yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-23 13:25:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Added support for the SHA256 ciphersuites of AES and Camellia

Browse source
This commit is contained in:
Paul Bakker 2012-04-12 21:26:34 +00:00
parent bf63b36127
commit 10cd225962
6 changed files with 285 additions and 69 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
include/polarssl/ssl.h
View file

@ -115,22 +115,32 @@
#define SSL_RSA_NULL_MD5 0x01 /**< Weak! */ #define SSL_RSA_NULL_MD5 0x01 /**< Weak! */
#define SSL_RSA_NULL_SHA 0x02 /**< Weak! */ #define SSL_RSA_NULL_SHA 0x02 /**< Weak! */
#define SSL_RSA_NULL_SHA256 0x3B /**< Weak! */ #define SSL_RSA_NULL_SHA256 0x3B /**< Weak! */
#define SSL_RSA_DES_SHA 0x09 /**< Weak! */ #define SSL_RSA_DES_SHA 0x09 /**< Weak! Not in TLS 1.2 */
#define SSL_EDH_RSA_DES_SHA 0x15 /**< Weak! */ #define SSL_EDH_RSA_DES_SHA 0x15 /**< Weak! Not in TLS 1.2 */
#define SSL_RSA_RC4_128_MD5 0x04 #define SSL_RSA_RC4_128_MD5 0x04
#define SSL_RSA_RC4_128_SHA 0x05 #define SSL_RSA_RC4_128_SHA 0x05
#define SSL_RSA_DES_168_SHA 0x0A #define SSL_RSA_DES_168_SHA 0x0A
#define SSL_EDH_RSA_DES_168_SHA 0x16 #define SSL_EDH_RSA_DES_168_SHA 0x16
#define SSL_RSA_AES_128_SHA 0x2F #define SSL_RSA_AES_128_SHA 0x2F
#define SSL_EDH_RSA_AES_128_SHA 0x33 #define SSL_EDH_RSA_AES_128_SHA 0x33
#define SSL_RSA_AES_256_SHA 0x35 #define SSL_RSA_AES_256_SHA 0x35
#define SSL_EDH_RSA_AES_256_SHA 0x39 #define SSL_EDH_RSA_AES_256_SHA 0x39
#define SSL_RSA_AES_128_SHA256 0x3C /**< TLS 1.2 */
#define SSL_RSA_AES_256_SHA256 0x3D /**< TLS 1.2 */
#define SSL_EDH_RSA_AES_128_SHA256 0x67 /**< TLS 1.2 */
#define SSL_EDH_RSA_AES_256_SHA256 0x6B /**< TLS 1.2 */
#define SSL_RSA_CAMELLIA_128_SHA 0x41 #define SSL_RSA_CAMELLIA_128_SHA 0x41
#define SSL_EDH_RSA_CAMELLIA_128_SHA 0x45 #define SSL_EDH_RSA_CAMELLIA_128_SHA 0x45
#define SSL_RSA_CAMELLIA_256_SHA 0x84 #define SSL_RSA_CAMELLIA_256_SHA 0x84
#define SSL_EDH_RSA_CAMELLIA_256_SHA 0x88 #define SSL_EDH_RSA_CAMELLIA_256_SHA 0x88
#define SSL_RSA_CAMELLIA_128_SHA256 0xBA /**< TLS 1.2 */
#define SSL_EDH_RSA_CAMELLIA_128_SHA256 0xBE /**< TLS 1.2 */
#define SSL_RSA_CAMELLIA_256_SHA256 0xC0 /**< TLS 1.2 */
#define SSL_EDH_RSA_CAMELLIA_256_SHA256 0xC4 /**< TLS 1.2 */
/* /*
* Supported Signature and Hash algorithms (For TLS 1.2) * Supported Signature and Hash algorithms (For TLS 1.2)

12
library/ssl_cli.c
View file

@ -448,8 +448,12 @@ static int ssl_parse_server_key_exchange( ssl_context *ssl )
ssl->session->ciphersuite != SSL_EDH_RSA_DES_168_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_DES_168_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_128_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_AES_128_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_256_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_AES_256_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_128_SHA256 &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_256_SHA256 &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_128_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_128_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_256_SHA) ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_256_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_128_SHA256 &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_256_SHA256 )
{ {
SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) ); SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
ssl->state++; ssl->state++;
@ -777,8 +781,12 @@ static int ssl_write_client_key_exchange( ssl_context *ssl )
