Commit d45ba43d authored by Matt Caswell's avatar Matt Caswell
Browse files

Updates following review comments 



Miscellaneous updates following review comments on the version negotiation
rewrite patches.

Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
parent a27e81ee

include/openssl/ssl.h

+1 −9
Original line number Diff line number Diff line
@@ -1931,14 +1931,6 @@ void ERR_load_SSL_strings(void); 
# define SSL_F_DTLS1_SEND_SERVER_HELLO                    266

# define SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE             267

# define SSL_F_DTLS1_WRITE_APP_DATA_BYTES                 268

# define SSL_F_SSL23_ACCEPT                               115

# define SSL_F_SSL23_CLIENT_HELLO                         116

# define SSL_F_SSL23_CONNECT                              117

# define SSL_F_SSL23_GET_CLIENT_HELLO                     118

# define SSL_F_SSL23_GET_SERVER_HELLO                     119

# define SSL_F_SSL23_PEEK                                 237

# define SSL_F_SSL23_READ                                 120

# define SSL_F_SSL23_WRITE                                121

# define SSL_F_SSL3_ACCEPT                                128

# define SSL_F_SSL3_ADD_CERT_TO_BUF                       296

# define SSL_F_SSL3_CALLBACK_CTRL                         233
@@ -2076,6 +2068,7 @@ void ERR_load_SSL_strings(void); 
# define SSL_F_SSL_SET_SESSION_ID_CONTEXT                 218

# define SSL_F_SSL_SET_SESSION_TICKET_EXT                 294

# define SSL_F_SSL_SET_TRUST                              228

# define SSL_F_SSL_SET_VERSION                            347

# define SSL_F_SSL_SET_WFD                                196

# define SSL_F_SSL_SHUTDOWN                               224

# define SSL_F_SSL_SRP_CTX_INIT                           313
@@ -2292,7 +2285,6 @@ void ERR_load_SSL_strings(void); 
# define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES           362

# define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG      363

# define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE            364

# define SSL_R_SSL23_DOING_SESSION_ID_REUSE               221

# define SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT             321

# define SSL_R_SSL3_EXT_INVALID_SERVERNAME                319

# define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE           320

ssl/install-ssl.com

+1 −1
Original line number Diff line number Diff line
@@ -70,7 +70,7 @@ $ if f$parse("wrk_sslinclude:") .eqs. "" then - 
$ if f$parse("wrk_sslxlib:") .eqs. "" then -

   create /directory /log wrk_sslxlib:

$!

$ exheader := ssl.h, ssl2.h, ssl3.h, ssl23.h, tls1.h, dtls1.h, srtp.h

$ exheader := ssl.h, ssl2.h, ssl3.h, tls1.h, dtls1.h, srtp.h

$ libs := ssl_libssl

$!

$ xexe_dir := [-.'archd'.exe.ssl]

ssl/record/rec_layer_s3.c

+8 −1
Original line number Diff line number Diff line
@@ -1124,7 +1124,7 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek) 
        goto f_err;

    }



    if(s->version == TLS_ANY_VERSION

    if(s->method->version == TLS_ANY_VERSION

            && (s->server || rr->type != SSL3_RT_ALERT)) {

        /*

         * If we've got this far and still haven't decided on what version
@@ -1493,11 +1493,18 @@ void ssl3_record_sequence_update(unsigned char *seq) 
    }

}



/*

 * Returns true if the current rrec was sent in SSLv2 backwards compatible

 * format and false otherwise.

 */

int RECORD_LAYER_is_sslv2_record(RECORD_LAYER *rl)

{

    return SSL3_RECORD_is_sslv2_record(&rl->rrec);

}



/*

 * Returns the length in bytes of the current rrec

 */

int RECORD_LAYER_get_rrec_length(RECORD_LAYER *rl)

{

    return SSL3_RECORD_get_length(&rl->rrec);

ssl/record/ssl3_record.c

+13 −28
Original line number Diff line number Diff line
@@ -220,16 +220,13 @@ int ssl3_get_record(SSL *s) 


        /*

         * Check whether this is a regular record or an SSLv2 style record. The

         * latter is only used in an initial ClientHello for old clients.

