coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge f0422f56d11ab3f4d9cde32fb38ab074bd5c88d7 into 3bb373867917b674265067cbd38b9d252c43d014

Browse Source
This commit is contained in:
Ray Chern 2026-07-20 21:00:39 +01:00 committed by GitHub
commit aa0046d13c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog.d/fix-alpn-empty-list.txt Normal file
View File

@ -0,0 +1,7 @@
Bugfix
* Fix mbedtls_ssl_conf_alpn_protocols() silently accepting an empty
protocol list, which caused an invalid ALPN extension with a
zero-length protocol_name_list to be sent during the handshake,
violating RFC 7301 and causing conforming peers to reject the
connection with a fatal decode error. mbedtls_ssl_conf_alpn_protocols()
now returns MBEDTLS_ERR_SSL_BAD_INPUT_DATA for an empty list.

10
library/ssl_tls.c
View File

@ -2526,6 +2526,16 @@ int mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config *conf,
size_t cur_len, tot_len;
const char *const *p;
/*
* RFC 7301 3.1: the ALPN extension's protocol_name_list must contain
* at least one entry - an empty list is not a valid ProtocolNameList
* and must not be sent. Reject it here rather than silently sending
* an ALPN extension with a zero-length list later.
*/
if (*protos == NULL) {
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
}
/*
* RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
* MUST NOT be truncated."