|
 |
45ebb7f |
From 93e26cedac20844733d59f33e313880da17fa23a Mon Sep 17 00:00:00 2001
|
|
|
45ebb7f |
From: Matt Caswell <matt@openssl.org>
|
|
|
45ebb7f |
Date: Thu, 5 Sep 2019 16:43:57 +0100
|
|
|
45ebb7f |
Subject: [PATCH 1/2] Don't send a status_request extension in a
|
|
|
45ebb7f |
CertificateRequest message
|
|
|
45ebb7f |
|
|
|
45ebb7f |
If a TLSv1.3 server configured to respond to the status_request extension
|
|
|
45ebb7f |
also attempted to send a CertificateRequest then it was incorrectly
|
|
|
45ebb7f |
inserting a non zero length status_request extension into that message.
|
|
|
45ebb7f |
|
|
|
45ebb7f |
The TLSv1.3 RFC does allow that extension in that message but it must
|
|
|
45ebb7f |
always be zero length.
|
|
|
45ebb7f |
|
|
|
45ebb7f |
In fact we should not be sending the extension at all in that message
|
|
|
45ebb7f |
because we don't support it.
|
|
|
45ebb7f |
|
|
|
45ebb7f |
Fixes #9767
|
|
|
45ebb7f |
---
|
|
|
45ebb7f |
ssl/statem/extensions_srvr.c | 4 ++++
|
|
|
45ebb7f |
1 file changed, 4 insertions(+)
|
|
|
45ebb7f |
|
|
|
45ebb7f |
diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
|
|
|
45ebb7f |
index e16722cbeb8..1c023fc6c40 100644
|
|
|
45ebb7f |
--- a/ssl/statem/extensions_srvr.c
|
|
|
45ebb7f |
+++ b/ssl/statem/extensions_srvr.c
|
|
|
45ebb7f |
@@ -1491,6 +1491,10 @@ EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
|
|
|
45ebb7f |
unsigned int context, X509 *x,
|
|
|
45ebb7f |
size_t chainidx)
|
|
|
45ebb7f |
{
|
|
|
45ebb7f |
+ /* We don't currently support this extension inside a CertificateRequest */
|
|
|
45ebb7f |
+ if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
|
|
|
45ebb7f |
+ return EXT_RETURN_NOT_SENT;
|
|
|
45ebb7f |
+
|
|
|
45ebb7f |
if (!s->ext.status_expected)
|
|
|
45ebb7f |
return EXT_RETURN_NOT_SENT;
|
|
|
45ebb7f |
|