kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Remove an unnecessary TLS 1.2 ClientHello state.

Browse Source 
The version negotiation logic was a little bizarrely wedged in the
middle of the state machine. (We don't support server renegotiation, so
have_version is always false here.)

BUG=128

Change-Id: I9448dce374004b92e8bd5172c36a4e0eea51619c
Reviewed-on: https://boringssl-review.googlesource.com/13561
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
David Benjamin 2017-02-02 23:28:14 -05:00 committed by Adam Langley
parent e5dfb52c3b
commit 42bfeb3623
2 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/openssl/ssl3.h
View File

@ -344,7 +344,6 @@ OPENSSL_COMPILE_ASSERT(
#define SSL3_ST_SR_CLNT_HELLO_B (0x111 | SSL_ST_ACCEPT) #define SSL3_ST_SR_CLNT_HELLO_B (0x111 | SSL_ST_ACCEPT)
#define SSL3_ST_SR_CLNT_HELLO_C (0x112 | SSL_ST_ACCEPT) #define SSL3_ST_SR_CLNT_HELLO_C (0x112 | SSL_ST_ACCEPT)
#define SSL3_ST_SR_CLNT_HELLO_D (0x113 | SSL_ST_ACCEPT) #define SSL3_ST_SR_CLNT_HELLO_D (0x113 | SSL_ST_ACCEPT)
#define SSL3_ST_SR_CLNT_HELLO_E (0x114 | SSL_ST_ACCEPT)
/* write to client */ /* write to client */
#define SSL3_ST_SW_HELLO_REQ_A (0x120 | SSL_ST_ACCEPT) #define SSL3_ST_SW_HELLO_REQ_A (0x120 | SSL_ST_ACCEPT)
#define SSL3_ST_SW_HELLO_REQ_B (0x121 | SSL_ST_ACCEPT) #define SSL3_ST_SW_HELLO_REQ_B (0x121 | SSL_ST_ACCEPT)

17
ssl/handshake_server.c
View File

@ -230,7 +230,6 @@ int ssl3_accept(SSL_HANDSHAKE *hs) {
case SSL3_ST_SR_CLNT_HELLO_B: case SSL3_ST_SR_CLNT_HELLO_B:
case SSL3_ST_SR_CLNT_HELLO_C: case SSL3_ST_SR_CLNT_HELLO_C:
case SSL3_ST_SR_CLNT_HELLO_D: case SSL3_ST_SR_CLNT_HELLO_D:
case SSL3_ST_SR_CLNT_HELLO_E:
ret = ssl3_get_client_hello(hs); ret = ssl3_get_client_hello(hs);
if (hs->state == SSL_ST_TLS13) { if (hs->state == SSL_ST_TLS13) {
break; break;
@ -541,6 +540,7 @@ int ssl_client_cipher_list_contains_cipher(const SSL_CLIENT_HELLO *client_hello,
static int negotiate_version(SSL_HANDSHAKE *hs, uint8_t *out_alert, static int negotiate_version(SSL_HANDSHAKE *hs, uint8_t *out_alert,
const SSL_CLIENT_HELLO *client_hello) { const SSL_CLIENT_HELLO *client_hello) {
SSL *const ssl = hs->ssl; SSL *const ssl = hs->ssl;
assert(!ssl->s3->have_version);
uint16_t min_version, max_version; uint16_t min_version, max_version;
if (!ssl_get_version_range(ssl, &min_version, &max_version)) { if (!ssl_get_version_range(ssl, &min_version, &max_version)) {
*out_alert = SSL_AD_PROTOCOL_VERSION; *out_alert = SSL_AD_PROTOCOL_VERSION;
@ -853,23 +853,18 @@ static int ssl3_get_client_hello(SSL_HANDSHAKE *hs) {
/* fallthrough */; /* fallthrough */;
} }
} }
hs->state = SSL3_ST_SR_CLNT_HELLO_C;
}
/* Negotiate the protocol version if we have not done so yet. */
if (!ssl->s3->have_version) {
if (!negotiate_version(hs, &al, &client_hello)) { if (!negotiate_version(hs, &al, &client_hello)) {
goto f_err; goto f_err;
} }
if (ssl3_protocol_version(ssl) >= TLS1_3_VERSION) { if (ssl3_protocol_version(ssl) >= TLS1_3_VERSION) {
/* Jump to the TLS 1.3 state machine. */
hs->state = SSL_ST_TLS13; hs->state = SSL_ST_TLS13;
hs->do_tls13_handshake = tls13_server_handshake; hs->do_tls13_handshake = tls13_server_handshake;
return 1; return 1;
} }
}
if (hs->state == SSL3_ST_SR_CLNT_HELLO_C) {
/* Load the client random. */ /* Load the client random. */
if (client_hello.random_len != SSL3_RANDOM_SIZE) { if (client_hello.random_len != SSL3_RANDOM_SIZE) {
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
@ -892,10 +887,10 @@ static int ssl3_get_client_hello(SSL_HANDSHAKE *hs) {
goto err; goto err;
} }
hs->state = SSL3_ST_SR_CLNT_HELLO_D; hs->state = SSL3_ST_SR_CLNT_HELLO_C;
} }
if (hs->state == SSL3_ST_SR_CLNT_HELLO_D) { if (hs->state == SSL3_ST_SR_CLNT_HELLO_C) {
/* Call |cert_cb| to update server certificates if required. */ /* Call |cert_cb| to update server certificates if required. */
if (ssl->cert->cert_cb != NULL) { if (ssl->cert->cert_cb != NULL) {
int rv = ssl->cert->cert_cb(ssl, ssl->cert->cert_cb_arg); int rv = ssl->cert->cert_cb(ssl, ssl->cert->cert_cb_arg);
@ -924,10 +919,10 @@ static int ssl3_get_client_hello(SSL_HANDSHAKE *hs) {
goto f_err; goto f_err;
} }
hs->state = SSL3_ST_SR_CLNT_HELLO_E; hs->state = SSL3_ST_SR_CLNT_HELLO_D;
} }
assert(hs->state == SSL3_ST_SR_CLNT_HELLO_E); assert(hs->state == SSL3_ST_SR_CLNT_HELLO_D);
/* Determine whether we are doing session resumption. */ /* Determine whether we are doing session resumption. */
int tickets_supported = 0, renew_ticket = 0; int tickets_supported = 0, renew_ticket = 0;