diff options
| author |   jsing <jsing@openbsd.org> | 2020-05-10 14:07:01 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2020-05-10 14:07:01 +0000 |
| commit | 834e13ab1c912d405b11915ba98eaf628abeb8ee (patch) | |
| tree | a89125b81e93fa496e8ab5d3bdf71d8abf5bef6e /lib | |
| parent | Correct tlsext_ocsp_resplen check. (diff) | |
| download | wireguard-openbsd-834e13ab1c912d405b11915ba98eaf628abeb8ee.tar.xz wireguard-openbsd-834e13ab1c912d405b11915ba98eaf628abeb8ee.zip | |
Only reset TLS extension state when parsing client hello or server hello.
With TLSv1.3 we end up parsing extensions from more than just these two
messages. This can result in variables (like the selected alpn) being
freed when things still need them.
ok tb@
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libssl/ssl_tlsext.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/lib/libssl/ssl_tlsext.c b/lib/libssl/ssl_tlsext.c index bc122686c9b..65e53f93beb 100644 --- a/lib/libssl/ssl_tlsext.c +++ b/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.65 2020/05/09 15:05:50 beck Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.66 2020/05/10 14:07:01 jsing Exp $ */ /* * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org> * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> @@ -2061,8 +2061,9 @@ tlsext_server_build(SSL *s, CBB *cbb, uint16_t msg_type) int tlsext_server_parse(SSL *s, CBS *cbs, int *alert, uint16_t msg_type) { - /* XXX - this possibly should be done by the caller... */ - tlsext_server_reset_state(s); + /* XXX - this should be done by the caller... */ + if (msg_type == SSL_TLSEXT_MSG_CH) + tlsext_server_reset_state(s); return tlsext_parse(s, cbs, alert, 1, msg_type); } @@ -2084,8 +2085,9 @@ tlsext_client_build(SSL *s, CBB *cbb, uint16_t msg_type) int tlsext_client_parse(SSL *s, CBS *cbs, int *alert, uint16_t msg_type) { - /* XXX - this possibly should be done by the caller... */ - tlsext_client_reset_state(s); + /* XXX - this should be done by the caller... */ + if (msg_type == SSL_TLSEXT_MSG_SH) + tlsext_client_reset_state(s); return tlsext_parse(s, cbs, alert, 0, msg_type); } |