OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2
if you are using the ssl26 packages for ssh and other things to work you will
need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs

1 files changed, 100 insertions, 35 deletions

diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index e4122f2d78..6a3bbb10b9 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -67,8 +67,10 @@ static SSL_METHOD *ssl23_get_server_method(int ver);
 int ssl23_get_client_hello(SSL *s);
 static SSL_METHOD *ssl23_get_server_method(int ver)
         {
+#ifndef NO_SSL2
         if (ver == SSL2_VERSION)
                 return(SSLv2_server_method());
+#endif
         if (ver == SSL3_VERSION)
                 return(SSLv3_server_method());
         else if (ver == TLS1_VERSION)
@@ -101,7 +103,7 @@ int ssl23_accept(SSL *s)
         int ret= -1;
         int new_state,state;
 
-        RAND_seed(&Time,sizeof(Time));
+        RAND_add(&Time,sizeof(Time),0);
         ERR_clear_error();
         clear_sys_error();
 
@@ -186,23 +188,39 @@ end:
 
 int ssl23_get_client_hello(SSL *s)
         {
-        char buf_space[8];
+        char buf_space[11]; /* Request this many bytes in initial read.
+                             * We can detect SSL 3.0/TLS 1.0 Client Hellos
+                             * ('type == 3') correctly only when the following
+                             * is in a single record, which is not guaranteed by
+                             * the protocol specification:
+                             * Byte  Content
+                             *  0     type            \
+                             *  1/2   version          > record header
+                             *  3/4   length          /
+                             *  5     msg_type        \
+                             *  6-8   length           > Client Hello message
+                             *  9/10  client_version  /
+                             */
         char *buf= &(buf_space[0]);
         unsigned char *p,*d,*dd;
         unsigned int i;
         unsigned int csl,sil,cl;
-        int n=0,j,tls1=0;
-        int type=0,use_sslv2_strong=0;
+        int n=0,j;
+        int type=0;
         int v[2];
+#ifndef NO_RSA
+        int use_sslv2_strong=0;
+#endif
 
-        /* read the initial header */
-        v[0]=v[1]=0;
         if (s->state == SSL23_ST_SR_CLNT_HELLO_A)
                 {
+                /* read the initial header */
+                v[0]=v[1]=0;
+
                 if (!ssl3_setup_buffers(s)) goto err;
 
-                n=ssl23_read_bytes(s,7);
-                if (n != 7) return(n); /* n == -1 || n == 0 */
+                n=ssl23_read_bytes(s, sizeof buf_space);
+                if (n != sizeof buf_space) return(n); /* n == -1 || n == 0 */
 
                 p=s->packet;
 
@@ -210,7 +228,9 @@ int ssl23_get_client_hello(SSL *s)
 
                 if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO))
                         {
-                        /* SSLv2 header */
+                        /*
+                         * SSLv2 header
+                         */
                         if ((p[3] == 0x00) && (p[4] == 0x02))
                                 {
                                 v[0]=p[3]; v[1]=p[4];
@@ -226,11 +246,14 @@ int ssl23_get_client_hello(SSL *s)
                                         {
                                         if (!(s->options & SSL_OP_NO_TLSv1))
                                                 {
-                                                tls1=1;
+                                                s->version=TLS1_VERSION;
+                                                /* type=2; */ /* done later to survive restarts */
                                                 s->state=SSL23_ST_SR_CLNT_HELLO_B;
                                                 }
                                         else if (!(s->options & SSL_OP_NO_SSLv3))
                                                 {
+                                                s->version=SSL3_VERSION;
+                                                /* type=2; */
                                                 s->state=SSL23_ST_SR_CLNT_HELLO_B;
                                                 }
                                         else if (!(s->options & SSL_OP_NO_SSLv2))
@@ -239,12 +262,26 @@ int ssl23_get_client_hello(SSL *s)
                                                 }
                                         }
                                 else if (!(s->options & SSL_OP_NO_SSLv3))
+                                        {
+                                        s->version=SSL3_VERSION;
+                                        /* type=2; */
                                         s->state=SSL23_ST_SR_CLNT_HELLO_B;
+                                        }
                                 else if (!(s->options & SSL_OP_NO_SSLv2))
                                         type=1;
 
