wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

If we receive an "update_requested" KeyUpdate then respond with a KeyUpdate

Browse source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2609)
This commit is contained in:
Matt Caswell 2017-02-09 16:00:12 +00:00
parent 8cdc8c5105
commit 5bf4793378
3 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ssl/statem/statem_clnt.c
View file

@ -439,6 +439,12 @@ static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s)
return WRITE_TRAN_CONTINUE; return WRITE_TRAN_CONTINUE;
case TLS_ST_CR_KEY_UPDATE: case TLS_ST_CR_KEY_UPDATE:
if (s->key_update != SSL_KEY_UPDATE_NONE) {
st->hand_state = TLS_ST_CW_KEY_UPDATE;
return WRITE_TRAN_CONTINUE;
}
/* Fall through */
case TLS_ST_CW_KEY_UPDATE: case TLS_ST_CW_KEY_UPDATE:
case TLS_ST_CR_SESSION_TICKET: case TLS_ST_CR_SESSION_TICKET:
case TLS_ST_CW_FINISHED: case TLS_ST_CW_FINISHED:

8
ssl/statem/statem_lib.c
View file

@ -525,6 +525,14 @@ MSG_PROCESS_RETURN tls_process_key_update(SSL *s, PACKET *pkt)
return MSG_PROCESS_ERROR; return MSG_PROCESS_ERROR;
} }
/*
* If we get a request for us to update our sending keys too then, we need
* to additionally send a KeyUpdate message. However that message should
* not also request an update (otherwise we get into an infinite loop).
*/
if (updatetype == SSL_KEY_UPDATE_REQUESTED)
s->key_update = SSL_KEY_UPDATE_NOT_REQUESTED;
return MSG_PROCESS_FINISHED_READING; return MSG_PROCESS_FINISHED_READING;
} }

6
ssl/statem/statem_srvr.c
View file

@ -470,6 +470,12 @@ static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s)
return WRITE_TRAN_CONTINUE; return WRITE_TRAN_CONTINUE;
case TLS_ST_SR_KEY_UPDATE: case TLS_ST_SR_KEY_UPDATE:
if (s->key_update != SSL_KEY_UPDATE_NONE) {
st->hand_state = TLS_ST_SW_KEY_UPDATE;
return WRITE_TRAN_CONTINUE;
}
/* Fall through */
case TLS_ST_SW_KEY_UPDATE: case TLS_ST_SW_KEY_UPDATE:
case TLS_ST_SW_SESSION_TICKET: case TLS_ST_SW_SESSION_TICKET:
st->hand_state = TLS_ST_OK; st->hand_state = TLS_ST_OK;