From 1b76c31b9c1e2634f8da466b12e601bf1776c25a Mon Sep 17 00:00:00 2001 From: tb <> Date: Wed, 8 May 2019 23:49:45 +0000 Subject: In DTLS, use_srtp is part of the extended server hello while in TLSv1.3, it is an encrypted extension. Include it in the server hello for now. This will have to be revisited once TLSv1.3 gets there. Fixes SRTP negotiation. Problem found by two rust-openssl regress failures reported by mikeb. with & ok beck --- src/lib/libssl/ssl_tlsext.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c index 0e37cc3cc0..62b8251ec4 100644 --- a/src/lib/libssl/ssl_tlsext.c +++ b/src/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.44 2019/03/25 17:21:18 jsing Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.45 2019/05/08 23:49:45 tb Exp $ */ /* * Copyright (c) 2016, 2017, 2019 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -1822,7 +1822,8 @@ static struct tls_extension tls_extensions[] = { #ifndef OPENSSL_NO_SRTP { .type = TLSEXT_TYPE_use_srtp, - .messages = SSL_TLSEXT_MSG_CH | SSL_TLSEXT_MSG_EE, + .messages = SSL_TLSEXT_MSG_CH | SSL_TLSEXT_MSG_SH /* XXX */ | + SSL_TLSEXT_MSG_EE, .client = { .needs = tlsext_srtp_client_needs, .build = tlsext_srtp_client_build, -- cgit v1.2.3-55-g6feb