From: Matt Caswell <matt@openssl.org>
Date: Mon, 12 Aug 2024 15:41:56 +0000 (+0100)
Subject: Ensure the msg_callback is called on CCS receipt in TLSv1.3
X-Git-Tag: openssl-3.4.0-alpha1~131
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8781087a69934cf45e201ac425d593b0e12a1538;p=thirdparty%2Fopenssl.git

Ensure the msg_callback is called on CCS receipt in TLSv1.3

CCS records are ignore in TLSv1.3. But we should still call the msg_callback
anyway.

Fixes #25166

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25169)
---

diff --git a/ssl/record/methods/tls_common.c b/ssl/record/methods/tls_common.c
index 0d92bdce9b7..0c2414f76e1 100644
--- a/ssl/record/methods/tls_common.c
+++ b/ssl/record/methods/tls_common.c
@@ -750,8 +750,11 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl)
         }
         /*
          * CCS messages are ignored in TLSv1.3. We treat it like an empty
-         * handshake record
+         * handshake record - but we still call the msg_callback
          */
+        if (rl->msg_callback != NULL)
+            rl->msg_callback(0, TLS1_3_VERSION, SSL3_RT_CHANGE_CIPHER_SPEC,
+                             thisrr->data, 1, rl->cbarg);
         thisrr->type = SSL3_RT_HANDSHAKE;
         if (++(rl->empty_record_count) > MAX_EMPTY_RECORDS) {
             RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,