coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge f0422f56d11ab3f4d9cde32fb38ab074bd5c88d7 into 03e1438089654fb884ac48e0f3cd0049cfe2c102

Browse Source
This commit is contained in:
Ray Chern 2026-10-27 10:46:00 -04:00 committed by GitHub
commit c078a123dc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog.d/fix-alpn-empty-list.txt Normal file
View File

@ -0,0 +1,7 @@
Bugfix
* Fix mbedtls_ssl_conf_alpn_protocols() silently accepting an empty
protocol list, which caused an invalid ALPN extension with a
zero-length protocol_name_list to be sent during the handshake,
violating RFC 7301 and causing conforming peers to reject the
connection with a fatal decode error. mbedtls_ssl_conf_alpn_protocols()
now returns MBEDTLS_ERR_SSL_BAD_INPUT_DATA for an empty list.

10
library/ssl_tls.c
View File

@ -2526,6 +2526,16 @@ int mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config *conf,
size_t cur_len, tot_len;
const char *const *p;
/*
* RFC 7301 3.1: the ALPN extension's protocol_name_list must contain
* at least one entry - an empty list is not a valid ProtocolNameList
* and must not be sent. Reject it here rather than silently sending
* an ALPN extension with a zero-length list later.
*/
if (*protos == NULL) {
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
}
/*
* RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
* MUST NOT be truncated."