summaryrefslogtreecommitdiff
path: root/src/lib/libssl
diff options
context:
space:
mode:
authordoug <>2015-10-25 15:49:04 +0000
committerdoug <>2015-10-25 15:49:04 +0000
commit1b22d2c5e4e56c3e39d49b552bf6edb38fe2e738 (patch)
tree61167cb403c2f73f47b4c1094076a23c4318819c /src/lib/libssl
parent991aadf92bf4eaaff00372d589c1629eb1909695 (diff)
downloadopenbsd-1b22d2c5e4e56c3e39d49b552bf6edb38fe2e738.tar.gz
openbsd-1b22d2c5e4e56c3e39d49b552bf6edb38fe2e738.tar.bz2
openbsd-1b22d2c5e4e56c3e39d49b552bf6edb38fe2e738.zip
Simplify ssl23_get_client_hello error handling.
ssl23_get_client_hello sets type=1 on error and continues processing. It should return an error immediately to simplify things. This also allows us to start removing the last of SSL_OP_NO_SSL*. Added extra paranoia for s->version to make sure it is set properly. ok jsing@
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/s23_srvr.c52
-rw-r--r--src/lib/libssl/src/ssl/s23_srvr.c52
2 files changed, 52 insertions, 52 deletions
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index 08b416cab8..2e63cfc830 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s23_srvr.c,v 1.45 2015/09/11 18:08:21 jsing Exp $ */ 1/* $OpenBSD: s23_srvr.c,v 1.46 2015/10/25 15:49:04 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -247,15 +247,14 @@ ssl23_get_client_hello(SSL *s)
247 * SSLv2 header 247 * SSLv2 header
248 */ 248 */
249 if ((p[3] == 0x00) && (p[4] == 0x02)) { 249 if ((p[3] == 0x00) && (p[4] == 0x02)) {
250 v[0] = p[3]; 250 /* SSLv2 support has been removed */
251 v[1] = p[4]; 251 goto unsupported;
252 /* SSLv2 */ 252
253 if (!(s->options & SSL_OP_NO_SSLv2))
254 type = 1;
255 } else if (p[3] == SSL3_VERSION_MAJOR) { 253 } else if (p[3] == SSL3_VERSION_MAJOR) {
256 v[0] = p[3]; 254 v[0] = p[3];
257 v[1] = p[4]; 255 v[1] = p[4];
258 /* SSLv3/TLSv1 */ 256 /* SSLv3/TLS */
257
259 if (p[4] >= TLS1_VERSION_MINOR) { 258 if (p[4] >= TLS1_VERSION_MINOR) {
260 if (p[4] >= TLS1_2_VERSION_MINOR && 259 if (p[4] >= TLS1_2_VERSION_MINOR &&
261 !(s->options & SSL_OP_NO_TLSv1_2)) { 260 !(s->options & SSL_OP_NO_TLSv1_2)) {
@@ -270,16 +269,13 @@ ssl23_get_client_hello(SSL *s)
270 s->version = TLS1_VERSION; 269 s->version = TLS1_VERSION;
271 /* type=2; */ /* done later to survive restarts */ 270 /* type=2; */ /* done later to survive restarts */
272 s->state = SSL23_ST_SR_CLNT_HELLO_B; 271 s->state = SSL23_ST_SR_CLNT_HELLO_B;
273 } else if (!(s->options & SSL_OP_NO_SSLv3)) { 272 } else {
274 type = 1; 273 goto unsupported;
275 } else if (!(s->options & SSL_OP_NO_SSLv2)) {
276 type = 1;
277 } 274 }
278 } else if (!(s->options & SSL_OP_NO_SSLv3)) { 275 } else {
279 type = 1; 276 /* SSLv3 support has been removed */
280 } else if (!(s->options & SSL_OP_NO_SSLv2)) 277 goto unsupported;
281 type = 1; 278 }
282
283 } 279 }
284 } else if ((p[0] == SSL3_RT_HANDSHAKE) && 280 } else if ((p[0] == SSL3_RT_HANDSHAKE) &&
285 (p[1] == SSL3_VERSION_MAJOR) && 281 (p[1] == SSL3_VERSION_MAJOR) &&
@@ -325,13 +321,18 @@ ssl23_get_client_hello(SSL *s)
325 } else if (!(s->options & SSL_OP_NO_TLSv1)) { 321 } else if (!(s->options & SSL_OP_NO_TLSv1)) {
326 s->version = TLS1_VERSION; 322 s->version = TLS1_VERSION;
327 type = 3; 323 type = 3;
324 } else {
325 goto unsupported;
328 } 326 }
329 } else { 327 } else {
328 /* SSLv3 */
330 if (!(s->options & SSL_OP_NO_TLSv1)) { 329 if (!(s->options & SSL_OP_NO_TLSv1)) {
