test/cipherlist_test.c:185: error: BUFFER_OVERRUN_L1
  Offset: [9, +oo] (⇐ [0, +oo] + 9) Size: 8 by call to `SSL_CTX_set_cipher_list`.
Showing all 13 steps of the trace


test/cipherlist_test.c:185:5: Call
183.   {
184.       SETUP_CIPHERLIST_TEST_FIXTURE();
185.       TEST_check(SSL_CTX_set_cipher_list(fixture.server, "DEFAULT"));
           ^
186.       TEST_check(SSL_CTX_set_cipher_list(fixture.client, "DEFAULT"));
187.       EXECUTE_CIPHERLIST_TEST();

ssl/ssl_lib.c:2276:1: Parameter `*str`
  2274.   
  2275.   /** specify the ciphers to be used by default by the SSL_CTX */
  2276. > int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
  2277.   {
  2278.       STACK_OF(SSL_CIPHER) *sk;

ssl/ssl_lib.c:2280:10: Call
  2278.       STACK_OF(SSL_CIPHER) *sk;
  2279.   
  2280.       sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,
                   ^
  2281.                                   &ctx->cipher_list_by_id, str, ctx->cert);
  2282.       /*

ssl/ssl_ciph.c:1258:1: Parameter `*rule_str`
    1256.   #endif
    1257.   
    1258. > STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)
    1259.                                                **cipher_list, STACK_OF(SSL_CIPHER)
    1260.                                                **cipher_list_by_id,

ssl/ssl_ciph.c:1276:10: Call
    1274.           return NULL;
    1275.   #ifndef OPENSSL_NO_EC
    1276.       if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))
                     ^
    1277.           return NULL;
    1278.   #endif

ssl/ssl_ciph.c:1204:1: Parameter `**prule_str`
      1202.   
      1203.   #ifndef OPENSSL_NO_EC
      1204. > static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
      1205.                                       const char **prule_str)
      1206.   {

ssl/ssl_ciph.c:1429:5: Assignment
    1427.        */
    1428.       ok = 1;
    1429.       rule_p = rule_str;
                ^
    1430.       if (strncmp(rule_str, "DEFAULT", 7) == 0) {
    1431.           ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,

ssl/ssl_ciph.c:1439:14: Call
    1437.   
    1438.       if (ok && (strlen(rule_p) > 0))
    1439.           ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);
                         ^
    1440.   
    1441.       OPENSSL_free(ca_list);      /* Not needed anymore */

ssl/ssl_ciph.c:948:1: <Length trace>
946.   }
947.   
948. > static int ssl_cipher_process_rulestr(const char *rule_str,
949.                                         CIPHER_ORDER **head_p,
950.                                         CIPHER_ORDER **tail_p,

ssl/ssl_ciph.c:948:1: Parameter `*rule_str`
      946.   }
      947.   
      948. > static int ssl_cipher_process_rulestr(const char *rule_str,
      949.                                         CIPHER_ORDER **head_p,
      950.                                         CIPHER_ORDER **tail_p,

ssl/ssl_ciph.c:961:5: Assignment
      959.   
      960.       retval = 1;
      961.       l = rule_str;
                 ^
      962.       for (;;) {
      963.           ch = *l;

ssl/ssl_ciph.c:997:13: Assignment
      995.           for (;;) {
      996.               ch = *l;
      997.               buf = l;
                          ^
      998.               buflen = 0;
      999.   #ifndef CHARSET_EBCDIC

ssl/ssl_ciph.c:1167:29: Array access: Offset: [9, +oo] (⇐ [0, +oo] + 9) Size: 8 by call to `SSL_CTX_set_cipher_list` 
      1165.                   ok = ssl_cipher_strength_sort(head_p, tail_p);
      1166.               else if (buflen == 10 && strncmp(buf, "SECLEVEL=", 9) == 0) {
      1167.                   int level = buf[9] - '0';
                                          ^
      1168.                   if (level < 0 || level > 5) {
      1169.                       SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,

