Skip to content

Commit b662bf5

Browse files
kareskares
committed
drop 1.1 aliases - restore previous behavior
we know the old code has issues and can not be mapped to OpenSSL still, the OpenSSL 1.1 behavior attempt needs much more work ...
1 parent 808a65a commit b662bf5

1 file changed

Lines changed: 57 additions & 138 deletions

File tree

‎src/main/java/org/jruby/ext/openssl/CipherStrings.java‎

Lines changed: 57 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,8 @@ public class CipherStrings {
317317
public final static long SSL_SHA256 = 0x00000010L;
318318
public final static long SSL_SHA384 = 0x00000020L;
319319

320-
//public final static long SSL_SSL_MASK = 0x03000000L;
320+
@Deprecated
321+
public final static long SSL_SSL_MASK = 0x03000000L; // legacy
321322
public final static long SSL_SSLV2 = 0x01000000L;
322323
public final static long SSL_SSLV3 = 0x02000000L;
323324
public final static long SSL_TLSV1 = SSL_SSLV3;
@@ -336,11 +337,14 @@ public class CipherStrings {
336337
public final static long SSL_MEDIUM = 0x00000040L; // 0x00000004U in OSSL 1.1
337338
public final static long SSL_HIGH = 0x00000080L; // 0x00000008U in OSSL 1.1
338339
public final static long SSL_FIPS = 0x00000100L; // 0x00000010U in OSSL 1.1
339-
public final static long SSL_NOT_DEFAULT = 0x00000200L; // 0x00000020U in OSSL 1.1 TODO: kares
340-
341-
//public final static long SSL_ALL = 0xffffffffL;
342-
public final static long SSL_ALL_CIPHERS = (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|SSL_MAC_MASK); // TODO drop
343-
public final static long SSL_ALL_STRENGTHS = (SSL_EXP_MASK|SSL_STRONG_MASK); // TODO drop
340+
public final static long SSL_NOT_DEFAULT = 0x00000200L; // 0x00000020U in OSSL 1.1
341+
342+
@Deprecated
343+
public final static long SSL_ALL = 0xffffffffL; // legacy
344+
@Deprecated
345+
public final static long SSL_ALL_CIPHERS = (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|SSL_MAC_MASK);
346+
@Deprecated
347+
public final static long SSL_ALL_STRENGTHS = (SSL_EXP_MASK|SSL_STRONG_MASK);
344348
public final static long SSL_PKEY_RSA_ENC = 0;
345349
public final static long SSL_PKEY_RSA_SIGN = 1;
346350
public final static long SSL_PKEY_DSA_SIGN = 2;
@@ -776,138 +780,53 @@ private static Collection<Def> matchingPattern(
776780
private final static Map<String, String> SuiteToOSSL;
777781

778782
static {
779-
final String NULL = null;
780-
781-
Object[] cipher_aliases[] = { // NOTE: copied from OpenSSL 1.1 (ssl_ciph.c)
782-
/* "ALL" doesn't include eNULL (must be specifically enabled) */
783-
{0, SSL_TXT_ALL, NULL, 0, 0, 0, ~SSL_eNULL},
784-
/* "COMPLEMENTOFALL" */
785-
{0, SSL_TXT_CMPALL, NULL, 0, 0, 0, SSL_eNULL},
786-
787-
/*
788-
* "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in ALL!)
789-
*/
790-
{0, SSL_TXT_CMPDEF, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_NOT_DEFAULT},
791-
792-
/*
793-
* key exchange aliases (some of those using only a single bit here
794-
* combine multiple key exchange algs according to the RFCs, e.g. kDHE
795-
* combines DHE_DSS and DHE_RSA)
796-
*/
797-
{0, SSL_TXT_kRSA, NULL, 0, SSL_kRSA},
798-
799-
{0, SSL_TXT_kEDH, NULL, 0, SSL_kDHE},
800-
{0, SSL_TXT_kDHE, NULL, 0, SSL_kDHE},
801-
{0, SSL_TXT_DH, NULL, 0, SSL_kDHE},
802-
803-
{0, SSL_TXT_kEECDH, NULL, 0, SSL_kECDHE},
804-
{0, SSL_TXT_kECDHE, NULL, 0, SSL_kECDHE},
805-
{0, SSL_TXT_ECDH, NULL, 0, SSL_kECDHE},
806-
807-
//{0, SSL_TXT_kPSK, NULL, 0, SSL_kPSK},
808-
//{0, SSL_TXT_kRSAPSK, NULL, 0, SSL_kRSAPSK},
809-
//{0, SSL_TXT_kECDHEPSK, NULL, 0, SSL_kECDHEPSK},
810-
//{0, SSL_TXT_kDHEPSK, NULL, 0, SSL_kDHEPSK},
811-
//{0, SSL_TXT_kSRP, NULL, 0, SSL_kSRP},
812-
//{0, SSL_TXT_kGOST, NULL, 0, SSL_kGOST},
813-
814-
/* server authentication aliases */
815-
{0, SSL_TXT_aRSA, NULL, 0, 0, SSL_aRSA},
816-
{0, SSL_TXT_aDSS, NULL, 0, 0, SSL_aDSS},
817-
{0, SSL_TXT_DSS, NULL, 0, 0, SSL_aDSS},
818-
{0, SSL_TXT_aNULL, NULL, 0, 0, SSL_aNULL},
819-
{0, SSL_TXT_aECDSA, NULL, 0, 0, SSL_aECDSA},
820-
{0, SSL_TXT_ECDSA, NULL, 0, 0, SSL_aECDSA},
821-
//{0, SSL_TXT_aPSK, NULL, 0, 0, SSL_aPSK},
822-
//{0, SSL_TXT_aGOST01, NULL, 0, 0, SSL_aGOST01},
823-
//{0, SSL_TXT_aGOST12, NULL, 0, 0, SSL_aGOST12},
824-
//{0, SSL_TXT_aGOST, NULL, 0, 0, SSL_aGOST01 | SSL_aGOST12},
825-
//{0, SSL_TXT_aSRP, NULL, 0, 0, SSL_aSRP},
826-
827-
/* aliases combining key exchange and server authentication */
828-
{0, SSL_TXT_EDH, NULL, 0, SSL_kDHE, ~SSL_aNULL},
829-
{0, SSL_TXT_DHE, NULL, 0, SSL_kDHE, ~SSL_aNULL},
830-
{0, SSL_TXT_EECDH, NULL, 0, SSL_kECDHE, ~SSL_aNULL},
831-
{0, SSL_TXT_ECDHE, NULL, 0, SSL_kECDHE, ~SSL_aNULL},
832-
{0, SSL_TXT_NULL, NULL, 0, 0, 0, SSL_eNULL},
833-
{0, SSL_TXT_RSA, NULL, 0, SSL_kRSA, SSL_aRSA},
834-
{0, SSL_TXT_ADH, NULL, 0, SSL_kDHE, SSL_aNULL},
835-
{0, SSL_TXT_AECDH, NULL, 0, SSL_kECDHE, SSL_aNULL},
836-
//{0, SSL_TXT_PSK, NULL, 0, SSL_PSK},
837-
//{0, SSL_TXT_SRP, NULL, 0, SSL_kSRP},
838-
839-
/* symmetric encryption aliases */
840-
{0, SSL_TXT_3DES, NULL, 0, 0, 0, SSL_3DES},
841-
{0, SSL_TXT_RC4, NULL, 0, 0, 0, SSL_RC4},
842-
{0, SSL_TXT_RC2, NULL, 0, 0, 0, SSL_RC2},
843-
{0, SSL_TXT_IDEA, NULL, 0, 0, 0, SSL_IDEA},
844-
{0, SSL_TXT_SEED, NULL, 0, 0, 0, SSL_SEED},
