Commit 6ad47e83 authored by Bodo Möller's avatar Bodo Möller
Browse files

improvements for alert handling

parent 241520e6

ssl/s23_clnt.c

+45 −51
Original line number Diff line number Diff line
@@ -542,7 +542,7 @@ static int ssl23_get_server_hello(SSL *s) 
			/* use special padding (SSL 3.0 draft/RFC 2246, App. E.2) */

			s->s2->ssl2_rollback=1;



		/* setup the 5 bytes we have read so we get them from

		/* setup the 7 bytes we have read so we get them from

		 * the sslv2 buffer */

		s->rstate=SSL_ST_READ_HEADER;

		s->packet_length=n;
@@ -558,28 +558,12 @@ static int ssl23_get_server_hello(SSL *s) 
		s->handshake_func=s->method->ssl_connect;

#endif

		}

	else if ((p[0] == SSL3_RT_HANDSHAKE) &&

		 (p[1] == SSL3_VERSION_MAJOR) &&

		 ((p[2] == SSL3_VERSION_MINOR) ||

		  (p[2] == TLS1_VERSION_MINOR)) &&

		 (p[5] == SSL3_MT_SERVER_HELLO))

	else if (p[1] == SSL3_VERSION_MAJOR &&

	         (p[2] == SSL3_VERSION_MINOR || p[2] == TLS1_VERSION_MINOR) &&

	         ((p[0] == SSL3_RT_HANDSHAKE && p[5] == SSL3_MT_SERVER_HELLO) ||

	          (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2)))

		{

		/* we have sslv3 or tls1 */

	have_sslv3_or_tls1:	



		if (!ssl_init_wbio_buffer(s,1)) goto err;



		/* we are in this state */

		s->state=SSL3_ST_CR_SRVR_HELLO_A;



		/* put the 5 bytes we have read into the input buffer

		 * for SSLv3 */

		s->rstate=SSL_ST_READ_HEADER;

		s->packet_length=n;

		s->packet= &(s->s3->rbuf.buf[0]);

		memcpy(s->packet,buf,n);

		s->s3->rbuf.left=n;

		s->s3->rbuf.offset=0;

		/* we have sslv3 or tls1 (server hello or alert) */



		if ((p[2] == SSL3_VERSION_MINOR) &&

			!(s->options & SSL_OP_NO_SSLv3))
@@ -599,19 +583,13 @@ static int ssl23_get_server_hello(SSL *s) 
			goto err;

			}



		s->handshake_func=s->method->ssl_connect;

		}

	else if ((p[0] == SSL3_RT_ALERT) &&

		 (p[1] == SSL3_VERSION_MAJOR) &&

		 ((p[2] == SSL3_VERSION_MINOR) ||

		  (p[2] == TLS1_VERSION_MINOR)) &&

		 (p[3] == 0) &&

		 (p[4] == 2))

		if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING)

			{

			/* fatal alert */



			void (*cb)(const SSL *ssl,int type,int val)=NULL;

			int j;



		/* An alert */

			if (s->info_callback != NULL)

				cb=s->info_callback;

			else if (s->ctx->info_callback != NULL)
@@ -624,13 +602,30 @@ static int ssl23_get_server_hello(SSL *s) 
				cb(s,SSL_CB_READ_ALERT,j);

				}

			

		if (p[5] == SSL3_AL_WARNING)

			goto have_sslv3_or_tls1;

			if (s->msg_callback)

				s->msg_callback(0, s->version, SSL3_RT_ALERT, p+5, 2, s, s->msg_callback_arg);



			s->rwstate=SSL_NOTHING;

			SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_AD_REASON_OFFSET+p[6]);

			goto err;

			}



		if (!ssl_init_wbio_buffer(s,1)) goto err;



		/* we are in this state */

		s->state=SSL3_ST_CR_SRVR_HELLO_A;



		/* put the 7 bytes we have read into the input buffer

		 * for SSLv3 */

		s->rstate=SSL_ST_READ_HEADER;

		s->packet_length=n;

		s->packet= &(s->s3->rbuf.buf[0]);

		memcpy(s->packet,buf,n);

		s->s3->rbuf.left=n;

		s->s3->rbuf.offset=0;



		s->handshake_func=s->method->ssl_connect;

		}

	else

		{

		SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNKNOWN_PROTOCOL);
@@ -648,4 +643,3 @@ static int ssl23_get_server_hello(SSL *s) 
err:

	return(-1);

	}

ssl/ssl_stat.c

+20 −0
Original line number Diff line number Diff line
@@ -399,6 +399,11 @@ const char *SSL_alert_desc_string(int value) 
	case TLS1_AD_INTERNAL_ERROR:		str="IE"; break;

	case TLS1_AD_USER_CANCELLED:		str="US"; break;

	case TLS1_AD_NO_RENEGOTIATION:		str="NR"; break;

	case TLS1_AD_UNSUPPORTED_EXTENSION:	str="UE"; break;

	case TLS1_AD_CERTIFICATE_UNOBTAINABLE:	str="CO"; break;

	case TLS1_AD_UNRECOGNIZED_NAME:		str="UN"; break;

	case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE: str="BR"; break;

	case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE: str="BH"; break;

	default:				str="UK"; break;

		}

	return(str);
@@ -482,6 +487,21 @@ const char *SSL_alert_desc_string_long(int value) 
	case TLS1_AD_NO_RENEGOTIATION:

		str="no renegotiation";

		break;

	case TLS1_AD_UNSUPPORTED_EXTENSION:

		str="unsupported extension";

		break;

	case TLS1_AD_CERTIFICATE_UNOBTAINABLE:

		str="certificate unobtainable";

		break;

	case TLS1_AD_UNRECOGNIZED_NAME:

		str="unrecognized name";

		break;

	case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE:

		str="bad certificate status response";

		break;

	case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE:

		str="bad certificate hash value";

		break;

	default: str="unknown"; break;

		}

	return(str);