generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG can't

Browse Source 
enable disabled ciphersuites.
This commit is contained in:
Bodo Möller 2008-09-22 21:22:47 +00:00
parent 1a489c9af1
commit 837f2fc7a4
2 changed files with 29 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
CHANGES
View File

@ -2,7 +2,7 @@
OpenSSL CHANGES
_______________
Changes between 0.9.8i and 0.9.9 [xx XXX xxxx]
Changes between 0.9.8j and 0.9.9 [xx XXX xxxx]
*) Delta CRL support. New use deltas option which will attempt to locate
and search any appropriate delta CRLs available.
@ -703,6 +703,15 @@
*) Change 'Configure' script to enable Camellia by default.
[NTT]
Changes between 0.9.8i and 0.9.8j [xx XXX xxxx]
*) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
to ensure that even with this option, only ciphersuites in the
server's preference list will be accepted. (Note that the option
applies only when resuming a session, so the earlier behavior was
just about the algorithm choice for symmetric cryptography.)
[Bodo Moeller]
Changes between 0.9.8h and 0.9.8i [15 Sep 2008]
*) Fix a state transitition in s3_srvr.c and d1_srvr.c

32
ssl/s3_srvr.c
View File

@ -947,21 +947,27 @@ int ssl3_get_client_hello(SSL *s)
break;
}
}
if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
{
/* Special case as client bug workaround: the previously used cipher may
* not be in the current list, the client instead might be trying to
* continue using a cipher that before wasn't chosen due to server
* preferences. We'll have to reject the connection if the cipher is not
* enabled, though. */
c = sk_SSL_CIPHER_value(ciphers, 0);
if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0)
{
s->session->cipher = c;
j = 1;
}
}
if (j == 0)
{
if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
{
/* Very bad for multi-threading.... */
s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
}
else
{
/* we need to have the cipher in the cipher
* list if we are asked to reuse it */
al=SSL_AD_ILLEGAL_PARAMETER;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
goto f_err;
}
/* we need to have the cipher in the cipher
* list if we are asked to reuse it */
al=SSL_AD_ILLEGAL_PARAMETER;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
goto f_err;
}
}