From b087cd0400f51020d64ecc9afd0c0f8c8abdcf4f Mon Sep 17 00:00:00 2001 From: tb <> Date: Thu, 23 Oct 2025 15:27:27 +0000 Subject: Ensure that we specify the correct group when creating a HelloRetryRequest. When processing the client supported groups and key shares extensions, the group selection is currently based on client preference. However, when building a HRR the preferred group is identified by calling tls1_get_supported_group(). If SSL_OP_CIPHER_SERVER_PREFERENCE is enabled, group selection will be based on server instead of client preference. This in turn can result in the server sending a HRR for a group that the client has already provided a key share for, violating the RFC. Avoid this issue by storing the client preferred group when processing the key share extension, then using this group when creating the HRR. Thanks to dzwdz for identifying and reporting the issue. ok beck@ tb@ from jsing@ This is errata/7.7/013_libssl.patch.sig --- src/lib/libssl/tls13_server.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'src/lib/libssl/tls13_server.c') diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c index 63b7d92093..ca4ea7ba0d 100644 --- a/src/lib/libssl/tls13_server.c +++ b/src/lib/libssl/tls13_server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_server.c,v 1.109 2024/07/22 14:47:15 jsing Exp $ */ +/* $OpenBSD: tls13_server.c,v 1.109.6.1 2025/10/23 15:27:27 tb Exp $ */ /* * Copyright (c) 2019, 2020 Joel Sing * Copyright (c) 2020 Bob Beck @@ -437,8 +437,6 @@ tls13_server_engage_record_protection(struct tls13_ctx *ctx) int tls13_server_hello_retry_request_send(struct tls13_ctx *ctx, CBB *cbb) { - int nid; - ctx->hs->tls13.hrr = 1; if (!tls13_synthetic_handshake_message(ctx)) @@ -446,9 +444,7 @@ tls13_server_hello_retry_request_send(struct tls13_ctx *ctx, CBB *cbb) if (ctx->hs->key_share != NULL) return 0; - if (!tls1_get_supported_group(ctx->ssl, &nid)) - return 0; - if (!tls1_ec_nid2group_id(nid, &ctx->hs->tls13.server_group)) + if (ctx->hs->tls13.server_group == 0) return 0; if (!tls13_server_hello_build(ctx, cbb, 1)) @@ -511,8 +507,6 @@ tls13_server_hello_send(struct tls13_ctx *ctx, CBB *cbb) if (!tls13_servername_process(ctx)) return 0; - ctx->hs->tls13.server_group = 0; - if (!tls13_server_hello_build(ctx, cbb, 0)) return 0; -- cgit v1.2.3-55-g6feb