mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #5900 from icing/tls12-no-tickets

Browse Source 
WOLFSSL_OP_NO_TICKET fix for TLSv1.2
This commit is contained in:
JacobBarthelmeh 2022-12-16 14:42:50 -07:00 committed by GitHub
commit 3d1775320b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/internal.c
View File

@ -34194,7 +34194,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
if (ssl->ctx->ticketEncCb == NULL
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL)
||
/* SSL_OP_NO_TICKET turns off tickets in < 1.2. Forces
/* SSL_OP_NO_TICKET turns off tickets in <= 1.2. Forces
* "stateful" tickets for 1.3 so just use the regular
* stateless ones. */
(!IsAtLeastTLSv1_3(ssl->version) &&

15
src/ssl.c
View File

@ -13358,6 +13358,7 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
#ifdef HAVE_SESSION_TICKET
if (ssl->options.createTicket && !ssl->options.noTicketTls12) {
if ( (ssl->error = SendTicket(ssl)) != 0) {
WOLFSSL_MSG("Thought we need ticket but failed");
WOLFSSL_ERROR(ssl->error);
return WOLFSSL_FATAL_ERROR;
}
@ -16774,6 +16775,12 @@ cleanup:
return BAD_FUNC_ARG;
ctx->mask = wolf_set_options(ctx->mask, opt);
#if defined(HAVE_SESSION_TICKET) && (defined(OPENSSL_EXTRA) \
|| defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL))
if ((ctx->mask & WOLFSSL_OP_NO_TICKET) == WOLFSSL_OP_NO_TICKET) {
ctx->noTicketTls12 = 1;
}
#endif
return ctx->mask;
}
@ -23556,6 +23563,14 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
#endif
}
#if defined(HAVE_SESSION_TICKET) && (defined(OPENSSL_EXTRA) \
|| defined(HAVE_WEBSERVER) || defined(WOLFSSL_WPAS_SMALL))
if ((ssl->options.mask & WOLFSSL_OP_NO_TICKET) == WOLFSSL_OP_NO_TICKET) {
ssl->options.noTicketTls12 = 1;
}
#endif
/* in the case of a version change the cipher suites should be reset */
#ifndef NO_PSK
havePSK = ssl->options.havePSK;