{"schema":"libjg2-1", "vpath":"/git/", "avatar":"/git/avatar/", "alang":"", "gen_ut":1752653785, "reponame":"openssl", "desc":"OpenSSL", "owner": { "name": "Andy Green", "email": "andy@warmcat.com", "md5": "c50933ca2aa61e0fe2c43d46bb6b59cb" },"url":"https://warmcat.com/repo/openssl", "f":3, "items": [ {"schema":"libjg2-1", "cid":"08aff163ed9211ff0d1dbbce085ede5e", "commit": {"type":"commit", "time": 1487875225, "time_ofs": 60, "oid_tree": { "oid": "b80c31b90ba3f28ce3909348587fb91dc6bed166", "alias": []}, "oid":{ "oid": "ccb8e6e0b1c536430290a87ba5c87dc072cc5a12", "alias": []}, "msg": "Export SSL_bytes_to_cipher_list()", "sig_commit": { "git_time": { "time": 1487875225, "offset": 60 }, "name": "Richard Levitte", "email": "levitte@openssl.org", "md5": "b737120f0642a6a5c30c6291e6170c77" }, "sig_author": { "git_time": { "time": 1485797057, "offset": -360 }, "name": "Benjamin Kaduk", "email": "bkaduk@akamai.com", "md5": "a05981ba89c2b7753f6e41ad2046bdd8" }}, "body": "Export SSL_bytes_to_cipher_list()\n\nMove ssl_bytes_to_cipher_list() to ssl_lib.c and create a public\nwrapper around it. This lets application early callbacks easily get\nSSL_CIPHER objects from the raw ciphers bytes without having to\nreimplement the parsing code. In particular, they do not need to\nknow the details of the sslv2 format ClientHello's ciphersuite\nspecifications.\n\nDocument the new public function, including the arguably buggy behavior\nof modifying the supplied SSL object. On the face of it, such a function\nshould be able to be pure, just a direct translation of wire octets to\ninternal data structures.\n\nReviewed-by: Matt Caswell \u003cmatt@openssl.org\u003e\nReviewed-by: Richard Levitte \u003clevitte@openssl.org\u003e\n(Merged from https://github.com/openssl/openssl/pull/2279)" , "diff": "diff --git a/doc/man3/SSL_get_ciphers.pod b/doc/man3/SSL_get_ciphers.pod\nindex ce0be6e..5933bf5 100644\n--- a/doc/man3/SSL_get_ciphers.pod\n+++ b/doc/man3/SSL_get_ciphers.pod\n@@ -3,7 +3,8 @@\n \u003dhead1 NAME\n \n SSL_get1_supported_ciphers, SSL_get_client_ciphers,\n-SSL_get_ciphers, SSL_CTX_get_ciphers, SSL_get_cipher_list\n+SSL_get_ciphers, SSL_CTX_get_ciphers,\n+SSL_bytes_to_cipher_list, SSL_get_cipher_list\n - get list of available SSL_CIPHERs\n \n \u003dhead1 SYNOPSIS\n@@ -14,6 +15,9 @@ SSL_get_ciphers, SSL_CTX_get_ciphers, SSL_get_cipher_list\n STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx);\n STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s);\n STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *ssl);\n+ STACK_OF(SSL_CIPHER) *SSL_bytes_to_cipher_list(SSL *s,\n+ const unsigned char *bytes,\n+ size_t len, int isv2format)\n const char *SSL_get_cipher_list(const SSL *ssl, int priority);\n \n \u003dhead1 DESCRIPTION\n@@ -41,6 +45,13 @@ SSL_get_client_ciphers() returns the stack of available SSL_CIPHERs matching the\n list received from the client on B\u003cssl\u003e. If B\u003cssl\u003e is NULL, no ciphers are\n available, or B\u003cssl\u003e is not operating in server mode, NULL is returned.