From de9e884b2f43c59834c2b1c3cfde35fa2c797f2b Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 7 Aug 2018 12:40:08 +0100 Subject: Tolerate encrypted or plaintext alerts At certain points in the handshake we could receive either a plaintext or an encrypted alert from the client. We should tolerate both where appropriate. Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/6887) --- ssl/statem/statem.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'ssl/statem/statem.h') diff --git a/ssl/statem/statem.h b/ssl/statem/statem.h index 0799870178..144d930fc7 100644 --- a/ssl/statem/statem.h +++ b/ssl/statem/statem.h @@ -80,6 +80,13 @@ typedef enum { ENC_WRITE_STATE_WRITE_PLAIN_ALERTS } ENC_WRITE_STATES; +typedef enum { + /* The enc_read_ctx can be used normally */ + ENC_READ_STATE_VALID, + /* We may receive encrypted or plaintext alerts */ + ENC_READ_STATE_ALLOW_PLAIN_ALERTS +} ENC_READ_STATES; + /***************************************************************************** * * * This structure should be considered "opaque" to anything outside of the * @@ -110,6 +117,7 @@ struct ossl_statem_st { unsigned int no_cert_verify; int use_timer; ENC_WRITE_STATES enc_write_state; + ENC_READ_STATES enc_read_state; }; typedef struct ossl_statem_st OSSL_STATEM; -- cgit v1.2.3