third_party/openssl: add ChaCha20+Poly1305 support.

openssl/ssl/s3_lib.c

 /* ssl/s3_lib.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
  * 
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
@@ skipping 148 matching lines @@
 #endif /* OPENSSL_NO_TLSEXT */
 #include <openssl/md5.h>
 #ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
 #endif
 
 const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
 
 #define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
 
+/* FIXED_NONCE_LEN is a macro that results in the correct value to set the
+ * fixed nonce length in SSL_CIPHER.algorithms2. It's the inverse of
+ * SSL_CIPHER_AEAD_FIXED_NONCE_LEN. */
+#define FIXED_NONCE_LEN(x) ((x/2)<<24)
+
 /* list of available SSLv3 ciphers (sorted by id) */
 OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
 /* The RSA ciphers */
 /* Cipher 01 */
         {
         1,
         SSL3_TXT_RSA_NULL_MD5,
         SSL3_CK_RSA_NULL_MD5,
         SSL_kRSA,
@@ skipping 1650 matching lines @@
         {
         1,
         TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
         SSL_kRSA,
         SSL_aRSA,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher 9D */
         {
         1,
         TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
         SSL_kRSA,
@@ skipping 11 matching lines @@
         {
         1,
         TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
         SSL_kEDH,
         SSL_aRSA,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher 9F */
         {
         1,
         TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
         SSL_kEDH,
@@ skipping 11 matching lines @@
         {
         0,
         TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
         SSL_kDHr,
         SSL_aDH,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher A1 */
         {
         0,
         TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
         SSL_kDHr,
@@ skipping 11 matching lines @@
         {
         1,
         TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
         TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
         SSL_kEDH,
         SSL_aDSS,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher A3 */
         {
         1,
         TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
         TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
         SSL_kEDH,
@@ skipping 11 matching lines @@
         {
         0,
         TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
         SSL_kDHd,
         SSL_aDH,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher A5 */
         {
         0,
         TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
         TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
         SSL_kDHd,
@@ skipping 11 matching lines @@
         {
         1,
         TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
         SSL_kEDH,
         SSL_aNULL,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher A7 */
         {
         1,
         TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
         SSL_kEDH,
@@ skipping 692 matching lines @@
         {
         1,
         TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
         SSL_kEECDH,
         SSL_aECDSA,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher C02C */
         {
         1,
         TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
         SSL_kEECDH,
@@ skipping 11 matching lines @@
         {
         1,
         TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
         SSL_kECDHe,
         SSL_aECDH,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher C02E */
         {
         1,
         TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
         SSL_kECDHe,
@@ skipping 11 matching lines @@
         {
         1,
         TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
         SSL_kEECDH,
         SSL_aRSA,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher C030 */
         {
         1,
         TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
         SSL_kEECDH,
@@ skipping 11 matching lines @@
         {
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
         SSL_kECDHr,
         SSL_aECDH,
         SSL_AES128GCM,
         SSL_AEAD,
         SSL_TLSV1_2,
         SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4)|
+                SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_INCLUDED_IN_RECORD,
         128,
         128,
         },
 
         /* Cipher C032 */
         {
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
         SSL_kECDHr,
@@ skipping 63 matching lines @@
         SSL_eGOST2814789CNT,
         SSL_GOST89MAC,
         SSL_TLSV1,
         SSL_NOT_EXP|SSL_HIGH,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
         256,
         256
         },
 #endif
 
+        {
+        1,
+        TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+        TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305,
+        SSL_kEECDH,
+        SSL_aRSA,
+        SSL_CHACHA20POLY1305,
+        SSL_AEAD,
+        SSL_TLSV1_2,
+        SSL_NOT_EXP|SSL_HIGH,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
+        256,
+        0,
+        },
+
+        {
+        1,
+        TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+        TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305,
+        SSL_kEECDH,
+        SSL_aECDSA,
+        SSL_CHACHA20POLY1305,
+        SSL_AEAD,
+        SSL_TLSV1_2,
+        SSL_NOT_EXP|SSL_HIGH,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
+        256,
+        0,
+        },
+
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305,
+        TLS1_CK_DHE_RSA_CHACHA20_POLY1305,
+        SSL_kEDH,
+        SSL_aRSA,
+        SSL_CHACHA20POLY1305,
+        SSL_AEAD,
+        SSL_TLSV1_2,
+        SSL_NOT_EXP|SSL_HIGH,
+        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(0),
+        256,
+        0,
+        },
+
 /* end of list */
         };
 
 SSL3_ENC_METHOD SSLv3_enc_data={
         ssl3_enc,
         n_ssl3_mac,
         ssl3_setup_key_block,
         ssl3_generate_master_secret,
         ssl3_change_cipher_state,
         ssl3_final_finish_mac,
@@ skipping 1438 matching lines @@
  */
 long ssl_get_algorithm2(SSL *s)
         {
         long alg2 = s->s3->tmp.new_cipher->algorithm2;
         if (TLS1_get_version(s) >= TLS1_2_VERSION &&
             alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
                 return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
         return alg2;
         }