X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=ssl%2Ft1_trce.c;h=394df980a0aca332ac24b9361b9b97313f56df39;hb=447cc0ad732858f3ab80b2dc52f15fd045b25363;hp=3bd25a5b1af02ad933dd44c0c3c83c5d24c0d5c8;hpb=ee1ed1d380f1bd3508186ddf78de678a7072f115;p=openssl.git diff --git a/ssl/t1_trce.c b/ssl/t1_trce.c index 3bd25a5b1a..394df980a0 100644 --- a/ssl/t1_trce.c +++ b/ssl/t1_trce.c @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2012-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -25,7 +25,8 @@ typedef struct { do_ssl_trace_list(bio, indent, msg, msglen, value, \ table, OSSL_NELEM(table)) -static const char *do_ssl_trace_str(int val, ssl_trace_tbl *tbl, size_t ntbl) +static const char *do_ssl_trace_str(int val, const ssl_trace_tbl *tbl, + size_t ntbl) { size_t i; @@ -38,7 +39,7 @@ static const char *do_ssl_trace_str(int val, ssl_trace_tbl *tbl, size_t ntbl) static int do_ssl_trace_list(BIO *bio, int indent, const unsigned char *msg, size_t msglen, - size_t vlen, ssl_trace_tbl *tbl, size_t ntbl) + size_t vlen, const ssl_trace_tbl *tbl, size_t ntbl) { int val; @@ -58,7 +59,7 @@ static int do_ssl_trace_list(BIO *bio, int indent, /* Version number */ -static ssl_trace_tbl ssl_version_tbl[] = { +static const ssl_trace_tbl ssl_version_tbl[] = { {SSL3_VERSION, "SSL 3.0"}, {TLS1_VERSION, "TLS 1.0"}, {TLS1_1_VERSION, "TLS 1.1"}, @@ -71,22 +72,21 @@ static ssl_trace_tbl ssl_version_tbl[] = { {DTLS1_BAD_VER, "DTLS 1.0 (bad)"} }; -static ssl_trace_tbl ssl_content_tbl[] = { +static const ssl_trace_tbl ssl_content_tbl[] = { {SSL3_RT_CHANGE_CIPHER_SPEC, "ChangeCipherSpec"}, {SSL3_RT_ALERT, "Alert"}, {SSL3_RT_HANDSHAKE, "Handshake"}, {SSL3_RT_APPLICATION_DATA, "ApplicationData"}, }; -/* Handshake types */ -static ssl_trace_tbl ssl_handshake_tbl[] = { +/* Handshake types, sorted by ascending id */ +static const ssl_trace_tbl ssl_handshake_tbl[] = { {SSL3_MT_HELLO_REQUEST, "HelloRequest"}, {SSL3_MT_CLIENT_HELLO, "ClientHello"}, {SSL3_MT_SERVER_HELLO, "ServerHello"}, {DTLS1_MT_HELLO_VERIFY_REQUEST, "HelloVerifyRequest"}, {SSL3_MT_NEWSESSION_TICKET, "NewSessionTicket"}, {SSL3_MT_END_OF_EARLY_DATA, "EndOfEarlyData"}, - {SSL3_MT_HELLO_RETRY_REQUEST, "HelloRetryRequest"}, {SSL3_MT_ENCRYPTED_EXTENSIONS, "EncryptedExtensions"}, {SSL3_MT_CERTIFICATE, "Certificate"}, {SSL3_MT_SERVER_KEY_EXCHANGE, "ServerKeyExchange"}, @@ -94,10 +94,10 @@ static ssl_trace_tbl ssl_handshake_tbl[] = { {SSL3_MT_SERVER_DONE, "ServerHelloDone"}, {SSL3_MT_CERTIFICATE_VERIFY, "CertificateVerify"}, {SSL3_MT_CLIENT_KEY_EXCHANGE, "ClientKeyExchange"}, - {SSL3_MT_CERTIFICATE_STATUS, "CertificateStatus"}, - {SSL3_MT_CLIENT_KEY_EXCHANGE, "ClientKeyExchange"}, {SSL3_MT_FINISHED, "Finished"}, + {SSL3_MT_CERTIFICATE_URL, "CertificateUrl"}, {SSL3_MT_CERTIFICATE_STATUS, "CertificateStatus"}, + {SSL3_MT_SUPPLEMENTAL_DATA, "SupplementalData"}, {SSL3_MT_KEY_UPDATE, "KeyUpdate"}, # ifndef OPENSSL_NO_NEXTPROTONEG {SSL3_MT_NEXT_PROTO, "NextProto"}, @@ -106,7 +106,7 @@ static ssl_trace_tbl ssl_handshake_tbl[] = { }; /* Cipher suites */ -static ssl_trace_tbl