mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Correct Alert Handling for Missing Compression Methods

Browse Source 
Fixes #7940: Updated the compression check logic to improve protocol compliance. The code now returns `SSL_AD_DECODE_ERROR` when no compression method is provided in the ClientHello message. It returns `SSL_AD_ILLEGAL_PARAMETER` if the “null” compression method (0x00) is missing.

Additionally, refactored the related test code for enhanced readability and maintainability.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25255)
This commit is contained in:
erbsland-dev 2024-08-21 18:18:58 +02:00 committed by Tomas Mraz
parent 6696682774
commit c026101be0
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
ssl/statem/statem_srvr.c
View File

@ -1683,7 +1683,6 @@ static int tls_early_post_process_client_hello(SSL_CONNECTION *s)
unsigned int j;
int i, al = SSL_AD_INTERNAL_ERROR;
int protverr;
size_t loop;
unsigned long id;
#ifndef OPENSSL_NO_COMP
SSL_COMP *comp = NULL;
@ -1924,16 +1923,18 @@ static int tls_early_post_process_client_hello(SSL_CONNECTION *s)
OSSL_TRACE_END(TLS_CIPHER);
}
for (loop = 0; loop < clienthello->compressions_len; loop++) {
if (clienthello->compressions[loop] == 0)
break;
}
if (loop >= clienthello->compressions_len) {
/* no compress */
/* At least one compression method must be preset. */
if (clienthello->compressions_len == 0) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_NO_COMPRESSION_SPECIFIED);
goto err;
}
/* Make sure at least the null compression is supported. */
if (memchr(clienthello->compressions, 0,
clienthello->compressions_len) == NULL) {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING);
goto err;
}
if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
ssl_check_for_safari(s, clienthello);