Changeset 808 for openssl/trunk/ssl/s3_srvr.c

Timestamp:

Aug 7, 2014, 8:25:37 PM (11 years ago)

Author:

dmik

Message:

openssl: Merge version 1.0.0n from vendor to trunk.

Location:

openssl/trunk

Files:

• . (modified) (1 prop)
• ssl/s3_srvr.c (modified) (21 diffs)

openssl/trunk/ssl/s3_srvr.c ¶

@@ -259 +259 @@
 
                         s->init_num=0;
+                        s->s3->flags &= ~SSL3_FLAGS_SGC_RESTART_DONE;
 
                         if (s->state != SSL_ST_RENEGOTIATE)
@@ -578 +579 @@
                 case SSL3_ST_SR_CERT_VRFY_B:
 
+                        s->s3->flags |= SSL3_FLAGS_CCS_OK;
                         /* we should decide if we expected this one */
                         ret=ssl3_get_cert_verify(s);
@@ -588 +590 @@
                 case SSL3_ST_SR_FINISHED_A:
                 case SSL3_ST_SR_FINISHED_B:
+                        s->s3->flags |= SSL3_FLAGS_CCS_OK;
                         ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
                                 SSL3_ST_SR_FINISHED_B);
@@ -768 +771 @@
         if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
                 {
+                /* We only allow the client to restart the handshake once per
+                 * negotiation. */
+                if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
+                        {
+                        SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
+                        return -1;
+                        }
                 /* Throw away what we have done so far in the current handshake,
-                 * which will now be aborted. (A full SSL_clear would be too much.)
-                 * I hope that tmp.dh is the only thing that may need to be cleared
-                 * when a handshake is not completed ... */
+                 * which will now be aborted. (A full SSL_clear would be too much.) */
 #ifndef OPENSSL_NO_DH
                 if (s->s3->tmp.dh != NULL)
@@ -779 +787 @@
                         }
 #endif
+#ifndef OPENSSL_NO_ECDH
+                if (s->s3->tmp.ecdh != NULL)
+                        {
+                        EC_KEY_free(s->s3->tmp.ecdh);
+                        s->s3->tmp.ecdh = NULL;
+                        }
+#endif
+                s->s3->flags |= SSL3_FLAGS_SGC_RESTART_DONE;
                 return 2;
                 }
@@ -986 +1002 @@
                                 }
                         }
+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0
                 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                         {
@@ -1000 +1020 @@
                                 }
                         }
+#endif
                 if (j == 0)
                         {
@@ -1045 +1066 @@
                         }
                 }
-                if (ssl_check_clienthello_tlsext(s) <= 0) {
+                if (ssl_check_clienthello_tlsext_early(s) <= 0) {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
                         goto err;
@@ -1251 +1272 @@
 
         if (!ssl3_digest_cached_records(s))
+                {
+                al = SSL_AD_INTERNAL_ERROR;
                 goto f_err;
+                }
         
         /* we now have the following setup. 
@@ -1263 +1287 @@
          * s->tmp.new_cipher    - the new cipher to use.
          */
+
+#ifndef OPENSSL_NO_TLSEXT
+        /* Handles TLS extensions that we couldn't check earlier */
+        if (s->version >= SSL3_VERSION)
+                {
+                if (ssl_check_clienthello_tlsext_late(s) <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
+                        goto err;
+                        }
+                }
+#endif
 
         if (ret < 0) ret=1;
@@ -1487 +1523 @@
                         if (s->s3->tmp.dh != NULL)
                                 {
-                                DH_free(dh);
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
                                 goto err;
@@ -1548 +1583 @@
                         if (s->s3->tmp.ecdh != NULL)
                                 {
-                                EC_KEY_free(s->s3->tmp.ecdh); 
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
                                 goto err;
@@ -1559 +1593 @@
                                 goto err;
                                 }
-                        if (!EC_KEY_up_ref(ecdhp))
+                        if ((ecdh = EC_KEY_dup(ecdhp)) == NULL)
                                 {
                                 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
                                 goto err;
                                 }
-                        ecdh = ecdhp;
 
