diff options
| author | Joel Sing <jsing@cvs.openbsd.org> | 2018-11-21 15:13:30 +0000 |
|---|---|---|
| committer | Joel Sing <jsing@cvs.openbsd.org> | 2018-11-21 15:13:30 +0000 |
| commit | 9677227ebd472807977e275461fba6c5c4b4e2a9 (patch) | |
| tree | f02e4aba2d7be973a12b9098fdf63f4a06750e25 /lib/libssl/ssl_locl.h | |
| parent | 69efb88b530b1da4538d57212464650f67cea230 (diff) | |
Fix DTLS transcript handling for HelloVerifyRequest.
If DTLS sees a HelloVerifyRequest the transcript is reset - the previous
tls1_init_finished_mac() function could be called multiple times and would
discard any existing state. The replacement tls1_transcript_init() is more
strict and fails if a transcript already exists.
Provide an explicit tls1_transcript_reset() function and call it from the
appropriate places. This also lets us make DTLS less of a special snowflake
and call tls1_transcript_init() in the same place as used for TLS.
ok beck@ tb@
Diffstat (limited to 'lib/libssl/ssl_locl.h')
| -rw-r--r-- | lib/libssl/ssl_locl.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/libssl/ssl_locl.h b/lib/libssl/ssl_locl.h index 50806d1b187..94bb76eca32 100644 --- a/lib/libssl/ssl_locl.h +++ b/lib/libssl/ssl_locl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_locl.h,v 1.224 2018/11/10 01:19:09 beck Exp $ */ +/* $OpenBSD: ssl_locl.h,v 1.225 2018/11/21 15:13:29 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1242,6 +1242,7 @@ void tls1_handshake_hash_free(SSL *s); int tls1_transcript_init(SSL *s); void tls1_transcript_free(SSL *s); +void tls1_transcript_reset(SSL *s); int tls1_transcript_append(SSL *s, const unsigned char *buf, size_t len); int tls1_transcript_data(SSL *s, const unsigned char **data, size_t *len); void tls1_transcript_freeze(SSL *s); |