diff options
| author | Matt Caswell <matt@openssl.org> | 2020-11-03 14:01:46 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2020-12-09 14:46:16 +0000 |
| commit | ebda646db6dcc4c3813ffa06d9c548bdf9b9a717 (patch) | |
| tree | 691f98cc7eab94ad0d63b08798280f3901a3e037 /ssl | |
| parent | 7eea331eabe8b0a7ce03c9602a2bc72e9ddfe676 (diff) | |
Modify is_tls13_capable() to take account of the servername cb
A servername cb may change the available certificates, so if we have one
set then we cannot rely on the configured certificates to determine if we
are capable of negotiating TLSv1.3 or not.
Fixes #13291
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13304)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/statem/statem_lib.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index 44cf5a6ce0..d5def193a0 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -1515,8 +1515,8 @@ static int ssl_method_error(const SSL *s, const SSL_METHOD *method) /* * Only called by servers. Returns 1 if the server has a TLSv1.3 capable - * certificate type, or has PSK or a certificate callback configured. Otherwise - * returns 0. + * certificate type, or has PSK or a certificate callback configured, or has + * a servername callback configure. Otherwise returns 0. */ static int is_tls13_capable(const SSL *s) { @@ -1525,6 +1525,17 @@ static int is_tls13_capable(const SSL *s) int curve; #endif + if (!ossl_assert(s->ctx != NULL) || !ossl_assert(s->session_ctx != NULL)) + return 0; + + /* + * A servername callback can change the available certs, so if a servername + * cb is set then we just assume TLSv1.3 will be ok + */ + if (s->ctx->ext.servername_cb != NULL + || s->session_ctx->ext.servername_cb != NULL) + return 1; + #ifndef OPENSSL_NO_PSK if (s->psk_server_callback != NULL) return 1; |