From 829e9f52773f8b90414659ed6b7a7417be728db1 Mon Sep 17 00:00:00 2001 From: Marco Oliverio Date: Mon, 9 May 2022 10:48:29 +0200 Subject: [PATCH] tls13: fix cookie has keyShare information check Fix the check to see if the cookie has key_share information or not (needed to reconstruct the HelloRetryRequest). At the moment, it looks like we never send a cookie without KeyShare extension. Indeed the HelloRetryRequest is sent only because the client didn't provide a good KeyShareEntry in the first ClientHello. When we will support DTLSv1.3, the HelloRetryRequest will be used as a return-routability check and it may be sent without the KeyShare extension. --- src/tls13.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/tls13.c b/src/tls13.c index 555c03ac2..3cd9bc1bd 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -4437,7 +4437,8 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie) length = HRR_BODY_SZ - ID_LEN + ssl->session->sessionIDSz + HRR_COOKIE_HDR_SZ + cookie->len; length += HRR_VERSIONS_SZ; - if (cookieDataSz > hashSz + OPAQUE16_LEN) { + /* HashSz (1 byte) + Hash (HashSz bytes) + CipherSuite (2 bytes) */ + if (cookieDataSz > OPAQUE8_LEN + hashSz + OPAQUE16_LEN) { keyShareExt = 1; length += HRR_KEY_SHARE_SZ; }