static int test_GetSupportedCiphers(SSLContextRef ssl)
{
size_t max_ciphers = 0;
int fail=1;
SSLCipherSuite *ciphers = NULL;
require_noerr(SSLGetNumberSupportedCiphers(ssl, &max_ciphers), out);
size_t size = max_ciphers * sizeof (SSLCipherSuite);
ciphers = (SSLCipherSuite *) malloc(size);
require_string(ciphers, out, "out of memory");
memset(ciphers, 0xff, size);
size_t num_ciphers = max_ciphers;
require_noerr(SSLGetSupportedCiphers(ssl, ciphers, &num_ciphers), out);
for (size_t i = 0; i < num_ciphers; i++) {
require(ciphers[i]!=(SSLCipherSuite)(-1), out);
}
/* Success! */
fail=0;
out:
if(ciphers) free(ciphers);
return fail;
}
/*
* Given an SSLContextRef and an array of SSLCipherSuites, terminated by
* SSL_NO_SUCH_CIPHERSUITE, select those SSLCipherSuites which the library
* supports and do a SSLSetEnabledCiphers() specifying those.
*/
static OSStatus setEnabledCiphers(
SSLContextRef ctx,
const SSLCipherSuite *ciphers)
{
UInt32 numSupported;
OSStatus ortn;
SSLCipherSuite *supported = NULL;
SSLCipherSuite *enabled = NULL;
unsigned enabledDex = 0; // index into enabled
unsigned supportedDex = 0; // index into supported
unsigned inDex = 0; // index into ciphers
/* first get all the supported ciphers */
ortn = SSLGetNumberSupportedCiphers(ctx, &numSupported);
if(ortn) {
printSslErrStr("SSLGetNumberSupportedCiphers", ortn);
return ortn;
}
supported = (SSLCipherSuite *)malloc(numSupported * sizeof(SSLCipherSuite));
ortn = SSLGetSupportedCiphers(ctx, supported, &numSupported);
if(ortn) {
printSslErrStr("SSLGetSupportedCiphers", ortn);
return ortn;
}
/*
* Malloc an array we'll use for SSLGetEnabledCiphers - this will be
* bigger than the number of suites we actually specify
*/
enabled = (SSLCipherSuite *)malloc(numSupported * sizeof(SSLCipherSuite));
/*
* For each valid suite in ciphers, see if it's in the list of
* supported ciphers. If it is, add it to the list of ciphers to be
* enabled.
*/
for(inDex=0; ciphers[inDex] != SSL_NO_SUCH_CIPHERSUITE; inDex++) {
for(supportedDex=0; supportedDex<numSupported; supportedDex++) {
if(ciphers[inDex] == supported[supportedDex]) {
enabled[enabledDex++] = ciphers[inDex];
break;
}
}
}
/* send it on down. */
ortn = SSLSetEnabledCiphers(ctx, enabled, enabledDex);
if(ortn) {
printSslErrStr("SSLSetEnabledCiphers", ortn);
}
free(enabled);
free(supported);
return ortn;
}
