yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-22 09:01:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'public/pr/1957' into mbedtls-2.1

Browse source
This commit is contained in:
Simon Butcher 2018-08-28 12:17:38 +01:00
parent d288ac0e83 10652b10d9
commit 263ca7282e
3 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -15,6 +15,11 @@ Bugfix
* Fix a miscalculation of the maximum record expansion in * Fix a miscalculation of the maximum record expansion in
mbedtls_ssl_get_record_expansion() in case of CBC ciphersuites mbedtls_ssl_get_record_expansion() in case of CBC ciphersuites
in (D)TLS versions 1.1 or higher. Fixes #1914. in (D)TLS versions 1.1 or higher. Fixes #1914.
* Fix a bug that caused SSL/TLS clients to incorrectly abort the handshake
with TLS versions 1.1 and earlier when the server requested authentication
without providing a list of CAs. This was due to an overly strict bounds
check in parsing the CertificateRequest message,
introduced in Mbed TLS 2.12.0. Fixes #1954.
= mbed TLS 2.1.14 branch released 2018-07-25 = mbed TLS 2.1.14 branch released 2018-07-25

2
library/ssl_cli.c
View file

@ -2504,7 +2504,7 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
* therefore the buffer length at this point must be greater than that * therefore the buffer length at this point must be greater than that
* regardless of the actual code path. * regardless of the actual code path.
*/ */
if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n ) if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) ); MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST ); return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );

16
tests/ssl-opt.sh
View file

@ -656,6 +656,22 @@ run_test "RC4: both enabled" \
-S "SSL - None of the common ciphersuites is usable" \ -S "SSL - None of the common ciphersuites is usable" \
-S "SSL - The server has no ciphersuites in common" -S "SSL - The server has no ciphersuites in common"
# Test empty CA list in CertificateRequest in TLS 1.1 and earlier
requires_gnutls
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
run_test "CertificateRequest with empty CA list, TLS 1.1 (GnuTLS server)" \
"$G_SRV"\
"$P_CLI force_version=tls1_1" \
0
requires_gnutls
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1
run_test "CertificateRequest with empty CA list, TLS 1.0 (GnuTLS server)" \
"$G_SRV"\
"$P_CLI force_version=tls1" \
0
# Tests for SHA-1 support # Tests for SHA-1 support
requires_config_disabled MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES requires_config_disabled MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES