Assume TLS 1.0 if ClientHello fragment is too short.

diff --git a/CHANGES b/CHANGES
index 812f139f545c07886aa7e524447c70185a5cdfd3..f04945168c9d3a05e6feac7ea57c2caa71b79e25 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,15 @@
 
  Changes between 0.9.6b and 0.9.6c  [XX xxx XXXX]
 
+  *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
+     faced with a pathologically small ClientHello fragment that does
+     not contain client_version: Instead of aborting with an error,
+     simply choose the highest available protocol version (i.e.,
+     TLS 1.0 unless it is disabled).  In practice, ClientHello
+     messages are never sent like this, but this change gives us
+     strictly correct behaviour at least for TLS.
+     [Bodo Moeller]
+
   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
      never resets s->method to s->ctx->method when called from within
      one of the SSL handshake functions.

diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index 2d0eb4a8fff32290e328e532f3a0dccc5363d67c..4117c566ac1e313d108928935e1e686696b22e6b 100644 (file)
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -200,6 +200,7 @@ int ssl23_connect(SSL *s)
                }
 end:
        s->in_handshake--;
+       if (s->in_handshake)
        if (cb != NULL)
                cb(s,SSL_CB_CONNECT_EXIT,ret);
        return(ret);

diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
index a403af36718a3ed071d274bab05bdc7fdc1b3320..b40bb01ab72a80723b1d13d4163497fe01c5c53d 100644 (file)
--- a/ssl/s23_srvr.c
+++ b/ssl/s23_srvr.c
@@ -232,9 +232,9 @@ int ssl23_accept(SSL *s)
                        }
                }
 end:
+       s->in_handshake--;
        if (cb != NULL)
                cb(s,SSL_CB_ACCEPT_EXIT,ret);
-       s->in_handshake--;
        return(ret);
        }
 
@@ -405,17 +405,22 @@ int ssl23_get_client_hello(SSL *s)
                        /* We must look at client_version inside the Client Hello message
                         * to get the correct minor version.
                         * However if we have only a pathologically small fragment of the
-                        * Client Hello message, this would be difficult, we'd have
-                        * to read at least one additional record to find out.
-                        * This doesn't usually happen in real life, so we just complain
-                        * for now.
-                        */
+                        * Client Hello message, this would be difficult, and we'd have
+                        * to read more records to find out.
+                        * No known SSL 3.0 client fragments ClientHello like this,
+                        * so we simply assume TLS 1.0 to avoid protocol version downgrade
+                        * attacks. */
                        if (p[3] == 0 && p[4] < 6)
                                {
+#if 0
                                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_SMALL);
                                goto err;
+#else
+                               v[1] = TLS1_VERSION_MINOR;
+#endif
                                }
-                       v[1]=p[10]; /* minor version according to client_version */
+                       else
+                               v[1]=p[10]; /* minor version according to client_version */
                        if (v[1] >= TLS1_VERSION_MINOR)
                                {
                                if (!(s->options & SSL_OP_NO_TLSv1))