Skip to content

Commit b8b847b

Browse files
julek-wolfssljulek-wolfssl
committed
Allow SetCipherList to operate on SSL without modifying on SSL_CTX
1 parent ac81d9d commit b8b847b

3 files changed

Lines changed: 49 additions & 26 deletions

File tree

‎src/internal.c‎

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26198,7 +26198,8 @@ ciphersuites introduced through the "bulk" ciphersuites.
2619826198

2619926199
@return true on success, else false.
2620026200
*/
26201-
int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
26201+
int SetCipherList(const WOLFSSL_CTX* ctx, const WOLFSSL* ssl, Suites* suites,
26202+
const char* list)
2620226203
{
2620326204
int ret = 0;
2620426205
int idx = 0;
@@ -26216,25 +26217,38 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2621626217
const int suiteSz = GetCipherNamesSize();
2621726218
const char* next = list;
2621826219

26219-
if (suites == NULL || list == NULL) {
26220+
ProtocolVersion version;
26221+
int privateKeySz = 0;
26222+
byte side;
26223+
#ifdef HAVE_ANON
26224+
byte haveAnon = 0;
26225+
#endif
26226+
26227+
if (suites == NULL || list == NULL || (ctx == NULL && ssl == NULL)) {
2622026228
WOLFSSL_MSG("SetCipherList parameter error");
2622126229
return 0;
2622226230
}
2622326231

26232+
version = ctx != NULL ? ctx->method->version : ssl->version;
26233+
#ifndef NO_CERTS
26234+
privateKeySz = (int)(ctx != NULL ? ctx->privateKeySz : ssl->buffers.keySz);
26235+
#endif
26236+
side = (byte)(ctx != NULL ? ctx->method->side : ssl->options.side);
26237+
2622426238
if (next[0] == 0 || XSTRCMP(next, "ALL") == 0 ||
2622526239
XSTRCMP(next, "DEFAULT") == 0 || XSTRCMP(next, "HIGH") == 0) {
2622626240
/* Add all ciphersuites except anonymous and null ciphers. Prefer RSA */
2622726241
#ifndef NO_RSA
2622826242
haveRSA = 1;
2622926243
#endif
26230-
InitSuites(suites, ctx->method->version,
26244+
InitSuites(suites, version,
2623126245
#ifndef NO_CERTS
26232-
ctx->privateKeySz,
26246+
privateKeySz,
2623326247
#else
2623426248
0,
2623526249
#endif
2623626250
haveRSA, 1, 1, !haveRSA, 1, haveRSA, !haveRSA, 1, 1, 0, 0,
26237-
ctx->method->side);
26251+
side);
2623826252
return 1; /* wolfSSL default */
2623926253
}
2624026254

@@ -26312,7 +26326,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2631226326
else
2631326327
haveSig &= ~SIG_ANON;
2631426328
#ifdef HAVE_ANON
26315-
ctx->haveAnon = (haveSig & SIG_ANON) == SIG_ANON;
26329+
haveAnon = (haveSig & SIG_ANON) == SIG_ANON;
2631626330
#endif
2631726331
haveRSA = 1;
2631826332
haveDH = 1;
@@ -26337,7 +26351,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2633726351
/* Disable static, anonymous, and null ciphers */
2633826352
haveSig &= ~SIG_ANON;
2633926353
#ifdef HAVE_ANON
26340-
ctx->haveAnon = 0;
26354+
haveAnon = 0;
2634126355
#endif
2634226356
haveRSA = 1;
2634326357
haveDH = 1;
@@ -26359,7 +26373,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2635926373
else
2636026374
haveSig &= ~SIG_ANON;
2636126375
#ifdef HAVE_ANON
26362-
ctx->haveAnon = allowing;
26376+
haveAnon = allowing;
2636326377
#endif
2636426378
if (allowing) {
2636526379
/* Allow RSA by default. */
@@ -26474,7 +26488,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2647426488