ssl->session->ciphersuite == SSL_EDH_RSA_DES_168_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_DES_168_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA) ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA256 )
{ {
#if !defined(POLARSSL_DHM_C) #if !defined(POLARSSL_DHM_C)
SSL_DEBUG_MSG( 1, ( "support for dhm in not available" ) ); SSL_DEBUG_MSG( 1, ( "support for dhm in not available" ) );

12
library/ssl_srv.c
View file

@ -552,8 +552,12 @@ static int ssl_write_server_key_exchange( ssl_context *ssl )
ssl->session->ciphersuite != SSL_EDH_RSA_DES_168_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_DES_168_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_128_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_AES_128_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_256_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_AES_256_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_128_SHA256 &&
ssl->session->ciphersuite != SSL_EDH_RSA_AES_256_SHA256 &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_128_SHA && ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_128_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_256_SHA) ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_256_SHA &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_128_SHA256 &&
ssl->session->ciphersuite != SSL_EDH_RSA_CAMELLIA_256_SHA256 )
{ {
SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) ); SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
ssl->state++; ssl->state++;
@ -761,8 +765,12 @@ static int ssl_parse_client_key_exchange( ssl_context *ssl )
ssl->session->ciphersuite == SSL_EDH_RSA_DES_168_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_DES_168_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA) ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA256 )
{ {
#if !defined(POLARSSL_DHM_C) #if !defined(POLARSSL_DHM_C)
SSL_DEBUG_MSG( 1, ( "support for dhm is not available" ) ); SSL_DEBUG_MSG( 1, ( "support for dhm is not available" ) );

142
library/ssl_tls.c
View file

@ -323,6 +323,20 @@ int ssl_derive_keys( ssl_context *ssl )
ssl->keylen = 32; ssl->minlen = 32; ssl->keylen = 32; ssl->minlen = 32;
ssl->ivlen = 16; ssl->maclen = 20; ssl->ivlen = 16; ssl->maclen = 20;
break; break;
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_AES_128_SHA256:
case SSL_EDH_RSA_AES_128_SHA256:
ssl->keylen = 16; ssl->minlen = 32;
ssl->ivlen = 16; ssl->maclen = 32;
break;
case SSL_RSA_AES_256_SHA256:
case SSL_EDH_RSA_AES_256_SHA256:
ssl->keylen = 32; ssl->minlen = 32;
ssl->ivlen = 16; ssl->maclen = 32;
break;
#endif
#endif #endif
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
@ -337,6 +351,20 @@ int ssl_derive_keys( ssl_context *ssl )
ssl->keylen = 32; ssl->minlen = 32; ssl->keylen = 32; ssl->minlen = 32;
ssl->ivlen = 16; ssl->maclen = 20; ssl->ivlen = 16; ssl->maclen = 20;
break; break;
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_CAMELLIA_128_SHA256:
case SSL_EDH_RSA_CAMELLIA_128_SHA256:
ssl->keylen = 16; ssl->minlen = 32;
ssl->ivlen = 16; ssl->maclen = 32;
break;
case SSL_RSA_CAMELLIA_256_SHA256:
case SSL_EDH_RSA_CAMELLIA_256_SHA256:
ssl->keylen = 32; ssl->minlen = 32;
ssl->ivlen = 16; ssl->maclen = 32;
break;
#endif
#endif #endif
#if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
@ -430,12 +458,20 @@ int ssl_derive_keys( ssl_context *ssl )
#if defined(POLARSSL_AES_C) #if defined(POLARSSL_AES_C)
case SSL_RSA_AES_128_SHA: case SSL_RSA_AES_128_SHA:
case SSL_EDH_RSA_AES_128_SHA: case SSL_EDH_RSA_AES_128_SHA:
