mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-11-09 14:50:17 +08:00
e462a2ea4e
The TLS 1.3 server accepted a malformed key_share extension in the ClientHello and then closed the connection without sending an alert: - a zero-length key_exchange was accepted; - a key_exchange whose length did not match its group was only caught later, by the key agreement, which returned without pending an alert; - data trailing the client_shares list was ignored. Reject these in ssl_tls13_parse_key_shares_ext() and in the shared key-exchange reader mbedtls_ssl_tls13_read_public_xxdhe_share(): - a zero-length key_exchange and trailing data after client_shares are rejected with a decode_error alert; - a key_exchange whose length does not match the group is rejected with an illegal_parameter alert, which is what OpenSSL does. The shared reader is also used by the client, so it now checks that a ServerHello key_share is consumed exactly. Expose ssl_tls13_parse_key_shares_ext() with MBEDTLS_STATIC_TESTABLE and add unit tests that feed crafted key_share extensions to the server parser. Fixes #10887. Fixes #10737. Signed-off-by: Joachim Bauernberger <joachim.bauernberger@protonmail.com>
31 lines
940 B
C
31 lines
940 B
C
/*
|
|
* Copyright The Mbed TLS Contributors
|
|
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
|
*/
|
|
|
|
#ifndef MBEDTLS_SSL_TLS13_INVASIVE_H
|
|
#define MBEDTLS_SSL_TLS13_INVASIVE_H
|
|
|
|
#include "ssl_misc.h"
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
|
|
|
#include "psa/crypto.h"
|
|
|
|
#if defined(MBEDTLS_TEST_HOOKS)
|
|
int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl,
|
|
const unsigned char *buf,
|
|
const unsigned char *end);
|
|
|
|
#if defined(MBEDTLS_SSL_SRV_C) && \
|
|
defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
|
|
int mbedtls_ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context *ssl,
|
|
const unsigned char *buf,
|
|
const unsigned char *end);
|
|
#endif
|
|
#endif /* MBEDTLS_TEST_HOOKS */
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
|
|
|
|
#endif /* MBEDTLS_SSL_TLS13_INVASIVE_H */
|