From daecd61139095533ccdd24c7b8fbac1ca439f207 Mon Sep 17 00:00:00 2001 From: jsing Date: Sat, 12 Jul 2014 22:33:39 +0000 Subject: [PATCH] The correct name for EDH is DHE, likewise EECDH should be ECDHE. Based on changes to OpenSSL trunk. ok beck@ miod@ --- lib/libssl/d1_clnt.c | 6 +- lib/libssl/d1_srvr.c | 12 +-- lib/libssl/s3_clnt.c | 12 +-- lib/libssl/s3_lib.c | 134 +++++++++++++++++----------------- lib/libssl/s3_srvr.c | 18 ++--- lib/libssl/src/ssl/d1_clnt.c | 6 +- lib/libssl/src/ssl/d1_srvr.c | 12 +-- lib/libssl/src/ssl/s3_clnt.c | 12 +-- lib/libssl/src/ssl/s3_lib.c | 134 +++++++++++++++++----------------- lib/libssl/src/ssl/s3_srvr.c | 18 ++--- lib/libssl/src/ssl/ssl_ciph.c | 28 +++---- lib/libssl/src/ssl/ssl_lib.c | 10 +-- lib/libssl/src/ssl/ssl_locl.h | 8 +- lib/libssl/src/ssl/t1_lib.c | 8 +- lib/libssl/ssl_ciph.c | 28 +++---- lib/libssl/ssl_lib.c | 10 +-- lib/libssl/ssl_locl.h | 8 +- lib/libssl/t1_lib.c | 8 +- 18 files changed, 236 insertions(+), 236 deletions(-) diff --git a/lib/libssl/d1_clnt.c b/lib/libssl/d1_clnt.c index 004fd6e04f5..552667f6c13 100644 --- a/lib/libssl/d1_clnt.c +++ b/lib/libssl/d1_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: d1_clnt.c,v 1.30 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: d1_clnt.c,v 1.31 2014/07/12 22:33:39 jsing Exp $ */ /* * DTLS implementation written by Nagendra Modadugu * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. @@ -984,7 +984,7 @@ dtls1_send_client_key_exchange(SSL *s) s->session->master_key, tmp_buf, sizeof tmp_buf); OPENSSL_cleanse(tmp_buf, sizeof tmp_buf); - } else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) { + } else if (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) { DH *dh_srvr, *dh_clnt; if (s->session->sess_cert->peer_dh_tmp != NULL) @@ -1037,7 +1037,7 @@ dtls1_send_client_key_exchange(SSL *s) DH_free(dh_clnt); /* perhaps clean things up a bit EAY EAY EAY EAY*/ - } else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) { + } else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) { const EC_GROUP *srvr_group = NULL; EC_KEY *tkey; int ecdh_clnt_cert = 0; diff --git a/lib/libssl/d1_srvr.c b/lib/libssl/d1_srvr.c index a94b7ed61b1..ecf4a198b16 100644 --- a/lib/libssl/d1_srvr.c +++ b/lib/libssl/d1_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: d1_srvr.c,v 1.32 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: d1_srvr.c,v 1.33 2014/07/12 22:33:39 jsing Exp $ */ /* * DTLS implementation written by Nagendra Modadugu * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. @@ -464,8 +464,8 @@ dtls1_accept(SSL *s) /* only send if a DH key exchange or * RSA but we have a sign only certificate */ if (s->s3->tmp.use_rsa_tmp - || (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) - || (alg_k & SSL_kEECDH) + || (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) + || (alg_k & SSL_kECDHE) || ((alg_k & SSL_kRSA) && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL ) @@ -1052,7 +1052,7 @@ dtls1_send_server_key_exchange(SSL *s) r[1] = rsa->e; s->s3->tmp.use_rsa_tmp = 1; } else - if (type & SSL_kEDH) { + if (type & SSL_kDHE) { dhp = cert->dh_tmp; if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) dhp = s->cert->dh_tmp_cb(s, 0, 0); @@ -1094,7 +1094,7 @@ dtls1_send_server_key_exchange(SSL *s) r[1] = dh->g; r[2] = dh->pub_key; } else - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { const EC_GROUP *group; ecdhp = cert->ecdh_tmp; @@ -1232,7 +1232,7 @@ dtls1_send_server_key_exchange(SSL *s) p += nr[i]; } - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { /* XXX: For now, we only support named (not generic) curves. * In this situation, the serverKeyExchange message has: * [1 byte CurveType], [2 byte CurveName] diff --git a/lib/libssl/s3_clnt.c b/lib/libssl/s3_clnt.c index 252100f587d..b55b2e62c6a 100644 --- a/lib/libssl/s3_clnt.c +++ b/lib/libssl/s3_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_clnt.c,v 1.82 2014/07/12 22:17:59 jsg Exp $ */ +/* $OpenBSD: s3_clnt.c,v 1.83 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1253,7 +1253,7 @@ ssl3_get_key_exchange(SSL *s) } s->session->sess_cert->peer_rsa_tmp = rsa; rsa = NULL; - } else if (alg_k & SSL_kEDH) { + } else if (alg_k & SSL_kDHE) { if ((dh = DH_new()) == NULL) { SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_DH_LIB); @@ -1328,7 +1328,7 @@ ssl3_get_key_exchange(SSL *s) SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); goto f_err; - } else if (alg_k & SSL_kEECDH) { + } else if (alg_k & SSL_kECDHE) { EC_GROUP *ngroup; const EC_GROUP *group; @@ -1987,7 +1987,7 @@ ssl3_send_client_key_exchange(SSL *s) s->method->ssl3_enc->generate_master_secret( s, s->session->master_key, tmp_buf, sizeof tmp_buf); OPENSSL_cleanse(tmp_buf, sizeof tmp_buf); - } else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) { + } else if (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) { DH *dh_srvr, *dh_clnt; if (s->session->sess_cert == NULL) { @@ -2051,7 +2051,7 @@ ssl3_send_client_key_exchange(SSL *s) DH_free(dh_clnt); /* perhaps clean things up a bit EAY EAY EAY EAY*/ - } else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) { + } else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) { const EC_GROUP *srvr_group = NULL; EC_KEY *tkey; int ecdh_clnt_cert = 0; @@ -2640,7 +2640,7 @@ ssl3_check_cert_and_algorithm(SSL *s) SSL_R_MISSING_RSA_ENCRYPTING_CERT); goto f_err; } - if ((alg_k & SSL_kEDH) && + if ((alg_k & SSL_kDHE) && !