331 /* we won't be able to use TLS of course, 330 /* we won't be able to use TLS of course,
332 * but this will send an appropriate alert */ 331 * but this will send an appropriate alert */
333 s->version = TLS1_VERSION; 332 s->version = TLS1_VERSION;
334 type = 3; 333 type = 3;
334 } else {
335 goto unsupported;
335 } 336 }
336 } 337 }
337 } 338 }
@@ -454,12 +455,7 @@ ssl23_get_client_hello(SSL *s)
454 /* imaginary new state (for program structure): */ 455 /* imaginary new state (for program structure): */
455 /* s->state = SSL23_SR_CLNT_HELLO_C */ 456 /* s->state = SSL23_SR_CLNT_HELLO_C */
456 457
457 if (type == 1) { 458 if (type == 2 || type == 3) {
458 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
459 return -1;
460 }
461
462 if ((type == 2) || (type == 3)) {
463 /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */ 459 /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
464 460
465 if (!ssl_init_wbio_buffer(s, 1)) 461 if (!ssl_init_wbio_buffer(s, 1))
@@ -490,12 +486,12 @@ ssl23_get_client_hello(SSL *s)
490 s->method = TLSv1_2_server_method(); 486 s->method = TLSv1_2_server_method();
491 else if (s->version == TLS1_1_VERSION) 487 else if (s->version == TLS1_1_VERSION)
492 s->method = TLSv1_1_server_method(); 488 s->method = TLSv1_1_server_method();
493 else 489 else if (s->version == TLS1_VERSION)
494 s->method = TLSv1_server_method(); 490 s->method = TLSv1_server_method();
491 else
492 goto unsupported;
495 s->handshake_func = s->method->ssl_accept; 493 s->handshake_func = s->method->ssl_accept;
496 } 494 } else {
497
498 if ((type < 1) || (type > 3)) {
499 /* bad, very bad */ 495 /* bad, very bad */
500 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); 496 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
501 return -1; 497 return -1;
@@ -503,4 +499,8 @@ ssl23_get_client_hello(SSL *s)
503 s->init_num = 0; 499 s->init_num = 0;
504 500
505 return (SSL_accept(s)); 501 return (SSL_accept(s));
502
503 unsupported:
504 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
505 return -1;
506} 506}
diff --git a/src/lib/libssl/src/ssl/s23_srvr.c b/src/lib/libssl/src/ssl/s23_srvr.c
index 08b416cab8..2e63cfc830 100644
--- a/src/lib/libssl/src/ssl/s23_srvr.c
+++ b/src/lib/libssl/src/ssl/s23_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s23_srvr.c,v 1.45 2015/09/11 18:08:21 jsing Exp $ */ 1/* $OpenBSD: s23_srvr.c,v 1.46 2015/10/25 15:49:04 doug Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -247,15 +247,14 @@ ssl23_get_client_hello(SSL *s)
247 * SSLv2 header 247 * SSLv2 header
248 */ 248 */
249 if ((p[3] == 0x00) && (p[4] == 0x02)) { 249 if ((p[3] == 0x00) && (p[4] == 0x02)) {
250 v[0] = p[3]; 250 /* SSLv2 support has been removed */
251 v[1] = p[4]; 251 goto unsupported;
252 /* SSLv2 */ 252
253 if (!(s->options & SSL_OP_NO_SSLv2))
254 type = 1;
255 } else if (p[3] == SSL3_VERSION_MAJOR) { 253 } else if (p[3] == SSL3_VERSION_MAJOR) {
256 v[0] = p[3]; 254 v[0] = p[3];
257 v[1] = p[4]; 255 v[1] = p[4];
258 /* SSLv3/TLSv1 */ 256 /* SSLv3/TLS */
257
259 if (p[4] >= TLS1_VERSION_MINOR) { 258 if (p[4] >= TLS1_VERSION_MINOR) {
260 if (p[4] >= TLS1_2_VERSION_MINOR && 259 if (p[4] >= TLS1_2_VERSION_MINOR &&
261 !(s->options & SSL_OP_NO_TLSv1_2)) { 260 !(s->options & SSL_OP_NO_TLSv1_2)) {
@@ -270,16 +269,13 @@ ssl23_get_client_hello(SSL *s)
