yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-05-05 02:32:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix handling of non-fatal alerts

Browse source 
fixes #308
This commit is contained in:
Manuel Pégourié-Gonnard 2015-10-23 11:13:28 +02:00
parent 134ca18fbc
commit a314076486
2 changed files with 35 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
ChangeLog
View file

@ -2,14 +2,17 @@ mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS 2.1.3 released 2015-10-xx = mbed TLS 2.1.3 released 2015-10-xx
Changes
* Improved performance of mbedtls_ecp_muladd() when one of the scalars is 1
or -1.
Bugfix Bugfix
* Fix build error with configurations where ECDHE-PSK is the only key * Fix build error with configurations where ECDHE-PSK is the only key
exchange. Found and fix provided by Chris Hammond. #270 exchange. Found and fix provided by Chris Hammond. #270
* Fix build error with configurations where RSA, RSA-PSK, ECDH-RSA or * Fix build error with configurations where RSA, RSA-PSK, ECDH-RSA or
ECHD-ECDSA if the only key exchange. Multiple reports. #310 ECHD-ECDSA if the only key exchange. Multiple reports. #310
* Fix bug causing some handshakes to fail due to some non-fatal alerts not
begin properly ignored. Found by Kasom Koht-arsa, #308
Changes
* Improved performance of mbedtls_ecp_muladd() when one of the scalars is 1
or -1.
= mbed TLS 2.1.2 released 2015-10-06 = mbed TLS 2.1.2 released 2015-10-06

34
library/ssl_tls.c
View file

@ -3696,8 +3696,9 @@ static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
/* /*
* Read a record. * Read a record.
* *
* For DTLS, silently ignore invalid records (RFC 4.1.2.7.) * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
* and continue reading until a valid record is found. * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
*
*/ */
int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl ) int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl )
{ {
@ -3729,9 +3730,7 @@ int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl )
/* /*
* Read the record header and parse it * Read the record header and parse it
*/ */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
read_record_header: read_record_header:
#endif
if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) ) ) != 0 ) if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) ) ) != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
@ -3887,7 +3886,7 @@ read_record_header:
ssl->in_msg[0], ssl->in_msg[1] ) ); ssl->in_msg[0], ssl->in_msg[1] ) );
/* /*
* Ignore non-fatal alerts, except close_notify * Ignore non-fatal alerts, except close_notify and no_renego
*/ */
if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL ) if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
{ {
@ -3902,6 +3901,31 @@ read_record_header:
MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY ); return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
} }
#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
/* Will be handled when trying to parse ServerHello */
return( 0 );
}
#endif
#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
/* Will be handled in mbedtls_ssl_parse_certificate() */
return( 0 );
}
#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
/* Silently ignore: fetch new message */
goto read_record_header;
} }
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );