lib/gnutls_algorithms.c

   1 /*
   2  * Copyright (C) 2000, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
   3  * 2010 Free Software Foundation, Inc.
   4  *
   5  * Author: Nikos Mavrogiannopoulos
   6  *
   7  * This file is part of GNUTLS.
   8  *
   9  * The GNUTLS library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public License
  11  * as published by the Free Software Foundation; either version 2.1 of
  12  * the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  22  * USA
  23  *
  24  */
  25
  26 #include "gnutls_int.h"
  27 #include "gnutls_algorithms.h"
  28 #include "gnutls_errors.h"
  29 #include "gnutls_cert.h"
  30 #include <x509/common.h>
  31
  32
  33
  34 /* Cred type mappings to KX algorithms
  35  * FIXME: The mappings are not 1-1. Some KX such as SRP_RSA require
  36  * more than one credentials type.
  37  */
  38 typedef struct
  39 {
  40   gnutls_kx_algorithm_t algorithm;
  41   gnutls_credentials_type_t client_type;
  42   gnutls_credentials_type_t server_type;        /* The type of credentials a server
  43                                                  * needs to set */
  44 } gnutls_cred_map;
  45
  46 static const gnutls_cred_map cred_mappings[] = {
  47   {GNUTLS_KX_ANON_DH, GNUTLS_CRD_ANON, GNUTLS_CRD_ANON},
  48   {GNUTLS_KX_RSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
  49   {GNUTLS_KX_RSA_EXPORT, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
  50   {GNUTLS_KX_DHE_DSS, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
  51   {GNUTLS_KX_DHE_RSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
  52   {GNUTLS_KX_PSK, GNUTLS_CRD_PSK, GNUTLS_CRD_PSK},
  53   {GNUTLS_KX_DHE_PSK, GNUTLS_CRD_PSK, GNUTLS_CRD_PSK},
  54   {GNUTLS_KX_SRP, GNUTLS_CRD_SRP, GNUTLS_CRD_SRP},
  55   {GNUTLS_KX_SRP_RSA, GNUTLS_CRD_SRP, GNUTLS_CRD_CERTIFICATE},
  56   {GNUTLS_KX_SRP_DSS, GNUTLS_CRD_SRP, GNUTLS_CRD_CERTIFICATE},
  57   {0, 0, 0}
  58 };
  59
  60 #define GNUTLS_KX_MAP_LOOP(b) \
  61         const gnutls_cred_map *p; \
  62                 for(p = cred_mappings; p->algorithm != 0; p++) { b ; }
  63
  64 #define GNUTLS_KX_MAP_ALG_LOOP_SERVER(a) \
  65                         GNUTLS_KX_MAP_LOOP( if(p->server_type == type) { a; break; })
  66
  67 /* KX mappings to PK algorithms */
  68 typedef struct
  69 {
  70   gnutls_kx_algorithm_t kx_algorithm;
  71   gnutls_pk_algorithm_t pk_algorithm;
  72   enum encipher_type encipher_type;     /* CIPHER_ENCRYPT if this algorithm is to be used
  73                                          * for encryption, CIPHER_SIGN if signature only,
  74                                          * CIPHER_IGN if this does not apply at all.
  75                                          *
  76                                          * This is useful to certificate cipher suites, which check
  77                                          * against the certificate key usage bits.
  78                                          */
  79 } gnutls_pk_map;
  80
  81 /* This table maps the Key exchange algorithms to
  82  * the certificate algorithms. Eg. if we have
  83  * RSA algorithm in the certificate then we can
  84  * use GNUTLS_KX_RSA or GNUTLS_KX_DHE_RSA.
  85  */
  86 static const gnutls_pk_map pk_mappings[] = {
  87   {GNUTLS_KX_RSA, GNUTLS_PK_RSA, CIPHER_ENCRYPT},
  88   {GNUTLS_KX_RSA_EXPORT, GNUTLS_PK_RSA, CIPHER_SIGN},
  89   {GNUTLS_KX_DHE_RSA, GNUTLS_PK_RSA, CIPHER_SIGN},
  90   {GNUTLS_KX_SRP_RSA, GNUTLS_PK_RSA, CIPHER_SIGN},
  91   {GNUTLS_KX_DHE_DSS, GNUTLS_PK_DSA, CIPHER_SIGN},
  92   {GNUTLS_KX_SRP_DSS, GNUTLS_PK_DSA, CIPHER_SIGN},
  93   {0, 0, 0}
  94 };
  95
  96 #define GNUTLS_PK_MAP_LOOP(b) \
  97         const gnutls_pk_map *p; \
  98                 for(p = pk_mappings; p->kx_algorithm != 0; p++) { b }
  99
 100 #define GNUTLS_PK_MAP_ALG_LOOP(a) \
 101                         GNUTLS_PK_MAP_LOOP( if(p->kx_algorithm == kx_algorithm) { a; break; })
 102
 103
 104
 105 /* TLS Versions */
 106
 107 typedef struct
 108 {
 109   const char *name;
 110   gnutls_protocol_t id;         /* gnutls internal version number */
 111   int major;                    /* defined by the protocol */
 112   int minor;                    /* defined by the protocol */
 113   int supported;                /* 0 not supported, > 0 is supported */
 114 } gnutls_version_entry;
 115
 116 static const gnutls_version_entry sup_versions[] = {
 117   {"SSL3.0", GNUTLS_SSL3, 3, 0, 1},
 118   {"TLS1.0", GNUTLS_TLS1, 3, 1, 1},
 119   {"TLS1.1", GNUTLS_TLS1_1, 3, 2, 1},
 120   {"TLS1.2", GNUTLS_TLS1_2, 3, 3, 1},
 121   {0, 0, 0, 0, 0}
 122 };
 123
 124 /* Keep the contents of this struct the same as the previous one. */
 125 static const gnutls_protocol_t supported_protocols[] = {
 126   GNUTLS_SSL3,
 127   GNUTLS_TLS1,
 128   GNUTLS_TLS1_1,
 129   GNUTLS_TLS1_2,
 130   0
 131 };
 132
 133 #define GNUTLS_VERSION_LOOP(b) \
 134         const gnutls_version_entry *p; \
 135                 for(p = sup_versions; p->name != NULL; p++) { b ; }
 136
 137 #define GNUTLS_VERSION_ALG_LOOP(a) \
 138                         GNUTLS_VERSION_LOOP( if(p->id == version) { a; break; })
 139
 140
 141 struct gnutls_cipher_entry
 142 {
 143   const char *name;
 144   gnutls_cipher_algorithm_t id;
 145   uint16_t blocksize;
 146   uint16_t keysize;
 147   cipher_type_t block;
 148   uint16_t iv;
 149   int export_flag;              /* 0 non export */
 150 };
 151 typedef struct gnutls_cipher_entry gnutls_cipher_entry;
 152
 153 /* Note that all algorithms are in CBC or STREAM modes.
 154  * Do not add any algorithms in other modes (avoid modified algorithms).
 155  * View first: "The order of encryption and authentication for
 156  * protecting communications" by Hugo Krawczyk - CRYPTO 2001
 157  *
 158  * Make sure to updated MAX_CIPHER_BLOCK_SIZE and MAX_CIPHER_KEY_SIZE as well.
 159  */
 160 static const gnutls_cipher_entry algorithms[] = {
 161   {"AES-256-CBC", GNUTLS_CIPHER_AES_256_CBC, 16, 32, CIPHER_BLOCK, 16, 0},
 162   {"AES-192-CBC", GNUTLS_CIPHER_AES_192_CBC, 16, 24, CIPHER_BLOCK, 16, 0},
 163   {"AES-128-CBC", GNUTLS_CIPHER_AES_128_CBC, 16, 16, CIPHER_BLOCK, 16, 0},
 164   {"3DES-CBC", GNUTLS_CIPHER_3DES_CBC, 8, 24, CIPHER_BLOCK, 8, 0},
 165   {"DES-CBC", GNUTLS_CIPHER_DES_CBC, 8, 8, CIPHER_BLOCK, 8, 0},
 166   {"ARCFOUR-128", GNUTLS_CIPHER_ARCFOUR_128, 1, 16, CIPHER_STREAM, 0, 0},
 167   {"ARCFOUR-40", GNUTLS_CIPHER_ARCFOUR_40, 1, 5, CIPHER_STREAM, 0, 1},
 168   {"RC2-40", GNUTLS_CIPHER_RC2_40_CBC, 8, 5, CIPHER_BLOCK, 8, 1},
 169 #ifdef  ENABLE_CAMELLIA
 170   {"CAMELLIA-256-CBC", GNUTLS_CIPHER_CAMELLIA_256_CBC, 16, 32, CIPHER_BLOCK,
 171    16, 0},