static int ssl_cipher_process_rulestr(const char *rule_str,
                                      CIPHER_ORDER **head_p,
                                      CIPHER_ORDER **tail_p,
                                      const SSL_CIPHER **ca_list, CERT *c)
{
    uint32_t alg_mkey, alg_auth, alg_enc, alg_mac, algo_strength;
    int min_tls;
    const char *l, *buf;
    int j, multi, found, rule, retval, ok, buflen;
    uint32_t cipher_id = 0;
    char ch;
    retval = 1;
    l = rule_str;
    for (;;) {
        ch = *l;
        if (ch == '\0')
            break;
        if (ch == '-') {
            rule = CIPHER_DEL;
            l++;
        } else if (ch == '+') {
            rule = CIPHER_ORD;
            l++;
        } else if (ch == '!') {
            rule = CIPHER_KILL;
            l++;
        } else if (ch == '@') {
            rule = CIPHER_SPECIAL;
            l++;
        } else {
            rule = CIPHER_ADD;
        }
        if (ITEM_SEP(ch)) {
            l++;
            continue;
        }
        alg_mkey = 0;
        alg_auth = 0;
        alg_enc = 0;
        alg_mac = 0;
        min_tls = 0;
        algo_strength = 0;
        for (;;) {
            ch = *l;
            buf = l;
            buflen = 0;
#ifndef CHARSET_EBCDIC
            while (((ch >= 'A') && (ch <= 'Z')) ||
                   ((ch >= '0') && (ch <= '9')) ||
                   ((ch >= 'a') && (ch <= 'z')) ||
                   (ch == '-') || (ch == '.') || (ch == '='))
#else
            while (isalnum(ch) || (ch == '-') || (ch == '.') || (ch == '='))
#endif
            {
                ch = *(++l);
                buflen++;
            }
            if (buflen == 0) {
                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND);
                retval = found = 0;
                l++;
                break;
            }
            if (rule == CIPHER_SPECIAL) {
                found = 0;
                break;
            }
            if (ch == '+') {
                multi = 1;
                l++;
            } else
                multi = 0;
            j = found = 0;
            cipher_id = 0;
            while (ca_list[j]) {
                if (strncmp(buf, ca_list[j]->name, buflen) == 0
                    && (ca_list[j]->name[buflen] == '\0')) {
                    found = 1;
                    break;
                } else
                    j++;
            }
            if (!found)
                break;
            if (ca_list[j]->algorithm_mkey) {
                if (alg_mkey) {
                    alg_mkey &= ca_list[j]->algorithm_mkey;
                    if (!alg_mkey) {
                        found = 0;
                        break;
                    }
                } else
                    alg_mkey = ca_list[j]->algorithm_mkey;
            }
            if (ca_list[j]->algorithm_auth) {
                if (alg_auth) {
                    alg_auth &= ca_list[j]->algorithm_auth;
                    if (!alg_auth) {
                        found = 0;
                        break;
                    }
                } else
                    alg_auth = ca_list[j]->algorithm_auth;
            }
            if (ca_list[j]->algorithm_enc) {
                if (alg_enc) {
                    alg_enc &= ca_list[j]->algorithm_enc;
                    if (!alg_enc) {
                        found = 0;
                        break;
                    }
                } else
                    alg_enc = ca_list[j]->algorithm_enc;
            }
            if (ca_list[j]->algorithm_mac) {
                if (alg_mac) {
                    alg_mac &= ca_list[j]->algorithm_mac;
                    if (!alg_mac) {
                        found = 0;
                        break;
                    }
                } else
                    alg_mac = ca_list[j]->algorithm_mac;
            }
            if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {
                if (algo_strength & SSL_STRONG_MASK) {
                    algo_strength &=
                        (ca_list[j]->algo_strength & SSL_STRONG_MASK) |
                        ~SSL_STRONG_MASK;
                    if (!(algo_strength & SSL_STRONG_MASK)) {
                        found = 0;
                        break;
                    }
                } else
                    algo_strength = ca_list[j]->algo_strength & SSL_STRONG_MASK;
            }
            if (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) {
                if (algo_strength & SSL_DEFAULT_MASK) {
                    algo_strength &=
                        (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) |
                        ~SSL_DEFAULT_MASK;
                    if (!(algo_strength & SSL_DEFAULT_MASK)) {
                        found = 0;
                        break;
                    }
                } else
                    algo_strength |=
                        ca_list[j]->algo_strength & SSL_DEFAULT_MASK;
            }
            if (ca_list[j]->valid) {
                cipher_id = ca_list[j]->id;
            } else {