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_AES_128_SHA256:
case SSL_EDH_RSA_AES_128_SHA256:
#endif
aes_setkey_enc( (aes_context *) ssl->ctx_enc, key1, 128 ); aes_setkey_enc( (aes_context *) ssl->ctx_enc, key1, 128 );
aes_setkey_dec( (aes_context *) ssl->ctx_dec, key2, 128 ); aes_setkey_dec( (aes_context *) ssl->ctx_dec, key2, 128 );
break; break;
case SSL_RSA_AES_256_SHA: case SSL_RSA_AES_256_SHA:
case SSL_EDH_RSA_AES_256_SHA: case SSL_EDH_RSA_AES_256_SHA:
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_AES_256_SHA256:
case SSL_EDH_RSA_AES_256_SHA256:
#endif
aes_setkey_enc( (aes_context *) ssl->ctx_enc, key1, 256 ); aes_setkey_enc( (aes_context *) ssl->ctx_enc, key1, 256 );
aes_setkey_dec( (aes_context *) ssl->ctx_dec, key2, 256 ); aes_setkey_dec( (aes_context *) ssl->ctx_dec, key2, 256 );
break; break;
@ -444,12 +480,20 @@ int ssl_derive_keys( ssl_context *ssl )
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
case SSL_RSA_CAMELLIA_128_SHA: case SSL_RSA_CAMELLIA_128_SHA:
case SSL_EDH_RSA_CAMELLIA_128_SHA: case SSL_EDH_RSA_CAMELLIA_128_SHA:
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_CAMELLIA_128_SHA256:
case SSL_EDH_RSA_CAMELLIA_128_SHA256:
#endif
camellia_setkey_enc( (camellia_context *) ssl->ctx_enc, key1, 128 ); camellia_setkey_enc( (camellia_context *) ssl->ctx_enc, key1, 128 );
camellia_setkey_dec( (camellia_context *) ssl->ctx_dec, key2, 128 ); camellia_setkey_dec( (camellia_context *) ssl->ctx_dec, key2, 128 );
break; break;
case SSL_RSA_CAMELLIA_256_SHA: case SSL_RSA_CAMELLIA_256_SHA:
case SSL_EDH_RSA_CAMELLIA_256_SHA: case SSL_EDH_RSA_CAMELLIA_256_SHA:
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_CAMELLIA_256_SHA256:
case SSL_EDH_RSA_CAMELLIA_256_SHA256:
#endif
camellia_setkey_enc( (camellia_context *) ssl->ctx_enc, key1, 256 ); camellia_setkey_enc( (camellia_context *) ssl->ctx_enc, key1, 256 );
camellia_setkey_dec( (camellia_context *) ssl->ctx_dec, key2, 256 ); camellia_setkey_dec( (camellia_context *) ssl->ctx_dec, key2, 256 );
break; break;
@ -755,7 +799,11 @@ static int ssl_encrypt_buf( ssl_context *ssl )
if ( ssl->session->ciphersuite == SSL_RSA_AES_128_SHA || if ( ssl->session->ciphersuite == SSL_RSA_AES_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA ||
ssl->session->ciphersuite == SSL_RSA_AES_256_SHA || ssl->session->ciphersuite == SSL_RSA_AES_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA) ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA ||
ssl->session->ciphersuite == SSL_RSA_AES_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA256 ||
ssl->session->ciphersuite == SSL_RSA_AES_256_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA256 )
{ {
aes_crypt_cbc( (aes_context *) ssl->ctx_enc, aes_crypt_cbc( (aes_context *) ssl->ctx_enc,
AES_ENCRYPT, enc_msglen, AES_ENCRYPT, enc_msglen,
@ -768,7 +816,11 @@ static int ssl_encrypt_buf( ssl_context *ssl )
if ( ssl->session->ciphersuite == SSL_RSA_CAMELLIA_128_SHA || if ( ssl->session->ciphersuite == SSL_RSA_CAMELLIA_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA ||
ssl->session->ciphersuite == SSL_RSA_CAMELLIA_256_SHA || ssl->session->ciphersuite == SSL_RSA_CAMELLIA_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA) ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA ||
ssl->session->ciphersuite == SSL_RSA_CAMELLIA_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA256 ||
ssl->session->ciphersuite == SSL_RSA_CAMELLIA_256_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA256 )
{ {
