Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-23 15:55:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'fb-scsv' into dtls

Browse source 
* fb-scsv:
  Update Changelog for FALLBACK_SCSV
  Implement FALLBACK_SCSV server-side
  Implement FALLBACK_SCSV client-side
This commit is contained in:
Manuel Pégourié-Gonnard 2014-11-05 16:12:09 +01:00
commit fedba98ede
8 changed files with 239 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
library/ssl_cli.c
View file

@ -658,6 +658,17 @@ static int ssl_write_client_hello( ssl_context *ssl )
*p++ = (unsigned char)( ciphersuites[i] );
}
/* Some versions of OpenSSL don't handle it correctly if not at end */
#if defined(POLARSSL_SSL_FALLBACK_SCSV)
if( ssl->fallback == SSL_IS_FALLBACK )
{
SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
*p++ = (unsigned char)( SSL_FALLBACK_SCSV >> 8 );
*p++ = (unsigned char)( SSL_FALLBACK_SCSV );
n++;
}
#endif
*q++ = (unsigned char)( n >> 7 );
*q++ = (unsigned char)( n << 1 );

47
library/ssl_srv.c
View file

@ -1088,6 +1088,30 @@ static int ssl_parse_client_hello_v2( ssl_context *ssl )
}
}
#if defined(POLARSSL_SSL_FALLBACK_SCSV)
for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
{
if( p[0] == 0 &&
p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV >> 8 ) & 0xff ) &&
p[2] == (unsigned char)( ( SSL_FALLBACK_SCSV ) & 0xff ) )
{
SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
if( ssl->minor_ver < ssl->max_minor_ver )
{
SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
}
break;
}
}
#endif /* POLARSSL_SSL_FALLBACK_SCSV */
ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
ciphersuite_info = NULL;
#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
@ -1719,6 +1743,29 @@ read_record_header:
}
}
#if defined(POLARSSL_SSL_FALLBACK_SCSV)
for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
{
if( p[0] == (unsigned char)( ( SSL_FALLBACK_SCSV >> 8 ) & 0xff ) &&
p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV ) & 0xff ) )
{
SSL_DEBUG_MSG( 0, ( "received FALLBACK_SCSV" ) );
if( ssl->minor_ver < ssl->max_minor_ver )
{
SSL_DEBUG_MSG( 0, ( "inapropriate fallback" ) );
ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
}
break;
}
}
#endif /* POLARSSL_SSL_FALLBACK_SCSV */
/*
* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
*/

7
library/ssl_tls.c
View file

@ -5411,6 +5411,13 @@ int ssl_set_min_version( ssl_context *ssl, int major, int minor )
return( 0 );
}
#if defined(POLARSSL_SSL_FALLBACK_SCSV) && defined(POLARSSL_SSL_CLI_C)
void ssl_set_fallback( ssl_context *ssl, char fallback )
{
ssl->fallback = fallback;
}
#endif
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code )
{