ssl_ciphers_tbl[] = { +static const ssl_trace_tbl ssl_ciphers_tbl[] = { {0x0000, "TLS_NULL_WITH_NULL_NULL"}, {0x0001, "TLS_RSA_WITH_NULL_MD5"}, {0x0002, "TLS_RSA_WITH_NULL_SHA"}, @@ -184,6 +184,8 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = { {0x006B, "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"}, {0x006C, "TLS_DH_anon_WITH_AES_128_CBC_SHA256"}, {0x006D, "TLS_DH_anon_WITH_AES_256_CBC_SHA256"}, + {0x0081, "TLS_GOSTR341001_WITH_28147_CNT_IMIT"}, + {0x0083, "TLS_GOSTR341001_WITH_NULL_GOSTR3411"}, {0x0084, "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"}, {0x0085, "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA"}, {0x0086, "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA"}, @@ -441,16 +443,18 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = { {0x1305, "TLS_AES_128_CCM_8_SHA256"}, {0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"}, {0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"}, + {0xFF85, "GOST2012-GOST8912-GOST8912"}, + {0xFF87, "GOST2012-NULL-GOST12"}, }; /* Compression methods */ -static ssl_trace_tbl ssl_comp_tbl[] = { +static const ssl_trace_tbl ssl_comp_tbl[] = { {0x0000, "No Compression"}, {0x0001, "Zlib Compression"} }; -/* Extensions */ -static ssl_trace_tbl ssl_exts_tbl[] = { +/* Extensions sorted by ascending id */ +static const ssl_trace_tbl ssl_exts_tbl[] = { {TLSEXT_TYPE_server_name, "server_name"}, {TLSEXT_TYPE_max_fragment_length, "max_fragment_length"}, {TLSEXT_TYPE_client_certificate_url, "client_certificate_url"}, @@ -461,30 +465,35 @@ static ssl_trace_tbl ssl_exts_tbl[] = { {TLSEXT_TYPE_client_authz, "client_authz"}, {TLSEXT_TYPE_server_authz, "server_authz"}, {TLSEXT_TYPE_cert_type, "cert_type"}, - {TLSEXT_TYPE_key_share, "key_share"}, - {TLSEXT_TYPE_psk, "psk"}, - {TLSEXT_TYPE_psk_kex_modes, "psk_key_exchange_modes"}, {TLSEXT_TYPE_supported_groups, "supported_groups"}, {TLSEXT_TYPE_ec_point_formats, "ec_point_formats"}, {TLSEXT_TYPE_srp, "srp"}, {TLSEXT_TYPE_signature_algorithms, "signature_algorithms"}, {TLSEXT_TYPE_use_srtp, "use_srtp"}, - {TLSEXT_TYPE_session_ticket, "session_ticket"}, - {TLSEXT_TYPE_supported_versions, "supported_versions"}, - {TLSEXT_TYPE_renegotiate, "renegotiate"}, -# ifndef OPENSSL_NO_NEXTPROTONEG - {TLSEXT_TYPE_next_proto_neg, "next_proto_neg"}, -# endif + {TLSEXT_TYPE_heartbeat, "tls_heartbeat"}, {TLSEXT_TYPE_application_layer_protocol_negotiation, "application_layer_protocol_negotiation"}, {TLSEXT_TYPE_signed_certificate_timestamp, "signed_certificate_timestamps"}, {TLSEXT_TYPE_padding, "padding"}, {TLSEXT_TYPE_encrypt_then_mac, "encrypt_then_mac"}, {TLSEXT_TYPE_extended_master_secret, "extended_master_secret"}, - {TLSEXT_TYPE_early_data, "early_data"} + {TLSEXT_TYPE_session_ticket, "session_ticket"}, + {TLSEXT_TYPE_psk, "psk"}, + {TLSEXT_TYPE_early_data, "early_data"}, + {TLSEXT_TYPE_supported_versions, "supported_versions"}, + {TLSEXT_TYPE_cookie, "cookie_ext"}, + {TLSEXT_TYPE_psk_kex_modes, "psk_key_exchange_modes"}, + {TLSEXT_TYPE_certificate_authorities, "certificate_authorities"}, + {TLSEXT_TYPE_post_handshake_auth, "post_handshake_auth"}, + {TLSEXT_TYPE_signature_algorithms_cert, "signature_algorithms_cert"}, + {TLSEXT_TYPE_key_share, "key_share"}, + {TLSEXT_TYPE_renegotiate, "renegotiate"}, +# ifndef