                if (ca_list[j]->min_tls) {
                    if (min_tls != 0 && min_tls != ca_list[j]->min_tls) {
                        found = 0;
                        break;
                    } else {
                        min_tls = ca_list[j]->min_tls;
                    }
                }
            }
            if (!multi)
                break;
        }
        if (rule == CIPHER_SPECIAL) {
            ok = 0;
            if ((buflen == 8) && strncmp(buf, "STRENGTH", 8) == 0)
                ok = ssl_cipher_strength_sort(head_p, tail_p);
            else if (buflen == 10 && strncmp(buf, "SECLEVEL=", 9) == 0) {
                int level = buf[9] - '0';
                if (level < 0 || level > 5) {
                    SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
                           SSL_R_INVALID_COMMAND);
                } else {
                    c->sec_level = level;
                    ok = 1;
                }
            } else
                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND);
            if (ok == 0)
                retval = 0;
            while ((*l != '\0') && !ITEM_SEP(*l))
                l++;
        } else if (found) {
            ssl_cipher_apply_rule(cipher_id,
                                  alg_mkey, alg_auth, alg_enc, alg_mac,
                                  min_tls, algo_strength, rule, -1, head_p,
                                  tail_p);
        } else {
            while ((*l != '\0') && !ITEM_SEP(*l))
                l++;
        }
        if (*l == '\0')
            break;
    }
    return (retval);
}
['static int test_default_cipherlist_explicit()\n{\n    SETUP_CIPHERLIST_TEST_FIXTURE();\n    TEST_check(SSL_CTX_set_cipher_list(fixture.server, "DEFAULT"));\n    TEST_check(SSL_CTX_set_cipher_list(fixture.client, "DEFAULT"));\n    EXECUTE_CIPHERLIST_TEST();\n}', 'int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)\n{\n    STACK_OF(SSL_CIPHER) *sk;\n    sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,\n                                &ctx->cipher_list_by_id, str, ctx->cert);\n    if (sk == NULL)\n        return 0;\n    else if (sk_SSL_CIPHER_num(sk) == 0) {\n        SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);\n        return 0;\n    }\n    return 1;\n}', 'STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)\n                                             **cipher_list, STACK_OF(SSL_CIPHER)\n                                             **cipher_list_by_id,\n                                             const char *rule_str, CERT *c)\n{\n    int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;\n    uint32_t disabled_mkey, disabled_auth, disabled_enc, disabled_mac;\n    STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;\n    const char *rule_p;\n    CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;\n    const SSL_CIPHER **ca_list = NULL;\n    if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)\n        return NULL;\n#ifndef OPENSSL_NO_EC\n    if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))\n        return NULL;\n#endif\n    disabled_mkey = disabled_mkey_mask;\n    disabled_auth = disabled_auth_mask;\n    disabled_enc = disabled_enc_mask;\n    disabled_mac = disabled_mac_mask;\n    num_of_ciphers = ssl_method->num_ciphers();\n    co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);\n    if (co_list == NULL) {\n        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,\n                               disabled_mkey, disabled_auth, disabled_enc,\n                               disabled_mac, co_list, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD,\n                          -1, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_AESGCM, 0, 0, 0, CIPHER_ADD, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20, 0, 0, 0, CIPHER_ADD, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD,\n                          -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    if (!ssl_cipher_strength_sort(&head, &tail)) {\n        OPENSSL_free(co_list);\n        return NULL;\n    }\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, TLS1_2_VERSION, 0, CIPHER_BUMP, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_AEAD, 0, 0, CIPHER_BUMP, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, 0, 0, 0,\n                          CIPHER_BUMP, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, SSL_AEAD, 0, 0,\n                          CIPHER_BUMP, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n    num_of_group_aliases = OSSL_NELEM(cipher_aliases);\n    num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;\n    ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);\n    if (ca_list == NULL) {\n        OPENSSL_free(co_list);\n        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,\n                               disabled_mkey, disabled_auth, disabled_enc,\n                               disabled_mac, head);\n    ok = 1;\n    rule_p = rule_str;\n    if (strncmp(rule_str, "DEFAULT", 7) == 0) {\n        ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,\n                                        &head, &tail, ca_list, c);\n        rule_p += 7;\n        if (*rule_p == \':\')\n            rule_p++;\n    }\n    if (ok && (strlen(rule_p) > 0))\n        ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);\n    OPENSSL_free(ca_list);\n    if (!ok) {\n        OPENSSL_free(co_list);\n        return (NULL);\n    }\n    if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {\n        OPENSSL_free(co_list);\n        return (NULL);\n    }\n    for (curr = head; curr != NULL; curr = curr->next) {\n        if (curr->active) {\n            if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {\n                OPENSSL_free(co_list);\n                sk_SSL_CIPHER_free(cipherstack);\n                return NULL;\n            }\n#ifdef CIPHER_DEBUG\n            fprintf(stderr, "<%s>\\n", curr->cipher->name);\n#endif\n        }\n    }\n    OPENSSL_free(co_list);\n    tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);\n    if (tmp_cipher_list == NULL) {\n        sk_SSL_CIPHER_free(cipherstack);\n        return NULL;\n    }\n    sk_SSL_CIPHER_free(*cipher_list);\n    *cipher_list = cipherstack;\n    if (*cipher_list_by_id != NULL)\n        sk_SSL_CIPHER_free(*cipher_list_by_id);\n    *cipher_list_by_id = tmp_cipher_list;\n    (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);\n    sk_SSL_CIPHER_sort(*cipher_list_by_id);\n    return (cipherstack);\n}', 'static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,\n                                    const char **prule_str)\n{\n    unsigned int suiteb_flags = 0, suiteb_comb2 = 0;\n    if (strncmp(*prule_str, "SUITEB128ONLY", 13) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY;\n    } else if (strncmp(*prule_str, "SUITEB128C2", 11) == 0) {\n        suiteb_comb2 = 1;\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n    } else if (strncmp(*prule_str, "SUITEB128", 9) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n    } else if (strncmp(*prule_str, "SUITEB192", 9) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS;\n    }\n    if (suiteb_flags) {\n        c->cert_flags &= ~SSL_CERT_FLAG_SUITEB_128_LOS;\n        c->cert_flags |= suiteb_flags;\n    } else\n        suiteb_flags = c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS;\n    if (!suiteb_flags)\n        return 1;\n    if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)) {\n        SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST,\n               SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE);\n        return 0;\n    }\n# ifndef OPENSSL_NO_EC\n    switch (suiteb_flags) {\n    case SSL_CERT_FLAG_SUITEB_128_LOS:\n        if (suiteb_comb2)\n            *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n        else\n            *prule_str =\n                "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384";\n        break;\n    case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:\n        *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256";\n        break;\n    case SSL_CERT_FLAG_SUITEB_192_LOS:\n        *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n        break;\n    }\n    return 1;\n# else\n    SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE);\n    return 0;\n# endif\n}', 'static int ssl_cipher_process_rulestr(const char *rule_str,\n                                      CIPHER_ORDER **head_p,\n                                      CIPHER_ORDER **tail_p,\n                                      const SSL_CIPHER **ca_list, CERT *c)\n{\n    uint32_t alg_mkey, alg_auth, alg_enc, alg_mac, algo_strength;\n    int min_tls;\n    const char *l, *buf;\n    int j, multi, found, rule, retval, ok, buflen;\n    uint32_t cipher_id = 0;\n    char ch;\n    retval = 1;\n    l = rule_str;\n    for (;;) {\n        ch = *l;\n        if (ch == \'\\0\')\n            break;\n        if (ch == \'-\') {\n            rule = CIPHER_DEL;\n            l++;\n        } else if (ch == \'+\') {\n            rule = CIPHER_ORD;\n            l++;\n        } else if (ch == \'!\') {\n            rule = CIPHER_KILL;\n            l++;\n        } else if (ch == \'@\') {\n            rule = CIPHER_SPECIAL;\n            l++;\n        } else {\n            rule = CIPHER_ADD;\n        }\n        if (ITEM_SEP(ch)) {\n            l++;\n            continue;\n        }\n        alg_mkey = 0;\n        alg_auth = 0;\n        alg_enc = 0;\n        alg_mac = 0;\n        min_tls = 0;\n        algo_strength = 0;\n        for (;;) {\n            ch = *l;\n            buf = l;\n            buflen = 0;\n#ifndef CHARSET_EBCDIC\n            while (((ch >= \'A\') && (ch <= \'Z\')) ||\n                   ((ch >= \'0\') && (ch <= \'9\')) ||\n                   ((ch >= \'a\') && (ch <= \'z\')) ||\n                   (ch == \'-\') || (ch == \'.\') || (ch == \'=\'))\n#else\n            while (isalnum(ch) || (ch == \'-\') || (ch == \'.