Don't ask for an invalid group in an HRR #21163
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If the client sends us a group in a key_share that is in our supported_groups list but is otherwise not suitable (e.g. not compatible with TLSv1.3) we reject it. We should not ask for that same group again in a subsequent HRR. Fixes openssl#21157
Test that if the client sends a key share for a group in the server's supported_group list but is otherwise invalid, that we don't select it in the HRR.
mattcaswell
added
branch: master
t8m
added
triaged: bug
t8m
approved these changes
Jun 9, 2023
t8m
removed
the
approval: otc review pending
tmshort
approved these changes
Jun 11, 2023
| @@ -1449,7 +1449,11 @@ static int final_key_share(SSL_CONNECTION *s, unsigned int context, int sent) | |||
| group_id = pgroups[i]; | |||
|
|
|||
| if (check_in_list(s, group_id, clntgroups, clnt_num_groups, | |||
| 1)) | |||
| 1) | |||
There was a problem hiding this comment.
Does line-length allow for this to be put with the previous line?
There was a problem hiding this comment.
No - line-length prevents this
tmshort
added
approval: done
openssl-machine
added
approval: ready to merge
|
This pull request is ready to merge |
|
@mattcaswell do you want to change what @tmshort suggests? Or just merge please. |
mattcaswell
added
approval: review pending
t8m
approved these changes
Jun 16, 2023
t8m
removed
the
approval: otc review pending
tmshort
approved these changes
Jun 20, 2023
|
Still good, though the |
tmshort
removed
the
approval: review pending
tmshort
added
the
approval: done
openssl-machine
added
approval: ready to merge
|
This pull request is ready to merge |
openssl-machine
pushed a commit
that referenced
this pull request
Jun 23, 2023
If the client sends us a group in a key_share that is in our supported_groups list but is otherwise not suitable (e.g. not compatible with TLSv1.3) we reject it. We should not ask for that same group again in a subsequent HRR. Fixes #21157 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from #21163)
openssl-machine
pushed a commit
that referenced
this pull request
Jun 23, 2023
Test that if the client sends a key share for a group in the server's supported_group list but is otherwise invalid, that we don't select it in the HRR. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from #21163)
openssl-machine
pushed a commit
that referenced
this pull request
Jun 23, 2023
If the client sends us a group in a key_share that is in our supported_groups list but is otherwise not suitable (e.g. not compatible with TLSv1.3) we reject it. We should not ask for that same group again in a subsequent HRR. Fixes #21157 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from #21163) (cherry picked from commit 7a949ae)
openssl-machine
pushed a commit
that referenced
this pull request
Jun 23, 2023
If the client sends us a group in a key_share that is in our supported_groups list but is otherwise not suitable (e.g. not compatible with TLSv1.3) we reject it. We should not ask for that same group again in a subsequent HRR. Fixes #21157 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from #21163) (cherry picked from commit 7a949ae)
|
Pushed to master/3.1/3.0. Thanks. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the client sends us a group in a key_share that is in our
supported_groups list but is otherwise not suitable (e.g. not compatible
with TLSv1.3) we reject it. We should not ask for that same group again
in a subsequent HRR.
Fixes #21157