[openssl-commits] [openssl] master update

[Kurt Roeckx]

The branch master has been updated
       via  88a9614ba30e2d1f5b1b14df5814b824190d46f8 (commit)
      from  d577a69a0f3a56146f644fda010e7efb2c0e693d (commit)


- Log -----------------------------------------------------------------
commit 88a9614ba30e2d1f5b1b14df5814b824190d46f8
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sun Feb 21 18:02:36 2016 +0100

    Check algo_strength using SSL_STRONG_MASK
    
    algo_strength contains 2 parts that need to be checked by their own.
    
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    
    MR: #2082

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_ciph.c | 15 +++++++++------
 ssl/ssl_locl.h |  1 +
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 938baac..46fa3e8 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -970,7 +970,8 @@ static void ssl_cipher_apply_rule(uint32_t cipher_id, uint32_t alg_mkey,
                 continue;
             if (min_tls && (min_tls != cp->min_tls))
                 continue;
-            if (algo_strength && !(algo_strength & cp->algo_strength))
+            if ((algo_strength & SSL_STRONG_MASK)
+                && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))
                 continue;
             if ((algo_strength & SSL_DEFAULT_MASK)
                 && !(algo_strength & SSL_DEFAULT_MASK & cp->algo_strength))
@@ -1237,15 +1238,17 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                     alg_mac = ca_list[j]->algorithm_mac;
             }
 
-            if (ca_list[j]->algo_strength) {
-                if (algo_strength) {
-                    algo_strength &= ca_list[j]->algo_strength;
-                    if (!algo_strength) {
+            if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {
+                if (algo_strength & SSL_STRONG_MASK) {
+                    algo_strength &=
+                        (ca_list[j]->algo_strength & SSL_STRONG_MASK) |
+                        ~SSL_STRONG_MASK;
+                    if (!(algo_strength & SSL_STRONG_MASK)) {
                         found = 0;
                         break;
                     }
                 } else
-                    algo_strength = ca_list[j]->algo_strength;
+                    algo_strength = ca_list[j]->algo_strength & SSL_STRONG_MASK;
             }
 
             if (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) {
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 4abe7b4..64f4ae9 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -417,6 +417,7 @@
  */
 # define TLS1_STREAM_MAC 0x10000
 
+# define SSL_STRONG_MASK         0x0000001FU
 # define SSL_DEFAULT_MASK        0X00000020U
 
 # define SSL_STRONG_NONE         0x00000001U