Fix the s_server psk_server_cb for use in DTLS#16838
Fix the s_server psk_server_cb for use in DTLS#16838mattcaswell wants to merge 2 commits intoopenssl:masterfrom
Conversation
Commit 0007ff2 added a protocol version check to psk_server_cb but failed to take account of DTLS causing DTLS based psk connections to fail. Fixes openssl#16707
mattcaswell
added
branch: master
|
@mattcaswell there is also PR #16709 fixing the same issue. |
| BIO_printf(bio_s_out, "psk_server_cb\n"); | ||
|
|
||
| if (SSL_version(ssl) >= TLS1_3_VERSION) { | ||
| if (!SSL_is_dtls(ssl) && SSL_version(ssl) >= TLS1_3_VERSION) { |
There was a problem hiding this comment.
Shouldn't we also check the specific DTLS version in the DTLS case?
There was a problem hiding this comment.
Err, no. It actually works just fine for DTLSv1 as well (and TLSv1). I fixed the comment instead :-)
There was a problem hiding this comment.
Oh! I meant that we should check that it's not DTLS1_3_VERSION in the DTLS case, since DTLS 1.3 is basically just TLS 1.3.
The DTLS 1.3 specification is, of course, in the RFC Editor's queue, and thus going to be something we ought to care about Real Soon Now.
But fixing the comment is also useful :)
There was a problem hiding this comment.
At the moment we don't have a definition for DTLS1_3_VERSION in the header files. Since there's a whole heap of places we check TLS1_3_VERSION without worrying about DTLS, when we do the DTLS1.3 work we're going to have to review each and every one of them.
|
This fix also needs to be applied to the 1.1.1 branch. |
mattcaswell
added
approval: done
openssl-machine
added
approval: ready to merge
|
This pull request is ready to merge |
Commit 0007ff2 added a protocol version check to psk_server_cb but failed to take account of DTLS causing DTLS based psk connections to fail. Fixes #16707 Reviewed-by: Ben Kaduk <[email protected]> (Merged from #16838)
Commit 0007ff2 added a protocol version check to psk_server_cb but failed to take account of DTLS causing DTLS based psk connections to fail. Fixes #16707 Reviewed-by: Ben Kaduk <[email protected]> (Merged from #16838) (cherry picked from commit 8b09a9c)
Commit 0007ff2 added a protocol version check to psk_server_cb but failed to take account of DTLS causing DTLS based psk connections to fail. Fixes #16707 Reviewed-by: Ben Kaduk <[email protected]> (Merged from #16838) (cherry picked from commit 8b09a9c)
|
Pushed. Thanks! |
Commit 0007ff2 added a protocol version check to psk_server_cb but
failed to take account of DTLS causing DTLS based psk connections to
fail.
Fixes #16707