OPENSSL_NO_NEXTPROTONEG + {TLSEXT_TYPE_next_proto_neg, "next_proto_neg"}, +# endif }; -static ssl_trace_tbl ssl_groups_tbl[] = { +static const ssl_trace_tbl ssl_groups_tbl[] = { {1, "sect163k1 (K-163)"}, {2, "sect163r1"}, {3, "sect163r2 (B-163)"}, @@ -514,6 +523,7 @@ static ssl_trace_tbl ssl_groups_tbl[] = { {27, "brainpoolP384r1"}, {28, "brainpoolP512r1"}, {29, "ecdh_x25519"}, + {30, "ecdh_x448"}, {256, "ffdhe2048"}, {257, "ffdhe3072"}, {258, "ffdhe4096"}, @@ -523,22 +533,34 @@ static ssl_trace_tbl ssl_groups_tbl[] = { {0xFF02, "arbitrary_explicit_char2_curves"} }; -static ssl_trace_tbl ssl_point_tbl[] = { +static const ssl_trace_tbl ssl_point_tbl[] = { {0, "uncompressed"}, {1, "ansiX962_compressed_prime"}, {2, "ansiX962_compressed_char2"} }; -static ssl_trace_tbl ssl_sigalg_tbl[] = { +static const ssl_trace_tbl ssl_mfl_tbl[] = { + {0, "disabled"}, + {1, "max_fragment_length := 2^9 (512 bytes)"}, + {2, "max_fragment_length := 2^10 (1024 bytes)"}, + {3, "max_fragment_length := 2^11 (2048 bytes)"}, + {4, "max_fragment_length := 2^12 (4096 bytes)"} +}; + +static const ssl_trace_tbl ssl_sigalg_tbl[] = { {TLSEXT_SIGALG_ecdsa_secp256r1_sha256, "ecdsa_secp256r1_sha256"}, {TLSEXT_SIGALG_ecdsa_secp384r1_sha384, "ecdsa_secp384r1_sha384"}, {TLSEXT_SIGALG_ecdsa_secp521r1_sha512, "ecdsa_secp521r1_sha512"}, {TLSEXT_SIGALG_ecdsa_sha224, "ecdsa_sha224"}, {TLSEXT_SIGALG_ed25519, "ed25519"}, + {TLSEXT_SIGALG_ed448, "ed448"}, {TLSEXT_SIGALG_ecdsa_sha1, "ecdsa_sha1"}, - {TLSEXT_SIGALG_rsa_pss_sha256, "rsa_pss_sha256"}, - {TLSEXT_SIGALG_rsa_pss_sha384, "rsa_pss_sha384"}, - {TLSEXT_SIGALG_rsa_pss_sha512, "rsa_pss_sha512"}, + {TLSEXT_SIGALG_rsa_pss_rsae_sha256, "rsa_pss_rsae_sha256"}, + {TLSEXT_SIGALG_rsa_pss_rsae_sha384, "rsa_pss_rsae_sha384"}, + {TLSEXT_SIGALG_rsa_pss_rsae_sha512, "rsa_pss_rsae_sha512"}, + {TLSEXT_SIGALG_rsa_pss_pss_sha256, "rsa_pss_pss_sha256"}, + {TLSEXT_SIGALG_rsa_pss_pss_sha384, "rsa_pss_pss_sha384"}, + {TLSEXT_SIGALG_rsa_pss_pss_sha512, "rsa_pss_pss_sha512"}, {TLSEXT_SIGALG_rsa_pkcs1_sha256, "rsa_pkcs1_sha256"}, {TLSEXT_SIGALG_rsa_pkcs1_sha384, "rsa_pkcs1_sha384"}, {TLSEXT_SIGALG_rsa_pkcs1_sha512, "rsa_pkcs1_sha512"}, @@ -554,7 +576,7 @@ static ssl_trace_tbl ssl_sigalg_tbl[] = { {TLSEXT_SIGALG_gostr34102001_gostr3411, "gost2001_gost94"}, }; -static ssl_trace_tbl ssl_ctype_tbl[] = { +static const ssl_trace_tbl ssl_ctype_tbl[] = { {1, "rsa_sign"}, {2, "dss_sign"}, {3, "rsa_fixed_dh"}, @@ -567,12 +589,12 @@ static ssl_trace_tbl ssl_ctype_tbl[] = { {66, "ecdsa_fixed_ecdh"} }; -static ssl_trace_tbl ssl_psk_kex_modes_tbl[] = { +static const ssl_trace_tbl ssl_psk_kex_modes_tbl[] = { {TLSEXT_KEX_MODE_KE, "psk_ke"}, {TLSEXT_KEX_MODE_KE_DHE, "psk_dhe_ke"} }; -static ssl_trace_tbl ssl_key_update_tbl[] = { +static const ssl_trace_tbl