Implement a blacklist for problem OpenSSL ciphers.
authorSteve Youngs <steve@sxemacs.org>
Mon, 16 May 2016 00:08:44 +0000 (10:08 +1000)
committerSteve Youngs <steve@sxemacs.org>
Mon, 16 May 2016 00:08:44 +0000 (10:08 +1000)
commit7e2aadc60f8269eee4b8a8b9fb072d0c31141a78
tree150d10d0f12c0497351cb3d3f77c3a541eb26184
parent0f847ef0829d1cacba92319bf0bb5836d3df08cb
Implement a blacklist for problem OpenSSL ciphers.

Since OpenSSL v1.0.0 was released, a number of ciphers have caused
problems for SXEmacs' ossl, up to and including data corruption.  This
changeset prevents these ciphers from being used.

See: `ossl-cipher-blacklist'

The blacklisted ciphers can still be used if they are first removed from
`ossl-cipher-blacklist', but obviously this is not recommended.

* src/openssl.c (ossl_check_cipher): New. Returns 0 if cipher is
NOT on our blacklist.
(Fossl_available_ciphers): Check cipher with ossl_check_cipher().
(ossl_cipher_fun): Ditto.
(Fossl_bytes_to_key): Ditto.
(Fossl_encrypt): Ditto.
(Fossl_encrypt_file): Ditto.
(Fossl_decrypt): Ditto.
(Fossl_decrypt_file): Ditto.
(Fossl_seal): Ditto.
(Fossl_open): Ditto.
(Fossl_pem_write_key): Ditto.
(Fossl_pem_key): Ditto.
(Fossl_digest_size): Typo fix "cipher" -> "digest".
(vars_of_openssl): New var, Vossl_cipher_blacklist. A list of
ciphers we don't want to use.
(syms_of_openssl): Define all of the blacklisted cipher names.

* tests/automated/openssl-tests.el: Run tests on all available
ciphers and digests.
Make sure use of blacklisted ciphers results in an error.

Signed-off-by: Steve Youngs <steve@sxemacs.org>
src/openssl.c
tests/automated/openssl-tests.el