diff options
| author |   tb <tb@openbsd.org> | 2020-08-31 14:04:51 +0000 |
|---|---|---|
| committer | tb <tb@openbsd.org> | 2020-08-31 14:04:51 +0000 |
| commit | 9a3f7535fd75ed526727ea8e8539a7d862d8a5ad (patch) | |
| tree | 8271c6ea1906c3d1c740b812d4774f97937491e0 /lib/libssl/ssl_locl.h | |
| parent | Backout clear endpoint stall on open(2). It seems to break an illuminated (diff) | |
| download | wireguard-openbsd-9a3f7535fd75ed526727ea8e8539a7d862d8a5ad.tar.xz wireguard-openbsd-9a3f7535fd75ed526727ea8e8539a7d862d8a5ad.zip | |
Send alert on ssl_get_prev_session failure
ssl_get_prev_session() can fail for various reasons some of which
may be internal_error others decode_error alerts. Propagate the
appropriate alert up to the caller so we can abort the handshake
by sending a fatal alert instead of rudely closing the pipe.
Currently only 28 of 292 test cases of tlsfuzzer's test-extension.py pass.
With this diff, 272 pass. The rest will require fixes elsewhere.
ok beck inoguchi jsing
Diffstat (limited to 'lib/libssl/ssl_locl.h')
| -rw-r--r-- | lib/libssl/ssl_locl.h | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/lib/libssl/ssl_locl.h b/lib/libssl/ssl_locl.h index e41465419a6..036c1dacb28 100644 --- a/lib/libssl/ssl_locl.h +++ b/lib/libssl/ssl_locl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_locl.h,v 1.284 2020/08/30 15:40:20 jsing Exp $ */ +/* $OpenBSD: ssl_locl.h,v 1.285 2020/08/31 14:04:51 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1161,7 +1161,8 @@ int ssl_cert_add1_chain_cert(CERT *c, X509 *cert); SESS_CERT *ssl_sess_cert_new(void); void ssl_sess_cert_free(SESS_CERT *sc); int ssl_get_new_session(SSL *s, int session); -int ssl_get_prev_session(SSL *s, CBS *session_id, CBS *ext_block); +int ssl_get_prev_session(SSL *s, CBS *session_id, CBS *ext_block, + int *alert); int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b); SSL_CIPHER *OBJ_bsearch_ssl_cipher_id(SSL_CIPHER *key, SSL_CIPHER const *base, int num); @@ -1397,7 +1398,7 @@ int ssl_check_clienthello_tlsext_late(SSL *s); int ssl_check_serverhello_tlsext(SSL *s); int tls1_process_ticket(SSL *s, CBS *session_id, CBS *ext_block, - SSL_SESSION **ret); + int *alert, SSL_SESSION **ret); long ssl_get_algorithm2(SSL *s); |