diff options
author | Matt Caswell <matt@openssl.org> | 2017-05-10 11:28:53 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2017-05-10 16:49:00 +0100 |
commit | 21181889d78f95f10738813285f681acd3b32c6c (patch) | |
tree | c5ff13183d4986cba98218d581eafcdeeb0163da /ssl/ssl_lib.c | |
parent | cf53cbea5bbf9c3a1998e2ddd0173881a5a97475 (diff) |
Copy custom extension flags in a call to SSL_set_SSL_CTX()
The function SSL_set_SSL_CTX() can be used to swap the SSL_CTX used for
a connection as part of an SNI callback. One result of this is that the
s->cert structure is replaced. However this structure contains information
about any custom extensions that have been loaded. In particular flags are
set indicating whether a particular extension has been received in the
ClientHello. By replacing the s->cert structure we lose the custom
extension flag values, and it appears as if a client has not sent those
extensions.
SSL_set_SSL_CTX() should copy any flags for custom extensions that appear
in both the old and the new cert structure.
Fixes #2180
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3425)
Diffstat (limited to 'ssl/ssl_lib.c')
-rw-r--r-- | ssl/ssl_lib.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index d1a1f027d9..a12800d6d3 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -3596,6 +3596,12 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) if (new_cert == NULL) { return NULL; } + + if (!custom_exts_copy_flags(&new_cert->custext, &ssl->cert->custext)) { + ssl_cert_free(new_cert); + return NULL; + } + ssl_cert_free(ssl->cert); ssl->cert = new_cert; |