\n \n+SSL_bytes_to_cipher_list() treats the supplied B\u003clen\u003e octets in B\u003cbytes\u003e\n+as a wire-protocol cipher suite specification (in the three-octet-per-cipher\n+SSLv2 wire format if B\u003cisv2format\u003e is nonzero; otherwise the two-octet\n+SSLv3/TLS wire format), and parses the cipher suites supported by the library\n+into the returned stack of SSL_CIPHER objects. Unsupported cipher suites\n+are ignored, and NULL is returned on error.\n+\n SSL_get_cipher_list() returns a pointer to the name of the SSL_CIPHER\n listed for B\u003cssl\u003e with B\u003cpriority\u003e. If B\u003cssl\u003e is NULL, no ciphers are\n available, or there are less ciphers than B\u003cpriority\u003e available, NULL\n@@ -63,10 +74,19 @@ free the return value itself.\n The stack returned by SSL_get1_supported_ciphers() should be freed using\n sk_SSL_CIPHER_free().\n \n+The stack returned by SSL_bytes_to_cipher_list() should be freed using\n+sk_SSL_CIPHER_free().\n+\n \u003dhead1 RETURN VALUES\n \n See DESCRIPTION\n \n+\u003dhead1 BUGS\n+\n+The implementation of SSL_bytes_to_cipher_list() mutates state in the\n+supplied SSL object B\u003cs\u003e; SSL_bytes_to_cipher_list() should not be called\n+on a server SSL object after that server has processed the received ClientHello.\n+\n \u003dhead1 SEE ALSO\n \n L\u003cssl(7)\u003e, L\u003cSSL_CTX_set_cipher_list(3)\u003e,\ndiff --git a/include/openssl/ssl.h b/include/openssl/ssl.h\nindex 1c58dcc..3716922 100644\n--- a/include/openssl/ssl.h\n+++ b/include/openssl/ssl.h\n@@ -1820,6 +1820,9 @@ __owur int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm);\n const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr);\n int SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c);\n int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c);\n+STACK_OF(SSL_CIPHER) *SSL_bytes_to_cipher_list(SSL *s,\n+ const unsigned char *bytes,\n+ size_t len, int isv2format);\n \n /* TLS extensions functions */\n __owur int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);\n@@ -2087,6 +2090,7 @@ int ERR_load_SSL_strings(void);\n /* Function codes. */\n # define SSL_F_ADD_CLIENT_KEY_SHARE_EXT 438\n # define SSL_F_ADD_KEY_SHARE 512\n+# define SSL_F_BYTES_TO_CIPHER_LIST 519\n # define SSL_F_CHECK_SUITEB_CIPHER_LIST 331\n # define SSL_F_CT_MOVE_SCTS 345\n # define SSL_F_CT_STRICT 349\ndiff --git a/ssl/ssl_err.c b/ssl/ssl_err.c\nindex 341712c..81b3a67 100644\n--- a/ssl/ssl_err.c\n+++ b/ssl/ssl_err.c\n@@ -21,6 +21,7 @@\n static ERR_STRING_DATA SSL_str_functs[] \u003d {\n {ERR_FUNC(SSL_F_ADD_CLIENT_KEY_SHARE_EXT), \u0022add_client_key_share_ext\u0022},\n {ERR_FUNC(SSL_F_ADD_KEY_SHARE), \u0022add_key_share\u0022},\n+ {ERR_FUNC(SSL_F_BYTES_TO_CIPHER_LIST), \u0022bytes_to_cipher_list\u0022},\n {ERR_FUNC(SSL_F_CHECK_SUITEB_CIPHER_LIST), \u0022check_suiteb_cipher_list\u0022},\n {ERR_FUNC(SSL_F_CT_MOVE_SCTS), \u0022ct_move_scts\u0022},\n {ERR_FUNC(SSL_F_CT_STRICT), \u0022ct_strict\u0022},\n@@ -116,7 +117,7 @@ static ERR_STRING_DATA SSL_str_functs[] \u003d {\n \u0022ssl_add_serverhello_use_srtp_ext\u0022},\n {ERR_FUNC(SSL_F_SSL_BAD_METHOD), \u0022ssl_bad_method\u0022},\n {ERR_FUNC(SSL_F_SSL_BUILD_CERT_CHAIN), \u0022ssl_build_cert_chain\u0022},\n- {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), \u0022ssl_bytes_to_cipher_list\u0022},\n+ {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), \u0022SSL_bytes_to_cipher_list\u0022},\n {ERR_FUNC(SSL_F_SSL_CERT_ADD0_CHAIN_CERT), \u0022ssl_cert_add0_chain_cert\u0022},\n {ERR_FUNC(SSL_F_SSL_CERT_DUP), \u0022ssl_cert_dup\u0022},\n {ERR_FUNC(SSL_F_SSL_CERT_NEW), \u0022ssl_cert_new\u0022},\ndiff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c\nindex dea2dac..56c6a24 100644\n--- a/ssl/ssl_lib.c\n+++ b/ssl/ssl_lib.c\n@@ -4402,3 +4402,162 @@ int ssl_log_secret(SSL *ssl,\n secret_len);\n }\n \n+\n+STACK_OF(SSL_CIPHER) *SSL_bytes_to_cipher_list(SSL *s,\n+ const unsigned char *bytes,\n+ size_t len, int isv2format)\n+{\n+ int alert;\n+ PACKET pkt;\n+\n+ if (!PACKET_buf_init(\u0026pkt, bytes, len))\n+ return 0;\n+ return bytes_to_cipher_list(s, \u0026pkt, NULL, isv2format, \u0026alert);\n+}\n+\n+#define SSLV2_CIPHER_LEN 3\n+\n+STACK_OF(SSL_CIPHER) *bytes_to_cipher_list(SSL *s,\n+ PACKET *cipher_suites,\n+ STACK_OF(SSL_CIPHER) **skp,\n+ int sslv2format, int *al)\n+{\n+ const SSL_CIPHER *c;\n+ STACK_OF(SSL_CIPHER) *sk;\n+ int n;\n+ /* 3 \u003d SSLV2_CIPHER_LEN \u003e TLS_CIPHER_LEN \u003d 2. */\n+ unsigned char cipher[SSLV2_CIPHER_LEN];\n+\n+ s-\u003es3-\u003esend_connection_binding \u003d 0;\n+\n+ n \u003d sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;\n+\n+ if (PACKET_remaining(cipher_suites) \u003d\u003d 0) {\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);\n+ *al \u003d SSL_AD_ILLEGAL_PARAMETER;\n+ return NULL;\n+ }\n+\n+ if (PACKET_remaining(cipher_suites) % n !\u003d 0) {\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,\n+ SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);\n+ *al \u003d SSL_AD_DECODE_ERROR;\n+ return NULL;\n+ }\n+\n+ sk \u003d sk_SSL_CIPHER_new_null();\n+ if (sk \u003d\u003d NULL) {\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n+ *al \u003d SSL_AD_INTERNAL_ERROR;\n+ return NULL;\n+ }\n+\n+ OPENSSL_free(s-\u003es3-\u003etmp.ciphers_raw);\n+ s-\u003es3-\u003etmp.ciphers_raw \u003d NULL;\n+ s-\u003es3-\u003etmp.ciphers_rawlen \u003d 0;\n+\n+ if (sslv2format) {\n+ size_t numciphers \u003d PACKET_remaining(cipher_suites) / n;\n+ PACKET sslv2ciphers \u003d *cipher_suites;\n+ unsigned int leadbyte;\n+ unsigned char *raw;\n+\n+ /*\n+ * We store the raw ciphers list in SSLv3+ format so we need to do some\n+ * preprocessing to convert the list first. If there are any SSLv2 only\n+ * ciphersuites with a non-zero leading byte then we are going to\n+ * slightly over allocate because we won't store those. But that isn't a\n+ * problem.\n+ */\n+ raw \u003d OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);\n+ s-\u003es3-\u003etmp.ciphers_raw \u003d raw;\n+ if (raw \u003d\u003d NULL) {\n+ *al \u003d SSL_AD_INTERNAL_ERROR;\n+ goto err;\n+ }\n+ for (s-\u003es3-\u003etmp.ciphers_rawlen \u003d 0;\n+ PACKET_remaining(\u0026sslv2ciphers) \u003e 0;\n+ raw +\u003d TLS_CIPHER_LEN) {\n+ if (!PACKET_get_1(\u0026sslv2ciphers, \u0026leadbyte)\n+ || (leadbyte \u003d\u003d 0\n+ \u0026\u0026 !PACKET_copy_bytes(\u0026sslv2ciphers, raw,\n+ TLS_CIPHER_LEN))\n+ || (leadbyte !