Commit 0d97d00b authored by Andy Polyakov's avatar Andy Polyakov
Browse files

DTLS RFC4347 says HelloVerifyRequest resets Finished MAC.

parent e7adda52

ssl/d1_clnt.c

+4 −2
Original line number Diff line number Diff line
@@ -213,8 +213,6 @@ int dtls1_connect(SSL *s) 


			/* don't push the buffering BIO quite yet */



			ssl3_init_finished_mac(s);



			s->state=SSL3_ST_CW_CLNT_HELLO_A;

			s->ctx->stats.sess_connect++;

			s->init_num=0;
@@ -226,6 +224,10 @@ int dtls1_connect(SSL *s) 
		case SSL3_ST_CW_CLNT_HELLO_B:



			s->shutdown=0;



			/* every DTLS ClientHello resets Finished MAC */

			ssl3_init_finished_mac(s);



			ret=dtls1_client_hello(s);

			if (ret <= 0) goto end;

ssl/d1_srvr.c

+3 −0
Original line number Diff line number Diff line
@@ -286,6 +286,9 @@ int dtls1_accept(SSL *s) 
			s->d1->send_cookie = 0;

			s->state=SSL3_ST_SW_FLUSH;

			s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;



			/* HelloVerifyRequest resets Finished MAC */

			ssl3_init_finished_mac(s);

			break;

			

		case SSL3_ST_SW_SRVR_HELLO_A: