*/
#include "ssl_locl.h"
-#ifndef OPENSSL_NO_SSL2
+#ifndef NO_SSL2
#include <stdio.h>
#include <openssl/bio.h>
#include <openssl/rand.h>
/* bad decrypt */
#if 1
/* If a bad decrypt, continue with protocol but with a
- * dud master secret */
+ * random master secret (Bleichenbacher attack) */
if ((i < 0) ||
((!is_export && (i != EVP_CIPHER_key_length(c)))
|| (is_export && ((i != ek) || (s->s2->tmp.clear+i !=
EVP_CIPHER_key_length(c))))))
{
+ ERR_clear_error();
if (is_export)
i=ek;
else
unsigned char *p;
STACK_OF(SSL_CIPHER) *cs; /* a stack of SSL_CIPHERS */
STACK_OF(SSL_CIPHER) *cl; /* the ones we want to use */
- STACK_OF(SSL_CIPHER) *prio, *allow;
int z;
/* This is a bit of a hack to check for the correct packet
&s->session->ciphers);
if (cs == NULL) goto mem_err;
- cl=SSL_get_ciphers(s);
+ cl=ssl_get_ciphers_by_id(s);
- if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
- {
- prio=sk_SSL_CIPHER_dup(cl);
- if (prio == NULL) goto mem_err;
- allow = cs;
- }
- else
- {
- prio = cs;
- allow = cl;
- }
- for (z=0; z<sk_SSL_CIPHER_num(prio); z++)
+ for (z=0; z<sk_SSL_CIPHER_num(cs); z++)
{
- if (sk_SSL_CIPHER_find(allow,sk_SSL_CIPHER_value(prio,z)) < 0)
+ if (sk_SSL_CIPHER_find(cl,sk_SSL_CIPHER_value(cs,z)) < 0)
{
- sk_SSL_CIPHER_delete(prio,z);
+ sk_SSL_CIPHER_delete(cs,z);
z--;
}
}
- if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
- {
- sk_SSL_CIPHER_free(s->session->ciphers);
- s->session->ciphers = prio;
- }
+
/* s->session->ciphers should now have a list of
* ciphers that are on both the client and server.
* This list is ordered by the order the client sent
- * the ciphers or in the order of the server's preference
- * if SSL_OP_CIPHER_SERVER_PREFERENCE was set.
+ * the ciphers.
*/
}
p+=s->s2->tmp.cipher_spec_length;
SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT,ERR_R_RSA_LIB);
return(i);
}
-#else /* !OPENSSL_NO_SSL2 */
+#else /* !NO_SSL2 */
# if PEDANTIC
static void *dummy=&dummy;