From 8dd8033519658bba2d7b776ec166f889a56bce31 Mon Sep 17 00:00:00 2001 From: Shigeki Ohtsu Date: Wed, 12 Sep 2018 17:34:24 +0900 Subject: [PATCH] tls: workaround handshakedone in renegotiation `SSL_CB_HANDSHAKE_START` and `SSL_CB_HANDSHAKE_DONE` are called sending HelloRequest in OpenSSL-1.1.1. We need to check whether this is in a renegotiation state or not. Backport-PR-URL: https://github.com/nodejs/node/pull/26270 PR-URL: https://github.com/nodejs/node/pull/25381 Reviewed-By: Daniel Bevenius Reviewed-By: Shigeki Ohtsu --- src/tls_wrap.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc index b5eff3835856bb..0ec66fc467e799 100644 --- a/src/tls_wrap.cc +++ b/src/tls_wrap.cc @@ -221,7 +221,10 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) { } } - if (where & SSL_CB_HANDSHAKE_DONE) { + // SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE are called + // sending HelloRequest in OpenSSL-1.1.1. + // We need to check whether this is in a renegotiation state or not. + if (where & SSL_CB_HANDSHAKE_DONE && !SSL_renegotiate_pending(ssl)) { c->established_ = true; Local callback = object->Get(env->onhandshakedone_string()); if (callback->IsFunction()) {