[src/netbsd-1-6]: src/crypto/dist/openssl/ssl Pull up revision 1.6 (requested...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/68c787a350ac
branches:  netbsd-1-6
changeset: 530766:68c787a350ac
user:      tron <tron%NetBSD.org@localhost>
date:      Thu Oct 02 09:20:16 2003 +0000

description:
Pull up revision 1.6 (requested by itojun in ticket #1496):
more fixes from 0.9.7c, from openbsd

diffstat:

 crypto/dist/openssl/ssl/s3_srvr.c |  12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diffs (43 lines):

diff -r c40fb3d23189 -r 68c787a350ac crypto/dist/openssl/ssl/s3_srvr.c
--- a/crypto/dist/openssl/ssl/s3_srvr.c Thu Oct 02 09:20:08 2003 +0000
+++ b/crypto/dist/openssl/ssl/s3_srvr.c Thu Oct 02 09:20:16 2003 +0000
@@ -415,8 +415,11 @@
                        else {
                                /* could be sent for a DH cert, even if we
                                 * have not asked for it :-) */
-                               ret=ssl3_get_client_certificate(s);
-                               if (ret <= 0) goto end;
+                                if (s->s3->tmp.cert_request)
+                                       {
+                                       ret=ssl3_get_client_certificate(s);
+                                       if (ret <= 0) goto end;
+                                       }
                                s->init_num=0;
                                s->state=SSL3_ST_SR_KEY_EXCH_A;
                        }
@@ -821,6 +824,9 @@
                }
 
        /* TLS does not mind if there is extra stuff */
+#if 0  /* SSL 3.0 does not mind either, so we should disable this test
+        * (was enabled in 0.9.6d through 0.9.6j and 0.9.7 through 0.9.7b,
+        * in earlier SSLeay/OpenSSL releases this test existed but was buggy) */
        if (s->version == SSL3_VERSION)
                {
                if (p < (d+n))
@@ -832,6 +838,7 @@
                        goto f_err;
                        }
                }
+#endif
 
        /* Given s->session->ciphers and ssl_get_ciphers_by_id(s), we must
         * pick a cipher */
@@ -1326,6 +1333,7 @@
                s->init_num += 4;
 #endif
 
+               s->state = SSL3_ST_SW_CERT_REQ_B;
                }
 
        /* SSL3_ST_SW_CERT_REQ_B */