[openssl-commits] [openssl] master update

[Matt Caswell]

The branch master has been updated
       via  4f9fab6bd0253416eeace5a45142c7c4a83bc511 (commit)
       via  d5d0a1cb1347d4a8547e78aec56c50c528186e50 (commit)
      from  d64070838ebba86f00fb3755df5d3e65106e1628 (commit)


- Log -----------------------------------------------------------------
commit 4f9fab6bd0253416eeace5a45142c7c4a83bc511
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Feb 5 13:59:16 2015 +0000

    Add ticket length before buffering DTLS message
    
    In ssl3_send_new_session_ticket the message to be sent is constructed. We
    skip adding the length of the session ticket initially, then call
    ssl_set_handshake_header, and finally go back and add in the length of the
    ticket. Unfortunately, in DTLS, ssl_set_handshake_header also has the side
    effect of buffering the message for subsequent retransmission if required.
    By adding the ticket length after the call to ssl_set_handshake_header the
    message that is buffered is incomplete, causing an invalid message to be
    sent on retransmission.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit d5d0a1cb1347d4a8547e78aec56c50c528186e50
Author: Matt Caswell <matt at openssl.org>
Date:   Thu Feb 5 13:54:37 2015 +0000

    Ensure last_write_sequence is saved in DTLS1.2
    
    In DTLS, immediately prior to epoch change, the write_sequence is supposed
    to be stored in s->d1->last_write_sequence. The write_sequence is then reset
    back to 00000000. In the event of retransmits of records from the previous
    epoch, the last_write_sequence is restored. This commit fixes a bug in
    DTLS1.2 where the write_sequence was being reset before last_write_sequence
    was saved, and therefore retransmits are sent with incorrect sequence
    numbers.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_srvr.c | 4 ++--
 ssl/t1_enc.c  | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 0efe3dd..ce52854 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -3431,11 +3431,11 @@ int ssl3_send_newsession_ticket(SSL *s)
         /* Now write out lengths: p points to end of data written */
         /* Total length */
         len = p - ssl_handshake_start(s);
-        if(!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, len))
-            goto err;
         /* Skip ticket lifetime hint */
         p = ssl_handshake_start(s) + 4;
         s2n(len - 6, p);
+        if(!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, len))
+            goto err;
         s->state = SSL3_ST_SW_SESSION_TICKET_B;
         OPENSSL_free(senc);
     }
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index df97f19..e4a689e 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -404,9 +404,9 @@ int tls1_change_cipher_state(SSL *s, int which)
         }
 #endif
         /*
-         * this is done by dtls1_reset_seq_numbers for DTLS1_VERSION
+         * this is done by dtls1_reset_seq_numbers for DTLS
          */
-        if (s->version != DTLS1_VERSION)
+        if (!SSL_IS_DTLS(s))
             memset(&(s->s3->read_sequence[0]), 0, 8);
         mac_secret = &(s->s3->read_mac_secret[0]);
         mac_secret_size = &(s->s3->read_mac_secret_size);
@@ -442,9 +442,9 @@ int tls1_change_cipher_state(SSL *s, int which)
         }
 #endif
         /*
-         * this is done by dtls1_reset_seq_numbers for DTLS1_VERSION
+         * this is done by dtls1_reset_seq_numbers for DTLS
          */
-        if (s->version != DTLS1_VERSION)
+        if (!SSL_IS_DTLS(s))
             memset(&(s->s3->write_sequence[0]), 0, 8);
         mac_secret = &(s->s3->write_mac_secret[0]);
         mac_secret_size = &(s->s3->write_mac_secret_size);