Be selective as to when ChangeCipherSpec messages will be accepted.

Without this an early ChangeCipherSpec message would result in session
keys being generated, along with the Finished hash for the handshake,
using an empty master secret.

For a detailed analysis see:

  https://www.imperialviolet.org/2014/06/05/earlyccs.html

This is a fix for CVE-2014-0224, from OpenSSL.

This issue was reported to OpenSSL by KIKUCHI Masashi. Unfortunately the
recent OpenSSL commit was the first we were made aware of the issue.

ok deraadt@ sthen@

1 files changed, 5 insertions, 2 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 948569a156..552f8290b5 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -635,6 +635,7 @@ ssl3_accept(SSL *s)
 
                 case SSL3_ST_SR_CERT_VRFY_A:
                 case SSL3_ST_SR_CERT_VRFY_B:
+                        s->s3->flags |= SSL3_FLAGS_CCS_OK;
 
                         /* we should decide if we expected this one */
                         ret = ssl3_get_cert_verify(s);
@@ -665,6 +666,7 @@ ssl3_accept(SSL *s)
 
                 case SSL3_ST_SR_FINISHED_A:
                 case SSL3_ST_SR_FINISHED_B:
+                        s->s3->flags |= SSL3_FLAGS_CCS_OK;
                         ret = ssl3_get_finished(s, SSL3_ST_SR_FINISHED_A,
                             SSL3_ST_SR_FINISHED_B);
                         if (ret <= 0)
@@ -735,10 +737,11 @@ ssl3_accept(SSL *s)
 #ifdef OPENSSL_NO_NEXTPROTONEG
                                 s->s3->tmp.next_state = SSL3_ST_SR_FINISHED_A;
 #else
-                                if (s->s3->next_proto_neg_seen)
+                                if (s->s3->next_proto_neg_seen) {
+                                        s->s3->flags |= SSL3_FLAGS_CCS_OK;
                                         s->s3->tmp.next_state =
                                             SSL3_ST_SR_NEXT_PROTO_A;
-                                else
+                                } else
                                         s->s3->tmp.next_state =
                                             SSL3_ST_SR_FINISHED_A;
 #endif