diff options
| author | Bodo Möller <bodo@openssl.org> | 2008-09-22 21:22:51 +0000 |
|---|---|---|
| committer | Bodo Möller <bodo@openssl.org> | 2008-09-22 21:22:51 +0000 |
| commit | d875413a0be952d4356321749e46cc5e6d1e5527 (patch) | |
| tree | 215e3996b34160a79b0e1f301b1ae696a4e614ee /ssl/s3_srvr.c | |
| parent | 155ad6d2190827465198221237a4009c410ec0b4 (diff) | |
Make sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG can't
enable disabled ciphersuites.
Diffstat (limited to 'ssl/s3_srvr.c')
| -rw-r--r-- | ssl/s3_srvr.c | 32 |
1 files changed, 19 insertions, 13 deletions
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index 398ce469d6..04f9f79ab2 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -902,22 +902,28 @@ int ssl3_get_client_hello(SSL *s) break; } } - if (j == 0) - { - if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) - { - /* Very bad for multi-threading.... */ - s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0); - } - else + if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) + { + /* Special case as client bug workaround: the previously used cipher may + * not be in the current list, the client instead might be trying to + * continue using a cipher that before wasn't chosen due to server + * preferences. We'll have to reject the connection if the cipher is not + * enabled, though. */ + c = sk_SSL_CIPHER_value(ciphers, 0); + if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0) { - /* we need to have the cipher in the cipher - * list if we are asked to reuse it */ - al=SSL_AD_ILLEGAL_PARAMETER; - SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING); - goto f_err; + s->session->cipher = c; + j = 1; } } + if (j == 0) + { + /* we need to have the cipher in the cipher + * list if we are asked to reuse it */ + al=SSL_AD_ILLEGAL_PARAMETER; + SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING); + goto f_err; + } } /* compression */ |