diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2010-01-01 14:39:37 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2010-01-01 14:39:37 +0000 |
| commit | 2be3d6ebc8cb5ee14f7a9792cd67491a5132cace (patch) | |
| tree | 468a8ef391a1f464f870a84d10d0674cec966eb9 /ssl/s3_clnt.c | |
| parent | e6f418bcb7344fe40b78c82722577ee1910400f9 (diff) | |
| download | openssl-2be3d6ebc8cb5ee14f7a9792cd67491a5132cace.zip openssl-2be3d6ebc8cb5ee14f7a9792cd67491a5132cace.tar.gz openssl-2be3d6ebc8cb5ee14f7a9792cd67491a5132cace.tar.bz2 | |
Client side compression algorithm sanity checks: ensure old compression
algorithm matches current and give error if compression is disabled and
server requests it (shouldn't happen unless server is broken).
Diffstat (limited to 'ssl/s3_clnt.c')
| -rw-r--r-- | ssl/s3_clnt.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 3d40ba4..af30d1a 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -891,10 +891,31 @@ int ssl3_get_server_hello(SSL *s) SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); goto f_err; } + /* If compression is disabled we'd better not try to resume a session + * using compression. + */ + if (s->session->compress_meth != 0) + { + al=SSL_AD_INTERNAL_ERROR; + SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_INCONSISTENT_COMPRESSION); + goto f_err; + } #else j= *(p++); - if ((j == 0) || (s->options & SSL_OP_NO_COMPRESSION)) + if (s->hit && j != (int)s->session->compress_meth) + { + al=SSL_AD_ILLEGAL_PARAMETER; + SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED); + goto f_err; + } + if (j == 0) comp=NULL; + else if (s->options & SSL_OP_NO_COMPRESSION) + { + al=SSL_AD_ILLEGAL_PARAMETER; + SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_COMPRESSION_DISABLED); + goto f_err; + } else comp=ssl3_comp_find(s->ctx->comp_methods,j); |