\u003d 0\n+ \u0026\u0026 !PACKET_forward(\u0026sslv2ciphers, TLS_CIPHER_LEN))) {\n+ *al \u003d SSL_AD_INTERNAL_ERROR;\n+ OPENSSL_free(s-\u003es3-\u003etmp.ciphers_raw);\n+ s-\u003es3-\u003etmp.ciphers_raw \u003d NULL;\n+ s-\u003es3-\u003etmp.ciphers_rawlen \u003d 0;\n+ goto err;\n+ }\n+ if (leadbyte \u003d\u003d 0)\n+ s-\u003es3-\u003etmp.ciphers_rawlen +\u003d TLS_CIPHER_LEN;\n+ }\n+ } else if (!PACKET_memdup(cipher_suites, \u0026s-\u003es3-\u003etmp.ciphers_raw,\n+ \u0026s-\u003es3-\u003etmp.ciphers_rawlen)) {\n+ *al \u003d SSL_AD_INTERNAL_ERROR;\n+ goto err;\n+ }\n+\n+ while (PACKET_copy_bytes(cipher_suites, cipher, n)) {\n+ /*\n+ * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the\n+ * first byte set to zero, while true SSLv2 ciphers have a non-zero\n+ * first byte. We don't support any true SSLv2 ciphers, so skip them.\n+ */\n+ if (sslv2format \u0026\u0026 cipher[0] !\u003d '\u005c0')\n+ continue;\n+\n+ /* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */\n+ if ((cipher[n - 2] \u003d\u003d ((SSL3_CK_SCSV \u003e\u003e 8) \u0026 0xff)) \u0026\u0026\n+ (cipher[n - 1] \u003d\u003d (SSL3_CK_SCSV \u0026 0xff))) {\n+ /* SCSV fatal if renegotiating */\n+ if (s-\u003erenegotiate) {\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,\n+ SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);\n+ *al \u003d SSL_AD_HANDSHAKE_FAILURE;\n+ goto err;\n+ }\n+ s-\u003es3-\u003esend_connection_binding \u003d 1;\n+ continue;\n+ }\n+\n+ /* Check for TLS_FALLBACK_SCSV */\n+ if ((cipher[n - 2] \u003d\u003d ((SSL3_CK_FALLBACK_SCSV \u003e\u003e 8) \u0026 0xff)) \u0026\u0026\n+ (cipher[n - 1] \u003d\u003d (SSL3_CK_FALLBACK_SCSV \u0026 0xff))) {\n+ /*\n+ * The SCSV indicates that the client previously tried a higher\n+ * version. Fail if the current version is an unexpected\n+ * downgrade.\n+ */\n+ if (!ssl_check_version_downgrade(s)) {\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,\n+ SSL_R_INAPPROPRIATE_FALLBACK);\n+ *al \u003d SSL_AD_INAPPROPRIATE_FALLBACK;\n+ goto err;\n+ }\n+ continue;\n+ }\n+\n+ /* For SSLv2-compat, ignore leading 0-byte. */\n+ c \u003d ssl_get_cipher_by_char(s, sslv2format ? \u0026cipher[1] : cipher, 1);\n+ if (c !\u003d NULL) {\n+ if (!sk_SSL_CIPHER_push(sk, c)) {\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n+ *al \u003d SSL_AD_INTERNAL_ERROR;\n+ goto err;\n+ }\n+ }\n+ }\n+ if (PACKET_remaining(cipher_suites) \u003e 0) {\n+ *al \u003d SSL_AD_INTERNAL_ERROR;\n+ SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_INTERNAL_ERROR);\n+ goto err;\n+ }\n+\n+ *skp \u003d sk;\n+ return sk;\n+ err:\n+ sk_SSL_CIPHER_free(sk);\n+ return NULL;\n+}\ndiff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h\nindex ff1f598..59605f5 100644\n--- a/ssl/ssl_locl.h\n+++ b/ssl/ssl_locl.h\n@@ -1991,6 +1991,11 @@ __owur STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *meth,\n **sorted,\n const char *rule_str,\n CERT *c);\n+__owur STACK_OF(SSL_CIPHER) *bytes_to_cipher_list(SSL *s,\n+ PACKET *cipher_suites,\n+ STACK_OF(SSL_CIPHER)\n+ **skp, int sslv2format,\n+ int *al);\n void ssl_update_cache(SSL *s, int mode);\n __owur int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,\n const EVP_MD **md, int *mac_pkey_type,\ndiff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c\nindex 2cbc219..00e69a6 100644\n--- a/ssl/statem/statem_srvr.c\n+++ b/ssl/statem/statem_srvr.c\n@@ -63,11 +63,6 @@\n \n static int