ssl_key_update_tbl[] = { {SSL_KEY_UPDATE_NOT_REQUESTED, "update_not_requested"}, {SSL_KEY_UPDATE_REQUESTED, "update_requested"} }; @@ -589,8 +611,7 @@ static void ssl_print_hex(BIO *bio, int indent, const char *name, BIO_puts(bio, "\n"); } -static int ssl_print_hexbuf(BIO *bio, int indent, - const char *name, size_t nlen, +static int ssl_print_hexbuf(BIO *bio, int indent, const char *name, size_t nlen, const unsigned char **pmsg, size_t *pmsglen) { size_t blen; @@ -651,12 +672,12 @@ static int ssl_print_random(BIO *bio, int indent, return 1; } -static int ssl_print_signature(BIO *bio, int indent, SSL *s, +static int ssl_print_signature(BIO *bio, int indent, const SSL *ssl, const unsigned char **pmsg, size_t *pmsglen) { if (*pmsglen < 2) return 0; - if (SSL_USE_SIGALGS(s)) { + if (SSL_USE_SIGALGS(ssl)) { const unsigned char *p = *pmsg; unsigned int sigalg = (p[0] << 8) | p[1]; @@ -681,6 +702,12 @@ static int ssl_print_extension(BIO *bio, int indent, int server, BIO_printf(bio, "extension_type=%s(%d), length=%d\n", ssl_trace_str(extype, ssl_exts_tbl), extype, (int)extlen); switch (extype) { + case TLSEXT_TYPE_max_fragment_length: + if (extlen < 1) + return 0; + xlen = extlen; + return ssl_trace_list(bio, indent + 2, ext, xlen, 1, ssl_mfl_tbl); + case TLSEXT_TYPE_ec_point_formats: if (extlen < 1) return 0; @@ -706,7 +733,7 @@ static int ssl_print_extension(BIO *bio, int indent, int server, while (xlen > 0) { size_t plen = *ext++; - if (plen > xlen + 1) + if (plen + 1 > xlen) return 0; BIO_indent(bio, indent + 2, 80); BIO_write(bio, ext, plen); @@ -769,11 +796,10 @@ static int ssl_print_extension(BIO *bio, int indent, int server, break; case TLSEXT_TYPE_key_share: - if (mt == SSL3_MT_HELLO_RETRY_REQUEST) { + if (server && extlen == 2) { int group_id; - if (extlen != 2) - return 0; + /* We assume this is an HRR, otherwise this is an invalid key_share */ group_id = (ext[0] << 8) | ext[1]; BIO_indent(bio, indent + 4, 80); BIO_printf(bio, "NamedGroup: %s (%d)\n", @@ -809,6 +835,17 @@ static int ssl_print_extension(BIO *bio, int indent, int server, break; case TLSEXT_TYPE_supported_versions: + if (server) { + int version; + + if (extlen != 2) + return 0; + version = (ext[0] << 8) | ext[1]; + BIO_indent(bio, indent + 4, 80); + BIO_printf(bio, "%s (%d)\n", + ssl_trace_str(version, ssl_version_tbl), version); + break; + } if (extlen < 1) return 0; xlen = ext[0]; @@ -855,6 +892,8 @@ static int ssl_print_extensions(BIO *bio, int indent, int server, BIO_puts(bio, "No Extensions\n"); return 1; } + if (msglen < 2) + return 0; extslen = (msg[0] << 8) | msg[1]; if (extslen != msglen - 2) return 0; @@ -868,8 +907,12 @@ static int ssl_print_extensions(BIO *bio, int indent, int server, return 0; extype = (msg[0] << 8) | msg[1]; extlen = (msg[2] << 8) | msg[3]; - if (msglen < extlen + 4) + if (msglen < extlen + 4) { + BIO_printf(bio, "extensions, extype = %d, extlen = %d\n", extype, + (int)extlen); + BIO_dump_indent(bio, (const char *)msg, msglen, indent + 2); return 0; + } msg += 4; if (!ssl_print_extension(bio, indent + 