Commit 31fd10e6 authored by Matt Caswell's avatar Matt Caswell
Browse files

Fix DTLSv1_listen following state machine changes 



Adding the new state machine broke the DTLSv1_listen code because
calling SSL_in_before() was erroneously returning true after DTLSv1_listen
had successfully completed. This change ensures that SSL_in_before returns
false.

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent 91eac8d5

ssl/d1_lib.c

+5 −2
Original line number Diff line number Diff line
@@ -872,8 +872,11 @@ int dtls1_listen(SSL *s, struct sockaddr *client) 
     */

    SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE);



    /* Put us into the "init" state so that we don't get our state cleared */

    ossl_statem_set_in_init(s, 1);

    /*

     * Tell the state machine that we've done the initial hello verify

     * exchange

     */

    ossl_statem_set_hello_verify_done(s);



    if(BIO_dgram_get_peer(rbio, client) <= 0) {

        SSLerr(SSL_F_DTLS1_LISTEN, ERR_R_INTERNAL_ERROR);

ssl/statem/statem.c

+14 −0
Original line number Diff line number Diff line
@@ -187,6 +187,20 @@ void ossl_statem_set_in_init(SSL *s, int init) 
    s->statem.in_init = init;

}



void ossl_statem_set_hello_verify_done(SSL *s)

{

    s->statem.state = MSG_FLOW_UNINITED;

    s->statem.in_init = 1;

    /*

     * This will get reset (briefly) back to TLS_ST_BEFORE when we enter

     * state_machine() because |state| is MSG_FLOW_UNINITED, but until then any

     * calls to SSL_in_before() will return false. Also calls to

     * SSL_state_string() and SSL_state_string_long() will return something

     * sensible.

     */

    s->statem.hand_state = TLS_ST_SR_CLNT_HELLO;

}



int ossl_statem_connect(SSL *s) {

    return state_machine(s, 0);

}

ssl/statem/statem.h

+1 −0
Original line number Diff line number Diff line
@@ -161,6 +161,7 @@ void ossl_statem_set_renegotiate(SSL *s); 
void ossl_statem_set_error(SSL *s);

int ossl_statem_in_error(const SSL *s);

void ossl_statem_set_in_init(SSL *s, int init);

void ossl_statem_set_hello_verify_done(SSL *s);

__owur int ossl_statem_app_data_allowed(SSL *s);

#ifndef OPENSSL_NO_SCTP

void ossl_statem_set_sctp_read_sock(SSL *s, int read_sock);