2647526489
#ifdef WOLFSSL_DTLS
2647626490
/* don't allow stream ciphers with DTLS */
26477-
if (ctx->method->version.major == DTLS_MAJOR) {
26491+
if (version.major == DTLS_MAJOR) {
2647826492
if (XSTRSTR(name, "RC4"))
2647926493
{
2648026494
WOLFSSL_MSG("Stream ciphers not supported with DTLS");
@@ -26591,22 +26605,22 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2659126605
if (ret) {
2659226606
int keySz = 0;
2659326607
#ifndef NO_CERTS
26594-
keySz = ctx->privateKeySz;
26608+
keySz = privateKeySz;
2659526609
#endif
2659626610
#ifdef OPENSSL_EXTRA
2659726611
if (callInitSuites) {
2659826612
suites->setSuites = 0; /* Force InitSuites */
2659926613
suites->hashSigAlgoSz = 0; /* Force InitSuitesHashSigAlgo call
2660026614
* inside InitSuites */
26601-
InitSuites(suites, ctx->method->version, keySz, (word16)haveRSA,
26615+
InitSuites(suites, version, keySz, (word16)haveRSA,
2660226616
(word16)havePSK, (word16)haveDH,
2660326617
(word16)((haveSig & SIG_ECDSA) != 0),
2660426618
(word16)haveECC, (word16)haveStaticRSA,
2660526619
(word16)haveStaticECC,
2660626620
(word16)((haveSig & SIG_FALCON) != 0),
2660726621
(word16)((haveSig & SIG_DILITHIUM) != 0),
2660826622
(word16)((haveSig & SIG_ANON) != 0),
26609-
(word16)haveNull, ctx->method->side);
26623+
(word16)haveNull, side);
2661026624
/* Restore user ciphers ahead of defaults */
2661126625
XMEMMOVE(suites->suites + idx, suites->suites,
2661226626
min(suites->suiteSz, WOLFSSL_MAX_SUITE_SZ-idx));
@@ -26621,7 +26635,7 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2662126635
}
2662226636

2662326637
#ifdef HAVE_RENEGOTIATION_INDICATION
26624-
if (ctx->method->side == WOLFSSL_CLIENT_END) {
26638+
if (side == WOLFSSL_CLIENT_END) {
2662526639
if (suites->suiteSz > WOLFSSL_MAX_SUITE_SZ - 2) {
2662626640
WOLFSSL_MSG("Too many ciphersuites");
2662726641
return 0;
@@ -26635,7 +26649,14 @@ int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
2663526649
suites->setSuites = 1;
2663626650
}
2663726651

26638-
(void)ctx;
26652+
#ifdef HAVE_ANON
26653+
if (ret == 1) {
26654+
if (ctx != NULL)
26655+
((WOLFSSL_CTX*)ctx)->haveAnon = haveAnon || haveSig | SIG_ANON;
26656+
else
26657+
((WOLFSSL*)ssl)->options.haveAnon = haveAnon || haveSig | SIG_ANON;
26658+
}
26659+
#endif
2663926660

2664026661
return ret;
2664126662
}

‎src/ssl.c‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1478,11 +1478,12 @@ WOLFSSL* wolfSSL_new(WOLFSSL_CTX* ctx)
14781478
return ssl;
14791479

14801480
ssl = (WOLFSSL*) XMALLOC(sizeof(WOLFSSL), ctx->heap, DYNAMIC_TYPE_SSL);
1481-
if (ssl)
1481+
if (ssl) {
14821482
if ( (ret = InitSSL(ssl, ctx, 0)) < 0) {
14831483
FreeSSL(ssl, ctx->heap);
14841484
ssl = 0;
14851485
}
1486+
}
14861487

