From 65c72ddfe112a85cb4e3f67bd0af05f219e7930b Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 26 Feb 2019 14:26:09 -0800
Subject: [PATCH] Reverted an earlier change to the renegotiation resumption.
 Still need to check the cert subject hash.

---
 src/internal.c      | 24 ++++++++++++++++++++++++
 wolfssl/error-ssl.h |  2 +-
 wolfssl/internal.h  |  1 +
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index c4d670343..cf06df492 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -9562,6 +9562,30 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
                     #endif
                     }
                 }
+
+            #ifdef HAVE_SECURE_RENEGOTIATION
+                if (args->fatal == 0 && ssl->secure_renegotiation
+                               && ssl->secure_renegotiation->enabled) {
+
+                    if (IsEncryptionOn(ssl, 0)) {
+                        /* compare against previous time */
+                        if (XMEMCMP(args->dCert->subjectHash,
+                                    ssl->secure_renegotiation->subject_hash,
+                                    KEYID_SIZE) != 0) {
+                            WOLFSSL_MSG(
+                                "Peer sent different cert during scr, fatal");
+                            args->fatal = 1;
+                            ret = SCR_DIFFERENT_CERT_E;
+                        }
+                    }
+
+                    /* cache peer's hash */
+                    if (args->fatal == 0) {
+                        XMEMCPY(ssl->secure_renegotiation->subject_hash,
+                                args->dCert->subjectHash, KEYID_SIZE);
+                    }
+                }
+            #endif /* HAVE_SECURE_RENEGOTIATION */
             } /* if (count > 0) */
 
             /* Check for error */
diff --git a/wolfssl/error-ssl.h b/wolfssl/error-ssl.h
index 3f0ae944d..c7423249c 100644
--- a/wolfssl/error-ssl.h
+++ b/wolfssl/error-ssl.h
@@ -119,7 +119,7 @@ enum wolfSSL_ErrorCodes {
     SECURE_RENEGOTIATION_E       = -388,   /* Invalid Renegotiation Info */
     SESSION_TICKET_LEN_E         = -389,   /* Session Ticket too large */
     SESSION_TICKET_EXPECT_E      = -390,   /* Session Ticket missing   */
-
+    SCR_DIFFERENT_CERT_E         = -391,   /* SCR Different cert error  */
     SESSION_SECRET_CB_E          = -392,   /* Session secret Cb fcn failure */
     NO_CHANGE_CIPHER_E           = -393,   /* Finished before change cipher */
     SANITY_MSG_E                 = -394,   /* Sanity check on msg order error */
diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index fd82aa107..5d7e94df5 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -2286,6 +2286,7 @@ typedef struct SecureRenegotiation {
    enum key_cache_state cache_status;  /* track key cache state */
    byte                 client_verify_data[TLS_FINISHED_SZ];  /* cached */
    byte                 server_verify_data[TLS_FINISHED_SZ];  /* cached */
+   byte                 subject_hash[KEYID_SIZE];  /* peer cert hash */
    Keys                 tmp_keys;  /* can't overwrite real keys yet */
 } SecureRenegotiation;