From fcc903ee8faa79f7dedb22f05008724ea327bdba Mon Sep 17 00:00:00 2001 From: tb <> Date: Fri, 21 Aug 2026 17:15:22 +0000 Subject: Change RFC references from 8446 to 9846 and adjust section numbers with/ok kenjiro --- src/lib/libssl/tls13_server.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'src/lib/libssl/tls13_server.c') diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c index 8ad11c6428..8b0dc8a26b 100644 --- a/src/lib/libssl/tls13_server.c +++ b/src/lib/libssl/tls13_server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_server.c,v 1.113 2026/07/31 03:59:50 kenjiro Exp $ */ +/* $OpenBSD: tls13_server.c,v 1.114 2026/08/21 17:15:22 tb Exp $ */ /* * Copyright (c) 2019, 2020 Joel Sing * Copyright (c) 2020 Bob Beck @@ -102,13 +102,13 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx) SSL *s = ctx->ssl; /* - * RFC 8446, section 9.2. If the ClientHello has supported_versions + * RFC 9846 section 9.2. If the ClientHello has supported_versions * containing TLSv1.3, presence or absence of some extensions requires * presence or absence of others. */ /* - * RFC 8446 section 4.2.9 - if we received a pre_shared_key, then we + * RFC 9846 section 4.3.9 - if we received a pre_shared_key, then we * also need psk_key_exchange_modes. Otherwise, section 9.2 specifies * that we need both signature_algorithms and supported_groups. */ @@ -133,7 +133,7 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx) /* * XXX - Require server_name from client? If so, we SHOULD enforce - * this here - RFC 8446, 9.2. + * this here - RFC 9846, 9.2. */ return 1; @@ -246,7 +246,7 @@ tls13_client_hello_process(struct tls13_ctx *ctx, CBS *cbs) /* * The legacy session identifier must either be zero length or a 32 byte * value (in which case the client is requesting middlebox compatibility - * mode), as per RFC 8446 section 4.1.2. If it is valid, store the value + * mode), as per RFC 9846 section 4.2.2. If it is valid, store the value * so that we can echo it back to the client. */ if (CBS_len(&session_id) != 0 && @@ -459,7 +459,7 @@ tls13_server_hello_retry_request_sent(struct tls13_ctx *ctx) /* * If the client has requested middlebox compatibility mode, * we MUST send a dummy CCS following our first handshake message. - * See RFC 8446 Appendix D.4. + * See RFC 9846 Appendix E.4. */ if (ctx->hs->tls13.legacy_session_id_len > 0) ctx->send_dummy_ccs_after = 1; @@ -519,7 +519,7 @@ tls13_server_hello_sent(struct tls13_ctx *ctx) /* * If the client has requested middlebox compatibility mode, * we MUST send a dummy CCS following our first handshake message. - * See RFC 8446 Appendix D.4. + * See RFC 9846 Appendix E.4. */ if ((ctx->handshake_stage.hs_type & WITHOUT_HRR) && ctx->hs->tls13.legacy_session_id_len > 0) @@ -572,7 +572,7 @@ tls13_server_check_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY *cpk, /* * The digitalSignature bit MUST be set if the Key Usage extension is - * present as per RFC 8446 section 4.4.2.2. + * present as per RFC 9846 section 4.5.1.2. */ if (!(X509_get_key_usage(cpk->x509) & X509v3_KU_DIGITAL_SIGNATURE)) goto done; -- cgit v1.2.3-55-g6feb