 172   {"CAMELLIA-128-CBC", GNUTLS_CIPHER_CAMELLIA_128_CBC, 16, 16, CIPHER_BLOCK,
 173    16, 0},
 174 #endif
 175
 176 #ifdef ENABLE_OPENPGP
 177   {"IDEA-PGP-CFB", GNUTLS_CIPHER_IDEA_PGP_CFB, 8, 16, CIPHER_BLOCK, 8, 0},
 178   {"3DES-PGP-CFB", GNUTLS_CIPHER_3DES_PGP_CFB, 8, 24, CIPHER_BLOCK, 8, 0},
 179   {"CAST5-PGP-CFB", GNUTLS_CIPHER_CAST5_PGP_CFB, 8, 16, CIPHER_BLOCK, 8, 0},
 180   {"BLOWFISH-PGP-CFB", GNUTLS_CIPHER_BLOWFISH_PGP_CFB, 8,
 181    16 /*actually unlimited */ , CIPHER_BLOCK, 8, 0},
 182   {"SAFER-SK128-PGP-CFB", GNUTLS_CIPHER_SAFER_SK128_PGP_CFB, 8, 16,
 183    CIPHER_BLOCK, 8, 0},
 184   {"AES-128-PGP-CFB", GNUTLS_CIPHER_AES128_PGP_CFB, 16, 16, CIPHER_BLOCK, 16,
 185    0},
 186   {"AES-192-PGP-CFB", GNUTLS_CIPHER_AES192_PGP_CFB, 16, 24, CIPHER_BLOCK, 16,
 187    0},
 188   {"AES-256-PGP-CFB", GNUTLS_CIPHER_AES256_PGP_CFB, 16, 32, CIPHER_BLOCK, 16,
 189    0},
 190   {"TWOFISH-PGP-CFB", GNUTLS_CIPHER_TWOFISH_PGP_CFB, 16, 16, CIPHER_BLOCK, 16,
 191    0},
 192 #endif
 193   {"NULL", GNUTLS_CIPHER_NULL, 1, 0, CIPHER_STREAM, 0, 0},
 194   {0, 0, 0, 0, 0, 0, 0}
 195 };
 196
 197 /* Keep the contents of this struct the same as the previous one. */
 198 static const gnutls_cipher_algorithm_t supported_ciphers[] = {
 199   GNUTLS_CIPHER_AES_256_CBC,
 200   GNUTLS_CIPHER_AES_128_CBC,
 201   GNUTLS_CIPHER_3DES_CBC,
 202   GNUTLS_CIPHER_DES_CBC,
 203   GNUTLS_CIPHER_ARCFOUR_128,
 204   GNUTLS_CIPHER_ARCFOUR_40,
 205   GNUTLS_CIPHER_RC2_40_CBC,
 206 #ifdef  ENABLE_CAMELLIA
 207   GNUTLS_CIPHER_CAMELLIA_256_CBC,
 208   GNUTLS_CIPHER_CAMELLIA_128_CBC,
 209 #endif
 210   GNUTLS_CIPHER_NULL,
 211   0
 212 };
 213
 214 #define GNUTLS_LOOP(b) \
 215         const gnutls_cipher_entry *p; \
 216                 for(p = algorithms; p->name != NULL; p++) { b ; }
 217
 218 #define GNUTLS_ALG_LOOP(a) \
 219                         GNUTLS_LOOP( if(p->id == algorithm) { a; break; } )
 220
 221
 222 struct gnutls_hash_entry
 223 {
 224   const char *name;
 225   const char *oid;
 226   gnutls_mac_algorithm_t id;
 227   size_t key_size;              /* in case of mac */
 228 };
 229 typedef struct gnutls_hash_entry gnutls_hash_entry;
 230
 231 static const gnutls_hash_entry hash_algorithms[] = {
 232   {"SHA1", HASH_OID_SHA1, GNUTLS_MAC_SHA1, 20},
 233   {"MD5", HASH_OID_MD5, GNUTLS_MAC_MD5, 16},
 234   {"SHA256", HASH_OID_SHA256, GNUTLS_MAC_SHA256, 32},
 235   {"SHA384", HASH_OID_SHA384, GNUTLS_MAC_SHA384, 48},
 236   {"SHA512", HASH_OID_SHA512, GNUTLS_MAC_SHA512, 64},
 237   {"MD2", HASH_OID_MD2, GNUTLS_MAC_MD2, 0},     /* not used as MAC */
 238   {"RIPEMD160", HASH_OID_RMD160, GNUTLS_MAC_RMD160, 20},
 239   {"NULL", NULL, GNUTLS_MAC_NULL, 0},
 240   {0, 0, 0, 0}
 241 };
 242
 243 /* Keep the contents of this struct the same as the previous one. */
 244 static const gnutls_mac_algorithm_t supported_macs[] = {
 245   GNUTLS_MAC_SHA1,
 246   GNUTLS_MAC_MD5,
 247   GNUTLS_MAC_SHA256,
 248   GNUTLS_MAC_SHA384,
 249   GNUTLS_MAC_SHA512,
 250   GNUTLS_MAC_MD2,
 251   GNUTLS_MAC_RMD160,
 252   GNUTLS_MAC_NULL,
 253   0
 254 };
 255
 256 #define GNUTLS_HASH_LOOP(b) \
 257         const gnutls_hash_entry *p; \
 258                 for(p = hash_algorithms; p->name != NULL; p++) { b ; }
 259
 260 #define GNUTLS_HASH_ALG_LOOP(a) \
 261                         GNUTLS_HASH_LOOP( if(p->id == algorithm) { a; break; } )
 262
 263 /* Key Exchange Section */
 264
 265
 266 extern mod_auth_st rsa_auth_struct;
 267 extern mod_auth_st rsa_export_auth_struct;
 268 extern mod_auth_st dhe_rsa_auth_struct;
 269 extern mod_auth_st dhe_dss_auth_struct;
 270 extern mod_auth_st anon_auth_struct;
 271 extern mod_auth_st srp_auth_struct;
 272 extern mod_auth_st psk_auth_struct;
 273 extern mod_auth_st dhe_psk_auth_struct;
 274 extern mod_auth_st srp_rsa_auth_struct;
 275 extern mod_auth_st srp_dss_auth_struct;
 276
 277 struct gnutls_kx_algo_entry
 278 {
 279   const char *name;
 280   gnutls_kx_algorithm_t algorithm;
 281   mod_auth_st *auth_struct;
 282   int needs_dh_params;
 283   int needs_rsa_params;
 284 };
 285 typedef struct gnutls_kx_algo_entry gnutls_kx_algo_entry;
 286
 287 static const gnutls_kx_algo_entry _gnutls_kx_algorithms[] = {
 288 #ifdef ENABLE_ANON
 289   {"ANON-DH", GNUTLS_KX_ANON_DH, &anon_auth_struct, 1, 0},
 290 #endif
 291   {"RSA", GNUTLS_KX_RSA, &rsa_auth_struct, 0, 0},
 292   {"RSA-EXPORT", GNUTLS_KX_RSA_EXPORT, &rsa_export_auth_struct, 0,
 293    1 /* needs RSA params */ },
 294   {"DHE-RSA", GNUTLS_KX_DHE_RSA, &dhe_rsa_auth_struct, 1, 0},
 295   {"DHE-DSS", GNUTLS_KX_DHE_DSS, &dhe_dss_auth_struct, 1, 0},
 296
 297 #ifdef ENABLE_SRP
 298   {"SRP-DSS", GNUTLS_KX_SRP_DSS, &srp_dss_auth_struct, 0, 0},
 299   {"SRP-RSA", GNUTLS_KX_SRP_RSA, &srp_rsa_auth_struct, 0, 0},
 300   {"SRP", GNUTLS_KX_SRP, &srp_auth_struct, 0, 0},
 301 #endif
 302 #ifdef ENABLE_PSK
 303   {"PSK", GNUTLS_KX_PSK, &psk_auth_struct, 0, 0},
 304   {"DHE-PSK", GNUTLS_KX_DHE_PSK, &dhe_psk_auth_struct,
 305    1 /* needs DHE params */ , 0},
 306 #endif
 307   {0, 0, 0, 0, 0}
 308 };
 309
 310 /* Keep the contents of this struct the same as the previous one. */
 311 static const gnutls_kx_algorithm_t supported_kxs[] = {
 312 #ifdef ENABLE_ANON
 313   GNUTLS_KX_ANON_DH,
 314 #endif
 315   GNUTLS_KX_RSA,
 316   GNUTLS_KX_RSA_EXPORT,
 317   GNUTLS_KX_DHE_RSA,
 318   GNUTLS_KX_DHE_DSS,
 319 #ifdef ENABLE_SRP
 320   GNUTLS_KX_SRP_DSS,
 321   GNUTLS_KX_SRP_RSA,
 322   GNUTLS_KX_SRP,
 323 #endif
 324 #ifdef ENABLE_PSK
 325   GNUTLS_KX_PSK,
 326   GNUTLS_KX_DHE_PSK,
 327 #endif
 328   0
 329 };
 330
 331 #define GNUTLS_KX_LOOP(b) \
 332         const gnutls_kx_algo_entry *p; \
 333                 for(p = _gnutls_kx_algorithms; p->name != NULL; p++) { b ; }
 334
 335 #define GNUTLS_KX_ALG_LOOP(a) \
 336                         GNUTLS_KX_LOOP( if(p->algorithm == algorithm) { a; break; } )
 337
 338
 339
 340 /* Cipher SUITES */
 341 #define GNUTLS_CIPHER_SUITE_ENTRY( name, block_algorithm, kx_algorithm, mac_algorithm, version ) \
 342         { #name, {name}, block_algorithm, kx_algorithm, mac_algorithm, version }
 343
 344 typedef struct
 345 {
 346   const char *name;
 347   cipher_suite_st id;
 348   gnutls_cipher_algorithm_t block_algorithm;
 349   gnutls_kx_algorithm_t kx_algorithm;
 350   gnutls_mac_algorithm_t mac_algorithm;
 351   gnutls_protocol_t version;    /* this cipher suite is supported
 352                                  * from 'version' and above;
 353                                  */
 354 } gnutls_cipher_suite_entry;
 355
 356 /* RSA with NULL cipher and MD5 MAC
 357  * for test purposes.
 358  */
 359 #define GNUTLS_RSA_NULL_MD5 { 0x00, 0x01 }
 360
 361
 362 /* ANONymous cipher suites.