2, server, mt, extype, msg, extlen)) @@ -883,7 +926,7 @@ static int ssl_print_extensions(BIO *bio, int indent, int server, return 1; } -static int ssl_print_client_hello(BIO *bio, SSL *ssl, int indent, +static int ssl_print_client_hello(BIO *bio, const SSL *ssl, int indent, const unsigned char *msg, size_t msglen) { size_t len; @@ -986,30 +1029,7 @@ static int ssl_print_server_hello(BIO *bio, int indent, return 1; } -static int ssl_print_hello_retry_request(BIO *bio, int indent, - const unsigned char *msg, - size_t msglen) -{ - unsigned int cs; - - if (!ssl_print_version(bio, indent, "server_version", &msg, &msglen, NULL)) - return 0; - - cs = (msg[0] << 8) | msg[1]; - BIO_indent(bio, indent, 80); - BIO_printf(bio, "cipher_suite {0x%02X, 0x%02X} %s\n", - msg[0], msg[1], ssl_trace_str(cs, ssl_ciphers_tbl)); - msg += 2; - msglen -= 2; - - if (!ssl_print_extensions(bio, indent, 1, SSL3_MT_HELLO_RETRY_REQUEST, &msg, - &msglen)) - return 0; - - return 1; -} - -static int ssl_get_keyex(const char **pname, SSL *ssl) +static int ssl_get_keyex(const char **pname, const SSL *ssl) { unsigned long alg_k = ssl->s3->tmp.new_cipher->algorithm_mkey; @@ -1053,7 +1073,7 @@ static int ssl_get_keyex(const char **pname, SSL *ssl) return 0; } -static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl, +static int ssl_print_client_keyex(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { const char *algname; @@ -1072,10 +1092,10 @@ static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl, case SSL_kRSAPSK: if (TLS1_get_version(ssl) == SSL3_VERSION) { ssl_print_hex(bio, indent + 2, - "EncyptedPreMasterSecret", msg, msglen); + "EncryptedPreMasterSecret", msg, msglen); } else { if (!ssl_print_hexbuf(bio, indent + 2, - "EncyptedPreMasterSecret", 2, &msg, &msglen)) + "EncryptedPreMasterSecret", 2, &msg, &msglen)) return 0; } break; @@ -1097,7 +1117,7 @@ static int ssl_print_client_keyex(BIO *bio, int indent, SSL *ssl, return !msglen; } -static int ssl_print_server_keyex(BIO *bio, int indent, SSL *ssl, +static int ssl_print_server_keyex(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { const char *algname; @@ -1202,12 +1222,13 @@ static int ssl_print_certificate(BIO *bio, int indent, return 1; } -static int ssl_print_certificates(BIO *bio, SSL *s, int server, int indent, - const unsigned char *msg, size_t msglen) +static int ssl_print_certificates(BIO *bio, const SSL *ssl, int server, + int indent, const unsigned char *msg, + size_t msglen) { size_t clen; - if (SSL_IS_TLS13(s) + if (SSL_IS_TLS13(ssl) && !ssl_print_hexbuf(bio, indent, "context", 1, &msg, &msglen)) return 0; @@ -1230,15 +1251,19 @@ static int ssl_print_certificates(BIO *bio, SSL *s, int server, int indent, return 1; } -static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, +static int ssl_print_cert_request(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { size_t xlen; unsigned int sigalg; - if (SSL_IS_TLS13(s)) { + if (SSL_IS_TLS13(ssl)) { if (!ssl_print_hexbuf(bio, indent, "request_context", 1, &msg, &msglen)) return 0; + if (!ssl_print_extensions(bio, indent, 1, + SSL3_MT_CERTIFICATE_REQUEST, &msg, &msglen)) + return 0; + return 1; } else { if (msglen < 1) return 0; @@ -1253,7 +1278,7 @@ static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, msg += xlen; msglen -= xlen + 1; } - if (SSL_USE_SIGALGS(s)) { + if (SSL_USE_SIGALGS(ssl)) { if (msglen < 2) return 0; xlen = (msg[0] << 8) | msg[1]; @@ -1274,6 +1299,8 @@ static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, msg += xlen; } + if (msglen < 2) + return 0; xlen = (msg[0] << 8) | msg[1]; BIO_indent(bio, indent, 80); if (msglen < xlen + 2) @@ -1305,15 +1332,15 @@ static int ssl_print_cert_request(BIO *bio, int indent, SSL *s, xlen -= dlen + 2; msg += dlen; } - if (SSL_IS_TLS13(s)) { - if (!ssl_print_hexbuf(bio, indent, "request_extensions", 2, - &msg, &msglen)) - return 0; + if (SSL_IS_TLS13(ssl)) { + if (!ssl_print_hexbuf(bio, indent, "request_extensions", 2, + &msg, &msglen)) + return 0; } return msglen == 0; } -static int ssl_print_ticket(BIO *bio, int indent, SSL *s, +static int ssl_print_ticket(BIO *bio, int indent, const SSL *ssl, const unsigned char *msg, size_t msglen) { unsigned int tick_life; @@ -1330,7 +1357,7 @@ static int ssl_print_ticket(BIO *bio, int indent, SSL *s, msg += 4; BIO_indent(bio, indent + 2, 80); BIO_printf(bio, "ticket_lifetime_hint=%u\n", tick_life); - if (SSL_IS_TLS13(s)) { + if (SSL_IS_TLS13(ssl)) { unsigned int ticket_age_add; if (msglen < 4) @@ -1347,16 +1374,16 @@ static int ssl_print_ticket(BIO *bio, int indent, SSL *s, } if (!ssl_print_hexbuf(bio, indent + 2, "ticket", 2, &msg, &msglen)) return 0; - if (SSL_IS_TLS13(s) && !ssl_print_extensions(bio, indent + 2, 0, - SSL3_MT_NEWSESSION_TICKET, - &msg, &msglen)) + if (SSL_IS_TLS13(ssl) + && !ssl_print_extensions(bio, indent + 2, 0, + SSL3_MT_NEWSESSION_TICKET, &msg, &msglen)) return 0; if (msglen) return 0; return 1; } -static int ssl_print_handshake(BIO *bio, SSL *ssl, int server, +static int ssl_print_handshake(BIO *bio, const SSL *ssl, int server, const unsigned char *msg, size_t msglen, int indent) { @@ -1441,11 +1468,6 @@ static int ssl_print_handshake(BIO *bio, SSL *ssl, int server, return 0; break; - case SSL3_MT_HELLO_RETRY_REQUEST: - if (!ssl_print_hello_retry_request(bio, indent + 2, msg, msglen)) - return 0; - break; - case SSL3_MT_ENCRYPTED_EXTENSIONS: if (!ssl_print_extensions(bio, indent + 2, 1, SSL3_MT_ENCRYPTED_EXTENSIONS, &msg, &msglen)) @@ -1479,7 +1501,16 @@ void SSL_trace(int write_p, int version, int content_type, switch (content_type) { case SSL3_RT_HEADER: { - int hvers = msg[1] << 8 | msg[2]; + int hvers; + + /* avoid overlapping with length at the end of buffer */ + if (msglen < (size_t)(SSL_IS_DTLS(ssl) ? + DTLS1_RT_HEADER_LENGTH : SSL3_RT_HEADER_LENGTH)) { + BIO_puts(bio, write_p ? "Sent" : "Received"); + ssl_print_hex(bio, 0, " too short message", msg, msglen); + break; + } + hvers = msg[1] << 8 | msg[2]; BIO_puts(bio, write_p ? "Sent" : "Received"); BIO_printf(bio, " Record\nHeader:\n Version = %s (0x%x)\n", ssl_trace_str(hvers, ssl_version_tbl), hvers);