camellia_crypt_cbc( (camellia_context *) ssl->ctx_enc, camellia_crypt_cbc( (camellia_context *) ssl->ctx_enc,
CAMELLIA_ENCRYPT, enc_msglen, CAMELLIA_ENCRYPT, enc_msglen,
@ -885,7 +937,11 @@ static int ssl_decrypt_buf( ssl_context *ssl )
if ( ssl->session->ciphersuite == SSL_RSA_AES_128_SHA || if ( ssl->session->ciphersuite == SSL_RSA_AES_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA ||
ssl->session->ciphersuite == SSL_RSA_AES_256_SHA || ssl->session->ciphersuite == SSL_RSA_AES_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA) ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA ||
ssl->session->ciphersuite == SSL_RSA_AES_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_128_SHA256 ||
ssl->session->ciphersuite == SSL_RSA_AES_256_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_AES_256_SHA256 )
{ {
aes_crypt_cbc( (aes_context *) ssl->ctx_dec, aes_crypt_cbc( (aes_context *) ssl->ctx_dec,
AES_DECRYPT, dec_msglen, AES_DECRYPT, dec_msglen,
@ -898,7 +954,11 @@ static int ssl_decrypt_buf( ssl_context *ssl )
if ( ssl->session->ciphersuite == SSL_RSA_CAMELLIA_128_SHA || if ( ssl->session->ciphersuite == SSL_RSA_CAMELLIA_128_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA || ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA ||
ssl->session->ciphersuite == SSL_RSA_CAMELLIA_256_SHA || ssl->session->ciphersuite == SSL_RSA_CAMELLIA_256_SHA ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA) ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA ||
ssl->session->ciphersuite == SSL_RSA_CAMELLIA_128_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_128_SHA256 ||
ssl->session->ciphersuite == SSL_RSA_CAMELLIA_256_SHA256 ||
ssl->session->ciphersuite == SSL_EDH_RSA_CAMELLIA_256_SHA256 )
{ {
camellia_crypt_cbc( (camellia_context *) ssl->ctx_dec, camellia_crypt_cbc( (camellia_context *) ssl->ctx_dec,
CAMELLIA_DECRYPT, dec_msglen, CAMELLIA_DECRYPT, dec_msglen,
@ -2212,6 +2272,20 @@ const char *ssl_get_ciphersuite_name( const int ciphersuite_id )
case SSL_EDH_RSA_AES_256_SHA: case SSL_EDH_RSA_AES_256_SHA:
return( "SSL-EDH-RSA-AES-256-SHA" ); return( "SSL-EDH-RSA-AES-256-SHA" );
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_AES_128_SHA256:
return( "SSL-RSA-AES-128-SHA256" );
case SSL_EDH_RSA_AES_128_SHA256:
return( "SSL-EDH-RSA-AES-128-SHA256" );
case SSL_RSA_AES_256_SHA256:
return( "SSL-RSA-AES-256-SHA256" );
case SSL_EDH_RSA_AES_256_SHA256:
return( "SSL-EDH-RSA-AES-256-SHA256" );
#endif
#endif #endif
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
@ -2226,6 +2300,20 @@ const char *ssl_get_ciphersuite_name( const int ciphersuite_id )
case SSL_EDH_RSA_CAMELLIA_256_SHA: case SSL_EDH_RSA_CAMELLIA_256_SHA:
return( "SSL-EDH-RSA-CAMELLIA-256-SHA" ); return( "SSL-EDH-RSA-CAMELLIA-256-SHA" );
#if defined(POLARSSL_SHA2_C)
case SSL_RSA_CAMELLIA_128_SHA256:
return( "SSL-RSA-CAMELLIA-128-SHA256" );
case SSL_EDH_RSA_CAMELLIA_128_SHA256:
return( "SSL-EDH-RSA-CAMELLIA-128-SHA256" );
case SSL_RSA_CAMELLIA_256_SHA256:
return( "SSL-RSA-CAMELLIA-256-SHA256" );
case SSL_EDH_RSA_CAMELLIA_256_SHA256:
return( "SSL-EDH-RSA-CAMELLIA-256-SHA256" );
#endif
#endif #endif
#if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
@ -2278,6 +2366,17 @@ int ssl_get_ciphersuite_id( const char *ciphersuite_name )
return( SSL_RSA_AES_256_SHA ); return( SSL_RSA_AES_256_SHA );
if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-AES-256-SHA")) if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-AES-256-SHA"))
return( SSL_EDH_RSA_AES_256_SHA ); return( SSL_EDH_RSA_AES_256_SHA );
#if defined(POLARSSL_SHA2_C)
