From c628562ee71eb28f2bd233b0d4e2cd329250c5aa Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Tue, 11 Dec 2018 10:42:09 +1000 Subject: [PATCH] Fix the Old ClientHello detection with TLS 1.3 with new state Put the clientState into CLIENT_HELLO_RETRY (new state) when waiting for second ClientHello. Chrome sends change_cipher_spec message, for reasons of compatability, which meets the requirements of the Old ClientHello detection when state of client is NULL. --- src/tls13.c | 2 +- wolfssl/internal.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/tls13.c b/src/tls13.c index b2229c2f1..64e1cb769 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -8194,7 +8194,7 @@ int wolfSSL_accept_TLSv13(WOLFSSL* ssl) case TLS13_ACCEPT_FIRST_REPLY_DONE : if (ssl->options.serverState == SERVER_HELLO_RETRY_REQUEST_COMPLETE) { - ssl->options.clientState = NULL_STATE; + ssl->options.clientState = CLIENT_HELLO_RETRY; while (ssl->options.clientState < CLIENT_HELLO_COMPLETE) { if ((ssl->error = ProcessReply(ssl)) < 0) { WOLFSSL_ERROR(ssl->error); diff --git a/wolfssl/internal.h b/wolfssl/internal.h index a2ab1c224..2564c594a 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -1508,6 +1508,7 @@ enum states { SERVER_CHANGECIPHERSPEC_COMPLETE, SERVER_FINISHED_COMPLETE, + CLIENT_HELLO_RETRY, CLIENT_HELLO_COMPLETE, CLIENT_KEYEXCHANGE_COMPLETE, CLIENT_CHANGECIPHERSPEC_COMPLETE,