Commit 0a89c575 authored by Andy Polyakov's avatar Andy Polyakov
Browse files

Make ChangeCipherSpec compliant with DTLS RFC4347. From HEAD with a twist: 

server interoperates with non-compliant pre-0.9.8f.
parent 4c860910

ssl/d1_both.c

+8 −4
Original line number Diff line number Diff line
@@ -816,9 +816,14 @@ int dtls1_send_change_cipher_spec(SSL *s, int a, int b) 
		*p++=SSL3_MT_CCS;

		s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;

		s->d1->next_handshake_write_seq++;

		s->init_num=DTLS1_CCS_HEADER_LENGTH;



		if (s->client_version == DTLS1_BAD_VER)

			{

			s2n(s->d1->handshake_write_seq,p);

			s->init_num+=2;

			}



		s->init_num=DTLS1_CCS_HEADER_LENGTH;

		s->init_off=0;



		dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
@@ -1056,7 +1061,7 @@ dtls1_buffer_message(SSL *s, int is_ccs) 
    if ( is_ccs)

        {

        OPENSSL_assert(s->d1->w_msg_hdr.msg_len + 

            DTLS1_CCS_HEADER_LENGTH == (unsigned int)s->init_num);

            DTLS1_CCS_HEADER_LENGTH <= (unsigned int)s->init_num);

        }

    else

        {
@@ -1259,5 +1264,4 @@ dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr) 
    memset(ccs_hdr, 0x00, sizeof(struct ccs_header_st));

    

    ccs_hdr->type = *(data++);

    n2s(data, ccs_hdr->seq);

}

ssl/d1_pkt.c

+29 −36
Original line number Diff line number Diff line
@@ -979,12 +979,11 @@ start: 


		dtls1_get_ccs_header(rr->data, &ccs_hdr);



		if ( ccs_hdr.seq == s->d1->handshake_read_seq)

			{

		/* 'Change Cipher Spec' is just a single byte, so we know

		 * exactly what the record payload has to look like */

		/* XDTLS: check that epoch is consistent */

			if (	(rr->length != DTLS1_CCS_HEADER_LENGTH) || 

		if (	(s->client_version == DTLS1_BAD_VER && rr->length != 3) ||

			(s->client_version != DTLS1_BAD_VER && rr->length != DTLS1_CCS_HEADER_LENGTH) || 

			(rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))

			{

			i=SSL_AD_ILLEGAL_PARAMETER;
@@ -1010,12 +1009,6 @@ start: 


		goto start;

		}

		else

			{

			rr->length = 0;

			goto start;

			}

		}



	/* Unexpected handshake message (Client Hello, or protocol violation) */

	if ((s->d1->handshake_fragment_len >= DTLS1_HM_HEADER_LENGTH) &&