generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Compression handling on session resume was badly broken: it always

Browse Source 
used compression algorithms in client hello (a legacy from when
the compression algorithm wasn't serialized with SSL_SESSION).
This commit is contained in:
Dr. Stephen Henson
2010-01-01 00:44:36 +00:00
parent 5448e6739c
commit e642fd7a1c
4 changed files with 65 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
ssl/s3_srvr.c
View File

@@ -1088,7 +1088,50 @@ int ssl3_get_client_hello(SSL *s)
* algorithms from the client, starting at q. */
s->s3->tmp.new_compression=NULL;
#ifndef OPENSSL_NO_COMP
if (!(s->options & SSL_OP_NO_COMPRESSION) && s->ctx->comp_methods)
/* This only happens if we have a cache hit */
if (s->session->compress_meth != 0)
{
int m, comp_id = s->session->compress_meth;
/* Perform sanity checks on resumed compression algorithm */
/* Can't disable compression */
if (s->options & SSL_OP_NO_COMPRESSION)
{
al=SSL_AD_INTERNAL_ERROR;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INCONSISTENT_COMPRESSION);
goto f_err;
}
/* Look for resumed compression method */
for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++)
{
comp=sk_SSL_COMP_value(s->ctx->comp_methods,m);
if (comp_id == comp->id)
{
s->s3->tmp.new_compression=comp;
break;
}
}
if (s->s3->tmp.new_compression == NULL)
{
al=SSL_AD_INTERNAL_ERROR;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INVALID_COMPRESSION_ALGORITHM);
goto f_err;
}
/* Look for resumed method in compression list */
for (m = 0; m < i; m++)
{
if (q[m] == comp_id)
break;
}
if (m >= i)
{
al=SSL_AD_ILLEGAL_PARAMETER;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING);
goto f_err;
}
}
else if (s->hit)
comp = NULL;
else if (!(s->options & SSL_OP_NO_COMPRESSION) && s->ctx->comp_methods)
{ /* See if we have a match */
int m,nn,o,v,done=0;
@@ -1112,6 +1155,16 @@ int ssl3_get_client_hello(SSL *s)
else
comp=NULL;
}
#else
/* If compression is disabled we'd better not try to resume a session
* using compression.
*/
if (s->session->compress_id != 0)
{
al=SSL_AD_INTERNAL_ERROR;
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_INCONSISTENT_COMPRESSION);
goto f_err;
}
#endif
/* Given s->session->ciphers and SSL_get_ciphers, we must