diff options
| author | Andy Polyakov <appro@openssl.org> | 2007-10-17 21:17:49 +0000 |
|---|---|---|
| committer | Andy Polyakov <appro@openssl.org> | 2007-10-17 21:17:49 +0000 |
| commit | a9c23ea079f2e85001a94b8e9824a07669722351 (patch) | |
| tree | c508b323520b837be8f87b05c1084463e5c6efff /ssl/d1_both.c | |
| parent | 33ffe2a7f7d0ef64c3012111188d5d0ee587dd59 (diff) | |
Don't let DTLS ChangeCipherSpec increment handshake sequence number. From
HEAD with a twist: server interoperates with non-compliant client.
PR: 1587
Diffstat (limited to 'ssl/d1_both.c')
| -rw-r--r-- | ssl/d1_both.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/ssl/d1_both.c b/ssl/d1_both.c index ca61c18853..15a201a25c 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -777,11 +777,11 @@ int dtls1_send_change_cipher_spec(SSL *s, int a, int b) p=(unsigned char *)s->init_buf->data; *p++=SSL3_MT_CCS; s->d1->handshake_write_seq = s->d1->next_handshake_write_seq; - s->d1->next_handshake_write_seq++; s->init_num=DTLS1_CCS_HEADER_LENGTH; if (s->client_version == DTLS1_BAD_VER) { + s->d1->next_handshake_write_seq++; s2n(s->d1->handshake_write_seq,p); s->init_num+=2; } @@ -974,6 +974,7 @@ dtls1_buffer_message(SSL *s, int is_ccs) pitem *item; hm_fragment *frag; PQ_64BIT seq64; + unsigned int epoch = s->d1->w_epoch; /* this function is called immediately after a message has * been serialized */ @@ -987,6 +988,7 @@ dtls1_buffer_message(SSL *s, int is_ccs) { OPENSSL_assert(s->d1->w_msg_hdr.msg_len + DTLS1_CCS_HEADER_LENGTH <= (unsigned int)s->init_num); + epoch++; } else { @@ -1002,7 +1004,7 @@ dtls1_buffer_message(SSL *s, int is_ccs) frag->msg_header.is_ccs = is_ccs; pq_64bit_init(&seq64); - pq_64bit_assign_word(&seq64, frag->msg_header.seq); + pq_64bit_assign_word(&seq64, epoch<<16 | frag->msg_header.seq); item = pitem_new(seq64, frag); pq_64bit_free(&seq64); |