Fix some bugs and document others

[openssl.git] / ssl / s3_srvr.c

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index c6cc4f73a9b65228bcb032c5b85955b73a6fa719..2a9e115e9c5306cb43d71140ed3f2ca80005dcf5 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -57,6 +57,8 @@
  */
 
 #define REUSE_CIPHER_BUG
+#define NETSCAPE_HANG_BUG
+
 
 #include <stdio.h>
 #include <openssl/buffer.h>
@@ -75,9 +77,9 @@ static int ssl3_send_server_hello(SSL *s);
 static int ssl3_send_server_key_exchange(SSL *s);
 static int ssl3_send_certificate_request(SSL *s);
 static int ssl3_send_server_done(SSL *s);
-static int ssl3_get_cert_verify(SSL *s);
 static int ssl3_get_client_key_exchange(SSL *s);
 static int ssl3_get_client_certificate(SSL *s);
+static int ssl3_get_cert_verify(SSL *s);
 static int ssl3_send_hello_request(SSL *s);
 
 static SSL_METHOD *ssl3_get_server_method(int ver)
@@ -142,7 +144,6 @@ int ssl3_accept(SSL *s)
                        s->new_session=1;
                        /* s->state=SSL_ST_ACCEPT; */
 
-               case SSL3_ST_SR_MS_SGC:
                case SSL_ST_BEFORE:
                case SSL_ST_ACCEPT:
                case SSL_ST_BEFORE|SSL_ST_ACCEPT:
@@ -153,7 +154,6 @@ int ssl3_accept(SSL *s)
 
                        if ((s->version>>8) != 3)
                                abort();
-                       /* s->version=SSL3_VERSION; */
                        s->type=SSL_ST_ACCEPT;
 
                        if (s->init_buf == NULL)
@@ -186,7 +186,7 @@ int ssl3_accept(SSL *s)
 
                        if (s->state != SSL_ST_RENEGOTIATE)
                                {
-                               if(s->state != SSL3_ST_SR_MS_SGC) ssl3_init_finished_mac(s);
+                               ssl3_init_finished_mac(s);
                                s->state=SSL3_ST_SR_CLNT_HELLO_A;
                                s->ctx->stats.sess_accept++;
                                }
@@ -270,8 +270,8 @@ int ssl3_accept(SSL *s)
                            || (l & (SSL_DH|SSL_kFZA))
                            || ((l & SSL_kRSA)
                                && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
-                                   || (SSL_IS_EXPORT(l)
-                                       && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_EXPORT_PKEYLENGTH(l)
+                                   || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher)
+                                       && EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher)
                                        )
                                    )
                                )
@@ -313,7 +313,12 @@ int ssl3_accept(SSL *s)
                                s->s3->tmp.cert_request=1;
                                ret=ssl3_send_certificate_request(s);
                                if (ret <= 0) goto end;
+#ifndef NETSCAPE_HANG_BUG
                                s->state=SSL3_ST_SW_SRVR_DONE_A;
+#else
+                               s->state=SSL3_ST_SW_FLUSH;
+                               s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
+#endif
                                s->init_num=0;
                                }
                        break;
@@ -343,10 +348,12 @@ int ssl3_accept(SSL *s)
 
                case SSL3_ST_SR_CERT_A:
                case SSL3_ST_SR_CERT_B:
-                       /* Check for second client hello if MS SGC */
+                       /* Check for second client hello (MS SGC) */
                        ret = ssl3_check_client_hello(s);
-                       if(ret <= 0) goto end;
-                       if(ret == 2) s->state = SSL3_ST_SR_MS_SGC;
+                       if (ret <= 0)
+                               goto end;
+                       if (ret == 2)
+                               s->state = SSL3_ST_SR_CLNT_HELLO_C;
                        else {
                                /* could be sent for a DH cert, even if we
                                 * have not asked for it :-) */
@@ -531,7 +538,21 @@ static int ssl3_check_client_hello(SSL *s)
                &ok);
        if (!ok) return((int)n);
        s->s3->tmp.reuse_message = 1;
-       if(s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO) return 2;
+       if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
+               {
+               /* Throw away what we have done so far in the current handshake,
+                * which will now be aborted. (A full SSL_clear would be too much.)
+                * I hope that tmp.dh is the only thing that may need to be cleared
+                * when a handshake is not completed ... */
+#ifndef NO_DH
+               if (s->s3->tmp.dh != NULL)
+                       {
+                       DH_free(s->s3->tmp.dh);
+                       s->s3->tmp.dh = NULL;
+                       }
+#endif
+               return 2;
+               }
        return 1;
 }
 
