Bugfix: In ssl3_accept, don't use a local variable 'got_new_session' (8c74b5e5) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+13 −0

Original line number	Diff line number	Diff line
		@@ -12,6 +12,19 @@
		*) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
		+) applies to 0.9.7 only

		*) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
		ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
		variable as an indication that a ClientHello message has been
		received. As the flag value will be lost between multiple
		invocations of ssl3_accept when using non-blocking I/O, the
		function may not be aware that a handshake has actually taken
		place, thus preventing a new session from being added to the
		session cache.

		To avoid this problem, we now set s->new_session to 2 instead of
		using a local variable.
		[Lutz Jaenicke, Bodo Moeller]

		*) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
		if the SSL_R_LENGTH_MISMATCH error is detected.
		[Geoff Thorpe, Bodo Moeller]

ssl/s3_clnt.c

+53 −0

Original line number	Diff line number	Diff line
		@@ -55,6 +55,59 @@
		* copied and put under another distribution licence
		* [including the GNU Public Licence.]
		*/
		/* ====================================================================
		* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
		*
		* Redistribution and use in source and binary forms, with or without
		* modification, are permitted provided that the following conditions
		* are met:
		*
		* 1. Redistributions of source code must retain the above copyright
		* notice, this list of conditions and the following disclaimer.
		*
		* 2. Redistributions in binary form must reproduce the above copyright
		* notice, this list of conditions and the following disclaimer in
		* the documentation and/or other materials provided with the
		* distribution.
		*
		* 3. All advertising materials mentioning features or use of this
		* software must display the following acknowledgment:
		* "This product includes software developed by the OpenSSL Project
		* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
		*
		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
		* endorse or promote products derived from this software without
		* prior written permission. For written permission, please contact
		* openssl-core@openssl.org.
		*
		* 5. Products derived from this software may not be called "OpenSSL"
		* nor may "OpenSSL" appear in their names without prior written
		* permission of the OpenSSL Project.
		*
		* 6. Redistributions of any form whatsoever must retain the following
		* acknowledgment:
		* "This product includes software developed by the OpenSSL Project
		* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
		*
		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
		* OF THE POSSIBILITY OF SUCH DAMAGE.
		* ====================================================================
		*
		* This product includes cryptographic software written by Eric Young
		* (eay@cryptsoft.com). This product includes software written by Tim
		* Hudson (tjh@cryptsoft.com).
		*
		*/

		#include <stdio.h>
		#include <openssl/buffer.h>

ssl/s3_srvr.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -56,7 +56,7 @@
		* [including the GNU Public Licence.]
		*/
		/* ====================================================================
		* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
		* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
		*
		* Redistribution and use in source and binary forms, with or without
		* modification, are permitted provided that the following conditions
		@@ -168,7 +168,6 @@ int ssl3_accept(SSL *s)
		long num1;
		int ret= -1;
		int new_state,state,skip=0;
		int got_new_session=0;

		RAND_add(&Time,sizeof(Time),0);
		ERR_clear_error();
		@@ -281,7 +280,7 @@ int ssl3_accept(SSL *s)
		s->shutdown=0;
		ret=ssl3_get_client_hello(s);
		if (ret <= 0) goto end;
		got_new_session=1;
		s->new_session = 2;
		s->state=SSL3_ST_SW_SRVR_HELLO_A;
		s->init_num=0;
		break;
		@@ -524,7 +523,7 @@ int ssl3_accept(SSL *s)

		s->init_num=0;

		if (got_new_session) /* skipped if we just sent a HelloRequest */
		if (s->new_session == 2) /* skipped if we just sent a HelloRequest */
		{
		/* actually not necessarily a 'new' session unless
		* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */

ssl/ssl.h

+55 −0

Original line number	Diff line number	Diff line
		@@ -108,6 +108,59 @@
		* Hudson (tjh@cryptsoft.com).
		*
		*/
		/* ====================================================================
		* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
		*
		* Redistribution and use in source and binary forms, with or without
		* modification, are permitted provided that the following conditions
		* are met:
		*
		* 1. Redistributions of source code must retain the above copyright
		* notice, this list of conditions and the following disclaimer.
		*
		* 2. Redistributions in binary form must reproduce the above copyright
		* notice, this list of conditions and the following disclaimer in
		* the documentation and/or other materials provided with the
		* distribution.
		*
		* 3. All advertising materials mentioning features or use of this
		* software must display the following acknowledgment:
		* "This product includes software developed by the OpenSSL Project
		* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
		*
		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
		* endorse or promote products derived from this software without
		* prior written permission. For written permission, please contact
		* openssl-core@openssl.org.
		*
		* 5. Products derived from this software may not be called "OpenSSL"
		* nor may "OpenSSL" appear in their names without prior written
		* permission of the OpenSSL Project.
		*
		* 6. Redistributions of any form whatsoever must retain the following
		* acknowledgment:
		* "This product includes software developed by the OpenSSL Project
		* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
		*
		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
		* OF THE POSSIBILITY OF SUCH DAMAGE.
		* ====================================================================
		*
		* This product includes cryptographic software written by Eric Young
		* (eay@cryptsoft.com). This product includes software written by Tim
		* Hudson (tjh@cryptsoft.com).
		*
		*/

		#ifndef HEADER_SSL_H
		#define HEADER_SSL_H
		@@ -715,6 +768,8 @@ struct ssl_st
		int server; /* are we the server side? - mostly used by SSL_clear*/

		int new_session;/* 1 if we are to use a new session.
		* 2 if we are a server and are inside a handshake
		* (i.e. not just sending a HelloRequest)
		* NB: For servers, the 'new' session may actually be a previously
		* cached session or even the previous session unless
		* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION is set */

ssl/ssl_lib.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -890,8 +890,11 @@ int SSL_shutdown(SSL *s)
		}

		int SSL_renegotiate(SSL *s)
		{
		if (s->new_session == 0)
		{
		s->new_session=1;
		}
		return(s->method->ssl_renegotiate(s));
		}