\') || (ch == \'=\'))\n#endif\n            {\n                ch = *(++l);\n                buflen++;\n            }\n            if (buflen == 0) {\n                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND);\n                retval = found = 0;\n                l++;\n                break;\n            }\n            if (rule == CIPHER_SPECIAL) {\n                found = 0;\n                break;\n            }\n            if (ch == \'+\') {\n                multi = 1;\n                l++;\n            } else\n                multi = 0;\n            j = found = 0;\n            cipher_id = 0;\n            while (ca_list[j]) {\n                if (strncmp(buf, ca_list[j]->name, buflen) == 0\n                    && (ca_list[j]->name[buflen] == \'\\0\')) {\n                    found = 1;\n                    break;\n                } else\n                    j++;\n            }\n            if (!found)\n                break;\n            if (ca_list[j]->algorithm_mkey) {\n                if (alg_mkey) {\n                    alg_mkey &= ca_list[j]->algorithm_mkey;\n                    if (!alg_mkey) {\n                        found = 0;\n                        break;\n                    }\n                } else\n                    alg_mkey = ca_list[j]->algorithm_mkey;\n            }\n            if (ca_list[j]->algorithm_auth) {\n                if (alg_auth) {\n                    alg_auth &= ca_list[j]->algorithm_auth;\n                    if (!alg_auth) {\n                        found = 0;\n                        break;\n                    }\n                } else\n                    alg_auth = ca_list[j]->algorithm_auth;\n            }\n            if (ca_list[j]->algorithm_enc) {\n                if (alg_enc) {\n                    alg_enc &= ca_list[j]->algorithm_enc;\n                    if (!alg_enc) {\n                        found = 0;\n                        break;\n                    }\n                } else\n                    alg_enc = ca_list[j]->algorithm_enc;\n            }\n            if (ca_list[j]->algorithm_mac) {\n                if (alg_mac) {\n                    alg_mac &= ca_list[j]->algorithm_mac;\n                    if (!alg_mac) {\n                        found = 0;\n                        break;\n                    }\n                } else\n                    alg_mac = ca_list[j]->algorithm_mac;\n            }\n            if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {\n                if (algo_strength & SSL_STRONG_MASK) {\n                    algo_strength &=\n                        (ca_list[j]->algo_strength & SSL_STRONG_MASK) |\n                        ~SSL_STRONG_MASK;\n                    if (!(algo_strength & SSL_STRONG_MASK)) {\n                        found = 0;\n                        break;\n                    }\n                } else\n                    algo_strength = ca_list[j]->algo_strength & SSL_STRONG_MASK;\n            }\n            if (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) {\n                if (algo_strength & SSL_DEFAULT_MASK) {\n                    algo_strength &=\n                        (ca_list[j]->algo_strength & SSL_DEFAULT_MASK) |\n                        ~SSL_DEFAULT_MASK;\n                    if (!(algo_strength & SSL_DEFAULT_MASK)) {\n                        found = 0;\n                        break;\n                    }\n                } else\n                    algo_strength |=\n                        ca_list[j]->algo_strength & SSL_DEFAULT_MASK;\n            }\n            if (ca_list[j]->valid) {\n                cipher_id = ca_list[j]->id;\n            } else {\n                if (ca_list[j]->min_tls) {\n                    if (min_tls != 0 && min_tls != ca_list[j]->min_tls) {\n                        found = 0;\n                        break;\n                    } else {\n                        min_tls = ca_list[j]->min_tls;\n                    }\n                }\n            }\n            if (!multi)\n                break;\n        }\n        if (rule == CIPHER_SPECIAL) {\n            ok = 0;\n            if ((buflen == 8) && strncmp(buf, "STRENGTH", 8) == 0)\n                ok = ssl_cipher_strength_sort(head_p, tail_p);\n            else if (buflen == 10 && strncmp(buf, "SECLEVEL=", 9) == 0) {\n                int level = buf[9] - \'0\';\n                if (level < 0 || level > 5) {\n                    SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,\n                           SSL_R_INVALID_COMMAND);\n                } else {\n                    c->sec_level = level;\n                    ok = 1;\n                }\n            } else\n                SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, SSL_R_INVALID_COMMAND);\n            if (ok == 0)\n                retval = 0;\n            while ((*l != \'\\0\') && !ITEM_SEP(*l))\n                l++;\n        } else if (found) {\n            ssl_cipher_apply_rule(cipher_id,\n                                  alg_mkey, alg_auth, alg_enc, alg_mac,\n                                  min_tls, algo_strength, rule, -1, head_p,\n                                  tail_p);\n        } else {\n            while ((*l != \'\\0\') && !ITEM_SEP(*l))\n                l++;\n        }\n        if (*l == \'\\0\')\n            break;\n    }\n    return (retval);\n}']