2 files changed, 16 insertions, 5 deletions

diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
index 7232b6dea0..174da2f9c3 100644
--- a/src/lib/libssl/tls13_lib.c
+++ b/src/lib/libssl/tls13_lib.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_lib.c,v 1.49 2020/05/21 19:43:40 tb Exp $ */
+/*      $OpenBSD: tls13_lib.c,v 1.50 2020/05/22 02:37:27 beck Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
@@ -430,8 +430,14 @@ tls13_cert_add(struct tls13_ctx *ctx, CBB *cbb, X509 *cert,
                 return 0;
         if (i2d_X509(cert, &data) != cert_len)
                 return 0;
-        if (!build_extensions(ctx->ssl, cbb, SSL_TLSEXT_MSG_CT))
-                return 0;
+        if (build_extensions != NULL) {
+                if (!build_extensions(ctx->ssl, cbb, SSL_TLSEXT_MSG_CT))
+                        return 0;
+        } else {
+                CBB cert_exts;
+                if (!CBB_add_u16_length_prefixed(cbb, &cert_exts))
+                        return 0;
+        }
         if (!CBB_flush(cbb))
                 return 0;
 
diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c
index 42409edbf7..e0ea6b564d 100644
--- a/src/lib/libssl/tls13_server.c
+++ b/src/lib/libssl/tls13_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_server.c,v 1.50 2020/05/21 18:34:34 jsing Exp $ */
+/* $OpenBSD: tls13_server.c,v 1.51 2020/05/22 02:37:27 beck Exp $ */
 /*
  * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -461,7 +461,12 @@ tls13_server_certificate_send(struct tls13_ctx *ctx, CBB *cbb)
 
         for (i = 0; i < sk_X509_num(chain); i++) {
                 cert = sk_X509_value(chain, i);
-                if (!tls13_cert_add(ctx, &cert_list, cert, tlsext_server_build))
+                /*
+                 * XXX we don't send extensions with chain certs to avoid sending
+                 * a leaf ocsp stape with the chain certs.  This needs to get
+                 * fixed
+                 */
+                if (!tls13_cert_add(ctx, &cert_list, cert, NULL))
                         goto err;
         }