if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-AES-128-SHA256"))
return( SSL_RSA_AES_128_SHA256 );
if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-AES-128-SHA256"))
return( SSL_EDH_RSA_AES_128_SHA256 );
if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-AES-256-SHA256"))
return( SSL_RSA_AES_256_SHA256 );
if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-AES-256-SHA256"))
return( SSL_EDH_RSA_AES_256_SHA256 );
#endif
#endif #endif
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
@ -2289,6 +2388,17 @@ int ssl_get_ciphersuite_id( const char *ciphersuite_name )
return( SSL_RSA_CAMELLIA_256_SHA ); return( SSL_RSA_CAMELLIA_256_SHA );
if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-CAMELLIA-256-SHA")) if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-CAMELLIA-256-SHA"))
return( SSL_EDH_RSA_CAMELLIA_256_SHA ); return( SSL_EDH_RSA_CAMELLIA_256_SHA );
#if defined(POLARSSL_SHA2_C)
if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-CAMELLIA-128-SHA256"))
return( SSL_RSA_CAMELLIA_128_SHA256 );
if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-CAMELLIA-128-SHA256"))
return( SSL_EDH_RSA_CAMELLIA_128_SHA256 );
if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-CAMELLIA-256-SHA256"))
return( SSL_RSA_CAMELLIA_256_SHA256 );
if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-CAMELLIA-256-SHA256"))
return( SSL_EDH_RSA_CAMELLIA_256_SHA256 );
#endif
#endif #endif
#if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
@ -2343,12 +2453,20 @@ int ssl_default_ciphersuites[] =
{ {
#if defined(POLARSSL_DHM_C) #if defined(POLARSSL_DHM_C)
#if defined(POLARSSL_AES_C) #if defined(POLARSSL_AES_C)
SSL_EDH_RSA_AES_128_SHA, #if defined(POLARSSL_SHA2_C)
SSL_EDH_RSA_AES_256_SHA256,
SSL_EDH_RSA_AES_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_EDH_RSA_AES_256_SHA, SSL_EDH_RSA_AES_256_SHA,
SSL_EDH_RSA_AES_128_SHA,
#endif #endif
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
SSL_EDH_RSA_CAMELLIA_128_SHA, #if defined(POLARSSL_SHA2_C)
SSL_EDH_RSA_CAMELLIA_256_SHA256,
SSL_EDH_RSA_CAMELLIA_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_EDH_RSA_CAMELLIA_256_SHA, SSL_EDH_RSA_CAMELLIA_256_SHA,
SSL_EDH_RSA_CAMELLIA_128_SHA,
#endif #endif
#if defined(POLARSSL_DES_C) #if defined(POLARSSL_DES_C)
SSL_EDH_RSA_DES_168_SHA, SSL_EDH_RSA_DES_168_SHA,
@ -2356,15 +2474,27 @@ int ssl_default_ciphersuites[] =
#endif #endif
#if defined(POLARSSL_AES_C) #if defined(POLARSSL_AES_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_AES_256_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_AES_256_SHA, SSL_RSA_AES_256_SHA,
#endif #endif
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_CAMELLIA_256_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_CAMELLIA_256_SHA, SSL_RSA_CAMELLIA_256_SHA,
#endif #endif
#if defined(POLARSSL_AES_C) #if defined(POLARSSL_AES_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_AES_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_AES_128_SHA, SSL_RSA_AES_128_SHA,
#endif #endif
#if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_CAMELLIA_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_CAMELLIA_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_CAMELLIA_128_SHA, SSL_RSA_CAMELLIA_128_SHA,
#endif #endif
#if defined(POLARSSL_DES_C) #if defined(POLARSSL_DES_C)

45
programs/ssl/ssl_server.c
View file

@ -72,21 +72,64 @@ char *my_dhm_G = "4";
*/ */
int my_ciphersuites[] = int my_ciphersuites[] =
{ {
#if defined(POLARSSL_DHM_C)
#if defined(POLARSSL_AES_C)
#if defined(POLARSSL_SHA2_C)