(has_bits(i, EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) { SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_MISSING_DH_KEY); diff --git a/lib/libssl/s3_lib.c b/lib/libssl/s3_lib.c index f94e207fc4e..decdda90a3d 100644 --- a/lib/libssl/s3_lib.c +++ b/lib/libssl/s3_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_lib.c,v 1.69 2014/07/11 09:24:44 beck Exp $ */ +/* $OpenBSD: s3_lib.c,v 1.70 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -433,7 +433,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, .id = SSL3_CK_EDH_DSS_DES_40_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -449,7 +449,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, .id = SSL3_CK_EDH_DSS_DES_64_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -465,7 +465,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, .id = SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -481,7 +481,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, .id = SSL3_CK_EDH_RSA_DES_40_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -497,7 +497,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, .id = SSL3_CK_EDH_RSA_DES_64_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -513,7 +513,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, .id = SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -529,7 +529,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_ADH_RC4_40_MD5, .id = SSL3_CK_ADH_RC4_40_MD5, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_MD5, @@ -545,7 +545,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_ADH_RC4_128_MD5, .id = SSL3_CK_ADH_RC4_128_MD5, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_MD5, @@ -561,7 +561,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_ADH_DES_40_CBC_SHA, .id = SSL3_CK_ADH_DES_40_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -577,7 +577,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_ADH_DES_64_CBC_SHA, .id = SSL3_CK_ADH_DES_64_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -593,7 +593,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_ADH_DES_192_CBC_SHA, .id = SSL3_CK_ADH_DES_192_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -655,7 +655,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, .id = TLS1_CK_DHE_DSS_WITH_AES_128_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -670,7 +670,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -685,7 +685,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_128_SHA, .id = TLS1_CK_ADH_WITH_AES_128_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -748,7 +748,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, .id = TLS1_CK_DHE_DSS_WITH_AES_256_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -764,7 +764,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -780,7 +780,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_256_SHA, .id = TLS1_CK_ADH_WITH_AES_256_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -877,7 +877,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256, .id = TLS1_CK_DHE_DSS_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -944,7 +944,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, .id = TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_CAMELLIA128, .algorithm_mac = SSL_SHA1, @@ -960,7 +960,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CAMELLIA128, .algorithm_mac = SSL_SHA1, @@ -976,7 +976,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA, .id = TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_CAMELLIA128, .algorithm_mac = SSL_SHA1, @@ -994,7 +994,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256, .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1042,7 +1042,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256, .id = TLS1_CK_DHE_DSS_WITH_AES_256_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA256, @@ -1058,7 +1058,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256, .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA256, @@ -1074,7 +1074,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_128_SHA256, .id = TLS1_CK_ADH_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1090,7 +1090,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_256_SHA256, .id = TLS1_CK_ADH_WITH_AES_256_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA256, @@ -1218,7 +1218,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, .id = TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_CAMELLIA256, .algorithm_mac = SSL_SHA1, @@ -1234,7 +1234,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CAMELLIA256, .algorithm_mac = SSL_SHA1, @@ -1250,7 +1250,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA, .id = TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_CAMELLIA256, .algorithm_mac = SSL_SHA1, @@ -1306,7 +1306,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -1324,7 +1324,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -1378,7 +1378,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -1396,7 +1396,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -1450,7 +1450,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_ADH_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -1468,7 +1468,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_ADH_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -1566,7 +1566,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_eNULL, .algorithm_mac = SSL_SHA1, @@ -1582,7 +1582,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_SHA1, @@ -1598,7 +1598,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -1614,7 +1614,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -1630,7 +1630,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -1726,7 +1726,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_NULL_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_eNULL, .algorithm_mac = SSL_SHA1, @@ -1742,7 +1742,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_SHA1, @@ -1758,7 +1758,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -1774,7 +1774,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -1790,7 +1790,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -1806,7 +1806,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_NULL_SHA, .id = TLS1_CK_ECDH_anon_WITH_NULL_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_eNULL, .algorithm_mac = SSL_SHA1, @@ -1822,7 +1822,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA, .id = TLS1_CK_ECDH_anon_WITH_RC4_128_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_SHA1, @@ -1838,7 +1838,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA, .id = TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -1854,7 +1854,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA, .id = TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -1870,7 +1870,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA, .id = TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -1889,7 +1889,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1905,7 +1905,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA384, @@ -1953,7 +1953,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256, .