mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-02-28 19:13:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add extension check for EncryptedExtensions

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu 2022-08-04 16:55:10 +08:00
parent e18dc7eb9a
commit cbd082f396
1 changed files with 31 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
library/ssl_tls13_client.c
View File

@ -32,6 +32,7 @@
#include "ssl_misc.h" #include "ssl_misc.h"
#include "ssl_client.h" #include "ssl_client.h"
#include "ssl_tls13_keys.h" #include "ssl_tls13_keys.h"
#include "ssl_debug_helpers.h"
/* Write extensions */ /* Write extensions */
@ -1969,6 +1970,7 @@ static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
size_t extensions_len; size_t extensions_len;
const unsigned char *p = buf; const unsigned char *p = buf;
const unsigned char *extensions_end; const unsigned char *extensions_end;
uint32_t extensions_present;
MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 ); extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
@ -1978,6 +1980,8 @@ static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len ); MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
extensions_end = p + extensions_len; extensions_end = p + extensions_len;
extensions_present = MBEDTLS_SSL_EXT_NONE;
while( p < extensions_end ) while( p < extensions_end )
{ {
unsigned int extension_type; unsigned int extension_type;
@ -1996,10 +2000,27 @@ static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len ); MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
/* The client MUST check EncryptedExtensions for the /* RFC 8446 page 35
* presence of any forbidden extensions and if any are found MUST abort *
* the handshake with an "unsupported_extension" alert. * If an implementation receives an extension which it recognizes and which
* is not specified for the message in which it appears, it MUST abort the
* handshake with an "illegal_parameter" alert.
*/ */
extensions_present |= mbedtls_tls13_get_extension_mask( extension_type );
MBEDTLS_SSL_DEBUG_MSG( 3,
( "encrypted extensions : received %s(%u) extension",
mbedtls_tls13_get_extension_name( extension_type ),
extension_type ) );
if( ( extensions_present & MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_EE ) == 0 )
{
MBEDTLS_SSL_DEBUG_MSG(
3, ( "forbidden extension received." ) );
MBEDTLS_SSL_PEND_FATAL_ALERT(
MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
}
switch( extension_type ) switch( extension_type )
{ {
case MBEDTLS_TLS_EXT_SERVERNAME: case MBEDTLS_TLS_EXT_SERVERNAME:
@ -2024,17 +2045,18 @@ static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
break; break;
#endif /* MBEDTLS_SSL_ALPN */ #endif /* MBEDTLS_SSL_ALPN */
default: default:
MBEDTLS_SSL_DEBUG_MSG( MBEDTLS_SSL_DEBUG_MSG( 3,
3, ( "unsupported extension found: %u ", extension_type) ); ( "encrypted extensions: received %s(%u) extension ( ignored )",
MBEDTLS_SSL_PEND_FATAL_ALERT( mbedtls_tls13_get_extension_name( extension_type ),
MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, extension_type ) );
MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); break;
return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
} }
p += extension_data_len; p += extension_data_len;
} }
MBEDTLS_SSL_TLS1_3_PRINT_EXTS( 3, "EncrypedExtensions", extensions_present );
/* Check that we consumed all the message. */ /* Check that we consumed all the message. */
if( p != end ) if( p != end )
{ {