OERV-RUNTIME/boringssl
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove SSL_OP_CISCO_ANYCONNECT.

Browse Source 
I see no internal users and the existence of a THIRD version encoding
complicates all version-checking logic. Also convert another version check to
SSL_IS_DTLS that was missed earlier.

Change-Id: I60d215f57d44880f6e6877889307dc39dbf838f7
Reviewed-on: https://boringssl-review.googlesource.com/1550
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
David Benjamin
2014-08-18 17:57:01 +00:00
committed by Adam Langley
parent 6f2600199c
commit cc23df53da
11 changed files with 9 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/openssl/dtls1.h
-1
View File
@@ -68,7 +68,6 @@ extern "C" {
#define DTLS1_VERSION 0xFEFF
#define DTLS1_BAD_VER 0x0100
#define DTLS1_2_VERSION 0xFEFD
/* Special value for method supporting multiple versions */
#define DTLS_ANY_VERSION 0x1FFFF
include/openssl/ssl.h
-2
View File
@@ -530,8 +530,6 @@ struct ssl_session_st
#define SSL_OP_COOKIE_EXCHANGE 0x00002000L
/* Don't use RFC4507 ticket extension */
#define SSL_OP_NO_TICKET 0x00004000L
/* Use Cisco's "speshul" version of DTLS_BAD_VER (as client) */
#define SSL_OP_CISCO_ANYCONNECT 0x00008000L
/* As server, disallow session resumption on renegotiation */
#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0x00010000L
ssl/d1_both.c
+3 -11
View File
@@ -373,7 +373,7 @@ int dtls1_do_write(SSL *s, int type)
const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
int xlen;
if (frag_off == 0 && s->version != DTLS1_BAD_VER)
if (frag_off == 0)
{
/* reconstruct message header is if it
* is being sent in single fragment */
@@ -464,10 +464,8 @@ again:
s2n (msg_hdr->seq,p);
l2n3(0,p);
l2n3(msg_len,p);
if (s->version != DTLS1_BAD_VER) {
p -= DTLS1_HM_HEADER_LENGTH;
msg_len += DTLS1_HM_HEADER_LENGTH;
}
p -= DTLS1_HM_HEADER_LENGTH;
msg_len += DTLS1_HM_HEADER_LENGTH;
ssl3_finish_mac(s, p, msg_len);
if (s->msg_callback)
@@ -951,12 +949,6 @@ int dtls1_send_change_cipher_spec(SSL *s, int a, int b)
s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
s->init_num=DTLS1_CCS_HEADER_LENGTH;
if (s->version == DTLS1_BAD_VER) {
s->d1->next_handshake_write_seq++;
s2n(s->d1->handshake_write_seq,p);
s->init_num+=2;
}
s->init_off=0;
dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
ssl/d1_clnt.c
+2 -3
View File
@@ -130,7 +130,7 @@ static int dtls1_get_hello_verify(SSL *s);
static const SSL_METHOD *dtls1_get_client_method(int ver)
{
if (ver == DTLS1_VERSION || ver == DTLS1_BAD_VER)
if (ver == DTLS1_VERSION)
return(DTLSv1_client_method());
else if (ver == DTLS1_2_VERSION)
return(DTLSv1_2_client_method());
@@ -196,8 +196,7 @@ int dtls1_connect(SSL *s)
s->server=0;
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00) &&
(s->version & 0xff00 ) != (DTLS1_BAD_VER & 0xff00))
if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00))
{
OPENSSL_PUT_ERROR(SSL, dtls1_connect, ERR_R_INTERNAL_ERROR);
ret = -1;
ssl/d1_lib.c
+1 -3
View File
@@ -271,9 +271,7 @@ void dtls1_clear(SSL *s)
}
ssl3_clear(s);
if (s->options & SSL_OP_CISCO_ANYCONNECT)
s->version=DTLS1_BAD_VER;
else if (s->method->version == DTLS_ANY_VERSION)
if (s->method->version == DTLS_ANY_VERSION)
s->version=DTLS1_2_VERSION;
else
s->version=s->method->version;
ssl/d1_pkt.c
-6
View File
@@ -1101,9 +1101,6 @@ start:
dtls1_get_ccs_header(rr->data, &ccs_hdr);
if (s->version == DTLS1_BAD_VER)
ccs_hdr_len = 3;
/* 'Change Cipher Spec' is just a single byte, so we know
* exactly what the record payload has to look like */
/* XDTLS: check that epoch is consistent */
@@ -1138,9 +1135,6 @@ start:
/* do this whenever CCS is processed */
dtls1_reset_seq_numbers(s, SSL3_CC_READ);
if (s->version == DTLS1_BAD_VER)
s->d1->handshake_read_seq++;
goto start;
}
ssl/d1_srvr.c
+1 -2
View File
@@ -327,8 +327,7 @@ int dtls1_accept(SSL *s)
s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;
/* HelloVerifyRequest resets Finished MAC */
if (s->version != DTLS1_BAD_VER)
ssl3_init_finished_mac(s);
ssl3_init_finished_mac(s);
break;
ssl/s3_both.c
+1 -1
View File
@@ -628,7 +628,7 @@ int ssl3_setup_write_buffer(SSL *s)
unsigned char *p;
size_t len,align=0,headerlen;
if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
if (SSL_IS_DTLS(s))
headerlen = DTLS1_RT_HEADER_LENGTH + 1;
else
headerlen = SSL3_RT_HEADER_LENGTH;
ssl/s3_srvr.c
+1 -6
View File
@@ -1993,12 +1993,7 @@ int ssl3_get_client_key_exchange(SSL *s)
}
rsa=pkey->pkey.rsa;
/* TLS and [incidentally] DTLS{0xFEFF}
*
* TODO(davidben): Should this (and
* ssl3_send_client_key_exchange) include DTLS1_BAD_VER?
* Alternatively, get rid of DTLS1_BAD_VER?
*/
/* TLS and [incidentally] DTLS{0xFEFF} */
if (s->version > SSL3_VERSION)
{
CBS copy = client_key_exchange;
ssl/ssl_sess.c
-5
View File
@@ -319,11 +319,6 @@ int ssl_get_new_session(SSL *s, int session)
ss->ssl_version=TLS1_2_VERSION;
ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
}
else if (s->version == DTLS1_BAD_VER)
{
ss->ssl_version=DTLS1_BAD_VER;
ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
}
else if (s->version == DTLS1_VERSION)
{
ss->ssl_version=DTLS1_VERSION;
ssl/ssl_txt.c
-2
View File
@@ -126,8 +126,6 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
s="DTLSv1";
else if (x->ssl_version == DTLS1_2_VERSION)
s="DTLSv1.2";
else if (x->ssl_version == DTLS1_BAD_VER)
s="DTLSv1-bad";
else
s="unknown";
if (BIO_printf(bp," Protocol : %s\n",s) <= 0) goto err;