX* ctx)
14781478
return ssl;
14791479

14801480
ssl = (WOLFSSL*) XMALLOC(sizeof(WOLFSSL), ctx->heap, DYNAMIC_TYPE_SSL);
1481-
if (ssl)
1481+
if (ssl) {
14821482
if ( (ret = InitSSL(ssl, ctx, 0)) < 0) {
14831483
FreeSSL(ssl, ctx->heap);
14841484
ssl = 0;
14851485
}
1486+
}
14861487

14871488
WOLFSSL_LEAVE("wolfSSL_new", ret);
14881489
(void)ret;
@@ -3068,7 +3069,7 @@ int wolfSSL_SetTmpDH(WOLFSSL* ssl, const unsigned char* p, int pSz,
30683069
ssl->options.haveDH, ssl->options.haveECDSAsig,
30693070
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
30703071
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
3071-
ssl->options.haveAnon, TRUE, ssl->options.side);
3072+
ssl->options.useAnon, TRUE, ssl->options.side);
30723073
}
30733074

30743075
WOLFSSL_LEAVE("wolfSSL_SetTmpDH", 0);
@@ -5329,7 +5330,7 @@ int wolfSSL_SetVersion(WOLFSSL* ssl, int version)
53295330
ssl->options.haveDH, ssl->options.haveECDSAsig,
53305331
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
53315332
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
5332-
ssl->options.haveAnon, TRUE, ssl->options.side);
5333+
ssl->options.useAnon, TRUE, ssl->options.side);
53335334
return WOLFSSL_SUCCESS;
53345335
}
53355336
#endif /* !leanpsk */
@@ -7950,7 +7951,7 @@ int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff,
79507951
havePSK, ssl->options.haveDH, ssl->options.haveECDSAsig,
79517952
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
79527953
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
7953-
ssl->options.haveAnon, TRUE, ssl->options.side);
7954+
ssl->options.useAnon, TRUE, ssl->options.side);
79547955
}
79557956
else if (ctx && resetSuites) {
79567957
word16 havePSK = 0;
@@ -7974,7 +7975,7 @@ int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff,
79747975
ctx->haveECC, TRUE, ctx->haveStaticECC,
79757976
ctx->haveFalconSig, ctx->haveDilithiumSig,
79767977
#ifdef HAVE_ANON
7977-
ctx->haveAnon,
7978+
ctx->useAnon,
79787979
#else
79797980
FALSE,
79807981
#endif
@@ -11837,8 +11838,8 @@ static int CheckcipherList(const char* list)
1183711838
*
1183811839
* returns WOLFSSL_SUCCESS on success and sets the cipher suite list
1183911840
*/
11840-
static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
11841-
const char* list)
11841+
static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
11842+
Suites* suites, const char* list)
1184211843
{
1184311844
int ret = 0;
1184411845
int listattribute = 0;
@@ -11863,7 +11864,7 @@ static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
1186311864
/* list has mixed(pre-TLSv13 and TLSv13) suites
1186411865
* update cipher suites the same as before
1186511866
*/
11866-
return (SetCipherList(ctx, suites, list)) ? WOLFSSL_SUCCESS :
11867+
return (SetCipherList_ex(ctx, ssl, suites, list)) ? WOLFSSL_SUCCESS :
1186711868
WOLFSSL_FAILURE;
1186811869
}
1186911870
else if (listattribute == 1) {
@@ -11877,7 +11878,8 @@ static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
1187711878
* simulate set_ciphersuites() compatibility layer API
1187811879
*/
1187911880
tls13Only = 1;
11880-
if (!IsAtLeastTLSv1_3(ctx->method->version)) {
11881+
if ((ctx != NULL && !IsAtLeastTLSv1_3(ctx->method->version)) ||
11882+
(ssl != NULL && !IsAtLeastTLSv1_3(ssl->version))) {
1188111883
/* Silently ignore TLS 1.3 ciphers if we don't support it. */
1188211884
return WOLFSSL_SUCCESS;
1188311885
}
@@ -11903,7 +11905,7 @@ static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
1190311905
XMEMCPY(suitesCpy, suites->suites, suites->suiteSz);
1190411906
suitesCpySz = suites->suiteSz;
1190511907

11906-
ret = SetCipherList(ctx, suites, list);
11908+
ret = SetCipherList_ex(ctx, ssl, suites, list);
1190711909
if (ret != 1) {
1190811910
#ifdef WOLFSSL_SMALL_STACK
1190911911
XFREE(suitesCpy, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -11967,7 +11969,7 @@ int wolfSSL_CTX_set_cipher_list(WOLFSSL_CTX* ctx, const char* list)
1196711969
return WOLFSSL_FAILURE;
1196811970

1196911971
#ifdef OPENSSL_EXTRA
11970-
return wolfSSL_parse_cipher_list(ctx, ctx->suites, list);
11972+
return wolfSSL_parse_cipher_list(ctx, NULL, ctx->suites, list);
1197111973
#else
1197211974
return (SetCipherList(ctx, ctx->suites, list)) ?
1197311975
WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
@@ -12003,9 +12005,9 @@ int wolfSSL_set_cipher_list(WOLFSSL* ssl, const char* list)
1200312005
return WOLFSSL_FAILURE;
1200412006

1200512007
#ifdef OPENSSL_EXTRA
12006-
return wolfSSL_parse_cipher_list(ssl->ctx, ssl->suites, list);
12008+
return wolfSSL_parse_cipher_list(NULL, ssl, ssl->suites, list);
1200712009
#else
12008-
return (SetCipherList(ssl->ctx, ssl->suites, list)) ?
12010+
return (SetCipherList_ex(NULL, ssl, ssl->suites, list)) ?
1200912011
WOLFSSL_SUCCESS :
1201012012
WOLFSSL_FAILURE;
1201112013
#endif
@@ -13105,7 +13107,7 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
1310513107
(void)havePSK;
1310613108

1310713109
#ifdef HAVE_ANON
13108-
haveAnon = ssl->options.haveAnon;
13110+
haveAnon = ssl->options.useAnon;
1310913111
#endif
1311013112
(void)haveAnon;
1311113113

@@ -15704,7 +15706,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1570415706
ssl->options.haveDH, ssl->options.haveECDSAsig,
1570515707
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
1570615708
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
15707-
ssl->options.haveAnon, TRUE, ssl->options.side);
15709+
ssl->options.useAnon, TRUE, ssl->options.side);
1570815710
}
1570915711
#ifdef OPENSSL_EXTRA
1571015712
/**
@@ -15761,7 +15763,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1576115763
ssl->options.haveDH, ssl->options.haveECDSAsig,
1576215764
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
1576315765
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
15764-
ssl->options.haveAnon, TRUE, ssl->options.side);
15766+
ssl->options.useAnon, TRUE, ssl->options.side);
1576515767
}
1576615768

1576715769
const char* wolfSSL_get_psk_identity_hint(const WOLFSSL* ssl)
@@ -15852,7 +15854,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1585215854
if (ctx == NULL)
1585315855
return WOLFSSL_FAILURE;
1585415856

15855-
ctx->haveAnon = 1;
15857+
ctx->useAnon = 1;
1585615858

1585715859
return WOLFSSL_SUCCESS;
1585815860
}
@@ -21971,7 +21973,7 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
2197121973
ssl->options.haveDH, ssl->options.haveECDSAsig,
2197221974
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
2197321975
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
21974-
ssl->options.haveAnon, TRUE, ssl->options.side);
21976+
ssl->options.useAnon, TRUE, ssl->options.side);
2197521977
}
2197621978

2197721979
return ssl->options.mask;

0 commit comments

Comments
 (0)