yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #8595 from yanrayw/issue/8593/srv-CH-fix-version-check

Browse source 
TLS1.3: SRV: check `min_tls_version` when parsing ClientHello
This commit is contained in:
Ronald Cron 2024-01-11 13:34:09 +00:00 committed by GitHub
commit 7c14afcaaa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog.d/fix-tls13-server-min-version-check.txt Normal file
View file

@ -0,0 +1,3 @@
Bugfix
* Fix TLS server accepting TLS 1.2 handshake while TLS 1.2
is disabled at runtime. Fixes #8593.

12
library/ssl_tls13_server.c
View file

@ -1925,13 +1925,23 @@ static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
* by MBEDTLS_SSL_PROC_CHK_NEG. */
/*
* Version 1.2 of the protocol has been chosen, set the
* Version 1.2 of the protocol has to be used for the handshake.
* If TLS 1.2 is not supported, abort the handshake. Otherwise, set the
* ssl->keep_current_message flag for the ClientHello to be kept and parsed
* as a TLS 1.2 ClientHello. We also change ssl->tls_version to
* MBEDTLS_SSL_VERSION_TLS1_2 thus from now on mbedtls_ssl_handshake_step()
* will dispatch to the TLS 1.2 state machine.
*/
if (SSL_CLIENT_HELLO_TLS1_2 == parse_client_hello_ret) {
/* Check if server supports TLS 1.2 */
if (!mbedtls_ssl_conf_is_tls12_enabled(ssl->conf)) {
MBEDTLS_SSL_DEBUG_MSG(
1, ("TLS 1.2 not supported."));
MBEDTLS_SSL_PEND_FATAL_ALERT(
MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
}
ssl->keep_current_message = 1;
ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
return 0;

15
tests/ssl-opt.sh
View file

@ -11756,6 +11756,21 @@ run_test "TLS 1.3: Not supported version check:openssl: srv max TLS 1.2" \
-S "Version: TLS1.2" \
-C "Protocol : TLSv1.2"
requires_config_enabled MBEDTLS_DEBUG_C
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "TLS 1.3 m->m: Not supported version check: cli TLS 1.2 only, srv TLS 1.3 only, fail" \
"$P_SRV debug_level=4 max_version=tls13 min_version=tls13" \
"$P_CLI debug_level=4 max_version=tls12 min_version=tls12" \
1 \
-c "The SSL configuration is tls12 only" \
-c "supported_versions(43) extension does not exist." \
-c "A fatal alert message was received from our peer" \
-s "The SSL configuration is tls13 only" \
-s "TLS 1.2 not supported."
requires_openssl_tls1_3_with_compatible_ephemeral
requires_config_enabled MBEDTLS_DEBUG_C
requires_config_enabled MBEDTLS_SSL_CLI_C