989d921f5d
I'm very pleased to announce the release of our new website and documentation using the new toolchain with Hugo and AsciiDoctor. To get more information about the new toolchain please read the FreeBSD Documentation Project Primer[1], Hugo docs[2] and AsciiDoctor docs[3]. Acknowledgment: Benedict Reuschling <bcr@> Glen Barber <gjb@> Hiroki Sato <hrs@> Li-Wen Hsu <lwhsu@> Sean Chittenden <seanc@> The FreeBSD Foundation [1] https://docs.FreeBSD.org/en/books/fdp-primer/ [2] https://gohugo.io/documentation/ [3] https://docs.asciidoctor.org/home/ Approved by: doceng, core
41 lines
1.8 KiB
Diff
41 lines
1.8 KiB
Diff
Index: crypto/openssl/ssl/s2_srvr.c
|
|
===================================================================
|
|
--- crypto/openssl/ssl/s2_srvr.c (revision 294905)
|
|
+++ crypto/openssl/ssl/s2_srvr.c (working copy)
|
|
@@ -402,7 +402,7 @@ static int get_client_master_key(SSL *s)
|
|
}
|
|
|
|
cp = ssl2_get_cipher_by_char(p);
|
|
- if (cp == NULL) {
|
|
+ if (cp == NULL || sk_SSL_CIPHER_find(s->session->ciphers, cp) < 0) {
|
|
ssl2_return_error(s, SSL2_PE_NO_CIPHER);
|
|
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_CIPHER_MATCH);
|
|
return (-1);
|
|
@@ -687,8 +687,12 @@ static int get_client_hello(SSL *s)
|
|
prio = cs;
|
|
allow = cl;
|
|
}
|
|
+
|
|
+ /* Generate list of SSLv2 ciphers shared between client and server */
|
|
for (z = 0; z < sk_SSL_CIPHER_num(prio); z++) {
|
|
- if (sk_SSL_CIPHER_find(allow, sk_SSL_CIPHER_value(prio, z)) < 0) {
|
|
+ const SSL_CIPHER *cp = sk_SSL_CIPHER_value(prio, z);
|
|
+ if ((cp->algorithm_ssl & SSL_SSLV2) == 0 ||
|
|
+ sk_SSL_CIPHER_find(allow, cp) < 0) {
|
|
(void)sk_SSL_CIPHER_delete(prio, z);
|
|
z--;
|
|
}
|
|
@@ -697,6 +701,13 @@ static int get_client_hello(SSL *s)
|
|
sk_SSL_CIPHER_free(s->session->ciphers);
|
|
s->session->ciphers = prio;
|
|
}
|
|
+
|
|
+ /* Make sure we have at least one cipher in common */
|
|
+ if (sk_SSL_CIPHER_num(s->session->ciphers) == 0) {
|
|
+ ssl2_return_error(s, SSL2_PE_NO_CIPHER);
|
|
+ SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_NO_CIPHER_MATCH);
|
|
+ return -1;
|
|
+ }
|
|
/*
|
|
* s->session->ciphers should now have a list of ciphers that are on
|
|
* both the client and server. This list is ordered by the order the
|