@@ -788,7 +809,7 @@ static int ssl3_get_client_hello(SSL *s)
         * compression          - basically ignored right now
         * ssl version is set   - sslv3
         * s->session           - The ssl session has been setup.
-        * s->hit               - sesson reuse flag
+        * s->hit               - session reuse flag
         * s->tmp.new_cipher    - the new cipher to use.
         */
 
@@ -816,7 +837,7 @@ static int ssl3_send_server_hello(SSL *s)
                p=s->s3->server_random;
                Time=time(NULL);                        /* Time */
                l2n(Time,p);
-               RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+               RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
                /* Do the message type and length last */
                d=p= &(buf[4]);
 
@@ -903,7 +924,7 @@ static int ssl3_send_server_key_exchange(SSL *s)
        unsigned int u;
 #endif
 #ifndef NO_DH
-       DH *dh,*dhp;
+       DH *dh=NULL,*dhp;
 #endif
        EVP_PKEY *pkey;
        unsigned char *p,*d;
@@ -963,6 +984,14 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_DH_KEY);
                                goto f_err;
                                }
+
+                       if (s->s3->tmp.dh != NULL)
+                               {
+                               DH_free(dh);
+                               SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, SSL_R_INTERNAL_ERROR);
+                               goto err;
+                               }
+
                        if ((dh=DHparams_dup(dhp)) == NULL)
                                {
                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_DH_LIB);
@@ -1109,7 +1138,7 @@ static int ssl3_send_server_key_exchange(SSL *s)
                s->init_off=0;
                }
 
-       /* SSL3_ST_SW_KEY_EXCH_B */
+       s->state = SSL3_ST_SW_KEY_EXCH_B;
        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 f_err:
        ssl3_send_alert(s,SSL3_AL_FATAL,al);
@@ -1186,6 +1215,17 @@ static int ssl3_send_certificate_request(SSL *s)
 
                s->init_num=n+4;
                s->init_off=0;
+#ifdef NETSCAPE_HANG_BUG
+               p=(unsigned char *)s->init_buf->data + s->init_num;
+
+               /* do the header */
+               *(p++)=SSL3_MT_SERVER_DONE;
+               *(p++)=0;
+               *(p++)=0;
+               *(p++)=0;
+               s->init_num += 4;
+#endif
+
                }
 
        /* SSL3_ST_SW_CERT_REQ_B */
@@ -1273,31 +1313,6 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                i=RSA_private_decrypt((int)n,p,p,rsa,RSA_PKCS1_PADDING);
 
-#if 0
-               /* If a bad decrypt, use a random master key */
-               if ((i != SSL_MAX_MASTER_KEY_LENGTH) ||
-                       ((p[0] != (s->client_version>>8)) ||
-                        (p[1] != (s->client_version & 0xff))))
-                       {
-                       int bad=1;
-
-                       if ((i == SSL_MAX_MASTER_KEY_LENGTH) &&
-                               (p[0] == (s->version>>8)) &&
-                               (p[1] == 0))
-                               {
-                               if (s->options & SSL_OP_TLS_ROLLBACK_BUG)
-                                       bad=0;
-                               }
-                       if (bad)
-                               {
-                               p[0]=(s->version>>8);
-                               p[1]=(s->version & 0xff);
-                               RAND_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
-                               i=SSL_MAX_MASTER_KEY_LENGTH;
-                               }
-                       /* else, an SSLeay bug, ssl only server, tls client */
-                       }
-#else
                if (i != SSL_MAX_MASTER_KEY_LENGTH)
                        {
                        al=SSL_AD_DECODE_ERROR;
@@ -1320,7 +1335,6 @@ static int ssl3_get_client_key_exchange(SSL *s)
                memset(p,0,i);
                }
        else
-#endif
 #ifndef NO_DH
                if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                {