CVSROOT: /cvs
Module name: src
Changes by: js...@cvs.openbsd.org 2022/09/17 11:14:06
Modified files:
lib/libssl : tls13_server.c
Log message:
Allow TLSv1.3 clients to send CCS without middlebox compatibility mode.
While RFC 8446 is clear about what legacy session identifiers can be sent
by a TLSv1.3 client and how middlebox compatibility mode is requested, it
is delightfully vague about the circumstances under which a client is
permitted to send CCS messages. While it does not make sense for a client
to send CCS messages when they are not requesting middlebox compatibility
mode, it is not strictly forbidden by the RFC and at least one (unknown)
TLSv1.3 stack has been observed to do this in the wild.
Revert part of the previous change and allow clients to send CCS messages,
even if they are not requesting middlebox compatibility mode.
Found the hard way by florian@
ok tb@