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1969,7 +1969,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384, .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA384, @@ -2019,7 +2019,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -2037,7 +2037,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -2091,7 +2091,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -2109,7 +2109,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -2224,7 +2224,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305, .id = TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CHACHA20POLY1305, .algorithm_mac = SSL_AEAD, @@ -2240,7 +2240,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, .id = TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_CHACHA20POLY1305, .algorithm_mac = SSL_AEAD, @@ -2256,7 +2256,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305, .id = TLS1_CK_DHE_RSA_CHACHA20_POLY1305, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CHACHA20POLY1305, .algorithm_mac = SSL_AEAD, @@ -3069,7 +3069,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, * if we are considering an ECC cipher suite that uses an * ephemeral EC key */ - (alg_k & SSL_kEECDH) + (alg_k & SSL_kECDHE) /* and we have an ephemeral EC key */ && (s->cert->ecdh_tmp != NULL) /* and the client specified an EllipticCurves extension */ @@ -3108,7 +3108,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, continue; ii = sk_SSL_CIPHER_find(allow, c); if (ii >= 0) { - if ((alg_k & SSL_kEECDH) && + if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari) { if (!ret) ret = sk_SSL_CIPHER_value(allow, ii); @@ -3139,12 +3139,12 @@ ssl3_get_req_cert_type(SSL *s, unsigned char *p) } #endif - if (alg_k & (SSL_kDHr|SSL_kEDH)) { + if (alg_k & (SSL_kDHr|SSL_kDHE)) { p[ret++] = SSL3_CT_RSA_FIXED_DH; p[ret++] = SSL3_CT_DSS_FIXED_DH; } if ((s->version == SSL3_VERSION) && - (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) { + (alg_k & (SSL_kDHE|SSL_kDHd|SSL_kDHr))) { p[ret++] = SSL3_CT_RSA_EPHEMERAL_DH; p[ret++] = SSL3_CT_DSS_EPHEMERAL_DH; } @@ -3157,7 +3157,7 @@ ssl3_get_req_cert_type(SSL *s, unsigned char *p) /* * ECDSA certs can be used with RSA cipher suites as well - * so we don't need to check for SSL_kECDH or SSL_kEECDH + * so we don't need to check for SSL_kECDH or SSL_kECDHE */ if (s->version >= TLS1_VERSION) { p[ret++] = TLS_CT_ECDSA_SIGN; diff --git a/lib/libssl/s3_srvr.c b/lib/libssl/s3_srvr.c index e0a7d78995e..8d47a16b559 100644 --- a/lib/libssl/s3_srvr.c +++ b/lib/libssl/s3_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_srvr.c,v 1.77 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: s3_srvr.c,v 1.78 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -422,8 +422,8 @@ ssl3_accept(SSL *s) * public key for key exchange. */ if (s->s3->tmp.use_rsa_tmp || - (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH)) || - (alg_k & SSL_kEECDH) || + (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kDHE)) || + (alg_k & SSL_kECDHE) || ((alg_k & SSL_kRSA) && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL))) { @@ -1416,7 +1416,7 @@ ssl3_send_server_key_exchange(SSL *s) r[1] = rsa->e; s->s3->tmp.use_rsa_tmp = 1; } else - if (type & SSL_kEDH) { + if (type & SSL_kDHE) { dhp = cert->dh_tmp; if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) dhp = s->cert->dh_tmp_cb(s, 0, 0); @@ -1463,7 +1463,7 @@ ssl3_send_server_key_exchange(SSL *s) r[1] = dh->g; r[2] = dh->pub_key; } else - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { const EC_GROUP *group; ecdhp = cert->ecdh_tmp; @@ -1614,7 +1614,7 @@ ssl3_send_server_key_exchange(SSL *s) p += nr[i]; } - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { /* * XXX: For now, we only support named (not generic) * curves. @@ -1968,7 +1968,7 @@ ssl3_get_client_key_exchange(SSL *s) p, i); OPENSSL_cleanse(p, i); } else - if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) { + if (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) { if (2 > n) goto truncated; n2s(p, i); @@ -2026,7 +2026,7 @@ ssl3_get_client_key_exchange(SSL *s) OPENSSL_cleanse(p, i); } else - if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) { + if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) { int ret = 1; int field_size = 0; const EC_KEY *tkey; @@ -2072,7 +2072,7 @@ ssl3_get_client_key_exchange(SSL *s) if (n == 0L) { /* Client Publickey was in Client Certificate */ - if (alg_k & SSL_kEECDH) { + if (alg_k & SSL_kECDHE) { al = SSL_AD_HANDSHAKE_FAILURE; SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_MISSING_TMP_ECDH_KEY); diff --git a/lib/libssl/src/ssl/d1_clnt.c b/lib/libssl/src/ssl/d1_clnt.c index 004fd6e04f5..552667f6c13 100644 --- a/lib/libssl/src/ssl/d1_clnt.c +++ b/lib/libssl/src/ssl/d1_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: d1_clnt.c,v 1.30 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: d1_clnt.c,v 1.31 2014/07/12 22:33:39 jsing Exp $ */ /* * DTLS implementation written by Nagendra Modadugu * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. @@ -984,7 +984,7 @@ dtls1_send_client_key_exchange(SSL *s) s->session->master_key, tmp_buf, sizeof tmp_buf); OPENSSL_cleanse(tmp_buf, sizeof