generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG can't

Browse Source 
enable disabled ciphersuites.
This commit is contained in:
Bodo Möller
2008-09-22 21:22:47 +00:00
parent 1a489c9af1
commit 837f2fc7a4
2 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
ssl/s3_srvr.c
View File

@@ -947,21 +947,27 @@ int ssl3_get_client_hello(SSL *s)
break;
}
}
if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
{
/* Special case as client bug workaround: the previously used cipher may
* not be in the current list, the client instead might be trying to
* continue using a cipher that before wasn't chosen due to server
* preferences. We'll have to reject the connection if the cipher is not
* enabled, though. */
c = sk_SSL_CIPHER_value(ciphers, 0);
if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0)
{
s->session->cipher = c;
j = 1;
}
}
if (j == 0)
{
if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
{
/* Very bad for multi-threading.... */
s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
}
else
{
/* we need to have the cipher in the cipher
* list if we are asked to reuse it */
al=SSL_AD_ILLEGAL_PARAMETER;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
goto f_err;
}
/* we need to have the cipher in the cipher
* list if we are asked to reuse it */
al=SSL_AD_ILLEGAL_PARAMETER;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
goto f_err;
}
}