2 files changed, 16 insertions, 2 deletions

diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index a26b91976e..65429a3925 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.234 2019/02/09 15:26:15 jsing Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.235 2019/02/10 13:04:29 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -451,6 +451,10 @@ typedef struct ssl_handshake_tls13_st {
 
         uint8_t *cookie;
         size_t cookie_len;
+
+        /* Preserved transcript hash. */
+        uint8_t transcript_hash[EVP_MAX_MD_SIZE];
+        size_t transcript_hash_len;
 } SSL_HANDSHAKE_TLS13;
 
 typedef struct ssl_ctx_internal_st {
diff --git a/src/lib/libssl/tls13_handshake.c b/src/lib/libssl/tls13_handshake.c
index 68d6a9d444..8d5b0e3516 100644
--- a/src/lib/libssl/tls13_handshake.c
+++ b/src/lib/libssl/tls13_handshake.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_handshake.c,v 1.24 2019/02/07 15:54:18 jsing Exp $      */
+/*      $OpenBSD: tls13_handshake.c,v 1.25 2019/02/10 13:04:29 jsing Exp $      */
 /*
  * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
@@ -33,6 +33,7 @@ struct tls13_handshake_action {
         uint8_t                 handshake_type;
         uint8_t                 sender;
         uint8_t                 handshake_complete;
+        uint8_t                 preserve_transcript_hash;
 
         int (*send)(struct tls13_ctx *ctx);
         int (*recv)(struct tls13_ctx *ctx);
@@ -133,6 +134,7 @@ struct tls13_handshake_action state_machine[] = {
                 .record_type = TLS13_HANDSHAKE,
                 .handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
                 .sender = TLS13_HS_SERVER,
+                .preserve_transcript_hash = 1,
                 .send = tls13_server_certificate_verify_send,
                 .recv = tls13_server_certificate_verify_recv,
         },
@@ -140,6 +142,7 @@ struct tls13_handshake_action state_machine[] = {
                 .record_type = TLS13_HANDSHAKE,
                 .handshake_type = TLS13_MT_FINISHED,
                 .sender = TLS13_HS_SERVER,
+                .preserve_transcript_hash = 1,
                 .send = tls13_server_finished_send,
                 .recv = tls13_server_finished_recv,
         },
@@ -361,6 +364,13 @@ tls13_handshake_recv_action(struct tls13_ctx *ctx,
         if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) <= 0)
                 return ret;
 
+        if (action->preserve_transcript_hash) {
+                if (!tls1_transcript_hash_value(ctx->ssl,
+                    ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash),
+                    &ctx->hs->transcript_hash_len))
+                        return TLS13_IO_FAILURE;
+        }
+
         tls13_handshake_msg_data(ctx->hs_msg, &cbs);
         if (!tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs)))
                 return TLS13_IO_FAILURE;