Updates from 1.0.0-stable
authorDr. Stephen Henson <steve@openssl.org>
Fri, 5 Jun 2009 14:59:26 +0000 (14:59 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Fri, 5 Jun 2009 14:59:26 +0000 (14:59 +0000)
apps/s_server.c
crypto/bio/bss_dgram.c
ssl/d1_both.c
ssl/d1_clnt.c
ssl/d1_pkt.c
ssl/d1_srvr.c
ssl/dtls1.h

index 6bbbd7f..6c9e6ba 100644 (file)
@@ -298,7 +298,9 @@ static const char *session_id_prefix=NULL;
 
 static int enable_timeouts = 0;
 static long socket_mtu;
+#ifndef OPENSSL_NO_DTLS1
 static int cert_chain = 0;
+#endif
 
 #ifndef OPENSSL_NO_PSK
 static char *psk_identity="Client_identity";
index 2e1a6fa..027cdf9 100644 (file)
@@ -217,12 +217,19 @@ static void dgram_adjust_rcv_timeout(BIO *b)
                        timeleft.tv_usec += 1000000;
                        }
 
+               if (timeleft.tv_sec < 0)
+                       {
+                       timeleft.tv_sec = 0;
+                       timeleft.tv_usec = 1;
+                       }
+
                /* Adjust socket timeout if next handhake message timer
                 * will expire earlier.
                 */
-               if (data->socket_timeout.tv_sec < timeleft.tv_sec ||
+               if ((data->socket_timeout.tv_sec == 0 && data->socket_timeout.tv_usec == 0) ||
+                       (data->socket_timeout.tv_sec > timeleft.tv_sec) ||
                        (data->socket_timeout.tv_sec == timeleft.tv_sec &&
-                        data->socket_timeout.tv_usec <= timeleft.tv_usec))
+                        data->socket_timeout.tv_usec >= timeleft.tv_usec))
                        {
 #ifdef OPENSSL_SYS_WINDOWS
                        timeout = timeleft.tv_sec * 1000 + timeleft.tv_usec / 1000;
index ebc0348..a56586f 100644 (file)
@@ -569,9 +569,13 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
        item = pqueue_find(s->d1->buffered_messages, seq64be);
        
        /* Discard the message if sequence number was already there, is
-        * too far in the future or the fragment is already in the queue */
+        * too far in the future, already in the queue or if we received
+        * a FINISHED before the SERVER_HELLO, which then must be a stale
+        * retransmit.
+        */
        if (msg_hdr->seq <= s->d1->handshake_read_seq ||
-               msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
+               msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
+               (s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED))
                {
                unsigned char devnull [256];
 
index 2364ad2..a4a438a 100644 (file)
@@ -442,7 +442,7 @@ int dtls1_connect(SSL *s)
 
                case SSL3_ST_CR_FINISHED_A:
                case SSL3_ST_CR_FINISHED_B:
-
+                       s->d1->change_cipher_spec_ok = 1;
                        ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
                                SSL3_ST_CR_FINISHED_B);
                        if (ret <= 0) goto end;
index a89edbc..394daf6 100644 (file)
@@ -1102,6 +1102,16 @@ start:
                        s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, 
                                rr->data, 1, s, s->msg_callback_arg);
 
+               /* We can't process a CCS now, because previous handshake
+                * messages are still missing, so just drop it.
+                */
+               if (!s->d1->change_cipher_spec_ok)
+                       {
+                       goto start;
+                       }
+
+               s->d1->change_cipher_spec_ok = 0;
+
                s->s3->change_cipher_spec=1;
                if (!ssl3_do_change_cipher_spec(s))
                        goto err;
index 6d6363f..ac09b45 100644 (file)
@@ -497,6 +497,7 @@ int dtls1_accept(SSL *s)
                case SSL3_ST_SR_CERT_VRFY_A:
                case SSL3_ST_SR_CERT_VRFY_B:
 
+                       s->d1->change_cipher_spec_ok = 1;
                        /* we should decide if we expected this one */
                        ret=ssl3_get_cert_verify(s);
                        if (ret <= 0) goto end;
@@ -508,6 +509,7 @@ int dtls1_accept(SSL *s)
 
                case SSL3_ST_SR_FINISHED_A:
                case SSL3_ST_SR_FINISHED_B:
+                       s->d1->change_cipher_spec_ok = 1;
                        ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
                                SSL3_ST_SR_FINISHED_B);
                        if (ret <= 0) goto end;
index 2fe0405..73af56d 100644 (file)
@@ -231,6 +231,7 @@ typedef struct dtls1_state_st
        unsigned int handshake_fragment_len;
 
        unsigned int retransmitting;
+       unsigned int change_cipher_spec_ok;
 
        } DTLS1_STATE;