 363  */
 364
 365 #define GNUTLS_ANON_DH_3DES_EDE_CBC_SHA1 { 0x00, 0x1B }
 366 #define GNUTLS_ANON_DH_ARCFOUR_MD5 { 0x00, 0x18 }
 367
 368  /* rfc3268: */
 369 #define GNUTLS_ANON_DH_AES_128_CBC_SHA1 { 0x00, 0x34 }
 370 #define GNUTLS_ANON_DH_AES_256_CBC_SHA1 { 0x00, 0x3A }
 371
 372 /* rfc4132 */
 373 #ifdef  ENABLE_CAMELLIA
 374 #define GNUTLS_ANON_DH_CAMELLIA_128_CBC_SHA1 { 0x00,0x46 }
 375 #define GNUTLS_ANON_DH_CAMELLIA_256_CBC_SHA1 { 0x00,0x89 }
 376 #endif
 377
 378 #define GNUTLS_ANON_DH_AES_128_CBC_SHA256 { 0x00, 0x6C }
 379 #define GNUTLS_ANON_DH_AES_256_CBC_SHA256 { 0x00, 0x6D }
 380
 381 /* PSK (not in TLS 1.0)
 382  * draft-ietf-tls-psk:
 383  */
 384 #define GNUTLS_PSK_SHA_ARCFOUR_SHA1 { 0x00, 0x8A }
 385 #define GNUTLS_PSK_SHA_3DES_EDE_CBC_SHA1 { 0x00, 0x8B }
 386 #define GNUTLS_PSK_SHA_AES_128_CBC_SHA1 { 0x00, 0x8C }
 387 #define GNUTLS_PSK_SHA_AES_256_CBC_SHA1 { 0x00, 0x8D }
 388
 389 #define GNUTLS_DHE_PSK_SHA_ARCFOUR_SHA1 { 0x00, 0x8E }
 390 #define GNUTLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1 { 0x00, 0x8F }
 391 #define GNUTLS_DHE_PSK_SHA_AES_128_CBC_SHA1 { 0x00, 0x90 }
 392 #define GNUTLS_DHE_PSK_SHA_AES_256_CBC_SHA1 { 0x00, 0x91 }
 393
 394
 395 /* SRP (rfc5054)
 396  */
 397 #define GNUTLS_SRP_SHA_3DES_EDE_CBC_SHA1 { 0xC0, 0x1A }
 398 #define GNUTLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1 { 0xC0, 0x1B }
 399 #define GNUTLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1 { 0xC0, 0x1C }
 400
 401 #define GNUTLS_SRP_SHA_AES_128_CBC_SHA1 { 0xC0, 0x1D }
 402 #define GNUTLS_SRP_SHA_RSA_AES_128_CBC_SHA1 { 0xC0, 0x1E }
 403 #define GNUTLS_SRP_SHA_DSS_AES_128_CBC_SHA1 { 0xC0, 0x1F }
 404
 405 #define GNUTLS_SRP_SHA_AES_256_CBC_SHA1 { 0xC0, 0x20 }
 406 #define GNUTLS_SRP_SHA_RSA_AES_256_CBC_SHA1 { 0xC0, 0x21 }
 407 #define GNUTLS_SRP_SHA_DSS_AES_256_CBC_SHA1 { 0xC0, 0x22 }
 408
 409 /* RSA
 410  */
 411 #define GNUTLS_RSA_ARCFOUR_SHA1 { 0x00, 0x05 }
 412 #define GNUTLS_RSA_ARCFOUR_MD5 { 0x00, 0x04 }
 413 #define GNUTLS_RSA_3DES_EDE_CBC_SHA1 { 0x00, 0x0A }
 414
 415 #define GNUTLS_RSA_EXPORT_ARCFOUR_40_MD5 { 0x00, 0x03 }
 416
 417 /* rfc3268:
 418  */
 419 #define GNUTLS_RSA_AES_128_CBC_SHA1 { 0x00, 0x2F }
 420 #define GNUTLS_RSA_AES_256_CBC_SHA1 { 0x00, 0x35 }
 421
 422 /* rfc4132 */
 423 #ifdef  ENABLE_CAMELLIA
 424 #define GNUTLS_RSA_CAMELLIA_128_CBC_SHA1 { 0x00,0x41 }
 425 #define GNUTLS_RSA_CAMELLIA_256_CBC_SHA1 { 0x00,0x84 }
 426 #endif
 427
 428 #define GNUTLS_RSA_AES_128_CBC_SHA256 { 0x00, 0x3C }
 429 #define GNUTLS_RSA_AES_256_CBC_SHA256 { 0x00, 0x3D }
 430
 431 /* DHE DSS
 432  */
 433
 434 #define GNUTLS_DHE_DSS_3DES_EDE_CBC_SHA1 { 0x00, 0x13 }
 435
 436
 437 /* draft-ietf-tls-56-bit-ciphersuites-01:
 438  */
 439 #define GNUTLS_DHE_DSS_ARCFOUR_SHA1 { 0x00, 0x66 }
 440
 441
 442 /* rfc3268:
 443  */
 444 #define GNUTLS_DHE_DSS_AES_256_CBC_SHA1 { 0x00, 0x38 }
 445 #define GNUTLS_DHE_DSS_AES_128_CBC_SHA1 { 0x00, 0x32 }
 446
 447 /* rfc4132 */
 448 #ifdef  ENABLE_CAMELLIA
 449 #define GNUTLS_DHE_DSS_CAMELLIA_128_CBC_SHA1 { 0x00,0x44 }
 450 #define GNUTLS_DHE_DSS_CAMELLIA_256_CBC_SHA1 { 0x00,0x87 }
 451 #endif
 452
 453 #define GNUTLS_DHE_DSS_AES_128_CBC_SHA256 { 0x00, 0x40 }
 454 #define GNUTLS_DHE_DSS_AES_256_CBC_SHA256 { 0x00, 0x6A }
 455
 456 /* DHE RSA
 457  */
 458 #define GNUTLS_DHE_RSA_3DES_EDE_CBC_SHA1 { 0x00, 0x16 }
 459
 460 /* rfc3268:
 461  */
 462 #define GNUTLS_DHE_RSA_AES_128_CBC_SHA1 { 0x00, 0x33 }
 463 #define GNUTLS_DHE_RSA_AES_256_CBC_SHA1 { 0x00, 0x39 }
 464
 465 /* rfc4132 */
 466 #ifdef  ENABLE_CAMELLIA
 467 #define GNUTLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 { 0x00,0x45 }
 468 #define GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 { 0x00,0x88 }
 469 #endif
 470
 471 #define GNUTLS_DHE_RSA_AES_128_CBC_SHA256 { 0x00, 0x67 }
 472 #define GNUTLS_DHE_RSA_AES_256_CBC_SHA256 { 0x00, 0x6B }
 473
 474 /* Safe renegotiation */
 475
 476 #define GNUTLS_RENEGO_PROTECTION_REQUEST { GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR, GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR }
 477
 478 #define CIPHER_SUITES_COUNT sizeof(cs_algorithms)/sizeof(gnutls_cipher_suite_entry)-1
 479
 480 static const gnutls_cipher_suite_entry cs_algorithms[] = {
 481   /* ANON_DH */
 482   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_ARCFOUR_MD5,
 483                              GNUTLS_CIPHER_ARCFOUR_128,
 484                              GNUTLS_KX_ANON_DH, GNUTLS_MAC_MD5,
 485                              GNUTLS_SSL3),
 486   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_3DES_EDE_CBC_SHA1,
 487                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_ANON_DH,
 488                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 489   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_AES_128_CBC_SHA1,
 490                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_ANON_DH,
 491                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 492   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_AES_256_CBC_SHA1,
 493                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_ANON_DH,
 494                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 495 #ifdef  ENABLE_CAMELLIA
 496   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_CAMELLIA_128_CBC_SHA1,
 497                              GNUTLS_CIPHER_CAMELLIA_128_CBC,
 498                              GNUTLS_KX_ANON_DH,
 499                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 500   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_CAMELLIA_256_CBC_SHA1,
 501                              GNUTLS_CIPHER_CAMELLIA_256_CBC,
 502                              GNUTLS_KX_ANON_DH,
 503                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 504 #endif
 505   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_AES_128_CBC_SHA256,
 506                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_ANON_DH,
 507                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 508   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_AES_256_CBC_SHA256,
 509                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_ANON_DH,
 510                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 511
 512   /* PSK */
 513   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_ARCFOUR_SHA1,
 514                              GNUTLS_CIPHER_ARCFOUR, GNUTLS_KX_PSK,
 515                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 516   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_3DES_EDE_CBC_SHA1,
 517                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_PSK,
 518                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 519   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_AES_128_CBC_SHA1,
 520                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_PSK,
 521                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 522   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_AES_256_CBC_SHA1,
 523                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_PSK,
 524                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 525
 526   /* DHE-PSK */
 527   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_ARCFOUR_SHA1,
 528                              GNUTLS_CIPHER_ARCFOUR, GNUTLS_KX_DHE_PSK,
 529                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 530   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1,
 531                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_PSK,
 532                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 533   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_AES_128_CBC_SHA1,
 534                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_PSK,
 535                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 536   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_AES_256_CBC_SHA1,
 537                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_PSK,
 538                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 539
 540   /* SRP */
 541   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_3DES_EDE_CBC_SHA1,
 542                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP,
 543                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 544   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_AES_128_CBC_SHA1,
 545                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_SRP,
 546                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 547   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_AES_256_CBC_SHA1,
 548                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_SRP,
 549                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 550
 551   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1,
 552                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP_DSS,
 553                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 554
 555   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1,
 556                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP_RSA,
 557                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 558
 559   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_DSS_AES_128_CBC_SHA1,
 560                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_SRP_DSS,
 561                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 562
 563   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_RSA_AES_128_CBC_SHA1,
 564                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_SRP_RSA,
 565                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 566
 567   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_DSS_AES_256_CBC_SHA1,
 568                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_SRP_DSS,
 569                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 570
 571   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_RSA_AES_256_CBC_SHA1,
 572                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_SRP_RSA,
 573                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 574
 575   /* DHE_DSS */
 576   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_ARCFOUR_SHA1,
 577                              GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_KX_DHE_DSS,
 578                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 579   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_3DES_EDE_CBC_SHA1,
 580                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_DSS,
 581                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 582   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_AES_128_CBC_SHA1,
 583                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_DSS,
 584                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 585   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_AES_256_CBC_SHA1,
 586                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS,
 587                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 588 #ifdef  ENABLE_CAMELLIA
 589   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_CAMELLIA_128_CBC_SHA1,
 590                              GNUTLS_CIPHER_CAMELLIA_128_CBC,
 591                              GNUTLS_KX_DHE_DSS,
 592                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 593   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_CAMELLIA_256_CBC_SHA1,
 594                              GNUTLS_CIPHER_CAMELLIA_256_CBC,
 595                              GNUTLS_KX_DHE_DSS,
 596                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 597 #endif
 598   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_AES_128_CBC_SHA256,
 599                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_DSS,
 600                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 601   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_AES_256_CBC_SHA256,
 602                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS,
 603                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 604   /* DHE_RSA */
 605   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_3DES_EDE_CBC_SHA1,
 606                              GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_RSA,
 607                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 608   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_AES_128_CBC_SHA1,
 609                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_RSA,
 610                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 611   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_AES_256_CBC_SHA1,
 612                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA,
 613                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 614 #ifdef  ENABLE_CAMELLIA
 615   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_CAMELLIA_128_CBC_SHA1,
 616                              GNUTLS_CIPHER_CAMELLIA_128_CBC,
 617                              GNUTLS_KX_DHE_RSA,
 618                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 619   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA1,
 620                              GNUTLS_CIPHER_CAMELLIA_256_CBC,
 621                              GNUTLS_KX_DHE_RSA,
 622                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 623 #endif
 624   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_AES_128_CBC_SHA256,
 625                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_RSA,
 626                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 627   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_AES_256_CBC_SHA256,
 628                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA,
 629                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 630   /* RSA */
 631   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_NULL_MD5,
 632                              GNUTLS_CIPHER_NULL,
 633                              GNUTLS_KX_RSA, GNUTLS_MAC_MD5, GNUTLS_SSL3),
 634
 635   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_EXPORT_ARCFOUR_40_MD5,
 636                              GNUTLS_CIPHER_ARCFOUR_40,
 637                              GNUTLS_KX_RSA_EXPORT, GNUTLS_MAC_MD5,
 638                              GNUTLS_SSL3),
 639
 640   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_ARCFOUR_SHA1,
 641                              GNUTLS_CIPHER_ARCFOUR_128,
 642                              GNUTLS_KX_RSA, GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 643   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_ARCFOUR_MD5,
 644                              GNUTLS_CIPHER_ARCFOUR_128,
 645                              GNUTLS_KX_RSA, GNUTLS_MAC_MD5, GNUTLS_SSL3),
 646   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_3DES_EDE_CBC_SHA1,
 647                              GNUTLS_CIPHER_3DES_CBC,
 648                              GNUTLS_KX_RSA, GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 649   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_AES_128_CBC_SHA1,
 650                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_RSA,
 651                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 652   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_AES_256_CBC_SHA1,
 653                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_RSA,
 654                              GNUTLS_MAC_SHA1, GNUTLS_SSL3),
 655 #ifdef  ENABLE_CAMELLIA
 656   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_CAMELLIA_128_CBC_SHA1,
 657                              GNUTLS_CIPHER_CAMELLIA_128_CBC, GNUTLS_KX_RSA,
 658                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 659   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_CAMELLIA_256_CBC_SHA1,
 660                              GNUTLS_CIPHER_CAMELLIA_256_CBC, GNUTLS_KX_RSA,
 661                              GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 662 #endif
 663   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_AES_128_CBC_SHA256,
 664                              GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_RSA,
 665                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 666   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_AES_256_CBC_SHA256,
 667                              GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_RSA,
 668                              GNUTLS_MAC_SHA256, GNUTLS_TLS1_2),
 669   GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RENEGO_PROTECTION_REQUEST,
 670                              GNUTLS_CIPHER_UNKNOWN, GNUTLS_KX_UNKNOWN,
 671                              GNUTLS_MAC_UNKNOWN, GNUTLS_SSL3),
 672   {0, {{0, 0}}, 0, 0, 0, 0}
 673 };
 674
 675 #define GNUTLS_CIPHER_SUITE_LOOP(b) \
 676         const gnutls_cipher_suite_entry *p; \
 677                 for(p = cs_algorithms; p->name != NULL; p++) { b ; }
 678
 679 #define GNUTLS_CIPHER_SUITE_ALG_LOOP(a) \
 680                         GNUTLS_CIPHER_SUITE_LOOP( if( (p->id.suite[0] == suite->suite[0]) && (p->id.suite[1] == suite->suite[1])) { a; break; } )
 681
 682
 683
 684 /* Generic Functions */
 685
 686 int
 687 _gnutls_mac_priority (gnutls_session_t session,
 688                       gnutls_mac_algorithm_t algorithm)
 689 {                               /* actually returns the priority */
 690   unsigned int i;
 691   for (i = 0; i < session->internals.priorities.mac.algorithms; i++)
 692     {
 693       if (session->internals.priorities.mac.priority[i] == algorithm)
 694         return i;
 695     }
 696   return -1;
 697 }
 698
 699 /**
 700  * gnutls_mac_get_name - Returns a string with the name of the specified mac algorithm
 701  * @algorithm: is a MAC algorithm
 702  *
 703  * Convert a #gnutls_mac_algorithm_t value to a string.