                         s->s3->tmp.ecdh=ecdh;
@@ -1727 +1760 @@
                             encodedlen);
                         OPENSSL_free(encodedPoint);
+                        encodedPoint = NULL;
                         p += encodedlen;
                         }
@@ -1913 +1947 @@
                 s->init_off=0;
 #ifdef NETSCAPE_HANG_BUG
+                if (!BUF_MEM_grow_clean(buf, s->init_num + 4))
+                        {
+                        SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
+                        goto err;
+                        }
                 p=(unsigned char *)s->init_buf->data + s->init_num;
 
@@ -2123 +2162 @@
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
+                        BN_clear_free(pub);
                         goto err;
                         }
@@ -2436 +2476 @@
                         i = *p; 
                         p += 1;
+                        if (n != 1 + i)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_EC_LIB);
+                                goto err;
+                                }
                         if (EC_POINT_oct2point(group, 
                             clnt_ecpoint, p, i, bn_ctx) == 0)
@@ -2580 +2626 @@
                         int ret = 0;
                         EVP_PKEY_CTX *pkey_ctx;
-                        EVP_PKEY *client_pub_pkey = NULL;
+                        EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
                         unsigned char premaster_secret[32], *start;
-                        size_t outlen=32, inlen;                        
+                        size_t outlen=32, inlen;
+                        unsigned long alg_a;
+                        int Ttag, Tclass;
+                        long Tlen;
 
                         /* Get our certificate private key*/
-                        pkey_ctx = EVP_PKEY_CTX_new(s->cert->key->privatekey,NULL);     
+                        alg_a = s->s3->tmp.new_cipher->algorithm_auth;
+                        if (alg_a & SSL_aGOST94)
+                                pk = s->cert->pkeys[SSL_PKEY_GOST94].privatekey;
+                        else if (alg_a & SSL_aGOST01)
+                                pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
+
+                        pkey_ctx = EVP_PKEY_CTX_new(pk,NULL);
                         EVP_PKEY_decrypt_init(pkey_ctx);
                         /* If client certificate is present and is of the same type, maybe
@@ -2598 +2653 @@
                                 }
                         /* Decrypt session key */
-                        if ((*p!=( V_ASN1_SEQUENCE| V_ASN1_CONSTRUCTED))) 
+                        if (ASN1_get_object((const unsigned char **)&p, &Tlen, &Ttag, &Tclass, n) != V_ASN1_CONSTRUCTED || 
+                                Ttag != V_ASN1_SEQUENCE ||
+                                Tclass != V_ASN1_UNIVERSAL) 
                                 {
                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DECRYPTION_FAILED);
                                 goto gerr;
                                 }
-                        if (p[1] == 0x81)
-                                {
-                                start = p+3;
-                                inlen = p[2];
-                                }
-                        else if (p[1] < 0x80)
-                                {
-                                start = p+2;
-                                inlen = p[1];
-                                }
-                        else
-                                {
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_DECRYPTION_FAILED);
-                                goto gerr;
-                                }
+                        start = p;
+                        inlen = Tlen;
                         if (EVP_PKEY_decrypt(pkey_ctx,premaster_secret,&outlen,start,inlen) <=0) 
 
@@ -2678 +2722 @@
                 SSL3_ST_SR_CERT_VRFY_B,
                 -1,
-                514, /* 514? */
+                SSL3_RT_MAX_PLAIN_LENGTH,
                 &ok);
 
@@ -2698 +2742 @@
                 {
                 s->s3->tmp.reuse_message=1;
-                if ((peer != NULL) && (type | EVP_PKT_SIGN))
+                if ((peer != NULL) && (type & EVP_PKT_SIGN))
                         {
                         al=SSL_AD_UNEXPECTED_MESSAGE;