commit 7d38d215b108bbaa23ff1a22c06f1938866c634e
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Wed Jul 23 17:52:09 2014 +0200
committer Paul Bakker <p.j.bakker@polarssl.org> Tue Oct 21 16:30:18 2014 +0200
tree b794fe5bcb0cbbad63b5e869aa6ab74c955a6c3b
parent e4de06145a92d811f060d5aa8fc8042259062340

Allow disabling HelloVerifyRequest

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 13af7a1..a66fcb3 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -1441,28 +1441,33 @@
                        buf + cookie_offset + 1, cookie_len );
 
 #if defined(POLARSSL_SSL_DTLS_HELLO_VERIFY)
-        if( ssl->f_cookie_check( ssl->p_cookie,
-                                 buf + cookie_offset + 1, cookie_len,
-                                 ssl->cli_id, ssl->cli_id_len ) != 0 )
+        if( ssl->f_cookie_check != NULL )
         {
-            SSL_DEBUG_MSG( 2, ( "client hello, cookie verification failed" ) );
-            ssl->handshake->verify_cookie_len = 1;
+            if( ssl->f_cookie_check( ssl->p_cookie,
+                                     buf + cookie_offset + 1, cookie_len,
+                                     ssl->cli_id, ssl->cli_id_len ) != 0 )
+            {
+                SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
+                ssl->handshake->verify_cookie_len = 1;
+            }
+            else
+            {
+                SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
+                ssl->handshake->verify_cookie_len = 0;
+            }
         }
         else
-        {
-            SSL_DEBUG_MSG( 2, ( "client hello, cookie verification passed" ) );
-            ssl->handshake->verify_cookie_len = 0;
-        }
-#else
-        /* We know we didn't send a cookie, so it should be empty */
-        if( cookie_len != 0 )
-        {
-            SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-        }
-
-        SSL_DEBUG_MSG( 2, ( "client hello, cookie verification skipped" ) );
 #endif /* POLARSSL_SSL_DTLS_HELLO_VERIFY */
+        {
+            /* We know we didn't send a cookie, so it should be empty */
+            if( cookie_len != 0 )
+            {
+                SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
+                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+            }
+
+            SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
+        }
     }
 #endif /* POLARSSL_SSL_PROTO_DTLS */
 
@@ -1982,6 +1987,13 @@
     SSL_DEBUG_BUF( 3, "server version", (unsigned char *) p, 2 );
     p += 2;
 
+    /* If we get here, f_cookie_check is not null */
+    if( ssl->f_cookie_write == NULL )
+    {
+        SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
+        return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
+    }
+
     /* Skip length byte until we know the length */
     cookie_len_byte = p++;