Only discard the extension block for client hello and server hello

messages.

TLSv1.3 messages that include extensions need a length prefixed field with
zero bytes, rather than no data at all.

ok beck@ tb@

1 files changed, 3 insertions, 2 deletions

diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index b76a48b99a..24f2bd5022 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.55 2020/01/25 12:31:42 jsing Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.56 2020/01/25 12:37:06 jsing Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -1918,7 +1918,8 @@ tlsext_build(SSL *s, CBB *cbb, int is_server, uint16_t msg_type)
                 extensions_present = 1;
         }
 
-        if (!extensions_present)
+        if (!extensions_present &&
+            (msg_type & (SSL_TLSEXT_MSG_CH | SSL_TLSEXT_MSG_SH)) != 0)
                 CBB_discard_child(cbb);
 
         if (!CBB_flush(cbb))