int ssl23_get_client_hello(SSL *s)
{
char buf_space[11]; /* Request this many bytes in initial read.
- * We can detect SSL 3.0/TLS 1.0 Client Hellos only
- * when the following is in a single record
- * (not guaranteed by protocol specs):
+ * We can detect SSL 3.0/TLS 1.0 Client Hellos
+ * ('type == 3') correctly only when the following
+ * is in a single record, which is not guaranteed by
+ * the protocol specification:
* Byte Content
* 0 type \
* 1/2 version > record header
* throw this away and implement it in a way
* that makes sense */
{
+#if 0
STACK_OF(SSL_CIPHER) *sk;
SSL_CIPHER *c;
int ne2,ne3;
goto next_bit;
}
}
+#else
+ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_OPTION);
+ goto err;
+#endif
}
}
}
else if ((p[0] == SSL3_RT_HANDSHAKE) &&
(p[1] == SSL3_VERSION_MAJOR) &&
(p[5] == SSL3_MT_CLIENT_HELLO) &&
- (p[9] == p[1]))
+ ((p[3] == 0 && p[4] < 5 /* silly record length? */)
+ || (p[9] == p[1])))
{
/*
* SSLv3 or tls1 header
*/
- /* we must look at client_version inside the client hello: */
- v[0]=p[9]; v[1]=p[10];
+ v[0]=p[1]; /* major version */
+ /* We must look at client_version inside the Client Hello message
+ * to get the correct minor version: */
+ v[1]=p[10];
+ /* However if we have only a pathologically small fragment of the
+ * Client Hello message, we simply use the version from the
+ * record header -- this is incorrect but unlikely to fail in
+ * practice */
+ if (p[3] == 0 && p[4] < 6)
+ v[1]=p[2];
if (v[1] >= TLS1_VERSION_MINOR)
{
if (!(s->options & SSL_OP_NO_TLSv1))
*(d++) = v[1];
/* lets populate the random area */
- /* get the chalenge_length */
+ /* get the challenge_length */
i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;
memset(d,0,SSL3_RANDOM_SIZE);
memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);
if (type == 1)
{
#ifdef NO_SSL2
- SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNKNOWN_PROTOCOL);
+ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
goto err;
#else
/* we are talking sslv2 */