                                 if (s->options & SSL_OP_NON_EXPORT_FIRST)
+                                        /* Not only utterly confusing, but broken
+                                         * ('fractured programming'?) -- the details
+                                         * of this block nearly make it work
+                                         * as intended in this environment, but on one
+                                         * of the fine points (w.r.t. restarts) it fails.
+                                         * The obvious fix would be even more devastating
+                                         * to program structure; if you want the functionality,
+                                         * throw this away and implement it in a way
+                                         * that makes sense */
                                         {
+#if 0
                                         STACK_OF(SSL_CIPHER) *sk;
                                         SSL_CIPHER *c;
                                         int ne2,ne3;
@@ -294,27 +331,51 @@ int ssl23_get_client_hello(SSL *s)
                                                         goto next_bit;
                                                         }
                                                 }
+#else
+                                        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_OPTION);
+                                        goto err;
+#endif
                                         }
                                 }
                         }
                 else if ((p[0] == SSL3_RT_HANDSHAKE) &&
                          (p[1] == SSL3_VERSION_MAJOR) &&
-                         (p[5] == SSL3_MT_CLIENT_HELLO))
+                         (p[5] == SSL3_MT_CLIENT_HELLO) &&
+                         ((p[3] == 0 && p[4] < 5 /* silly record length? */)
+                                || (p[9] == p[1])))
                         {
-                        v[0]=p[1]; v[1]=p[2];
-                        /* true SSLv3 or tls1 */
-                        if (p[2] >= TLS1_VERSION_MINOR)
+                        /*
+                         * SSLv3 or tls1 header
+                         */
+                        
+                        v[0]=p[1]; /* major version */
+                        /* We must look at client_version inside the Client Hello message
+                         * to get the correct minor version: */
+                        v[1]=p[10];
+                        /* However if we have only a pathologically small fragment of the
+                         * Client Hello message, we simply use the version from the
+                         * record header -- this is incorrect but unlikely to fail in
+                         * practice */
+                        if (p[3] == 0 && p[4] < 6)
+                                v[1]=p[2];
+                        if (v[1] >= TLS1_VERSION_MINOR)
                                 {
                                 if (!(s->options & SSL_OP_NO_TLSv1))
                                         {
+                                        s->version=TLS1_VERSION;
                                         type=3;
-                                        tls1=1;
                                         }
                                 else if (!(s->options & SSL_OP_NO_SSLv3))
+                                        {
+                                        s->version=SSL3_VERSION;
                                         type=3;
+                                        }
                                 }
                         else if (!(s->options & SSL_OP_NO_SSLv3))
+                                {
+                                s->version=SSL3_VERSION;
                                 type=3;
+                                }
                         }
                 else if ((strncmp("GET ", (char *)p,4) == 0) ||
                          (strncmp("POST ",(char *)p,5) == 0) ||
@@ -331,12 +392,16 @@ int ssl23_get_client_hello(SSL *s)
                         }
                 }
 
-next_bit:
         if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
                 {
-                /* we have a SSLv3/TLSv1 in a SSLv2 header */
+                /* we have SSLv3/TLSv1 in an SSLv2 header
+                 * (other cases skip this state) */
+
                 type=2;
                 p=s->packet;
+                v[0] = p[3]; /* == SSL3_VERSION_MAJOR */
+                v[1] = p[4];
+
                 n=((p[0]&0x7f)<<8)|p[1];
                 if (n > (1024*4))
                         {
@@ -361,14 +426,11 @@ next_bit:
                         goto err;
                         }
 
-                *(d++)=SSL3_VERSION_MAJOR;
-                if (tls1)
-                        *(d++)=TLS1_VERSION_MINOR;
-                else
-                        *(d++)=SSL3_VERSION_MINOR;
+                *(d++) = SSL3_VERSION_MAJOR; /* == v[0] */
+                *(d++) = v[1];
 
                 /* lets populate the random area */
-                /* get the chalenge_length */
+                /* get the challenge_length */
                 i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;
                 memset(d,0,SSL3_RANDOM_SIZE);
                 memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);
@@ -402,8 +464,15 @@ next_bit:
                 s->s3->tmp.message_size=i;
                 }
 
+        /* imaginary new state (for program structure): */
+        /* s->state = SSL23_SR_CLNT_HELLO_C */
+
         if (type == 1)
                 {
+#ifdef NO_SSL2
+                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
+                goto err;
+#else
                 /* we are talking sslv2 */
                 /* we need to clean up the SSLv3/TLSv1 setup and put in the
                  * sslv2 stuff. */
@@ -431,7 +500,7 @@ next_bit:
                 else
                         s->s2->ssl2_rollback=1;
 
-                /* setup the 5 bytes we have read so we get them from
+                /* setup the n bytes we have read so we get them from
                  * the sslv2 buffer */
                 s->rstate=SSL_ST_READ_HEADER;
                 s->packet_length=n;
@@ -442,11 +511,12 @@ next_bit:
 
                 s->method=SSLv2_server_method();
                 s->handshake_func=s->method->ssl_accept;
+#endif
                 }
 
         if ((type == 2) || (type == 3))
                 {
-                /* we have SSLv3/TLSv1 */
+                /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
 
                 if (!ssl_init_wbio_buffer(s,1)) goto err;
 
@@ -471,17 +541,13 @@ next_bit:
                         s->s3->rbuf.offset=0;
                         }
 
-                if (tls1)
-                        {
-                        s->version=TLS1_VERSION;
-                        s->method=TLSv1_server_method();
-                        }
+                if (s->version == TLS1_VERSION)
+                        s->method = TLSv1_server_method();
                 else
-                        {
-                        s->version=SSL3_VERSION;
-                        s->method=SSLv3_server_method();
-                        }
+                        s->method = SSLv3_server_method();
+#if 0 /* ssl3_get_client_hello does this */
                 s->client_version=(v[0]<<8)|v[1];
+#endif
                 s->handshake_func=s->method->ssl_accept;
                 }
         
@@ -500,4 +566,3 @@ err:
         if (buf != buf_space) Free(buf);
         return(-1);
         }
-