Skip to main content
  • Home
  • login
  • Browse the archive

    swh mirror partner logo
swh logo
SoftwareHeritage
Software
Heritage
Mirror
Features
  • Search

  • Downloads

  • Save code now

  • Add forge now

  • Help

Revision 464774d75f91ab84772de71743e3c8c0db9a96a6 authored by Matt Caswell on 06 May 2015, 20:31:16 UTC, committed by Matt Caswell on 13 May 2015, 10:21:01 UTC
Don't allow a CCS when expecting a CertificateVerify
Currently we set change_cipher_spec_ok to 1 before calling
ssl3_get_cert_verify(). This is because this message is optional and if it
is not sent then the next thing we would expect to get is the CCS. However,
although it is optional, we do actually know whether we should be receiving
one in advance. If we have received a client cert then we should expect
a CertificateVerify message. By the time we get to this point we will
already have bombed out if we didn't get a Certificate when we should have
done, so it is safe just to check whether |peer| is NULL or not. If it is
we won't get a CertificateVerify, otherwise we will. Therefore we should
change the logic so that we only attempt to get the CertificateVerify if
we are expecting one, and not allow a CCS in this scenario.

Whilst this is good practice for TLS it is even more important for DTLS.
In DTLS messages can be lost. Therefore we may be in a situation where a
CertificateVerify message does not arrive even though one was sent. In that
case the next message the server will receive will be the CCS. This could
also happen if messages get re-ordered in-flight. In DTLS if
|change_cipher_spec_ok| is not set and a CCS is received it is ignored.
However if |change_cipher_spec_ok| *is* set then a CCS arrival will
immediately move the server into the next epoch. Any messages arriving for
the previous epoch will be ignored. This means that, in this scenario, the
handshake can never complete. The client will attempt to retransmit
missing messages, but the server will ignore them because they are the wrong
epoch. The server meanwhile will still be waiting for the CertificateVerify
which is never going to arrive.

RT#2958

Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit a0bd6493369d960abef11c2346b9bbb308b4285a)
1 parent 833518c
  • Files
  • Changes
  • 1ecfe6f
  • /
  • util
  • /
  • openssl-format-source
Raw File
Cook and download a directory from the Software Heritage Vault

You have requested the cooking of the directory with identifier None into a standard tar.gz archive.

Are you sure you want to continue ?

Download a directory from the Software Heritage Vault

You have requested the download of the directory with identifier None as a standard tar.gz archive.

Are you sure you want to continue ?

Cook and download a revision from the Software Heritage Vault

You have requested the cooking of the history heading to revision with identifier swh:1:rev:464774d75f91ab84772de71743e3c8c0db9a96a6 into a bare git archive.

Are you sure you want to continue ?

Download a revision from the Software Heritage Vault

You have requested the download of the history heading to revision with identifier swh:1:rev:464774d75f91ab84772de71743e3c8c0db9a96a6 as a bare git archive.

Are you sure you want to continue ?

Invalid Email !

The provided email is not well-formed.

Download link has expired

The requested archive is no longer available for download from the Software Heritage Vault.

Do you want to cook it again ?

Permalinks

To reference or cite the objects present in the Software Heritage archive, permalinks based on SoftWare Hash IDentifiers (SWHIDs) must be used.
Select below a type of object currently browsed in order to display its associated SWHID and permalink.

  • revision
  • content
revision badge
swh:1:rev:464774d75f91ab84772de71743e3c8c0db9a96a6
content badge Iframe embedding
swh:1:cnt:8c3a7c0dbb9449fc61ea08d47a8baeefc2d889e5
openssl-format-source
#!/bin/sh
#
# openssl-format-source 
# - format source tree according to OpenSSL coding style using indent
#
# usage:
#   openssl-format-source [-v] [-n] [file|directory] ...
#
# note: the indent options assume GNU indent v2.2.10 which was released
#       Feb-2009 so if you have an older indent the options may not 
#	match what is expected
#
# any marked block comment blocks have to be moved to align manually after
# the reformatting has been completed as marking a block causes indent to 
# not move it at all ...
#

PATH=/usr/local/bin:/bin:/usr/bin:$PATH
export PATH
HERE="`dirname $0`"

set -e

if [ $# -eq 0 ]; then
  echo "usage: $0 [-v] [-n] [-c] [sourcefile|sourcedir] ..." >&2
  exit 1
fi

VERBOSE=false
DONT=false
STOPARGS=false
COMMENTS=false
DEBUG=""

# for this exercise, we want to force the openssl style, so we roll
# our own indent profile, which is at a well known location
INDENT_PROFILE="$HERE/indent.pro"
export INDENT_PROFILE
if [ ! -f "$INDENT_PROFILE" ]; then
  echo "$0: unable to locate the openssl indent.pro file" >&2
  exit 1
fi

