Compare encodings in X509_cmp as well as hash.

[openssl.git] / ssl / s3_pkt.c

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 3f936c0905dff34765a38b5421c1395e3d7b82cf..c3a061dac0e0a8b5a58754e4ee375f2827c97fc2 100644 (file)
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -117,6 +117,10 @@
 #include <openssl/buffer.h>
 #include <openssl/rand.h>
 
+#ifndef  EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK
+# define EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK 0
+#endif
+
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                         unsigned int len, int create_empty_fragment);
 static int ssl3_get_record(SSL *s);
@@ -344,7 +348,7 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
                        if (version != s->version)
                                {
                                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
-                                if ((s->version & 0xFF00) == (version & 0xFF00))
+                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
                                        /* Send back error using their minor version number :-) */
                                        s->version = (unsigned short)version;
                                al=SSL_AD_PROTOCOL_VERSION;
@@ -724,6 +728,55 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                        goto err;
                }
 
+#if !defined(OPENSSL_NO_MULTIBLOCK) && EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK
+       if (type==SSL3_RT_APPLICATION_DATA && s->compress==NULL &&
+           !SSL_USE_ETM(s) && SSL_USE_EXPLICIT_IV(s) && /*!SSL_IS_DTLS(s) &&*/
+           EVP_CIPHER_flags(s->enc_write_ctx->cipher)&EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)
+               do {
+               unsigned char aad[13];
+               EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM mb_param = {NULL,aad,sizeof(aad),0};
+               int packlen;
+
+               memcpy(aad,s->s3->write_sequence,8);
+               aad[8]=type;
+               aad[9]=(unsigned char)(s->version>>8);
+               aad[10]=(unsigned char)(s->version);
+               aad[11]=(unsigned char)(len>>8);
+               aad[12]=(unsigned char)len;
+               packlen = EVP_CIPHER_CTX_ctrl(s->enc_write_ctx,
+                               EVP_CTRL_TLS1_1_MULTIBLOCK_AAD,
+                               sizeof(mb_param),&mb_param);
+
+               if (packlen==0 || packlen > wb->len) break;
+
+               mb_param.out = wb->buf;
+               mb_param.inp = buf;
+               mb_param.len = len;
+               EVP_CIPHER_CTX_ctrl(s->enc_write_ctx,
+                               EVP_CTRL_TLS1_1_MULTIBLOCK_ENCRYPT,
+                               sizeof(mb_param),&mb_param);
+
+               s->s3->write_sequence[7] += mb_param.interleave;
+               if (s->s3->write_sequence[7] < mb_param.interleave)
+                       {
+                       int j=6;
+                       while (j>=0 && (++s->s3->write_sequence[j--])==0) ;
+                       }
+
+               wb->offset=0;
+               wb->left = packlen;
+
+               /* memorize arguments so that ssl3_write_pending can detect bad write retries later */
+               s->s3->wpend_tot=len;
+               s->s3->wpend_buf=buf;
+               s->s3->wpend_type=type;
+               s->s3->wpend_ret=len;
+
+               /* we now just need to write the buffer */
+               return ssl3_write_pending(s,type,buf,len);
+               } while (0);
+#endif
+
        /* 'create_empty_fragment' is true only when this function calls itself */
        if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done)
                {
@@ -1510,8 +1563,14 @@ int ssl3_do_change_cipher_spec(SSL *s)
                slen=s->method->ssl3_enc->client_finished_label_len;
                }
 
-       s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
+       i = s->method->ssl3_enc->final_finish_mac(s,
                sender,slen,s->s3->tmp.peer_finish_md);
+       if (i == 0)
+               {
+               SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
+               return 0;
+               }
+       s->s3->tmp.peer_finish_md_len = i;
 
        return(1);
        }