 704  *
 705  * Returns: a string that contains the name of the specified MAC
 706  *   algorithm, or %NULL.
 707  **/
 708 const char *
 709 gnutls_mac_get_name (gnutls_mac_algorithm_t algorithm)
 710 {
 711   const char *ret = NULL;
 712
 713   /* avoid prefix */
 714   GNUTLS_HASH_ALG_LOOP (ret = p->name);
 715
 716   return ret;
 717 }
 718
 719 /**
 720  * gnutls_mac_get_id - Returns the gnutls id of the specified in string algorithm
 721  * @name: is a MAC algorithm name
 722  *
 723  * Convert a string to a #gnutls_mac_algorithm_t value.  The names are
 724  * compared in a case insensitive way.
 725  *
 726  * Returns: a #gnutls_mac_algorithm_t id of the specified MAC
 727  *   algorithm string, or %GNUTLS_MAC_UNKNOWN on failures.
 728  **/
 729 gnutls_mac_algorithm_t
 730 gnutls_mac_get_id (const char *name)
 731 {
 732   gnutls_mac_algorithm_t ret = GNUTLS_MAC_UNKNOWN;
 733
 734   GNUTLS_HASH_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id);
 735
 736   return ret;
 737 }
 738
 739 /**
 740  * gnutls_mac_get_key_size - Returns the length of the MAC's key size
 741  * @algorithm: is an encryption algorithm
 742  *
 743  * Get size of MAC key.
 744  *
 745  * Returns: length (in bytes) of the given MAC key size, or 0 if the
 746  *   given MAC algorithm is invalid.
 747  **/
 748 size_t
 749 gnutls_mac_get_key_size (gnutls_mac_algorithm_t algorithm)
 750 {
 751   size_t ret = 0;
 752
 753   /* avoid prefix */
 754   GNUTLS_HASH_ALG_LOOP (ret = p->key_size);
 755
 756   return ret;
 757 }
 758
 759 /**
 760  * gnutls_mac_list - Get a list of supported MAC algorithms
 761  *
 762  * Get a list of hash algorithms for use as MACs.  Note that not
 763  * necessarily all MACs are supported in TLS cipher suites.  For
 764  * example, MD2 is not supported as a cipher suite, but is supported
 765  * for other purposes (e.g., X.509 signature verification or similar).
 766  *
 767  * Returns: Return a zero-terminated list of #gnutls_mac_algorithm_t
 768  *   integers indicating the available MACs.
 769  **/
 770 const gnutls_mac_algorithm_t *
 771 gnutls_mac_list (void)
 772 {
 773   return supported_macs;
 774 }
 775
 776 const char *
 777 _gnutls_x509_mac_to_oid (gnutls_mac_algorithm_t algorithm)
 778 {
 779   const char *ret = NULL;
 780
 781   /* avoid prefix */
 782   GNUTLS_HASH_ALG_LOOP (ret = p->oid);
 783
 784   return ret;
 785 }
 786
 787 gnutls_mac_algorithm_t
 788 _gnutls_x509_oid2mac_algorithm (const char *oid)
 789 {
 790   gnutls_mac_algorithm_t ret = 0;
 791
 792   GNUTLS_HASH_LOOP (if (p->oid && strcmp (oid, p->oid) == 0)
 793                     {
 794                     ret = p->id; break;}
 795   );
 796
 797   if (ret == 0)
 798     return GNUTLS_MAC_UNKNOWN;
 799   return ret;
 800 }
 801
 802
 803 int
 804 _gnutls_mac_is_ok (gnutls_mac_algorithm_t algorithm)
 805 {
 806   ssize_t ret = -1;
 807   GNUTLS_HASH_ALG_LOOP (ret = p->id);
 808   if (ret >= 0)
 809     ret = 0;
 810   else
 811     ret = 1;
 812   return ret;
 813 }
 814
 815 /* CIPHER functions */
 816 int
 817 gnutls_cipher_get_block_size (gnutls_cipher_algorithm_t algorithm)
 818 {
 819   size_t ret = 0;
 820   GNUTLS_ALG_LOOP (ret = p->blocksize);
 821   return ret;
 822
 823 }
 824
 825  /* returns the priority */
 826 int
 827 _gnutls_cipher_priority (gnutls_session_t session,
 828                          gnutls_cipher_algorithm_t algorithm)
 829 {
 830   unsigned int i;
 831   for (i = 0; i < session->internals.priorities.cipher.algorithms; i++)
 832     {
 833       if (session->internals.priorities.cipher.priority[i] == algorithm)
 834         return i;
 835     }
 836   return -1;
 837 }
 838
 839
 840 int
 841 _gnutls_cipher_is_block (gnutls_cipher_algorithm_t algorithm)
 842 {
 843   size_t ret = 0;
 844
 845   GNUTLS_ALG_LOOP (ret = p->block);
 846   return ret;
 847
 848 }
 849
 850 /**
 851  * gnutls_cipher_get_key_size - Returns the length of the cipher's key size
 852  * @algorithm: is an encryption algorithm
 853  *
 854  * Get key size for cipher.
 855  *
 856  * Returns: length (in bytes) of the given cipher's key size, or 0 if
 857  *   the given cipher is invalid.
 858  **/
 859 size_t
 860 gnutls_cipher_get_key_size (gnutls_cipher_algorithm_t algorithm)
 861 {                               /* In bytes */
 862   size_t ret = 0;
 863   GNUTLS_ALG_LOOP (ret = p->keysize);
 864   return ret;
 865
 866 }
 867
 868 int
 869 _gnutls_cipher_get_iv_size (gnutls_cipher_algorithm_t algorithm)
 870 {                               /* In bytes */
 871   size_t ret = 0;
 872   GNUTLS_ALG_LOOP (ret = p->iv);
 873   return ret;
 874
 875 }
 876
 877 int
 878 _gnutls_cipher_get_export_flag (gnutls_cipher_algorithm_t algorithm)
 879 {                               /* In bytes */
 880   size_t ret = 0;
 881   GNUTLS_ALG_LOOP (ret = p->export_flag);
 882   return ret;
 883
 884 }
 885
 886 /**
 887  * gnutls_cipher_get_name - Returns a string with the name of the specified cipher algorithm
 888  * @algorithm: is an encryption algorithm
 889  *
 890  * Convert a #gnutls_cipher_algorithm_t type to a string.
 891  *
 892  * Returns: a pointer to a string that contains the name of the
 893  *   specified cipher, or %NULL.
 894  **/
 895 const char *
 896 gnutls_cipher_get_name (gnutls_cipher_algorithm_t algorithm)
 897 {
 898   const char *ret = NULL;
 899
 900   /* avoid prefix */
 901   GNUTLS_ALG_LOOP (ret = p->name);
 902
 903   return ret;
 904 }
 905
 906 /**
 907  * gnutls_cipher_get_id - Returns the gnutls id of the specified in string algorithm
 908  * @name: is a MAC algorithm name
 909  *
 910  * The names are compared in a case insensitive way.
 911  *
 912  * Returns: return a #gnutls_cipher_algorithm_t value corresponding to
 913  *   the specified cipher, or %GNUTLS_CIPHER_UNKNOWN on error.
 914  **/
 915 gnutls_cipher_algorithm_t
 916 gnutls_cipher_get_id (const char *name)
 917 {
 918   gnutls_cipher_algorithm_t ret = GNUTLS_CIPHER_UNKNOWN;
 919
 920   GNUTLS_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id);
 921
 922   return ret;
 923 }
 924
 925 /**
 926  * gnutls_cipher_list - Get a list of supported ciphers
 927  *
 928  * Get a list of supported cipher algorithms.  Note that not
 929  * necessarily all ciphers are supported as TLS cipher suites.  For
 930  * example, DES is not supported as a cipher suite, but is supported
 931  * for other purposes (e.g., PKCS#8 or similar).
 932  *
 933  * Returns: a zero-terminated list of #gnutls_cipher_algorithm_t
 934  *   integers indicating the available ciphers.
 935  *
 936  **/
 937 const gnutls_cipher_algorithm_t *
 938 gnutls_cipher_list (void)
 939 {
 940   return supported_ciphers;
 941 }
 942
 943 int
 944 _gnutls_cipher_is_ok (gnutls_cipher_algorithm_t algorithm)
 945 {
 946   ssize_t ret = -1;
 947   GNUTLS_ALG_LOOP (ret = p->id);
 948   if (ret >= 0)
 949     ret = 0;
 950   else
 951     ret = 1;
 952   return ret;
 953 }
 954
 955 /* Key EXCHANGE functions */
 956 mod_auth_st *
 957 _gnutls_kx_auth_struct (gnutls_kx_algorithm_t algorithm)
 958 {
 959   mod_auth_st *ret = NULL;
 960   GNUTLS_KX_ALG_LOOP (ret = p->auth_struct);
 961   return ret;
 962
 963 }
 964
 965
 966 int
 967 _gnutls_kx_priority (gnutls_session_t session,
 968                      gnutls_kx_algorithm_t algorithm)
 969 {
 970   unsigned int i;
 971   for (i = 0; i < session->internals.priorities.kx.algorithms; i++)
 972     {
 973       if (session->internals.priorities.kx.priority[i] == algorithm)
 974         return i;
 975     }
 976   return -1;
 977 }
 978
 979 /**
 980  * gnutls_kx_get_name - Returns a string with the name of the specified key exchange algorithm
 981  * @algorithm: is a key exchange algorithm
 982  *
 983  * Convert a #gnutls_kx_algorithm_t value to a string.
