Skip to content

Commit 0976770

Browse files
julek-wolfssljulek-wolfssl
committed
Validate cipher suite after HelloRetryRequest
Add validation to ensure the cipher suite in the ServerHello matches the one specified in the HelloRetryRequest.
1 parent 67c2d80 commit 0976770

4 files changed

Lines changed: 104 additions & 1 deletion

File tree

‎src/tls13.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5253,6 +5253,18 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
52535253
/* Set the cipher suite from the message. */
52545254
ssl->options.cipherSuite0 = input[args->idx++];
52555255
ssl->options.cipherSuite = input[args->idx++];
5256+
if (*extMsgType == hello_retry_request) {
5257+
ssl->options.hrrCipherSuite0 = ssl->options.cipherSuite0;
5258+
ssl->options.hrrCipherSuite = ssl->options.cipherSuite;
5259+
}
5260+
else if (ssl->msgsReceived.got_hello_retry_request &&
5261+
(ssl->options.hrrCipherSuite0 != ssl->options.cipherSuite0 ||
5262+
ssl->options.hrrCipherSuite != ssl->options.cipherSuite)) {
5263+
WOLFSSL_MSG("Received ServerHello with different cipher suite than "
5264+
"HelloRetryRequest");
5265+
WOLFSSL_ERROR_VERBOSE(INVALID_PARAMETER);
5266+
return INVALID_PARAMETER;
5267+
}
52565268
#ifdef WOLFSSL_DEBUG_TLS
52575269
WOLFSSL_MSG("Chosen cipher suite:");
52585270
WOLFSSL_MSG(GetCipherNameInternal(ssl->options.cipherSuite0,

‎tests/api/test_tls13.c‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2224,3 +2224,88 @@ int test_tls13_same_ch(void)
22242224
#endif
22252225
return EXPECT_RESULT();
22262226
}
2227+
2228+
int test_tls13_hrr_different_cs(void)
2229+
{
2230+
EXPECT_DECLS;
2231+
/*
2232+
* TLSv1.3 Record Layer: Handshake Protocol: Hello Retry Request
2233+
* Content Type: Handshake (22)
2234+
* Version: TLS 1.2 (0x0303)
2235+
* Length: 56
2236+
* Handshake Protocol: Hello Retry Request
2237+
* Handshake Type: Server Hello (2)
2238+
* Length: 52
2239+
* Version: TLS 1.2 (0x0303)
2240+
* Random: cf21ad74e59a6111be1d8c021e65b891c2a211167abb8c5e079e09e2c8a8339c (HelloRetryRequest magic)
2241+
* Session ID Length: 0
2242+
* Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
2243+
* Compression Method: null (0)
2244+
* Extensions Length: 12
2245+
* Extension: supported_versions (len=2) TLS 1.3
2246+
* Extension: key_share (len=2) secp384r1
2247+
*
2248+
*/
2249+
unsigned char hrr[] = {
2250+
0x16, 0x03, 0x03, 0x00, 0x38, 0x02, 0x00, 0x00, 0x34, 0x03, 0x03, 0xcf,
2251+
0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02, 0x1e,
2252+
0x65, 0xb8, 0x91, 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 0x07,
2253+
0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c, 0x00, 0x13, 0x02, 0x00, 0x00,
2254+
0x0c, 0x00, 0x2b, 0x00, 0x02, 0x03, 0x04, 0x00, 0x33, 0x00, 0x02, 0x00,
2255+
0x18
2256+
};
2257+
/*
2258+
* TLSv1.3 Record Layer: Handshake Protocol: Server Hello
2259+
* Content Type: Handshake (22)
2260+
* Version: TLS 1.2 (0x0303)
2261+
* Length: 155
2262+
* Handshake Protocol: Server Hello
2263+
* Handshake Type: Server Hello (2)
2264+
* Length: 151
2265+
* Version: TLS 1.2 (0x0303)
2266+
* Random: 0101010101010101010101010101010101010101010101010101010101010101
2267+
* Session ID Length: 0
2268+
* Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)
2269+
* Compression Method: null (0)
2270+
* Extensions Length: 111
2271+
* Extension: key_share (len=101) secp384r1
2272+
* Extension: supported_versions (len=2) TLS 1.3
2273+
*
2274+
*/
2275+
unsigned char sh[] = {
2276+
0x16, 0x03, 0x03, 0x00, 0x9b, 0x02, 0x00, 0x00, 0x97, 0x03, 0x03, 0x01,
2277+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2278+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2279+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x13, 0x03, 0x00, 0x00,
2280+
0x6f, 0x00, 0x33, 0x00, 0x65, 0x00, 0x18, 0x00, 0x61, 0x04, 0x53, 0x3e,
2281+
0xe5, 0xbf, 0x40, 0xec, 0x2d, 0x67, 0x98, 0x8b, 0x77, 0xf3, 0x17, 0x48,
2282+
0x9b, 0xb6, 0xdf, 0x95, 0x29, 0x25, 0xc7, 0x09, 0xfc, 0x03, 0x81, 0x11,
2283+
0x1a, 0x59, 0x56, 0xf2, 0xd7, 0x58, 0x11, 0x0e, 0x59, 0xd3, 0xd7, 0xc1,
2284+
0x72, 0x9e, 0x2c, 0x0d, 0x70, 0xea, 0xf7, 0x73, 0xe6, 0x12, 0x01, 0x16,
2285+
0x42, 0x6d, 0xe2, 0x43, 0x6a, 0x2f, 0x5f, 0xdd, 0x7f, 0xe5, 0x4f, 0xaf,
2286+
0x95, 0x2b, 0x04, 0xfd, 0x13, 0xf5, 0x16, 0xce, 0x62, 0x7f, 0x89, 0xd2,
2287+
0x01, 0x9d, 0x4c, 0x87, 0x96, 0x95, 0x9e, 0x43, 0x33, 0xc7, 0x06, 0x5b,
2288+
0x49, 0x6c, 0xa6, 0x34, 0xd5, 0xdc, 0x63, 0xbd, 0xe9, 0x1f, 0x00, 0x2b,
2289+
0x00, 0x02, 0x03, 0x04
2290+
};
2291+
WOLFSSL_CTX *ctx_c = NULL;
2292+
WOLFSSL *ssl_c = NULL;
2293+
struct test_memio_ctx test_ctx;
2294+
2295+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2296+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, NULL, &ssl_c, NULL,
2297+
wolfTLSv1_3_client_method, NULL), 0);
2298+
2299+
ExpectIntEQ(wolfSSL_connect(ssl_c), -1);
2300+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), WOLFSSL_ERROR_WANT_READ);
2301+
ExpectIntEQ(test_memio_inject_message(&test_ctx, 1, (char*)hrr,
2302+
sizeof(hrr)), 0);
2303+
ExpectIntEQ(wolfSSL_connect(ssl_c), -1);
2304+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), WOLFSSL_ERROR_WANT_READ);
2305+
ExpectIntEQ(test_memio_inject_message(&test_ctx, 1, (char*)sh,
2306+
sizeof(sh)), 0);
2307+
ExpectIntEQ(wolfSSL_connect(ssl_c), -1);
2308+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), INVALID_PARAMETER);
2309+
2310+
return EXPECT_RESULT();
2311+
}

