yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-25 22:01:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix NewSesssionTicket vs ChangeCipherSpec bug

Browse source 
Since we were cheating on state, ssl_read_record() wasn't able to drop
out-of-sequence ChangeCipherSpec messages. Cheat a bit less.
This commit is contained in:
Manuel Pégourié-Gonnard 2014-09-20 13:54:12 +02:00 committed by Paul Bakker
parent a6189f0fb0
commit cd32a50d67
1 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
library/ssl_cli.c
View file

@ -2686,6 +2686,7 @@ static int ssl_parse_new_session_ticket( ssl_context *ssl )
/* We're not waiting for a NewSessionTicket message any more */ /* We're not waiting for a NewSessionTicket message any more */
ssl->handshake->new_session_ticket = 0; ssl->handshake->new_session_ticket = 0;
ssl->state = SSL_SERVER_CHANGE_CIPHER_SPEC;
/* /*
* Zero-length ticket means the server changed his mind and doesn't want * Zero-length ticket means the server changed his mind and doesn't want
@ -2751,6 +2752,16 @@ int ssl_handshake_client_step( ssl_context *ssl )
} }
#endif #endif
/* Change state now, so that it is right in ssl_read_record(), used
* by DTLS for dropping out-of-sequence ChangeCipherSpec records */
#if defined(POLARSSL_SSL_SESSION_TICKETS)
if( ssl->state == SSL_SERVER_CHANGE_CIPHER_SPEC &&
ssl->handshake->new_session_ticket != 0 )
{
ssl->state = SSL_SERVER_NEW_SESSION_TICKET;
}
#endif
switch( ssl->state ) switch( ssl->state )
{ {
case SSL_HELLO_REQUEST: case SSL_HELLO_REQUEST:
@ -2823,13 +2834,14 @@ int ssl_handshake_client_step( ssl_context *ssl )
* ChangeCipherSpec * ChangeCipherSpec
* Finished * Finished
*/ */
case SSL_SERVER_CHANGE_CIPHER_SPEC:
#if defined(POLARSSL_SSL_SESSION_TICKETS) #if defined(POLARSSL_SSL_SESSION_TICKETS)
if( ssl->handshake->new_session_ticket != 0 ) case SSL_SERVER_NEW_SESSION_TICKET:
ret = ssl_parse_new_session_ticket( ssl ); ret = ssl_parse_new_session_ticket( ssl );
else break;
#endif #endif
ret = ssl_parse_change_cipher_spec( ssl );
case SSL_SERVER_CHANGE_CIPHER_SPEC:
ret = ssl_parse_change_cipher_spec( ssl );
break; break;
case SSL_SERVER_FINISHED: case SSL_SERVER_FINISHED: