diff options
| author | nelsonb%netscape.com <devnull@localhost> | 2001-01-13 02:32:39 +0000 |
|---|---|---|
| committer | nelsonb%netscape.com <devnull@localhost> | 2001-01-13 02:32:39 +0000 |
| commit | f0822c7c9b7d333c74f23fb4c5aafa2a4ad9c5b6 (patch) | |
| tree | fd4e476253a27cbc0ab87535711eb2ea4fccf385 /security/nss/lib/ssl/ssl3con.c | |
| parent | 3ac9f5bd980c31bc6b916e07b413190182cb45de (diff) | |
| download | nss-hg-f0822c7c9b7d333c74f23fb4c5aafa2a4ad9c5b6.tar.gz | |
Send SSL 3.x alert records when a version mismatch occurs.
Use the other party's version number to decide which alert to send.
Bug 65142. R&A: relyea.
Diffstat (limited to 'security/nss/lib/ssl/ssl3con.c')
| -rw-r--r-- | security/nss/lib/ssl/ssl3con.c | 18 |
1 files changed, 6 insertions, 12 deletions
diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c index d8cc871d5..014a4a156 100644 --- a/security/nss/lib/ssl/ssl3con.c +++ b/security/nss/lib/ssl/ssl3con.c @@ -3666,13 +3666,13 @@ ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length) ** know SSL 3.x. */ if (MSB(version) != MSB(SSL_LIBRARY_VERSION_3_0)) { - desc = handshake_failure; + desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure; goto alert_loser; } rv = ssl3_NegotiateVersion(ss, version); if (rv != SECSuccess) { - desc = handshake_failure; + desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure; errCode = SSL_ERROR_NO_CYPHER_OVERLAP; goto alert_loser; } @@ -4559,11 +4559,7 @@ ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length) ss->clientHelloVersion = version = (SSL3ProtocolVersion)tmp; rv = ssl3_NegotiateVersion(ss, version); if (rv != SECSuccess) { - /* We can't do the usual isTLS test here, because the negotiated - ** version is definitely not 3.1. So the question is, are we - ** willing/able to do TLS here on our side? - */ - desc = ss->enableTLS ? protocol_version : handshake_failure; + desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure; errCode = SSL_ERROR_NO_CYPHER_OVERLAP; goto alert_loser; } @@ -4985,12 +4981,10 @@ ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length) rv = ssl3_NegotiateVersion(ss, version); if (rv != SECSuccess) { - desc = ss->enableTLS ? protocol_version : handshake_failure; + /* send back which ever alert client will understand. */ + desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure; errCode = SSL_ERROR_NO_CYPHER_OVERLAP; - /* It's not appropriate to send back SSL3/TLS alert records in - ** response to an SSL2 client hello, unless the version is - ** succesfully negotiated to 3.0 or greater, so just goto loser. */ - goto loser; /* alert_loser */ + goto alert_loser; } /* if we get a non-zero SID, just ignore it. */ |