lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-30 22:43:08 +03:00
Code Activity

ssl_session_reset: preserve HOSTNAME_SET flag

Browse Source 
When we don't reset `ssl->hostname`, we must not reset the
`MBEDTLS_SSL_CONTEXT_FLAG_HOSTNAME_SET` flag either.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2025-02-24 18:45:49 +01:00
parent eb2d29eb6b
commit fd89acc735
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
library/ssl_misc.h
View File

@ -57,6 +57,16 @@ typedef enum {
MBEDTLS_SSL_CONTEXT_FLAG_HOSTNAME_SET = 1, MBEDTLS_SSL_CONTEXT_FLAG_HOSTNAME_SET = 1,
} mbedtls_ssl_context_flags_t; } mbedtls_ssl_context_flags_t;
/** Flags from ::mbedtls_ssl_context_flags_t to keep in
* mbedtls_ssl_session_reset().
*
* The flags that are in this list are kept until explicitly updated or
* until mbedtls_ssl_free(). The flags that are not listed here are
* reset to 0 in mbedtls_ssl_session_reset().
*/
#define MBEDTLS_SSL_CONTEXT_FLAGS_KEEP_AT_SESSION \
(MBEDTLS_SSL_CONTEXT_FLAG_HOSTNAME_SET)
#define MBEDTLS_SSL_INITIAL_HANDSHAKE 0 #define MBEDTLS_SSL_INITIAL_HANDSHAKE 0
#define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */ #define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */
#define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */ #define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */

2
library/ssl_tls.c
View File

@ -1411,7 +1411,7 @@ int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
ssl->state = MBEDTLS_SSL_HELLO_REQUEST; ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
ssl->flags = 0; ssl->flags &= MBEDTLS_SSL_CONTEXT_FLAGS_KEEP_AT_SESSION;
ssl->tls_version = ssl->conf->max_tls_version; ssl->tls_version = ssl->conf->max_tls_version;
mbedtls_ssl_session_reset_msg_layer(ssl, partial); mbedtls_ssl_session_reset_msg_layer(ssl, partial);