Commit 96ec4ce0 authored by Bodo Möller's avatar Bodo Möller
Browse files

Assume TLS 1.0 if ClientHello fragment is too short.

parent 38b3e9ed

CHANGES

+9 −0
Original line number Diff line number Diff line
@@ -4,6 +4,15 @@ 


 Changes between 0.9.6b and 0.9.6c  [XX xxx XXXX]



  *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when

     faced with a pathologically small ClientHello fragment that does

     not contain client_version: Instead of aborting with an error,

     simply choose the highest available protocol version (i.e.,

     TLS 1.0 unless it is disabled).  In practice, ClientHello

     messages are never sent like this, but this change gives us

     strictly correct behaviour at least for TLS.

     [Bodo Moeller]



  *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()

     never resets s->method to s->ctx->method when called from within

     one of the SSL handshake functions.

ssl/s23_clnt.c

+1 −0
Original line number Diff line number Diff line
@@ -200,6 +200,7 @@ int ssl23_connect(SSL *s) 
		}

end:

	s->in_handshake--;

	if (s->in_handshake)

	if (cb != NULL)

		cb(s,SSL_CB_CONNECT_EXIT,ret);

	return(ret);

ssl/s23_srvr.c

+12 −7
Original line number Diff line number Diff line
@@ -232,9 +232,9 @@ int ssl23_accept(SSL *s) 
			}

		}

end:

	s->in_handshake--;

	if (cb != NULL)

		cb(s,SSL_CB_ACCEPT_EXIT,ret);

	s->in_handshake--;

	return(ret);

	}
@@ -405,16 +405,21 @@ int ssl23_get_client_hello(SSL *s) 
			/* We must look at client_version inside the Client Hello message

			 * to get the correct minor version.

			 * However if we have only a pathologically small fragment of the

			 * Client Hello message, this would be difficult, we'd have

			 * to read at least one additional record to find out.

			 * This doesn't usually happen in real life, so we just complain

			 * for now.

			 */

			 * Client Hello message, this would be difficult, and we'd have

			 * to read more records to find out.

			 * No known SSL 3.0 client fragments ClientHello like this,

			 * so we simply assume TLS 1.0 to avoid protocol version downgrade

			 * attacks. */

			if (p[3] == 0 && p[4] < 6)

				{

#if 0

				SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_SMALL);

				goto err;

#else

				v[1] = TLS1_VERSION_MINOR;

#endif

				}

			else

				v[1]=p[10]; /* minor version according to client_version */

			if (v[1] >= TLS1_VERSION_MINOR)

				{