lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Merge pull request #8727 from ronald-cron-arm/tls13-ignore-early-data-when-rejected

Browse Source 
TLS 1.3: SRV: Ignore early data when rejected
This commit is contained in:
Manuel Pégourié-Gonnard
2024-02-06 13:16:03 +00:00
committed by GitHub
parent 32c28cebb4 d0a772740e
commit 5c9cc0b30f
8 changed files with 219 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
library/ssl_msg.c
View File

@ -3985,6 +3985,31 @@ static int ssl_prepare_record_content(mbedtls_ssl_context *ssl,
rec)) != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "ssl_decrypt_buf", ret);
#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SRV_C)
/*
* Although the server rejected early data, it might receive early
* data as long as it has not received the client Finished message.
* It is encrypted with early keys and should be ignored as stated
* in section 4.2.10 of RFC 8446:
*
* "Ignore the extension and return a regular 1-RTT response. The
* server then skips past early data by attempting to deprotect
* received records using the handshake traffic key, discarding
* records which fail deprotection (up to the configured
* max_early_data_size). Once a record is deprotected successfully,
* it is treated as the start of the client's second flight and the
* server proceeds as with an ordinary 1-RTT handshake."
*/
if ((old_msg_type == MBEDTLS_SSL_MSG_APPLICATION_DATA) &&
(ssl->discard_early_data_record ==
MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD)) {
MBEDTLS_SSL_DEBUG_MSG(
3, ("EarlyData: deprotect and discard app data records."));
/* TODO: Add max_early_data_size check here, see issue 6347 */
ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
}
#endif /* MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_SRV_C */
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
if (ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
ssl->conf->ignore_unexpected_cid
@ -3994,9 +4019,27 @@ static int ssl_prepare_record_content(mbedtls_ssl_context *ssl,
}
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
/*
* The decryption of the record failed, no reason to ignore it,
* return in error with the decryption error code.
*/
return ret;
}
#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SRV_C)
/*
* If the server were discarding protected records that it fails to
* deprotect because it has rejected early data, as we have just
* deprotected successfully a record, the server has to resume normal
* operation and fail the connection if the deprotection of a record
* fails.
*/
if (ssl->discard_early_data_record ==
MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD) {
ssl->discard_early_data_record = MBEDTLS_SSL_EARLY_DATA_NO_DISCARD;
}
#endif /* MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_SRV_C */
if (old_msg_type != rec->type) {
MBEDTLS_SSL_DEBUG_MSG(4, ("record type after decrypt (before %d): %d",
old_msg_type, rec->type));
@ -4070,6 +4113,32 @@ static int ssl_prepare_record_content(mbedtls_ssl_context *ssl,
}
#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SRV_C)
/*
* Although the server rejected early data because it needed to send an
* HelloRetryRequest message, it might receive early data as long as it has
* not received the client Finished message.
* The early data is encrypted with early keys and should be ignored as
* stated in section 4.2.10 of RFC 8446 (second case):
*
* "The server then ignores early data by skipping all records with an
* external content type of "application_data" (indicating that they are
* encrypted), up to the configured max_early_data_size. Ignore application
* data message before 2nd ClientHello when early_data was received in 1st
* ClientHello."
*/
if (ssl->discard_early_data_record == MBEDTLS_SSL_EARLY_DATA_DISCARD) {
if (rec->type == MBEDTLS_SSL_MSG_APPLICATION_DATA) {
MBEDTLS_SSL_DEBUG_MSG(
3, ("EarlyData: Ignore application message before 2nd ClientHello"));
/* TODO: Add max_early_data_size check here, see issue 6347 */
return MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
} else if (rec->type == MBEDTLS_SSL_MSG_HANDSHAKE) {
ssl->discard_early_data_record = MBEDTLS_SSL_EARLY_DATA_NO_DISCARD;
}
}
#endif /* MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_SRV_C */
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
mbedtls_ssl_dtls_replay_update(ssl);