270 s->version = TLS1_VERSION; 269 s->version = TLS1_VERSION;
271 /* type=2; */ /* done later to survive restarts */ 270 /* type=2; */ /* done later to survive restarts */
272 s->state = SSL23_ST_SR_CLNT_HELLO_B; 271 s->state = SSL23_ST_SR_CLNT_HELLO_B;
273 } else if (!(s->options & SSL_OP_NO_SSLv3)) { 272 } else {
274 type = 1; 273 goto unsupported;
275 } else if (!(s->options & SSL_OP_NO_SSLv2)) {
276 type = 1;
277 } 274 }
278 } else if (!(s->options & SSL_OP_NO_SSLv3)) { 275 } else {
279 type = 1; 276 /* SSLv3 support has been removed */
280 } else if (!(s->options & SSL_OP_NO_SSLv2)) 277 goto unsupported;
281 type = 1; 278 }
282
283 } 279 }
284 } else if ((p[0] == SSL3_RT_HANDSHAKE) && 280 } else if ((p[0] == SSL3_RT_HANDSHAKE) &&
285 (p[1] == SSL3_VERSION_MAJOR) && 281 (p[1] == SSL3_VERSION_MAJOR) &&
@@ -325,13 +321,18 @@ ssl23_get_client_hello(SSL *s)
325 } else if (!(s->options & SSL_OP_NO_TLSv1)) { 321 } else if (!(s->options & SSL_OP_NO_TLSv1)) {
326 s->version = TLS1_VERSION; 322 s->version = TLS1_VERSION;
327 type = 3; 323 type = 3;
324 } else {
325 goto unsupported;
328 } 326 }
329 } else { 327 } else {
328 /* SSLv3 */
330 if (!(s->options & SSL_OP_NO_TLSv1)) { 329 if (!(s->options & SSL_OP_NO_TLSv1)) {
331 /* we won't be able to use TLS of course, 330 /* we won't be able to use TLS of course,
332 * but this will send an appropriate alert */ 331 * but this will send an appropriate alert */
333 s->version = TLS1_VERSION; 332 s->version = TLS1_VERSION;
334 type = 3; 333 type = 3;
334 } else {
335 goto unsupported;
335 } 336 }
336 } 337 }
337 } 338 }
@@ -454,12 +455,7 @@ ssl23_get_client_hello(SSL *s)
454 /* imaginary new state (for program structure): */ 455 /* imaginary new state (for program structure): */
455 /* s->state = SSL23_SR_CLNT_HELLO_C */ 456 /* s->state = SSL23_SR_CLNT_HELLO_C */
456 457
457 if (type == 1) { 458 if (type == 2 || type == 3) {
458 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
459 return -1;
460 }
461
462 if ((type == 2) || (type == 3)) {
463 /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */ 459 /* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
464 460
465 if (!ssl_init_wbio_buffer(s, 1)) 461 if (!ssl_init_wbio_buffer(s, 1))
@@ -490,12 +486,12 @@ ssl23_get_client_hello(SSL *s)
490 s->method = TLSv1_2_server_method(); 486 s->method = TLSv1_2_server_method();
491 else if (s->version == TLS1_1_VERSION) 487 else if (s->version == TLS1_1_VERSION)
492 s->method = TLSv1_1_server_method(); 488 s->method = TLSv1_1_server_method();
493 else 489 else if (s->version == TLS1_VERSION)
494 s->method = TLSv1_server_method(); 490 s->method = TLSv1_server_method();
491 else
492 goto unsupported;
495 s->handshake_func = s->method->ssl_accept; 493 s->handshake_func = s->method->ssl_accept;
496 } 494 } else {
497
498 if ((type < 1) || (type > 3)) {
499 /* bad, very bad */ 495 /* bad, very bad */
500 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); 496 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
501 return -1; 497 return -1;
@@ -503,4 +499,8 @@ ssl23_get_client_hello(SSL *s)
503 s->init_num = 0; 499 s->init_num = 0;
504 500
505 return (SSL_accept(s)); 501 return (SSL_accept(s));
502
503 unsupported:
504 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
505 return -1;
506} 506}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-23 23:51:25 +0000