 984  *
 985  * Returns: a pointer to a string that contains the name of the
 986  *   specified key exchange algorithm, or %NULL.
 987  **/
 988 const char *
 989 gnutls_kx_get_name (gnutls_kx_algorithm_t algorithm)
 990 {
 991   const char *ret = NULL;
 992
 993   /* avoid prefix */
 994   GNUTLS_KX_ALG_LOOP (ret = p->name);
 995
 996   return ret;
 997 }
 998
 999 /**
1000  * gnutls_kx_get_id - Returns the gnutls id of the specified in string algorithm
1001  * @name: is a KX name
1002  *
1003  * Convert a string to a #gnutls_kx_algorithm_t value.  The names are
1004  * compared in a case insensitive way.
1005  *
1006  * Returns: an id of the specified KX algorithm, or %GNUTLS_KX_UNKNOWN
1007  *   on error.
1008  **/
1009 gnutls_kx_algorithm_t
1010 gnutls_kx_get_id (const char *name)
1011 {
1012   gnutls_cipher_algorithm_t ret = GNUTLS_KX_UNKNOWN;
1013
1014   GNUTLS_KX_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->algorithm);
1015
1016   return ret;
1017 }
1018
1019 /**
1020  * gnutls_kx_list - Get a list of supported key exchange methods
1021  *
1022  * Get a list of supported key exchange algorithms.
1023  *
1024  * Returns: a zero-terminated list of #gnutls_kx_algorithm_t integers
1025  * indicating the available key exchange algorithms.
1026  **/
1027 const gnutls_kx_algorithm_t *
1028 gnutls_kx_list (void)
1029 {
1030   return supported_kxs;
1031 }
1032
1033 int
1034 _gnutls_kx_is_ok (gnutls_kx_algorithm_t algorithm)
1035 {
1036   ssize_t ret = -1;
1037   GNUTLS_KX_ALG_LOOP (ret = p->algorithm);
1038   if (ret >= 0)
1039     ret = 0;
1040   else
1041     ret = 1;
1042   return ret;
1043 }
1044
1045 int
1046 _gnutls_kx_needs_rsa_params (gnutls_kx_algorithm_t algorithm)
1047 {
1048   ssize_t ret = 0;
1049   GNUTLS_KX_ALG_LOOP (ret = p->needs_rsa_params);
1050   return ret;
1051 }
1052
1053 int
1054 _gnutls_kx_needs_dh_params (gnutls_kx_algorithm_t algorithm)
1055 {
1056   ssize_t ret = 0;
1057   GNUTLS_KX_ALG_LOOP (ret = p->needs_dh_params);
1058   return ret;
1059 }
1060
1061
1062 /* Version */
1063 int
1064 _gnutls_version_priority (gnutls_session_t session, gnutls_protocol_t version)
1065 {                               /* actually returns the priority */
1066   unsigned int i;
1067
1068   for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
1069     {
1070       if (session->internals.priorities.protocol.priority[i] == version)
1071         return i;
1072     }
1073   return -1;
1074 }
1075
1076 gnutls_protocol_t
1077 _gnutls_version_lowest (gnutls_session_t session)
1078 {                               /* returns the lowest version supported */
1079   unsigned int i, min = 0xff;
1080
1081   for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
1082     {
1083       if (session->internals.priorities.protocol.priority[i] < min)
1084         min = session->internals.priorities.protocol.priority[i];
1085     }
1086
1087   if (min == 0xff)
1088     return GNUTLS_VERSION_UNKNOWN;      /* unknown version */
1089
1090   return min;
1091 }
1092
1093 gnutls_protocol_t
1094 _gnutls_version_max (gnutls_session_t session)
1095 {                               /* returns the maximum version supported */
1096   unsigned int i, max = 0x00;
1097
1098   for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
1099     {
1100       if (session->internals.priorities.protocol.priority[i] > max)
1101         max = session->internals.priorities.protocol.priority[i];
1102     }
1103
1104   if (max == 0x00)
1105     return GNUTLS_VERSION_UNKNOWN;      /* unknown version */
1106
1107   return max;
1108 }
1109
1110
1111 /**
1112  * gnutls_protocol_get_name - Returns a string with the name of the specified SSL/TLS version
1113  * @version: is a (gnutls) version number
1114  *
1115  * Convert a #gnutls_protocol_t value to a string.
1116  *
1117  * Returns: a string that contains the name of the specified TLS
1118  *   version (e.g., "TLS1.0"), or %NULL.
1119  **/
1120 const char *
1121 gnutls_protocol_get_name (gnutls_protocol_t version)
1122 {
1123   const char *ret = NULL;
1124
1125   /* avoid prefix */
1126   GNUTLS_VERSION_ALG_LOOP (ret = p->name);
1127   return ret;
1128 }
1129
1130 /**
1131  * gnutls_protocol_get_id - Returns the gnutls id of the specified in string protocol
1132  * @name: is a protocol name
1133  *
1134  * The names are compared in a case insensitive way.
1135  *
1136  * Returns: an id of the specified protocol, or
1137  * %GNUTLS_VERSION_UNKNOWN on error.
1138  **/
1139 gnutls_protocol_t
1140 gnutls_protocol_get_id (const char *name)
1141 {
1142   gnutls_protocol_t ret = GNUTLS_VERSION_UNKNOWN;
1143
1144   GNUTLS_VERSION_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id);
1145
1146   return ret;
1147 }
1148
1149 /**
1150  * gnutls_protocol_list - Get a list of supported protocols
1151  *
1152  * Get a list of supported protocols, e.g. SSL 3.0, TLS 1.0 etc.
1153  *
1154  * Returns: a zero-terminated list of #gnutls_protocol_t integers
1155  * indicating the available protocols.
1156  *
1157  **/
1158 const gnutls_protocol_t *
1159 gnutls_protocol_list (void)
1160 {
1161   return supported_protocols;
1162 }
1163
1164 int
1165 _gnutls_version_get_minor (gnutls_protocol_t version)
1166 {
1167   int ret = -1;
1168
1169   GNUTLS_VERSION_ALG_LOOP (ret = p->minor);
1170   return ret;
1171 }
1172
1173 gnutls_protocol_t
1174 _gnutls_version_get (int major, int minor)
1175 {
1176   int ret = -1;
1177
1178   GNUTLS_VERSION_LOOP (if ((p->major == major) && (p->minor == minor))
1179                        ret = p->id);
1180   return ret;
1181 }
1182
1183 int
1184 _gnutls_version_get_major (gnutls_protocol_t version)
1185 {
1186   int ret = -1;
1187
1188   GNUTLS_VERSION_ALG_LOOP (ret = p->major);
1189   return ret;
1190 }
1191
1192 /* Version Functions */
1193
1194 int
1195 _gnutls_version_is_supported (gnutls_session_t session,
1196                               const gnutls_protocol_t version)
1197 {
1198   int ret = 0;
1199
1200   GNUTLS_VERSION_ALG_LOOP (ret = p->supported);
1201   if (ret == 0)
1202     return 0;
1203
1204   if (_gnutls_version_priority (session, version) < 0)
1205     return 0;                   /* disabled by the user */
1206   else
1207     return 1;
1208 }
1209
1210
1211 /* This function determines if the version specified has a
1212    cipher-suite selected PRF hash function instead of the old
1213    hardcoded MD5+SHA1. */
1214 int
1215 _gnutls_version_has_selectable_prf (gnutls_protocol_t version)
1216 {
1217   return version == GNUTLS_TLS1_2;
1218 }
1219
1220 /* This function determines if the version specified has selectable
1221    signature/hash functions for certificate authentification. */
1222 int
1223 _gnutls_version_has_selectable_sighash (gnutls_protocol_t version)
1224 {
1225   return version == GNUTLS_TLS1_2;
1226 }
1227
1228 /* This function determines if the version specified has support for
1229    TLS extensions. */
1230 int
1231 _gnutls_version_has_extensions (gnutls_protocol_t version)
1232 {
1233   switch (version)
1234     {
1235     case GNUTLS_TLS1_0:
1236     case GNUTLS_TLS1_1:
1237     case GNUTLS_TLS1_2:
1238       return 1;
1239     default:
1240       return 0;
1241     }
1242 }
1243
1244 /* This function determines if the version specified has explicit IVs
1245    (for CBC attack prevention). */
1246 int
1247 _gnutls_version_has_explicit_iv (gnutls_protocol_t version)
1248 {
1249   switch (version)
1250     {
1251     case GNUTLS_TLS1_1:
1252     case GNUTLS_TLS1_2:
1253       return 1;
1254     default:
1255       return 0;
1256     }
1257 }
1258
1259 /* This function determines if the version specified can have
1260    non-minimal padding. */
1261 int
1262 _gnutls_version_has_variable_padding (gnutls_protocol_t version)
1263 {
1264   switch (version)
1265     {
1266     case GNUTLS_TLS1_0:
1267     case GNUTLS_TLS1_1:
1268     case GNUTLS_TLS1_2:
1269       return 1;
1270     default:
1271       return 0;
1272     }
1273 }
1274
1275 /* Type to KX mappings */
1276 gnutls_kx_algorithm_t
1277 _gnutls_map_kx_get_kx (gnutls_credentials_type_t type, int server)
1278 {
1279   gnutls_kx_algorithm_t ret = -1;
1280
1281   if (server)
1282     {
1283       GNUTLS_KX_MAP_ALG_LOOP_SERVER (ret = p->algorithm);
1284     }
1285   else
1286     {
1287       GNUTLS_KX_MAP_ALG_LOOP_SERVER (ret = p->algorithm);
1288     }
1289   return ret;
1290 }
1291
1292 gnutls_credentials_type_t
1293 _gnutls_map_kx_get_cred (gnutls_kx_algorithm_t algorithm, int server)
1294 {
1295   gnutls_credentials_type_t ret = -1;
1296   if (server)
1297     {
1298       GNUTLS_KX_MAP_LOOP (if (p->algorithm == algorithm) ret =
1299                           p->server_type);
1300     }
1301   else
1302     {
1303       GNUTLS_KX_MAP_LOOP (if (p->algorithm == algorithm) ret =
1304                           p->client_type);
1305     }
1306
1307   return ret;
1308 }
1309
1310
1311 /* Cipher Suite's functions */
1312 gnutls_cipher_algorithm_t
1313 _gnutls_cipher_suite_get_cipher_algo (const cipher_suite_st * suite)
1314 {
1315   int ret = 0;
1316   GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->block_algorithm);
1317   return ret;
1318 }
1319
1320 gnutls_protocol_t
1321 _gnutls_cipher_suite_get_version (const cipher_suite_st * suite)
1322 {
1323   int ret = 0;
1324   GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->version);
1325   return ret;
1326 }
1327
1328 gnutls_kx_algorithm_t
1329 _gnutls_cipher_suite_get_kx_algo (const cipher_suite_st * suite)
1330 {
1331   int ret = 0;
1332
1333   GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->kx_algorithm);
1334   return ret;
1335
1336 }
1337
1338 gnutls_mac_algorithm_t
1339 _gnutls_cipher_suite_get_mac_algo (const cipher_suite_st * suite)
1340 {                               /* In bytes */
1341   int ret = 0;
1342   GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->mac_algorithm);
1343   return ret;
1344
1345 }
1346
1347 const char *
1348 _gnutls_cipher_suite_get_name (cipher_suite_st * suite)
1349 {
1350   const char *ret = NULL;
1351
1352   /* avoid prefix */
1353   GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->name + sizeof ("GNUTLS_") - 1);
1354
1355   return ret;
1356 }
1357
1358 /**
1359  * gnutls_cipher_suite_get_name - get name of the specified cipher suite
1360  * @kx_algorithm: is a Key exchange algorithm
1361  * @cipher_algorithm: is a cipher algorithm
1362  * @mac_algorithm: is a MAC algorithm
1363  *
1364  * Note that the full cipher suite name must be prepended by TLS or
1365  * SSL depending of the protocol in use.
