From 07d447a6fcd02bbccca9f7bd139cf0554fedf48c Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 8 May 2017 16:51:47 +0100 Subject: [PATCH] Don't do the final key_share checks if we are in an HRR Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/3414) --- ssl/statem/extensions.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c index 8984577d4f..9b16014f7b 100644 --- a/ssl/statem/extensions.c +++ b/ssl/statem/extensions.c @@ -1058,6 +1058,10 @@ static int final_key_share(SSL *s, unsigned int context, int sent, int *al) if (!SSL_IS_TLS13(s)) return 1; + /* Nothing to do for key_share in an HRR */ + if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) + return 1; + /* * If * we are a client -- 2.25.1