Fix Bleichenbacher PKCS #1 1.5 countermeasure.

[oweals/openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 19777079477a5faef01410f7137a76bf66473116..eec45cfa485d0d0a7ae6a4f06a3f3abf430d15b4 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -142,7 +142,12 @@ int ssl3_connect(SSL *s)
                        if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
 
                        if ((s->version & 0xff00 ) != 0x0300)
-                               abort();
+                               {
+                               SSLerr(SSL_F_SSL3_CONNECT, SSL_R_INTERNAL_ERROR);
+                               ret = -1;
+                               goto end;
+                               }
+                               
                        /* s->version=SSL3_VERSION; */
                        s->type=SSL_ST_CONNECT;
 
@@ -810,6 +815,7 @@ static int ssl3_get_server_certificate(SSL *s)
                X509_free(s->session->peer);
        CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
        s->session->peer=x;
+       s->session->verify_result = s->verify_result;
 
        x=NULL;
        ret=1;
@@ -935,10 +941,12 @@ static int ssl3_get_key_exchange(SSL *s)
                s->session->sess_cert->peer_rsa_tmp=rsa;
                rsa=NULL;
                }
-       else
+#else /* NO_RSA */
+       if (0)
+               ;
 #endif
 #ifndef NO_DH
-               if (alg & SSL_kEDH)
+       else if (alg & SSL_kEDH)
                {
                if ((dh=DH_new()) == NULL)
                        {
@@ -994,10 +1002,12 @@ static int ssl3_get_key_exchange(SSL *s)
 #ifndef NO_RSA
                if (alg & SSL_aRSA)
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
-               else
+#else
+               if (0)
+                       ;
 #endif
 #ifndef NO_DSA
-               if (alg & SSL_aDSS)
+               else if (alg & SSL_aDSS)
                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].x509);
 #endif
                /* else anonymous DH, so no certificate or pkey. */
@@ -1011,7 +1021,7 @@ static int ssl3_get_key_exchange(SSL *s)
                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER);
                goto f_err;
                }
-#endif
+#endif /* !NO_DH */
        if (alg & SSL_aFZA)
                {
                al=SSL_AD_HANDSHAKE_FAILURE;