From a9a8863b791a54625da2a079a496a31cb7f94482 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 2 Dec 2019 17:29:21 +0000 Subject: [PATCH] Don't acknowledge a servername following warning alert in servername cb If the servername cb decides to send back a warning alert then the handshake continues, but we should not signal to the client that the servername has been accepted. Reviewed-by: Ben Kaduk (Merged from https://github.com/openssl/openssl/pull/10018) (cherry picked from commit cd624ccd41ac3ac779c1c7a7a1e63427ce9588dd) --- ssl/statem/extensions.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c index f6a1cd7dd2..44d8a2591a 100644 --- a/ssl/statem/extensions.c +++ b/ssl/statem/extensions.c @@ -1010,6 +1010,7 @@ static int final_server_name(SSL *s, unsigned int context, int sent) /* TLSv1.3 doesn't have warning alerts so we suppress this */ if (!SSL_IS_TLS13(s)) ssl3_send_alert(s, SSL3_AL_WARNING, altmp); + s->servername_done = 0; return 1; case SSL_TLSEXT_ERR_NOACK: -- 2.25.1