Fixes an issue were dropped records sent from server was not retransmitted.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25119)

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 718ccd777f8c3ebdee775020299d841e7554c600..efc0b8a8c3a09d1193fbb80d87a5e89ad78ed477 100644 (file)
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -199,7 +199,9 @@ void dtls1_clear_sent_buffer(SSL_CONNECTION *s, int keep_unacked_msgs)
 
         if (((!SSL_CONNECTION_IS_DTLS13(s) && record_type == SSL3_RT_CHANGE_CIPHER_SPEC)
              || (SSL_CONNECTION_IS_DTLS13(s)
-                 && (msg_type == SSL3_MT_FINISHED || msg_type == SSL3_MT_KEY_UPDATE)))
+                 && (msg_type == SSL3_MT_FINISHED
+                     || msg_type == SSL3_MT_SERVER_HELLO
+                     || msg_type == SSL3_MT_KEY_UPDATE)))
             && sent_msg->saved_retransmit_state.wrlmethod != NULL
             && s->rlayer.wrl != sent_msg->saved_retransmit_state.wrl) {
             /*

diff --git a/ssl/record/rec_layer_d1.c b/ssl/record/rec_layer_d1.c
index 031f2c67e4dc579a7216ad646a2cd890020e15ba..3dd29d89543823e8e7efeb16b7a42d37656a7518 100644 (file)
--- a/ssl/record/rec_layer_d1.c
+++ b/ssl/record/rec_layer_d1.c
@@ -733,6 +733,8 @@ int do_dtls1_write(SSL_CONNECTION *sc, uint8_t type, const unsigned char *buf,
     if (type == SSL3_RT_HANDSHAKE && ret > 0 && SSL_CONNECTION_IS_DTLS13(sc)) {
         pitem *item;
         unsigned char prio[8];
+        dtls_sent_msg *sent_msg;
+        DTLS1_RECORD_NUMBER *rec_num;
 
         dtls1_get_queue_priority(prio, sc->d1->w_msg.msg_seq, 0);
         item = pqueue_find(&sc->d1->sent_messages, prio);
@@ -740,18 +742,13 @@ int do_dtls1_write(SSL_CONNECTION *sc, uint8_t type, const unsigned char *buf,
         if (item == NULL)
             return ret;
 
-        if (dtls_msg_needs_ack(sc->server, sc->d1->w_msg.msg_type)) {
-            dtls_sent_msg *sent_msg;
-            DTLS1_RECORD_NUMBER *rec_num;
+        sent_msg = (dtls_sent_msg *) item->data;
+        rec_num = dtls1_record_number_new(tmpl.epoch, tmpl.sequence_number);
 
-            sent_msg = (dtls_sent_msg *) item->data;
-            rec_num = dtls1_record_number_new(tmpl.epoch, tmpl.sequence_number);
-
-            if (rec_num == NULL)
-                return -1;
+        if (rec_num == NULL)
+            return -1;
 
-            ossl_list_record_number_insert_tail(&sent_msg->rec_nums, rec_num);
-        }
+        ossl_list_record_number_insert_tail(&sent_msg->rec_nums, rec_num);
     }
 
     return ret;

diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index d08f76d993c8fb59139e19d49e244e01311b56ed..8448affe1776412eefae5a0f54c4457b7d52d687 100644 (file)
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -825,10 +825,8 @@ int tls13_change_cipher_state(SSL_CONNECTION *s, int which)
         }
 
         /* We have moved to the next flight lets clear out old messages */
-        if (direction == OSSL_RECORD_DIRECTION_READ) {
+        if (direction == OSSL_RECORD_DIRECTION_READ)
             dtls1_clear_received_buffer(s);
-            dtls1_acknowledge_sent_buffer(s, dtls1_get_epoch(s, which));
-        }
 
         dtls1_clear_sent_buffer(s, 1);
     }