Commit e4f77bf1 authored by Matt Caswell's avatar Matt Caswell
Browse files

Add Error state 



Reusing an SSL object when it has encountered a fatal error can
have bad consequences. This is a bug in application code not libssl
but libssl should be more forgiving and not crash.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(cherry picked from commit a89db885)

Conflicts:
	ssl/s3_srvr.c
	ssl/ssl_stat.c
parent cd5f206c

ssl/s3_srvr.c

+4 −1
Original line number Diff line number Diff line
@@ -849,6 +849,7 @@ int ssl3_accept(SSL *s) 
            goto end;

            /* break; */



        case SSL_ST_ERR:

        default:

            SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_UNKNOWN_STATE);

            ret = -1;
@@ -1463,8 +1464,10 @@ int ssl3_get_client_hello(SSL *s) 
    if (0) {

 f_err:

        ssl3_send_alert(s, SSL3_AL_FATAL, al);

    }

 err:

        s->state = SSL_ST_ERR;

    }



    if (ciphers != NULL)

        sk_SSL_CIPHER_free(ciphers);

    return ret < 0 ? -1 : ret;

ssl/ssl.h

+1 −0
Original line number Diff line number Diff line
@@ -1727,6 +1727,7 @@ extern "C" { 
# define SSL_ST_BEFORE                   0x4000

# define SSL_ST_OK                       0x03

# define SSL_ST_RENEGOTIATE              (0x04|SSL_ST_INIT)

# define SSL_ST_ERR                      0x05



# define SSL_CB_LOOP                     0x01

# define SSL_CB_EXIT                     0x02

ssl/ssl_stat.c

+6 −0
Original line number Diff line number Diff line
@@ -117,6 +117,9 @@ const char *SSL_state_string_long(const SSL *s) 
    case SSL_ST_OK | SSL_ST_ACCEPT:

        str = "ok/accept SSL initialization";

        break;

    case SSL_ST_ERR:

        str = "error";

        break;

#ifndef OPENSSL_NO_SSL2

    case SSL2_ST_CLIENT_START_ENCRYPTION:

        str = "SSLv2 client start encryption";
@@ -496,6 +499,9 @@ const char *SSL_state_string(const SSL *s) 
    case SSL_ST_OK:

        str = "SSLOK ";

        break;

    case SSL_ST_ERR:

        str = "SSLERR";

        break;

#ifndef OPENSSL_NO_SSL2

    case SSL2_ST_CLIENT_START_ENCRYPTION:

        str = "2CSENC";