generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add support for magic cipher suite value (MCSV). Make secure renegotiation

Browse Source 
work in SSLv3: initial handshake has no extensions but includes MCSV, if
server indicates RI support then renegotiation handshakes include RI.

NB: current MCSV value is bogus for testing only, will be updated when we
have an official value.

Change mismatch alerts to handshake_failure as required by spec.

Also have some debugging fprintfs so we can clearly see what is going on
if OPENSSL_RI_DEBUG is set.
This commit is contained in:
Dr. Stephen Henson
2009-12-08 13:15:38 +00:00
parent 1ff44a99a4
commit 7a014dceb6
11 changed files with 295 additions and 246 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
ssl/ssl_lib.c
View File

@@ -1287,6 +1287,22 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p,
j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);
p+=j;
}
/* If p == q, no ciphers and caller indicates an error, otherwise
* add MCSV
*/
if (p != q)
{
static SSL_CIPHER msvc =
{
0, NULL, SSL3_CK_MCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
};
j = put_cb ? put_cb(&msvc,p) : ssl_put_cipher_by_char(s,&msvc,p);
p+=j;
#ifdef OPENSSL_RI_DEBUG
fprintf(stderr, "MCSV sent by client\n");
#endif
}
return(p-q);
}
@@ -1297,6 +1313,8 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
STACK_OF(SSL_CIPHER) *sk;
int i,n;
s->s3->send_connection_binding = 0;
n=ssl_put_cipher_by_char(s,NULL,NULL);
if ((num%n) != 0)
{
@@ -1313,6 +1331,19 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
for (i=0; i<num; i+=n)
{
/* Check for MCSV */
if ((n != 3 || !p[0]) &&
(p[n-2] == ((SSL3_CK_MCSV >> 8) & 0xff)) &&
(p[n-1] == (SSL3_CK_MCSV & 0xff)))
{
s->s3->send_connection_binding = 1;
p += n;
#ifdef OPENSSL_RI_DEBUG
fprintf(stderr, "MCSV received by server\n");
#endif
continue;
}
c=ssl_get_cipher_by_char(s,p);
p+=n;
if (c != NULL)