1366  *
1367  * Returns: a string that contains the name of a TLS cipher suite,
1368  * specified by the given algorithms, or %NULL.
1369  **/
1370 const char *
1371 gnutls_cipher_suite_get_name (gnutls_kx_algorithm_t kx_algorithm,
1372                               gnutls_cipher_algorithm_t cipher_algorithm,
1373                               gnutls_mac_algorithm_t mac_algorithm)
1374 {
1375   const char *ret = NULL;
1376
1377   /* avoid prefix */
1378   GNUTLS_CIPHER_SUITE_LOOP (if (kx_algorithm == p->kx_algorithm &&
1379                                 cipher_algorithm == p->block_algorithm &&
1380                                 mac_algorithm == p->mac_algorithm)
1381                             ret = p->name + sizeof ("GNUTLS_") - 1);
1382
1383   return ret;
1384 }
1385
1386 /**
1387  * gnutls_cipher_suite_info:
1388  * @idx: index of cipher suite to get information about, starts on 0.
1389  * @cs_id: output buffer with room for 2 bytes, indicating cipher suite value
1390  * @kx: output variable indicating key exchange algorithm, or %NULL.
1391  * @cipher: output variable indicating cipher, or %NULL.
1392  * @mac: output variable indicating MAC algorithm, or %NULL.
1393  * @version: output variable indicating TLS protocol version, or %NULL.
1394  *
1395  * Get information about supported cipher suites.  Use the function
1396  * iteratively to get information about all supported cipher suites.
1397  * Call with idx=0 to get information about first cipher suite, then
1398  * idx=1 and so on until the function returns NULL.
1399  *
1400  * Returns: the name of @idx cipher suite, and set the information
1401  * about the cipher suite in the output variables.  If @idx is out of
1402  * bounds, %NULL is returned.
1403  **/
1404 const char *
1405 gnutls_cipher_suite_info (size_t idx,
1406                           char *cs_id,
1407                           gnutls_kx_algorithm_t * kx,
1408                           gnutls_cipher_algorithm_t * cipher,
1409                           gnutls_mac_algorithm_t * mac,
1410                           gnutls_protocol_t * version)
1411 {
1412   if (idx >= CIPHER_SUITES_COUNT)
1413     return NULL;
1414
1415   if (cs_id)
1416     memcpy (cs_id, cs_algorithms[idx].id.suite, 2);
1417   if (kx)
1418     *kx = cs_algorithms[idx].kx_algorithm;
1419   if (cipher)
1420     *cipher = cs_algorithms[idx].block_algorithm;
1421   if (mac)
1422     *mac = cs_algorithms[idx].mac_algorithm;
1423   if (version)
1424     *version = cs_algorithms[idx].version;
1425
1426   return cs_algorithms[idx].name + sizeof ("GNU") - 1;
1427 }
1428
1429
1430 static inline int
1431 _gnutls_cipher_suite_is_ok (cipher_suite_st * suite)
1432 {
1433   size_t ret;
1434   const char *name = NULL;
1435
1436   GNUTLS_CIPHER_SUITE_ALG_LOOP (name = p->name);
1437   if (name != NULL)
1438     ret = 0;
1439   else
1440     ret = 1;
1441   return ret;
1442
1443 }
1444
1445 #define SWAP(x, y) memcpy(tmp,x,size); \
1446                    memcpy(x,y,size); \
1447                    memcpy(y,tmp,size);
1448
1449 #define MAX_ELEM_SIZE 4
1450 static inline int
1451 _gnutls_partition (gnutls_session_t session, void *_base,
1452                    size_t nmemb, size_t size,
1453                    int (*compar) (gnutls_session_t,
1454                                   const void *, const void *))
1455 {
1456   uint8_t *base = _base;
1457   uint8_t tmp[MAX_ELEM_SIZE];
1458   uint8_t ptmp[MAX_ELEM_SIZE];
1459   unsigned int pivot;
1460   unsigned int i, j;
1461   unsigned int full;
1462
1463   i = pivot = 0;
1464   j = full = (nmemb - 1) * size;
1465
1466   memcpy (ptmp, &base[0], size);        /* set pivot item */
1467
1468   while (i < j)
1469     {
1470       while ((compar (session, &base[i], ptmp) <= 0) && (i < full))
1471         {
1472           i += size;
1473         }
1474       while ((compar (session, &base[j], ptmp) >= 0) && (j > 0))
1475         j -= size;
1476
1477       if (i < j)
1478         {
1479           SWAP (&base[j], &base[i]);
1480         }
1481     }
1482
1483   if (j > pivot)
1484     {
1485       SWAP (&base[pivot], &base[j]);
1486       pivot = j;
1487     }
1488   else if (i < pivot)
1489     {
1490       SWAP (&base[pivot], &base[i]);
1491       pivot = i;
1492     }
1493   return pivot / size;
1494 }
1495
1496 static void
1497 _gnutls_qsort (gnutls_session_t session, void *_base, size_t nmemb,
1498                size_t size, int (*compar) (gnutls_session_t, const void *,
1499                                            const void *))
1500 {
1501   unsigned int pivot;
1502   char *base = _base;
1503   size_t snmemb = nmemb;
1504
1505 #ifdef DEBUG
1506   if (size > MAX_ELEM_SIZE)
1507     {
1508       gnutls_assert ();
1509       _gnutls_debug_log ("QSORT BUG\n");
1510       exit (1);
1511     }
1512 #endif
1513
1514   if (snmemb <= 1)
1515     return;
1516   pivot = _gnutls_partition (session, _base, nmemb, size, compar);
1517
1518   _gnutls_qsort (session, base, pivot < nmemb ? pivot + 1 : pivot, size,
1519                  compar);
1520   _gnutls_qsort (session, &base[(pivot + 1) * size], nmemb - pivot - 1,
1521                  size, compar);
1522 }
1523
1524
1525 /* a compare function for KX algorithms (using priorities).
1526  * For use with qsort
1527  */
1528 static int
1529 _gnutls_compare_algo (gnutls_session_t session, const void *i_A1,
1530                       const void *i_A2)
1531 {
1532   gnutls_kx_algorithm_t kA1 =
1533     _gnutls_cipher_suite_get_kx_algo ((const cipher_suite_st *) i_A1);
1534   gnutls_kx_algorithm_t kA2 =
1535     _gnutls_cipher_suite_get_kx_algo ((const cipher_suite_st *) i_A2);
1536   gnutls_cipher_algorithm_t cA1 =
1537     _gnutls_cipher_suite_get_cipher_algo ((const cipher_suite_st *) i_A1);
1538   gnutls_cipher_algorithm_t cA2 =
1539     _gnutls_cipher_suite_get_cipher_algo ((const cipher_suite_st *) i_A2);
1540   gnutls_mac_algorithm_t mA1 =
1541     _gnutls_cipher_suite_get_mac_algo ((const cipher_suite_st *) i_A1);
1542   gnutls_mac_algorithm_t mA2 =
1543     _gnutls_cipher_suite_get_mac_algo ((const cipher_suite_st *) i_A2);
1544
1545   int p1 = (_gnutls_kx_priority (session, kA1) + 1) * 64;
1546   int p2 = (_gnutls_kx_priority (session, kA2) + 1) * 64;
1547   p1 += (_gnutls_cipher_priority (session, cA1) + 1) * 8;
1548   p2 += (_gnutls_cipher_priority (session, cA2) + 1) * 8;
1549   p1 += _gnutls_mac_priority (session, mA1);
1550   p2 += _gnutls_mac_priority (session, mA2);
1551
1552   if (p1 > p2)
1553     {
1554       return 1;
1555     }
1556   else
1557     {
1558       if (p1 == p2)
1559         {
1560           return 0;
1561         }
1562       return -1;
1563     }
1564 }
1565
1566 #ifdef SORT_DEBUG
1567 static void
1568 _gnutls_bsort (gnutls_session_t session, void *_base, size_t nmemb,
1569                size_t size, int (*compar) (gnutls_session_t, const void *,
1570                                            const void *))
1571 {
1572   unsigned int i, j;
1573   int full = nmemb * size;
1574   char *base = _base;
1575   char tmp[MAX_ELEM_SIZE];
1576
1577   for (i = 0; i < full; i += size)
1578     {
1579       for (j = 0; j < full; j += size)
1580         {
1581           if (compar (session, &base[i], &base[j]) < 0)
1582             {
1583               SWAP (&base[j], &base[i]);
1584             }
1585         }
1586     }
1587
1588 }
1589 #endif
1590
1591 int
1592 _gnutls_supported_ciphersuites_sorted (gnutls_session_t session,
1593                                        cipher_suite_st ** ciphers)
1594 {
1595
1596 #ifdef SORT_DEBUG
1597   unsigned int i;
1598 #endif
1599   int count;
1600
1601   count = _gnutls_supported_ciphersuites (session, ciphers);
1602   if (count <= 0)
1603     {
1604       gnutls_assert ();
1605       return count;
1606     }
1607 #ifdef SORT_DEBUG
1608   _gnutls_debug_log ("Unsorted: \n");
1609   for (i = 0; i < count; i++)
1610     _gnutls_debug_log ("\t%d: %s\n", i,
1611                        _gnutls_cipher_suite_get_name ((*ciphers)[i]));
1612 #endif
1613
1614   _gnutls_qsort (session, *ciphers, count,
1615                  sizeof (cipher_suite_st), _gnutls_compare_algo);
1616
1617 #ifdef SORT_DEBUG
1618   _gnutls_debug_log ("Sorted: \n");
1619   for (i = 0; i < count; i++)
1620     _gnutls_debug_log ("\t%d: %s\n", i,
1621                        _gnutls_cipher_suite_get_name ((*ciphers)[i]));
1622 #endif
1623
1624   return count;
1625 }
1626
1627 int
1628 _gnutls_supported_ciphersuites (gnutls_session_t session,
1629                                 cipher_suite_st ** _ciphers)
1630 {
1631
1632   unsigned int i, ret_count, j;
1633   unsigned int count = CIPHER_SUITES_COUNT;
1634   cipher_suite_st *tmp_ciphers;
1635   cipher_suite_st *ciphers;
1636   gnutls_protocol_t version;
1637
1638   if (count == 0)
1639     {
1640       return 0;
1641     }
1642
1643   tmp_ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
1644   if (tmp_ciphers == NULL)
1645     return GNUTLS_E_MEMORY_ERROR;
1646
1647   ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
1648   if (ciphers == NULL)
1649     {
1650       gnutls_free (tmp_ciphers);
1651       return GNUTLS_E_MEMORY_ERROR;
1652     }
1653
1654   version = gnutls_protocol_get_version (session);
1655
1656   for (i = 0; i < count; i++)
1657     {
1658       memcpy (&tmp_ciphers[i], &cs_algorithms[i].id,
1659               sizeof (cipher_suite_st));
1660     }
1661
1662   for (i = j = 0; i < count; i++)
1663     {
1664       /* remove private cipher suites, if requested.
