diff options
| author | Matt Caswell <matt@openssl.org> | 2018-03-02 15:02:11 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-03-05 11:55:07 +0000 |
| commit | 5de683d2c6ae2f8c30b97326e72ff19f41228b74 (patch) | |
| tree | 195406b55b9ed7d77f746f018de4a9bf3bb53e51 /ssl/statem/extensions.c | |
| parent | c04c60217ab748effc5a07bf098abda2045c927b (diff) | |
Fix status_request and SCT extensions
They are valid for use in a CertificateRequest message, but we did not
allow it. If a server sent such a message using either of those two
extensions then the handshake would abort.
This corrects that error, but does not add support for actually processing
the extensions. They are simply ignored, and a TODO is inserted to add
support at a later time.
This was found during interoperability testing with btls:
https://gitlab.com/ilari_l/btls
Prompted by these errors I reviewed the complete list of extensions and
compared them with the latest table in draft-24 to confirm there were no
other errors of a similar type. I did not find any.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/5490)
Diffstat (limited to 'ssl/statem/extensions.c')
| -rw-r--r-- | ssl/statem/extensions.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c index 722943fa69..6e3f8d1672 100644 --- a/ssl/statem/extensions.c +++ b/ssl/statem/extensions.c @@ -211,7 +211,7 @@ static const EXTENSION_DEFINITION ext_defs[] = { { TLSEXT_TYPE_status_request, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO - | SSL_EXT_TLS1_3_CERTIFICATE, + | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, init_status_request, tls_parse_ctos_status_request, tls_parse_stoc_status_request, tls_construct_stoc_status_request, tls_construct_ctos_status_request, NULL @@ -263,7 +263,7 @@ static const EXTENSION_DEFINITION ext_defs[] = { { TLSEXT_TYPE_signed_certificate_timestamp, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO - | SSL_EXT_TLS1_3_CERTIFICATE, + | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, NULL, /* * No server side support for this, but can be provided by a custom |