tls_construct_encrypted_extensions(SSL *s, WPACKET *pkt);\n static int tls_construct_hello_retry_request(SSL *s, WPACKET *pkt);\n-static STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,\n- PACKET *cipher_suites,\n- STACK_OF(SSL_CIPHER)\n- **skp, int sslv2format,\n- int *al);\n \n /*\n * ossl_statem_server13_read_transition() encapsulates the logic for the allowed\n@@ -1551,8 +1546,8 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)\n }\n }\n \n- if (ssl_bytes_to_cipher_list(s, \u0026clienthello.ciphersuites, \u0026ciphers,\n- clienthello.isv2, \u0026al) \u003d\u003d NULL) {\n+ if (bytes_to_cipher_list(s, \u0026clienthello.ciphersuites, \u0026ciphers,\n+ clienthello.isv2, \u0026al) \u003d\u003d NULL) {\n goto f_err;\n }\n \n@@ -3508,153 +3503,6 @@ static int tls_construct_encrypted_extensions(SSL *s, WPACKET *pkt)\n return 1;\n }\n \n-#define SSLV2_CIPHER_LEN 3\n-\n-STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,\n- PACKET *cipher_suites,\n- STACK_OF(SSL_CIPHER) **skp,\n- int sslv2format, int *al)\n-{\n- const SSL_CIPHER *c;\n- STACK_OF(SSL_CIPHER) *sk;\n- int n;\n- /* 3 \u003d SSLV2_CIPHER_LEN \u003e TLS_CIPHER_LEN \u003d 2. */\n- unsigned char cipher[SSLV2_CIPHER_LEN];\n-\n- s-\u003es3-\u003esend_connection_binding \u003d 0;\n-\n- n \u003d sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;\n-\n- if (PACKET_remaining(cipher_suites) \u003d\u003d 0) {\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);\n- *al \u003d SSL_AD_ILLEGAL_PARAMETER;\n- return NULL;\n- }\n-\n- if (PACKET_remaining(cipher_suites) % n !\u003d 0) {\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,\n- SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);\n- *al \u003d SSL_AD_DECODE_ERROR;\n- return NULL;\n- }\n-\n- sk \u003d sk_SSL_CIPHER_new_null();\n- if (sk \u003d\u003d NULL) {\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n- *al \u003d SSL_AD_INTERNAL_ERROR;\n- return NULL;\n- }\n-\n- OPENSSL_free(s-\u003es3-\u003etmp.ciphers_raw);\n- s-\u003es3-\u003etmp.ciphers_raw \u003d NULL;\n- s-\u003es3-\u003etmp.ciphers_rawlen \u003d 0;\n-\n- if (sslv2format) {\n- size_t numciphers \u003d PACKET_remaining(cipher_suites) / n;\n- PACKET sslv2ciphers \u003d *cipher_suites;\n- unsigned int leadbyte;\n- unsigned char *raw;\n-\n- /*\n- * We store the raw ciphers list in SSLv3+ format so we need to do some\n- * preprocessing to convert the list first. If there are any SSLv2 only\n- * ciphersuites with a non-zero leading byte then we are going to\n- * slightly over allocate because we won't store those. But that isn't a\n- * problem.\n- */\n- raw \u003d OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);\n- s-\u003es3-\u003etmp.ciphers_raw \u003d raw;\n- if (raw \u003d\u003d NULL) {\n- *al \u003d SSL_AD_INTERNAL_ERROR;\n- goto err;\n- }\n- for (s-\u003es3-\u003etmp.ciphers_rawlen \u003d 0;\n- PACKET_remaining(\u0026sslv2ciphers) \u003e 0;\n- raw +\u003d TLS_CIPHER_LEN) {\n- if (!PACKET_get_1(\u0026sslv2ciphers, \u0026leadbyte)\n- || (leadbyte \u003d\u003d 0\n- \u0026\u0026 !PACKET_copy_bytes(\u0026sslv2ciphers, raw,\n- TLS_CIPHER_LEN))\n- || (leadbyte !