feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #5554 from rizlik/dtls_cid_fix

Browse Source 
fix: dtls13: do not negotiate ConnectionID in HelloRetryRequest
This commit is contained in:
David Garske
2022-09-06 09:28:25 -07:00
committed by GitHub
parent 7b0128f9ac aee81764f2
commit e2de8f3b6c
2 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/dtls.c
View File

@ -240,9 +240,20 @@ int TLSX_ConnectionID_Parse(WOLFSSL* ssl, const byte* input, word16 length,
}
info = DtlsCidGetInfo(ssl);
if (info == NULL || info->tx != NULL)
if (info == NULL)
return BAD_STATE_E;
/* it may happen if we process two ClientHello because the server sent an
* HRR request */
if (info->tx != NULL) {
if (ssl->options.side != WOLFSSL_SERVER_END &&
ssl->options.serverState != SERVER_HELLO_RETRY_REQUEST_COMPLETE)
return BAD_STATE_E;
XFREE(info->tx, ssl->heap, DYNAMIC_TYPE_TLSX);
info->tx = NULL;
}
if (length < OPAQUE8_LEN)
return BUFFER_ERROR;

16
src/tls13.c
View File

@ -4374,7 +4374,7 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
}
#ifdef WOLFSSL_DTLS_CID
if (ssl->options.useDtlsCID)
if (ssl->options.useDtlsCID && *extMsgType == server_hello)
DtlsCIDOnExtensionsParsed(ssl);
#endif /* WOLFSSL_DTLS_CID */
@ -5826,11 +5826,6 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
goto exit_dch;
}
#ifdef WOLFSSL_DTLS_CID
if (ssl->options.useDtlsCID)
DtlsCIDOnExtensionsParsed(ssl);
#endif /* WOLFSSL_DTLS_CID */
#ifdef HAVE_SNI
if ((ret = SNI_Callback(ssl)) != 0)
return ret;
@ -6026,6 +6021,15 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
}
#endif /* WOLFSSL_DTLS13 */
#ifdef WOLFSSL_DTLS_CID
/* do not modify CID state if we are sending an HRR */
if (ssl->options.useDtlsCID &&
ssl->options.serverState != SERVER_HELLO_RETRY_REQUEST_COMPLETE)
DtlsCIDOnExtensionsParsed(ssl);
#endif /* WOLFSSL_DTLS_CID */
exit_dch:
WOLFSSL_LEAVE("DoTls13ClientHello", ret);