diff options
| author | Matt Caswell <matt@openssl.org> | 2016-11-02 09:14:51 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2016-11-02 23:25:48 +0000 |
| commit | 77cd04bd27397161faa4ad0b211727bfd97e6a67 (patch) | |
| tree | c417e3e66eded2b6a196e1b1c73669c340f1df02 | |
| parent | bfca0515b6977cba7b50215fc6d7d88250c9ca38 (diff) | |
Fail if an unrecognised record type is received
TLS1.0 and TLS1.1 say you SHOULD ignore unrecognised record types, but
TLS 1.2 says you MUST send an unexpected message alert. We swap to the
TLS 1.2 behaviour for all protocol versions to prevent issues where no
progress is being made and the peer continually sends unrecognised record
types, using up resources processing them.
Issue reported by 郭志攀
Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 436a2a0179416d2cc22b678b63e50c2638384d5f)
| -rw-r--r-- | ssl/record/rec_layer_s3.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c index 4535f89a1e..28de7c384e 100644 --- a/ssl/record/rec_layer_s3.c +++ b/ssl/record/rec_layer_s3.c @@ -1463,14 +1463,12 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf, switch (SSL3_RECORD_get_type(rr)) { default: /* - * TLS up to v1.1 just ignores unknown message types: TLS v1.2 give - * an unexpected message alert. + * TLS 1.0 and 1.1 say you SHOULD ignore unrecognised record types, but + * TLS 1.2 says you MUST send an unexpected message alert. We use the + * TLS 1.2 behaviour for all protocol versions to prevent issues where + * no progress is being made and the peer continually sends unrecognised + * record types, using up resources processing them. */ - if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION) { - SSL3_RECORD_set_length(rr, 0); - SSL3_RECORD_set_read(rr); - goto start; - } al = SSL_AD_UNEXPECTED_MESSAGE; SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD); goto f_err; |