diff options
| author | Bodo Möller <bodo@openssl.org> | 2011-11-24 21:07:01 +0000 |
|---|---|---|
| committer | Bodo Möller <bodo@openssl.org> | 2011-11-24 21:07:01 +0000 |
| commit | 6f31dd72d28b5b2b75c50a54ed2666cab963922a (patch) | |
| tree | d4d9702dbed91f5bdc1194098097265e284d0b0c | |
| parent | 4521eda739b330c0de7a7822be5e08e100fcce62 (diff) | |
Fix NPN implementation for renegotiation.
(Problem pointed out by Ben Murphy.)
Submitted by: Adam Langley
| -rw-r--r-- | ssl/s3_clnt.c | 2 | ||||
| -rw-r--r-- | ssl/t1_lib.c | 11 |
2 files changed, 11 insertions, 2 deletions
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 5597e13bb0..a32978be30 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -465,7 +465,7 @@ int ssl3_connect(SSL *s) #if defined(OPENSSL_NO_TLSEXT) || defined(OPENSSL_NO_NEXTPROTONEG) s->state=SSL3_ST_CW_FINISHED_A; #else - if (s->next_proto_negotiated) + if (s->s3->next_proto_neg_seen) s->state=SSL3_ST_CW_NEXT_PROTO_A; else s->state=SSL3_ST_CW_FINISHED_A; diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 7b54dc9cd1..92eb35b61d 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -836,6 +836,9 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in s->servername_done = 0; s->tlsext_status_type = -1; +#ifndef OPENSSL_NO_NEXTPROTONEG + s->s3->next_proto_neg_seen = 0; +#endif if (data >= (d+n-2)) goto ri_check; @@ -1305,6 +1308,10 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in int tlsext_servername = 0; int renegotiate_seen = 0; +#ifndef OPENSSL_NO_NEXTPROTONEG + s->s3->next_proto_neg_seen = 0; +#endif + if (data >= (d+n-2)) goto ri_check; @@ -1431,7 +1438,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in s->tlsext_status_expected = 1; } #ifndef OPENSSL_NO_NEXTPROTONEG - else if (type == TLSEXT_TYPE_next_proto_neg) + else if (type == TLSEXT_TYPE_next_proto_neg && + s->s3->tmp.finish_md_len == 0) { unsigned char *selected; unsigned char selected_len; @@ -1461,6 +1469,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in } memcpy(s->next_proto_negotiated, selected, selected_len); s->next_proto_negotiated_len = selected_len; + s->s3->next_proto_neg_seen = 1; } #endif else if (type == TLSEXT_TYPE_renegotiate) |