Only use explicit IV if cipher is in CBC mode.

[openssl.git] / ssl / s3_pkt.c

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index febc2860e1f49defac832249a4d7ce3d0fef1108..a168f934a99037e600e997cbb2e4a0e836c47a6f 100644 (file)
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -115,6 +115,7 @@
 #include "ssl_locl.h"
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
+#include <openssl/rand.h>
 
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                         unsigned int len, int create_empty_fragment);
@@ -336,9 +337,9 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
                        if (version != s->version)
                                {
                                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
-                               /* Send back error using their
-                                * version number :-) */
-                               s->version=version;
+                                if ((s->version & 0xFF00) == (version & 0xFF00))
+                                       /* Send back error using their minor version number :-) */
+                                       s->version = (unsigned short)version;
                                al=SSL_AD_PROTOCOL_VERSION;
                                goto f_err;
                                }
@@ -629,6 +630,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
        unsigned char *p,*plen;
        int i,mac_size,clear=0;
        int prefix_len=0;
+       int eivlen;
        long align=0;
        SSL3_RECORD *wr;
        SSL3_BUFFER *wb=&(s->s3->wbuf);
@@ -738,9 +740,19 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
        /* field where we are to write out packet length */
        plen=p; 
        p+=2;
+       /* Explicit IV length, block ciphers and TLS version 1.1 or later */
+       if (s->enc_write_ctx && s->version >= TLS1_1_VERSION
+               && EVP_CIPHER_CTX_mode(s->enc_write_ctx) == EVP_CIPH_CBC_MODE)
+               {
+               eivlen = EVP_CIPHER_CTX_iv_length(s->enc_write_ctx);
+               if (eivlen <= 1)
+                       eivlen = 0;
+               }
+       else 
+               eivlen = 0;
 
        /* lets setup the record stuff. */
-       wr->data=p;
+       wr->data=p + eivlen;
        wr->length=(int)len;
        wr->input=(unsigned char *)buf;
 
@@ -768,11 +780,19 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 
        if (mac_size != 0)
                {
-               if (s->method->ssl3_enc->mac(s,&(p[wr->length]),1) < 0)
+               if (s->method->ssl3_enc->mac(s,&(p[wr->length + eivlen]),1) < 0)
                        goto err;
                wr->length+=mac_size;
-               wr->input=p;
-               wr->data=p;
+               }
+
+       wr->input=p;
+       wr->data=p;
+
+       if (eivlen)
+               {
+       /*      if (RAND_pseudo_bytes(p, eivlen) <= 0)
+                       goto err; */
+               wr->length += eivlen;
                }
 
        /* ssl3_enc can only have an error on read */
@@ -1120,7 +1140,25 @@ start:
                 * now try again to obtain the (application) data we were asked for */
                goto start;
                }
-
+       /* If we are a server and get a client hello when renegotiation isn't
+        * allowed send back a no renegotiation alert and carry on.
+        * WARNING: experimental code, needs reviewing (steve)
+        */
+       if (s->server &&
+               SSL_is_init_finished(s) &&
+               !s->s3->send_connection_binding &&
+               (s->version > SSL3_VERSION) &&
+               (s->s3->handshake_fragment_len >= 4) &&
+               (s->s3->handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
+               (s->session != NULL) && (s->session->cipher != NULL) &&
+               !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+               
+               {
+               /*s->s3->handshake_fragment_len = 0;*/
+               rr->length = 0;
+               ssl3_send_alert(s,SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
+               goto start;
+               }
        if (s->s3->alert_fragment_len >= 2)
                {
                int alert_level = s->s3->alert_fragment[0];
@@ -1150,6 +1188,21 @@ start:
                                s->shutdown |= SSL_RECEIVED_SHUTDOWN;
                                return(0);
                                }
+                       /* This is a warning but we receive it if we requested
+                        * renegotiation and the peer denied it. Terminate with
+                        * a fatal alert because if application tried to
+                        * renegotiatie it presumably had a good reason and
+                        * expects it to succeed.
+                        *
+                        * In future we might have a renegotiation where we
+                        * don't care if the peer refused it where we carry on.
+                        */
+                       else if (alert_descr == SSL_AD_NO_RENEGOTIATION)
+                               {
+                               al = SSL_AD_HANDSHAKE_FAILURE;
+                               SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_NO_RENEGOTIATION);
+                               goto f_err;
+                               }
                        }
                else if (alert_level == 2) /* fatal */
                        {
@@ -1228,6 +1281,7 @@ start:
 #else
                        s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
 #endif
+                       s->renegotiate=1;
                        s->new_session=1;
                        }
                i=s->handshake_func(s);
@@ -1262,7 +1316,7 @@ start:
        default:
 #ifndef OPENSSL_NO_TLS
                /* TLS just ignores unknown message types */
-               if (s->version == TLS1_VERSION)
+               if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION)
                        {
                        rr->length = 0;
                        goto start;
@@ -1322,8 +1376,10 @@ err:
 int ssl3_do_change_cipher_spec(SSL *s)
        {
        int i;
+#ifdef OPENSSL_NO_NEXTPROTONEG
        const char *sender;
        int slen;
+#endif
 
        if (s->state & SSL_ST_ACCEPT)
                i=SSL3_CHANGE_CIPHER_SERVER_READ;
@@ -1346,6 +1402,7 @@ int ssl3_do_change_cipher_spec(SSL *s)
        if (!s->method->ssl3_enc->change_cipher_state(s,i))
                return(0);
 
+#ifdef OPENSSL_NO_NEXTPROTONEG
        /* we have to record the message digest at
         * this point so we can get it before we read
         * the finished message */
@@ -1362,6 +1419,7 @@ int ssl3_do_change_cipher_spec(SSL *s)
 
        s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
                sender,slen,s->s3->tmp.peer_finish_md);
+#endif
 
        return(1);
        }