14871488
WOLFSSL_LEAVE("wolfSSL_new", ret);
14881489
(void)ret;
@@ -11837,8 +11838,8 @@ static int CheckcipherList(const char* list)
1183711838
*
1183811839
* returns WOLFSSL_SUCCESS on success and sets the cipher suite list
1183911840
*/
11840-
static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
11841-
const char* list)
11841+
static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
11842+
Suites* suites, const char* list)
1184211843
{
1184311844
int ret = 0;
1184411845
int listattribute = 0;
@@ -11863,7 +11864,7 @@ static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
1186311864
/* list has mixed(pre-TLSv13 and TLSv13) suites
1186411865
* update cipher suites the same as before
1186511866
*/
11866-
return (SetCipherList(ctx, suites, list)) ? WOLFSSL_SUCCESS :
11867+
return (SetCipherList(ctx, ssl, suites, list)) ? WOLFSSL_SUCCESS :
1186711868
WOLFSSL_FAILURE;
1186811869
}
1186911870
else if (listattribute == 1) {
@@ -11877,7 +11878,8 @@ static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
1187711878
* simulate set_ciphersuites() compatibility layer API
1187811879
*/
1187911880
tls13Only = 1;
11880-
if (!IsAtLeastTLSv1_3(ctx->method->version)) {
11881+
if ((ctx != NULL && !IsAtLeastTLSv1_3(ctx->method->version)) ||
11882+
(ssl != NULL && !IsAtLeastTLSv1_3(ssl->version))) {
1188111883
/* Silently ignore TLS 1.3 ciphers if we don't support it. */
1188211884
return WOLFSSL_SUCCESS;
1188311885
}
@@ -11903,7 +11905,7 @@ static int wolfSSL_parse_cipher_list(WOLFSSL_CTX* ctx, Suites* suites,
1190311905
XMEMCPY(suitesCpy, suites->suites, suites->suiteSz);
1190411906
suitesCpySz = suites->suiteSz;
1190511907

11906-
ret = SetCipherList(ctx, suites, list);
11908+
ret = SetCipherList(ctx, ssl, suites, list);
1190711909
if (ret != 1) {
1190811910
#ifdef WOLFSSL_SMALL_STACK
1190911911
XFREE(suitesCpy, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -11967,9 +11969,9 @@ int wolfSSL_CTX_set_cipher_list(WOLFSSL_CTX* ctx, const char* list)
1196711969
return WOLFSSL_FAILURE;
1196811970

1196911971
#ifdef OPENSSL_EXTRA
11970-
return wolfSSL_parse_cipher_list(ctx, ctx->suites, list);
11972+
return wolfSSL_parse_cipher_list(ctx, NULL, ctx->suites, list);
1197111973
#else
11972-
return (SetCipherList(ctx, ctx->suites, list)) ?
11974+
return (SetCipherList(ctx, NULL, ctx->suites, list)) ?
1197311975
WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
1197411976
#endif
1197511977
}
@@ -12003,9 +12005,9 @@ int wolfSSL_set_cipher_list(WOLFSSL* ssl, const char* list)
1200312005
return WOLFSSL_FAILURE;
1200412006

1200512007
#ifdef OPENSSL_EXTRA
12006-
return wolfSSL_parse_cipher_list(ssl->ctx, ssl->suites, list);
12008+
return wolfSSL_parse_cipher_list(NULL, ssl, ssl->suites, list);
1200712009
#else
12008-
return (SetCipherList(ssl->ctx, ssl->suites, list)) ?
12010+
return (SetCipherList(NULL, ssl, ssl->suites, list)) ?
1200912011
WOLFSSL_SUCCESS :
1201012012
WOLFSSL_FAILURE;
1201112013
#endif

‎wolfssl/internal.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2377,8 +2377,8 @@ typedef struct TLSX TLSX;
23772377
WOLFSSL_LOCAL int MatchSuite_ex(const WOLFSSL* ssl, Suites* peerSuites,
23782378
CipherSuite* cs, TLSX* extensions);
23792379
WOLFSSL_LOCAL int MatchSuite(WOLFSSL* ssl, Suites* peerSuites);
2380-
WOLFSSL_LOCAL int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites,
2381-
const char* list);
2380+
WOLFSSL_LOCAL int SetCipherList(const WOLFSSL_CTX* ctx, const WOLFSSL* ssl,
2381+
Suites* suites, const char* list);
23822382
WOLFSSL_LOCAL int SetCipherListFromBytes(WOLFSSL_CTX* ctx, Suites* suites,
23832383
const byte* list, const int listSz);
23842384
WOLFSSL_LOCAL int SetSuitesHashSigAlgo(Suites* suites, const char* list);

0 commit comments

Comments
 (0)