1665        */
1666       if (tmp_ciphers[i].suite[0] == 0xFF &&
1667           session->internals.enable_private == 0)
1668         continue;
1669
1670       /* remove cipher suites which do not support the
1671        * protocol version used.
1672        */
1673       if (_gnutls_cipher_suite_get_version (&tmp_ciphers[i]) > version)
1674         continue;
1675
1676       if (_gnutls_kx_priority
1677           (session, _gnutls_cipher_suite_get_kx_algo (&tmp_ciphers[i])) < 0)
1678         continue;
1679       if (_gnutls_mac_priority
1680           (session, _gnutls_cipher_suite_get_mac_algo (&tmp_ciphers[i])) < 0)
1681         continue;
1682       if (_gnutls_cipher_priority
1683           (session,
1684            _gnutls_cipher_suite_get_cipher_algo (&tmp_ciphers[i])) < 0)
1685         continue;
1686
1687       memcpy (&ciphers[j], &tmp_ciphers[i], sizeof (cipher_suite_st));
1688       j++;
1689     }
1690
1691   ret_count = j;
1692
1693 #if 0                           /* expensive */
1694   if (ret_count > 0 && ret_count != count)
1695     {
1696       ciphers =
1697         gnutls_realloc_fast (ciphers, ret_count * sizeof (cipher_suite_st));
1698     }
1699   else
1700     {
1701       if (ret_count != count)
1702         {
1703           gnutls_free (ciphers);
1704           ciphers = NULL;
1705         }
1706     }
1707 #endif
1708
1709   gnutls_free (tmp_ciphers);
1710
1711   /* This function can no longer return 0 cipher suites.
1712    * It returns an error code instead.
1713    */
1714   if (ret_count == 0)
1715     {
1716       gnutls_assert ();
1717       gnutls_free (ciphers);
1718       return GNUTLS_E_NO_CIPHER_SUITES;
1719     }
1720   *_ciphers = ciphers;
1721   return ret_count;
1722 }
1723
1724 /**
1725  * gnutls_certificate_type_get_name - Returns a string with the name of the specified certificate type
1726  * @type: is a certificate type
1727  *
1728  * Convert a #gnutls_certificate_type_t type to a string.
1729  *
1730  * Returns: a string that contains the name of the specified
1731  *   certificate type, or %NULL in case of unknown types.
1732  **/
1733 const char *
1734 gnutls_certificate_type_get_name (gnutls_certificate_type_t type)
1735 {
1736   const char *ret = NULL;
1737
1738   if (type == GNUTLS_CRT_X509)
1739     ret = "X.509";
1740   if (type == GNUTLS_CRT_OPENPGP)
1741     ret = "OPENPGP";
1742
1743   return ret;
1744 }
1745
1746 /**
1747  * gnutls_certificate_type_get_id - Returns the gnutls id of the specified in string type
1748  * @name: is a certificate type name
1749  *
1750  * The names are compared in a case insensitive way.
1751  *
1752  * Returns: a #gnutls_certificate_type_t for the specified in a
1753  *   string certificate type, or %GNUTLS_CRT_UNKNOWN on error.
1754  **/
1755 gnutls_certificate_type_t
1756 gnutls_certificate_type_get_id (const char *name)
1757 {
1758   gnutls_certificate_type_t ret = GNUTLS_CRT_UNKNOWN;
1759
1760   if (strcasecmp (name, "X.509") == 0 || strcasecmp (name, "X509") == 0)
1761     return GNUTLS_CRT_X509;
1762   if (strcasecmp (name, "OPENPGP") == 0)
1763     return GNUTLS_CRT_OPENPGP;
1764
1765   return ret;
1766 }
1767
1768 static const gnutls_certificate_type_t supported_certificate_types[] = {
1769   GNUTLS_CRT_X509,
1770   GNUTLS_CRT_OPENPGP,
1771   0
1772 };
1773
1774 /**
1775  * gnutls_certificate_type_list - Get a list of supported certificate types
1776  *
1777  * Get a list of certificate types.  Note that to be able to use
1778  * OpenPGP certificates, you must link to libgnutls-extra and call
1779  * gnutls_global_init_extra().
1780  *
1781  * Returns: a zero-terminated list of #gnutls_certificate_type_t
1782  *   integers indicating the available certificate types.
1783  **/
1784 const gnutls_certificate_type_t *
1785 gnutls_certificate_type_list (void)
1786 {
1787   return supported_certificate_types;
1788 }
1789
1790 /* returns the gnutls_pk_algorithm_t which is compatible with
1791  * the given gnutls_kx_algorithm_t.
1792  */
1793 gnutls_pk_algorithm_t
1794 _gnutls_map_pk_get_pk (gnutls_kx_algorithm_t kx_algorithm)
1795 {
1796   gnutls_pk_algorithm_t ret = -1;
1797
1798   GNUTLS_PK_MAP_ALG_LOOP (ret = p->pk_algorithm) return ret;
1799 }
1800
1801 /* Returns the encipher type for the given key exchange algorithm.
1802  * That one of CIPHER_ENCRYPT, CIPHER_SIGN, CIPHER_IGN.
1803  *
1804  * ex. GNUTLS_KX_RSA requires a certificate able to encrypt... so returns CIPHER_ENCRYPT.
1805  */
1806 enum encipher_type
1807 _gnutls_kx_encipher_type (gnutls_kx_algorithm_t kx_algorithm)
1808 {
1809   int ret = CIPHER_IGN;
1810   GNUTLS_PK_MAP_ALG_LOOP (ret = p->encipher_type) return ret;
1811
1812 }
1813
1814 /* signature algorithms;
1815  */
1816 struct gnutls_sign_entry
1817 {
1818   const char *name;
1819   const char *oid;
1820   gnutls_sign_algorithm_t id;
1821   gnutls_pk_algorithm_t pk;
1822   gnutls_mac_algorithm_t mac;
1823   /* See RFC 5246 HashAlgorithm and SignatureAlgorithm
1824      for values to use in aid struct. */
1825   sign_algorithm_st aid;
1826 };
1827 typedef struct gnutls_sign_entry gnutls_sign_entry;
1828
1829 #define TLS_SIGN_AID_UNKNOWN {255, 255}
1830
1831 static const gnutls_sign_entry sign_algorithms[] = {
1832   {"RSA-SHA1", SIG_RSA_SHA1_OID, GNUTLS_SIGN_RSA_SHA1, GNUTLS_PK_RSA,
1833    GNUTLS_MAC_SHA1, {2, 1}},
1834   {"RSA-SHA256", SIG_RSA_SHA256_OID, GNUTLS_SIGN_RSA_SHA256, GNUTLS_PK_RSA,
1835    GNUTLS_MAC_SHA256, {4, 1}},
1836   {"RSA-SHA384", SIG_RSA_SHA384_OID, GNUTLS_SIGN_RSA_SHA384, GNUTLS_PK_RSA,
1837    GNUTLS_MAC_SHA384, {5, 1}},
1838   {"RSA-SHA512", SIG_RSA_SHA512_OID, GNUTLS_SIGN_RSA_SHA512, GNUTLS_PK_RSA,
1839    GNUTLS_MAC_SHA512, {6, 1}},
1840   {"RSA-RMD160", SIG_RSA_RMD160_OID, GNUTLS_SIGN_RSA_RMD160, GNUTLS_PK_RSA,
1841    GNUTLS_MAC_RMD160, TLS_SIGN_AID_UNKNOWN},
1842   {"DSA-SHA1", SIG_DSA_SHA1_OID, GNUTLS_SIGN_DSA_SHA1, GNUTLS_PK_DSA,
1843    GNUTLS_MAC_SHA1, {2, 2}},
1844   {"RSA-MD5", SIG_RSA_MD5_OID, GNUTLS_SIGN_RSA_MD5, GNUTLS_PK_RSA,
1845    GNUTLS_MAC_MD5, {1, 1}},
1846   {"RSA-MD2", SIG_RSA_MD2_OID, GNUTLS_SIGN_RSA_MD2, GNUTLS_PK_RSA,
1847    GNUTLS_MAC_MD2, TLS_SIGN_AID_UNKNOWN},
1848   {"GOST R 34.10-2001", SIG_GOST_R3410_2001_OID, 0, 0, 0,
1849    TLS_SIGN_AID_UNKNOWN},
1850   {"GOST R 34.10-94", SIG_GOST_R3410_94_OID, 0, 0, 0, TLS_SIGN_AID_UNKNOWN},
1851   {0, 0, 0, 0, 0, TLS_SIGN_AID_UNKNOWN}
1852 };
1853
1854 /* Keep the contents of this struct the same as the previous one. */
1855 static const gnutls_sign_algorithm_t supported_sign[] = {
1856   GNUTLS_SIGN_RSA_SHA1,
1857   GNUTLS_SIGN_RSA_SHA256,
1858   GNUTLS_SIGN_RSA_SHA384,
1859   GNUTLS_SIGN_RSA_SHA512,
1860   GNUTLS_SIGN_RSA_RMD160,
1861   GNUTLS_SIGN_DSA_SHA1,
1862   GNUTLS_SIGN_RSA_MD5,
1863   GNUTLS_SIGN_RSA_MD2,
1864   0
1865 };
1866
1867 #define GNUTLS_SIGN_LOOP(b) \
1868   do {                                                                 \
1869     const gnutls_sign_entry *p;                                        \
1870     for(p = sign_algorithms; p->name != NULL; p++) { b ; }             \
1871   } while (0)
1872
1873 #define GNUTLS_SIGN_ALG_LOOP(a) \
1874   GNUTLS_SIGN_LOOP( if(p->id && p->id == sign) { a; break; } )
1875
1876 /**
1877  * gnutls_sign_algorithm_get_name - Returns a string with the name of the specified sign algorithm
1878  * @sign: is a sign algorithm
1879  *
1880  * Convert a #gnutls_sign_algorithm_t value to a string.
1881  *
1882  * Returns: a string that contains the name of the specified sign
1883  *   algorithm, or %NULL.
