feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #1409 from SparkiDev/tls13_old_ver_fix

Browse Source 
Fix downgrading when WOLFSSL_TLS13 is defined (despite NO_OLD_TLS being defined)
This commit is contained in:
toddouska
2018-03-08 13:59:59 -08:00
committed by GitHub
parent 200077c62c d6ffa0dd8e
commit 1f9583c59c
3 changed files with 21 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/tls.c
View File

@ -4645,10 +4645,9 @@ static int TLSX_SupportedVersions_Parse(WOLFSSL *ssl, byte* input,
if (!ssl->options.downgrade) if (!ssl->options.downgrade)
continue; continue;
#ifdef NO_OLD_TLS if (minor < ssl->options.minDowngrade)
if (minor < TLSv1_2_MINOR)
continue; continue;
#endif
/* Downgrade the version. */ /* Downgrade the version. */
ssl->version.minor = minor; ssl->version.minor = minor;
} }
@ -4699,10 +4698,9 @@ static int TLSX_SupportedVersions_Parse(WOLFSSL *ssl, byte* input,
if (!ssl->options.downgrade) if (!ssl->options.downgrade)
return VERSION_ERROR; return VERSION_ERROR;
#ifdef NO_OLD_TLS if (minor < ssl->options.minDowngrade)
if (minor < TLSv1_2_MINOR)
return VERSION_ERROR; return VERSION_ERROR;
#endif
/* Downgrade the version. */ /* Downgrade the version. */
ssl->version.minor = minor; ssl->version.minor = minor;
} }
@ -9012,7 +9010,7 @@ int TLSX_Parse(WOLFSSL* ssl, byte* input, word16 length, byte msgType,
InitSSL_Method(method, MakeTLSv1_1()); InitSSL_Method(method, MakeTLSv1_1());
#endif #endif
#endif #endif
#ifndef NO_OLD_TLS #if !defined(NO_OLD_TLS) || defined(WOLFSSL_TLS13)
method->downgrade = 1; method->downgrade = 1;
#endif #endif
} }
@ -9136,7 +9134,7 @@ int TLSX_Parse(WOLFSSL* ssl, byte* input, word16 length, byte msgType,
#error Must have SHA256, SHA384 or SHA512 enabled for TLS 1.2 #error Must have SHA256, SHA384 or SHA512 enabled for TLS 1.2
#endif #endif
#endif #endif
#ifndef NO_OLD_TLS #if !defined(NO_OLD_TLS) || defined(WOLFSSL_TLS13)
method->downgrade = 1; method->downgrade = 1;
#endif #endif
method->side = WOLFSSL_SERVER_END; method->side = WOLFSSL_SERVER_END;

11
src/tls13.c
View File

@ -2643,6 +2643,11 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
return VERSION_ERROR; return VERSION_ERROR;
} }
#else #else
if (pv.major == ssl->version.major && pv.minor < TLSv1_2_MINOR &&
ssl->options.downgrade) {
ssl->version.minor = TLSv1_2_MINOR;
return DoServerHello(ssl, input, inOutIdx, helloSz);
}
if (pv.major != ssl->version.major || pv.minor != TLSv1_2_MINOR) if (pv.major != ssl->version.major || pv.minor != TLSv1_2_MINOR)
return VERSION_ERROR; return VERSION_ERROR;
#endif #endif
@ -3622,9 +3627,13 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
if (TLSX_Find(ssl->extensions, TLSX_SUPPORTED_VERSIONS) == NULL) { if (TLSX_Find(ssl->extensions, TLSX_SUPPORTED_VERSIONS) == NULL) {
if (!ssl->options.downgrade) { if (!ssl->options.downgrade) {
WOLFSSL_MSG("Client trying to connect with lesser version"); WOLFSSL_MSG("Client trying to connect with lesser version than "
"TLS v1.3");
return VERSION_ERROR; return VERSION_ERROR;
} }
if (pv.minor < ssl->options.minDowngrade)
return VERSION_ERROR;
ssl->version.minor = pv.minor; ssl->version.minor = pv.minor;
} }

6
wolfssl/internal.h
View File

@ -1261,7 +1261,11 @@ enum Misc {
/* minimum Downgrade Minor version */ /* minimum Downgrade Minor version */
#ifndef WOLFSSL_MIN_DOWNGRADE #ifndef WOLFSSL_MIN_DOWNGRADE
#define WOLFSSL_MIN_DOWNGRADE TLSv1_MINOR #ifndef NO_OLD_TLS
#define WOLFSSL_MIN_DOWNGRADE TLSv1_MINOR
#else
#define WOLFSSL_MIN_DOWNGRADE TLSv1_2_MINOR
#endif
#endif #endif
/* Set max implicit IV size for AEAD cipher suites */ /* Set max implicit IV size for AEAD cipher suites */