845-
{0, SSL_TXT_eNULL, NULL, 0, 0, 0, SSL_eNULL},
846-
//{0, SSL_TXT_GOST, NULL, 0, 0, 0, SSL_eGOST2814789CNT | SSL_eGOST2814789CNT12},
847-
{0, SSL_TXT_AES128, NULL, 0, 0, 0,
848-
SSL_AES128 | SSL_AES128GCM | SSL_AES128CCM | SSL_AES128CCM8},
849-
{0, SSL_TXT_AES256, NULL, 0, 0, 0,
850-
SSL_AES256 | SSL_AES256GCM | SSL_AES256CCM | SSL_AES256CCM8},
851-
{0, SSL_TXT_AES, NULL, 0, 0, 0, SSL_AES},
852-
{0, SSL_TXT_AES_GCM, NULL, 0, 0, 0, SSL_AES128GCM | SSL_AES256GCM},
853-
{0, SSL_TXT_AES_CCM, NULL, 0, 0, 0,
854-
SSL_AES128CCM | SSL_AES256CCM | SSL_AES128CCM8 | SSL_AES256CCM8},
855-
{0, SSL_TXT_AES_CCM_8, NULL, 0, 0, 0, SSL_AES128CCM8 | SSL_AES256CCM8},
856-
{0, SSL_TXT_CAMELLIA128, NULL, 0, 0, 0, SSL_CAMELLIA128},
857-
{0, SSL_TXT_CAMELLIA256, NULL, 0, 0, 0, SSL_CAMELLIA256},
858-
{0, SSL_TXT_CAMELLIA, NULL, 0, 0, 0, SSL_CAMELLIA},
859-
{0, SSL_TXT_CHACHA20, NULL, 0, 0, 0, SSL_CHACHA20},
860-
861-
{0, SSL_TXT_ARIA, NULL, 0, 0, 0, SSL_ARIA},
862-
{0, SSL_TXT_ARIA_GCM, NULL, 0, 0, 0, SSL_ARIA128GCM | SSL_ARIA256GCM},
863-
{0, SSL_TXT_ARIA128, NULL, 0, 0, 0, SSL_ARIA128GCM},
864-
{0, SSL_TXT_ARIA256, NULL, 0, 0, 0, SSL_ARIA256GCM},
865-
866-
/* MAC aliases */
867-
{0, SSL_TXT_MD5, NULL, 0, 0, 0, 0, SSL_MD5},
868-
{0, SSL_TXT_SHA1, NULL, 0, 0, 0, 0, SSL_SHA1},
869-
{0, SSL_TXT_SHA, NULL, 0, 0, 0, 0, SSL_SHA1},
870-
//{0, SSL_TXT_GOST94, NULL, 0, 0, 0, 0, SSL_GOST94},
871-
//{0, SSL_TXT_GOST89MAC, NULL, 0, 0, 0, 0, SSL_GOST89MAC | SSL_GOST89MAC12},
872-
{0, SSL_TXT_SHA256, NULL, 0, 0, 0, 0, SSL_SHA256},
873-
{0, SSL_TXT_SHA384, NULL, 0, 0, 0, 0, SSL_SHA384},
874-
//{0, SSL_TXT_GOST12, NULL, 0, 0, 0, 0, SSL_GOST12_256},
875-
876-
/* protocol version aliases */
877-
{0, SSL_TXT_SSLV3, NULL, 0, 0, 0, 0, 0, SSL3_VERSION},
878-
{0, SSL_TXT_TLSV1, NULL, 0, 0, 0, 0, 0, TLS1_VERSION},
879-
{0, "TLSv1.0", NULL, 0, 0, 0, 0, 0, TLS1_VERSION},
880-
{0, SSL_TXT_TLSV1_2, NULL, 0, 0, 0, 0, 0, TLS1_2_VERSION},
881-
882-
/* strength classes */
883-
{0, SSL_TXT_LOW, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_LOW},
884-
{0, SSL_TXT_MEDIUM, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_MEDIUM},
885-
{0, SSL_TXT_HIGH, NULL, 0, 0, 0, 0, 0, 0, 0, 0, 0, SSL_HIGH},
886-
/* FIPS 140-2 approved ciphersuite */
887-
//{0, SSL_TXT_FIPS, NULL, 0, 0, 0, ~SSL_eNULL, 0, 0, 0, 0, 0, SSL_FIPS},
888-
889-
/* "EDH-" aliases to "DHE-" labels (for backward compatibility) */
890-
//{0, SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA, NULL, 0, SSL_kDHE, SSL_aDSS, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS},
891-
//{0, SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA, NULL, 0, SSL_kDHE, SSL_aRSA, SSL_3DES, SSL_SHA1, 0, 0, 0, 0, SSL_HIGH | SSL_FIPS},
892-
};
893-
894-
Definitions = new HashMap<String, Def>(128);
895-
896-
for (Object[] a : cipher_aliases) {
897-
int valid = (Integer) a[0];
