Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-03 23:47:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix TLS alert codes

Browse Source 
Signed-off-by: Dave Rodgman <[email protected]>
This commit is contained in:
Dave Rodgman
2021-06-29 09:44:35 +01:00
parent 438ef16d45
commit 459a46102d
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog.d/fix_tls_alert_codes.txt
+6
View File
@@ -0,0 +1,6 @@
Bugfix
* Fix the alert raised when a client requests an invalid
* fragment length, as per RFC6066 section 4. We now alert with
* MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER. Similarly, raise
* MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR for an invalid finished
* message, as per RFC5247 section 7.2.2.
library/ssl_cli.c
+1 -1
View File
@@ -1318,7 +1318,7 @@ static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
mbedtls_ssl_send_alert_message(
ssl,
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
}
library/ssl_tls.c
+1 -1
View File
@@ -6684,7 +6684,7 @@ int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
}