Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update pre9

Browse Source
This commit is contained in:
Hakase
2018-07-19 21:47:35 +09:00
parent 1914ae9055
commit 46f6b5e2fe
84 changed files with 2388 additions and 962 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssl/statem/statem_lib.c
+48 -20
View File
@@ -1485,6 +1485,40 @@ static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
return 0;
}
/*
* Only called by servers. Returns 1 if the server has a TLSv1.3 capable
* certificate type, or has PSK configured. Otherwise returns 0.
*/
static int is_tls13_capable(const SSL *s)
{
int i;
#ifndef OPENSSL_NO_PSK
if (s->psk_server_callback != NULL)
return 1;
#endif
if (s->psk_find_session_cb != NULL)
return 1;
for (i = 0; i < SSL_PKEY_NUM; i++) {
/* Skip over certs disallowed for TLSv1.3 */
switch (i) {
case SSL_PKEY_DSA_SIGN:
case SSL_PKEY_GOST01:
case SSL_PKEY_GOST12_256:
case SSL_PKEY_GOST12_512:
continue;
default:
break;
}
if (ssl_has_cert(s, i))
return 1;
}
return 0;
}
/*
* ssl_version_supported - Check that the specified `version` is supported by
* `SSL *` instance
@@ -1494,7 +1528,7 @@ static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
*
* Returns 1 when supported, otherwise 0
*/
int ssl_version_supported(const SSL *s, int version)
int ssl_version_supported(const SSL *s, int version, const SSL_METHOD **meth)
{
const version_info *vent;
const version_info *table;
@@ -1514,9 +1548,14 @@ int ssl_version_supported(const SSL *s, int version)
for (vent = table;
vent->version != 0 && version_cmp(s, version, vent->version) <= 0;
++vent) {
if (vent->cmeth != NULL &&
version_cmp(s, version, vent->version) == 0 &&
ssl_method_error(s, vent->cmeth()) == 0) {
if (vent->cmeth != NULL
&& version_cmp(s, version, vent->version) == 0
&& ssl_method_error(s, vent->cmeth()) == 0
&& (!s->server
|| version != TLS1_3_VERSION
|| is_tls13_capable(s))) {
if (meth != NULL)
*meth = vent->cmeth();
return 1;
}
}
@@ -1625,11 +1664,11 @@ int ssl_set_version_bound(int method_version, int version, int *bound)
static void check_for_downgrade(SSL *s, int vers, DOWNGRADE *dgrd)
{
if (vers == TLS1_2_VERSION
&& ssl_version_supported(s, TLS1_3_VERSION)) {
&& ssl_version_supported(s, TLS1_3_VERSION, NULL)) {
*dgrd = DOWNGRADE_TO_1_2;
} else if (!SSL_IS_DTLS(s) && vers < TLS1_2_VERSION
&& (ssl_version_supported(s, TLS1_2_VERSION)
|| ssl_version_supported(s, TLS1_3_VERSION))) {
&& (ssl_version_supported(s, TLS1_2_VERSION, NULL)
|| ssl_version_supported(s, TLS1_3_VERSION, NULL))) {
*dgrd = DOWNGRADE_TO_1_1;
} else {
*dgrd = DOWNGRADE_NONE;
@@ -1735,19 +1774,8 @@ int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello, DOWNGRADE *dgrd)
*/
if (version_cmp(s, candidate_vers, best_vers) <= 0)
continue;
for (vent = table;
vent->version != 0 && vent->version != (int)candidate_vers;
++vent)
continue;
if (vent->version != 0 && vent->smeth != NULL) {
const SSL_METHOD *method;
method = vent->smeth();
if (ssl_method_error(s, method) == 0) {
best_vers = candidate_vers;
best_method = method;
}
}
if (ssl_version_supported(s, candidate_vers, &best_method))
best_vers = candidate_vers;
}
if (PACKET_remaining(&versionslist) != 0) {
/* Trailing data? */