‎tests/api/test_tls13.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ int test_tls13_rpk_handshake(void);
3131
int test_tls13_pq_groups(void);
3232
int test_tls13_early_data(void);
3333
int test_tls13_same_ch(void);
34+
int test_tls13_hrr_different_cs(void);
3435

3536
#define TEST_TLS13_DECLS \
3637
TEST_DECL_GROUP("tls13", test_tls13_apis), \
@@ -39,6 +40,7 @@ int test_tls13_same_ch(void);
3940
TEST_DECL_GROUP("tls13", test_tls13_rpk_handshake), \
4041
TEST_DECL_GROUP("tls13", test_tls13_pq_groups), \
4142
TEST_DECL_GROUP("tls13", test_tls13_early_data), \
42-
TEST_DECL_GROUP("tls13", test_tls13_same_ch)
43+
TEST_DECL_GROUP("tls13", test_tls13_same_ch), \
44+
TEST_DECL_GROUP("tls13", test_tls13_hrr_different_cs)
4345

4446
#endif /* WOLFCRYPT_TEST_TLS13_H */

‎wolfssl/internal.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5100,6 +5100,10 @@ struct Options {
51005100
byte processReply; /* nonblocking resume */
51015101
byte cipherSuite0; /* first byte, normally 0 */
51025102
byte cipherSuite; /* second byte, actual suite */
5103+
#ifdef WOLFSSL_TLS13
5104+
byte hrrCipherSuite0; /* first byte, normally 0 */
5105+
byte hrrCipherSuite; /* second byte, actual suite */
5106+
#endif
51035107
byte hashAlgo; /* selected hash algorithm */
51045108
byte sigAlgo; /* selected sig algorithm */
51055109
byte peerHashAlgo; /* peer's chosen hash algo */

0 commit comments

Comments
 (0)