mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-04-25 00:02:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add option to respect client ciphersuite order

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard 2013-11-30 18:30:06 +01:00
parent 011a8db2e7
commit 1a9f2c7245
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/polarssl/config.h
View File

@ -642,6 +642,16 @@
*/ */
#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO #define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
/**
* \def POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE
*
* Pick the ciphersuite according to the client's preferences rather than ours
* in the SSL Server module (POLARSSL_SSL_SRV_C).
*
* Uncomment this macro to respect client's ciphersuite order
*/
//#define POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE
/** /**
* \def POLARSSL_SSL_MAX_FRAGMENT_LENGTH * \def POLARSSL_SSL_MAX_FRAGMENT_LENGTH
* *

12
library/ssl_srv.c
View File

@ -975,9 +975,15 @@ static int ssl_parse_client_hello_v2( ssl_context *ssl )
ciphersuites = ssl->ciphersuite_list[ssl->minor_ver]; ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
ciphersuite_info = NULL; ciphersuite_info = NULL;
#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
{
for( i = 0; ciphersuites[i] != 0; i++ )
#else
for( i = 0; ciphersuites[i] != 0; i++ ) for( i = 0; ciphersuites[i] != 0; i++ )
{ {
for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 ) for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
#endif
{ {
if( p[0] != 0 || if( p[0] != 0 ||
p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
@ -1424,9 +1430,15 @@ static int ssl_parse_client_hello( ssl_context *ssl )
*/ */
ciphersuites = ssl->ciphersuite_list[ssl->minor_ver]; ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
ciphersuite_info = NULL; ciphersuite_info = NULL;
#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
{
for( i = 0; ciphersuites[i] != 0; i++ )
#else
for( i = 0; ciphersuites[i] != 0; i++ ) for( i = 0; ciphersuites[i] != 0; i++ )
{ {
for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 ) for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
#endif
{ {
if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
p[1] != ( ( ciphersuites[i] ) & 0xFF ) ) p[1] != ( ( ciphersuites[i] ) & 0xFF ) )