feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Improved fix for TLS1.3 to TLS1.2 client downgrade

Browse Source
This commit is contained in:
Lealem Amedie
2024-06-06 12:22:50 -06:00
parent 29df90197e
commit f3061359d8
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/tls13.c
View File

@ -5023,6 +5023,7 @@ typedef struct Dsh13Args {
int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx, int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
word32 helloSz, byte* extMsgType) word32 helloSz, byte* extMsgType)
{ {
word32 inOutIdxCopy;
int ret; int ret;
byte suite[2]; byte suite[2];
byte tls12minor; byte tls12minor;
@ -5298,13 +5299,6 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
return ret; return ret;
} }
#endif /* WOLFSSL_DTLS13 */ #endif /* WOLFSSL_DTLS13 */
#ifndef WOLFSSL_NO_TLS12
return DoServerHello(ssl, input, inOutIdx, helloSz);
#else
SendAlert(ssl, alert_fatal, wolfssl_alert_protocol_version);
return VERSION_ERROR;
#endif
} }
} }
@ -5359,6 +5353,7 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
DtlsCIDOnExtensionsParsed(ssl); DtlsCIDOnExtensionsParsed(ssl);
#endif /* WOLFSSL_DTLS_CID */ #endif /* WOLFSSL_DTLS_CID */
inOutIdxCopy = *inOutIdx;
*inOutIdx = args->idx; *inOutIdx = args->idx;
ssl->options.serverState = SERVER_HELLO_COMPLETE; ssl->options.serverState = SERVER_HELLO_COMPLETE;
@ -5403,8 +5398,9 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
else else
ssl->chVersion.minor = TLSv1_2_MINOR; ssl->chVersion.minor = TLSv1_2_MINOR;
/* Complete TLS v1.2 processing of ServerHello. */ /* Complete TLS v1.2 processing of ServerHello. */
ret = CompleteServerHello(ssl); ret = DoServerHello(ssl, input, &inOutIdxCopy, helloSz);
#else #else
(void)inOutIdxCopy;
WOLFSSL_MSG("Client using higher version, fatal error"); WOLFSSL_MSG("Client using higher version, fatal error");
WOLFSSL_ERROR_VERBOSE(VERSION_ERROR); WOLFSSL_ERROR_VERBOSE(VERSION_ERROR);
ret = VERSION_ERROR; ret = VERSION_ERROR;