kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Avoid transitioning into SSL_ST_OK and back out.

Browse Source 
I doubt this matters, but this seems a little odd. In particular, this
avoids info_callback seeing the SSL_ST_OK once we stop switching
hs->state back and forth.

BUG=177

Change-Id: Ied39c0e94c242af9d5d0f26795d6e0f2f0b12406
Reviewed-on: https://boringssl-review.googlesource.com/13827
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
David Benjamin 2017-02-10 23:33:27 -05:00 committed by CQ bot account: commit-bot@chromium.org
parent 9e766d7532
commit 77458a436e
3 changed files with 11 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/openssl/ssl.h
View File

@ -3043,7 +3043,6 @@ OPENSSL_EXPORT void SSL_CTX_set_dos_protection_cb(
#define SSL_ST_OK 0x03 #define SSL_ST_OK 0x03
#define SSL_ST_RENEGOTIATE (0x04 | SSL_ST_INIT) #define SSL_ST_RENEGOTIATE (0x04 | SSL_ST_INIT)
#define SSL_ST_TLS13 (0x05 | SSL_ST_INIT) #define SSL_ST_TLS13 (0x05 | SSL_ST_INIT)
#define SSL_ST_ERROR (0x06| SSL_ST_INIT)
/* SSL_CB_* are possible values for the |type| parameter in the info /* SSL_CB_* are possible values for the |type| parameter in the info
* callback and the bitmasks that make them up. */ * callback and the bitmasks that make them up. */

1
include/openssl/ssl3.h
View File

@ -307,6 +307,7 @@ OPENSSL_COMPILE_ASSERT(
#define SSL3_ST_CW_FLUSH (0x100 | SSL_ST_CONNECT) #define SSL3_ST_CW_FLUSH (0x100 | SSL_ST_CONNECT)
#define SSL3_ST_FALSE_START (0x101 | SSL_ST_CONNECT) #define SSL3_ST_FALSE_START (0x101 | SSL_ST_CONNECT)
#define SSL3_ST_VERIFY_SERVER_CERT (0x102 | SSL_ST_CONNECT) #define SSL3_ST_VERIFY_SERVER_CERT (0x102 | SSL_ST_CONNECT)
#define SSL3_ST_FINISH_CLIENT_HANDSHAKE (0x103 | SSL_ST_CONNECT)
/* write to server */ /* write to server */
#define SSL3_ST_CW_CLNT_HELLO_A (0x110 | SSL_ST_CONNECT) #define SSL3_ST_CW_CLNT_HELLO_A (0x110 | SSL_ST_CONNECT)
/* read from server */ /* read from server */

24
ssl/handshake_client.c
View File

@ -393,7 +393,7 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
hs->state = SSL3_ST_CW_FLUSH; hs->state = SSL3_ST_CW_FLUSH;
if (ssl->session != NULL) { if (ssl->session != NULL) {
hs->next_state = SSL_ST_OK; hs->next_state = SSL3_ST_FINISH_CLIENT_HANDSHAKE;
} else { } else {
/* This is a non-resumption handshake. If it involves ChannelID, then /* This is a non-resumption handshake. If it involves ChannelID, then
* record the handshake hashes at this point in the session so that * record the handshake hashes at this point in the session so that
@ -456,7 +456,7 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
if (ssl->session != NULL) { if (ssl->session != NULL) {
hs->state = SSL3_ST_CW_CHANGE; hs->state = SSL3_ST_CW_CHANGE;
} else { } else {
hs->state = SSL_ST_OK; hs->state = SSL3_ST_FINISH_CLIENT_HANDSHAKE;
} }
break; break;
@ -466,7 +466,7 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
goto end; goto end;
} }
hs->state = hs->next_state; hs->state = hs->next_state;
if (hs->state != SSL_ST_OK) { if (hs->state != SSL3_ST_FINISH_CLIENT_HANDSHAKE) {
ssl->method->expect_flight(ssl); ssl->method->expect_flight(ssl);
} }
break; break;
@ -476,10 +476,10 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
if (ret <= 0) { if (ret <= 0) {
goto end; goto end;
} }
hs->state = SSL_ST_OK; hs->state = SSL3_ST_FINISH_CLIENT_HANDSHAKE;
break; break;
case SSL_ST_OK: case SSL3_ST_FINISH_CLIENT_HANDSHAKE:
ssl->method->release_current_message(ssl, 1 /* free_buffer */); ssl->method->release_current_message(ssl, 1 /* free_buffer */);
SSL_SESSION_free(ssl->s3->established_session); SSL_SESSION_free(ssl->s3->established_session);
@ -493,10 +493,6 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
ssl->s3->established_session = ssl->s3->established_session =
SSL_SESSION_dup(ssl->s3->new_session, SSL_SESSION_DUP_ALL); SSL_SESSION_dup(ssl->s3->new_session, SSL_SESSION_DUP_ALL);
if (ssl->s3->established_session == NULL) { if (ssl->s3->established_session == NULL) {
/* Do not stay in SSL_ST_OK, to avoid confusing |SSL_in_init|
* callers. */
hs->state = SSL_ST_ERROR;
skip = 1;
ret = -1; ret = -1;
goto end; goto end;
} }
@ -506,6 +502,10 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
ssl->s3->new_session = NULL; ssl->s3->new_session = NULL;
} }
hs->state = SSL_ST_OK;
break;
case SSL_ST_OK: {
const int is_initial_handshake = !ssl->s3->initial_handshake_complete; const int is_initial_handshake = !ssl->s3->initial_handshake_complete;
ssl->s3->initial_handshake_complete = 1; ssl->s3->initial_handshake_complete = 1;
if (is_initial_handshake) { if (is_initial_handshake) {
@ -516,11 +516,7 @@ int ssl3_connect(SSL_HANDSHAKE *hs) {
ret = 1; ret = 1;
ssl_do_info_callback(ssl, SSL_CB_HANDSHAKE_DONE, 1); ssl_do_info_callback(ssl, SSL_CB_HANDSHAKE_DONE, 1);
goto end; goto end;
}
case SSL_ST_ERROR:
OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_HANDSHAKE_FAILURE);
ret = -1;
goto end;
default: default:
OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_STATE); OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_STATE);