jinql
/
openssl-patch
mirror of https://github.com/hakasenyang/openssl-patch
1
0
Fork 0
Code Issues Releases Wiki Activity

Edit pre7_test

openssl-1.1.1
Hakase 2018-05-12 06:37:37 +09:00
parent 4ffaae62a1
commit 7d0cb8964b
1 changed files with 22 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
openssl-equal-pre7_test.patch
View File

@ -71,7 +71,7 @@ index 8e395cdd2d..700d7b7b4e 100644
# define SSL_R_UNINITIALIZED 276 # define SSL_R_UNINITIALIZED 276
# define SSL_R_UNKNOWN_ALERT_TYPE 246 # define SSL_R_UNKNOWN_ALERT_TYPE 246
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index c5f22359d5..98cdb21ff0 100644 index c5f22359d5..561535bd96 100644
--- a/ssl/s3_lib.c --- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c +++ b/ssl/s3_lib.c
@@ -4095,6 +4095,17 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len) @@ -4095,6 +4095,17 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len)
@ -128,13 +128,13 @@ index c5f22359d5..98cdb21ff0 100644
/* SUITE-B takes precedence over server preference and ChaCha priortiy */ /* SUITE-B takes precedence over server preference and ChaCha priortiy */
- if (tls1_suiteb(s)) { - if (tls1_suiteb(s)) {
- prio = srvr;
- allow = clnt;
- } else if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
+ if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || tls1_suiteb(s)) { + if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || tls1_suiteb(s)) {
prio = srvr; prio = srvr;
+ in_group_flags = server_pref->in_group_flags; + in_group_flags = server_pref->in_group_flags;
allow = clnt; allow = clnt;
- } else if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
- prio = srvr;
- allow = clnt;
-#ifndef OPENSSL_NO_CHACHA -#ifndef OPENSSL_NO_CHACHA
- /* If ChaCha20 is at the top of the client preference list, - /* If ChaCha20 is at the top of the client preference list,
- and there are ChaCha20 ciphers in the server list, then - and there are ChaCha20 ciphers in the server list, then
@ -243,13 +243,27 @@ index c5f22359d5..98cdb21ff0 100644
} }
ii = sk_SSL_CIPHER_find(allow, c); ii = sk_SSL_CIPHER_find(allow, c);
if (ii >= 0) { if (ii >= 0) {
@@ -4272,16 +4272,36 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, @@ -4272,14 +4272,7 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED, if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED,
c->strength_bits, 0, (void *)c)) c->strength_bits, 0, (void *)c))
continue; continue;
-#if !defined(OPENSSL_NO_EC) -#if !defined(OPENSSL_NO_EC)
- if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA) - if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA)
- && s->s3->is_probably_safari) { - && s->s3->is_probably_safari) {
- if (!ret)
- ret = sk_SSL_CIPHER_value(allow, ii);
- continue;
- }
-#endif
+
if (prefer_sha256) {
const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, ii);
@@ -4291,13 +4284,38 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
ret = tmp;
continue;
}
- ret = sk_SSL_CIPHER_value(allow, ii);
+ +
+ if (in_group_flags != NULL && in_group_flags[i] == 1) { + if (in_group_flags != NULL && in_group_flags[i] == 1) {
+ /* This element of |prio| is in a group. Update + /* This element of |prio| is in a group. Update
@ -274,23 +288,10 @@ index c5f22359d5..98cdb21ff0 100644
+ /* We are about to leave a group, but we found a match + /* We are about to leave a group, but we found a match
+ * in it, so that's our answer. */ + * in it, so that's our answer. */
+ if (safari_ec) { + if (safari_ec) {
if (!ret) + if (!ret)
- ret = sk_SSL_CIPHER_value(allow, ii);
+ ret = sk_SSL_CIPHER_value(allow, group_min); + ret = sk_SSL_CIPHER_value(allow, group_min);
continue; + continue;
} + }
-#endif
if (prefer_sha256) {
- const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, ii);
+ const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, group_min);
if (ssl_md(tmp->algorithm2) == mdsha256) {
ret = tmp;
@@ -4291,13 +4311,10 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
ret = tmp;
continue;
}
- ret = sk_SSL_CIPHER_value(allow, ii);
+ ret = sk_SSL_CIPHER_value(allow, group_min); + ret = sk_SSL_CIPHER_value(allow, group_min);
break; break;
} }