diff options
| author | Matt Caswell <matt@openssl.org> | 2018-08-07 10:25:54 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-08-08 10:16:58 +0100 |
| commit | 7426cd343d99d3d82e3fb06c8df18e5cc6bcec75 (patch) | |
| tree | a0dac1b700927151c1a81d04d1f8cb037fd8be10 /ssl/s3_enc.c | |
| parent | b4f001eb1a9e0bd0fda8f3c7dfbccb6422ad8c47 (diff) | |
Ensure that we write out alerts correctly after early_data
If we sent early_data and then received back an HRR, the enc_write_ctx
was stale resulting in errors if an alert needed to be sent.
Thanks to Quarkslab for reporting this.
In any case it makes little sense to encrypt alerts using the
client_early_traffic_secret, so we add special handling for alerts sent
after early_data. All such alerts are sent in plaintext.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6887)
Diffstat (limited to 'ssl/s3_enc.c')
| -rw-r--r-- | ssl/s3_enc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 6d78aa1a2e..5f403817b4 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -155,7 +155,7 @@ int ssl3_change_cipher_state(SSL *s, int which) RECORD_LAYER_reset_read_sequence(&s->rlayer); mac_secret = &(s->s3->read_mac_secret[0]); } else { - s->statem.invalid_enc_write_ctx = 1; + s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; if (s->enc_write_ctx != NULL) { reuse_dd = 1; } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { @@ -238,7 +238,7 @@ int ssl3_change_cipher_state(SSL *s, int which) goto err; } - s->statem.invalid_enc_write_ctx = 0; + s->statem.enc_write_state = ENC_WRITE_STATE_VALID; OPENSSL_cleanse(exp_key, sizeof(exp_key)); OPENSSL_cleanse(exp_iv, sizeof(exp_iv)); return 1; |