[openssl-commits] [openssl] master update

[Matt Caswell]

The branch master has been updated
       via  1aac20f5095fca8691ef4495c3e7438c935a33dc (commit)
      from  d61e6040a02464f1dd41942ee1e17ef59822102d (commit)


- Log -----------------------------------------------------------------
commit 1aac20f5095fca8691ef4495c3e7438c935a33dc
Author: Matt Caswell <matt at openssl.org>
Date:   Mon May 21 12:20:18 2018 +0100

    Fix no-ec in combination with no-dh
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/6321)

-----------------------------------------------------------------------

Summary of changes:
 ssl/statem/extensions_srvr.c | 11 +++++++++--
 test/dtlstest.c              | 11 ++++++++++-
 test/sslapitest.c            |  4 +++-
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
index 65b9d3b..7c756c0 100644
--- a/ssl/statem/extensions_srvr.c
+++ b/ssl/statem/extensions_srvr.c
@@ -721,6 +721,7 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
 int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                           size_t chainidx)
 {
+#ifndef OPENSSL_NO_TLS1_3
     unsigned int format, version, key_share, group_id;
     EVP_MD_CTX *hctx;
     EVP_PKEY *pkey;
@@ -936,6 +937,7 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
     s->hello_retry_request = 1;
 
     s->ext.cookieok = 1;
+#endif
 
     return 1;
 }
@@ -1694,14 +1696,16 @@ EXT_RETURN tls_construct_stoc_key_share(SSL *s, WPACKET *pkt,
         /* SSLfatal() already called */
         return EXT_RETURN_FAIL;
     }
-#endif
-
     return EXT_RETURN_SENT;
+#else
+    return EXT_RETURN_FAIL;
+#endif
 }
 
 EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context,
                                      X509 *x, size_t chainidx)
 {
+#ifndef OPENSSL_NO_TLS1_3
     unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie;
     unsigned char *hmac, *hmac2;
     size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen;
@@ -1826,6 +1830,9 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context,
     EVP_MD_CTX_free(hctx);
     EVP_PKEY_free(pkey);
     return ret;
+#else
+    return EXT_RETURN_FAIL;
+#endif
 }
 
 EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt,
diff --git a/test/dtlstest.c b/test/dtlstest.c
index 859ec6b..c41aac8 100644
--- a/test/dtlstest.c
+++ b/test/dtlstest.c
@@ -116,7 +116,16 @@ static int test_dtls_unprocessed(int testidx)
 
 #define CLI_TO_SRV_EPOCH_0_RECS 3
 #define CLI_TO_SRV_EPOCH_1_RECS 1
-#define SRV_TO_CLI_EPOCH_0_RECS 12
+#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
+# define SRV_TO_CLI_EPOCH_0_RECS 12
+#else
+/*
+ * In this case we have no ServerKeyExchange message, because we don't have
+ * ECDHE or DHE. When it is present it gets fragmented into 3 records in this
+ * test.
+ */
+# define SRV_TO_CLI_EPOCH_0_RECS 9
+#endif
 #define SRV_TO_CLI_EPOCH_1_RECS 1
 #define TOTAL_FULL_HAND_RECORDS \
             (CLI_TO_SRV_EPOCH_0_RECS + CLI_TO_SRV_EPOCH_1_RECS + \
diff --git a/test/sslapitest.c b/test/sslapitest.c
index fe1c1e6..f2978aa 100644
--- a/test/sslapitest.c
+++ b/test/sslapitest.c
@@ -4473,7 +4473,9 @@ static int test_info_callback(int tst)
     int tlsvers;
 
     if (tst < 2) {
-#ifndef OPENSSL_NO_TLS1_2
+/* We need either ECDHE or DHE for the TLSv1.2 test to work */
+#if !defined(OPENSSL_NO_TLS1_2) && (!defined(OPENSSL_NO_EC) \
+                                    || !defined(OPENSSL_NO_DH))
         tlsvers = TLS1_2_VERSION;
 #else
         return 1;