From 1255f4593d55f6c28cc5a865759d9a6fc96e238f Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Sat, 9 May 2020 15:47:12 +0000 Subject: Send dummy ChangeCipherSpec messages from the TLSv1.3 client. When operating in middlebox compatibility mode, the TLSv1.3 client needs to send a dummy ChangeCipherSpec message immediately before its second flight of handshake messages (when early data is not offered). ok tb@ --- lib/libssl/tls13_client.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'lib/libssl/tls13_client.c') diff --git a/lib/libssl/tls13_client.c b/lib/libssl/tls13_client.c index d5ac6ba5e07..27b2d712ae9 100644 --- a/lib/libssl/tls13_client.c +++ b/lib/libssl/tls13_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_client.c,v 1.56 2020/05/09 15:30:21 jsing Exp $ */ +/* $OpenBSD: tls13_client.c,v 1.57 2020/05/09 15:47:11 jsing Exp $ */ /* * Copyright (c) 2018, 2019 Joel Sing * @@ -150,6 +150,9 @@ tls13_client_hello_sent(struct tls13_ctx *ctx) tls1_transcript_freeze(ctx->ssl); + if (ctx->middlebox_compat) + ctx->send_dummy_ccs = 1; + return 1; } @@ -544,6 +547,7 @@ tls13_server_certificate_request_recv(struct tls13_ctx *ctx, CBS *cbs) err: if (ctx->alert == 0) ctx->alert = TLS1_AD_DECODE_ERROR; + return 0; } -- cgit v1.2.3