         * latter is only used in an initial ClientHello for old clients. We

         * check s->read_hash and s->enc_read_ctx to ensure this does not apply

         * during renegotiation

         */

        if (s->first_packet && s->server && !s->read_hash && !s->enc_read_ctx

                && (p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {

            /* SSLv2 style record */

            if (s->msg_callback)

                s->msg_callback(0, SSL2_VERSION, 0,  p + 2,

                                RECORD_LAYER_get_packet_length(&s->rlayer) - 2,

                                s, s->msg_callback_arg);



            rr->type = SSL3_RT_HANDSHAKE;

            rr->rec_version = SSL2_VERSION;
@@ -262,9 +259,7 @@ int ssl3_get_record(SSL *s) 
            n2s(p, rr->length);



            /* Lets check version */

            if (!s->first_packet) {

                if (version != s->version

                        && s->method->version != TLS_ANY_VERSION) {

            if (!s->first_packet && version != s->version) {

                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);

                if ((s->version & 0xFF00) == (version & 0xFF00)

                    && !s->enc_write_ctx && !s->write_hash)
@@ -275,7 +270,6 @@ int ssl3_get_record(SSL *s) 
                al = SSL_AD_PROTOCOL_VERSION;

                goto f_err;

            }

            }



            if ((version >> 8) != SSL3_VERSION_MAJOR) {

                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
@@ -309,15 +303,6 @@ int ssl3_get_record(SSL *s) 
        n = ssl3_read_n(s, i, i, 1);

        if (n <= 0)

            return (n);         /* error or non-blocking io */

        /*

         * now n == rr->length, and

         * s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length

         * or

         * s->packet_length == SSL2_RT_HEADER_LENGTH + rr->length

         * (if SSLv2 packet)

         */

    } else {

        n = 0;

    }



    /* set state for later operations */

ssl/s3_both.c

+8 −13
Original line number Diff line number Diff line
@@ -363,7 +363,8 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) 


    p = (unsigned char *)s->init_buf->data;



    if (s->state == st1) {      /* s->init_num < 4 */

    if (s->state == st1) {

        /* s->init_num < SSL3_HM_HEADER_LENGTH */

        int skip_message;



        do {
@@ -393,12 +394,11 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) 


                        if (s->msg_callback)

                            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,

                                            p, 4, s, s->msg_callback_arg);

                    }

                                            p, SSL3_HM_HEADER_LENGTH, s,

                                            s->msg_callback_arg);

                    }

        while (skip_message);



        /* s->init_num == 4 */

        } while (skip_message);

        /* s->init_num == SSL3_HM_HEADER_LENGTH */



        if ((mt >= 0) && (*p != mt)) {

            al = SSL_AD_UNEXPECTED_MESSAGE;
@@ -441,7 +441,8 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) 
                SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);

                goto f_err;

            }

            if (l && !BUF_MEM_grow_clean(s->init_buf, (int)l + 4)) {

            if (l && !BUF_MEM_grow_clean(s->init_buf,

                                        (int)l + SSL3_HM_HEADER_LENGTH)) {

                SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB);

                goto err;

            }
@@ -480,12 +481,6 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) 
    /* Feed this message into MAC computation. */

    if(RECORD_LAYER_is_sslv2_record(&s->rlayer)) {

        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);

        /*

         * In previous versions we would have rewritten the SSLv2 record into

         * something that looked like a SSLv3+ record and passed that to the

         * callback. As we're not doing the rewriting anymore it's not clear

         * what we should do here.

         */

        if (s->msg_callback)

            s->msg_callback(0, SSL2_VERSION, 0,  s->init_buf->data,

                            (size_t)s->init_num, s, s->msg_callback_arg);