tmp_buf); - } else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) { + } else if (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) { DH *dh_srvr, *dh_clnt; if (s->session->sess_cert->peer_dh_tmp != NULL) @@ -1037,7 +1037,7 @@ dtls1_send_client_key_exchange(SSL *s) DH_free(dh_clnt); /* perhaps clean things up a bit EAY EAY EAY EAY*/ - } else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) { + } else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) { const EC_GROUP *srvr_group = NULL; EC_KEY *tkey; int ecdh_clnt_cert = 0; diff --git a/lib/libssl/src/ssl/d1_srvr.c b/lib/libssl/src/ssl/d1_srvr.c index a94b7ed61b1..ecf4a198b16 100644 --- a/lib/libssl/src/ssl/d1_srvr.c +++ b/lib/libssl/src/ssl/d1_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: d1_srvr.c,v 1.32 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: d1_srvr.c,v 1.33 2014/07/12 22:33:39 jsing Exp $ */ /* * DTLS implementation written by Nagendra Modadugu * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. @@ -464,8 +464,8 @@ dtls1_accept(SSL *s) /* only send if a DH key exchange or * RSA but we have a sign only certificate */ if (s->s3->tmp.use_rsa_tmp - || (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) - || (alg_k & SSL_kEECDH) + || (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) + || (alg_k & SSL_kECDHE) || ((alg_k & SSL_kRSA) && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL ) @@ -1052,7 +1052,7 @@ dtls1_send_server_key_exchange(SSL *s) r[1] = rsa->e; s->s3->tmp.use_rsa_tmp = 1; } else - if (type & SSL_kEDH) { + if (type & SSL_kDHE) { dhp = cert->dh_tmp; if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) dhp = s->cert->dh_tmp_cb(s, 0, 0); @@ -1094,7 +1094,7 @@ dtls1_send_server_key_exchange(SSL *s) r[1] = dh->g; r[2] = dh->pub_key; } else - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { const EC_GROUP *group; ecdhp = cert->ecdh_tmp; @@ -1232,7 +1232,7 @@ dtls1_send_server_key_exchange(SSL *s) p += nr[i]; } - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { /* XXX: For now, we only support named (not generic) curves. * In this situation, the serverKeyExchange message has: * [1 byte CurveType], [2 byte CurveName] diff --git a/lib/libssl/src/ssl/s3_clnt.c b/lib/libssl/src/ssl/s3_clnt.c index 252100f587d..b55b2e62c6a 100644 --- a/lib/libssl/src/ssl/s3_clnt.c +++ b/lib/libssl/src/ssl/s3_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_clnt.c,v 1.82 2014/07/12 22:17:59 jsg Exp $ */ +/* $OpenBSD: s3_clnt.c,v 1.83 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1253,7 +1253,7 @@ ssl3_get_key_exchange(SSL *s) } s->session->sess_cert->peer_rsa_tmp = rsa; rsa = NULL; - } else if (alg_k & SSL_kEDH) { + } else if (alg_k & SSL_kDHE) { if ((dh = DH_new()) == NULL) { SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_DH_LIB); @@ -1328,7 +1328,7 @@ ssl3_get_key_exchange(SSL *s) SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER); goto f_err; - } else if (alg_k & SSL_kEECDH) { + } else if (alg_k & SSL_kECDHE) { EC_GROUP *ngroup; const EC_GROUP *group; @@ -1987,7 +1987,7 @@ ssl3_send_client_key_exchange(SSL *s) s->method->ssl3_enc->generate_master_secret( s, s->session->master_key, tmp_buf, sizeof tmp_buf); OPENSSL_cleanse(tmp_buf, sizeof tmp_buf); - } else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) { + } else if (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) { DH *dh_srvr, *dh_clnt; if (s->session->sess_cert == NULL) { @@ -2051,7 +2051,7 @@ ssl3_send_client_key_exchange(SSL *s) DH_free(dh_clnt); /* perhaps clean things up a bit EAY EAY EAY EAY*/ - } else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) { + } else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) { const EC_GROUP *srvr_group = NULL; EC_KEY *tkey; int ecdh_clnt_cert = 0; @@ -2640,7 +2640,7 @@ ssl3_check_cert_and_algorithm(SSL *s) SSL_R_MISSING_RSA_ENCRYPTING_CERT); goto f_err; } - if ((alg_k & SSL_kEDH) && + if ((alg_k & SSL_kDHE) && !(has_bits(i, EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) { SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_MISSING_DH_KEY); diff --git a/lib/libssl/src/ssl/s3_lib.c b/lib/libssl/src/ssl/s3_lib.c index f94e207fc4e..decdda90a3d 100644 --- a/lib/libssl/src/ssl/s3_lib.c +++ b/lib/libssl/src/ssl/s3_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_lib.c,v 1.69 2014/07/11 09:24:44 beck Exp $ */ +/* $OpenBSD: s3_lib.c,v 1.70 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -433,7 +433,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_EDH_DSS_DES_40_CBC_SHA, .id = SSL3_CK_EDH_DSS_DES_40_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -449,7 +449,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_DSS_DES_64_CBC_SHA, .id = SSL3_CK_EDH_DSS_DES_64_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -465,7 +465,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, .id = SSL3_CK_EDH_DSS_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -481,7 +481,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_EDH_RSA_DES_40_CBC_SHA, .id = SSL3_CK_EDH_RSA_DES_40_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -497,7 +497,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_RSA_DES_64_CBC_SHA, .id = SSL3_CK_EDH_RSA_DES_64_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -513,7 +513,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, .id = SSL3_CK_EDH_RSA_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -529,7 +529,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_ADH_RC4_40_MD5, .id = SSL3_CK_ADH_RC4_40_MD5, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_MD5, @@ -545,7 +545,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_ADH_RC4_128_MD5, .id = SSL3_CK_ADH_RC4_128_MD5, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_MD5, @@ -561,7 +561,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 0, /* Weakened 40-bit export cipher. */ .name = SSL3_TXT_ADH_DES_40_CBC_SHA, .id = SSL3_CK_ADH_DES_40_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -577,7 +577,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_ADH_DES_64_CBC_SHA, .id = SSL3_CK_ADH_DES_64_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_DES, .algorithm_mac = SSL_SHA1, @@ -593,7 +593,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = SSL3_TXT_ADH_DES_192_CBC_SHA, .id = SSL3_CK_ADH_DES_192_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -655,7 +655,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, .id = TLS1_CK_DHE_DSS_WITH_AES_128_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -670,7 +670,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -685,7 +685,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_128_SHA, .id = TLS1_CK_ADH_WITH_AES_128_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -748,7 +748,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, .id = TLS1_CK_DHE_DSS_WITH_AES_256_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -764,7 +764,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -780,7 +780,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_256_SHA, .id = TLS1_CK_ADH_WITH_AES_256_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -877,7 +877,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256, .id = TLS1_CK_DHE_DSS_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -944,7 +944,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, .id = TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_CAMELLIA128, .algorithm_mac = SSL_SHA1, @@ -960,7 +960,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CAMELLIA128, .algorithm_mac = SSL_SHA1, @@ -976,7 +976,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA, .id = TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_CAMELLIA128, .algorithm_mac = SSL_SHA1, @@ -994,7 +994,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256, .id = TLS1_CK_DHE_RSA_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1042,7 +1042,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256, .id = TLS1_CK_DHE_DSS_WITH_AES_256_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA256, @@ -1058,7 +1058,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256, .id = TLS1_CK_DHE_RSA_WITH_AES_256_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA256, @@ -1074,7 +1074,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_128_SHA256, .id = TLS1_CK_ADH_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1090,7 +1090,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_256_SHA256, .id = TLS1_CK_ADH_WITH_AES_256_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA256, @@ -1218,7 +1218,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, .id = TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_CAMELLIA256, .algorithm_mac = SSL_SHA1, @@ -1234,7 +1234,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, .id = TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CAMELLIA256, .algorithm_mac = SSL_SHA1, @@ -1250,7 +1250,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA, .id = TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_CAMELLIA256, .algorithm_mac = SSL_SHA1, @@ -1306,7 +1306,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -1324,7 +1324,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -1378,7 +1378,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -1396,7 +1396,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aDSS, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -1450,7 +1450,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_ADH_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -1468,7 +1468,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_ADH_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -1566,7 +1566,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_eNULL, .algorithm_mac = SSL_SHA1, @@ -1582,7 +1582,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_SHA1, @@ -1598,7 +1598,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -1614,7 +1614,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -1630,7 +1630,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -1726,7 +1726,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_NULL_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_eNULL, .algorithm_mac = SSL_SHA1, @@ -1742,7 +1742,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_SHA1, @@ -1758,7 +1758,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -1774,7 +1774,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -1790,7 +1790,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA, .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -1806,7 +1806,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_NULL_SHA, .id = TLS1_CK_ECDH_anon_WITH_NULL_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_eNULL, .algorithm_mac = SSL_SHA1, @@ -1822,7 +1822,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA, .id = TLS1_CK_ECDH_anon_WITH_RC4_128_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_RC4, .algorithm_mac = SSL_SHA1, @@ -1838,7 +1838,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA, .id = TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_3DES, .algorithm_mac = SSL_SHA1, @@ -1854,7 +1854,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA, .id = TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA1, @@ -1870,7 +1870,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA, .id = TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA1, @@ -1889,7 +1889,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1905,7 +1905,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA384, @@ -1953,7 +1953,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256, .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128, .algorithm_mac = SSL_SHA256, @@ -1969,7 +1969,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384, .