From bff18d9048c0f1988fc16d3154f7851c9abbcfc7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 16 Jun 2026 17:59:05 +0200 Subject: [PATCH] tls-protection: Reject unencrypted TLS 1.3 records We only allow unencrypted change_cipher_spec records (as before), which are handled by the upper layers accordingly. Without the check, we also accepted unprotected alerts and handshake records that could potentially cause state confusion. Fixes: 7a2b02667c30 ("libtls: Implement TLS 1.3 handshake on client-side") --- src/libtls/tls_protection.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/libtls/tls_protection.c b/src/libtls/tls_protection.c index 89c102167..fb25b0e89 100644 --- a/src/libtls/tls_protection.c +++ b/src/libtls/tls_protection.c @@ -74,6 +74,15 @@ METHOD(tls_protection_t, process, status_t, return NEED_MORE; } + if (this->version >= TLS_1_3 && this->aead_in && + type != TLS_APPLICATION_DATA && type != TLS_CHANGE_CIPHER_SPEC) + { + DBG1(DBG_TLS, "received unencrypted TLS 1.3 %N record", + tls_content_type_names, type); + this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE); + return NEED_MORE; + } + if (this->version < TLS_1_3 || type == TLS_APPLICATION_DATA) {