898-
String txt_name = (String) a[1];
899-
String std_name = (String) a[2];
900-
long id = (Integer) a[3];
901-
long algorithm_mkey = a.length > 4 ? ((Number) a[4]).longValue() : 0;
902-
long algorithm_auth = a.length > 5 ? ((Number) a[5]).longValue() : 0;
903-
long algorithm_enc = a.length > 6 ? ((Number) a[6]).longValue() : 0;
904-
long algorithm_mac = a.length > 7 ? ((Number) a[7]).longValue() : 0;
905-
int min_tls = a.length > 8 ? ((Integer) a[8]) : 0;
906-
int max_tls = a.length > 9 ? ((Integer) a[9]) : 0;
907-
Definitions.put(txt_name,
908-
new Def(valid, txt_name, std_name, id, algorithm_mkey, algorithm_auth, algorithm_enc, algorithm_mac, min_tls, max_tls)
909-
);
910-
}
783+
Definitions = new HashMap<String, Def>( 48, 1 );
784+
// TODO review base on OpenSSL's static const SSL_CIPHER cipher_aliases[] ?!
785+
Definitions.put(SSL_TXT_ALL,new Def(0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL));
786+
Definitions.put(SSL_TXT_CMPALL,new Def(0,SSL_TXT_CMPALL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0));
787+
Definitions.put(SSL_TXT_CMPDEF,new Def(0,SSL_TXT_CMPDEF,0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK,0));
788+
Definitions.put(SSL_TXT_kKRB5,new Def(0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0));
789+
Definitions.put(SSL_TXT_kRSA,new Def(0,SSL_TXT_kRSA,0,SSL_kRSA, 0,0,0,0,SSL_MKEY_MASK,0));
790+
Definitions.put(SSL_TXT_kDHr,new Def(0,SSL_TXT_kDHr,0,SSL_kDHr, 0,0,0,0,SSL_MKEY_MASK,0));
791+
Definitions.put(SSL_TXT_kDHd,new Def(0,SSL_TXT_kDHd,0,SSL_kDHd, 0,0,0,0,SSL_MKEY_MASK,0));
792+
Definitions.put(SSL_TXT_kEDH,new Def(0,SSL_TXT_kEDH,0,SSL_kEDH, 0,0,0,0,SSL_MKEY_MASK,0));
793+
Definitions.put(SSL_TXT_kFZA,new Def(0,SSL_TXT_kFZA,0,SSL_kFZA, 0,0,0,0,SSL_MKEY_MASK,0));
794+
Definitions.put(SSL_TXT_DH,new Def(0,SSL_TXT_DH, 0,SSL_DH, 0,0,0,0,SSL_MKEY_MASK,0));
795+
Definitions.put(SSL_TXT_ECC,new Def(0,SSL_TXT_ECC, 0,(SSL_kECDH|SSL_kECDHE), 0,0,0,0,SSL_MKEY_MASK,0));
796+
Definitions.put(SSL_TXT_EDH,new Def(0,SSL_TXT_EDH, 0,SSL_EDH, 0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0));
797+
Definitions.put(SSL_TXT_aKRB5,new Def(0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0));
798+
Definitions.put(SSL_TXT_aRSA,new Def(0,SSL_TXT_aRSA,0,SSL_aRSA, 0,0,0,0,SSL_AUTH_MASK,0));
799+
Definitions.put(SSL_TXT_aDSS,new Def(0,SSL_TXT_aDSS,0,SSL_aDSS, 0,0,0,0,SSL_AUTH_MASK,0));
800+
Definitions.put(SSL_TXT_aFZA,new Def(0,SSL_TXT_aFZA,0,SSL_aFZA, 0,0,0,0,SSL_AUTH_MASK,0));
801+
Definitions.put(SSL_TXT_aNULL,new Def(0,SSL_TXT_aNULL,0,SSL_aNULL,0,0,0,0,SSL_AUTH_MASK,0));
802+
Definitions.put(SSL_TXT_aDH,new Def(0,SSL_TXT_aDH, 0,SSL_aDH, 0,0,0,0,SSL_AUTH_MASK,0));
803+
Definitions.put(SSL_TXT_DSS,new Def(0,SSL_TXT_DSS, 0,SSL_DSS, 0,0,0,0,SSL_AUTH_MASK,0));
804+
Definitions.put(SSL_TXT_DES,new Def(0,SSL_TXT_DES, 0,SSL_DES, 0,0,0,0,SSL_ENC_MASK,0));