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256, .algorithm_mac = SSL_SHA384, @@ -2019,7 +2019,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -2037,7 +2037,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -2091,7 +2091,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256, .id = TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES128GCM, .algorithm_mac = SSL_AEAD, @@ -2109,7 +2109,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384, .id = TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_AES256GCM, .algorithm_mac = SSL_AEAD, @@ -2224,7 +2224,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305, .id = TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CHACHA20POLY1305, .algorithm_mac = SSL_AEAD, @@ -2240,7 +2240,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, .id = TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aECDSA, .algorithm_enc = SSL_CHACHA20POLY1305, .algorithm_mac = SSL_AEAD, @@ -2256,7 +2256,7 @@ SSL_CIPHER ssl3_ciphers[] = { .valid = 1, .name = TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305, .id = TLS1_CK_DHE_RSA_CHACHA20_POLY1305, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aRSA, .algorithm_enc = SSL_CHACHA20POLY1305, .algorithm_mac = SSL_AEAD, @@ -3069,7 +3069,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, * if we are considering an ECC cipher suite that uses an * ephemeral EC key */ - (alg_k & SSL_kEECDH) + (alg_k & SSL_kECDHE) /* and we have an ephemeral EC key */ && (s->cert->ecdh_tmp != NULL) /* and the client specified an EllipticCurves extension */ @@ -3108,7 +3108,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, continue; ii = sk_SSL_CIPHER_find(allow, c); if (ii >= 0) { - if ((alg_k & SSL_kEECDH) && + if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari) { if (!ret) ret = sk_SSL_CIPHER_value(allow, ii); @@ -3139,12 +3139,12 @@ ssl3_get_req_cert_type(SSL *s, unsigned char *p) } #endif - if (alg_k & (SSL_kDHr|SSL_kEDH)) { + if (alg_k & (SSL_kDHr|SSL_kDHE)) { p[ret++] = SSL3_CT_RSA_FIXED_DH; p[ret++] = SSL3_CT_DSS_FIXED_DH; } if ((s->version == SSL3_VERSION) && - (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) { + (alg_k & (SSL_kDHE|SSL_kDHd|SSL_kDHr))) { p[ret++] = SSL3_CT_RSA_EPHEMERAL_DH; p[ret++] = SSL3_CT_DSS_EPHEMERAL_DH; } @@ -3157,7 +3157,7 @@ ssl3_get_req_cert_type(SSL *s, unsigned char *p) /* * ECDSA certs can be used with RSA cipher suites as well - * so we don't need to check for SSL_kECDH or SSL_kEECDH + * so we don't need to check for SSL_kECDH or SSL_kECDHE */ if (s->version >= TLS1_VERSION) { p[ret++] = TLS_CT_ECDSA_SIGN; diff --git a/lib/libssl/src/ssl/s3_srvr.c b/lib/libssl/src/ssl/s3_srvr.c index e0a7d78995e..8d47a16b559 100644 --- a/lib/libssl/src/ssl/s3_srvr.c +++ b/lib/libssl/src/ssl/s3_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: s3_srvr.c,v 1.77 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: s3_srvr.c,v 1.78 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -422,8 +422,8 @@ ssl3_accept(SSL *s) * public key for key exchange. */ if (s->s3->tmp.use_rsa_tmp || - (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH)) || - (alg_k & SSL_kEECDH) || + (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kDHE)) || + (alg_k & SSL_kECDHE) || ((alg_k & SSL_kRSA) && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL))) { @@ -1416,7 +1416,7 @@ ssl3_send_server_key_exchange(SSL *s) r[1] = rsa->e; s->s3->tmp.use_rsa_tmp = 1; } else - if (type & SSL_kEDH) { + if (type & SSL_kDHE) { dhp = cert->dh_tmp; if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL)) dhp = s->cert->dh_tmp_cb(s, 0, 0); @@ -1463,7 +1463,7 @@ ssl3_send_server_key_exchange(SSL *s) r[1] = dh->g; r[2] = dh->pub_key; } else - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { const EC_GROUP *group; ecdhp = cert->ecdh_tmp; @@ -1614,7 +1614,7 @@ ssl3_send_server_key_exchange(SSL *s) p += nr[i]; } - if (type & SSL_kEECDH) { + if (type & SSL_kECDHE) { /* * XXX: For now, we only support named (not generic) * curves. @@ -1968,7 +1968,7 @@ ssl3_get_client_key_exchange(SSL *s) p, i); OPENSSL_cleanse(p, i); } else - if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) { + if (alg_k & (SSL_kDHE|SSL_kDHr|SSL_kDHd)) { if (2 > n) goto truncated; n2s(p, i); @@ -2026,7 +2026,7 @@ ssl3_get_client_key_exchange(SSL *s) OPENSSL_cleanse(p, i); } else - if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) { + if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) { int ret = 1; int field_size = 0; const EC_KEY *tkey; @@ -2072,7 +2072,7 @@ ssl3_get_client_key_exchange(SSL *s) if (n == 0L) { /* Client Publickey was in Client Certificate */ - if (alg_k & SSL_kEECDH) { + if (alg_k & SSL_kECDHE) { al = SSL_AD_HANDSHAKE_FAILURE; SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_MISSING_TMP_ECDH_KEY); diff --git a/lib/libssl/src/ssl/ssl_ciph.c b/lib/libssl/src/ssl/ssl_ciph.c index a2dec527ca1..70c91bf6007 100644 --- a/lib/libssl/src/ssl/ssl_ciph.c +++ b/lib/libssl/src/ssl/ssl_ciph.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_ciph.c,v 1.65 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: ssl_ciph.c,v 1.66 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -233,7 +233,7 @@ static const SSL_CIPHER cipher_aliases[] = { */ { .name = SSL_TXT_CMPDEF, - .algorithm_mkey = SSL_kEDH|SSL_kEECDH, + .algorithm_mkey = SSL_kDHE|SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = ~SSL_eNULL, }, @@ -265,11 +265,11 @@ static const SSL_CIPHER cipher_aliases[] = { }, { .name = SSL_TXT_kEDH, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, }, { .name = SSL_TXT_DH, - .algorithm_mkey = SSL_kDHr|SSL_kDHd|SSL_kEDH, + .algorithm_mkey = SSL_kDHr|SSL_kDHd|SSL_kDHE, }, { @@ -286,11 +286,11 @@ static const SSL_CIPHER cipher_aliases[] = { }, { .name = SSL_TXT_kEECDH, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, }, { .name = SSL_TXT_ECDH, - .algorithm_mkey = SSL_kECDHr|SSL_kECDHe|SSL_kEECDH, + .algorithm_mkey = SSL_kECDHr|SSL_kECDHe|SSL_kECDHE, }, { @@ -348,12 +348,12 @@ static const SSL_CIPHER cipher_aliases[] = { /* aliases combining key exchange and server authentication */ { .name = SSL_TXT_EDH, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = ~SSL_aNULL, }, { .name = SSL_TXT_EECDH, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = ~SSL_aNULL, }, { @@ -367,12 +367,12 @@ static const SSL_CIPHER cipher_aliases[] = { }, { .name = SSL_TXT_ADH, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, }, { .name = SSL_TXT_AECDH, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, }, @@ -1451,8 +1451,8 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method, /* Now arrange all ciphers by preference: */ /* Everything else being equal, prefer ephemeral ECDH over other key exchange mechanisms */ - ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); - ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); + ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); + ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); /* * CHACHA20 is fast and safe on all hardware and is thus our preferred @@ -1609,7 +1609,7 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) case SSL_kDHd: kx = "DH/DSS"; break; - case SSL_kEDH: + case SSL_kDHE: kx = "DH"; break; case SSL_kECDHr: @@ -1618,7 +1618,7 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) case SSL_kECDHe: kx = "ECDH/ECDSA"; break; - case SSL_kEECDH: + case SSL_kECDHE: kx = "ECDH"; break; default: diff --git a/lib/libssl/src/ssl/ssl_lib.c b/lib/libssl/src/ssl/ssl_lib.c index b563071cdad..6b62713bca5 100644 --- a/lib/libssl/src/ssl/ssl_lib.c +++ b/lib/libssl/src/ssl/ssl_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_lib.c,v 1.77 2014/07/12 19:45:53 jsing Exp $ */ +/* $OpenBSD: ssl_lib.c,v 1.78 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1973,7 +1973,7 @@ ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) mask_k|=SSL_kRSA; if (dh_tmp) - mask_k|=SSL_kEDH; + mask_k|=SSL_kDHE; if (dh_rsa) mask_k|=SSL_kDHr; @@ -2022,7 +2022,7 @@ ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) } if (have_ecdh_tmp) { - mask_k|=SSL_kEECDH; + mask_k|=SSL_kECDHE; } @@ -2108,10 +2108,10 @@ ssl_get_server_send_pkey(const SSL *s) if (alg_k & (SSL_kECDHr|SSL_kECDHe)) { /* - * We don't need to look at SSL_kEECDH + * We don't need to look at SSL_kECDHE * since no certificate is needed for * anon ECDH and for authenticated - * EECDH, the check for the auth + * ECDHE, the check for the auth * algorithm will set i correctly * NOTE: For ECDH-RSA, we need an ECC * not an RSA cert but for EECDH-RSA diff --git a/lib/libssl/src/ssl/ssl_locl.h b/lib/libssl/src/ssl/ssl_locl.h index 22ba8d926e5..34e6337856b 100644 --- a/lib/libssl/src/ssl/ssl_locl.h +++ b/lib/libssl/src/ssl/ssl_locl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_locl.h,v 1.61 2014/07/12 19:45:53 jsing Exp $ */ +/* $OpenBSD: ssl_locl.h,v 1.62 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -256,10 +256,10 @@ #define SSL_kRSA 0x00000001L /* RSA key exchange */ #define SSL_kDHr 0x00000002L /* DH cert, RSA CA cert */ /* no such ciphersuites supported! */ #define SSL_kDHd 0x00000004L /* DH cert, DSA CA cert */ /* no such ciphersuite supported! */ -#define SSL_kEDH 0x00000008L /* tmp DH key no DH cert */ +#define SSL_kDHE 0x00000008L /* tmp DH key no DH cert */ #define SSL_kECDHr 0x00000020L /* ECDH cert, RSA CA cert */ #define SSL_kECDHe 0x00000040L /* ECDH cert, ECDSA CA cert */ -#define SSL_kEECDH 0x00000080L /* ephemeral ECDH */ +#define SSL_kECDHE 0x00000080L /* ephemeral ECDH */ #define SSL_kGOST 0x00000200L /* GOST key exchange */ /* Bits for algorithm_auth (server authentication) */ @@ -397,7 +397,7 @@ /* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) | * <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN) * SSL_kDH <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN) - * SSL_kEDH <- RSA_ENC | RSA_SIGN | DSA_SIGN + * SSL_kDHE <- RSA_ENC | RSA_SIGN | DSA_SIGN * SSL_aRSA <- RSA_ENC | RSA_SIGN * SSL_aDSS <- DSA_SIGN */ diff --git a/lib/libssl/src/ssl/t1_lib.c b/lib/libssl/src/ssl/t1_lib.c index 03af6e29efa..46b47a95b7b 100644 --- a/lib/libssl/src/ssl/t1_lib.c +++ b/lib/libssl/src/ssl/t1_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: t1_lib.c,v 1.49 2014/07/09 11:10:51 bcook Exp $ */ +/* $OpenBSD: t1_lib.c,v 1.50 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1477,7 +1477,7 @@ ssl_prepare_clienthello_tlsext(SSL *s) alg_k = c->algorithm_mkey; alg_a = c->algorithm_auth; - if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || + if ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA))) { using_ecc = 1; break; @@ -1524,7 +1524,7 @@ ssl_prepare_serverhello_tlsext(SSL *s) unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth; - int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA); + int using_ecc = (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA); using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL); if (using_ecc) { @@ -1650,7 +1650,7 @@ ssl_check_serverhello_tlsext(SSL *s) (s->tlsext_ecpointformatlist_length > 0) && (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && - ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA))) { + ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA))) { /* we are using an ECC cipher */ size_t i; unsigned char *list; diff --git a/lib/libssl/ssl_ciph.c b/lib/libssl/ssl_ciph.c index a2dec527ca1..70c91bf6007 100644 --- a/lib/libssl/ssl_ciph.c +++ b/lib/libssl/ssl_ciph.