fix(tls13): Reject oversized Finished messages via exact length check - #6040
Open
alexw91 wants to merge 1 commit into
Open
fix(tls13): Reject oversized Finished messages via exact length check#6040alexw91 wants to merge 1 commit into
alexw91 wants to merge 1 commit into
Conversation
s2n_stuffer_data_available returns uint32_t but the result was stored in a uint8_t, silently truncating values above 255. A Finished message with hash_size + 256 trailing bytes wraps back to hash_size, bypassing the length validation and corrupting the handshake transcript hash. Move s2n_tls13_connection_keys initialization before the length check and replace the permissive "length != 0" guard with an exact equality check against keys.size (the expected HMAC output length per RFC 8446 §4.4.4). Apply the same fix to both client and server finished_recv. Add a regression test that writes hash_size + 256 bytes into the handshake stuffer and asserts the receive function rejects it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Reject TLS 1.3 Finished messages whose length does not exactly match the negotiated HMAC output size.
Why
s2n_stuffer_data_availablereturnsuint32_tbut the result was stored in auint8_t. A Finished message withhash_size + 256trailing bytes wraps back tohash_size, bypassing length validation. This silently corrupts the handshake transcript hash and breaks session resumption state.How
uint8_t lengthtouint32_t lengthin boths2n_tls13_client_finished_recvands2n_tls13_server_finished_recv.s2n_tls13_connection_keysinitialization before the length check sokeys.sizeis available.S2N_ERROR_IF(length == 0, ...)withPOSIX_ENSURE_EQ(length, keys.size), an exact match per RFC 8446 §4.4.4.Callouts
The existing "+1 byte" test already passed before this fix because 33 != 32 without truncation. The new test targets the specific wrap-around at +256 bytes that the
uint8_tallowed through.Testing
New unit test.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.