From: Dr. Stephen Henson <steve@openssl.org>
Date: Wed, 20 Jul 2011 15:17:51 +0000 (+0000)
Subject: PR: 2555
X-Git-Tag: OpenSSL-fips-2_0-rc1~251
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0445ab3ae03d94ccb48eb9b1c22a11a296e3b5c3;p=openssl

PR: 2555
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Reviewed by: steve

Fix DTLS sequence number bug
---

diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c
index e5e5a5958c..1d3805a1b4 100644
--- a/ssl/d1_srvr.c
+++ b/ssl/d1_srvr.c
@@ -167,6 +167,8 @@ int dtls1_accept(SSL *s)
 	s->in_handshake++;
 	if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
 
+	s->d1->listen = listen;
+
 	if (s->cert == NULL)
 		{
 		SSLerr(SSL_F_DTLS1_ACCEPT,SSL_R_NO_CERTIFICATE_SET);
@@ -276,6 +278,12 @@ int dtls1_accept(SSL *s)
 
 			s->init_num=0;
 
+			/* Reflect ClientHello sequence to remain stateless while listening */
+			if (listen)
+				{
+				memcpy(s->s3->write_sequence, s->s3->read_sequence, sizeof(s->s3->write_sequence));
+				}
+
 			/* If we're just listening, stop here */
 			if (listen && s->state == SSL3_ST_SW_SRVR_HELLO_A)
 				{