generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Digest cached records if not sending a certificate.

Browse Source 
If server requests a certificate, but the client doesn't send one, cache
digested records. This is an optimisation and ensures the correct finished
mac is used when extended master secret is used with client authentication.

Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2015-05-07 00:04:48 +01:00
parent 45ebd73128
commit dab18ab596
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ssl/s3_clnt.c
View File

@ -3348,6 +3348,11 @@ int ssl3_send_client_certificate(SSL *s)
return (1);
} else {
s->s3->tmp.cert_req = 2;
if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s)) {
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
s->state = SSL_ST_ERR;
return 0;
}
}
}