denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-peer: Ensure TLS 1.3 CertificateRequest structure is valid

Browse Source 
If nothing was read from the message, the previous code could result in
a crash depending on where `ext.ptr` pointed to, as determined by the
current stack contents.  Since TLS 1.3 is still disabled by default and
this is usually used for TLS-based EAP methods after validating the
IKEv2 server's certificate, the real world impact seems relatively low.

Fixes: 9ef46cfaf9 ("tls-peer: Mutual authentication support for TLS 1.3")
This commit is contained in:
Tobias Brunner
2026-04-02 08:14:29 +02:00
parent e454b4adb3
commit 236ef93c50
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_peer.c
+9 -4
View File
@@ -936,9 +936,14 @@ static status_t process_certreq(private_tls_peer_t *this, bio_reader_t *reader)
}
else
{
/* certificate request context as described in RFC 8446, section 4.3.2 */
reader->read_data8(reader, &context);
reader->read_data16(reader, &ext);
/* certificate request as described in RFC 8446, section 4.3.2 */
if (!reader->read_data8(reader, &context) ||
!reader->read_data16(reader, &ext))
{
DBG1(DBG_TLS, "received invalid CertificateRequest");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
return NEED_MORE;
}
extensions = bio_reader_create(ext);
while (extensions->remaining(extensions))
{
@@ -984,7 +989,7 @@ static status_t process_certreq(private_tls_peer_t *this, bio_reader_t *reader)
}
extension->destroy(extension);
}
extensions->destroy(extensions);
extensions->destroy(extensions);
}
this->certreq_received = TRUE;
this->state = STATE_CERTREQ_RECEIVED;