SSL_EDH_RSA_AES_256_SHA256,
SSL_EDH_RSA_AES_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_EDH_RSA_AES_256_SHA, SSL_EDH_RSA_AES_256_SHA,
SSL_EDH_RSA_CAMELLIA_256_SHA,
SSL_EDH_RSA_AES_128_SHA, SSL_EDH_RSA_AES_128_SHA,
#endif
#if defined(POLARSSL_CAMELLIA_C)
#if defined(POLARSSL_SHA2_C)
SSL_EDH_RSA_CAMELLIA_256_SHA256,
SSL_EDH_RSA_CAMELLIA_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_EDH_RSA_CAMELLIA_256_SHA,
SSL_EDH_RSA_CAMELLIA_128_SHA, SSL_EDH_RSA_CAMELLIA_128_SHA,
#endif
#if defined(POLARSSL_DES_C)
SSL_EDH_RSA_DES_168_SHA, SSL_EDH_RSA_DES_168_SHA,
#endif
#endif
#if defined(POLARSSL_AES_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_AES_256_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_AES_256_SHA, SSL_RSA_AES_256_SHA,
#endif
#if defined(POLARSSL_CAMELLIA_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_CAMELLIA_256_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_CAMELLIA_256_SHA, SSL_RSA_CAMELLIA_256_SHA,
#endif
#if defined(POLARSSL_AES_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_AES_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_AES_128_SHA, SSL_RSA_AES_128_SHA,
#endif
#if defined(POLARSSL_CAMELLIA_C)
#if defined(POLARSSL_SHA2_C)
SSL_RSA_CAMELLIA_128_SHA256,
#endif /* POLARSSL_SHA2_C */
SSL_RSA_CAMELLIA_128_SHA, SSL_RSA_CAMELLIA_128_SHA,
#endif
#if defined(POLARSSL_DES_C)
SSL_RSA_DES_168_SHA, SSL_RSA_DES_168_SHA,
#endif
#if defined(POLARSSL_ARC4_C)
SSL_RSA_RC4_128_SHA, SSL_RSA_RC4_128_SHA,
SSL_RSA_RC4_128_MD5, SSL_RSA_RC4_128_MD5,
#endif
#if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
#if defined(POLARSSL_DES_C)
SSL_EDH_RSA_DES_SHA, SSL_EDH_RSA_DES_SHA,
SSL_RSA_DES_SHA, SSL_RSA_DES_SHA,
#endif
#if defined(POLARSSL_CIPHER_NULL_CIPHER) #if defined(POLARSSL_CIPHER_NULL_CIPHER)
SSL_RSA_NULL_MD5, SSL_RSA_NULL_MD5,
SSL_RSA_NULL_SHA, SSL_RSA_NULL_SHA,

119
tests/compat.sh
View file

@ -1,19 +1,21 @@
killall -q openssl ssl_server killall -q openssl ssl_server
#MODES="ssl2 ssl3 tls1 tls1_1 tls1_2" MODES="ssl3 tls1 tls1_1 tls1_2"
MODES=tls1_2 #VERIFY="YES"
VERIFY=""
if [ "X$VERIFY" = "XYES" ];
then
P_CLIENT_ARGS="crt_file=data_files/server2.crt key_file=data_files/server2.key"
O_SERVER_ARGS="-verify 10"
fi
for MODE in $MODES; for MODE in $MODES;
do do
echo "Running for $MODE" echo "Running for $MODE"
echo "-----------" echo "-----------"
openssl s_server -cert data_files/server2.crt -key data_files/server2.key -www -quiet -cipher NULL,ALL -$MODE & P_CIPHERS=" \
PROCESS_ID=$!
sleep 1
CIPHERS=" \
SSL-EDH-RSA-AES-128-SHA \ SSL-EDH-RSA-AES-128-SHA \
SSL-EDH-RSA-AES-256-SHA \ SSL-EDH-RSA-AES-256-SHA \
SSL-EDH-RSA-CAMELLIA-128-SHA \ SSL-EDH-RSA-CAMELLIA-128-SHA \
@ -32,10 +34,52 @@ CIPHERS=" \
SSL-EDH-RSA-DES-SHA \ SSL-EDH-RSA-DES-SHA \
" "
# Not supported by OpenSSL: SSL-RSA-NULL-SHA256 O_CIPHERS=" \
for i in $CIPHERS; DHE-RSA-AES128-SHA \
DHE-RSA-AES256-SHA \
DHE-RSA-CAMELLIA128-SHA \
DHE-RSA-CAMELLIA256-SHA \
EDH-RSA-DES-CBC3-SHA \
AES256-SHA \
CAMELLIA256-SHA \
AES128-SHA \
CAMELLIA128-SHA \
DES-CBC3-SHA \
RC4-SHA \
RC4-MD5 \
NULL-MD5 \
NULL-SHA \
DES-CBC-SHA \
EDH-RSA-DES-CBC-SHA \
"
if [ "$MODE" = "tls1_2" ];
then
P_CIPHERS="$P_CIPHERS \
SSL-RSA-NULL-SHA256 \
SSL-RSA-AES-128-SHA256 \
SSL-EDH-RSA-AES-128-SHA256 \
SSL-RSA-AES-256-SHA256 \
SSL-EDH-RSA-AES-256-SHA256 \
"
O_CIPHERS="$O_CIPHERS \
NULL-SHA256 \
AES128-SHA256 \
DHE-RSA-AES128-SHA256 \
AES256-SHA256 \
DHE-RSA-AES256-SHA256 \
"
fi
openssl s_server -cert data_files/server2.crt -key data_files/server2.key -www -quiet -cipher NULL,ALL $O_SERVER_ARGS -$MODE &
PROCESS_ID=$!
