From f1185392189641014dca94f3fe7834bccb5f4c16 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 2 Nov 2016 22:26:17 +0000 Subject: [PATCH] Fail if an unrecognised record type is received MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit TLS1.0 and TLS1.1 say you SHOULD ignore unrecognised record types, but TLS 1.2 says you MUST send an unexpected message alert. We swap to the TLS 1.2 behaviour for all protocol versions to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. Issue reported by 郭志攀 Reviewed-by: Tim Hudson --- ssl/s3_pkt.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 7e3a7b480e..cb74d467bb 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -1605,16 +1605,13 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek) switch (rr->type) { default: -#ifndef OPENSSL_NO_TLS /* - * TLS up to v1.1 just ignores unknown message types: TLS v1.2 give - * an unexpected message alert. + * TLS 1.0 and 1.1 say you SHOULD ignore unrecognised record types, but + * TLS 1.2 says you MUST send an unexpected message alert. We use the + * TLS 1.2 behaviour for all protocol versions to prevent issues where + * no progress is being made and the peer continually sends unrecognised + * record types, using up resources processing them. */ - if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION) { - rr->length = 0; - goto start; - } -#endif al = SSL_AD_UNEXPECTED_MESSAGE; SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD); goto f_err; -- 2.25.1