\u003d 0\n- \u0026\u0026 !PACKET_forward(\u0026sslv2ciphers, TLS_CIPHER_LEN))) {\n- *al \u003d SSL_AD_INTERNAL_ERROR;\n- OPENSSL_free(s-\u003es3-\u003etmp.ciphers_raw);\n- s-\u003es3-\u003etmp.ciphers_raw \u003d NULL;\n- s-\u003es3-\u003etmp.ciphers_rawlen \u003d 0;\n- goto err;\n- }\n- if (leadbyte \u003d\u003d 0)\n- s-\u003es3-\u003etmp.ciphers_rawlen +\u003d TLS_CIPHER_LEN;\n- }\n- } else if (!PACKET_memdup(cipher_suites, \u0026s-\u003es3-\u003etmp.ciphers_raw,\n- \u0026s-\u003es3-\u003etmp.ciphers_rawlen)) {\n- *al \u003d SSL_AD_INTERNAL_ERROR;\n- goto err;\n- }\n-\n- while (PACKET_copy_bytes(cipher_suites, cipher, n)) {\n- /*\n- * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the\n- * first byte set to zero, while true SSLv2 ciphers have a non-zero\n- * first byte. We don't support any true SSLv2 ciphers, so skip them.\n- */\n- if (sslv2format \u0026\u0026 cipher[0] !\u003d '\u005c0')\n- continue;\n-\n- /* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */\n- if ((cipher[n - 2] \u003d\u003d ((SSL3_CK_SCSV \u003e\u003e 8) \u0026 0xff)) \u0026\u0026\n- (cipher[n - 1] \u003d\u003d (SSL3_CK_SCSV \u0026 0xff))) {\n- /* SCSV fatal if renegotiating */\n- if (s-\u003erenegotiate) {\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,\n- SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);\n- *al \u003d SSL_AD_HANDSHAKE_FAILURE;\n- goto err;\n- }\n- s-\u003es3-\u003esend_connection_binding \u003d 1;\n- continue;\n- }\n-\n- /* Check for TLS_FALLBACK_SCSV */\n- if ((cipher[n - 2] \u003d\u003d ((SSL3_CK_FALLBACK_SCSV \u003e\u003e 8) \u0026 0xff)) \u0026\u0026\n- (cipher[n - 1] \u003d\u003d (SSL3_CK_FALLBACK_SCSV \u0026 0xff))) {\n- /*\n- * The SCSV indicates that the client previously tried a higher\n- * version. Fail if the current version is an unexpected\n- * downgrade.\n- */\n- if (!ssl_check_version_downgrade(s)) {\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,\n- SSL_R_INAPPROPRIATE_FALLBACK);\n- *al \u003d SSL_AD_INAPPROPRIATE_FALLBACK;\n- goto err;\n- }\n- continue;\n- }\n-\n- /* For SSLv2-compat, ignore leading 0-byte. */\n- c \u003d ssl_get_cipher_by_char(s, sslv2format ? \u0026cipher[1] : cipher, 0);\n- if (c !\u003d NULL) {\n- if (!sk_SSL_CIPHER_push(sk, c)) {\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n- *al \u003d SSL_AD_INTERNAL_ERROR;\n- goto err;\n- }\n- }\n- }\n- if (PACKET_remaining(cipher_suites) \u003e 0) {\n- *al \u003d SSL_AD_INTERNAL_ERROR;\n- SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_INTERNAL_ERROR);\n- goto err;\n- }\n-\n- *skp \u003d sk;\n- return sk;\n- err:\n- sk_SSL_CIPHER_free(sk);\n- return NULL;\n-}\n-\n static int tls_construct_hello_retry_request(SSL *s, WPACKET *pkt)\n {\n int al \u003d SSL_AD_INTERNAL_ERROR;\ndiff --git a/util/libssl.num b/util/libssl.num\nindex 32b5f76..7f51002 100644\n--- a/util/libssl.num\n+++ b/util/libssl.num\n@@ -415,3 +415,4 @@ SSL_CTX_get_keylog_callback 415\t1_1_1\tEXIST::FUNCTION:\n SSL_get_peer_signature_type_nid 416\t1_1_1\tEXIST::FUNCTION:\n SSL_key_update 417\t1_1_1\tEXIST::FUNCTION:\n SSL_get_key_update_type 418\t1_1_1\tEXIST::FUNCTION:\n+SSL_bytes_to_cipher_list 419\t1_1_1\tEXIST::FUNCTION:\n","s":{"c":1752653785,"u": 39765}} ],"g": 43424,"chitpc": 0,"ehitpc": 0,"indexed":0 , "ab": 0, "si": 0, "db":0, "di":0, "sat":0, "lfc": "0000"}