aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/src/tls_connection.erl
diff options
context:
space:
mode:
authorPéter Dimitrov <[email protected]>2018-07-13 14:33:29 +0200
committerPéter Dimitrov <[email protected]>2018-07-19 14:30:00 +0200
commit84a4a9b5b14b5b035e1b8e2699203015f4df16d4 (patch)
treea1329e7024aaad6ae7fb56b99c93317841f3f24e /lib/ssl/src/tls_connection.erl
parent8c6116c5432f3198e7f50de04b4f777cb23b80b4 (diff)
downloadotp-84a4a9b5b14b5b035e1b8e2699203015f4df16d4.tar.gz
otp-84a4a9b5b14b5b035e1b8e2699203015f4df16d4.tar.bz2
otp-84a4a9b5b14b5b035e1b8e2699203015f4df16d4.zip
ssl: Fix handling of TLS record versions
- Introduce new macro ALL_TLS_RECORD_VERSIONS to decouple ALL_AVAILABLE_VERSIONS from the list of valid TLS record versions. It consists of versions allowed in TLSCiphertext.version (TLS 1.2 and prior) and TLSCiphertext.legacy_record_version (TLS 1.3). - TLS 1.3 sets TLSCiphertext.legacy_record_version to 0x0303 for all records generated other than an initial ClientHello, where it MAY also be 0x0301. - TLSPlaintext.legacy_record_version is ignored. Change-Id: Iabb1a954ab21f8be012e6460ae99ab533e31e123
Diffstat (limited to 'lib/ssl/src/tls_connection.erl')
-rw-r--r--lib/ssl/src/tls_connection.erl14
1 files changed, 11 insertions, 3 deletions
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 1a0a9b9275..8320d3f7f3 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -679,8 +679,8 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, Tracker}, Us
next_tls_record(Data, StateName, #state{protocol_buffers =
#protocol_buffers{tls_record_buffer = Buf0,
tls_cipher_texts = CT0} = Buffers,
- ssl_options = SslOpts} = State0) ->
- case tls_record:get_tls_records(Data,
+ ssl_options = SslOpts} = State0) ->
+ case tls_record:get_tls_records(Data,
acceptable_record_versions(StateName, State0),
Buf0, SslOpts) of
{Records, Buf1} ->
@@ -693,10 +693,18 @@ next_tls_record(Data, StateName, #state{protocol_buffers =
end.
+%% TLS 1.3 Client/Server
+%% - Ignore TLSPlaintext.legacy_record_version
+%% - Verify that TLSCiphertext.legacy_record_version is set to 0x0303 for all records
+%% other than an initial ClientHello, where it MAY also be 0x0301.
acceptable_record_versions(hello, _) ->
- [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_AVAILABLE_VERSIONS];
+ [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_TLS_RECORD_VERSIONS];
+acceptable_record_versions(_, #state{negotiated_version = {Major, Minor}})
+ when Major > 3; Major =:= 3, Minor >= 4 ->
+ [{3, 3}];
acceptable_record_versions(_, #state{negotiated_version = Version}) ->
[Version].
+
handle_record_alert(Alert, _) ->
Alert.