feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Adapt wolfSSL_dtls_got_timeout to secure renegotiation usage

Browse Source 
Reset DTLS stored messages on a FreeHandshakeResources call even if secure renegotiation is enabled. Without this, in a server initiated rehandshake, the server would keep old messages (ChangeCipherSpec and Finished) even when it sent a HelloRequest message.
This commit is contained in:
Juliusz Sosinowicz
2020-11-24 16:06:35 +01:00
parent f5c2bef78f
commit 41d58465c0
2 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/internal.c
View File

@@ -6488,6 +6488,16 @@ void SSL_ResourceFree(WOLFSSL* ssl)
void FreeHandshakeResources(WOLFSSL* ssl) void FreeHandshakeResources(WOLFSSL* ssl)
{ {
#ifdef WOLFSSL_DTLS
/* DTLS_POOL */
if (ssl->options.dtls) {
DtlsMsgPoolReset(ssl);
DtlsMsgListDelete(ssl->dtls_rx_msg_list, ssl->heap);
ssl->dtls_rx_msg_list = NULL;
ssl->dtls_rx_msg_list_sz = 0;
}
#endif
#ifdef HAVE_SECURE_RENEGOTIATION #ifdef HAVE_SECURE_RENEGOTIATION
if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) { if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) {
WOLFSSL_MSG("Secure Renegotiation needs to retain handshake resources"); WOLFSSL_MSG("Secure Renegotiation needs to retain handshake resources");
@@ -6532,16 +6542,6 @@ void FreeHandshakeResources(WOLFSSL* ssl)
} }
} }
#ifdef WOLFSSL_DTLS
/* DTLS_POOL */
if (ssl->options.dtls) {
DtlsMsgPoolReset(ssl);
DtlsMsgListDelete(ssl->dtls_rx_msg_list, ssl->heap);
ssl->dtls_rx_msg_list = NULL;
ssl->dtls_rx_msg_list_sz = 0;
}
#endif
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) && \ #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) && \
defined(HAVE_SESSION_TICKET) defined(HAVE_SESSION_TICKET)
if (!ssl->options.tls1_3) if (!ssl->options.tls1_3)

2
src/ssl.c
View File

@@ -11633,7 +11633,7 @@ int wolfSSL_dtls_got_timeout(WOLFSSL* ssl)
if (ssl == NULL) if (ssl == NULL)
return WOLFSSL_FATAL_ERROR; return WOLFSSL_FATAL_ERROR;
if (!ssl->options.handShakeDone && if ((IsSCR(ssl) || !ssl->options.handShakeDone) &&
(DtlsMsgPoolTimeout(ssl) < 0 || DtlsMsgPoolSend(ssl, 0) < 0)) { (DtlsMsgPoolTimeout(ssl) < 0 || DtlsMsgPoolSend(ssl, 0) < 0)) {
result = WOLFSSL_FATAL_ERROR; result = WOLFSSL_FATAL_ERROR;