sleep 1
for i in $P_CIPHERS;
do do
RESULT="$( ../programs/ssl/ssl_client2 force_ciphersuite=$i )" RESULT="$( ../programs/ssl/ssl_client2 $P_CLIENT_ARGS force_ciphersuite=$i )"
EXIT=$? EXIT=$?
echo -n "OpenSSL Server - PolarSSL Client - $i : $EXIT - " echo -n "OpenSSL Server - PolarSSL Client - $i : $EXIT - "
if [ "$EXIT" = "2" ]; if [ "$EXIT" = "2" ];
@ -56,27 +100,7 @@ PROCESS_ID=$!
sleep 1 sleep 1
CIPHERS=" \ for i in $O_CIPHERS;
DHE-RSA-AES128-SHA \
DHE-RSA-AES256-SHA \
DHE-RSA-CAMELLIA128-SHA \
DHE-RSA-CAMELLIA256-SHA \
EDH-RSA-DES-CBC3-SHA \
AES256-SHA \
CAMELLIA256-SHA \
AES128-SHA \
CAMELLIA128-SHA \
DES-CBC3-SHA \
RC4-SHA \
RC4-MD5 \
NULL-MD5 \
NULL-SHA \
DES-CBC-SHA \
EDH-RSA-DES-CBC-SHA \
"
# Not supported by OpenSSL: NULL-SHA256
for i in $CIPHERS;
do do
RESULT="$( ( echo -e 'GET HTTP/1.0'; echo; sleep 1 ) | openssl s_client -$MODE -cipher $i 2>&1)" RESULT="$( ( echo -e 'GET HTTP/1.0'; echo; sleep 1 ) | openssl s_client -$MODE -cipher $i 2>&1)"
EXIT=$? EXIT=$?
@ -104,27 +128,20 @@ PROCESS_ID=$!
sleep 1 sleep 1
CIPHERS=" \ # OpenSSL does not support RFC5246 Camellia ciphers with SHA256
SSL-RSA-RC4-128-SHA \ # Add for PolarSSL only test, which does support them.
SSL-RSA-NULL-MD5 \ #
SSL-EDH-RSA-AES-128-SHA \ if [ "$MODE" = "tls1_2" ];
SSL-EDH-RSA-AES-256-SHA \ then
SSL-EDH-RSA-CAMELLIA-128-SHA \ P_CIPHERS="$P_CIPHERS \
SSL-EDH-RSA-CAMELLIA-256-SHA \ SSL-RSA-CAMELLIA-128-SHA256 \
SSL-EDH-RSA-DES-168-SHA \ SSL-EDH-RSA-CAMELLIA-128-SHA256 \
SSL-RSA-NULL-SHA \ SSL-RSA-CAMELLIA-256-SHA256 \
SSL-RSA-AES-256-SHA \ SSL-EDH-RSA-CAMELLIA-256-SHA256 \
SSL-RSA-CAMELLIA-256-SHA \
SSL-RSA-AES-128-SHA \
SSL-RSA-CAMELLIA-128-SHA \
SSL-RSA-DES-168-SHA \
SSL-RSA-RC4-128-MD5 \
SSL-RSA-DES-SHA \
SSL-EDH-RSA-DES-SHA \
SSL-RSA-NULL-SHA256 \
" "
fi
for i in $CIPHERS; for i in $P_CIPHERS;
do do
RESULT="$( ../programs/ssl/ssl_client2 force_ciphersuite=$i )" RESULT="$( ../programs/ssl/ssl_client2 force_ciphersuite=$i )"
EXIT=$? EXIT=$?