From 5156641f2bb18ab8364733363e425f7361c0de28 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Tue, 20 Nov 2018 08:38:14 +1000 Subject: [PATCH] No Extended Master Secret in ServerHello if protocol TLSv1.3 --- src/tls.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/tls.c b/src/tls.c index f31dd0102..dae00e970 100644 --- a/src/tls.c +++ b/src/tls.c @@ -9607,8 +9607,10 @@ int TLSX_GetResponseSize(WOLFSSL* ssl, byte msgType, word16* pLength) #endif #ifdef HAVE_EXTENDED_MASTER - if (ssl->options.haveEMS && msgType == server_hello) + if (ssl->options.haveEMS && msgType == server_hello && + !IsAtLeastTLSv1_3(ssl->version)) { length += HELLO_EXT_SZ; + } #endif if (TLSX_SupportExtensions(ssl)) @@ -9724,7 +9726,8 @@ int TLSX_WriteResponse(WOLFSSL *ssl, byte* output, byte msgType, word16* pOffset #endif #ifdef HAVE_EXTENDED_MASTER - if (ssl->options.haveEMS && msgType == server_hello) { + if (ssl->options.haveEMS && msgType == server_hello && + !IsAtLeastTLSv1_3(ssl->version)) { c16toa(HELLO_EXT_EXTMS, output + offset); offset += HELLO_EXT_TYPE_SZ; c16toa(0, output + offset);