diff options
| author | David Benjamin <davidben@chromium.org> | 2014-11-30 02:49:50 -0500 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2014-12-02 19:35:27 +0000 |
| commit | 8c6fe45c2f678041f5150460a0efc5e9ce5cda8a (patch) | |
| tree | be11a618d0987a3170fb84bd86cc3d40bb8182d5 /include | |
| parent | cde8abae14da0cf7d7047974246df5f0ccf4ca4d (diff) | |
| download | boringssl-8c6fe45c2f678041f5150460a0efc5e9ce5cda8a.zip boringssl-8c6fe45c2f678041f5150460a0efc5e9ce5cda8a.tar.gz boringssl-8c6fe45c2f678041f5150460a0efc5e9ce5cda8a.tar.bz2 | |
Replace s->first_packet with a s->s3->have_version bit.
first_packet is a temporary connection-global flag set for the duration of some
call and then queried from other code. This kind of logic is too difficult to
reason through. It also incorrectly treats renegotiate ClientHellos as
pre-version-negotiation records. This eliminates the need to query
enc_write_ctx (which wasn't EVP_AEAD-aware anyway).
Instead, take a leaf from Go TLS's book and add a have_version bit. This is
placed on s->s3 as it is connection state; s->s3 automatically gets reset on
SSL_clear while s doesn't.
This new flag will also be used to determine whether to do the V2ClientHello
sniff when the version-locked methods merge into SSLv23_method. It will also
replace needing to condition s->method against a dummy DTLS_ANY_VERSION value
to determine whether DTLS version negotiation has happened yet.
Change-Id: I5c8bc6258b182ba4ab175a48a84eab6d3a001333
Reviewed-on: https://boringssl-review.googlesource.com/2442
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/ssl.h | 1 | ||||
| -rw-r--r-- | include/openssl/ssl3.h | 4 |
2 files changed, 4 insertions, 1 deletions
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 2a388c7..216d0c9 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -1300,7 +1300,6 @@ struct ssl_st unsigned long options; /* protocol behaviour */ unsigned long mode; /* API behaviour */ long max_cert_list; - int first_packet; int client_version; /* what was passed, used for * SSLv3/TLS rollback check */ unsigned int max_send_fragment; diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h index 54e8c1e..3bb9da3 100644 --- a/include/openssl/ssl3.h +++ b/include/openssl/ssl3.h @@ -365,6 +365,10 @@ typedef struct ssl3_state_st /* The value of 'extra' when the buffers were initialized */ int init_extra; + /* have_version is true if the connection's final version is + * known. Otherwise the version has not been negotiated yet. */ + char have_version; + SSL3_BUFFER rbuf; /* read IO goes into here */ SSL3_BUFFER wbuf; /* write IO goes into here */ |