From 60af8bdb7c518f746b6747824bd03e3823911e98 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Mon, 1 Jul 2019 09:26:05 +1000 Subject: [PATCH] Fix for TLS 1.3 and secure renegotiation --- src/internal.c | 5 +++-- src/tls.c | 10 ++++++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/src/internal.c b/src/internal.c index ea1b2e816..c6c6e4a36 100644 --- a/src/internal.c +++ b/src/internal.c @@ -9660,8 +9660,9 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, } #ifdef HAVE_SECURE_RENEGOTIATION - if (args->fatal == 0 && ssl->secure_renegotiation - && ssl->secure_renegotiation->enabled) { + if (args->fatal == 0 && !IsAtLeastTLSv1_3(ssl->version) + && ssl->secure_renegotiation + && ssl->secure_renegotiation->enabled) { if (IsEncryptionOn(ssl, 0)) { /* compare against previous time */ diff --git a/src/tls.c b/src/tls.c index d6b90114b..934353142 100644 --- a/src/tls.c +++ b/src/tls.c @@ -9959,7 +9959,7 @@ int TLSX_GetResponseSize(WOLFSSL* ssl, byte msgType, word16* pLength) case server_hello: PF_VALIDATE_RESPONSE(ssl, semaphore); #ifdef WOLFSSL_TLS13 - if (ssl->options.tls1_3) { + if (IsAtLeastTLSv1_3(ssl->version)) { XMEMSET(semaphore, 0xff, SEMAPHORE_SIZE); #ifndef WOLFSSL_TLS13_DRAFT_18 TURN_OFF(semaphore, @@ -10003,6 +10003,9 @@ int TLSX_GetResponseSize(WOLFSSL* ssl, byte msgType, word16* pLength) #endif #ifdef HAVE_CERTIFICATE_STATUS_REQUEST TURN_ON(semaphore, TLSX_ToSemaphore(TLSX_STATUS_REQUEST)); + #endif + #if defined(HAVE_SECURE_RENEGOTIATION) + TURN_ON(semaphore, TLSX_ToSemaphore(TLSX_RENEGOTIATION_INFO)); #endif break; @@ -10076,7 +10079,7 @@ int TLSX_WriteResponse(WOLFSSL *ssl, byte* output, byte msgType, word16* pOffset case server_hello: PF_VALIDATE_RESPONSE(ssl, semaphore); #ifdef WOLFSSL_TLS13 - if (ssl->options.tls1_3) { + if (IsAtLeastTLSv1_3(ssl->version)) { XMEMSET(semaphore, 0xff, SEMAPHORE_SIZE); #ifndef WOLFSSL_TLS13_DRAFT_18 TURN_OFF(semaphore, @@ -10120,6 +10123,9 @@ int TLSX_WriteResponse(WOLFSSL *ssl, byte* output, byte msgType, word16* pOffset #endif #ifdef HAVE_CERTIFICATE_STATUS_REQUEST TURN_ON(semaphore, TLSX_ToSemaphore(TLSX_STATUS_REQUEST)); + #endif + #if defined(HAVE_SECURE_RENEGOTIATION) + TURN_ON(semaphore, TLSX_ToSemaphore(TLSX_RENEGOTIATION_INFO)); #endif break;