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_ciph.c,v 1.65 2014/07/12 13:11:53 jsing Exp $ */ +/* $OpenBSD: ssl_ciph.c,v 1.66 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -233,7 +233,7 @@ static const SSL_CIPHER cipher_aliases[] = { */ { .name = SSL_TXT_CMPDEF, - .algorithm_mkey = SSL_kEDH|SSL_kEECDH, + .algorithm_mkey = SSL_kDHE|SSL_kECDHE, .algorithm_auth = SSL_aNULL, .algorithm_enc = ~SSL_eNULL, }, @@ -265,11 +265,11 @@ static const SSL_CIPHER cipher_aliases[] = { }, { .name = SSL_TXT_kEDH, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, }, { .name = SSL_TXT_DH, - .algorithm_mkey = SSL_kDHr|SSL_kDHd|SSL_kEDH, + .algorithm_mkey = SSL_kDHr|SSL_kDHd|SSL_kDHE, }, { @@ -286,11 +286,11 @@ static const SSL_CIPHER cipher_aliases[] = { }, { .name = SSL_TXT_kEECDH, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, }, { .name = SSL_TXT_ECDH, - .algorithm_mkey = SSL_kECDHr|SSL_kECDHe|SSL_kEECDH, + .algorithm_mkey = SSL_kECDHr|SSL_kECDHe|SSL_kECDHE, }, { @@ -348,12 +348,12 @@ static const SSL_CIPHER cipher_aliases[] = { /* aliases combining key exchange and server authentication */ { .name = SSL_TXT_EDH, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = ~SSL_aNULL, }, { .name = SSL_TXT_EECDH, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = ~SSL_aNULL, }, { @@ -367,12 +367,12 @@ static const SSL_CIPHER cipher_aliases[] = { }, { .name = SSL_TXT_ADH, - .algorithm_mkey = SSL_kEDH, + .algorithm_mkey = SSL_kDHE, .algorithm_auth = SSL_aNULL, }, { .name = SSL_TXT_AECDH, - .algorithm_mkey = SSL_kEECDH, + .algorithm_mkey = SSL_kECDHE, .algorithm_auth = SSL_aNULL, }, @@ -1451,8 +1451,8 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method, /* Now arrange all ciphers by preference: */ /* Everything else being equal, prefer ephemeral ECDH over other key exchange mechanisms */ - ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); - ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); + ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); + ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); /* * CHACHA20 is fast and safe on all hardware and is thus our preferred @@ -1609,7 +1609,7 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) case SSL_kDHd: kx = "DH/DSS"; break; - case SSL_kEDH: + case SSL_kDHE: kx = "DH"; break; case SSL_kECDHr: @@ -1618,7 +1618,7 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) case SSL_kECDHe: kx = "ECDH/ECDSA"; break; - case SSL_kEECDH: + case SSL_kECDHE: kx = "ECDH"; break; default: diff --git a/lib/libssl/ssl_lib.c b/lib/libssl/ssl_lib.c index b563071cdad..6b62713bca5 100644 --- a/lib/libssl/ssl_lib.c +++ b/lib/libssl/ssl_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_lib.c,v 1.77 2014/07/12 19:45:53 jsing Exp $ */ +/* $OpenBSD: ssl_lib.c,v 1.78 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1973,7 +1973,7 @@ ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) mask_k|=SSL_kRSA; if (dh_tmp) - mask_k|=SSL_kEDH; + mask_k|=SSL_kDHE; if (dh_rsa) mask_k|=SSL_kDHr; @@ -2022,7 +2022,7 @@ ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) } if (have_ecdh_tmp) { - mask_k|=SSL_kEECDH; + mask_k|=SSL_kECDHE; } @@ -2108,10 +2108,10 @@ ssl_get_server_send_pkey(const SSL *s) if (alg_k & (SSL_kECDHr|SSL_kECDHe)) { /* - * We don't need to look at SSL_kEECDH + * We don't need to look at SSL_kECDHE * since no certificate is needed for * anon ECDH and for authenticated - * EECDH, the check for the auth + * ECDHE, the check for the auth * algorithm will set i correctly * NOTE: For ECDH-RSA, we need an ECC * not an RSA cert but for EECDH-RSA diff --git a/lib/libssl/ssl_locl.h b/lib/libssl/ssl_locl.h index 22ba8d926e5..34e6337856b 100644 --- a/lib/libssl/ssl_locl.h +++ b/lib/libssl/ssl_locl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_locl.h,v 1.61 2014/07/12 19:45:53 jsing Exp $ */ +/* $OpenBSD: ssl_locl.h,v 1.62 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -256,10 +256,10 @@ #define SSL_kRSA 0x00000001L /* RSA key exchange */ #define SSL_kDHr 0x00000002L /* DH cert, RSA CA cert */ /* no such ciphersuites supported! */ #define SSL_kDHd 0x00000004L /* DH cert, DSA CA cert */ /* no such ciphersuite supported! */ -#define SSL_kEDH 0x00000008L /* tmp DH key no DH cert */ +#define SSL_kDHE 0x00000008L /* tmp DH key no DH cert */ #define SSL_kECDHr 0x00000020L /* ECDH cert, RSA CA cert */ #define SSL_kECDHe 0x00000040L /* ECDH cert, ECDSA CA cert */ -#define SSL_kEECDH 0x00000080L /* ephemeral ECDH */ +#define SSL_kECDHE 0x00000080L /* ephemeral ECDH */ #define SSL_kGOST 0x00000200L /* GOST key exchange */ /* Bits for algorithm_auth (server authentication) */ @@ -397,7 +397,7 @@ /* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) | * <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN) * SSL_kDH <- DH_ENC & (RSA_ENC | RSA_SIGN | DSA_SIGN) - * SSL_kEDH <- RSA_ENC | RSA_SIGN | DSA_SIGN + * SSL_kDHE <- RSA_ENC | RSA_SIGN | DSA_SIGN * SSL_aRSA <- RSA_ENC | RSA_SIGN * SSL_aDSS <- DSA_SIGN */ diff --git a/lib/libssl/t1_lib.c b/lib/libssl/t1_lib.c index 03af6e29efa..46b47a95b7b 100644 --- a/lib/libssl/t1_lib.c +++ b/lib/libssl/t1_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: t1_lib.c,v 1.49 2014/07/09 11:10:51 bcook Exp $ */ +/* $OpenBSD: t1_lib.c,v 1.50 2014/07/12 22:33:39 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1477,7 +1477,7 @@ ssl_prepare_clienthello_tlsext(SSL *s) alg_k = c->algorithm_mkey; alg_a = c->algorithm_auth; - if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || + if ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA))) { using_ecc = 1; break; @@ -1524,7 +1524,7 @@ ssl_prepare_serverhello_tlsext(SSL *s) unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth; - int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA); + int using_ecc = (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA); using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL); if (using_ecc) { @@ -1650,7 +1650,7 @@ ssl_check_serverhello_tlsext(SSL *s) (s->tlsext_ecpointformatlist_length > 0) && (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && - ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA))) { + ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA))) { /* we are using an ECC cipher */ size_t i; unsigned char *list; -- 2.20.1