diff options
| author | Matt Caswell <matt@openssl.org> | 2018-08-07 10:25:54 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-08-08 10:16:58 +0100 |
| commit | 7426cd343d99d3d82e3fb06c8df18e5cc6bcec75 (patch) | |
| tree | a0dac1b700927151c1a81d04d1f8cb037fd8be10 /ssl/t1_enc.c | |
| parent | b4f001eb1a9e0bd0fda8f3c7dfbccb6422ad8c47 (diff) | |
Ensure that we write out alerts correctly after early_data
If we sent early_data and then received back an HRR, the enc_write_ctx
was stale resulting in errors if an alert needed to be sent.
Thanks to Quarkslab for reporting this.
In any case it makes little sense to encrypt alerts using the
client_early_traffic_secret, so we add special handling for alerts sent
after early_data. All such alerts are sent in plaintext.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6887)
Diffstat (limited to 'ssl/t1_enc.c')
| -rw-r--r-- | ssl/t1_enc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 23d3efb024..2db913fb06 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -154,7 +154,7 @@ int tls1_change_cipher_state(SSL *s, int which) mac_secret = &(s->s3->read_mac_secret[0]); mac_secret_size = &(s->s3->read_mac_secret_size); } else { - s->statem.invalid_enc_write_ctx = 1; + s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; if (s->ext.use_etm) s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; else @@ -316,7 +316,7 @@ int tls1_change_cipher_state(SSL *s, int which) ERR_R_INTERNAL_ERROR); goto err; } - s->statem.invalid_enc_write_ctx = 0; + s->statem.enc_write_state = ENC_WRITE_STATE_VALID; #ifdef SSL_DEBUG printf("which = %04X\nkey=", which); |