805+
Definitions.put(SSL_TXT_3DES,new Def(0,SSL_TXT_3DES,0,SSL_3DES, 0,0,0,0,SSL_ENC_MASK,0));
806+
Definitions.put(SSL_TXT_RC4,new Def(0,SSL_TXT_RC4, 0,SSL_RC4, 0,0,0,0,SSL_ENC_MASK,0));
807+
Definitions.put(SSL_TXT_RC2,new Def(0,SSL_TXT_RC2, 0,SSL_RC2, 0,0,0,0,SSL_ENC_MASK,0));
808+
Definitions.put(SSL_TXT_IDEA,new Def(0,SSL_TXT_IDEA,0,SSL_IDEA, 0,0,0,0,SSL_ENC_MASK,0));
809+
Definitions.put(SSL_TXT_eNULL,new Def(0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0));
810+
Definitions.put(SSL_TXT_eFZA,new Def(0,SSL_TXT_eFZA,0,SSL_eFZA, 0,0,0,0,SSL_ENC_MASK,0));
811+
Definitions.put(SSL_TXT_AES,new Def(0,SSL_TXT_AES, 0,SSL_AES, 0,0,0,0,SSL_ENC_MASK,0));
812+
Definitions.put(SSL_TXT_MD5,new Def(0,SSL_TXT_MD5, 0,SSL_MD5, 0,0,0,0,SSL_MAC_MASK,0));
813+
Definitions.put(SSL_TXT_SHA1,new Def(0,SSL_TXT_SHA1,0,SSL_SHA1, 0,0,0,0,SSL_MAC_MASK,0));
814+
Definitions.put(SSL_TXT_SHA,new Def(0,SSL_TXT_SHA, 0,SSL_SHA, 0,0,0,0,SSL_MAC_MASK,0));
815+
Definitions.put(SSL_TXT_NULL,new Def(0,SSL_TXT_NULL,0,SSL_eNULL, 0,0,0,0,SSL_ENC_MASK,0));
816+
Definitions.put(SSL_TXT_KRB5,new Def(0,SSL_TXT_KRB5,0,SSL_KRB5, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0));
817+
Definitions.put(SSL_TXT_RSA,new Def(0,SSL_TXT_RSA, 0,SSL_RSA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0));
818+
Definitions.put(SSL_TXT_ADH,new Def(0,SSL_TXT_ADH, 0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0));
819+
Definitions.put(SSL_TXT_FZA,new Def(0,SSL_TXT_FZA, 0,SSL_FZA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0));
820+
Definitions.put(SSL_TXT_SSLV2,new Def(0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,0,0,0,SSL_SSL_MASK,0));
821+
Definitions.put(SSL_TXT_SSLV3,new Def(0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,0,0,0,SSL_SSL_MASK,0));
822+
Definitions.put(SSL_TXT_TLSV1,new Def(0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,0,0,0,SSL_SSL_MASK,0));
823+
Definitions.put(SSL_TXT_EXP,new Def(0,SSL_TXT_EXP ,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK));
824+
Definitions.put(SSL_TXT_EXPORT,new Def(0,SSL_TXT_EXPORT,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK));
825+
Definitions.put(SSL_TXT_EXP40,new Def(0,SSL_TXT_EXP40, 0, 0, SSL_EXP40, 0,0,0,0,SSL_STRONG_MASK));
826+
Definitions.put(SSL_TXT_EXP56,new Def(0,SSL_TXT_EXP56, 0, 0, SSL_EXP56, 0,0,0,0,SSL_STRONG_MASK));
827+
Definitions.put(SSL_TXT_LOW,new Def(0,SSL_TXT_LOW, 0, 0, SSL_LOW, 0,0,0,0,SSL_STRONG_MASK));
828+
Definitions.put(SSL_TXT_MEDIUM,new Def(0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK));
829+
Definitions.put(SSL_TXT_HIGH,new Def(0,SSL_TXT_HIGH, 0, 0, SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK));
911830

912831
final ArrayList<Def> Ciphers = new ArrayList<Def>( 96 );
913832
/* Cipher 01 */

0 commit comments

Comments
 (0)