Commit fe9ce2b7 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> 

Reviewed by: steve
Improved localisation of TLS extension handling and code tidy.
parent 8e7ccf6f

ssl/s3_clnt.c

+4 −15
Original line number Diff line number Diff line
@@ -822,7 +822,7 @@ int ssl3_get_server_hello(SSL *s) 
	STACK_OF(SSL_CIPHER) *sk;

	const SSL_CIPHER *c;

	unsigned char *p,*d;

	int i,al,ok;

	int i,al=SSL_AD_INTERNAL_ERROR,ok;

	unsigned int j;

	long n;

#ifndef OPENSSL_NO_COMP
@@ -928,7 +928,6 @@ int ssl3_get_server_hello(SSL *s) 
			{

			if (!ssl_get_new_session(s,0))

				{

				al=SSL_AD_INTERNAL_ERROR;

				goto f_err;

				}

			}
@@ -1002,7 +1001,6 @@ int ssl3_get_server_hello(SSL *s) 
	 */

	if (s->session->compress_meth != 0)

		{

		al=SSL_AD_INTERNAL_ERROR;

		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_INCONSISTENT_COMPRESSION);

		goto f_err;

		}
@@ -1039,20 +1037,11 @@ int ssl3_get_server_hello(SSL *s) 


#ifndef OPENSSL_NO_TLSEXT

	/* TLS extensions*/

	if (s->version >= SSL3_VERSION)

	if (!ssl_parse_serverhello_tlsext(s,&p,d,n))

		{

		if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))

			{

			/* 'al' set by ssl_parse_serverhello_tlsext */

		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_PARSE_TLSEXT);

			goto f_err; 

			}

		if (ssl_check_serverhello_tlsext(s) <= 0)

			{

			SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);

		goto err; 

		}

		}

#endif



	if (p != (d+n))

ssl/s3_srvr.c

+1 −5
Original line number Diff line number Diff line
@@ -914,7 +914,7 @@ int ssl3_check_client_hello(SSL *s) 


int ssl3_get_client_hello(SSL *s)

	{

	int i,j,ok,al,ret= -1;

	int i,j,ok,al=SSL_AD_INTERNAL_ERROR,ret= -1;

	unsigned int cookie_len;

	long n;

	unsigned long id;
@@ -1194,7 +1194,6 @@ int ssl3_get_client_hello(SSL *s) 
		l2n(Time,pos);

		if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)

			{

			al=SSL_AD_INTERNAL_ERROR;

			goto f_err;

			}

	}
@@ -1249,7 +1248,6 @@ int ssl3_get_client_hello(SSL *s) 
		/* Can't disable compression */

		if (s->options & SSL_OP_NO_COMPRESSION)

			{

			al=SSL_AD_INTERNAL_ERROR;

			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INCONSISTENT_COMPRESSION);

			goto f_err;

			}
@@ -1265,7 +1263,6 @@ int ssl3_get_client_hello(SSL *s) 
			}

		if (s->s3->tmp.new_compression == NULL)

			{

			al=SSL_AD_INTERNAL_ERROR;

			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INVALID_COMPRESSION_ALGORITHM);

			goto f_err;

			}
@@ -1314,7 +1311,6 @@ int ssl3_get_client_hello(SSL *s) 
	 */

	if (s->session->compress_meth != 0)

		{

		al=SSL_AD_INTERNAL_ERROR;

		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INCONSISTENT_COMPRESSION);

		goto f_err;

		}

ssl/ssl.h

+1 −0
Original line number Diff line number Diff line
@@ -2277,6 +2277,7 @@ void ERR_load_SSL_strings(void); 
#define SSL_F_SSL_RSA_PRIVATE_DECRYPT			 187

#define SSL_F_SSL_RSA_PUBLIC_ENCRYPT			 188

#define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT		 320

#define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT		 321

#define SSL_F_SSL_SESSION_NEW				 189

#define SSL_F_SSL_SESSION_PRINT_FP			 190

#define SSL_F_SSL_SESSION_SET1_ID_CONTEXT		 312

ssl/ssl_err.c

+1 −0
Original line number Diff line number Diff line
@@ -248,6 +248,7 @@ static ERR_STRING_DATA SSL_str_functs[]= 
{ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT),	"SSL_RSA_PRIVATE_DECRYPT"},

{ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT),	"SSL_RSA_PUBLIC_ENCRYPT"},

{ERR_FUNC(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT),	"SSL_SCAN_CLIENTHELLO_TLSEXT"},

{ERR_FUNC(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT),	"SSL_SCAN_SERVERHELLO_TLSEXT"},

{ERR_FUNC(SSL_F_SSL_SESSION_NEW),	"SSL_SESSION_new"},

{ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP),	"SSL_SESSION_print_fp"},

{ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT),	"SSL_SESSION_set1_id_context"},

ssl/ssl_locl.h

+1 −3
Original line number Diff line number Diff line
@@ -1123,11 +1123,9 @@ int tls1_shared_list(SSL *s, 
unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit); 

unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit); 

int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n);

int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n, int *al);

int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n);

int ssl_prepare_clienthello_tlsext(SSL *s);

int ssl_prepare_serverhello_tlsext(SSL *s);

int ssl_check_clienthello_tlsext(SSL *s);

int ssl_check_serverhello_tlsext(SSL *s);



#ifndef OPENSSL_NO_HEARTBEATS

int tls1_heartbeat(SSL *s);