# Extra arguments; for adding the comment-formatting
INDENT_ARGS=""
for i 
do
  if [ "$STOPARGS" != "true" ]; then
    case $i in
      --) STOPARGS="true"; continue;;
      -n) DONT="true"; continue;;
      -v) VERBOSE="true"; 
	  echo "INDENT_PROFILE=$INDENT_PROFILE";
	  continue;;
      -c) COMMENTS="true"; 
      	  INDENT_ARGS="-fc1 -fca -cdb -sc"; 
	  continue;;
      -nc) COMMENTS="true";
	  continue;;
      -d) DEBUG='eval tee "$j.pre" |'
	  continue;;
    esac
  fi

  if [ -d "$i" ]; then
    LIST=`find "$i" -name '*.[ch]' -print`
  else 
    if [ ! -f "$i" ]; then
      echo "$0: source file not found: $i" >&2
      exit 1
    fi
    LIST="$i"
  fi
  
  for j in $LIST
  do
    # ignore symlinks - we only ever process the base file - so if we
    # expand a directory tree we need to ignore any located symlinks
    if [ -d "$i" ]; then
      if [ -h "$j" ]; then
	continue;
      fi
    fi

    if [ "$VERBOSE" = "true" ]; then
      echo "$j"
    fi

    if [ "$DONT" = "false" ]; then
      tmp=$(mktemp /tmp/indent.XXXXXX)
      trap 'rm -f "$tmp"' HUP INT TERM EXIT

      case `basename $j` in 
	# the list of files that indent is unable to handle correctly
	# that we simply leave alone for manual formatting now
	obj_dat.h|aes_core.c|aes_x86core.c|ecp_nistz256.c)
	  echo "skipping $j"
	  ;;
	*)
	  if [ "$COMMENTS" = "true" ]; then
	    # we have to mark single line comments as /*- ...*/ to stop indent
	    # messing with them, run expand then indent as usual but with the
	    # the process-comments options and then undo that marking, and then 
	    # finally re-run indent without process-comments so the marked-to-
	    # be-ignored comments we did automatically end up getting moved 
	    # into the right possition within the code as indent leaves marked 
	    # comments entirely untouched - we appear to have no way to avoid 
	    # the double processing and get the desired output
	    cat "$j" | \
	    expand | \
	    perl -0 -np \
	      -e 's/(\n#[ \t]*ifdef[ \t]+__cplusplus\n[^\n]*\n#[ \t]*endif\n)/\n\/**INDENT-OFF**\/$1\/**INDENT-ON**\/\n/g;' \
	      -e 's/(\n\/\*\!)/\n\/**/g;' \
	      -e 's/(STACK_OF|LHASH_OF)\(([^ \t,\)]+)\)( |\n)/$1_$2_$3/g;' \
	      | \
	    perl -np \
	      -e 's/^([ \t]*)\/\*([ \t]+.*)\*\/[ \t]*$/if (length("$1$2")<75) {$c="-"}else{$c=""}; "$1\/*$c$2*\/"/e;' \
	      -e 's/^\/\* ((Copyright|=|----).*)$/\/*-$1/;' \
	      -e 's/^((DECLARE|IMPLEMENT)_(EXTERN_ASN1|ASN1|ADB|STACK_OF|PKCS12_STACK_OF).*)$/\/**INDENT-OFF**\/\n$1\n\/**INDENT-ON**\//;' \
	      -e 's/^([ \t]*(make_dh|make_dh_bn|make_rfc5114_td)\(.*\)[ \t,]*)$/\/**INDENT-OFF**\/\n$1\n\/**INDENT-ON**\//;' \
	      -e 's/^(ASN1_ADB_TEMPLATE\(.*)$/\/**INDENT-OFF**\/\n$1\n\/**INDENT-ON**\//;' \
	      -e 's/^((ASN1|ADB)_.*_(end|END)\(.*[\){=,;]+[ \t]*)$/$1\n\/**INDENT-ON**\//;' \
	      -e '/ASN1_(ITEM_ref|ITEM_ptr|ITEM_rptr|PCTX)/ || s/^((ASN1|ADB)_[^\*]*[){=,]+[ \t]*)$/\/**INDENT-OFF**\/\n$1/;' \
	      -e 's/^(} (ASN1|ADB)_[^\*]*[\){=,;]+)$/$1\n\/**INDENT-ON**\//;' \
	      | \
	      $DEBUG indent $INDENT_ARGS | \
	      perl -np \
		-e 's/^([ \t]*)\/\*-(.*)\*\/[ \t]*$/$1\/*$2*\//;' \
		-e 's/^\/\*-((Copyright|=|----).*)$/\/* $1/;' \
	      | indent | \
	      perl -0 -np \
		-e 's/\/\*\*INDENT-(ON|OFF)\*\*\/\n//g;' \
	      | perl -np \
	        -e 's/(STACK_OF|LHASH_OF)_([^ \t,]+)_( |\/)/$1($2)$3/g;' \
	        -e 's/(STACK_OF|LHASH_OF)_([^ \t,]+)_$/$1($2)/g;' \
	      | perl "$HERE"/su-filter.pl \
	      > "$tmp"
	  else
	    expand "$j" | indent $INDENT_ARGS > "$tmp"
	  fi;
	  mv "$tmp" "$j"
	  ;;
      esac
    fi
  done
done


The diff you're trying to view is too large. Only the first 1000 changed files have been loaded.
Showing with 0 additions and 0 deletions (0 / 0 diffs computed)
swh spinner

Computing file changes ...

ENEA — Copyright (C), ENEA. License: GNU AGPLv3+.
Legal notes  ::  JavaScript license information ::  Web API

back to top