wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Actually make TLS 1.3 alerts encrypted when possible

Browse Source 
Pervious fix didn't work.
This time, if TLS 1.3 and encryption is on then it will encrypt the
alert.
This commit is contained in:
Sean Parkinson
2020-05-21 08:38:42 +10:00
parent a6f5bc84e6
commit 3fec01c0aa
1 changed files with 5 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/internal.c
View File

@ -212,14 +212,7 @@ static WC_INLINE int IsEncryptionOn(WOLFSSL* ssl, int isSend)
return 0;
#endif /* WOLFSSL_DTLS */
#ifdef WOLFSSL_TLS13
if (isSend)
return ssl->encrypt.setup;
else
return ssl->decrypt.setup;
#else
return ssl->keys.encryptionOn;
#endif
}
@ -17519,10 +17512,11 @@ int SendAlert(WOLFSSL* ssl, int severity, int type)
ssl->options.isClosed = 1; /* Don't send close_notify */
}
/* only send encrypted alert if handshake actually complete, otherwise
other side may not be able to handle it */
if (IsEncryptionOn(ssl, 1) && (IsAtLeastTLSv1_3(ssl->version) ||
ssl->encrypt.setup)) {
/* send encrypted alert if encryption is on - can be a rehandshake over
* an existing encrypted channel.
* TLS 1.3 encrypts handshake packets after the ServerHello
*/
if (IsEncryptionOn(ssl, 1)) {
sendSz = BuildMessage(ssl, output, outputSz, input, ALERT_SIZE, alert,
0, 0, 0);
}