diff options
| author | Matt Caswell <matt@openssl.org> | 2018-07-30 09:13:14 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-07-31 09:31:50 +0100 |
| commit | 43a0f2733a943799060ea275516fcce00d89eb38 (patch) | |
| tree | f306c49491086a35ac38767945b1a026006191ce /ssl | |
| parent | 50db81633ece00593b245afed0ed9480d7ffb334 (diff) | |
| download | openssl-43a0f2733a943799060ea275516fcce00d89eb38.tar.gz | |
Fix some TLSv1.3 alert issues
Ensure that the certificate required alert actually gets sent (and doesn't
get translated into handshake failure in TLSv1.3).
Ensure that proper reason codes are given for the new TLSv1.3 alerts.
Remove an out of date macro for TLS13_AD_END_OF_EARLY_DATA. This is a left
over from an earlier TLSv1.3 draft that is no longer used.
Fixes #6804
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6809)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/ssl_err.c | 4 | ||||
| -rw-r--r-- | ssl/tls13_enc.c | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c index d3e805636f..11331ce41f 100644 --- a/ssl/ssl_err.c +++ b/ssl/ssl_err.c @@ -1137,6 +1137,10 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_SESSION_VERSION_MISMATCH), "ssl session version mismatch"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_STILL_IN_INIT), "still in init"}, + {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED), + "tlsv13 alert certificate required"}, + {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV13_ALERT_MISSING_EXTENSION), + "tlsv13 alert missing extension"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_ALERT_ACCESS_DENIED), "tlsv1 alert access denied"}, {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_ALERT_DECODE_ERROR), diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c index 264381bd00..48990fd65c 100644 --- a/ssl/tls13_enc.c +++ b/ssl/tls13_enc.c @@ -701,7 +701,8 @@ int tls13_update_key(SSL *s, int sending) int tls13_alert_code(int code) { - if (code == SSL_AD_MISSING_EXTENSION) + /* There are 2 additional alerts in TLSv1.3 compared to TLSv1.2 */ + if (code == SSL_AD_MISSING_EXTENSION || code == SSL_AD_CERTIFICATE_REQUIRED) return code; return tls1_alert_code(code); |