diff options
| author | Matt Caswell <matt@openssl.org> | 2018-01-30 15:41:56 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-02-14 15:42:36 +0000 |
| commit | 6e99ae58c8e1b4a41ae376f91affc7992b0738f7 (patch) | |
| tree | e64e0773a1fd863e04fc75558c0a1d8da4c346fd /ssl | |
| parent | cb1c3d1a2714eb69012b079053f7fbcca1acc544 (diff) | |
Ignore an s_client psk in TLSv1.3 if not TLSv1.3 suitable
The s_client psk_use_session_cb callback has a comment stating that we
should ignore a key that isn't suitable for TLSv1.3. However we were
actually causing the connection to fail. Changing the return value fixes
the issue.
Also related to this is that the early_data extension was not marked as
TLSv1.3 only which it should be.
Fixes #5202
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/5205)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/statem/extensions.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c index daf43c6276..7d456f353a 100644 --- a/ssl/statem/extensions.c +++ b/ssl/statem/extensions.c @@ -358,7 +358,7 @@ static const EXTENSION_DEFINITION ext_defs[] = { { TLSEXT_TYPE_early_data, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS - | SSL_EXT_TLS1_3_NEW_SESSION_TICKET, + | SSL_EXT_TLS1_3_NEW_SESSION_TICKET | SSL_EXT_TLS1_3_ONLY, NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data, tls_construct_stoc_early_data, tls_construct_ctos_early_data, final_early_data |