mirror of
https://github.com/openssl/openssl.git
synced 2026-10-29 08:56:08 +08:00
Mounir IDRASSI
3e4f7e7720
TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello or HelloRetryRequest. Add a validation pass for these messages so fully unknown extension types fail early with unsupported_extension. Keep the existing ignore behavior for other extension contexts and leave TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the TLS 1.3 ServerHello case. Correct the unknown-extension path in tls_collect_extensions(). Collection still runs before the new TLS 1.3 validation, and verify_extension() returns success with thisex == NULL for fully unknown extension types. The previous idx calculation used invalid pointer arithmetic on NULL in that path. Map unknown extensions explicitly outside the built-in extension range instead, preserving the existing ignore semantics while avoiding undefined behavior. Update the truncated HRR ECH corruption vector to keep testing malformed ECH length after the new unknown-extension validation. The old 0xdddd bytes were only padding to preserve the replacement length, but they now trigger the unknown-extension check before the ECH parser. Use a known HRR cookie extension as padding so the test still reaches the intended SSL_R_LENGTH_MISMATCH path. Reviewed-by: Andrew Dinh <andrewd@openssl.org> Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jul 23 15:55:09 2026 (Merged from https://github.com/openssl/openssl/pull/31086)