1884  **/
1885 const char *
1886 gnutls_sign_algorithm_get_name (gnutls_sign_algorithm_t sign)
1887 {
1888   const char *ret = NULL;
1889
1890   /* avoid prefix */
1891   GNUTLS_SIGN_ALG_LOOP (ret = p->name);
1892
1893   return ret;
1894 }
1895
1896 /**
1897  * gnutls_sign_list - Get a list of supported public key signature algorithms
1898  *
1899  * Get a list of supported public key signature algorithms.
1900  *
1901  * Returns: a zero-terminated list of #gnutls_sign_algorithm_t
1902  *   integers indicating the available ciphers.
1903  *
1904  **/
1905 const gnutls_sign_algorithm_t *
1906 gnutls_sign_list (void)
1907 {
1908   return supported_sign;
1909 }
1910
1911 /**
1912  * gnutls_sign_get_id - Returns the gnutls id of the specified in signature algorithm
1913  * @name: is a MAC algorithm name
1914  *
1915  * The names are compared in a case insensitive way.
1916  *
1917  * Returns: return a #gnutls_sign_algorithm_t value corresponding to
1918  *   the specified cipher, or %GNUTLS_SIGN_UNKNOWN on error.
1919  **/
1920 gnutls_sign_algorithm_t
1921 gnutls_sign_get_id (const char *name)
1922 {
1923   gnutls_sign_algorithm_t ret = GNUTLS_SIGN_UNKNOWN;
1924
1925   GNUTLS_SIGN_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id);
1926
1927   return ret;
1928
1929 }
1930
1931 /**
1932  * gnutls_sign_get_name - Get name string for a #gnutls_sign_algorithm_t
1933  * @algorithm: is a public key signature algorithm
1934  *
1935  * Convert a #gnutls_sign_algorithm_t value to a string.
1936  *
1937  * Returns: a pointer to a string that contains the name of the
1938  *   specified public key signature algorithm, or %NULL.
1939  *
1940  * Since: 2.6.0
1941  **/
1942 const char *
1943 gnutls_sign_get_name (gnutls_sign_algorithm_t algorithm)
1944 {
1945   const char *ret = "SIGN_UNKNOWN";
1946
1947   GNUTLS_SIGN_LOOP (if (p->id == algorithm) ret = p->name);
1948
1949   return ret;
1950 }
1951
1952 gnutls_sign_algorithm_t
1953 _gnutls_x509_oid2sign_algorithm (const char *oid)
1954 {
1955   gnutls_sign_algorithm_t ret = 0;
1956
1957   GNUTLS_SIGN_LOOP (if (strcmp (oid, p->oid) == 0)
1958                     {
1959                     ret = p->id; break;}
1960   );
1961
1962   if (ret == 0)
1963     {
1964       _gnutls_x509_log ("Unknown SIGN OID: '%s'\n", oid);
1965       return GNUTLS_SIGN_UNKNOWN;
1966     }
1967   return ret;
1968 }
1969
1970 gnutls_sign_algorithm_t
1971 _gnutls_x509_pk_to_sign (gnutls_pk_algorithm_t pk, gnutls_mac_algorithm_t mac)
1972 {
1973   gnutls_sign_algorithm_t ret = 0;
1974
1975   GNUTLS_SIGN_LOOP (if (pk == p->pk && mac == p->mac)
1976                     {
1977                     ret = p->id; break;}
1978   );
1979
1980   if (ret == 0)
1981     return GNUTLS_SIGN_UNKNOWN;
1982   return ret;
1983 }
1984
1985 const char *
1986 _gnutls_x509_sign_to_oid (gnutls_pk_algorithm_t pk,
1987                           gnutls_mac_algorithm_t mac)
1988 {
1989   gnutls_sign_algorithm_t sign;
1990   const char *ret = NULL;
1991
1992   sign = _gnutls_x509_pk_to_sign (pk, mac);
1993   if (sign == GNUTLS_SIGN_UNKNOWN)
1994     return NULL;
1995
1996   GNUTLS_SIGN_ALG_LOOP (ret = p->oid);
1997   return ret;
1998 }
1999
2000 gnutls_mac_algorithm_t
2001 _gnutls_sign_get_hash_algorithm (gnutls_sign_algorithm_t sign)
2002 {
2003   gnutls_mac_algorithm_t ret = GNUTLS_DIG_UNKNOWN;
2004
2005   GNUTLS_SIGN_ALG_LOOP (ret = p->mac);
2006
2007   return ret;
2008 }
2009
2010 gnutls_pk_algorithm_t
2011 _gnutls_sign_get_pk_algorithm (gnutls_sign_algorithm_t sign)
2012 {
2013   gnutls_pk_algorithm_t ret = GNUTLS_PK_UNKNOWN;
2014
2015   GNUTLS_SIGN_ALG_LOOP (ret = p->pk);
2016
2017   return ret;
2018 }
2019
2020 gnutls_sign_algorithm_t
2021 _gnutls_tls_aid_to_sign (const sign_algorithm_st * aid)
2022 {
2023   gnutls_sign_algorithm_t ret = GNUTLS_SIGN_UNKNOWN;
2024
2025   GNUTLS_SIGN_LOOP (if (p->aid.hash_algorithm == aid->hash_algorithm
2026                         && p->aid.sign_algorithm == aid->sign_algorithm)
2027                     {
2028                     ret = p->id; break;}
2029   );
2030
2031   return ret;
2032 }
2033
2034 sign_algorithm_st
2035 _gnutls_sign_to_tls_aid (gnutls_sign_algorithm_t sign)
2036 {
2037   sign_algorithm_st ret = TLS_SIGN_AID_UNKNOWN;
2038
2039   GNUTLS_SIGN_ALG_LOOP (ret = p->aid);
2040
2041   return ret;
2042 }
2043
2044
2045
2046 /* pk algorithms;
2047  */
2048 struct gnutls_pk_entry
2049 {
2050   const char *name;
2051   const char *oid;
2052   gnutls_pk_algorithm_t id;
2053 };
2054 typedef struct gnutls_pk_entry gnutls_pk_entry;
2055
2056 static const gnutls_pk_entry pk_algorithms[] = {
2057   {"RSA", PK_PKIX1_RSA_OID, GNUTLS_PK_RSA},
2058   {"DSA", PK_DSA_OID, GNUTLS_PK_DSA},
2059   {"GOST R 34.10-2001", PK_GOST_R3410_2001_OID, 0},
2060   {"GOST R 34.10-94", PK_GOST_R3410_94_OID, 0},
2061   {0, 0, 0}
2062 };
2063
2064 /**
2065  * gnutls_pk_algorithm_get_name - Get string with name of public key algorithm
2066  * @algorithm: is a pk algorithm
2067  *
2068  * Convert a #gnutls_pk_algorithm_t value to a string.
2069  *
2070  * Returns: a string that contains the name of the specified public
2071  *   key algorithm, or %NULL.
2072  **/
2073 const char *
2074 gnutls_pk_algorithm_get_name (gnutls_pk_algorithm_t algorithm)
2075 {
2076   const char *ret = NULL;
2077   const gnutls_pk_entry *p;
2078
2079   for (p = pk_algorithms; p->name != NULL; p++)
2080     if (p->id && p->id == algorithm)
2081       {
2082         ret = p->name;
2083         break;
2084       }
2085
2086   return ret;
2087 }
2088
2089 /**
2090  * gnutls_pk_list - Get a list of supported public key algorithms
2091  *
2092  * Get a list of supported public key algorithms.
2093  *
2094  * Returns: a zero-terminated list of #gnutls_pk_algorithm_t integers
2095  *   indicating the available ciphers.
2096  *
2097  * Since: 2.6.0
2098  **/
2099 const gnutls_pk_algorithm_t *
2100 gnutls_pk_list (void)
2101 {
2102   static const gnutls_pk_algorithm_t supported_pks[] = {
2103     GNUTLS_PK_RSA,
2104     GNUTLS_PK_DSA,
2105     0
2106   };
2107
2108   return supported_pks;
2109 }
2110
2111 /**
2112  * gnutls_pk_get_id - Get #gnutls_pk_algorithm_t from a string
2113  * @name: is a string containing a public key algorithm name.
2114  *
2115  * Convert a string to a #gnutls_pk_algorithm_t value.  The names are
2116  * compared in a case insensitive way.  For example,
2117  * gnutls_pk_get_id("RSA") will return %GNUTLS_PK_RSA.
2118  *
2119  * Returns: a #gnutls_pk_algorithm_t id of the specified public key
2120  *   algorithm string, or %GNUTLS_PK_UNKNOWN on failures.
2121  *
2122  * Since: 2.6.0
2123  **/
2124 gnutls_pk_algorithm_t
2125 gnutls_pk_get_id (const char *name)
2126 {
2127   if (strcasecmp (name, "RSA") == 0)
2128     return GNUTLS_PK_RSA;
2129   else if (strcasecmp (name, "DSA") == 0)
2130     return GNUTLS_PK_DSA;
2131
2132   return GNUTLS_PK_UNKNOWN;
2133 }
2134
2135 /**
2136  * gnutls_pk_get_name - Get name string with #gnutls_pk_algorithm_t algorithm
2137  * @algorithm: is a public key algorithm
2138  *
2139  * Convert a #gnutls_pk_algorithm_t value to a string.
2140  *
2141  * Returns: a pointer to a string that contains the name of the
2142  *   specified public key algorithm, or %NULL.
2143  *
2144  * Since: 2.6.0
2145  **/
2146 const char *
2147 gnutls_pk_get_name (gnutls_pk_algorithm_t algorithm)
2148 {
2149   const char *p;
2150
2151   switch (algorithm)
2152     {
2153     case GNUTLS_PK_RSA:
2154       p = "RSA";
2155       break;
2156
2157     case GNUTLS_PK_DSA:
2158       p = "DSA";
2159       break;
2160
2161     default:
2162     case GNUTLS_PK_UNKNOWN:
2163       p = "PK_UNKNOWN";
2164       break;
2165     }
2166
2167   return p;
2168 }
2169
2170 gnutls_pk_algorithm_t
2171 _gnutls_x509_oid2pk_algorithm (const char *oid)
2172 {
2173   gnutls_pk_algorithm_t ret = GNUTLS_PK_UNKNOWN;
2174   const gnutls_pk_entry *p;
2175
2176   for (p = pk_algorithms; p->name != NULL; p++)
2177     if (strcmp (p->oid, oid) == 0)
2178       {
2179         ret = p->id;
2180         break;
2181       }
2182
2183   return ret;
2184 }
2185
2186 const char *
2187 _gnutls_x509_pk_to_oid (gnutls_pk_algorithm_t algorithm)
2188 {
2189   const char *ret = NULL;
2190   const gnutls_pk_entry *p;
2191
2192   for (p = pk_algorithms; p->name != NULL; p++)
2193     if (p->id == algorithm)
2194       {
2195         ret = p->oid;
2196         break;
2197       }
2198
2199   return ret;
2200 }