Update from 1.0.0-stable.

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 727827f91d3e68df6a8f1fe859ac4e46d0a6a82b..7aa1c037b25758d97edb56a0cd6bd97e957b7508 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2821,13 +2821,11 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
        SSL_CIPHER *c,*ret=NULL;
        STACK_OF(SSL_CIPHER) *prio, *allow;
        int i,ii,ok;
-#ifndef OPENSSL_NO_TLSEXT
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_EC)
        unsigned int j;
-#ifndef OPENSSL_NO_EC
        int ec_ok, ec_nid;
        unsigned char ec_search1 = 0, ec_search2 = 0;
-#endif /* OPENSSL_NO_EC */
-#endif /* OPENSSL_NO_TLSEXT */
+#endif
        CERT *cert;
        unsigned long alg_k,alg_a,mask_k,mask_a,emask_k,emask_a;
 
@@ -3089,6 +3087,18 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
 
        alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 
+#ifndef OPENSSL_NO_GOST
+       if (s->version >= TLS1_VERSION)
+               {
+               if (alg_k & SSL_kGOST)
+                       {
+                       p[ret++]=TLS_CT_GOST94_SIGN;
+                       p[ret++]=TLS_CT_GOST01_SIGN;
+                       return(ret);
+                       }
+               }
+#endif
+
 #ifndef OPENSSL_NO_DH
        if (alg_k & (SSL_kDHr|SSL_kEDH))
                {
@@ -3138,6 +3148,7 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
 
 int ssl3_shutdown(SSL *s)
        {
+       int ret;
 
        /* Don't do anything much if we have not done the handshake or
         * we don't want to send messages :-) */
@@ -3155,18 +3166,32 @@ int ssl3_shutdown(SSL *s)
 #endif
                /* our shutdown alert has been sent now, and if it still needs
                 * to be written, s->s3->alert_dispatch will be true */
+               if (s->s3->alert_dispatch)
+                       return(-1);     /* return WANT_WRITE */
                }
        else if (s->s3->alert_dispatch)
                {
                /* resend it if not sent */
 #if 1
-               s->method->ssl_dispatch_alert(s);
+               ret=s->method->ssl_dispatch_alert(s);
+               if(ret == -1)
+                       {
+                       /* we only get to return -1 here the 2nd/Nth
+                        * invocation, we must  have already signalled
+                        * return 0 upon a previous invoation,
+                        * return WANT_WRITE */
+                       return(ret);
+                       }
 #endif
                }
        else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
                {
                /* If we are waiting for a close from our peer, we are closed */
                s->method->ssl_read_bytes(s,0,NULL,0,0);
+               if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
+                       {
+                       return(-1);     /* return WANT_READ */
+                       }
                }
 
        if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&