DTLS RFC4347 says HelloVerifyRequest resets Finished MAC.

[openssl.git] / ssl / d1_srvr.c

diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c
index 0cfcf99971d0af6587beda45702cb4025ca4c5e2..14fdcff03b6e600ae14a3f7e36d1f650ccb521b1 100644 (file)
--- a/ssl/d1_srvr.c
+++ b/ssl/d1_srvr.c
@@ -286,6 +286,9 @@ int dtls1_accept(SSL *s)
                        s->d1->send_cookie = 0;
                        s->state=SSL3_ST_SW_FLUSH;
                        s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;
                        s->d1->send_cookie = 0;
                        s->state=SSL3_ST_SW_FLUSH;
                        s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;

+
+                       /* HelloVerifyRequest resets Finished MAC */
+                       ssl3_init_finished_mac(s);

                        break;
                        
                case SSL3_ST_SW_SRVR_HELLO_A:
                        break;
                        
                case SSL3_ST_SW_SRVR_HELLO_A: