Commit 67556483 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

New option to enable/disable connection to unpatched servers

parent 2456cd58

CHANGES

+5 −0
Original line number Diff line number Diff line
@@ -828,6 +828,11 @@ 


 Changes between 0.9.8l (?) and 0.9.8m (?)  [xx XXX xxxx]

  

  *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to

     connect (but not renegotiate) with servers which do not support RI.

     Until RI is more widely deployed this option is enabled by default.

     [Steve Henson]



  *) Add "missing" ssl ctrls to clear options and mode.

     [Steve Henson]

apps/s_client.c

+8 −1
Original line number Diff line number Diff line
@@ -382,7 +382,7 @@ int MAIN(int, char **); 


int MAIN(int argc, char **argv)

	{

	int off=0;

	unsigned int off=0, clr=0;

	SSL *con=NULL;

	int s,k,width,state=0;

	char *cbuf=NULL,*sbuf=NULL,*mbuf=NULL;
@@ -661,6 +661,10 @@ int MAIN(int argc, char **argv) 
			off|=SSL_OP_CIPHER_SERVER_PREFERENCE;

		else if (strcmp(*argv,"-legacy_renegotiation") == 0)

			off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;

		else if	(strcmp(*argv,"-legacy_server_connect") == 0)

			{ off|=SSL_OP_LEGACY_SERVER_CONNECT; }

		else if	(strcmp(*argv,"-no_legacy_server_connect") == 0)

			{ clr|=SSL_OP_LEGACY_SERVER_CONNECT; }

		else if	(strcmp(*argv,"-cipher") == 0)

			{

			if (--argc < 1) goto bad;
@@ -871,6 +875,9 @@ bad: 
		SSL_CTX_set_options(ctx,SSL_OP_ALL|off);

	else

		SSL_CTX_set_options(ctx,off);



	if (clr)

		SSL_CTX_clear_options(ctx, clr);

	/* DTLS: partial reads end up discarding unread UDP bytes :-( 

	 * Setting read ahead solves this problem.

	 */

crypto/evp/evp.h

+2 −0
Original line number Diff line number Diff line
@@ -1289,6 +1289,8 @@ void ERR_load_EVP_strings(void); 
#define EVP_R_PRIVATE_KEY_DECODE_ERROR			 145

#define EVP_R_PRIVATE_KEY_ENCODE_ERROR			 146

#define EVP_R_PUBLIC_KEY_NOT_RSA			 106

#define EVP_R_UNKNOWN_CIPHER				 160

#define EVP_R_UNKNOWN_DIGEST				 161

#define EVP_R_UNKNOWN_PBE_ALGORITHM			 121

#define EVP_R_UNSUPORTED_NUMBER_OF_ROUNDS		 135

#define EVP_R_UNSUPPORTED_ALGORITHM			 156

crypto/evp/evp_err.c

+4 −2
Original line number Diff line number Diff line 
/* crypto/evp/evp_err.c */

/* ====================================================================

 * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.

 * Copyright (c) 1999-2009 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions
@@ -85,7 +85,7 @@ static ERR_STRING_DATA EVP_str_functs[]= 
{ERR_FUNC(EVP_F_EVP_DIGESTINIT_EX),	"EVP_DigestInit_ex"},

{ERR_FUNC(EVP_F_EVP_ENCRYPTFINAL_EX),	"EVP_EncryptFinal_ex"},

{ERR_FUNC(EVP_F_EVP_MD_CTX_COPY_EX),	"EVP_MD_CTX_copy_ex"},

{ERR_FUNC(EVP_F_EVP_MD_SIZE),	"EVP_MD_SIZE"},

{ERR_FUNC(EVP_F_EVP_MD_SIZE),	"EVP_MD_size"},

{ERR_FUNC(EVP_F_EVP_OPENINIT),	"EVP_OpenInit"},

{ERR_FUNC(EVP_F_EVP_PBE_ALG_ADD),	"EVP_PBE_alg_add"},

{ERR_FUNC(EVP_F_EVP_PBE_ALG_ADD_TYPE),	"EVP_PBE_alg_add_type"},
@@ -185,6 +185,8 @@ static ERR_STRING_DATA EVP_str_reasons[]= 
{ERR_REASON(EVP_R_PRIVATE_KEY_DECODE_ERROR),"private key decode error"},

{ERR_REASON(EVP_R_PRIVATE_KEY_ENCODE_ERROR),"private key encode error"},

{ERR_REASON(EVP_R_PUBLIC_KEY_NOT_RSA)    ,"public key not rsa"},

{ERR_REASON(EVP_R_UNKNOWN_CIPHER)        ,"unknown cipher"},

{ERR_REASON(EVP_R_UNKNOWN_DIGEST)        ,"unknown digest"},

{ERR_REASON(EVP_R_UNKNOWN_PBE_ALGORITHM) ,"unknown pbe algorithm"},

{ERR_REASON(EVP_R_UNSUPORTED_NUMBER_OF_ROUNDS),"unsuported number of rounds"},

{ERR_REASON(EVP_R_UNSUPPORTED_ALGORITHM) ,"unsupported algorithm"},

crypto/evp/evp_pbe.c

+14 −0
Original line number Diff line number Diff line
@@ -174,12 +174,26 @@ int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen, 
	if (cipher_nid == -1)

		cipher = NULL;

	else

		{

		cipher = EVP_get_cipherbynid(cipher_nid);

		if (!cipher)

			{

			EVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_CIPHER);

			return 0;

			}

		}



	if (md_nid == -1)

		md = NULL;

	else

		{

		md = EVP_get_digestbynid(md_nid);

		if (!md)

			{

			EVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_DIGEST);

			return 0;

			}

		}



	if (!keygen(ctx, pass, passlen, param, cipher, md, en_de))

		{