From 52999e1f7e30b54f4a2484ac63d95db925c9b889 Mon Sep 17 00:00:00 2001 From: jsing Date: Sun, 11 Sep 2022 14:33:07 +0000 Subject: [PATCH] Only permit CCS messages if requesting middlebox compatibility mode. Currently the TLSv1.3 client always permits the server to send CCS messages. Be more strict and only permit this if the client is actually requesitng middlebox compatibility mode. ok tb@ --- lib/libssl/tls13_client.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/libssl/tls13_client.c b/lib/libssl/tls13_client.c index 87759632f9b..33ef55d2ec0 100644 --- a/lib/libssl/tls13_client.c +++ b/lib/libssl/tls13_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_client.c,v 1.98 2022/08/17 07:39:19 jsing Exp $ */ +/* $OpenBSD: tls13_client.c,v 1.99 2022/09/11 14:33:07 jsing Exp $ */ /* * Copyright (c) 2018, 2019 Joel Sing * @@ -148,12 +148,12 @@ tls13_client_hello_send(struct tls13_ctx *ctx, CBB *cbb) int tls13_client_hello_sent(struct tls13_ctx *ctx) { - tls13_record_layer_allow_ccs(ctx->rl, 1); - tls1_transcript_freeze(ctx->ssl); - if (ctx->middlebox_compat) + if (ctx->middlebox_compat) { + tls13_record_layer_allow_ccs(ctx->rl, 1); ctx->send_dummy_ccs = 1; + } return 1; } -- 2.20.1