Partial workaround for PR#2771.

Some servers hang when presented with a client hello record length exceeding
255 bytes but will work with longer client hellos if the TLS record version
in client hello does not exceed TLS v1.0. Unfortunately this doesn't fix all
cases...

diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index 13412f26aab9acac4bed0ab60b9296c81f6e1d79..76f1057b5b4381dc26def594b1b9352b06046dd4 100644 (file)
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -523,8 +523,13 @@ static int ssl23_client_hello(SSL *s)
                        d=buf;
                        *(d++) = SSL3_RT_HANDSHAKE;
                        *(d++) = version_major;
-                       *(d++) = version_minor; /* arguably we should send the *lowest* suported version here
-                                                * (indicating, e.g., TLS 1.0 in "SSL 3.0 format") */
+                       /* Some servers hang if we use long client hellos
+                        * and a record number > TLS 1.0.
+                        */
+                       if (TLS1_get_client_version(s) > TLS1_VERSION)
+                               *(d++) = 1;
+                       else
+                               *(d++) = version_minor;
                        s2n((int)l,d);
 
                        /* number of bytes to write */

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index a0169dcc0695d0a6f1da82d74754a7f488e42396..adf8c387cc0a504801211bfeece83e46b60b5f98 100644 (file)
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -740,7 +740,14 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
        wr->type=type;
 
        *(p++)=(s->version>>8);
-       *(p++)=s->version&0xff;
+       /* Some servers hang if iniatial client hello is larger than 256
+        * bytes and record version number > TLS 1.0
+        */
+       if (s->state == SSL3_ST_CW_CLNT_HELLO_B
+                               && TLS1_get_version(s) > TLS1_VERSION)
+               *(p++) = 0x1;
+       else
+               *(p++)=s->version&0xff;
 
        /* field where we are to write out packet length */
        plen=p;