generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prepare OpenSSL 0.9.8g: cherry pick

Browse Source 
http://cvs.openssl.org/chngview?cn=16694
Don't let DTLS ChangeCipherSpec increment handshake sequence number. From HEAD with a twist: server interoperates with non-compliant client.
PR: 1587
Submitted by: appro
This commit is contained in:
Lutz Jänicke
2007-10-19 07:39:53 +00:00
parent 8c447031ad
commit 13e8459dea
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ssl/d1_both.c
View File

@@ -777,11 +777,11 @@ int dtls1_send_change_cipher_spec(SSL *s, int a, int b)
p=(unsigned char *)s->init_buf->data; p=(unsigned char *)s->init_buf->data;
*p++=SSL3_MT_CCS; *p++=SSL3_MT_CCS;
s->d1->handshake_write_seq = s->d1->next_handshake_write_seq; s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
s->d1->next_handshake_write_seq++;
s->init_num=DTLS1_CCS_HEADER_LENGTH; s->init_num=DTLS1_CCS_HEADER_LENGTH;
if (s->client_version == DTLS1_BAD_VER) if (s->client_version == DTLS1_BAD_VER)
{ {
s->d1->next_handshake_write_seq++;
s2n(s->d1->handshake_write_seq,p); s2n(s->d1->handshake_write_seq,p);
s->init_num+=2; s->init_num+=2;
} }
@@ -974,6 +974,7 @@ dtls1_buffer_message(SSL *s, int is_ccs)
pitem *item; pitem *item;
hm_fragment *frag; hm_fragment *frag;
PQ_64BIT seq64; PQ_64BIT seq64;
unsigned int epoch = s->d1->w_epoch;
/* this function is called immediately after a message has /* this function is called immediately after a message has
* been serialized */ * been serialized */
@@ -987,6 +988,7 @@ dtls1_buffer_message(SSL *s, int is_ccs)
{ {
OPENSSL_assert(s->d1->w_msg_hdr.msg_len + OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
DTLS1_CCS_HEADER_LENGTH <= (unsigned int)s->init_num); DTLS1_CCS_HEADER_LENGTH <= (unsigned int)s->init_num);
epoch++;
} }
else else
{ {
@@ -1002,7 +1004,7 @@ dtls1_buffer_message(SSL *s, int is_ccs)
frag->msg_header.is_ccs = is_ccs; frag->msg_header.is_ccs = is_ccs;
pq_64bit_init(&seq64); pq_64bit_init(&seq64);
pq_64bit_assign_word(&seq64, frag->msg_header.seq); pq_64bit_assign_word(&seq64, epoch<<16 | frag->msg_header.seq);
item = pitem_new(seq64, frag); item = pitem_new(seq64, frag);
pq_64bit_free(&seq64); pq_64bit_free(&seq64);

4
ssl/d1_pkt.c
View File

@@ -1006,8 +1006,8 @@ start:
/* do this whenever CCS is processed */ /* do this whenever CCS is processed */
dtls1_reset_seq_numbers(s, SSL3_CC_READ); dtls1_reset_seq_numbers(s, SSL3_CC_READ);
/* handshake read seq is reset upon handshake completion */ if (s->client_version == DTLS1_BAD_VER)
s->d1->handshake_read_seq++; s->d1->handshake_read_seq++;
goto start; goto start;
} }