From 87fa230da49456f81bbf5b5f65e35d79e48f9664 Mon Sep 17 00:00:00 2001 From: jsing <> Date: Tue, 28 Nov 2017 16:46:14 +0000 Subject: Correct TLS extensions handling when no extensions are present. If no TLS extensions are present in a client hello or server hello, omit the entire extensions block, rather than including it with a length of zero. ok beck@ inoguchi@ --- src/lib/libssl/ssl_tlsext.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c index 835c413478..d43ebc6775 100644 --- a/src/lib/libssl/ssl_tlsext.c +++ b/src/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.17 2017/09/25 18:02:27 jsing Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.18 2017/11/28 16:46:14 jsing Exp $ */ /* * Copyright (c) 2016, 2017 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -1296,6 +1296,7 @@ tlsext_clienthello_build(SSL *s, CBB *cbb) { CBB extensions, extension_data; struct tls_extension *tlsext; + int extensions_present = 0; size_t i; if (!CBB_add_u16_length_prefixed(cbb, &extensions)) @@ -1313,8 +1314,13 @@ tlsext_clienthello_build(SSL *s, CBB *cbb) return 0; if (!tls_extensions[i].clienthello_build(s, &extension_data)) return 0; + + extensions_present = 1; } + if (!extensions_present) + CBB_discard_child(cbb); + if (!CBB_flush(cbb)) return 0; @@ -1351,6 +1357,7 @@ tlsext_serverhello_build(SSL *s, CBB *cbb) { CBB extensions, extension_data; struct tls_extension *tlsext; + int extensions_present = 0; size_t i; if (!CBB_add_u16_length_prefixed(cbb, &extensions)) @@ -1368,8 +1375,13 @@ tlsext_serverhello_build(SSL *s, CBB *cbb) return 0; if (!tlsext->serverhello_build(s, &extension_data)) return 0; + + extensions_present = 1; } + if (!extensions_present) + CBB_discard_child(cbb); + if (!CBB_flush(cbb)) return 0; -- cgit v1.2.3-55-g6feb